Breaking news and updates from the world of technology.
ShieldCrash reads arbitrary files as SYSTEM on fully patched Windows 10, 11, and Server machines, bypassing a fix Microsoft shipped for the researcher's previous exploit less than a month earlier.
The Siri rebuild Apple showed off at WWDC 2024 and promoted in iPhone 16 ads — then delayed twice and paid $250 million to settle a false-advertising suit over — finally rolls out today as part of iOS 27.
A single malicious link was enough to backdoor any machine running Sogou Input Method — researchers at Gen Digital uncovered UNC3569 exploiting a chained three-flaw attack via an outdated Chromium 80 engine.
A maximum-severity path traversal bug in GitLab’s commits API lets unauthenticated attackers read any file on the server — active exploitation began within hours of disclosure.
No server was hacked and no password was stolen — fraudsters simply spoofed a government email account and asked. Revolut handed over passports, driving licenses, selfies, and transaction histories for a group of customers crypto investigator ZachXBT says were likely targeted for their wealth.
A 24-day exploitation campaign chained three CVEs — including a standalone CVSS 9.8 authentication bypass — to gain admin control of self-hosted Artifactory instances and deploy persistent Rust malware. Between 49–62% of public instances remain unpatched.
The Netherlands NCSC has assessed both pre-authentication RCE vulnerabilities as facing near-term exploitation. All organizations running Check Point Security Gateways should apply LivePatch Take 24 immediately.
The three payment giants are exploring how to align their separate AI-agent verification protocols as agentic commerce is projected to reach $3-5 trillion by 2030.
The Italian holding company known for gutting staff at Evernote and WeTransfer after acquiring them is buying the collaborative whiteboard platform in an all-cash deal.
New connected products sold in the EU from today must give users direct data access by default, closing a gap in the Data Act's request-based rules from last year.
OpenAI's safety monitoring surfaced a 15-year-old's messages asking what he'd need to attack classmates, triggering a cross-border alert that reached Argentine police within days.
Two independent security disclosures this week found nearly every major AI coding agent executes trust-sensitive background commands before any approval prompt fires — a structural pattern, not a single bug.