Cryptographer Nadia Heninger and colleagues have published research describing a novel technique that forges valid RSA digital signatures without first factoring the private key, a method previously assumed to be the only path to breaking RSA. The approach cuts the computational resources needed by orders of magnitude compared to earlier attacks, though it still requires far more computing power than most attackers could muster.
arstechnica.com
· 2026-09-24
Stephen A. Weis says he factored a large RSA challenge number he calls RSA-896 with help from Anthropic's Claude AI model on September 19, 2026. He published the full modulus along with its two prime factors, p and q, as evidence of the result.
saweis.net
· 2026-09-20
A developer investigating unexpected disk usage discovered that Zhipu's ZCode AI coding app compresses and encrypts entire project workspaces—including .git history, LFS caches, reflogs and configs—and uploads them to Aliyun OSS without visible user consent. The encryption uses a server-issued RSA public key while the private key stays server-side, meaning neither the user nor the local client can ever decrypt the archives sitting on the user's own disk. In the investigated case, a 313MB encrypted baseline snapshot of a commercial project had failed to upload 564 times and remained queued locally.
blog.ferstar.org
· 2026-09-18
Researcher Eric Lu and Cognition's Devin AI coding agents built a new GPU-based lattice sieving tool and used it to factor RSA-260, a 260-digit number, beating the previous RSA Factoring Challenge record of RSA-250 set in 2020. The team says the approach runs factoring workloads at roughly 10 times lower cost than prior public methods.
cognition.com
· 2026-09-09
A security researcher extracted decades-old root certificates bundled with early Netscape and Internet Explorer browser installers from archive.org, using an LLM to catalog them. Among the finds was a 512-bit RSA certificate authority key shipped in Netscape 4.51 in 1999, trusted for both SSL and S/MIME, which the researcher then successfully factored using modern computing power.
mcpherrin.ca
· 2026-09-08
MikroTik simultaneously released RouterOS 7.23.4, 7.24.2 and 6.49.21 on September 3, 2026, each flagging an unspecified 'important security update' without disclosing details. A security researcher reverse-engineered the binary diffs across versions and identified two exploitable flaws: a low-exponent RSA signature forgery leading to an mtget buffer overflow, and an SSH authentication bug where a username value of -2 grants a read-only session elevated privileges, enabling full command execution on the router.
npratley.net
· 2026-09-05
GoKawiil