Top stories
Stripe and Advent International Reportedly Bid $53.4B for PayPal
Stripe and Advent International have reportedly submitted a $53.4 billion joint bid to acquire PayPal. This major acquisition, if completed, would consolidate two significant players in the digital payments market, impacting its competitive landscape.
Apple Releases iOS 26.6 and iPadOS 26.6 with 87 Security Fixes
Apple released iOS 26.6 and iPadOS 26.6, addressing 87 vulnerabilities across its mobile operating systems. These updates fix flaws that could allow arbitrary code execution, privilege escalation, and data access, enhancing device security for iPhone and iPad users.
Model Context Protocol Receives Major Update, Adopting Stateless Architecture
The Model Context Protocol (MCP), an open standard for AI agents, has received its largest update since its launch, transitioning to a fully stateless architecture. This revision removes sessions and the initialization handshake, deprecates three core features, and graduates two capabilities into official protocol extensions, simplifying deployment for large-scale enterprise AI agent applications.
Hugging Face Models Generate Nonconsensual Deepfakes, Lacking Safeguards
A report by European nonprofit AI Forensics found that seven of the top nine image editing models on Hugging Face generated nonconsensual deepfakes of women and children using simple prompts. This indicates a lack of platform-level safeguards on Hugging Face, contrasting with other mainstream generative AI models, and raises concerns about the proliferation of harmful AI applications.
Baidu and Lyft Begin Robotaxi Testing in London with Apollo Go RT6 Vehicles
Baidu, in partnership with Lyft and its subsidiary Freenow, has started testing its Apollo Go RT6 robotaxis in London. These tests involve human safety operators and are part of a broader strategy to deploy autonomous vehicles across European markets, with public availability targeted for 2027.
ASML Increases Sales Forecast Amid AI Chip Demand, Plans EUV Tool Price Hikes
ASML has raised its 2023 sales forecast to €43-45 billion due to strong demand for AI chips. Plans to increase capacity for EUV and DUV machines align with surging orders. The company is also exploring price increases for its Low-NA EUV tools, facing criticism from major client TSMC. ASML's pricing strategy and market position could impact the broader semiconductor industry.
ChatGPT Now Refuses to Mimic Specific Authors' Writing Styles
OpenAI's ChatGPT has begun refusing requests to generate text that directly imitates the writing styles of specific authors, including both living and deceased individuals. Instead, the chatbot offers responses that draw on broad qualities of those authors while maintaining its own voice. This change is likely a response to ongoing copyright infringement lawsuits against OpenAI.
Google Threat Intelligence Group Unifies Threat Actor Naming System
Google Threat Intelligence Group (GTIG) has introduced a new unified naming schema for tracking threat actors, replacing the previously separate systems used by Mandiant and Google's Threat Analysis Group (TAG). This change aims to standardize threat actor identification across platforms and public reporting, making it easier for defenders to understand and respond to threats.
Amazon launches GuardDuty investigation agent for AI-powered threat assessment
Amazon introduced the GuardDuty investigation agent in public preview, enhancing threat assessments across AWS environments. This tool automates investigation processes, reducing time from hours to minutes and providing structured risk assessments and actionable recommendations.
LM Studio Unveils Bionic AI Agent for Mac with Privacy-Focused Open Model Support
LM Studio has launched Bionic, a Mac app leveraging open AI models to handle tasks such as coding and document processing. Bionic supports both local and cloud-based models, ensuring user privacy with a Zero Data Retention policy. This development offers flexible computational environments for users, emphasizing control over data security and cost.
T-Mobile Outage Causes Widespread iPhone SOS Mode Activation Across US
T-Mobile experienced a widespread service outage across the United States, beginning around 4 p.m. ET/1 p.m. PT, affecting cellular calls, texts, and data for many users. This outage caused iPhones to display an "SOS" indicator, signifying a loss of network connectivity, though emergency calls remained possible.
Dysphoria IoT Botnet Uses Blockchain for C2 After JackSkid Disruption
The Dysphoria IoT botnet has adopted blockchain-based name services and infected-device relays for command-and-control (C2) following a March law enforcement operation against its predecessor, JackSkid. Researchers from CNCERT and Qi'anxin's XLab estimate the botnet to have over 200,000 bots, using them for distributed denial of service (DDoS) attacks and traffic relay operations. This architectural change makes the botnet more resilient to disruption by obscuring the location of its controllers.
Cloudflare open-sources 'pvcli' debugger for OHTTP and MASQUE privacy protocols
Cloudflare has open-sourced "privacy-client" (pvcli), a command-line debugger for Oblivious HTTP (OHTTP) and MASQUE protocols, under an Apache 2.0 license. This tool addresses the difficulty of troubleshooting privacy services like Apple's iCloud Private Relay and Microsoft's Edge Secure Network VPN, which split trust across multiple operators to prevent any single entity from linking user identity to online activity.
Meta Exits RE100 Clean Energy Initiative Amidst Increased Natural Gas Power Plant Investments
Meta has withdrawn from the RE100 corporate renewable energy initiative after a decade of membership, a move confirmed by the company. This departure coincides with Meta's accelerated investment in natural gas power plants to support its AI data centers, raising questions about its commitment to 100% clean energy. The exit follows RE100's updated guidance requiring more rigorous reporting on renewable energy progress.
Nothing Denies Market Exit, Confirms Layoffs and AI Business Unit
Nothing cofounder Akis Evangelidis denied reports of the company exiting global markets and inaccurate sales figures for its Phone (4b), stating the device sold nearly 30,000 units on its first day. Evangelidis confirmed a reorganization of teams, including the creation of an AI-native business unit, which has impacted some positions, though the scale of reported layoffs was disputed.
Indian Government Orders GitHub to Remove Bluetooth-Based Chat App Bitchat
The Indian Cybercrime Coordination Centre (I4C) has ordered GitHub to remove the Bluetooth-based messaging application Bitchat, citing concerns that it enables communication during network restrictions and poses a risk of misuse by various illicit groups. This action highlights government efforts to control communication channels, particularly those that bypass traditional surveillance methods, impacting developers of privacy-focused communication tools.
NHTSA to Develop New Safety Rules for Vehicle Exit Mechanisms Following Tesla Incidents
The National Highway Traffic Safety Administration (NHTSA) will begin developing new requirements for automakers regarding safe vehicle exits. This action follows incidents where individuals became trapped in cars with flush, electronically operated door handles, such as those on Tesla vehicles, and could lead to new federal motor vehicle standards affecting all manufacturers.
Dolphin X Malware Uses AI Profiling to Rank High-Value Targets
A new remote access trojan named Dolphin X incorporates an "AI Profiler" feature to score and rank infected users, helping cybercriminals prioritize victims. This development allows attackers to automate the identification of high-value targets from a large pool of compromised accounts, potentially increasing the efficiency of cyberattacks.
Chick-fil-A reports data breach from credential stuffing attacks
Chick-fil-A has alerted customers about a data breach caused by credential stuffing attacks affecting accounts. The breach may involve sensitive information like names, email addresses, and partial credit card numbers.
AegisAI raises $36M Series A to combat AI-driven spear phishing with AI agents
AegisAI, a startup founded by former Google security executives, secured $36 million in Series A funding to develop AI agents that detect and prevent AI-crafted spear phishing attacks. The company's technology analyzes email messages for anomalies that traditional rule-based systems often miss, addressing the increasing sophistication of AI-powered cyber threats.
Black Forest Labs Launches FLUX 3 Multimodal AI for Image and 20-Second Video Generation
Black Forest Labs (BFL) released FLUX 3, a multimodal AI model capable of generating images and video clips up to 20 seconds with audio from a single prompt. This release marks BFL's first public video generation model and aims to connect creative generation, simulation, computer use, and robotics through a single visual intelligence capability.
White House Launches AI-Driven Gold Eagle Initiative for Cybersecurity Coordination
The White House has launched the Gold Eagle initiative, an AI-supported federal clearinghouse for cybersecurity vulnerabilities. This program aims to enhance vulnerability detection and remediation across government and private sectors by facilitating collaboration between software maintainers and infrastructure operators. Gold Eagle is backed by multiple federal agencies and uses AI to manage cybersecurity risks efficiently.
Upbound Group discloses $13M fraud in Acima leases following data breach
Upbound Group reported a cybersecurity incident where threat actors stole non-sensitive customer information and documents, leading to $13 million in fraudulent Acima lease-to-own agreements. The stolen data was used to obtain goods, resulting in financial losses for the company when fraudsters failed to make payments. Upbound has implemented enhanced security measures and notified federal law enforcement.
Swiss rail manufacturer Stadler rejects $12.3M ransom demand after cyberattack
Swiss rail vehicle manufacturer Stadler Rail rejected a $12.3 million ransom demand from the Everest ransomware gang following a data breach on a platform shared with a supplier. The company reported no impact on its IT systems or production operations, and stated only non-security-relevant technical information was stolen, demonstrating a firm stance against cyber extortion.
South Korea's diplomat training system breached by hackers for 9 months
Hackers compromised South Korea's diplomatic academy's e-learning platform for nine months, exposing employee data. This breach raises serious cybersecurity concerns, especially given the country's past experiences with North Korean cyberattacks.
GitHub Restructures Bug Bounty Program, Reduces Public Payouts by July 2026
GitHub is restructuring its bug bounty program to prioritize quality over quantity, introducing a permanent, invite-only VIP program with higher payouts and direct access to its security engineering team. Starting July 27, 2026, public bug bounty payouts will be reduced by at least 50% across all severity levels, with fixed payments replacing previous ranges. This change aims to reduce the volume of submissions and reward established researchers more effectively.
Flock Cameras Expand Surveillance Across U.S., Sparking Privacy Concerns
Law enforcement agencies across the U.S. are using Flock cameras, initially for vehicle tracking, to search for individuals through detailed descriptions. This usage extends beyond license plate recognition, incorporating AI to track people based on physical characteristics or affiliations. The widespread deployment of 90,000 cameras has raised significant privacy concerns due to lack of public consent.
Intel Partners With Fortinet for SP6 Chip Development on Intel 4 Technology
Intel and Fortinet have entered a strategic collaboration to develop Fortinet's Security Processor 6 (SP6) using Intel's 4 nm process. Fortinet becomes Intel's first named external silicon customer for the Intel 4 node, marking a significant development for Intel's foundry business. This collaboration strengthens the relationship between semiconductor manufacturing and cybersecurity, with Intel showcasing its foundry capabilities under CEO Lip-Bu Tan.
Cyberattack Halts Operations of Japanese Cold-Chain Operator Nichirei, Impacts Food Supply
A cyberattack on Nichirei Logistics Group disrupted frozen food shipments in Japan, affecting major chains like KFC. Operations began partial restoration post-attack, with a focus on data safety due to potential personal data compromise.
AI-Driven Security Startup Glow Emerges With $180M Funding at $1.2B Valuation
Glow, a cybersecurity startup leveraging AI to bolster endpoint security, has emerged from stealth with a $1.2 billion valuation and $180 million in Series A funding. Founded by former Meta and Snowflake executives, the startup seeks to address AI-related cyber risks by providing tools that manage software on employee devices. This reflects the growing concern over AI-augmented cyber threats and the need for enhanced security strategies.
Authorities Shut Down Kratos Phishing-as-a-Service Platform, Arrest Developer
German and U.S. authorities dismantled the Kratos phishing-as-a-service platform, used for Microsoft 365 phishing campaigns, and arrested its developer in Indonesia. The platform had 1,800 users running 15,000 campaigns monthly, significantly affecting global cybersecurity due to its ability to bypass multifactor authentication.
23andMe Settles $18 Million Data Breach Case Across 42 States
23andMe will pay $18 million to settle claims from 42 states over a data breach affecting 6.9 million users, including genetic data. The settlement requires enhanced cybersecurity measures and accountability going forward. This settlement follows issues of inadequate data protection and significant delays in breach notifications.
Garmin Launches Screen-Free Cirqa Fitness Tracker for $199.99
Garmin has unveiled the Cirqa, a $199.99 screen-free fitness tracker offering extensive health monitoring without subscription fees. The device tracks metrics such as heart rate, blood oxygen levels, and skin temperature with a 10-day battery life. It competes with subscription-based products from Whoop and Fitbit, offering connections to the Garmin Connect app for additional insights.
Judge Dismisses Lawsuit Against Apple Over iCloud CSAM Detection
A lawsuit accusing Apple of not preventing child sexual abuse material (CSAM) on iCloud was dismissed by a California judge. The company was ruled immune under Section 230, shielding it from liability for user-uploaded content. The case highlights ongoing debates about tech companies' roles in moderating content on their platforms.
Qilin Ransomware Gang Exploits Patched PAN-OS VPN Vulnerability
The Qilin ransomware gang is exploiting a critical flaw (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect to gain unauthorized access and deploy ransomware. Despite the vulnerability being patched on May 13, 2026, attacks have led to network breaches and data encryption. The U.S. CISA has urged federal agencies to secure their GlobalProtect instances immediately.
Halliday's Second-Generation Smart Glasses Aim to Improve User Experience
Halliday has released its second-generation smart glasses, addressing previous display issues with improved waveguide technology. These new glasses come without a camera and feature a separate display for each eye, targeting work meetings as their primary use case. Halliday learned from its first-generation criticisms to enhance the viewing experience.
TSMC Plans 5-10% Chip Production Price Hike amid AI Demand and Rising Costs
TSMC plans to increase chip production prices by 5% to 10% starting next year, citing rising demand for AI processors and material costs. This move, affecting both advanced and mature technologies, follows Apple's recent product price hikes due to increased memory costs, potentially impacting future Apple device prices.
Estée Lauder Data Breach Exposes Sensitive Details Through Oracle E-Business Vulnerability
Estée Lauder disclosed a significant data breach resulting from the exploitation of a zero-day vulnerability in Oracle E-Business Suite. The attack occurred in August 2025 and was revealed in June 2026, impacting personal data including Social Security numbers, financial, and health information of employees. The breach was connected to the Cl0p cybercrime group and affected multiple companies.
Sony Files Lawsuit Against Udio Over 30,000 AI-Generated Songs
Sony Music Entertainment has filed a lawsuit against Udio alleging the AI music generator infringed on over 30,000 copyrighted songs. The lawsuit, separate from a previous attempt to expand claims, includes famous tracks by artists like Elvis and Beyoncé. This legal action underscores ongoing copyright issues in AI-generated music.
FCC Fines and Plans Ban on DJI-Tech Disguised Products Citing National Security
The FCC has fined eight companies $25,000 each for not responding to inquiries about their use of DJI technology. The Commission plans a retroactive ban on their drones and cameras, given concerns over evading foreign drone bans. This crackdown reflects national security concerns involving disguised DJI tech in the US.