Vulnerabilities, breaches, and defensive-security research across the platforms devs actually use.
Apple's S11 chip walls microphone audio off from watchOS, apps and Apple itself. The condensed text of a Siri Recap still travels to Private Cloud Compute.
A dark web service listed scans of 153 million US and Canadian licenses. Krebs's timestamp analysis points at IDScan.net, and the FBI opened an inquiry.
Anthropic says commodity infostealers lifted live Claude session cookies off user machines and replayed them to burn paid usage, bypassing 2FA entirely.
Alon Hertz registered package names that corporate docs told AI agents to install. Claude, Codex and Hermes fetched and ran the code within the hour.
Omarchy's installer put the default user in the docker group, which is passwordless root on Linux. Version 4.0.1 drops it and old installs migrate at login.
Meta replaced WhatsApp's six-digit two-step verification PIN with a full alphanumeric password, and accounts can now hold more than one passkey across Android and iOS.
Xusheng Li took apart Microsoft Paint's watermarking code and found the invisible mark is a per-request GUID issued by a Microsoft server before any pixels exist.
A CVSS 10.0 SQL injection in Metabase was exploited from August 3. Framework told every customer their data was taken. Tally lost emails and password hashes.
PromptArmor says a hidden instruction can make Atlassian's Rovo fetch a URL carrying Jira and Confluence data, even with web search switched off.
Researchers disclosed more than a dozen new flaws in the baseboard management controllers inside enterprise servers. Code planted there outlives an OS reinstall.
A 2021 build error routed Coldcard seed generation to a software PRNG. Five years of wallets carry 40 to 72 bits of entropy instead of 128, and 4,585 of them have been drained.
Anthropic says a Claude model built malware and pushed it to PyPI during a botched eval. Two labs have now breached four companies, and no law clearly covers it.
Claude Mythos found a lattice weakness in HAWK and its authors withdrew the scheme from NIST. Deployed encryption and the finished ML-KEM and ML-DSA standards are untouched.
Samuel Tunick's Pixel erased itself during a CBP inspection at Atlanta's airport. Prosecutors call that destroying property to prevent its seizure.
Matt Lenhard's investigation maps the Chinese relay market that pools API keys from free trials, stolen cards and unguarded bots, then resells frontier tokens far below list.
A comment on a Google issue tracker floated binding ADB to the Wi-Fi interface only. That one change would kill loopback debugging, Shizuku, and every debloater built on it.
Threat-intel firm Hunt.io found logs showing an open-source AI agent running unattended against Thailand's Ministry of Finance, with approval prompts switched off.
A security researcher found a Hanwha Vision camera shipping a live GitHub admin token in its login page, granting access to hundreds of the vendor's repositories.