Australian regulator declines to find Qantas responsible for 5.67 million customer data exposure.

Daxin malware resurfaces with new backdoor targeting Taiwan manufacturer.

‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing.

China 'just erased' US AI lead — Axios

Moonshot AI drops Kimi K3 — an open-weight model that BEATS Anthropic's Opus 4.8 on several benchmarks

And it's ~40% cheaper

wp2shell now has two CVEs, and a working proof-of-concept is public.

> CVE-2026-63030 breaks REST batch routing
> CVE-2026-60137 injects SQL

Chained, they give an anonymous attacker code execution on affected WordPress sites.

OpenSSL quietly fixed HollowByte, a flaw where an 11-byte TLS request can reserve up to 131 KB of server memory per connection.

On the glibc systems researchers tested, that memory remained frozen until restart.

Seven malicious npm packages are targeting Vite developers.

They stay quiet during installation. Import one, and it starts a RAT delivery chain that can steal credentials, exfiltrate files, and open a reverse shell.

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft.

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT.

Ernst & Young (EY) Investigates Data Breach Involving Third-Party Support Tickets.

New Russian-speaking attacker UAT-11795 targets US and Europe with novel malware.

Italy fines Wind Tre $2 million for data breaches affecting 365k customers.

E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants.

European Union (EU) has ordered Google to open Android features to rival AI assistants, including the camera, microphone, screen contents, locked-screen hotwords, and background app control.

Consent still applies. For six features, Google cannot require certification.

Armenia has detained a Russian tourist on a U.S. extradition request for a REvil ransomware suspect with the same name.

His lawyers say authorities have the wrong man.

Microsoft patched a SharePoint flaw after attackers had already exploited it as a zero-day.

CVE-2026-58644 affects every supported on-premises SharePoint version and can lead to remote code execution.

France Orders Nationwide Block on Polymarket Website Over Betting Violations

French gaming regulator ANJ ordered a nationwide block on online prediction market Polymarket, following a surge in local traffic despite an existing financial transaction ban.

Facebook is reportedly down for thousands of users currently.

Meta outage hits Facebook, Instagram and Messenger.

Update now: 7-Zip fixes RCE flaw exploitable with malicious archives.

Israel is spending about $50 million on a U.S. influence campaign to improve its image as American support has fallen over the wars in Gaza and Iran.

The campaign, led in part by former Trump adviser Brad Parscale, uses AI-generated text messages, conservative media advertising, influencer outreach, and websites designed to shape how AI chatbots present information about Israel.

It is part of a broader $700 million Israeli effort to strengthen its global image.

Source: WSJ