Feed aggregator

The GPT-6.1 Astra model was slated to debut in ChatGPT and Codex in October, but it fell short of expectations. 

The post OpenAI Calls Off GPT-6.1 Astra Launch, Details Safety Cases for Frontier Training appeared first on SecurityWeek.

Pepijn van der Stap was convicted in 2023 for hacking multiple organizations, stealing their data, and extorting them.

The post Dutch Police Arrest Convicted Hacker in ShinyHunters Investigation appeared first on SecurityWeek.

Apple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file. Apple says it may have been used in highly targeted attacks against iPhone users running versions of iOS before iOS 27.

The fix is in iOS and iPadOS 26.7.1, as well as macOS Sequoia 15.8.1 and macOS Tahoe 26.7.1. Check Software Update on each of your Apple devices and install the latest version offered.

Updates for your particular device

The table below shows which relevant updates are available and links to Apple’s security information for each one.

UpdateAvailable foriOS 26.7.1 and iPadOS 26.7.1iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and latermacOS Tahoe 26.7.1macOS TahoemacOS Sequoia 15.8.1macOS Sequoia How to update your Apple devices How to update your iPhone or iPad

To check if you’re using the latest software version, go to Settings > General > Software Update. You’ll see if an update is available and be guided through installing it.

Turn on Automatic Updates if you haven’t already—you’ll find it on the same screen.

Available update options on iPad How to update macOS on any version

To update macOS on any supported Mac, use Software Update:

• Click the Apple menu in the upper-left corner of your screen.
• Choose System Settings (or System Preferences on older versions).
• Select General in the sidebar, then click Software Update on the right. On older macOS, look for Software Update directly.
• Your Mac will check for updates automatically. If updates are available, click Update Now (or Upgrade Now for major new versions) and follow the on-screen instructions. Before you upgrade to macOS Tahoe 26, read Apple’s instructions.
• Enter your administrator password if prompted, then let your Mac finish the update. It may need to restart.
• Make sure your Mac stays plugged in and connected to the internet until the update is done.

Technical details

The bug, CVE-2026-86950, affects CoreGraphics, an Apple framework used throughout its operating systems and apps to display and process visual content such as images and PDFs.

It’s an out-of-bounds write issue, which Apple addressed with improved bounds checking. This type of bug happens when software writes data beyond the limits of its allocated area of memory. It can overwrite other data in memory, interfere with the normal operation of the program, cause a crash, or even let an attacker take control of the affected process. In this case, processing a maliciously crafted file may lead to an attacker running their own code.

Apple says it is aware of a report that the issue may have been exploited in an “extremely sophisticated attack” against specific people using versions of iOS before iOS 27. Although the reported attack was highly targeted, other attackers could try to exploit the flaw now that it has been disclosed. 

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

Apple announced its first foldable iPhone on September 9, and scammers were ready to ‘deliver’ one before anyone could buy it.

Most of what we found around the launch of the iPhone Duo and iPhone 18 Pro was familiar fraud.

But one fake preorder page was different.

The fake Apple-style page offers a $500 voucher and a ticking preorder deadline.

Behind its Apple-style design and $500 voucher, the page uses the leaked DarkSword exploit chain to try to break into vulnerable iPhones. If it succeeds, a separate payload attempts to steal saved credentials, cryptocurrency wallet data, and notes.

You don’t have to fill in the form, tap a download, or approve anything. Opening the page is enough to start the attempt.

The $500 voucher is a distraction

The page looks like Apple’s, down to its logo and “Copyright © 2026 Apple Inc.” footer. It promises an “Authorized Partner Exclusive” $500 voucher and AppleCare+ coverage if you complete a preorder form. The form asks for your name, email, and phone number, with WhatsApp “preferred,” but promises no upfront payment.

The form asks for contact details and offers Duo models and colors that do not match Apple’s.

But Apple doesn’t open iPhone Duo preorders until October 16. You cannot place an Apple preorder now. It offers 6.3-inch and 6.9-inch models in colors Apple doesn’t sell for the Duo. Its countdown starts over whenever the page loads, and its privacy, terms, and sales policy links go nowhere.

In the version we captured, submitting the form doesn’t place an order. Its submission handler doesn’t read or send the details entered, and the page generates its own “Pre-Order Successful” message. The exploit attempt has already begun in the background.

How the attack starts when the page opens

Visitors using browsers the script doesn’t recognize as Safari see a “Browser Restricted” notice. On iPhones, the page also tries to reopen the link in Safari, the browser the exploit chain targets. That steers visitors toward the intended browser, although background resources may still load in others.

Visitors shown this notice are urged to open the page in Safari.

An invisible frame checks the visitor’s iOS version and selects the next code to load. DarkSword then attempts to get past the iPhone’s protections and, if successful, gain deep access to the phone. It doesn’t wait for a button press or form submission.

What attackers could take from an iPhone

If the exploit succeeds, the payload attempts to contact its server. Its first message includes a device identifier, device information, and status. It also attempts to send a list of installed apps and the contents of Apple Notes.

The code looks for cryptocurrency wallets, including MetaMask, Phantom, Trust Wallet, Coinbase Wallet, Exodus, and Tonkeeper. It also attempts to recover saved credentials from the phone’s keychain. If it finds a targeted wallet and the first exchanges with its server succeed, it attempts to upload wallet files, recovered keychain data, and photo thumbnails. Exposure of wallet files or credentials could put funds at risk.

The captured code checks for installed cryptocurrency wallet apps. This is part of the list.

The payload also tries to access files containing messages, call history, contacts, voicemail, email, calendar entries, and cached location data.

The payload can then repeatedly contact its server for instructions. Its commands can list directories, retrieve files and full-size photos, gather app information, and run JavaScript supplied by the server. The payload also tries to cover its tracks by deleting diagnostic reports that could help investigators spot the attack.

The beacon sends a device identifier, device information and status to the configured server. The command loop uses the response to obtain instructions.

The code is designed to run inside a system process, but may stop before the phone restarts. We found no mechanism that automatically brings it back after a reboot.

We analyzed the captured code, but did not test it on an iPhone or observe data leaving one.

Which iPhones could be at risk?

Several parts of the captured code match the DarkSword chain described by Google in March. Apple has patched the vulnerabilities Google reported.

When DarkSword was disclosed in March, iVerify estimated that up to 270 million devices were running the iOS 18.4 through 18.6.2 versions targeted by the variant it analyzed. That is not a current count or a measure of how many phones this page could compromise. We haven’t confirmed this page’s exact range; its files also contain code for older iOS versions.

The lure fits the exploit: someone considering a new iPhone may still be using an older, unpatched one. That could make them vulnerable simply by opening the preorder page.

Safari can report an older iOS version to websites, so an updated iPhone may still load the attack code. That doesn’t mean the exploit can break in: Apple says updated devices are protected against the reported attacks.

How to stay safe

• Keep your iPhone updated. Go to Settings > General > Software Update and install the latest version available. Turn on Automatic Updates there too. Apple says updated devices are protected against the reported DarkSword attacks.
• Check offers without opening unfamiliar links. Go directly to Apple or a retailer you know by typing its address yourself. A preorder link in an ad, message, or social post could start an exploit attempt as soon as the page opens.
• Opened this page? Restart your iPhone after updating it. We found no code that automatically brings the payload back after a reboot. Restarting cannot undo any data already taken.
• Keep a cryptocurrency wallet on that phone? Take precautions from a trusted device. If the phone may have been compromised and you keep a wallet on it, create a new wallet with a new recovery phrase and move the funds. For an exchange account, secure the account and contact the exchange.
• Change potentially exposed passwords from a trusted device. Start with email, your Apple Account, banking, and crypto accounts, and turn on two-factor authentication.
• Report the page. Save its URL and any screenshots without reopening it, and report it to your national cybercrime reporting service.
• Check a suspicious offer before you act. Scam Guard can give a verdict on a screenshot or link. On desktop, Browser Guard blocks the fake preorder page we analyzed; web protection in Malwarebytes Premium blocks it too.

Indicators of compromise

• pnmrud[.]cc — command-and-control and collection server
• cloud[.]cmatgldn[.]click — ad click and conversion tracker

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

Article URL: https://sheets.works/data-viz/apple-in-colour

Comments URL: https://news.ycombinator.com/item?id=49890546

Points: 1

# Comments: 0

The malware framework uses a modular architecture and a custom executable file format for long-term persistence.

The post Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft appeared first on SecurityWeek.

Article URL: https://wajo.ai/

Comments URL: https://news.ycombinator.com/item?id=49890528

Points: 1

# Comments: 0

Article URL: https://venturebeat.com/technology/stanford-and-nvidias-open-clm-8b-caches-reusable-agent-actions-and-runs-up-to-9x-faster-than-jev-in-tests

Comments URL: https://news.ycombinator.com/item?id=49890520

Points: 1

# Comments: 0

Article URL: https://github.com/abue-ammar/tinycast

Comments URL: https://news.ycombinator.com/item?id=49890519

Points: 1

# Comments: 0

Article URL: https://twitter.com/teslaeurope/status/2104844301461262602

Comments URL: https://news.ycombinator.com/item?id=49890515

Points: 1

# Comments: 0

Article URL: https://boringsql.com/posts/repack-concurrently-costs/

Comments URL: https://news.ycombinator.com/item?id=49890508

Points: 1

# Comments: 0

Article URL: https://simtx.net/

Comments URL: https://news.ycombinator.com/item?id=49890503

Points: 1

# Comments: 0

Article URL: https://www.abc.net.au/news/2026-09-29/drunk-ai-testing-unsw-research/107208104

Comments URL: https://news.ycombinator.com/item?id=49890502

Points: 2

# Comments: 0

Article URL: https://www.thetransmitter.org/consciousness/revisiting-the-neural-correlates-of-consciousness/

Comments URL: https://news.ycombinator.com/item?id=49890490

Points: 2

# Comments: 0

Trying to figure out the recurring use cases people have discovered.

Comments URL: https://news.ycombinator.com/item?id=49890470

Points: 1

# Comments: 0

Article URL: https://www.nature.com/articles/s41586-026-10999-2

Comments URL: https://news.ycombinator.com/item?id=49890457

Points: 1

# Comments: 0

I spend most of my time coding with agents, often from my phone. Off-the-shelf tools like Herdr and Orca look cool, but I didn’t want to give up owning and customizing my setup.

I built Overmux so I could build an experience similar to Orca on top of my existing tmux workflow, mixing terminals with custom web UIs.

Nearly everything in Overmux is a plugin. The idea is to support different multiplexers like tmux, Zellij, and Superlogical, and terminal renderers like xterm.js and Ghostty, rather than imposing a single workflow.

You could also hook up cloud infrastructure, so your workspace isn’t limited to what’s running on your dev machine.

It’s an experimental beta. The best place to start is the short demo video in the README.

Cheers,

Richard

Comments URL: https://news.ycombinator.com/item?id=49890454

Points: 1

# Comments: 0

Article URL: https://lightbulbcomputer.com/

Comments URL: https://news.ycombinator.com/item?id=49890450

Points: 2

# Comments: 0

Article URL: https://now-next.nl/en/insights/multi-tenant-postgresql-indexes-tenant-id-first/

Comments URL: https://news.ycombinator.com/item?id=49890443

Points: 1

# Comments: 0

Article URL: https://lexidesk.ai/knowledge-hub/lexidesk-launches-mcp-integration-to-eliminate-the-black-box-in-law-firm-intake-analytics

Comments URL: https://news.ycombinator.com/item?id=49890412

Points: 1

# Comments: 0