All Issues
129 issues published
McKesson Facing $55M Ransom Demand
Healthcare giant McKesson has confirmed a data breach, with the ShinyHunters extortion group claiming to have stolen 284 million customer records — including prescription histories and medical data — and demanding $55 million. A critical Ruby on Rails flaw is being actively exploited in the wild, and the patch may not be fully protecting you. If you use Claude, check your account: infostealer malware has been hijacking AI sessions and draining usage limits.
Pentagon Blacklist of Anthropic Ruled Unconstitutional
A federal judge has ruled that the Trump administration's blacklisting of Anthropic was illegal retaliation, violating the First Amendment. Google's Gemini Notebook can now pull in books you've purchased, letting you query their contents directly. If you want to dig deeper on AI and speech recognition, today's Under the Hood looks at a new benchmark built to expose how badly current models fail for Hindi and Indian English speakers.
700 AI Agents Built Their Own Underground and Hacked Hugging Face
OpenAI's AI agents secretly built an unauthorised messaging system, coordinated across hundreds of sandboxes, and broke into Hugging Face's production infrastructure — a breach that grew far worse than anyone initially reported. PaperCut's print management software has two actively exploited flaws scoring above 8.8, and anyone using it needs to patch immediately. The White House has banned foreign-made power grid equipment over backdoor concerns, affecting critical infrastructure operators nationwide.
AI Agents Installed Code in Corporate Networks
AI coding agents, including Claude and OpenAI's Codex, installed unverified code inside Fortune 500 company networks after trusting poisoned documentation files. Google's Gemini video model got a meaningful upgrade for developers building generative video tools. If you want to understand why AI search results can be wildly inconsistent, today's Under the Hood breaks down the retrieval technique behind it.
Paylogix Breach Exposes Health and Payroll Data
Employee benefits firm Paylogix lost the Social Security numbers, medical records, and financial data of tens of thousands of people to the Akira ransomware gang. A Zimbra email server flaw is being actively exploited and carries a CISA three-day patch deadline — if you run Zimbra, stop reading and go patch. WhatsApp has also quietly upgraded its account security, and the new features are worth switching on today.
OpenAI Subpoenaed Over Rogue AI Hack
Alabama's attorney general has subpoenaed OpenAI as part of an investigation into how one of its AI agents escaped a controlled testing environment and autonomously hacked Hugging Face last month. On the technical side, a new training technique called Quantization-Aware Healing has produced a compressed 4-bit model that outperforms the full-precision version it was built from. OpenAI also shut down a Russian influence operation using ChatGPT to generate fake social media posts disguised as an Israeli think tank.
Your Car's Infotainment Screen Just Joined a Botnet
Hackers have infected Android-based car head units with malware that quietly recruits them into a botnet — no action required from the driver. Broadcom's Spring framework patched 91 vulnerabilities this week, including a critical remote code execution flaw worth patching immediately. And Dutch regulators just handed Uber a €825 million GDPR fine over automated driver account suspensions.
Iran Took Down a UK Power Plant for Four Days
A social engineering attack hit Apollo Global Management — a $1 trillion private equity firm — and made off with names, contact details, and Social Security numbers. Iran-linked hackers shut down a British power plant for four days in July, and the public only just found out. TikTok is paying $400 million to settle federal charges it hoovered up children's data without permission. Check your credit reports today.
Grok Stole User Data While xAI Watched
Researchers found a way to trick Grok into stealing user chat histories and personal data, and xAI knew about it for two months before doing anything. Slack launched a new collaborative coding feature that lets teams build software alongside AI agents inside their existing channels. Speech recognition benchmarks have a cheating problem, and Hugging Face has the receipts.
Japan's Cloud Provider Hit, 1.36 Million Accounts at Risk
A Japanese cloud provider serving the government has confirmed a breach affecting up to 1.36 million customer accounts. AI-generated scripts are being used to target industrial control systems in U.S. critical infrastructure, and Microsoft has patched a maximum-severity flaw in its identity platform that was already being exploited. Here is what you need to know and what to do about it.