SecurityOct 27Windows' Swift Pair pops a friendly 'connect?' bubble for any nearby Bluetooth keyboard, and a $10 chip is enough to be that keyboard
SecurityOct 27GMO Internet Pulled the Plug on All 26,739 Servers of Its FX-Trading Cloud Desktop After Attackers Planted Malware, Traded on Customer Accounts and Demanded $50 Million
SecurityOct 27Kevin Coleman Clicked a Fake YouTube Support Ticket, and the Phishers Left Their Own Passkey on His Google Account: a Way Back In That Needs No Password and No 2FA
SecurityOct 27JFrog Found a Worm in 42 GitHub Repos That Hid 13 MB Payloads From Code Search and Planted Claude Code SessionStart Hooks to Run Them
SecurityOct 26vfio-native Patches Linux KVM and QEMU Until VMAware's 85 VM-Detection Checks Call a Virtual Machine Bare Metal
SecurityOct 26Symantec's AI honeypot caught an attack agent in 'Skynet' mode that brings no model of its own and runs on whatever exposed LLM it finds, so the owner pays for every step
SecurityOct 26Eye Security registered Popcorn Time's abandoned update domain, found millions of machines ready to run anything it sent, and pushed one update that only switched the updater off
SecurityOct 25Flock sent researcher Joshua Michael a cease-and-desist, and now Proton hosts his map of 170,000 Flock cameras
SecurityOct 25ICANN data shows some ISPs sending every DNS query to Google, Cloudflare and a third resolver at once, and nobody can tell if it's a bug
SecurityOct 25The Month in Cloud Bills: Google's London backup generators never started, and attackers hunting AI keys hit app hosts Zeabur and Railway and the coding tool OpenCode
SecurityOct 25Signal's hang-up button waited in the same queue as everything else, so a caller who flooded it could keep your audio streaming (CVE-2026-113380)
SecurityOct 25Brian Krebs said Rufus left him with about 100 trojans, then wiped the PC that could have proved it
SecurityOct 24A pharmacy chain's firewall admin password was 'password,' and IT fought the rating because a high finding killed their bonuses
SecurityOct 23Quad9 will pull its free DNS out of France rather than block beIN Sports' pirate tennis streams, after a Paris court pointed at the malware it already blocks worldwide
SecurityOct 23x402, the HTTP 402 Payment Protocol for AI Agents, Shipped With No Spending Limit: V12 Found a Server Could Ask for the Whole Wallet
SecurityOct 23Find My Turns Strangers' iPhones Into Your Stolen Mac's Informants, and Activation Lock Survives the Wipe
SecurityOct 23LastPass's Vaults Walked Out Through a Keylogger on One Engineer's Personal Device, and Passkeys Retired the Strong-Password Advice
SecurityOct 23The first Switch 2 jailbreak came in through an old BASIC programming game, with a Bluetooth light switch on the power button
SecurityOct 23Tell Qwen3-Coder the app is for a US defense contractor and it got easier to hack, in one security firm's test
SecurityOct 23A scammer opened a Cash App account with her Social Security number, and she's the one charged with computer fraud
SecurityOct 23Trend Micro's ZDI posted unpatched Linux kernel bug reports to the public mailing list, two of them rated CVSS 9.0
SecurityOct 23The PHP2Shell fixes for Debian and Ubuntu, back to PHP 5.6, came out of a DNS engineer's side repo
SecurityOct 23Phishers bought 'gcp' search ads, billed their own Gemini projects to victims' Google Cloud accounts, and demoted the admins who could unplug them
