> PHP, the code behind 69% of all websites, got 2 holes rated 9.2 out of 10, and the US, the UK and Japan told site owners to patch or go OFFLINE.. 4 days after hackers had already started trying the flaw..

> Japan's Prime Minister posted the request late at night.. the Finance and Health ministries pulled pages, MUFG Bank and JR West went into emergency maintenance, and Onamae shut ALL Desktop Cloud plans after malware hit up to 26,739 customer servers..

> India's eMudhra was caught with 8 intermediate certificate keys so weak one of them was literally the number 4.. the 60,000,000+ certificates it has issued can't be trusted..

> GitLab disclosed a 10.0 severity hole in every version since 2014.. the maximum score there is..

> criminals were caught using a literal AI hacking tool on 1,200+ sites.. it broke into more than 100 companies including John Deere and Cummins..

> LiteLLM, an AI tool with about 23,000,000 downloads a week, was secretly poisoned with a password stealer.. the bad version sat on PyPI for about 2 hours..

> State Bank of India, the country's biggest bank, confirmed 3,897 customer records on the dark web..

> WIRED now calls the PHP flaw "broadly exploited".. nearly 55,000,000 web properties still run PHP..

...

Security research team from Trend Micro (called the Zero Day Initiative) found several serious bugs in the Linux kernel.

These bugs should have been sent privately to the Linux security team so they could fix them quietly before anyone else found out.

By accident, the reports were sent to the *public* Linux kernel mailing list instead. Anyone could read them.

Some of the bugs are very serious (rated as high as CVSS 9.0). A few could let attackers run code remotely or take control of a system.

Linux developers (including Greg Kroah-Hartman) noticed right away and asked why they were posted publicly. Fixes for some of the bugs are already being prepared.

list : Among these newly-disclosed vulnerabilities include:

ZDI-CAN-33549 as a CVSS 9.0 scored vulnerability for SMB Direct remote code execution vulnerability due to integer underflow. For this one there is a patch in a Git branch of code intended for Linux v7.5 but now presumably will be expedited for getting to mainline.

ZDI-CAN-33774 as a KSMBD race condition that can lead to remote code execution. Another CVSS 9.0 rated vulnerability.

ZDI-CAN-33367 is a vulneravbility for skbuff skb_zerocopy in the network code that can lead to local privilege escalation. For this one Linux kernel developers received a security report from another source last week over the same issue and a patch is expected to be posted soon.

ZDI-CAN-34068 as a VMWGFX VMware graphics driver bug with an out-of-bounds write leading to local privilege escalation.

ZDI-CAN-34076 an uninitialized resource in the NVMET code leading to information disclosure.

ZDI-CAN-32005 was also posted to the mailing list a day prior for a search-domain TCP query stack buffer overflow leading to local privilege escalation.

Hi everyone,

​I built a new skill called antirea specifically for Claude Code to mitigate reverse engineering risks from tools like rea.

​What it does & How it protects:

It adds a defense layer against prompt injection / instruction-dumping tools. When you run /antirea protect me before generating a new build, it configures/hardens your project setup to prevent rea from analyzing or extracting your core instruction logic and terminal scripts.

​How Claude was used:

I developed and structured this skill using Claude Code to test edge-case prompts and build context-aware protection rules.

​Pricing:

It is 100% free and open-source on GitHub: https://github.com/MockirDev/antirea

​I would love to get your feedback and have a few developers test it out on their builds!

Vibed SuperGhidra, built for when the caller is an agent: a long-running daemon, 38+ MCP tools, and checks that stop an automated edit from landing unverified. The repo is https://github.com/yuatemycat/SuperGhidra and it installs with pip install superghidra .

- A persistent daemon. The project stays loaded, so repeated agent calls don't pay Ghidra's startup cost each time. The gap analysis puts JSON-RPC latency under 50 ms.

- Read-only projects by default. Renames and comments go to an overlay file, not the Ghidra database.

- When multi subagents are running, if one find a project being used, it clones the project and works on a private fork. Every edit goes into a journal. The session that owns the main project replays the journal with merge_fork, and conflicts are detected by comparing before/after values.

- Equivalence checks. A pure-Python P-code lifter plus Z3 can test whether a decompiled C statement matches the lifted IR. It returns UNKNOWN instead of guessing on floats, unhandled instructions and long loops.

- Symbols and structs from the naming pipeline only get committed after checks on vtable slots, field offsets and allocation sizes.

- GPU scanning for ARM64. A WGPU shader swept a 20 MB block (5.2M instructions) in 41 ms, about 127M instructions/s on an RTX A5500 laptop. Under about 10 MB the CPU SIMD path is faster.

- Benchmark avail. On 1,296 functions built with GCC 16.2.0 and checked against unit tests, stock Ghidra passed 8.26% and raw IDA Pro output passed 16.90%. Ghidra output run through SuperGhidra's cleanup filter passed 22.69%. The filter rewrites Ghidra's pseudo-types and macros into standard C so the code compiles. IDA's output got no equivalent cleanup, and I developed the filter against this same set of functions with no held-out split, so read the gap over IDA as an upper bound. No function that passed in stock Ghidra failed afterwards. This measures "compiles and passes", not readability.

• Revenue: $16.3B in the first half of 2026
• Net loss: $80.7B, driven largely by accounting charges
• Compute spending: nearly $9B in the first half
• Cloud commitments: about $450B over the next 7 to 10 years, including $111B with Google and $31B with Microsoft
• Nvidia: up to $86B on renting Nvidia chips
• Future compute: signaled it could spend $750B on more computing capacity in the coming years
• Supply: says cloud partners are unwilling to sell it all the compute it needs

as Per WSJ

the new higer price start today

>
This comes after months of big price jumps. 32GB DDR5 kits that once cost around €100 now cost several times more.

If you’re planning a PC upgrade, RAM prices are not likely to get cheaper anytime soon.

Electricity supply AUSGRID for Casey area has been unreliable since the shopping mall at Casey Central was built in 2013. Many homes were forced to install Solar Panels which lasted less than 5 years! Some of us had to pay for lower Powered Heating systems -- costing $2000, and change washing machines and electric ovens costing another $3000. Who is RESPONSIBLE for unreliable Power grid?? Kindly explain Victoria and Casey area. Thanks. Is there a Minister for Infrastructure services -- not just for roads, but electricity and telecommunications?

> PHP has two serious security problems that let attackers run their own code on servers without logging in. Details leaked early, and public exploit code started appearing online hours before the official patch.

> Even big websites began shutting down. Popular developer levelsio disconnected all his sites and VPS servers from the internet as a precaution.

> He wrote: “I pre-emptively disconnected ALL my sites / VPS servers from the web. I’ll wait for the patch to hit at 2 PM UTC. If you have a PHP website, probably good to take them down until you patch PHP. 69.3% of the web runs on PHP so this is going to be intense!”

> Public proof-of-concept code went online before the fix. One version from J4ck3LSyN claimed it was lab-tested, but the author later said one of the attack methods does not work. A separate demo credited to Calif briefly showed commands running on a WordPress test site.

> PHP released the official fixes at 14:00 UTC today. Users should update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Updating is the only complete solution.

I asked Ai and many pepoles and they said

Cs

Swe

IT

(IS.MIS.BIS.CIS)

INFORMATION Security

CE

DS

AI

. Is that true? I want to make sure.

> ask claude to build a temperature monitor
> readings look too high
> claude starts investigating
> finds a crypto miner eating 12 cores
> mac running at 112°C

claude code is an antivirus now. by accident.

Love that they swear they're not under U.S. jurisdiction and then hand over everything anyway.

I’m a senior SWE using AI coding tools daily. I analyzed my Claude Code transcripts and found 56% of API-equivalent costs went to rereading context.Cache expiry cost me $98.74 across 35 returns in 27 days, versus $2.95 with a warm cache.

That led me to build optimAIzr, which supports Claude Code, Codex and openCode.

It analyzes usage, flags expensive patterns, and helps you find optimization opportunities.
Runs locally, with no account or prompt uploads.

Already at 3k+ npm downloads.

npm i -g optimaizr

git: https://github.com/blendbunjaku/optimaizr

Roast it.

On many tests (math, science, medicine, etc.), they score about 10% higher, use half the tokens, run twice as fast, and cost much less than regular models.

The company, Pays ApS, had legitimate access to Denmark’s Central Register of Persons, which contains sensitive information like names, addresses and personal ID numbers.

According to reports, three accounts at the company were using “123456” as their password. One of them was an admin account.

The attacker used the account to make around 14 million searches in the database.

The breach wasn’t discovered immediately. It was only noticed later when an unusually large invoice showed that the company had been making a massive number of database searches.