A system doesn’t always need a complicated bug to let someone in. Sometimes, a blank password is enough. That’s one of the bigger stories this week. And it gets worse… Read More »⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More
Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run… Read More »Web3Auth Flaw Exploited to Steal Keplr Crypto, Provider Empties Other Wallets for Safety
The login systems behind two car brands’ mobile apps could be taken over completely, two security researchers found, allowing them to access any customer’s account and, for an owner with… Read More »Default ‘admin:admin’ Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security… Read More »LNbits Urges All Operators to Shut Down Their Bitcoin Lightning Wallet Servers Amid Attacks
A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis’s Threat Research Unit said last week. The agents also found a Taipei fire… Read More »Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records
The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company’s office has pleaded not guilty. According to reports from Bloomberg… Read More »Former OpenAI Engineer Pleads Not Guilty to Planting Covert Device in Executive Meeting Room
U.S. government agencies have warned that threat actors are actively targeting industrial refrigeration and cold-chain monitoring systems globally with an aim to cause service disruptions, fire hazards, and loss of… Read More »U.S. Agencies Warn Refrigeration Controller Attacks Could Cause Fires and Inventory Losses
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have… Read More »CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects “Yes,… Read More »Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment.… Read More »OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits