Seven malicious npm Vite packages use blockchain as a C2 channel to deliver a RAT
Seven npm typosquatted packages around Vite hide their command address in a blockchain transaction - an almost impossible-to-cut C2 channel.
Jul 18, 2026 2 1
MSI Claw 8 EX: the most powerful Intel Panther Lake handheld - but not yet the one to buy
The Verge takes a close look at the MSI Claw 8 EX AI Plus, the first handheld PC to feature an Intel Panther Lake chip. The result: the most powerful and portable handheld PC to date — but compromises still prevent it from being unreservedly recommended.
Aug 14, 2026 2 1
Azure DevOps MCP: Indirect prompt injection, the AI review agent as an exfiltration vector
The official Microsoft MCP server for Azure DevOps does not sanitize pull request descriptions before passing them to an LLM. As a result, a hidden instruction in a PR comment can redirect the AI review agent to projects the attacker does not control and silently exfiltrate their content.
Aug 13, 2026 7 2
EA to come under Saudi ownership next week: $55 billion LBO in closing phase
Electronic Arts announces that its leveraged buyout for $55 billion is expected to be completed next week—the Saudi PIF, Silver Lake, and Affinity Partners (Jared Kushner) will take control and take EA private.
Jul 31, 2026 21 3
Ocarina of Time on iPad, 60 FPS and native resolution: Kahris let Codex 5.6 Sol code the iOS port in one command
A developer named Kahris published on GitHub a native iOS port of The Legend of Zelda: Ocarina of Time - 60 FPS, iPad resolution, Bluetooth controller support. The twist: the iOS layer was generated autonomously by Codex 5.6 Sol from OpenAI, based on a single prompt refined for hours.
Jul 28, 2026 25 4
Shark vacuum cleaners: a flaw turns robots into rolling spies - SharkNinja is slow to patch
A researcher claims to have alerted SharkNinja as early as March about a vulnerability that allows remote control of Shark robot vacuum cleaners, access to their camera, and the exfiltration of sensitive data. Patches are still awaited.
Jul 27, 2026 4 1
Bing Images: two SVG traps, and ImageMagick executes SYSTEM code on Microsoft servers
CVE-2026-32194 and CVE-2026-32191, both CVSS 9.8. Two command injections in the Bing image search pipeline: a simple SVG whose image attribute starts with " | " is enough for ImageMagick to launch server-side shell commands from Microsoft. Discovered by the autonomous startup XBOW, patched in March 2026, published today.
Jul 24, 2026 4 2
The Zilog Z80 is 50 years old: a chronicle of the 8 bits that refuse to die
Fifty years after its release, the Zilog Z80 is still produced to order, runs in dozens of open-source projects, and still haunts emulators. A look back at the chip that shaped our childhoods.
Jul 22, 2026 9 3
KFC Japan halts operations: a cyberattack pauses the archipelago's favorite fast-food chain
Online orders suspended, temporary restaurant closures considered: KFC Japan (ケンタッキー) suffers the consequences of a cyberattack targeting its logistics partner. An opportunity to recall what makes the brand so unique in Japan.
Jul 17, 2026 21 4
Moon Festival 2026 at Starbucks Japan: The moon-viewing celebration infuses the autumn collection
Starbucks Japan unveils its Tsukimi (月見, moon-viewing) collection for autumn 2026: mugs, tumblers, and gifts inspired by the Japanese tradition from late September. A textbook example of Western seasonal marketing adapted to the Japanese lunar calendar.
Sep 3, 2026 18 3
SonicWall SMA1000: Two actively exploited 0-days, potentially chainable
The Register and The Hacker News reported on September 2, 2026, that SonicWall SMA1000 appliances are once again under active attack, with two zero-days capable of forming a full exploit chain. Immediate operational priority.
Sep 3, 2026 2 1
A malicious .git file can execute code in Claude Code, Codex, and Cursor
The Hacker News documents a new class of attack: malicious .git configurations that, when read by AI coding agents, execute attacking code. The tools meant to secure become vectors.
Sep 3, 2026 9 2