Security · Top stories
RSA-896 Factored with Claude AI
The RSA-896 challenge number was factored into its prime components (p and q) using the Claude AI. This demonstrates the capability of AI in cryptographic challenges, specifically in integer factorization.
Microsoft fixes Defender Antivirus false alerts after recent updates
Microsoft has resolved an issue causing incorrect "Defender Antivirus is turned off" alerts after installing recent updates, with the fix included in Microsoft Defender Antivirus update version 4.18.26080.4. This matters because the false alerts affected all supported Windows client and server versions, creating confusion about system security status.
Google Recognized as a Leader in External Threat Intelligence by Forrester Wave
Google has been named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 report. The company received the highest possible score across nine criteria, including Deep and Dark Web Monitoring and Intelligence Collection Sources, due to its threat intelligence expertise and AI capabilities.
International Meteor Organization Suffers Cyberattack, Causing Weeks of Downtime
The International Meteor Organization (IMO) experienced a cyberattack that severely damaged its aging infrastructure, leading to partial website downtime for several weeks. This incident disrupts the IMO's role in coordinating meteor observations and maintaining essential databases for the astronomical community.
Plaintiff in torrent tracker lawsuit dismisses claims after identity dispute
A plaintiff suing private torrent trackers for copyright infringement voluntarily dismissed his claims after being accused of impersonating the actual filmmaker. The plaintiff, who used the name Matthew Schneider, claimed to have coincidentally made films with the same titles as another filmmaker, leading to suspicions of a revenge plot by a banned user.
Adversarial Fashion Emerges to Evade AI Surveillance Cameras
Individuals are developing and using "adversarial fashion" to counter AI-powered surveillance cameras, which are increasingly prevalent globally. This trend includes clothing designed with patterns that disrupt object detection systems, reflecting growing privacy concerns regarding data collection and misuse.
Tesla's Assetnote Scanners Mistakenly Target NTP Pool Server
A volunteer NTP Pool server operator reported receiving approximately 8,000 exploit attempts from Tesla's Assetnote security scanners over two days. The issue stems from Tesla's pool-ntp.tesla.com CNAME record pointing to pool.ntp.org, causing Assetnote to incorrectly identify the NTP Pool server as a Tesla asset.
Mexican authorities seize cartel crypto farm with 300 GPUs in Puebla mountains
Mexican police, federal authorities, and the Navy seized a clandestine cryptocurrency mining farm in Tlaola, Puebla, containing 300 GPUs, electricity infrastructure, and satellite equipment. This discovery is the fourth such operation uncovered in the region since early last year, indicating Mexican cartels are increasingly using crypto mining for income diversification and money laundering.
Kiteworks Acquires Bonfy.AI to Enhance Data Governance for AI and Human Workflows
Kiteworks acquired Bonfy.AI, an AI data security company, to extend real-time policy enforcement over sensitive data exchanged by human users and AI agents. This acquisition aims to fill a gap in enterprise data protection by classifying data at the point of exchange and applying security policies before transfer, including interactions with AI assistants.
Activist Clifford Cawthon, Dressed as Doctor Doom, Protests Seattle's Surveillance Network
Clifford Cawthon, a policy advisor and activist, appeared at a Seattle Public Safety Committee meeting dressed as Marvel's Doctor Doom to protest the city's expanding surveillance camera network. Cawthon used the persona to highlight concerns about mass surveillance, privacy, and the potential misuse of data collected by systems like those from Axon and Flock. This action draws attention to ongoing debates about the balance between public safety and individual privacy in urban environments.
Channel 5 Shared Subscriber Email List with Hunter Biden for Memecoin Promotion
Channel 5, a YouTube channel, provided its email subscriber list to Hunter Biden, who used it to promote a new memecoin. This action has drawn criticism and is likely illegal under data protection regulations like GDPR.
Autistici/Inventati Collective Announces Shutdown Due to Security Risks to Users
The Autistici/Inventati (A/I) collective is shutting down its services, citing threats to its users and the inability to maintain its mission in the current political climate. The collective, which provided free, privacy-friendly infrastructure for 25 years, stated that continuing operations would endanger its community members.
Quad9 DNS Service Emphasizes Privacy and Security with Swiss Foundation Operations
Quad9, a free DNS recursive service, operates under a Swiss-based foundation to provide security against threats like malware and phishing while prioritizing user privacy by not logging IP addresses. This service offers an alternative to ISP DNS configurations, focusing on data protection and GDPR compliance.
Mullvad discontinues its public encrypted DNS service, sponsors Quad9 instead
Mullvad is shutting down its public encrypted DNS (DoH) servers, which have been operational since 2022, and will instead financially support Quad9. This change means Mullvad Browser users will be automatically migrated to Quad9's DNS, while manual configurations require user action.
KAIST Researchers Develop $7 AI-Powered Smartphone Clip-On for Hidden Camera Detection
Researchers from KAIST, NUS, and SMU have developed SweepLED, a $7 smartphone clip-on with an AI app that detects hidden cameras with 93.9% accuracy. This technology offers a more reliable and easier method for individuals to identify hidden cameras compared to existing manual or app-based solutions.
Sevii Extends Autonomous Defense Platform with New AI Security Module for Real-Time Remediation
Sevii has added a new AI security module to its Autonomous Defense & Remediation (ADR) platform, designed to provide instant and autonomous responses to AI-driven attacks. This module ingests alerts from existing security tools, analyzes them in real-time, and uses AI agents to confirm and remediate genuine AI attacks across a customer's infrastructure. The update addresses the increasing speed of AI attacks, which often outpace human response capabilities.
Google Cloud introduces VPC Service Controls policy intelligence tools for simplified perimeter management
Google Cloud has released new policy intelligence capabilities for VPC Service Controls (VPC-SC), including a violation analyzer and dashboard. These tools aim to simplify policy management and troubleshooting for cloud environments, helping to protect against data exfiltration and insider threats.
AWS Security Hub Extended Integrates Upwind for Cloud Workload Protection
AWS Security Hub Extended has integrated Upwind, a cloud security company, into its program. This integration provides customers with Upwind's runtime-first cloud workload protection directly through their existing AWS relationship, offering choice even with overlapping services.
Slovenian Casinos Reopen After Cyberattack Disrupted Gaming Systems
Hit, a major Slovenian gambling and tourism group, has begun reopening its casinos after a cyberattack forced them to shut down for several days. The incident highlights the ongoing vulnerability of the gaming industry to cyber threats and the operational disruptions that can result.
Laptops and game builds stolen from three exhibitors at Gamescom 2026
Multiple exhibitors at Gamescom 2026, including Mimic developer Ryan Laley, iam8bit, and Tessera Studios, reported the theft of laptops and a Steam Deck containing unfinished game builds. This incident raises concerns about the security of unreleased game data and the financial impact on developers, particularly smaller indie creators.
GTA 6 Leaker Cashes Out $250,000 in Crypto Rug Pull Before Official Reveal
The individual or group behind the recent Grand Theft Auto VI gameplay leaks cashed out approximately $250,000 from the $CYBERLEEK memecoin. This rug pull occurred hours before Rockstar's official Extended Look premiered, ending a campaign that used leaked content to drive trading volume and accrue fees.
Sesame, a local-first, open-source password manager, is available for Windows beta
Sesame, a new local-first and open-source password manager, has been released in beta for Windows, offering features like 2FA, vault imports, and document attachments. The application is licensed under AGPL-3.0-or-later, providing full access to its codebase for transparency and trust.
UK man sentenced to over six years for operating illegal IPTV service
A 68-year-old man in the UK received a six-year prison sentence for running an illegal IPTV service that generated £980,812 ($1.3 million) over three years. The operation, which provided pirated broadcasts from major rights holders, was shut down by the Police Intellectual Property Crime Unit (PIPCU). This case highlights ongoing efforts by law enforcement and rights holders to combat digital piracy.
PayPal app blocks GrapheneOS users due to root detection security policy
The PayPal application is now preventing users on GrapheneOS from running the app, citing a "Security policy violation: s=root" error. This action restricts access for users of the privacy-focused Android operating system, potentially impacting their ability to use PayPal's services, especially for features like contactless payments.
AurionMail Suite integrates CryptPad and JMAP email with single-password E2EE
AurionMail Suite combines CryptPad and a JMAP-based email service to offer a single-password user experience for end-to-end encrypted documents and emails. This open-source, self-hosted solution aims to provide the convenience of commercial encrypted platforms while maintaining user control and open standards.
LACMA Data Breach Exposed Social Security and Medical Information from July 2025 Incident
The Los Angeles County Museum of Art (LACMA) disclosed that a data breach detected in July 2025 exposed customer and employee information, including Social Security numbers, driver's licenses, and medical data. The museum confirmed the network compromise a month after detection, but the full scope of exposed data was only determined over a year later in late February 2026. This incident highlights the extended timelines often involved in identifying the full impact of cyberattacks, even after initial detection.
New bootloader enables root access and Meta-free operation for original Quest VR headset
A new bootloader and exploit called QuestStack provides full root access to the original Meta Quest VR headset, allowing users to operate the device independently of Meta's services. This development enables sideloading apps without a Meta Developer account and ensures continued functionality even if Meta discontinues server support for the device.
Man Charged with Felonies for Destroying 3D-Printed Decoy Flock Camera
A Florida police department used 3D-printed decoy Flock cameras to bait vandals, leading to felony charges against a man who destroyed one of the plastic devices. The incident highlights police efforts to deter vandalism of surveillance equipment, despite the low material cost of the decoy.
Darth Vader Impersonator Criticizes San Diego's Use of Flock Surveillance Technology
A person dressed as Darth Vader spoke at a San Diego city council meeting, sarcastically advocating for the city's continued use of Flock surveillance technology to highlight privacy concerns. The impersonator's comments drew attention to the extensive data collection capabilities of Flock's Nova service, which reportedly links license plate data with personal information.
Indian National Arrested for Alleged Role in $7.5 Million Elder Scam
Jay Sunilbharthi Goswami, an Indian national, was arrested in Canada while attempting to flee the U.S. after being charged with wire fraud and money laundering. He is accused of acting as a money mule for overseas scammers who defrauded elderly New Yorkers and New Jersey residents of over $7.5 million.
GlassBox Tool Reveals Browser Fingerprinting Data to Users
GlassBox is a new tool that shows users the data websites can collect from their browsers for tracking and anti-fraud purposes. It demonstrates how various browser and hardware signals can be used to identify users across different browsing sessions and engines.
U.S. Bank Attributes Ransomware Claims to Fourth-Party Incident, Denies Internal Breach
U.S. Bancorp stated that recent data theft claims by the LockBit ransomware gang are linked to a breach involving a contractor for a third-party, not its own systems. The bank confirmed no evidence of compromise to its internal networks or data repositories.
Bluesky reports recent day-long outage caused by DDoS attack
Bluesky confirmed a recent day-long service disruption was due to a distributed denial-of-service (DDoS) attack. This incident follows a similar attack in April, raising concerns about the platform's resilience against such disruptions.
Local MITM Proxy Controls TLS/HTTP/2 Fingerprints for WAF Bot-Detection Testing
A new local Man-in-the-Middle (MITM) proxy has been released that allows users to control TLS (JA3/JA4) and HTTP/2 fingerprints, HTTP header order, User-Agent, and source IP headers via a single YAML configuration. This tool is designed for authorized security testing of Web Application Firewall (WAF) bot-detection systems.
Threema secure messaging service disrupted by large-scale DDoS attacks
The Threema secure messaging service experienced severe disruptions due to multiple large-scale distributed denial-of-service (DDoS) attacks. The attacks were difficult to mitigate because the threat actor constantly changed patterns and targeted both Threema and its colocation partner. This incident highlights the persistent challenge of defending against sophisticated DDoS campaigns, even for services focused on security.
Exploit Grants Hardware-Level Control on AMD 2011-2015 CPUs via Single Instruction
A new exploit named Skitter Creek Bath Salts (Skitter) allows access to protected memory areas on AMD CPUs from the 15h and 16h families (2011-2015) using a single instruction. This exploit grants full hardware-level control, including access to the Platform Security Processor and System Management Mode, but requires kernel-level access to the affected machine.
Former Brightly Software Analyst Sentenced to Prison for Data Theft and Extortion
A former data analyst contractor for Brightly Software received a two-year prison sentence for stealing sensitive company data and attempting to extort $2.5 million from his employer. The individual threatened to leak payroll information and personally identifiable information (PII) after his contract was not extended, leading to a federal investigation and conviction.
AWS Completes 2025-26 NHS DSPT Assessment with "Standards Exceeded" Status
Amazon Web Services (AWS) has successfully completed its 2025-26 NHS Data Security and Protection Toolkit (DSPT) assessment, achieving a "Standards Exceeded" status. This assessment demonstrates AWS's compliance with data security standards required for organizations accessing NHS patient data and systems.
AWS completes CyberVadis assessment with highest score, report available for due diligence
Amazon Web Services (AWS) has completed its annual CyberVadis security assessment, achieving the highest score of "Mature" in all assessed areas. This report is now available to customers to assist with third-party supplier due diligence.
Norman, Oklahoma Rejects Flock License Plate Readers Over Privacy Concerns
The city of Norman, Oklahoma, has repeatedly declined to implement Flock automated license plate readers (ALPRs) despite requests from its police department. City officials cited privacy and data security concerns, particularly regarding data storage duration and access, as reasons for their decision.