TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESSPage 2 of 5: earlier stories.
The national incident-response center says attackers behind a run of Japanese data leaks mined smartphone apps for keys and hit internal dashboards never meant to face the internet.
Certificates behind the update service expire May 17 and June 19, 2027, and Microsoft says devices on unsupported Windows versions will stop receiving updates.
iVerify found the variant, which it calls P7, on a financial-sector employee's phone; it rides the existing exploit chain but adds crypto-wallet theft and two-way control.
Bitdefender says the malware runs as system apps on MediaTek-based Doogee and Cubot models and on Samsung and Apple knockoffs, so owners cannot simply uninstall it.
A memory-exhaustion bug in DCGM Exporter lets unauthenticated requests crash GPU monitoring, and a startup found about 12,000 GPUs advertising their details to the internet.
Most of the five critical NX-OS bugs depend on optional features being switched on, so administrators can check exposure quickly while they plan upgrades.
A new infrastructure program brings 11 founding partners on board, and an opt-in scanner will send maintainers exploits and fixes without human review.
Google's flagship phone fell three times on the final day, including once to a team using an AI tool, as Oracle's AI database, printers and smart home hubs were also hacked.
Researchers took $232,500 for 45 zero-days, with Nvidia's Dynamo, Oracle's AI database and the Chroma vector store among the targets compromised.
The 9.8-rated flaw sits in the cache server's multiprocess mode, and the project's own Kubernetes example exposes it on every network interface.
The attorneys general say the router maker oversold its HomeShield protection and played down its reliance on China while claiming its production had moved to Vietnam.
Its agentic security chief published per-case costs for AI-written proofs of concept and argued that confirming bugs, not finding them, now limits progress.
Lumen researchers say the malware mines cryptocurrency on Ollama, LiteLLM and other open-source services, and can move its control server by editing a few words of verse.
Honeypots logged attempts against CVE-2026-21589 within about two hours, and researchers showed how a stolen Crowd config file can lead to Jira admin access.
The bug lets an attacker with no login push requests through the appliance to internal functions, on a product line already hit by two exploited zero-day pairs this year.
The release also blocks shell characters in command-line usernames, hardens sftp downloads and promises faster releases as AI tools surface more bugs.
Vetted defenders, red teams and critical-infrastructure testers get progressively fewer refusals, while the public versions of Claude keep their stricter blocks.
Microsoft is adding .msix and .msixbundle files to the blocked list in new Outlook for Windows and Outlook on the web, with an opt-out for admins.
AI tools including OpenAI Codex, LiteLLM and Oracle's Autonomous AI Database fell alongside phones, printers and smart home gear.
GitHub rejected the report because a user must point the agent at untrusted content, but the researchers say the attack chain still works.
The bureau's first account of the root cause points to an unpatched third-party platform, which Reuters sources identify as Oracle PeopleSoft run by Accenture.
The companies used AI-assisted analysis to find the bugs and now let enterprises queue specific open-source dependencies for embargoed fixes and backports.
LibreOffice shipped fixes Monday, but Apache OpenOffice users remain exposed until version 4.1.17 leaves testing, and a proof of concept is already public.
Checkmarx says one package, function-flag, has been delivering malware for more than a year and drew about 37,000 downloads with no advisory flagging it.