OpenAI’s GPT-6 Astra silently obstructed safety research tasks
OpenAI disclosed that its GPT-6 Astra frontier model sometimes hindered safety research by complicating simple tasks, abandoning viable approaches, and silently refusing researchers’ requests. During evaluation, the AI company’s model reported nonexistent or self-made blockers without explaining its restrictions to users. OpenAI said it first received a report of what it calls “covert underperformance” in […]
OpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password. The flaw only affects OpenSSH servers running on Linux distributions that use the musl C library, including Alpine Linux, OpenWrt, […]
Hackers backdoor Linux servers using trojanized CWP web server
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. CWPdoor acts as a passive backdoor that sits dormant on the compromised system until the attacker sends a specially crafted request. Researchers at XLab, the cybersecurity research arm of […]
DigiCert data breach exposes customer information, identity documents
DigiCert warns it suffered a data breach after a server migration mistakenly exposed an internal business system to the internet, allowing unauthorized access to customer information and identity documents. The certificate authority says the breach affected a small portion of its archived customer data, including names, business email addresses, phone numbers, and business addresses. For […]
GhostMap Android flaw lets malicious app trigger persistent boot loop
Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed. To cause the persistent denial-of-service (DoS), the app triggers a vulnerability that researchers dubbed ‘GhostMap’ that makes Android map a file into an unallocated memory region. The affected process crashes […]
Vercel rolls out new protection against stolen session cookie attacks
Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. The new feature, announced by Vercel’s CTO Malte Ubl on X, binds a login session to the user’s device with a private key stored in a TPM, so even if the session cookie is […]
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The vulnerability, tracked as CVE-2026-107441, is an out-of-bounds write flaw in the switches’ web management interface that allows an unauthenticated attacker with network access to execute operating system […]
DreamHost confirms data breach exposed FTP logins and webmail sessions
DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers’ FTP/SFTP usernames and passwords. This follows the American web hosting provider and domain registrar’s announcement that it suffered a cybersecurity incident requiring users to reset their email and FTP/SFTP passwords. In a data […]
Cyberattack disrupts blood storage refrigeration systems in France
France’s national blood service has confirmed that a cyberattack targeting a refrigeration equipment provider raised temperature and defrost settings at three of its facilities, threatening stored blood products. The French Blood Establishment (Établissement français du sang or EFS), which manages blood collection, processing, and distribution across France, said the incident occurred on November 2 and affected […]
NIKKE PC game launcher hacked to spread remote access, data-stealing malware
The developers of Goddess of Victory: NIKKE have confirmed that hackers tampered with the game’s PC launcher scripts in a supply-chain attack, distributing malware capable of stealing credentials and cryptocurrency wallet data. According to a notice published on X, a client update was issued on November 4 at 02:30 (UTC +9) to address the issue. […]