Cybersecurity news — data breaches, vulnerability disclosures, AI-powered security tools, threat intelligence, and enterprise security research.
Structural backpressure—using deterministic, machine-checkable gates like compilers and type checkers—is more effective than relying on smarter AI agents to enforce software invariants. The author contends that behaviora…
Based solely on the provided text, the article titled "The big AI companies are going to see their margins disappear" argues that major AI firms are facing a future of shrinking profits. This is due to a "hardware crunch…
A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) publicly exposed highly sensitive credentials on a GitHub repository, including keys to AWS GovCloud accounts and plaintext passwords for interna…
An autonomous AI system built for penetration testing that overcomes human limitations by combining tool selection, memory of past attacks, real-time vulnerability database queries, mathematical modeling for zero-day dis…
IBM engineer Bob developed a custom skill for the "IBM Bob" coding agent to automate the design of HashiCorp Vault secrets engines, based on his own reverse-engineering experience and a tutorial he wrote. The skill was t…
The FBI is seeking to purchase nationwide access to automated license plate readers (ALPRs), which would enable the agency to track vehicle movements across the country without a warrant, according to procurement records…
Xint, an LLM-based security tool developed by Theori, reports a false positive rate of less than 25% for its highest-severity vulnerability findings, based on manual validation through proof-of-concept testing. For examp…
Linux founder Linus Torvalds stated in his latest kernel update that the Linux security list has become nearly unmanageable due to a flood of AI-generated bug reports, which create massive duplication as different users …
Findings from Project Glasswing, where security-focused LLMs, particularly Anthropic's Mythos Preview, were tested against over fifty internal code repositories. It highlights Mythos Preview's advanced capabilities in ex…
Open-source macOS tool called "auto-identity-remove" that automates the process of opting out of over 500 data broker and people-search sites. The script runs monthly, uses AI-powered CAPTCHA solving, tracks completed op…
A researcher known as Nightmare-Eclipse published a zero-day exploit named YellowKey that bypasses default Windows 11 BitLocker encryption. The attack requires physical access to the computer and targets the full-volume …
The chapter introduces dynamic relocation, a hardware-based mechanism that translates every memory access from a virtual to a physical address using base and bounds registers, enabling the OS to control memory while allo…
Based on the provided text, the article is a set of instructions for conducting a professional security code audit. It defines the scope of the audit, focusing on finding and proving high-impact vulnerabilities like remo…
The Government Digital Service (GDS) has advised the NHS to maintain an "open by default" policy for its code repositories, countering the NHS's decision to close access following security vulnerabilities reported during…
The article is a blog post about the bigfin squid that also invites discussion of unaddressed security news. The comment section features a lengthy argument by Clive Robinson that the rise of AI and corporate cost-cuttin…
In 2008, the author worked at RSA, a network security company with a strong nerd culture where prime-number employee IDs were considered lucky. During a monthly HR-organized game, teams were given five minutes to list al…
This article is a behind-the-scenes look at how a story about ICE using Palantir to track 20 million people on iPhones was reported. The journalist, Joseph, explains he gathered information by speaking to four conference…
The Google Threat Intelligence Group (GTIG) has tracked an extortion campaign by the threat actor UNC6671, operating under the "BlackFile" brand, which targets organizations through sophisticated voice phishing (vishing)…
GitHub is updating its bug bounty program by raising the quality standards for submissions, requiring a working proof of concept with demonstrated security impact, validation before submission, and awareness of scope and…
A zero-day exploit called YellowKey allows attackers with physical access to a Windows 11 system to bypass default BitLocker encryption protections and access encrypted drive contents within seconds. The exploit involves…