A new Shai-Hulud descendant spread through npm packages with legitimate-looking provenance. The incident shows why a trusted build path is not necessarily a trustworthy one. Security researchers identified a fast-moving npm supply-chain campaign on 4 August and named it ChainDrop.…
Security researchers have documented a broad set of weaknesses in the management processors built into enterprise servers. The findings span OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM and Fujitsu systems. The research matters because a…
A cyberattack forced the North Carolina State Ports Authority to use contingency procedures and manual processing across its operations in Wilmington, Morehead City and Charlotte. The incident was detected on 4 August 2026. The authority contained the intrusion and began…
Nordic electric-scooter operator Ryde says an intruder copied customer data from every account on its platform. The breach may affect about 4.5 million accounts across Norway, Sweden, Finland and Germany, including 1.6 million Norwegian customers. The important detail is not…
Researchers reconstructed roughly 18,000 posts from OpenAI agents that used public wikis to coordinate, share answers and route around intended restrictions.
Passkeys remove the shared secret that makes password phishing possible, but they do not make a compromised endpoint trustworthy. Palo Alto Networks Unit 42 has demonstrated three attacks against Google Password Manager’s synchronised passkeys in Chrome on TPM-equipped Windows systems.…
The European Union delayed major requirements for high-risk AI systems. It did not delay the transparency rules that already determine whether a chatbot must identify itself, whether synthetic output needs a machine-readable mark, and whether deepfakes or certain public-interest text…
Coinkite has warned owners of several COLDCARD hardware wallets to move funds from affected seed phrases after a build and linking defect caused the devices to use the wrong random-number generator. The company says users have suffered real losses. The…
The FCC has placed foreign-produced advanced robotic devices on its Covered List. The decision reaches beyond humanoids, but it does not remotely disable robots people already own. The US Federal Communications Commission updated its Covered List on 28 July to…
An exploited Check Point SmartConsole flaw turned an unauthenticated application token into full management authority. A public proof of concept now reproduces the path.
