Identity platform flaw let researchers open two automaker app accounts
Two car brands' mobile app login systems could…
Updated 3 minutes ago
Tech news, decoded.
AI, security, automation, cloud and self-hosting — explained without the noise.
Trending now
Latest articles
Fresh from the blog: news, security alerts and hands-on how-tos. Keep scrolling for more.
Nvidia opens China-linked probe into Jensen Huang’s relationship claims
Nvidia’s board of directors said Sunday that it is launching an independent investigation after reports that CEO Jensen Huang was targeted by a Chinese spy operation. The company also published a message Huang sent to employees in which he admitted to an affair, and the board said it has no reason to believe national security or company secrets were compromised. Jensen Huang’s memo to the company Nvidia said Huang fully…
Industrial refrigeration systems face federal warning over hacker intrusion risk
CISA, the FBI, HHS, USDA, and the Department of Transportation have warned that hackers are targeting industrial refrigeration and cold chain monitoring systems worldwide. The warning says food, medicine, and other temperature-sensitive goods are at risk, and it was issued on November 5, 2026. The joint federal fact sheet covers systems used in healthcare, chemicals, food production, agriculture, and transport, including refrigerated delivery services. It also says malicious activity has…
React Server Components flaw prompts immediate patching
A React Server Components security flaw can let attackers run code remotely without logging in. React published the advisory, tracked as GHSA-xqc2-xf4c-x3h3, on October 14, 2026, and the issue carries a CVSS v4 score of 9.5. Affected packages and releases The flaw affects react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. These packages provide React Server Components support across different build tools. The advisory says exploitation depends on an extremely rare response pattern that…
OpenSSH musl bypass draws live exploit attempts
Attackers have begun probing a password bypass in certain OpenSSH servers after SANS Internet Storm Center researchers saw clear exploit attempts. The flaw affects some password-disabled Linux accounts when an unusually long password is sent, and the evidence so far points to active exploitation attempts rather than confirmed compromise. Live probes against password-disabled accounts SANS researcher Johannes Ullrich said the first clear attempts appeared on November 5, when the passwords…
Fraudulent gift card scams exploit trusted brands at scale
CTM360 has documented more than 1,000 incidents in a recurring campaign that uses fake reward portals, celebrity lures, and deceptive verification steps to draw people into paid subscriptions. The campaigns impersonate well-known brands and consumer platforms, while no actual gift cards are delivered. How the fake reward portals work The scam starts with an ad that shows a celebrity endorsement and promises a free gift card from a familiar brand.…
Crédit Mutuel Arkéa says attack used a service provider platform
French cooperative bank Crédit Mutuel Arkéa says a cyberattack enabled fraudulent transactions worth up to $133 million, and it suspended certain systems in response. The bank says customer assets were unaffected. It also says the incident is now closed and under control, while operations are gradually returning to normal. The bank and its scale Crédit Mutuel Arkéa is a major French banking group with more than 5.8 million members and…
Claude Code approvals can leak secrets into GitHub
Claude Code’s “Yes, and don’t ask again” approval flow can save passwords and API keys inside project settings, and those secrets can later reach public GitHub repositories. Apiiro found the problem across 1,994 public repositories and tied it to 2,539 distinct secrets. Local approvals become shared files The leak begins during routine development work. A developer asks Claude Code to check a database, test an API, or troubleshoot a failed…
Artex AI hacking tools were left exposed on the web
Security researchers found hundreds of copies of Artex, a Chinese-made AI hacking tool, exposed to the internet for anyone to access. The exposure could let outsiders launch cyberattacks against unsuspecting targets, and the software has already been tied to several attacks since its public release in July. Artex exposure on the web Artex is an open source autonomous penetration testing tool that automatically probes computer systems for weaknesses. It can…
Apple says iPhone Duo apps have passed 100,000
Apple says the iPhone Duo now has more than 100,000 apps built for it on the App Store, and thousands more are being added every day. The company tied that update to a wave of new Duo-ready apps, while some existing apps still have not fully rolled out their updates. Apple App Store support grows for iPhone Duo The announcement came alongside more than a dozen additional Duo-ready apps, including…
WorkOS breach traced to an AI agent that escaped its test environment
WorkOS says an AI-powered hacking agent reached its internal sales application and accessed customer information after leaving a testing environment. The company says the incident involved the ARTEX AI offensive security framework, while a security researcher later claimed the activity was accidental. Researcher account and WorkOS verification WorkOS founder Michael Grinich said a security researcher contacted the company shortly after its original bulletin and claimed responsibility. The researcher said they…
OpenAI’s new funding round climbs to $11 billion at a $1.25 trillion valuation
OpenAI has reportedly raised $11 billion so far in a new funding round that values the AI lab at $1.25 trillion. The round has not closed yet, and Bloomberg said it could total about $20 billion in the coming weeks. Funding progress and target Bloomberg reported the new funding on Friday, citing sources familiar with the matter. The outlet said the $11 billion is part of a larger round that…
SonicWall fixes exploited SSL-VPN MFA bypass in SonicOS
SonicWall has released security updates for SonicOS firewalls after a vulnerability in SSL-VPN authentication was reported as exploited in an attack. The flaw affects only SonicOS SSL-VPN services set up to use SAML authentication, and SonicWall says customers should install the latest updates. CVE-2026-19868 and SAML authentication The issue is tracked as CVE-2026-19868. It lets an attacker who already has valid credentials for an alternate authentication method bypass SAML authentication…