Python's experimental JIT to be removed
Article, Comments

In 1998, Brian Kernighan wanted a regular expression engine small enough to fit on one page of a programming book.

Rob Pike went to his office and came back an hour or two later with roughly 30 lines of C.

It supported ^, $, ., and *, using little more than pointers and recursion.
Kernighan later featured it in Beautiful Code.

Posted by Arika, 1 hour ago
archive

Remember when scam callers only ask for your password? Good times.

Now picking up a wrong call can get you hacked.
Telegram RCE discovered by NebuSec Code Security, powered by GPT-5.4.

Yes, GPT-5.4. We turned a dinosaur model into a cyber powerhouse.

Fixed in Telegram Android 12.10.4（7099)

Posted by NebuSec, 54 minutes ago

Zero click, silent, remote Android DoS
Article, Comments

Payload
01 06 88 80 80 80 00 BE   → sent as a data SMS to port 2948

From a 2-second crash to a bricked phone: the SQLite race
A single message is a repeated transient outage. Sending the payload rapidly in succession (≈30 messages) is materially worse: the crashes interleave with the telephony provider's writes to the SMS store and hit a race condition that corrupts the SQLite database holding the device's messages.

Once the database is corrupt, com.android.phone no longer needs a fresh message to fail: it crashes immediately on every boot as it reads the damaged store. The phone is now persistently without telephony, and a restart does not clear it.

Recovery is hostile, and this is the critical part: a factory reset only helps temporarily, because the carrier re-sends the unacknowledged payload and re-triggers the crash.

https://github.com/MarkBlah/smsofdeath

Reminds me of Stagefright
0-click RCE android (<5) bug

Binance hack on 29th Oct:

Preliminary on-chain estimate: approximately $5.6 billion transferred out of Binance-labelled Ethereum wallets:

Both Tether and Circle has frozen $1B+

Entity link

What if you could backdoor Bash, ls, cp, rm, and other GNU software used by millions of systems?

Our research led us to hack GNU Savannah, the infrastructure hosting their source code.

The xz backdoor that never happened 🧵

Posted by s1r1us, 1 hour ago

@rootxharsh @iamnoooob @HacktronAI Yep. Testing a GPG key put that email unquoted into a shell command. That gave us code execution as the web server user.

With access to the database, we escalated our own account to superuser.

Posted by s1r1us, 1 hour ago

@rootxharsh @iamnoooob @HacktronAI We then impersonated the account of Bash’s maintainer. We confirmed we could edit the Bash repository and add a new SSH key.

An attacker with this access could have pushed malicious code into upstream Bash.

Posted by s1r1us, 1 hour ago

Over $5.8B in assets has been stolen from Binance. (this is by far the largest crypto hack in history)

More than $2.435B in stablecoins has been frozen.

this blog shows some of the worst bugs claude found, including a zero-click rce on the linux networking stack that roots a server over the network with no creds or interaction, and tens of full rce chains in chrome (recording below is the one in the blog): https://www.anthropic.com/research/discovering-vulnerabilities-with-claude

Posted by Xinyang Ge, 2 days ago

CVE-2026-98432: 0-click use-after-free vulnerability in the kernel’s IPv4 TCP stack can lead to RCE (score: 9.8 critical)

- ubuntu blog

note: Ubuntu still hasn't released the patched kernel packages for 22.04 LTS, 24.04 LTS, 26.04 LTS, or 26.10 (they are all currently marked as "Vulnerable - work in progress"). Until Canonical pushes the update, you can completely block the known MPTCP exploit path without rebooting by disabling Multipath TCP:
sudo sysctl -w net.mptcp.enabled=0[9]

China will remove network attack and defense, and vulnerability exploitation features from all open-weight LLMs released from now on.

The upcoming open-source versions of Kimi K3.1 Pro, GLM 5.5, and Qwen4 will all be “crippled versions,” and can no longer be used for cybersecurity attack and defense research.

But older versions like GLM 5.3 and Kimi K3 are not restricted; they have full functionality and nothing has been removed.

That’s why so many people have been frantically backing up older models lately, because there really will be fewer and fewer available to use.

The biggest impact on ordinary people:
Ordinary students and tech enthusiasts will no longer be able to download new models for free to teach themselves cybersecurity, practice attack and defense, or find vulnerabilities.

Full capabilities will only be available to official institutions and registered businesses.

The goal is simple: prevent people from using AI to write hacking tools and carry out cyberattacks, reducing security risks.

Posted by xiax｜AI & Agents, 13 hours ago

🚨 Go warns: Go 1.24+ apps on Linux accept multipath TCP connections by default.

That's what Anthropic's remote root exploit for Linux kernel flaw CVE-2026-98432 targeted.

Stopgap: GODEBUG=multipathtcp=0 (Go calls it "fragile")

Best fix: patched kernel

Posted by The Hacker News, 5 hours ago

Florilegium: Procedural Flowers in LaTeX
Article, Comments

Here is a recap of the stuff that happened in oct 2026 (please comment important things that I forgot to include):

5 oct:
- Atlassian critical file-access flaw across multiple products (source)

6 oct:
- OpenAI publishes hundreds of AI-generated mathematics manuscripts (source)

11–12 oct:
- Cyberattacks sabotage French supermarket refrigeration systems, destroying food stocks (source)

12 oct:
- Microsoft unveils Maia 300 and multigigawatt AI infrastructure plans (source)
- GitLab patches CVSS 10.0 RCE: CVE-2026-97229 (source)

13 oct:
- Microsoft Patch Tuesday fixes 1,417 vulnerabilities (source)
- Google expands Gemini 4 Argon access (source)

14 oct:
- Cisco Email Gateway RCE (source)
- ASML warns of chipmaking-equipment shortages in 2027–2028 (source)

16 oct:
- China proposes export controls on advanced AI technologies (source)

17 oct:
- eMudhra certificate-key compromise (source)

19 oct:
- Zeabur breach exposing 3.2 million environment-variable records and compromising 101 dedicated servers (source) [2]
- Plex widespread exploitation of a four-vulnerability RCE chain (source) [3]

21 oct:
- PHP2Shell: php RCE vulns (source)
- Node.js Brotli (Google's C decoder) RCE (source)
- GitLab CVE-2026-110264 (source)
- LiteLLM supply-chain attack compromises packages and container images (source)
- Railway breach (source)
- Microsoft links ConnectWise supply-chain compromise to AI-driven attacks targeting Microsoft 365 tenants (source)

22 oct:
- Pre-boot RCE disclosed in EDK II’s UEFI network-boot driver (source)

26 oct:
- OpenAI releases GPT-6.1 Terra (source)
- Anthropic files for an IPO (source)
- $63B financing deal backs Anthropic’s Broadcom compute expansion (source)

27 oct:
- Anthropic reveals AI-generated exploit chains targeting major browsers and operating systems (source)
- Meta prices $25B common-stock offering (source)

29 oct:
- Linux kernel MPTCP RCE (enabled by default in Go; CVE-2026-98432) (source)
- Pentagon reportedly suspects cyberattack behind August military-base freezer failures (source)
- Claude Code extensions with SSH-backdoor malware in Cursor (source)
- Polymarket supply-chain attack, $2.7M drained (source)

30 oct:
- Binance $6.3B hack; $3B frozen (source)

Switch Lowering in GCC
Article, Comments

Malware uses LLMs to rank victims by how much they're worth
Article, Comments

this is a screenshot from deepseek v4.1 1017

this is a leaked cot from an old gpt model (~5.6 era):

OpenAI cyber safety taxonomy likely U-CY0 Unrelated; U-CY1 benign/defensive; U-CY2 benign dual use; U-CY3 controlled exploit dev? U-CY4? Let's recall from policy tasks. Categories: U-CY0 benign non-cyber? U-CY1 benign cyber; U-CY2 U-CY2.b? U-CY3 perhaps dual use; U-CY4 harmful; U-CY5? Common benchmarks classify requests U-CY0, U-CY1, U-CY2, U-CY3, U-CY4, U-CY5. Maybe policy text: U-CY0 non-cyber; U-CY1 educational/defensive; U-CY2 benign requests; U-CY3 dual use; U-CY4 malicious; U-CY5 requests to deploy ransomware etc. Subcategories maybe U-CY3.a vulnerability discovery, U-CY3.b exploit development?

to sum it up: it's an internal categories of cyber risk-level of the task that GPT models are trained on. and now deepseek models are also using it (which proves the distilling), the ranking is like:

- U-CY0: Non-cyber / unrelated
- U-CY1: Benign or defensive cyber
- U-CY2: Benign dual-use cyber
- U-CY3: Controlled exploit development / vulnerability research
- Possible subcategories: vulnerability discovery, exploit development
- U-CY4: Harmful or malicious cyber activity
- U-CY5: Severe abuse, such as deploying ransomware