30
Smart search ranks by meaning as well as keywords (one row per story, last 45 days).
When will average people feel AI’s impact?
Interconnects essay argues AI's impact is still a rounding error for average people, comparing looming wage stagnation to Engels' pause.
An Interconnects essay argues that AI currently touches daily life far less than previous industrial revolutions, since its benefits are concentrated in knowledge work and lack tangible consumer goods. The author invokes Engels' pause (1790-1840), when British wages stagnated amid rapid GDP growth, as a warning that popular backlash could kneecap AI's development. He contends the current phase is about building compounding infrastructure, and predicts daily life may look similar even 50 years from now.
22
PurpleDelta's Fraudulent Employment Operations
Recorded Future details North Korean cluster PurpleDelta using AI-generated personas and ChatGPT assistants to infiltrate companies via fraudulent employment.
Recorded Future profiles PurpleDelta, a North Korean IT worker threat cluster, in a new research report. The group uses AI-generated personas, sophisticated tradecraft, and custom ChatGPT assistants to obtain employment at target organizations and operate covertly. The report includes key indicators of compromise and recommended mitigation strategies for defenders.
58
CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.
CVE-2026-82435 (rated important) affects Apache Storm Worker (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. The worker's Netty message decoder sits ahead of SASL authentication handlers and processes frames before any authentication occurs. It allocates buffers sized from an attacker-controlled length field, so a single frame from an unauthenticated peer reaching the worker can exhaust memory. Users must upgrade to 3.1.0.
45
North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring
Researchers expose DPRK remote IT worker infiltration tactics, including forged identities and AI-assisted interview behavior.
A joint investigation by Mauro Eldritch, Heiner García, and ANY.RUN hired suspected DPRK developers linked to Lazarus Group into controlled sandboxes, revealing forged IDs, remote-access tools, AI-assisted workflows, and VPN/VPS infrastructure. The FBI is investigating a North Korean remote IT worker who reportedly worked for a U.S. federal agency. The article outlines verification steps and indicators including VPS and AstrillVPN exit node IPs.
48
60
North Korea-linked IT Workers Are Getting Hired Inside Western Companies
Huntress documented five DPRK-linked FAMOUS CHOLLIMA workers hired by Western companies in 2026 using fake identities, proxies and laptop farms.
Huntress published an investigation of five confirmed 2026 cases of North Korea-linked IT workers, tracked as FAMOUS CHOLLIMA, obtaining remote jobs at legitimate companies in IT, sales, marketing and healthcare. The workers use stolen or fabricated identity documents, VPNs and proxy services, and some were caught using PiKVM hardware-level control, travel routers and laptop farms to mask their true location. Detection relied on document forensics, behavioral anomalies and indicators like identical typo artifacts in electricity bills rather than network intrusions.
55
Give every teammate and agent the right level of access to your Workers
Cloudflare launches per-Worker granular access controls with four roles, enabling least-privilege access for teammates, AI agents, and CI/CD pipelines.
Cloudflare announced granular authorization for Workers, letting admins scope access to a single Worker instead of the whole account. Four new roles are available: Metadata Read-Only (observability without source code), Content Read-Only (read code without changes), Editor (deploy without delete), and Admin (full control of one Worker). Roles apply at Developer Platform, product, or resource level, can be attached to dashboard users or API tokens, and are available to all customers now, with plans to extend to D1, R2, and KV.
22
Building AI to accelerate science and improve lives
Google highlights AI-for-science advances: AlphaGenome Atlas mapping 9 billion genetic variants, WeatherNext 3 weather model, and global health AI tools.
Google detailed AI advances across science and health, including AlphaGenome Atlas, which mapped all 9 billion possible single-letter genetic changes in the human genome and was made openly available. WeatherNext 3 delivers 50% more accurate precipitation forecasts a day or more ahead and is already in products. AlphaFold is used by 4 million researchers in 190 countries, TB chest X-ray screening has processed 25,000+ scans across six nations, and the diabetic retinopathy model has supported 1.15 million screenings. Google also released its AI & Economy ATLAS global usage insights.
45
Red Flags That Expose Fake North Korean IT Workers
Researchers outline red flags for spotting North Korean operatives posing as remote IT workers as their tactics improve.
Dark Reading describes indicators that help organizations identify North Korean operatives working undercover as IT workers. Researchers say these operatives are improving their tactics, but detection methods still exist. Catching them early helps employers avoid infiltration, data theft, and damage.
50
30
Researching Employment Scams
Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.
The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.
30
Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.
25
AI made software development unrecognizable. Is cybersecurity next?
Opinion piece argues AI-driven shifts that transformed software development—agent-run SOCs, autonomous triage—will soon reshape cybersecurity operations and staffing.
A CSO Online analysis notes Google Cloud research found 90% of developers already use AI, while a March 2026 Federal Reserve paper found coder employment growth fell roughly 3% since ChatGPT's arrival. Gartner predicts 80% of organizations will run smaller, AI-augmented engineering teams by 2030. Security leaders from Contrast Security, Menlo Security and the Cloud Security Alliance expect agent-run SOCs, machine-speed containment and abundant vulnerability discovery, but caution that absorption capacity and autonomous production-environment validation remain bottlenecks.
30
Insights into Suspected DPRK Workers
Huntress details incidents involving suspected DPRK remote workers (Famous Chollima) in partner environments and shares detection indicators.
Huntress analyzed several incidents involving suspected North Korean remote workers, associated with the activity cluster known as Famous Chollima. The report describes indicators defenders can use to detect and prevent DPRK worker infiltration in customer environments. The scheme centers on operatives obtaining remote jobs at Western companies under assumed identities.
58
What must happen for AI’s trillion-dollar gamble to pay off
Hyperscalers need 2.7x productivity gains by 2030 to justify nearly $1.1 trillion in AI data center spending, or risk bankruptcy and capital misallocation.
Wharton finance professor Jessica Wachter estimates hyperscaler AI expenditure will reach nearly $1.1 trillion through 2027 and that a 2.7x productivity increase is needed to break even by 2030. AI revenues of roughly $150-200 billion this year fall far short of about $750 billion in annual spending, with total investment from Alphabet, Microsoft, Amazon, Meta, and Oracle potentially exceeding $5 trillion over four years. Alphabet reported its first free cash flow deficit (about $5.9 billion) since its 2004 IPO due to AI infrastructure costs. Researchers warn that failed demand could make the buildout the largest capital misallocation in history, with depreciating GPU chips risking stranded assets.
35
Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning
Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.
Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.
70
Securing the Infrastructure of Intelligence
NVIDIA positions AI factories combining chips, networking, power and data as the defining infrastructure of the AI economy needing full-stack security.
NVIDIA's blog argues that AI factories are the defining infrastructure of the AI era, transforming energy and data into intelligence that powers businesses and countries. It frames compute as revenue and lists the full stack of critical resources required: advanced chips, packaging, memory, networking, land and power. The piece is a corporate positioning article about securing this infrastructure, with no specific incident or product announcement detailed in the excerpt.
14
TuxBot v3: Inside an IoT Botnet Framework With LLM
Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.
Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.
45
Separating AI's Technological Problems from Its Capitalism Problems
Schneier and Sanders argue AI's harms stem from capitalist incentives and governance gaps, not just technical limits, urging structural reform.
Writing with Nathan E. Sanders in Tech Policy Press, Bruce Schneier argues that AI's technological problems (hallucination, sycophancy, overconfidence) must be separated from socio-political problems created by capitalist market incentives. The essay contrasts US frontier-scale, energy-intensive development with China's incentive-driven leaner open models on commodity hardware, and cites Switzerland's Apertus model - trained on licensed data using public computing and renewable hydropower - as a public-interest alternative. It contends that proposals like research pauses, data-center moratoria, and federal screening conflate technology problems with governance problems, and that society faces independent choices on both axes.
26
Secure all your internal vibe-coded applications — in one click
Cloudflare launched Access for Workers, letting admins attach one zero-trust policy to a Worker across all routes, domains, and previews automatically.
Cloudflare announced Access for Workers, a feature that binds an Access (zero-trust) policy directly to a Worker rather than to individual routes. The policy then applies automatically everywhere the Worker runs, including custom domains, workers.dev subdomains, routes, and preview URLs. Cloudflare positions it as one-click protection for internal, quickly built (vibe-coded) applications.
20
45
Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras
Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.
Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.
72
The Work Now Within Reach
OpenAI argues increasingly capable and affordable AI can expand what workers and businesses accomplish, lowering the cost of growth.
An OpenAI publication frames more capable, affordable AI as a way to expand the work people and businesses can accomplish and to make economic growth more economical. The piece is presented as an exploration of AI's economic impact rather than a technical or product announcement. No specific models, benchmarks, or metrics are named in the available text.
15
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
CERT-UA says Sandworm-linked UAC-0145 poses as recruiters in fake job interviews to deliver a trojanized WireGuard VPN that runs attacker commands on victims' hosts.
CERT-UA attributes the campaign, ongoing since May 2026, to UAC-0145, a subgroup within GRU-affiliated Sandworm (APT44). Posing as HR staff of firms like ATLAS Business Group and Sopra Steria Bulgaria, attackers lure Ukrainian IT specialists into Zoom interviews, then share failing WireGuard configs and push a custom SopraVPN client from SourceForge. The modified WireGuard build supports a non-standard SymmetricKey option holding AES-256-GCM-encrypted PowerShell, decrypted with the decoded PrivateKey and executed via runScriptCommand. A scheduled task then downloads a second-stage payload on Windows, while the Linux variant fetches it via cURL.
72
Anthropic built an economic model that frames its CEO's bleakest job forecasts as an outlier scenario
Anthropic published an economic model with three US economic scenarios through 2030, framing CEO Dario Amodei's bleakest job-loss forecasts as the outlier outcome.
Anthropic released an economic model outlining three scenarios for AI's impact on the US economy through 2030. The modest scenario resembles the internet's impact with stable wages, the middle scenario doubles growth while knowledge worker wages stagnate, and the extreme scenario projects 17.9% knowledge worker unemployment with labor's GDP share falling from 60% to 45%. CEO Dario Amodei's May 2025 warning of up to half of entry-level office jobs vanishing and 10-20% unemployment aligns with the extreme scenario, which the model treats as the least likely outcome.
30
ZDI-26-528: Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability
ZDI advisory ZDI-26-528 discloses CVE-2026-28220, a CVSS 9.9 deserialization RCE in Wazuh's cluster DAPI protocol exploitable by network-adjacent attackers.
Wazuh contains a deserialization-of-untrusted-data flaw in its cluster DAPI protocol, tracked as CVE-2026-28220 with CVSS 9.9. Network-adjacent attackers can execute arbitrary code on affected installations, but must first obtain the ability to execute low-privileged code on a worker node. The vulnerability was disclosed through ZDI advisory ZDI-26-528.
50
OpenAI Builds ‘Defense Factory’ as AI Agents Gain Ability to Chain Cyber Exploits
OpenAI unveiled a Defense Factory using AI agents to continuously discover, validate, patch, and verify vulnerabilities, warning the defender's window against agentic attackers is shrinking.
OpenAI describes a Defense Factory workflow where AI agents integrate source control, scanners, issue trackers, and secret stores to discover, reproduce, patch, and verify vulnerabilities under human oversight. The approach responds to agentic attackers that can retain knowledge across sessions and chain vulnerabilities into multi-stage attack paths faster than human triage can respond, which OpenAI calls a shrinking defender's window. During an internal security sprint involving 250+ people across 100+ service areas, agents closed 53 urgent or high-priority issues on day one, achieved 90.6% ownership-routing acceptance, cut 37% of findings as duplicates, and produced Codex-generated patches with a 0.53% rollback rate. Runtime validation reduced false positives to 0.81%, and each agent operates in isolated, reproducible environments with a control plane for policy and credentials.
58
CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability
CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.
CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.
74
North Korean remote workers are broadening their job hunt beyond IT
Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.
Huntress investigations identified suspected DPRK remote workers hired beyond IT in sales, marketing, and healthcare/financial organizations, sometimes actually performing the work they were hired for. Fraudulent documents included passports from the same city issued one day apart, ID cards with identical validity dates, and electricity bills built from the same online template with matching typos. A financial-services case found a PiKVM and Guermok USB capture card on a new hire's laptop within hours of delivery, suggesting a laptop farm, and another hire used a police mugshot with the photo digitally swapped. Researchers urge rigorous background checks and identity verification at the interview stage.
58
First ‘Take It Down Act’ Sentencing Puts Man Behind Bars for 15 Years
Ohio man James Strahler gets the first US Take It Down Act sentence: 15 years for distributing real and AI-generated abuse imagery.
James Strahler, 38, became the first person convicted under the Take It Down Act, receiving a 15-year federal prison sentence after investigators found more than 3,000 real and AI-generated abuse images across his devices, including over 700 he posted online. He pleaded guilty to cyberstalking, producing obscene visual representations of child sexual abuse, and publication of digital forgeries after victims received threats, extortion demands, and AI-fabricated explicit images; the FBI took over the case in June. The federal law, which took effect in May, criminalizes knowingly publishing or threatening to publish nonconsensual intimate imagery, and free-speech advocates have criticized its 48-hour platform removal window as a censorship risk.
50
How a team of entity maintainers monitors, connects and scores entities in Elastic Security
Elastic Security explains how background 'maintainer' jobs build user, host and service entities from raw logs and drive identity resolution and risk scoring.
Elastic Security Labs describes the internal background jobs, called maintainers, that each own one piece of every user, host and service record in Elastic Security. The maintainers construct entities from raw logs, resolve identities across sources and compute risk scores, and the write-up explains how the team keeps this entity machinery consistent.
25
When AI quietly breaks things, who pays?
Reed Smith partner David Halbreich explains how AI companies can avoid D&O/E&O coverage gaps around mergers, governance warranties, and claims timing.
In an interview, insurance recovery partner David Halbreich of Reed Smith outlines insurance pitfalls for AI companies under claims-made D&O and E&O policies. He highlights 'straddle' claims after mergers that fall between tail coverage and go-forward policies, potentially leaving policyholders with no coverage. He also warns that governance artifacts submitted in insurance applications, such as bias testing records and model cards, can become warranties carriers use to deny claims, and discusses who should answer AI-use questions and how business interruption coverage applies to cloud and compute vendor outages.
15
CISOs Race to Control AI Agents Without Destroying Their Value
Team8 survey: 78% of CISOs name AI and agent security their biggest pain point as over-privileged agents expand attack surface.
Team8's annual CISO Village survey reports that 78% of security leaders cite AI and agent security as their biggest pain point, twice the second-ranked concern (39%), while 71% are experimenting with or augmenting security tools using AI agents. Team8 CISO Tim Brown warns that employee-built agents created with tools like Claude Code, Cursor and Codex can take unintended harmful actions, such as poking around production systems, because prompt imprecision combines with non-deterministic model behavior. Brown recommends building guardrails into the agent development process to limit where agents can go and what they can do, without destroying business utility. He also urges greater transparency and experience sharing among security leaders facing the same agent security problems.
28
Chrome, Firefox Updates Patch 115 Vulnerabilities
Google and Mozilla patch 115 vulnerabilities across Chrome 153 and Firefox 156, including three critical Chrome bugs; no exploitation reported.
Google's Chrome 153 (153.0.8010.47/.48 for Windows/macOS) fixes 42 flaws, including three critical: CVE-2026-91726, an out-of-bounds read in WebGL, and use-after-free bugs CVE-2026-91721 and CVE-2026-91749 in Internals and Workers. Mozilla's Firefox 156 resolves 73 vulnerabilities, including 29 high-severity use-after-free and privilege escalation issues, with related fixes in Thunderbird and Firefox ESR branches. Neither vendor reports any of the defects being exploited in the wild.
55
Occamy-1.0: Open Pareto-frontier 35B Intelligence for Co-work
Occamy-1.0 releases open 35B weights post-trained from Qwen3.6-35B-A3B, targeting cost-efficient co-work agents at Pareto-frontier pricing.
Occamy-1.0 is a cost-efficient co-work agent model built by further training the post-trained Qwen3.6-35B-A3B checkpoint, using execution-grounded data, replayable long-horizon trajectories across multiple harnesses, and staged post-training. It consistently ranks among the strongest comparably sized models across co-work benchmarks and remains competitive with substantially larger frontier systems on several tasks. Its aggregate performance across four representative benchmarks places it at the low-cost knee of the observed cost-performance Pareto frontier, while preserving tool calling, coding, and instruction following capability. The model weights and a subset of training data are publicly released.
58
Nimbus Manticore Expands Toolset With TWOSTROKE
Group-IB found new infrastructure and TWOSTROKE-like malware used by IRGC-linked Nimbus Manticore, indicating expanded Middle East and Europe targeting.
Group-IB reported new Tortoiseshell infrastructure spanning Europe and the Middle East and two previously undocumented tools from IRGC-linked Nimbus Manticore (UNC1549): a reverse SSH tunneling utility connecting to 172.86.98.113 on port 443, and a C++ backdoor masquerading as wtsapi32.dll with three hard-coded C2 servers. The backdoor overlaps with TWOSTROKE and supports file transfer, execution, host information gathering, and persistence. Findings build on Kaspersky's report of the NightLedger backdoor and WebSocket tunnelers BridgeHead and ArcBridge, and suggest expanded targeting beyond the Middle East into Europe.
60
North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs
ANY.RUN details the expanding North Korean IT worker infiltration scheme using forged identities and AI-assisted workflows, sharing detection IOCs for SOCs.
ANY.RUN describes how North Korean IT workers infiltrate American and European organizations using forged identities and AI-assisted workflows to become trusted insiders. The operation bypasses traditional security perimeters and has expanded beyond the private sector to government targets. The post provides detection IOCs and tactics for government and corporate SOCs.
50
27.5KB language-agnostic WebGPU syntax highlighter
A developer released gpu-lexer, a 27.5KB language-agnostic syntax highlighter that uses a tiny WebGPU model to label code tokens in the browser.
gpu-lexer splits source into words, whitespace, and symbols, then a small WebGPU model uses local and whole-file context to assign nine token classes, working on languages never seen in training. On held-out files, 12.57% of token labels differ from Shiki, though this measures agreement with Shiki rather than objective correctness. In benchmarks against Shiki 4.4.3, Prism.js, Highlight.js, Sugar High, and Starry Night, it highlighted 10 concatenated copies of three.min.js (5.56M characters) about 10x faster on an Apple M4 Pro in Chrome 152. The author frames it as an experiment, not a grammar-equivalent highlighter.
15
How AI-native companies turn workflows into operating capability
OpenAI highlights Basis, Clay, and Exa Labs using AI agents for onboarding, account management, and developer integrations in enterprise workflows.
An OpenAI news post profiles AI-native companies Basis, Clay, and Exa Labs that use AI agents to improve onboarding, account management, and developer integrations. The piece positions these workflows as operating capability and draws lessons for enterprise leaders. It is promotional case-study content rather than product or research news.
20