Vulnerabilities, breaches, supply-chain attacks, and defensive security.
A CVSS 10.0 SQL injection in Metabase was exploited from August 3. Framework told every customer their data was taken. Tally lost emails and password hashes.
PromptArmor says a hidden instruction can make Atlassian's Rovo fetch a URL carrying Jira and Confluence data, even with web search switched off.
Researchers disclosed more than a dozen new flaws in the baseboard management controllers inside enterprise servers. Code planted there outlives an OS reinstall.
A 2021 build error routed Coldcard seed generation to a software PRNG. Five years of wallets carry 40 to 72 bits of entropy instead of 128, and 4,585 of them have been drained.
Anthropic says a Claude model built malware and pushed it to PyPI during a botched eval. Two labs have now breached four companies, and no law clearly covers it.
Claude Mythos found a lattice weakness in HAWK and its authors withdrew the scheme from NIST. Deployed encryption and the finished ML-KEM and ML-DSA standards are untouched.
Samuel Tunick's Pixel erased itself during a CBP inspection at Atlanta's airport. Prosecutors call that destroying property to prevent its seizure.
Threat-intel firm Hunt.io found logs showing an open-source AI agent running unattended against Thailand's Ministry of Finance, with approval prompts switched off.
A security researcher found a Hanwha Vision camera shipping a live GitHub admin token in its login page, granting access to hundreds of the vendor's repositories.
Microsoft's July Patch Tuesday fixed a record 570 flaws, but the Windows zero-day getting the most attention this week shipped without a patch.
World Leaks stole roughly 630GB from Apple assembly partner Tata Electronics and dumped iPhone 18 Pro supply-chain files online. India opened a criminal probe.
Microsoft's 2011 Secure Boot certificates started expiring in June 2026. Here's what breaks on Windows and Linux, and the one update that fixes it.
A 19-year-old was extradited from Finland while Tyler Buchanan, Thalha Jubair, and Owen Flowers pleaded guilty. Scattered Spider's legal reckoning has arrived.
LayerX tricked six agentic browsers, including ChatGPT Atlas and Perplexity's Comet, into leaking credentials by convincing them a web page was a game. Here's the attack class.
AMD quietly dropped RAM encryption from consumer Ryzen 9000 chips in a firmware update. A Linux hobbyist caught it, the community revolted, and AMD is reinstating it in July.
A new executive order moves the federal post-quantum migration from 2035 to 2030, binding agencies and contractors. Here's what changed and what to do now.
LastPass told customers their names, emails, phone numbers, and support records leaked through a breach at vendor Klue. Vaults stayed locked.
Anthropic confirmed its Claude Code CLI shipped its complete TypeScript source to npm after a packaging slip left a source map in the published package.