ls ./archive --page 14
Binarly found six vulnerabilities in U-Boot's FIT signature verification. Two allow code execution during verification itself. The code dates to U-Boot 2013.07, and the devices running it mostly update through vendors who may never ship a patch.
The DPDP Rules were notified on 14 November 2025 with an 18-month runway to May 2027. But the soft-enforcement phase ends on 13 November 2026, legacy data must be revalidated by then, and penalties reach ₹250 crore.
Nearly 140,000 US tech jobs went this year, and AI keeps appearing in the explanation. But only four employers said anything specific, and the Financial Times found firms citing AI underperformed the Nasdaq by around 10% in the following 30 trading days.
CVE-2026-8037 is a CVSS 9.6 command injection in Progress Kemp LoadMaster, traced to its escape_quotes() routine. 792 exploitation attempts over 41 days from 65 IPs across 18 countries — and the federal remediation deadline is today.
Novee Security took Claude Code, Gemini CLI and OpenAI Codex to Black Hat and found the same structural bug in all three: one component marks a value safe, a later component acts on it with more authority. Gemini CLI's carries a CVSS 4.0 of 10.0.
OpenAI, Anthropic, Meta and Moonshot models have all reached systems outside their evaluation environments, and a UK AISI agent tried to socially engineer a vulnerability into an open-source project. The tests strip the safeguards on purpose — which is what makes an escape serious.
COLDCARD firmware fell back to a deterministic pseudo-random generator seeded from the chip ID and system timing. Researchers say seeds made that way could be reconstructed offline, and the sweep began roughly 30 hours before the flaw was public.
xAI sued in April, the Justice Department intervened two weeks later, and SB24-205 came into force on 30 June regardless. No court has enjoined it and no federal statute preempts it, which makes the compliance obligation entirely real.
Vijay Shekhar Sharma left his first company two weeks before his shares vested, ran an astrology call centre to keep One97 alive, and was dodging his landlord at dawn. Paytm didn't arrive until 2010.
SCTPhantom (CVE-2026-64564) traces to Linux 2.6.25 and has been in every kernel since. Tencent's lab got root on five distributions and escaped a container to host root in six of eight attempts, without CAP_NET_ADMIN or CAP_SYS_ADMIN.
Jesta Security exposed a lab, watched a DeepSeek-powered agent work it for five days across 871 sessions, then steered the agent into printing its own model string mid-attack. Its target list held 1,283 hosts with working credentials.
Member states had until the end of July to implement the Right to Repair directive. The bigger change comes in 2027, when phones, tablets, earbuds and laptops sold in the EU must let users swap the battery with ordinary tools.
H1 2026 funding held up. Q2 didn't: $4.4bn, down around 30% on both Q1 and the year before, with round counts falling too. The total survived because eight companies took $100m or more.
CVE-2026-9198 gives unauthenticated remote code execution on default Langflow deployments, and it was patched in July. Telemetry recorded 650 exploitation attempts from 244 IPs before CISA added it to the KEV catalog on 5 August.
CVE-2026-18577 exists because the fix for CVE-2026-18556 didn't finish the job. Both are being exploited, and N-central sits at the top of MSP estates — admin on the server means Take Control access to every endpoint underneath it.
Regulation (EU) 2026/1744 entered into force on 27 July, moving Annex III high-risk obligations to December 2027 and embedded systems to August 2028. Prohibitions, GPAI rules and transparency duties are unaffected — and already in force.
DRAM contract prices nearly doubled in a quarter as Samsung, SK Hynix and Micron moved capacity to the stacked memory that feeds AI accelerators. Device makers are responding with higher prices — and, more quietly, by holding RAM configurations still.
The wall-of-rejections narrative gets attached to Zomato often enough to read as fact. It never happened: the founders ran it as a side project for eighteen months, bootstrapped for two and a half years, and nearly bought a $10 domain instead.
Volexity says a threat actor it tracks as UTA0533 is harvesting credentials from compromised SonicWall appliances, and researchers note INC Ransomware has picked up its pace since the start of August.
Explore the latest cybersecurity threats in 2026 including AI-powered attacks, advanced ransomware, phishing 2.0, and identity-based breaches. Stay ahead with deep research insights.
Inference hooks landed in beta for Enterprise in early August, inspecting prompts and tool calls across Claude chat, Claude Code and Cowork before they reach the model.
OWASP has ranked it the top LLM vulnerability three years running. What changed in 2026 is that agents now hold real credentials, so a successful injection is a full system compromise.
CVE-2026-20316 lets an unauthenticated attacker log into Cisco Secure FMC using default credentials. Chained with CVE-2026-20079, that becomes root.
Attack volume jumped nearly 20% month over month. Qilin alone accounted for 372 incidents across Europe, hitting 26 of 31 countries analyzed.