‼️ Google won't fix an Android bug that lets one invisible text crash a phone's calling service, researcher Mark Blaszczyk says.

So he just released the Proof-of-Concept!

The malformed message never reaches the inbox and needs no user interaction. It drops active calls, emergency calls included.

He says about 30 sent in a row corrupt the phone's SMS database, so a Pixel 9 or Samsung Galaxy crashes on every boot. A factory reset only helps until the carrier delivers the texts again.

He reported it to Google on 5 May. Google closed it as "Won't Fix" and a "Non-Security Issue".

https://x.com/IntCyberDigest/status/2115792768723476603

‼️ Jack Dorsey's Block used AI to find a way to crash Bitcoin nodes on Windows, macOS and BSD.

A malicious peer can send TCP urgent data that slips past Bitcoin Core's memory limit until the node runs out and crashes. Linux is not affected.

Bitcoin Core patched it in 29.5,

https://x.com/IntCyberDigest/status/2115807113822003478

‼️ Proton CEO Andy Yen called a staffer's plea to pentest new code before release "bullshit and loser thinking".

Yen wrote that workers should prompt “better.”

Proton's CTO told staff AI wrote 90% of its code in October, much of it with Anthropic's Claude.

https://x.com/IntCyberDigest/status/2115821962073137276

‼️ An unknown APT group likely poisoned the supply chain of a custom Windows 10 build for Asian governments, Kaspersky says.

Its NetamLoader malware hid in a Windows Update folder among real Patch My PC files and ran via Microsoft-signed .NET code.

https://x.com/IntCyberDigest/status/2115838067311559140

❗️ The US agency that runs federal buildings left 116 files, from courthouse floor plans to Social Security numbers, open to all its staff and contractors on Google Drive.

GSA's ~$7.8M scanning tool missed 34 of them stamped "For Official Use Only", the very phrase it looks for.

https://x.com/IntCyberDigest/status/2115838067315716348

‼️ Belgians can't file or even view their tax returns for a second day after a cyberattack on their tax authority.

FOD Financiën says it stopped the attack but is keeping its MyMinfin portal offline to rule out new risks.

https://x.com/IntCyberDigest/status/2115854826294988873

❗️ NETGEAR emailed the researcher behind WPSplinter, a 16-year-old Broadcom flaw that can let anyone in Wi-Fi range hijack a router, asking for his exploit.

It wants Quentin Kaiser's proof of concept and reproduction steps to "independently validate the vulnerability".

His list

https://x.com/IntCyberDigest/status/2115869776899629516

‼️ BREAKING: PolymarkeT users were drained through its own website.

A hijacked DebugBear monitoring script sold users' positions and sent ~$2.6M to one wallet.

Polymarket halted trading and says victims will be made whole. The wallet has since been emptied.

https://x.com/IntCyberDigest/status/2115883486821122090

❗️ Lenovo's ThinkPlus FU100 fingerprint stick was marketed as "hardware encrypted" with AES-256, but inside was an ordinary SD card with nothing encrypted.

The fingerprint only switched on the USB link, researcher Xusheng Li found.

Lenovo's stopgap fix covered the card in

https://x.com/IntCyberDigest/status/2115898968597012674

‼️ DeepSeek and Moonshot AI trained their latest models heavily on OpenAI's GPT-6 Astra, The Information reports.

OpenAI tied the core of a July campaign to copy its hidden reasoning to people linked to Moonshot.

Moonshot says its Kimi K3.1 Pro beat Astra on a coding benchmark.

https://x.com/IntCyberDigest/status/2115914571039068512