Top stories
TypeScript Compiler, Checker, and LSP Ported to Rust Using LLMs
A new project, tsc-rs, has successfully ported the TypeScript compiler, checker, and language server protocol (LSP) to Rust. This port was achieved using large language models (LLMs), specifically Claude Opus 5.5, and aims to provide a faster TypeScript type checker with high performance, including in WebAssembly environments.
Capcom confirms data breach affecting 11.7 million CAPCOM ID accounts
Capcom announced a data breach of its CAPCOM ID membership service, exposing email addresses and associated information for over 11.7 million accounts. This incident follows a 2020 ransomware attack and highlights ongoing security challenges for the gaming company.
FCC Blocks Gadgets Containing Huawei-Made "Surveillance Chips"
The FCC has begun blocking electronic gadgets that contain chips from companies on its national security threat list, specifically targeting the HiVision Hi3516CV610 UHD Smart Vision SoC, a chip designed for surveillance applications and made by a Huawei subsidiary. This action marks the first use of a new power granted to the FCC in October to prevent the use of components from banned entities in consumer devices.
AWS Lambda introduces Web Functions for standard HTTP web applications
AWS Lambda launched Web Functions, a new form factor enabling direct deployment of standard HTTP web applications without code rewriting. This allows developers to run port-listening servers from frameworks like Express or Next.js on Lambda, simplifying deployment and scaling for web applications and API backends.
DeepSeek Releases V4.1 Flash 1017 Model with New CED Architecture and Asymmetric Parameter Activation
DeepSeek released V4.1 Flash 1017, a new sparse mixture-of-experts model built on its Causal Encoder-Decoder (CED) architecture. This model activates 8B parameters on input and 16B on output from a 552B-parameter backbone, and includes native image understanding, aiming for cost-efficient performance in agentic workloads.
AWS Introduces TorchNeuron for Direct PyTorch Execution on Trainium AI Chips
Amazon Web Services (AWS) has launched TorchNeuron, a new PyTorch plugin that enables direct execution of AI applications on AWS Trainium AI chips. This integration allows developers to run PyTorch models on Trainium with minimal configuration changes, supporting eager mode, `torch.compile`, and native distributed APIs, and expanding out-of-the-box support for Hugging Face text generation models.
1Password Launches "1Password for Agents" to Securely Manage AI Agent Logins
1Password introduced "1Password for Agents," a new platform that allows AI agents to sign into websites using user credentials without directly accessing or seeing the passwords. This system requires user approval for each sign-in request, with 1Password handling the login process and removing credentials after use, aiming to enhance security for AI-driven tasks.
Over 300 Tor exit nodes compromised to intercept SSH and unencrypted mail traffic
On October 2, 333 Tor exit nodes, representing 10% of the network, began intercepting SSH connections and unencrypted email traffic. The attackers had deployed the Ebury 1.8.3 payload two months prior to steal credentials and monitor SSH sessions. The Tor Project's network health team was notified and began contacting affected relay operators to remove the compromised nodes.
Google BigQuery Introduces TimesFM 3.0 for Multivariate Time-Series Forecasting
Google has launched TimesFM 3.0 in preview for BigQuery, enabling native multivariate time-series forecasting directly within SQL. This update allows users to predict future values based on multiple related time series and external factors, addressing a limitation of previous univariate-only models.
New York Lawsuit Alleges TikTok Provided Placebo Safety Feature to Teens and Children
New York's lawsuit against TikTok claims the platform gave thousands of teen and child users a non-functional "Algo Refresh" safety feature during an experiment. This action is part of broader allegations that TikTok designs its platform for addictive use and misleads users about safety.
OVHcloud CLI Releases Hijacked to Distribute Secret-Stealing Malware
An attacker compromised a contributor's GitHub account to replace download archives for five OVHcloud CLI releases with secret-stealing malware. The malicious files were live for up to 94 minutes, affecting users who installed or updated the CLI on specific platforms during that period. OVHcloud has since removed the compromised archives and issued a clean, immutable release.
Ukraine Claims First Drone Evacuation of Wounded Soldier from Front Lines
Ukraine's 92nd Separate Assault Brigade reported the first drone evacuation of an injured soldier from the front lines. A heavy-lift hexacopter, identified as a Gurzuf Defense model capable of carrying 130kg, was used to extract an infantryman named 'Kostya' from a heavily mined area with intense enemy drone activity where conventional evacuation was impossible. This event demonstrates a new application of drone technology for personnel recovery in hazardous combat zones.
AOMEI Backupper Update Servers Briefly Compromised to Deliver Backdoor
Attackers tampered with AOMEI Backupper's update servers for short periods between May and July 2026, causing the Windows backup software to download and execute a backdoor. The compromise allowed the installation of malicious software on systems that checked for updates during these brief windows, affecting users without requiring any specific action beyond having the program installed.
Ahold Delhaize takes systems offline after cyberattack
Retail giant Ahold Delhaize confirmed it took some systems offline following a cybersecurity incident. The incident has impacted employee access to schedules and pay stubs, and customer access to websites and apps in some regions, affecting operations for a major global retailer.
Elon Musk Pledges to Distribute SpaceX Shares to Every Child in the U.S.
Elon Musk announced plans to give one SpaceX share to every child in the U.S., with distribution starting in 2025 or 2027. This initiative, potentially valued at over $10 billion, follows Anthropic's commitment to a public benefit fund and Musk's suggestion for direct public distribution. The shares are expected to be distributed via Trump Accounts.
International timekeepers replace leap second with leap hour to reduce system risks
Delegates from 69 countries voted to replace the leap second with a leap hour, effective next year. This change aims to mitigate risks to computer systems and national infrastructure caused by the current 61-second or 59-second minutes.
Tech and Telecom Companies Donated Over $330 Million to Trump's White House Ballroom Project
A Washington Post investigation revealed that tech, telecom, and crypto industries contributed over $330 million to President Trump's White House ballroom project. Apple, Nvidia, and Charles Ergen (Dish Network co-founder) each pledged $25 million, making them among the largest donors. Other contributors included Amazon, Palantir, ServiceNow, Meta Platforms, Microsoft, and Cisco, with some donations made through a nonprofit trust.
UK Legal Aid Agency Data Breach Exposed Records Dating Back to 1978
The UK Legal Aid Agency (LAA) confirmed that a data breach in April 2025 resulted in the theft of records dating back to 1978, affecting sensitive applicant, recipient, and provider data. This expands the scope of the breach beyond initial estimates, revealing a longer history of compromised information.
Hirudo Android Trojan Replaces Banking Apps to Bypass Security Checks
A new Android banking trojan named Hirudo replaces legitimate banking applications with patched versions to bypass built-in security checks. This malware combines credential theft, device takeover, screen capture, and SMS theft, targeting users in Indonesia, China, India, Mexico, Morocco, and Thailand. Hirudo is delivered via dropper apps that present the trojan as an in-app update, escalating financial fraud risks.
IMF Chief Georgieva: AI is a key economic driver but also a growth threat
IMF Managing Director Kristalina Georgieva stated that AI is rapidly becoming a key driver of global economies, with potential to add half a percentage point to annual world growth. However, she warned that AI advancement, soaring energy costs, and record public debt are challenging global growth and increasing economic inequality.
Norway Fines Microsoft Subsidiary Xandr $9.6 Million for Grindr Data Misuse
Norway's Data Protection Authority (NDPA) has fined Xandr, a Microsoft subsidiary, 92 million Norwegian kroner (approximately $9.6 million) for allegedly misusing sensitive user data from the Grindr dating app. The NDPA stated that Xandr did not obtain explicit consent to use Grindr user data for advertising purposes, instead assuming Grindr had secured approval. This fine, the largest ever issued by the Norwegian authority, stems from a 2020 complaint regarding the sharing of user data, including sexual orientation, with thousands of advertisers through real-time ad auctions.
Low-cost Android phones ship with 'Midnight Mimosa' residential proxy malware
A malware campaign named 'Midnight Mimosa' has been discovered on low-cost Android smartphones, embedding malicious software in their firmware to install apps, perform ad fraud, and turn devices into residential proxies. The malware, present on devices from manufacturers like Doogee and Cubot, affected thousands of devices across over 150 countries by exploiting system-level privileges.
Leader of "Your Mule Cashout" Pleads Guilty to Laundering Millions for Cybercriminals
Oleg Korniev, a Ukrainian-Russian dual citizen, pleaded guilty to charges related to leading the "Your Mule Cashout" (YMCO) money laundering operation. YMCO used over 15,000 money mules in the U.S. and other countries to launder at least $10 million stolen from U.S. bank accounts, resulting in over $14.7 million in losses. Korniev managed YMCO's operations, which ran from 2007 to 2014.
GitLab Duo Self-Hosted Integrates Microsoft Foundry for AI Model Deployment
GitLab Duo Self-Hosted now supports AI models deployed through Microsoft Foundry, allowing organizations to run GitLab's AI development features using models hosted within their own Azure environment. This integration provides enterprises with more control over model providers, deployment locations, and data paths, addressing data residency and regulatory requirements.
NYC Implements Click-to-Cancel Rule for Subscriptions, First in the US
New York City has enacted a "click-to-cancel" rule requiring businesses to make subscription cancellation as easy as signing up, allowing residents to submit complaints to the city government. This initiative is projected to save New Yorkers between $21.5 million and $162.5 million annually, setting a precedent for local governments to regulate consumer protections.
PoeLLM Malware Infects Over 3,400 Servers, Expanding Crypto Mining Botnet
A new malware family, PoeLLM, has infected over 3,400 servers since April 2026, targeting AI and LLM infrastructure to deploy cryptocurrency miners. The campaign, dubbed Canto Incognito, reuses compromised hosts to scan for and infect additional vulnerable systems, expanding its botnet.
McDonald's uses AI for dynamic pricing, varying burger costs by location
McDonald's is reportedly using AI to dynamically price menu items, adjusting costs based on estimated customer willingness to pay at each location. This system can lead to significant price differences for the same item between nearby stores, and franchisees report pressure to adopt the AI's recommendations.
South Korea Investigates Bank Breaches, Suspects AI-Powered Attacks
South Korea's Financial Services Commission is investigating cyberattacks on Shinhan Bank and Kookmin Bank, which resulted in data breaches affecting thousands of customers. Authorities suspect the use of AI-powered attack automation tools, prompting instructions for financial institutions to enhance security measures.
Ukrainian report details Russian mobile attacks, including iPhone exploit kit DarkSword
Ukrainian researchers reported increased targeting of military and government smartphones by Russian hackers using malicious apps and sophisticated exploits for both Android and iOS devices. The report highlights the use of DarkSword, an iPhone exploit kit, in watering-hole attacks to steal sensitive information.
Microsoft 365 Family and Premium plans to reduce shared OneDrive storage
Microsoft is changing its Microsoft 365 Personal, Family, Premium, and Pro subscriptions, reducing shared OneDrive storage for Family and Premium plans from 6TB to 2TB. This change, rolling out in the coming months, means subscribers using more than 2TB will need to reduce usage or pay for additional storage.
Pwn2Own Ireland Day 1: Researchers Exploit 32 Zero-Days, Earning $388,500
Security researchers exploited 32 zero-day vulnerabilities on the first day of Pwn2Own Ireland 2026, earning $388,500. Exploits included the Samsung Galaxy S26, printers, smart home devices, and OpenAI Codex, highlighting ongoing efforts to identify and patch critical flaws in various technologies.
US Offers $10 Million Reward for Accused Chinese 'Hafnium' Hacker Zhang Yu
The US State Department is offering a $10 million reward for information leading to the arrest of Zhang Yu, a Chinese national accused of involvement in the Hafnium hacking campaign. Zhang allegedly worked for the Chinese government to breach thousands of computers, steal data, and target COVID-19 research.
FBI Warns FortiBleed Campaign Continues to Target Fortinet Devices, Amassing Credentials
The FBI and USSS have issued a warning that the FortiBleed campaign remains active, targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. This campaign exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication data at scale. As of June 19, 2026, over 86,644 device credentials across 194 countries have been compromised, with some incidents linked to ransomware groups like INC/Lynx and Payload ransomware.
Ofcom investigates Pornhub owner Aylo over age verification effectiveness
Ofcom has launched an investigation into Aylo, owner of Pornhub, to determine if its new age verification system effectively prevents minors from accessing adult content. The regulator is concerned Aylo may not have conducted sufficient due diligence before implementing the third-party age checks, which could leave children at risk under the UK's Online Safety Act.
US sanctions 10 individuals for ATM malware scheme linked to Tren de Aragua
The U.S. Treasury Department sanctioned 10 individuals and several companies for their involvement in an ATM malware scheme that caused $40.7 million in losses across 1,500 attacks. This scheme is identified as a key revenue source for the Venezuelan criminal group Tren de Aragua, with proceeds laundered through cryptocurrency and companies in Mexico.
Googlebooks with Intel Processors May Experience Performance Issues with Some Android Apps
Google has acknowledged that a "small handful of complex apps or games" may not run optimally on Googlebooks equipped with Intel x86 processors. This is due to many Android applications being originally designed for ARM architecture, requiring developer tuning for better performance on Intel-based devices. The issue affects initial Googlebook models like the Asus Googlebook 14, Lenovo Googlebook 15, and Acer Googlebook 14, while models with Qualcomm Snapdragon X Elite chips are not cited with this issue.
Meta's Muse AI exposed internal filesystem and SSH keys via data export feature
A user exploited Meta's Muse AI by requesting an archive of its visible files, resulting in a 6.8 GB download containing the AI's Linux root filesystem, internal documentation, integration code, and SSH keys. This vulnerability allowed internal runtime files and sensitive material to be exported through an ordinary conversation and connected export destination.
Iranian National Accused of Hacking US Universities Extradited from Montenegro
Amir Barati, an Iranian national accused of participating in a large-scale hacking operation targeting universities and companies, has been extradited from Montenegro to the U.S. Barati is charged with computer intrusion, wire fraud, and identity theft related to the alleged theft of 31 terabytes of academic data and intellectual property.
Meta Open-Sources Muse AI Agent Code for Custom Hardware Development
Meta has open-sourced the code for its Muse AI agent, providing SDKs and firmware under the Apache 2.0 license. This allows users to integrate Muse with custom hardware projects using ESP32 boards or Raspberry Pi, enabling the creation of personalized AI gadgets and expanding Muse's application beyond Meta's devices.
Lyft to Pay $272.5 Million to Settle California Driver Misclassification Lawsuit
Lyft has agreed to a $272.5 million settlement in a lawsuit alleging it misclassified drivers as independent contractors in California. This settlement resolves claims from April 2016 to December 2020, a period before Proposition 22 reclassified app-based drivers as contractors, and allows Lyft to avoid further litigation.