Malicious sites use JavaScript to build malware in browser memory

A massive malvertising campaign is using fake Solana, Luno, and TradingView webpages with malicious JavaScript that instructs ...
InfoQ

Ink & Switch Introduces Bijou64: Canonical Variable-Length Integer Encoding for Safe Parsing

Ink & Switch published bijou64, a variable-length integer encoding where every number has exactly one byte representation, closing the canonicality bug class behind attacks on PKCS#1, JWT libraries, ...
Hackaday

Dress Up Your YubiKey With This Web-Based Tool

The combination of hardware required to make use of this project is specific enough that we imagine only a relatively limited ...
HackerNoon

Hidden Infrastructure Exposed: ANY.RUN Reveals Hijacked Gov Websites Delivering Malware

ANY.RUN reveals how PhantomEnigma abused compromised Brazilian government infrastructure, uncovered a new backdoor generation ...
BeInCrypto

Why Isn’t Vitalik Pumping ETH? His Vibe-Coded Billboard Asks Too

Vitalik Buterin builds an anonymous billboard demo with zero-knowledge proofs, joking he skips easier ways to promote ETH.
Hackaday

Calculator UI Is More Complex Than You Might Think

Calculators are so ubiquitous and so familiar that they are easy to take for granted in many different ways. [lcamtuf] points ...

Now, even Russia’s most elite hackers are using Clickfix to infect devices

One of the Russian government’s most elite hacking groups has adopted an attack, known as Clickfix, to compromise devices belonging to sensitive organizations in Ukraine, the latter country’s CERT ...
VentureBeat

Anthropic brings Claude Cowork to mobile and web as usage data shows most users aren’t coding

Anthropic on Tuesday launched Claude Cowork on mobile and web, expanding a tool that has quietly become the company's bridge between the developer-centric world of AI coding agents and the far larger ...
Reuters

Alibaba to ban employees from using Anthropic's coding tool, source says

Anthropic's Claude Code has tool that can help identify China-linked users Anthropic has accused Alibaba of illicitly extracting its AI model capabilities U.S. and China locked in frantic race to ...
Bleeping Computer

Clean GitHub repo tricks AI coding agents into running malware

An agentic coding tool tasked with cloning and setting up a seemingly benign GitHub repository could execute a malicious payload that remains invisible to security scanners, AI agents, and human ...
scmp.com

China’s Zhipu AI sparks new ‘DeepSeek moment’ with cost-effective coding model

Nearly a year and a half after China’s DeepSeek shook Silicon Valley with its powerful yet affordable artificial intelligence model, Beijing-based Zhipu AI has delivered another jolt to the US tech ...
IEEE

Toward Automatic Heap Exploit Generation by Using Heap Layout Constraints on Binary Programs

Abstract: Automatic exploit generation (AEG) is widely recognized as one of the most effective methods for assessing the risk level of vulnerabilities. To exploit heap-related vulnerabilities, it is ...