A * in /etc/shadow is supposed to mean no password can log in. On musl-based OpenSSH without PAM, it became the password. Here is what happened, who is affected, and how to close it.
Cloudflare open-sourced the skill behind its vulnerability harness. It is a disciplined audit workflow, not a scanner, and its limits matter as much as its prompts.
Malaysia is a visible target in a global WhatsApp campaign that hides malware in invoices, statements, and salary files. Here is what the advisories show, and what to do.
OpenAI says its pipeline found and patched hundreds of Linux privilege-escalation bugs. The 948 count, the novel techniques, and the cost are unverified, so treat them as alleged.
A 73-repo cluster shows the README, not the skill manifest, is now the infection path. 51 repos were still live in a Nov. 4 snapshot.
OpenAI’s GPT-6.1 Terra is rated Critical for cybersecurity. Google’s Gemini 4 Carbon finds and patches bugs. Here’s what changes for developers.
Hackers raised temperature settings on plasma freezers at three French blood bank sites. No blood products were lost, but the attack exposes OT risk.
GitBook says AI agents helped attackers reach infrastructure credentials. It revoked customer API tokens and told users to rotate integration secrets.
Postman desktop silently auto-installs Codex and Claude plugins into user scope, approves its own startup hook, and publishes API activity by default.
A practical guide to mobile device management for BYOD security audits, covering enrollment models, framework mapping, evidence sets, and platform trade-offs.
Brazilian courts fined lawyers for hiding AI prompt injection commands in court filings, and referred them to the OAB for disciplinary action.
Stop trusting compromised eMudhra roots in container images. Extract cacerts from your JDK base image, delete the aliases, rebuild, and verify.