Claude blocked a routine web search about an npm vulnerability and pointed me to Anthropic's Cyber Verification Program. I applied out of curiosity — and the approval came back so fast that a human almost certainly never read it.
Trump signed an order asking AI companies to voluntarily hand the government a 30-day look at their most powerful models before release. It explicitly bars any mandatory licensing — making the whole thing a request, not a rule.
An attacker took over Instagram accounts by asking Meta's AI support assistant to add an email and issue a password reset — no phishing, no breach. The damage was small. The mechanism is the warning.
The patch for a Linux root exploit called Dirty Frag turned out to hide a second one. Fragnesia was found by an AI auditing tool — a clean illustration of why the page-cache-write bug class keeps outrunning the people patching it.
A steady stream of Google Cloud customers keep waking up to four- and five-figure Gemini API bills, racked up in hours by attackers who scraped Maps or Firebase keys from public code. Google has set a June 19, 2026 cutoff to block unrestricted keys from Gemini entirely. Here is what the recurring pattern looks like, and what to do this week.
CVE-2026-23918 is a double-free in Apache 2.4.66's mod_http2. Two frames crash the worker. On Debian and the official Docker image, the same bug becomes a viable RCE path. The fix shipped May 4.
Mozilla published the first concrete result from Anthropic's Project Glasswing: 271 vulnerabilities fixed in Firefox 150, including a 20-year-old bug. Healthcare IT runs on patch cadences that are about to look very slow.
ShinyHunters defaced the Canvas login page on May 7 and pulled millions of students offline during finals week, two days after Instructure called the breach contained.
Three things hit Ubuntu in nine days: a root-level Linux kernel exploit dropped without coordinated patches, a pro-Iran DDoS that knocked Canonical's web infrastructure offline, and the 26.04 LTS release landing in the middle of both. Here's what it means for whatever you use Ubuntu for.
A new phishing-as-a-service kit ships with an AI assistant, 40+ templates, and an adversary-in-the-middle proxy that defeats SMS and TOTP MFA. The AI is the part the press loved. The AiTM is the part defenders should actually worry about.