Pew Research Center finds 51% of Americans say no, cite lack of interest - not know-how - as the top reason If you thought everyone was into chatbots, think again: about half of US adults never use the AI tools, and most have no interest in starting. According to Pew Research Center, older adults are the least likely to use chatbots, with roughly three-quarters of those aged 65 and older saying th

Techies at 'Russia's Google' work around the clock as users await access to funds and network connectivity falls to 30% of normal Yandex engineers are working to restore services after Ukraine launched drone strikes on three of its five Russian datacenters. The strikes began overnight on October 7-8, "seriously damaging" Yandex's Sasovo datacenter and leading to a total shutdown. Ukrainian drones

This week on The Kettle, we discuss some arrests and how Mythos' mathematical expertise has led to a second exploited bug that no human would have found KETTLE The FBI has announced what appears to be a third arrest in the ShinyHunters investigation, following the group's breach of Bureau systems, even as AI advances potentially leave human hackers on borrowed time. You can listen to the latest ep

Meanwhile, AI agents move robotic arms, 'make OT device operator screens lie' Autonomous AI systems are fully capable of carrying out a nightmare cyberattack scenario – finding and attacking critical operational technology and industrial equipment, and shutting down access to water, power, and other daily life necessities. If this happens, defenders may only have minutes to detect and block it, ac

Attackers abusing rare Cyrillic and Latin letters to impersonate popular websites Researchers say two characters available to typosquatters and phisherfolk can trick Chromium browsers into displaying lookalike URLs as genuine web addresses. Wangling a domain name to look an awful lot like that of a popular website is nothing new. We’ve all encountered phishing sites such as macrosoft[.]com and app

Tokens transmitted in metadata, weak VM isolation, and expansive permissions make hacking a lot easier UPDATED Bob, possibly the same Bob whose conversations with Alice draw so much interest from eavesdropping Eve, was browsing a site we'll call TechHub. The site hosts an AI agent served by Amazon Bedrock AgentCore. Bob asked the agent for help understanding the content of a URL, a credential endp

No word on exploitation status, but a 9.5 severity score suggests time is of the essence Citrix is urging customers to patch another critical NetScaler vulnerability after weeks of disclosures involving actively exploited flaws. CVE-2026-107406 affects NetScaler ADC and NetScaler Gateway and can lead to remote code execution (RCE) or denial of service (DoS). It carries a CVSS v4.0 score of 9.5. Th

Infecting devices from 2021 until the FBI stepped in The FBI announced that it has seized seven web domains linked to hacking tools allegedly operated by a Chinese security firm called Integrity Technology Group and used by Beijing-backed cyber operatives to scan a South Carolina power company's network and other critical infrastructure systems for vulnerabilities. In a subsequent advisory, the FB

The GPU giant released a fix for the flaw, tracked as CVE-2026-47483 Researchers found thousands of GPU servers exposing Nvidia's DCGM Exporter to the internet, with hundreds potentially vulnerable to a high-severity flaw that could let unauthenticated attackers crash the GPU monitoring service and disrupt AI workloads. DCGM Exporters read telemetry from the GPUs on a host, including its hardware,

Credential-stealing malware detected within minutes of npm release, but impact remains unknown The credential-hijacking Shai-Hulud worm has struck again, this time burrowing its way into a popular AI agent platform SDK. Multiple security researchers reported Thursday that they had detected Shai-Hulud infection in a recent release of the npm package for version 0.5.144 of Tensorlake’s SDK. That pac

SPONSORED FEATURE: Old attack, new protections The use of phishing emails as a means of stealing information or implanting damaging malware dates back to the mid-1990s. Although almost as old as the Internet, it remains the instrument of choice for threat actors wanting to pose as trusted organizations or individuals for the purposes of corporate infiltration. In fact its use is on the rise: accor

Security pact promises information-sharing and coordinated disruption, but offers little detail on agencies or funding Britain and Germany have announced a partnership to counter cyberattacks and sabotage, particularly from Russia, as Prime Minister Andy Burnham heads to Berlin for talks. Under the arrangement announced Thursday, the countries will share information and coordinate efforts to monit

The owner knew a guy... Welcome back to PWNED, the weekly column where we highlight some of the lowlights in corporate security. This week, we’ll talk about two scenarios, one that ended in tragedy and another that shows the power of a good defense over dedicated phishing attacks. Have a story about someone leaving a gaping hole in their network? Share it with us at [email protected]. Anonymity is

Feds claim he charged clients more than ransoms, paid up, pocketed the difference The United States Department of Justice has charged a man with fraud after he allegedly told clients he could decrypt files locked up by ransomware but actually paid ransoms – and seemingly got away with it for years. The Feds allege that Zohar Pinhasi – aka “Zack Silver” and “Zack Green” – ran a Florida company call

Trusted brand impersonation without the usual browser certificate warnings spells trouble Imagine going to a Google website at its correct URL, only to be redirected to a crim's illegitimate copy. Attackers hijacked top-level domains, allowing them to alter DNS records and mint fraudulent HTTPS certificates for several Google domains, and those belonging to other organizations. Google said it beca

Strands Box is the latest open source AI control tool from the cloud giant; like its predecessors, it promises tighter reins on autonomous agents AWS has offered multiple open-source strategies for holding AI agents accountable, and now it’s adding a full-on sandbox to this stack. Dubbed Strands Box, the new solution uses OS-level isolation and some of AWS’ other recent open-source AI control tool

Router maker rejects allegations it misled buyers about protection and its reliance on Chinese suppliers The attorneys general of Florida, Iowa, Montana, and Nebraska have sued ubiquitous networking and smart home tech maker TP-Link, alleging its security claims were misleading and it hadn't properly disclosed ties to China. The company has a large presence in US retail and the tech channel, espec

Quoth the LLM, 'More and more' A suspected Italian attacker armed with a malware-controlling poem has infected more than 3,000 servers since April, breaking into enterprise AI infrastructure to mine cryptocurrency and add compromised systems to its growing botnet. This is the first case of “adversarial poetry” - an AI jailbreak technique that turns harmful prompts into poems to trick LLMs into byp

Tens of thousands more victims and more ransomware groups getting in on the act The FBI and US Secret Service (USSS) say criminals using credentials linked to the FortiBleed campaign are locking organizations out of their Fortinet firewalls. The agencies published a joint advisory on Tuesday, citing SOCRadar's verification of more than 86,644 compromised devices across 194 countries. "Based on ini

'Complete security paradigm refresh' needed for the AI era South Korean president Lee Jae Myung has told the nation’s cabinet that it’s time to develop AI-powered defensive tools to combat AI-wielding attackers. “Recently, a series of personal information leak incidents have been occurring at financial and public institutions,” he said yesterday – likely referring to incidents like the breach at e