Patrick C Miller

Default

Production, Persuasion, and Power: How Generative and Agentic AI Are Transforming Influence Operations

Generative AI can increase the quantity and quality of malign foreign influence campaigns. However, questions remain as to whether these campaigns influence public opinion.

Handheld Scanner Is A Radio Multi-tool

These days, it’s possible to cram a whole lot of radio functionality into a very compact device. A great example of that is the LakeShark scanner from [SAMS0N1TE]. The LakeShark is based on t…

ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks

The ShinyHunters extortion gang is using a URL-encoding trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 flaw, allowing the threat actors to resume widespread exploitation of a flaw on vulnerable servers.

Just Security

The AI Governance Momentum: Why We Need to Fill the Accountability Gap Now

This series aims to set out what a meaningful, multistakeholder, and globally relevant AI accountability mechanism should look like.

Schneier on Security

On Anthropic's AI Misuse Report - Schneier on Security

Earlier this month, Anthropic published a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully summarized the report into 117 findings. A few of the highlights: AI agents increasingly handled reconnaissance, exploitation, data theft, propaganda production, surveillance workflows, and research while humans selected targets, set goals, and reviewed important outputs. The report describes attackers using AI to industrialize credential theft, cloud compromise, phishi

Hackers now exploit critical Roundcube flaw in code injection attacks

A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in attacks, according to the Canadian Centre for Cyber Security.

thenextweb.com

Google’s new Gemini TTS models can clone a voice from 30 seconds of audio

Google's Gemini 3.8 TTS models design voices from text prompts, offer 2,000+ voices and clone a voice from 30 seconds of audio after a consent check.

Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data

CVE flood pushes Ubuntu onto weekly kernel release cycle

AI-assisted bug hunting is helping pile up vulnerabilities faster than defenders can patch them, so Canonical is picking up the pace

TechCrunch

'We're already fighting yesterday's battle': Greece's prime minister gets candid about AI | TechCrunch

Most leaders on a trade mission stick to the pitch, but when I interviewed Greek Prime Minister Kyriakos Mitsotakis this week, he also admitted that no government is ready for what AI is about to do.

Crooks use fake desktop apps to fool HR staff into giving them remote access

Nothing in the attack chain screams malicious software, except none of the impersonated HR and payroll providers actually offers a desktop app

Abusing SQL To Play DOOM

Most laypeople who encounter SQL think of it purely as a tool for managing large datasets. While that is certainly what it was designed for, SQL is still a programming language at its core. It incl…

thenextweb.com

AI model costs are pushing startups towards cheaper open weight

Harvey's gross margin fell from about 50% to minus 50% by June on AI model costs. It turned positive after it built a model on China's Kimi K3.

TechCrunch

Discord's age-verification era is upon us, despite community backlash | TechCrunch

According to Discord, 90% of users will not have to verify their age.

Windows, Linux, Android File Notification Systems Leak User Activity

File-change notification systems in Linux, Android, Windows, and macOS can leak keystroke timing, browsing activity, and WhatsApp events.

Arista Urges Immediate Patching of Exploited VCO Zero-Day

Arista patched CVE-2026-93952, an exploited zero-day in on-premises deployments of VeloCloud Orchestrator (VCO).

NetScaler admins told to patch critical zero-days in ADC and Gateway now

Citrix published patches for two critical flaws and six lesser ones on Sunday; “Monday will be too late” to patch, said one expert.

26 state attorneys general call on Congress to rein in AI, flagging risks

Legislation introduced in the Senate on Wednesday would pause AI research until the creation of a federal department that would regulate the technology.

Nextgov.com

Senators propose voluntary telecom security framework after Salt Typhoon hacks

The bipartisan bill would establish cybersecurity best practices and independent certification, following the FCC’s rollback of safeguards adopted in response to the Chinese hacking campaign.

Google Warns of ShinyHunters' Fresh Oracle PeopleSoft Campaign

Google warns of a new ShinyHunters campaign mass targeting Oracle PeopleSoft with a modified CVE-2026-35273 exploit.

CyberScoop

CISA outlines improvement plan for CVE program

Cybersecurity experts express skepticism over CISA’s new CVE data quality white paper, citing unaddressed software identifiers and unreleased baseline metrics.

OpenAI Says Its Models Engaged With US Government Websites in New Model Misbehavior Disclosure

OpenAI said its artificial intelligence agents had interacted with several U.S. government websites in unexpected ways.

Cyberattack hits Welsh police force, may have affected staff data

Dyfed-Powys Police in Wales said a cyberattack affecting the force disrupted some non-emergency systems and may have compromised staff information.

Security Affairs

AI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS

MikroTrick chains RouterOS flaws to bypass authentication and gain admin access. AI helped researchers uncover the attack chain within days.

Chinese hackers exploit WordPress, Zyxel flaws to steal govt data

A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.

Cybersecurity and Infrastructure Security Agency CISA

Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway | CISA

Default

New York Could Share Frontier AI Safety Reports Nationwide Without New Legislation

An existing financial-regulatory platform could provide a secure channel for states to share confidential frontier AI safety reports.

thenextweb.com

A user says Meta’s Muse gave his address to a Marketplace buyer

Muse agreed a lowball price and sent a Marketplace buyer to a user’s building, he says. Meta says Muse usually asks for permission.

Honeywell: OT Security Teams Embrace AI, but Autonomy Still Rare

Honeywell OT Cybersecurity Benchmark Report shows a disconnect between how organizations rate their OT security and how prepared they are.

Placeholder domain used in dev docs now serves ClickFix attacks

The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands.

BBC News

Are we back in big tech's 'move fast and break things' era?

Despite promises to make safe AI, examples of bots behaving badly are now coming at us thick and fast.

IEEE Spectrum

Measure An Asteroid’s Shadow With a Small Telescope and Some DIY Gear

Watching space rocks obscure stars is easier than you think

thenextweb.com

Dutch government publishes call from 21 countries and the EU for international oversight of frontier AI

Leaders of 21 countries and the European Commission call for mandatory testing of frontier AI and a possible international oversight body.

TechCrunch

Apple says it's tightening macOS 'Full Disk Access' controls due to new risks from AI agents | TechCrunch

Apple says it will add new controls around macOS’s Full Disk Access permission, warning that increasingly capable AI agents make broad access to users’ files, messages, mail, and browsing history riskier.

A Look at AI Doomsday Scenarios That Researchers Say Could Put Humanity at Risk

Debates over the plausibility of these doomsday scenarios have heated up since several executives endorsed slowing the technology’s development for safety reasons.

TechCrunch

Robotaxi operators will face fines for blocking first responders | TechCrunch

A new California law places new rules on autonomous vehicles operators.

thenextweb.com

OpenAI names the four things it wants safety assessors to test

OpenAI has published the four areas and seven principles it wants outside safety assessors to work to, including time to fix findings before publication.

thenextweb.com

Amazon blocks Meta’s Muse and accuses Perplexity of misleading a court

Amazon blocks Muse from its store and says Perplexity told the Ninth Circuit something its own servers contradicted.

Rogue external MFA providers can steal passwords during logins

Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users' passwords during legitimate login attempts.

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session