Security

Google Expands Android Age Verification Worldwide With Privacy-First API

Google will expand its Play Age Signal API for Android worldwide by end of 2026. The privacy-first age verification tool needs no ID or selfie uploads.

Apple Credits Claude and Codex AI Tools for Finding Security Flaws in iOS 26.6

Apple's iOS 26.6 fixes 87 vulnerabilities with Claude and Codex AI tools credited for finding WebKit and Safari security flaws alongside Anthropic researchers.

Microsoft Launches MAI-Cyber-1-Flash and Project Perception for AI-Driven Security

Microsoft launched MAI-Cyber-1-Flash and Project Perception to cut enterprise security costs by 50%. The new AI model beats Anthropic and Google on the CyberGym benchmark.

Security Camera Ships GitHub Admin Token in Its Login Page

A security camera shipped a GitHub admin token in its login page, exposing repositories. Learn how IoT firmware leaks and AI agents exploit similar credential flaws in 2026.

WP2Shell Attack Hits Up to 90 Million WordPress Sites Running Unpatched Versions

Hackers actively exploit WP2Shell, a critical WordPress core RCE flaw. Up to 90 million unpatched websites are at risk of complete remote server takeover. Update now.

Hacker Wipes Romania's Entire Land Registry Database After Failed Extortion

A hacker wiped Romania's complete land registry database on July 14, 2026, after extortion failed. ANCPI systems stayed offline for over a week while citizen data went up for sale.

LG Monitors Silently Install McAfee Adware Through Windows Update Without Consent

LG monitors silently install McAfee adware via Windows Update without consent. Gamers Nexus found the app demands all system resources. Affected UltraGear displays cost $1,200.

Tailscale SSH Flaw TS-2026-009 Allowed Root Access Through Argument Injection

Tailscale SSH flaw TS-2026-009 allowed authenticated users to inject arguments and gain root access. Learn how the vulnerability works and how to patch affected nodes.

Windows Defender Zero-Day Patched 29 Days After Public Exploit Exposed Millions of PCs

Microsoft took 29 days to patch the RoguePlanet Defender zero-day after a public exploit exposed millions of PCs, only for the researcher to weaponize the fix itself.

Grok Build CLI Uploaded Entire User Directories Including SSH Keys to xAI

Wire-level analysis confirms Grok Build CLI 0.2.93 uploaded full user directories including SSH keys and password databases to xAI servers. Opt-out was ignored.

EU Parliament Revives Chat Control 1.0 in Last-Minute Vote Before Summer Recess

EU Parliament approved Chat Control 1.0 with 322 to 255 votes using a fast-track procedure before summer recess, enabling voluntary scanning of private messages.

GitLost Prompt Injection Made GitHub's AI Agent Leak Private Repos

GitLost vulnerability disclosed in July 2026 lets unauthenticated attackers trick GitHub Agentic Workflows into leaking private repository data via public issues.

EU Pushes Chat Control 1.0 Through Fast-Track Vote Before Summer Recess

EU Council fast-tracked Chat Control 1.0 after rules expired on April 3, forcing Parliament to vote on mass message scanning before summer recess on July 10, 2026.

YouTube Private Video Leak Exposes Creators' Unlisted Content Through API Flaw

YouTube API flaw exposed over 15,000 private creator videos through authorization bypass. Learn how the leak worked and what creators should do now.

Alibaba Bans Claude Code Over Alleged Backdoor Risks Starting July 10

Alibaba bans Claude Code from July 10 over alleged backdoor risks. The move hits Anthropic amid a growing distillation dispute with the Chinese e-commerce giant.

Linux 6.9 Broke LUKS Disk Encryption Key Wipe on Sleep

European Digital ID Wallets Depend on Apple and Google Security Services

European digital ID wallets rely on Apple and Google security services. UK regulators want to limit platform control over payments as EU antitrust pressure grows in 2026.

Supreme Court Rules Geofence Warrants Must Meet Full Fourth Amendment Protections

Supreme Court rules geofence warrants require full Fourth Amendment protections, ending broad location dragnets. Google received 11,554 geofence requests in 2022 alone.

Age Verification Systems Build Infrastructure for Speech Attribution

Age verification mandates in Australia and the EU build technical infrastructure for automated speech attribution, creating surveillance systems that track identity across platforms. Over 30 countries now pursue similar frameworks.

Anonymous GitHub Account Mass-Drops Undisclosed Zero-Day Exploits

An anonymous GitHub account is mass-dropping undisclosed zero-day exploit PoCs while urging readers to claim CVE credit amid CI/CD pipeline threats.

Danish Police Raid Privacy Activist Who Published Two Numbers on X

Danish police raided privacy activist Lars Andersen on June 21, 2026, smashing his door and cutting power after he published 2 numbers on X. Learn what happened.

Cloudflare's Temporary Accounts Let AI Agents Deploy Workers Without Signup

Cloudflare's June 2026 update adds temporary accounts for AI agents. Deploy Workers with no signup using wrangler --temporary, then claim within 60 minutes.

10,000 GitHub Repositories Found Distributing Trojan Malware

A researcher found 10,000 GitHub repositories distributing Trojan malware. Learn how attackers bypass detection, what malware they hide, and how to stay safe.

Malware Authors Hide Spyware Inside Weapons-Related Texts

Microsoft Yanks 70+ GitHub Repos After Hackers Planted Credential-Stealing Malware

Microsoft pulled 70+ open-source GitHub repositories after hackers injected credential-stealing malware targeting AI developers' passwords and authentication tokens.

UK Wants to Scan Every Message on Your Phone Before You Send It

The UK government proposes scanning all phone messages and photos before sending, with prison penalties for non-compliant companies. Over 19,000 fraudulent sites detected in 2026 alone.

Meta AI Chatbot Let Hackers Hijack Thousands of Instagram Accounts

Meta confirmed thousands of Instagram accounts were hacked after attackers tricked the Meta AI chatbot into resetting passwords. Learn how the exploit worked and what it means for AI security.

AI Agents Like Claude Code Pose New CI/CD Risks in GitHub Actions

Microsoft found 5 critical risks when AI agents like Claude Code run in GitHub Actions. Prompt injection can steal credentials. SEO poisoning targets developers. Here is how to secure your CI/CD pipelines.

Anthropic Mythos: 1 Tool That Finds 0-Days Before Hackers Do

Anthropic opened Mythos on June 3, 2026 — an AI framework for vulnerability discovery. Learn how it works, what it finds, and the risks of open-sourcing security tools.

Testing LLMs Against a Vulnerable App for $1,500

I spent $1,500 testing whether LLMs like GPT-5.5 and Claude could hack a deliberately vulnerable app. Here are 7 findings about AI-powered security testing, from prompt injection to SQLi.

VSCode 1-Click Exploit Steals GitHub OAuth Tokens via Webview

A 1-click VSCode vulnerability steals GitHub OAuth tokens, compromising 3,800 repos. Learn how the webview exploit works, the TanStack connection, and 5 protection steps for developers.

Critical ChatGPT Mac Security Breach — Update Your App Immediately

A critical security breach in the ChatGPT Mac app requires immediate update. Learn 5 facts about the vulnerability, how hackers exploit it, and steps to protect your Mac now.

GitHub Bans Security Researcher for Publishing Windows Zero-Day Exploits

GitHub banned an anonymous security researcher known as Nightmare-Eclipse after publicly publishing 6 Windows zero-day exploits. Three were actively exploited before Microsoft patched them.

ChatGPT Google Sheets Add-on Leaks Your Data Without Permission

A vulnerability in the ChatGPT add-on for Google Sheets allows attackers to silently exfiltrate data from spreadsheets without the owner's knowledge.

Miasma Worm Hits 32 npm Packages in Red Hat Supply Chain Attack

The Miasma worm compromised 32 npm packages in Red Hat's @redhat-cloud-services scope via a hijacked OIDC trusted publisher, stealing AWS, Azure, and GCP credentials through self-replicating malware.

Microsoft Open-Sources RAMPART and Clarity for AI Agent Security Testing

Microsoft released two open-source tools — RAMPART and Clarity — that bring security testing directly into the AI agent development workflow, from design verification to automated red-team testing in CI pipelines.