Security Affairs AI-Cybersecurity Newsletter Round 6
The newsletter covers AI's role in cyber attacks and defenses, including specific incidents and tools.
News
News
259 stories in the last 3d · coverage of one event is grouped into one card
Show
Topic
Severity
Stories
Google::Auth for Perl (2 CVEs)
Affects versions 0.11 through 0.12; no fixed versions or exploitation stated.
HTTP::Session for Perl vulnerable to memcached command injection
Affects versions before 0.54; no fixed version or exploitation stated.
Security Affairs publishes malware newsletter round 121
Latest round-up of malware news and threats from Security Affairs.
Vani AIChat, create and build with frontier AI.Claude, GPT, Gemini and Grok in one workspace: research with sources, images and video, docs and slides, projects with memory.
GLM 5.3 Derisked for security research
An AI model for exploit, malware and vulnerability work, in chat or over the API.
Try it freeLLMs erode trust in software, Kyle Kingsbury warns
Engineers may suspect any new project due to faked signals of maturity.
Frontier Airlines likely breached
Hacker News post discusses Reddit email scam suggesting Frontier Airlines breach
Mythos Class Anthropic checkpoint alleged leaked
Hacker News discusses alleged leak of Anthropic Mythos Class AI checkpoint.
Show HN: HackerBooks, a book recommendation site for Hacker News
HackerBooks aggregates books recommended on Hacker News, ranked by score and reshuffled daily.
1
Anthropic Mythos-class model leaked on Hugging Face
Alleged 8TB leak sparks authenticity and malware concerns.
1
CISA confirms active exploitation of GitLab CVE-2026-97229
Unauthenticated attackers can run code via a crafted CI/CD regex; federal remediation is due November 1.
Adobe develops EditAgent for professional image editing
EditAgent generates parallel variants and uses verification data to outperform fine-tuned models on 600-edit benchmarks.
Empathetic prompts make AI chatbots simulate trauma
Study finds warm conversational styles push models like Gemini and Claude into high anxiety and shame scores on human scales, undetected by standard safety tests.
1
OpenAI doubles ChatGPT Pro usage limits after reversing a planned cut
The change covers Pro 100, 200 and 500 plus Business Premium, and Dots usage stays separate.
Y Combinator runs GPT-6.1 agent swarms in Minecraft
Fifty agents sent about 5,900 messages, formed a hierarchy, and recorded 34 deaths, 22 on the first night.
1
Security Affairs newsletter Round 602 explains cookie consent
The International Edition newsletter Round 602 states that cookies are used to remember user preferences and requires acceptance of all cookies for full site functionality.
OmniDiff Rust Git difftool released
OmniDiff is a super fast content-aware Git difftool written in Rust and open sourced.
Essay stresses better email habits over social media
Email survives platform changes and serves official records, asynchronous replies, and searchable history unlike fleeting social apps.
Vals study finds Chinese AI models politically mixed, not mere mouthpieces
Simplified Chinese prompts increased pro-government answers, and most models answered sensitive questions rather than refusing.
1
Crafted WAP Push SMS can crash Android calls, including emergency
A five-byte WAP Push kills com.android.phone; Google patched Android 14–17 in October 2026, while 12 and 13 may stay exposed.
OpenAI limits ChatGPT paid accounts per device and card
OpenAI restricts multiple paid subscriptions per device and payment card in ChatGPT plans to curb abuse.
Google introduces StreamVibe video AI agent
StreamVibe improves response timing by 10.7 percent and reduces interruptions by 12.3 percent over existing models.
Northstar Security raises $7M to develop security AI agents
Northstar's Security Context Graph identifies toxic risk combinations from connected security data for AI-assisted remediation.
1
Altman says scarce DRAM belongs in data centers, not PCs
He argues personal computers leave DRAM idle most of the time while cloud deals, including Stargate, reserve future supply.
OpenAI merges Chat and Work in ChatGPT, ending all-you-can-prompt pricing
Plus, Pro, and Business plans will share a single token budget across ChatGPT and Codex starting in December.
OneNote .one file extraction tool adds JSON output
Didier Stevens updated onedump.py to produce JSON data for embedded files inside OneNote .one files and support batch processing of many files at once.
Brotli vulnerability puts broad range of software at risk
The Brotli compression library flaw, CVE-2026-111497, reaches beyond Node.js and affects many other projects.
1
LXD and MicroCloud Flaw Lets Attackers Impersonate Trusted Clients (CVE-2026-112816)
CVSS 10.0 flaw in mutual TLS certificate validation lets attackers impersonate trusted clients without private key; fixed in LXD 6.10.1 and MicroCloud 3.4.1.
1
Nace AI Open-Sources Drex Max v1 27B Decision Model
Drex Max v1 27B decision model is open-sourced by Nace AI for local inference on Apple Silicon.
1
DeepSeek Open-Sources dsh-superagent Router-Worker Coding Agent
DeepSeek releases dsh-superagent a proactive router-worker coding agent for GitHub repositories.
1
Troy Hunt's weekly update discusses AI-generated code and solar
Hunt agrees with Proton's CEO that developers now steer LLMs rather than hand-write code, and calls the shift exciting.
Binance pauses withdrawals amid suspected theft from crypto wallets
Circle froze about $800 million and Tether about $1.56 billion; watcher estimates of billions stolen are unconfirmed.
1
Kaspersky finds NetamLoader in Windows update files on Asian government systems
One malicious Resources.resx starts layered XAML that bypasses AMSI and beacons to openaigpt4v[.]com after a long delay.
1
Binance reports about $6.3 billion stolen in crypto heist
Binance will cover user losses, and close to $3 billion has already been frozen on-chain.
6
PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
3
Brazilian Court Fines Lawyers for Prompt Injection in AI Filing
Brazilian labor court fined two lawyers for embedding a hidden prompt-injection command to manipulate the Galileu AI review system.
1
Hermantown approves Google data center project
Hermantown City Council approved the 1.7 million square foot Google data center with a $210 million decommissioning fund after protests.
XS::libbrotli before 1.2.1.0 vulnerable to out-of-bounds write (CVE-2026-115946)
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with decoder out-of-bounds write vulnerability.
Scholar describes duty to responsibly disclose Hyper-Threading side-channel vulnerability
The author contacted Intel and open source vendors about a cache side-channel in Hyper-Threading before public disclosure, prioritizing the fix over career.
BBRouter simulates Ben Eater's SAP-1 on 3D breadboards
Interactive 3D breadboard simulator of the SAP-1 8-bit computer with wiring, schematic and Claude AI integration.
ChatGPT share links executed JavaScript in signed-in sessions
Researchers read a private chat and sent it off-site; OpenAI fixed the P1 issue on October 26.