GoKawiil
Tech News
Researchers report that attackers are actively exploiting a chain of recently patched Plex Media Server vulnerabilities, dubbed 'Plex2Shell,' to achieve remote code execution on unpatched devices. A honeypot set up to monitor the activity recorded scanning within a day and subsequent successful infections that install cryptomining software and residential proxy applications.
A developer-focused blog post contends that relying on an AI provider's built-in analytics dashboard gives users little real insight into token usage or request behavior. Instead, the author recommends running a self-hosted LLM proxy that logs which API key called which model, from which client, and when, across multiple providers and models from one endpoint.
A phrase coined by software engineer Niklas Gruhn in August 2026, 'meat proxy,' describes someone who passes along AI-generated content to others without reading, reviewing, or thinking it through first. The term has begun circulating as shorthand for a growing concern about professionals outsourcing judgment entirely to AI tools rather than using them as a starting point for their own analysis.
Security researchers at Bitdefender say firmware on low-cost Android devices using MediaTek chipsets has been shipping with malware that grants system-level control, enabling silent app installs, ad fraud, and turning phones into residential proxies. The campaign has affected thousands of devices across more than 150 countries over roughly two years, hitting models from Doogee and Cubot as well as phones impersonating Samsung and Apple products.
A developer who already used Home Assistant to track bin collection schedules built a new project called BinRange to detect whether bins had actually been moved. The system uses a fixed ultra-wideband radio anchor, six battery-powered tags attached to wheelie bins, a 3D-printed enclosure, custom firmware with wireless updates, and integration with Home Assistant to combine location data with collection schedules. The build followed an earlier, less successful attempt using Bluetooth tags and a proxy, and was developed with heavy use of AI coding tools including Codex and Astra.
A software engineering blogger describes a growing trend where workers let LLMs perform tasks like coding or summarizing without verifying the output, simply relaying results back and forth—dubbed being a 'meat proxy.' The author argues that while this approach has improved since early 2025, its logical endpoint is self-defeating: if an LLM can eventually produce good software unsupervised, employers will simply automate the loop and remove the human entirely.
Security firm Socket found that the Chrome and Firefox extension 'Twitch Enhanced Viewer | JeetBot,' which promises ad-blocking and forced 1080p playback, secretly captures users' Twitch OAuth session tokens. The credentials are routed through proxy servers run by JeetBot, a Russian-language streaming and chatbot service, where they land in plaintext request logs accessible to the vendor. The extension exempts ten hardcoded Russian-language channels from this behavior, and its own store listing admits earlier versions sent tokens to its servers outright.
Surfshark disclosed that hackers gained access to an internal engineering test server after a misconfiguration left it exposed to the internet, along with a separate proxy server used for content-accessibility optimization. The company says the exposed systems contained build credentials, code history and system binaries, but no user identities, IP addresses, encryption keys or browsing traffic were compromised. Suspicious activity was spotted on August 31, contained by September 2, and remediation finished three days later.
Security researchers found that a Chinese-speaking threat actor has compromised Brazilian government and education websites, using them as a reverse-proxy network to funnel traffic to gambling-themed phishing sites. The attackers exploit the trust and infrastructure of official domains to disguise malicious traffic and evade detection.
A developer released Mador, an open-source JavaScript library that lets existing DOM elements respond to state changes without adopting a full framework. It uses a Proxy-based state tuple with read and write functions to bind elements to specific state properties, updating only when those dependencies change. The tool is distributed as a native ES module via npm or CDN and is roughly 855 bytes when minified.
Utah has enacted Senate Bill 73, an age-verification law requiring adult websites to confirm users' ages regardless of whether they use a VPN or proxy to mask their location. The law, which had been delayed by a court injunction after a challenge from Pornhub owner Aylo, imposes fines up to $2,500 per violation and bars sites from telling users how to bypass verification with a VPN.