Feed aggregator

Article URL: https://www.pcgamer.com/software/ai/educational-game-dev-program-cancelled-because-students-were-submitting-games-made-entirely-with-ai/

Comments URL: https://news.ycombinator.com/item?id=50453586

Points: 3

# Comments: 0

Article URL: https://community.vercel.com/t/chat-sdk-agents-can-now-stream-generative-ui-with-json-render/1000000182

Comments URL: https://news.ycombinator.com/item?id=50453578

Points: 2

# Comments: 0

Article URL: https://conversationswithtyler.com/episodes/terence-tao/

Comments URL: https://news.ycombinator.com/item?id=50453571

Points: 2

# Comments: 0

Attackers could exploit them for command execution, memory overwrites, and privilege escalation.

The post Asus, Zoom Release Security Patches appeared first on SecurityWeek.

Changing your password should be part of recovering a compromised account. The developers of Remus Stealer are advertising a Gmail-reading feature they claim can survive that step and even session revocation.

That is a serious claim. It is not, however, a demonstrated capability in the published investigation. Threat intelligence company Hudson Rock examined Remus’s promotional material and questioned both its developer and a self-described customer. Its conclusion is more cautious than the sales pitch: The material depicts a mailbox-reading interface, but it does not establish that Remus can retrieve new messages after an account has been comprehensively secured. Nor does it establish a Gmail zero-day vulnerability.

What Remus is advertising

According to Hudson Rock, Remus’s version 1.3.9 announcement promotes a feature that lets operators open a compromised Gmail mailbox directly from the service’s dashboard. The supplied screenshots show message lists, individual emails, and a “Mail” option attached to records of compromised devices.

The announcement makes several additional claims:

• Operators can intercept email verification codes without collecting browser cookie files.
• Password changes and session revocation do not stop access.
• Mailbox access can be shared with other operators through links.

Asked how it works, the developer described interaction with browser memory and said the malware executes and exits. The developer also claimed the service avoids Google’s anti-fraud checks, but withheld the technical details needed to assess that assertion.

Remember, those are marketing statements from the seller of a criminal service, not independently verified findings.

What the evidence shows

Hudson Rock spoke with a person who had publicly endorsed the feature and described using it. That source said mailbox access continued after browser closure, a session reset, and a Google password change.

But the correspondence does not document exactly which sessions were reset, the account settings involved, or the timing of the password change and subsequent access. The source’s independence was not established, and the statements were not accompanied by a controlled test.

Hudson Rock explicitly states that its report includes neither reverse engineering of the new feature nor controlled post-recovery validation.

Breaches happen every day. Don’t be the last to know.

SEE PLANS

Can Gmail access survive a password change?

Yes. Under some conditions, continued access after a password change is possible.

Google documents that password changes ordinarily invalidate access tokens and refresh tokens used by applications with Gmail permissions. These tokens allow an application to access an account without asking for the password on every request. Token theft alone therefore does not establish that Remus can maintain access after a password change.

What Gmail users should do

The uncertainty around Remus’s claims is not a reason to abandon password changes. It is a reminder that recovering from an infostealer infection involves more than changing a password.

If you suspect an infection or unauthorized Gmail access:

• Use a separate, trusted device to begin securing the account promptly. Disconnect the suspected infected device from the internet and remove the malware before signing in to accounts on it again.
• Change your Google password, review recent security events and signed-in devices, and remove unfamiliar access. Check applications with access to the account as well as device sessions.
• Inspect Gmail settings for unauthorized forwarding, filters, delegated mailbox access, and changes to remote mail access. Check your recovery email, recovery phone number, and verification methods too.
• Run trusted security software on the affected device. Google notes that resetting the computer and reinstalling its operating system is another option when dealing with harmful software.
• Review other important accounts that rely on the mailbox for sign-in or recovery, especially if you see unfamiliar verification or password-reset messages.

A mailbox can be a stepping stone to other accounts because it receives recovery links and verification messages. But the Remus screenshots do not demonstrate a universal multifactor-authentication bypass, the ability to send mail, or complete control over every account associated with that address.

Remus’s claimed persistence remains unverified. If you suspect an infection, secure your account and clean the affected device. Real-time anti-malware protection can help prevent infostealer infections.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Attackers could exploit the bugs to tamper with certificate entries, achieve remote code execution, and compromise hosts.

The post Citrix, Ivanti Patch Critical and High-Severity Vulnerabilities appeared first on SecurityWeek.

The Series C round will fund international expansion and more autonomous features for the firm’s device security platform. 

The post Finite State Raises $27 Million to Secure Software and Firmware in Connected Devices appeared first on SecurityWeek.

.kadence-column487343_5a0625-ad > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column487343_5a0625-ad > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column487343_5a0625-ad > .kt-inside-inner-col{flex-direction:column;}.kadence-column487343_5a0625-ad > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column487343_5a0625-ad > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.83);}.kadence-column487343_5a0625-ad > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column487343_5a0625-ad{position:relative;}@media all and (max-width: 1024px){.kadence-column487343_5a0625-ad > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column487343_5a0625-ad > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}In this article

• Muse’s maker used about 50,000 hours of users’ brainwave recordings to train AI without explicitly telling them
• Stripping names might not be enough to make brainwave data anonymous; researchers have identified individuals from EEG recordings
• Check privacy policies and ask about opt-out and data deletion

Technology companies have spent years trying to get into your head for profit. Now they’re doing it literally. The maker of Muse, a headband that measures brain activity during sleep and meditation, used users’ brainwave data to train AI without explicitly telling them, an investigation has revealed.

Companies sell these consumer sleep bands to help you better understand what your brain does when you sleep and meditate. However, according to an investigation in Science magazine, they’re picking up a little understanding of their own on the side.

The year-long investigation found that Canadian company Interaxon, which makes the Muse sleep and meditation headband, was using the data that it collected from users’ brains to train AI. The company used about 50,000 hours of electroencephalography (EEG) recordings, which measure the brain’s electrical activity, to train a “brain foundation model.”

AI models trained with large amounts of brainwave data from different people can spot patterns in brain activity. For example, a model might learn to recognize patterns associated with seizures.

Researching such outcomes is laudable, but only if you first tell the people whose EEG data is being used for the training. Interaxon didn’t.

This is your brain on an inadequate privacy policy

When Science questioned Interaxon about the issue, its chief marketing officer Nadia Kumentas acknowledged that users should be explicitly informed about the AI training. The company updated its privacy policy, which now says de-identified data is used to train machine learning models.

Collecting data through devices like this is tempting for companies because brainwave data is otherwise difficult to obtain and therefore incredibly valuable.

No wonder, then, that it isn’t the only neuraltech company facing questions about its data practices. The publication reviewed 57 companies that collect brain data, and found that only six explicitly said they wouldn’t sell users’ brain data. More than two-thirds allow brain data to pass to a new owner if they are acquired. Eleven of them only had a privacy policy for website visitors, and four had no policy at all.

To its credit, Interaxon removed names and email addresses from user EEG data before using it for training. However, those users’ data has already helped shape a model trained without explicitly telling them. Removing its influence after the fact is extremely difficult.

But is such “de-identification” enough? An academic study conducted by the University of South-Eastern Norway this year found that EEG recordings and derived features can contain sensitive patient-specific information. It said that this can create privacy risks when that data is shared across clinical and research environments. It added:

“Conventional anonymization methods are often insufficient for high-dimensional biomedical signals, since removing direct identifiers does not necessarily prevent re-identification, linkage, or inference risks.”

Another study by researchers at Ben-Gurion University, Israel, found that analyzing resting-state EEG recordings could shed light on personality traits and cognitive abilities. Resting-state EEG identified users 88.4% of the time, according to a 2018 study by researchers at Korea University. And a University of Southern California study claimed that EEG data could reveal mental health status, neurological conditions, and even substance use history.

These findings do not establish what can be inferred from Muse recordings specifically. Consumer headbands generally have fewer electrodes than clinical EEG systems.

This isn’t the first review of the consumer neurotech industry to reveal some worrying trends. A 2024 Neurorights Foundation report found that 29 of 30 companies it surveyed appeared to have access to consumers’ neural data and had provided “no meaningful limitations to this access.”

The law is still catching up to all this. The Illinois Biometric Information Privacy Act (BIPA) counts your fingerprint, voiceprint, or face geometry among other things as biometric identifiers, but EEG data doesn’t make the cut. However, Colorado and California do now treat neural data as sensitive.

These concerns extend beyond brainwave data. In a Malwarebytes survey of newsletter readers, 90% worried about AI using their data without consent, while 92% were concerned about corporations using their personal data inappropriately.

What Muse owners can do

Do you use a sleep band or another neurotech device? Consider that your brain data might be used for more than you imagined. And if the company goes bust and/or gets acquired, it might pass to another owner. That’s exactly what happened with genetic testing company 23andMe.

With this in mind, check the manufacturer’s privacy policy, and if you can’t find one, ask it directly. Ask whether your EEG data is used to train AI, whether you can opt out, and whether you can delete recordings already collected.

If those options aren’t available, consider whether you’re comfortable continuing to use the device.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

The massive drop comes after the company integrated frontier AI models into its product security testing.

The post Fortinet Patches Nearly 100 Vulnerabilities appeared first on SecurityWeek.

Founded by three ex-IDF Unit 8200 intelligence officers, Bay is launched to provide a control plane for AI agents.

The post Bay Raises $50 Million to Control What Enterprise AI Agents Can Do appeared first on SecurityWeek.

Microsoft’s November Patch Tuesday fixes more than 1,000 Microsoft vulnerabilities, including an Outlook flaw that attackers are already exploiting to steal authentication information.

The release also fixes 48 critical remote code execution (RCE) vulnerabilities that could allow attackers to run code on affected machines, in some cases without user interaction.

While Windows updates address many of this month’s vulnerabilities, readers should check for Office updates as well: the exploited Outlook flaw is patched through the affected Office products.

To do this, follow these instructions:

1. Open an Office application, such as Word.
2. Go to File > Account. In Outlook, this may appear as Office Account.
3. Under Product Information, select Update Options > Update Now.
4. If necessary, select Enable Updates first. If the update controls are missing on a work device, contact your organization’s IT team; updates may be centrally managed.

During the update, you may be prompted to save your work (check your open documents). Afterward, you should see something similar to this:

Office updates installedHow to apply Windows patches and check if you’re protected

These updates fix security problems and help keep your Windows PC protected. Here’s how to make sure you’re up to date:

• Click the Start button, then open Settings.
• Select Windows Update (usually at the bottom of the menu on the left).
• Click Check for updates. Windows will search for the latest security updates. If you’ve enabled Get the latest updates as soon as they’re available under More options, you may be prompted to restart immediately to complete the update.
• You may find the update (Security Update KB5132061) already installed.

Windows Update history

• If updates are available, they’ll start downloading automatically. When they’re ready, click Install or Restart now if prompted. Your computer may need a restart to finish the update.
• After restarting, go back to Windows Update and check again. If it says You’re up to date, you’re all set.

Technical details

As usual, we’ve selected a few vulnerabilities to highlight for readers interested in the technical details.

We’ll start with CVE-2026-124194, an Outlook vulnerability that attackers are already exploiting. It has a CVSS score of 6.5 out of 10 and could expose authentication information that attackers could use to impersonate the user. From Microsoft’s description:

“Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.”

To exploit this vulnerability, an attacker must convince someone to open a specially crafted message file in an affected version of Outlook. This can cause Outlook to connect to an attacker-controlled network location without its usual external-content warning, potentially exposing authentication information (the user’s NTLMv2 hash) that could be used to impersonate them.

As this vulnerability is being exploited in the wild, updating Office as described earlier is a priority.

One other vulnerability I want to highlight is CVE-2026-116928 (CVSS score 9.8 out of 10):

“Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.”

An out-of-bounds write vulnerability allows a program to write outside the memory boundaries it is supposed to use, which can lead to memory corruption or place malicious code in memory and trick the system into running it.

Microsoft describes an attack in which a malicious email attachment is processed automatically for indexing by Exchange Server. In that scenario, the recipient does not need to open the email or attachment. Processing it could be enough to let the attacker run code with the permissions of the affected service. Microsoft has not reported exploitation of this vulnerability.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Created by Zerto and Kashya veterans, the startup has launched a platform designed to recover whole cloud applications. 

The post Dreeze Emerges From Stealth With $33M to Rebuild Cloud Apps After Cyberattacks appeared first on SecurityWeek.

Pre-Patch Tuesday advisories were published by VDE CERT, Phoenix Contact, Johnson Controls, and Hitachi Energy. 

The post ICS Patch Tuesday: Siemens Flags High-Severity Flaws, Node2Shell Exposure appeared first on SecurityWeek.

Article URL: https://hamy.xyz/blog/2026-11_just-write-rust

Comments URL: https://news.ycombinator.com/item?id=50451279

Points: 1

# Comments: 0

Article URL: https://torrentfreak.com/nintendo-targets-picofly-switch-modchip-firmware-in-github-dmca-takedown/

Comments URL: https://news.ycombinator.com/item?id=50451252

Points: 1

# Comments: 0

Article URL: https://www.telegraph.co.uk/world-news/2026/11/06/earliest-polar-vortex-collapse-threatens-weather-chaos/

Comments URL: https://news.ycombinator.com/item?id=50451247

Points: 2

# Comments: 0

Article URL: https://wordloom.billpg.com/

Comments URL: https://news.ycombinator.com/item?id=50451228

Points: 1

# Comments: 0

Article URL: https://github.com/dev-kleo/OpenHighlights

Comments URL: https://news.ycombinator.com/item?id=50451210

Points: 1

# Comments: 0

Article URL: https://www.red5.net/blog/xdn-architecture-traditional-cdns-need-not-apply/

Comments URL: https://news.ycombinator.com/item?id=50451207

Points: 1

# Comments: 0