GoKawiil
Tech News
A security researcher discovered a cross-site scripting vulnerability in the ansi2html tool used to render build logs on builds.sr.ht and other Sourcehut instances. The flaw let anyone inject malicious text into a build log, which would then execute in the browser of any user who viewed it, potentially hijacking their account and spreading further through the same mechanism.
Apple and Goldman Sachs raised the annual percentage yield on the Apple Card Savings Account from 3.4% to 3.5%. The new rate matches Goldman Sachs' own Marcus savings account rate, though Marcus is separately offering a promotional 4.50% rate for a limited time. The account remains exclusive to Apple Card holders, who can fund it via Daily Cash rewards, linked bank accounts, or Apple Cash.
Discord has begun automatically sorting users into age groups using account signals like account age, activity patterns, and connected servers, rather than requiring ID or selfie verification. Users estimated to be 13-17 will get added safety restrictions, while those judged 18+ see no account changes; anyone misclassified can manually verify age through account settings. The rollout follows a February pause of Discord's prior ID-based verification system after a third-party vendor breach exposed users' scanned identification documents.
Researchers describe how Google Kubernetes Config Connector (KCC), a GitOps controller used to manage Google Cloud resources from Kubernetes YAML files, can be manipulated through resources like IAMPolicyMember to escalate privileges. Because KCC authenticates to Google Cloud on behalf of developers using its own credentials, a maliciously crafted or overly permissive YAML file applied to a cluster could grant broad access across a Google Cloud organization.
Google has published guidance on configuring Android phones so they can be tracked if lost, including keeping software updated, verifying the linked Google account, and enabling Location services. Users are directed to enable settings under Security such as Find Hub or Find My Mobile, along with an Offline Finding option that requires a device PIN, pattern, or password.
Code found in Android 17 QPR2 Beta 5 references an 'Unlock with Google Account' feature that would let users regain access to a locked phone using their linked Google credentials instead of performing a factory reset. Google offered a similar pattern-unlock recovery option through Android 4.4 before removing it, leaving users locked out of forgotten PINs with no option but a full wipe. The feature appears unreleased and possibly optional, suggesting Google is still testing how to implement it.
A software glitch in iOS 27 and iOS 27.2 is causing the Settings app to display an unremovable red badge urging users to 'Activate iCloud Storage,' even when they already have ample space, including those on 2TB Apple One family plans. Tapping the alert only leads to the storage purchase screen and dismissing it does not clear the badge.
A financial advisor breaks down how trillions of dollars sitting in low-interest checking and savings accounts are quietly losing value. With savings accounts averaging just 0.38% APY against 3.4% inflation, that cash loses more than 2% of real purchasing power annually, even as the balance stays unchanged.
Google has started actively prompting users on its homepage to set up a video selfie as an optional sign-in method, following its initial announcement of the feature in July. The setup involves recording a short video while turning your head, which Google can use later to verify identity if you're locked out of your account. Google also says the selfie data may be used to estimate a user's age and, with opt-in consent, to improve its broader facial recognition and verification systems.
Samsung is rolling out a new option letting Gallery app users sync photos and videos directly to Google Photos, replacing the native Microsoft OneDrive integration that shuts down September 30. The feature requires a compatible Samsung phone running Android 13 or later and a personal (non-Workspace, non-supervised) Google account, and is rolling out gradually with availability varying by device, region and account type.
A tech commentator argues that while Big Tech companies like Google and Microsoft are aggressively pushing users toward passkeys, the technology trades one security risk for another. Passkeys eliminate phishing by binding logins to a specific site, but because they can't be backed up or transferred between hardware keys, users face a higher chance of losing access entirely if devices are lost or accounts are banned.
A Hacker News user described being locked out of Google, banking, email and Drive accounts after their phone was stolen, since 2FA and account recovery relied on that device and an old email they could no longer access. The poster noted Google's automated recovery flow offers only options tied to the lost phone or an outdated backup email, leaving no clear path to a human for help.