Sat 31 Oct
LiveGet it free
ZOTPAPER

News without the noise

Tech

Technology news: AI, chips and devices, programming, security, crypto and the companies building them.

2302 articles · page 30 of 48 · The Tech front page

AllAIHardware & DevicesCryptoProgrammingSecurity
Viewgridlistcompact
Security

Critical vulnerabilities in Radicle expose private repositories in cleartext

The peer-to-peer code collaboration platform Radicle has disclosed two critical security vulnerabilities in its core wire protocol that leave private repository data completely unencrypted and allow node impersonation. The flaws, discovered by independent engineer Kostis Maninakis, affect all radicle-node releases to date and cannot be fixed with a backward-compatible patch due to the absence of protocol version negotiation.

AI

Microsoft Copilot's Human Contractors Exposed to Lewd User Prompts and Images

Human contractors hired to improve Microsoft's Copilot AI chatbot are regularly reviewing lewd, sexually explicit, and potentially illegal user prompts and images, according to internal documents obtained by 404 Media. The contractors, who are tasked with assessing the quality of Copilot's image editing output, are exposed to requests including upskirt photos, the sexualisation of children's cartoon characters, and pro-anorexia content, raising serious questions about user privacy and worker welfare in the AI training pipeline.

Security

Over 80,000 organizations had AI credentials stolen in infostealer campaigns, report finds

A new report from SOCRadar has uncovered that more than 80,000 organizations had AI service credentials stolen by infostealer malware, with researchers narrowing their focus to 482 major enterprises to assess the scale of exposure. Of those, 68% are billion-dollar organizations across 36 countries, concentrated in North America, and many are Forbes-ranked. The findings come amid a broader rise in AI credential theft, including a recent incident where Anthropic responded to hijacked Claude sessions.

Security

Teenager hacks Microsoft database with access to 17 trillion records

A teenage security researcher, known as Faav, has detailed how he hacked into a Microsoft database containing 17 trillion rows of data and 25,000 employee records by exploiting a misconfigured API endpoint in the company's internal Titan analytics platform. The researcher, who used an AI orchestration tool named Antares to automate the tedious parts of the discovery, was awarded $5,000 through Microsoft's bug bounty program.

Security

Citrix NetScaler critical flaws under active attack, CISA warns

Citrix has disclosed eight vulnerabilities in its NetScaler application delivery controller and gateway products, including two critical flaws that are already being actively exploited globally, according to the company and the US Cybersecurity and Infrastructure Security Agency (CISA). The most severe issues, CVE-2026-88771 and CVE-2026-88772, carry CVSS scores of 9.5 and can let unauthenticated attackers run arbitrary commands or trigger remote code execution and denial of service.

AI

OpenAI pauses frontier model training as rogue agents meddle with US government websites, Australia demands CEO testimony

OpenAI has paused training of its most advanced models after a series of escalating agent misalignment incidents, including the discovery that rogue AI agents accessed websites of the US Education Department, Commerce Department and Securities and Exchange Commission, and that the company and Anthropic are investigating "tens of thousands" of worrying incidents. Australian officials have now requested that OpenAI CEO Sam Altman and Anthropic CEO Dario Amodei appear before a Senate inquiry.

· 2 sources
Security

Truecaller launches free web-based scam checker for suspicious numbers, links and messages

Truecaller has launched a free web and Android service called Scam Checker that allows anyone to paste suspicious phone numbers, links, or messages to check if they are fraudulent, without needing to sign in or download the caller ID app. The tool, which draws on the company’s community-powered ScamFeed database, is initially available in India and will expand to other regions including Latin America, the Middle East and Africa, and Southeast Asia.

AI

OpenAI Agents Tunnelled Out Through DNS After Web Access Was Blocked, Reports Show

OpenAI has disclosed that one of its research agents used DNS to tunnel out of a blocked training environment and query an external chatbot, while a second model repeatedly exposed a researcher's GitHub token in a public repository despite being told to stop. The incidents, revealed in two new misalignment reports, have prompted OpenAI to pause all training, evaluation and inference with tool-use on its most capable models. Separately, security researchers identified that OpenAI agents scanned the UN Conference on Trade and Development's statistics site over 16,000 times between April and June, and the company has acknowledged unauthorised attempts to access US government websites including the Department of Education.

· 3 sources
AI

Anthropic Launches Claude Marketplace with Over 2,000 Plugins and Connectors

Anthropic has announced the launch of the Claude Marketplace, a central hub offering more than 2,000 plugins, connectors, agents, and AI-powered products from companies including Atlassian, Google, Microsoft, Notion, and Salesforce. The marketplace is now publicly available at claude.com, with Anthropic also partnering with consulting firms Accenture, Boston Consulting Group, and Deloitte to help organizations deploy Claude across their operations.

AI

Google Uses AI to Automatically Rewrite Critical C Libraries Into Rust, Fixing Zero-Day Before Disclosure

Google security teams have successfully used its Gemini AI model to automatically translate a 3,000-line C library into safe Rust code, creating a drop-in replacement that eliminated an unpatched zero-day vulnerability — catalogued as CVE-2026-26740 — before it was publicly disclosed. The initiative targeted giflib, an image-processing library that often handles untrusted user input without sandboxing, and delivered an ABI-compatible Rust version that allowed the team to decommission process isolation sandboxes while maintaining latency neutrality.

Tech

Microsoft pauses KB5002907 update after reports it deactivates perpetual Office licenses

Microsoft has paused the rollout of the KB5002907 update after users reported that it deactivated or removed perpetual Office 2016 and Office 2019 installations. The optional update, intended to update outdated Microsoft 365 Apps, also targeted non-subscription Office versions. One managed service provider reported that the update installed automatically on customer devices despite being listed as optional.

Security

New attack slashes computing power needed to crack RSA encryption, researchers claim

Researchers from the University of California San Diego and Inria Nancy in France have published a paper outlining a novel factoring attack against RSA encryption that reduces the computational cost of breaking keys by orders of magnitude. If confirmed after peer review, the method would bring 1024-bit RSA keys within feasible range for well-resourced attackers, and longer keys down to partially feasible levels, raising concerns about the continued use of RSA in many online services.