OpenAI’s New Cyber Model Found Ways to Attack Nearly 1,000 Linux Flaws
OpenAI says its new GPT-6 Cyber model helped an automated system identify 1,724 security flaws in the Linux kernel and exploit 948 of them to gain administrator-level access during testing, including at least 10 previously unknown techniques. Axios reports: During testing, the system identified 1,724 security flaws and found ways to use 9 … ⌘ Read more

OpenSSH Flaw Lets Attackers Log Into Password-Disabled Linux Accounts
A newly disclosed OpenSSH flaw dubbed “*sshole” can allow attackers to log in to password-disabled accounts on certain musl-based Linux systems simply by submitting a password longer than 256 bytes. “Apparently certain varieties of musl Linux (Alpine, OpenWrt, Buildroot, Yocto, etc.) have had this OpenSSH vulnerability for about a decade … ⌘ Read more

Debian, Ubuntu and derivatives hit by APT flaw that could give attackers root access
Got root? Someone else might have on your system - if you’re running Debian, Ubuntu and derivatives you’ll want to get updating soon.

Image

Read the full article on [GamingOnLinux](https://www.gamingonlinux.com/2026/11/debian-ubuntu-and-derivatives-hit-by-apt-flaw-that-could-gi … ⌘ Read more

Debian’s APT Affected By Man-In-The-Middle Attack For Arbitrary Code Execution As Root
A new vulnerability was disclosed today affecting Debian’s APT package manager where a man-in-the-middle attacker could carry out arbitrary code execution as root… ⌘ Read more

Binance Says Hackers Used Fake Job Interviews, AI Tool to Steal $6.3 Billion In Crypto
Binance says hackers spent months infiltrating its systems through fake job interviews, a tampered developer tool and compromised internal AI tools before stealing $6.34 billion in crypto in the Oct. 29 attack. Co-CEO Richard Teng said Binance has replenished 98% of the affected assets, and that it is still … ⌘ Read more

Supermarket Freezers Across Europe Hit By Second Suspected Cyberattack
An anonymous reader quotes a report from The Guardian: Supermarket chains in Sweden, Belgium and Luxembourg have said the temperatures of their refrigerators and freezers in dozens of stores rose overnight, prompting fears of a cyber-attack similar to one that caused millions of euros of food losses in France. Sweden’s Coop chain told t … ⌘ Read more

Experts Expect ‘Security Reckoning’ As AI Tools Find And Exploit Software Bugs
The Washington Post reports:

Tens of thousands of South Koreans had their financial data exposed online in recent weeks after at least nine major banks there suffered cyberattacks that suggested a dark future for online security. One man, a 26-year-old living in southern China, was allegedly behind the attacks, according t … ⌘ Read more

Ukraine Is Wiping Out Data Centers Across the Border
Ukrainian drone strikes have damaged three major Yandex data centers as well as facilities serving Sberbank and VKontakte (the country’s equivalent to Facebook), disrupting cloud services, banking, e-commerce, ride-hailing and other digital services across Russia. The attacks may deal a longer-lasting blow to Russia’s AI ambitions: Yandex’s affected facilities housed it … ⌘ Read more

Zoe Kleinman: PHP Is the Cyber Equivalent of an Unexploded Bomb
BBC technology editor Zoe Kleinman likens the recently discovered PHP security vulnerabilities to an unexploded bomb, writing, “The PHP story feels like the cyber equivalent of an unexploded bomb – I have never seen such a dramatic, public and global response to a cyber event that hasn’t happened yet.” Although no successful attacks have been confi … ⌘ Read more

x86 Kernel Shadow Stacks Being Worked On For Linux As Powerful Control Flow Protection
Linux user-space for several years had shadow stack support for hardware-enforced control-flow enforcement in defending against return oriented programming (ROP) attacks. Intel Tigerlake and newer CPUs or AMD Zen 3 and newer have the necessary hardware shadow stacks support. Shadow stacks have been effective for helping user-space software fend ROP attacks while now there is new work toward bringing shadow stack support for k … ⌘ Read more

Startup Claims To Use AI-Created Viruses To Treat a Patient
An anonymous reader quotes a report from The New York Times: For the first time, scientists say they have used viruses designed by artificial intelligence to treat a human patient. Researchers announced on Tuesday that they had administered the virus, known as a phage, to a patient suffering from a deadly bacterial infection. Phages attack bacteria, and … ⌘ Read more

Florida DMV Hacked After Police Dept Insecurely Stored Login Info
Florida’s DMV says a September 4 breach exposed driver’s license and motor vehicle records after attackers obtained credentials that a local law-enforcement employee had “improperly stored on an electronic device.” The ShinyHunters group has been linked to the intrusion. Ars Technica reports: In a notice posted Friday, [Florida Department of Hi … ⌘ Read more

TAINT_FORCED_BIND Sent In For Linux 7.4 To Deal With Major Fuzzing Attack
Among the early pull requests sent out in advance of the Linux 7.4 kernel merge window opening were the driver core updates. Standing out here is the new TAINT_FORCED_BIND for dealing with the recent major fuzzing “attack” by AI agents/bots testing impractical driver/hardware combinations… ⌘ Read more

Scientists Discover Why Microplastics Trigger Inflammation
An anonymous reader quotes a report from Scientific American: Microplastics are a source of extreme concern for health: the presence of these tiny pieces of plastic has been linked to heart attacks, stroke, dementia and brain tumors. But what drives these associations is unclear. Now a study published in Nature offers a tantalizing clue: microplastics int … ⌘ Read more

Linux 7.4 To Enable Intel Instruction Timeout For Fending Off TDX VM DoS Attacks
Linux 7.4 is enabling support for a new Intel CPU feature for providing safety against possible denial of service attacks using Trust Domain Extensions “TDX” VMs. The new feature is Intel Instruction Timeout and previously in-development known as Notify VM Exit… ⌘ Read more

Russia Was Not Ready For the Data Center War It Started With Ukraine
An anonymous reader quotes a report from Ars Technica: When Russia began attacking Ukrainian data centers and telecommunication infrastructure, it apparently failed to prepare for possible retaliation. Now Russia’s digital services are facing widespread outages after Ukrainian drone strikes knocked out three of the largest data centers ow … ⌘ Read more

Ubuntu Confirms Thursday’s Distributed Denial of Service Attack Against Its Web Infrastructure
On Thursday those trying to access the Ubuntu website, ISO downloads, and similar Ubuntu resources on Thursday found the site “inoperable,” reports Phoronix, with the disruption confirmed as a distributed denial of service attack.

“Our team is working diligently to resolve the incident,” … ⌘ Read more

Ubuntu Currently Suffering From Sustained DDoS Attack
Those trying to access the Ubuntu website, ISO downloads, and similar Ubuntu resources today are finding the site inoperable amid what’s now confirmed as an ongoing distributed denial of service attack… ⌘ Read more

Hackers Stole Millions of US Military Personnel Records During Months-Long Data Breach
A months-long breach of the Defense Manpower Data Center exposed personal information belonging to roughly 2.8 million living current and former U.S. military personnel and staff, plus records for nearly 300,000 deceased people. Attackers reportedly exploited a file-sharing vulnerability between October … ⌘ Read more

Branch Target Reuse, BTR: New Spectre V2 Attack Targeting JIT Compilers
It’s been a while since any new Spectre vulnerabilities have come to light but that’s changing today. The embargo has now lifted on BTR, Branch Target Reuse as a new Spectre-V2 attack affecting just-in-time (JIT) compilers… ⌘ Read more

America Acknowledges for the First Time: It Has Deployed Weapons In Space
Tuesday U.S. Space Force chief Douglas Schiess said his branch of the U.S. military operates “on-orbit weapons,” reports Reuters, to defend “against space-enabled attacks.” He promised “disciplined and responsible choices” when scaling America’s orbital defense arsenal in the coming years.

NPR calls this week’s reveleations “rem … ⌘ Read more

Rust Issues Warning Over Key Developers Being Targeted For Compromise
The Rust security response working group and Crates.io team have issued a warning that a targeted attack is underway against key Rust programming language developers… ⌘ Read more

Malicious OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers in May
A swarm of OpenAI agents launched a “major malicious attack” against RubyGems last May, according to a new report. That coordinated attack hit Ruby’s package manager “with hundreds of junk gems, prompting the maintainers to suspend new user sign-ups for about four days,” writes The Hacker News, … ⌘ Read more

ABC Show Won’t Air Interview With Democrat Because of FCC Threats
An anonymous reader quotes a report from Ars Technica: ABC’s Jimmy Kimmel said he will be interviewing a Democratic candidate for Senate tonight, but the interview will be on YouTube only and not broadcast on TV because of threats made by the Federal Communications Commission. Kimmel has been a prime target in the Trump FCC’s attacks on ABC and i … ⌘ Read more

Microsoft Breaks Another Patch Tuesday Record
Microsoft’s September 2026 Patch Tuesday is its largest ever, fixing a record 966 vulnerabilities, including 105 rated critical and two zero-days already being exploited in attacks. BleepingComputer reports: This Patch Tuesday addresses 105 “Critical” vulnerabilities, 81 of which are remote code execution, 20 are elevation of privileges, 2 are information disclosure, and 1 security fea … ⌘ Read more

Bank of England Chief Warns New AI Models Threaten Global Financial Stability
Bank of England Governor Andrew Bailey is warning that advanced “frontier” AI models could materially increase cyber risk across the global financial system by making attacks faster, cheaper, and more scalable. In a letter to G20 finance officials, he said financial firms need stronger defenses and contingency plans for … ⌘ Read more

Xylitol Linked To Strokes and Heart Attacks, Study Finds
An anonymous reader quotes a report from The Guardian: A common sweetener used in products such as chewing gum, toothpaste, jam, yoghurts and ice-cream has been linked to an increased risk of strokes, heart attacks and death. Xylitol is a sugar alcohol present in some natural foods in very low amounts. It is also added – often in amounts 1,000 times higher – … ⌘ Read more

AI/LLM Usage Becoming A “Denial of Service Attack” On Open-Source Project Maintainers
The latest criticism of the increased burden placed on open-source software project maintainers caused by AI / LLM agents is around too many bug reports effectively causing a “denial of service” attack on project maintainers… ⌘ Read more

Iran-linked Cyberattackers Shut Down a UK Power Plant for Four Days
“Iran shut down a British power plant for four days in an unprecedented cyber attack,” reports the Telegraph.

More details from the BBC:

The government said that at no point was there a risk to the UK’s energy system, but the Department for Energy Security and Net Zero (DESNZ) has contacted power companies to advise them about the risk of … ⌘ Read more

Ukrainian Publishers Call For Support After Russian Attacks Destroy 10 Million Books
Russian attacks on Ukrainian publishing infrastructure in July and August destroyed roughly 10 million books, which equates to about 30% of Ukraine’s annual book output. The Ukrainian Book Institute is warning of a potential “collapse of the entire book ecosystem” and is calling for international financial a … ⌘ Read more

Vulnerability Giving Attackers Full Control of Macs Is Under Active Exploitation
joshuark shares a report from Ars Technica: Dutch officials have warned that a high-severity macOS vulnerability that allows attackers to execute malicious code is under active exploitation. “The NCSC has received a notification indicating that active abuse of this vulnerability has been observed on multiple syste … ⌘ Read more

China-Linked Hackers Used AI To Run First-Ever ‘Autonomous’ Cyberattack On Taiwan
Researchers at Israeli cybersecurity firm Dream say suspected China-linked hackers used an open-source AI-agent system to conduct what may be the first observed end-to-end autonomous cyberattack against a government. According to the Financial Times (paywalled), the attack compromised at least 85 accounts and resulte … ⌘ Read more

DEF CON Crowd Suspected In Fake-Hotspot Attack On Delta Flight
An anonymous reader quotes a report from Ars Technica: On Monday, passengers aboard Delta flight 591 going from Las Vegas to Atlanta allegedly spoofed the onboard Wi-Fi, raising the attention of federal law enforcement. The incident came one day after the DEF CON security conference concluded in Las Vegas, and was first described on social media acc … ⌘ Read more

England Set To Eliminate Hepatitis C
An anonymous reader quotes a report from the BBC: England is on track to become one of the first countries in the world to eliminate hepatitis C, a dangerous virus that attacks the liver, figures show. The target of treating 80% of all known cases has already been met, and deaths from the virus have fallen by 36% in the last decade, just short of what is needed by 2030. Taking antiviral tablets for … ⌘ Read more

Taiwan ‘Throttles’ Mobile Internet For First Time During Annual War Games
Taiwan deliberately throttled mobile internet across the Taichung area during its annual Han Kuang war games, “simulating communication disruption in the event of a Chinese attack or natural disaster,” reports Reuters. The drill accompanied air-raid exercises and military rehearsals aimed at defending strategically important areas … ⌘ Read more

AI Assistant Hacks Gym Website In First Known Australian Autonomous Cyber Attack
An anonymous reader quotes a report from ABC News & Headlines: Andrew asked his personal assistant to book him a spot in one of his gym’s coveted morning classes. It was a task he thought was well suited to this particular assistant because the booking form was online and because his assistant was not a person – it … ⌘ Read more

Anthropic’s AI Used Fake Identities, Malware In Rogue Attack On GitHub Project
An anonymous reader quotes a report from Ars Technica: Routine cybersecurity testing of frontier AI models sparked a series of unexpected security incidents – the most serious case arising when Anthropic’s Mythos 5 model attempted to insert malicious code into an open source software application and created fake identitie … ⌘ Read more

Recovery Seeds Reportedly Breached for Coldcard Hardware Bitcoin Wallets, $75M Taken
“A hardware wallet is supposed to be the safest place to keep Bitcoin,” writes The Street, since it never connects to the internet, its keys never leave the device, and “the whole point is that an attacker would need to physically hold it to steal anything.”

The problem is that anyone who can reproduce the rec … ⌘ Read more

Arch Linux AUR Under Another Wave Of Malicious Packages, Package Adoptions Halted
Last month the Arch Linux User Repository “AUR” saw more than 1,500 malicious packages amid a sophisticated malware attack and then also seeing an influx of spam and profanities amid this community/user-maintained repository for the popular Arch Linux distribution. Unfortunately, there is another round of AUR troubles… ⌘ Read more

A Fundamental Flaw Leaves LLMs Strikingly Vulnerable To Attack
joshuark quotes a report from MIT Technology Review: It is impossible to make large language models fully secure against hacks because of a fundamental flaw in how they work, a team of researchers argue in a paper presented at the International Conference on Machine Learning, a top AI conference, this month. The claim has huge implications for the safety … ⌘ Read more

OpenAI’s Rogue AI Agent Hacked More Than Just Hugging Face
An anonymous reader quotes a report from Wired: OpenAI said Tuesday that the rogue AI agent that breached Hugging Face’s platform also hacked multiple third-party accounts and services as part of the attack. It’s now clear that the unprecedented security incident, which arose during an internal test of OpenAI’s latest AI models, was more extensive than the comp … ⌘ Read more

More Than 30 Minnesota Water Systems Targeted In Cyberattack
jrnvk shares a report from KMSP: Minnesota IT Services reports that a “coordinated cyberattack” targeted technology at more than 30 community water systems between Sunday, July 26 and Monday, July 27. The state has activated its cybersecurity incident response capabilities to respond to the attacks.

On Monday and Tuesday, FOX 9 reported on notices from fou … ⌘ Read more

AI-Found Bugs Aren’t Proving Any Easier to Exploit Despite the Hype
AI-assisted vulnerability discovery has yet to produce the expected surge in real-world attacks: VulnCheck found that only 14 of 1,061 attributed discoveries, or 1.3 percent, had been exploited, which is “almost identical to the rate across all vulnerabilities in VulnCheck’s dataset,” reports The Register. “That’s a far cry from the narrative t … ⌘ Read more

Anthropic AI Model Finds Flaws in Tough-to-Crack Encryption Algorithms
Anthropic’s Claude Mythos Preview has “found flaws in a weakened version of a digital encryption standard that is in pervasive use throughout the internet,” reports The New York Times. Researchers said the model discovered novel attacks against weakened versions of AES and the experimental post-quantum HAWK system, including one that wa … ⌘ Read more

For game 2, everyone else brought out bigger guns - tribal dragons, tribal giants, tribal spiders (led by the completely broken Cosmic Spider-Man), and Atraxa (equipped with Captain America’s shield, no less), while I ran my new (also unlisted) 5-color tribal Super Villains deck (fronted by the Super Skrull). Although I got off to a slow start, it kept me mostly under the radar, allowing me to ultimately win with the Villains by goading everyone else’s creatures into attacking each other on one turn (via Maximum Carnage), and then killing off the remaining players over 3 combat phases on the follow-up turn (Full Throttle).

Boo-yah!

Decades-Old Bash Tricks Expose AI Coding Agents To Supply Chain Attacks
Slashdot reader wiredmikey writes: AI security researchers have uncovered a structural security flaw dubbed GuardFall that allows decades-old Bash shell tricks to bypass safeguards in most open source AI coding agents. By exploiting shell behaviors such as quote removal and variable expansion, attackers can hide malicious commands … ⌘ Read more

Linux 7.2-rc2 BPF Code Being Hardened Against JIT Spraying Attacks
Some post-merge-window code changes merged overnight ahead of Linux 7.2-rc2 this weekend is hardening the kernel’s BPF code against JIT spraying attacks… ⌘ Read more

How a Seemingly Harmless Image Can Jailbreak Vision-Language AI Models
Slashdot reader BrianFagioli writes: Florida International University researchers have developed a technique called JaiLIP (Jailbreaking with Loss-guided Image Perturbation) that uses subtle image modifications to bypass AI safety guardrails. Unlike traditional jailbreaks that rely on carefully crafted prompts, the attack works through ima … ⌘ Read more

Anthropic Says Alibaba Must Be Punished For Largest Claude Cloning Attack
An anonymous reader quotes a report from Ars Technica: Anthropic has accused the Chinese firm Alibaba of launching the largest attack yet attempting to clone Claude, as China races to match the capabilities of Anthropic’s leading model following Mythos’ release and subsequent restriction from foreign markets. Ars obtained a June … ⌘ Read more

@movq@www.uninformativ.de But foxes always run away and don’t attack. They’re afraid of us humans – unless they have rabies.