Cursor IDE automatically executes a malicious git.exe from repository root without user interaction, leading to arbitrary code execution.
Vulnerability identified December 2025, reported multiple times but remains unfixed after over 6 months and 197+ versions, with minimal vendor response.
Mitigations include AppLocker policies for enterprises and using isolated environments for consumers until patched.
Proof-of-concept demonstrated with Windows Calculator renamed to git.exe, showing repeated automatic execution.
Lack of communication from Cursor raises concerns about security processes and accountability in AI-assisted development tools.
Debian 12.15 is the fifteenth and final update of the oldstable distribution Debian 12 (bookworm).
This point release includes security corrections and adjustments for serious issues; it does not constitute a new version but updates some packages.
Users can upgrade using an up-to-date Debian mirror; new installation images will be available soon.
Notable updates: fwupd to version 2.0.20 for Secure Boot CA updates, geoip-database reverted to a 2019 version for licensing reasons, and end of support for bookworm with advice to upgrade to Debian 13 trixie.
The release includes miscellaneous bugfixes for numerous packages addressing security vulnerabilities and other issues.
Security updates have been published separately, and some packages like smb4k were removed due to inability to provide security support.
xAI disabled the Grok Build CLI's ability to upload entire developer repositories to cloud storage after a security researcher exposed the behavior.
The CLI was bundling and uploading full repositories, including Git history and secrets, to a Google Cloud Storage bucket, unrelated to the specific coding task.
A toggle labeled 'Improve the model' did not stop the uploads; it only governed training consent, not data collection.
The fix was implemented silently via a server-side flag, with no official advisory or statement from xAI on the purpose or fate of already collected code.
The researcher's findings highlight undisclosed collection but do not confirm misuse, such as whether xAI trained on or viewed the uploaded code.
Grok Build CLI transmits the contents of files it reads, including secrets in .env files, unredacted to xAI via POST /v1/responses and POST /v1/storage.
Grok uploads the entire repository, including unread files and git history, to Google Cloud Storage bucket 'grok-code-session-traces' at multi-GB scale, independent of model usage quotas.
The upload mechanism is active by default, not disabled by the 'Improve the model' toggle, and not explicitly documented in the CLI's setup materials.
South Korean chip startup FuriosaAI is expanding into European datacenters with its RNGD accelerators at Equinix's Lisbon facilities.
Enterprise AI adoption is facing security challenges, with a majority reporting incidents or vulnerabilities.
Researchers are using quantum computers and AI to tackle fusion fuel issues, with institutions like the DOE and IBM simulating molten salts for tritium production.
Software engineers can earn high salaries at fast-growing companies, though AI's impact on the tech business is complex.
Microsoft is restructuring its commercial and Xbox teams, acknowledging rapid global changes and the need to avoid complacency.
Phishing attacks involving Russians posing as Signal support are occurring, alongside US takedowns of Iranian propaganda sites.
Microsoft's patches for on-prem SharePoint failed, leaving it vulnerable to zero-day attacks, amid other security updates.
DEF CON's Franklin project is engaging hackers to strengthen critical infrastructure, with the event now fully incorporating these efforts.
EQT has acquired a majority stake in Acronis, valuing the cybersecurity company at over $3.5 billion.
Despite a decade of corporate ransomware, there's no end in sight, but cybersecurity remains a stable career option.
Collabora's CODE 26.04 release enhances FOSS office suites with Markdown support and AI integration, though AI is off by default.
GIMP 0.54 has been revived as a Flatpak for retro-computing enthusiasts, using Motif instead of GTK.
Bcachefs has left experimental status with a performance-focused release, incorporating more Rust but facing AI-related issues.
France's push for digital sovereignty struggles to move users away from Microsoft products, as shown by Nextcloud rollouts.
CentOS evolved from a biochemist's hobby into a default enterprise OS after community efforts post-Red Hat's shift.
Netflix engineer open-sourced Project Headroom, an app designed to significantly reduce AI-related costs.
Introduction of a new 'kernel' repository type on the Hugging Face Hub to cater to compute-specific needs, allowing users to browse accelerators, operating systems, and backend versions.
Enhanced security measures including trusted kernel publishers, code signing with Sigstore's cosign for ephemeral keys, and reproducibility via Nix builds to prevent malicious kernel execution.
Revamped CLI tools with better separation between kernels and kernel-builder, focusing on library functions versus building processes, and improved support for agentic kernel development workflows.
Extended framework and backend coverage, such as Torch Stable ABI support and Apache TVM FFI integration, enabling cross-framework kernel interoperability.
Foundation for agentic kernel development with tools for scaffolding, building, benchmarking, and optimizing kernels via HF Jobs integration for performance testing across hardware configurations.
Miscellaneous updates including an easier environment setup script, system cards for kernels, compatibility checks via has_kernel() and get_kernel_variants(), and improved manylinux_2_28 support to resolve libstdc++ linking issues.
The Department of Energy, Cleveland Clinic, and IBM are simulating molten salts to address the fusion fuel dilemma, focusing on tritium production.
Software engineers can earn high salaries at fast-growing companies, but AI's impact on the tech business is complex and varied.
Microsoft is restructuring its commercial and Xbox teams, acknowledging rapid global changes and the need to avoid complacency.
AMD's Ryzen AI Halo offers local AI capabilities but comes at a high cost of $4K, featuring 128 GB of memory.
Nvidia has introduced a datacenter financing scheme that allows for double payments, enhancing revenue streams.
Russian actors are conducting phishing attacks by impersonating Signal support, alongside US actions against Iranian propaganda and data security issues.
Microsoft's patches failed to fix on-prem SharePoint, leaving it vulnerable to zero-day attacks, with additional updates on China's surveillance and Ring's policies.
The DEF CON Franklin project engages hackers to strengthen critical infrastructure, expanding efforts based on successful voting village reports.
EQT acquired a majority stake in Acronis at a valuation over $3.5 billion, though the exact portion sold is unspecified.
Mikko Hyppönen notes that corporate ransomware persists after ten years, but cybersecurity remains a stable career choice.
Collabora released CODE 26.04 with Markdown support, improved formula handling, and optional AI integration amid competition in FOSS office suites.
GIMP 0.54 has been revived as a Flatpak, offering retro-computing nostalgia with its original Motif interface.
Bcachefs has exited experimental status in a performance release, incorporating more Rust but facing challenges with AI-related issues.
France's digital sovereignty efforts struggle to reduce Microsoft dependency, as seen in Nextcloud's rollout challenges with Office migration.
The history of CentOS traces its evolution from a biochemist's hobby to an enterprise default, driven by community response to Red Hat's changes.
A Netflix expert created and open-sourced Project Headroom, an app designed to significantly reduce AI-related costs.
AI: Quantum computers and AI are being explored to solve fusion fuel issues, with simulations by the Department of Energy, Cleveland Clinic, and IBM.
AI and ML: Software engineers can earn high salaries at fast-growing companies, despite AI's complex impact on the tech business.
Software: Microsoft is restructuring commercial and Xbox teams, citing rapid global changes and the need to avoid complacency.
AI and ML: AMD's Ryzen AI Halo facilitates local AI but is expensive, priced at $4K with 128 GB of memory.
AI and ML: Nvidia introduces a double-dipping financing scheme for datacenters to maximize payments.
Security: Russian phishing attacks impersonate Signal support, while the US targets Iranian propaganda and a marketing company raises data privacy concerns.
Security: Microsoft patches fail to protect on-prem SharePoint from zero-day attacks, amid other security updates from China and Ring.
Black Hat and DEF CON: DEF CON expands its Franklin project to include hackers in hardening critical infrastructure, with voting village successes.
Security: EQT acquires a majority stake in Acronis at a $3.5B+ valuation, strengthening cybersecurity investments.
Malware Month: Ten years after the first corporate ransomware, Mikko Hyppönen predicts ongoing threats but notes infosec as a stable career.
FOSS: Collabora releases CODE 26.04 with Markdown support and AI integration, intensifying competition among open-source office suites.
FOSS: GIMP 0.54 is revived via Flatpak for retro-computing, using the original Motif interface instead of GTK.
FOSS: Bcachefs exits experimental status in a performance release, but faces challenges with AI-related issues.
FOSS: France's digital sovereignty push struggles to move away from Microsoft, as shown by Nextcloud's rollout challenges.
FOSS: The history of CentOS traces its evolution from a hobby project to a default enterprise OS after community efforts post-Red Hat.
FOSS: Netflix creates and open-sources Project Headroom to reduce AI costs, offering potential savings for users.
NSA historically weakened cryptographic standards, including DES, RC4, and RSA-512, and sabotaged random number generators to enable exploitation.
The IETF TLS working group is voting on an NSA-driven RFC for solo ML-KEM in TLS, risking widespread deployment despite security concerns.
Opposition to solo ML-KEM is growing, with over 60 objections citing security risks, while proponents push for adoption with flawed arguments.
IETF procedures show a pro-endorsement bias: repeated 'last calls' allow document advancement even with unresolved objections, favoring entities like NSA and defense contractors.
Voting against the spec or staying silent has asymmetric consequences: opposition encourages discussion and delays potential security sabotage, while support risks immediate harm to millions of users.
Nvidia introduces a datacenter financing scheme aimed at maximizing revenue through dual payment models.
Research shows that companies integrating more AI technologies are also increasing their human workforce, though this does not always align with business objectives.
SoftBank enters the GPU rental market to support AI training, leveraging its large US server farm infrastructure.
The UN emphasizes the urgent need for global governance to prevent potential AI-related catastrophes, as technological advancements outpace regulatory frameworks.
Oracle discloses various risk factors that could jeopardize its significant investments in AI.
Russian actors are impersonating Signal support to conduct phishing attacks, while the US shuts down Iranian propaganda sites.
Microsoft's recent patches failed to secure on-premises SharePoint, leaving it vulnerable to zero-day attacks, amid other security updates.
DEF CON's Franklin project recruits hackers to enhance critical infrastructure security, expanding its scope to include the entire conference.
EQT acquires a majority stake in Acronis, valuing the cybersecurity firm at over $3.5 billion.
A decade after the first corporate ransomware attack, security expert Mikko Hyppönen predicts continued threats, highlighting infosec as a stable career choice.
Collabora launches CODE 26.04 with new features like Markdown support and integrated AI, intensifying competition among FOSS office suites.
GIMP 0.54 is revived via Flatpak, offering a nostalgic retro-computing experience with its original Motif interface.
Bcachefs moves out of experimental status in a performance-focused release, incorporating more Rust but facing challenges with AI-generated content.
France's push for digital sovereignty struggles to reduce reliance on Microsoft, as seen in efforts to transition from Office to alternatives like Nextcloud.
The history of CentOS traces its evolution from a personal Linux project to a widely used enterprise OS, driven by community collaboration after Red Hat's shift.
A Netflix developer creates and open-sources Project Headroom, an app designed to significantly reduce AI-related expenses.
Guix substitute utility has vulnerabilities enabling remote privilege escalation, store corruption, and file disclosure, affecting all systems regardless of root privileges.
Exploitation requires downloading a binary substitute; any substitute server or MITM can attack, even with HTTPS, and local exploitation requires socket access.
Guix pull and guix time-machine have a vulnerability allowing channel file control to create or overwrite files, mainly causing denial-of-service risks.
Four specific vulnerabilities are detailed: restore-file not hardened, fetch-narinfos not verifying URLs, file:// URI issues, and cache-key misuse.
Mitigation includes disabling substitutes with --no-substitutes, avoiding untrusted channels files, and updating to fixed commits via guix pull and daemon restart.
Fixes involve hardening restore-file, verifying narinfos, restricting file:// URIs, and modifying cache-key derivation to prevent directory traversal.
Upgrading instructions vary for Guix System and other distributions, emphasizing immediate updates and cautious substitute use during the process.
Timeline shows discovery from May to June 2026, with coordinated disclosure and fixes via pull request #9665.
A test script is provided to check vulnerability status, with code included for validation.