ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “werror”

31 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAll
SeverityAllcritical 0high 0medium 0low 0info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Re: Retrospective by 'gpg.fail' authors

Sam James replies to GnuPG author Werner Koch that upstream may freely adopt stricter -W compiler warnings, while distros should avoid blanket -Werror.

This is an oss-security mailing list reply by Sam James (Gentoo toolchain maintainer) to Werner Koch in the thread on the 'gpg.fail' authors' retrospective about GnuPG. James states that upstream projects like GnuPG should feel free to enable whatever -W* warning flags they need. He adds that distributions should not use -Werror indiscriminately, allowing narrow exceptions such as -Werror=format-security, and may reject warning-driven bugs that do not reflect real issues. No new CVE or vulnerability details are disclosed in this reply.

oss-securityupdated · 3h agofirst · 1d agoVulnerability 9 sources

Building a Production Greek-English Speech Recognizer

Engineering report details Sophea, a production Greek-English ASR reaching 4.26% WER on public English sets via ROVER ensemble and data-pipeline calibration.

Across 23 training iterations, two architectures, and nine production gates, no single data composition passed all gates; a three-model ROVER ensemble reached 9 of 9 gates and cut overlapping-speech WER from 53.35% to 37.87%. Calibrating an audio-quality filter against in-domain anchors reduced discarded scored Greek audio from 98.7% to 10.6%, and a pre-registered ablation traced a hallucination defect to one training-data package. The sophea/asr-k1 preview arbiter lists 4.26% average WER on eight public English test sets and 25.88% WER on live Greek noisy traffic; no weights or training data are released.

Hugging Face daily papers · 6d agoAI research

EITest Campaign Evolution: From Angler EK to Neutrino and Rig

Unit 42 details the EITest campaign's shift from Angler to Neutrino and Rig exploit kits while distributing ransomware, downloaders, and banking trojans.

Unit 42 updated its tracking of the EITest campaign, first identified in October 2014, which compromises websites with injected scripts that redirect victims through a gate to exploit kits. After Angler EK disappeared in June 2016, EITest switched to Neutrino and then primarily used Rig EK by August 2016. In September 2016 the campaign began using hex-obfuscated JavaScript and simplified gate URLs, while continuing to distribute payloads including Gootkit, Cerber, Bart, CryptFile2, Vawtrak, Ursnif, and Tinba. Gate infrastructure consistently reused IP blocks such as 85.93.0.0/24 even as domain names changed.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild

Understanding Angler Exploit Kit

Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.

Unit 42 published the second part of its Angler EK analysis, covering the kit's history since 2013, its SaaS rental model, and its focus on Flash, Internet Explorer, and Silverlight exploits. Angler integrated the CVE-2015-5119 Flash zero-day from the Hacking Team leak within hours and later added exploits for CVE-2015-2419 and CVE-2016-0034 roughly a month after Microsoft patched them. Campaigns use Angler to deliver ransomware such as CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest. Since August 2014, Angler has used fileless, in-memory execution, most often for Bedep, which later downloads CryptXXX and click-fraud malware.

Palo Alto Unit 42 · Aug 17, 2026Research in the wildCVE-2015-5119CVE-2015-2419CVE-2016-0034

New Python-Based Payload MechaFlounder Used by Chafer

Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.

Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.

Palo Alto Unit 42 · Aug 17, 2026Threat actor

Quoting Calif Research

Calif Research demos WeWorm, an AI-built zero-click worm that spreads via WeChat calls on iOS and Android without user interaction.

Calif Research released a demo of WeWorm, described as the first zero-click worm to spread through WeChat calls across iOS and Android; victims need not answer the call and hear nothing even if they do. The team used AI to find the underlying bug and write a remote code execution exploit in about two days, then spent one more week building the worm. The researchers argue AI can now do most of the exploit-development work, with humans supplying judgment on targeting and safe testing.

Simon Willison · 7d agoAI safety & security

Trezor warns users of email provider breach, phishing attacks

Trezor says attackers breached its third-party email provider and are phishing customers with fake STM32 entropy vulnerability alerts.

Trezor warned customers that threat actors breached its third-party email provider and sent fake 'Critical Security Alert: STM32 Entropy Vulnerability' emails from [email protected], claiming wallet seeds were exposed to brute-force attacks; the phishing domain has been taken down while Trezor investigates. This follows the ShipMonk breach, revised upward from about 14,000 to 81,000 customers (including 67,000 additional US customers) who received orders between May 10 and August 8, 2026. Attackers reportedly exploited a Metabase SQL injection zero-day to access ShipMonk data, and ShinyHunters sent extortion emails.

BleepingComputerupdated · 5d agofirst · 6d agoData breach in the wild 5 sources

Knowledgator Releases GLiFormer: A 575M-Parameter Encoder That Hits 91.10 F1 on Nested JSON Extraction Without Generating Tokens

Knowledgator released GLiFormer, an Apache-2.0 encoder (264M/575M) handling NER, classification, relations, and nested JSON extraction, scoring 91.10 F1.

Knowledgator Engineering released GLiFormer, a schema-conditioned encoder that performs NER, classification, relation extraction, nested JSON structuring, and embeddings without generating output tokens. GLiFormer Large v1 has 575.6M parameters and scores 91.10 F1 on nested JSON extraction, close to GPT-5.6-luna's 91.96; both checkpoints are Apache 2.0 on Hugging Face. Reported median latency is 69 ms on GPU for the base model, though relation extraction (21.33 micro-F1) still trails GLiNER-Relex and larger LLMs.

MarkTechPost · 9h agoModel release

Tricky 'SynkLoader' Multitool May Herald Ransomware

Researchers detail SynkLoader, an advanced multilingual multitool that hijacks screens to steal passwords and may precede ransomware attacks.

Dark Reading reports analysis of SynkLoader, an advanced, multilingual malware family functioning as a multitool loader. The family revives an older technique — screen hijacking — to enable effective password theft, alongside several novel features. Analysts assess its activity may be a precursor to ransomware deployments, making early detection valuable for defenders.

Dark Reading · 23d agoMalware

GentleKiller targets more than 400 security processes across 48 products

ESET details the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework targeting over 400 security processes across 48 products, supplied to affiliates.

ESET analyzed the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework, confirmed through an internal data leak from May 2026. The framework has at least eight variants impersonating legitimate security products and abusing vulnerable or malicious kernel drivers, targeting more than 400 process names across 48 security products. Gentlemen emerged in late 2025, became one of the five most active ransomware gangs in Q1 2026, offers affiliates a 90% ransom share, and practices double extortion using Go-based and C-based ESXi encryptors. The suite also reuses outside tools including HexKiller, ThrottleBlood, and HavocKiller, unified by a shared evasion layer that mimics well-known security vendors.

Help Net Security · 24d agoRansomware in the wild

12 Best Ransomware Protection Solutions Compared (2026): Features & Pricing

GBHackers compares 12 ransomware protection solutions for 2026, recommending layered stacks of EDR prevention, managed detection, containment, and guaranteed recovery.

The editorial comparison argues no single product stops ransomware, recommending a layered strategy across prevention, early detection, blast-radius containment, and clean recovery. CrowdStrike and SentinelOne are named best-in-class EDR, Huntress and Sophos MDR for managed 24/7 coverage, ColorTokens for microsegmentation containment, and Rubrik and Acronis for guaranteed recovery. The guide notes ransomware is now professionalized with double extortion and encryption sprints measured in minutes.

GBHackersupdated · 20h agofirst · 5d agoIndustry 14 sources1

A Princeton Researcher Proposes Recurrent Looped Transformer (RLT) that Carries Decoder State across Every Token, Fixing 96 Blocks per Token with Unbounded Temporal Depth

Princeton researcher Yifan Zhang proposes Recurrent Looped Transformer, carrying full decoder state across every token for unbounded temporal depth.

Yifan Zhang's technical report defines the Recurrent Looped Transformer (RLT), pairing a causal encoder with a recurrent decoder whose final output and layerwise sliding-window attention cache carry into every subsequent token with no prompt-response boundary reset. The reference configuration ties 48 encoder and 48 decoder layers, executing 96 logical blocks per token while the state path grows to 48t blocks after t tokens at fixed per-token compute. The report details RL replay contracts that rebuild all states under current parameters and exact prefix snapshots for multi-turn serving, but explicitly reports no measured efficiency, reasoning quality, or scaling results.

MarkTechPost · 3d agoAI research1

Trezor customers hit with phishing calls and letters after shipping-partner breach

A breach at shipping partner ShipMonk exposed data for about 67,000 additional US Trezor customers, who now face phishing calls and QR scam letters.

SatoshiLabs, maker of Trezor hardware wallets, confirmed the August 2026 ShipMonk breach exposed names, emails, phone numbers, and shipping addresses for roughly 67,000 US customers who ordered between November 2019 and August 2021, on top of 3,889 customers affected initially. ShipMonk attributed the intrusion to attackers exploiting an SQLi zero-day in Metabase's Cloud SaaS platform and retained data past the 90-day deletion requirement. Trezor's own systems were not compromised; customers are reporting phishing calls and QR-code phishing delivered via physical letters.

Help Net Security · 8d agoData breach

Trezor Says ShipMonk Breach Exposed 67,000 U.S. Customers' Data It Said Was Deleted

Trezor disclosed the ShipMonk breach exposed data of 67,000 additional US customers, reportedly by ShinyHunters exploiting a Metabase zero-day SQL injection, CVE-2026-72898.

Trezor disclosed that a breach at shipping provider ShipMonk exposed names, email addresses, phone numbers, shipping addresses, and order numbers of 67,000 additional US customers, with orders dating November 2019 to August 2021 despite written assurances the data had been deleted. This adds to the 13,689 customers previously disclosed after ShipMonk informed Trezor of unauthorized access on August 10, 2026. According to Holborn, the ShinyHunters extortion gang is behind the breach, which began with zero-day exploitation of CVE-2026-72898 (CVSS 10.0), a critical SQL injection flaw in Metaboobase analytics software Metabase. Trezor says hardware wallet security is unaffected but warns customers to watch for phishing and social engineering; ShipMonk has not publicly acknowledged the incident.

The Hacker News · 11d agoData breach in the wildCVE-2026-72898

Tracking OceanLotus’ new Downloader, KerrDown

Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.

Unit 42 tracks KerrDown, a previously undocumented downloader family used by OceanLotus (APT32) since at least early 2018, primarily targeting Vietnam or Vietnamese-speaking individuals. Delivery uses macro-laced Microsoft Office documents embedding base64-encoded 32-bit and 64-bit DLLs, and RAR archives containing a legitimate program abused for DLL side-loading. KerrDown is dropped as main_background.png, downloads a DES-encrypted payload from a URL, and executes it directly in memory. Researchers used Jaccard-index similarity analysis to identify the new family, connect campaign samples, and infer patterns in the group's working hours and days.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wild1

TokenRhythm/NeoHorse-1-4B — new model trending #30 on Hugging Face

TokenRhythm releases NeoHorse-1-4B, an Apache-2.0 agentic fine-tune of Qwen3.5-4B claiming +5.93 benchmark macro-average gain.

NeoHorse-1-4B is a roughly 4B-parameter text-only causal language model post-trained by TokenRhythm from Qwen/Qwen3.5-4B for agent harnesses, tool use, coding, and instruction following. It applies routing-guided curriculum SFT and routing-guided on-policy distillation over execution trajectories as an early prototype toward recursive self-improvement (RSI). The release reports a 64.87 macro average across ten benchmarks versus 58.94 for Qwen3.5-4B (+5.93) and is distributed under Apache-2.0, trending #30 on Hugging Face.

Hugging Face trending models · 11d agoModel release1

WeWorm – First 0-Click Worm Spreading Through WeChat Calls Across iOS and Android

Researchers demonstrated WeWorm, a zero-click worm exploiting a memory-corruption flaw in WeChat's VoIP stack to spread via calls across iOS and Android.

Security firm Calif published WeWorm, a proof-of-concept zero-click worm exploiting a memory-corruption bug in WeChat's VoIP stack to spread through voice calls on iOS and Android without the victim answering. The demo chained a Pixel 10a, an iPhone 17e, and a second Pixel 10a, compromising each device while the call was still ringing and giving full control of the WeChat account. The attacker must already be on the victim's friend list, but compromised contacts become the propagation layer across a platform with over 1.4 billion monthly users. Calif reported the bug to Tencent in July 2026, and Tencent has since mitigated it; full technical details are withheld for a later conference presentation.

Cyber Security News · 8d agoExploit / PoC

Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls

Calif researchers built WeWorm, a zero-click worm exploiting a WeChat VoIP memory-corruption RCE that Tencent has now patched.

Calif researchers found a memory corruption flaw in WeChat's VoIP stack in July using LLM-assisted analysis and built working exploits within two days, then integrated them into WeWorm, which they call the first zero-click worm spreading through WeChat calls on iOS and Android. A crafted incoming call yields remote code execution with no user interaction, giving full control of the victim's WeChat account; the attacker only needs to be on the victim's friend list, easily achieved by compromising a contact first. Tencent confirmed the bug and shipped patches in WeChat Android 8.0.77 and iOS 8.0.76, and chaining with other OS bugs could yield full device control.

Infosecurity Magazine · 7d agoExploit / PoC

Researchers Uncover 10,000+ Malware Loaders Behind YouTube and SEO Poisoning Campaign

Unit 42 uncovers CL-CRI-1171, a two-year pay-per-install campaign distributing 10,000+ OfferLoader samples via YouTube and SEO poisoning.

Palo Alto Networks Unit 42 tracked a campaign as CL-CRI-1171, an infection-as-a-service platform operating for at least two years. It used 11 YouTube gaming channels with hundreds of thousands of subscribers and SEO-poisoned download pages for trojanized WinDirStat and Bluetooth driver installers to distribute OfferLoader, a disposable loader embedded in Inno Setup installers. Payloads delivered included Insomnia RAT (Node.js and Python backdoors), ARKTunnel (a WebSocket-based RAT using LSB steganography), and Docro Hijacker (Chrome browser hijacker), with later infections delivering GCleaner and Socks5Systemz. Over 200 rotating domains across .xyz, .cfd, .space, and .info TLDs were used, with gating filters that served broken links or decoy pages to scanners and researchers.

GBHackers · 5d agoMalware in the wild2

Climate-ModernBERT: Revisiting Corpus Composition for Domain-Adaptive Continued Pretraining

Climate-ModernBERT domain-adapted encoders reach 76.3 average F1 across nine climate benchmarks, 2.8 points above vanilla ModernBERT-Base.

The authors continue pretraining ModernBERT-Base on three climate corpora - academic text, climate-filtered web data, and synthetic documents - and compare joint mixtures against parameter-space merging of specialized checkpoints. The best model achieves 76.3 average F1 across nine climate NLP benchmarks, a 2.8-point improvement over the vanilla baseline. Academic climate corpora provide the strongest adaptation signal, and parameter-space merging outperforms joint multi-source training while preserving complementary corpus information; all variants are released.

arXiv cs.AI / cs.LG / cs.CL · 9d agoAI research

WeChat worm could pwn a friend before they even answered the call

Calif researchers demoed WeWorm, a zero-click WeChat VoIP memory-corruption worm enabling account takeover; Tencent patched it August 21.

Security firm Calif found a memory corruption bug in WeChat's VoIP stack that let a trusted contact take over a user's account simply by calling them, without the call being answered. The demo worm then called the victim's contacts to self-propagate across iOS and Android; declining the call prevented infection. Tencent pushed fixes on August 21, and Calif said chaining the bug with other Android and iOS flaws could yield full device control. Calif used AI to find the vulnerability and build its first RCE exploit in about two days.

The Register · Security · 7d agoExploit / PoC

NCP-ArchPreview Technical Report: Moving towards Latent Space Language Models through Next Concept Prediction

An 8.9B-parameter latent-space language model using next-concept prediction matches OLMo-3-7B pretraining loss with only 51.3% of the training tokens.

NCP-ArchPreview augments next-token prediction with Next Concept Prediction over a product-quantized concept vocabulary built from hidden states, trained jointly end-to-end. The 8.9B model was trained on 5.73T tokens from the Dolma-3 dataset, the largest latent-space language model demonstration to date. It consumes 51.3% of the tokens to reach OLMo-3-7B's final pretraining loss and outperforms it by 2.45 points on the downstream macro-average, including a 5.99-point GSM8K gain. The learned latent space also enables lightweight domain adaptation via a 17M-parameter VQ module and improves speculative drafting accepted length by 4.17%.

Hugging Face daily papers · 8d agoAI research1

How the EITest Campaign's Path to Angler EK Evolved Over Time

Unit 42 documents how the EITest campaign's gate URLs and infrastructure evolved since 2014 while still routing victims to Angler EK and diverse malware.

Unit 42 traced network traffic changes in the EITest campaign, which Malwarebytes identified in October 2014 across thousands of compromised websites. The campaign's injected script patterns have remained consistent, but its gate URLs changed repeatedly, and since January 2016 gates used the 85.93.0.0/24 IP block, often with .tk domains. The gate returns a Flash file that redirects victims to Angler EK, which delivered malware including Vawtrak, Tinba, TeslaCrypt, Bedep, Kovter, Ursnif, and Zeus variants from 2014 through 2016.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild

Google Research Introduces Retrieve-for-Train (R4T): An RL-Compiled Diffusion Retriever for 12× to 20× Faster Query Fan-Outnew

Google Research introduced R4T, an RL-trained fan-out pipeline distilled into a 53.9M-parameter diffusion retriever achieving 12x-20x faster query fan-out.

Google Research introduced Retrieve-for-Train (R4T), which trains a fan-out language model with GRPO plus soft PPO regularization, then distills query fan-out into a 53.9M-parameter diffusion transformer that generates all retrieval embeddings in a single non-autoregressive pass. A three-term reward (groundedness 0.6, diversity 0.2 via Vendi Score, alignment 0.2) prevents paraphrastic collapse and reward hacking during training. On the Polyvore dataset, Gemma3-4B R4T-FOLM averaged 49.1 versus 40.9 for Best-of-N, and the diffusion retriever cut fan-out latency from 1.46s to 0.07s at batch size 8, a consistent 12x-20x speedup over autoregressive methods.

MarkTechPost · 14m agoAI research

Google Open-Sources Mantis: A Modular Skills Toolkit That Lets Coding Agents Find, Reproduce and Patch Vulnerabilities

Google open-sourced Mantis, an Apache-2.0 modular skills toolkit that lets AI coding agents find, reproduce, and patch vulnerabilities with sandboxed verification.

Google released Mantis on GitHub under Apache 2.0 as a stack-agnostic set of slash-command skills that chain through the full vulnerability lifecycle: mining version history, building threat models, filtering findings, reproducing bugs in gVisor or network-disabled VMs, assembling exploit chains, patching, and scoring residual risk from 1 to 10. It runs with Gemini CLI, Antigravity CLI, the Google ADK, or comparable agent frameworks, and a supervisor skill (/mantis-meta-agent) can drive the whole loop. Google says the design targets the sub-7 percent true-positive rate of naive AI code scanning, and that its hierarchical summary tree cuts token overhead by over 85 percent. The toolkit is deployable for local and internal evaluation but not yet recommended for production.

MarkTechPost · 7d agoAI tools & infra

Technical Manual for a Toolkit for Measuring Contextual Individuation in Transformer Language Models

An open methodology toolkit measures whether transformer language models contextualize fixed word forms across domains using bridge forms and layer-wise silhouette analysis.

The manual documents an open toolkit built around 'bridge forms' - identical written words recurring across two or more subject domains with a different sense in each - to test whether transformer language models individuate word occurrences by context beyond the embedding layer. It covers declarative specification of bridge forms, Wikipedia corpus acquisition, occurrence localization, layer-wise representation extraction, domain-pairwise silhouette measurement, and visualization, justifying each choice against failure modes such as sense contamination and subword-tokenization misalignment. It is a methodological and implementation reference and reports no empirical results.

arXiv cs.AI / cs.LG / cs.CL · 12d agoAI research

Exploring the Latest Mispadu Stealer Variant

Unit 42 found a new Mispadu infostealer variant targeting Mexican users via malicious .url files exploiting the SmartScreen CVE-2023-36025 bypass.

Unit 42 discovered a new variant of Mispadu Stealer, a Delphi-based banking trojan first reported in 2019, found while hunting for the Windows SmartScreen bypass CVE-2023-36025. The campaign uses crafted .url files referencing UNC network-share paths with an HTTP port (@80) that forces payload retrieval over WebDAV via rundll32.exe, avoiding SmartScreen warnings. Analyzed samples (~4 KB, compiled 2023-11-12) predate the CVE publication, and ZIP payloads were likely distributed as email attachments, primarily targeting users in Mexico.

Palo Alto Unit 42 · Aug 17, 2026Malware in the wildCVE-2023-360251

Comprehensive reconstruction of collider events with hypergraph representation learning and graph-conditioned diffusion

VyPER framework reconstructs collider events using hypergraph representation learning and graph-conditioned diffusion, outperforming existing reconstruction techniques across Standard Model processes.

Researchers present VyPER, a geometric learning framework that represents collider events as hypergraphs with a physics-inspired topology for particle event reconstruction. It combines supervised hyperedge classification for assigning measured jets and charged leptons to parent particles with a graph-conditioned diffusion model predicting unmeasured neutrino kinematics, optimized with a joint loss. Evaluated across several proton-proton collision processes, it demonstrates accurate reconstruction across Higgs, electroweak, and top-quark sectors.

arXiv cs.AI / cs.LG / cs.CL · 13h agoAI research

Trezor data breach impact now reaches 81,000 customers

Trezor's ShipMonk breach now affects 81,000 customers, adding 67,000 US customers after Metabase exploitation by ShinyHunters-linked attackers.

Trezor expanded its August 13 breach disclosure, saying the incident at shipping partner ShipMonk now affects 81,000 customers, with 67,000 additional US customers who ordered between November 2019 and August 2021 exposed. Attackers exploited a Metabase SQL injection zero-day to access ShipMonk's systems, exposing names, emails, phone numbers, shipping addresses, and order numbers; ShipMonk reportedly received extortion emails from the ShinyHunters gang. Trezor's own systems and devices were not compromised, and affected users are warned of phishing and scams. The broader Metabase campaign also hit Tally and Framework.

BleepingComputer · 9d agoData breach in the wild

BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams

DFIR Report exposes BengalSEO, an India-based SEO-poisoning operation running since 2015, delivering MayaBot malware and tech support scams via Bing results.

The DFIR Report details BengalSEO, a financially motivated cluster operating from Rajasthan, India, since at least 2015, run through two IT service providers: WeConnect Solutions LLC and Garage2Global. The group uses black-hat SEO techniques—backlinks, DOM injection, DOM shuffling, keyword stuffing—to push lure pages to the top of Microsoft Bing results, routing victims through a traffic distribution system to either the custom MayaBot malware (which delivers an XMRig cryptominer and enables C2) or tech support scam call centers. A Vizio decoy page had 2,000 backlinks from 167 unique external domains, and Matomo analytics is used for victim fingerprinting, with the tracking domain appearing in 1,112 urlscan.io results.

The Hacker News · 8d agoThreat actor in the wild

Rewiring Democracy Series on The Renovator

Schneier and Sanders link a four-part Rewiring Democracy essay series covering civic AI in Japan, Switzerland, Brazil and Scotland.

Bruce Schneier and Nathan E. Sanders announced links to their Rewiring Democracy essay series on The Renovator. The four parts cover Japan's digital democracy party Team Mirai, Switzerland's public AI model Apertus, Brazil's Open Knowledge civic technologists, and civic AI in Scotland. The post is a brief index without technical details.

Schneier on Security · 15d agoAI policy