Hasty Briefsbeta

All tags

cybersecurity

75 stories total

Bilingual

Anthropic says US lifts export ban on Fable 5
a month ago
- US government lifts export ban on Anthropic's advanced AI models Claude Fable 5 and Mythos 5.
- The ban was initially imposed on June 12 due to national security concerns about potential misuse by hackers.
- Anthropic addressed risks by agreeing to detect security issues, collaborate on future releases, and alert the government of malicious activity.
- Models were restored on Wednesday, with the Commerce Department reserving the right to reconsider the decision if necessary.
- Fable 5 is for consumer use, while Mythos 5 targets businesses and cybersecurity experts, both released on June 9.
- The company disagreed with the initial suspension, arguing that a potential jailbreak finding shouldn't warrant recalling widely deployed models.
Anatomy of a Failed (Nation-State?) Attack
a month ago
- The author describes a targeted fake-interview scam that attempted to backdoor their machine through a TypeScript repository named 'Ticket Harbor'.
- The attack used a malicious patch file (typescript+5.9.2.patch) containing a base64-blob that injected a RAT (PinpinRAT) into the system upon running typecheck or build commands.
- The malware employed multiple obfuscation layers, including XOR decryption and WASM stubs, to evade detection and executed a remote-access trojan with capabilities like file exfiltration and arbitrary command execution.
- Indicators of compromise include C2 server 89.124.107.161:80, specific process masquerades, and environment variables like NODT_PAYLOAD_PATH.
- The attacker used a fabricated persona with a fake LinkedIn profile and defunct company (Lua Ventures) to appear legitimate, but red flags included LLM-generated text, lack of calendar invites, and suspicious domain choices.
.garden TLD's change to a bad neighborhood
a month ago
- The .garden TLD has seen a massive increase in registrations in 2026, with 147,000 domains ingested compared to 2.5k in 2025.
- The average risk score for .garden domains jumped from 55 in 2025 to 84 in 2026, indicating a significant rise in potential threats.
- AliDNS nameservers, particularly when combined with Dominet registrar, contribute to very high risk scores, with some reaching 94.
- Cloudflare accounts for a smaller portion of domains with a slightly below-average risk score, not the primary driver of the overall risk increase.
- Recommendations include blocking the .garden TLD entirely, allowlisting as needed, and evaluating blocking based on registrar or nameserver characteristics like AliDNS or Dominet.
Oracle outlines all the ways it could lose the farm it bet on AI
25 days ago
- UN warns about the urgent need for global governance to prevent AI-related catastrophes, as capabilities outpace safety regulations.
- Oracle discloses numerous risk factors that could jeopardize its significant investment in AI technology.
- Anthropic is removing hidden code previously used to detect Chinese competitors, citing planned deactivation of steganography systems.
- Cloudflare will block bots that scrape content from ad-supported web pages, balancing search visibility and AI training data protection.
- Russian actors are impersonating Signal support for phishing attacks; US disrupts Iranian propaganda sites.
- Microsoft's patches fail to address zero-day attacks on on-prem SharePoint, while China enhances smartphone surveillance tools.
- DEF CON's Franklin project recruits hackers to strengthen critical infrastructure, expanding from successful voting village initiatives.
- EQT acquires a majority stake in Acronis at a valuation over $3.5 billion, boosting cybersecurity investments.
- Mikko Hyppönen marks ten years since corporate ransomware began, predicting no end in sight but highlighting stable infosec careers.
- Collabora releases CODE 26.04 with Markdown and AI features, intensifying competition among FOSS office suites.
- GIMP 0.54 is revived via Flatpak for retro-computing enthusiasts, using the original Motif toolkit.
- Bcachefs exits experimental status in a performance-focused release, incorporating more Rust but facing AI-related challenges.
- France's digital sovereignty efforts struggle to reduce Microsoft dependency, as Nextcloud storage adoption contrasts with Office migration hurdles.
- CentOS evolved from a biochemist's hobby into an enterprise default, fueled by community response to Red Hat's Windows endorsement.
- A Netflix developer open-sources Project Headroom, an app designed to significantly reduce AI operational costs.
Spain Orders Blacklist of Palantir from Public and Private Companies
24 days ago
- The Spanish government has blacklisted Palantir from state-controlled public and private companies due to concerns about misuse of classified national security information.
- Major affected entities include Telefónica, Indra, and Navantia, with procurement deals disrupted, such as a Navantia project and a Guardia Civil agreement.
- Palantir still holds an active €16.5 million defense contract expiring in November 2026, with military leaders lobbying for renewal despite political opposition.
- The blacklist aligns with geopolitical tensions between Spain and the U.S., as Palantir founders have ties to Donald Trump, and Spain is investing in domestic tech alternatives like Openchip.
- Similar pushback against Palantir is occurring in Europe, with France ending collaborations and Germany favoring European competitors.
FBI Seizes NetNut Proxy Platform, Popa Botnet
24 days ago
- FBI seized hundreds of domains linked to NetNut, an Israeli residential proxy service tied to the Popa botnet.
- NetNut used compromised home devices like smart TVs to create proxy nodes for cybercrime, including ad fraud and account takeovers.
- Google disabled NetNut-related accounts and apps, noting widespread use by threat actors to mask malicious traffic.
- NetNut's parent company Alarum Technologies is cooperating with law enforcement following the domain seizures.
- Security experts say the takedown disrupts major proxy networks, impacting cybercrime and reducing DDoS botnet resources.
- Consumers are advised to use reputable TV brands and avoid unofficial Android systems to prevent proxy enrollment.
- Proxy tracking services and apps for smart TVs often include SDKs that turn devices into proxy nodes without user consent.
- Efforts are ongoing to seize additional domains, with some NetNut infrastructure still active or under legal scrutiny.
Startup sues Palo Alto Networks' Koi Security due to AI-hallucinated report
24 days ago
- Nvidia introduces a double-dipping datacenter financing scheme in AI, focusing on dual payments.
- Companies adding more AI also hire more people, but may not meet business needs effectively.
- SoftBank enters the GPU rental market for AI training amid its US server farm construction.
- UN warns of AI risks, calling for global governance to ensure safe and responsible use.
- Oracle outlines numerous risk factors in its AI-focused strategy, including potential losses.
- Russian phishing attacks impersonate Signal support, alongside US takedowns of Iranian propaganda sites.
- Microsoft patches fail to fix on-prem SharePoint vulnerabilities, now under zero-day attack.
- DEF CON expands efforts to harden critical infrastructure by involving hackers through the Franklin project.
- EQT acquires a majority stake in Acronis at over $3.5 billion valuation for cybersecurity.
- Mikko Hyppönen notes no end in sight for corporate ransomware, despite infosec career stability.
- Collabora releases CODE 26.04 with AI integration off by default, amid competition in FOSS office suites.
- GIMP 0.54 is revived in Flatpak form for retro-computing nostalgia, featuring the Motif interface.
- Bcachefs exits experimental status in a 'performance release', with increased Rust and AI-related issues.
- France's digital sovereignty push struggles against Microsoft's dominance, exemplified by Nextcloud rollouts.
- CentOS evolved from a hobby project to an enterprise OS, driven by community after Red Hat changes.
- Netflix developer creates open-source app Headroom to reduce AI costs, offering potential savings.
Amazon's Mechanical Turk to stop accepting new customers
24 days ago
- Nvidia introduces a datacenter financing scheme to get paid twice for AI/ML services.
- Adding more AI leads to hiring more people, but may not align with business needs.
- SoftBank enters the GPU rental market for AI training in the US.
- UN warns of the need for global governance to prevent AI risks, as capabilities outpace regulations.
- Oracle highlights various risk factors related to its heavy investment in AI.
- Russians are conducting phishing attacks by posing as Signal support.
- Microsoft's patches failed to fix SharePoint vulnerabilities, leading to zero-day attacks.
- DEF CON expands to include hacking efforts to harden critical infrastructure.
- EQT acquires a majority share in Acronis at a valuation over $3.5 billion.
- Mikko Hyppönen notes no end in sight for corporate ransomware after ten years.
- Collabora releases CODE 26.04 with Markdown support and AI integration in FOSS office suites.
- GIMP 0.54 is revived in Flatpak form for retro-computing enthusiasts.
- Bcachefs exits experimental status but faces issues with AI-generated content.
- France struggles to achieve digital sovereignty as users remain tied to Microsoft products.
- CentOS's history from a hobby project to the enterprise default OS, driven by community efforts.
- Netflix engineer open-sources Project Headroom to reduce AI-related costs.
Hackers shoveled snow for company, were rewarded with network admin access
23 days ago
- Nvidia introduces a double-dipping datacenter financing scheme to maximize payments.
- Companies adding more AI also increase hiring, but it may not align with business needs.
- SoftBank enters the GPU rental market for AI training, leveraging its US server farm.
- UN warns that AI capabilities outpace governance, urging global rules to prevent risks.
- Oracle highlights numerous risk factors related to its heavy investment in AI.
- Russian attackers impersonate Signal support for phishing, amid other security incidents.
- Microsoft's patches fail to fix on-prem SharePoint vulnerabilities, now under zero-day attack.
- DEF CON expands its Franklin project to involve hackers in securing critical infrastructure.
- EQT acquires a majority stake in Acronis at a valuation over $3.5 billion.
- Mikko Hyppönen notes no end in sight for corporate ransomware, a decade after its first appearance.
- Collabora releases CODE 26.04 with Markdown and AI features, though AI is off by default.
- GIMP 0.54 is revived in Flatpak form for retro-computing enthusiasts.
- Bcachefs exits experimental status with a performance release, including more Rust but AI-related issues.
- France's digital sovereignty push faces challenges in moving users away from Microsoft Office.
- CentOS's history shows how a hobby project became a default enterprise OS after community efforts.
- Netflix engineer open-sources Project Headroom to reduce AI costs significantly.
New serious vulnerabilities spiked around release of Claude Mythos Preview
23 days ago
- In April 2026, Anthropic announced its Claude Mythos Preview model capable of autonomous cybersecurity vulnerability discovery and exploitation.
- Anthropic and OpenAI then began using frontier models to harden critical software before malicious actors could use the same models for harm.
- The number of Common Vulnerabilities and Exposures (CVEs) increased significantly after these announcements.
- High- and critical-severity vulnerabilities increased more than 3.5 times in June compared to the previous monthly record before the Mythos Preview announcement.
Espionage Against the European Parliament
23 days ago
- Former MEP Stelios Kouloglou was repeatedly hacked with NSO Group's Pegasus spyware while serving on the PEGA committee investigating spyware abuses.
- The infections occurred during critical periods of PEGA committee activity, potentially compromising confidential documents, deliberations, and parliamentary privilege.
- Forensic analysis confirmed infections on October 21, 2022, and March 6-7, 2023, with possible exposure of sensitive information including health data and committee communications.
- The attacker used the PWNYOURHOME zero-click exploit, and the same operator may have targeted exiled Russian and Belarusian-speaking journalists and activists in Europe.
- No attribution to a specific government was made, and no evidence points to the Greek government, but the license likely allowed infections across multiple EU jurisdictions.
- This case highlights the threat of mercenary spyware to democratic processes, with several other MEPs also previously targeted.
- Recommendations include immediate forensic screenings for MEPs and staff, enhanced cybersecurity measures, and investigations by EU institutions into the breach.
Soatok's Informal Guide to Threat Models
23 days ago
- Threat modeling is a key cybersecurity process, often misunderstood or used as a buzzword.
- A basic threat model should answer what assets are being protected, who the adversaries are, how attacks might occur, and prevention strategies.
- Important additional considerations include relationships between assets, assumptions made, and which threats are not being addressed.
- Threat models should be living documents, updated regularly as systems and threats evolve.
- Starting threat modeling involves mapping system components and iteratively analyzing them for risks and assumptions.
- Good threat models list assumptions, assets, actors, and risks with mitigation statuses (prevented, mitigated, addressable, open).
- Bad threat models are often incomplete lists of attacks without clear assets, assumptions, or relationships.
- Threat modeling helps improve security by identifying and mitigating risks, leading to better design choices like using passkeys over passwords.
- In decentralized systems, threat modeling reveals challenges such as ensuring message ordering and avoiding central authorities.
- Understanding threat models aids in evaluating technical debates, such as those around post-quantum cryptography and hybrid vs. pure algorithms.
AI Agent ransomware attack through Langflow instance by exploiting CVE-2025-3248
23 days ago
- Falco Feeds extends Falco by providing continuously updated expert-written rules.
- JADEPUFFER is the first documented case of agentic ransomware, a fully automated extortion operation driven by an LLM.
- Initial access was gained via CVE-2025-3248, a missing-authentication flaw in Langflow, allowing arbitrary Python execution.
- The campaign involved two targets: the Langflow instance and a production database server.
- Phase 1 included reconnaissance, credential harvesting, lateral discovery, and persistence via a crontab beacon.
- Phase 2 involved attacking a Nacos service, exploiting vulnerabilities, and deploying ransomware to encrypt and delete data.
- Evidence of LLM-driven automation includes self-narrating code, rapid failure correction, and comprehension of natural language context.
- Recommendations include patching Langflow, hardening Nacos, enforcing egress controls, and monitoring for IoCs.
EU appears to find datacenter emissions easier to offset than lobbyists
22 days ago
- Nvidia launches datacenter financing scheme allowing double payments.
- Adding more AI to companies leads to hiring more employees but not necessarily meeting business needs.
- SoftBank enters GPU rental market for AI training in the US.
- UN warns global AI governance is needed to prevent catastrophic risks.
- Oracle highlights multiple risk factors in its AI investments.
- Russian actors impersonate Signal support for phishing attacks; US takes down Iranian sites.
- Microsoft patches fail to fix zero-day attacks on SharePoint on-premises.
- DEF CON expands hacker efforts to protect critical infrastructure through the Franklin project.
- EQT acquires majority stake in Acronis for over $3.5 billion valuation.
- After ten years, corporate ransomware persists, making infosec a stable career choice.
- Collabora releases CODE 26.04 with Markdown and AI features for office suites.
- GIMP 0.54 is revived as a Flatpak for retro-computing enthusiasts.
- Bcachefs exits experimental status with performance improvements and Rust integration.
- France's digital sovereignty efforts face challenges in moving away from Microsoft.
- CentOS evolved from a hobby project to a default enterprise OS after community support.
- Netflix engineer open-sources Project Headroom to reduce AI costs.
Security Roundup: Apple's Hide My Email Service Fails to Hide Your Email
22 days ago
- A European Parliament politician on the PEGA Committee was targeted with Pegasus spyware, according to new research. Google warned that EU pro-competition rules could make its Search and Android systems vulnerable to hacking.
- Meta contractors posed as kids and teens to test how chatbots like Gemini and ChatGPT respond to high-risk subjects, including suicide and drugs, per a WIRED investigation.
- A researcher used Anthropic’s Claude Opus to break into Front Gate and issue tickets to major US music festivals, such as Lollapalooza and Bonnaroo.
- Apple’s Hide My Email service is leaking real email addresses due to a vulnerability, with 100% of tested addresses exploitable; Apple has not fixed it despite reports since 2025.
- A 19-year-old alleged member of the Scattered Spider hacking group was extradited to the US and faces charges for hacking a jewelry retailer and demanding an $8 million ransom.
- India threatened WhatsApp over its plan to introduce usernames, citing concerns about increased fraud and cybercrime, and asked to pause the rollout.
- Errors in automatic license plate reader (ALPR) systems have led to innocent people being detained by police, with at least 24 misidentification cases reported over eight years.
Confidential computing's core trust mechanism is broken. The fix may not exist
22 days ago
- Confidential computing relies on remote attestation to prove a server runs in a genuine Trusted Execution Environment (TEE) before sharing sensitive data.
- New research reveals flaws in attested TLS protocols used in confidential computing, allowing relay attacks where a client’s connection can be redirected to a compromised server without detection.
- The study formalizes three levels of cryptographic binding for attestation, with level three (tying evidence to application traffic keys) potentially unattainable in current intra-handshake architectures.
- Real-world implementations like Meta’s WhatsApp, Edgeless Systems’ Contrast, and Cocos AI are vulnerable, leading to CVE-2026-33697, a high-severity vulnerability.
- Despite responsible disclosure, the Confidential Computing Consortium’s Attestation Special Interest Group delayed creating a repository for the research artifacts, raising concerns about vendor influence.
- Germany’s Federal Office for Information Security (BSI) cautions that confidential computing alone cannot meet digital sovereignty requirements, highlighting dependencies on external services.
- Intel and Google continue marketing confidential computing for sovereignty, but Intel avoided addressing legal risks under U.S. laws like RISAA, while Google did not respond.
- The IETF has incorporated formal verification into its standards process, but the sales pitch for confidential computing often overlooks these fundamental security gaps.
- The researcher recommends abandoning intra-handshake attestation in favor of post-handshake methods to achieve stronger security guarantees.
Show HN: Grade your code's post-quantum crypto exposure A–F, free, in-browser
22 days ago
- A Cryptographic Bill of Materials (CBOM) is crucial for identifying quantum-vulnerable cryptography in your stack as part of PQC migration.
- An open-source scanner provides a full scan in CI/CD workflows, generating a CycloneDX 1.6 CBOM, SARIF report, and an A–F grade badge without uploading data.
- The scan can be run locally via npm or integrated into GitHub Actions, with options to fail builds on broken classical cryptography.
- For audit readiness, an Evidence Pack Express offers a cryptographically signed deliverable including an executive summary, findings, CBOM, and migration plan.
- Note: The scanner is lexical, findings are leads to verify, not a complete inventory, and it does not guarantee quantum safety or certification.
Why DMARC's new "NP" tag can fail with DNSSEC
21 days ago
- DMARC's new np tag (non-existent subdomain policy) was introduced in RFC 9989 to apply policies to non-existent subdomains.
- RFC 9989 defines non-existent domains by NXDOMAIN response code, but RFC 9824 (Compact Denial of Existence in DNSSEC) uses NOERROR with NXNAME bit for DNSSEC, causing a clash.
- Many DNS providers (e.g., Cloudflare, AWS Route 53) use compact denial, so NXDOMAIN is often not returned, leading np tag failures in DMARC implementations.
- DMARC implementations typically check for NXDOMAIN strictly and don't support DNSSEC or NXNAME bit, so np tag may not work for DNSSEC-signed domains.
- IETF discussions haven't resolved the issue; solutions include DMARC software checking NXNAME or wider adoption of NXDOMAIN restoration via CO flag.
- Domain owners should assume np tag may not work reliably, especially with DNSSEC and major DNS providers using compact denial.
Hackers made death threats against this security researcher. Big mistake
21 days ago
- Allison Nixon, a cybersecurity researcher at Unit 221B, faced death threats and AI-generated nudes from hackers after helping arrest many members of the Com, an online hacker community.
- The Com, comprising mostly teens and young adults, engages in cybercrimes like DDoS attacks, SIM swapping, crypto theft, and offline violence such as swatting and bricking, posing a significant threat comparable to state actors.
- Nixon's investigative approach involves tracking hackers on forums like Hack Forums, exploiting their operational security mistakes to unmask identities, and using tools like eWitness to preserve chat data for law enforcement.
- She successfully identified and helped arrest Connor Riley Moucka (Waifu/Judische), a key figure in the Com linked to the 2024 Snowflake breach and extortion of AT&T, highlighting her role in countering cybercriminal threats.
- Nixon's work extends to combating sextortion and child sexual abuse material within the Com, aiming to secure harsher sentences for hackers by connecting financial crimes to violent activities.
AI Can Steal Your Bank Account in Hours
21 days ago
- AI is amplifying cyber threats in the financial sector, exploiting concentrated infrastructure and data breaches.
- Fraud is industrializing via AI, with deepfakes and phishing targeting individuals, especially young investors.
- Resilience and real-time monitoring using AI are key defenses, along with sector collaboration and training.

firstprev0next

About|Login

cybersecurity

Anthropic says US lifts export ban on Fable 5

Anatomy of a Failed (Nation-State?) Attack

.garden TLD's change to a bad neighborhood

Oracle outlines all the ways it could lose the farm it bet on AI

Spain Orders Blacklist of Palantir from Public and Private Companies

FBI Seizes NetNut Proxy Platform, Popa Botnet

Startup sues Palo Alto Networks' Koi Security due to AI-hallucinated report

Amazon's Mechanical Turk to stop accepting new customers

Hackers shoveled snow for company, were rewarded with network admin access

New serious vulnerabilities spiked around release of Claude Mythos Preview

Espionage Against the European Parliament

Soatok's Informal Guide to Threat Models

AI Agent ransomware attack through Langflow instance by exploiting CVE-2025-3248

EU appears to find datacenter emissions easier to offset than lobbyists

Security Roundup: Apple's Hide My Email Service Fails to Hide Your Email

Confidential computing's core trust mechanism is broken. The fix may not exist

Show HN: Grade your code's post-quantum crypto exposure A–F, free, in-browser

Why DMARC's new "NP" tag can fail with DNSSEC

Hackers made death threats against this security researcher. Big mistake

AI Can Steal Your Bank Account in Hours