Security on IT News

A ChatGPT Prompt Injection Trick Let Researchers Leak Internal File Paths

Tue, 07 Jul 2026 00:00:00 +0800

There’s a quiet tension in how chatbots handle the files you upload. You can ask ChatGPT to summarize a PDF, edit a spreadsheet, or analyze an image, but you can’t download the original file back. That’s by design. But a security researcher figured out how to bypass that restriction, and the trick reveals more than just a missing download button.

How Attackers Turned Microsoft's Own Login Pages Into Phishing Bait

Tue, 07 Jul 2026 00:00:00 +0800

There’s a kind of phishing that’s nearly impossible to spot at first glance — because you’re logging into the real website. Kaspersky researchers have documented a campaign that weaponized Microsoft’s own identity platform, tricking victims into completing a legitimate OAuth authentication flow on microsoft.com while attackers pocketed the access tokens behind the scenes.

A security team found a way to break out of Claude Desktop's sandbox — and get root on its VM

Mon, 06 Jul 2026 22:35:00 +0800

A security research team called Armadin has found a way to punch through the sandbox isolation in Anthropic’s Claude Desktop app for Windows. The flaw lets an attacker gain root access inside the Ubuntu virtual machine that powers Claude Cowork — and then send data past the network boundaries Anthropic put in place.

'Bad Epoll' Linux Vulnerability Gives Attackers Root Access — Android Phones Are Affected Too

Sun, 05 Jul 2026 00:00:00 +0800

Jaeyoung Chung, a security researcher at Seoul National University, found something worrying in the Linux kernel earlier this year. The vulnerability, now tracked as CVE-2026-46242 and nicknamed “Bad Epoll,” lives in the epoll subsystem, a core piece of the Linux kernel that handles how applications respond to I/O events. It earned a CVSS score of 7.8, putting it in the high-severity bucket, and its reach extends well beyond desktop Linux.

Linux Had 2,308 CVEs in the First Half of 2026 — More Than Any Other Platform

Sat, 04 Jul 2026 00:00:00 +0800

Greg Kroah-Hartman, one of Linux’s most active maintainers, posted the first-half 2026 vulnerability stats on his social feed Thursday. The numbers are striking — and they tell a story that goes well beyond which vendor had the worst quarter.

Anthropic's Claude Code Was Secretly Fingerprinting Users in China

Wed, 01 Jul 2026 00:00:00 +0800

A Reddit user pulled apart Claude Code version 2.1.196 and found something that wasn’t in the release notes: a detection system that checks whether you’re in China.

The tool, which has been running since April 2, inspects the system timezone for Asia/Shanghai or Asia/Urumqi, then cross-references URLs against a list of 147 domains. That list includes major Chinese tech companies (Baidu, Alibaba, ByteDance) and AI labs like Moonshot AI, MiniMax, and Stepfun, plus a long tail of Claude API relay services.

Apple's iOS 26.5.2 Patches Critical Kernel Bug Found by Baidu Security Team

Tue, 30 Jun 2026 00:00:00 +0800

Apple dropped iOS and iPadOS 26.5.2 on Tuesday, a security-focused update that patches nearly 30 vulnerabilities — including a kernel-level bug that could let attackers corrupt memory and crash devices.

The update (build 23F84) arrives 28 days after the last point release. Apple’s release notes are characteristically terse: “This update provides security fixes for your iPhone.” The full disclosure tells a bigger story.

Hackers are using OpenAI's own invitation system to phish employees

Tue, 30 Jun 2026 00:00:00 +0800

There’s a new phishing technique making the rounds, and this one is hard to spot because the emails come from OpenAI itself.

Security firm Push Security revealed Monday that hackers created a fake “Push Security Inc” organization on OpenAI’s platform and used the company’s own notification system to send invitation emails to Push Security employees. The emails arrive from noreply@tm.openai.com — a legitimate OpenAI address that passes standard email authentication checks.

New 'DirtyClone' Linux Vulnerability Lets Attackers Gain Root Access — CVSS 8.8

Sat, 27 Jun 2026 00:00:00 +0800

Another week, another Linux kernel bug with roots in how the system handles memory. This time it’s DirtyClone, tracked as CVE-2026-43503 and carrying a CVSS score of 8.8 — high severity, local privilege escalation, and potentially worse.

Microsoft's 2011 Secure Boot Certificates Begin Expiring — What It Means for Windows Users

Wed, 24 Jun 2026 18:00:00 +0800

Microsoft’s three core certificates underpinning the Windows Secure Boot mechanism are entering their expiration phase, with the first certificate reaching end-of-life on June 24, 2026. These certificates, issued in 2011, have served as the trust anchors for verifying the digital signatures of every firmware and software component during the PC boot process. The transition requires migrating the trust chain in system firmware from the 2011-era certificates to a new set issued in 2023.

LastPass Discloses Third-Party Supply Chain Attack Exposing Customer Data

Wed, 24 Jun 2026 05:24:00 +0800

Password management giant LastPass has disclosed yet another security incident, this time stemming from a supply chain attack that leveraged a compromised third-party integration to gain access to sensitive customer data.

Critical FFmpeg Vulnerability Lets Attackers Hijack Systems via Malicious Video Files

Tue, 23 Jun 2026 20:48:00 +0800

A critical security vulnerability has been discovered in FFmpeg, the world’s most widely deployed open-source multimedia framework, that allows attackers to hijack systems simply by getting them to process a maliciously crafted video file. The vulnerability, tracked as CVE-2026-8461 with a CVSS severity score of 8.8 out of 10, has already been patched in an emergency release.

Ubuntu 26.04 LTS Livepatch Brings Zero-Downtime Kernel Patching to Arm64

Tue, 23 Jun 2026 15:28:00 +0800

Canonical announced today that its Canonical Livepatch zero-downtime kernel hot-patching technology now supports the Arm64 architecture. For the first time, Ubuntu systems running on Arm64 processors can apply critical kernel security updates without interrupting services or requiring a reboot — a significant milestone for the rapidly expanding Arm server and edge computing ecosystem.