Cybersecurity is the rickety scaffolding supporting everything you do online. For every new feature or app, there are a thousand different ways it can break – and a hundred of those can be exploited by criminals for data breaches, identity theft, or outright cyber heists. Staying ahead of those exploits is a full-time job, and one of the most lucrative and sought-after skills in the tech industry. All too often, it’s something up-and-coming companies decide to skip out on, only to pay the price later on.
It says it used an upcoming cyber model to autonomously scan the latest Linux kernel as of “mid-October 2026.” OpenAI’s system also generated patches for the bugs, and it says a human researcher reviewed them.
[OpenAI]
Cold storage rooms at three French Blood Establishment (EFS) sites were impacted on Monday, which massively increased the temperature and defrosting thresholds. The EFS says it wasn’t directly targeted, and the anomalies were detected before any of the stored blood was lost, but the ongoing hacks present a worrying future risk for healthcare facilities.
[French Blood Establishment]
Grocery stores and food suppliers in Germany, Italy, Romania, and the United Kingdom are now confirmed to be among the victims of suspected cyberattacks that are tampering with the temperatures of refrigeration units across Europe. Companies in at least 11 countries have now been impacted, but the culprits and motive remain unclear.
LED billboards in Egypt, Malaysia, Brazil, and possibly Iraq and China were hacked to show sexually explicit material. The group Leakers$ claimed responsibility for the attack and said that “anyone with two brain cells” could have done it. According to Gizmodo:
A representative said participants using the pseudonyms Never, 19ylegal, CH, and Nivex identified thousands of exposed systems through an automated random scan lasting roughly two hours. The systems were allegedly accessible via web pages and interfaces that lacked basic security protections.
The fanworks platform announced yesterday that it could be down for four weeks, and now we know why. Details about the security incident itself haven’t been shared, but no AO3 data has been deleted, and the site runners currently don’t believe that user account information was stolen, but are “unable to rule it out.”
“Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far.”
After making Large 4 available in a public preview earlier this month, Mistral is now releasing an improved version to everyone, which it says ranks as the “best open-weight model for coding.” The model offers advancements in cybersecurity-related tasks, like creating patches or reproducing vulnerabilities, and is more likely to refuse “malicious cyber requests” compared to other open models, according to Mistral.
On Wednesday, the nonprofit DDoSecrets published a database of more than 41,000 employee records stolen from the DHS. Bluesky, which has strict policies against sharing someone’s personal information, tells Wired that it’s blocking links to the archive because they contain people’s email addresses and phone numbers “shared without their authorization.”
Want a recap of all the abuses of Flock? A look at its failures to properly secure its system? An examination of its efficacy? Well, it’s all here, along with possible solutions to the problems of warrantless AI surveillance — including a prototype secure dumb camera.
The map comes from security researcher Joshua Michael, who is facing a trademark complaint from Flock after he published an interactive map of automated license plate readers (ALPRs) using information from a data leak. Proton is now hosting the map, but notes that it’s a snapshot from December 2025, so “devices installed or removed since then won’t be reflected.”
The scope of the attack and exactly what data was compromised isn’t clear, only that some “personal information and patient records were affected.” Quest says its investigation is ongoing and it will alert impacted customers “as required by applicable law.” Oddly, as TechCrunch notes, the FAQ about the breach contains “noindex” code, making it difficult for customers to find.
[Quanum | Quest Diagnostics]
Charlie Warzel at The Atlantic interviewed Ondřej Surý, the man almost single-handedly responsible for packaging up the patch for this week’s vulnerabilities. It’s a fascinating conversation, from Surý‘s odd nonchalance about saving the web to his concern that for-profit companies are exploiting open-source. But he hopes that this AI-assisted discovery will lead to a change:
… Everything’s moving fast now, and it’s taking a toll on the people who are defending the stuff. At the same time, maybe this is the turning point where we actually start caring about this … I might be wrong, but I’m an optimist that people will finally realize that we can’t go like this forever. This has been a disaster waiting to happen for a really, really long time.
From July 21st to August 11th, two employees from METR and Redwood Research conducted a “pilot” to stress test the system, and METR published a high-level overview of their findings, as reported by CNBC. One exploit would have allowed agents to “prevent hundreds of recent actions (including the actions involved in the exploit itself) from being monitored.”
OpenAI “has stated” that the vulnerabilities identified “that impact their production safeguards stack” have been patched, METR says.
According to Axios, banks have detected AI agents accessing customer accounts and taking actions, sometimes without clear authorization or instruction. JPMorgan, Citi, Bank of America, and Morgan Stanley have started to restrict or block some third-party access because of it. But more concerning, it seems the banks just don’t know what AI agents are doing or why:
One bank executive told Axios they struggle to differentiate between agents, as well as whether an agent has been authorized by a user or has gone rogue and gained access to a customer account.
The list of sites that had to go down, at least temporarily, because of the recently disclosed PHP vulnerability keeps growing. Thankfully, the Internet Archive’s ops team quickly got things patched, secured, and back online. Digital librarian Brewster Kahle posted his thanks on Mastodon last night: “Given the severity, there are heroes in many many orgs from last night. Could have been no lights, no traffic signals, real problems.“
World Quest and Save My Demonic World have run for over a decade, but they’re built on older tech that the developers say can’t be updated to patch the apocalyptic PHP exploit disclosed this week. Because the vulnerability affects almost 20 years of PHP, big chunks of internet history are in danger of being lost. Per Kotaku:
Many old websites and services that are no longer being actively updated (or may simply be too old to receive the update, as was the case for these two games) are now at risk of permanently going offline. Such an event would lock swathes of the old internet from public view, including bits that were already beginning to break down and become inaccessible.
The breach was discovered on October 19th. That’s a lot of exposed Capcom ID email addresses, but thankfully the hackers didn’t leak much else: 196 passwords were changed (but no existing passwords were leaked), and 43 cases involved date of birth, gender, country, and nicknames being revealed.
CEO Matthew Prince says the company saw thousands of attempts to exploit the PHP vulnerability across the Cloudflare network in the 10 hours before the issue was publicly announced. That jumped to “hundreds of thousands” of attacks in the 2 hours after the disclosure, and “millions” by last night. Yikes.
[X (formerly Twitter)]
As announced last year, Chrome will now show a warning when you visit public websites without an encrypted HTTPS connection. The new warnings will appear the first time you visit a site without a secure connection. If you continue to the site, Google won’t present the warning for another two weeks.
OpenAI says a security researcher at Calif used GPT-5.6 Sol to identify PHP exploits before attackers did, and has shared a tool that lets developers check if they’re using a potentially vulnerable version of PHP that needs patching. Ami Luttwak, co-founder of Google’s Wiz security team that also helped to identidy the PHP2Shell exploit, told the Wall Street Journal that its “the most severe AI vulnerability that was ever found.”
Eight certificates issued by India-based eMudhra have been compromised, theoretically allowing attackers to spoof trusted browser and app credentials. Cryptography engineer Filippo Valsorda told Ars that the number of affected devices means it’ll take longer to clean up than Heartbleed, an infamous OpenSSL vulnerability that rocked the internet in 2014 and took years to fix.
When unusual activity is detected on an account, the platform will now temporarily pause features for 24 hours, including uploading or updating videos, livestreaming, creating or adjusting playlists, uploading thumbnails, and making private videos public. Full feature access will be restored once the account’s security is verified.
As Ars Technica reports, Florida’s Department of Highway Safety and Motor Vehicles says the hackers accessed its systems using a local law enforcement employee’s “compromised credentials.” The FLHSMV has started notifying victims about the breach, which could have exposed “driver licenses data, motor-vehicle information, document images, and other personal information.”
Days later, Energize Lab still hasn’t even acknowledged that its “AI charm bot” is literally profiling you, storing everything you tell it in the cloud, and that a single hacker can read all those conversations, hijack the bot’s personality, and make it lie to you.
Fun fact: when Sammy hacked my bot, he accidentally hacked others too…
Students’ names, addresses, birth dates, demographic info, disability status, and other personal data was copied from Educational Testing Services, one of the state’s testing partners, the Los Angeles Times reports. California’s Department of Education says the breach could affect “all students enrolled in the three previous school years.”
