23 casos · pág. 1/2
Nikkei Inc., the Japanese media group that owns The Nikkei and the Financial Times, disclosed a breach of a cloud service used for system development. On October 7, attackers used previously stolen credentials to gain unauthorized access. As of October 16, about 1.83 million items of personal information had leaked. The company reported t…
Japanese media group Nikkei (publisher of The Nikkei and the Financial Times) disclosed a data breach affecting about 1.83 million records held in a cloud service used for system development. On the morning of October 7, attackers used previously compromised credentials to access the service. About 1.68 million records held only non-ident…
Nikkei Inc. disclosed a third data breach in about a month, exposing 1.83 million records stored in the cloud. Attackers used stolen credentials to access a development system in the early hours of October 7. About 150,000 records contained at least one of: full names, email addresses, physical addresses, phone numbers or dates of birth, …
TLDR: I pointed Claude Opus at Discord’s bundled Chrome (version 138, nine major versions behind upstream) and asked it to build a full V8 exploit chain. The V8 OOB we used was from Chrome 146, the same version Anthropic’s own Claude Desktop is running. A week of back and forth, 2.3 billion tokens, $2,283 in API costs, and about ~20 hours…
Three months ago, I wrote a blog titled “I Let Claude Opus Write a Chrome Exploit: The Next Model (Mythos?) Won’t Need My Help?”. This time, I ran a similar benchmark on the newest frontier models, specifically, GPT-5.6 Sol Medium, Sol Ultra, and Grok 4.5, and watched Sol Ultra hill-climb a full renderer exploit on recent Chrome from star…
In July 2025, the German news service NIUS suffered a data breach whose data was subsequently leaked publicly. Have I Been Pwned added the dataset on 23 Aug 2026. It covers 6k unique email addresses along with names, physical addresses and payment details tied to purchases. HIBP flagged the breach as sensitive, so it is not publicly searc…
TLDR: PostHog used Playwright Chromium with --no-sandbox for heatmap screenshots. I used Claude to write a V8 n-day (CVE-2026-7899) exploit, got production RCE in a worker container with prod db access. I then used the same exploit as an evaluation for open-weight models. With the increasing number of supply chain attacks, I was thinking …
A modular phishing campaign targets YouTube creators with personalized sponsorship offers from fake brand representatives. One variant impersonates Hollyland, a maker of wireless video transmission equipment, and also Nike and Spotify. Victims are led through a convincing fake collaboration platform to a bogus "Sign in with Google" page t…
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach exposed roughly 145k unique email addresses along with usernames and passwords stored as MD5 or PBKDF2 hashes. OTW self-submitted the data to Have I Been Pwned, which added it on 19 Aug 2026 (144.5k af…
This Foreign Affairs essay, co-written by Bruce Schneier and Seva Gunitsky, argues that AI offers autocrats two things: real-time monitoring of subordinates and replacement of human intermediaries. Examples include RT's AI-generated anchors, China's Zero Trust AI system and smart city oversight, Russia's Oculus censorship system and Melio…
Meta updated its commercial terms of use to state it could "use any content from a business account's domains, web pages, or URLs" to provide, develop, improve, research, train and maintain its products and services. Legal experts quoted by Nieman Lab read this as a "remarkable provision" that could let Meta scrape any publisher with a Me…
Meta is updating its commercial terms for Meta Business Suite, effective Oct. 30. Under the new terms, accounts authorize Meta and any entity acting on its behalf to use scrapers, bots, crawlers and user agents on domains and URLs "associated with" the account, including news publisher sites. Nieman Lab first reported the change, and lega…
The Center for AI Safety (CAIS) maintains a Wage Loss Dashboard that estimates the economic cost of US job cuts companies attribute to AI. It was updated this month with September data. It shows just over 117,000 AI-attributed job cuts nationally since January 2026, equal to about $8.5 billion in estimated annual wage losses. This is indu…
VisionHeight, an Israeli threat intelligence firm, uncovered a network of hyperlocal websites spanning at least 14 US states, built to influence how AI chatbots answer questions about local and state races. Sites with names like "Wolverine State Report", "Peach State Bulletin" and "Tarheel State Report" repeat hundreds of near-identical s…
Citizen Lab reports that Candiru spyware was delivered to devices at Al Jazeera Media Network through targeted online advertisements, in a zero-click attack that only required the malicious ad to render on the victim's device. Citizen Lab calls the technique AdFection and says its report is the first public technical confirmation of merce…
Citizen Lab reported that Israeli mercenary spyware vendor Candiru infected devices at Al Jazeera through targeted online ads that needed no user interaction. It calls this the first public technical confirmation of mercenary spyware reaching real devices via ad delivery. At least 45 Al Jazeera devices were targeted in 2024 and 2025, and …
The Citizen Lab disclosed AdFection, the first technical demonstration of zero-click mercenary spyware delivered through targeted online advertising. The Israeli firm Discover-Tech presents itself as a legitimate ad company but acts as a facilitator for several mercenary spyware partners, including Candiru. Its ads covertly direct million…
Citizen Lab reported the first publicly confirmed zero-click mercenary spyware attack delivered through targeted online ads, a technique it calls "AdFection". The Israel-based adtech firm Discover-Tech allegedly acts as a front and middleman between the advertising ecosystem and spyware vendors. Citizen Lab traced attacks on at least 45 A…
Citizen Lab documented AdFection, a campaign in which the Israeli-founded ad firm Discover-Tech delivered zero-click mercenary spyware attributed to Candiru through the online advertising ecosystem. During 2024 and 2025, 45 devices belonging to Al Jazeera were targeted. Citizen Lab calls this the first detailed public technical evidence o…
Episode 485 of the Smashing Security podcast, hosted by Graham Cluley with guest Lianne Potter, covers several security stories. Researchers who wanted to test LG smart TVs for security risks got around the terms and conditions by setting up the TV while drunk, on the reasoning that they could not be bound by a contract agreed to while in…
