• Gadgets with foreign chips are now being banned by the FCC
• Two unnamed devices have been put on the official Covered List
• However, Intel has been granted an exemption for factory robots

There's new movement in both directions on the Covered List maintained by the Federal Communications Commission (FCC) in the US — the list of banned tech products that the agency has determined are a threat to national security, including DJI hardware.

New rules that came into effect this month allow the FCC to ban not just devices from specific companies, but also devices with components from specific companies inside them. As The Verge reports, those rules are now being put into practice.

Two unnamed gadgets have been added to the Covered List because they have a HiVision chip inside — HiVision being a subsidiary of Huawei, which is already on the list. These chips are typically used in home security cameras and dashcams.

As per the FCC, they're "foreign surveillance chips", and offer "built-in detection algorithms for human faces" (a feature you might have seen advertised as a way of identifying strangers around your property, rather than friends and family).

Factory robot workers

However, one company has managed to extract a waiver out of the FCC to avoid equipment it relies on being added to the Covered List: Reuters reports that Intel has been granted an exception for the robots it uses in its semiconductor factories.

The "foreign-made advanced robotics" involved can't be sourced domestically, Intel has argued. With that in mind, the FCC has kept them off the Covered List to avoid "potential disruptions in the availability of domestic semiconductor manufacturing services".

As it stands, the waiver only lasts for a year though — Intel will then have to find some factory floor robots without foreign components inside, or apply to the FCC again to prevent its army of autonomous workers from being banned.

The 'Automated Guided Vehicles' in question have been in use for two decades, Intel says. The exemption doesn't apply to new models, but rather software, firmware, and hardware tweaks to the existing models already in operation.

• An AI tool called Raven can cross-reference fixtures, fittings, and other interior details to find the location of a property
• It pinpoints properties using data scraped from Airbnb and other sites
• Raven was previously known as GeoSpy and was initially conceived to identify locations based on landmarks

A new AI tool that can identify a property’s location using interior photos has been publicized online. Already in use by law enforcement agencies in Florida and California, Raven uses AI to match fixtures and fittings and decorative elements from photos with information sourced online.

Following the publication of a video demonstrating the software, Raven has attracted attention from some of the websites it apparently uses to acquire the information it uses. The sites – which include Airbnb – seem to have concerns about how the data and images they collect is being used.

Raven’s existence could potentially be used to find the location of any property – assuming that its address and similar images already exist online.

Innocent? Your home is safe

Raven has been used by the LAPD and the Miami-Dade Sheriff's Office in Florida. Its main purpose so far has been in tackling human trafficking, but the software represents obvious privacy challenges which its creators seem to be sidestepping at this stage.

The most important takeaway is that as long as your home (or business premises) hasn’t been used for criminal activities and photos of its interior aren’t online, then you have nothing to worry about.

Daniel Heinen of Raven developers Graylark described the product as “purpose-built AI for the people working to find answers and protect lives.”

However, some of the websites that Raven uses to gather information have expressed concern. The video of Raven in action appears to show the software using both Zillow, Vrbo, and Airbnb, with the latter reviewing the situation. Zillow stated scraping its data was against its ToS.

These issues could prove to be a challenge to the successful use of Raven across a wider area.

Matching interiors

Raven essentially breaches privacy by providing the location of an interior photo. Assuming a similar photo of the same interior exists online with an address attached – such as on Airbnb or a property site – then Raven should be able to identify it.

Heinen doesn’t mention the privacy challenges in his LinkedIn post about Raven, instead focusing on the software’s “ability to geolocate interior images across millions of short-term rental units worldwide.”

While highlighting the use of short-term rentals for human trafficking, the post focuses on Raven’s USP: “For investigators, a photo or video from inside a property may be a critical lead, but without an address or location tag, knowing where to start can be difficult. Raven helps investigators match interior imagery to potential properties, turning visual clues into location leads they can review and verify.”

It would seem likely that for Raven to be embraced successfully by other police departments in the US and beyond, it would need to accept regional privacy laws and build partnerships with the companies it appears to be scraping.

• A new report claims that Amazon is buying up more AI GPU racks than it can deploy in data centers
• An analyst links this report to Nvidia's GeForce GPU supply woes, theorizing that there's a connection
• The contention is that Nvidia is deliberately 'channel stuffing' or in other words, pushing an excess of AI GPUs to the detriment of gaming GPU chips

Nvidia's supply issues with its gaming GPUs are seemingly the result of a strategy to get AI giants to stock up on more graphics chips than they can handle, if fresh reports are to be believed.

You can't have failed to notice the stock issues around Nvidia's GeForce GPUs, and the spike in prices that has happened over the past few months, particularly for higher-end graphics cards.

Well, according to the musings of tech pundit and analyst Ed Zitron (via RespawnFirst) — who picked up on a report by Business Insider — the consumer GPU shortage is a direct result of Nvidia pushing AI graphics cards on the likes of Amazon.

Business Insider informs us that Amazon (or rather AWS) is buying more Nvidia GPUs than it can deploy. Apparently, racks of the AI graphics cards are being kept unused in holding warehouses until there's power available at the data centers where they'll be used (electricity capacity, not space, is the issue here).

Amazon is paying out huge sums for these GB300 racks from Nvidia, and according to an internal email that Business Insider got hold of, a new 'Early Rack Receipt' process (buying these GPUs upfront, before they're installed) saw some $5 billion worth of server racks paid for in August 2026. Seemingly $3 billion more are on order every month for the "foreseeable future" going by another email.

We're told one AWS team didn't have a "clear forecasted path" for getting the purchased racks installed — in other words, they're not even sure when these GPUs might be used.

Zitron's argument is based on a key phrase in the Business Insider report, where the author states that the reason for the switch in policy — Amazon only used to pay for racks when they were installed in a data center — is that "Amazon has to compete more for scarce resources as it jockeys with rivals for access to Nvidia GPUs and other AI components."

The conclusion Zitron draws is that this is basically indicating that Nvidia is making Amazon, and others buying up AI GPUs, compete with each other by agreeing to order a whole pile of them there and then — more than they possibly need — otherwise they won't get their allocation (presumably).

Analysis: GPU misery is clear enough to see

In short, these AI GPUs aren't actually needed as such — not by Amazon in this quantity, as per the Business Insider report — but Nvidia is effectively strong-arming the company into buying the chips, or as Zitron puts it, this is "deliberate channel stuffing." Meaning Nvidia is forcing this AI demand artificially to the seeming detriment of GeForce GPUs, with lesser chip supply for those gaming cards causing price inflation and general misery for gamers.

Obviously we need to take this with a good deal of caution — that goes for the initial report from Business Insider, and doubly so with the theorizing that Zitron applies on top of that article.

There's no denying, however, that we have witnessed a frustrating shortage of consumer GPUs, and in particular Nvidia's high-end gaming graphics cards have become painfully thin on the ground — and pricey. The RTX 5090 is either unobtainable, save through third-party marketplace sellers trying to gouge you out of the best part of 10 grand (in the US), or it's hideously expensive to the tune of over £6,000 in the UK, for example.

What's worse is the RTX 5080 is now getting ridiculously pricey too, reaching £1,400 in the UK. And in the US on Newegg, there's now only one model for sale (direct from the retailer) — and it'll set you back $2,000. It's all getting silly, frankly, and with rumors that the RTX 5090 is being discontinued doing the rounds — speculation Nvidia has denied, I should make clear — it's currently a disappointingly gloomy picture for GPUs.

The expectation is that matters are only going to get worse for RAM, SSDs, and GPUs, as next year rolls into town — and that makes all the above theorizing seem a bit more plausible. It's certainly clear that Nvidia's priority is AI GPUs rather than GeForce graphics cards because of the profits involved with AI, but of course, Team Green is a business — so what do we expect? Prioritization is one thing, though, and the levelled accusation of the practice of 'channel stuffing' is entirely another.

• Critical PHP2Shell flaws also impact internet-exposed NAS devices and PHP-based Docker workloads
• Major vendors are still releasing patches, leaving some Synology, QNAP, and other systems exposed
• Researchers urge immediate updates, removal of public exposure, and VPN-only remote access

Websites and web servers are apparently not the only products affected by the php2shell vulnerability - Network Attached Storage (NAS) devices are at risk, too - and to make matters worse, some of the most popular manufacturers have not yet released a patch, despite the flaws being actively abused in the wild.

Research by Apple Insider noted that the flaw also affects software maintained by NAS manufacturers, as well as applications running independently in Docker containers, with NAS devices that are reachable through the public internet also at risk.

What's particularly concerning is that some of the biggest NAS manufacturers have said to be working on a fix, but the work is yet to be done. Synology, for example, released a new security advisory saying PHP versions 7.3 - 8.4, Mail Station, and Synology Calendar are all affected and adding that it released updated PHP packages to address the flaws. Those running Synology NAS products should head over to the company’s Package Center and download archive and look for updated PHP 8.2 and PHP 8.4 packages.

Twofold risk

The company also stressed that there is a difference between installed PHP packages and PHP components within DiskStation manager, and added that its built-in PHP isn’t exposed to the public internet, therefore most likely not at risk.

Another major NAS manufacturer, QNAP, confirmed a wide range of affected products, including QTS 5.2.11 and older, QTS 6.1.9, QuTS hero and QuTScloud, and Note Station 3. It said it was currently working on a fix, but did not give a timeline on when the patch might become available. So far, there is no evidence of in-the-wild attacks, but the company does recommend removing the devices from the open internet, disabling unnecessary port forwarding, UPnP, and remote-access services.

Other manufacturers are also currently working on a fix, including TerraMaster, Ugreen, and Asustor, Apple Insider found. “NAS owners should check their manufacturer's security notices and available updates for their specific models,” the publication said.

For NAS owners, the risk is twofold, since PHP is found in both the operating system and Docker containers.

Those running PHP-based services in Docker should check if their container images are running affected versions of PHP, and update them as soon as humanly possible.

There is also the problem of running older devices that have reached end-of-life and are, as such, no longer supported with patches. These, security experts agree, should be removed from public access. Unsolicited inbound connections should be blocked, and the device should be kept accessible only locally. Remote access should be achieved through a secure VPN, instead of forwarding NAS management ports.

P2PShell?

PHP2Shell is a name for a pair of vulnerabilities - CVE-2026-109618 and CVE-2026-109619 - that were recently discovered in the PHP programming language. They are considered critical and allow malicious actors to take over websites, steal data, deploy malware, and more. However, the story that has so far revolved around internet sites and web apps is now expanding into NAS devices, too.

PHP2Shell is shaping up to be the biggest security incident of the year, and possibly longer, arguably rivaled only by the Spectre/Meltdown flaws from eight years ago.

The pair of vulnerabilities - both critical in severity and both allowing for remote code execution - affects the vast majority of websites and web apps in existence today.

Knowledge of the flaws leaked four days before the patches were released, according to Amazon, and the number of exploitation attempts went from a few hundred 10 hours before publication, to millions today.

However, most of these attempts seem to have been unsuccessful. Analysis is ongoing as to why that is the case, with some researchers thinking code execution needs to get past ASLR, which is a difficult thing to do remotely. However, breaking in only seems to be a matter of time, which is why the security community urges manufacturers to release a fix as soon as possible, and owners to apply them without delay.

• Evidence suggests PHP2Shell exploitation began days before public disclosure, indicating prior attacker knowledge
• Researchers say real-world attacks remain limited, though exploitation attempts rapidly surged after disclosure
• Millions of PHP systems remain exposed, with experts urging immediate patching of supported versions

The exploitation of php2shell began four days before the vulnerabilities were made public, Amazon has claimed, meaning someone knew well in advance about the bugs in the popular software.

The company has released its own analysis which shows that the attacks actually started several days earlier.

“Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619,” the company said in an advisory. “The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor, though it remains unclear how the actor acquired exploit information prior to disclosure.”

Attacks four days prior

On the day of the patch release, four days into the disaster, Amazon Threat Intelligence discovered multiple proof-of-concept (PoC) exploits, and since the payloads and choices in anonymization infrastructure varied, it was most likely the work of multiple threat actors. The company is currently analyzing the payloads to see if they would have been successful in the wild or not.

Together with a handful of partners, PHP Foundation was working on a fix for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed ‘php2shell’. Both have a severity score of 9.2/10, and both can be used for full website takeover. Given that PHP is a programming language used to write a significant majority of all websites in existence, the bugs were quite dangerous, and required carefully coordinated disclosure and patching.

The patch was supposed to be released on October 21, and those who were aware of it, were asked not to disclose the details until it was released. However, a few hours before that embargo were to be lifted, security outfit Chainguard allegedly published container images containing fixes for the flaws. At approximately the same time, news started breaking that cybercriminals were actively exploiting php2shell to target websites.

All hell broke loose - many major government, education, and healthcare websites around the world preventively shut down, while PHP Foundation issued an alert telling admins to prepare and apply the patch as soon as it becomes available.

What is ASLR and why is it important for p2pshell?

One of the reasons why we’re yet to see many successful exploitation attempts is apparently ASLR. Short for Address Space Layout Randomization, it is a security feature that randomly changes where a program’s code and data are stored in memory every time it runs. This is according to Yotam Perkal, Director of Security Research at Pluto Security.

“PHP2Shell doesn't seem trivial to exploit. I believe that part of the reason we’ve yet to see successful exploitation is that reliable code execution requires getting past ASLR, a memory protection that randomizes where code sits in memory,” Perkal said. “That's hard to do remotely, and most of the public PoCs floating around (many of them vibe coded) simply don't work reliably on real systems.”

“I wouldn't count on it staying that way, though. Exploits will get better, and most PHP servers out there are still unpatched, so teams should patch and restart their PHP workers now. But compared with all the drama before and after the release, real-world exploitation so far looks pretty limited.”

At the same time, Cloudflare has said the number of attacks launched in the hours after disclosure was staggering and growing at an unprecedented rate. Company CEO Matthew Prince said in a post on X that the team saw thousands of exploitation attempts in the 10 hours before the patch was announced. This grew to tens of thousands within an hour of disclosure, and hundreds of thousands within two hours. Now, it’s gone into the millions.

To make matters worse, different threat actors are approaching the flaws in different ways and are adapting on the go. According to Cloudflare, some threat actors were modifying their payloads based on feedback from blocked requests, all in order to find a way past web application firewalls (WAF).

Via The Register

• Capcom discloses breach affecting 11.7 million CAPCOM ID users, primarily exposing email addresses
• A small number of accounts also lost personal details, and attackers reset passwords on 196 accounts
• Company secured the platform, notified authorities, and warned users about phishing attempts

Japanese gaming behemoth Capcom just confirmed suffering a data breach that exposed sensitive information on more than 11.7 million people. Almost all had their emails compromised, with a small subset also losing birthdays and locations, as well as passwords changed.

Capcom is a super popular video game developer and publisher, behind mainstream names such as Resident Evil and Street Fighter. One of its services is called CAPCOM ID - it offers a free, unified account that lets users access various games and online services.

Currently, CAPCOM ID has more than 10 million users and the company recently published a new security advisory on its Japanese site, saying the service was accessed by a third party, “resulting in the leakage of some customer information to external parties”..

Changing passwords

“We deeply apologize for the great inconvenience and concern caused to our customers and all stakeholders,” the machine-translated warning reads.

Capcom said the breach triggered its security protocols, and that the CAPCOM ID service has been secured. It continues to be available for use, and there is no impact on gameplay in any of the games.

However, the analysis of the breach determined that the threat actors obtained 11,774,247 user email addresses, as well as system-specific identification information: account creation date and time, last login date and time, number of login counts, and client IP at last login

For a handful of users - 43 of them - the threat actors also obtained dates of birth, gender information, nicknames, and data on their country and region. For 196 people, the attackers managed to change their passwords, in an attempt to lock legitimate users out of their accounts. The passwords themselves weren’t leaked, and Capcom said it triggered the password reset process and that the accounts were restored to their rightful owners.

“We will contact eligible customers individually in order. Please note that credit card information is not included in the leak target,” the company concluded.

Capcom did not discuss the identity of the attackers, or the nature of the breach. Therefore, we don’t know if the attackers stole an employee’s login credentials via phishing, or broke in using a vulnerability such as the php2shell flaw that everyone is scrambling to patch right now. We also don’t know if the attackers tried to make contact or attempted to extort Capcom for money, in exchange for deleting the data.

No threat actors have yet claimed responsibility for the attack on the dark web and have not shared samples or leaked the full database. Capcom said it notified the police and other relevant authorities, and that the investigation continues.

Targeted again

Capcom has had cybersecurity incidents in the past. In November 2020, the company fell prey to the infamous Ragnar Locker ransomware group, which managed to walk away with a terabyte of sensitive data. A few months later, the company said the attackers broke in through an old VPN device, and confirmed the breach affected 390,000 people.

Capcom also builds and runs gaming machines and has, as of March 2026, employed almost 4,000 people worldwide. In fiscal 2025 its games sold 51.87 million units, and two titles - Resident Evil and Street Fighter - are currently making great strides in movie theaters around the world. For fiscal 2026, the company’s annual revenue reached $1.3 billion.

Just having someone’s email address is not enough for a serious cyberattack, but it is a good start towards a highly tailored phishing email which can result in ransomware infections, infostealers, or business email compromise (BEC). Capcom is now urging users to be vigilant and wary of incoming email messages, especially those containing references to the company.

Via BleepingComputer

• Scientists say they’ve dated Van Gogh’s The Starry Night
• Study says the painting was made on July 22, 1889
• The researchers used AI and CAD tools to help find an answer

The Starry Night by Vincent Van Gogh is one of the most famous paintings in the world, and it’s generally held that the artist finished the work in June 1889, shortly before a serious mental breakdown. But a new scientific study has attempted to see if technology can find the exact date that the masterpiece was made — and it’s come to a quite different conclusion to past experts.

Research published in the journal Scientific Reports argues that not only was the painting based on a real night sky rather than pulled from Van Gogh’s imagination, but that July 22, 1889 is the most likely candidate for the date of the composition. That flies in the face of the conventional wisdom, and not everyone is happy with that verdict.

The study’s authors reached that conclusion by first identifying the likely location where Van Gogh stood to paint the scene, concluding that he used a narrow field of view when selecting which stars to depict. Using CAD tools and historical astronomical data, they then compared the star positions in the painting to those on every night at that place in June and July 1889, with the dates of June 23, July 22 and July 23 being the strongest matches. Of those, July 22 stood out, with the moon, Venus and the Hyades star cluster all lining up closely with the artwork.

This was backed up with contemporaneous documentary records, such as letters Van Gogh sent to his friends and relatives that described conditions at the time. AI also played a role, with the report noting that the authors used the technology for “language editing, independent cross-checking of the numerical results, and assistance in preparing the deposited analysis code".

In the end, the study authors concluded that the best evidence pointed towards July 22. This “shifts the burden of proof,” they argued, with those contending that the artwork came from Van Gogh’s imagination now needing to explain why it matches an actual night sky from the time he was known to be active.

Doubts emerge

Not everyone agreed with the conclusions drawn by the study. The Van Gogh Museum in Amsterdam was quoted in The Guardian as reaffirming that the painting was made in June 1889 and that “Van Gogh was not concerned with exact likenesses. The positions of the celestial bodies depicted can therefore not form a reliable basis for dating the work.”

The Guardian also cited Donald Olson, professor emeritus of physics and astronomy at Texas State University, who said that “The authors’ assumed narrow field of view, essential for their theory that the stars of the Hyades fill most of the canvas, is inconsistent with the much wider field of view required to encompass Starry Night’s round hills and cliffs.”

I also can’t help feeling that, whether it’s on the money or not, this scientific study misses the point of paintings like Van Gogh’s Starry Night. The entire purpose of art is to make you feel something on an emotional level, and often the scientific accuracy is far less important than the emotive impact. Trying to pin down the exact date the painting was made risks missing the forest for the trees and ignoring the message that the artist was trying to convey.

Still, if you are interested in knowing exactly when Van Gogh might have set his paint on the canvas to make The Starry Night, the study is a fun attempt at drawing a conclusion that isn’t just based on educated guesswork. Hopefully you can still enjoy the painting on its own merits, whether or not you agree with the researchers’ conclusions.

• Windows 11 has an alternative take on Recall in testing
• It's an app called the 'Context Vault' offering a similar supercharged search experience
• In this case, though, you have to manually add content to the vault – there's no automatic regular screenshotting of the activity on your PC

Hate the idea of Recall in Windows 11? You wouldn't be alone, so Microsoft is trying a new spin on the idea of an AI-powered supercharged search which is a lot more limited than Recall – although the initial reaction has still been rather negative.

Windows Latest discovered that Microsoft is working on Project Pantheon, the current name of which is the 'Context Vault', and rather than being built into Windows 11 like Recall, this has to be installed from the Microsoft Store.

This isn't just an optional feature, then, it's an app you have to actively seek out, and it works quite differently to Recall in that it doesn't automatically take regular screenshots (snapshots) of the activity on your PC.

Instead, you must manually add the files or content you want to use with the Context Vault, so its AI powers can then make use of them.

To what end? Similar to Recall, you can ask the AI questions about the contents of the vault, or get it to organize material, planning the likes of a summer trip (the example Windows Latest gives) from documents, images, web pages, or even clipboard text saved to the vault.

Note that the app isn't yet officially available, and not listed in the Microsoft Store as such, but Windows Latest managed to find it nonetheless.

Context Vault doesn't necessarily need a Copilot+ PC – or a powerful local NPU, in other words, as it can leverage cloud-based AI – and you can give third-party AI like Claude access to the content in your vault, too, we're told. There's even a panel that tracks your AI token usage in the current build of the vault.

Bear in mind that this is still an early version of the feature, and it sounds pretty wonky right now. It's not clear if this app is something Microsoft will definitely carry forward to a release version for Windows 11, as ever with functionality in testing.

Analysis: is a retake on Recall going to fly?

On the one hand, the full user control over what content Context Vault can access compared to Recall could be a big selling point. On the other hand, using the cloud for running the AI processes is obviously more of a privacy concern (although you don't have to go that route to be fair).

Windows Latest has been led to believe that Microsoft is considering other ways to make the Context Vault more secure, including encryption and per-app access controls, as well as requiring a Windows Hello login for access (as Recall does) to protect the vault from possible local attackers jumping on your device.

As noted at the outset, the reaction to this idea in testing is generally skeptical, and many folks simply see it as 'yet more AI' that Microsoft is cramming into Windows 11 (although it isn't actually confirmed this is coming to the OS, of course).

As one Redditor puts it, this is a classic case of "solving [a] problem [that] doesn't exist."

Another agrees: "Yeah, Microsoft can't even be creative in thinking up something even marginally useful in an extremely far fetched scenario. Literally never in my life felt the need or wanted a tool like Recall or this equally s****y version of it. This problem was solved circa 2000 with bookmarks and Word/Excel documents. Not whatever convoluted trash this is."

In fairness, others are more positive, and there are Recall users out there. One commenter on the same thread says: "I use Recall all the time, it has been a gamechanger for me, I just wish it synced between my devices so I could look up something on my desktop I saw on my tablet."

The one thing that seems clear enough is that the anti-Recall folks aren't going to be swayed by a different take on the same concept, even one that sports a pretty radical change.

The kind of people this might persuade are those who most likely won't be drawn to comment on this idea in testing one way or another. I think it's certainly an alternative that's worth trying for Microsoft, provided it's implemented in a secure enough manner, of course.

• Microsoft collaborated with the Japanese National Police Agency to tackle Chinese-language cybercrime “app stores”
• The YAM Store, CoGUI, and Iron Man have targeted people in more than 150 countries
• Microsoft is working with law enforcement agencies worldwide to take down illegal operations that target businesses and individuals

Microsoft has announced a successful operation with the Japanese National Police Agency in which a collection of cybercrime app stores were disrupted. Investigating fraudulent, scam messages targeting Japanese businesses and citizens, the operation uncovered a multi-faceted criminal marketplace, with three key elements.

The YAM Store, CoGUI, and Iron Man had targeted 75,000 organizations across more than 150 countries worldwide, sent over one billion malicious communications promoting scams, and generated millions of dollars for the criminals behind them. Furthermore, 750 million messages were aimed at Microsoft’s own customers.

Alongside the Japanese authorities, Cloudflare, Oracle, Proofpoint, Resecurity, and TRM Labs were also involved in the operation.

Impersonation templates

Exploring the cybercrime ecosystem targeting Japanese businesses, investigators found the trio of the YAM Store, CoGUI, and Iron Man. Investigators found these provided a route into a cybercrime ecosystem for cybercriminals.

The environment was providing criminals with pre-fabricated fake websites and messages, designed to be used to fool targets into thinking they were interacting with the genuine article. Amazon was among the faked sites, on sale so scammers could simply host convincing pages to steal login and payment credentials, without any need to hire their own coder. Other spoofs on sale included government agencies, financial institutions, and other well-known companies.

Security filtering software was initially unable to handle the CoGUI phishing-as-a-service (Phaas) framework as it employed some sophisticated methods to avoid detection, including browser fingerprinting and geofencing.

What is interesting to note is the role these facilities played for the distribution of cybercrime assets. CoGUI was apparently targeting Japan and US victims, but during the course of the investigation, was replaced by a new service, Iron Man.

The YAM Store

While all three components were already known to Microsoft and the authorities, it took a concerted effort to infiltrate the network of cybercriminals using the services. They were hosted in a wholly Chinese-language environment, requiring native-speakers to be added to the investigating team, and gain access to the underground cybercrime marketplace known as the YAM Store.

Microsoft assigned a tracking number Storm-3119 to the marketplace, which it describes as an “Initial Access Broker.” It was set up to provide its customers with “compromised or fraudulently obtained environments in providers like Microsoft and Google.”

While it may be expected for compromised software to be on the radar of its publishers, the creator(s) of the YAM Store had a workaround. It was able to keep its inventory fresh by using automation. This identified “expired environment or organization names and leverages legitimate customer information associated with them to help circumvent existing detections.”

Microsoft has seized domains associated with the YAM/CoGUI/Iron Man infrastructure, and either blocked or redirected them.

• Anthropic used Claude to analyze 25 open source projects and uncovered nearly 500 security issues
• Research found exposed pre-authentication code paths, conflicting security settings, and long-hidden flaws
• AI identified attack-surface reductions that removed unnecessary code exposure before vulnerabilities could be exploited

Anthropic recently used Claude to analyze 25 major open source projects written in C, C++, Java, PHP, and Python, in search of security issues. It found almost 500 of them, including security controls turned off by conflicts in settings, sensitive code accessible before authentication, and even a vulnerability that sat in the code for 21 years.

This wasn’t a standard hunt for vulnerabilities. In its report, Anthropic argues that looking for individual vulnerabilities is a Sisyphean task that scales poorly and never guarantees security. Instead, it thinks defenders should turn towards reducing software attack surfaces by restricting unnecessary access to potentially exploitable code.

“A defender who reduces unnecessary attack surface in their code reduces the risk from all of the unknown vulnerabilities in that code at once—including any that are already being quietly exploited,” Anthropic said.

The 25 projects it scanned contained more than five million lines of code. Claude created an inventory of more than 17,000 configuration options, 3,842 of which related to security-relevant controls and features.

Misconfigured security controls

The company’s research focused on three ways code may get unnecessarily exposed: features accessible in the default configuration when they’re not needed, different settings which, when combined, erode security, and unnecessarily complex and sensitive code running before security checks.

The analysis showed all 11 projects, which were designed to serve authenticated users, contained code that was reachable when it shouldn’t have been. These include 93 pre-authentication attack surfaces in default configurations, 37 instances of code executing before authentication, and 61 combinations of different configurations that eroded pre-authentication controls.

In total, the 25 analyzed projects contained 162 configuration combinations that were accepted without their documentation explaining how they were supposed to behave. In some cases, security controls were being disabled. In others, there were various inconsistencies and problems.

One configuration flaw was sitting undetected for more than two decades, Anthropic found. While one setting made clients prove their identity through certificates, another one disabled it entirely (even though it was designed to delay the check, not kill it). Even though these were conflicting options, they were accepted without warning.

OpenSSH exposed thousands of lines of code

Anthropic singled out OpenSSH as its case study for the report. The software, widely used to provide secure remote access, contained a daemon that could reach 4,500 lines of experimental code that implements a post-quantum signature algorithm before checking if it was permitted by the server’s configuration to begin with.

As it turned out, the algorithm was disabled by default, but its parsing code was accessible to unauthenticated clients. Anthropic disclosed its findings to OpenSSH, who came back with a fix in version 10.6, in which some 20% of the code was now unreachable by unauthenticated clients.

The company said it combined these techniques into a reusable Claude skill which will soon be integrated into OSS-Scanner, its free, opt-in security scanning service for open-source projects. The skill will examine default configurations, code that is reachable before security checks, as well as settings configurations that are in conflict with one another.

Anthropic added that the system will validate the findings through a dynamic program tracing, and will test proposed changes against existing behavior. Potentially disruptive changes will be left for humans to review.

“It is perhaps impossible to measure how many unknown vulnerabilities are in any given codebase,” the researchers concluded. “And there is plenty of data that shows attackers can and will find those vulnerabilities with enough time (particularly if equipped with frontier AI models).” Therefore, AI could help developers systematically limit unnecessary exposure, making software that much harder to attack.

• Researchers found 22.7TB of exposed data from AI aggregator 302.ai, including chat logs and personal information
• Leaked records contained user prompts, AI responses, metadata, and sensitive corporate documents
• Incident highlights the risks of sharing confidential data with third-party AI platforms and services

Security experts who were screaming “don’t share sensitive data with public AI” from the rooftops have been properly vindicated by an AI aggregator called 302.ai.

Researchers from Cybernews claim this company leaked terabytes of sensitive user and corporate data, including personally identifiable information (PII), confidential business documents, and a lot more.

Every hacker's dream

An AI aggregator is a platform that brings together multiple AI models and tools in one place. Users then get to switch between them without having to visit each provider separately.

For example, an AI aggregator might let a user start with Chat-GPT and switch to Claude with a push of a button, all through a single interface and a single subscription or API.

Although there are different use cases for AI aggregators, the number one is being able to compare the responses quickly and easily.

302.ai was launched six years ago by a company called Univerads Technology Limited, based in Hong Kong.

Cybernews says it kept an unencrypted, non-password-protected, publicly available Azure storage bucket that contained 17.6 million files. The entire archive was 22.72TB heavy, most of which went on image files (almost 9TB). Video took up 7.7TB, while audio took up 5.6TB. The rest - around 500GB, were user chat logs.

Totaling more than 144,000, these logs were stored in .json files and exposed plenty of personal information, including user prompts, replies from the AI bot, which model was used, how much it cost in tokens, timestamps, and other metadata. Users also seem to have provided plenty of data themselves, including their names, birth dates, genders, postal addresses, and other contact information.

Some of the information leaked this way was quite embarrassing, too. “What we found was that some companies used the service for enterprise tasks. For example, we found multiple chat logs from a customer support chatbot owned by a prominent sex doll manufacturer,” the team wrote.

This kind of private, even intimate, data is a goldmine for cybercriminals. They can use it to create highly customized and personalized phishing emails, knowing exactly which company to impersonate, what kind of context to mention, and how to phrase the lure email, to get the victim to react. That reaction usually ends up in business email compromise, wire fraud, or ransomware infections.

Database gets locked down

Cybernews’ researchers reached out to Univerads Technology, but did not hear back. In the meantime, the company locked down the database and it is no longer leaking sensitive files.

However, key questions remain unanswered: Does Univerads maintain this database, or was the job outsourced to a third party? When did the company first start collecting this data? How long did the archive stay unprotected? Cybernews found it in early August 2026, and saw it locked down a month later. Did anyone else find it before the Cybernews team did? Are there any indications that the files were copied or viewed by a third party? Is there any evidence of misuse or data spilling into the dark web?

It is highly unlikely these questions will be answered. Given the company’s prompt response and the closure of the database, it’s safe to assume that there was no ill intention, and that the leak is purely unintentional.

Accidental data spills such as this one are, unfortunately, very common. Many organizations either don’t know, or simply forget, that it is their responsibility to secure the data they generate and store in the cloud. As a result, new reports of large leaks emerge almost every week, some of which affect entire populations of certain countries, such as Brazil.

• A major PHP vulnerability has affected scores of websites
• Many popular sites have gone offline or restricted their operations
• Government sites across Europe have also been affected

A major flaw found in the PHP coding language that powers an untold number of websites across the internet has seen scores of sites taken offline as they attempt to patch out the severe vulnerability.

If you’ve found your favorite website has been unavailable over the last few days, there’s a chance it’s related to this security incident.

Here, we’ve put together a list of as many affected websites as we can find, along with reasoning given by the sites where possible. You can also follow all the latest news in our PHP crisis liveblog.

Global sites

1. Wikimedia / Wikipedia

The Wikimedia Foundation said it had taken some services offline to patch the PHP security vulnerability.

The group runs popular websites like Wikipedia and said in a blog post that “You may see outages for our wikis as we work on this, and we have deliberately taken many of our supporting services offline until they can be safely patched.”

The organization said this includes services such as Toolforge and Cloud VPS, while a separate post said that Wikimedia Cloud Services and other tools were affected.

2. Internet Archive

The Internet Archive, which backs up pages across the internet, was offline on October 21. The organization posted on X to say that “Archive.org is currently offline. We are working to restore service now,” although this was not definitively linked to the PHP incident.

Internet Archive founder Brewster Kahle called his organizations operations staff “heroes” due to their actions in limiting the damage.

3. Orange Telecom

The telecommunications giant Orange has announced thats it's "temporarily" suspended access to several of its websites and apps that use PHP.

That move affects dozens of countries, mostly in Europe but also Africa and the Middle East. Orange called it a "precautionary" measure and that each country would communicate which sites have been affected locally.

That could cause a lot of confusion in some regions — for example, in France Orange has over 34 million customers. Orange said it "apologizes to impacted customers and users for any inconvenience caused".

Other popular sites

Many other high-traffic websites were affected or taken offline in response to the PHP crisis. That included several of the BBC news site’s pages, message board 4chan, school community site Pinboard, wiki hosting site Miraheze, and mapping tool OpenStreetMap all either went offline or restricted their operations.

Some major sites paused operations without mentioning PHP. That included the likes of Nintendo, productivity tool Asana, language-learning platform Duolingo, and games storefront GOG.

And several games also went offline, such as Pokémon Sleep, Umamusume: Pretty Derby, Granblue Fantasy, and Princess Connect! Re:Dive.

UK sites

A UK minister has revealed that 32 government services are currently offline due to the PHP security threat, while a spokesperson added: "Our work has begun with OpenAI and NCSC to fix vulnerabilities in government systems".

Meanwhile, the country’s Office for Budget Responsibility took to X on October 21 to announce that “Consistent with guidance from the National Cyber Security Centre (NCSC), we have taken our website offline in view of the critical security issues affecting PHP. We will continue to follow further guidance.” As of October 22, the Office’s website is back online.

The National Cyber Security Centre also warned organizations to identify where PHP was used across their systems and update to the latest version of the coding language as soon as possible. It added that “If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.”

Several local government websites also went offline in the UK, including those of Edinburgh Council, Oxfordshire County Council and Hillingdon Council.

Europe

A large number of European governmental and commercial websites have been taken offline while patches are rolled out for the PHP vulnerability. That includes those below:

• Belgium: The Foreign Ministry
• Czechia: The national government website
• Denmark: Municipal IT company Kombit
• Finland: Public government service websites
• France: Local government (prefecture) websites run by the Interior Ministry
• Germany: The federal IT service provider ITZBund
• Netherlands: The National Cyber Security Centre
• Netherlands: The Port of Rotterdam
• Netherlands: Government website Overheid.nl
• Netherlands: National football association KNVB
• Netherlands: The ‌websites of ⁠the five largest political parties
• Netherlands: The websites of many national hospitals

• PHP released fixes for two critical remote code execution flaws and urged immediate patching
• Security researchers and Cloudflare reported early exploitation attempts before patches became available
• Millions of internet-facing PHP installations may be at risk, especially unsupported legacy versions

PHP has released patches for two critical remote code execution (RCE) vulnerabilities and “strongly encouraged” all users to apply them as soon as possible, as hackers are starting to abuse the flaws in real-life attacks.

PHP issued a new security advisory saying it addressed CVE-2026-109618 and CVE-2026-109619 with a patch. The former is an out-of-memory handling bug, while the latter is a use-after-free memory error. Both were assigned a severity score of 9.2/10 (critical).

The vulnerabilities were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users can download the versions from PHP’s downloads pages, with Windows source and binaries being on the same page. Linux distributions and LTS vendors received the patches in advance, it was said, so users should check with their vendors for updated packages.

Shaking the internet’s foundations

PHP is among the most popular programming languages for websites and web applications in the world, so when remote code execution zero-days are found, it’s a big deal.

PHP was supposed to work on a solution in silence, not to give cybercriminals a head start on exploitation. However, information about the vulnerabilities leaked on the internet two days in advance, causing serious panic, and according to Reuters multiple government, healthcare, and education websites across Europe decided to temporarily shut down to prevent being targeted.

Different sources made different claims. For example, Florian Roth, Head of Research at Nextron Systems, said both flaws would be given a 10/10 severity score, which did not happen. He also said only PHP 8 would be patched, which turned out to be true, despite other sources claiming PHP down to version 5 being fixed.

This, too, is a huge deal, since it’s safe to say that millions of websites are running older, end-of-life PHP versions, and could now be targeted with relative ease. Citing VirusTotal, BleepingComputer said more than 5.1 million PHP hosts are currently exposed online, with some 3.8 million having at least one port open.

According to PHP, “all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed,” are at risk.“We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”

Unsupported versions

PHP 8.1 and older will not be fixed, so if you’re running any of those versions, you’re in danger. Cloudflare’s CTO, Dane Knecht, said the company is “seeing early attacks emerging” and is updating mitigations as new vectors show up. This was a few hours before PHP released the fixes. “Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to help people building from source or without access to an LTS vendor,” PHP added.

The safest play here is to update PHP. For those that cannot do that immediately, PHP recommends a few mitigations, but stresses that these are not a complete solution. For the out-of-memory flaw, the maintainers recommend setting memory limits appropriately, and restricting the size of incoming requests, including file uploads, to reduce the risk of memory-related attacks. Admins can use container limits to prevent a vulnerable worker from affecting the wider system, it was said.

For the use-after-free one, PHP says admins can disable session upload progress tracking and turn on fatal-error backtraces (on PHP 8.5). They should also fix application errors that could trigger crashes or timeouts and avoid outdated settings that generate error messages before the app is fully initialized.

Via BleepingComputer

• PHP discloses two critical remote code execution vulnerabilities that could enable website takeover and data theft
• Details leaked before patch release, prompting an early security advisory and urgent upgrade warning
• Researchers confirmed the flaws are real, with widespread impact expected across multiple PHP versions

PHP, arguably the most popular programming language for websites and web applications in the world, contains two critical-level vulnerabilities that could expose countless sites to remote code execution (RCE) attacks, the provider has revealed.

The flaws could lead to website takeovers, data theft, malicious redirects, and a whole swathe of similarly sinister situations.

Security rush hour

PHP published a new security advisory, giving admins a “heads up” on an incoming patch.

“The PHP security team would like to give advance notice of an upcoming security release,” the advisory reads.

“It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.Full details, affected versions, and the fixed versions will be published with the release.”

If you’re thinking the announcement is rather unorthodox and that PHP might as well just released the patch - you’re absolutely right. The problem is that someone spilled the beans on the vulnerabilities before the official embargo was lifted, having the cybersecurity community scrambling for answers.

That ‘someone’ is a person with an alias ‘petecooper’, who published a new post on Y Combinator’s Hacker News forum earlier this week. In the post, they claimed PHP would disclose two remote code execution bugs on October 22 2026.

The post has since been deleted so we couldn’t independently verify it, but BleepingComputer says the post claimed the bugs carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5.

The post also labeled the bugs as CVE-2026-109618 and CVE-2026-109619, which was subsequently confirmed. Therefore, the only thing that’s wrong is the CVSS score which seems to be 9.2, not 10.0.

Among the people who knew about the flaw and the upcoming patch were watchTowr, and Florian Roth, Head of Research at Nextron Systems.

The embargo on the news was set for October 20, with the patch due a day later, on October 21. However, yesterday Roth posted on X, saying “Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.”

Leaking the zero-days

This forced PHP’s hand, not just to release the advisory, but also to send a notice to its ANNOUNCE mailing list, according to BleepingComputer.

Security researchers watchTowr confirmed the news, saying the bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and that the duo is being nicknamed “php2shell” by the community. Obviously, technical details are being withheld to protect users, but most likely affect PHP versions 5, 6, 7, and 8.

"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," watchTowr CEO Benjamin Harris told BleepingComputer.

"While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8."

The researchers also told the publication they managed to successfully reproduce CVE-2026-109618, confirming the flaws actually work. Good news is, there are still no confirmed reports of the flaws being used as zero-days in the wild.

• Windows 11 is cutting some Copilot features on the right-click menu
• At the same time, a Microsoft exec said that "AI has already helped our design team accelerate significantly"
• The exec added that "we're even seeing designers contribute directly to code fixes" and this has caused quite a stir online with anti-AI pushback

Windows 11 is getting tweaked to cut back on Copilot functionality, while at the same time, a Microsoft exec has admitted that the operating system's design team are using AI to help them – which has provoked something of a reaction, as you might expect.

First up, the move to cut back on AI, which as Windows Latest reports consists of stripping out some Copilot options from Windows 11's context menu, the one which pops up when you right-click on a file or folder.

In a post on the Microsoft 365 Message Center, the company explained: "We're retiring the OneDrive Copilot Summarize, Create FAQ, Compare Files, Ask a question, Explain image, Explain images, Compare images, Extract text actions from the File Explorer context menu."

These are Copilot actions which are tied to OneDrive, then, that folks who don't use Microsoft's cloud storage wouldn't have seen anyway.

You can still reach these options using the 'Ask Copilot' icon in the right-click menu, so overall, this is a streamlining change for the better (albeit one that some users won't even realize has happened).

It's not being implemented right away, but from mid-November, and by the end of the year, these options will have disappeared from Windows 11's context menu.

Now for the more controversial development that Windows Latest also noticed, namely a comment from a Microsoft executive on X. Diego Baca, who is VP of Design for Windows, posted in reply to a comment pushing for "Windows design unification" (better consistency) and using AI to help to that end.

Baca observed: "On AI agents, 100% agree. I'm not the best person to speak to the engineering side, but AI has already helped our design team accelerate significantly. We're even seeing designers contribute directly to code fixes that improve craft, consistency, and quality. That's exciting progress, and we're only getting started."

The key part of this that's getting picked up on social media is the admission that AI is being used by the Windows 11 design team to ensure tasks are completed more swiftly, and that it's helping designers to contribute code fixes. As you might guess, there are some unhappy people out there due to this admission.

Analysis: a chorus of noticing

As noted, the reaction on Reddit has been predictably full of barbs and withering fire at Microsoft. This upvoted post complains: "We noticed [the use of AI in coding], the rapid decline in quality, every patch bricking at least some devices, major releases bricking entire fleets, and the introduction of major security vulnerabilities that are easily exploitable makes it clear the codebase is being vibecoded with insufficient code review and testing."

In fact, there's quite a chorusing of "we noticed" or "we know" regarding Microsoft turning to AI in coding, as well as the inevitable "slop" accusations, including the likes of: "And this is how Linux goes mainstream, not because it becomes better, but because Microslop becomes unusable thanks to AI integrations." (I should note that as you may have seen, Linux has its own controversies with AI, but that's a whole other story).

At any rate, I think we need to dig down a bit into the meaning of Baca's statement here. When the exec says, "AI has already helped our design team accelerate significantly," it's a pretty broad statement – perhaps referring to assistance on the design brainstorming front more than coding.

Yes, designers may "contribute directly to code fixes" now with the help of AI, but how often is that really happening? I'm guessing not that much, and that this work is more about simple interface tweaks and polish than anything, and this code will be passed to software engineers to be fully checked and reviewed – the main hope being it saves a bit of time. There's a lot of the Windows interface to fix, after all.

I think the hostility here is a bit unfair given that Baca is just trying to be honest about what Microsoft is doing, and I don't think the reality is that Windows 11's interface is suddenly being vibe-coded (by AI) to any great extent. What's happening is that Windows 11 users are jumping on this and venting because they're fed up of too many bugs, and that has nothing to do with the design team.

For me, this is about Microsoft's broader failure with Windows 11 bug testing and flaky updates, which isn't something you can lay at the door of AI as such. Rather, this is about the overall QA (quality assurance) processes which aren't picking up these problems and sorting them out before release (whether any given bug was introduced by AI, or not).

This is what's really the root cause of the outbursts on social media here, and the comments about patches going wrong and general unreliability. And this is what Microsoft really needs to fix, and fast – it remains the biggest problem with Windows 11 that needs addressing.

• State Bank of India is investigating a suspected dark web data leak affecting thousands of customer records
• Exposed information reportedly includes personal details, loan-related data, and customer identifiers
• Bank has launched a forensic investigation but has not yet confirmed the source or authenticity of the leak

The State Bank of India (SBI) has confirmed losing sensitive data on thousands of its users, and worryingly said that it doesn’t yet know when or where the leak took place.

SBI is India’s largest public-sector bank, and one of the country’s biggest financial institutions. Its majority owner is the Indian government, and it provides services such as personal and business banking, loans, credit cards, and similar.

The company has filed a new report with the country’s stock exchange, saying it experienced “an incident involving the loss of certain data.” In the filing, it said that in mid-October 2026 it was contacted by its Threat Intelligence Service Provider, the Defence Cyber Agency, and CERT-In, in response to an alert regarding data leaking into the dark web.

Leaking PII

375,000 records were apparently made available on the dark web, among which were 3,897 bank customer records containing Personally Identifiable Information (PII).

“The exposed information reportedly included customers’ registered mobile numbers, dates of birth, names, gender, email addresses, residential addresses, branch and CIF identifiers, lead IDs, and metadata associated with loan/lead records and other related files,” the filing says.

So far, the bank does not know if the leak is authentic, who leaked it, or how they obtained the data. It kicked off a detailed investigation to determine the source and extent of the exposure, and assess any associated risks. Cyber incident response and containment protocols were triggered, and an independent CERT-In-empanelled cybersecurity agency was brought in for forensic analysis.

The bank stressed that the leak does not have a material impact on its business operations, and that it expects to continue functioning as usual.

In the meantime, an X account called CyberPulse56 flagged a dark web forum post, made on October 16 2026 by a threat actor called Siriusim. In the post, the actor claimed to have 375,000 CSV rows and 2,722 PDF documents belonging to the bank. They allegedly contained personal customer information, loan applications and supporting documents, account-opening applications, and address and other application-related details.

The Free Press Journal later established that the post was made on BreachForums, one of the most popular dark web cybercrime forums, and concluded that at least some of the data found there was authentic. It found that a WhatsApp profile picture associated with one number matched the passport-size photograph on that person’s KYC document, and it also found that the shared sample was primarily related to loans and contained KYC fields.

No clear connection to SBI

However, there was no information connecting the data to SBI, any of its subsidiaries, or third-party providers in its supply chain. Therefore, we cannot conclude if SBI was actually breached or not. There are a number of ways this data might have wound up on the dark web - it could originate from an older breach, it could be from an entirely different entity, or it could be a recycling of multiple older breaches - something cybercriminals are known for doing.

However, if the data is confirmed authentic, it could be a major risk for the bank’s customers. Information such as postal addresses, CIF identifiers, and loan records, can be used to create highly convincing phishing emails, through which the victims could end up downloading malware, or sharing vital login credentials with the attackers.

This type of stage-two compromise can then lead to ransomware or BEC attacks, which could cause severe disruptions, trigger class-action lawsuits, and result in brand erosion. SBI users should be wary of incoming email messages, especially those claiming to be from the bank, carrying a sense of urgency, or threatening account closure or funds displacement.

Via The Hacker News

• Cybercriminals use antidetect browsers to disguise devices, hijack accounts, and evade fraud detection systems
• Stolen session cookies, fake identities, and AI automation help scale scams and account abuse
• Researchers warn AI-integrated antidetect tools are lowering barriers for large-scale fraud operations

Cybercriminals have started using antidetect browsers as part of their tech stack, helping them evade detection while deploying session cookies, creating thousands of fake accounts, and passing Know Your Customer (KYC) checks. This is according to a new in-depth report published by security experts Check Point Research (CPR), in which it says that Russian, Iranian, and Chinese hackers are spearheading these activities.

What are antidetect browsers?

When users log into services like Facebook or TikTok using regular browsers, they leave behind digital fingerprints - screen resolution, operating system, fonts. This information can be used to identify and track a device across online sessions, and if a single entity (for example, a digital marketing agency) tries logging into multiple accounts from the same browser, it might trigger a security alert (or simply go against certain terms of service).

Hence the need for antidetect browsers - specialized software whose key feature is the ability to create isolated profiles with different digital fingerprints, making multiple accounts appear to originate from separate devices.

They are generally used to manage social media accounts, advertising, and e-commerce accounts, or to run web scraping operations or test websites across environments.

Antidetect browsers are not malicious by design, and are mostly used by digital marketing agencies and affiliate marketers. However, just as many other good things, these browsers are actively used by cybercriminals to exploit the tech and run fraudulent accounts.

Many competing tools are available today, but a handful stand out - Kameleo, AdsPower, Multilogin, GoLogin, and Dolphin Anty.

According to CPR, underground forums are full of discussions on using antidetect browsers for different fraudulent activities. These mostly originate from Chinese, Iranian, or Russian hackers, and generally revolve around Kameleo, AdsPower, and Multilogin.

“We selected these specifically on the basis of documented references across underground forums and criminal marketplaces, indicating active adoption beyond their stated commercial purposes,” CPR explained.

Analyzing these discussions, CPR discovered that the threat actors primarily use antidetect browsers to leverage stolen session cookies. When they steal a cookie, they can inject it into a clean browser profile to assume control of the account and operate it unabated. Banking accounts and cryptocurrency wallets are the most popular targets.

AI seasoning

Besides banks and crypto wallets, threat actors are also using these browsers to test payment credentials across e-commerce platforms without triggering any alarms. They’re also using them to apply for loans under fabricated identities, and to create fake accounts in bulk, which are then used to generate advertising revenue at scale.

At the same time, Artificial Intelligence is making these operations easier to scale, CPR says. AdsPower, for example, offers integration with Large Language Models (LLM) through a Model Context Protocol (MCP) server, allowing AI-powered workflows to connect with browser profiles. Through automation marketplaces, it also offers different templates for things like commenting, liking, or sending messages across multiple accounts.

A combination of antidetect browsers, AI account management, and AI generated content creates a powerful concoction that allows threat actors to run large, coordinated campaigns with minimal involvement. This allows them to build and “warm up” fake accounts over time, which then appear more credible and are easier to use in scam and fraud attacks.

“The antidetect browser ecosystem represents a sophisticated, commercially mature, and increasingly AI-driven infrastructure that has fundamentally lowered the barrier to running scam and fraud operations, as well as coordinated inauthentic operations at scale,” CPR warns. “These commercially maintained tools are available in dozens of languages, backed by customer support teams, tested daily against the world’s largest social media platforms, and are now integrated with LLM pipelines that remove the human operator from the execution layer.”

The researchers advise security teams to look beyond account behavior and focus on the infrastructure, including residential proxies, browser fingerprint inconsistencies, and unusual session-cookie patterns. Social media platforms should start analyzing antidetect browsers to better understand how they bypass their detection mechanisms, while companies should review whether their security systems can detect account takeovers involving session cookies.

• Nvidia's RTX 6060 may not arrive until 2029 a leaker claims
• They note that when there are supply issues (the current RAM shortage), Nvidia tends to drag out the release of lower-end GPUs
• They also believe it's unlikely the RTX 6060 will match the PS6 for frame rates

Nvidia's budget GPU for its next-gen range may not be released for three years yet, if a new rumor about the RTX 6060 turns out to be correct.

Wccftech spotted a post from leaker Kepler on the NeoGAF forums, who chipped in with speculation on Nvidia's graphics cards in a thread about the cost of the PlayStation 6.

Kepler was responding to a comment observing that the PS6 is going to go up against the RTX 6060 when it launches in terms of comparisons to PC gaming, and the leaker said — add seasoning with this as ever — that the "6060 will launch much later (and based on recent trends I doubt it will match PS6)".

In a further post, the leaker added: "When there's a supply shortage Nvidia tends to really drag the release of lower end cards. There's a good chance RTX 6060 comes out in 2029."

This would mean we're looking at an early-to-mid 2028 launch for the RTX 6090, 6080 and 6070, which lines up with more recent rumors. Of course, that's not a foregone conclusion, and Kepler is clearly speculating here.

Recent reports from analysts indicate that the PS6 will likely launch in 2028, though some have argued that Sony's next-gen console could appear late in 2027 (alongside other devices, perhaps).

Analysis: late, as well as short on performance?

Of course, what Kepler contends here is what Nvidia is supposedly planning right now, and just as with the PS6, a lot of the direction that Team Green goes in with its next-gen GPUs will depend on the memory crisis. Graphics cards do, of course, use video RAM (VRAM), and the next generation of GeForce products will be expected to up the ante on that score. (Gamers are already unhappy with Nvidia's current-gen VRAM configurations).

The problem is that there's no shortage of predictions that RAM cost inflation is going to get even worse in 2027, after it has already spiked in a big way through the middle of this year. The theorizing then runs that 2028 is also going to be a difficult year, which lends weight to the argument that the RTX 6060 will indeed be late to the GPU party.

In short, I wouldn't rule out the possibility of a 2029 arrival for the RTX 6060 as suggested, which obviously isn't great news for those hoping to score a more wallet-friendly next-gen Nvidia GPU.

It's also interesting to note that Kepler believes the RTX 6060 won't be as powerful as the PS6 for gaming frame rates, but I'd take that claim with even more salt than the rumors around timing.

Gauging hardware capabilities at this stage is obviously a trickier task, but Kepler's assertion isn't an impossibility of course. Note that the current RTX 5060 matches the PS5 Pro's gaming performance (roughly, for rasterization as opposed to ray tracing), so if the RTX 6060 couldn't equal the PS6, that would be a clear disappointment for PC gamers on a budget (particularly if the VRAM loadout again turns out lean).