All Issues
129 issues published
North Korea Walks Off With $387 Million
North Korean hackers have stolen $387 million from crypto exchange Bitget, with the company's User Protection Fund stepping in to cover affected users. A newly disclosed flaw in Roundcube webmail is being actively exploited in the wild — patch now if you run a server. Senators Warner and Cruz have introduced a bipartisan bill on telecom cybersecurity standards, though whether "voluntary" is enough remains an open question.
AI Helped Scammers Hit 12,000 Accounts
Microsoft took down a subscription-based fraud platform that used an AI chatbot to compromise 12,000 email accounts across 10,000 organisations worldwide. Google is rolling out a Pixel 11 feature that lets Gemini make phone calls on your behalf, and the company has also detailed how it plans to keep your AI memory private in the cloud. If you use the OpenAI API, there are new tools to make your GPT-6 agents faster and cheaper to run.
A Security Firm Got Breached By Its Own Ex-Employee
CrowdSec, a French cybersecurity company, lost 170 private GitHub repositories after attackers exploited an access token belonging to a former employee who was never fully offboarded. AI chatbots including ChatGPT and Gemini are being fed fake support numbers and phishing pages by a coordinated poisoning campaign affecting over 370 companies. Meanwhile, a critical F5 BIG-IP vulnerability is being actively exploited in the wild — patch today if you run it.
California Makes Data Centers Pay Their Own Bills
California has signed seven new laws forcing AI data centers to cover the cost of the energy and water infrastructure they use, rather than passing those costs to residents. Hugging Face's model library (a platform where AI models are publicly shared and downloaded) is now directly supported by the Transformers software library, making it much easier to run capable AI models on a personal laptop. A UN scientific panel is warning that governments should start regulating powerful AI systems now, even before the full risks are understood.
German University Breach Exposes 52,000 Students
A cyberattack on one of Germany's largest universities has put student bank details, health insurance numbers, and financial aid records at risk. A newly discovered Android trojan is using AI to navigate your phone in real time — and it can reinstall itself even after you delete it. Google has been fined $463 million for mishandling location data, a reminder that your privacy settings are worth a look today.
OpenAI Knew It Was Breaking the Web
Court documents in the New York Times lawsuit reveal OpenAI and Microsoft's own internal records described their training practices as "the largest theft of labor in human history" and warned they were creating a "doom loop" that would damage the web. A new study finds that AI watermarking can accidentally make safety guardrails easier to bypass. California's governor has signed an executive order pushing for mandatory AI kill switches and incident reporting requirements.
23 Million Gyazo Records Hit in Server Attack
A hacker broke into Gyazo's servers and walked off with 23 million user records, plus metadata for nearly half a billion images. An AI agent was used to breach a Spanish organisation's data systems — and it did the job faster than any human attacker could have. A critical unpatched vulnerability in workflow software has been actively exploited since August; if your team runs Orkes Conductor, this one needs attention today.
AI's Hidden Trash Problem Is Bigger Than Anyone Thought
By 2050, AI infrastructure could generate enough e-waste to fill 23 million shipping containers — and most of it will never be properly recycled. Google is opening your smart home to third-party AI agents, which is either exciting or alarming depending on how you feel about Claude knowing when your laundry is done. OpenAI has published a formal framework for disclosing when its models behave in ways they shouldn't, and the EU has proposed a law blocking under-15s from creating their own social media accounts.
610,000 Roblox Accounts Sold for Pocket Change
Three Ukrainians face trial for stealing and selling 610,000 Roblox accounts using hijacked session cookies. A critical flaw in a popular WordPress events plugin leaves over 200,000 sites open to full takeover — update the plugin now if you run one. Plus: a new browser AI attack technique, a fake CAPTCHA scam making the rounds, and the EU proposing an emergency cyber response mechanism.
Big Tech's AI Slowdown: Safety Pact or Cartel?
Google is rolling out two new voice AI models with advanced reasoning capabilities and built-in watermarking, starting today for developers and API users. Meanwhile, the biggest story in AI right now is a loose agreement between the industry's most powerful CEOs to slow down development — and nobody can quite agree whether that's responsible leadership or self-serving market control. If you use AI agents for anything that matters, there's also new research showing those agents are far less consistent than their headline accuracy numbers suggest.