Security

KAIST's SweepLED promises 94% detection of hidden cameras with a $7 LED clip‑on and an AI app. For IT teams worrying about privacy in hotels and rented offices, the reality is far less comforting.

Anthropic's August threat report frames AI misuse as novel when attackers simply repurpose safety tools for extortion and fraud. Here's why your SOC team is already behind.

Anthropic's grateful update on US CAISI and UK AISI red-teaming hides a confession: Claude Opus 4's Constitutional Classifiers harbored a universal jailbreak. Here's the security fallout for anyone running Claude in production.

Hister puts you in control of your search index, indexing the full text of your browsing history and local files without telemetry or mandatory cloud services.

Hacktron researchers chained a libheif heap buffer overflow in Discourse with an OpenAI SSO misconfiguration to takeover employee accounts and access internal repositories, demonstrating how AI accelerates exploit development.

A critical vulnerability in the Cursor AI-assisted development environment has been exposed after 7 months of silence from the company. The vulnerability allows for arbitrary code execution with no user interaction required.

A security camera shipped with a GitHub admin token in its login page, exposing hundreds of repositories to potential security risks. The token was found in the camera's firmware, which was downloaded from the manufacturer's website.

A take-home interview project was revealed to be a malicious operation, designed to infect candidates' systems with malware. The project, disguised as a legitimate coding assignment, contained hidden directories and scripts that could compromise a user's system.

TP-Link Kasa cameras have been found to leak home GPS data via unauthenticated UDP requests, exposing user locations. Firmware updates are available to patch the vulnerability.

A new wave of AI-powered voice fraud is sweeping the nation, leaving law enforcement and financial institutions struggling to keep up. With just three seconds of audio, scammers can create a convincing clone of a person's voice, allowing them to trick victims into handing over sensitive information or money.

A dormant stack‑use‑after‑free in the rtmutex implementation lets an unprivileged process hijack kernel control flow, affecting every Linux distro released since 2011.

A flaw in YouTube Studio’s Ask Studio AI lets a comment control the assistant, exposing private video titles to attackers.

A hacker's arrest reveals Microsoft can track users via a Windows device ID, sparking privacy concerns about Windows' surveillance capabilities.

A hidden authentication backdoor in Tenda router firmware grants admin access, potentially allowing attackers to gain control over devices. The issue, tracked as CVE-2026-11405, affects multiple firmware versions and can be exploited to bypass normal login checks.

Noma Labs discovered a critical prompt injection vulnerability within GitHub's new Agentic Workflows, allowing an unauthenticated attacker to silently pull data from private repositories. The vulnerability, named GitLost, highlights the security challenges of agentic AI systems.

A use-after-free vulnerability in OpenBSD allows local privilege escalation to root, posing a significant security risk. The vulnerability, identified as CVE-2026-57589, affects OpenBSD versions through 7.9.

Paradigm Shift’s usbliter8 exploit shows how a design flaw in the Synopsys DWC2 USB controller lets attackers overwrite SRAM and gain code execution in Apple’s A12/A13 SecureROM.

LLMs have leveled the playing field, turning the once‑sacred vulnerability report into just another issue ticket.