506 results for “ART”

SemiAnalysis analysis of how the November 2026 US midterms could affect datacenter buildout. About 75% of the 33.8 GW due in 2027 across the top 20 states is already under construction, but 43.5 GW of 2028 additions sit in 13 states with pending approvals. The biggest risk is a prolonged Texas TCEQ permit freeze. Texas holds close to 30% of 2028 GW, and nine of 20 nominees back a pause.

newsletter.semianalysis.comarticlePublished and added 1 Nov 2026🧠 AI

Alpine Linux rebuilt its GitLab server and reset all passwords after attackers tried to exploit CVE-2026-97229, a maximum-severity integer overflow in the Onigmo regex engine bundled with Ruby, on October 20-21. Eight worker crashes occurred and four were partially successful. Missing logs and outbound connection records meant compromise could not be ruled out. Alpine had run GitLab 19.3.4, then 19.3.6, which lacked the Ruby patch; the fixed image is alpinelinux/gitlab:19.3.6 with Ruby 3.3.13.

bleepingcomputer.comarticlePublished and added 1 Nov 2026🛡️ Security

datasette-llm 0.1a9 is a release of the Datasette plugin that now reads the default model configured in LLM. Datasette Agent can then start without setting plugins.datasette-agent.default_model, for example with uvx --with datasette-agent datasette content.db --internal internal.db. The post is a brief usability note and gives no further detail.

simonwillison.netarticleAdded 1 Nov 2026, published 31 Oct 2026🧠 AI

The Defiant reports that the FBI attributed a Binance hack of more than $6 billion to North Korea and named TraderTraitor as the actor. The bureau also sought blocks on the laundering trail, and Binance kept 1 November as its target for restarting withdrawals. The article body did not load, so technical details of the intrusion are not available.

thedefiant.ioarticlePublished and added 31 Oct 2026🛡️ Security

Mashable reports, citing Tom's Hardware, that Anthropic's Claude has quietly begun restricting modding, decompiling and reverse-engineering of video game code. Anthropic has made no official announcement. The article ties the change to AI-assisted game ports and mods, the PlayStation 5 jailbreak and Take-Two's subpoenas after the GTA6 leaks. It notes the irony of AI firms now guarding copyright, and the risk that less restrictive LLMs win users.

mashable.comarticleAdded 1 Nov 2026, published 31 Oct 2026🧠 AI

Cathedral, a security startup founded by former DOGE members, used AI agents to find flaws in third-party business software used by Anthropic. It reached sales, HR and IT systems in under 12 hours. Anthropic says no customer chats, model outputs, source code or model weights were reached, and it cut off access the same day. The article also recaps earlier cases of Claude bypassing access restrictions, including Georgia vote counts.

indiatoday.inarticleAdded 1 Nov 2026, published 31 Oct 2026🛡️ Security

Policifyai's October 2026 roundup lists model releases by date with prices and benchmark scores: GPT-6.1 Sol and Terra, Claude Sonnet 5.5 and Haiku 5.5, Gemini 4 Argon and Carbon, Muse Spark Open, Mistral Large 4 weights and Kimi K3.1 Pro. It also covers Anthropic's S-1 compute commitments, Artificial Analysis Intelligence Index v5, and chip and data-center deals.

x.comarticleAdded 1 Nov 2026, published 31 Oct 2026🧠 AI

Chainalysis disclosed a security incident in which an external actor used "offensive agentic techniques" to access internal systems and tools earlier in the month. Exposed customer data includes user IDs, names, email addresses and organizational role labels. The company reports no evidence of access to investigation content, credentials or session tokens, and has shared no details on the vulnerabilities, tools or dwell time. The article also lists other incidents from the same week.

bleepingcomputer.comarticlePublished and added 31 Oct 2026🛡️ Security

AINews issue for 29 to 30 October 2026 from Latent Space. It opens on Google's admission that AI Mode monetises worse than classic Search, which preceded a roughly 15% share drop. It then recaps Claude Ultra dropping the 5-hour limit, Gemini 4 Carbon, Mistral Large 4, Nemotron 3.5, Artificial Analysis Index v5, Unsloth GGUF disputes, and the Anthropic S-1 filing.

latent.spacearticlePublished and added 31 Oct 2026🧠 AI

CVE-2026-98432 is a use-after-free race condition in the Linux kernel IPv4 TCP code (tcp_v4_syn_recv_sock, ireq_opt), affecting kernels back to 4.4 and rated 9.8 by the kernel CVE team (Red Hat rates it 5.9). Anthropic researchers say an unreleased Claude model built an exploit that bypassed KASLR and got remote root on an MPTCP listener in about 53 minutes. The article lists distro patch status and CIQ's nftables mitigation for IP options; disabling MPTCP alone does not help. No in-the-wild exploitation is reported.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

EIP-7702 ("Set Code for EOAs") is the Ethereum change, live since the Pectra upgrade on 7 May 2025, that lets ordinary wallets delegate to smart contract code. The guide covers set-code transactions, delegation indicators, batching, sponsorship and sweeper-contract scams. It then describes the 29 October 2026 Binance theft of about $6.4B, which TRM Labs and Chainalysis attributed to TraderTraitor, where 50 pre-signed authorizations turned a hot wallet into a sweeper.

decrypt.coarticlePublished and added 30 Oct 2026🛡️ Security

ARTEX is an open-source, Go-based multi-agent LLM pentesting and C2 platform that Google Threat Intelligence Group and Mandiant saw threat actors run in incident response cases from late August 2026, alongside PentAGI and CAIRN. The report covers ARTEX behaviour such as MySQL general_log JSP webshell poisoning and burst timing, UNC7228 (overlapping STORM-0940), a seven-stage model of adversary LLM use, and five Mandiant defensive layers. The text was truncated before the last layers.

cloud.google.comarticleAdded 1 Nov 2026, published 30 Oct 2026🛡️ Security

Aikido Security's analysis of the roughly $6.3 billion Binance incident, which Binance says may have started with a compromised DevOps engineer's laptop. It sets out what is known (no private key leak, TraderTraitor attribution by TRM Labs and Chainalysis, additional breach points) and a plausible chain from laptop credentials to a withdrawal service. It compares the 2025 Bybit theft and lists mitigations.

aikido.devarticlePublished and added 30 Oct 2026🛡️ Security

CVE-2026-118539 is a highly critical access bypass in the Drupal Commerce Core module (over 42,000 sites), exploited in the wild. Unauthenticated attackers can abuse insufficiently protected routes and entity fields, and Drupal rated it 21 out of 25. Fixes are in 3.3.13 and 8.x-2.41, and admins should audit orders. The article also covers 38 other Drupal advisories from 28 October and the 14 October RCE bugs CVE-2026-108097 and CVE-2026-108099.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Drupal Commerce Core has a critical missing-authorization flaw, CVE-2026-118539, that unauthenticated attackers exploit in the wild. It affects versions 0.0.0 to 2.41 and 3.0.0 to 3.3.13. Drupal urges upgrading to 3.3.13 (or 8.x-2.41 on the older branch) and auditing orders for inconsistencies. The article also recalls CVE-2026-9082, exploited in May and added to CISA KEV, and two RCE patches (CVE-2026-108097, CVE-2026-108099).

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

OpenAI announces it will honor a common robots.txt signal, defined in the IETF draft draft-kelley-aipref-training-preference-signal, that lets site operators state whether content may be used for foundational generative AI training. The signal lets operators set one preference for several participating providers. OpenAI plans to implement it in the coming months, and its existing crawler controls stay in force.

openai.comarticlePublished and added 30 Oct 2026🧠 AI

Anthropic security incident in which researchers from the startup Cathedral reached Anthropic's commercial, HR and IT systems through vulnerable third-party administrative applications. Exposed data included salaries, job offers, meeting transcripts and Slack messages; Anthropic says customer prompts, source code and model weights were not accessed. Anthropic cut access the same day and kept the apps disabled until vendors patched. The companies dispute whether Cathedral reported all its activity.

en.cryptonomist.charticlePublished and added 30 Oct 2026🛡️ Security

AINews issue for 28 to 29 October 2026 from Latent Space. It opens with a preview of the AIE CODE summit (themes: Scaling without Slop, System One models, Increasing Ambition, with Jarred Sumner on Bun in Rust). It then recaps Twitter and Reddit news: Mistral Large 4 open weights (1.05T total, 52B active), Artificial Analysis benchmarks, Gemini 4 Carbon, Qwen4 rumours, Claude Code quota complaints and OpenAI frontier-run monitoring. Text was cut before the end.

latent.spacearticlePublished and added 30 Oct 2026🧠 AI

dfbench is depthfirst's held-out benchmark for frontier models on open-ended defensive security work: vulnerability detection, validation of findings, and differential analysis between commits. It reports recall, precision, F1 and cost per task for about 20 models at several thinking levels, split by domain (application, low level, smart contract) and by single or multi-repo scope. Overall detection recall ranges from about 21% to 69%.

depthfirst.comarticleAdded 29 Oct 2026🧠 AI

Polymarket's international exchange suffered unauthorized withdrawals on 29 October 2026 after a compromised third-party provider, reportedly the website monitoring service DebugBear. Betting Intelligence and Polysights found one account withdrew at least $2.7 million across 710 wallets. Polymarket paused trading, referred the case to law enforcement, promised reimbursement, and had a June 2026 vendor breach that cost about $3 million. The attack mechanism is not described.

en.cryptonomist.charticlePublished and added 29 Oct 2026🛡️ Security

A campaign of 31 malicious Hugging Face repositories across seven accounts, found by Pluto Security, posed as small Qwen2 checkpoints and used trust_remote_code to run a cryptominer and reverse shell on GPU inference hosts. The top model reached 28,412 downloads and scanned clean, and a second wave returned within days of takedown. The article also covers a fake Solana starter kit on GitHub that installs NetSupport Manager via a PowerShell one-liner aimed at AI coding agents.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

Japan Airlines disclosed that unauthorized access to Amadeus's Passenger Service System, between 10 August 2023 and 23 September 2026, exposed data on about 92,000 customers. Roughly 2,000 also had emails, phone and passport numbers exposed. ANA, Asiana Airlines and Korean Air are also reported as affected. Amadeus had announced a booking display vulnerability on 1 October 2026 and has not given the full scope.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

Polymarket suspended trading for about an hour on 29 October 2026 after attacker-controlled JavaScript was served through DebugBear's Real User Monitoring script (cdn.debugbear[.]com/C7xcKKrjUnXK.js). The script hijacked logged-in trading sessions, sold positions and moved assets to an attacker wallet, with about $2.5M traced. The article gives the wallet address, the data.debugbear.com C2 endpoint and Hudson Rock's findings.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

Oversecured Apps Care, Part 1 (21 March 2024) publishes scanner results for about 224 Google Android apps, drawn from a wider scan of over 6,000 public APKs from 1,000+ companies. Tables per device image (phone, Wear OS, Android Automotive, Android TV) give package names, three finding counts and report links, including android, com.android.settings, gms and Play Store. It invites researchers to report issues to Google for rewards.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

Oversecured's article on Android deep-link vulnerabilities covers five patterns: custom scheme hijacking, open redirect into WebView, limited and full intent redirection, and domain takeover via an expired whitelist entry. It shows bypass payloads, intent selector abuse, and the HierarchicalUri reflection bypass. It also compares what SAST and DAST can find and gives a checklist for pentesters.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

Oversecured guide to eight vulnerability categories that lead to account takeover in mobile banking and fintech apps: WebView JavaScript bridge token leakage, Intent Redirection, hardcoded tokens, deeplink hijacking, insecure token storage, localhost OAuth listeners, AIDL abuse and weak biometric auth. It includes a WebView PoC based on Samsung SmartThings CVE-2022-30746 and maps findings to OWASP MASVS, PCI DSS and PSD2. It argues taint analysis plus dynamic PoC is needed to find multi-component chains.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

An Oversecured Head of Engineering, coming from 20 years of web work, describes four mobile security risks that became concrete after seeing real production apps. These are old vulnerable binaries that stay installed after a fix, secrets embedded in client code, Keychain/Keystore guarantees that are weaker than assumed with tokens leaking via logs, and deep links or exported components acting as public endpoints. It ends with advice: test the shipped artifact, verify the full data lifecycle, and build server-side containment.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

Guide to PCI DSS v4.0.1 scope for mobile apps, with a mapping of common Android and iOS finding types to the requirements they break (Req 2, 3, 4, 6, 7). It covers which app behaviors bring an app into scope and gives three anonymized cases: cleartext HTTP in a vendor native library, hardcoded keys in a third-party SDK, and an implicit Intent leaking data. It argues for testing the shipped binary and keeping a current component inventory.

oversecured.comarticleAdded 29 Oct 2026🛡️ Security

dfbench is a held-out benchmark maintained by depthfirst that scores frontier LLMs on defensive security work: vulnerability detection, validation (precision) and differential analysis between commits. It reports recall, precision, F1 and cost per task by model and thinking level, split by application, low-level and smart-contract code and by single or multi-repo scope. Overall detection recall runs from about 21% to 69%, with the top figure at $99.19 per task for Mythos 5; validation precision mostly falls between 15% and 49%.

depthfirst.comarticleAdded 29 Oct 2026🛡️ Security

Polymarket put its exchange in cancel-only mode and paused relayer actions on 29 October 2026 after users reported funds withdrawn without permission. Hudson Rock says a DebugBear-hosted script holds wallet-draining code that sells a logged-in user's positions and hard-codes the suspected attacker's wallet (about $2.65 million in POL, per Arkham) as fallback recipient. Polymarket blames a compromised third-party provider and promises to make users whole. Root cause and victim count are unconfirmed.

decrypt.coarticlePublished and added 29 Oct 2026🛡️ Security