Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
Apple ships visionOS 27.0 (build 24M362) for Vision Pro; release notice contains no security or CVE details.
Apple announced the general availability of visionOS 27.0, build 24M362, via its developer release feed. The notice contains only download and release-notes links with no vulnerability or CVE information. Defenders should consult the security release notes to determine if patches affect Apple Vision Pro devices.
Apple shipped visionOS 26.6.1 (build 23O780), a security and maintenance update for Vision Pro headsets.
Apple listed the visionOS 26.6.1 release (build 23O780) on August 17, 2026. The announcement contains only download and release note links, with no CVE identifiers or exploitation details disclosed in the feed text. Updates to visionOS generally bundle security patches alongside functional improvements for Apple Vision Pro.
Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.
Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.
A newly observed Mirai-based Linux botnet dubbed Evooo1Bot compromises edge devices and turns them into persistent proxies for threat actors.
Evooo1Bot is a newly identified Linux botnet built on the Mirai framework but enhanced with additional advanced capabilities. The malware compromises edge devices and converts them into persistent proxies, likely for relay or resale use. The botnet's evolution beyond stock Mirai highlights continued targeting of poorly secured IoT and edge systems.
A public proof-of-concept exploit was released for an IDOR vulnerability in web application Probo 0.222.2.
Exploit-DB published exploit #52650 targeting Probo version 0.222.2. The flaw is an Insecure Direct Object Reference (IDOR) in this web application. No exploitation in the wild is reported in the disclosure text.
Apple seeded tvOS 27.0 release candidate build 24J360 to developers ahead of the general release.
Apple released the tvOS 27.0 release candidate (build 24J360) through its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.
Apple seeded visionOS 27.0 release candidate build 24M362 to developers ahead of the general release.
Apple released the visionOS 27.0 release candidate (build 24M362) through its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.
DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.
DeepZero is a free, open-source Python pipeline orchestrator that automates hunting for exploitable Windows kernel drivers relevant to BYOVD (bring your own vulnerable driver) attacks. Its seven-stage YAML pipeline parses PE headers, filters for kernel-mode drivers with IOCTL surfaces, excludes drivers listed on loldrivers.io, then runs headless Ghidra decompilation, Semgrep scanning, and an LLM-based exploitability assessment. The maintainer reports multiple verified vulnerabilities in the Snappy Driver Installer corpus, some still in the disclosure process, and notes findings involving plug-and-play-created device objects may need physical hardware to confirm.
Hobbyist benchmark re-runs the pelican-bicycle SVG test on six 2026 frontier models, comparing generation time and API cost per image.
A Show HN post re-runs the classic pelican-bicycle and similar SVG generation tests across six 2026 models: GPT-6 Astra, Claude Fable 5.1, Gemini 3.8 Flash, DeepSeek V4 Pro, Qwen3.8 Max, and Fugu Ultra v2, recording wall-clock time and cost. It also lists 2025 baseline runs with ten models including Claude Sonnet 4.5, GPT-5.2 Pro, and Qwen3-VL-235B-A22B-Thinking. DeepSeek V4 Pro is consistently cheapest ($0.04-$0.10) while Qwen3.8 Max is slowest, taking up to roughly 17 minutes per generation.
Patchstack disclosed CVE-2026-32475 (CVSS 9.0), an unauthenticated file-upload flaw in Elementor Pro enabling PHP upload and RCE; fixed in version 4.2.2.
Patchstack researcher Tin Pham reported an unrestricted file upload flaw in Elementor Pro's Forms module (CVE-2026-32475, CVSS 9.0), affecting all versions up to and including 4.2.1. Submitting two file parts for one field bypasses the extension blocklist and writes attacker-controlled PHP into a public uploads directory, yielding unauthenticated remote code execution when a published Elementor page uses a Form widget with a File Upload field. A patched version 4.2.2 shipped August 19, 2026, a day after WordPress 7.0.4 fixed CVE-2026-65640 (CVSS 8.8), an RCE via Postscript file upload when Imagick and Ghostscript are in use.
ThinkPrior builds zero-rollout difficulty priors via an offline verifier-anchored pass, halving silent groups in RLVR and cutting wasted rollouts on Qwen2.5-Math-7B.
In GRPO-based RLVR, groups where all rollouts are correct or all are wrong yield zero advantages and consume about 39% of a run's rollouts under uniform sampling. ThinkPrior initializes a Beta posterior from an external anchor pass's verifier-scored pass rate, selecting prompts by expected learnability before any target-policy rollout, without changing the loss or optimizer. On Qwen2.5-Math-7B across sixteen seeds it more than halves early silent groups and cuts wasted rollouts through step 30 by nearly a fifth, with no detected final-accuracy difference. The ThinkPrior+DAPO composition reduces generated rollouts by 10.6% at an equal 3,840-rollout update budget.
OpenAI's Jalapeño custom inference chip shows faster, more power-efficient inference with higher throughput and lower latency.
OpenAI announced first results for Jalapeño, its custom AI inference chip. The company claims industry-leading speed and efficiency, delivering higher throughput and lower latency for modern models compared with existing options. The chip targets more power-efficient serving of large models at scale.
Apple seeded watchOS 27.0 release candidate build 24R363 to developers ahead of the general release.
Apple released the watchOS 27.0 release candidate (build 24R363) through its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.
OpenAI unveiled Jalapeno custom inference chip claiming 1.5-1.9x better perf-per-watt than NVIDIA GB200/GB300, deploying in-house by year-end.
At the 37th Hot Chips conference, OpenAI published first benchmark details for its custom Jalapeno inference chip, claiming 1.5-1.9x more work per watt, 1.7-3.6x lower end-to-end latency, and 2.1-4.1x higher interactive-workload performance versus NVIDIA GB200/GB300, with the 700W-rated part staying at or below 550W in tests. Deployment into OpenAI's own infrastructure begins by year-end, with Gen 2 deep in development and Gen 3 underway. OpenAI also said GPT-Astra and Codex helped write low-level kernels, reportedly 1.5-1.8x faster than human-expert code for selected attention and MoE blocks. Cerebras CS-5, Groq 3 LPX and Apple M6 were also featured at the conference.
FortiGuard Labs disclosed Evooo1Bot, a Mirai-based Linux botnet active since July 2026 that hijacks routers and IoT devices for DDoS, credential theft, and SOCKS5 proxying.
Fortinet's FortiGuard Labs disclosed Evooo1Bot, a previously undocumented Linux botnet active since July 2026 that reuses Mirai's DDoS engine while adding encrypted C2, SSH brute-force scanning, credential sniffing, and SOCKS5 proxy modules. The bot exploits 18 known CVEs across Alcatel, NETGEAR, Tenda, D-Link, Telesquare, and Mitsubishi devices, some dating back to 2007, and communicates exclusively over port 443 to blend with HTTPS traffic. Compromised hosts can be turned into SOCKS5 relays for anonymous traffic forwarding or monetization via proxy services. The malware uses AES-256-CTR, ChaCha20, and XOR obfuscation with a 28-command administration interface.
Suno launches v6, v6-wild, and free v6-mini music models co-developed with Warner Music Group, BMG, and Believe, retiring all older models.
Suno's flagship v6 serves Pro and Premier subscribers, v6-wild targets experimentation, and v6-mini is free; all three understand vocals, instrumentation, structure, mood, and multimodal inputs, with text-based editing of individual song sections. The models were built with Warner Music Group, BMG, and Believe following Warner's November 2025 licensing settlement, while Universal and Sony continue litigating and a Munich court found v3.5 and v4 infringed six works. Suno reports more than 100 million users, over two million paying subscribers, and $300 million ARR after raising $400 million at a $5.4 billion valuation in June.
DriveZero pairs a frozen vision-foundation-model perception stack with a PPO-trained closed-loop RL teacher to beat replay experts on nuPlan.
DriveZero is an end-to-end camera-only autonomous-driving planner that separates perception and action. Its DriveVFM perception backbone consolidates frozen vision foundation models (DINOv3, SigLIP2, SAM, Depth Anything V2) from raw images without task annotations, while DriveRL trains a privileged PPO teacher policy through closed-loop rollouts in interactive worlds built from real driving logs. The planner distills this teacher, achieving a 93.57 mean nuPlan score across Val14, Test14-hard and Test14-random splits and beating the Log-Replay expert on all three. It also sets state of the art on NAVSIMv1, NAVSIMv2 and closed-loop HUGSIM without human trajectory supervision.
CISA advisory details hard-coded bootloader credential CVE-2026-85083 in ANJIA AJL33PC0801 CareCam Pro cameras, allowing physical-access firmware compromise.
CISA ICS advisory ICSA-26-251-01 describes CVE-2026-85083, a hard-coded credential (CWE-798) used for bootloader authentication in the ANJIA AJL33PC0801 CareCam Pro IP camera. An attacker with physical access could gain privileged bootloader access and modify firmware and configuration, potentially fully compromising the device. The flaw scores 6.8 on CVSS 3.1 (7.0 on CVSS 4.0), is not remotely exploitable, and no public exploitation has been reported. Affected firmware is linux_linux_202008261138_svn13796 with U-Boot 2010.06; the vendor is headquartered in China with worldwide deployments.
Apple seeded iPadOS 27.0 release candidate build 24A435 to developers ahead of the general release.
Apple released the iPadOS 27.0 release candidate (build 24A435) via its developer releases feed. The listing only provides downloads and release notes, with no security content or CVE details. RC builds typically precede the public availability of the final OS version.
ZDI disclosed CVE-2026-81988, a use-after-free in Adobe Acrobat Pro DC document object handling that enables remote code execution.
Zero Day Initiative advisory ZDI-26-673 describes a use-after-free vulnerability in the document object handling of Adobe Acrobat Pro DC. Arbitrary code execution is possible when a target opens a malicious file or visits a malicious page. The flaw received a CVSS rating of 7.8. No in-the-wild exploitation is reported.
Slovakia's NBÚ warns that speed camera systems from SODASUS, Simicon and NEROline pose cyber risks including undocumented remote access.
Slovakia's National Security Authority (NBÚ) warned of a significant cyber threat tied to several road speed camera products: NERO R-ONE units sold by Cyprus-based SODASUS, and Cordon-series cameras made by Russia's Simicon and sold by Croatia's NEROline. A security analysis requested by the Interior Ministry found weak protections, mismatches between documented and actual communication settings and software versions, unclear hardware/software provenance, and pre-configured remote-access mechanisms outside operator control. NBÚ warned that compromised cameras could expose vehicle and licence-plate data, tamper with records, or serve as a foothold into public-sector networks lacking segmentation. The Interior Ministry reportedly removed the units from its pilot deployment and asked the supplier to replace them with equipment meeting Slovak and EU security requirements.
A critical Elementor Pro Forms module flaw allowing unauthenticated file uploads is under active attack against widely used WordPress sites.
A critical vulnerability in Elementor Pro, a widely used WordPress page builder plugin, allowed unauthenticated attackers to upload arbitrary files through the plugin's Forms module. The SOCRadar report indicates the flaw is being actively exploited in the wild. No CVE identifier was provided in the available text.
Metasploit 6.5 ships 13 new modules including RCEs for SonicWall SMA1000, Ghost CMS, Joomla JCE and Langflow, plus a Linux kernel LPE.
Rapid7's Metasploit wrap-up covers the 6.5 release, which adds 13 new modules, including remote code execution exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard and a Pix-for-WooCommerce plugin. The Fragnesia Linux kernel local privilege escalation (CVE-2026-46300) also landed. The release introduces HTTP malleable profiles, MCP functionality, Linux multi-fetch payloads and improved Windows on ARM support.
AVP-Inspect automated testing finds 58% of 324 Apple Vision Pro apps show privacy violations, with over 60% of network traffic flows undisclosed.
Researchers built AVP-Inspect, a dynamic analysis framework combining custom hardware device control, 3D UI exploration, and a unified privacy taxonomy for Apple Vision Pro. Testing 324 App Store apps for 20 minutes each found 188 (58.0%) with at least one privacy violation. More than 60% of observed network traffic flows were not properly disclosed, extending prior XR privacy work beyond Android-based devices such as Meta Quest.
Simon Willison's pelican SVG comparison shows GPT-6 Astra producing markedly better images than GPT-5.6 Sol, Terra, and Luna across reasoning levels.
Willison generated pelicans-riding-bicycles SVGs with newly accessed GPT-6 Astra at low through max reasoning levels and rendered them in a comparison grid against GPT-5.6 Sol, Terra, and Luna. Astra's outputs were markedly more coherent, while even the best GPT-5.6-Sol images remained largely abstract shapes. Astra does not support a reasoning=none setting, so all comparisons involved reasoning-enabled runs.
Forescout used Claude to port a WAGO PLC exploit for $536 in 8 hours, and an AI-generated payload later permanently bricked the test device.
Forescout researchers used Claude Code with Ghidra, terminal access, and physical hardware to port CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server, from a WAGO 750-852 PLC to the WAGO 750-831 without source code or debugger access. The final RCE development stage cost $535.74 in API fees over an 8-hour, 32-minute session (2.6k input and 1.3M output tokens) and required heavy researcher guidance. Claude produced working ICMP and UDP beacon exploits in 12 minutes after identifying that normal FTP command completion was overwriting its shellcode, fixed by omitting the CRLF terminator. A follow-up session extending the payloads toward a C2 implant wrote to flash-mapped memory and permanently bricked the PLC, underscoring the risks of autonomous agents operating against physical infrastructure.
Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.
Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.
Hugging Face guide fine-tunes a 350M-parameter model with 100 GRPO steps to improve structured output reliability.
A Hugging Face blog post demonstrates fine-tuning a 350M-parameter model using GRPO (Group Relative Policy Optimization) with TRL over 100 training steps. The stated goal is more reliable structured outputs from small language models. No article body was available, so details beyond the title are limited.
Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.
ClearFake compromises websites, injects JavaScript via a malicious Cloudflare Worker, retrieves instructions from BNB Smart Chain contracts (EtherHiding), and presents a fake Google CAPTCHA that tricks Windows users into pasting a command that loads a remote library over WebDAV via rundll32. The crypto-stealer branch uses DLL side-loading with a signed Chrome component to launch ZigCryptoStealer, which hijacks clipboard cryptocurrency addresses, alongside a signed but vulnerable Windows driver used in a BYOVD attack to terminate EDR processes. A parallel branch delivers Amatera secondary payloads that install a hidden remote-access client providing operator desktop control, with Cisco Talos tracking the remote-loader activity as UAT-10820. Talos observed unusual remote library execution at a Ukrainian government organization in April 2026 and assesses the attacks are part of a broader theft operation rather than a single targeted campaign.
Schneier on Security highlights a printed vehicle-camouflage pattern tested to defeat Flock surveillance cameras and Axon body cameras.
The post discusses covering cars with printed patterns designed to fool Flock automated license-plate recognition software, with testing reportedly done against Flock and Axon body cameras. Reader comments question effectiveness against other ALPR vendors, Flock's RF MAC-address upgrade, and whether such camouflage might become regulated. The page also contains off-topic comment threads about anti-bot over-blocking and privacy.