Torvalds says the patchpocalypse may have peaked. Don’t hold your breath.
Since Anthropic launched its Mythos bug-finding model in April, developers have been uncovering software flaws faster than anyone has been able to fix them....
Is Iran hacking freezers on U.S. military bases?
U.S. officials suspect Iran-linked hackers are behind a string of cyberattacks that have made freezers malfunction at around six military commissaries, the...
Brotli’s “harmless” bug just became an RCE affecting half the internet
A flaw disclosed in Node.js last week (“Node2Shell”) has turned out to hit far more than Node. CVE-2026-111497 is a critical bug (CVSS 9.2) in Google’s...
Anthropic wrote its own AI safety bill, and quietly sent it to Congress
Anthropic has been quietly pitching lawmakers on a draft bill to regulate frontier AI safety, according to Politico, which obtained the confidential text....
Anthropic’s AI filed a fake murder tip with Philadelphia police
During a routine test that sent an AI model browsing random public websites, Anthropic’s Claude landed on Philadelphia’s unsolved homicides tip portal and...
The CAPTCHA that asks you to hack yourself
This Thursday, I’m speaking alongside Sysdig’s Senior Threat Detection Engineer Alessandro Lo Prete at SecTor in Toronto. If you’re attending the conference,...
How a teenage hacker became “admin” at Microsoft
I’m going to be speaking alongside Sysdig’s Senior Threat Detection Engineer Alessandro Lo Prete at Sector in Toronto on 8 October. If you’re going to be at...
Hackers just hacked the hackers: ShinyHunters defaces clop's leak site
In an unusual case of criminals turning on criminals, the extortion group ShinyHunters has defaced the dark web leak site run by the Clop ransomware gang....
Fake misconduct complaints are the new phishing lure targeting universities
Picture getting an email that looks like it's from your university president, accusing you of a Title IX violation. That's exactly the trap researchers at...
The cleanup code is the attack surface
This week, a story about the part of your endpoint agent that exists to clean up after an attacker, and what happens when the attacker chooses the file it...
The malware comment that makes AI refuse to keep reading
This week, a story about attackers who stopped trying to fool the AI and started trying to make it walk away. ESET Research found a line sitting in a comment...
ShinyHunters phished the security firm that researches ShinyHunters
This week, a story about what actually stops an attack after the phishing has already worked. On August 17, ReliaQuest’s threat research account posted about...
Washington is hiring pirates to fight cybercrime
This week delivered a striking split-screen on how governments are choosing to fight cybercrime. In the United States, President Trump signed a memorandum on...
A war 6,000 miles away just reached a small-town water tower
This week: a distant war arrived in small-town America through the pipes. Iran-linked hackers broke into internet-connected water systems in at least a dozen...
Anthropic's Claude went rogue, and a swarm platform left the door wide open
We’re at Black Hat this week Bagheera Labs founder and CEO, Sherwyn Moodley, is speaking at Black Hat this week with a talk entitled, “Closed Loop: From...
An Al model hacked a real company to cheat on its own exam
This week, two stories that reframe how close Al-enabled cyberattacks already are. OpenAl disclosed that during an internal capability evaluation run with...
One in three websites just got a skeleton key
Searchlight Cyber disclosed a pre-authentication remote code execution flaw in WordPress Core itself. Not a plugin, not a theme, but the platform that runs...
Your ransomware negotiator might be working for the attackers
This week: a cautionary tale about who you trust during a breach. A former ransomware negotiator, Angelo Martino, was sentenced to 70 months in federal...
Smugness won’t protect Mac Users from this new threat
In this week’s cybersecurity roundup, we break down a stark reminder that macOS users are no longer safe under the radar of modern cybercriminals. A...
Mythos is driving a new cybersecurity arms race
Chinese cybersecurity firm Qihoo 360 has escalated the global AI arms race by claiming to have developed an automated bug-finder that outperforms Anthropic's...