Search
13 stories found
Researchers found a malicious instruction file that tricked a coding agent into installing an unauthorized npm package — and reproduced it with a 90% success rate. Five settings that close the hole.
DeepSeek's Harness team published an MIT-licensed research prototype that watches a GitHub repo, takes authorized requests and answers with pull requests. It passed 11,000 stars within days — but DeepSeek itself says it is not production-ready and runs with full user access.
A misconfigured DNS resolver, chained zero-days and a covert channel built from CPU cache timing — OpenAI's own red team found the paths. Here's what happened and why it matters beyond OpenAI.
Amazon's cloud unit accelerated for another quarter and now earns 63% of the company's operating profit, but $77 billion of quarterly capex pushed trailing free cash flow to minus $42 billion.
An open-source scanner compares your system against ~12,400 published indicators from 25 sources — without sending anything anywhere. What it can find, what it can't, and how to run it in five minutes.
Synology says attackers are exploiting a DSM flaw it patched in December 2024 to plant C3RB3R ransomware, which also encrypts backups on the same device. Researchers disagree about the entry point, so the safe move is the latest build for your DSM branch plus a few quick checks.
Google's Suncatcher prototype satellite returned its first AI response from a data-center-class TPU in orbit. It's a real hardware milestone, but it says very little yet about whether space data centers can compete on cost.
A polished, ad-free, offline-capable vocabulary app — and the more interesting part is that its words, illustrations and audio are released under CC BY 4.0 for anyone to build on.
Semiconductors were almost half of Korea's $115.3 billion in October exports, and Samsung and SK hynix's latest quarters show how much of that is AI-driven memory pricing.
Attackers chained an authentication bypass with two newer Ivanti Connect Secure flaws to get root on VPN appliances, and CISA's first federal deadline has already passed. Here's which builds fix it and what to check if your box was exposed.
Two critical flaws in PHP's default upload-progress feature allow unauthenticated remote code execution. Here are the fixed versions, a one-line check, and the config change that buys you time.
A new arXiv preprint claims a theorem showing that JEPA models trained on different modalities converge to the same representation. It reports that a 109M-parameter text model out-aligns 72B LLMs. The results are striking, but they are benchmark-specific and not yet peer-reviewed.
CISA has added CVE-2026-97229 to its exploited-vulnerabilities list after an attack on Alpine Linux's GitLab server. The flaw lives in Ruby's regex engine, so self-built and custom GitLab images can stay vulnerable even on a "fixed" version number.
