News about leaks and new security systems
OpenAI adds Red Team and Defense Factory to Daybreak. The tools test web applications, validate vulnerabilities, and prepare patches for engineering review.
A network migration exposed an internal DigiCert archive online. An unauthorized account accessed business contact records and, in a smaller set of cases, documents such as passports and driver’s licenses. DigiCert says certificate operations were unaffected.
Attackers drained Binance hot wallets across multiple blockchains in a breach estimated at $6.3 billion. Investigators are examining compromised withdrawal infrastructure, an employee laptop and additional breach points. About $3 billion is frozen, and withdrawals remain paused.
An X user claims Claude Code uncovered 14,219 hidden facial photos stored in Android system caches over 15 months, raising concerns about Face Unlock data retention and privacy.
Meta suspended Muse sharing after researchers found sensitive material in publicly accessible shared pages. Claroc traced the exposure to conversation titles and random identifiers appearing in DNS records, making supposedly unlisted links searchable.
Attackers triggered defrosting in French supermarket refrigeration systems, with temperatures reaching 50°C, according to Intermarché’s owner. Stores discarded food after the overnight attack. French authorities confirmed compromises of Danfoss controllers.
Claude Haiku 4.5 submitted a fabricated homicide tip during an internal test. Philadelphia police flagged the message as spam. Anthropic disclosed the incident on October 9 and suspended live internet access across internal evaluations.
Claude Opus 5.5 brings lower API prices, faster output, and stronger coding results in Anthropic’s tests. The release also introduces stricter safeguards and API changes affecting existing integrations.
Google’s Gemini accessed three real company systems during a misconfigured cybersecurity evaluation. In a separate authorized investigation, Hacktron researchers used Claude Opus 5 to build an exploit chain into OpenAI employee ChatGPT and Codex accounts. Recent OpenAI and Anthropic incidents show similar failures around sandboxing, network access, and connected credentials.
Microsoft AI published a draft Code of Conduct for MAI models. The document defines a chain of command for model behavior and sets strict constraints against offensive cyber operations, assistance with CBRNE weapons, malicious deepfakes, large-scale manipulation, and loss of human control.
Revolut disclosed sensitive customer information to an unauthorized third party after fraudulent requests arrived from a legitimate government agency email domain. TechCrunch says exposed data included contact details, identity documents, and possibly selfies, account statements, and transaction histories. Revolut says funds and systems were unaffected.
Liquid Network paused activity after actors who called themselves white-hat hackers withdrew about 4,000 BTC from its federation wallet on September 6. About 3,400 BTC returned after Blockstream said bridge nodes were patched. Roughly 598.5 BTC, worth about $47M, remained outside the federation wallet.
Infoblox says threat actors are buying expired domains at industrial scale because old domains inherit backlinks, traffic, search visibility and reputation. One operation, tracked as Sable Squirrel, allegedly spent nearly $7 million and connected more than 10,000 domains to illegal streaming, gambling redirects and malware infrastructure.
GitHub detected a security breach affecting internal repositories. A poisoned VS Code extension compromised an employee device. Learn what happened and how GitHub responded.
Linux developers have excluded 11 Russian-linked programmers from the list of those responsible for kernel development
Indian startup Dotpe, which raised ~$100M to build point-of-sale systems for restaurants left their entire API fully public.
Apple presented the new Apple Watch, AirPods, and iPhone 16 at the Apple Event 2024
Deep learning алгоритм смог с точностью 90+ процентов распознать напечатанный текст по звукам нажатия клавиатуры. При этом он справился со звуками, которые записали как на микрофоне телефона, так и через запись с Zoom'a или скайпа. Пока алгоритм тестили только на клавиатуре MacBook pro, но разработчики считают, что и с другими клавиатурами можно провернуть аналогичное.
Компания предложила способ борьбы с «галлюцинациями» искусственного интеллекта, когда ИИ фабрикуют информацию.
В Reuters провели масштабное расследование, в ходе которого более десяти сотрудников Tesla на условиях анонимности признались, что делились такими видео в корпоративных чатах и делали из них мемы. Причём иногда в кадр попадали довольно пикантные моменты из частной жизни владельцев автомобилей.