Feed aggregator

SBOM pioneer Allan Friedman joined the SecurityWeek Podcast to discuss why knowing what is inside software is only the beginning, how AI is complicating software supply chain visibility, and what organizations should be doing with SBOM data once they have it.

The post Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next appeared first on SecurityWeek.

Google opened Carbon to paying developers and businesses as DeepMind used agents built on it to prove libsignal security guarantees.

The post Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code appeared first on SecurityWeek.

Iran has been officially accused by France of being responsible for cyber attacks last month that meddled with supermarket freezers, causing some to catch fire. Read more in my article on the Hot for Security blog.

We’ve written before about what Meta’s Ray-Ban smart glasses can see and hear, and who might get to use that information. Those worries focus on how the glasses handle information during normal use. A security researcher has now shown how to bypass a safeguard meant to stop unauthorized software running on them.

Vulnerability researcher Paula, known online as pamoutaf, found a way to run her own software on a pair of Ray-Ban Meta glasses. For the technical details I’ll gladly refer you to her own post about it.

The glasses are controlled by the Meta AI app on the owner’s phone. Developers can add their own apps to the glasses through a developer tool, and the phone sends that software to the glasses to install.

The glasses were supposed to check that the software really came from Meta. In older firmware (up to and including version 126), they didn’t check, so the researcher could swap in an app of her own.

Meta introduced a check in firmware version 127 to verify the app’s digital signature to prove that it came from Meta . The researcher found the on/off switch for that signature check came from a settings file passed along by the phone. The glasses only checked the file was correctly formed, not whether it had been tampered with. Changing a single byte in the file turned the signature check off.

Once her app was running, she could send commands to the glasses from the paired phone over a wireless connection.

The glasses have a camera, microphones and a wireless connection, and they sit on your face all day. A wearable that can be made to run unapproved code goes beyond a privacy-policy question. It becomes a security question about who controls the device. As we’ve seen, some cheaper smart glasses already are a security disaster.

In this case the person running the code would be the person that controls the phone. If malicious software running on the glasses could access the camera or stored recordings, it could potentially send footage to an attacker’s server. Pamoutaf’s research doesn’t demonstrate that scenario, but it raises questions about what that software might be able to access.

In her post she promised a follow-up exploring other potential ways to attack the glasses.

How to stay safe

Keep the glasses’ firmware and the Meta AI app updated, and avoid unofficial apps or modifications.

If smart glasses are just another gadget to you, I’d leave them on the shelf. If you rely on them as an accessibility aid, you deserve technology that helps you without putting your privacy or other people’s at risk.

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

.wp-block-kadence-advancedbtn.kb-btns97520_6de029-2f{gap:var(--global-kb-gap-xs, 0.5rem );justify-content:flex-start;align-items:center;}.kt-btns97520_6de029-2f .kt-button{font-weight:normal;font-style:normal;}.kt-btns97520_6de029-2f .kt-btn-wrap-0{margin-right:5px;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button{color:#555555;border-color:#555555;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{color:#ffffff;border-color:#444444;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button::before{display:none;}.wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:hover, .wp-block-kadence-advancedbtn.kt-btns97520_6de029-2f .kt-btn-wrap-0 .kt-button:focus{background:#444444;}ul.menu .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{width:initial;}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button{color:var(--color-neutral-10);background:var(--color-brand-blue-60);border-top-left-radius:40px;border-top-right-radius:40px;border-bottom-right-radius:40px;border-bottom-left-radius:40px;padding:var(--kb-btn-padding);margin:var(--kb-btn-margin);box-shadow:1px 1px 2px 0px rgba(0, 0, 0, 0.2);}.wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:hover, .wp-block-kadence-advancedbtn .kb-btn97520_074a67-a8.kb-button:focus{box-shadow:0px 4px 0px 0px var(--color-brand-blue-90);}Try it now

Designed for cybersecurity leaders, this immersive two-day virtual event is your premier destination to discuss, share, and learn innovative risk management and defense strategies defining the modern enterprise.

The post Today: CISO Forum Virtual Summit 2026 – Join Global Cybersecurity Leaders appeared first on SecurityWeek.

The cybersecurity startup deploys a dedicated guardian agent for every AI agent in an organization’s environment.

The post WhiteMatter Raises $20 Million in Series A Funding appeared first on SecurityWeek.

SAP has published 42 new and updated security advisories, including nine that address critical-severity vulnerabilities.

The post SAP Patches Critical ICM2SHELL, ProxyGate Vulnerabilities appeared first on SecurityWeek.

Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials.

The post Over a Dozen Organizations Hit in Qubole Supply Chain Attack appeared first on SecurityWeek.

On November 9, Google issued a security update to Chrome’s Stable channel for Windows, Mac, and Linux. The update is rolling out over the coming days and weeks.

Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 157.0.8103.50/.51 for Windows and Mac and 157.0.8103.50 for Linux. It includes nine security fixes, including one for an actively exploited zero-day vulnerability.

A zero-day vulnerability is a security flaw disclosed or exploited before an official fix becomes available.

Hong Kong’s Computer Emergency Response Team Coordination Centre (HKCERT) rates the overall risk as “Extremely High.” Its bulletin says some of the vulnerabilities address in the update could allow denial of service, security restriction bypass, and remote code execution.

How to update Chrome

The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.

If you don’t want to wait for the rollout to reach you, you can update manually. Open About Google Chrome from Chrome’s Settings or Help menu. Chrome will check for updates and download any available update. If prompted, click Relaunch to apply it.

Chrome 157.0.8103.51 is up to date

You can find an explanation of the version numbering system and step-by-step instructions in our guide: How to update Chrome on every operating system.

Google also released Chrome 157.0.8103.50 for Android on November 9. Google says it includes the same security fixes as the desktop release unless otherwise noted. Android users should check Google Play for the update.

Technical details

Let’s take a closer look at that zero-day vulnerability.

Google says it was notified about a vulnerability by an unnamed third party on November 6. The vulnerability is tracked as CVE-2026-125350 and rated as a high-severity use-after-free vulnerability in Chrome’s XML component.

XML is a data format Chrome uses to read and process certain kinds of structured web content. XML stands for Extensible Markup Language: it labels information with tags, rather like HTML, but allows authors to define their own tags to describe their data.

A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code.

Google only says that it is “aware that an exploit for CVE-2026-125350 exists in the wild.” It has not named the attackers, the targets, the delivery method, or what the exploit can do.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{flex-direction:column;}.kadence-column482817_d8e68a-90 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{background-color:rgba(255, 229, 229, 0.85);}.kadence-column482817_d8e68a-90 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column482817_d8e68a-90{position:relative;}@media all and (max-width: 1024px){.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column482817_d8e68a-90 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}} In this article

• Store-added reviews and countdowns that keep resetting make products look popular and deals urgent
• Missing contact details can make it harder to resolve a problem with an order
• AI-generated images and unverified brand partnerships promote products with no licensing information
• Learn how to check an online seller before you buy

Advent calendar buying guides are already appearing across the holiday shopping coverage this year. Social media can also put unfamiliar sellers directly in shoppers’ feeds. We found several stores using the same website template, product images with an AI-generated content watermark, and a TikTok account using one store’s branding to link straight to its product page.

We examined stores selling a Legend of Zelda music calendar, a Michael Jackson music calendar, a Lord of the Rings figure calendar, and Harry Potter character plant pots. Other stores, including one selling a Metallica calendar, use the same layout, low-stock warning, and recycled marketing lines. We found no licensing information on the stores, which is reason enough to avoid them.

Fake reviews and countdowns create a false sense of demand

Each store sells a single product. Its page surrounds polished product images with urgency cues: a sale that ends today, a low-stock warning, a five-minute cart reservation timer, a count of orders placed in the last day, and star ratings with thousands of reviews. Testimonials appear underneath, with “verified buyer” badges and timestamps such as “three hours ago.”

None of it is connected to anything. The ratings, review counts, and testimonials are entered into the site theme manually, rather than generated by a review system. The timestamps don’t change, and countdowns reset and run again—on some stores, every day.

Checkout runs through Shopify. That doesn’t establish whether orders will arrive or match their descriptions, and our investigation found no evidence that these pages were designed to steal card details. The risks we can support are misleading sales claims and the possibility of paying for something that never arrives or is very different from what was advertised. Several stores also offer optional checkout add-ons, including shipping protection, a queue-skip fee, and a mystery gift. On one store, these add-ons total nearly $35.

The Zelda calendar’s description contradicts itself

The clearest finding needs no technical analysis. The listing says each of the 25 discs holds a small chip storing your track data, and that the included player reads it and plays music through a built-in speaker with no app, no subscription and no Wi-Fi. Elsewhere on the same page it says the discs work with Spotify, Apple Music and YouTube, and that you can re-link any disc to a new song using a chip-writing app on your phone.

These claims cannot all be true. A device without a network connection can’t stream music from those services. And the instructions for linking discs to new songs suggest that each chip stores a link to a track, rather than the track itself. That’s how the legitimate version of this product works, according to our research: the chip holds a link, and a phone plays the music. Someone appears to have copied that mechanism and bolted a fictional standalone speaker onto it.

The bundle pricing also doesn’t add up. Two bundles claim savings of $15 and $33, but the prices shown below them work out to about $19 and $43 in savings.

The stores are copies of one another

Despite their different names, the stores we examined are nearly identical. They use the same commercial theme version and share an internal fingerprint indicating that their theme files are copies of one another. They also block right-clicking and access to developer tools.

The most direct link was left behind by accident, in that one store’s theme is still named after the file it was exported from, and that filename includes the web address of another store in the group. Other pages contain leftover text from a previous shop, including a warranty promising to replace costumes that don’t inflate properly and a scrolling banner with the unedited placeholder “use code X for X percent off.”

The stores’ files are timestamped from mid-July to the second week of September, with the newest store only days old when we examined it. Most merchant accounts are registered in Romania, while prices are shown in dollars. None of the calendar stores we examined listed a business address or phone number.

The pattern runs well past unlicensed character merchandise. We found advent calendars for fishing lures, squishy toys, charm bracelets, and wearable jumpers, with the same countdowns, stock warnings, and paid add-ons. Most appear to sell real, inexpensive goods at a steep markup. Their add-on prices differ, so we can’t conclude that the same person runs all of them. The evidence points to a shared sales playbook, not necessarily a shared owner.

What the evidence shows, and what it doesn’t

Product images from two of the calendar stores triggered a provenance checker for a watermark, indicating they were produced with OpenAI tools. The filenames agree: across three stores every product image follows the same automated naming pattern, and one store’s entire photography set is timestamped to a single afternoon.

A TikTok account uses one store’s name and branding and links directly to its product page. Several videos claim the store is collaborating with Walmart. They show retail scenes, including an oversized character figure outside a store and pallets of branded boxes. We found no evidence of such a partnership. The videos also depict scenes that don’t appear to be real. Combined with the shared website template and the filename linking two stores, this suggests that one operator or a closely connected group may be involved. It doesn’t establish who is behind the stores.

How to spot a questionable store before you pay

In our survey earlier this year, 22% of respondents said they had been “misled by AI-generated photos or product reviews.”
Here are some checks that can help you spot warning signs.

• Be wary of endless urgency. If a sale keeps “ending today” or low-stock warnings never change, don’t treat them as proof of a genuine deal.
• Check that the product could exist. Search the product type and read how the real version works. If the listing claims something the technology can’t do, stop there.
• Don’t arrive through a link. These stores sell largely through social video. Search the brand name separately and look for history, press, or customers outside its own website.
• Treat partnership claims as claims. A video saying a brand is stocked by a retailer isn’t evidence that it is. Partnerships are announced by the retailer too, not only by the seller.
• Look for a real business. A postal address, company registration and working phone number are easy for a legitimate seller to provide and were absent from these.
• Reverse-image search the photos. Generated images usually have no history anywhere else online. A complete absence of results is itself informative.
• Read the small print against itself. If a calendar’s warranty talks about inflatable costumes, the page wasn’t written for the product you’re buying.
• Check the spelling, including on the box. We found a misspelled artist name in a product title, a mangled savings line, and a calendar with the word spelled “calindar” on the packaging artwork itself. A real manufacturer proofreads its own box.
• Pay with a method that offers buyer protection. A credit card or payment service with buyer protection gives you a route to a refund. Bank transfers can be harder to reverse.

Tools that help

Malwarebytes Browser Guard blocks scam sites, which can help when a link appears in your feed before you’ve had a chance to look up the seller.

Malwarebytes Scam Guard lets you check a suspicious link, message, or screenshot when something feels off but you can’t say why.

If a purchase leads to follow-up texts or calls about delivery fees, customs charges, or a refund, Malwarebytes Scam Number Check can tell you whether the number has been reported. A follow-up message can turn a bad purchase into something worse.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Anthropic says Mythos 5.2 improves vulnerability discovery while showing a lower tendency to escape sandboxes in controlled tests.

The post Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes appeared first on SecurityWeek.

Attackers could exploit the flaws for remote code execution, credential theft, and administrator account creation.

The post N-able Takes N-central Offline as Researcher Drops Over 30 Zero-Days appeared first on SecurityWeek.

CISA has added CVE-2026-123218 and CVE-2026-116779 to KEV, urging federal agencies to patch them within three days.

The post IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks appeared first on SecurityWeek.

France summoned the Iranian ambassador and said it would seek European sanctions against those responsible for the attack

The post France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators appeared first on SecurityWeek.

A researcher’s trawl through publicly available code found private information was at risk across multiple departments.

The high-severity use-after-free in Chrome’s XML component was reported anonymously on November 6 and is already exploited in attacks.

The post Chrome Update Patches Exploited XML Zero-Day, Eighth This Year appeared first on SecurityWeek.

Article URL: https://discourse.julialang.org/t/formalizing-julia-in-lean-and-finding-400-bugs-in-base/140243

Comments URL: https://news.ycombinator.com/item?id=50436297

Points: 1

# Comments: 0