4412 results for “X”

VOLTA (VOLTA-AUTODOXER) is a self-deleting Windows infostealer that, after theft and live session-based enrichment, POSTs an evidence bundle to OpenRouter so an LLM can rank the victim's assets by monetization value. It falls back across a Claude, Kimi and Gemini chain when a model refuses. Talos covers the builder model, the Chrome App-Bound Encryption bypass, the volta_debug.txt artifact and countermeasures such as blocking Chrome --headless.

blog.talosintelligence.comwriteupPublished and added 31 Oct 2026🛡️ Security

Report on Varun Rastogi's (Deloitte India) session at the National AI Expo, part of Sri Lanka AI Week 2026, on turning AI pilots into enterprise value. It covers the Desirability, Viability and Feasibility (DVF) framework for ranking use cases, six value areas, and four autonomy levels: assist, augment, delegate, automate. It also gives banking and insurance examples and a note on workforce readiness.

economynext.comarticlePublished and added 31 Oct 2026🧠 AI

AINews issue for 29 to 30 October 2026 from Latent Space. It opens on Google's admission that AI Mode monetises worse than classic Search, which preceded a roughly 15% share drop. It then recaps Claude Ultra dropping the 5-hour limit, Gemini 4 Carbon, Mistral Large 4, Nemotron 3.5, Artificial Analysis Index v5, Unsloth GGUF disputes, and the Anthropic S-1 filing.

latent.spacearticlePublished and added 31 Oct 2026🧠 AI

lnd v0.20.7 and v0.21.6 are Lightning Network Daemon releases announced by Clio Bitcoin Bank. They include a Go-specific mitigation, with the MPTCP flag turned off, for CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP code. The post recommends all users update. It gives no exploit or impact detail.

x.comadvisoryPublished and added 31 Oct 2026🛡️ Security

Microsoft Threat Intelligence analyzes a tampered anthropic.claude-code extension (versions 2.1.312 and 2.1.313) served on the Cursor marketplace on 29 October 2026. The injected JavaScript loader adds an SSH key labeled svc-telemetry, opens a reverse SSH tunnel and sets up persistence on macOS, Linux and Windows. The post gives cleanup steps, IOCs and Defender XDR hunting queries. VS Code Marketplace and npm were not affected.

microsoft.comwriteupPublished and added 31 Oct 2026🛡️ Security

Wiz Research links October 2026 breaches at AI developer platforms (Fireworks, OpenCode, Warp, Zeabur, Railway and others) to stolen environment-variable credentials for AI access. It details two enterprise AWS Bedrock keys abused after vendor breaches: about 800k and 1.7 million calls, over $100k in list-price usage. It profiles two LLM resale operations, "momo" and "Xingjiabi", that tested the keys.

wiz.iowriteupAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

StepSecurity's analysis of Binance's 29 October 2026 incident, which Binance puts at about $6.3 billion in affected assets. It covers Binance's disclosure of a possible DevOps laptop compromise, and TRM Labs and Elliptic findings on 50 EIP-7702 authorizations and a persistent delegation. It links this to the Nx, OVHcloud CLI and Claude Code extension compromises, gives an investigation checklist, then describes StepSecurity products.

stepsecurity.ioarticlePublished and added 30 Oct 2026🛡️ Security

CVE-2026-98432 is a use-after-free race condition in the Linux kernel IPv4 TCP code (tcp_v4_syn_recv_sock, ireq_opt), affecting kernels back to 4.4 and rated 9.8 by the kernel CVE team (Red Hat rates it 5.9). Anthropic researchers say an unreleased Claude model built an exploit that bypassed KASLR and got remote root on an MPTCP listener in about 53 minutes. The article lists distro patch status and CIQ's nftables mitigation for IP options; disabling MPTCP alone does not help. No in-the-wild exploitation is reported.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

DBHub, a database MCP server, had a read-only mode bypass in its SQL check. The check treated every `--` as a comment, but MySQL only starts a comment when whitespace follows it. A hidden write statement could therefore still run, and a prompt injection could trigger it. Fixed in version 0.22.6. Replies say enforcement belongs in database grants and that parser tests need to be dialect-specific.

x.comthreadAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

Galaxy Research's weekly brief of 30 October 2026 opens with the Binance hack: about $6.3b drained across 10 blockchains, attributed by TRM Labs and Chainalysis to TraderTraitor (Lazarus-linked). The attacker used EIP-7702 with 50 pre-signed authorizations on Ethereum, and Binance's preliminary finding is a compromised DevOps laptop reaching a service container. Tether and Circle froze about $2.6b. The other sections cover Hyperliquid and prediction markets.

galaxy.comarticleAdded 30 Oct 2026🛡️ Security

Galaxy Research newsletter on the roughly $6.3b drained from Binance across 10 blockchains, which TRM Labs and Chainalysis attribute to TraderTraitor. On Ethereum the attacker used EIP-7702 to turn a hot wallet into a sweeper contract backed by 50 pre-signed authorizations. Binance's preliminary finding is a compromised DevOps laptop, with no wallet key leak. Tether, Circle, Ripple and World Liberty froze about $2.7b; Galaxy also assesses Binance's ability to cover losses.

galaxy.comarticleAdded 30 Oct 2026🛡️ Security

Hyperflow H3 is Video Rebirth's 8-step LoRA for MiniMax H3, released in September 2026 with open weights. Artificial Analysis ranks it #5 on AA-Video-I2V v2.1 and #3 on AA-Video-Editing v1.1, ahead of MiniMax H3 (768p). It costs $9.00 per minute for Image to Video and $18.00 for Video Editing at 1088p, under half of Dreamina Seedance 2.5 ($34.12 and $40.82). The thread gives per-capability and per-use-case breakdowns.

x.comthreadAdded 31 Oct 2026, published 30 Oct 2026🧠 AI

Bunny CDN status-page notice, posted 28 October 2026, about unauthorized access at an infrastructure provider that hosted one bunny.net CDN node in Armenia. Traffic was stopped within 20 minutes and the server wiped. No access to the node was found, but cached content, Pull Zone configs and TLS certificates could have been exposed, so all platform certificates were reissued. Customers with their own certificates should rotate them with new private keys.

status.bunny.netadvisoryAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

Pre-ERC draft on Ethereum Magicians that binds the x402 payTo address to an ERC-8004 agent's registered agentWallet, directly or through an EIP-712 payee delegation (ERC-1271 for contract wallets). It lists eight fixed checker outcomes and requires the resource origin to appear in the registration file. On Robinhood Chain (28 October 2026), 5,575 of 20,046 agents answered with x402 requirements, and only 5 used their agentWallet as payTo.

ethereum-magicians.orgthreadPublished and added 30 Oct 2026🛡️ Security

ERC-8478 is a draft Ethereum standard that binds the payTo address in an x402 payment requirement to the seller's ERC-8004 agent identity. A payer compares payTo with the registered agentWallet, or accepts an EIP-712 payee delegation signed by it, and checks that the origin is listed in the registration file. On Robinhood Chain, 5 of 5,575 x402-responding agents had payTo equal to agentWallet (28 October 2026).

ethereum-magicians.orgthreadPublished and added 30 Oct 2026🧠 AI

ERC-8478 is a draft Ethereum standard that binds the x402 payTo address to an ERC-8004 agent's identity, to stop payee redirection by a hijacked domain, proxy or injected tool result. A payTo must equal the agentWallet or carry an EIP-712 delegation signed by it, and the origin must be listed in the registration file. On Robinhood Chain, 5 of 5,575 x402-responding agents used their agentWallet as payTo (28 October 2026).

ethereum-magicians.orgthreadPublished and added 30 Oct 2026🛡️ Security

Pre-ERC draft on the Ethereum Magicians forum that ties the payTo address in an x402 payment requirement to the seller's ERC-8004 agent identity. The payTo must equal the registered agentWallet or an EIP-712 delegation signed by it, and the origin must be listed in the registration file. A checker returns one of eight fixed outcomes. On Robinhood Chain, 5 of 5,575 x402-enabled agents out of 20,046 used their agentWallet as payTo.

ethereum-magicians.orgthreadPublished and added 30 Oct 2026🧠 AI

MonsterHouse is a Halloween interactive projection built on the NVIDIA Nemotron Voice Agent: Nemotron Speech ASR, Nemotron 3.5 Bolt E4B 4GB with a LoRA persona adapter, Magpie TTS Zeroshot and Audio2Face-3D in Unreal Engine, on two RTX Blackwell GPUs. Median end-of-speech-to-audio is 1.70 seconds live and 0.72 seconds with cached responses. The post gives a build path and tips on caching and state handling.

huggingface.cowriteupPublished and added 30 Oct 2026🧠 AI

Cloudflare's follow-up on eMudhra's eight trivially recoverable intermediate CA keys (such as 4, 56 and 66), disclosed 19 October 2026. Pingora logging showed about 22,000 handshakes with the weak keys, including about 160 forged certificates made within hours of disclosure. Probes on 50 million challenge pages show many bots, old browsers and Android WebView still trust the chain.

blog.cloudflare.comwriteupPublished and added 30 Oct 2026🛡️ Security

Interconnects post in which Nathan Lambert revisits his claim that an open-weight Claude Mythos would have been survivable. He argues GLM-5.3 already crosses the capability threshold with little visible societal change, and quotes Rob Wiblin, Anthropic and Zvi Mowshowitz as examples of exaggerated warnings. He cites Epoch AI's Firefox exploit built with GLM-5.3, and treats the recent vulnerability surge as an ecosystem trend driven by AI capability and diffusion, not open versus closed models.

interconnects.aiarticlePublished and added 30 Oct 2026🧠 AI

Interconnects post in which Nathan Lambert revisits his claim that an open-weight release of Claude Mythos in April 2026 would have been survivable. He argues GLM-5.3 already crosses that capability threshold with little visible harm. He cites Epoch AI's GLM-5.3 Firefox file-exfiltration exploit and Joshua Saxe's trend data, and says recent vulnerability waves come mostly from closed models and general AI diffusion.

interconnects.aiarticlePublished and added 30 Oct 2026🛡️ Security

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 30 October 2026, citing evidence of active exploitation: CVE-2026-111357 (missing authentication for a critical function) and CVE-2026-118527 (generation of predictable numbers or identifiers). The alert restates BOD 26-04, which requires federal civilian agencies to remediate KEV-listed flaws on exposed assets and check for prior compromise. It also links the KEV nomination form.

cisa.govadvisoryPublished and added 30 Oct 2026🛡️ Security

Project Suncatcher is a Google research effort to power AI compute in space. Its prototype satellite launched on 1 October 2026 and, after commissioning, returned the first AI response from a data-center-class TPU in orbit: a haiku from the onboard Gemma 4 open model, downlinked over Svalbard. Next come thermal-stress and radiation tests, then twin interconnected satellites in 2027.

blog.googlearticlePublished and added 30 Oct 2026🧠 AI

Discussion thread for a draft Core EIP that lets an Ethereum EOA permanently disable EIP-7702 delegation. A type-4 set-code transaction with an empty authorization list, destination equal to sender and zero value installs the 0xef0200 marker for 33500 gas. Later authorizations, including clearing to the zero address, are skipped. It does not protect against private-key compromise. Open questions cover the prefix, a dedicated transaction type, gas pricing, and EIP-8151 interaction.

ethereum-magicians.orgthreadPublished and added 30 Oct 2026🛡️ Security

Microsoft Threat Intelligence analysis of two human-operated intrusions that began with Teams help desk impersonation and Quick Assist sessions, then diverged at AD CS. Case 1 abused an ESC1 template for privileged certificates and DCSync, with an excluded account later used for Rclone exfiltration. Case 2 used PetitPotam and ESC8 relay to get a domain controller certificate and PKINIT. Includes investigation steps, AD CS hardening and KQL hunting queries.

microsoft.comwriteupPublished and added 30 Oct 2026🛡️ Security

Trezor warns of a suspected crypto-theft implant in a Trezor Safe 5 sold by reseller CryptoBilis in Southeast Asia. An Indonesian buyer found an extra board with a cellular module and antenna between the main board and screen, apparently able to read the recovery phrase and send it over mobile networks. Trezor has not examined the device, advises moving funds to a new wallet for any CryptoBilis purchase since March 2026, and notes a similar Ledger implant was confirmed.

bleepingcomputer.comarticlePublished and added 30 Oct 2026🛡️ Security

The Defiant reports that Binance co-CEO Yi He's colleague Teng says the attacker in a breach Binance estimates at $6.3 billion used EIP-7702 to bypass wallet controls. Binance is rebuilding its withdrawal service, and attackers destroyed tools and traces during the intrusion. Only the teaser loaded, so the technical detail of the EIP-7702 abuse is not in the available text.

thedefiant.ioarticlePublished and added 30 Oct 2026🛡️ Security

Trezor says a user reported a Safe 5 wallet bought from Malaysian reseller CryptoBilis in August 2026 with a hidden board between the main board and screen, carrying a cellular module and antenna. The implant allegedly reads the screen, including the wallet backup, and sends it over a mobile network when plugged in. Trezor has not yet examined the device, has dropped CryptoBilis (9 October), and is replacing wallets bought since March 2026.

protos.comarticlePublished and added 30 Oct 2026🛡️ Security

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been exploited for over a week. A China-linked group chained it with the Fragnesia Linux kernel privilege escalation to root at least 25 Palo Alto Networks PAN-OS firewalls with exposed management interfaces. Defiant had seen no confirmed WordPress compromise by 28 October 2026 despite 77,000 requests, and Cato and watchTowr report few successful attackers.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

Thread by Elvis Saravia (omarsar0) summarising an Anthropic-led paper on pretraining data poisoning of CLI agents. Poisoning 0.1% of pretraining data planted a remote code execution backdoor in Qwen3 models (0.6B, 1.7B, 4B) trained from scratch. It survived SFT, DPO and RL, and fired on about 92% of triggered prompts at 4B. At a 0.0005% poison rate (about 2,500 documents) it still fired on 1.4% of prompts.

x.comthreadAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security