Microsoft’s Secure Boot has been broken for a decade and no one noticed until now
Old and forgotten “shims” Microsoft failed to revoke have made Secure Boot bypasses simple.
Dan Goodin
–
|
54
Security
The US government warns that Russia state hackers are coming after your router
With residential proxies all the rage, CISA urges router users to be vigilant.
Dan Goodin
–
|
111
Now, defenders are embracing the prompt injection, too
“Context bombing” tricks hacking agents into shutting down before they can do harm.
Dan Goodin
–
|
55
Patch for Windows Defender 0-day could allow attackers to fill hard disk
The feud between NightmareEclipse and Microsoft shows no signs of resolving soon.
Dan Goodin
–
|
45
Google pays $250K for Linux vulnerability allowing guest VM escapes
Both vulnerabilities allow untrusted users to gain root privileges.
Dan Goodin
–
|
24
Hackers can use 9 of the most popular AI tools to assemble massive botnets
“HalluSquatting” weaponizes LLMs’ inability to say “I don’t know.”
Dan Goodin
–
|
64
Newly discovered PamStealer isn’t your typical macOS malware
The discovery underscores the increased effort being poured into Mac infostealers.
Dan Goodin
–
|
48
NASA inspector general suggests Boeing’s Starliner will now be a decade late
Starliner’s certification may be delayed to 2027, 10 years later than Boeing’s original schedule.
Stephen Clark
–
|
123
Most Read
New attack provides one more reason why AI browsers are a bad idea
Telling an LLM that 2 + 2 = 5 is enough to make it follow forbidden instructions.
Dan Goodin
–
|
75
US offers $10 million for info on group behind Signal and WhatsApp hacking spree
Operation by two Russia-state groups has been ongoing since at least March.
Dan Goodin
–
|
52
One-two punch delivered in global operation disrupts cybercrime “assembly line”
“Operation Endgame” simultaneously disrupts two widely used crime tools.
Dan Goodin
–
|
13
White House drastically shortens deadline for dropping quantum-vulnerable crypto
Order warns of national security risks if post-quantum cryptography isn’t adopted in time.
Dan Goodin
–
|
55
Following user outcry, AMD reinstates memory encryption in consumer CPUs
Critics saw the move as an underhanded way to steer them toward more costly chips.
Dan Goodin
–
|
49
Microsoft discovers new lightweight backdoor that steals cryptocurrency
Crypto Clipper spreads over USB and communicates over Tor.
Dan Goodin
–
|
83
Apple patches high-severity eavesdropping vulnerability in Beats Studio Buds
The vulnerability, disclosed 12 months ago, affects multiple manufacturers.
Dan Goodin
–
|
15
Massive breach spills credentials for thousands of sensitive networks
The affected include Oracle, Lenovo, FedEx, a NATO contractor, and Fortinet.
Dan Goodin
–
|
89
“Dangerous” AI models are coming no matter what
AI models with advanced hacking capabilities will soon be the norm.
WIRED
–
|
133
Windows and Linux users: The deadline to update Secure Boot keys is near
What you need to know about the expiration of keys securing your machine’s boot sequence.
Dan Goodin
–
|
165
Critical Copilot vulnerability allowed hackers to steal 2FA code from users
SearchLeak exploit shows why the industry’s approach to LLM security fails over and over.
Dan Goodin
–
|
92
Users cry foul after AMD stripped memory crypto from its consumer CPUs
AMD’s stripping of TSME from consumer CPUs appears to be a deliberate, covert move.
Dan Goodin
–
|
101
PeopleSoft 0-day affecting hundreds of organizations steals gigabytes of data
Vulnerability in the Oracle-owned PeopleSoft software is about as critical as they come.
Dan Goodin
–
|
48
Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed
A separate zero-day also disclosed by Nightmare Eclipse appears to be patched as well.
Dan Goodin
–
|
110
High-severity vulnerability in Linux caused by a single faulty character
Use-after-free bug can be exploited to evade sandbox defenses.
Dan Goodin
–
|
56
For the 2nd time in weeks, Microsoft packages laced with credential stealer
73 packages run self-replicating stealer as soon as they’re opened by an AI agent.
Dan Goodin
–
|
39
How a USB-connected speaker can infect a PC without ever being touched
Seller of the Sound Blaster Katana V2X doesn’t consider the behavior a vulnerability.
Dan Goodin
–
|
139
Dashlane explains how attackers managed to download encrypted password vaults
By targeting large numbers of users, attackers increased their chances of success.
Dan Goodin
–
|
82
Can’t make sense of Dashlane’s vault theft notification? You’re not alone.
Security advisory leaves out key details. Dashlane maintains complete silence.
Dan Goodin
–
|
40
Hackers duped Meta AI support chatbot to steal celebrity Instagram accounts
Pricey Instagram handles were stolen and resold before Meta patched the exploit.
Jeremy Hsu
–
|
51
Dozens of Red Hat packages backdoored through its official NPM channel
Anyone who has downloaded affected Red Hat packages should investigate immediately.
Dan Goodin
–
|
40
Botnet of more than 17 million devices dismantled
The botnet was reportedly tied to a Russia-based residential proxy network.
Dan Goodin
–
|
27
Fed up with vibe coders, dev sneaks data-nuking prompt injection into their code
Undisclosed addition in jqwik instructed AI coding agents to delete app output.
Dan Goodin
–
|
388
Websites have a new way to spy on visitors: Analyzing their SSD activity
Telltale SSD activity can be measured in the browser using simple JavaScript.
Dan Goodin
–
|
148
Millions of AI agents imperiled by critical vulnerability in open source package
“BadHost” was found in Starlette, a package with 325 million weekly downloads.
Dan Goodin
–
|
67
Police boast of hacking VPN where criminals “believed themselves to be safe”
Law enforcement intercepted VPN traffic, seized domains, and arrested its operator.
Jon Brodkin
–
|
60
Texas AG sues Meta over claims that WhatsApp doesn’t provide end-to-end encryption
Critics note a lack of factual support in lawsuit filed by US Senate candidate.
Dan Goodin
–
|
49
A hacker group is poisoning open source code at an unprecedented scale
GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks.
WIRED
–
|
49