Cybersecurity

Read more of this story at Slashdot.

Read more of this story at Slashdot.

Read more of this story at Slashdot.

Read more of this story at Slashdot.

Read more of this story at Slashdot.

ChatGPT now lets users lock private conversations with a PIN or biometrics. Learn how Locked Chats works, its limitations, and the risks of resetting a PIN.

The post ChatGPT Locked Chats Explained: How to Use It and What to Know appeared first on TechRepublic.

Get to know the ins and outs of cyber threat intelligence and how your company's security can be can be strengthened by putting threat intelligence into place.

The post How to choose the right CTI tools for your business appeared first on TechRepublic.

Google Chrome introduces suspicious-site warnings and AI-powered ClickFix detection, with both new defenses tied to Enhanced Protection mode.

The post Chrome Adds Suspicious Site Warnings and ClickFix Protection appeared first on TechRepublic.

Critical PHP flaws forced European government websites offline. Learn which PHP versions need patches and what IT teams should do.

The post EU Website Outages Follow Critical PHP Flaws: What IT Teams Should Know appeared first on TechRepublic.

Amazon's new Bee AI devices can summarize conversations, but their recording controls raise consent questions for employers and meeting participants.

The post Amazon Bee Frontier and Bee Eclipse Raise Workplace Consent Concerns appeared first on TechRepublic.

Presently sponsored by: After the Hugging Face incident, everyone asked the same thing. What did the agents actually do? Origin answers it: prompt to outcome.

I have this sense that we've passed the point where "vibe coding" is a derogatory term. I have no empirical evidence for this; it's more a feeling that those weaponising the term have now accepted the inevitability and are just getting with the program.

Presently sponsored by: After the Hugging Face incident, everyone asked the same thing. What did the agents actually do? Origin answers it: prompt to outcome.

I remember the name of that AI doco now - The AI Doc: Or How I Became an Apocaloptimist. I was watching it on the long-haul flight home the other day, and what I found particularly engrossing was the polar-opposite opinions from a bunch of people: "it'

Presently sponsored by: After the Hugging Face incident, everyone asked the same thing. What did the agents actually do? Origin answers it: prompt to outcome.

I'm in Denmark! Well, just, I'm now at Copenhagen airport ready to begin the long trek home, with the final event at GOTO now done and going just perfectly. This week, there are two ShinyHunters arrests in the news: Pepijn in the Netherlands and then Saif

Presently sponsored by: After the Hugging Face incident, everyone asked the same thing. What did the agents actually do? Origin answers it: prompt to outcome.

How's that view?! With NDC Oslo now done, it's a little bit of sightseeing before heading to Denmark for GOTO in Copenhagen for Scott's and my "Cyber-broken" talk. In the meantime, this week is mostly about the ShinyHunters trajectory targeting both

Presently sponsored by: After the Hugging Face incident, everyone asked the same thing. What did the agents actually do? Origin answers it: prompt to outcome.

Heads up: the first 7 mins is a bit quiet until we worked out the external mic was misbehaving - sorry! But get through that and have a listen to Scott's experiences with how Report URI is identifying malware-infected machines within orgs, all due to CSP reporting. It&

PHP maintainers have released fixes for two critical vulnerabilities:

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs...

There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS).

Really nice resource. It’s fun to reread my 2002 essay on the economics of information security.

Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him:

Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A press release from earlier this year confirms AU is a new product for 2026.

[...]

According to Cellebrite, AU:

• is a “next-generation AFU vector that is more resilient to Apple’s OS changes”
• works with Stolen Device Protection enabled, which tightens USB restrictions
• is enabled by a dedicated appliance with a stated range (!) of about 8 meters...

Interesting research:

Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first. Specialized detectors invert the trade-off, answering in milliseconds but only for categories they were trained on. Neither improves with exposure. We study what changes when a solver improves with use. Our system pairs a fine-tuned YOLOv8 detector with an open-weight VLM behind a confidence-based router, and runs entirely from screenshots and operating-system input events, with no browser automation or DOM access. It reaches 85.4% overall and 84.2% macro accuracy across 16 classes, exceeding either component alone. Every answer VLM produces also serves as a training label, so the detector absorbs categories it was never trained for, typically after one or two encounters and without human annotation. The same loop also repairs it. A CAPTCHA operator can perturb images against the publicly released detector and drive its accuracy to 0%, but the perturbations leave VLM untouched, and its labels let the detector recover. Under a year-long simulated arms race in which the CAPTCHA operator re-crafts its perturbations each month, the solver recovers every round, and a cheap ~70%-accurate open-weight teacher hardens it as effectively as a perfect oracle. Visual CAPTCHA defenses that assume a failing bot stays failing therefore understate how quickly an adaptive solver returns...

New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.