Topic
Explore English articles about Cybersecurity & Privacy.
TamperBench, presented at KDD '26 by an international research team including the University of Waterloo, shows that safety mechanisms in all 21 open-weight LLMs tested could be neutralized. The findings expose the limits of existing defense techniques and raise new questions for public procurement and safety evaluation.
Microsoft Paint records a server-issued GUID in both the AI-generated image and its C2PA data, even for local generation. Photos was found to use a similar code path, but no personal identification or account matching has been confirmed.
Passkeys have grown to an estimated 5 billion in use worldwide, but passwords persist due to unfinished cross-provider migration, shared-device limitations, and immature secure recovery systems. The pace of full rollout depends less on adoption numbers than on how complete these migration paths become.
AliExpress's silent WebAudio processing combined a weak audio-only identification signal with Canvas, WebGL, and other signals before transmitting them. A Bluetooth malfunction exposed invisible code execution that had persisted for two years.
Five US agencies have flagged an active threat involving AI-generated Python scripts targeting internet-exposed Siemens S7 PLCs. The activity is likely reconnaissance, with agencies urging exposure reduction and monitoring for unusual read/write access.
Anthropic will keep the 30-day retention period for its Mythos-tier models but move enterprise data storage to customer-controlled clouds, with Anthropic itself no longer holding the data, starting in fall 2026.
Google won a $10 million bid for the internal data of bankrupt, liquidating Spirit Airlines — including 100 million emails. This piece examines the bidding war with runner-up Mercor, the 100x gap versus typical Asset Hub pricing for liquidation data brokerage, and how effective the line drawn around excluded personal information really is.
A research team at UMass Amherst has discovered a design flaw unique to Visa's contactless payment kernel: the expiration date is excluded from cryptographic signing. Using two off-the-shelf smartphones, they revived an expired card and successfully completed a transaction at a real store. Mastercard and Amex proved resistant, pointing to the issue as a Visa-specific implementation choice.
OpenAI cannot rule out that Astra has reached "Critical" cyber capability, and has held off its largest frontier RL run as a result. Monitoring now covers roughly 20% of targeted inference compute, as safety standards are being updated mid-development.
On GitHub.com, roughly 20% of Web/API requests and about 50% of archive and Raw content fetches failed. Enterprise authentication and Actions were also affected, and even after migrating to dedicated infrastructure, the user-facing retrieval paths still experienced disruption.
