Dev
CISA to End Weekly Vulnerability Bulletin on September 28
CISA to end weekly vulnerability bulletin on Sept. 28, shifting from severity-based management to risk-based prioritization.
Tags: security
Dev
Fishing App Fishbrain Breach: Hashes Exposed
Fishing app Fishbrain suffered a data breach. Hashes and salts leaked along with names and contact details. All users must reset passwords.
Dev
Google Announces HEIR, Compiler for Encrypted AI Model Computation
Google releases the open-source compiler HEIR, enabling AI inference on encrypted data without decryption using fully homomorphic encryption, aiming for a new foundation for privacy-preserving AI services.
Dev
LiteLLM Attack Leaks Credentials from More Than 2,500 Organizations
A supply-chain attack on AI development tool LiteLLM has leaked credentials from major organizations, affecting over 2,500 organizations.
Dev
UK Ministry of Defence Data Breach Caused by Lack of Excel Training
A UK parliamentary committee report found that the breach of 18,700 Afghans' data by the Ministry of Defence was caused by inadequate basic Excel training. The report also questions the use of superinjunctions and secret evacuation programs.
Dev
Amnezia VPN Gains Attention with Self-Hosted Client Model
Amnezia is an open-source VPN client that enables users to automatically deploy VPN servers on their own infrastructure, offering a broad range of protocols including OpenVPN, WireGuard, IKEv2, and traffic masking for enhanced censorship circumvention.
Dev
Book Release of the XZ Backdoor Incident: 'Half a Second' Available for Free
A Microsoft engineer's discovery of a backdoor in XZ Utils, prompted by a 0.5-second login lag, is now documented in a free book under CC BY-NC-ND 4.0.
Gadgets
ESP32 Blocks 537,000 Domains for Ad Blocking, a Clever $5 Implementation
An Egyptian developer uses an ESP32-C3 microcontroller to build a DNS filter capable of blocking 537,000 domains. Leveraging 40-bit FNV-1a hashing, it fits within 4MB of flash memory.
Dev
HiveLegacy Released: Windows Privilege Escalation Zero-Day Unveiled on Record Patch Day
On the same day Microsoft released a record-breaking number of patches, an anonymous researcher unveiled exploit code for a zero-day vulnerability, HiveLegacy, allowing low-privilege users to manipulate admin account registries.
AI
xAI Files First Lawsuit Against Man for Generating CSAM Using Grok
xAI has filed a lawsuit against a man for generating and distributing CSAM using Grok. The focus is on safeguard circumvention and legal accountability of AI platforms.
Dev
Debian 13.6 Released, GeoIP Database Rolled Back to 2019 Version
Debian 13.6 point release is now available, featuring numerous security updates for Linux kernel, Nginx, and more. GeoIP database rolled back due to non-compliance with DFSG, and fwupd 2.0.20 addresses expired UEFI Secure Boot CA.
Dev
Emergence of "HalluSquatting" Attacks Exploiting AI Hallucinations
Researchers at Tel Aviv University have unveiled the "HalluSquatting" attack, a method exploiting AI hallucinations to execute malicious code, exposing vulnerabilities in all LLMs.
Dev
Linux 7.2-rc2 Strengthens Protections Against BPF JIT Spraying Attacks
Patches have been merged into Linux 7.2-rc2 to implement indirect branch predictor and IBPB flushes in BPF JIT allocator memory reuse, significantly reducing the risk of JIT spraying attacks.
Internet Voices
Bitdefender VPN Review: Affordable Pricing and Ease of Use
A review of Bitdefender VPN. Its $35 first-year price and simplicity stand out, but it lacks advanced privacy features. Wired's rating: 7/10.
Gadgets
AMD to Reinstate TSME Memory Encryption on Ryzen 9000 CPUs
AMD will restore TSME memory encryption for non-PRO Ryzen 9000 CPUs in July through a BIOS update, following community feedback.
Dev
Oracle PeopleSoft Zero-Day Compromises Over 100 Organizations
Hacker group ShinyHunters exploited Oracle PeopleSoft zero-day CVE-2026-35273, breaching over 100 organizations, including the University of Nottingham, where 40 GB of data was stolen. Google threat intel confirms.
Dev
French Government Tchap Breach Under ANSSI Investigation; Only Public Chats Affected?
Account hijacking occurred on French government encrypted messaging service Tchap. ANSSI has launched an investigation, and authorities claim only public chats were compromised, but hackers claim access to over 70,000 user records.