New attack provides one more reason why AI browsers are a bad idea
Telling an LLM that 2 + 2 = 5 is enough to make it follow forbidden instructions.
Dan Goodin
–
|
75
Security
US offers $10 million for info on group behind Signal and WhatsApp hacking spree
Operation by two Russia-state groups has been ongoing since at least March.
Dan Goodin
–
|
52
One-two punch delivered in global operation disrupts cybercrime “assembly line”
“Operation Endgame” simultaneously disrupts two widely used crime tools.
Dan Goodin
–
|
13
White House drastically shortens deadline for dropping quantum-vulnerable crypto
Order warns of national security risks if post-quantum cryptography isn’t adopted in time.
Dan Goodin
–
|
55
Following user outcry, AMD reinstates memory encryption in consumer CPUs
Critics saw the move as an underhanded way to steer them toward more costly chips.
Dan Goodin
–
|
49
Microsoft discovers new lightweight backdoor that steals cryptocurrency
Crypto Clipper spreads over USB and communicates over Tor.
Dan Goodin
–
|
83
Apple patches high-severity eavesdropping vulnerability in Beats Studio Buds
The vulnerability, disclosed 12 months ago, affects multiple manufacturers.
Dan Goodin
–
|
15
Massive breach spills credentials for thousands of sensitive networks
The affected include Oracle, Lenovo, FedEx, a NATO contractor, and Fortinet.
Dan Goodin
–
|
89
Most Read
“Dangerous” AI models are coming no matter what
AI models with advanced hacking capabilities will soon be the norm.
WIRED
–
|
133
Windows and Linux users: The deadline to update Secure Boot keys is near
What you need to know about the expiration of keys securing your machine’s boot sequence.
Dan Goodin
–
|
165
Critical Copilot vulnerability allowed hackers to steal 2FA code from users
SearchLeak exploit shows why the industry’s approach to LLM security fails over and over.
Dan Goodin
–
|
92
Users cry foul after AMD stripped memory crypto from its consumer CPUs
AMD’s stripping of TSME from consumer CPUs appears to be a deliberate, covert move.
Dan Goodin
–
|
101
PeopleSoft 0-day affecting hundreds of organizations steals gigabytes of data
Vulnerability in the Oracle-owned PeopleSoft software is about as critical as they come.
Dan Goodin
–
|
48
Locked in heated rivalry with researcher, Microsoft fixes 0-day they disclosed
A separate zero-day also disclosed by Nightmare Eclipse appears to be patched as well.
Dan Goodin
–
|
111
High-severity vulnerability in Linux caused by a single faulty character
Use-after-free bug can be exploited to evade sandbox defenses.
Dan Goodin
–
|
56
For the 2nd time in weeks, Microsoft packages laced with credential stealer
73 packages run self-replicating stealer as soon as they’re opened by an AI agent.
Dan Goodin
–
|
39
How a USB-connected speaker can infect a PC without ever being touched
Seller of the Sound Blaster Katana V2X doesn’t consider the behavior a vulnerability.
Dan Goodin
–
|
139
Dashlane explains how attackers managed to download encrypted password vaults
By targeting large numbers of users, attackers increased their chances of success.
Dan Goodin
–
|
82
Can’t make sense of Dashlane’s vault theft notification? You’re not alone.
Security advisory leaves out key details. Dashlane maintains complete silence.
Dan Goodin
–
|
40
Hackers duped Meta AI support chatbot to steal celebrity Instagram accounts
Pricey Instagram handles were stolen and resold before Meta patched the exploit.
Jeremy Hsu
–
|
51
Dozens of Red Hat packages backdoored through its official NPM channel
Anyone who has downloaded affected Red Hat packages should investigate immediately.
Dan Goodin
–
|
40