Top stories
GitHub Agentic Workflows Vulnerable to Prompt Injection, Exposing Private Repos
Noma Labs identified a prompt injection vulnerability, named GitLost, in GitHub's Agentic Workflows, enabling data leaks from private repositories. Attackers can manipulate AI agents to disclose private content through crafted public issues. This highlights security concerns in using AI-driven workflows in GitHub's system.
Supreme Court Upholds Texas App Store Age Verification Law
The US Supreme Court denied requests from trade groups, including Apple and Google, to block the enforcement of Texas's App Store Accountability Act, a law requiring age verification for app users. The law mandates that app stores verify users' ages and obtain parental consent for minors, amid constitutional debates. This development impacts how app companies handle user compliance in Texas.
Discord Bug Mistakenly Bans Over 8,000 Accounts for Harmless Images
Discord experienced a glitch in its AI moderation system that mistakenly banned over 8,000 users for posting harmless images since May 2026. The system inaccurately flagged grid-like images as harmful content, impacting accounts posting items like spreadsheets and game textures. Discord has resolved the issue and unbanned affected users.
FCC Proposed Rule Change May Obscure Broadband Costs
The FCC is set to vote on a proposed rule change that would let ISPs list all passthrough fees as a single 'up to' amount rather than itemizing them. This change could reduce transparency in broadband costs, affecting consumers' ability to understand the true cost of services. ISPs often use these passthrough fees to elevate monthly bills above advertised rates.
Medtronic Hack Exposes Data of Nearly 4 Million People in ShinyHunters Breach
Medtronic suffered a data breach in April 2026, compromising the personal and medical information of over 3.8 million individuals, with some sources claiming 9 million records affected. The ShinyHunters group accessed Medtronic's corporate IT systems, despite the company's reassurance about device safety. Medtronic is offering credit monitoring and support services to those impacted, highlighting security vulnerabilities in healthcare technology.
NASA Launches Swift Rescue Mission with Katalyst's LINK Satellite
NASA has launched the Swift Boost mission using the LINK satellite by Katalyst Space to rescue the Neil Gehrels Swift Observatory from orbital decay. LINK aims to elevate the observatory's orbit by 150 miles, extending its operational life. This joint effort highlights a rapid industry response to preserve crucial space science capabilities.
Meta Introduces $19.99 Subscription for Expanded Smart Glasses Feature Access
Meta has implemented a $19.99 subscription model for its AI glasses, particularly affecting the 'Conversation Focus' feature. Previously free, this feature will now be limited to three hours of monthly use without a subscription, while subscribers will get 15 hours. This move is part of Meta's broader strategy to monetize certain features across its platforms.
FortiBleed Campaign Compromises Fortinet Devices, Linked to Ransomware Groups
The FortiBleed campaign has been connected to the INC and Lynx ransomware groups, compromising credentials from Fortinet devices. Researchers found the operation entailed scanning 11,250 FortiGate portals and compromised 354 targets, leading to 12 ransomware deployments. The breach highlights significant cybersecurity risks, affecting organizations globally.
Anthropic Releases Economical AI Model Claude Sonnet 5 for Enhanced Agentic Tasks
Anthropic has unveiled Claude Sonnet 5, an advanced AI model designed for agentic capabilities, available on AWS. This model provides substantial improvements in planning, tool use, and coding over previous versions at a lower cost, aiming to compete with top-tier AI models.
Ubuntu LTS Kernels Remain Unpatched for Critical CVE-2026-98432 After Three Weeks
Ubuntu has not released patches for CVE-2026-98432, a critical vulnerability with a CVSS score of 9.8, affecting its 22.04, 24.04, and 26.04 LTS kernel releases. This leaves internet-facing and multi-tenant systems using these Ubuntu versions vulnerable to potential remote or local attacks.
Google Cloud's Lakehouse enables BigQuery to query Databricks Apache Iceberg tables directly
Google Cloud's borderless Lakehouse now allows BigQuery to directly query Databricks-managed Apache Iceberg tables without data duplication. This integration removes the need for complex data pipelines, reducing storage costs, latency, and fragmented security controls. It enables cross-cloud analytics by reading open-format files in Google Cloud Storage, Amazon S3, or Azure Blob Storage.
Silicon Valley AI Political Groups Clash Over Regulation in 2026 Midterm Elections
Silicon Valley political groups advocating for different approaches to AI regulation are spending millions in the 2026 midterm elections, creating internal conflict within the tech industry's political efforts. This division is evident in specific congressional races, where pro-development and pro-safety PACs are backing opposing candidates, potentially weakening the industry's overall influence on AI policy.
Shai-Hulud Worm Evolves to Automate Package Registry Compromises and Credential Theft
A series of self-propagating worms, starting with Shai-Hulud in September 2025, have demonstrated the ability to automatically publish malicious package versions to registries like npm, steal credentials, and bypass security measures. The latest variant, ChainDrop, compromised over 400 packages in hours by exploiting legitimate, cryptographically signed release pipelines, highlighting a critical vulnerability in software supply chain security.
AI Technology Reduces Vulnerability Exploitation Time, Increasing Security Concerns
The rapid increase in newly reported vulnerabilities, and the use of AI in exploit development, has significantly reduced the time it takes for cyber threats to be operationalised. This has created a larger 'exposure window' between vulnerability discovery and remediation, placing pressure on security teams. With CVEs published at an unprecedented rate, prompt response times are becoming crucial to mitigate potential breaches.
Azure API Connections Vulnerabilities Lead to Five Cross-Tenant Compromises
Multiple vulnerabilities in Azure API Connections, a component of Azure Logic Apps, allowed for five distinct cross-tenant compromises. These flaws enabled attackers to gain full access to connected backend services, including Azure Key Vaults and SQL databases, across different tenants.
Backdoor Found in Claude Code for VS Code Extension on Cursor Marketplace
Phorion detected a persistent SSH backdoor in versions 2.1.312 and 2.1.313 of the official Claude Code for VS Code extension distributed through the Cursor Marketplace. The backdoor affects macOS, Linux, and Windows, allowing unauthorized access to developer environments. Cursor has removed the compromised versions from its marketplace.
Intel's Disappointing Outlook Triggers $1 Trillion Semiconductor Market Cap Drop
Intel's shares plunged 30%, losing nearly $150 billion in market capitalization, after the company issued a disappointing financial outlook, primarily due to an anticipated 20% sales drop in its client computing group. This decline led to a broader selloff across the semiconductor industry, resulting in an estimated $1 trillion loss in market capitalization for the sector. The PHLX Semiconductor Sector Index (SOX) fell 9.14%, indicating widespread impact beyond Intel.
AI-enabled hacking raises alarm after critical PHP vulnerability discovery
Cybersecurity leaders warn of a "vulnerability tsunami" due to AI's ability to find and exploit security flaws at an unprecedented scale, following the discovery of a critical vulnerability in PHP. This development signals a new era where patching efforts may not keep pace with AI-driven exploitation, potentially impacting millions of websites.
Critical PHP Vulnerabilities Lead to Global Website Shutdowns and Urgent Patching
Two critical cybersecurity flaws in the PHP programming language, which powers 70% of the internet, were discovered and a fix was issued. Governments and organizations, including the Finnish government and parts of Wikipedia, took websites offline as a precautionary measure while applying the update. The vulnerabilities were found by AI tools from OpenAI's "Patch the Planet" program, highlighting the severity and the rapid response required.
Linux Kernel Flaw Vghost (CVE-2026-74580) Allows Local Root and VM Escape
A critical flaw, Vghost (CVE-2026-74580), in the Linux vhost subsystem allows local users to achieve root privileges and, in specific virtualization setups, enables virtual machines to escape to the host. The vulnerability affects nearly a decade of kernel versions and was discovered by Tencent Zhuque Lab, which released a fix and detailed write-up.
Paramount Acquires Warner Bros. Discovery for $111 Billion After Bidding War
Paramount, backed by David Ellison, acquired Warner Bros. Discovery (WBD) for $111 billion, outbidding Netflix. This acquisition includes WBD's studios, HBO, streaming platforms, games, and TV networks, marking a significant consolidation in the entertainment industry.
Biohub, DOE, NIH, and tech firms commit $1.8B to AI-ready biological data initiative
Biohub, the U.S. Department of Energy, the National Institutes of Health, Google DeepMind, Isomorphic Labs, and Meta are investing $1.8 billion to create an open resource of AI-ready biological data. This initiative aims to accelerate scientific discovery and disease treatment by enabling predictive AI models of biology.
Oracle Health Data Breach Affects Nearly 20 Million Individuals
A cyberattack on Oracle Health's legacy Cerner systems compromised the personal and medical information of nearly 20 million people. This figure, reported by Bloomberg citing the Texas attorney general, is significantly higher than previously disclosed counts, making it one of the largest healthcare data breaches on record.
New Algorithm Achieves Subquadratic 3SUM and Subcubic APSP Times, Refuting Hypotheses
Researchers have developed a new algorithm that solves the 3SUM problem in O(n^1.9992) time and the All-Pairs Shortest Paths (APSP) problem in O(n^2.9995) time. This marks the first polynomial improvement over textbook algorithms for these problems, refuting long-standing 3SUM and APSP hypotheses and offering speedups for related computational challenges.
Nobel Prize Awarded for Optogenetics, a Method to Control Neurons with Light
Karl Deisseroth, Peter Hegemann, and Georg Nagel received the Nobel Prize in Physiology or Medicine for developing optogenetics, a technique that uses light to control nerve cell behavior. This method allows scientists to activate and deactivate specific neurons in an intact brain, providing a more precise way to study brain function than previous methods.
Internet Watch Foundation Reports Significant Increase in AI-Generated Child Sexual Abuse Material
The Internet Watch Foundation (IWF) reported a 40% increase in AI-generated child sexual abuse material (CSAM) in the first half of 2026 compared to all of 2025, with 6,310 AI images assessed. This rise highlights the urgent need for new statutory regulation on AI to compel companies to build safer models and prevent the abuse of AI technology.
Epic pauses product development to address security flaws in MyChart software
Epic, developer of the MyChart software, has paused most product development for six weeks to fix security vulnerabilities. These flaws, discovered by Anthropic's Mythos AI, could allow unauthorized access to patient data without detection, impacting over 320 million patient records.
FBI Investigates Data Breach Exposing Medical Records of Thousands of Agents
Cyber-criminals breached FBI systems and stole sensitive medical and personal data belonging to thousands of special agents. The stolen information, including blood and urine test results and doctors' notes, could expose agents to blackmail, scams, and targeted attacks, and aid impersonation of law enforcement officers.
Pentagon: AI Overreliance Contributed to Missile Strike on Iran School
The Pentagon stated that an overreliance on artificial intelligence contributed to a missile strike on a school in Iran. This incident highlights the critical risks associated with autonomous systems in military operations and their potential for unintended civilian casualties.
OMB Director Russell Vought to gain veto power over all NIH grants via executive order
An executive order is being drafted to grant Russell Vought, Director of the Office of Management and Budget (OMB), veto power over every individual grant awarded by the National Institutes of Health (NIH). This move would centralize control over the NIH's $47 billion budget, potentially shifting funding decisions from scientific merit to political considerations.
OpenAI projects $278 billion cash burn by 2030 due to compute infrastructure costs
OpenAI anticipates a cumulative negative free cash flow of $278 billion between 2026 and 2030, driven by substantial investments in computing resources and infrastructure. This projection highlights the immense capital requirements for developing and deploying advanced AI models, impacting the company's financial strategy and future funding rounds.
Court Documents Reveal OpenAI and Microsoft Knew AI Training Would Harm the Web
Unsealed court documents from The New York Times' lawsuit against OpenAI and Microsoft indicate that both companies were aware their AI training practices could create a "doom loop" for the web and were described internally as the "largest theft of labor in human history." These documents suggest the companies anticipated the negative impact of AI on content creators and publishers, despite Microsoft's attempts to distance itself from some of the more critical internal comments.
Second Circuit Rules Border Agents Can Search Electronic Devices Without Suspicion
The U.S. Court of Appeals for the Second Circuit ruled that border agents can search travelers' electronic devices without requiring suspicion. This decision allows the government to use evidence from warrantless phone searches at the border, impacting privacy and First Amendment rights for individuals, including journalists.
New Android Exploitation Strategy Achieves Root on Samsung, Xiaomi, and Other OEM Devices
A new exploitation strategy allows an unprivileged Android app to gain root access on devices from Samsung, Xiaomi, Oppo, OnePlus, and Realme. The method targets Use-After-Free vulnerabilities in OEM-specific kernel drivers, often combined with OEM-specific sandbox escapes, to bypass security measures.
AT&T's Room 641A: NSA Interception Facility Revealed by Former Technician
Room 641A, an AT&T facility used by the U.S. National Security Agency for mass surveillance, was publicly revealed in 2006 by former AT&T technician Mark Klein. This facility, equipped with a Narus STA 6400, intercepts and analyzes internet communications, leading to a class-action lawsuit by the Electronic Frontier Foundation against AT&T for privacy violations.
Houthis Seize Control of Yemen's Red Sea Coast and Key Islands
The Iran-backed Houthi movement has reportedly taken control of Yemen's entire Red Sea coast and two islands in the Bab al-Mandab Strait, including Perim Island. This development significantly impacts global shipping routes through the Red Sea, a critical waterway for international trade.
Man Dies by Suicide After Extensive Interaction with ChatGPT; Former Partner Raises Alarm
A man died by suicide after months of confiding in ChatGPT, prompting his former partner to warn about the potential dangers of AI. This incident is part of a growing number of cases where individuals or their families allege that AI chatbots contributed to self-harm or other harmful actions.
DHS Border Patrol Uses Secretive 'Predictive Intelligence Targeting Teams' for Surveillance
404 Media revealed that Border Patrol operates "Predictive Intelligence Targeting Teams" (PITT) that analyze Americans' financial activity and other data to identify individuals for law enforcement stops without specific crime suspicion. This practice raises concerns about privacy, due process, and the potential for "parallel construction" to obscure the true reasons for stops.
220 Million Traveler Records Exposed in Vietnam-Linked APIS Leak
An Advance Passenger Information System (APIS) database, containing over 220 million passenger and crew records, was publicly accessible due to security misconfigurations. This exposure includes passport numbers and flight details for travelers to, from, or through Vietnam from 2017 to 2026, posing a significant privacy risk for a large number of individuals.
US Diesel Prices Reach Record High of $5.85 Per Gallon, Increasing Transportation Costs
US diesel prices have reached a new record high of $5.85 per gallon, driven by the six-month war with Iran disrupting global fuel flow. This increase directly translates to higher transportation costs for a wide range of goods, impacting businesses and consumers through rising prices for everyday items.