Rambler, Google's AI-powered dictation feature, seems genuinely useful. At its core, Rambler is like your phone's existing dictation tool, only much smarter. It can automatically edit your speech into a more polished end product. It'll eliminate your filler words like "um" and ah," shape up your grammar, and understand your intended meaning (e.g., if you say "we need to pick whole milk...I mean, oat milk," Rambler will type "we need to pick up oat milk.")

This is the type of feature most of us would like to have on our phones, there's only one problem: Despite developing the Android operating system, Google decided to make Rambler a Pixel 11-exclusive feature. As such, if you have a non-Pixel phone, like a Samsung or a Motorola, you're out of luck, unless you want to upgrade to one of Google's smartphones—or, as it turns out, download this third-party tool instead.

"PixelBoard" adds Rambler to any Android

As reported by Android Authority, developer Akshay Kadam modded Google's Gboard app and uploaded it to GitHub under the name PixelBoard. Kadam advertises PixelBoard as a "supercharged Gboard mod" sporting features from the Pixel 11 series—including AI writing tools, and, notably, Rambler.

According to Kadam's GitHub page, PixelBoard runs side-by-side with the Gboard app on your phone. You don't need to replace the existing app or uninstall it, nor do you need to root your Android. Still, this is an unofficial port that requires sideloading onto your Android device. While the tool comes from a public GitHub page, exercise caution if you want to give it a shot.

If you do, Kadam's GitHub page has detailed instructions for downloading the app on your phone. It seems you have three options: You can download PixelBoard directly from GitHub, then install it from the notification drawer or File Manager on your phone; if you're a developer, you can sideload the app by connecting your phone via USB with USB Debugging enabled; and, finally, you can patch the stock Gboard APK using Morphe Manager. (Kadam recommends the first method.)

Once you do have PixelBoard on your phone, head to Settings > System > Languages & input > On-screen keyboard (or Manage Keyboards), then enable PixelBoard. Tap the keyboard switch button or spacebar selector, then choose PixelBoard as the input method. To use Rambler, choose "Rambler Dictation" from this settings page, choose "Voice typing," then, under "Dictation type," switch from "Standard" to "Rambler."

Hopefully, Google brings Rambler to more phones in due time. But, until then, you can use PixelBoard to bring the feature to your device on your own.

from Lifehacker https://ift.tt/ZBFI2OU

We may earn a commission from links on this page.

On most runs, I prefer to pay attention to pace and heart rate data from my Garmin, and ignore the rest (even though I love playing with the data later on). But I also believe in trying a fun experiment now and then. So, for my most recent training block, I’ve retooled my watch's data screens around several of the more nitty-gritty metrics available to me— cadence, stride length, vertical oscillation, ground contact time, and more—to see what useful insights I could gain.

First, a quick definition, because "running economy" gets thrown around a lot: Running economy is the energy (oxygen) cost of running at a given speed. Two runners can hold the same 8:00 pace, but the one who uses less oxygen to do so is more “economical.” That runner can run the same pace at a lower heart rate, hold it longer, or go faster for the same effort. It's one of the big levers for performance, alongside VO2 max and lactate threshold, and it's one you can improve with training, strength work, and technique.

Technically, your watch can't measure running economy directly and give you one neat number. What it can do is show you how you're producing your speed, so you can spot inefficiencies and then test whether fixing them lowers your heart rate at the same pace. That's the experiment I’m running (pun intended). After my next marathon, I'll break down how my running economy actually improved, and in what ways.

All the running dynamics on Garmin watches

Garmin groups these metrics under "running dynamics." Depending on your watch and accessories, they include cadence, stride length, ground contact time, ground contact time balance, vertical oscillation, vertical ratio, running power, and step speed loss. In all the examples below, I'm using a Garmin Forerunner 970; note that not every Garmin can show all of these data fields.

Garmin Forerunner 970 Premium GPS Smartwatch (Black)

$749.99 at Amazon

$749.99 at Amazon

• Cadence works on nearly every Garmin running watch.

• Stride length is available on many mid-range and higher watches, sometimes from the wrist and sometimes only with an accessory.

• Ground contact time, ground contact balance, vertical oscillation, and vertical ratio have historically required a compatible chest strap, but many newer watches now measure these from the wrist.

• Running power has its own requirements, depending on your watch and whether you use an accessory. Check Garmin's running power device requirements.

• Step speed loss and step speed loss percentage require an HRM 600 chest strap paired to a compatible watch. They aren't measured when you're moving at a walking pace during a run.

Check your watch's owner's manual (the "Running Dynamics" page) to see what metrics are available for you to rebuild your own data screens.

How I use Garmin data screens to chart my running economy

Keep in mind that while these metrics are useful, there is no universally "correct" cadence or vertical oscillation number. Chasing the oh-so-coveted 180 steps per minute can do more harm than good if you end up overstriding at a fast turnover or running stiff and choppy. Think of everything below as a diagnostic, not a target. Some more tips to make the most of your Garmin data screens, without succumbing to information overload:

• Change one variable at a time. I spent a few weeks laser-focused on cadence before getting stressed over anything else.

• Use the new data screens on easy runs. Hard workouts are for hard efforts; easy runs are where you can afford to observe more.

• Review after the run, not during. Staring at vertical oscillation mid-stride is a great way to trip and fall. Feel free to glance, but don't let the numbers take over your run.

• Watch the trends, not single numbers. Again, focus on personal patterns, not any specific number targets.

• Keep screens sparse. Three or four fields per screen is plenty. Anything denser is hard to read mid-stride.

• Consider keeping your base screen first in the rotation and add the experimental screens after it, so you can flip over on easy runs without losing your usual setup.

Screen 1: Cadence + Stride Length + Lap Pace

Credit: Meredith Dietz

"Run at 180 steps per minute" is one of the most repeated pieces of running advice, and one of the most misunderstood. Cadence naturally varies with pace, so chasing one magic number regardless of how fast you're going can actually hold you back. Pace is the product of cadence and stride length. Seeing those two variables together can help show you how you're getting faster paces (or not).

What I noticed immediately: on easy runs, I naturally fall into a longer stride and lower cadence. It felt relaxed, but it also meant a lot of braking on each landing. Over the past several weeks, I've been nudging my cadence up by about 3 to 5 steps per minute, which shortens my stride slightly at the same pace, and my heart rate at that pace has come down a bit (although cooler weather certainly helps there, too).

The goal is to find your own cadence range and shift it slightly higher, not to force a fixed number. When in doubt, aim for a cadence at each pace that keeps your foot landing close to your body rather than reaching out ahead of it.

Screen 2: Ground Contact Time + GCT Balance + Step Speed Loss

Credit: Meredith Dietz

This screen needs compatible hardware, and if you do have it, it's my favorite for spotting fatigue.

Ground contact time (GCT) is how long your foot stays on the ground each step. Generally, shorter is associated with a springier, more efficient stride, and it tends to shrink as you get faster. GCT balance shows the left/right split.

Step speed loss is the newest of these metrics, and the one most directly tied to economy. Every time your foot lands, it acts a bit like a brake, and your forward speed dips before you push off again. Step speed loss measures how much speed you give up during each footstrike, and the percentage version expresses that loss relative to your running speed. Lower numbers mean less braking and more of your energy going into moving forward instead of fighting yourself.

It's useful for a few reasons:

• It captures overstriding. Reaching your foot out ahead of your body increases braking, and this metric shows you the cost. That makes it a great companion to the cadence screen: if raising cadence brings your landing closer to your body, you may see step speed loss drop.

• It's a cleaner efficiency signal than bounce. Vertical oscillation tells you how much you move up and down. Step speed loss tells you how much you're slowing down horizontally, which is closer to what actually costs you energy.

• It shows fatigue. Like GCT, it can creep up late in long runs as form degrades.

Two other uses I found valuable on this screen:

1. Fatigue tracking. In long runs, my GCT always creeps up in the final third, well before my pace or heart rate tell me I'm utterly cooked.

2. Asymmetry flags. A consistent tilt away from 50/50 isn't automatically a problem, since a small imbalance is common. But if yours shifts noticeably on days something feels off, it's worth listening to.

Again, don't stress about small imbalances. Look for changes from your normal.

Screen 3: Vertical Oscillation + Vertical Ratio

Credit: Meredith Dietz

Vertical oscillation is how much you bounce with each step. Vertical ratio is that bounce relative to your stride length, which makes it easier to compare across paces and across runners. Lower generally means less energy spent going up rather than forward.

Personally, this was the most misleading screen in the beginning. I saw my number, decided it was too high, and tried to "run flatter." That just made my stride feel forced and awkward. What worked better was treating it as a trend. The plan is that when I improve cadence and let my stride shorten a touch, vertical oscillation naturally drops on its own. Strength work and a slightly higher cadence should do more for me than any overly contrived form cue about "floating."

Screen 4: Running Power (if you have it)

Credit: Meredith Dietz

The economy framing here is simple: compare power to heart rate over time. In fact, I'm planning to go in and put heart rate on my screen alongside power. Because power responds instantly to changes in effort and terrain, it's a better gauge of your economy compared to pace on hills or extra windy days.

If you can hold the same wattage at a lower heart rate than you could two months ago, that's a real improvement in fitness and efficiency, regardless of what pace says. Just be aware that different power systems calculate the number differently, so stick with one source and don't compare across devices.

Screen 5: Base screen

Credit: Meredith Dietz

Finally, the screen I never removed: pace, heart rate, and lap or average pace (plus a timer and time of day, since this is still my watch, after all). For the sake of these runs, I could judge my form changes by whether my heart rate at a given pace went up or down. At the end of the day, this is how you find out whether any of the tweaks above are making a difference. 

How to add or edit data screens on your Garmin watch

You can customize your screens on the watch itself or in the Garmin Connect app. The app is easier if you're editing several screens at once, since the fields are larger and easier to read. Menu names vary by model, so treat these as the general path.

On your watch

1. Open the activity settings. From the watch face, press Start and select Run. Then hold the Up/Menu button (or tap the screen on touchscreen models) and choose Run Settings.

2. Choose Data Screens. This lists every screen you cycle through during a run.

3. Pick a screen to edit, or choose Add New to create one.

4. Set the layout. Choose how many data fields appear, from one large field to several smaller ones.

5. Choose your data fields. Select each field slot, browse the categories (Cadence, Running Dynamics, Power, Heart Rate), and pick the metric you want.

6. Reorder or remove screens back in the Data Screens menu.

In the Garmin Connect app

1. Open Garmin Connect and tap your watch (usually under More or the device icon).

2. Go to Activities & Apps, then select Run.

3. Tap Data Screens and pick the screen you want to edit.

4. Change the layout and fields, then sync your watch so the changes carry over.

The bottom line

If you have the hardware and a little curiosity, spending a few weeks with running dynamics on your wrist can help you nerd out like you're a true running machine. Look, learn, adjust one thing, and let your heart rate tell you whether it worked. For more, check out these ten hacks every Garmin user should know.

from Lifehacker https://ift.tt/RV5c0Kh

All messaging apps should let you schedule texts by default. Sometimes, you need to send a message to a friend or family member, but you don't want them to get it just yet. Maybe they're in a different time zone, and it's too early or late to politely text them; maybe they're in an important meeting, and you don't want their phone sounding or buzzing as a distraction. Either way, a scheduled message can save you: You won't forget to text them later, and they'll get the message whenever you think they should. Win-win.

Of course, this is not a standard feature in all apps yet. Some apps have it, like Telegram or iMessage, and it's a great addition when you need it. Others, like Messenger or WhatsApp, are sorely missing it. While Meta doesn't appear to have any plans to bring scheduled texts to Messenger, it does seem like WhatsApp users are getting the upgrade on the horizon. In fact, you might be able to try it out today.

Scheduling messaging in WhatsApp

As reported by WABetaInfo, WhatsApp is currently testing a new feature for users to schedule texts, photos, and videos to send at a later time. At this time, the feature works even when you're offline, so your scheduled messages will still send even if you don't have a wifi or cellular connection. In addition, the feature is not limited to single chats, as so many new messaging features are. You can schedule texts in both one-on-one and group chats, and all scheduled messages are still end-to-end encrypted.

At this time, it looks like Meta is only testing scheduling messages on WhatsApp for Android. The bright side for iPhone users is that this test is quite limited: Only select users are getting the feature at this time—and, while it's no guarantee, you should enroll in the WhatsApp beta if you want a chance at trying it out early. To start, head to WhatsApp's official beta tester page on the Google Play Store. Here, make sure you're logged into your Google Account, then enroll in the beta. Head back to the official WhatsApp Play Store page, and you should have a new update. This is the beta.

Once you're on the WhatsApp beta, you can check if you have the feature like so: Craft a new message in any chat, then tap and hold on the send button. If you have it, WhatsApp will present a pop-up, letting you cycle through a date and time to schedule your message. (You can choose to send the message in as little as 10 minutes, or as long as two weeks.) When you're ready to schedule, you can tap the green schedule button at the bottom of the menu. You can then tap the contact or group name at the top of this window, then tap "Schedule messages" to manage all scheduled texts in that thread.

from Lifehacker https://ift.tt/8oTyiHS

In this Help Net Security interview, Akshay Joshi, Head of the Centre for Cybersecurity at the World Economic Forum, talks about how AI, geopolitics and industrialized fraud are changing cyber risk. He discusses findings from the Global Cybersecurity Outlook 2026, including that CEOs now rank cyber-enabled fraud above ransomware as their top concern.

Joshi explains the widening resilience gap between large and small organizations and between regions, the role of skills shortages, and what public-private cooperation needs to work at scale. He also offers advice for CEOs and boards.

How would you describe the current cybersecurity landscape in one or two sentences, and what has changed most over the past year?

Cybersecurity is entering a new phase: AI is accelerating the threat landscape, geopolitical fragmentation is increasing systemic exposure, and cyber-fraud has become industrialized. This trifecta is changing the speed and scale at which cyber risk unfolds, calling for better governance; stronger collaboration and the ability to turn emerging technology into a source of resilience as speed and control are what have changed most.

What findings from the Forum’s recent cybersecurity research surprised you most, and what should leaders take from them?

One of the most striking findings in the Global Cybersecurity Outlook 2026 is the scale at which cyber-enabled fraud has become part of everyday life. 73% of respondents said they or someone in their network had been personally affected by cyber-enabled fraud in 2025, while 77% reported an increase in fraud and phishing. Unsurprisingly, CEOs now rank cyber-enabled fraud and phishing as their top cyber concern, ahead of ransomware.

Cyber-enabled fraud directly affects customers, employees and organizations, eroding trust in the digital economy. Addressing it therefore requires leaders to look beyond protecting their own networks and strengthen prevention, response, and collaboration across technology companies, financial institutions, telecommunications providers, governments and law enforcement.

How is AI changing the balance between attackers and defenders? Where do you see the biggest risks and the biggest opportunities?

AI is accelerating cyber offence and defense, driving a shift from human-paced operations towards autonomous, machine-speed activity. Frontier AI models are reshaping not only the cybercrime landscape and the capabilities available to attackers and defenders, but also how we think about security, governance and oversight.

According to our research, 87% of respondents identify AI-related vulnerabilities as the fastest-growing cyber risk. This concern is compounded by the emerging possibility of AI agents operating as independent threat actors, exhibiting goal-directed behaviors such as self-preservation and resource acquisition, and coordinating complex cyber operations in ways that challenge existing approaches to governance and defense.

In times when technological progress raises a critical security question, the opportunity is significant and it depends on getting the fundamentals right. Governments, regulators and industry must work together to put security at the heart of how AI is designed and deployed, ensuring that humans are making and accountable for high-impact decisions. For frontier AI developers, this means building internal controls to ensure AI is developed safely, complemented by credible external review and oversight. For adopters, it means harnessing AI to strengthen the defender’s advantage: as attackers automate and scale reconnaissance, exploitation and fraud, defenders can use AI to detect threats, investigate incidents and respond with greater speed and efficiency.

How are geopolitical tensions shaping the threat environment for businesses and critical infrastructure?

Geopolitics has become one of cybersecurity’s defining variables, while cyber capabilities are increasingly part of geopolitical competition itself. Our research finds that 91% of the largest organizations have changed their cybersecurity strategies in response to geopolitical volatility, while 64% of organizations now factor geopolitically motivated attacks into their risk mitigation strategies.

At the same time, confidence in national preparedness is eroding. 31% of respondents report low confidence in their country’s ability to respond to a major cyber incident. That confidence is also highly uneven: 84% of respondents in the Middle East and North Africa express confidence in their country’s ability to protect critical infrastructure, compared with just 13% in Latin America and the Caribbean.

For businesses and governments, this means cyber resilience can no longer be assessed solely through technical vulnerabilities. Leaders must understand geopolitical exposure, critical infrastructure dependencies, supply-chain concentration and national response capacity, particularly as digital infrastructure itself increasingly becomes a strategic target.

The gap in cyber resilience between large and small organizations, and between regions, appears to be widening. Why is that, and what can be done to close it?

The cyber resilience gap is fundamentally a capability and investment gap. Our research finds that smaller organizations are twice as likely as larger ones to report insufficient cyber resilience, while significant regional disparities persist, with the highest levels of resilience reported in the Middle East and North Africa and the lowest in Latin America and the Caribbean and sub-Saharan Africa.

The reason is access to skills, resources and institutional capacity. For example, 85% of insufficiently resilient organizations report lacking the workforce needed to meet their cybersecurity objectives, compared with just 22% of highly resilient organizations. Highly resilient organizations are also much more likely to integrate security into procurement, regularly assess AI tools, monitor operational technology and exercise incident response with ecosystem partners.

Closing that gap means investing in the foundations of resilience which are skills, shared capabilities, recovery capacity and sustained financing as well as directing resources to where vulnerability is greatest. Ultimately, it is important to see that this is not just an equity issue. It is a systemic resilience issue. In an interconnected digital economy, underinvestment in one part of the ecosystem can create risk for everyone.

How serious is the cybersecurity skills shortage today, and which approaches are proving effective?

Cyber skills shortages as a key driver of inequity. Our research shows that skills are one of the differentiators between resilient and insufficiently resilient organizations: 85% of organizations reporting insufficient resilience also face critical skills and talent gaps, compared with just 22% of highly resilient organizations.

Organizations need to broaden the talent pipeline, continuously upskill existing employees and embed cybersecurity capabilities across business and technology functions. There is also an opportunity to use AI to augment scarce expertise, helping human detect and analyze threats, automate repetitive tasks and respond faster. Ultimately, closing the skills gap is essential to closing the resilience gap. If advanced cyber capabilities remain concentrated in organizations and economies that can afford talent, technological progress risks widening rather than reducing existing cyber inequities.

Several leaders argue that more than a skills gap, the cybersecurity industry has an experience gap. It is crucial to ensure we focus on training and provide exposure to the workforce to complex challenges.

What does effective public-private cooperation look like in practice, and where is it still falling short?

Effective public-private cooperation means moving from sharing information to shared commitment and coordinated action. The Global Cybersecurity Outlook 2026 shows that highly resilient organizations are already doing this: 48% of CEOs of highly resilient organizations are increasing collaboration with government agencies and information-sharing groups. We’ve seen public-private partnerships through the Partnership Against Cybercrime initiative that combines intelligence, technology and steady collaboration with law-enforcement authorities to disrupt cybercrime in ways no actor could achieve alone.

Where we still fall short is in making that cooperation systematic, scalable and accessible. As pointed above that collaboration remains easier for large, well-resourced organizations, while smaller organizations and less-resourced ecosystems often lack access to the same intelligence, expertise and partnerships. The priority now is to build trusted mechanisms for intelligence sharing, joint preparedness and coordinated response before a crisis occurs, while raising the collective baseline so that cooperation strengthens the whole ecosystem rather than only its strongest participants.

If you could give one piece of advice to a CEO or board member reading this piece, what would it be?

Treat cybersecurity as an enabler of business resilience. Our research shows that the most resilient organizations distinguish themselves through stronger CEO engagement, greater collaboration and more proactive approaches to emerging risks such as AI, geopolitics and supply-chain dependencies.

For CEOs and boards, that means understanding organizational dependencies, knowing what disruption would cost, and investing to safeguard against real exposure rather than simply meeting compliance requirements. In an environment where cyber disruption can affect operations, supply chains, customers and trust, resilience has to be part of business strategy and leadership accountability.

Download eBook: Identity-First Threat Intelligence

from Help Net Security https://ift.tt/jZhBe4M

Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering effort, according to Google’s case study, “How much does it cost to maintain a copy of an open source software package (at Google)?”

Study suggests that most updates to its internal copies of open source packages should take four engineering hours or less. More demanding updates can require days or months of effort, with local modifications, dependencies, and repairs to affected software contributing to the workload.

Google tracked the engineering effort involved in 54 package updates between April and December 2024. It also surveyed employees about the factors that make updates take longer.

Local changes create recurring work

Of the 47 packages with usable patch-detection results, those with company-specific patches had a median update effort three times that of packages without patches. The average effort was the same for both groups. Employees identified patches and customization as the leading cause of additional work.

In your experience, what characteristics of an OSS package or the update process make it take longer than average? (Source: Google)

When a company modifies its copy of an open source package, engineers must account for those changes when adopting a new version. They may need to adapt the patches and resolve compatibility problems.

Larger numbers of external dependencies and upstream contributors were associated with greater update effort. Activity in the original project’s repository showed a relationship with effort. The timing of previous updates and version installations, along with internal usage levels, showed no consistent relationship with update complexity.

Repairs drive lengthy updates

The median total effort was 2.2 engineering hours, while the average was 13.9 hours. One update required an estimated 400 hours.

“For updates that took more than 2 days, the majority of time was spent on remediation,” Sophia Vargas, Google Open Source, explained.

That work involves resolving downstream dependency issues and repairing breakage. An update can affect applications and other components that rely on the package, requiring repairs before the update is complete.

In 52 of the 54 updates, the engineers were very familiar with the programming language but completely unfamiliar with the package and how it was used inside Google. Learning enough to begin took less than an hour on average.

Google’s setup limits broader conclusions

The observed work represented less than 1% of Google’s package updates during the collection period. Updates were selected according to internal business priorities, and 52 of the packages were written in Go.

Google generally maintains one version of each imported package in its internal repository. Its tools and processes influence maintenance effort, including the work required to repair affected software.

The study did not prescribe which tools engineers could use or evaluate the impact of individual tools, including generative AI. Stale and archived packages received limited coverage.

Must read:

Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

from Help Net Security https://ift.tt/flvCqAi

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

Three questions a hospital CISO should ask a healthcare fintech vendor
In this Help Net Security interview, Drew McCombs, CTO and CISO at Cylerity, explains how he balances both roles. Security work is scheduled into every sprint, and issues touching patient data or funds disbursement come first. He covers how Cylerity keeps PHI away from its bank partner, why AI models recommend but never act, and why turning on MFA for email is the cheapest fix for small practices.

MAKERphone 2: A DIY 4G phone with plug-in camera, speaker and prototyping board
CircuitMess, a Croatian electronics kit maker, is selling MAKERphone 2.0, a build-it-yourself 4G phone on Kickstarter that buyers program in MicroPython or Arduino C++ and extend with plug-in hardware.

RemoveMacAI turns off Apple Intelligence on macOS 27 and deletes its models
A developer has released RemoveMacAI, a free command-line tool that turns off Apple Intelligence on macOS 27 and deletes about 12 GB of downloaded AI models. It requires a Mac with Apple silicon.

U.S. Bank CISO says the security role keeps growing and no one can own all of it
In this interview with Help Net Security, Ann Barron-DiCamillo, EVP, CISO at U.S. Bank, talks about how the CISO role has grown to cover fraud, resilience, third-party risk, and AI governance. She says no single leader can own all of it, so partnerships across technology, risk, legal, and business teams matter most.

Automation, AI agents or people? Sorting out who handles each security finding
Just over half of the 200 senior security and technology leaders polled for ArmorCode say their organizations will struggle to simplify their software security programs if they keep working the way they do today.

Who watches the AI watching your street?
Yusaku Fujii, a professor at Gunma University in Japan, has designed audits and penalties to stop operators from misusing AI that analyzes street camera footage. His system adds an independent record-keeper and unannounced spot checks to the AI’s outputs.

Pricing your bad days and how to build an economic model for security decisions
Ivan Milenkovic, VP Risk Technology EMEA at Qualys, explains how security leaders can build an economic model that puts money behind their decisions. He suggests starting with a few loss scenarios, then working down to the assets that drive them.

What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
ESET researchers traced almost two years of changes to MATCHBOIL, a downloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windows machines in Ukraine. The program MATCHBOIL installs is a spying tool, and the access it creates may be useful to other groups.

Thousands of wind and solar park systems sit exposed on the internet across Europe
Modat and NCSC-NL, the Dutch government’s cybersecurity center, found 8,547 internet-facing systems at wind farms and solar parks in 35 countries in and around the EU that should not be reachable from the internet. The systems range from login screens to a turbine control page that offers a Stop button to anyone with a browser.

What the BPFDoor backdoor tells us about attacks on the network edge
A backdoor that makes no noise is hard to catch, and that’s the point of BPFDoor. The Linux malware waits for a special “magic packet” before it acts. In this interview with Help Net Security, Christiaan Beek, VP of Rapid7 Intelligence, explains why its operators go after mail gateways and other edge devices that can’t run endpoint agents, and why a hacked telecom network can put a whole nation at risk.

Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940)
Microsoft has pushed out an out-of-band security update for Exchange Server that fixes a high-severity vulnerability (CVE-2026-96940) that may allow authenticated attackers to read emails and attachments of other users in the same organization, but “does not allow access across tenant boundaries.”

CISA flags new exploited NetScaler flaw as attackers crash appliances (CVE-2026-88779)
CISA has added another Citrix NetScaler vulnerability to its Known Exploited Vulnerabilities catalog on Sunday: CVE-2026-88779, a memory overflow bug that may cripple vulnerable NetScaler ADCs and Gateways.

SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)
SonicWall has patched four vulnerabilities in its popular Secure Mobile Access (SMA) 1000 series of appliances, including one (CVE-2026-102255) that could allow remote unauthenticated attackers “to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”

Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)
One day after Atlassian released patches fixing a critical arbitrary file access vulnerability (CVE-2026-21589) in its self-managed Data Center products, and a few hours after watchTowr researchers published a technical rundown of the flaw, attackers have been spotted attempting to exploit it.

YouTubers targeted with fake sponsorships and “channel verification” phishing
Scammers are going after YouTube creators’ Google accounts by posing as a brand looking for sponsorship partners. By sending out personalized emails that reference a creator’s own videos and directing targeted creators to a convincing fake collaboration platform, the fraudsters walk them through what looks like a routine brand deal, right up until the moment they’re asked to sign in with Google.

NIS2 compliance: 7 low-cost steps to secure credentials
Security budgets rarely stretch to cover a full NIS2 programme in one pass. Credential controls are where a constrained team can start, because they make access visible, revocable, and reviewable without new infrastructure. NIS2 compliance rests on risk-management measures that fit the actual risk an organization faces under Article 21, with the choice of specific products and policies left to that assessment.

AI endpoint management: Visibility, compliance, and remediation
Endpoint estates are growing faster than the teams that look after them. Hybrid work, cloud adoption, contractor laptops, a steady stream of new CVEs, and rising compliance pressure mean security teams manage more devices, more software, and more exceptions than a spreadsheet or a monthly scan can hold. Manual tracking and manual remediation no longer keep up.

How AI can fix cybersecurity compliance: From dashboards to continuous execution
Most compliance work goes into proving security, not improving it. That isn’t because the rules are unreasonable. Regulators, customers, and cyber insurers are right to expect organizations to implement hundreds of technical and administrative controls, monitor their environments, respond to incidents, and prove that all of it works. The problem is the cost of delivering it.

October 2026 Patch Tuesday forecast: Time for an Office cleanup
September 2026 Patch Tuesday set an all-time record with 973 CVEs addressed across the Microsoft portfolio. We’re only four months into the Patch Apocalypse and everyone seems to be numb with respect to the insane number of CVEs reported.

How RMM abuse gives attackers a way in that looks like business as usual
Huntress found attackers using legitimate remote monitoring and management (RMM) software in 45% of the endpoint-related incidents it recorded in the first quarter of 2026. The security company also ranked 11 attack tactics by how often it sees them and how much damage each can do, and RMM abuse sits farthest right on the chart, the position for tactics it sees most often.

AI slop submissions force Google to freeze its open-source bug bounty
Google has stopped accepting new product vulnerability reports through its Open Source Software Vulnerability Reward Program (OSS VRP), after a wave of invalid, AI-generated submissions swamped the engineers and open source maintainers who review them.

Detained ShinyHunters hacker reportedly helping FBI track down fellow members
A suspected ShinyHunters member known as Rey has been detained in Jordan and is reportedly helping the FBI track down the rest of the group. Reuters reports that Jordanian authorities detained Saif al-Din Khader, alias Rey, last week, with two of its three sources placing the arrest on Tuesday.

Fake brand discounts on social media prey on shoppers’ fear of missing out
Cybercriminals are using fake discounts posted on Facebook and TikTok to lure shoppers to phishing sites that steal their payment card details and one-time passwords, Group-IB has warned. The phishing kit called Milk Dragon (also known as NaiLong) has been active since October 2025, and is linked to 258 phishing pages and victims in 66 countries.

Data breach at Denmark’s population register exposes 8.8 million people
A data breach at Denmark’s Central Population Register (CPR) has exposed the personal information of 8.8 million people. These include people living in Denmark, deceased people and citizens who have moved abroad.

Dell System Update flaw allows attackers to gain root privileges (CVE-2026-86360)
Dell is urging customers to patch a vulnerability (CVE-2026-86360) in Dell System Update (DSU) that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.

Rogue OpenAI agents made unauthorized Wikipedia edits and millions of requests to Wikimedia
Rogue OpenAI agents made unauthorized edits on Wikimedia wikis and sent millions of automated requests to Wikimedia’s public APIs, traffic that may have contributed to a partial outage of the Wikidata Query Service in May, the Wikimedia Foundation said on Monday.

OpenSSH 10.6 enables a post-quantum signature algorithm, so experimental keys need replacing
The OpenSSH team released version 10.6 on Oct. 6 and said it will ship releases more often for now to get bugfixes into users’ hands more quickly. The maintainers have received a large number of security reports, many found by AI models or with AI help, and in a number of cases a different researcher independently found the same bug later.

ASOS confirms data breach after “hacked” app alert reaches shoppers
UK fashion retailer ASOS has confirmed a data breach after a notification claiming hackers had broken into its data was sent to shoppers through its app. According to the company’s update to investors, the unauthorised notification went out to its customers at around 10am on 6 October 2026.

Hackers hijack three country-code domain registries, obtain HTTPS certificates for Google domains
Attackers who took control of three country-code top-level domains (ccTLDs) used that access to obtain HTTPS certificates for several Google domains and for domains run by other large organizations, Google disclosed on Tuesday.

FortiBleed is still active, with attackers locking admins out of Fortinet firewalls
Some organizations hit by the FortiBleed campaign have been locked out of their own Fortinet firewalls, according to a joint FBI and U.S. Secret Service advisory. FortiBleed targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The advisory cites SOCRadar, which has verified more than 86,644 compromised devices in 194 countries.

Ransomware recovery firm boss charged with secretly paying attackers and overcharging victims
The owner of Florida-based ransomware remediation company MonsterCloud has been charged with fraud for allegedly paying ransomware gangs behind his clients’ backs and billing them far more than the ransom. Zohar Pinhasi (aka “Zack Silver” and “Zack Green”), a 50-year-old US and Israeli national from Hollywood, Florida, allegedly billed MonsterCloud clients more than $19 million while paying more than $8 million to the ransomware gangs that attacked them.

Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
Thousands of hijacked servers have been looking up their command and control (C2) server in a poem posted on GitHub, according to Black Lotus Labs. The malware reading it, dubbed PoeLLM, breaks into exposed AI services and open-source tools, mines cryptocurrency on them and uses them to hunt for new victims.

Authorities seize sites selling hacked, stolen intimate images of 17,000 women and girls
The FBI and French law enforcement have seized two websites that sold hacked and stolen sexually explicit images and videos of young women and girls, and arrested their suspected administrator in northern France.

FBI disrupts Flax Typhoon hacking tools used in global cyberattacks
The FBI seized seven domains used to operate Microscan and FishHub, two hacking tools linked to Chinese state-sponsored hackers known as Flax Typhoon that were used to target critical infrastructure and other organizations in the US and abroad.

High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring
Hundreds of internet-exposed graphics processing unit (GPU) servers were open to a high-severity flaw in NVIDIA’s DCGM Exporter (CVE-2026-47483) that lets unauthenticated attackers crash the monitoring service and may disrupt AI workloads, according to Lava.

Keyorix: Open-source secrets management for teams that can’t use SaaS
Keyorix is an open-source secrets manager that runs entirely on a company’s own servers. A secrets manager is the locked store where an application fetches the database passwords, API keys, and tokens it needs, so they stay out of config files and source code. It ships as one binary and, in its core form, needs no internet connection.

Apple tightens macOS disk access as AI agents become more powerful
Apple plans to introduce additional controls for Full Disk Access in macOS, citing growing privacy risks as AI agents become more capable and autonomous. Users will need to take explicit action to grant apps this permission. The company has not specified a rollout date or detailed how the controls will work.

Product showcase: Webroot Mobile Security screens texts, blocks risky sites, and checks for data leaks
Webroot Mobile Security combines device security checks, Safari protection, text scam filtering, and data breach monitoring. It is available for iPhone, iPad, and Android devices. The app requires an active Webroot subscription and is included with Essentials, Premium, and Total Protection.

Reflection’s Beam trails top open models on coding tests but claims lower inference compute
Reflection AI has built Beam, a 501-billion-parameter open-weight model for coding and agent tasks, and plans to publish the weights under an Apache 2.0 license later this month. Open-weight means developers can download the trained model and run it on their own hardware. Beam uses a mixture-of-experts design, so 23 billion of its parameters fire for any given token, which keeps the cost of each answer down.

GitHub’s ReviewBench puts AI code reviewers to the test
GitHub’s ReviewBench measures how well AI code review tools detect problems before software is released. Available in research preview through its website, the benchmark lets users compare review agents and evaluate their own tools.

Check your X.Org server version because a dozen vulnerabilities have been patched
X.Org fixed 12 security flaws in the X server and Xwayland, with the repairs shipping in xorg-server 21.1.25 and xwayland-24.1.14. Nine of the flaws can lead to arbitrary code execution. The other three can crash the server or disclose information.

Even with OT network visibility, critical infrastructure operators struggle with legacy equipment
Large critical infrastructure operators run seven separate security tools on average, and most still cannot see every asset on their operational technology (OT) networks. That is the picture from a Palo Alto Networks survey of more than 1,600 security and operations leaders.

AI Agent Gateway: Open-source tool keeps credentials out of agent configs
Tuskira’s AI Agent Gateway is an open-source solution that sits between AI agents and everything they call: the MCP tool servers that connect them to services like GitHub and Jira, and the model providers they send prompts to. The gateway runs in your own environment without a Tuskira account.

Anthropic loosens Claude’s cyber restrictions for verified defenders
Anthropic expanded its Cyber Verification Program (CVP), giving approved security professionals access to advanced Claude capabilities with fewer automated blocks on work such as malware analysis and vulnerability testing.

Your Windows PC can now reach other PCs through Windows App
Microsoft has made remote PC connections generally available in Windows App on Windows. Users can access physical or virtual Windows PCs alongside Windows 365, Azure Virtual Desktop, and Microsoft Dev Box resources.

Cisco quantum network controller lets apps order entanglement on demand
Cisco has built a Quantum Network Controller, a research prototype that lets an application ask a quantum network for entanglement and leaves the network to work out the delivery. Entanglement, a linked quantum state shared between distant points, is the resource these networks distribute, and operators today set up the hardware that produces it device by device, link by link.

Medical devices patients rely on most are least prepared for quantum attacks
Threat actors are exploiting IT, IoMT, OT and IoT devices across healthcare delivery organizations (HDOs) to deploy ransomware, demand payments and monetize stolen patient data, according to Forescout’s Post-Quantum Cryptography (PQC) in Healthcare: From Data Risk to Migration Readiness report.

Java library vulnerabilities: IBM and Red Hat fix 400+ previously unknown flaws
IBM and Red Hat have found and fixed more than 400 previously unknown vulnerabilities in widely used Java libraries through Lightwell, their program for patching open source code that companies already run in production.

The people who know passkeys best are still typing passwords
Yubico and Okta asked 1,890 technology and security professionals across nine countries how they sign in to work accounts. The most common answer was a username and password, at 43%, from a group in which 87% said they were familiar with passkeys.

GitHub adds AI to catch passwords before a code push
GitHub has announced an AI detector, developed with Microsoft Applied Sciences, to help prevent developers from uploading passwords and other credentials to code repositories. The ModernBERT-based classifier will expand GitHub’s push protection, which checks code for secrets and can block a push before a credential enters repository history.

Anthropic’s new budget model gets much better at ignoring hidden commands
Anthropic’s Claude Haiku 5.5 model, designed for quick, repetitive workloads and speed-sensitive tasks, is now better at finding vulnerabilities and writing exploits than its predecessor. The company has given it stricter cybersecurity safeguards than Haiku 4.5, though lighter ones than its more advanced models, whose offensive skills remain well ahead.

Companies want autonomous IT operations but hesitate to let AI act alone
Ninety percent of companies want to move toward autonomous IT operations over the next two years, with agentic AI, software that plans and carries out multi-step tasks on its own, doing the work. Yet 77 percent say their own organization hesitates to let AI make an operational decision without a human approving it.

PCI SSC calls for human approval of AI agent actions involving cardholder data
The PCI Security Standards Council (PCI SSC) has published Security Considerations for AI Systems, guidance covering the protection of data supplied to AI systems in payment environments and defenses against AI-assisted attacks.

Product showcase: SimpleLogin keeps your email address private with aliases
SimpleLogin is an email alias service from Proton that forwards messages to an existing mailbox. Users create addresses for registrations, purchases, and correspondence, giving them control over where their primary email address is shared. The service is open source and supports self-hosting.

Anthropic offers free AI security scans to open-source maintainers
Anthropic’s OSS Scanner is a new, free service that uses the company’s strongest AI models to find security vulnerabilities in open-source software. Maintainers who opt in receive periodic scans and reports explaining suspected flaws, how to reproduce them and, when available, how to fix them.

Cybersecurity jobs available right now: October 6, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

from Help Net Security https://ift.tt/NFC478H

On Wednesday I spent a day fishing, on a small boat out of Gloucester, MA. We caught many cod (none of which we could keep), and a bunch of hake and mackerel (all of which we could keep). And…I caught a squid! Near as I can tell, it’s a longfin squid, sometimes called a Boston squid (Doryteuthis (Amerigo) pealeii).

That night I cooked it over a barbecue grill—hot and fast. Delicious.

from Schneier on Security https://ift.tt/5o7wT6e