Kategorie

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional conditions vulnerability in the TLS receive path Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain root, the highest level of access on a machine. Kernel maintainers have fixed all four over the past few weeks, so a system running an up-to-date kernel is not affected. But the exploit code is now public, and any machine still running an older kernel should be updated. The flawsSwati Khandelwalhttp://www.blogger.com/profile/[email protected]

Microsoft fixed hundreds of security flaws in its September Patch Tuesday software updates — but it also introduced some annoying bugs. Now it has fixed some of them with a series of out-of-band updates.

Excel 2016 users were among the victims, as Patch Tuesday update caused certain paste operations to fail. A hotfix in update 5002665 partly fixes the problem, but if operations still fail then users will have to resort to using Excel’s “Paste special” command instead.

Users of Remote Desktop Services had found some instability in the application where RDP connections failed or where servers were left hanging at “Please wait for the Remote Desktop Configuration”. The issue was resolved with update KB5129194.

 Another issue that users were facing after the update was a problem with some Credential Guard-protected machine accounts. Some users discovered that they had lost some security within Active Directory which meant that some devices were not recognized. The solution involves temporarily preventing Machine Identity Isolation enforcement before installing a fix. Microsoft said that it would be introducing a permanent solution in a future update.

Another issue raised by the September update affected applications that use HCS-managed virtual machines. In some cases, Plan9 users found that they were not able to access folders shared from the Windows host.

Applications that depended on these shared folders sometimes displayed an error indicating that no Plan9 drive shares were mounted. Microsoft said that Claude Cowork and the Windows Subsystem for Linux (WSL) were two of the applications affected, while Hyper-V virtual machines that did not have the Plan9 feature were not affected.

Microsoft also fixed an issue with USB Audio Class 1.0 devices. Some users found that no sound was coming from their audio devices after the Patch Tuesday update, and volume controls were unresponsive. Now restored sound, so affected users can once again make and take Teams calls.

In addition to these fixes from the September update, there was also an issue for some users where they were incorrectly informed that Microsoft Defender had been switched off. This has now been resolved.

WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell. On its own the flaw only Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

The Gyazo image-sharing platform has confirmed it suffered a data breach after hackers exploited a server vulnerability that allowed them to steal 23.6 million user records. [...]

The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan. The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been codenamed Operation Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

 An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms to push a previously undocumented information stealer called Rapuncel. [...]

Microsoft 365 users are being tricked into handing over access to their accounts by a new phishing kit, GhostCode, that exploits a weakness in a legitimate device authorization flow. Researchers in eSentire’s threat response unit identified the campaign in late August 2026.

The kit abuses Microsoft’s OAuth 2.0 device authorization grant flow, a legitimate mechanism designed to enable authentication from IoT devices, smart TVs, printers, or other devices that cannot easily support a conventional browser-based login. The technique, known as device-code phishing, has been seen in other attacks before. As part of the flow, the device displays a code for the user to enters in a browser on another device to complete authentication.

GhostCode poses as one such device, gets Microsoft’s OAuth to generate a device code and then convinces the victim to enter it on Microsoft’s authentication page. The victim then signs in and completes multifactor authentication as normal — but the authentication is for the attacker-controlled device, allowing them to obtain the resulting authentication tokens. These tokens are then used to register attacker-controlled devices, obtain additional credentials and establish persistence in the victim’s Microsoft environment.

In the campaign observed by eSentire, the attack involved a social-engineering setup where attackers pose as procurement officers through a web contact form before moving conversations to an NDA-themed HTML file. Opening the file took the victim to the device-code phishing page.

Stolen tokens allow persistence

GhostCode’s post-authentication activity is focused on turning the stolen access into persistence inside the Microsoft environment. Once access was granted, eSentire recorded nine successful API calls over a 78-second period, involving Microsoft Intune Enrollment, the Device Registration Service, Azure Active Directory and Microsoft Graph.

Three devices were registered during that time, at 28, 53 and 77 seconds after authentication, a sequence eSentire said was automated.

The third device was also successfully enrolled into Intune, Microsoft’s cloud-based device management service. eSentire noted that Intune enrollment survived token revocation: The attacker-created device remained in the tenant until it iwas explicitly removed.

The attackers also obtained a Primary Refresh Token (PRT), which eSentire called “one of the most powerful” credentials in a Microsoft identity environment.

“Obtaining a PRT via device code abuse gives the threat actors essentially SSO-equivalent access to the victim’s entire M365 environment for the PRT’s lifetime — including any service not explicitly protected by a Conditional Access policy requiring a compliant device,” eSentire said, adding that the token persists 14 days by default.

The attackers also employed multiple evasion techniques, including padding and obfuscating the HTML code in their lure, encrypting redirects, checking for bots, and using Cloudflare Turnstile to keep security tools away from the phishing page.

What defenders can do

To defend against attacks like this, eSentire’s researchers recommend restricting Microsoft’s device-code authentication flow through Conditional Access and disabling it for users who do not need it. It also advises monitoring the Device Registration Service for multiple device registrations from a single non-interactive session, and looking for activity involving the user agent python-requests following device-code authentication.

Auditing Entra ID for devices matching GhostCode’s naming pattern and correlating successful device-code authentication with subsequent Python-based requests, should be able to catch an attack in progress, the company said. It shared a list of indicators of comprise related to the campaign to aid detection.

GhostCode adds to a growing number of attacks abusing device-code phishing to target Microsoft’s OAuth authentication flow. Recent examples include attacks using the “EvilTokens” phishing-as-a-service (PhaaS) kit, a campaign reported by KnowBe4 in February 2026, and activity observed in December 2026 involving multiple clusters, including both financially motivated and state-sponsored actors.

John Ternus’ Apple threw a curveball at OpenAI with Siri Recap on Apple Watch, accelerating a conversation about privacy and data protection in an AI-augmented digital era. It’s a move that may yet contribute to finding a balance between scary surveillance and digital convenience.

Think of it this way: Apple operates on such a big scale that it must have expected the feature to face regulatory and legal investigation. We know Apple has tried to stay on the right side of existing data protection and privacy laws by ensuring that its system doesn’t keep personal data, audio recordings, or transcripts, but one thing it doesn’t do is achieve consent from everyone who may be exposed to the feature. That’s a big no-no in some places, and it’s logical to think Apple expects some pushback to that.

Apple thought it through

From where I sit, it looks like Apple has thought about this. You only need to look to Apple Worldwide Marketing VP Greg Joswiak’s recent comments on the matter to see this, as he very swiftly tried to position Recap as little more than the digital equivalent of notebook and pen, or a smartphone set to record. The difference is that using the latter still technically requires consent in some places, while using a pen and paper does not. 

But if Apple has thought about it and anticipates oversight, then there are benefits to be had. Apple is not the only company seeking to use ambient data monitoring and AI tech to create new product families. Meta, OpenAI, and others also seem to be exploring ambient monitoring with AI, possibly with less of a commitment to privacy.

While it’s true as a general rule that your rights in a public place are weaker, they are not nonexistent, and both Apple and OpenAI must expect to face regulatory pushback on what they make.

This could be why Apple has accelerated regulatory conversation concerning such tools by introducing Siri Recap. The argument is that by forcing legislatures to make decisions on such matters, Apple is effectively throwing a punch at competitors who must also work within the law. (Though with data encryption such a huge piece of the privacy jigsaw, it’s fair to say that some nations may yet mess things up.)

Because it isn’t just about Apple

It makes sense for international lawmakers to create a harmonized framework of legislation to govern such products, particularly as they clamber headlong into so many different layers of protected personal existence. Apple’s decision to create this product at this time means regulators will now have to decide where to draw the line. 

We can surmise where Apple thinks that line will be on the basis of what Joswiak said and the actions the company has taken with a variety of guardrails to maintain privacy and data security. The idea it seems to be moving toward is that by stripping out the stuff we want kept private, it has effectively built the digital equivalent of writing a few notes in your book with a pen while a conversation takes place.

If Apple’s argument prevails, then those will become the regulatory-approved principles to define what other companies must do with their devices in this space. Including Meta and OpenAI.

Caught in a trap

That’s going to be fine for some entities, but companies that want to build businesses on your data will be disadvantaged by those decisions. Apple’s approach is that by defining the space, it also knows precisely what it must do to compete within it. That’s going to make for a far more equal playing field as AI hardware reaches the market.

A second outcome Apple may also be looking at is that by challenging regulators to sit down and declare what data and privacy rights consumers should enjoy in an AI digital age, it also identifies terms of reference to inform how its future AR glasses handle and process external video. Right now, it’s plausible to imagine a similar arrangement in which actual video is never stored, just classified and summarized like audio in Siri Recap.

And, of course, one final potential outcome might be that if Apple manages to convince the EU that its system provides an appropriate balance between consumer privacy and security and third-party product design, then it may forge a path through the impasse that currently stops Apple Intelligence from working in the EU. This could be a blueprint of the intermediary architecture Apple originally proposed to the EU when it first introduced Apple Intelligence. We’ll have to see if Europe accepts that.

Now please subscribe to my daily, human-curated Apple-related news headline feed at The Core, or follow me on BlueSky, LinkedIn, or Mastodon.

Microsoft 365 makes sharing files easy, but access can remain long after its original purpose has ended, leaving organizations with little visibility into who can still reach sensitive data. tenfold Software explains how centralized access governance and owner-driven reviews can help identify and remove unnecessary access. [...]

Microsoft Teams will soon let administrators tweak the list of file extensions commonly associated with security threats to meet their company's security requirements. [...]

A new survey from the Pew Research Center shows that a majority of people worldwide now expect artificial intelligence to lead to fewer jobs rather than more. The survey is based on responses from 37 countries. In 34 of these countries, it is more common to believe that AI will result in fewer jobs over the next 20 years. Concerns are greater in wealthier countries.

In Sweden, for example, there are signs of growing skepticism toward the technology. The proportion of Swedes who are more concerned than enthusiastic about the increased use of AI has risen by nine percentage points in one year. This is the largest increase among the countries compared over time. Concerns have also increased among both younger and older Swedes.

In the US, 71% of respondents said they think AI will lead to fewer jobs over the next 20, compared to 5% who say it will lead to more jobs. Most pessimistic were the Australians, with 76% predicting fewer jobs because of AI. The most optimistic groups were in Nigeria and the Philippines, where just 26% of respondents predicted AI-induced job losses outweighing gains.

Globally, many also fear that AI will widen economic disparities. In none of the 37 countries do more than a quarter of respondents believe that AI will reduce inequality.

However, views on the technology are not entirely negative. The median for the 37 countries shows that 41% say they feel roughly equal amounts of concern and enthusiasm about the technology. People who have heard and read a lot about the technology also tend to have a more positive view of it.

This article was originally published on Computer Sweden.

Related:

• No, AI is not killing jobs for everyone, studies say
• Older workers are more bullish on AI than younger ones
• AI hits entry-level jobs for younger workers the hardest — study

Fast-growing companies face countless recommendations for securing Google Workspace, but not every control provides the same value. This webinar examines real-world breaches to explore which security controls matter most, which may be overrated, and where lean security teams should focus their resources. [...]

Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege escalation. No customer action is required. The vulnerability, tracked as CVE-2026-85889, carries a CVSS score of 10.0. "Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network," Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Microsoft has resolved a known issue that causes incorrect alerts warning that Defender Antivirus was turned off after installing recent updates. [...]

In July 2025, someone registered a domain that used to belong to a content delivery network.  The CDN had been wound down years earlier, and the domain it served assets from was allowed to expire. What it had not lost were its callers. Thousands of websites, code repositories, and documentation pages still carry hard-coded references to hostnames beneath it.  The new owner holds [email protected]

A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no Swati Khandelwalhttp://www.blogger.com/profile/[email protected]

There we were, listening to AI leaders doing their usual spiel: AI is great! AI will cure cancer! AI impact will be “unprecedented, perhaps 10x of the Industrial Revolution at 10x the speed”! AI will find a final answer to “Why do socks disappear in washing machines?” (Well, maybe not the last one. Some things may be beyond us and our clever inventions.)

Then all the top AI leaders screamed as one: “Stop!”

Why? Well, it all seems to have started when AI researcher Jacob Coxon quit his job at Anthropic and proclaimed on X, “The people building AI earnestly believe that it could kill us all by the end of the decade.” Evan Hubinger, Anthropic’s Alignment Science Lead, immediately chimed in: “we really do earnestly believe AI could kill all humans! I personally think it will be >10% within the next decade.” And the world went nuts.

This added fuel to the “AI is untrustworthy” fire as more details came out about OpenAI’s Hugging Face fiasco and agent attacks on German programming wiki sites, while Anthropic has now racked up four known hacking attempts on other sites. Boy, is AI safe or what?

So the very next weekend, three of the top AI CEOs — Dario Amodei of Anthropic, Sam Altman of OpenAI, and Elon Musk of xAI — all urged an AI frontier model slowdown for safety reasons. Amodei, the most articulate of the trio, argued, “We must slow the pace at which we improve the capabilities of AI models” because we’re losing control of our AI systems (Really? Golly! Who knew?) and that an AI agent “swarm could be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage).”

Well, he’s not wrong. Sorry, President Donald Trump, but safe AI requires more than a “strong and smart” president. Even his Truth Social supporters think his stance on AI is wrong.

Like a stopped clock, Trump was right about one thing when he sputtered, “The only one that is happy about it is China.”

You see, just because some big US AI companies say “slow down!” doesn’t mean Chinese AI vendors will pump the brakes on their model development. Why would they?

Or, for that matter, why would the multitude of smaller AI companies or open-source AI developers? There are AI startups getting tens of millions in Series A rounds on nothing but a good pitch. You think they’ll tell their investors, “We’ll get right on improving our model… next month”? I don’t think so.

Besides, as wise writer Corey Doctorow observed, the narrative around “chatbots that wake up, ‘set their own goals,’ and ‘spontaneously’ start hacking servers — is fake. It doesn’t have ‘a 10% chance of ending the human race.’ The Hugging Face hack isn’t a mysterious, supernatural occurrence. It’s a Python loop and a chatbot. The people responsible didn’t accidentally create god: they created autonomous malicious software and then failed to closely monitor it, resulting in it doing something both foreseeable and bad.”

Exactly so.

In other words, it’s not the development of more powerful models that’s inherently dangerous. AI agents haven’t gone rogue; they’ve just been meeting their assigned objectives in ways researchers didn’t expect or plan for. What’s dangerous is the AI firms’ failure to pay close enough attention to what their agents are doing in tests. In fact, OpenAI just admitted to screwing up even more!

As Meta’s high poobah Mark Zuckerberg tweeted, “Every lab has the responsibility and incentive to move at the pace required to train its models safely, and the ability to take its own actions to ensure that happens.” He then goes on to explain that that’s why Meta delayed shipping Muse. Sure, Mark, sure.

Let’s get real. The big American AI companies may hope a slowdown will ensure that their lesser rivals, in the US anyway, can’t catch up. But given how OpenAI’s circular financing keeps leaking money, another reason OpenAI might welcome a slowdown is to save cash on R&D. 

It’s not going to work. We’re in steamboat time. Steamboat time? While we remember Robert Fulton for building the first commercially successful steamboat in 1807, everyone and their uncle were making steamboats as fast as they could. Soon steamboats were everywhere, and they sparked an economic boom. But they also caused many deaths because of shoddy construction and pilots racing them to ever greater, unsafe speeds. Hmm, does that remind anyone of anything recently?

Seriously, we’re not going to slow down. But doesn’t all this hand-wringing about safety do a great job of distracting people from the simple truth that AI isn’t delivering the productivity gains it’s been claiming all along?

By slamming on the brakes now, Big AI firms can obscure that they won’t be able to deliver the AI fantasyland they’ve been trying to con people into believing. A case in point: A recent McKinsey survey report finds that 80% of people say AI makes them more productive, but only 37% of companies see that reflected in their earnings. A number, they say, that hasn’t budged in a year. Let’s hide that damning number under the concern that we must slow down AI.

It also means AI leaders can hand-wave away their failures to actually generate a profit. Sure, NVIDIA is making money hand over fist, but for all the financial hype, none of the frontier-model companies is making money. Not one of them.

Yes, I know: Anthropic just told the Financial Times that it would be profitable for the second consecutive quarter if you don’t factor in all its expenses. Seriously? Seriously!?

Sure, its adjusted operating income (AOI) is set to be positive for the second consecutive quarter, but come on, AOI “profitability” is billions and billions of dollars from bottom-line profitability.

No, what this is really all about is AI leaders making the right noises to assure people that they really — no, really — care about securing their AI, while slowing things down to maximize their own profits and get rid of the competition.

Oh, I’m certain they also want to make things safer. I mean, just think about the lawsuits when loosely controlled Anthropic or OpenAI agents swarm and take down a major company. This will happen. They have no choice but to make them safer. Now, how will they do that? Given their abysmal track record, that’s a good question, and neither they nor we have an answer yet.

Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]

Browsing the web on Android sure ain’t what it used to be.

Earlier this week, we talked about how the Vivaldi web browser is bringing support for Chrome extensions to Android. Vivaldi has the same Chromium code foundation as Chrome but with lots of extra features and options. I’ve been using it on Android and the desktop alike for months now and can’t see myself going back anytime soon.

And with extensions now in the mix, Goog almighty, are things really getting interesting. We’ve already looked at five Chrome extensions that can enhance your efficiency on Android — and today, we’re rounding out that list with five more excellent extension options that work impressively well in the Android environment and can improve your mobile web meanderings in some commendable ways.

While the last additions were all about saving you steps and eliminating common mobile web roadblocks, this next batch revolves around the notion of supplementing or upgrading the actual web itself and the experience of working within different sites — even when they don’t always provide an optimal framework.

So refresh your memory on the mechanics of installing and managing Chrome extensions in Vivaldi, then read on and see which of these internet-improving Android Chrome additions hits home for you.

[Keep the knowledge flowing with my free Android Intelligence newsletter — one useful new thing to try every Friday!]  

Chrome Android extension #1: Your web customization genie

Let’s be honest: Most of the web isn’t exactly a pleasure to peruse. (Insert awkward pause here.)

But with an extension called Click to Remove Element, you can take total control and remove any element of any website that doesn’t please you.

Vivaldi already has some customizable ad and script blocking elements built in at the browser level, if that’s your jam, but Click to Remove Element is more about the stuff that those systems don’t automatically catch and hide — and it doesn’t have to be ad-related, either. It could be a pop-up video player on a site, a prominent button in a back-end interface, a logo or floating menu that takes up too much screen space, or literally anything else that annoys you on any website anywhere.

All you’ve gotta do is tap the extension’s icon, once it’s installed, then tap on any element on a page that you want to remove. And…

One tap, and boom: Any element on any website is invisible.

JR Raphael, Foundry

Poof! It’s gone. If you tap the little box beneath “Remember” in the Click to Remove Element panel at the bottom of the screen, that change will stick and stay present every time you load the same page in the future.

Chrome Android extension #2: A paywall peeper

For the record, as a working journalist in this weird and sustainability-challenged state of modern media we’re in right now, I strongly believe in and endorse paying for publications you appreciate whenever the opportunity arises.

Sometimes, though, you just want to read a random single article from a source you don’t follow regularly. Or maybe you want to share something you’ve read from a paywalled site with someone who doesn’t subscribe and isn’t going to do so just to read this one little thing you’re sending them.

That’s where a site called Archive Today can come in handy. Archive Today captures live views of articles and then saves ’em in a way that can be easily viewed and shared without any subscriptions or sign-ins required.

And a Chrome extension called Archive Page makes it as easy as can be to send a page over to the service for that purpose. Install it, tap its icon (in your Vivaldi extensions menu or in your browser toolbar, if you pin the extension), and you’ll have your viewable, shareable link in no time.

The tool won’t work for every site, depending on the nature of the paywall — and, again, I’d highly encourage you to use it as thoughtfully and ethically as possible — but it’s a powerful option to have available and one that’ll absolutely come in handy.

Chrome Android extension #3: An Amazon price spy

Whether you’re eyeing Amazon listings for work or maybe just for “work,” keep an extension called Keepa in your Vivaldi Android browser. You’ll never think about it or directly open it again after you’ve installed it, but it’ll add a helpful price tracking section into every Amazon listing you pull up on your phone so you can see how the associated product’s price has varied over time and know as soon as it drops again.

Keepa adds a helpful product price history and tracking option onto every Amazon listing in your browser.

JR Raphael, Foundry

Just scroll down a bit on any Amazon page you open, with the extension installed, and you’ll find the info along with the “Track product” option.

Chrome Android extension #4: Easier image saving

Ever find yourself needing to save an image from a website — then discovering that the image is in some funky format that isn’t what you require?

The aptly named Save Image As Type Chrome extension fixes that frustration once and for all. Just install the thing, then long-press on any image anywhere on the web — and…

Finally, you can save any image in any form you want — without any extra steps.

JR Raphael, Foundry

There ya have it: You’ll find a newly added “Save image as…” option in the Vivaldi long-press menu, and tapping it will reveal a full menu of possibilities for saving your image however you need — without any annoying extra steps or after-saving conversions.

Chrome Android extension #5: The Wikipedia wizard

Finally, make your Wikipedia work infinitely more pleasant with the excellent Wikiwand Chrome extension.

Wikiwand transforms every Wikipedia page into one with a delightfully modern, easy-on-the-eyes interface that has all the same info — just in a noticeably nicer form.

Once you see Wikipedia like this, you won’t want to go back.

JR Raphael, Foundry

Install it, forget it, and enjoy a better Wikipedia experience henceforth. Now, that’s what I call an easy win.

Ready for even more unfair advantages? Check out my free Android Intelligence newsletter to get something new and useful in your inbox every Friday — and get my Android Notification Power-Pack today.