Sony's latest PS5 firmware got cracked, just in time for GTA 6's November release
"Hello 14.10"
OpenAI says its AI agents disabled safety guardrails, and then lied about it
A new day, a new rogue AI agent
Two web emergencies in one week: guessable certificate keys and critical PHP bugs that leaked before patches
Browsers patched one problem remotely. Servers will need to be fixed by hand.
A hot potato: Security teams are dealing with two separate emergencies this week, and both go straight to the foundations of the web. The first is a certificate authority that shipped private keys anyone could guess. The second is a pair of critical PHP flaws that leaked before patches existed. Browsers fixed the certificate problem within hours. Everything else, from Linux servers to Docker images and IoT gear, needs someone to log in and patch.
PSA: PHP patches two critical flaws, server admins urged to update
PHP has released emergency security updates addressing two critical vulnerabilities that could allow attackers to remotely execute code without authentication. With PHP powering nearly 70% of all websites, the potential impact is enormous. Apache deployments are particularly vulnerable, and security agencies are urging immediate updates.
Meta suspends Muse sharing after sensitive documents turn up in shared chats
Researchers found loan paperwork, revenue figures, and confidential meeting notes
Staples hackers created more than 15,000 gift cards, then went on a shopping spree
Investigators tie the breach to Chinese crime, with much of the merchandise shipped to China
Millions of routers can be hijacked over Wi-Fi thanks to a 16-year-old bug
Broadcom says it replaced the vulnerable code in 2018 and won't assign a CVE. The fix never reached the routers.
Why it matters: Chipmakers ship buggy code all the time, that alone isn't news. What makes WPSplinter stand out is that Broadcom apparently did issue a fix eight years ago, but that fix never reached the routers sitting in people's homes. Furthermore, the lack of a CVE kept the problem invisible to the advisories and patch pipelines that router makers and ISPs rely on.
Update now: Hackers are exploiting Plex server vulnerabilities to install malware
Hackers are actively exploiting security vulnerabilities in outdated Plex Media Server installations to deploy cryptocurrency miners and proxy malware. Plex confirms widespread attacks against internet-facing servers, with the flaws allowing remote code execution without authentication. The vulnerabilities were patched in version 1.43.3.10861. Users running older versions are urged to update immediately.
A judge lets Denuvo subpoena Discord, Reddit, and Steam to unmask the cracker Voices38
The most hated DRM in PC gaming is asking a federal judge to unmask a pseudonym
Connecting the dots: Denuvo has spent the past few weeks trying to uncover Voices38's true identity. The mysterious cracker has been wreaking havoc on the company's notorious DRM and anti-tamper technology, and Denuvo is now turning to lawyers in a bid to unmask the skilled coder.
Anthropic wants AI models blocked only if they threaten over $1 billion in damage or more than 50 deaths or serious injuries
Intervention is limited to catastrophic risks involving cyberattacks, biological weapons, or loss of control
Eiliko robot maker Energize Lab left its entire fleet of 68,000 robots open to a remote takeover
The exposed data includes 13 million conversations, but the company won't answer questions about it
PSA: The calendar invite is the new phishing vector, and email filters aren't catching it
Google Calendar and Microsoft 365 treat invites differently from email, and attackers are exploiting the gap
Windows Defender now works in Linux, because why not
Do Linux operating systems really need an antivirus, though?
Researchers say an ad platform could identify targets and install spyware through online ads, no click needed
Zero-click spyware is real, weaponized, and ready to infect target machines
Microsoft won't patch old Windows Servers, so a small security firm is doing it
Third-party service 0patch is patching a Windows DNS Server flaw that Microsoft won't fix
Microsoft breaks Patch Tuesday record with more than 1,000 Windows security flaws fixed
That's a lot of bandages
Holy Patch: Microsoft is increasingly relying on AI tools to uncover security vulnerabilities in Windows and its other software products. Yet this month's Patch Tuesday brings an unprecedented number of bug fixes, with Windows bearing the brunt of the latest security cleanup.
Meta's smart glasses were recording conversations without the wake phrase, company admits
Meta says the issue has been fixed, but hasn't explained what caused the unwanted recordings
A hot potato: If there's one product that really doesn't need any more negative stories, it's Meta's smart glasses, but here we are. Some users discovered that the wearables were recording their voices without the wake phrase, an issue the company says has now been resolved.
One of the world's worst passwords, 123456, helped a hacker steal 8.8 million people's data in Denmark
The hacker claims at least three company accounts, including an admin account, used the same password
OpenAI employee arrested for hiding recording device in executive meeting room
The Saudi engineer allegedly concealed a tiny recording device in toilet paper and plugged it into a TV's USB port
What we know so far: In a prime example of the cloak-and-dagger world of tech espionage, a Saudi national has been arrested for allegedly planting a recording device in OpenAI's executive conference room. It's claimed that Abdulrahman Alfozan wrapped the device in toilet paper and inserted it into a USB port on the back of a TV.
Flock faces lawsuit after deputies allegedly used its cameras to retaliate against man who sued sheriff
The man claims his vehicle was monitored over a 197-day period after he filed a civil rights lawsuit
Hackers hit European supermarket refrigeration systems, spoiling food and forcing stores to dump stock
Freezers were set to defrost mode for hours on end
An engineer built a Flock-like camera to detect police cars, says officers visited him afterward
They worried his $180 prototype could reveal officers' homes, work schedules and daily routines
82% of approved electronics are tested in China, but the FCC wants that figure down to zero by 2028
The proposed rules could create major headaches for manufacturers
Decompilation on Steroids: Why AI Is Suddenly Cracking Open Old Software
Everything is being decompiled. GoldenEye, Halo, Photoshop, even bank mainframes: AI is prying open old code at record speed. The secret isn't just AI, it's an answer key to check its work.
Windows PCs with outdated certificates will stop receiving security updates, here's what to do
Windows 11 24H2 and Server 2025 lose Windows Update access on June 19, 2027, without a security update