Cybersecurity
Ongoing coverage on Cybersecurity.
Latest coverage
A malware dev has committed a magnificent self-own after an AI-coded malicious package leaked its own GitHub private…
Researchers at Ox Security have discovered a malicious npm package called mouse5212-super-formatter, which was designed to steal information from Claude users. The AI-coded malware reportedly leaked its own GitHub private token, allowing researchers to trace the stolen files and analyze its operations before the threat actor's account was deleted.
Evening Safety Dance
Ars Technica reports on new methods for websites to track visitors by analyzing SSD activity. Additionally, The Register covers how CrowdStrike and Google have disrupted the Glassworm botnet.
Evening Legal Briefs
The FBI reported that criminals are stealing data from legal offices using USB drives. Separately, California has defeated Tesla's attempt to dismiss a racial discrimination lawsuit.
Morning Safety Dance
Microsoft's GitHub platform has banned a security researcher who posted zero-day exploits for Windows. The researcher claims the company's actions have negatively impacted their life.
AI Yi-Yi!
A critical vulnerability has been discovered in an open-source package, potentially imperiling millions of artificial intelligence agents. The issue was reported by Ars Technica, highlighting a significant cybersecurity risk within the AI development ecosystem.
Evening Safety Dance
The article highlights cybersecurity vulnerabilities from the week of May 18, 2026, as reported by CISA. It also discusses the decision MyPillow faces regarding ransomware demands and questions the lack of investigation into such incidents.
On Sale
Humble is offering a "Spring Hunting Collection 2026" bundle for Monster Hunter, allowing customers to pay what they want while supporting charity. Additionally, a "Cybersecurity & AI Defense Mega Bundle" by Packt is available with a similar pay-what-you-want model.
Morning Safety Dance
Artificial intelligence has drastically reduced the time it takes to exploit zero-day vulnerabilities from a year down to a single day, with the potential to reach one minute. The "Zero-Day Clock" indicates a significant collapse in the security window for these previously unknown software flaws.
AI Yi-Yi!
Pope Leo has issued a 42,300-word encyclical warning about the potential risks associated with Artificial Intelligence. Separately, an article from WIRED discusses how the AI era is fueling an 'arms race' in bug hunting within the tech industry.
Saturday Safety Dance
Anthropic's Mythos system has reportedly identified over 10,000 vulnerabilities. Separately, attackers exploited valid certificates and stolen accounts to compromise npm's security, undermining its trust mechanisms.
Evening Safety Dance
Lawmakers are seeking answers from CISA regarding a data leak, while Microsoft has confirmed two significant security vulnerabilities in its Defender software, urging users to update immediately to prevent potential attacks.
Evening Legal Briefs
Microsoft has finalized its acquisition of Activision Blizzard after a four-year regulatory process. Separately, law enforcement announced a successful hack of a VPN service used by criminals, highlighting vulnerabilities in perceived online safety.
Evening Safety Dance
Discord's recent privacy feature has not improved its user reputation. Separately, Democratic politicians are criticizing proposed cyber funding cuts by Donald Trump, referencing the January 6th events.
Morning Safety Dance
Microsoft is phasing out SMS-based two-factor authentication for sign-ins, a move that could impact user security. Separately, a hacker group is reportedly poisoning open-source code at an unprecedented scale, posing a significant threat to software supply chains.
Security researcher describes freshly uncovered Windows 11 vulnerability as 'one of the most insane discoveries I…
A security researcher known as Nightmare-Eclipse has discovered a BitLocker bypass vulnerability in Windows 11, dubbed YellowKey. The exploit allows attackers to access encrypted drives by abusing the Windows Recovery Environment, a vulnerability that does not appear to affect Windows 10. Microsoft has acknowledged the issue as a security feature bypass.
Devs, be careful what you plug in: GitHub security breach was apparently facilitated by a 'poisoned Visual Studio…
GitHub has reported a cyberattack resulting in unauthorized access to its internal repositories. While customer information does not appear to be compromised, the platform confirmed that the attacker's claims of exfiltrating approximately 3,800 repositories are consistent with their investigation. Hacker group TeamPCP has claimed responsibility, but stated their motivation is not extortion, and they are seeking buyers for the data or will leak it for free.
Web infrastructure company Cloudflare says Claude Mythos reasoning 'looks like the work of a senior…
Cloudflare has analyzed Anthropic's Claude Mythos AI model, finding it to be a significant advancement in identifying and exploiting software vulnerabilities. While the model can chain low-severity bugs into severe exploits, Cloudflare suggests a more directed, multi-agent approach is more effective than a single agent reviewing large codebases. The company believes the focus should shift from rapid patching to architectural defenses that make exploitation harder, even when bugs exist.
Your Nvidia drivers could be insecure, and you should update now
Nvidia has released a security bulletin detailing vulnerabilities in several versions of its GPU drivers for GeForce, Quadro, and Tesla products. The company strongly recommends users update to the latest driver versions immediately to patch issues that could lead to denial of service, privilege escalation, information disclosure, data tampering, or code execution.
Your Nvidia GPU Needs A Driver Update Right Now, Unless You Enjoy Surprise Malware DLC
Nvidia has issued a critical security alert for its graphics card drivers on Windows and Linux, urging users to update to version 596.49 immediately. Hackers have exploited a vulnerability to gain unauthorized access to PCs, potentially stealing data or injecting malware. The company also introduced Auto Shader Compilation for RTX 50-series cards, designed to compile shaders in the background during idle times.
Your Nvidia GPU Needs A Driver Update Right Now, Unless You Enjoy Surprise Malware DLC
Nvidia has issued a critical security alert for its graphics card drivers on Windows and Linux, urging users to update to version 596.49 immediately. Hackers have exploited a vulnerability to gain unauthorized access to PCs, potentially stealing data or injecting malware. The company also introduced Auto Shader Compilation for RTX 50-series cards, designed to compile shaders in the background during idle times.