Feed aggregator

Article URL: https://www.theguardian.com/world/2026/sep/10/secret-systems-used-by-israel-in-mass-killings-of-gaza-civilians-revealed-in-new-film

Comments URL: https://news.ycombinator.com/item?id=49645905

Points: 3

# Comments: 0

Use the AI Tool below in the comment for your Instagram captions - See the spikes and peaks of your post when it becomes viral. Our customized AI Tool generates exactly the Instagram Caption that has the potential to give reach in millions.

Comments URL: https://news.ycombinator.com/item?id=49645895

Points: 2

# Comments: 0

Article URL: https://oussama-mater.tech/laravel-queue-gotchas/

Comments URL: https://news.ycombinator.com/item?id=49645893

Points: 1

# Comments: 0

Article URL: https://academic.oup.com/mnras/article/549/3/stag844/8701424

Comments URL: https://news.ycombinator.com/item?id=49645889

Points: 1

# Comments: 0

Article URL: https://github.com/Edge0-AI/edge0/

Comments URL: https://news.ycombinator.com/item?id=49645864

Points: 1

# Comments: 0

Article URL: https://www.thecollector.com/casablanca-unproduced-play-movie-history/

Comments URL: https://news.ycombinator.com/item?id=49645826

Points: 5

# Comments: 0

Article URL: https://proxylity.com/docs/listeners/dtls.html

Comments URL: https://news.ycombinator.com/item?id=49645804

Points: 3

# Comments: 1

BlueMoon, a shared Chrome and Windows exploit kit, shows why “patch later” is becoming a dangerous gamble.

Security updates are easy to put off. The browser still opens, Windows still works, and choosing to relaunch your browser or restart your computer later can feel harmless.

But a newly documented exploit kit called “BlueMoon” shows how quickly patching delays can become dangerous. Proofpoint Researchers found four espionage groups using the same exploit chain against Chrome browsers running on Windows within days of one another.

The campaign is a timely reminder that once a security flaw, or even its fix, becomes public, attackers may move faster than many users expect.

The attacks began with phishing emails. A victim who clicked a malicious link could be sent to a web page designed to exploit two vulnerabilities in Chrome’s V8 JavaScript engine, followed by a Windows vulnerability to break out of the browser’s protections and gain higher privileges on the computer.

The Chrome vulnerabilities used by BlueMoon were patched in the Stable channel on September 3 and September 8, 2026. The first was already actively exploited when Google released its update. Microsoft addressed the Windows vulnerability in its September Patch Tuesday updates, by which point it was also being exploited.

CISA has since added all three flaws to its Known Exploited Vulnerabilities (KEV) catalog, which lists vulnerabilities known to have been exploited in real-world attacks.

The notable part is not just that BlueMoon exploited the flaws, but how quickly the capability appears to have spread. Publicly visible upstream fixes can give attackers clues before downstream browser updates reach users, allowing a weaponized chain to be developed and adopted by multiple groups very quickly.

Does that mean that patches can no longer be tested before they are released to the public? No, but we may need to rethink how they are tested and deployed, because it appears some cybercriminals are effectively beta-testing the patches themselves.

The researchers also found clues, but no conclusive evidence, that the exploit kit was developed with AI assistance. The broader concern is credible: AI tools can help attackers interpret source-code changes, write and modify code, document test results, and learn from failed attempts.

In practical terms, the gap between “a flaw is fixed upstream” and “most people are protected” may be increasingly valuable to attackers. We should try to minimize that gap.

How to stay safe

Not every security update needs to be installed the moment it appears. In organizations especially, updates may need testing, staged deployment, and contingency plans. But vulnerabilities known to be actively exploited deserve greater priority. That is precisely why CISA’s KEV catalog is so important: It helps organizations identify the vulnerabilities they should address first.

For home users:

• Install browser and operating-system updates promptly. Use the few minutes they take to grab a drink rather than repeatedly postponing them.
• Don’t click links in unsolicited emails.
• Use up-to-date, real-time anti-malware protection to help catch the malware that exploit kits attempt to deliver.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Article URL: https://www.tryworthit.app/about

Comments URL: https://news.ycombinator.com/item?id=49645780

Points: 2

# Comments: 1

Article URL: https://kirkdiamond.com/tools/

Comments URL: https://news.ycombinator.com/item?id=49645766

Points: 1

# Comments: 0

Article URL: https://neki.dev/

Comments URL: https://news.ycombinator.com/item?id=49645763

Points: 6

# Comments: 0

Article URL: https://costsofwar.watson.brown.edu/paper/how-big-tech-and-silicon-valley-are-transforming-military-industrial-complex

Comments URL: https://news.ycombinator.com/item?id=49645754

Points: 1

# Comments: 1

Article URL: https://cel.cs.brown.edu/blog/design-space-async-await/

Comments URL: https://news.ycombinator.com/item?id=49645736

Points: 1

# Comments: 0

Both Anthropic and OpenAI have seen high-profile resignations in recent years that were tied to safety concerns.

The post Anthropic Researcher Resigns With Warning About the Dangers of AI Development appeared first on SecurityWeek.

Vinnie Liu was recruited by the NSA when he was just 17 years old. He is now the CEO of Bishop Fox.

The post Hacker Conversations: Vinnie Liu, Performer Turned Ringmaster appeared first on SecurityWeek.

AWS says public sector AI adoption must move to ‘full transformation’ as it shows advanced workflow redesign yields 68% efficiency gains at its London symposium

UK government views the outsourcer’s overall performance as ‘unacceptable’ after it reports meeting a self-imposed target

Deceptive apps in Early Access are being used by dishonest developers for their own benefit.

The post Deceptive Android Apps Exploit Google Play Early Access to Evade Reviews appeared first on SecurityWeek.

Here's a tip for any budding cybercriminals out there. If you're going to steal a quarter of a billion dollars worth of cryptocurrency, maybe don't broadcast on a group chat every time you buy a Lamborghini, or blow half a million dollars on a single night out at a nightclub. Read more in my article on the Hot for Security blog.

Join the webinar for a focused, 20-minute discussion on Frontier Pace Governance, an approach to balancing automation, policy, and business risk as IT operations accelerate.

The post Webinar Today: Keep Pace With AI – A New Operating Model for Endpoint Remediation appeared first on SecurityWeek.