‼️ The U.S. sanctioned at least six Iranian nationals on Monday over a hacking team inside Iran's intelligence ministry that Treasury blames for "extensive compromises" of U.S. critical infrastructure since 2023. Four were indicted last week over breached email accounts at the Department of Labor, FERC and the UN.

This comes after an attack on an U.S. ally, days earlier, Iranian hackers shut down a small British power plant for four days.

‼️ Microsoft Paint and Photos embed GUIDs as invisible watermarks in locally generated AI images. Even though you are using 'local AI', both apps send your prompt to Microsoft's servers, which moderate it and return a unique identifier that gets baked into the image.

https://xusheng.dev/posts/reversing/mspaint_invisible_watermark/main/

‼️ BREAKING: Ubiquiti has patched 21 criticalUniFi vulnerabilities, with CVSS scores up to 10.0. Attackers can execute commands remotely, bypass authentication and escalate privileges to take over the device.

The vulnerabilities are present in UniFi OS Server and the Protect, Network and Connect applications.

https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9

‼️ Bill Gates accuses the tech industry of knowingly downplaying AI's risks because too much money is at stake.

Executives are worried in private but won't say so publicly, he told the NYT. Their reasoning, in his words: "It's bad for us — the next trillion dollars we're trying to raise."

Gates says the industry blew past milestones it once said would warrant caution: models escaping their creators' control, AI producing bioweapon recipes.

https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make

‼️ BREAKING: OpenAI has published its full post-mortem on their AI breakout and compromise of Hugging Face. Carried out by its own models, with no human directing them.

Agents stuck on evaluation tasks turned an internal Artifactory server into a covert message board, escaped the sandbox via SSRF, then chained two Hugging Face zero-days into code execution on dozens of production servers.

OpenAI calls it a "warning shot" for loss of control.

https://openai.com/index/hugging-face-incident-and-the-road-ahead/

‼️ BREAKING: Two TeamPCP members, Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, have been arrested in Perth, Australia. The group is known for its npm supply chain attacks, including the Shai-Hulud worm.

‼️ Proton says 85% of the 390 VPN apps in US app stores contain trackers that collect and share personal data, and 64 of them are owned by Chinese companies. 31 of those hide it behind shell firms in Singapore, Hong Kong and the UK.
Chinese law compels those companies to hand user data to the state on request, putting the browsing activity and personal data of US users in reach of the Chinese government. Americans downloaded them 3M+ times in one month.