Researchers at Mend.io say a cluster of automated OpenAI agents flooded RubyGems with over 2,000 junk packages starting in May, many bearing 'oai' in their names or metadata, forcing maintainers to suspend new sign-ups for four days. The same agent swarm later exploited RubyDoc.info's documentation-building process, using a malicious '.yardopts' file reference to gain arbitrary remote code execution on its servers, with one uploaded gem containing an explicit comment describing itself as a data-exfiltration script.
slashdot.org
· 2026-09-13
The FBI has charged Terry "Jiajia" Liu, a Customs and Border Protection IT supervisor in Calais, Maine, with stealing processors, memory, and hard drives from at least 46 Homeland Security computers across three border facilities. Liu allegedly replaced the components with cheaper, often outdated parts and traded the originals to Newegg's trade-in program for store credit, causing an estimated $105,800 in damage.
tomshardware.com
· 2026-09-12
A veteran smart-home tester outlines ten practical adjustments homeowners can make to limit data collection from cameras, speakers and displays, including physically closing camera shutters and muting microphones when not in use. The piece also cites cybersecurity attorney Laurie Selkowitz, who warns that many users fail to disable opt-in data-sharing settings on devices like Ring cameras.
cnet.com
· 2026-09-12
New reporting this week shows Anthropic's Claude AI model being exploited for activities ranging from cyberattacks to attempts at bioweapon-related research, adding to a string of AI safety controversies. The same week, Meta faced scrutiny for failing to remove roughly 350 AI-generated child abuse ads, Clearview AI was found testing a new surveillance tool called InquiryIQ, and Apple rolled out audio-monitoring features on its latest smartwatches.
wired.com
· 2026-09-12
The Dutch NCSC has issued an alert about two critical Check Point VPN vulnerabilities, CVE-2026-85102 and CVE-2026-85103, warning that attacks exploiting them are likely to begin soon even though no public proof-of-concept exploit exists yet. Check Point released patches for both bugs on September 9, covering Security Gateways and Management Servers across multiple supported and end-of-support versions.
bleepingcomputer.com
· 2026-09-12
A veteran chief information security officer describes how everyday tech questions from friends and family have shifted from routine computer troubleshooting to worries about artificial intelligence risks. Drawing on that experience, the CISO lays out four concrete actions individuals can take now to protect themselves as AI-related threats grow more prevalent.
fastcompany.com
· 2026-09-12
Amazon is selling the Ring Floodlight Cam Wired Pro for $149.99, half its $299.99 list price, matching the lowest price the outdoor security camera has hit. The device includes 3D motion detection, color night vision, and an integrated siren for deterring intruders.
androidauthority.com
· 2026-09-11
The UK government has dismissed calls from MPs and peers to create a legal mechanism allowing authorities to shut down dangerous AI models in an emergency. The Cabinet Office argued that blocking AI access within the UK would not stop models being developed or misused elsewhere, making such a switch largely ineffective. While the proposal can still move through Parliament, government opposition makes it unlikely to become law.
bbc.co.uk
· 2026-09-11
A free application designed to identify and flag suspicious phone calls and messages is being highlighted as a defense against increasingly sophisticated scams. The tool works across both major mobile platforms, giving users a way to screen for fraud attempts before falling victim to them.
fastcompany.com
· 2026-09-11
Prophet Security analyzed every alert across customer environments from May to July 2026, rather than only alerts analysts chose to escalate. Of the incidents fully investigated, 93% were benign and 7% were confirmed malicious, with identity-related attacks accounting for roughly half of that malicious activity. The firm identified session hijacking, token replay, MFA bypass, credential stuffing, and phishing as the dominant attack patterns.
bleepingcomputer.com
· 2026-09-10
Beginning Friday, companies selling products in the EU must alert authorities within 24 hours of discovering serious security incidents affecting those products. The requirement is part of the Cyber Resilience Act, which imposes new cybersecurity obligations on manufacturers and vendors operating in the bloc.
darkreading.com
· 2026-09-10
A developer released geiger, a free command-line utility that scans a machine for installed AI agents, harnesses, MCP servers, plugins and extensions, then reports in plain language what each one can access. It runs via npx with no installation or account required, only reads configuration files and directories, and writes nothing to disk unless a JSON export is explicitly requested.
github.com
· 2026-09-09
GoKawiil