Feed aggregator

Article URL: https://unsung.aresluna.org/no-such-thing-as-too-fast/

Comments URL: https://news.ycombinator.com/item?id=49021774

Points: 1

# Comments: 0

jupyterlite-numbl-kernel is a JupyterLite kernel for numbl (https://numbl.org). It demonstrates running MATLAB syntax in Jupyter, client-side in the browser (no MATLAB or Octave needed). The live demo is a static site hosted on GitHub Pages... nothing to install:

https://concept-collection.github.io/jupyterlite-numbl-kerne...

Numbl is a lightweight (TypeScript + wasm + optional native bridge to OpenBLAS) numerical computing environment that tries to be as compatible as possible with MATLAB syntax. It has 500+ built-in functions and runs both in the browser and on the command line. I am developing it with Dan Fortunato at the Flatiron Institute.

Why do this? There are many codebases that are written exclusively in MATLAB, require a MATLAB license, and cannot be run client-side in the browser. One such example is chebfun (https://www.chebfun.org/), whose heavy use of MATLAB's object-oriented features means it does not run on Octave. Right now, numbl is mature enough to run most of Chebfun. The capabilities will expand over time as we implement more builtins.

I make a lot of static web applications (many of them proofs of concept) and I love trying to get code to run client-side in the browser. I think it's great for teaching, sharing ideas and methods, and communicating science with interactive views.

Caveat: numbl of course is not MATLAB. It covers a large, tested subset of the language though.

Kernel source: https://github.com/concept-collection/jupyterlite-numbl-kern...

Numbl source: https://github.com/flatironinstitute/numbl

Comments URL: https://news.ycombinator.com/item?id=49021763

Points: 1

# Comments: 0

Article URL: https://blog.jsbarretto.com/post/languages-as-latent-spaces

Comments URL: https://news.ycombinator.com/item?id=49021760

Points: 1

# Comments: 0

Article URL: https://avc.xyz/the-clarity-act

Comments URL: https://news.ycombinator.com/item?id=49021757

Points: 2

# Comments: 0

Article URL: https://purplesyringa.moe/blog/log-is-non-monotonic-in-php-and-lua/

Comments URL: https://news.ycombinator.com/item?id=49021756

Points: 1

# Comments: 0

Article URL: https://www.goto10retro.com/p/atari-2600-tv-ads

Comments URL: https://news.ycombinator.com/item?id=49021749

Points: 2

# Comments: 0

Article URL: https://etymology.substack.com/p/slop-realism

Comments URL: https://news.ycombinator.com/item?id=49021743

Points: 1

# Comments: 0

Article URL: https://legallayer.substack.com/p/when-does-distilling-gpt-become-theft

Comments URL: https://news.ycombinator.com/item?id=49021740

Points: 1

# Comments: 0

The latest investment round brings the total raised by Abstract to nearly $50 million.

The post Abstract Raises $25 Million to Expand Composable Security Operations Platform appeared first on SecurityWeek.

SentinelOne’s new benchmark, built on the Fast16 case, shows which AI models can sustain a malware investigation and which cannot.

The post Nuclear-Sabotage Malware Benchmark Trips Up Most Frontier AI Models appeared first on SecurityWeek.

Many adults are unable to access digital government services in the UK, leading the digital divide to widen

The parent company of Google and YouTube has increased its debt portfolio from $16bn to $100bn to pay for AI infrastructure

A car alarm vendor’s coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms, many affected drivers don’t even know they have one installed.

The device is the KARR Security System, a Bluetooth-enabled aftermarket alarm built by Acrisure Protection Group. It’s installed by dealers, primarily at Honda, Toyota, Mazda, Ford, and Jeep dealerships in Southern California.

Aftermarket car alarms are a strange corner of the auto industry. Dealers install them in your car before you ever see the vehicle, then try to sell you the subscription afterward. Say no and the hardware still stays put. According to researchers at the University of California San Diego, KARR systems are installed in about 2.2 million American vehicles, and around half of owners don’t even know they’re there.

The research team, led by computer science professor Aaron Schulman, investigated the system and found a single design flaw repeated across nearly a decade of installations.

Every KARR device shares the same authentication key, and it’s stored in plain text inside the KARR smartphone app. Extract it once and you can communicate with any KARR-equipped vehicle made since 2017. That is what the researchers did.

What the attack actually does

Standing within about five yards of a target vehicle, an attacker using the researchers’ proof-of-concept tool can unlock the vehicle and even disable its ignition, potentially leaving a driver stranded. The only outward sign is a brief beep and flicker when the command is sent. The owner receives no alert.

The location tracking issue is arguably even more concerning. KARR units continuously broadcast Bluetooth identifiers, so crowdsourced radio databases like WiGLE have been logging their locations for years. Feed a device’s identifier into WiGLE and you can build a picture of where that car has been parked. It’s a stalker’s dream. The researchers also demonstrated a “mayhem” mode that triggers horns and lights across multiple parked vehicles at once.

Owners who declined the paid service and assumed the hardware was inactive were wrong. According to the researchers, dormant units accept a single Bluetooth wake-up command before exposing the same functionality.

Eighteen months, one conference deadline

UC San Diego disclosed the flaw to Acrisure in January 2025, but a firmware fix did not arrive until July 20, 2026—roughly 18 months later, and only weeks before the team was due to present its findings at the DEF CON hacker conference next month. Acrisure has publicly characterized the real-world risk as low.

Compare that with Subaru’s response to a similar connected-car flaw disclosed last year. Researchers found that Subaru’s Starlink admin portal could hand over any car to anyone armed with a license plate and the owner’s last name or email. From there, someone could unlock the doors and start the engine—or dig into a year of location history accurate to within five meters.

The underlying problems there were an insecure password-reset endpoint and weak protection against two-factor authentication (2FA) bypass. Subaru fixed the issues within 24 hours.

The fix can’t reach half its audience

The awkward part here is that the patch ships through the KARR companion app, which only paying customers would ever have downloaded. The researchers estimate that at least half of car owners with these devices installed didn’t ask for it, meaning that there’s little chance they’ll run the app or update the firmware. Roughly a million people cannot patch what they do not know exists. This includes many folks who might have purchased a KARR-equipped vehicle on the second-hand market.

How to check your car

Look for a KARR sticker on the driver-side window, or one reading “SWDS” for SouthWest Dealer Services (an Acrisure subsidiary). Then check the underside of the dashboard for a small button with a blinking light, according to Wired. If you find one, download the KARR app and apply the firmware update—even if you never knowingly signed up for the alarm in the first place.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

HermeticReader is the name given to a recently disclosed vulnerability in the Adobe Acrobat PDF extension for Chrome, tracked as CVE-2026-48294.

Researchers discovered the issue in early June 2026 and reported it to Adobe, which patched the flaw over a single weekend. They found that a single visit to a malicious website could turn Adobe’s Acrobat Chrome browser extension into a silent spy on your WhatsApp Web conversations.

The exploit worked across platforms, meaning any Windows, macOS, Linux, or ChromeOS device was potentially vulnerable if it met three conditions:

• It used Google Chrome or another Chromium-based browser compatible with Chrome extensions, which account for around 78% of the browser market.
• It had the vulnerable Adobe Acrobat PDF extension installed and enabled. The extension has reportedly been installed on around 329 million browsers.
• It had at least one WhatsApp Web tab open or the user was logged into WhatsApp Web when they visited a malicious website.

HermeticReader did not exploit a bug in WhatsApp itself. It also didn’t require malware on the device or stolen usernames and passwords.

There are plenty of potential victims. And if these conditions were met, a visit to a specially crafted website could give an attacker access to your WhatsApp chat list, contact names, profile name, messages, and the contents of whichever conversation was open at the time.

How the attack worked

HermeticReader effectively broke the browser’s same‑origin protections via the Adobe extension’s privileged context. Same‑origin protections are basically the browser’s rule that says websites aren’t allowed to snoop on each other’s private data unless they’re clearly part of the same site (same scheme, host, and port).

The problem was that the Adobe extension operated with much higher privileges than a normal website, effectively bypassing those restrictions. It was like giving a visitor a master key that opened every apartment in the building instead of just the one they were invited into.

How to stay safe

Adobe fixed the vulnerability in version 26.5.2.3 of the Acrobat PDF extension. The update is installed automatically, but it’s worth checking that you’re running the latest version. Versions 26.5.2.2 and earlier are affected by HermeticReader.

The affected extension ID is efaidnbmnnnibpcajpcglclefindmkaj.

You should also:

• Review the devices linked to your WhatsApp account and sign out of any you don’t recognize or no longer use.
• Remove browser extensions you don’t use, recognize, or trust.
• Keep software and extensions updated so security fixes are installed as soon as they’re available.

HermeticReader is a reminder that browser extensions sit in a powerful position between users and the web, and that convenience integrations can become privacy liabilities if messaging and storage flows are not tightly constrained. Even well‑known brands can ship features that briefly put your privacy at risk.

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Article URL: https://www.theverge.com/entertainment/968703/neill-blomkamps-nightborne-barley-studios-seedance

Comments URL: https://news.ycombinator.com/item?id=49019588

Points: 1

# Comments: 0

Article URL: https://twitter.com/yuxin_tang_/status/2080042329583374796

Comments URL: https://news.ycombinator.com/item?id=49019568

Points: 1

# Comments: 0

Article URL: https://www.marginalia.nu/log/a_138_systemdocker/

Comments URL: https://news.ycombinator.com/item?id=49019511

Points: 1

# Comments: 0

Hackers recently obtained non-sensitive customer information and other documents from the company.

The post Upbound Group Says Data Breach Led to $13 Million in Fraudulent Contract Losses appeared first on SecurityWeek.

Article URL: https://blog.vxneo.com/building-a-voice-assistant-that-works-for-one-very-specific-person/

Comments URL: https://news.ycombinator.com/item?id=49019487

Points: 1

# Comments: 0