The Latest

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

Week in review

r/opensource bans AI projects, and solo devs go down with them
Moderators of r/opensource, Reddit’s catch-all forum for open source software, have barred any project that “uses AI, is made by AI, or is intended for AI.” Moderator Wolvereness announced the rules in a post over the weekend.

AI slop is piling up highest on the biggest open-source projects
The maintainers of large open source projects are taking the worst of the AI slop. In a Linux Foundation survey of 234 open source contributors and maintainers, people running projects with more than 50 contributors estimated that close to a third of the code changes landing in their queue are low quality or AI-generated. Those maintainers now worry more about burning out than about the code itself.

Microsoft Authenticator vulnerability let rogue Android apps steal work account access
If you use Microsoft Authenticator on Android, update it. Researchers at Enclave found a flaw that let any app on your phone quietly take over your work account. The app didn’t need permissions, and you didn’t need to tap anything.

Several AI security market categories are headed for bigger platforms
In this interview with Help Net Security, Jonathan Care, Lead Analyst and Practice Lead AI at KuppingerCole Analysts, compares AI security startups to the early fraud market he helped define at Gartner. He explains which categories will survive as products and which will become features inside bigger platforms.

Private repos still leak secrets to Gheist, a stolen GitHub token campaign
Wiz Research has recovered more than 13,500 planted branches from 850+ compromised GitHub accounts, the work of a campaign it calls Gheist, after the user agent the tool sends with its GitHub API requests. The tool takes a stolen token, finds every repository that token can open, and plants a workflow in each one. The workflow prints the repository’s secrets into a log, and the attacker downloads it.

Bellini Capital CISO on AI security governance and the limits of patching faster
In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital and ConnectSecure, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He argues that “patch faster” is not enough and that teams need to cut exposure while remediation is pending.

CISA updates ScubaGear and ScubaGoggles, and says Microsoft 365 checks get faster
CISA released ScubaGear v2.0 and ScubaGoggles v1.1.0, new versions of the open-source tools it publishes to check Microsoft 365 and Google Workspace settings against its security baselines. The agency calls ScubaGear v2.0 the most comprehensive update to that tool since its 2022 launch. ScubaGoggles, which launched in 2023, gets a new baseline and enhanced Gemini controls.

GitHub’s npm package firewall can block brand-new versions before they install
GitHub announced a package firewall that checks npm packages against an enterprise’s policy before they install. It blocks known malware, critical vulnerabilities, and brand-new versions, and any developer can turn it on by pointing npm at the firewall.

Stolen staff logins are spreading attacks between K-12 school districts
Last school year, 808 K-12 school organizations got some unwelcome news. The Multi-State Information Sharing and Analysis Center (MS-ISAC) told them their staff accounts or credentials were circulating on underground and dark web marketplaces. That’s 808 of the center’s 6,116 K-12 members, and attackers are using those logins to get in the door and then reach the next district.

IT bosses are confident they’ve found the certificates they don’t know about
Forty percent of 500 senior IT and security leaders surveyed for certificate authority Sectigo said they are very prepared for monthly TLS certificate renewals because automated systems are already in place. Their more specific answers point elsewhere. Only 4% said their certificate management is already automated, and 61% said their organization had a certificate-related outage or incident in the past 12 months.

Qualys CISO on what security teams can do as exploit campaigns grow
In this Help Net Security interview, Nathan Smolenski, CISO at Qualys, talks about how security teams can handle the growing volume of AI-discovered vulnerabilities. He explains why CISOs should track the average window of exposure instead of standard MTTR, and why only a small share of disclosed flaws, under one percent in 2025, pose active risk.

Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop
Forever Security found ways out of the built-in browsers in five AI coding assistants: Cursor, GitHub Copilot, OpenAI’s Codex, Microsoft’s VS Code and Anthropic’s Claude Desktop. In all five, a web page or a local file reached the computer behind the browser. Cursor ran attacker code, Copilot showed a fake address, and Codex, VS Code and Claude Desktop let a single local file read the rest of the disk.

Fake IT help desk callers got by on little more than names and email addresses
Attackers posing as IT help desk staff contacted employees by phone, email and Microsoft Teams in the third quarter of 2026 and talked them into opening remote access sessions, Cisco Talos Incident Response (Talos IR) found across several engagements. In one case, that access ended in ransomware.

Cyberattack disrupts University of New Mexico hospitals, extortion group claims attack
University of New Mexico (UNM) Health Sciences Center (HSC), the academic medical arm of the University of New Mexico, has suffered a cyberattack that has temporarily disrupted the operation of its hospitals and may have resulted in a substantial data breach.

Brotli bug reaches far beyond Node.js (CVE-2026-111497)
A vulnerability in Brotli, Google’s widely used open-source compression library, is putting a broad range of software at risk. Alternatively known as “Node2Shell”, “Broccoli2Shell” and “Brotli2Shell”, CVE-2026-111497 is a remotely exploitable out-of-bounds write flaw that gained widespread attention after Node.js publicly disclosed it on October 21, 2026.

Tailscale fixes SSH flaws allowing lateral movement within tailnets
Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including some in Tailscale SSH that could let an attacker who already had access to a device in the network gain more privileges on other machines that are part of it.

Compromised camera management software gives attackers a way into corporate networks
Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents in September and October back to a compromised application.

Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network
Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday.

Chinese hackers used VMware ESX zero-day; PHP2Shell and Fragnesia chained to root firewalls
China-nexus threat actors have exploited a VMware ESX zero-day to hide their tracks and chained PHP2Shell flaws with the “Fragnesia” Linux kernel bug to root servers and firewalls, cybersecurity researchers claim. Cisco has also confirmed that attackers are crashing its firewalls with a newly disclosed vulnerability.

LLM agent security needs more than guardrails
Madhu Shashanka, Chief Scientist at Concentric AI, explains why securing LLM tools and agents depends more on your data than on the model. Controls on model behavior, such as guardrails and injection detection, lower the rate of bad outcomes but never reach zero. Controls on what goes in are different, because you own the documents, systems, and credentials an agent can reach.

Product showcase: Stellar Cyber’s ISOC platform provides full-cycle architecture
An AI SOC that starts with somebody else’s alert is already too late. Stellar Cyber collects and normalizes telemetry, detects suspicious activity, correlates evidence, builds cases, investigates incidents, triages findings, and drives response from the same security architecture. That gives people and AI access to the evidence behind the alert – not just the alert itself.

I underestimated how fast security teams would trust AI to act in the SOC
For most of her career, Aqsa Taylor has watched enterprises adopt new security platforms slowly. She expected AI adoption in security operations centers (SOCs) to follow the same pattern, particularly given strict compliance requirements. Instead, adoption moved faster than she expected as AI helped attackers shorten the time between initial compromise and damage.

What exactly is ISOC? And what does it mean for you?
Security teams often spend too much time moving between tools to piece together an incident. Integrated Security Operations Center (ISOC) solutions aim to reduce that work by bringing detection, investigation, and response together, while SIEM remains the system of record for security data. Stellar Cyber’s approach uses the same underlying data throughout this process, giving analysts and AI access to the evidence behind an alert.

Security pros reckon the biggest AI risk comes with an employee badge
Employees pasting company data into AI tools worry security teams more than AI-powered attacks do. AI-generated phishing, the attack they run into most often, made the list of top concerns for only a quarter of the 209 security professionals O’Reilly surveyed in September.

DreamHost incident triggers password resets, locks customers out of email and FTP accounts
DreamHost has brought its File Manager back online after an incident that disrupted several of its services, though some of its customers still can’t get into their email or FTP accounts until someone sets a new password for them.

Cyberattack on University of Copenhagen exposes data of 525,000 people
The University of Copenhagen (UCPH) has ruled out a second cyberattack, saying the activity that led it to shut down several administrative systems on Monday is tied to the breach it disclosed last week, which exposed personal data belonging to some 525,000 people.

Hackers bury inboxes in spam then show up on Microsoft Teams posing as IT support
Threat actors are flooding employees’ inboxes with spam and then contacting them on Microsoft Teams as IT support, offering to fix the problem they created, Arctic Wolf has found. The security company documented more than 400 incidents in which the external chat feature in Teams was abused.

Data breach at Sony-owned internet provider compromises 2.6 million customer records
Attackers who broke into the So-net member database made off with personal information belonging to more than 2.58 million current and former customers, along with the email passwords of 54,401 users, Sony Network Communications has disclosed.

FBI seizes Virtualine, bulletproof hosting provider that promised to shield criminals from police
The FBI has seized virtualine.net, the domain of a bulletproof hosting provider that laundered money for its criminal customers and kept a forum trading in child sexual abuse material online despite repeated warnings from police and child protection groups.

345,000 email addresses stolen in cyberattack on Germany’s far-right party AfD
Over 345,000 unique email addresses were exposed in the September 2026 breach at German far-right political party Alternative für Deutschland (AfD). Breach notification service Have I Been Pwned (HIBP) added the data to its database on 27 October, listing email addresses and email messages as the compromised information.

Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents
Names, offices, contact details and assignments of more than 41,000 U.S. Department of Homeland Security (DHS) employees have been leaked by a hacktivist group calling itself the Department of Peace.

Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)
Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw. The flaw carries a CVSS score of 9.8 and affects the Application Object Library product in EBS versions 12.2.3 to 12.2.15. Oracle’s description in the NVD entry calls it an “easily exploitable vulnerability” open to an unauthenticated attacker over HTTP.

Yoba malware hides in fake desktop versions of ChatGPT and Claude
Fake GitHub projects posing as desktop versions of ChatGPT and Claude have been used to spread a malware chain that ends with a cryptocurrency miner, Check Point has found. The researchers have been tracking the campaign, dubbed Yoba, for the past two months.

Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record
About $6.3 billion in cryptocurrency was stolen from Binance in what might be the biggest crypto hack in history. The company found no evidence of a wallet private key leak and plans to publish a technical post-mortem once the investigation is complete.

Claude Code extension poisoned with persistent SSH backdoor
A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm Phorion have found.

Assad regime hacker who caused $136 billion market drop sentenced to 42 months
A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced.

OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken
The OpenSSL project released version 4.1.0, adding support for DTLS 1.3 and listing four known bugs in the DTLS code that ships with it. DTLS is the variant of TLS built for datagram transports such as UDP, and version 1.3 is defined in RFC 9147.

Google open-sources the Elephant-Goldfish Model plugin its engineers use to catch AI coding mistakes
Google has open-sourced the Elephant-Goldfish Model plugin, an internal tool that makes an AI coding agent write and defend a design document before it touches any code. The plugin hands that document to fresh AI sessions that have never seen the design conversation and tells them to find what is wrong with it.

Synthetic identities leave US lenders with $2.4 billion in fraud exposure
Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion’s Fraud in the Age of Continuous Trust report. Eighty-one percent of suspected digital fraud in its network during the first half of 2026 occurred during account logins and financial transactions, highlighting risks that persist throughout a customer relationship.

Forgotten AI agents may still access sensitive company data
AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 Autonomous Agents Threat Report. About 76% of enabled agents examined had not run in 60 days, leaving access available through inactive software.

Witness: Open-source framework for verifying how your software was built
Witness is an open-source command-line tool that records how software gets built, signs that record, and checks it against a policy before the software ships. TestifySec built Witness and donated it to the in-toto ecosystem within the Cloud Native Computing Foundation, and an open community now maintains it.

Anthropic details what stops Claude Duet from going rogue
Anthropic has outlined the security and privacy protections behind Claude Duet, its proactive AI agent that can monitor connected accounts and complete tasks while users are away. The safeguards include approval requirements, checks for sensitive information and infrastructure that keeps credentials outside the model’s reach.

Kali Linux 2026.3 ships kernel 7.1.5, brings wardriving to the TicWatch Pro 3
The Kali Linux team released version 2026.3 after overhauling the public build scripts it uses to produce every official image. The refreshed scripts share the same features, command-line arguments and, where possible, the same layout, so a pipeline written against an older script may need edits.

GPT-6.1 Terra meets OpenAI’s Critical cyber threshold, and it’s cheaper than GPT-5.6 Terra
OpenAI released GPT-6.1 Terra, a model that operates desktop software, to all Plus, Pro, Enterprise, and Edu users in ChatGPT Work and Codex, and to developers through its API as gpt-6.1-terra. API prices are 50 percent below those of GPT-5.6 Terra and GPT-6.1 Sol: $1 per million input tokens, $0.05 per million cached input tokens, and $5 per million output tokens. Tokens are the chunks of text a model reads and writes.

71% of vulnerability exploitation starts within a week of disclosure
Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7’s Q3 2026 Quarterly Threat Landscape Report. The company reported an average of three days between public disclosure and exploitation of high-severity vulnerabilities, with 71% of tracked exploitation occurring within the first week.

Amutable Foundations is a Linux system with no SSH and no package manager
Amutable opened signups for the private preview of Amutable Foundations, a Linux system in which each machine sends a signed report of the software and configuration it runs, drawing on local hardware to make the report easier to verify. The company says its engineers write and maintain code in the kernel, in systemd and in image-building tools.

CISA lays out plan to push cyber adversaries out of US critical infrastructure
The Cybersecurity and Infrastructure Security Agency (CISA) has released CISA 2030: Defend, Harden, Prevail, a strategy to strengthen national security and the resilience of critical infrastructure. It addresses intersecting cyber, physical, and geopolitical threats that can disrupt essential services.

Breach victims discover their data was held by companies they’ve never heard of
Nearly seven in ten people affected by data breaches handled by Kroll were exposed through an outside supplier, according to its Data Breach Outlook 2026. Businesses rely on outside providers to store information, process transactions and operate software. A breach at one of those providers can expose customer records across multiple organizations, including people who have never heard of the company holding their data.

NIST starts the countdown to retire quantum-vulnerable encryption
The National Institute of Standards and Technology (NIST) has released a roadmap for moving to post-quantum cryptography (PQC), with earlier deadlines for certain sensitive federal systems. The report, Transition to Post-Quantum Cryptography Standards (NIST IR 8547), explains which cryptographic methods need to be replaced, what organizations should consider and how the transition will unfold.

AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records
AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and email-authentication records, and sends an alert when something changes. A DNS blacklist, or DNSBL, is a list that mail servers and other services consult when deciding whether to trust an address.

Ukrainian ransomware hacker sentenced, $11 million reward offered for co-conspirator
A Ukrainian national who participated in ransomware attacks targeting hospitals, government entities, law firms, and other businesses was sentenced to five years and 10 months in prison. Artem Stryzhak, 36, pleaded guilty in December 2025 to two counts of conspiracy to commit fraud, extortion, and related activity in connection with computers.

Upwind secures $400 million to protect AI across endpoints, code, and cloud
Upwind Security has raised $400 million in Series C funding to expand its cloud and AI security platform, bringing the company’s total funding to more than $800 million.

Shame and sleepless nights haunt scam victims long after the money is gone
Scams and identity theft hurt people in different ways, and recovering involves much more than getting money back, according to ITRC’s 2026 Consumer Impact Report. Scam victims often struggle with shame and self-blame, while identity theft victims can spend weeks of personal effort trying to repair the damage.

Ubuntu Core Desktop returns as Canonical’s plan for an immutable default desktop
Canonical has restarted work on Ubuntu Core Desktop, the immutable and attestable version of Ubuntu that the company says will over time become the default Ubuntu desktop. Jon Seager, Canonical’s VP of engineering, laid out the plan and admitted that the 2023 developer preview “fell short” of what the company had in mind.

Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws
Google’s Gemini 4 Carbon is a frontier AI model designed for software engineering and cybersecurity tasks, with safeguards built on those of its predecessor, Argon. Google says its teams have seen Carbon spend days investigating and fixing bugs across large codebases and low-level systems. The model was also trained to handle complex tasks and high-pressure situations.

Smart TVs can harbor unpatched security flaws and track what you watch
Smart TVs and connected plugs accounted for a large share of recorded security weaknesses in household devices, according to Bitdefender’s 2026 IoT Security Landscape Report. The analysis covered approximately 10.4 million protected home routers between January and September.

Scammers rebuild fake shopping sites within hours of a takedown
One retail scam used more than 1,200 look-alike .shop domains sharing a single IP address. The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse Report 2026.

Open-weight AI model GLM-5.3 cheated its way to correct answers
Irregular evaluated Zhipu AI’s open-weight model GLM-5.3 across 13 offensive cyber scenarios using CyScenarioBench, the company’s framework for measuring an LLM’s ability to plan and execute multistage attacks under realistic constraints.

Cybersecurity jobs available right now: October 27, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.


from Help Net Security https://ift.tt/DNPce5g

We may earn a commission from links on this page.

Following its recently concluded fourth season, Netflix's political thriller The Diplomat has been renewed for a fifth season, and even better, it's the rare streaming show that seems to keep to a fairly regular schedule, meaning there's likely to be more of the Keri Russell-led espionage drama coming by late next year. If you're looking for something with the same political thriller vibes to watch in the meantime, here are 10 other series to stream now.

Homeland (2011 – 2020)

Diplomat creator Debora Cahn got her start on The West Wing, but honed her political-espionage craft on this show, for which she served as writer and, later, executive producer. The series begins with CIA case officer Carrie Mathison (Claire Danes) coming to suspect that decorated Marine Corps scout sniper Nicholas Brody (Damian Lewis), recently rescued from an al-Qaeda compound, has been turned and is planning a terrorist attack on the United States. As she has been diagnosed with bipolar disorder, her superiors don't give Mathison's suspicions much credence, kicking off a cat-and-mouse/is-he-or-isn't he? game between the two. As the show progresses, Carrie moves up the ranks until she's working directly for the president. Both leads won Emmys for their performances, and the series took the Outstanding Drama prize in its first year. Stream Homeland on Hulu and Netflix.

Slow Horses (2022 – )

Focusing largely on the seedier side of international espionage, Slow Horses, based on the novels by Mick Herron, shares with The Diplomat a dry sense of humor about the consequences of institutional and human failures. With nods to the great spy dramas of John le Carré, Slow Horses updates the setting without losing either the thrills or the style of a time-honored genre. The “Slow Horses” of the title are a group of has-been MI5 agents—they’ve all made messes of significant jobs, but are still seen as having some use, if only in dull administrative tasks. Naturally, the members of the group (led by Gary Oldman's endlessly flatulent Jackson Lamb) find themselves in deeper waters than anyone thought them capable of navigating. Kristin Scott Thomas is the spymaster, navigating political pressures, misogyny, and her own unrepentant ambition in trying to do her job. Stream Slow Horses on Apple TV.

The Night Agent (2023 – )

An action drama that plays a bit like a spy thriller, The Night Agent stars Gabriel Basso as Peter Sutherland, an FBI agent who works overnights in the basement of the White House watching a phone that never, ever rings (dream job, honestly), until the night it does. Peter gets a call from Rose Larkin, a cybersecurity expert whose aunt and uncle were just killed; unbeknownst to her, they were also government operatives, and rescuing Rose sees Peter delving deep inside a web of conspiracy and corruption that plays out over three seasons, with a fourth and final on the way. While a bit more action-heavy than The Diplomat, it still plays in that realm of government secrets and conspiracies. Stream The Night Agent on Netflix.

The West Wing (1999 – 2006)

There was a moment, around the turn of the millennium, when The West Wing seemed like a heightened but not entirely implausible picture of politics in action; its ripped-from-the-headlines style gave it an edge that allowed us to imagine smart, thoughtful people getting jobs in government, trying to do the more-or-less right thing despite systemic and personal flaws (it's also where The Diplomat's creator Debora Cahn started her TV writing career). The show's world can be a little frustrating when contrasted against our more explicitly appalling actual one, but it's a thoroughly pleasing fantasy nonetheless, with President Matin Sheen leading a White House staff through various diplomatic, military, and political crises. Stream The West Wing on Netflix and HBO Max.

Borgen (2010 – 2022)

Sidse Babett Knudsen stars as Birgitte Nyborg in this popular import. She's a minor Danish politician who watches other politicians fall to scandal and incompetence as she rapidly and unexpectedly ascends to the job of prime minister. The espionage and action are entirely incidental (but not nonexistent) here, as the show deals instead with the moral and political compromises that are seemingly intrinsic to statecraft. There's been talk of an American remake for years now, but you should just watch the original. Stream Borgen on Netflix.

Scandal (2012 – 2018)

Shonda Rhimes was already a powerhouse producer and screenwriter with several successful seasons of Grey's Anatomy under her belt when Scandal debuted, but its blend of political thrills and sexy, soapy drama truly solidified her brand—and her spot atop the modern TV landscape. Kerry Washington stars as Olivia Pope, head of the D.C.-based crisis management firm Olivia Pope & Associates (OPA), who is the person to call when you've got a PR disaster to fix. If you want to get a sense of the stakes involved, consider that Tony Goldwyn costars as Fitzgerald Grant III, who is both the president of the United States. and also Olivia's lover. Stream Scandal on Hulu and Netflix.

Madam Secretary (2014 – 2019)

Téa Leoni plays Elizabeth McCord, a former CIA analyst who gave up that hectic life to become a political science professor. That's all going great until the Secretary of State dies under mysterious circumstances and she's called up by her old CIA boss, who's now the president, to take over the job. With her outsider's perspective and resistance to political considerations, she's surprisingly good at the gig, navigating foreign and domestic crises while also trying to figure out who the hell killed her predecessor, and whether they're coming for her, too. Stream Madam Secretary on The Roku Channel.

Designated Survivor: 60 Days (2019)

You could absolutely watch the original American take on this show, which stars Kiefer Sutherland—they have essentially the same premise—but this South Korean remake earns a few extra points by only running for a compact 16 episodes, making it far leaner and meaner. Education Minister Park Mu-jin (Ji Jin-hee) is fired from his job one day before an attack occurs amid an announcement of peace talks with the North, wiping out the entire presidential line of succession. His dismissal having not yet been finalized, the largely unambitious Minister Park is forced into the job, even as questions linger over the attack that put him in the role. Stream Designated Survivor: 60 Days on Netflix.

The Americans (2013 – 2018)

It's a different time and setting, but all the Keri Russell spy action you could want as a Diplomat fan. Set during the Cold War 1980s and created by former CIA officer Joe Weisberg, The Americans follows Soviet KGB intelligence agents Elizabeth (Russell) and Philip Jennings (the ever-reliable Matthew Rhys), living undercover lives posing as an American couple in the DC metro area—and raising their American-born children. The critically acclaimed show makes much of its period setting and a central conflict that places two spies in the heart of suburban America, even as they're tasked with undermining the Reagan-era government under which their children are growing up. Stream The Americans on Hulu.

The Whirlwind (2024)

A power struggle for leadership of an entire country is at the heart of this juicy political thriller. Prime Minister Park Dong-ho comes to believe that the president has been corrupted by powerful, wealthy individuals and companies (something that could only happen in South Korea, obviously). Deputy Prime Minister Jeong Su-jin sees the problem, too, but she's not so sure about his solution: He wants to have the president assassinated. But how much better is he than the man he would be replacing? And how pure are her motives in potentially putting herself in line for the top job? Stream The Whirlwind on Netflix.


from Lifehacker https://ift.tt/2pTe3Wz

Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday.

This network, dubbed Silent Train by the researchers, consists of chains of compromised SOHO and IoT devices (e.g., TP-Link and Netgear routers) and enterprise systems (e.g., Fortinet and Cisco appliances, PRTG and CyberPanel servers).

Through it, the group exploited zero-days in network and endpoint management systems, SD-WAN orchestrators and other control plane infrastructure. Among the targeted solutions were:

“Compromising these technologies offers significant operational benefits,” the researchers noted. Instead of having to – step-by-step and more noisily – traverse networks, identify administrators, locate key systems and establish multiple footholds, the group was able to achieve all of that with much less effort, no lateral movement required, and without leaving many forensic artifacts behind.

“Post-incident analysis with partners uncovered in-memory webshells, credential harvesting and abuse of native features such as endpoint control and remote file transfers. In several cases, the actors also erased or altered logs and other evidence of exploitation and operator activity,” the researchers explained.

Beyond these campaigns, Black Lotus Labs observed the group using Silent Train to target “a broad range of edge, identity, network and enterprise management technologies, including Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto, ServiceNow and ArcGIS,” though the researchers couldn’t always determine whether known or unknown vulnerabilities were exploited.

In a separate blog post published on Wednesday, Cisco Talos researchers detailed how UAT-11473, a group whose “operating infrastructure overlaps considerably with Volt Typhoon’s ‘Silent Train’ covert access network”, exploited CVE-2026-20127 to compromise Cisco SD-WAN Catalyst Controller instances and deploy KeyDrift, a custom malware framework.

KeyDrift provides persistent access to the controllers and extracts and exfiltrates control-session metadata and data-plane keying material.

How Silent Train works

Volt Typhoon began building the Silent Train network before the December 2023 takedown of the KV botnet, and ramped up its use in its aftermath.

“Traditional botnets often rely on persistent, centralized or recurring patterns, making them easier for defenders to detect. Silent Train took a different approach: instead of maintaining a permanent network, Volt Typhoon rapidly assembled and dismantled transient infrastructure, creating a resilient, secure and compartmentalized framework that protected valuable access,” Black Lotus Labs noted.

The group expanded this infrastructure gradually, adding new types of compromised devices over time (more than 27 device classes in all). Early chains relied on SOHO and IoT devices (e.g., TP-Link, Netgear, Intelbras, Zyxel, Ruckus and Cambium), which were exploited via exposed web interfaces, used for a single session and then restored to their original state.

Later, the group added enterprise platforms such as Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel as final hops before the victim.

While Volt Typhoon uses other infrastructure for reconnaissance, Silent Train was reserved for “exploitation, credential access, data exfiltration and ongoing engagement with victim environments,” researchers found.

Sessions start from virtual private servers outside the US, pass through compromised overseas devices, and then exit via one or more US-based devices before reaching the victim, which helps the traffic blend in and bypass geo-blocking and IP reputation filters. “In some cases, as many as six hops separated the operator from the victim,” Black Lotus Labs noted.

Volt Typhoon Silent Train

Example of a Silent Train session (Source: Black Lotus Labs)

“As Silent Train matured, reverse-tunnel variants were introduced alongside the traditional SSH-chaining model. Rather than exposing temporary SSH services on each hop and pivoting sequentially through the chain, some operations mixed in reverse tunnels via open-source proxies like Chisel and FRP, sending traffic from compromised devices to upstream infrastructure,” the researchers added.

Victimology

Over the past three years, Black Lotus Labs’ monitoring of Silent Train has led to hundreds of victim notifications.

The group was selective in its targeting: each session typically went after one to five victims, and often just a single organization.

Among the victims are US government entities, telecommunications providers, defense contractors, satellite and mission-critical communications providers, managed service providers (MSPs), IT firms, universities with military affiliations, and critical infrastructure organizations in sectors such as water, energy, transportation, aviation and emergency services.

These sectors may look diverse, but the researchers say they share a common trait: “each offers access to broader networks, customers or essential operations.”

Geographically, Hawaii, California and Texas were the most frequently targeted states. They host major military installations, defense contractors, telecom and satellite infrastructure, and logistics networks that support US operations in the Indo-Pacific region.

According to the researchers, this pattern is consistent with an effort to pre-position access in strategic communications and critical infrastructure ecosystems that would become essential during geopolitical tensions or a crisis.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!


from Help Net Security https://ift.tt/crfMmW3

The VR headset may be becoming a thing of the past. At Google's Android Developer Summit this morning, XReal officially debuted XReal Aura XR glasses, smart glasses with full XR capability. They're powered by Android XR and run on a Snapdragon Reality Elite-powered puck, with Xreal's X1S Chip in the glasses themselves. The result: Aura packs a 70° field of view in a pair of glasses that weigh less than 95 grams.

Customers in the United States, Canada, Japan, and South Korea can order XReal Aura on XReal's site starting today, and they're expected to begin shipping in mid-November. The limited-time launch price is $1,099 for the 12GB + 256GB configuration and $1,299 for the 16GB + 512GB configuration, $180 and $200 less, respectively, than XReal announced earlier this month.

If the claim of mixed reality in a pair of sunglasses seems dubious, I tried them out a few months ago, and they are exactly that.

Instead of an enclosed headset, XReal Aura projects digital content on transparent lenses so you can be present in the real world while also in the digital world. Unlike "traditional" virtual reality headsets, the Aura's batteries and main compute are in a wired puck/controller you can slip into your pocket. That keeps the weight down and makes them comfortable enough to wear for longer periods. Because it's built on Android XR, users will have access to millions of 2D and 3D Android apps right out of the box.

If you want to go beyond Android, you can plug a USB-C-compatible computer or gaming console into Aura, and use that device in the same virtual space as native Android XR apps.

XReal Aura is launching with a library of over 150 "made for XR" apps as well, including games like Nevatars, designed by Andy Serkis, Fallout: Factions, a dice-based head-to-head game in the Fallout universe, and Landing Party, "the world's first outdoor roleplaying video game." There will also be companion apps for the NBA, NASCAR, and the San Francisco Ballet Company’s The Nutcracker. In terms of productivity, ShapexXR, a platform for software developer collaboration, is making its debut on Android XR, and you'll be able to use apps like Frontline.io for job training and assistance, and Plynk Spatial for stock research and trading.

If you want to get down to the nitty-gritty, here are the Aura's specs:

  • Under 95g

  • 70-degree field of view

  • Sony Micro-OLED display

  • 1200p resolution at 120Hz

  • Sound by Bose

  • Snapdragon Reality Elite Platform

  • XReal X1S Chip

  • Split-compute architecture with compact compute puck

  • Puck trackpad for navigation

  • Wired Mirroring for laptops and compatible handheld gaming devices

  • USB-C connectivity using a standard connection

  • Electrochromic dimming for more immersive viewing

  • TÜV Rheinland certified for Eye Comfort

  • Support for voice, hand, keyboard, trackpad, and game controller input


from Lifehacker https://ift.tt/BPRanYu

Wordle’s biggest draw is its simplicity: Anybody can look at five blank spaces and think of a five-letter word. But when it comes to playing Wordle well, and enjoying the game over time, you might do better with a few tips. I have a nearly 100% win rate in Wordle—more about win rates below—so here are some of mine. 

Never guess letters you already know

If I could only give one strategy tip, it would be this: Your first guess, and even your second and third, shouldn’t be attempts to solve the puzzle. Instead, you should be gathering information about possible solutions. 

This means that if you guessed a word ending in “ER” and those letters turned green, you should not try another word ending in ER as your next guess. If you guess a completely different five-letter word, say BENCH, you can find out whether B, N, C, and H are in the solution, while also getting information about whether there’s an E in the second position (which helps you know whether words like LEVER and METER might be in play). 

There is a toggle in the game interface that requires every word to use green squares from your previous guesses. It’s called “hard mode.” If you ask me, this should be called “luck mode,” because it takes away one of the game’s best strategies for smart solvers, as guessing letters you already know is just wasting guesses. 

I wrote more about this strategy here, and included more examples. Use this tip, and you’ll avoid the trap of losing after guessing FOUND, ROUND, POUND, MOUND, SOUND, and WOUND when you could have used MARSH as your second guess and instantly figured out the answer (HOUND). 

Choose a starter with common consonants

There are competing schools of thought on choosing the best starting word for Wordle, an issue I have considered in depth. But to summarize the best advice: Choose a word with five different letters (no repeats) that includes at least two or three of the English language’s most common consonants. 

Those most common consonants include T, N, S, H, R, D, L, and C. That means TRASH is a great starter, and so are CRANE and STEAL and STARE. For best results, use E and/or A as your vowels, since these are some of the most common vowels in English. 

Play two starters to give you a one-two punch

A starting word needs to give you information about what might be in the solution, but you don’t gain a ton of information with just five letters. So I recommend having another starting word that doesn’t overlap with the first, but expands the amount of information you can collect to 10 total data points. 

After all these years, my trusty pair is still ARISE and TOUCH. That gives me all five vowels and a good sampling of the most common consonants, as discussed above. (Only N is notably missing, but I can always play that in a later guess.) 

Feel free to come up with your own pair, where the second guess fills in gaps left by the first. If you like to start with a vowel-heavy word like ADIEU, use more consonants in your second move: perhaps THORN. Or if you start with TRASH, perhaps follow it with OUNCE. 

Play more perfect games to get your win rate back to 100%

I pride myself on my 100% Wordle win rate, but the truth is, I’m actually at 99% right now. The NYT’s “About Wordle” page says that “Win % counts the percentage of total puzzles played that you have won,”  but that doesn’t seem to be entirely correct. It also does not say how the app handles rounding. I believe I’ve lost three times over the 1,368 games I’ve played, which is actually a 99.8% win rate. But after every loss, the count has eventually gotten back up to 100%.

What I’ve figured out is this: As soon as you lose a game, your 100% win rate drops to 99%.But if you win (I am pretty sure!) another 200 in a row, you can earn that last percentage point back. I haven’t kept a perfect count since my last loss, but I’m pretty sure I’ve played more than 100. And despite losing a few games over the years, I’ve usually managed to keep a 100% win score. 

Remember that past solutions are once again fair game

For its first few years, Wordle never repeated a solution. If you could remember ever seeing a certain word as a solution, it was guaranteed not to be that day's answer. But that changed in February of 2026, when the New York Times officially announced that previous solutions may be reused. 


from Lifehacker https://ift.tt/IXwVL03

We may earn a commission from links on this page.

I love e-readers, but I'd be the first to admit that as far as the general public is concerned, they are just about the least exciting tech devices around—and that goes double for the Amazon Kindle. Any attention the space has gotten over the past couple of years has involved obscure players like Boox and weird concepts like the phone-shaped Palma or the tiny Boox Picco. But the clear leader in terms of market share is still Amazon, and despite some minor innovations over the years, the device hasn't received an essential upgrade in around a decade: A Kindle is a Kindle is a Kindle.

I'd still say this holds true in 2026, even after the company unveiled a complete redesign of the Kindle lineup. While the new flush-front display is nice-looking (and Amazon is quite proud of the new process it has developed to add colored bezels by painting them directly onto the outer glass screen), competitors have offered similar designs for years, and it's hard to get too excited about "innovations" like an $80 case that adds back the physical buttons that used to be built in or finally opening up the firmware to allow for the use of a Bluetooth page-turn remote.

But one thing has changed about the 2026 Kindle lineup: I think the $50 premium Amazon charges for the top-of-the-line Signature Editions of the Paperwhite and Colorsoft is finally truly justified.

The Signature Edition finally offers some irresistible upgrades

Kindle Paperwhite Signature Edition 2026 showing library screen
Credit: Joel Cunningham

Amazon introduced the first "Signature Edition" of the Kindle Paperwhite back in 2021, and while the 25% price increase didn't get you nothing, the features it did add weren't too exciting: At 32GB, it had three times the storage versus the standard Paperwhite, but how important is a ton of storage when most e-book files are tiny? (That's still enough room for more than 6,000 texts, well more than even true bookworms will read in an entire lifetime.) Other bonuses, like wireless charging and an auto-adjusting front light, won't matter at all to a huge subset of readers, and it's hard to think of "no ads on the lock screen" as an extra perk.

But the latest Signature Editions of the Kindle Paperwhite and Kindle Colorsoft actually give you more for the price premium, and for the first time, I would recommend shelling out the extra cash. While the important specs are still the same as the standard model:

  • 7-inch, 300ppi flush-front display (with color content on the Colorsoft maxing out at 150ppi)

  • Temperature-adjustable front lighting

  • USB-C charging with battery life "up to 12 weeks on a single charge," per Amazon

  • Bluetooth support for wireless headphones

  • IPX8 water resistance

...the Signature Editions give you quite a bit more this time around, including, most noticeably, a totally new design with an all-metal rear panel that gives the devices a much sleeker look and feel without adding much in the way of weight (the standard plastic models weigh around 7.2 ounces, while the Signature Editions weigh 8.1 ounces). The new design makes the Signature Editions feel truly premium.

Kindle Paperwhite SE 2026 back panel
Credit: Joel Cunningham

But that's not the only meaningful addition. Once again, alongside wireless charging and automatically adjusting lighting, the Signature Editions have a boosted 32GB of storage, which is still probably overkill, but worthwhile if you like to load your device with a bunch of audiobooks or (in the case of the Colorsoft) color comics.

You also get an accelerometer, which means the display will auto-rotate if you flip it upside down, giving you more flexibility in how you hold it (especially if you're springing for the new Page-Turn Cover, which brings back physical buttons à la the beloved, discontinued Kindle Oasis). Moreover, there's a new ability to turn pages by double-tapping on the bottom sides or back of the device rather than touching the screen (though it only works for moving forward in your book).

Only the Signature Edition gets the best new accessories

Kindle Click next to Kindle Paperwhite SIgnature Edition 2026
Credit: Joel Cunningham

Speaking of which, you'll need to go for the Signature Editions if you want to use accessories like the Page-Turn Cover or the also-new Charging Stand (not yet available for pre-order), as only the Signature Editions include the built-in magnetic pogo you'll need to connect them. (If you're interested in the Kindle Click page-turn remote, it at least works with any Kindle from 2024 or later.)

Finally, if you care about your Kindle looking pretty, it's worth noting that only the Signature Editions are available in Seaglass Green (for the Paperwhite) and the reddish-purple Plum (for the Colorsoft).

Otherwise, it's mostly still a Kindle

Outside of those extras, the 2026 Kindles don't feel much different than the 2024 models. According to Amazon, they are the fastest Kindles ever, but that's mostly hype—any recent Kindle will turn pages quickly enough that you'll barely notice the speed difference, if you notice it at all. They all still run on the same firmware, which is both a good thing (Amazon makes it extremely easy to browse for and buy books and audiobooks directly on the device; there are a ton of options to search through and sort your library; and quality-of-life features like being able to sideload books via email using the "Send to Kindle" feature are a godsend) and a bad thing (I hope you like being locked into the Amazon ecosystem).

The new flush-front design won't please everyone

Photo of Kindle Paperwhite SE 2026 displaying a book
Credit: Joel Cunningham

One change to the entire 2026 Kindle lineup is already proving divisive: Judging by reactions on the Kindle Reddit, not everyone is in love with the new flush-front design, which eliminates the raised bezels around the screen that were present on the 2024 model, but at the cost of adding a thin layer of glass over the e-ink display.

Depending on how picky you are, you may find fault with this setup, as the additional layer of glass slightly reduces text clarity by putting more distance and another barrier between your eyes and the text or images in your book. Is this something I noticed myself? No—I don't have an older Kindle to make a direct comparison, and the text is still much, much sharper (and the front lighting more even) than what I see on competing e-readers like the Boox Go 6 or the Xteink X4 Pro. But there is a contingent of readers already lamenting the change, so take that for what you will.

The bottom line

The question to consider whenever a new device model rolls around is simple: Is this worth the upgrade? If you have a working Kindle from any time after the introduction of temperature-adjustable lighting, I would say no—the 2026 models are nicer, but they still don't do anything to make them worth it, especially at the new higher price points.

That said, if you are in the market for a new Kindle, I'd suggest opting for the Paperwhite over the entry-level model, which has a smaller screen and lacks the warm light option—and if you're getting a Paperwhite or Colorsoft, you might as well pay the premium for the Signature Edition, because it's finally worth the extra money.


from Lifehacker https://ift.tt/xVh3bTy

We may earn a commission from links on this page.

Stephen King’s Carrie is one of those endlessly rebootable stories. Way back in 1974, King zeroed in on a near-perfect horror setup that explored being othered, the emotional and mental health consequences of bullying, and just how crappy being a teen girl can be in the modern world. Those themes—and the iconic visuals King conjured with his words—are evergreen, and resonate with audiences each time the story gets rebooted. Mike Flanagan has proved himself a master of horror and a clear successor to King’s legacy in the genre, and if you thought his Carrie reboot on Prime Video was terrific (and you’ve watched all the similar series out there), you should really watch Jennifer’s Body.

Why Jennifer’s Body is the movie to watch if you loved Carrie

Carrie and Jennifer’s Body share a lot of themes—the corrosive pressure of high school, the casual cruelty of adolescents, the explosive power of feminine anger. While Jennifer Check (Megan Fox) is superficially presented as having more power and control than Carrie White (Summer H. Howell) because she’s more self-possessed (and played by Megan Fox), underneath the hair and makeup, Jennifer is just as naive and confused as Carrie. Both girls endure horrific experiences that set them on a path to horrific violence—and those experiences are symbolic of what women everywhere have to deal with all the damn time.

Just as in Carrie, Jennifer’s Body tracks a teen girl’s descent into monstrousness—but where Carrie leans into the tragic nature of those themes, Jennifer’s Body offers a funnier, more sarcastic take buoyed by Diablo Cody’s sharp dialogue and laugh-out-loud moments. The series highlights Carrie’s suffocating home life that offers her no relief from the grinding hell of being a 16-year-old girl who doesn’t quite fit the expected physical or behavioral norms imposed on teen girls, tracing a slow boil of rage. Jennifer’s Body depicts a character who ultimately chooses the dark path, leaning into her newfound destructive power, and has more fun with it, making it the perfect complement to the series.

Although the stories take different paths to get there, they both wind up at a cathartic and bloody climax centered on a school dance, where a lot of people die and chaos reigns. The film is the perfect way to examine, from a different angle, the themes that Carrie explores. Stream Jennifer’s Body on Hulu or rent it on Prime Video.

More movies if you enjoyed Carrie

Looking for more stories about angry teen girls teaching society a terrifying lesson? Here are a few more films that make a perfect pairing with Carrie.

Carrie (1976)

It’s been 50 years since Brian De Palma adapted King’s novel for the first time, and it’s still worth watching today, especially if you enjoyed Flanagan’s modern take. What could have been a trashy horror movie designed to cash in on the book’s success is instead a well-crafted film that makes every character feel real and consequential, and Sissy Spacek’s performance as Carrie is screen-meltingly amazing. Few horror films have aged this well, and watching a different creator’s vision of the story will be well worth your time. Rent Carrie on Prime Video.

The Craft (1996)

If Carrie’s cathartic presentation of female rage and teen angst is what hooked you, the most relevant movie to jump to is The Craft. The story of four high school girls who harness dark powers to take revenge on, well, high school life itself is anchored by four feral performances from Robin Tunney, Fairuza Balk, Neve Campbell, and Rachel True. Like Jennifer’s Body, the teen protagonists enthusiastically embrace their power in a way that Carrie White doesn’t, but it transforms (and destroys them) just the same. Rent The Craft on Prime Video.

The Innocents (2021)

One reason Carrie is terrifying in all its forms? The very idea of a child with an imperfect grasp of ethics and an immature emotional state having thermonuclear-level psychic powers. After all, teenage girls without powers can be terrifying when triggered. The Innocents focuses on sisters Ida (Rakel Lenora Petersen Fløttum) and Anna (Alva Brynsmo Ramstad), who meet Ben (Sam Ashraf) and Aisha (Mina Yasmin Bremseth Asheim), who both demonstrate powers including telekinesis and mind control. Their interaction soon reveals that Anna also has mental powers, and the four begin working to enhance their capabilities—but when one of them begins using their powers to hurt others and seek revenge, things take a dark turn that fans of Carrie will appreciate. Stream The Innocents on Kanopy or rent it on Prime Video.

Sissy (2022)

Anyone who was ever bullied in the teen years (so ... everyone) knows that those wounds never quite heal. That’s one aspect of Carrie’s power, and it’s also what makes Sissy an ideal movie to watch when you’ve finished the series. A mental health influencer, Cecilia (Aisha Dee)—once known as “Sissy”—runs into her old best friend, Emma (Hannah Barlow) and is unexpectedly invited to Emma’s bachelorette weekend—only to run into her childhood tormentor, Alex (Emily De Margheriti). The old trauma hits Cecilia like a bomb, shattering her fragile mental balance and leading to a surprisingly funny series of murders as Sissy works through her lingering anger issues. Stream Sissy on Hoopla or Tubi, or rent it on Prime Video.

Doctor Sleep (2019)

If you’re a Mike Flanagan and Stephen King superfan, the obvious movie choice is their other collab, Doctor Sleep. A sequel to one of the most famous horror stories of all time (The Shining), the story finds a middle-aged Danny Torrance (Ewan McGregor) struggling to control his psychic powers, and leading the fight against an ancient group of entities that feed off of people like him. If you want more of that Flanagan/King magic, this is the right move. Rent Doctor Sleep on Prime Video.


from Lifehacker https://ift.tt/FzARNLK