Wazafak — Safety

A take-home interview project was revealed to be a malicious operation, designed to infect candidates' systems with malware. The project, disguised as a legitimate coding assignment, contained hidden directories and scripts that could compromise a user's system.

TP-Link Kasa cameras have been found to leak home GPS data via unauthenticated UDP requests, exposing user locations. Firmware updates are available to patch the vulnerability.

A massive data breach has exposed nearly one million passports and photo IDs from multiple countries, leaving individuals vulnerable to identity theft and document fraud. The breach occurred due to a fundamental failure in data security practices, with the documents being hosted on unprotected public URLs.

A new wave of AI-powered voice fraud is sweeping the nation, leaving law enforcement and financial institutions struggling to keep up. With just three seconds of audio, scammers can create a convincing clone of a person's voice, allowing them to trick victims into handing over sensitive information or money.

Noma Labs discovered a critical prompt injection vulnerability within GitHub's new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories. The vulnerability, named GitLost, highlights the security challenges of agentic AI systems.

A use-after-free vulnerability in OpenBSD allows local privilege escalation to root, posing a significant security risk. The vulnerability, identified as CVE-2026-57589, affects OpenBSD versions through 7.9.

A vulnerability in Linux's LUKS suspend feature has been discovered, allowing encryption keys to remain in memory after suspension, potentially exposing sensitive data. Since Linux 6.9, the tool that locks the laptop's drive on suspend had been silently failing to wipe disk-encryption keys from memory.