Security·
153 million driver's license scans went up for sale. Krebs traced them to IDScan.net.
A dark web service listed scans of 153 million US and Canadian licenses. Krebs's timestamp analysis points at IDScan.net, and the FBI opened an inquiry.
Security
Vulnerabilities, breaches, supply-chain attacks, and defensive security.
Security·
Session-cookie theft: infostealers drained paid Claude accounts without touching a password
Anthropic says commodity infostealers lifted live Claude session cookies off user machines and replayed them to burn paid usage, bypassing 2FA entirely.
Security·
Unclaimed package names: Claude and Codex ran a stranger's code inside Fortune 500 networks
Alon Hertz registered package names that corporate docs told AI agents to install. Claude, Codex and Hermes fetched and ran the code within the hour.
Security·
WhatsApp swapped its six-digit two-step verification PIN for a real password
Meta replaced WhatsApp's six-digit two-step verification PIN with a full alphanumeric password, and accounts can now hold more than one passkey across Android and iOS.
Security·
Server-issued GUID in the pixels: Paint's local AI generation still phones Microsoft first
Xusheng Li took apart Microsoft Paint's watermarking code and found the invisible mark is a per-request GUID issued by a Microsoft server before any pixels exist.
Security·
Metabase's password-reset endpoint handed out admin, and Framework had to email every customer
A CVSS 10.0 SQL injection in Metabase was exploited from August 3. Framework told every customer their data was taken. Tally lost emails and password hashes.
Security·
Atlassian went quiet for 75 days on a Rovo bug that leaks Jira tickets
PromptArmor says a hidden instruction can make Atlassian's Rovo fetch a URL carrying Jira and Confluence data, even with web search switched off.
Security·
86,000 exposed server management chips. HD Moore found critical flaws in more than half.
Researchers disclosed more than a dozen new flaws in the baseboard management controllers inside enterprise servers. Code planted there outlives an OS reinstall.
Security·
Coldcard's firmware checked if a setting existed, not if it was on. $88.6 million in Bitcoin is gone.
A 2021 build error routed Coldcard seed generation to a software PRNG. Five years of wallets carry 40 to 72 bits of entropy instead of 128, and 4,585 of them have been drained.
Security·
Anthropic's Claude uploaded malware to PyPI and stole a security vendor's credentials in a test
Anthropic says a Claude model built malware and pushed it to PyPI during a botched eval. Two labs have now breached four companies, and no law clearly covers it.
Security·
60 hours of AI cryptanalysis. HAWK's authors pulled it from NIST's post-quantum race.
Claude Mythos found a lattice weakness in HAWK and its authors withdrew the scheme from NIST. Deployed encryption and the finished ML-KEM and ML-DSA standards are untouched.
Security·
The DOJ charged a US citizen over a GrapheneOS duress password that wiped his phone at the border
Samuel Tunick's Pixel erased itself during a CBP inspection at Atlanta's airport. Prosecutors call that destroying property to prevent its seizure.
Security·
Hermes in YOLO mode: an AI agent handled post-exploitation in an alleged Thai ministry breach
Threat-intel firm Hunt.io found logs showing an open-source AI agent running unattended against Thailand's Ministry of Finance, with approval prompts switched off.
Security·
A Hanwha camera's login page leaked a GitHub token with admin on hundreds of repos
A security researcher found a Hanwha Vision camera shipping a live GitHub admin token in its login page, granting access to hundreds of the vendor's repositories.
Security·
Microsoft fixed a record 570 flaws and still left a Windows zero-day unpatched
Microsoft's July Patch Tuesday fixed a record 570 flaws, but the Windows zero-day getting the most attention this week shipped without a patch.
Security·
World Leaks stole 630GB from Tata Electronics and leaked Apple's iPhone 18 Pro files
World Leaks stole roughly 630GB from Apple assembly partner Tata Electronics and dumped iPhone 18 Pro supply-chain files online. India opened a criminal probe.
Security·
Secure Boot's 2011-era keys start expiring, cutting off boot updates on unpatched PCs
Microsoft's 2011 Secure Boot certificates started expiring in June 2026. Here's what breaks on Windows and Linux, and the one update that fixes it.
Security·
A Scattered Spider suspect was extradited to the U.S. as three members pleaded guilty
A 19-year-old was extradited from Finland while Tyler Buchanan, Thalha Jubair, and Owen Flowers pleaded guilty. Scattered Spider's legal reckoning has arrived.