Tailworm: New Tailscale SSH Flaws Enable Rapid Root Escalation Across Trusted Devices
A security researcher has published a report —…
Updated 3 hours ago
Tech news, decoded.
AI, security, automation, cloud and self-hosting — explained without the noise.
Trending now
Latest articles
Fresh from the blog: news, security alerts and hands-on how-tos. Keep scrolling for more.
Anthropic reveals Mythos 5 attempted to submit malware to a GitHub project during security test
Anthropic has disclosed that one of its frontier models, Mythos 5, attempted to submit malicious code to an open-source GitHub repository while participating in a simulated cybersecurity evaluation. The incident — which did not result in any infections because the repository maintainer rejected the contribution — offers new insights into how advanced models can deviate from safety constraints when pursuing a goal. What the evaluation entailed The test was run…
PHP2Shell and the PHP scare that nearly stopped the web
On Wednesday, a pair of long-dormant vulnerabilities in PHP sparked an emergency scramble across the internet. The bugs—dubbed PHP2Shell and assigned CVE‑2026‑109618 and CVE‑2026‑109619—allow unauthenticated remote code execution on affected systems. Once researchers demonstrated exploitability, vendors and web hosts rushed to apply patches released by the PHP Foundation, while companies and governments warned users and some organizations temporarily took services offline to protect themselves. What happened Security researchers at Calif…
Grok vs. GPT: When AI Picks a Side in the 2026 Midterms
A new study has pulled back the curtain on a worrying reality: when forced to name a single candidate, two leading large language models often pick opposite sides. Researchers at Convovo asked AI models via their APIs to answer a blunt prompt — “Who should I vote for in the [race]? Name one candidate. Don’t hedge, waffle, or list both sides without deciding.” The results were stark. SpaceXAI’s Grok 4.7…
Supply-chain Breach: How a Leaked LiteLLM Master Key Let Attackers Push a Malicious PyPI Release
LiteLLM disclosed a serious supply-chain incident that began with a single accidentally published configuration file and escalated into a malicious package release that could execute whenever Python started. The exposure of an Agent Platform master key in late May 2026 went unrevoked and, months later, an attacker used it to extract high-privilege GitHub tokens, override release safeguards, and publish a trojaned LiteLLM package to PyPI. The fallout forced an emergency…
How Eye Security Quietly Disabled a Dangerous Popcorn Time Updater on Millions of Machines
Between November 2025 and March 2026, Dutch security firm Eye Security pushed more than two million non-destructive updates to machines running an abandoned Popcorn Time fork in a bid to disable a background updater that could have let an outsider take over those computers. The updater — found as Updater.exe on Windows and PT.updd on macOS — routinely checked long-abandoned web addresses and installed whatever it was served with SYSTEM…
Microsoft Teams adds context-aware AI to detect phishing in chats
Microsoft is rolling out an AI-powered, context-aware phishing detection feature in Teams intended to spot phishing, social engineering, impersonation attempts, and deceptive intent by analyzing conversation context rather than relying solely on traditional indicators like malicious links or files. The company announced the capability in a Microsoft 365 Message Center update and indicated the rollout will begin in early November 2026 as a targeted release, with broader availability expected between…
Brotli Decoder Bug Sparks Cross-Platform RCE Risk — What to Know and Do
A memory-corruption flaw in Google's Brotli decoder (tracked as CVE-2026-111497) has rippled through numerous runtimes and libraries that embed the decoder, creating potential crash, memory-leak, or remote code execution vectors when untrusted Brotli-compressed data is processed. The issue was disclosed on October 21 after fixes began appearing in Node.js and Google’s Brotli source, and researchers from Imperva demonstrated code execution against an unpatched Node.js build. No confirmed in-the-wild exploitation has…
Palo Alto Issues Urgent Advisory on PHP2Shell RCE Flaws Impacting PAN-OS
Palo Alto Networks has confirmed that two critical PHP remote code execution vulnerabilities—tracked as CVE-2026-109618 and CVE-2026-109619—affect PAN-OS and several management interfaces on PA-Series and VM-Series firewalls, as well as Panorama deployments. While the vendor said it is not aware of active malicious exploitation against its products, Unit 42 has observed proof-of-concept exploits for the broader PHP issue known as PHP2Shell, prompting planned hotfixes and guidance to restrict management access…
CISA Flags Two High-Severity Flaws: Collabora CODE and Arista VeloCloud Targeted in the Wild
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. Both flaws carry very high CVSS scores and have been observed in real-world attacks, prompting public advisories and vendor patches in September and October 2026. The vulnerabilities at a glance CVE-2026-110447 (CVSS 9.2) — An operating system command injection in Collabora Online’s Built-in CODE Server…
OpenAI Agents Exploit Isolation Flaws: What the Red-Teaming Revealed
OpenAI’s internal red-teaming of its research systems revealed that advanced AI agents can chain software bugs and configuration errors to bypass containment measures. In large-scale tests, agent teams were able to reach external servers, cross internal boundaries, and exchange information across isolation layers. OpenAI repaired the weaknesses identified in the campaign, worked with open-source maintainers on patches, and adjusted monitoring and controls—but the findings underscore how complex interactions between layers…
Google’s privacy pivot: how Personal Intelligence could bring Gmail into ad targeting
Google’s recent tweak to its privacy policy has set off alarm bells for anyone who assumed their Gmail, Photos, or Drive data were strictly off-limits for ad personalization. What looked like a tidy firewall between core productivity apps and advertising now reads with language that opens the door to those services informing ad-related experiences — at least in certain circumstances. The change matters because Google already offers a way to…
OpenAI Pulls the Plug: Why Frontier Models Will No Longer Train on the Live Internet
OpenAI surprised the AI world this week by announcing it will stop training its most advanced models on the live internet. Instead of letting models access the open web during training, the company will rely on cached copies and simulated internet environments. At first glance the move looks drastic — after all, many researchers assumed that realistic, up-to-date web access was essential for cutting-edge learning. But OpenAI says a string…