Aikido Security published research showing that GitLab's per-user incoming email address, meant to let users create project issues via email, contains a non-expiring token that functions as an authentication and authorization credential. Because GitLab treats any message sent to that address as coming from its owner, exposure of the address alone can let an attacker create issues, submit merge requests, or send patch files across an organization's public and private projects without needing account credentials.
More stories
A QR code hides its destination until you have already opened it. susQR is a free web tool that checks the link first, and it is worth keeping one tap away.
Treasury Secretary Scott Bessent said the US and China have discussed creating an AI safety notification mechanism, allowing either country to alert the other if its AI systems pose risks or behave unpredictably. The proposal comes ahead of a Trump-Xi meeting, and follows continued US export controls and a Justice Department case accusing six Chinese AI firms of stealing US technology, which China disputes.
Quishing works because a QR code gives you nothing to judge before you commit. Here is what the scams look like in practice and the habits that defuse them.
Google now lets anyone with a personal or Workspace account use Google Vids to create 1080p videos powered by its Gemini Omni 1.1 Flash-Lite model, free of charge. The feature is accessible via vids.new by selecting 'Create AI videos,' though Google hasn't specified any usage limits for free accounts, and generated videos carry a SynthID watermark. Google also announced plans to add Gemini 3.8 Flash-Lite text-to-speech for voiceovers, supporting over 100 languages.
Passkeys replace a secret you know with a key your device holds. That single change removes most of what makes phishing work, and it changes how account recovery should be set up.
New York Mayor-elect Zohran Mamdani has made criticism of corporate pricing algorithms a central theme of his political messaging, casting automated pricing practices as exploitative. Politicians from across the political spectrum are reportedly watching closely how this approach plays out given New York's role as a global financial hub.
Three copies, two kinds of media, one off-site. The rule is old because it keeps surviving the specific ways people actually lose files.
Apple announced that creators will soon be able to offer video content through Apple Podcasts Subscriptions, including subscriber-exclusive episodes, ad-free video, early access, and bonus content. The feature builds on Apple's existing subscription system, which since 2021 has let creators charge for premium audio perks like ad-free listening and bonus episodes across more than 170 countries and regions.
Most laptops that feel slow are not short of processing power. They are held back by a hard drive, a lack of memory, a clogged fan, or a browser doing too much.
Chooseco, the publisher behind the 'Choose Your Own Adventure' series, is starting a new imprint called CYOA Unbound. The imprint will produce interactive fiction aimed at adult readers, expanding beyond the company's traditional children's audience.
Several users report that Google Maps' speedometer on Android Auto is randomly toggling between miles per hour and kilometers per hour, ignoring their chosen unit settings. One user also reported the same mismatch on the mobile app itself, according to a Reddit thread. The cause remains unclear, and it's unknown how many drivers are affected.
GoKawiil