Security This Week

Ondrej Surý: The Volunteer Who Shipped PHP2Shell Fixes for 12 PHP Versions. What Founders Owe the Open Source They Run On

PHP Warns of Two Critical 9.2 Security Vulnerabilities. Patch

Carl plays an insane recording of an audio interaction with a new kind of AI model.

“An AI did it” is no defense, says nonprofit suing OpenAI over Hugging Face hack

OpenAI and Anthropic are probing a colossal wave of security incidents

HTTP QUERY Method: The Grey Zone Between GET And POST.

AI caught telling future versions of itself to bypass human controls, OpenAI reveals

X/Twitter message revealing token router shenanigans

OpenAI Astra Brings Autonomous Zero-Day Exploitation to AI

FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

US government will let private companies hack criminal gangs

Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations

OpenAI finds AI agent leaving escape notes for its future versions

OpenAI Models Autonomously Hack Hugging Face

New Windows LegacyHive zero-day gives hackers admin privileges

AI-Powered Attack Compromises AWS Cloud in 72 Hours

Trump administration lifts restrictions on Anthropic's Claude models after cybersecurity alarm

Hackers leak facial recognition records tied to millions of Madison Square Garden visitors

FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide

Anthropic rolls out Claude Fable 5, but it's available for a limited time

Claude Code’s GitHub Actions Vulnerability Lets Attackers Compromise Any Repository

FBI warns of in-person data theft attacks from extortion gang

First public macOS kernel memory corruption exploit on Apple M5

New Linux 'Dirty Frag' zero-day gives root on all major distros

Copy Fail: 732 Bytes to Root on Every Major Linux Distribution.

Anthropic investigates unauthorized Mythos access by Discord group

AI chatbots used tactical nuclear weapons in 95% of AI war games, launched strategic strikes three times!

$10 Domain Could Have Handed Hackers 25k Endpoints, Including in OT and Gov Networks

Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems

Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly Downloads

FCC bans foreign routers, putting enterprise network risk in focus

Researchers uncover iPhone spyware capable of penetrating millions of devices.

Microsoft SQL Server Zero-Day Vulnerability Allows Attackers to Escalate Privileges

Anthropic ditches its core safety promise in the middle of an AI red line fight with the Pentagon

Exploitable Flaws Found in Cloud-Based Password Managers

iPhone Lockdown Mode is so good even the FBI can’t crack it

Hacking Moltbook: The AI Social Network Any Human Can Control

How to get Doom running on a pair of earbuds

New Study Shows GPT-5.2 Can Reliably Develop Zero-Day Exploits at Scale