Find articles

A major hospital network in New Mexico was racing to fix a cybersecurity issue on Monday that forced it to send ambulances to other hospitals and left the state without an emergency department capable of treating the most serious injuries.

The post Cybersecurity CEO Indicted for Allegedly Scamming Millions From Ransomware Victims appeared first on ProPublica .

Systems that guard our email and bank accounts are vulnerable to attacks, but building on the best defenses will buy time and prevent a crisis, writes Tyler Cowen. AI commentator Zvi Mowshowitz declared: “It was the probably worst day in cybersecurity history. So far.” The day in question was last Thursday, when news that AI had detected a critical flaw in PHP, a programming language used for building websites, leaked before the fix was available. That sent much of the internet running for patches and fixes, and the result probably will be that many older websites end up permanently dysfunctional. Many governments even took their websites offline for a while, to limit the risk of hacking. We are likely to survive this particular episode without the economy crashing down. But as Zvi’s comment indicated, other problems will arise in the future and they may be far more serious. One issue I have followed with special interest is cryptography. Throughout the tech industry, there is a slowly rising worry about AI breakthroughs in cryptography, which, in theory, could throw open the front door of every email, online transaction, and bank account. Recent headlines tell the story. “Vitalik Buterin Warns AI Could Break Lattice Cryptography Within Two Years,” reads one, announcing that the cryptocurrency creator has lost faith in systems recently thought to be invulnerable. Even more daunting: “Claude AI Solves 25-Year NSA Cryptography Mystery in Just 30 Minutes.” Now that an AI model from Anthropic (where I am an economic adviser) has cracked through a barrier no human has managed, whether any barrier is safe has become a live question.

Article URL: https://www.wiz.io/blog/gheist-attempted-scaled-abuse-of-stolen-github-tokens-stumbles Comments URL: https://news.ycombinator.com/item?id=50235010 Points: 21 # Comments: 0

An AI expert says banks may not just fear hackers. They may fear customers making better money decisions.

Article URL: https://unicode.org/reports/tr39/ Comments URL: https://news.ycombinator.com/item?id=50233438 Points: 21 # Comments: 1

Microsoft is warning that Chinese state-aligned hackers have unleashed a sophisticated new wave of artificial intelligence-powered cyberattacks targeting hundreds of organizations worldwide, exploiting trusted software providers and gaining privileged access to corporate...

Article URL: https://www.dreamhoststatus.com/ Comments URL: https://news.ycombinator.com/item?id=50231166 Points: 36 # Comments: 13

Eye-opening revelations this past week have solidified my personal fears about the year ahead: As a nation and as a globe, we're facing a record number of wild risks that are way outside our control. My growing hunch about this scenario has been bolstered by daily conversations with CEOs, government insiders and top investors. Why it matters: It feels likely — not certain — that between now and 2028, we'll face society-level disruptions, possibly including cyberattacks and fast-twitch economic shocks. What we're facing: We've navigated single-shot crises like the financial meltdown of 2008 and the pandemic of 2020. This next year will be different. The real risk is a chain reaction: One shock sets off others — faster than we can process, and caused by AI dynamics we don't fully understand. Call it chain-reaction chaos . And that's against the backdrop of this age of post-processable velocity : The speed of change exceeds the ability of any individual, company, market or government to fully absorb, understand and respond. The reason this scenario looks so likely is that so many obvious risks, all with relatively high probabilities, keep piling up. Any one of them will rock already highly volatile markets and politics: Cyber chaos. This past week was a big flashing siren. AI-detected flaws in PHP, the code behind millions of websites, knocked government sites offline worldwide and prompted the National Security Agency to warn organizations to patch immediately or go dark. Major banks found unauthorized AI agents inside customer accounts, some trying to take actions customers never asked for. And Anthropic's deputy chief information security officer, Jason Clinton , warned that as bad as the past several days had been, cyber threats will get "a lot worse before they get better." Salesforce CEO Marc Benioff quickly agreed , writing on X: "Code red." As Madison Mills reported for Axios , the AI companies and the banks are scrambling for "day after" planning, fully anticipating a bigger cyber hit in coming months. People at top AI companies tell me the chances are far north of 50%. AI bubble bursts (partially). This doesn't feel like 1999, since giant companies with huge balance sheets are underwriting the AI boom. But that's also the problem. They're increasingly doing it with borrowed money: Goldman Sachs expects about a third of Big Tech's AI capital expenditure to be debt-financed this year. A bubble doesn't need to burst spectacularly to cause widespread economic and political pain. These companies are deeply intertwined, investing in, selling to and buying from each other. Look what happened with Meta this past week: It crushed its earnings , but then spooked the market by detailing the difficulties of raising capital to fund AI. Any sign of overbuilding … or companies underusing AI … or China catching up … or AI prices collapsing … or credit costs spiking … or the political backlash intensifying, and markets could tumble fast. A sharp correction feels like a 50%+ scenario in the short term. AI hits true RSI. AI could get better, faster than almost anyone anticipates via recursive self-improvement (RSI). People inside Anthropic, OpenAI and Google see this unfolding now. This could be awesome long-term if we steer the technology smartly. But it could also prove wildly disruptive in 2027: More advanced AI would pose a more urgent threat to industries, companies and jobs. You could easily see this enticing Democrats to join Sen. Bernie Sanders (I-Vt.) in demanding a slowdown or full pause, which would rattle markets. War expands, oil spikes. President Trump's aides believe he's likely to resume the Iran war postelection. The Iranians warn they would expand their targets in retaliation. The U.S. reduced staffing at embassies throughout the Middle East amid increased threats . Escalation feels more likely than not at the very moment oil supplies are tight and gas and diesel prices are very high. Imagine the economic pain of sustained $120-a-barrel oil. An aging, unrestrained president. I want to be clear here: This isn't a political statement or Trump health appraisal. I'd write the same for Joe Biden. It's a simple, fact-based observation based on actuarial tables. Trump, age 80, heads into the next two years as the oldest person ever to be president. It's a medical certainty that the chances of mental decline and incapacitation rise dramatically in your 80s. Trump is much like Biden in that he doesn't have people around him who can level with him. The risk stretches from health episodes to judgments about war and the limits of presidential power. What you can do: I spell this out not to scare you or cause you to throw up your hands and retreat from reality. You can only make wise decisions for your career, your life and your family if you're living in the future — understanding what's coming, and living these historic times with your head in the game. The expert journalists of Axios are working hour by hour to be your clinical, useful guide to this head-spinning era. Three very practical steps: Be aware: This is an exciting time to be alive. So learn about AI — the good, bad and ugly. And think more deeply about what you expect from your employer and elected representatives. Be vigilant: This past week's Axios reporting about AI agents showed the importance of locking down your passwords. Put every account in a secure password manager with a unique password. Use passkeys where offered. Protect your email and phone with an authenticator app, since whoever controls those can reset everything else. And don't hand a password or login code to anyone who contacts you, human or AI agent. Be ready: This past week also showed how AI is the market. So if you have a 401(k) or other investments, make sure to understand how concentrated you are in different sectors. Seek out smart diversification strategies. And find a few news sources, like Axios, that you can trust to make sense of all the craziness. The bottom line: It's easy to argue any one of these risks won't materialize. But when you add up this many, the overall chance of a crisis outside our direct control is spiking by the day.

reVault is a new, secure-by-default archive format called a lockbox, designed to be simple to use. I've been working on reVault for about 2 years. It was originally written in Dart, but with the improvements in AI, I decided to port it to Rust using AI. It's now in beta, so I'm looking for feedback, particularly around the different language bindings. A lockbox is encrypted, signed and compressed by default. Each can be disabled selectively. - Hybrid post-quantum or passphrase encryption, including metadata. - Zstd compression. - Pure Rust libraries wherever possible. We intend to phase out remaining C code as alternatives become available. The project has been scanned using OpenAI's Daybreak cyber security tools. The manual is a work in progress: https://docs.revault.onepub.dev/ reVault supports Linux, macOS and Windows, x64 and arm64, plus Wasm. The core is Rust, with bindings for C/C++, Java, Dart, Python, Ruby, JS/TypeScript, Go, C#, Kotlin, Lua, PHP and Swift. Within a lockbox you can store: - Files, directories, permissions and symlinks. - Variables. - Forms. Variables, forms and the lockbox itself can have descriptions. reVault uses a portable vault (just another lockbox with structured content) to hold your keys, contacts' keys, lockbox aliases and form definitions. It ties into your platform's secure store, so logging into your desktop unlocks your vault. You don't have to enter a passphrase every time you access a lockbox. You can disable this. There are lots of shortcuts. Creating a lockbox stores an alias in your vault, based on its filename or a name you choose: lbx create /some/path/mybox.lbox lbx mybox open --duration 1h lbx mybox var set KEY VALUE Set a default lockbox and you can leave its name out: lbx session default mybox lbx var get KEY You can mirror a directory tree into a lockbox and update it when the directory changes: lbx store.lbox mirrors project create --from ./project --to /projects/project lbx store.lbox mirrors update The API lets you read, write and seek within files without extracting them to the filesystem. Each lockbox has a table of contents, so extracting a single file from a multi-gigabyte lockbox is fast. Recovery Updates are transactional, with automatic rollback for failed updates. The format is designed for recovery: content is stored in pages, allowing unaffected content to be recovered if part of a lockbox is corrupted. Sharing An encrypted lockbox is more useful if you can share it. reVault has an open-source keyserver for exchanging public keys, with validation through a second trusted channel. It's still experimental. OnePub has donated a server to run a single keyserver. If you're interested in donating resources, I'd like to bring up a second redundant server. It's pure Rust, uses under 100 MB RSS and supports rate limits. To publish your default profile's public key: lbx vault profiles email you@example.com lbx vault profiles publish Give the publish code to your contact. They can import your key: lbx vault contacts receive Display your profile's fingerprint and exchange it through a second trusted channel: lbx vault profiles fingerprint Repeat the process in the opposite direction to get their key. Once you have it, grant them access to your default lockbox: lbx access grant alice You can then email the encrypted lockbox to Alice. To install the CLI and get started: cargo install revault_cli lbx vault init lbx completion install Completion installation detects your shell. To diagnose issues: lbx doctor The language bindings are published to their respective package repositories. I'm looking for constructive criticism of the project on its own merits, particularly the APIs and language bindings. I'm not interested in a debate about using AI. Comments URL: https://news.ycombinator.com/item?id=50227527 Points: 3 # Comments: 1

Laboratory operator Quest Diagnostics reported a cyber breach in which an unauthorized party gained access to certain patient records.

The New York Knicks’ parent company says it is giving out more than $3.7 million worth of championship rings and jewelry after acknowledging an “unfortunate mistake” of using an offer of free rings to lure employees into a cybersecurity test. As first reported by The Athletic, the email said employees were eligible for a free Knicks championship ring.

‘You’re literally sending your data’ to China

Article URL: https://gitlab.com/c4psu13/mali-pagecache-root Comments URL: https://news.ycombinator.com/item?id=50220042 Points: 4 # Comments: 0

Article URL: https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497 Comments URL: https://news.ycombinator.com/item?id=50219177 Points: 36 # Comments: 19

Article URL: https://security.apple.com/research-device/ Comments URL: https://news.ycombinator.com/item?id=50217903 Points: 59 # Comments: 17

Article URL: https://nitter.click/AikidoSecurity/status/2113759110625906950?__galadriel=lPmlGl9id4oAd5UeBwMhlYKArHyr6lR2IDGujPwB5HV2kQ1aLoPWFd5A9sGuzNcmrp8fUso8qygmHcKTDZ8MNHWqQ3bDJcycV87xp_0VypzQLYj6O_RRHlZuQqj33oASGY2YLSoAiMjeOZN40h7Stf8AG7DPrGZbAPVKUXy36HoMudRbvwF3_r2uYNmfJMhpKzywQDM6Ab8 Comments URL: https://news.ycombinator.com/item?id=50216791 Points: 35 # Comments: 8

This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here. Are we living through “Black October”? Maybe, according to cybersecurity experts who are raising the alarm about AI’s increasingly sophisticated and far-reaching hacking abilities. This week alone has seen a string of alarming incidents […]

New York Knicks employees who clicked a phishing email disguised as a free championship ring offer were forced into a mandatory cybersecurity class.

Headline-grabbing security hole in global websites, found by AI, now has evildoers using AI to exploit the gap. An AI Insider analysis and scoop.

Article URL: https://cve.0xosprey.com/ Comments URL: https://news.ycombinator.com/item?id=50215530 Points: 88 # Comments: 31

Cybersecurity researchers raced to patch a major flaw in PHP as details leaked online and attempted exploits surged.

Article URL: https://openai.com/index/securing-our-frontier-model-training-environment/ Comments URL: https://news.ycombinator.com/item?id=50214416 Points: 68 # Comments: 80

After discovery of severe bug in the PHP programming language, executives warn of ‘vulnerability tsunami’ Leaders in cybersecurity are sounding the alarm after the discovery of a major vulnerability this week. They are predicting that artificial intelligence tools will expose more fundamental weaknesses in global internet infrastructure in the months to come. “I no longer think we’re going to be able to patch all bugs,” said Sam Altman on Thursday evening, joining the chorus of executives. In the midst of what’s being called “Black October”, for which researchers used AI to help identify critical flaws in a coding language that is used across millions of websites and may have been unpatched for years, tech executives are warning about the ways AI will be used both to identify and exploit security vulnerabilities at an unprecedented scale and pace. Continue reading...

An explosion of AI-powered hacks will reshape life online.