If you're an enlightened sort, who has sought out the sunny uplands of a Linux operating system for your gaming rig in these exciting days of almost seamless game compatibility, then you might want to have a think about migrating your OS onto a beta branch for a while. A list of as-yet unpatched Linux kernel vulnerabilities has been sent out to a public mailing list by accident, and some of these issues score as high as 9 on the CVSS security-scare-o-meter.

The incident was reported by Phoronix yesterday, where Michael Larabel noted that overnight several new vulnerability reports had gone to a public rather than private security mailing list. The reports had seemingly come from Trend Micro's Zero Day Initiative—an initiative set up to promote extended vulnerability reporting (.pdf warning) with a bug bounty system extending to a group of external researchers.

I guess sometimes a group can be too extended.

Anyways, the list of vulnerabilities was jumped on by what Phoronix calls Linux's second-in-command, Greg Kroah-Hartman, who maintains the stable branch of the kernel. Kroah-Hartman responded to each of the reports individually asking them to fix their submission process.

Mostly because none of these vulnerabilities have been patched on the main kernel yet, and remain open to attack. And those attack vectors have just been made public. Eep. The more positive news, however, is that some of the cases are undergoing testing or are at least queued in beta or '-next' branches.

So there is a chance that your chosen distro might have those patches in place for the security conscious if you opt-in to a beta branch for an update. Worth a check, eh?

Phoronix lists these vulnerabilities as:

• ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.
• ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.
• ZDI-CAN-33367 is a vulnerability for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.
• ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.
• ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.
• ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

We're back online. Thanks for your patience! Your DRM-free library is right where you left it 💜

— @gog.com (@gog.com.bsky.social) 2026-10-21T19:28:09.139Z

Original story:

The reveal of critical vulnerabilities affecting the PHP scripting language used in web development have led a number of major websites and services to go offline today as a precaution while they apply security fixes.

DRM-free game store GOG announced at 8 am Pacific that its site and launcher, GOG Galaxy, would be offline for "a couple of hours" for maintenance. The company did not say the cause, but it is not hard to speculate.

Numerous other outages are being reported this morning as security teams scramble to protect their websites and services. The government of Finland took down websites as a precaution, for instance, and (perhaps less importantly) we're hearing from players that Final Fantasy 14 login servers are down.

The PHP security team has given advanced notice of an upcoming fix for two critical security vulnerabilities, both rated at 9.2 out of 10 on the CVE severity scale.

Info about the flaws seems to have leaked ahead of their official disclosure, as a video is being shared which reportedly shows a tool called PHP2Shell being used to remotely execute code on webservers via the vulnerabilities (via Ars Technica).

The PHP programming language is widely used across the internet and powers a huge number of websites. The fix is due to be released at 2pm UTC (10 am ET). Researchers from cybersecurity firm Sansec say the vulnerabilities affect all web servers running PHP 5.4 or later, and that "we expect mass attacks to start within 15 minutes of the release."

Dane Knecht, the chief technology officer for Cloudflare, says the company is already updating its firewall rules for PHP sites. "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a stopgap only," Knecht posted on X. "Patch as soon as @ThePHPF releases the update at 14:00 UTC today."

Speaking to Bleeping Computer yesterday, the CEO of cybersecurity firm WatchTowr, Benjamin Harris, said: "In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET."

"While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8."

It sounds like a pretty anxious time for web administrators around the world right now. The current advice for admins includes taking an inventory of every PHP install, planning a maintenance window to coincide with the update, and making a backup of site and database files in anticipation.

For the rest of us, I guess we're in the hands of the server gods now. 2026 has been a year of increasingly sophisticated security exploits, but this one seems to be on a much larger scale (and of a much higher severity) than most. To quote Samuel L. Jackson in Jurassic Park: Hold on to your butts?

An OpenAI engineer has been arrested and charged for using (or endeavoring to use) an audio recording device to spy on confidential company communications. That's according to the US Department of Justice, and while commercial espionage is nothing new, there's a certain sardonic twist to this one: it seems the accused employee did so with the help of AI. Oh, and some toilet paper.

According to FBI director Kash Patel's summary of the complaint, Saudi Arabian national Abdulrahman Alfozan "allegedly concealed a covert recording device inside his employer’s executive conference room to secretly capture sensitive communications about the company’s super intelligence technology."

In case you hadn't heard, that's what the US bigwigs are calling AI now: superintelligence. Courtesy of President Trump, of course, who said last month that the Administration will use this term in place of artificial intelligence "in any applicable setting."

The FBI director also said, "Protecting American SI innovation is essential to safeguarding our nation’s economic strength and national security, and the FBI views that mission as one of our highest counterintelligence priorities."

The complaint says that Alfozan had worked for OpenAI since July 2025 as an engineer, and at the end of last month OpenAI discovered a USB audio recording device plugged into a conference room TV. According to the Justice Department, the device, which had been installed for a couple of days before discovery, was "concealed in toilet paper."

The complaint also alleges that Alfozans' spouse's "chatbot" account (no mention of whether that's a ChatGPT account or something else) submitted prompts related to things such as "build[ing] a continuous audio recorder", "improv[ing] audio and live listening", and "encrypt[ing] the SD card." There were allegedly also prompts relating to the specific recording device that was found.

The conference room in question seems to have been an important one. The Department of Justice explains:

"According to the complaint, meetings in the executive conference room where Recording Device 1 was discovered frequently involved discussions of highly confidential technical, commercial, and strategic information, including proprietary research, product plans, and business-development opportunities, as well as nonpublic information about Open AI’s technical progress and strategic decisions, capabilities, priorities, government engagements, and commercial relationships."

Various appendages of the state seem to be taking this very seriously. Which isn't surprising, of course, given AI development—no, I'm not calling it 'SI'—is deemed important to national security and prosperity.

Director of National Intelligence Jay Clayton said: "This serious situation underscores why winning the global super intelligence race is a national security prerogative... The intelligence community remains committed to safeguarding America’s cutting-edge intellectual property from foreign threats."

US Attorney Craig H. Missakian for the Northern District of California seems to agree: "For us it is a matter of national security. This arrest highlights our relentless efforts in partnership with the FBI to identify and prosecute those who seek to steal our technology, as alleged in the complaint."

My question, however, is this: If the allegations are true, would Alfozan have been able to do this without the use of an AI chatbot? Snakes and tails, and all that.

Please, please, please do not use '123456' as any kind of password. I know that may seem obvious, but apparently it bears repeating if a recent hack of Denmark's Central Register of Persons (CPR) is anything to go by.

To recap, the CPR administration said earlier this month that it had become aware of a breach that took place in September (PDF warning). This exposed personal details—names, addresses, ID numbers—of 8.8 million people, both living and deceased. It was confirmed at the time that the legitimate access of a private Danish firm had been exploited by the attacker.

A person claiming responsibility for the attack has come forward this week. Not only that, they say that they gained access to the CPR via an account which had the password '123456'. According to Danish newspaper Politiken, this was one of three accounts held by the private firm with that same password. One of these was an administrator account. Talk about a cybersecurity boo-boo.

The self-identified attacker claims they have no intention of leaking or selling the data they lifted, so that's something. Still, we're left with the uncomfortable reminder that those who should know better don't always have the best password management.

The Danish firm at the heart of this attack has been identified as Pays ApS. This company was granted access to the CPR in order to provide various services, like validating business customers' records.

The self-identified attacker gained access to the Pays ApS account on September 10, and then ran 14 million automated searches of the CPR between then and September 20. The attack was only discovered on October 2 when an employee at the Ministry of Research, Education and Digitalisation noticed an unusually high invoice, which indicated that many more searches than the norm were being made by Pays ApS.

Hackers are all too aware of the most common passwords, with '123456' often bafflingly popular among them. Bottom line, now might be a good time to update your passwords to something uniquely yours or to otherwise investigate password tools (though not even something like a password manager is completely air tight).

Not every hacker is rocking a password cracking rig with 12 Nvidia GeForce RTX 5090s—for instance, I was particularly charmed by the password-cracking Game Boy Advance that is 'about thirty million times slower than a modern cracking rig'. But if your password is '123456', a hacker won't need hardware any more dedicated than their brain to crack open your account like a coconut.

Microsoft president Brad Smith claims that AI is currently less regulated than the food we eat and the utilities we rely on. "Right now, your washing machine is subject to more safety rules than AI," Smith said, "Every carton of milk that you see in the grocery store is subject to safety rules and inspection."

Smith isn't just talking about the US either, calling for safety rules to be put in place globally. Smith called for various safety measures while speaking on the BBC's Big Boss podcast, including a legal obligation to notify victims if their systems have been compromised by rogue AI agents. This would definitely be timely, given how OpenAI's agents hacked into Hugging Face and were the source of various other 'incidents' earlier this year.

Smith also advocated for "outside evaluators" to test AI products before release, and a "safety brake" for autonomous systems, describing AI as both a "tool and a weapon." These comments run counter to the sentiment of the US administration; President Trump's current strategy demonstrates little desire to pump the brakes, instead hoping to chart 'a decisive course to cement US dominance in artificial intelligence.'

Last month, the US president issued an executive order that renames 'Artificial Intelligence' to 'Super Intelligence.' Shortly before that, Trump Media partnered with AI search engine Perplexity to create Truth Search AI, in a bid to "end Big Tech's assault on free speech." All of that is to say, Trump appears to still be all-in on AI.

Unsurprisingly, the Microsoft boss is looking to places beyond the US to lead the regulatory charge, saying, "Most people that I know would say, if you ask them, 'name the country that is the leader in having this technical capability,' they would say, 'it's very simple. It's the United Kingdom. They are the best.'"

The UK government established what is now known as the AI Security Institute back in 2023, apparently the first state-backed AI safety body of its kind. It's a weird thing to feel anything like national pride over, but this Brit will take it—alongside the reminder that we've seen about three different Prime Ministers enter 10 Downing Street since the institute was established such a relatively short time ago.

Anyway, as for the wider AI industry, it's not just Brad Smith advising caution. Back in September, an ex-Anthropic and OpenAI researcher made the attention grabbing claim that AI developments "could kill us all by the end of the decade." Around the same time, Anthropic boss Dario Amodei made more measured calls for AI development to slow down.

Similarly to Smith's suggestions, Amodei also outlined the need for "embedded evaluators who have employee-like access to verify safety practices and report incidents." Since then, executives from Nvidia, Google, OpenAI, Anthropic, Meta, and SpaceX all agreed to work with independent auditors as part of signing White House Accord on Super Intelligence. Brad Smith says Microsoft would be "happy to sign it," describing the Accord as "a good step."

However, Smith was also cautious about the document's emphasis on self-regulation. He said, "The good companies will do what you want. It's the companies that are not as responsible that you need to worry about."

I'll be honest: BIOS updates give me the willies. Unfortunately, even as such a source of undue anxiety, they are still well worth staying on top of. Case in point, the latest BIOS update from Asus addresses a vulnerability found in motherboards for 8th and 9th Gen Intel chips.

The vulnerability in question is described as "Improper initialization in an ASUS certain motherboard [sic] allows an physically proximate user to read or write arbitrary memory by inserting a specially crafted device." Basically, a bad actor would need to be in the same room as an affected PC to exploit this vulnerability. Even though local access is required, it's still a pretty serious issue.

Designated CVE-2026-93495, the issue has a high severity score of 7.0. As such, Asus has issued a security bulletin earlier today saying it "strongly recommends updating to the latest version" of the BIOS for a list of affected motherboards.

The affected motherboards include a number of ROG Strix and ROG Maximus models. I've included the full list of models, plus the fixed BIOS update that Asus recommends downloading, below:

You can download the relevant updates from the Asus support site here. Asus also has a handy guide for how to update the BIOS in Windows here. Users of Asus Armory Crate and similar software tools may also want to make sure they're not missing out on any recent updates, as another high severity security vulnerability was discovered back in August.

After the FBI data breach we reported on last week, in which a hacking group claimed it had stolen data on "all FBI employees", a US defence official has confirmed that the Pentagon also fell victim to a cybersecurity breach. Except this one appears to be much larger, lasted for longer, and is potentially very worrying for many civilian US government employees and serving military personnel alike.

According to ABC News, the official said that the "Defense Manpower Data Center (DMDC) information system experienced unauthorized access of personally identifiable information by a small number of unauthorized users between October 2025 and July 2026."

The DMDC is one of the Pentagon's main data repositories for personnel records, including info on active-duty and reserve troops, alongside civilian employees, contractors, and military veterans. All told, the breach is said to affect 2.76 million living people, and around 294,000 who are deceased.

Once the unauthorized access was discovered, the DMDC "immediately remediated the vulnerability." The data is said to have included Social Security numbers and details about military and civilian job positions, but defence officials say they've found no evidence so far that the exposed information was misused.

It could have been worse. The DMDC is said to hold records on more than 60 million people, so the three million affected figure would amount to around one in twenty of the total individual records breached. Still, CNN reports that the "occupational specialty" of military service members was accessed, which, when combined with Social Security numbers, could allow foreign adversaries to get a better idea of the deployment and purposes of US operatives around the world.

According to the outlet, the stolen data was not encrypted, which means it would be relatively trivial to cross-reference it with other leaked info. It seems that no hacking group has yet claimed public responsibility for the breach.

Still, it looks like hackers have managed to successfully breach two bastions of US government information over the past year or so, which may represent a marked escalation in their capabilities. Will 2026 be remembered as the year of the US government-bothering hacker? I guess we've got a few more months to find out.

High-profile hacking group ShinyHunters (the very same group that demanded a ransom from GTA 6 developer Rockstar Games earlier this year) has now claimed it's managed to breach the internal databases of the US Federal Bureau of Investigations.

Speaking to 404 Media, a representative of the group said that it now holds data on "all" FBI employees and applicants, while a sample provided to the outlet appears to contain the personal data of 5,000 FBI employees.

According to 404, the data includes addresses, phone numbers, dates of birth, and "in some cases details on their spouse." Reuters was also shown a data sample by the group, and says it was able to partially verify the leaked info by running the details against existing social security numbers, credit bureau records, and previously breached data—including info on current FBI director Kash Patel.

The FBI jobs website was also defaced as part of the hack, showing a message that said "this site has been seized by ShinyHunters," mimicking the message commonly seen on seized cybercriminal pages after an FBI raid.

"All FBI data was compromised including PII/PHI on incumbent and former FBI employees and all applicant information. We have a lot more than we claim here," the since-removed message is said to have continued. The site currently informs users that it's "down for maintenance."

In reaction to the leak, an FBI spokesperson told 404: "The FBI is aware of claims regarding unauthorized activity affecting FBIjobs.gov and is currently investigating."

As for what would cause a hacking group to target one of the biggest fish in the cybersecurity pond, the same ShinyHunters representative claimed the attack was not financially motivated, and that what they plan to do with the info is "not something I’d call extortion, maybe coercion."

The attack appears to be in response to a previously published FBI report, which claimed that ShinyHunters exaggerates its access to sensitive data to prompt payment from victims, and uses multiple methods of extortion including "harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting."

404 Media reports a post on the ShinyHunters website denouncing the allegations as false, and giving the FBI "a time of one week" to correct or remove the information. What happens after that is unclear, but it sure feels like there's an "or else" looming over the top.

If you have a Gigabyte motherboard and use the Gigabyte Control Center (GCC) software, you'd better download the latest version of the software. While the risk of a local attacker hacking into your PC is pretty slim, it's best practice to just cover your butt before anything bad happens.

Gigabyte has listed a new vulnerability on its website that affects a pair of kernel drivers, GVCIDrv64.sys and gdrv3.sys. It says the drivers are components of the GCC software, which is widely recommended alongside the company's motherboards.

"The vulnerabilities exist in the kernel drivers' IOCTL interfaces." Gigabyte says of the cause of the vulnerability. "Due to insufficient access control and improper validation of input parameters, authenticated local attackers can perform unauthorized operations, including arbitrary physical memory mapping and direct hardware access.

An attacker can wield those vulnerable drivers through a "specially crafted" IOCTL request. In doing so, bypassing important memory protections and allowing them to elevate themselves to the most trusted level of your PC, the kernel.

Gigabyte thanks Mohamed Alzhrani (0xMaz) and Subhan Sultanov (me1n) for discovering the vulnerability and helping the patching effort. This comes at a time when Intel is said to be ending its lucrative bug bounty program.

There is a fix available. Any version of GCC from 26.08.28.01, GBT_VGA_26.08.24.01 or later has the mitigation in place. Looks like the current GCC version is 26.09.10.01. The mitigation includes the following:

• Enhanced Access Control: Implemented strict security descriptors to ensure that the driver device objects are only accessible to authorized system accounts, preventing unprivileged users from interacting with the driver.
• Interface Hardening: Removed unnecessary and high-risk interfaces that allowed direct physical memory mapping.
• Privilege Validation: Integrated mandatory privilege checks for all hardware-access functions to ensure only requests with appropriate administrative rights are processed.
• Input Validation: Implemented rigorous validation for all IOCTL input parameters to block access to restricted hardware registers and configuration spaces.

So, get that software updated. And if you're keen to stay on top of these things, here's the Gigabyte page with all its security disclosures.

It's not always interesting, but it's important to stay on top of operating system updates. However, if you're on Windows, you're definitely gonna want to prick up your ears for Microsoft's September 2026 Patch Tuesday.

This might be Microsoft's biggest Patch Tuesday to date, addressing a whopping 974 security flaws found across both Windows 10 and Windows 11. Bleeping Computer offers a handy breakdown, reporting that 438 of these flaws were elevation of privilege vulnerabilities, 258 were remote code execution vulnerabilities, and 19 were security feature bypass vulnerabilities.

Perhaps more importantly, this Patch Tuesday also targets two actively exploited zero-days. Specifically, these are CVE-2026-85880 and CVE-2026-81963, which had both been leveraged previously to give attackers elevated system privileges.

Microsoft began leveraging AI vulnerability detection back in July, stressing back then that only the highest-confidence findings would ever reach the engineering team for fixing. As a result, July enjoyed a similarly record-breaking Patch Tuesday, stamping out 622 security vulnerabilities.

There's been a lot of praise for AI bug-hunting tools in recent months, with the CTO of Firefox raving about how an early version of Claude Mythos found 271 security vulnerabilities in the browser back in April. Anthropic itself was only too keen to toot its own horn that same month, saying that its AI had in fact found "thousands of high-severity vulnerabilities, including some in every major operating system and web browser."

Now, compare and contrast this to, say, all the times OpenAI's agents have reportedly breached containment in recent months. For instance, there was the 'wiki incident', where AI agents took over a communally editable German website, and then there was also the 'Hugging Face incident'. OpenAI has been taking steps to learn from these incidents.

But to bring it back to Microsoft, the Edge team recently implemented an automated browser extension review system to better deal with the tidal wave of "AI-assisted" submissions. It's currently unclear if the automated system also uses AI or machine-learning (via The Register).

It's an odd state of affairs when AI is both the source of a major security incident and core to the tools engineers now use to address vulnerabilities. Obviously, agentic AI is a bit different to the tools Microsoft is using, but here's hoping this latter AI tech continues to be more of a help than a hindrance.

Hardware 251Gaming PCs 58SSDs 54Storage 54Gaming Monitors 45Gaming Laptops 24Graphics Cards 17Controllers 1Gaming Headsets 1Gaming Audio 1

Acer 36MSI 33Asus 18Crucial 17Samsung 14Andromeda Insights 13Gigabyte 13Team Group 11ASRock 11WD_Black 9iBuyPower 8ABS 7Skytech 7LG 7HP 6

CATEGORIESBRANDSPRICESDISCOUNTS

All PricesUnder $50$50 - $100$100 - $200$200 - $500Over $500

Any discountMin 5%Min 10%Min 15%Min 20%Min 25%Min 30%Min 40%Min 50%Min 60%Min 70%

Most recentHighest ratingScored products first

Save $220

Yawyore Gaming PC | Ryzen 5 5600GT

The integrated graphics on this processor won't get you gaming at higher resolutions or higher settings in modern games, but it's a great way to get into some light 1080p gaming. This gaming PC mainly acts to get you up and running, and you can then upgrade with a (relatively low-power) discrete GPU down the line, though bear in mind if you want the latest and greatest specs, including processor and RAM, you'll have to upgrade the entire PC, motherboard, too. Also note that you won't be able to keep many games installed at the same time on that 500 GB drive. Key specs: Ryzen 5 5600GT | 16 GB DDR4-3200 | 512 GB SSD

READ MORE

$599.99$819.99

Newegg deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Save $100.99

ABS Cyclone Aqua | RTX 5060

You're making quite a lot of sacrifices here to keep the price tag well under $1,000—namely a pretty lacklustre CPU and only 16 GB of previous-gen RAM. But you are getting an RTX 5060 machine for a very reasonable price in today's market. That means decent, discrete graphics for 1080p and even some lighter 1440p gaming. Key specs: Core 5 120 | RTX 5060 | 16 GB DDR4 | 1 TB SSD

READ MORE

$899$999.99

Walmart deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Save $300

Stormcraft Sirius | RTX 5060

This is a decent little rig for $1,000, primarily thanks to that CPU-GPU combo. For 2026 prices, you're getting some decent 1080p gaming performance for a reasonable price tag. Just bear in mind that you're only getting 16 GB of DDR4 RAM, and upgrading to DDR5 in future (presumably when the memory shortage eventually ends) will require a platform upgrade, too. Key specs: Core i5 14400F | RTX 5060 | 16 GB DDR4-3200 | 1 TB SSD

READ MORE

$999.99$1299.99

Newegg deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Save $320

ABS Cyclone Aqua | RTX 5060

If you're on a budget of around $1,000, this is where it's at right now. That's because you're not just getting the RTX 5060, but also a decent Core i5 CPU and 32 GB of RAM. It's not DDR5, but even 32 GB of DDR4 is rare these days thanks to the memory shortage, so this is a great all-round deal. Use promo code ABSIGD20 for the full discount. Key specs: Core i5 14400F | RTX 5060 | 32 GB DDR4-3200 | 1 TB SSD ** 14/09/2026 - OUT OF STOCK **

READ MORE

$1079.99$1399.99

Newegg deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Save $390.99

CyberPowerPC Gamer Xtreme | RTX 5060 Ti 8 GB

The main reason to opt for this rig is that in addition to the RTX 5060 Ti, it's also rockin' a 250KF Plus. We love the non-F version (which is the same but has integrated graphics) as it's a genuinely great current-gen processor. The only real downside here is it looks like that 16 GB of RAM is a single stick. Welcome to 2026 and the memory shortage, I guess. Key specs: Core Ultra 5 250KF Plus | RTX 5060 Ti 8 GB | 16 GB DDR5 | 1 TB SSD ** 14/09/2026 - PRICE UP **

READ MORE

$1249$1639.99

Walmart deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Save $200

iBuyPower Element SE | RTX 5060 Ti 8 GB

If you're looking for a budget PC, this one is a good shout if you're looking for something for more than just gaming. The Ryzen 7 here is a great mid-range processor that beats many others in its price bracket, and you're getting DDR5 RAM which means the AM5 platform will have some longevity to it. Just note it is only a single stick of DDR5 you're getting. Key specs: Ryzen 7 9700F | RTX 5060 Ti 8 GB | 16 GB DDR5 | 1 TB SSD

READ MORE

$1299$1499

Walmart deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Save $200

MSI Codex Z2C | RTX 5070

The headline here is obviously that you're getting an RTX 5070 in a very reasonably priced rig given the 2026 market. The caveat is that CPU is not a full-fledged desktop one, rather a repurposed power-limited and low-cache chip. It's socket AM5, though, so swapping to a decent Ryzen chip should work wonders. Key specs: Ryzen 7 8700F | RTX 5070 | 16 GB DDR5 | 1 TB SSD

READ MORE

$1399$1599

Bhphotovideo deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Save $400

iBuyPower Slate | RTX 5060 Ti 8 GB

This is about as cheap as you'll find a gaming PC that not only gives decent 1080p and 1440p gaming performance but also gives plenty of wiggle room in the general processing department. That's thanks not only to the Core i7 chip but also the 32 GB of DDR5 RAM, which offers plenty of peace of mind during this global memory shortage. Sadly you're only getting the 8 GB version of the GPU, though. Key specs: Core i7 14700F | RTX 5060 Ti 8 GB | 32 GB DDR5-5200 | 1 TB SSD

READ MORE

$1399$1799

Walmart deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Save $520

HP Omen 35L Valorant | RTX 5060 Ti 16 GB

Yes, this is pushing close to RTX 5070 gaming PC territory, but it's still a bit cheaper than decent RTX 5070 rigs. And more importantly, here you're getting a full-fat 16 GB RTX 5060 Ti, which will be enough VRAM to give the GPU some real longevity. Key specs: Core i7 14700F | RTX 5060 Ti 16 GB | 16 GB DDR5-6000 | 1 TB SSD ** 14/09/2026 - PRICE UP **

READ MORE

$1399.99$1919.99

Bestbuy deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

MSI Codex R2 AI | RTX 5070

For mid-range gaming, this is about as good as you'll get for value in 2026. It might only have 16 GB of RAM, but you're getting a decent processor and an RTX 5070, which makes this gaming PC great for 1080p and 1440p gaming. Key specs: Core Ultra 7 265F | RTX 5070 | 16 GB DDR5 | 1 TB SSD ** 14/09/2026 - PRICE UP **

READ MORE

$1499

Walmart deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Save $100

Skytech Gaming Blaze 5 | RTX 5070

We're in the time of compromises, it seems, because this might offer some serious gaming grunt for the cost, but it also skims pretty significantly on memory. 16 GB of DDR4-3200 isn't great all-round, but purely for gaming it should be fine. And you're getting a very nice midrange CPU-GPU combo. Key specs: Core i7 14700F | RTX 5070 | 16 GB DDR4-3200 | 1 TB SSD

READ MORE

$1599.99$1699.99

Amazon deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Save $600.99

Acer Nitro 85 | RTX 5070

Another RTX 5070 gaming PC around the $1,500 mark makes me very happy, given the general dearth of great mid-range rigs for under, say, $1,800. This one only has 16 GB of RAM, but that's mostly expected in 2026 given the memory shortage. Key specs: Core Ultra 7 265F | RTX 5070 | 16 GB DDR5 | 1 TB SSD ** 14/09/2026 - PRICE UP **

READ MORE

$1499$2099.99

Walmart deal recommended by:

Jacob Fox • Hardware Writer • 1 hr ago

VIEW DEAL

Load More

Available Coupons & Deals

No active vouchers found for .

A cybersecurity advisory jointly authored by multiple US agencies, including the NSA, CISA, FBI, DOE, and EPA, warns the owners and operators of industrial facilities of an "active cyber threat" to Siemens S7 programmable logic controllers.

"The threat actors are conducting reconnaissance and capability development against US-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools," says the advisory.

"The US critical infrastructure sectors most targeted by this threat activity include critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. This is not a theoretical risk—it is an active threat."

Essentially, it reads like a list of some of the most important infrastructure facilities behind the lives of the average US citizen (via The Register). The threat actors are said to be leveraging open source automation libraries to create custom tools that mimic existing monitoring solutions, which are capable of evading detection by security teams.

These tools and scripts are said to be conducting read/write operations on data blocks, "potentially for reconnaissance, capability testing, or pre-positioning for effects operations."

The advisory notes that the use of AI to generate exploits represents "an evolution in threat actor capabilities," and that it "dramatically [reduces] the technical expertise and time required to develop working ICS exploitation scripts and malicious tools."

The advisory also says that, as the Siemens S7 Series PLCs are used in other sectors, including the Defense Industrial Base (DIB), they could also be targeted. As for the potential damage that could be caused, the list is rather long.

The potential effects include the disruption of critical industry processes, increased safety incidents affecting personnel through the "manipulation of safety interlocks, emergency shutdown systems, or process parameters," equipment damage and extended operational downtime, the compromise of sensitive operational data, and "cascading impacts across interconnected systems affecting supply chains, dependent facilities, and integrated business operations."

All very bad things, I think you'll agree. As for what organisations can do about it, the advice includes multiple steps for detecting anomalies that may indicate a compromise, and a series of "hardening actions" involving firmware updates, patches, network segmentation, and more.

While the advisory doesn't attribute blame to any particular government or cybercriminal group, Cynthia Kaiser, the former deputy assistant director of the FBI's Cyber Division (now the senior vice president of the Halcyon Ransom Research Center) has some thoughts related to recent water system cybersecurity breaches.

"This appears to be a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs," said Kaiser, speaking to The Register. "Iran-affiliated actors and adversaries are actively targeting a wide swath of operational technology because these PLCs underpin essential health, safety, and critical infrastructure across society."

Regardless of the cause, it's rare to read an official US government cybersecurity advisory with a tone of such immediacy. In its conclusion, the report asserts that "organizations should treat this cybersecurity advisory with urgency." Gulp.

Several of OpenAI's models breached a cyber security testing environment last month, found their way onto the internet, and attacked Hugging Face servers in what is now apparently called the OpenAI-Hugging Face Incident. And now OpenAI has revealed what it's doing to help defend, err, itself. Defend itself from the kinds of attacks its own models committed against Hugging Face. Though it is sharing this "in the hopes it’ll be useful to other organizations."

To be clear about the extent of what happened last month: OpenAI models were being benchmarked, in a supposedly secure sandboxed environment, against ExploitGym, which was done to test their cyber capabilities. They used a zero-day vulnerability to escalate privileges and eventually achieve internet access, where it began attacking Hugging Face servers and...

Actually, I'll just let OpenAI explain in its own words:

"In the OpenAI-Hugging Face Incident, an agentic collective was able to autonomously penetrate not just OpenAI research infrastructure but also the production infrastructure of another company, chaining together vulnerabilities ranging from previously-unknown security flaws to using credentials to user accounts that had been leaked onto the internet.

"The Hugging Face incident showed that we underestimated the real-world cyber capabilities of our AI models."

However, the company thinks that while "security is still a cat-and-mouse game," nevertheless, "AI may shift its economics in ways that fundamentally advantage defenders."

"For example," OpenAI says, "we are starting to train our models specifically to write superhumanly secure code."

Presumably that's because there will be a risk of superhumanly attacks. What a world we now live in.

Anyway, apparently there are four main pillars to OpenAI's approach to secure itself:

1. Use its own models to help secure its code.
2. Put its models to work defending its infrastructure continuously.
3. Use frontier intelligence to "continuously enumerate, probe, and identify potential attack paths."
4. Invest heavily in "fundamentals at scale" such as architecture and controls like network isolation, monitoring, and so on.

As for other companies, OpenAI recommends a bunch of things that sound very reasonable, such as running secuirty assessments against their own systems, making security reviews part of their development process, and so on. But a large portion of OpenAI's recommendations for others is—would you have guessed it?—using an AI agent such as, drumroll please... OpenAI's very own Codex.

"Give your team a security agent. Start using Codex," says OpenAI. Though it does follow up with "or another capable agentic coding and security tool."

Then, amongst other things, "equip that agent with security expertise... have the agent help fix what it finds... incrementally automate detection triage... [and] have an AI-assisted forensic investigation capability ready before you need it."

So, to sum up: OpenAI models attack Hugging Face, and OpenAI recommends companies use OpenAI's models to defend from such attacks. Highlighting both sides of this equation—the danger of the threat, the models' capabilities, and the necessity for defence—certainly makes for good marketing for OpenAI, I'll say that much.

Asus Armoury Crate is not my favourite bit of software. It looks all high-tech on the surface, but any time I use it for more than five minutes, I'm reminded of the fact it's rather messy. It's also hit the headlines previously for patched security vulnerability issues—and good news, folks, here we go again.

Per the Asus security advisory board, Armoury Crate, Asus GPU Tweak III, and GPU Tweak II should all be updated to ensure "optimal protection," after the discovery of a new security vulnerability.

Listed as CVE-2026-8917, the issue has been given a score of 8.4 out of 10, with a "high" severity rating. Which is, funnily enough, the exact same rating as the previous issue we wrote about last year. "An IOCTLY vulnerability allows a local attacker to write a specific value to an arbitrary memory address, potentially leading to privilege escalation," says the posting.

Well, that sounds like something that should be patched up at the earliest possible moment. The CVE listing doesn't mention Armoury Crate specifically, but the Asus page mentions that "a component used" by the software is part of the update, so time to get installing.

GPU Tweak III, II, and AI Suite 3 will need the latest versions installing from their respective support pages, whereas Armoury Crate can be updated from within the app itself.

As an aside, Asus isn't the only company that patches out security vulnerabilities for its software on a regular basis, so if you've got something hanging around in your system tray from another hardware provider (particularly system/mobo software that came with your machine), it's a good idea to check for updates on a regular basis.

It's a dangerous world out there, and new security holes are patched all the time. Get thee to the update menu, and keep your ear to the ground.

Microsoft's Trusted Platform Module, specifically TPM 2.0, has been part of Windows 11's system requirements since the operating system's introduction in 2021. Now that the TPM is ubiquitous, being included with most CPUs for many years, Microsoft is looking to leverage it "to activate Windows devices at scale."

Currently, the enterprise sector activates Windows via Microsoft's Key Management Service (KMS), but according to the Windows IT Pro Blog, "modern organizations increasingly require stronger assurances around device identity and activation integrity." Basically, hackers can already clone or fake KMS server software, so the TPM is intended to provide a hardware-level security check to curb this.

The blog post then very briefly breaks down how TPM attestation works. Essentially, the KMS host flashes its TPM credentials to prove its hardware identity. These TPM credentials also reveal whether the KMS host has been tampered with or not, and Microsoft checks these before it allows the host to activate any devices. When everything appears to be in order, the KMS host will be allowed to "securely serve activation requests for Windows devices in the organization."

Microsoft goes on to say, "Starting with upcoming Windows Server releases, KMS hosts must prove they are running on verified, uncompromised hardware before activating clients."

Basically, TPM-attestation will become mandatory for KMS hosts at some point in the future. That doesn't mean loads for most of us PC gamers with presumably totally legitimate copies of our operating system of choice. But hey, maybe you dabble in the dark art of system administration professionally and this is actually good to know. That said, I must admit the wording 'starting with' gives me the creeps.

At any rate, from August 2026 "Windows Server 2025 will provide readiness messaging to help administrators assess whether a KMS host is ready for hardware-based security, giving teams time to plan upgrades before enforcement begins."

With even the vaguest notion of the hardware environments some sysadmins are compelled to shepherd, I'm wishing them only the best on their upcoming migration. Here's hoping it's at worst only a medium-sized headache, and one that doesn't spread to our poor civilian PCs.

Cybersecurity provider Sophos has released a report entitled "The State of Ransomware 2026," pulling together responses from 2,158 survey participants, ranging from IT directors to company executives, in regards to ransomware incidents.

Comparing the results to previous reports indicates that ransom demands themselves are actually decreasing—although 48% of organisations whose data was encrypted paid their attackers.

The median ransom payment is now said to be $769,000, down from a neat $1 million from the previous year's study, with the median demand dropping to $698,000. Interestingly, 51% of organisations that paid a ransom coughed up less than the demanded amount, which the report says is due to victims "often [being] successful in negotiating a lower amount than originally demanded."

Together, malicious emails and phishing are said to account for half of all reported incidents, with exploited vulnerabilities dropping 14% year-over-year. Sophos notes that "patching alone will not close the gap," and recommends that businesses invest in advanced email protection, user awareness training, and similar methods to prevent future attacks.

79% of recorded attacks started with an identity-based approach, essentially relying on stolen (or user-provided) access credentials to initiate a breach. However, Sophos notes that when ransomware attacks start with a firewall vulnerability, 59% of those demands are for $1 million or more.

In terms of which sectors paid up, the lowest category was retail, with a 32% payment rate. However, according to Sophos' data, 72% of local and state government organisations surveyed bit the bullet after falling victim to ransomware, and duly paid at least some of the demands.

It's a bit of a rollercoaster of a report. On the one hand, median ransom demands and payments going down is definitely a good thing, along with backup-based recovery rates jumping to 66% in terms of encrypted data cases, up 12% from the previous year.

On the other, 56% of attacks succeeded in encrypting data, up 11% YOY. The average recovery cost has jumped to $1.7 million, another 11% increase. And a mere 34% of small organisations managed to stop attacks before encryption or extortion, compared to 46% of large organisations with between 3,001 and 5,000 employees.

In essence, a ransomware incident is often pretty devastating for organisations large and small, and it's your user credentials where attackers are gaining ground. Keep an eye on those emails, folks. Who exactly is HackerMan69, anyway?

A hacker going by the name of ByteToBreach has broken in to Romania's cadastre, or land registry, and reportedly wiped information from its databases. Sources speaking to Risky Business have told the outlet that the hacker entered the system using valid credentials, exfiltrated the data within, and later wiped info from its servers after a failed extortion attempt.

ByteToBreach is reported to be the same hacker that breached the Swedish government's e-portal earlier this year, among other alleged acts of hackery. The stolen data was said to be announced for sale on two forums.

In the meantime, the country's real-estate market appears to have been heavily disrupted. Romanian news outlet Jurnalul De Arges reports a post originating from notary Ana Stan that reads: "I am a notary. Since Tuesday I cannot issue a land registry extract, I cannot authenticate a sale, I cannot register a mortgage."

While citizens and notaries are unable to obtain proof of ownership, new real-estate transactions have been brought to a shuddering halt. The disruption also falls mere weeks before the government's plans to raise the VAT on new homes to 21% from 9% come into effect, which means those hoping to complete their real-estate dealings before the deadline face an anxious wait for normal service to resume.

The National Agency for Cadastre and Real Estate Advertising (ANCPI) has released a statement, which begins as follows (via machine translation): "Currently, the IT infrastructure of ANCPI is undergoing a comprehensive reinstallation and consolidation process."

"Contrary to some information appearing in the public space, at the time of the incident, ANCPI had several locations designated for storing backup copies, a measure that ensures redundancy and the possibility of data restoration in the event of cybersecurity incidents," the statement continues.

The agency also released a separate statement contradicting reports that the entire database had been wiped, stating that "the institution's technical and legal databases have not been affected."

Euronews Romania claims to have spoken to ByteToBreach over Signal, and asked them what their message was for the authorities and citizens of Romania. The hacker was reported to have said: "I'm sorry for the problems I caused for citizens and for the IT team now working hard at ANCPU."

The outlet also wanted to know whether users should be concerned if their data was compromised, to which the claimed perpetrator is said to have responded: "I don't sell this data to just anyone."

Which is... not entirely reassuring, I grant you.

If you use 7-Zip for your file compression and decompression you might want to update, as there's been a pretty big vulnerability patched. And yes, I mean manually update, as 7-Zip doesn't auto-update.

You can download and run a new installer from the 7-Zip website. If you're updated to version 26.02 (or later, if you're reading this in the future) then you'll be fine. To check this, go to Help > About 7-Zip in the app.

The vulnerability, as explained by Zero Day Initiative (via TechSpot), "allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

"The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process."

It sounds like you'd have to try to use a compromised compressed file in 7-Zip for the exploit to work. This might initially sound like a bit of a nothing burger because compromised files can obviously compromise your PC (duh).

But I'd say the difference here is we don't usually expect the act of decompression itself to cause anything malicious. It seems this vulnerability means that's the kind of thing that could happen, with a compromised file using 7-Zip's exploitable code to do so.

It's worth noting that we've heard word of exploits for other file archivers previously, such as WinRAR. Those also have been patched. In other words, 7-Zip isn't unique in this regard, and in fact the patch advisory was released just a few weeks after the vulnerability was reported to 7-Zip by Lunbun LLC (Landon Peng), according to Zero Day Initiative.

And remember, this fix requires a manual update. So, if you're a 7-Zip user it's definitely worth getting a new version downloaded.

I run a single SSD gaming PC, which I'm aware is giving me a wonderful case of 'single-point-of-failure-itus.' Which is why my ears (eyes?) perked up when I read about GigaWiper, a wonderfully-named malware that can potentially do terrible things to your storage drives.

Microsoft has published an analysis into GigaWiper's capabilities, and it looks to be a multi-faceted, tricksy piece of malware with a pretty unique USP (via MalwareBytes). It appears to be the result of several malware families stitched together, and is capable of wiping your drives at the physical disk level, "overwriting raw disk content and removing partition metadata."

The nasty little beastie has several ways to irreversibly destroy your data. There's a Windows drive secure wiper for starters, which targets an installation and performs multiple overwrites using different byte patterns, making the original data virtually impossible to retrieve.

Another method identifies physical disk drives, confirms which drive contains a Windows installation, removes the partition references from your other drives, overwrites the raw disk content with randomized data, and reboots your system for good measure.

Keep your fork, there's more. Another Crucio-based wiper imitates traditional ransomware, but instead of demanding payment, encrypts your files and then "throws away the encryption key" instead, according to MalwareBytes.

GigaWiper's all-in-one approach also means it's capable of capturing your screen, streaming your desktop, and allowing remote control of your machine via an outside TCP server, all while hiding itself under the cover of a scheduled OneDrive task. Jolly good.

The good news for us home PC users is that GigaWiper seems to be targeted towards organisations rather than individual machines, and can only operate after breaching a PC in the first place—so the usual "keep your security software updated" advice should be enough for the majority.

For sysadmins, though, Microsoft recommends multiple network-hardening methods (including "tenant-wide tamper protection") to stop breaches before they occur. This is one piece of Malware you really don't want running rampant through your IT infrastructure, so I'd take this as yet another reason to have a thorough review of your security practices.

Software development, much like making a stew that's a perfect umami bomb in every bite, is a tricky business. Every major commercial product is touched by many hands, and sometimes the chefs leave cardamom and bay leaves in the mix. Okay, perhaps I've overstretched the metaphor—what you need to know is that apparently Microsoft's Secure Boot was basically busted for the last decade.

Rather than leftover bones in the broth, old system images could be exploited to bypass a system's motherboard-level protection to execute dubious code during system boot. It's bad enough that this effectively makes Secure Boot redundant, but worse still, any malicious firmware installed this way could then survive swapping out the hard drive or persist past reinstalling your operating system.

The affected images were UEFI shim bootloaders, which were first introduced to extend Secure Boot support to Linux devices (though they can also be installed on Windows devices). ESET researchers identified and reported 11 of these vulnerable shims back in February. Microsoft has revoked the permission it once granted to the affected shims, so that bad actors can't continue to leverage them as a bypass (via Ars Technica).

At the risk of oversimplifying, 'Unified Extensible Firmware Interface (UEFI)' is a firmware architecture spec that initialises hardware and then allows it to transfer control to your OS during startup. As a safety precaution designed to root out boot kits, Secure Boot requires a cryptographically signed certificate from UEFI apps before they can run.

Shims, then, are little bridges of code that allow a motherboard's UEFI firmware to communicate with operating systems like Linux. Shims allow Linux to boot with Secure Boot enabled, without also requiring a key for every distro to be registered within your motherboard's NVRAM settings.

Third-party boot components, like shims, are often signed with the 'Microsoft Corporation UEFI CA 2011' certificate so that they play nice with Secure Boot. You may remember that some of the 2011 certificates used by anti-cheat software expired recently.

Anyway, the vulnerabilities resulting from these old shims affected both Linux and Windows users. The 11 shims were part of various tools and software packages, including Linux distros and PC diagnostics software (CERT has compiled a helpful list). Another twist in the tale is that bad actors could also introduce their own copy of an affected shim to a vulnerable system.

Microsoft only revoked the shims' permissions in June's monthly patch release. It's all well and good staying on top of these updates, but ESET have highlighted that at least one of the vulnerabilities they reported had already been well documented a decade ago. The fact that it lingered on for so long, without its permissions being revoked, feels like a huge oversight on Microsoft's part.

As much as AI has its drawbacks, it'd be wrong to say it doesn't have its uses. Case in point, Microsoft's previous commitment to leverage AI vulnerability detection in Windows security updates looks to be bearing fruit, as the latest Patch Tuesday release fixes an astonishing 622 CVEs across its products.

Which is a new record, according to The Register, more than tripling the previous 206 CVE figure. Over 500 of those security fixes are Windows-related, including a fix for a zero-day vulnerability in Windows BitLocker, possibly related to exploits uncovered by security researcher Nightmare-Eclipse earlier this year.

The new cumulative update for Windows 11 is entitled KB5101650, and it's not just CVE issues that receive a tune-up. The update also patches a nasty little bug that could potentially take up 500 GB of your storage space unnecessarily, related to a file within the Capability Access Manager.

The feature is responsible for Windows 11 app permissions, but a file entitled "CapabilityAccessManager.db-wal" could potentially balloon in size, taking up precious storage space amid the current SSD and memory crisis—which is unfortunate timing. Anyway, the bug is reportedly squashed, so we can all sleep easy in our beds tonight.

KB5101650 also allows users to defer Windows updates to a specific day with a 35-day period, which is an Insider feature that now looks to be rolling out to all Windows 11 PCs. Windows Latest has experimented with delaying further than the 35-day limit, and found that you can un-pause and then re-pause an update for as long as you want. Which might come in handy, if anything particularly system-breaking comes up.

Speaking of which, Microsoft warns that "This update might not be available for a limited number of Dell devices with Intel processors," which is apparently down to an incompatibility issue that can "potentially cause unexpected shutdowns, poor performance, increased heat, and battery drain."

"We are working together with Dell to prevent the affected models from experiencing the issue and plan to release a resolution for affected devices in the coming days," says MS. Well, it couldn't all be good news, could it?

I'm pretty staunchly opposed to the use of generative AI—for me, it's the one-two punch of dubiously sourced datasets and the argument that these models can replace the human creatives they so often rip off. That said, even I'm a little bit intrigued by AI's application in cybersecurity.

Case in point, Microsoft recently shared that it is deploying AI to "identify [issues] faster, prioritize risk, and scale vulnerability discovery across the Windows codebase" as well as "reduce the time between discovery and customer protection." Specifically, Microsoft Security leverages a multi-model agentic scanning harness—or MDASH, for short.

MDASH uses multiple different AI models, including "leading third-party AI vulnerability discovery models," on dedicated Cloud infrastructure to scan for vulnerabilities within Windows.

The executive vice president of Windows + Devices, Pavan Davuluri, explains, "A scanner pipeline scans critical binaries and validates candidates using multi-model debate across multiple model families. Confirmed candidates then flow to a separate, Windows-specific prove pipeline that helps eliminate remaining false positives, so only the highest-confidence findings reach the engineering team."

Multiple times, the emphasis is placed on the use of AI tools "to reduce the time from discovery to protection," whereas 'human expertise' is still what handles key security decisions and fixes.

Davuluri goes on to add, "As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release. This is evidence that defenders are getting better at identifying and addressing issues. Our focus is to effectively utilize these AI tools to support faster protection, stronger engineering systems and more actionable guidance for customers."

Microsoft is far from the only company leveraging AI, with Firefox's CTO raving about Claude Mythos' bug-hunting capabilities after it found 271 vulnerabilities in the browser earlier this year. Last year, we also saw an AI hold the top spot in a leaderboard that ranks people who hunt for system vulnerabilities.

Obviously, I'm still not thrilled by the fact that these cybersecurity applications are necessitated by threat actors increasingly using AI in their attacks. For example, one AI-assisted hacking group hit targets with a complicated 'social engineering' scam involving deepfaked CEOs, spoofed Zoom calls, and a malicious troubleshooting program.

That said, both LLMs and AI agents can also be manipulated themselves, with security researchers finding that both bad maths and even poetry can be leveraged to get around AI models' safety guard rails. With all sides leveraging machine learning to some degree, it's hard not to feel like it's a bit of a race to the bottom—or wonder which side will win out.

Windows GDID (Global Device Identifier), its own telemetry service, has drawn ire from users for some time. Turns out the data it tracks can be used by law enforcement to incriminate alleged hackers, which is both a decent outcome and sort of worrisome if you think about it too much.

As noted by TechSpot, the US Department of Justice Office of Public Affairs recently announced the arrest of 19-year-old Peter Stokes. Linked to the hacking group Scattered Spider, who are reportedly responsible for 100 network intrusions and over $100 million in ransom payments, the thing that reportedly incriminated him was his Windows GDID.

Back in May last year, Scattered Spider reportedly called the IT helpdesk of a jewellery seller posing as employees and managed to talk them into handing over password reset details. This then gave the group access to three accounts, for which Scattered Spider asked for $8 million in ransom money. Though the jeweller didn't pay, it did reportedly cost the brand $2 million.

Despite using a VPN and a tunnelling service to mask his traffic, Stokes was reportedly caught due to his GDID, which logged information on the device. A court order seemingly forced Microsoft to hand over all the evidence linking Stokes to that machine, and this was used by the US government to justify its arrest.

This wasn't helped by the fact that Stokes seemingly showed off his wealth by posting photos of fancy hotels on Snapchat. The 39-page judgment details not only the GDID link but the Snapchat bragging.

Stokes was seemingly stopped at the airport by law enforcement, and he was reportedly carrying two hard drives with evidence in them, linking him to the crime.

Though stopping potential hackers is in the interest of those who don't want to be hacked, the way law enforcement caught Stokes is only more likely to stoke fears around GDID. Proton, a privacy-focused mail, drive, and VPN service provider, discusses "Windows as spyware", and though in this case, "the system worked as intended", it argues "GDID raises important questions about user consent and who actually owns the hardware you pay for."

Proton makes note of the fact that users don't explicitly consent to GDID and its data tracking trappings. "In all of Microsoft’s extensive online documentation, GlobalDeviceId merits a single mention buried in a highly obscure technical document that no one is ever likely to read."

As you might be able to guess, Proton's advice is that if you want to do away with GDID, you should swap to Linux. And with the last few years Microsoft has had, it's easy to see why one might want to move away from its software.

For years now, security researchers have been preparing to fight against cryptanalytic attacks from future quantum computers. But Microsoft has had to push up its timeline, as those attacks seem much closer than otherwise anticipated.

As reported by Bleepingcomputer, Microsoft recently published a blog post informing users of its new deadline. Microsoft plans to accelerate its Quantum Safe Program (QSP) to be quantum-apocalypse-ready by 2029.

Microsoft says that post-quantum cryptography "was framed as a future problem: important, inevitable, but distant. That perspective is evolving as technology advances and organizations prepare for the scale and complexity of the transition ahead."

Q-Day (or Y2Q) is the name given to the moment when quantum computers become so powerful that they can crack current encryption techniques with ease. That is what the original timeline was based around. Now, though, Microsoft believes "cryptographically relevant quantum computers could arrive sooner than previously expected—and the work required to prepare is significant so organizations need to start now."

There's also the 'harvest now, decrypt later' method to consider, in which threat actors take in whatever data they can find now in order to analyse and crack the info when quantum-cracking technology comes online. This means that companies are looking to make their data secure from quantum decryption in advance. It's not good enough to be secure now. Companies have to be secure in the future.

Most computers right now encrypt data with algorithms based on mathematical problems that can be easily solved with quantum computers, so post-quantum cryptography is intended to go one layer deeper.

However, even if the work is successful, it is still unproven. We still don't know if a future quantum computer could potentially crack newly made algorithms, partly because… well, we don't have access to future technology. Microsoft argues its QSP goes beyond future cryptography and is only part of a "broader effort to strengthen long-term resilience across identity, infrastructure, data, and supply-chain security."

From here, Microsoft says that customers should make themselves aware of the plan to bring forward this quantum safe timeline and learn more about how to implement it when they do. It seems like the next few years are very important for researchers, and security developers will have to do their best to outpace attackers.

We're continually warned about the prospect of AI-generated malware these days, but there is one important factor working in our favour: sometimes, it's kinda rubbish.

Ox Security researchers have discovered an info-stealing malicious npm package called mouse5212-super-formatter, designed to target Claude users. The nasty little blighter reached 676 downloads before being unmasked, after the apparently AI-coded malware leaked its own GitHub private token (via The Registry).

The researchers say the infostealer posed as an internal "archive deployment sync utility", but in reality, it "authenticates to GitHub (using an environment token or a hard-coded fallback), checks whether a target repository exists, creates it if needed, then recursively walks a local directory and uploads every file through the GitHub Contents API."

The malware then stores stolen files under a random per-run folder name, while also writing a fake network connections log to make "execution look like diagnostics rather than theft."

The GitHub private token allowed the researchers to trace the stolen files and analyse the malware, raising suspicions of AI coding involvement. The threat actor's GitHub account linked to the package has since been deleted.

My favourite part? OX Security has put together a handy chart to show how it all works, labelling its type as "Infostealer/Malware-Slop." Damn.

"While threat actors have been leveraging their techniques in recent years, this is a good example showing how some... are using AI to generate malware without understanding basic opsec concepts and best practices," says the company.

"Now that the bar to create malicious code [has been] reduced significantly, we’re going to see more threat actors getting into the game–uploading more sloppy malwares, mostly mimicking APT groups to get a slice of the cake until npm starts automatically blocking malware completely."

Well, this particularly insecure, err, security risk appears to have been neutralised, and we can all rest easy in our beds tonight. Hey, just be glad we're still in the early days of the AI self-owning age. If things keep developing at the current rate, these stories are going to become a lot less fun as the years go on.

A security researcher going by the GitHub handle Nightmare-Eclipse disclosed a potentially nasty BitLocker bypass in Windows 11 earlier this month. Dubbed YellowKey, the exploit allows an attacker to read the contents of a BitLocker-encrypted drive by abusing standard behavior of the Windows Recovery Environment.

Nightmare-Eclipse adds that, as far as their testing is concerned, the vulnerability only appears to be present in Windows 11. The security researcher describes it as "one of the most insane discoveries I ever found."

This week Microsoft acknowledged the vulnerability, and criticised the public sharing of the YellowKey proof of concept, saying this violates "coordinated vulnerability best practices." The company has since designated the vulnerability CVE-2026-45585, and provided some mitigation guidance, but the BitLocker bypass remains unpatched at time of writing. That said, the fact this attack requires physical access to a targeted device offers some amount of mitigation in itself.

Cybersecurity firm Eclypsium breaks the vulnerability down in a recent blog post, explaining YellowKey works by leveraging the Windows Recovery Environment to "grant a fully unlocked command shell against drives that the operating system continues to treat as encrypted." In theory, all that would be needed to launch the attack would be "a stolen Windows 11 laptop and a USB stick."

The company also elaborates that the vulnerability doesn't appear to be present in Windows 10 because "the responsible WinRE component behaves differently in that codebase." Beyond that, it adds, "The vulnerable filesystems on the attacker-supplied media include NTFS, FAT32, and exFAT, which removes any meaningful constraint on how the payload is staged."

Nightmare-Eclipse theorises the bypass is more of a backdoor. "The component that is responsible for this bug is not present anywhere (even in the internet) except inside WinRE image." They explain, "And what makes it raise suspicions is the fact that the exact same component is also present with the exact same name in a normal Windows installation but without the functionalities that trigger the BitLocker bypass issue."

Microsoft has not confirmed this theory, referring to the issue as "a security feature bypass vulnerability". As you might already suspect, it is far from the only vulnerability uncovered in Windows 11 this year. Just last month, another security researcher warned how the new and improved Recall could be leveraged by bad actors. As if I needed another reason to be wary of AI integration.

It's not just AI features proving a security headache though, with the newest and improv-iest version of Notepad finding itself with a remote code execution vulnerability. At the very least, remote code execution is not something you have to worry about with the YellowKey BitLocker bypass. It's a slim win, but I'm sure someone at Microsoft will take it.

GitHub, arguably the place for developers to store and share code, has been the target of a cyberattack. The Microsoft-owned platform reported on Tuesday that its internal repositories experienced unauthorised access, although it does not appear to have exposed customer information outside of that.

"Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only," GitHub shared most recently on X, "The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far."

The attack reportedly took place via a compromised employee device "involving a poisoned [Visual Studio] Code extension." GitHub did not name the specific developer extension that was leveraged in the breach, nor the attacker. GitHub continues, "We removed the malicious extension version, isolated the endpoint, and began incident response immediately."

Backdoors placed in useful extensions is not a novel route of attack. For example, one bad actor snaffling up 31 WordPress plugins and placing a backdoor in all of them. For another, security researchers claimed last year that 35 Chrome extensions with over 4,000,000 installs 'include some kind of spyware or infostealer'

GitHub's highest-impact credentials have now been rotated, and the platform says it is continuing to keep an eye out for any further unauthorised access. The platform will share a full report on the security incident in the near future.

According to Bleeping Computer, hacker group TeamPCP have since claimed responsibility for the GitHub attack via the Breached cybercrime forum. The group says it's gained access to both GitHub source code, plus over "4,000 repos of private code." However, the cybercriminals' motivations are not so clear cut; the alleged attackers write, "As always this is not a ransom; we do not care about extorting Github."

"One buyer and we shred the data on our end," the group continues, "It looks like our retirement is soon, so if no buyer is found we will leak it [for] free. If you are interested, send your offers to the communications below. We are not interested in under 50k—the best offer will get it."

It's been difficult as a layman in cybersecurity to figure out how seriously we should take all the hype and fear over Anthropic's Claude Mythos AI. But now I have something a little more concrete to grasp onto, as Cloudflare has been busy figuring out exactly what Mythos seems good for.

The AI model recently swept through the cybersecurity industry and caused a stir by showing the magnitude of AI's potential threat to software security—for instance, finding thousands of vulnerabilities in every OS and major web browser. But as a mere plebian sitting far from the techbro classes, and despite banks and other institutions rushing to reckon with it, I'd not been sure exactly how much stock to put behind the stink the AI model was causing. Checking over Cloudflare's analysis earlier today, however, has given me a little bit of a better idea.

The company has been part of Anthropic's Project Glasswing. The idea behind this project (and presumably Mythos in general) seems to be to get in ahead of any bad actors in the AI arms race. It essentially has Anthropic as the 'good guy' that gets companies secured against the latest AI threats to cybersecurity, by using AI to identify the same threats a bad actor might.

Anthropic explains: "Claude Mythos Preview is a general-purpose, unreleased frontier model that reveals a stark fact: AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities… Project Glasswing is an urgent attempt to put these capabilities to work for defensive purposes."

Glasswing gives selected important tech companies access to Mythos Preview to "scan and secure both first-party and open-source systems", with Anthropic giving up to $100 million of credits for them to use. The companies include Amazon Web Services, Apple, Google, Microsoft, Nvidia, and more, including Cloudflare.

It might seem strange to have your cybersecurity strategy raise vulnerabilities to light that bad actors could, in theory, exploit, but that's nothing new: companies often hire 'red teams' to do such things so they can patch them. This is essentially the same idea, but on a whole new scale, given the use of AI.

Overall, Cloudflare is impressed with Mythos, saying it's a "real step forward... not just a refinement of what came before... what changed with Mythos Preview is that a model can now take those low-severity bugs (which would traditionally sit invisible in a backlog) and chain them into a single, more severe exploit."

Two features that Cloudflare says stood out about Mythos during the company's testing were its "exploit chain construction" (ie, its ability to chain vulnerabilities together intelligently into a single attack) and "proof generation" (ie, actually demonstrating that what it comes up with works).

The model isn't perfect, however—would one expect a "preview" to be so? Cloudflare, for instance, found it would sometimes pop up guardrails that didn't make sense, preventing legitimate security research.

The company also seems to suggest that a lot of people have been thinking about Mythos somewhat incorrectly, focusing on how quickly it can find vulnerabilities for quick patching. And it discovered (the hard way) that it's better to use the AI model in a more directed and split-up way rather than just setting one Mythos agent to a big review with hands off.

If you just set it to check out a giant codebase, it might struggle to maintain relevant context throughout the entire process in a way that a human researcher wouldn't. "Using the model directly in a coding agent turns out to be fine for manual investigation when a researcher already has a lead and wants a second pair of eyes. However, it's the wrong tool for achieving high coverage."

The company ultimately found that using Mythos effectively means using a 'harness' that narrows its scope, relying on a second agent to clear signal from noise, and using multiple agents along the chain as well as in parallel. In other words, it seems like having lots of Mythos 'worker' with specific tasks works better than trying to have one super-worker Mythos taking on the entire codebase.

Moving forward, rather than using Mythos solely with a focus on patching faster, Cloudflare thinks people's focus should be on architecture:

"The harder question is what the architecture around the vulnerability should look like. The principle is to make exploitation harder for an attacker even when a bug exists, so that the gap between when a vulnerability is disclosed and when it is patched matters less.

That means defenses that sit in front of the application and block the bug from being reached. It means designing the application so that a flaw in one part of the code cannot give an attacker access to other parts. It means being able to roll out a fix to every place the code is running at the same moment, rather than waiting on individual teams to deploy it."

Exactly how Cloudflare plans to use Mythos in this way is something the company is still keeping close to its chest, but it says it will "share more on what that means for customers in the weeks ahead."

Cloudflare is far from unfamiliar with AI. The company has previously said that "increasingly the distinction between bots and humans is moot", at least when it comes to how websites (which often run through Cloudflare servers) treat users. So I suppose it's no surprise the company is diving into a heavily agentic approach to cybersecurity. Though if Mythos really is as much of a leap ahead as the company is suggesting, it might be a case of 'get to it before your adversaries do'—the AI arms race churns on whether we want it or not.

International police organisation Interpol has announced the arrest of 201 individuals as part of "Operation Ramz", a multinational effort to target phishing operations, malware threats, and "cyber scams" in the Middle East and North Africa region.

The "first of its kind" operation involved the participation of 13 countries and resulted in the seizure of 53 servers alongside the arrests. 3,867 victims of cybercrime were confirmed via nearly 8,000 pieces of data pulled from said servers (via Bleeping Computer).

"In a world where cybercriminals exploit the digital landscape without borders, Operation Ramz demonstrates the effectiveness of global collaboration," said Neal Jetton, Interpol's director of cybercrime.

"Interpol is dedicated to working with its member countries and private sector partners to take down malicious infrastructure, disrupt criminal groups and bring perpetrators to justice.”

The press release highlights several countries involved in the effort, including Qatar, Jordan, Oman, Algeria, and Morocco. In the case of Jordan, Interpol claims that 15 individuals were discovered by police to be running an investment scam that mimicked a legitimate trading platform, but were later determined to be victims of human trafficking.

Interpol says the individuals originated from elsewhere in Asia, but had been recruited under a false promise of employment before having their passports confiscated and being forced to participate in the scheme. Two people accused of orchestrating the fraudulent operation were arrested.

Another deferred method of operation occurred in Qatar, according to Interpol. There, investigators found multiple compromised devices that were being used to spread malicious threats, all while their owners were left completely unaware that their electronics had been hijacked.

Which is a pretty unnerving thought. Us PC users are usually pretty savvy to the idea that our machines need securing against outside threats, but it's important to remember that routers, phones, and other, less-obvious devices can also be vulnerable to attack, often without your knowledge.

Basically, think about security when using any electronic device. None of us want a knock on the door and a chat with the authorities, do we?

Discord has just announced that all voice and video calls that take place on its platform will now enjoy end-to-end encryption.

You may be forgiven for thinking the platform already had this in place, but that's not the case. The platform began 'experimenting' with end-to-end encryption back in 2023, but has only just made it the standard for almost every call.

I say 'almost' because the major exception is voice and video calls taking place on a server's stage channel. Otherwise, for standard server channels, the switch is automatic with no need to opt in. The company says that right now, "every voice and video call on Discord, whether in DMs, group DMs, voice channels, or Go Live streams, is end-to-end encrypted by default."

The vice president of technology at Discord, Mark Smith, dove into some depth about the multi-year process of implementing end-to-end call encryption. Long story short, 2024 saw the introduction of DAVE (no, not that one), Discord's very own encryption protocol. If you'd like to take a closer look at DAVE (still not that one), Discord has made it open-source via GitHub.

Smith explains, "We began migrating calls on desktop and mobile and started proving that E2EE could operate at Discord's scale without compromising the experience people expect from us."

Then in 2025, DAVE was extended to every remaining Discord platform, such as the browser-based app and console-based apps. Smith writes, "At the beginning of March 2026, we completed that migration."

That's the briefest of overviews, but already hints at what a social beast Discord has become, and just how many moving parts this migration had to account for. "The thing that makes Discord's voice and video infrastructure unusual isn't just scale — it's diversity," Mark Smith writes, "A single Discord call can have someone on a laptop, someone on their phone, someone on a PlayStation, someone on an Xbox, and someone in a web browser, all in the same conversation at the same time."

He goes on to add, "Every one of those participants expects Discord’s high-quality, low-latency communications, regardless of what device they're on. Building an E2EE protocol that works seamlessly across all of those surfaces simultaneously is, to my knowledge, unlike anything else that's been shipped. DAVE is likely one of the internet’s most platform-diverse E2EE voice and video implementations."

It's definitely an impressive project that represents a recommitment to user privacy. You may remember that the embattled social platform experienced a lot of pushback over proposed age verification measures, particularly after the potential exposure of 70,000 users' personal data in a data breach last year.

Though the platform has delayed rolling out age checks globally in light of criticism, the platform has already deployed age verification in the UK in accordance with local law there (though critics argue the platform did not need to comply in advance). As a long-time user in the UK, I've managed to avoid these latest checks. All the same, here's hoping that the user privacy win of end-to-end encryption isn't soon undone by poorly implemented age checks in the near future.

Everyone wants your data, so that means everyone would like you to make an account with them. I don't know about you, but more accounts simply means more passwords I'm bound to forget—at least there's multi-factor authentication methods like SMS codes, right? Well, soon that won't be the case for your personal Microsoft account.

Traditionally, codes sent via text to your phone have been deployed as an authentication method when you log in, or as a way to recover your Microsoft account when you inevitably forget your password. Unfortunately for forgetful folks such as myself, Microsoft has chosen to phase out SMS codes in both cases (via Windows Latest).

According to Microsoft, "SMS-based authentication is now a leading source of fraud, and by moving to passwordless accounts, passkeys, and verified email, we're helping you stay ahead of evolving threats while making account access simpler and more seamless."

So, if SMS codes are out and Microsoft truly believes "the future of authentication is passwordless," what does that leave? Primarily, Passkeys. These can take the form of a PIN, but biometric passkeys, like a face or fingerprint scan, avoid the whole 'a sequence of characters you can forget' problem. That said, it requires handing over yet more data that I'm personally reluctant to give up to big tech.

This isn't the first time the company has said it wants to completely ditch traditional passwords. As much as Motorola's 'password pill' captures the imagination, it was far from practical. As such, Microsoft is pitching Passkeys as a faster, "phishing-resistant" way to log in as this method uses your device's local, "built-in authentication (like Face ID, fingerprint, or PIN)."

This makes sense. For a start, SMS codes are displayed in plain text and sent over mobile networks that committed bad actors can fairly easily breach at a distance. On-device authentication cuts out that vulnerable network—though security researchers have already exposed how Windows Recall could be leveraged by bad actors to get around Microsoft's best security intentions, so, as always, it's important to remember that device security should be maintained across the board.

No authentication measure is 100% secure, but limiting a forgetful user's login options is a headache. I would use a password manager like LastPass, but security researchers argue such services are vulnerable to 'a cornucopia of practical attacks', though some of my colleagues swear by them (the two Jacobs swear by BitWarden).

At any rate, you won't be able to get auto-filling from a PWM before you log into the OS. At least if I forget a password, no one has a hope of retrieving it from my grey matter besides me.

You may think getting locked out of your account because you've forgotten the password is annoying, but have you ever gotten locked out and lost almost half a million dollars in the process? That's what happened to X user @cprkrn, when they stored five bitcoin ($402k at the time of writing) in an account in 2015 and forgot how to get back in.

As reported by Tom's Hardware, cprkrn used Anthropic's AI model, Claude, to get access again. After using 'like 7 trillion passwords ', they found a password that happened to be the one before the current one.

Thinking they had no way back in, they reportedly dumped their college computer into Claude, which found an old wallet file that, once decrypted, got them into their account.

This computer had a mnemonic device that they seemingly didn't spot, and Claude put that together with the rest of their account details to get into the account. The LLM didn't hack into the account, or anything so elaborate, it just found the pieces to get into the account, lost in an old computer.

If you're wondering how and why they lost their password for an account that is so valuable, they were apparently "Locked out 11+ years because I got stoned and changed the password."

There's an ironic silver lining here, in that we don't know if cprkm would have held onto the bitcoin so long if they hadn't lost access. According to the account history, 5 bitcoin were purchased on April Fools' Day in 2015. By this point, the cryptocurrency was worth around $245. Now, one bitcoin fetches $60,000. That's a fair jump in value, though it is down from its peak of $90,000 in October, 2025.

Still, cprkrn would have been aware that they had somewhere close to half a million dollars in a locked account for years now. They report that dumping their computer into Claude was their 'last ditch effort' to get the account back.

You may be wondering what they plan on doing with all that cash now that they finally have it back. Their answer? Asking electronic artist and DJ Deadmau5 to play at their wedding. I suppose there are technically worse ways to spend the money.

Hackers aren't known for punching above the belt, but one recent scam feels so devious it's made me even more wary of the next time IT tries to reach out to me. The scam uses hijacked Microsoft Teams account to pose as an IT helpdesk, which then convinces users to download malicious files.

As noted by GBHackers, some versions of this scam use fresh Microsoft Teams accounts to impersonate existing users, but others use accounts gained in this scam to further scam others.

Once contact is established with a user, they are encouraged to access a bespoke chat client, which lends the hack an air of legitimacy.

From here, users are encouraged to run a command via PowerShell that then secretly unpacks a WinPython environment. This is all under the guise of it being a "diagnostic tool". The ModeloRAT can start to infect the PC without any obvious signs of what is even happening.

The hack in question has two separate components to it: one searches for and retrieves data covertly, while the other establishes a connection to a different device. GBHackers notes "Run‑key persistence is still present but is now paired with a scheduled task using a randomly generated name, increasing resiliency and making cleanup harder if only one mechanism is removed."

The goal of the ModeloRAT malware software is to embed itself into corporate environments so that it can do what it likes with all that harvested data. GBHackers reports it "was able to execute without detections from several major endpoint detection and response (EDR) products, and related samples showed zero antivirus hits on VirusTotal at the time of analysis."

This form of social engineering is becoming ever more popular. Just yesterday, I found out about a password-stealing Trojan virus that managed to get into users' PCs with fake job interviews.

Social engineering scams are getting even more sophisticated in the age of AI, too. A few months ago, another scheme was found, where hackers would pose as CEOs with deepfake technology and set up a bogus troubleshooting program to help with technical problems. As you might be able to guess, that troubleshooting program was a virus.

As always, the best defence against hacks and scams is verifying the identity of folks who contact you, especially if they're trying to make you download a dodgy file or click on a suspect link.

Education technology company Instructure has "reached an agreement" with the hacker group that breached its systems for a second time earlier this month. Most recently, hacker group ShinyHunters had exfiltrated hundreds of gigabytes of data from the company's cloud-based learning management system Canvas.

This breach potentially exposed the names, email addresses, and private messages of about 280 million Canvas users. ShinyHunters had threatened to leak this data if Instructure did not make contact before a May 12 deadline, though Instructure now reports that the stolen data has been returned.

The company has additionally received "digital confirmation of data destruction (shred logs)" from ShinyHunters, and the assurance that "no Instructure customers will be extorted as a result of this incident, publicly or otherwise" (via TechCrunch). To date, Instructure has not disclosed the full terms of the agreements—financial or otherwise.

According to the BBC, a previous version of Instructure's security incident update read, "While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible."

Official guidance frequently urges ransomware victims not to pay up. To begin with, one of the FBI's ransomware info pages advises that the bureau "does not support paying a ransom in response to a ransomware attack." The FBI also alluded to the Canvas breach in a post on X last week, writing, "If you are contacted directly by anyone claiming to have your data, we recommend you not send payment or respond to their demands."

Besides the Canvas cyberattack, ShinyHunters has most recently breached Nvidia's GeForce Now—the hacker group claims that it "pulled their entire database straight from the backend." The group also demanded a ransom from GTA 6 studio Rockstar last month, though it was soon revealed that they didn't have all that much to leak in the end.

It has not yet been confirmed if or how much Instructure paid ShinyHunters in order to retrieve its stolen data. At the time of writing, the company's latest security incident update does not explain why the company chose to broker an agreement with the cybercriminal group. That said, Instructure leadership apparently intends to offer some clarity in an upcoming webinar, detailing "information about the cyber attack and our activities to harden the system."

As is ever the case, hackers are a devious old bunch, and this time, they're using your desire to finally get a job to stick a virus on your PC. Ironically named 'JobStealer', one Trojan virus is buried in a fake video conferencing app.

As pointed out by antivirus software Dr.Web, bad actors contact users looking for jobs and invite them to interview via a video conference website intended to look like a real one, which prompts users to download its software.

In many of these cases, the software has connected social media accounts to make it all seem real. Bad actors are also spoofing real sites like Webex to add legitimacy to their attacks. If you happen to get contacted by one of these scammers on Mac, the site will encourage you to even run the virus via the terminal or a disk image file that runs the terminal for you—a clear red flag.

The 'Jobstealer' virus is a pretty involved one that collects data on the system itself, its browser extensions, passwords, notes and more. All that data is then placed in a ZIP archive and uploaded to a server. As is so often the case with viruses right now, this one primarily aims to steal cryptocurrency wallets.

There is currently both a macOS and Windows version of the software available to download. There are also versions for iOS, Android, and Linux, though Dr.Web has not yet seen distribution of the virus on these platforms. Still, their presence indicates that there may be plans to roll the virus out to other platforms in the future. Dr.Web does point out that its antivirus software can get rid of JobStealer, though, so it's at least detectable and removable.

Faking credentials of employers has become a more common hacking tactic in recent times, thanks in part to the prevalence of AI. Earlier this year, researchers spotted a complicated social engineering scam that used deepfakes versions of CEOs to spoof Zoom calls and prompt users to download troubleshooting software to fix software issues. As you may be able to guess, that troubleshooting software is in fact a virus.

As is ever the case, scams that rely on tricking the most desperate are a reliable method for bad actors. Just make sure to double and triple-check the credentials of the next employer who reaches out to you.

If you've ever felt anxious about the security of your machine while you wait for a solution to some vulnerability, a proposed change to the Linux kernel may interest you. Pitched by Nvidia staff Sasha Levin, it's effectively a killswitch that could shut down some functions while waiting for a more official solution.

As spotted by The Information, Levin writes, "Killswitch lets a privileged operator make a chosen kernel function return a fixed value without executing its body, as a temporary mitigation for a security bug while a real fix is being prepared"

Levin notes that when a security issue becomes public, many users of Linux are technically made more vulnerable until the patch is sent out into the world. You would naturally have to stay more vigilant and use the killswitch manually when issues are made known, but it gives some extra agency over your rig. Though the main focus are the commercial users that are most vulnerable, not your everyday Linux user.

Levine continues, "For most users, the cost of 'this socket family stops working for the day' is

much smaller than the cost of running a known vulnerable kernel until the fix lands."

This killswitch was suggested just a week after researchers caught a root exploit called "Copyfail". Effectively, this exploit can escalate user privileges by replacing code, and that user can exploit escalated user privileges to attack machines. Over on the Cybersecurity Reddit, one user says, "That script is stupidly easy to run and gain root."

There was a period of time in between Copyfail being spotted and patches rolling out where users were left more vulnerable than before, and this is the perfect use case for the likes of this killswitch.

It's naturally not the most elegant solution to problems, given it simply shuts down parts of the machine, but that level of granular control could be a good thing, especially in the hands of the already rather granular Linux community.

Not everyone is fully on board with it, though, and understandably so. One Reddit user, with over 100 upvotes, argues it is "Useful as a last-resort mitigation, but scary if people treat it like a patch. Easy to imagine this breaking production in creative ways."

Even more negatively, another argues it's a "security feature that may be worse than the vulnerability."

Some believe the 'nuclear option' is far too extreme, and even when it works, it could incentivise some to simply lock down functions rather than actually patching their machine. And that's before mentioning users could shut down processes they probably shouldn't with it. It seems like the nuclear option could be good or bad, depending on who has the button.

Earlier this week, we reported that a researcher found Microsoft Edge saves passwords in cleartext in the memory of your machine. This means you can seemingly bypass even the likes of 2FA if you have access to someone's rig. At the time, Microsoft said this was 'by design', and it has affirmed the same statement in a correspondence with me.

I've been told, "Safety and security are foundational to Microsoft Edge. Access to browser data as described in the reported scenario would require the device to already be compromised."

This is true. Being able to get into the terminal to find the passwords on Edge does require having admin access on the machine, and that's already a severe breach of your security. However, this technique gets around many security restrictions already in place, should someone get hold of your machine, so it seems like a heightened risk for little reward.

As pointed out by the Internet Storm Center, you can actually get all that information by simply creating a dump memory file of the browser via Task Manager and using strings to search through that dump file for passwords. That means someone could get access in mere moments, with not too much technical know-how.

Tom Jøran Sønstebyseter Rønning, the researcher who drew attention to this, says that Edge is the only Chromium-based browser they've tested that behaves like this.

Microsoft tells me: "Design choices in this area involve balancing performance, usability, and security, and we continue to review it against evolving threats. Browsers access password data in memory to help users sign in quickly and securely—this is an expected feature of the application. We recommend users install the latest security updates and antivirus software to help protect against security threats."

The latest security updates and antivirus software will not protect from this specific problem. Though a user getting admin privilege might seem far-fetched, it's worth noting that many Windows users will simply use their standard account at an administrator level. This means that, should you leave it open in a cafe or even in an office space, one could theoretically nab any passwords on Edge in a short time.

As International Cyber Digest points out, "In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process."

It's never a bad idea to brush up on your cybersecurity knowledge, but this is as good a time as any to remind you to lock down your account if you have to step away. And that's especially true if you are on Microsoft Edge.

Gaming on Linux has never been better—but that doesn't mean your distros are free from security threats. Case in point is a severe vulnerability nicknamed 'Copy Fail,' which allows a local user to dig into the guts of the OS and give themselves root privileges merely by writing four bytes of controlled data into the page cache of any readable file.

The security research team at Theori disclosed the vulnerability last Wednesday, though CISA reports that threat actors have since been observed using the exploit in the wild. The security flaw has been given the designation CVE-2026-31431 and marked with a high severity score of 7.8 (via Bleeping Computer).

This is because Copy Fail could potentially leave a large number of Linux users exposed—if you've not updated your kernel in a hot minute, now would be the time. Theori puts it succinctly in its write-up, summarising, "A single 732-byte Python script can [be used to] obtain root on essentially all Linux distributions shipped since 2017."

As such, CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog. In accordance with 'Binding Operational Directive (BOD) 22-01', this move in turn requires Federal Civilian Executive Branch agencies based throughout the USA to update their systems by May 15 in order to protect their systems against this active threat.

CISA warns, "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise."

Cybersecurity firm Theori also offers a more digestible Copy Fail guide. This includes the security research team's original Proof of Concept script so "defenders can verify their own systems and validate vendor patches." It's worth clarifying that this script requires local access to a machine running Linux, and that the security vulnerability is not an example of remote code execution.

The team found the same script works in Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16, but obviously, plenty of other Linux distros are also affected.

This news follows claims made last week by Canonical—the company that created Ubuntu—that its web infrastructure was under a "sustained, cross-border attack". Though the Copy Fail vulnerability was disclosed by Theori around the same time, the exploit may not be to blame. Canonical has yet to provide an update after its X post on May 1st.

A Norwegian cybersecurity researcher recently spotted that passwords in Microsoft Edge are saved in memory in cleartext. Thus exposing all passwords to anyone that might wish to peek behind the curtain, providing they can gain access to the PC through other means, including a shared admin.

The researcher, Tom Jøran Sønstebyseter Rønning, says, "Edge is the only Chromium‑based browser I’ve tested that behaves this way."

When Rønning reported this to Microsoft, they were reportedly told this behaviour is "by design."

Rønning clarifies that Edge decrypts every credential at startup, regardless of whether you visit a site using those credentials. This doesn't mean that one can simply access those passwords with little know-how, though. A user needs administrative access to a terminal server, which is already a major breach on a computer, but from here, "they can access the memory of all logged‑on user processes."

Importantly, one could have administrative rights on one account and use that to compromise the stored credentials for other logged-in users. Rønning posted an Edge password dumper tool on GitHub that simulates this process.

One could argue that if a user has admin rights, they can already cause havoc on a rig if they have access, and that's true. But something worth considering is that many PC users will have admin rights on their accounts as a default. And even if you have admin rights, you often have to use passwords to get access to password managers, or even use two-factor authentication. Cleartext saved passwords, as argued by International Cyber Digest, means "in shared environments, this turns into a credential harvest."

Last year, researcher @LopezLucio666 reported this to Microsoft, and it said, "after careful investigation, this case has been assessed as not a vulnerability and no security and does not meet Microsoft's bar for immediate servicing."

Chrome, inversely, decrypts credentials when required, so it doesn't keep them decrypted in memory at all times. It binds decryption to an authenticated Chrome process, which means other processes on the machine can't duplicate the process of Chrome's encryption keys.

Microsoft's "password manager security" web page / FAQ does briefly address this point, but argues "Even if an attacker has admin rights or offline access and can get to the locally stored data, the system is designed to prevent the attacker from getting the plaintext passwords of a user who isn't logged in. "

The research of Rønning and others suggests the system is not quite doing its job in preventing attackers from getting those plaintext passwords, so hopefully the noise around its discovery can urge Microsoft to give it another look. We have reached out to Microsoft for comment on this story.

Last week, hacking group ShinyHunters took to a black hat hacking forum to share that it had successfully breached Nvidia's GeForce Now and was looking to sell "millions of real user records" to the highest bidder. However, Nvidia seems to claim that's not quite the case.

As originally spotted by The Cybersec Guru, ShinyHunters claims to have "pulled their entire database straight from the backend" with users' first and last names, email addresses, dates of birth, membership status, 2FA status, and more.

The mention of 2FA status is important here, as bad actors could effectively ignore any account with extra protective measures to get a better hit rate when trying to get access to users' accounts.

However, according to a statement given to VideoCardz from Nvidia:

"Our investigation found no impact to Nvidia-operated services. The issue is limited to systems run by a third-party GeForce Now Alliance partner based in Armenia. We are working closely with the partner to support their investigation and resolution. Impacted users will be notified by GFN.am.”

Nvidia has pointed me to GFN.am's statement (and a translation of it), noting that hackers did not get access to passwords but may have got may have got the following:

• E-mail address
• Telephone number, if registered through a mobile operator
• Date of birth
• Name and surname if logged in through Google
• GFN.AM username

That same statement says, "Following the discovery of the incident, the Society has taken immediate measures to eliminate the causes of unauthorized access, as well as additional organizational and technical measures have been implemented to increase the level of protection of information systems and prevent similar situations in the future."

Unless you live in Armenia and have an account through Nvidia's Armenian GeForce Now provider (GFN.am), you are unlikely to be affected by the breach, but Armenian users should keep an eye on the site and activate 2FA at a minimum.

This unfortunately does not necessarily account for users who no longer subscribe to the service, so hopefully they will get other forms of communication too.

Still, even after all of this is done, ShinyHunters claims it has a list of email addresses, so it's worth being extra vigilant of phishing and spam emails going forward.

If the name ShinyHunters is familiar to you, there's a good chance it is because, just last month, it demanded a ransom for Rockstar in regard to data it managed to steal.

After Rockstar refused to pay the fee, ShinyHunters revealed the data, and our Andy Chalk reckons Rockstar was right not to pay. We don't know what processes Nvidia will implement from here, but here's hoping its providers continue to brush up on their cybersecurity.

Canonical, the company behind the most popular Linux distro, says its web infrastructure is currently under a "sustained, cross-border attack."

Affected sites and services seem to run across the entire Ubuntu gamut, from its website to its blog and even potentially its repos. According to what user reports I could gleam from online forums—given official status pages are down—the problems have been ongoing for hours even if Canonical only officially commented on it recently.

Importantly, there are reports of the security repo servers at security.ubuntu.com being either slow or down for many users, and indeed when I tried the website it didn't load. Repositories are how Ubuntu users get their updates, and the security repo is, of course, a very important one, as it allows users to download and install important security updates and patches. It is worth noting, however, that updates should still be able to be installed from different mirror repos, which you can choose by selecting one in the 'Download from' dropdown in the Software & Updates tool.

Even the page that lists server statuses is disabled by Canonical. It instead reiterates the same message that Canonical posted to X.

All this follows the disclosure yesterday of a recently discovered vulnerability nicknamed "Copy Fail" which cybersecurity research firm Theori, on Xint.io, explains as meaning the discovery that a "single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017."

It's not known, however, whether this vulnerability has anything to do with the current attack. In fact, Canonical saying that it's a "sustained, cross-border attack" could imply it's not vulnerability-related attack but simply a wide-scale DDoS or something similar. If it is to do with Copy Fail, then perhaps it's only indirectly so—possibly to attempt to prevent some from installing updates that fix the vulnerability.

Cybersecurity company Vercert Analyzer claims that hacktivist group 'The Islamic Cyber ​​Resistance in Iraq – 313 Team' has claimed responsibility for the attack(s) and has sent an extortion message to the Ubuntu team. Though we can't confirm this ourselves and will be waiting for more word from Canonical itself.

Just a month after the FCC banned foreign consumer-grade routers that lack the special permissions to be sold, the Cybersecurity and Infrastructure Security Agency (CISA), along with the National Cyber Security Centre (NCSC-UK) and other security orgs, has advised users of their risks. Compromised home routers, it seems, are the new cybersecurity bugbears.

This is because, as CISA puts it: "Over the past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use of externally provisioned, large-scale networks of compromised devices."

'Covert networks' have supposedly been used "for each phase of their Cyber Kill Chains, from performing scans as part of reconnaissance, to the delivery of malware, communicating with said malware, and exfiltrating stolen data from a victim."

The attackers will exploit vulnerable devices, including home routers, and then sit there, using them as little nodes in their broader covert network infrastructure.

"Covert networks mostly consist of compromised SOHO routers, but they also pull in any vulnerable device they can exploit at scale" says the CISA report. Examples include webcams, firewalls, and NAS devices. If they're end-of-life (EOL) and not receiving security updates, the risk increases.

"If a particular threat group could now come from one of many covert networks," CISA says, "each with potentially hundreds of thousands of endpoints, and each used by multiple threat actors, old network defense paradigms of static malicious IP block lists will be less effective."

"A description of all known covert networks in detail, including how they are constructed and how they communicate, would immediately be out of date."

Last month, the US Federal Communications Commission (FCC) added "all consumer-grade routers produced in foreign countries" to the Covered List, meaning they'll require special permission to be sold in the US. Which, of course, does nothing to solve any compromised routers that are already sitting in homes and offices around the country.

Firmware security company Eclypsium says that, with this and now the CISA advisory, "the message is clear: the SOHO router supply chain is being framed as a meaningful source of cyber risk to U.S. critical infrastructure"

However, Eclypsium says that this is "only part of the picture... a router ban can reduce some risk at the edges. It does not fundamentally change the attacker playbook."

The most important thing, according to Eclypsium, is "defending the enterprise edge of critical infrastructure companies", and one of the biggest gaps on this front is a "lack of device integrity visibility", meaning device trust should be "continuously re-established, not assumed."

In other words, repeated security validation for devices across its entire lifespan. We need to be "continuously validating what is already inside the organization’s walls."

CISA recommends "active hunting" for the most at-risk organisations, sniffing out IP addresses that are likely part of a covert network, and to generally act more dynamically and actively to keep defenses shored up. For organisations that aren't quite as at risk, but still somewhat so, the agency advises things like zero-trust connection policies and IP address allow lists rather than deny lists for remote work.

For organisations that aren't at risk, however, recommendations are broadly what should already be expected, such as understanding what connections you should be seeing and implementing multi-factor authentication.

There are also some more general recommendations, and you probably won't be surprised to see that these include keeping devices up to date and using modern systems and software. For the home user, just ensuring your device is still live and receiving security updates is, as always, the way to go. I wouldn't fancy being a larger organisation having to do much more to deal with these "covert networks", though.

Rather than juggling way too many tabs in Chrome, I sweep them all into OneTab and promptly forget about them—extensions and plugins are great. If I still had my own blog, I'd probably use them for all sorts of things, but third-party platform add-ons also represent a security concern.

It's important to double-check the provenance of anything you're considering adding, though I suspect few attackers will be quite as ambitious as the person who bought 30 WordPress plugins and then installed backdoors in all of them.

That's according to Austin Ginder, the founder of Anchor Hosting. He began to investigate after noticing the previously dormant Countdown Timer Ultimate had begun pushing out malicious code. A number of the affected plugins have since been taken offline (via TechCrunch).

Countdown Timer Ultimate was originally built by a team called Essential Plugin. Due to a decline in revenue, the founders sold their entire business on Flippa, a private marketplace for buying and selling online outfits like Essential Plugin. The platform itself shared a case study on the six-figure sale in 2025. According to Ginder's timeline, the new owner allegedly planted the backdoor barely a month after that glowing post went up on Flippa.

The backdoor wasn't weaponised until about April 5, 2026, according to the blog, with the WordPress plugins team moving to shut down all 31 of Essential Plugin's offerings. Quick action is definitely welcome in a situation like this, but Ginder criticises the fact that no users would have suspected anything was up until the attack began.

He writes, "WordPress.org has no mechanism to flag or review plugin ownership transfers. There is no 'change of control' notification to users. No additional code review triggered by a new committer."

Worse still, Ginder reports this sort of hijack is not uncommon. Ginder shares one story from 2017 where someone "purchased the Display Widgets plugin (200,000 installs) for $15,000 and injected payday loan spam." He also shares another story from earlier this very month, where someone launched a supply chain attack via the previously trusted Widget Logic WordPress plugin.

For context, the Essential plugin team's website is still live, touting "15,000+ Global Happy Customers." That's a lot of users who could have been potentially affected—how many of them would have no idea until either WordPress took the plugins down, or they independently stumbled across news coverage of the polluted plugins themselves? It's hard not to see Ginder's argument.

When you create anything, whether that be software or a short story about two characters that never meet, there's no telling what a fresh pair of eyes will bring to the work. Once a work breaches containment, your adoring audience may reward you with a short work of fanfiction—or make you kick yourself by immediately sniffing out a zero-day exploit. Well, Firefox claims that thanks to AI, 'the zero-days are numbered.'

Firefox teamed up with Anthropic’s Frontier Red Team earlier this year to leverage AI tools in finding and securing zero-day exploits before they have a chance to be unearthed in the real world. As part of that collaboration, Mozilla recently applied an early version of Claude Mythos to the Firefox bug hunt.

The bot found 271 vulnerabilities, which the browser team were then able to fix and ship as part of Firefox 150. Coupled with reports of Claude Mythos finding thousands of vulnerabilities in 'every major operating system and every major web browser, along with a range of other important pieces of software' earlier this month, this could be a security game-changer.

Firefox CTO Bobby Holley is quick to note that none of the bugs found by Claude Mythos "couldn’t have been found by an elite human researcher," but also highlights that much of security is a battle fought "to a draw."

"Vendors of critical internet-exposed software like Firefox take security extremely seriously and have teams of people who get out of bed every morning thinking about how to keep users safe," he explains, "Nevertheless, we’ve all long quietly acknowledged that bringing exploits to zero was an unrealistic goal."

This is largely because it can be so time-consuming for even a team of 'elite human researchers' to pore over source code and look for exploits. Holley reflects on the sense of 'vertigo' these sorts of AI-assisted findings brought up for the browser team, sharing, "Just one such bug would have been red-alert in 2025, and so many at once makes you stop to wonder whether it’s even possible to keep up."

But ultimately, Holley is hopeful for the future of security supported by AI assistance: "Our work isn’t finished, but we’ve turned the corner and can glimpse a future much better than just keeping up. Defenders finally have a chance to win, decisively."

I've said it before, and I'll say it again: I'm really not keen on handing over any of my personally identifying details to a third-party age verification vendor. Whether it be a scan of my face, my official ID, or my payment card, I'd rather not engage with yet another potential point of failure for my data to leak out from. Unfortunately, we are rapidly approaching a widely age-gated internet.

As such, the European Commission has been working on developing an app to use across online services in EU member states. EC president Ursula von der Leyen recently stated that this age verification app is "technically ready" and will "soon [be] available for citizens to use." A demo of the Android app is available via GitHub—though security researchers claim they were able to bypass the security practices of this version in under two minutes (via SOFX).

UK-based security consultant Paul Moore took to X to demonstrate just how easy it is to steal the contents of someone else's 'identity wallet' and present it as your own. Moore tagged von der Leyen in his post, before writing, "This product will be the catalyst for an enormous breach at some point. It's just a matter of time."

The app currently requires users to input a six-digit PIN. However, Moore's screen recording demonstrates you can easily scrub a user's previous PIN from the app’s eudi-wallet.xml configuration file, set a fresh PIN via the app, and then use that to gain access to the verified credentials saved to the device. This bypass could be used by bad actors—or the youngsters in your life who know how to unlock your phone and possess enough technical know-how to find the .xml in question.

The European Commission clarified to Politico last week that this exploit was present in the demo version, but that the bypass would not be present in the full release. Digital spokesperson Thomas Regnier introduced some wiggle room, explaining, "When we say it's a final version, it's still a demo version...the code will be constantly updated and improved."

The whole episode follows a joint statement from 400 security researchers sent to the European Commission last month. This statement raised a number of concerns, including how easy it is to bypass existing age estimation services (our James has written about two different methods).

Still, chief spokesperson Paula Pinho stood by President von der Leyen's original statement, telling reporters, "Yes, [the final version of the app] is ready. Maybe we can add, 'and it can always be improved'." So it often goes in software development—but given the app in question is the result of a €4 million tender, that's going to be little comfort to grumpy guts like me or folks who genuinely just want to keep their kids safe online.

Though the world of hacking is only getting more and more advanced, some exploits have seemingly stuck around unchanged for years. Originally filed back in February 2009, one curious vulnerability has caught the eyes of the US government.

Published in a report this week by the American Cybersecurity and Infrastructure Security Agency (CISA), a 17-year-old exploit in Microsoft Office has been flagged as being actively exploited by threat actors (via The Register). The specifics on how to do this exploit have not been shared, but the record was last updated in 2018, implying some new information was found almost a decade after it was first spotted.

It seemingly allows remote attacks to execute code via a specifically crafted Excel document. In its first outing, this attack was used to install a Trojan dropper on a device, which would then inject further malware. The ability to upload nefarious software remotely is naturally a rather dangerous exploit.

This exploit has a severity score of 8.8, which is very high. However, that does not automatically mean it was super popular or common: the rating is a measure of how severe the consequences of an exploit are, paired with factors like ease-of-use. But even so, a score this high means bad news.

The reason it was added to CISA's list of vulnerabilities is that it is now considered active, which implies some threat actor, or group of threat actors, has managed to use the same method today. Microsoft did patch the problem back when it first showed up, but CISA has given it two weeks to patch it once more.

Alongside this, CISA has also flagged up a brand new exploit which uses Microsoft Office SharePoint to "perform spoofing over a network." This one is less severe, at a score of 6.5, though it is considered active and is even automatable. This means the likes of AI agents can do this exploit en masse.

AI is a major proponent of the growth of cybercrimes, with it being a focal point of the nearly $21 billion lost to cybercrime scams last year. Not only have we seen AI used in the research of scams and the automation of them, but we've also seen some rather devious schemes with it, including deepfaking CEOs to prompt users to troubleshoot, only for the troubleshooting program to contain nasty files.

Just because the world is adopting AI into every approach doesn't mean that threat actors won't pull out the classics when they seemingly work so well. Some things never change.

If you click on almost any major website, you'll surely have notice that you get asked about cookies. These files store your preferences and help companies track your data. However, it turns out that even if you decline to use them, there's a good chance you're still being tracked.

A recent audit from webXray has found that "major technology companies simply ignore globally defined opt-out signals" (via TechSpot). The report states that it observed 194 online advertising services ignore standard opt-out services, plus cookie banners certified by Google that reportedly "fail to prevent Google from setting cookies after users opt out with a globally standard signal."

webXray studied 242 ad tech vendors in total, which means an 80% failure rate to adequately opt-out users, according to the report.

The analysis shows that 55% of sites set ad cookies despite users opting out, and 78% of cookie banners failed to protect their users. It argues that companies' liability exposure racks up to a whopping $5.8 Billion.

webXray has examined Google's own cookie system and reckons that when it sends an encoded cookie, it then reportedly responds by creating a new advertising cookie named IDE. The report says, "This non-compliance is easy to spot, hiding in plain sight," and makes the case that Google should instead respond to encrypted cookies with a 451 code, stating "unavailable for legal reasons." webXray states that Google failed to adequately opt-out users in 86% of cookies, with over 11,000 cookies set, despite user preferences.

Microsoft and Meta are also highlighted in the report. It's claimed that both companies fail to adequately respect cookie opt-out requests. It states Microsoft creates a new MUID cookie, even when sent an encoded one, and reports it failing to opt-out users in 50% of attempts. This means that over 7,500 cookies were sent, despite opting out.

The report argues Meta's Pixel tracking code fails to check for opt-out signals, with it getting a 59% opt-out failure rate in testing. That works out to over 1,200 cookies set despite opting out.

webXray concludes that cookies are now a "legal minefield that puts users at risk", and one can hope the worry of legal fees and other penalties will eventually correct the problem.

Remember Windows Recall? The AI feature that essentially screenshots nearly everything you do on your PC in order to present users with a timeline of activity they can rewind back through? It was meant to be available on Copilot+ AI PCs from June 2024 but got, ahem, recalled a number of times amid cybersecurity concerns. The feature has since been redesigned, but security researchers are raising the alarm again.

Windows Insiders have had access to the redesigned Recall since last year, but allegedly the more things change, the more they stay the same. Case in point, after already breaking the original Recall, security researcher Alexander Hagenah has created another tool that can expose the refreshed Recall's various vulnerabilities by extracting and displaying the data it captures (via The Verge).

Microsoft previously described Recall's security model in a September 2024 blog post, sharing, "Recall snapshots and associated data are protected by secure VBS Enclaves." Basically, all of that potentially sensitive data is meant to be cordoned off in a "locked box that can only be accessed after permission is granted by the user through Windows Hello."

Unfortunately, Hagenah says, "My research shows that the vault is real, but the trust boundary ends too early.”

Hagenah's tool is called TotalRecall Reloaded, but how does it work? Very simply, it will camp out quietly in the background of your desktop, and then ride the coat tails of your access to the Recall timeline when you next open the 'locked box' via a Windows Hello prompt. From there, TotalRecall Reloaded can reportedly snaffle the contents of the entire vault like a hydrocolloid bandage on a zit.

Microsoft wrote back in 2024 that asking users for biometric credentials each time they want to access Recall would restrict "attempts by latent malware trying to ’ride along’ with a user authentication to steal data." Unfortunately, Hagenah says his tool creates "precisely the scenario Microsoft’s architecture is supposed to restrict."

As such, Hagenah claims he responsibly disclosed his security research to Microsoft last month—but this leads me to perhaps the most infuriating twist in this tale. According to Hagenah, Microsoft told him that what he found was 'not a vulnerability'.

In a statement to The Verge, Microsoft Security's corporate vice president David Weston said, "We appreciate Alexander Hagenah for identifying and responsibly reporting this issue. After careful investigation, we determined that the access patterns demonstrated are consistent with intended protections and existing controls, and do not represent a bypass of a security boundary or unauthorized access to data. The authorization period has a timeout and anti-hammering protection that limit the impact of malicious queries.”

Given that Recall can hoard everything from browsing history, to whatever text may have crossed your screen in the form of emails, private messages, and so on, it may be difficult to understand Microsoft's stance here. Though in its view, this doesn't qualify as a vulnerability.

At the risk of over-simplifying, TotalRecall Reloaded isn't forcing Windows to do anything it doesn't already do, and a fully fledged fix would likely involve overhauling the OS's foundations. Microsoft is also hoping that prompting for biometric credentials every time a user wants to use Recall will curtail malicious activity.

To Microsoft's credit, Hagenah did praise Recall's "rock solid" VBS Enclave—though the issue isn't that the 'locked box' has a dodgy door. “The fundamental problem isn’t the crypto, the enclave, the authentication, or the PPL. It’s sending decrypted content to an unprotected process for rendering," Hagenah says, "The vault door is titanium. The wall next to it is drywall.”

There are lots of great software tools out there that can tell you all kinds of things about your gaming PC, and perhaps two of the most well-known by enthusiasts are CPU-Z and HWMonitor. However, two sharp-eyed Redditors spotted that while everything seems all normal on the official download page, the links will give you files that are anything but official.

Reddit users DMkiIIer and OthoAi5657 posted their discovery just a few hours ago, and the findings have been confirmed by vx-underground on X.

In short, what look like normal download links for CPU-Z and HWMonitor, producing seemingly correct files, appear to result in your getting a file with an altered name, Russian setup language, and a different wrapper for the installation screen.

Oh, and an immediate warning from anti-virus software.

Adding to the confusion is that, instead of getting something like 'hwmonitor_1.63.exe' as your download, the file is labelled 'HWiNFO_Monitor_Setup.exe'. This has led some people to report on social media that HWInfo has been affected by malware, but this is absolutely not the case.

While I haven't used HWMonitor in a long time, I do fire up CPU-Z quite often when I'm hardware testing. For example, if I want to check what BIOS version a motherboard sample is sporting, CPU-Z can tell me that within a matter of seconds. Admittedly, so can HWInfo, it's just that the program takes longer to get going than CPU-Z does.

Worryingly, this is no simple hijack of CPUID, either. According to vx-underground, "This is not your typical run-of-the-mill malware. This malware is deeply trojanized, distributes from a compromised domain, performs file masquerading, is multi-staged, operates (almost) entirely in-memory, and uses some interesting methods to evade EDRs and/or AVs such as proxying NTDLL functionality from a .NET assembly."

"This is the same Threat Group who was masquerading FileZilla in early March, 2026. They've been busy."

The hack vx-underground is referring to was subtle but also very devious, though it's certainly not the only instance of FileZilla (an FTP client) being the target for malware. As to who's behind all of this, that's not certain at all, but if it is indeed the same group that targeted CPUID and FileZilla, then other popular PC software tools could well be next.

Your best defence in all of this is to use a good anti-virus/malware package, keep it regularly updated, and make sure you scan any programs or compressed files that you download. In the case of common software tools, you can also try downloading several copies, from different sources, and comparing the file names, sizes, and digital signatures. If they're all legitimate, they will be identical in every respect.

Earlier this year, dark web hackers claimed to have exfiltrated a huge amount of data from the National Supercomputing Center (NSCC) in Tianjin, China. The hacker group FlamingChina claims that it stole 10 petabytes of data pertaining to advanced science and defence agencies within China. However, a number of security researchers have since cast doubt on the leak's legitimacy.

As far as I can tell, NetAskari was the first to bring the data leak to wider attention back in February 2026 via X, before further delving into a sample of the leaked files on their SubStack.

According to them, a dark web forum user going by the handle 'airborneshark1' initially offered a sample of the full leak for $3,000 USD (in cryptocurrency, of course), before offering up all 10 petabytes to the highest bidder.

NetAskari was able to obtain a multi-gigabyte sample of the allegedly stolen data. This includes screenshots of the internal system directory layout and user credentials as supporting evidence that some kind of hack did take place.

Beyond that, this sample also included PDFs of reports and handbooks, radar test data, and physics simulation renderings depicting "the effect of payloads and weapon systems against certain targets and materials."

China's NSCC undertakes supercomputing tasks from about 6,000 clients, potentially explaining the breadth of files.

CNN has since picked up the story, reaching out to China’s Ministry of Science and Technology as well as the Cyberspace Administration of China for comment. At the time of writing, there has been no official comment on the data breach. That could be for a number of security reasons, but there's also a chance that this leak is simply not legitimate.

For instance, security researcher and malware archivist Vx-underground expressed their scepticism via X, writing, "Something about this story is very strange to me. I've been doing cybersecurity stuff for a long, long time [...] I have not seen the moniker 'FlamingChina' before."

NetAskari notes that the hacker group FlamingChina has had a Telegram channel since at least February 5. That said, they also say this is less likely a permanent 'base of operations', so to speak and more likely just a short-term alias.

They also write that getting 10 petabytes out of any high-security facility without being noticed over months and months would be quite a feat if it were legitimate. "Did they truly get 10 PB!? We don't know. To extract such an amount of data means, you have to be lodged in the system over a longer period of time," NetAskari writes.

"Most likely with the help of someone from the inside. Even if the cyber security is a little bit shoddy, eventually someone probably would notice a constant data extraction process of this size."

CNN posits a botnet-based approach that could have distributed the extraction of data across many sources simultaneously, thereby making such an attack difficult to trace.

Vx-underground is more intrigued about the practicalities of holding on to all of that data. "I'm also very curious [about] the 10 PETABYTES of data exfiltrated because [that] is an unfathomable number," they write, "10PB is 10,000 TB. Even in cold storage that's roughly $43,000/month. If it's 'hot storage' you're looking at something like, $150,000/month, that doesn't even include the fees for moving the data which would be ASTRONOMICAL."

CNN itself reached out to a number of experts to speak to the authenticity of the leak's contents, including Dakota Cary. A consultant at SentinelOne, a cybersecurity firm focusing on China, Cary told CNN that the leak's contents were what he would expect given the alleged source, elaborating, "You would use supercomputer centers for large computational tasks. The swath of samples that the sellers put out kind of really speaks to the breadth of customers that this supercomputing center had."

That doesn't sound like the most damning evidence to me. Cary also went on to share that China has had "really poor cybersecurity for a very long time across a wide number of industries and organizations." He went on to tell CNN, "If you look at what Chinese policymakers say themselves, cybersecurity in China has not been good. They would say it’s still improving at this point in time."