We may earn a commission from links on this page.

My house has precisely one outdoor area, which makes it precious. It’s the only spot where we can hang out outside without actually leaving. Since I’m a dedicated introvert who enjoys fake conversations with his cats more than real conversations with people, that’s incredibly important. As a result, I put a lot of time into keeping the deck comfortable and in good repair.

A few years ago, I replaced some of the composite decking with new pieces that didn’t quite match the original color, so I painted the decking to keep things uniform. This past winter was pretty rough on the deck, though, which was starting to look a little worn:

My deck before the paint job, looking a little sad. Credit: Jeff Somers

The time had obviously come for a fresh paint job. I chose a lighter color this time and went shopping for the tools I’d need. A roller and a brush? Nope. A regular, cheap push broom and a bender pad.

How to paint a deck with a broom and a bender pad

Here’s all I needed to paint my deck: A paint tray, a can of floor and patio paint, a broom, and a bender pad:

My paint tools for this project. Credit: Jeff Somers

Painting your deck with a push broom is a lot easier than using a paint roller or a brush. A 10-inch push broom pretty generally covers two deck planks, and the bristles work the paint into the crevices much more efficiently than a roller, requiring fewer passes to get good coverage. And a bender pad is just a flexible, handheld tool that slips easily between tight spaces that need to be painted—like the spaces between deck boards.

Using these two unusual tools, I banged out this paint job in about an hour from start to finish. First, I cleaned the deck using a stiff brush to scrape away any dirt that had crusted on it. I scraped any loose paint away and let the deck dry out thoroughly. Once it was dry, I grabbed the broom and got to work. The key is to choose a push broom with flexible bristles—if they’re too stiff, you won’t get good coverage.

Using the broom to paint the deck. Credit: Jeff Somers

I alternated between painting the top of the boards and working on the spaces between with the bender bar. Instead of working a sloppy brush in between the boards, the bender pad smoothly pads the sides of the boards, leaving a clean, near-perfect coat. In retrospect, I should have started off by painting the sides first so I didn’t have to twist myself into pretzels at times because the boards were all wet with paint, but that’s a lesson for another time.

Using the bender pad on the deck. Credit: Jeff Somers

The broom and bender pad combo made painting the deck super easy and fast. If you’ve got a deck you want to paint or stain, forget the rollers and brushes and use a broom and a pad instead. You won’t regret it. Here’s the finished result:

My deck after the paint job. Credit: Jeff Somers

from Lifehacker https://ift.tt/7WjLR5p

In recent years, Apple has taken significant steps to make the iPad more like a Mac. But while windowed multitasking and a desktop-like Files app helps bridge the gap, the gap still exists. It's still a bit too difficult to use an iPad like a touchscreen MacBook, leaving fans who want such a product wanting. Luckily, a touchscreen MacBook is in the works—it might just take a bit longer than expected to get here.

11-inch iPad Pro (256GB)

$899.99 at Amazon

$999.00 Save $99.01

$899.99 at Amazon

$999.00 Save $99.01

The touchscreen MacBook Pro might not get here until 2027

In the latest edition of his Power On newsletter, Bloomberg's Mark Gurman shares the bad news: Apple's first MacBook with a touchscreen is more likely to arrive in 2027 than in 2026. See, Gurman previously reported that it was possible Apple would ship 14- and 16-inch MacBook Pros with touch-enabled displays later this year. Another Apple leaker, Ming-Chi Kuo, had a similar assessment. That said, Gurman had reserved the possibility that Apple could push into 2027, depending on how quickly it could actually get its supply out to the market.

That seems to be the case here: The global RAM shortage is hitting everyone hard. As AI companies scoop up as much memory as possible, manufacturers are having trouble producing enough RAM to meet demand. That forces prices for RAM and the devices that use it to rise, but it also puts a strain on companies that are trying to build hardware with RAM: Apple included.

The release date might not have been set in stone regardless, but were Apple more ahead of schedule, it may have announced the new product at WWDC 2026—an event usually reserved for software releases. But Apple likely won't announce a product so early in development if it isn't planning on releasing it until next year, so we'll likely need to keep waiting.

Apple's touchscreen MacBook Pro may come with other advantages

While the touchscreen is the main focus of this upcoming product, this MacBook Pro is rumored to have a number of other perks as well. In addition to being able to touch the display for the first time, this MacBook might be Apple's first to come with an OLED display, rather than the mini-LED tech the MacBook Pros currently ship with. In addition, Apple may take the opportunity to roll out the M6 Pro and M6 Max chips with this MacBook Pro, making it the most powerful MacBook yet.

If you have a newer iPhone, this MacBook may resemble it a bit, too: Apple might ditch the camera "notch" in favor of an iPhone-like Dynamic Island. Apple made that switch back with the iPhone 14 Pro, and might do the same with its first touchscreen Mac—though some developers have tried turning the current notch into a Dynamic Island. Finally, Apple might slim down the MacBook Pro line with this model, offering the first major design refresh since 2021.

from Lifehacker https://ift.tt/oBKwDhR

Nikkei Asia has some bad news for anyone hoping for RAM prices to fall anytime soon: The outlet reported on Friday that the global shortage of memory chips will likely continue until around 2027. According to Nikkei, U.S. and South Korean memory suppliers are raising DRAM production, but are only going to be able to meet about 60% of the demand. What's more, the current conflicts in the Middle East are making electricity and other relevant goods more expensive. Even Samsung, which is launching a fourth RAM plant this year, won't be at full-scale production until at least 2027, if not later.

The memory crisis is ongoing

Part of the problem is split production needs: Samsung's fourth plant needs to make logic chips for computing as well, which means it can't use all of its resources to develop memory chips. And while the company is also building a fifth plant, that location will be designated for producing advanced high-bandwidth memory (HMB), a specific type of memory used for AI semiconductors. That could lower the demand for more general use RAM, but Nikkei reports that this fifth plant will not begin running until 2028 or later. Nikkei reports that memory prices for the first three months of this year are up 90% on the quarter.

A silver lining though: SK Hynix, the second-largest memory chip producer in the world, is currently producing HMB chips, and has been since February. SK Hynix is also on track to start producing in a new plant in Seoul by February 2027, which is three months earlier than previous estimates. That said, Nikkei says this is the only production increase among the big three memory companies, which include SK Hynix, Samsung, and Micron Technology (based in the U.S.) For its part, Micron will start producing in both Idaho as well as Singapore in 2027. Taken together, these three companies control 90% of the global DRAM, and are the only companies that can make HBM.

Nikkei cites Counterpoint Research, which estimates that these companies would need to increase production by 12% per year through 2027 in order to fix the RAM shortage. Right now, it reports that growth looks to be about 7.5%. As such, the issue may not return to normal until sometime next year.

The RAM shortage affects everything

This news is disappointing, especially following positive developments in late March. Back then, we saw prices for RAM kits drop slightly—still far above historic lows, but $30 to $45 reductions in a time when the biggest AI companies on the planet were buying up as much RAM as possible. But following Nikkei's reporting, general prices likely won't fall (or stop rising) for at least another year and a half.

Unfortunately, that has implications for everything that uses RAM, not just the RAM itself. While those who build or work with computers will notice the strain on RAM hardware, there's a long list of consumer devices that will continue to be impacted here as well. Smartphones, laptops, smart glasses, tablets, gaming consoles, cars: If it runs on a computer, it uses RAM. Coupled with market instability across the globe, expect prices on devices you buy to increase in tandem. This perfect storm likely caused Sony to raise prices on the PlayStation consoles and handhelds, for example.

from Lifehacker https://ift.tt/WTmpDwa

Cloud deployment and hosting platform Vercel has suffered a security breach that resulted in attackers accessing some of its internal systems and compromising Vercel credentials of a “limited subset of customers”.

Advice for affected customers

“The incident originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee,” the Vercel security team explained in a post published on Sunday.

“The attacker used that access to take over the employee’s Vercel Google Workspace account, which enabled them to gain access to some Vercel environments and environment variables that were not marked as ‘sensitive.'”

Vercel CEO Guillermo Rauch explained it better: “Vercel stores all customer environment variables fully encrypted at rest. We have numerous defense-in-depth mechanisms to protect core systems and customer data. We do have a capability however to designate environment variables as ‘non-sensitive’. Unfortunately, the attacker got further access through their enumeration.”

Confirmed affected customers were notified directly and advised to immediately rotate credentials and environment variables, review their account’s activity log and environments for suspicious activity, rotate Deployment Protection tokens (if used), and look for recent unexpected or suspicious looking deployments.

“Take advantage of the sensitive environment variables feature going forward, so that secret values are protected from being read in the future,” the team also counseled.

In the meantime, the company deployed additional protection measures, extended their monitoring, notified law enforcement, and called in experts to help with the investigation.

“We’ve analyzed our supply chain, ensuring Next.js, Turbopack, and our many open source projects remain safe for our community,” Rauch added.

What happened, exactly?

The investigation into the breach is ongoing, and Vercel is getting help from the Google Mandiant team and other cybersecurity firms.

They’ve already confirmed how attackers managed to gain initial access to the Vercel employee’s account.

“Our investigation has revealed that the incident originated from a small, third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting its hundreds of users across many organizations,” the Vercel security team shared, along with the unique identifier for the app in question: 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com.

Nudge Security CTO Jaime Blasco tied this tool to Context.ai, the company behind the eponymous AI-native office suite.

“Google has deleted the account but I’m confident the third party AI tool that vercel mentioned in the blog post is context[.]ai based on a now removed chrome browser extension listing linked to an oauth grant in the same account id,” he explained. “They removed the extension from the Chrome marketplace on March 27th which is suspicious.”

It’s unlikely that Vercel is the only victim of this third-party compromise. Google Workspace Administrators and Google Account owners have been advised to check whether they are using the Chrome extension and mount an investigation on their own if they are.

“We’ve reached out to Context to assist in understanding the full scale of the incident, in an effort to protect other organizations and the broader internet,” Rauch stated.

On Sunday, Context released an advisory of their own confirming a security incident that involved unauthorized access to their AWS environment.

“Based on information provided by Vercel and some additional internal investigation, we learned that, during the incident last month, the unauthorized actor also likely compromised OAuth tokens for some of our consumer users. We also learned that the unauthorized actor appears to have used a compromised OAuth token to access Vercel’s Google Workspace,” the company stated.

“Vercel is not a Context customer, but it appears at least one Vercel employee signed up for the AI Office Suite using their Vercel enterprise account and granted ‘Allow All’ permissions. Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace.”

Who’s behind the breach?

“We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI,” Rauch said today. “They moved with surprising velocity and in-depth understanding of Vercel.”

Screenshot of the BreachForums post

The Vercel compromise has been claimed by ShinyHunters – or someone who’s impersonating the infamous and prolific cybercriminal group – via a post on BreachForums, and they were apparently trying to sell the stolen information, which they say can be used to mount “the largest supply chain attack ever.”

The post has since been removed and the real ShinyHunters denied involvement in the breach.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

from Help Net Security https://ift.tt/r9n8RJP

Boost Security has released SmokedMeat, an open-source framework that runs attack chains against CI/CD infrastructure so engineering and security teams can see what an attacker would do in their specific environment.

What the tool does

SmokedMeat takes a flagged pipeline vulnerability and executes a live demonstration against a team’s own infrastructure. Starting from a single vulnerability, it deploys a payload, compromises the runner, harvests credentials from process memory, exchanges those credentials for cloud access, exposes private repositories, and maps the blast radius of the attack.

Zaid Al Hamami, CEO of Boost Security, described the scope: “This tool is showing what attackers can do; they can find a vulnerability in an open source repo, craft an exploit payload, steal credentials in that repo, and use those credentials to pivot to other areas, insert malware, infect developers working on those repos.”

The TeamPCP attack that changed the conversation

In March 2026, a coordinated campaign known as TeamPCP compromised Trivy, Checkmarx, LiteLLM, and dozens of npm packages. The attack used techniques that Boost Labs had documented in prior research. Boost’s open-source scanner, Poutine, had flagged vulnerabilities in Trivy’s pipeline months before the attack. Those findings went unpatched. Al Hamami described the campaign as the largest cascade supply chain attack to date.

The backlog problem

Boost Labs had been publishing research on CI/CD attack techniques for years, documenting how attackers move through build pipelines, steal credentials, and pivot into cloud environments. A static scan result that flags “workflow injection possible” does not convey what an attacker can do with that injection in a matter of seconds. Without a concrete demonstration, remediation work tends to stay deprioritized.

SmokedMeat is designed to close that gap by running the attack scenario against real infrastructure, giving security teams and engineering leaders a concrete view of what exploitation looks like in their own environment.

SmokedMeat is available for free on GitHub.

Must read:

Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

from Help Net Security https://ift.tt/GIrLqwg

Syncthing is a free and open-source application that synchronizes files directly between your devices. Instead of uploading data to a central server, it uses a peer-to-peer approach, transferring files whenever peers are online. This decentralized model ensures that your data remains private and under your control.

Syncthing monitors shared folders for changes. When a file is created, modified, or removed, updates are propagated to connected peers. Synchronization happens automatically once they are online, keeping folder contents consistent without manual intervention.

Device identity and connections

Syncthing does not require account creation because it does not rely on a central server. Identity, authentication, and trust are handled directly between peers. Each instance is assigned a unique device ID generated at first startup, which is used to establish trust. Connections are formed by exchanging these IDs and approving them on both sides, creating trusted relationships without external services.

Setup and interface

Initial setup involves installing the application, connecting devices, and selecting folders to share. In this setup, the application was installed on both a Windows system and a macOS device.

Syncthing is managed through a local web-based interface. The device ID generated at startup is used to add and authorize remote peers. The interface provides access to settings, folder management, and synchronization status.

To establish a connection, a remote peer is added using its device ID. The request must be approved on both sides before becoming active. Once approved, the peers are ready to share data.

The synchronization process starts with indexing files, followed by comparing states between devices. Data is transferred directly, and the interface displays progress through stages such as scanning, preparing to sync, and active transfer. Once complete, the folder status indicates that it is up to date. The interface also shows transfer rates, file counts, and connection status.

Built-in security and privacy

All communication between devices is encrypted, and connections are established only after mutual approval. Syncthing uses secure protocols to protect data during transfer, and no third-party servers store user files. This ensures that data remains on user-controlled devices and is shared only with explicitly trusted peers.

Conclusion

Syncthing provides a straightforward way to keep files synchronized across devices without relying on external services. In testing across Windows and macOS, file transfers were consistent and required minimal intervention, making Syncthing a practical solution for maintaining local control over data while keeping it accessible on multiple systems.

from Help Net Security https://ift.tt/MEPQ93g

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

Bringing governance and visibility to machine and AI identities
In this Help Net Security interview, Archit Lohokare, CEO of AppViewX, explains how the rise of AI marked a turning point where machine and AI agent identities began converging into a single problem. Drawing on his experience across IBM and CyberArk, he describes the shift from human-driven systems to autonomous machines.

MITRE releases a shared fraud-cyber framework built from real attack data
The MITRE Fight Fraud Framework, known as F3, is a behavior-based model designed to give both teams a common structure for describing, detecting, and disrupting fraud campaigns. F3 organizes fraudster behavior into tactics and techniques drawn from real-world incidents. The tactics cover the full attack lifecycle: Reconnaissance, Resource Development, Initial Access, Defense Evasion, Positioning, Execution, and Monetization.

ZeroID: Open-source identity platform for autonomous AI agents
ZeroID is an open-source identity platform that implements an identity and credentialing layer specifically for autonomous agents and multi-agent systems. The core issue ZeroID targets is attribution in agentic workflows. When an orchestrator agent spawns sub-agents to carry out parts of a task, each sub-agent may call APIs, write files, or execute shell commands.

Fixing vulnerability data quality requires fixing the architecture first
In this Help Net Security interview, Art Manion, Deputy Director at Tharros, examines why vulnerability data across repositories stays inconsistent and hard to trust. The problem starts with systems not designed to collect or manage that data well. They introduce the idea of Minimum Viable Vulnerability Enumeration (MVVE), a minimum set of assertions needed to confirm two systems describe the same vulnerability, and find no true minimum exists.

Review: The Psychology of Information Security
Security controls fail when they are designed without regard for the people who must use them. That is the central argument of Leron Zinatullin’s second edition, and it is an argument he builds methodically across 17 chapters that draw from organizational psychology, change management, and usability research.

Agentic AI memory attacks spread across sessions and users, and most organizations aren’t ready
In this Help Net Security interview, Idan Habler, AI Security Researcher at Cisco, breaks down a threat most security teams haven’t named yet: agentic memory as an attack surface. Habler walks through MemoryTrap, a disclosed and remediated method to compromise Claude Code’s memory, showing how a single poisoned memory object can spread across sessions, users, and subagents.

Network segmentation projects fail in predictable patterns
Most enterprise networks have segmentation on the roadmap. Many have had it there for years. A survey of 400 U.S.-based network security practitioners who lived through failed segmentation projects finds that failure clusters into four distinct patterns, and the type of failure a team experiences depends heavily on the kind of environment and approach they attempted.

Coordinated vulnerability disclosure is now an EU obligation, but cultural change takes time
In this Help Net Security interview, Nuno Rodrigues Carvalho, Head of Sector for Incident and Vulnerability Services at ENISA, discusses the recent CVE funding scare and what it exposed about the fragility of global vulnerability disclosure infrastructure. He outlines how EU regulations, including the Cyber Resilience Act and NIS2, are creating stronger accountability for vendors and organizations.

The exploit gap is closing, and your patch cycle wasn’t built for this
The Cloud Security Alliance has published a briefing on what it calls a turning point in the threat landscape: the time between a vulnerability being discovered and a working exploit is shrinking fast.

EU cybersecurity standards are at risk if supplier ban passes
The European standards body ETSI sent a formal position paper to the European Commission, calling for changes to the proposed Cybersecurity Act 2 (CSA2), the EU’s planned revision to its existing cybersecurity certification framework.

GitHub lays out copyright liability changes and upcoming DMCA review for developers
A U.S. Supreme Court ruling issued in March has settled a question that has circulated among platform operators and developers for years: whether a service provider can be held liable for copyright infringement committed by its users without evidence of intent to contribute to that infringement.

Cargo theft malware actor spent a month inside a decoy network before researchers pulled the plug
Proofpoint researchers executed a malicious payload from a threat actor known to target trucking and logistics companies in late February 2026, doing so inside a decoy environment. The environment stayed compromised for more than 30 days, long enough for researchers to watch the actor work through their tools, scripts, and decisions beyond the initial break-in.

Workplace stress in 2026 is still worse than before the pandemic
Roughly 40% of employees worldwide said they experienced a lot of stress during the previous day, according to Gallup’s State of the Global Workplace 2026 report, a figure that has remained above pre-pandemic levels for several years. Daily anger stood at 22% globally, sadness at 23%, and loneliness at 22%. Together, these numbers point to a workforce that has not returned to the emotional baseline it held before 2020.

Adobe issues emergency fix for Acrobat Reader flaw exploited in the wild (CVE-2026-34621)
Adobe has pushed out an emergency security update for Adobe Acrobat Reader, patching a zero-day vulnerability (CVE-2026-34621) exploited in the wild since November 2025. CVE-2026-34621 is a critical prototype pollution vulnerability – a type of vulnerability that occurs in JavaScript and allows attackers to add or modify an application’s JavaScript objects and properties.

Hackers hijacked CPUID downloads, served STX RAT to victims
If you tried to download software from CPUID’s website late last week, you might have downloaded malware instead. CPUID (at cpuid[.]com) is a website that hosts free software utilities, primarily for Windows and Android.

Booking.com data breach: Customer reservation data exposed
“Unauthorized third parties may have been able to access certain booking information associated with your reservation,” email alerts sent out by Booking.com over the weekend warn. The online travel agency did not say which system(s) were accessed by the unauthorized third parties nor explained the scope of the incident.

Testing reveals Claude Mythos’s offensive capabilities and limits
Could Claude Mythos Preview, Anthropic’s latest large language model, be leveraged for fully automated cyber attacks? The UK government’s AI Security Institute (AISI) tested its capability to successfully engage in capture-the-flag (CTF) challenges and multi-step attack scenarios, and found that that while its cybersecurity capabilities exceed those of previously available models, it can’t reliably execute autonomous attacks on hardened networks.

Fortinet fixes critical FortiSandbox vulnerabilities (CVE-2026-39813, CVE-2026-39808)
Two vulnerabilities (CVE-2026-39813, CVE-2026-39808) in FortiSandbox could be leveraged by unauthenticated attackers to bypass authentication and execute unauthorized code or commands on vulnerable systems. Both vulnerabilities can be triggered with a specially crafted HTTP request, putting unpatched FortiSandbox deployments at risk.

NIST admits defeat on NVD backlog, will enrich only highest-risk CVEs going forward
NIST is overhauling how it manages the National Vulnerability Database (NVD) and switching to a risk-based model that prioritizes “enrichment” of only the most critical CVE-numbered security vulnerabilities.

Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild
The security researcher who earlier this month published a proof-of-concept (PoC) exploit for a zero-day privilege escalation vulnerability in Microsoft Defender is back with two more. The first, dubbed “RedSun,” is another privilege escalation flaw in the same platform. The second, “UnDefend,” allows a standard user to block Microsoft Defender from receiving signature updates or disable it entirely (if Microsoft pushes a major Defender update).

29 million leaked secrets in 2025: Why AI agents credentials are out of control
GitGuardian’s State of Secrets Sprawl Report found 28,649,024 new secrets exposed in public GitHub commits across 2025, a 34% year-over-year increase and the largest annual jump in the report’s history.

Product showcase: Stop secrets from leaking through AI coding tools with GitGuardian
AI coding assistants are becoming part of everyday development, but they introduce new risks: secrets can be exposed before code reaches a repository or CI pipeline. Developers may paste API keys into prompts, or AI agents may access sensitive data through files and commands. Once inside the workflow, that data can be sent to model providers, logged, or cached. GitGuardian addresses this with ggshield AI hooks, which scan prompts and actions in real time to detect and block secrets before they are exposed.

Why manual certificate management is running out of time
In this video, John Murray, Senior Vice President of Sales at GlobalSign, explains what’s changing in the certificate industry and what companies need to do about it. Certificate validity periods are shrinking, which means companies will need to rotate certificates far more often than before.

Zero trust at year two: What nobody planned for
In this Help Net Security video, Jim Alkove, CEO of Oleria, walks through where zero trust programs typically stand one to two years in. Most organizations have made gains in endpoint security and network segmentation, but identity remains the stubborn problem. Identity sprawl, legacy system exceptions, and workforce friction each contribute to stalls that few programs anticipated.

Webinar: The IT Leader’s Guide to AI Governance
Generative AI is moving into everyday enterprise use, often outpacing governance. As adoption grows, organizations face challenges around security, privacy, and control. This discussion explores how enterprises manage AI governance in practice, focusing on real-world tradeoffs. Learn how guardrails, trusted content, and API-first platforms like headless CMS help bring AI under control while maintaining speed and visibility.

Google makes it harder to exploit Pixel 10 modem firmware
Google is working to improve the security of Pixel phones by focusing on the cellular baseband modem, a part of the device that handles communication with mobile networks and processes external data.

$12 million frozen, 20,000 victims identified in crypto scam crackdown
More than $12 million has been frozen, and over 20,000 victims have been identified in an international law enforcement operation targeting cryptocurrency and investment scammers.

Basic-Fit hack compromises data of up to 1 million members
Basic-Fit, a European gym chain, disclosed that hackers breached one of its internal systems, exposing members’ personal data in several countries. The company operates more than 2,150 clubs in 12 countries under two brands, with more than 5.8 million members.

W3LL phishing service sold for $500 dismantled by the FBI
The W3LL phishing kit, a cybercrime tool used to impersonate legitimate login pages and steal usernames and passwords, has been dismantled by the FBI and Indonesian law enforcement authorities. Officials estimate the operation was tied to more than $20 million in attempted fraud.

Microsoft ends desktop detour for sensitivity labels in Office web apps
Microsoft is rolling out an update to Office for the web that removes a long-standing limitation around document protection, adding new control to browser-based apps.

OpenAI expands its cyber defense program with GPT-5.4-Cyber for vetted researchers
Defending critical software has long depended on the ability to find and fix vulnerabilities faster than attackers can exploit them. OpenAI is expanding a program designed to give professional defenders prioritized access to AI tools built for that purpose. Alongside that expansion, OpenAI is releasing GPT-5.4-Cyber, a version of GPT-5.4 fine-tuned specifically for defensive cybersecurity work.

Windows is getting stronger RDP file protections to fight phishing attacks
Microsoft has introduced new Windows protections starting with the April 2026 security update to reduce phishing attacks that abuse Remote Desktop (.rdp) files. With these updates, the Remote Desktop Connection app displays stronger warning dialogs before a connection is established, shows details about the remote system, and requires users to review any request to share local resources such as drives or the clipboard.

European AI spending set to hit $290 billion by 2029
European enterprises are committing serious money to AI, and the numbers are accelerating. According to IDC’s Worldwide AI and Generative AI Spending Guide, AI spending across Europe will reach $290 billion by 2029, growing at a compound annual growth rate of 33.7%.

Command integrity breaks in the LLM routing layer
Systems that rely on LLM agents often send requests through intermediary routing services before reaching a model. These routers connect to different providers through a single endpoint and manage how requests are handled. This layer can influence what gets executed and what data is exposed. A recent study examined 28 paid routers and 400 free routers used to access model APIs.

Anthropic tests user trust with ID and selfie checks for Claude
Anthropic announced identity verification for Claude using government ID and selfie checks, becoming the first major AI chatbot to do so, a move that may prove unpopular with users. Having built its reputation around privacy in the AI race, Anthropic risks undermining its positioning, as competitors such as OpenAI’s ChatGPT and Google’s Gemini do not require such verification.

Two US nationals jailed over scheme that generated $5 million for the North Korean regime
Two US nationals have been sentenced for their role in a scheme that placed North Korean IT workers inside American companies under false identities. Over several years, the operation used stolen identities from at least 80 US individuals and brought in more than $5 million for the North Korean government.

Anthropic releases Claude Opus 4.7 with automated cybersecurity safeguards
Software teams building agentic AI workflows have been pushing frontier models toward longer, unsupervised task runs. Claude Opus 4.7, now generally available from Anthropic, is aimed squarely at that demand, with particular gains in software engineering, multimodal processing, and the kind of instruction fidelity that matters when a model is running tasks autonomously over multiple steps.

Social media bans might steer kids into riskier corners of the internet
Governments are moving to block children under 16 from social media in the name of safety. But once these measures move from policy to practice, they raise a harder question: what happens when protecting kids requires collecting more data than ever before and may put them at greater risk?

Apple AirTag tracking can be misled by replayed Bluetooth signals
Apple’s AirTag is designed to help users track lost items by relying on a vast network of nearby Apple devices. New research shows that this same system can be manipulated to display locations where an AirTag has never been.

Android 17 Beta 4 arrives with post-quantum cryptography and new memory limits
Google shipped Android 17 Beta 4 on April 16, marking the last scheduled beta in the Android 17 release cycle. The build targets app compatibility testing and platform stability ahead of the final release, and it carries several behavior changes that developers need to account for before the stable version ships.

Mozilla challenges enterprise AI providers with Thunderbolt, open-source AI client under your control
For organizations that want to keep company data within their own systems and have more control over how AI is deployed, Mozilla is offering an alternative to externally hosted AI services with Thunderbolt, an open-source AI client designed for self-hosted use.

Google wipes out 602 million scam ads with Gemini on duty
Google claims that its security teams work around the clock using its Gemini AI models to detect and stop harmful ads. Malvertising remains an ongoing issue across Google’s ad network, with attackers abusing paid ads to pose as legitimate brands and lure users into malware downloads or phishing sites.

The fully free Linux OS Trisquel gets a major update with version 12.0 Ecne
Trisquel GNU/Linux, a free operating system aimed at home users, small enterprises, and educational centers, released version 12.0. The release, codenamed Ecne, is declared production-ready and builds on the previous version, Aramo, with changes to packaging, the kernel, security, and available software.

Seized VerifTools servers expose 915,655 fake IDs, 8 arrested
On April 7 and 8, Dutch police arrested eight suspects in a nationwide operation targeting users of the VerifTools platform as part of an identity fraud investigation. The suspects, all men aged 20 to 34, are accused of identity fraud, forgery, and cybercrime-related offenses. During searches, officers seized smartphones, laptops, cash, cryptocurrency, and weapons or items resembling them.

AI adoption is outpacing the safeguards around it
The 2026 AI Index from Stanford’s Institute for Human-Centered Artificial Intelligence outlines the broader environment around AI growth, including economic value, labor market effects, and the role of AI sovereignty. It also examines developments in science and medicine, the saturation of benchmarks, and governance frameworks that are struggling to keep up.

Google to penalize sites that hijack the back button
Google is broadening its spam policies to crack down on “back button hijacking,” a deceptive practice where websites interfere with browser navigation, blocking users from returning to the page they came from.

DavMail 6.6.0 patches a regex flaw and advances its Microsoft Graph backend
Organizations that run DavMail to bridge standard mail clients to Microsoft Exchange or Office 365 received an update this week. Version 6.6.0 addresses a code-scanning alert tied to a regex vulnerability, adjusts OAuth redirect handling to match a recent Microsoft change, and ships fixes across IMAP, SMTP, CalDAV, and CardDAV subsystems.

OpenSSL 4.0.0 release cuts deprecated protocols and gains post-quantum support
OpenSSL 4.0.0 removes several long-deprecated features, adds support for Encrypted Client Hello, and introduces API-level changes that will require code updates for applications built against older versions.

Legitify: Open-source scanner for security misconfigurations on GitHub and GitLab
Misconfigured source code management platforms remain a common entry point in software supply chain attacks, and organizations often lack visibility into which settings put them at risk. Legitify, an open-source tool from Legit Security, addresses that gap by scanning GitHub and GitLab environments and reporting policy violations across organizations, repositories, members, and CI/CD runner groups.

What changed in nginx 1.30.0 and what it means for your upstream config
nginx 1.30.0 brings together features accumulated across the 1.29.x mainline series. The release covers a broad range of changes, from protocol support additions to security-relevant fixes and new configuration options.

Raspberry Pi OS 6.2 disables passwordless sudo by default
Raspberry Pi OS 6.2, based on the Trixie version, introduces small changes, bug fixes, and disables passwordless sudo by default for new installations.

Wi-Fi roaming security practices for access network providers and identity providers
Public Wi-Fi roaming networks carry authentication credentials across multiple administrative boundaries, and the protocols governing that process vary widely in their security properties. The Wireless Broadband Alliance published a set of guidelines that specifies which authentication, encryption, and credential-handling practices operators should apply to networks running Passpoint and OpenRoaming.

Product showcase: Ente Auth encrypts, backs up, and syncs 2FA
Ente Auth is a free, open-source authenticator app designed to generate and store one-time passcodes for 2FA. It supports setup through QR codes and manual entry, allowing users to add accounts and begin generating codes.

OpenAI updates Agents SDK, adds sandbox for safer code execution
OpenAI’s updated Agents SDK helps developers build agents that inspect files, run commands, edit code, and handle tasks within controlled sandbox environments. The update provides standardized infrastructure for OpenAI models, a model-native harness that lets agents work with files and tools on a computer, and native sandbox execution for running tasks safely.

Google Play is changing how Android apps access your contacts and location
Google’s new set of Google Play policy updates and account transfer feature strengthen user privacy and protect businesses from fraud. Google is also expanding features for managing new contact and location policy changes to support a smoother, more predictable app review experience.

Codex can now operate between apps. Where are the boundaries?
OpenAI is rolling out a major update to the Codex desktop app for users signed in with ChatGPT. Personalization features, including context-aware suggestions and memory, will roll out to Enterprise, Edu, and users in the EU and UK soon. Computer use is initially available on macOS and will expand to EU and UK users in the near future.

Cybersecurity jobs available right now: April 14, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

New infosec products of the week: April 17, 2026
Here’s a look at the most interesting products from the past week, featuring releases from Axonius, Broadcom, Siemens, and Sitehop.

from Help Net Security https://ift.tt/fHmc5k0