Schneier on Security (2 hours ago)
Interesting research: Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first.
Read the full story on Schneier on Security.
Remote code execution is now available on non-updated Plex servers.
Threat actors have been observed delivering cryptocurrency miners and proxy software.
The leaked records belonged mostly to Burger King mobile app users.
Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006.
Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics.
Trading standards officers say AI is “super-charging” existing scams through clones and fake websites.
New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build.
Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms: Abstract: We estimate how much public cryptanalysis each public-key assumption has received, using the literature itself as the instrument.
This is a current list of where and when I am scheduled to speak: I’m speaking at ATTENTION: Democracy, Rebuilt in Montreal, Canada. The event runs October 21–23, 2026, and my talk is on Wednesday, October 21.
72 active sources
27 Turkish · 45 English
All sources
