Researchers at the Graz University of Technology Austria demonstrated a new attack that can track you via file change events "on all systems," allowing for various data leaks.

wiredmikey shares a report from SecurityWeek: Nvidia on Monday announced the Open Agent Safety Platform, which combines open source software and a reference system design to keep AI agents within set boundaries from testing through deployment. The chipmaker explained that the platform pairs the open...

The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core components. [...]

In a completely unsurprising turn of events, Meta's Muse AI is stealing Apple Messages, past and present, and uploading the contents to its cloud, even if explicitly told not to.

Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect's arrest, remaining ShinyHunters members dramatically escalated their attacks, stealing highly sensitive data from the FBI and extorting the Russian ransomware group Cl0p.

Human contractors are reviewing Copilot users’ prompts and uploaded images, according to internal documents obtained by 404 Media. The contractors are also bombarded with users’ requests for sexual AI images.

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. government agencies over the weekend to secure their systems against attacks exploiting two critical Citrix NetScaler vulnerabilities. [...]

Meta announced in a blog post that its notorious smart glasses will soon use its Private Processing to protect your data as it's being processed in the cloud.

Two unpatched Citrix NetScaler zero-day vulnerabilities are reportedly being exploited in attacks, with cybersecurity agencies, security researchers, and IT providers privately warning organizations about the flaws ahead of patches expected next week.

Cloudflare has fixed a vulnerability in Containers and Sandboxes that allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host. [...]

The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers.

Artificial intelligence is getting very good at finding software bugs. That sounds like a win for security, but it is also creating a new problem: somebody still has to fix everything AI discovers. Canonical says the rapidly growing number of Linux vulnerabilities is now forcing it to change how Ubuntu kernel security updates are delivered. The company is moving away from its existing four-week regular and two-week security Stable Release Update cycles in favor of a unified two-week process that will result in new kernel releases every week. **SEE ALSO:**GEEKOM A5 2027 Edition is a tiny Ryzen 7 PC starting at $479 The reasoning is particularly interesting. Canonical directly points to artificial intelligence as one of the forces behind the explosion in reported CVEs. Large language models and specialized AI agents can automate work that previously required much more manual effort, allowing researchers to uncover bugs at a much faster rate. There is another factor too. The CVE Program officially added kernel.org as a CVE Numbering Authority in 2024, giving the Linux kernel team the ability to assign CVE identifiers for vulnerabilities within its scope. The kernel’s own documentation says potentially security-related fixes can now receive CVEs as part of the normal stable release process. That helps explain why the numbers can look alarming. The Linux kernel team says it takes a deliberately cautious approach because almost any kernel bug could potentially have security implications. It also warns that many assigned CVEs may not actually apply to a particular Linux system because users only run a subset of the enormous kernel codebase. In other words, Linux did not suddenly become wildly insecure overnight. We are getting much better at finding and cataloging problems that may have previously gone unnoticed. AI is accelerating that process, while the kernel’s newer CVE assignment approach is making more of those bugs visible to the security ecosystem. Canonical’s answer is overlapping two-week kernel cycles. During the first week, engineers prepare kernel packages, select patches, build them, and perform basic smoke testing. The second week focuses on hardware certification, Ubuntu integration, and regression testing. Because a new cycle begins every week, finished kernels can also arrive weekly. That testing component matters because simply pushing patches faster would be easy. Doing it without introducing regressions across the enormous variety of hardware running Ubuntu is the harder part. Canonical says it intends to retain its extensive certification and regression testing rather than trading reliability for speed. Organizations that cannot wait for the full cycle will have another option. Kernel release candidates are published through Ubuntu’s -proposed pocket before certification testing, and Canonical says those builds will be updated weekly. Companies willing to perform their own acceptance testing can therefore potentially get access to fixes sooner. That is not something ordinary Ubuntu users should rush to enable. The point of -proposed is that those packages have not yet completed Canonical’s full certification and regression process. For organizations facing a serious vulnerability, however, having the option to test a fix early could be valuable. Canonical is also addressing the awkward period between a vulnerability becoming public and a patched kernel reaching users. The company says it will try to provide safe workarounds or hardening guidance when possible, with a target of helping customers reach a safer state within 24 to 48 hours of public disclosure. There is something almost ironic about all of this. AI is routinely pitched as a tool that will make software development faster, but it is also making vulnerability discovery faster. That means maintainers now have to accelerate the other side of the equation too. For Ubuntu users, that should ultimately be good news. More bugs being discovered is preferable to vulnerabilities sitting unnoticed in the Linux kernel. The challenge for Canonical is making sure the growing torrent of CVEs can be fixed quickly without turning faster security updates into a source of new problems. ☕ ### Support independent tech journalism NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi. Support NERDS.xyz Written by ### Brian Fagioli ✔ Technology journalist and founder of NERDS.xyz Brian Fagioli is a technology journalist and founder of NERDS.xyz. A former BetaNews writer, he has spent over a decade covering Linux, hardware, software, cybersecurity, and AI with a no nonsense approach for real nerds. 📄 More by Brian Fagioli ✖ Follow on X ▶ YouTube @ Threads 🐘 Mastodon

Privacy advocates are always looking for alternatives to banking, but most of the alternatives are actually even worse.

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code.

In an era of increasingly sophisticated AI-fueled scams, a retro threat may be lurking in your mailbox.

A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims.

The Clop ransomware gang has moved its data leak site to a new Tor address after confirming its previous server was compromised and defaced through an unpatched Grav CMS flaw that BleepingComputer has learned is an unauthenticated path traversal vulnerability.

Tor has released updates for "all components" of Tor that include severe vulnerabilities and bugs from the "LLM report firehose" and recommends "upgrading as soon as possible."

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts.

The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2.

Our submission covers the following topics, following the government's call for evidence:

A Kosovar national has pleaded guilty to operating Rydox, a large illegal online marketplace that sold stolen personal information, login credentials, credit card details, and cybercrime tools.

​Cryptocurrency exchange Bitget disclosed today that suspected North Korean hackers have stolen $351.6 million from its hot and warm wallets.

VPNs make it safer to use the Internet. Governments are trying to ban them. Sign to renew your commitment and tell world leaders: using the Internet safely and privately is a human right. Don’t ban VPNs! Last year, nearly 20,000 VPN users mobilized to demand safe, private browsing. But with the continued global rise of […]

A new variant of the MacSync malware targeting macOS systems now uses public iCloud calendar events to deliver new native payloads.

A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...]

Hey everyone, Just wanted to share a quick update for anyone interested in hardware-level privacy but hesitant to leave the mainstream Android ecosystem. The Hiroh Phone—which features a physical hardware kill switch that completely disconnects the microphone and camera at the circuit level—is now officially offering a version that ships with stock Android 16. I know a lot of people here prefer GrapheneOS over /e/OS because /e/OS isn’t always seen as robust on security. If you found the phone...

Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports. [...]

New research finds that most AI chatbot users have shared something sensitive, but few trust the companies behind them.

A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security. [...]

​The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July. [...]

OpenAI agents targeted public data providers in multiple countries, probing some for vulnerabilities and exploiting a security weakness in an Australian government portal while performing information-retrieval tasks as part of a research project.