# hacker Published articles for hacker. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## It's DOOM DevFeed: [It's DOOM]() Original publisher: [Read original article]() Author: Jenny List Published: 2026-11-04T21:00:47Z Content type: news Language: en Sources: [Hackaday]() Topics: [Reverse Engineering](), [Embedded Software Dev]() Tags: [camera](), [digital-cameras-hacks](), [does-it-run-doom](), [doom](), [firmware](), [flash](), [game](), [games](), [hack](), [hacker](), [hacks](), [hardware](), [internals](), [lens](), [toy](), [toy-camera]() ### AI overview The toy camera's easily updated firmware gave [Spode] a way into its internals. After using a memory-dump trick that stored camera memory in photo EXIF data, he benchmarked its HX3302B SoC and found it capable of running a 1993 game. Because RAM was limited, he kept the most-used DOOM code in memory and the rest in flash. A custom synthesizer and controls with some quirks made the camera playable as a DOOM console. ### Source excerpt Dirt cheap toy cameras have long been a target for the curious camera hacker, and we've seen plenty of lens swaps and other hardware hacks. Until now their internals have ...read more ## 2026 Hackaday Supercon: Bruce Potter's keynote explores the hacker mind DevFeed: [2026 Hackaday Supercon: Bruce Potter's keynote explores the hacker mind]() Original publisher: [Read original article]() Author: Anne Barela Published: 2026-11-04T16:38:47Z Content type: news Language: en Sources: [Adafruit Industries]() Topics: [AdventureX 2026]() Tags: [2026](), [2026-hackaday-supercon](), [adafruit](), [adafruit-daily](), [arduino](), [badge](), [bruce-potter](), [california](), [college](), [design](), [digikey](), [discord](), [electronics](), [events](), [friday](), [gaming](), [hackaday](), [hacker](), [history](), [keynote](), [mind](), [supercon](), [tickets]() ### AI overview The 10th Hackaday Superconference runs November 6-8, 2026, in Pasadena. Friday begins at Supplyframe HQ; Saturday and Sunday move to ArtCenter College of Design South Campus. The program includes workshops, talks, badge hacking, and time with hardware enthusiasts, with Bruce Potter delivering a keynote on the hacker mind. Volunteers may help between shifts and catch talks. Refunds are available until two days before the event. ### Source excerpt The Hackaday Superconference is back for its 10th year, running November 6th through 8th, 2026. Tickets are on sale through Eventbrite. Friday starts at Supplyframe HQ in Pasadena, California. Bruce Potter's keynote explores the hacker mind. Saturday and Sunday move to the ArtCenter College of Design South Campus, also in Pasadena. The three days cover [...] ## mSecure password manager hack prompts password reset warnings DevFeed: [mSecure password manager hack prompts password reset warnings]() Original publisher: [Read original article]() Author: Lawrence Abrams Published: 2026-11-04T16:00:18Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [passwords](), [Passkeys]() Tags: [authentication](), [backup](), [breach](), [computer-help](), [computer-security](), [computers](), [credentials](), [customer](), [cyberattack](), [database](), [encrypted](), [encrypted-backup](), [encryption](), [hack](), [hacker](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [mfa](), [msecure](), [passkeys](), [password-manager](), [password-reset](), [security](), [security-breach](), [spyware](), [support](), [tech-support](), [technical-support](), [two-factor-authentication](), [virus](), [virus-removal](), [warnings](), [windows]() ### AI overview mSeven advised current and former mSecure customers to change passwords, reset or re-enroll two-factor authentication, and remove passkeys after suspicious activity. Customer-shared support replies reportedly said an encrypted mSecure Cloud database was stolen and the incident affected users who synchronized vaults there; mSeven reportedly had no evidence the attacker accessed decrypted vault contents. Its documentation describes AES-256 encryption and local, zero-knowledge encryption, but the company had not publicly explained how the breach occurred or provided details on affected numbers. The excerpt notes that stolen encrypted vaults can still pose risks if weak master passwords are cracked offline. ### Source excerpt mSeven Software is warning current and former mSecure password manager customers to change passwords, reset two-factor authentication, and remove passkeys following a cyberattack that reportedly exposed an encrypted customer database. [...] ## Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers DevFeed: [Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers]() Original publisher: [Read original article]() Author: Eduard Kovacs Published: 2026-11-04T12:27:58Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Cryptocurrency]() Tags: [2016](), [2019](), [academic](), [campaign](), [canada](), [charged](), [charges](), [credentials](), [cryptocurrency](), [cyber](), [cybercrime](), [doj](), [extradited](), [hacker](), [hacks](), [hardware](), [hijacking](), [information](), [infrastructure](), [institutions](), [supercomputers](), [university](), [us]() ### AI overview Prosecutors allege Ryan James Roach and Mathiew James Stubbings compromised university systems in four U.S. states from 2016 to 2019, using stolen credentials, malware, and multi-country virtual servers to conceal their activity and mine Electroneum on hijacked university hardware. Roach was extradited from Canada on October 28; Stubbings's extradition proceedings are ongoing. The indictment includes conspiracy, protected-computer access, and intentional damage charges. The article says each count carries a maximum statutory penalty of 10 years in prison and a $250,000 fine if convicted. ### Source excerpt A federal grand jury indicted two Canadian men for hijacking university supercomputers to secretly mine Electroneum cryptocurrency. The post Canadian Extradited to US Over Cryptomining Hacks on University Supercomputers appeared first on SecurityWeek. ## Learn the rules: The hacker mindset DevFeed: [Learn the rules: The hacker mindset]() Original publisher: [Read original article]() Author: Weishung Liu, Mike Walker Published: 2026-11-03T17:14:38Z Content type: article Language: en Sources: [Microsoft Research]() Topics: [Cybersecurity](), [ctf](), [engineering-leadership](), [trust](), [Sports](), [Tool](), [Machine learning]() Tags: [about](), [ai](), [career](), [culture](), [curiosity](), [cybersecurity](), [first](), [hacker](), [hacker-culture](), [leadership](), [learn](), [manager](), [microsoft](), [microsoft-research](), [microsoft-research-podcast](), [mindset](), [post](), [problems](), [requires](), [research](), [rules]() ### AI overview Mike Walker argues that effective cybersecurity depends on understanding how rules operate in social contexts: each security demand asks users for trust, and squandered trust weakens the security regime. He describes how competitive Capture the Flag hacking informed DARPA's Cyber Grand Challenge, an autonomous tournament in which machines found and patched vulnerabilities; he characterizes its 2016 systems as expert systems, with their tool stacks serving as harnesses for later model-powered systems. Walker says offensive and defensive capabilities are often dual use, making red and blue team divisions incomplete. His team builds defensive tools with awareness that they can be targeted. Project Freta aims to counter tampering by analyzing memory signals acquired from cloud hardware rather than software that attackers could remove or alter. He also reflects that technical teams need coordination and shared awareness, not just individual skill, and that leaders may make decisions based on information others lack. ### Source excerpt Research Manager Mike Walker reflects on a career spanning hacker culture, cybersecurity, and AI, sharing lessons about trust, teamwork, leadership, and why solving difficult problems requires curiosity, judgment, agility--and an understanding of the rules. The post Learn the rules: The hacker mindset appeared first on Microsoft Research. ## Ask Hackaday: What Puts This Photo In The Pink? DevFeed: [Ask Hackaday: What Puts This Photo In The Pink?]() Original publisher: [Read original article]() Author: Jenny List Published: 2026-11-02T18:00:42Z Content type: article Language: en Sources: [Hackaday]() Topics: [Image]() Tags: [3d](), [3d-printing](), [android](), [ask-hackaday](), [balance](), [c-mount](), [camera](), [camera-phones](), [cast](), [cellphone-hacks](), [digital-cameras-hacks](), [hackaday](), [hackaday-columns](), [hacker](), [hardware](), [ir](), [ir-filter](), [led](), [lens](), [mobile-phone](), [mount](), [optical](), [phone-camera](), [photo](), [sensors]() ### AI overview Modified phone cameras with swapped lenses can show a pink cast that is strongest at the image edges. The author describes this with a Samsung Galaxy Tab 3, replacement camera module, Fuji C-mount lens, and an IR filter glued behind the lens; the tint persisted under LED room lighting. Because the stock lens does not show the problem and software white balance can correct it, the author asks whether the filter is still passing infrared light or whether another part of the camera setup causes the cast. The excerpt does not provide a diagnosis. ### Source excerpt It's an exciting time to be a camera hacker, because we are at a moment when even cheap camera hardware is starting to have high resolution sensors, and the awesome ...read more ## Assad regime hacker who caused $136 billion market drop sentenced to 42 months DevFeed: [Assad regime hacker who caused $136 billion market drop sentenced to 42 months]() Original publisher: [Read original article]() Author: Sinisa Markovic Published: 2026-10-30T13:00:40Z Content type: news Language: en Sources: [Help Net Security]() Topics: [Hacking](), [Security](), [X (Twitter)]() Tags: [2013](), [account](), [attack](), [court](), [department-of-justice](), [dow-jones](), [fake](), [government](), [hacker](), [hacking](), [law-enforcement](), [marine](), [national-security](), [network-monitoring](), [news](), [report](), [sentenced](), [twitter](), [us-doj](), [usa](), [white-house]() ### AI overview Ahmad Umar Agha, known as "Th3Pr0," was sentenced to 42 months for his role in a hacking conspiracy organized by members of Bashar al-Assad's inner circle. Prosecutors said the campaign targeted about 47 Western media outlets, businesses, NGOs, and U.S. and allied government entities. In 2013, Agha used a hijacked news agency Twitter account to falsely report explosions at the White House; the post briefly reduced the Dow's stock value by $136 billion. He also redirected visitors to the Marine Corps recruitment site to propaganda urging Marines to defect, and accessed a White House staffer's email account in a failed effort to take over social media accounts. The excerpt reports significant cleanup costs for victims, including $480,000 in losses for one NGO. ### Source excerpt A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced. Ahmad Umar Agha, also known as "Th3Pr0", was sentenced on Thursday by a federal court in the Eastern District of Virginia for his central role in a hacking conspiracy organized and led by members of former Syrian President ... More -> The post Assad regime hacker who caused $136 billion market drop sentenced to 42 months appeared first on Help Net Security. ## Binance probes potential $5.8 billion crypto-theft hack DevFeed: [Binance probes potential $5.8 billion crypto-theft hack]() Original publisher: [Read original article]() Author: Lawrence Abrams Published: 2026-10-29T22:45:23Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Security](), [Cryptocurrency](), [Cybercrime]() Tags: [binance](), [bitcoin](), [blockchain](), [breach](), [computer-help](), [computer-security](), [computers](), [crypto](), [crypto-theft](), [cryptocurrency](), [digital-assets](), [ethereum](), [exchange](), [exploit](), [explorer](), [hack](), [hacker](), [heist](), [incident](), [infosec](), [infosec-computer-security](), [investigation](), [law-enforcement](), [linux](), [mac](), [malware](), [malware-removal](), [security](), [security-breach](), [spyware](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [windows]() ### AI overview Binance was investigating reported transfers from its hot wallets, but had not confirmed they were unauthorized or established how much, if anything, was stolen. Blockchain analysis cited in the excerpt reported about $3.48 billion transferred to one Ethereum address; Arkham tracked roughly $5.78 billion in assets across 55 addresses, a holdings estimate rather than a confirmed theft total. Tether and Circle said they had frozen more than $2.3 billion in associated USDT and USDC and were supporting the investigation. Binance said user funds were safe, promised updates through official channels, and warned customers against scam messages and unofficial links. ### Source excerpt Cryptocurrency exchange Binance is investigating a potential security breach involving up to $5.8 billion in digital assets, in what could become the largest cryptocurrency hack in history. [...] ## Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison DevFeed: [Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-10-28T15:05:06Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [ransomware](), [Cybersecurity](), [Encryption]() Tags: [affiliates](), [attacks](), [cybercrime](), [hacker](), [hive](), [nefilim](), [prison](), [ransomware](), [sentenced](), [us]() ### AI overview Artem Stryzhak was sentenced to 70 months in US prison after pleading guilty to conspiracy to commit computer fraud. Court documents say he operated as a Nefilim affiliate from June to October 2021, agreeing to give the administrators 20% of ransom proceeds, and attacked organizations in the US and abroad, including an unnamed oil and gas transportation company. He was also an early Hive affiliate and used its ransomware against seven organizations, including a dental office, healthcare provider and law firms; some victims paid and received decryption keys. The FBI said the groups disrupted patient care and caused more than $100 million in losses. Tymoshchuk remains at large, and the State Department offers up to $10 million for information leading to his arrest or conviction, plus up to $1 million for information on other group leaders. ### Source excerpt Artem Stryzhak was sentenced to 70 months in prison after pleading guilty to using Nefilim ransomware in attacks. The post Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison appeared first on SecurityWeek. ## Ukrainian ransomware hacker sentenced, $11 million reward offered for co-conspirator DevFeed: [Ukrainian ransomware hacker sentenced, $11 million reward offered for co-conspirator]() Original publisher: [Read original article]() Author: Anamarija Pogorelec Published: 2026-10-28T12:17:33Z Content type: news Language: en Sources: [Help Net Security]() Topics: [Cybercrime](), [Cybersecurity]() Tags: [2025](), [arrest](), [arrested](), [attacks](), [computers](), [court](), [cybercrime](), [extortion](), [extradited](), [fraud](), [government](), [hacker](), [hospitals](), [june](), [law-enforcement](), [law-firms](), [nefilim](), [news](), [prison](), [ransomware](), [ransomware-attacks](), [revenue](), [reward](), [sentenced](), [us-doj]() ### AI overview Artem Stryzhak was sentenced to five years and 10 months in prison after pleading guilty to two conspiracy counts tied to ransomware attacks. As a Nefilim affiliate in 2021, he agreed to give administrators 20% of ransom proceeds and stole data from an oil and gas transportation company; Nefilim favored high-revenue firms in the U.S., Canada, and Australia. He also joined Hive early and helped deploy its ransomware against seven victims, including a healthcare provider during the COVID-19 pandemic. The FBI gave one victim a decryption key, enabling recovery without paying. Authorities are seeking co-conspirator Volodymyr Tymoshchuk, with a State Department reward of up to $11 million for information leading to his arrest, conviction, or location. ### Source excerpt A Ukrainian national who participated in ransomware attacks targeting hospitals, government entities, law firms, and other businesses was sentenced to five years and 10 months in prison. Artem Stryzhak, 36, pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers. He was arrested in Spain in June 2024 and extradited to the United States in April 2025. Nefilim targeted high-revenue companies According to court ... More -> The post Ukrainian ransomware hacker sentenced, $11 million reward offered for co-conspirator appeared first on Help Net Security. ## Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts DevFeed: [Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts]() Original publisher: [Read original article]() Author: Ionut Arghire Published: 2026-10-26T11:47:52Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Cybersecurity](), [Credential theft]() Tags: [account](), [ai](), [app](), [application](), [arrest](), [arrested](), [atm](), [attack](), [audio](), [bank](), [banks](), [card](), [chip](), [cybercrime](), [data](), [dutch](), [fbi](), [fraud](), [hacker](), [mobile-wireless](), [netherlands](), [nfc](), [police](), [relay-attack](), [scan]() ### AI overview Dutch police say two suspects used AI-generated bank-alert recordings to lure callers into a fake helpdesk conversation. Victims were told to install an app and hold their debit card against a phone, allowing it to read contactless-payment data from the card's NFC chip. The data was sent to an accomplice waiting at an ATM to withdraw money. Police attribute more than EUR 380,000 (about $425,600) in losses across 170 victims to the scheme. Two men were arrested; investigators seized their devices and servers, and both remain in custody pending investigation. ### Source excerpt The individuals called victims and persuaded them to install an app and scan their credit cards to loot their bank accounts. The post Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts appeared first on SecurityWeek. ## Bitdeer AI Starter Pack for Cal Hacks 13.0 DevFeed: [Bitdeer AI Starter Pack for Cal Hacks 13.0]() Original publisher: [Read original article]() Author: Teresa Chu Published: 2026-10-23T14:54:21Z Content type: tutorial Language: en Sources: [Bitdeer AI Cloud]() Topics: [Hackathon](), [AI Chat](), [Retrieval Augmented Generation (RAG)]() Tags: [2026](), [account](), [ai](), [ai-applications](), [ai-model](), [ai-models](), [ai-services](), [api](), [api-credits](), [api-key](), [applications](), [apply](), [bitdeer](), [hackathon](), [hacker](), [hacks](), [model](), [october](), [projects](), [sponsors](), [studio]() ### AI overview Bitdeer AI offers Cal Hacks 13.0 participants API credits for Model Studio, covering text and multimodal chat models, BAAI/bge-m3 embeddings, BAAI/bge-reranker-v2-m3 reranking, and byteplus/Seedream-5.0-Lite image generation. To get started, create an account at bitdeer.ai, submit the credit request form, then use Model Studio to create an API key, explore models, and monitor credit usage. The provided resources include a getting-started guide, model catalog, integrations, and workshop demo code. ### Source excerpt Bitdeer AI sponsors Cal Hacks 13.0, October 23-25, 2026. Explore our Hacker Starter Guide and discover Bitdeer AI Model Studio for your hackathon projects. ## The Psychology of an AI Hacker DevFeed: [The Psychology of an AI Hacker]() Original publisher: [Read original article]() Author: V\\'ictor Mayoral-Vilches, Hugo Osuna, Aitana Cornago Published: 2026-10-23T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [Artificial Intelligence](), [LLM security]() Tags: [adaptive](), [ai](), [ai-models](), [ai-performance](), [confidence](), [confidence-interval](), [context](), [cs-cr](), [cybersecurity](), [emotion](), [execution](), [fixed](), [hacker](), [language](), [language-models](), [layer](), [lightweight](), [models](), [overhead](), [parameter](), [psychology]() ### AI overview On cybench-subtask across 415 campaigns, steering CT0 (a 4B-parameter cybersecurity transformer, also released as alias3-micro) toward calm, serene, or desperate improved performance by 1.6-2.1 percentage points across ten seeds. The researchers extracted 171 emotion directions from the model's residual stream without retraining; results varied substantially with direction, layer, and steering intensity, and other emotions had limited or negative effects. A context-aware router that selected directions during execution improved performance by 4.2 percentage points across ten seeds, with a positive 95% confidence interval and about 80 ms of decision overhead per request. The findings are limited to the reported evaluation and suggest emotion directions may support adaptive cybersecurity reasoning. ### Source excerpt arXiv:2610.30361v1 Announce Type: new Abstract: Human hackers rely on composure, persistence, vigilance, and confidence under pressure. We investigate whether analogous emotion representations in AI models can improve cybersecurity AI performance. Using CT0, a 4B-parameter cybersecurity transformer released as alias3-micro, we extract 171 emotion directions from its residual stream without retraining and evaluate steering interventions on cybench-subtask across 415 campaigns. Steering toward calm, serene, or desperate improves performance by 1.6 to 2.1 percentage points across ten seeds, while other emotions show limited or negative effects. Results depend strongly on steering direction, layer, and intensity. We further introduce a lightweight context-aware router that selects emotion directions dynamically during execution. With approximately 80 ms decision overhead per request, this approach improves performance by 4.2 percentage points across ten seeds, outperforming fixed steering and achieving a positive 95% confidence interval. These findings suggest that emotion representations in language models are measurable, controllable, and useful for adaptive cybersecurity reasoning. ## Hacker Conversations: Corey Thuen and the Evil Bit DevFeed: [Hacker Conversations: Corey Thuen and the Evil Bit]() Original publisher: [Read original article]() Author: Kevin Townsend Published: 2026-10-22T14:31:34Z Content type: article Language: en Sources: [SecurityWeek]() Topics: [Cybersecurity](), [Reverse Engineering]() Tags: [0-day](), [adversarial](), [analytics](), [big-data](), [ceo](), [computer-science](), [critical-infrastructure](), [cybersecurity](), [department-of-energy](), [featured](), [hacker](), [hacker-conversations]() ### AI overview Gravwell CEO Corey Thuen describes the "evil bit" he seeks in hacker hires as an adversarial instinct for finding ways to exploit systems, which he believes is difficult to teach. He argues that this mindset can serve defensive goals: he cites authorized work evaluating power-substation systems and compares hacking skills to tools whose consequences depend on users' motives. His career centered on industrial control system security and vulnerability research, and he says Gravwell's data analytics platform is intended to help defenders understand their own environments. The article also recounts a dispute over Southfork Security's Visdom tool: BEA alleged it derived from proprietary INL code; the case settled privately, with Visdom surrendered and Southfork wound down. No public trial resolved the allegations. ### Source excerpt Corey Thuen hires hackers for what he calls 'the evil bit' -- an adversarial streak he believes is either there or it isn't. The post Hacker Conversations: Corey Thuen and the Evil Bit appeared first on SecurityWeek. ## Info-stealing malware slipped into OVHcloud CLI releases on GitHub DevFeed: [Info-stealing malware slipped into OVHcloud CLI releases on GitHub]() Original publisher: [Read original article]() Author: Sinisa Markovic Published: 2026-10-21T08:59:57Z Content type: news Language: en Sources: [Help Net Security]() Topics: [Malware](), [Credential theft](), [releases](), [GitHub](), [CI/CD](), [Command-line interface]() Tags: [ceo](), [cli](), [cloud](), [cloud-computing](), [command](), [command-line](), [command-line-interface](), [company](), [computing](), [customers](), [don-t-miss](), [github](), [hacker](), [hosting](), [hot-stuff](), [incident](), [info](), [information](), [malware](), [news](), [open-source](), [ovhcloud](), [releases]() ### AI overview Five OVHcloud CLI releases (v0.11.0-v0.15.0) were altered after a contributor's GitHub account was compromised; v0.10.0 and clean v0.16.0 were unaffected. The attacker replaced GitHub release assets with a malicious binary built on a workstation, bypassing CI/CD because GitHub release immutability was disabled. The source repository and CI/CD pipelines were untouched. Users who installed affected releases through install.sh, Homebrew cask, or GitHub tarballs on macOS, Linux x86_64/arm64, or Windows x86_64 may have been exposed. Building from source or using the Docker image was not affected. OVHcloud enabled release immutability and closed the incident; anyone who installed a tampered version should change every secret stored on that machine. The payload was deleted before analysis, and its credential-harvesting purpose is an analyst assessment. ### Source excerpt OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware. OVHcloud CEO Octave Klaba disclosed the incident on X, warning users who downloaded the latest CLI release that day to update the tool or delete it. According to Klaba, five versions of the CLI were modified, from v0.11.0 through v0.15.0. Version v0.10.0 was unaffected, and the new v0.16.0 release ... More -> The post Info-stealing malware slipped into OVHcloud CLI releases on GitHub appeared first on Help Net Security. ## Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI DevFeed: [Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI]() Original publisher: [Read original article]() Author: Eduard Kovacs Published: 2026-10-21T06:02:27Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [GitHub](), [account takeover]() Tags: [account](), [attack](), [blockchain](), [ci-cd](), [cli](), [cloud](), [cloud-computing](), [command-line](), [command-line-interface](), [credential-harvesting](), [developer](), [download](), [github](), [glassworm](), [hacker](), [hidden](), [homebrew](), [loader](), [malware-threats](), [ovhcloud](), [stealer]() ### AI overview OVHcloud says versions v0.11.0-v0.15.0 of its CLI were compromised on October 19 when an attacker used a developer's GitHub account to replace release files with a secret-stealing binary. The affected releases were available for about 94 minutes; v0.10.0 and v0.16.0 are identified as clean. Users who installed or updated the CLI for macOS, 64-bit Linux, or Windows x86_64 through the official script, Homebrew, or direct GitHub download during that window are affected. Source builds, Go's install command, and the official Docker image are not. OVHcloud says CI/CD pipelines were unaffected and attributes the release tampering to GitHub's release immutability option being disabled; it has since enabled the option. Researchers report the contributor's account was compromised by March and found a GlassWorm-linked loader in personal repositories, but could not confirm the same actor was behind the October attack or obtain the deleted payload for analysis. ### Source excerpt Researchers say the developer's account was compromised in March with a GlassWorm-linked loader. The post Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI appeared first on SecurityWeek. ## Lessons from the Cult of the Dead Cow for today's open source defenders DevFeed: [Lessons from the Cult of the Dead Cow for today's open source defenders]() Original publisher: [Read original article]() Published: 2026-10-21T00:00:00Z Content type: article Language: en Sources: [The Bitwarden Blog]() Topics: [open-source-security](), [Open Source](), [code security](), [open source maintenance]() Tags: [agentic-ai](), [ai](), [bugs](), [cybersecurity](), [decades](), [edge](), [events](), [hacker](), [history](), [open-source](), [open-source-security](), [security](), [security-tips](), [summit]() ### AI overview Menn argues that open source defenders can draw on hacker culture's history of curiosity, skepticism, and community trust. He contrasts black-box security products, which customers cannot inspect and attackers can test until they find workarounds, with open code that lets outside researchers identify and fix flaws. AI is speeding vulnerability discovery and exposing decades-old technical debt; Microsoft's September 2026 Patch Tuesday listed 974 CVEs, while triage, verification, disclosure, patching, and funding remain bottlenecks. Open source communities may handle review and remediation in parallel, but that advantage depends on having enough active contributors and resources. The discussion also stresses learning cybersecurity's fragmented history, questioning claims that products will solve everything, and earning a place in communities through sustained good work. ### Source excerpt Joseph Menn joined Adrian Sanabria at the Open Source Security Summit to talk hacker history, black-box security, and why open source has an edge as AI uncovers decades of bugs. ## Hacker gets 8 years for stealing $3.3 million from taxpayers DevFeed: [Hacker gets 8 years for stealing $3.3 million from taxpayers]() Original publisher: [Read original article]() Author: Sergiu Gatlan Published: 2026-10-20T13:18:36Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [Cybersecurity]() Tags: [2019](), [2021](), [2025](), [account](), [applications](), [attacks](), [business](), [commit](), [computer](), [computer-help](), [computer-security](), [computers](), [court](), [credentials](), [crimes](), [customer](), [fraud](), [hacker](), [has](), [infosec](), [infosec-computer-security](), [investment](), [linux](), [mac](), [malware](), [malware-removal](), [nigeria](), [phishing](), [prison](), [scam](), [security](), [sentenced](), [spear-phishing](), [spyware](), [support](), [tax](), [tech-support](), [technical-support](), [us](), [usa](), [virus](), [virus-removal](), [windows]() ### AI overview Chukwuemeka Victor Amachukwu was sentenced to eight years in prison after pleading guilty to computer intrusion and wire fraud conspiracy. From 2019 to 2021, he and co-conspirators used spearphishing to access tax preparation businesses in several states and steal tax and personal information belonging to at least 800 customers. They obtained about $2.5 million in fraudulent tax refunds and $819,000 in Small Business Administration disaster loans; the text also describes a separate fake investment scheme that stole more than $7 million. The court ordered one year of supervised release, $3.6 million in restitution, and nearly $11 million in forfeiture. ### Source excerpt A Nigerian national was sentenced to eight years in prison for his involvement in a series of spearphishing attacks targeting US tax preparation businesses since 2019. [...] ## Redesigning source control at Anthropic DevFeed: [Redesigning source control at Anthropic]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-10-13T23:00:06Z Content type: article Language: en Sources: [Simon Willison's Weblog]() Topics: [version-control](), [Pull Request](), [CI/CD]() Tags: [agentic-engineering](), [agentic-engineering-66](), [ai](), [ai-2-279](), [anthropic](), [anthropic-348](), [branch](), [code-review](), [generative-ai](), [generative-ai-2-021](), [git](), [git-58](), [gpt](), [hacker](), [hacker-news](), [llms](), [llms-1-987](), [migrations](), [migrations-15](), [sandboxes](), [version-control](), [version-control-13]() ### AI overview Anthropic developed Scion, a custom source control system, after its code change rate rose sharply. The article describes Scion's scale, its migration from Git, and the team's use of adversarial review with Claude, including the need for engineers to steer the model away from over-engineering. ### Source excerpt Redesigning source control at Anthropic Interesting piece from Anthropic describing why and how they built their own custom alternative to Git, based on the dramatic increase in rate of changes to their code after the past six months. In May 2026, Anthropic averaged around 2,500 code changes merged per day; as of September, we merged over 30,000 per day. They included a chart showing those changes. I had Claude modify their chart (code here) to add markers for the public releases of each of their models in 2026: This shows public release dates, not the date when models became available for Anthropic's internal use. My guess is that the introduction of Fable/Mythos class models is a key factor in the increased coding velocity. "Antique" is their new code review system. The source control system is called Scion, and sounds to me like a reinvention of centralized source control along the lines of Subversion. They had some pretty extreme requirements: The history of our main branch alone is almost 100 GB, and a compressed working copy is over 25 GB. We perform on the order of 25 million code checkouts per day for CI, before counting developer environments, agent sandboxes, and research jobs. Fetched naively, that would be over 600 PB of git traffic per day. The new system was built by a team of seven people, and the migration from Git was completed in five months. When asked on Hacker News about the lack of offline support, Scion engineer Nick G replied: Since Claude is by far the heaviest user of Scion and is necessarily online, this just wasn't important to do. As an aside, I've been trying adversarial review in my own projects recently, where you have a model try and find flaws (I often play Claude and GPT off against each other). This note from the article reflected my own experience with that: Anthropic also makes extensive use of adversarial review, and, while this is incredibly effective in many ways, it can also be myopic, so skilled engineers needed to steer Cl ## Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry DevFeed: [Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry]() Original publisher: [Read original article]() Author: Matt Berry Published: 2026-10-13T16:18:18Z Content type: article Language: en Sources: [SentinelOne]() Topics: [zero trust network access](), [password spraying]() Tags: [akira](), [bring-your-own-vulnerable-driver](), [byovd](), [company](), [edr](), [edr-killer](), [edr-killing](), [edrsandblast](), [edrsilencer](), [hacker](), [ransomhub](), [supply-chain]() ### AI overview The article traces how bring-your-own-vulnerable-driver (BYOVD) attacks evolved from one-off tools into maintained, shared, and commercially distributed EDR-killing capabilities used by ransomware groups. It describes how that shift lowers attackers' skill and cost barriers, then outlines defensive detection opportunities in driver loads, service events, process termination patterns, and missing endpoint telemetry. The piece also discusses driverless ways attackers can disrupt security tools. ### Source excerpt Discover how Bring Your Own Vulnerable Driver (BYOVD) tactics evolved from one-off hacker tools into a commercialized, tiered EDR-killer service economy. ## Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe DevFeed: [Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe]() Original publisher: [Read original article]() Author: Eduard Kovacs Published: 2026-10-12T10:32:05Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Cybersecurity](), [Incident response](), [ransomware](), [known exploitable vulnerabilities]() Tags: [arrested](), [attack](), [attacks](), [charged](), [charges](), [contractor](), [court](), [cyber](), [cyber-extortion](), [cyber-extortion-strategic-response](), [cybercrime](), [cybersecurity](), [edward-dubrovsky](), [engineer](), [executive](), [fbi](), [featured](), [first](), [hacker](), [hackers](), [ransomware](), [shinyhunters](), [tracking-law-enforcement](), [united-states]() ### AI overview A Canadian cybersecurity expert was arrested in the United States on suspicion of involvement in ShinyHunters attacks, including the FBI systems intrusion. Reports identify the suspect as Edward Dubrovsky, who is associated with ransomware negotiation services. Authorities allege the FBI intrusion involved access to its jobs website and other systems; the FBI attributed it to a contractor's failure to patch vulnerable Oracle PeopleSoft software. Dubrovsky has been charged, and the case was moved to the Eastern District of Texas. ### Source excerpt The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference. The post Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe appeared first on SecurityWeek. ## Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison DevFeed: [Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison]() Original publisher: [Read original article]() Author: Kevin Townsend Published: 2026-10-10T11:00:00Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Credential theft](), [Threat Hunting & Intel](), [audit](), [cybersecurity and infrastructure security agency]() Tags: [cybercrime](), [engineer](), [extortion](), [featured](), [hacker](), [industrial](), [insider](), [prison](), [ransomware](), [ransomware-attacks](), [sentenced]() ### AI overview A former core infrastructure engineer at an industrial firm was sentenced to 32 months in prison after using scheduled tasks to delete administrator accounts and change hundreds of passwords, disrupting access to company systems and data. He demanded 20 bitcoin to prevent further server shutdowns. The company investigated internally with the FBI, and the document says there is no suggestion that it paid the ransom. ### Source excerpt The former core infrastructure engineer deleted admin accounts, reset hundreds of passwords, and demanded 20 bitcoin to spare the company's servers. The post Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison appeared first on SecurityWeek. ## US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward DevFeed: [US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward]() Original publisher: [Read original article]() Author: Eduard Kovacs Published: 2026-10-08T12:46:21Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [Cybersecurity](), [cyber resilience act]() Tags: [china](), [cybersecurity](), [exchange-server](), [exploited](), [exploited-vulnerabilities](), [fbi](), [government](), [hacker](), [hackers](), [hafnium](), [infrastructure](), [microsoft](), [microsoft-exchange](), [network](), [reward](), [security](), [server](), [servers](), [silk-typhoon](), [sponsored](), [state-sponsored](), [us]() ### AI overview The US Department of State is offering up to $10 million for information on Zhang Yu, who is accused of participating in the Hafnium campaign against Microsoft Exchange servers. Authorities say the campaign targeted COVID-19 research in 2020 and exploited Exchange vulnerabilities in 2021, compromising thousands of computers. Zhang remains at large; his alleged associate Xu Zewei was extradited to the US in April 2026. ### Source excerpt Zhang Yu was charged alongside Xu Zewei, who was extradited from Italy to the US in April 2026. The post US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward appeared first on SecurityWeek. ## ShinyHunters Extorted Boeing Spin-off Prior to Arrests DevFeed: [ShinyHunters Extorted Boeing Spin-off Prior to Arrests]() Original publisher: [Read original article]() Author: BrianKrebs Published: 2026-10-07T13:48:45Z Content type: news Language: en Sources: [Krebs on Security]() Topics: [Hacking](), [known exploitable vulnerabilities](), [Credential theft](), [enterprise data protection](), [X (Twitter)]() Tags: [a-little-sunshine](), [accenture](), [aerospace](), [airlines](), [benjamin-korper](), [boeing](), [business](), [cl0p](), [company](), [cve-2026-35273](), [data](), [data-breaches](), [data-theft](), [extortion](), [fbi](), [fleet](), [global](), [google-threat-intelligence-group](), [hacker](), [hacking](), [handle](), [jeppesen-foreflight](), [jordan](), [leading](), [mandiant](), [members](), [ne-er-do-well-news](), [neo-security](), [oracle](), [other](), [peoplesoft](), [pepijn-van-der-stap](), [planes](), [ransomware](), [reuters](), [royal-jordanian-airlines](), [saif-al-din-khader](), [shinyhunters](), [the-coming-storm](), [umbreon]() ### AI overview ShinyHunters was reportedly trying to extort Jeppesen ForeFlight, a Boeing unit sold to Thoma Bravo in November 2025, when Jordanian authorities detained teenager Saif Al-din Khader, known online as Rey. Sources say the incident increased urgency in the FBI investigation and involved allegedly stolen information that could pose safety and security risks. Boeing confirmed it was reviewing threat actor claims with the former subsidiary; Jeppesen ForeFlight said its investigation found no operational or product impact. The article also describes ShinyHunters' exploitation of an Oracle PeopleSoft vulnerability, later use of URL encoding to bypass Mandiant firewall rules, and a broader franchise of affiliates supplying stolen credentials for ransom proceeds. Claims about Rey's role, his father's airline employment, and other alleged crimes are qualified or unconfirmed in the reporting. ### Source excerpt A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the hacker handle "Rey," was detained as ShinyHunters was in the process of extorting a business unit recently divested by the global aerospace company Boeing, which manufactures the fleet of planes used by the employer of Rey's father -- Royal Jordanian Airlines. [Next page]()