The Image Was Generated Locally. Its Identifier Came From Microsoft.
Microsoft Paint and Photos embed server-issued identifiers into locally generated AI images, joining remote moderation, pixel watermarking and C2PA provenance.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
Chrome Patched a Critical Chromoting Use-After-Free. Verify the Running Build.
Chrome 151 fixes a critical Chromoting use-after-free and six high-severity flaws. Google has not reported exploitation, so the immediate task is to verify that staged updates reached every managed endpoint.
An EU Data Order Can Now Cross Borders Directly. The Provider May Have Eight Hours.
The EU e-Evidence Regulation makes cross-border data orders an eight-hour operational challenge for service providers, not merely a legal process.
France Thought It Had a Staff-Data Breach. The Same Incident May Have Reached Millions of Students.
France’s Education Ministry is testing whether a breach first described as staff-only reached student records across a fragmented national data estate.
LegacyHive Was Public for a Month Before Microsoft Gave It a Patch and a CVE.
A public LegacyHive proof of concept exposed a Windows privilege-escalation path after July's updates. Microsoft patched it in August, showing how public research can compress the defender's window.
The Package Worked. A Single Import Started RedC2’s Linux Backdoor.
Fourteen functional npm utilities launched a native Linux backdoor when imported, bypassing install-hook defences and giving RedC2 an AI-assisted post-exploitation path.
AliExpress Wasn’t Playing Audio. It Was Measuring Your Browser.
AliExpress's homepage ran silent WebAudio processing as part of a broader device fingerprint. A Bluetooth malfunction exposed what ordinary browser controls did not.
The Attack Was Stopped at the Edge. The University Still Had to Delay the Semester.
UT San Antonio says an intrusion attempt was stopped before core systems, yet precautionary shutdowns disrupted services and delayed fall classes.
Clearing Cookies Did Not Break the Link. The Browser Called the App Through Localhost.
Meta Pixel and Yandex Metrica used Android localhost connections to link browser activity with native-app identities, bypassing familiar privacy controls.
China’s New Data Security Rule Starts Today. A Risk Assessment Is No Longer Just an Internal Document.
China’s new rules for network-data security risk assessments took effect on 20 August 2026. For organisations that process data in China, the important change is not simply another assessment obligation. The result may now have to leave the security team,…