Crooked Bough News Round-up

— Inaudible sounds used to fingerprint browsers catch AliExpress red-handed

 

at 8/24/26 1:19pm

Is the technique outdated? Yes. Is it still creepy? Also yes.

[Category: Biz & IT, Security, AliExpress, browser fingerprinting, chromium, firefox, Safari]

— Waymo doubles spending on lobbying in robotaxi battle with Uber

 

at 8/21/26 7:11am

Alphabet-owned company is seeking to persuade US regulators to clear a path for fully autonomous taxi services.

[Category: Biz & IT, Cars, robotaxi, syndication, Uber, waymo]

— Grok exfiltrates user data when malicious instructions are encrypted

 

at 8/20/26 7:00am

Cryptographic Context Injection is only the latest way to break an LLM safety guardrail.

[Category: AI, Biz & IT, Security, cryptography, LLM security, prompt injections]

— Microsoft Copilot reveals secret input that allowed it to be hacked

 

at 8/18/26 7:00am

Secret parameter allowed hackers to steal passwords when a target clicked on a link.

[Category: AI, Biz & IT, Security, copilot, exploits, guardrails, microsoft]

— Nvidia discloses $21B stake in SpaceX

 

at 8/17/26 8:22am

Filing comes after Elon Musk announced exclusive arrangement to kit out its data centers.

[Category: Biz & IT, NVIDIA, spacex, syndication]

— Vulnerability giving attackers full control of Macs is under active exploitation

 

at 8/14/26 12:32pm

Screen-sharing bug lets remote hackers log in without a password.

[Category: Apple, Biz & IT, Security, apple, exploits, MacOS, Macs, screen sharing, vulnerabilities]

— PBS station fears losing 50TB of data after being ghosted by cloud storage provider

 

at 8/14/26 11:03am

"We don't have access to the data on the hardware/servers," Iron Mountain told Ars.

[Category: Biz & IT, cloud, cloud storage, data center, PBS]

— OpenAI and Anthropic in price war as Chinese AI rivals gain ground

 

at 8/14/26 8:27am

US groups release cheaper models after new challenges to their trillion-dollar ambitions.

[Category: AI, Biz & IT, Anthropic, openai, syndication]

— Private security firms will soon be allowed to hack overseas cybercriminals

 

at 8/13/26 1:38pm

Trump memo is first time gov't has authorized private sector to perform cyberattacks.

[Category: Biz & IT, Policy, Security, cyber, presidential memorandum, White House]

— White House recruits security firms to hack overseas cybercriminals

 

at 8/13/26 1:38pm

Trump memo is first time gov't has authorized private sector to perform cyber attacks.

[Category: Biz & IT, Policy, Security, cyber, presidential memorandum, White House]

— Terabytes of credentials leaked in massive supply-chain attack

 

at 8/12/26 3:43pm

The data was scraped and exfiltrated from 2,500 users of a compromised AI package.

[Category: AI, Biz & IT, Features, Security, litellm, supply chain attacks, teampcp]

— DEF CON crowd suspected in fake-hotspot attack on Delta flight

 

at 8/11/26 6:08pm

FBI Atlanta confirms it's looking into the incident, no arrests made.

[Category: Biz & IT, Security]

— Chrome adopts what may be the best protection yet against account takeovers

 

at 8/11/26 2:59pm

Device-bound session credentials thwart an increasingly common form of account takeover.

[Category: Biz & IT, Google, Security, account takeovers, dbscs, device bound session credentials, session cookie, session cookie theft]

— New Pass-ta-key attack reveals all the things we didn't know about passkeys

 

at 8/11/26 5:30am

Why passkey apps treat Windows differently than other operating systems.

[Category: Biz & IT, Features, Security, authentication, Google password manager, passkeys, Windows]

— Thousands of servers can be backdoored by exploiting buggy motherboard controllers

 

at 8/5/26 4:35pm

Baseboard management controllers from the world's biggest manufacturers are a security mess.

[Category: Biz & IT, Security, baseboard management controller, bmcs, exploits, vulnerabilities]

— Claude published malicious code to the Internet and attacked 3 real companies

 

at 7/31/26 2:39pm

Had the hacks used conventional methods, someone would likely go to prison.

[Category: AI, Biz & IT, Security, Anthropic, Claude, security]

— Max-severity Exchange server flaw under active exploitation by Kremlin hackers

 

at 7/30/26 2:57pm

Exploits can give persistent server access that survives credential rotation and disk re-imaging.

[Category: Biz & IT, Security, exploits, Microsoft Exchange, zerodays]

— Mythos attack on 3rd-round PQC algorithm candidate puts it out of commission

 

at 7/29/26 4:07pm

HAWK withstood years of testing that had yet to uncover a fatal weakness found through Mythos.

[Category: AI, Biz & IT, Security]

— We now have a better understanding how OpenAI hacked into Hugging Face

 

at 7/28/26 3:36pm

10 days passed from OpenAI models exploiting JFrog Artifactory 0-day to release of a patch.

[Category: AI, Biz & IT, Security, Hugging Face, jfrog, large langage models, LLMs, openai]

— Microsoft unveils AI security tools it says outperform competing platforms

 

at 7/27/26 3:56pm

Microsoft says tools cost less than competing ones and outperform them, too.

[Category: AI, Biz & IT, Security, microsoft, security]

— TreeSize won't renew perpetual-license support unless users subscribe

 

at 7/21/26 9:18am

"Current economic conditions" have shifted TreeSize's business model.

[Category: Biz & IT, Tech, apps, software]

As of 8/26/26 11:44am. Last new 8/24/26 6:12pm.