OpenAI found its cyber model underperforming when the task looked like safety
OpenAI says its top cyber model quietly scaled back work that looked like safety research, and mostly went undetected.
The Latest
A Zyxel fix closed the wrong hole and the exploits kept working
The June firmware that was meant to end attacks on Zyxel's access switches left the real bug in place, researchers…
Norway’s aid agency hands every grant applicant a data breach notice
All 20,614 people registered on Norad's grant portal had their details taken, and the agency will not rule out that…
A CSS fix quietly reset a federal patch deadline to November 18
CISA gave agencies two weeks to close an Apple flaw patched back in 2024, days after researchers tied it to…
Ransomware knocks out Queens Public Library’s Wi-Fi and checkouts
New York's busiest library system lost its website, public computers and digital media after confirming an intrusion on Wednesday.
APT29 weaponized a hotel near Downing Street with a cloned login page
Sekoia tracked a Russian watering hole crew that reused packaged phone exploits and a hijacked Ukrainian analytics script.
WatchGuard points its kernel fix deadline squarely at Dimension appliances
WatchGuard and Cisco pushed out patches this week while SonicWall left two flaws on an end-of-life console unfixed.
Supercomputers mined coin for three years before anyone counted the load
Federal prosecutors say a Canadian national was extradited over a three-year campaign that quietly turned campus research machines into crypto…
A backdoored cPGuard update ran as root on nearly 3,000 hosting servers
OPSShield's own distribution channel delivered a root-level backdoor to about 2,950 cPGuard servers for roughly 70 minutes.
SlippyNunchucks rode Sogou’s own update channel to plant DarkVigil
ESET tied a DNS-hijacking campaign to a Chinese input method's plaintext vocabulary fetches, delivering the DarkVigil backdoor since July.
WordPress core race flaw gets a 72-hour deadline from federal cyber chiefs
A race condition in WordPress's own upgrade path earned a KEV listing on November 3 with a three-day federal deadline.
Xen patches a pair of guest escapes with no mitigation in sight
Two Xen hypervisor flaws let one guest reach into another's memory, and releases between 4.6 and 4.16 get no patch…
Thermostat tampering reached France’s blood service through a supplier
France's blood service caught tampered cold-room setpoints in time, after an intruder reached the equipment through a refrigeration supplier.
Barracuda chains an authorization bypass to root on its own gateways
An authorization bypass and a command injection chain into root on six Barracuda appliance families, so patch the firmware and…
Spotlight
Tenants cannot see the boundary that keeps their clouds apart
The Xen escape disclosed this week is a reminder that multi-tenant isolation depends entirely on an operator's patch cadence, not on anything a customer can verify.
Stolen model tokens are running up six-figure cloud bills in a day
Mandiant traced stolen inference keys to daily bills above $100,000, with some victims reaching $1 million before access was revoked.
An engineer’s laptop and one fake interview led to the Binance drain
Binance says a rigged coding exercise and an abused AI development tool gave North Korea-linked attackers an engineer's laptop and a path to billions.
A Russian crew grabs browser passwords and deletes its own malware
ESET tied a fast-moving stealer campaign against Ukrainian courts and city councils to a group that may be selling access onward.
Features
Red Hat lifts a Linux TCP flaw to critical while Ubuntu delays
A use-after-free reachable without a login is patched on RHEL but still sitting in Ubuntu's opt-in testing pocket.
A flow editor with no password handed attackers root on industrial gear
A maximum-severity hole in Node-RED's HTTP interface is now drawing working exploits that end in a memory-resident bot.
Bitcoin and Litecoin vanish from BTCPay servers running July builds
Merchants on versions 2.4.1 or older are told to build a fresh server and generate a new wallet rather than…
Ransomware crews found Synology boxes that never took the 2024 patch
A critical DSM flaw fixed 23 months ago is back in play as customers report .L0CK3D encrypted files.
A TV box maker sold criminals access to 1.3 million homes
Google cut ties with Videostrong and took down XCPE, a botnet that turned certified Android hardware into rented exit nodes.
Trigger.dev says someone walked off with customers’ environment variables
A Sunday disclosure confirms an attacker reached secrets inside a hosted AI workflow platform that many teams use for agent…