Android malware detection collapses when the context stage comes out 2026-07-29 at 07:00 By Anamarija Pogorelec A phone backup app asks for storage, contacts, SMS, and call logs. A device-management tool asks for more than that. Run either one past a machine learning malware scanner and it comes back flagged. Six Android detectors in wide […]
Android malware detection collapses when the context stage comes out Read More »
Exposed BMCs hand out password hashes before login 2026-07-28 at 15:00 By Sinisa Markovic An attacker who reaches UDP port 623 on a server’s baseboard management controller can ask it for a password hash and receive one before logging in. The exchange is part of the IPMI 2.0 handshake, built on an authentication protocol introduced
Exposed BMCs hand out password hashes before login Read More »
AI took more than junior developer jobs and the bill comes later 2026-07-28 at 08:30 By Sinisa Markovic A ticket comes in for a small bug fix. Hand it to the junior on your team and you wait a day, review something that half works, and sit down to explain what went wrong. Describe it
AI took more than junior developer jobs and the bill comes later Read More »
The automotive software vulnerabilities hiding in your dashboard 2026-07-24 at 09:30 By Anamarija Pogorelec Pop the hood on a new car and you won’t find much you can fix with a wrench. What you’ll find is software, and a lot of it. The screen in the dash probably runs Android or a flavor of Linux.
The automotive software vulnerabilities hiding in your dashboard Read More »
Multi-patch vulnerability fixes can leave open source exposed 2026-07-23 at 08:00 By Mirko Zorz Vulnerability management runs on a shorthand. A CVE shows a linked patch, someone applies it, and the ticket moves to closed. That shorthand covers most open source fixes. A share work in a different way, arriving as a run of two
Multi-patch vulnerability fixes can leave open source exposed Read More »
Small teams are the heaviest users of AI coding agents 2026-07-22 at 09:00 By Sinisa Markovic The pull request arrives with the tests already run and the description already written, the work of an agent that handled the whole thing on its own. Somebody still has to read it. On GitHub that somebody is usually
Small teams are the heaviest users of AI coding agents Read More »
Nobody was checking the drives that encrypt your laptop 2026-07-21 at 08:30 By Anamarija Pogorelec A drive ships with a label promising hardware encryption. You plug it in, set a password, and trust the chip inside to handle the rest. Millions of laptops and workstations run this way, on solid-state drives built to the TCG
Nobody was checking the drives that encrypt your laptop Read More »
A forensic tool for backdoored code completions in AI assistants 2026-07-20 at 08:00 By Sinisa Markovic Developers lean on AI coding assistants for a growing share of their daily work, letting the tools predict the next few lines and accepting many suggestions with a quick glance. Those tools learn from large collections of code, and
A forensic tool for backdoored code completions in AI assistants Read More »
The script, not the voice, is what makes AI voice phishing work 2026-07-17 at 10:31 By Sinisa Markovic The call comes in at 4:40 on a Friday. The voice belongs to a senior manager, or sounds close enough, and she needs a password reset before a flight. She is polite, she is in a hurry,
The script, not the voice, is what makes AI voice phishing work Read More »
Prompt injection is becoming the XSS of the web agent era 2026-07-17 at 09:00 By Anamarija Pogorelec Autonomous web agents read whatever a page displays, and much of that content comes from strangers. Product reviews, seller listings, and advertisements sit beside trusted site menus on a single page. An agent that reads all of that
Prompt injection is becoming the XSS of the web agent era Read More »
What public money does to open-source projects 2026-07-16 at 08:30 By Mirko Zorz Most of the software running inside a typical company was written by volunteers the company never paid. Open-source code sits under web apps, build pipelines, and the machine learning stacks getting so much attention right now. Roughly 96 percent of codebases carry
What public money does to open-source projects Read More »
An AI overthinking attack can tie a robot up for over a minute 2026-07-15 at 07:30 By Anamarija Pogorelec Robots that read the world through cameras now lean on large vision-language models to interpret what they see and decide what to do next. These models handle images and text together, so any words that fall
An AI overthinking attack can tie a robot up for over a minute Read More »
“Context bombs” can frustrate AI-driven attacks, researchers found 2026-07-14 at 15:27 By Zeljka Zorz A new approach tried out by Tracebit researchers has proven very effective at stopping AI agents from fully compromising targeted environments. What makes it notable isn’t the technique – prompt injection is old news – but the direction it’s pointed: not
“Context bombs” can frustrate AI-driven attacks, researchers found Read More »
No one knows how many old shims can still bypass UEFI Secure Boot 2026-07-14 at 13:26 By Mirko Zorz The vast majority of UEFI computers carry a Microsoft certificate that will trust a small first-stage loader called a shim, a program Microsoft signs so that Linux and assorted boot tools can run with Secure Boot
No one knows how many old shims can still bypass UEFI Secure Boot Read More »
New tutorials on underground hacking forums have roughly doubled 2026-07-14 at 09:30 By Sinisa Markovic Underground hacking forums are producing more original tutorials again, with growing attention on financial fraud, particularly the theft and fraudulent use of payment card data, known as carding, and cash-out techniques. New tutorials per month versus reposts (Source: Radware) Fraud
New tutorials on underground hacking forums have roughly doubled Read More »
Fake smart home residents could stand in for real ones in security research 2026-07-14 at 08:30 By Anamarija Pogorelec Smart home security research runs on a scarce ingredient: recordings of how real people use the gadgets in their homes. Getting that data means wiring up someone’s house and watching for months, which is slow, costly,
Fake smart home residents could stand in for real ones in security research Read More »
A hardware security AI assistant that checks chips for hidden backdoors 2026-07-13 at 08:00 By Sinisa Markovic Chip designers license blocks of circuitry from outside vendors and drop them into larger products. A single processor can carry components from a range of suppliers, each written by a company the buyer may never deal with directly.
A hardware security AI assistant that checks chips for hidden backdoors Read More »
The open source library holding up your stack might have one maintainer 2026-07-10 at 10:00 By Sinisa Markovic Every serious software product runs on code that someone else wrote and released for free. A web service leans on a cryptography library, a data pipeline pulls in a parser, and a mobile app ships a handful
The open source library holding up your stack might have one maintainer Read More »
Most data brokers won’t tell you what happened to your deletion request 2026-07-10 at 09:30 By Sinisa Markovic Data brokers collect personal details on most adults in the United States and sell them to buyers that include employers, landlords, insurance companies, and government agencies. California gives residents a way to push back. You can ask
Most data brokers won’t tell you what happened to your deletion request Read More »
Your coding agent says no in chat and yes in the code 2026-07-09 at 13:44 By Mirko Zorz Millions of developers share their keyboard with GitHub Copilot. Inside Visual Studio Code, it opens their files, writes and edits code, runs scripts, and reworks its own output across many turns. The safety testing that vets these
Your coding agent says no in chat and yes in the code Read More »