Jensen's purchase of a new toy could reshape the entire AI industry
This week on The Kettle we weigh in on Nvidia's Hugging Face acquisition and why it could spell a new, more fragmented and siloed era of AI development
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Might as well blame AI for this giant Linux release candidate, says Linus Torvalds
Last week, he blamed himself for being ‘a grade A nincompoop’ who assumed a system upgrade couldn’t possibly go wrong
Show HN: GET Together – A social network where you don't need POST to Post
Article URL: https://gettogether.dev Comments URL: https://news.ycombinator.com/item?id=49592840 Points: 107 # Comments: 59
ChatGPT Astra is now rolling out to $20 Plus subscription
OpenAI is now rolling out ChatGPT Astra, its most powerful model to date, to those with a $20 Plus subscription, but there's no word on when free users will get access.. [...]
Thailand pauses all datacenter builds and approvals
PLUS: Fujitsu not yet budgeting Horizon compensation; DeepSeek's vast Huawei GPU buy; Korea plans sovereign security model; and more
Attackers conceal phishing lures using invisible Unicode characters
Threat actors have adopted the ASCII smuggling technique in phishing campaigns, using invisible Unicode characters to evade email security filters. [...]
Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
Attackers are exploiting MikroTik routers with their Secure Shell (SSH) remote-access service, which is reachable from the internet, to gain full administrative control without aut…
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine aft…
Time lords prepare to kick leap seconds into the next millennium
Risk of an unprecedented negative adjustment prompts plan to let UTC drift by as much as an hour
US troops can still be tracked by purchased location data, and Congress wants to know why
DoD controls on mobile ad identifiers haven't stopped military location data turning up for sale
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, D…
Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed c…
Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
Broadcom has released security updates for two security flaws impacting VMware Workstation and Fusion, including one critical bug that could result in arbitrary code execution unde…
Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain
A massive cybercriminal operation is leveraging thousands of compromised small-business websites to deliver ClickFix payloads stored in smart contracts on the BNB Smart Chain (BSC)…
Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted
Hardware wallet manufacturer Trezor on Friday disclosed that another 67,000 customers from the U.S. have been impacted in a breach at its shipping provider ShipMonk. The exposed i…
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions. The post Elementor Pro WordPress P…
HPE Patches Critical RCE Vulnerabilities in AOS-CX
An unauthenticated attacker could exploit the security defects by sending crafted packets to the vulnerable service, achieving RCE with elevated privileges The post HPE Patches Cri…
OpenAI admits it didn't disclose rogue AI wiki hijacking incident
OpenAI admits it did not disclose an incident where autonomous AI agents hijacked a German wiki, created 18,000 posts, shared answers, and bypassed restrictions, saying it treated …
Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel
A group of AI safety researchers says a fleet of autonomous agents that identified themselves as OpenAI systems left about 18,000 posts on a dormant 25-year-old German wiki between…
Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
Threat actors are exploiting the newly disclosed PaperCut flaws to facilitate credential theft in attacks targeting the education sector in the U.S. and Europe. The Arctic Wolf Ad…
BepiColombo sheds its ride and starts the final glide to Mercury
Eight years after launch, Mercury probe and its Mercury Transfer Module consciously uncouple as orbit approaches
Friday Squid Blogging: Squid on a Stick at the New York State Fair
Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
Anthropic lays groundwork for bots that shop for you
Now comes the harder sell: Convincing customers and merchants to trust AI with purchases
AMD's Threadripper Halo is a local-AI workstation for researchers with deep pockets
AI workstation promises to put up to 576 GB of HBM3e and 16 TB/s of memory bandwidth on your desk
ASCII smuggling isn't just an AI security risk
Phishers find a new use for invisible Unicode tag characters
Government Rails Site Hit Hours After CVE Patch
Article URL: https://rietta.com/blog/ruby-on-rails-cve-exploited-hours-after-patch/ Comments URL: https://news.ycombinator.com/item?id=49568828 Points: 117 # Comments: 38
TNO071: The Network Team Is Drowning. Is AI the Life Raft? (Sponsored)
Last year, 49,000 CVEs were published, more than 130 new vulnerabilities every day. So what actually happens with all of those CVEs in your network infrastructure? In this sponsore…
HN840: How to Make a Technology Buying Decision
When engineers look to buy new technology they tend to focus on features and functionality, but there’s more to it than that. Sian Morgan joins Drew and Ethan to discuss the best p…
IDScan sued over alleged data breach affecting 153 million drivers
Multiple lawsuits have been filed against identity verification company IDScan after hackers allegedly breached the service and offered to sell more than 153 million driver's licen…
Using a VM to Contain an AI Agent
It won’t work: My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable …