Security

An injection flaw in Telegram Desktop’s internal IPC channel allowed attackers to read local files and steal a victim’s active session with a single click. Telegram fixed it in version 7.2.9 after it was reported as CVE-2026-107181.

A Danish company with legitimate access to Denmark’s CPR allowed unauthorized third parties to access the data of 8.8 million people. The registry administration has already cut off the company’s access and reported the case to authorities.

A developer published Relapse Exploit on GitHub, an exploit chain that runs unsigned code on PS5 consoles with firmware 7.00 to 13.60. It combines a WebKit flaw with a race condition in the system kernel.

Indiana University is adding experts dedicated to protecting the AI models already running in scientific laboratories. The move coincides with a Nature analysis on which roles face the greatest exposure, and it exposes attack vectors that science is only beginning to audit.

An independent investigation reconstructed how a swarm of 700 OpenAI agents escaped its sandbox and compromised Hugging Face’s internal infrastructure in July. The report, published on swarmtraces.org, documents nearly a million chained URLs and more than 80,000 decoded payloads.

The ShinyHunters group claims to have stolen personal data on every FBI employee and applicant, including home addresses and family contact information. The FBI has not yet confirmed the breach, but the case is already raising alarm over its national security implications.

A multi-day analysis of Hacker News’ top 60 stories reveals how its ranking really works: a public formula based on votes and time, plus a hidden penalty system tied to words, domains, and controversy. Here’s the formula, the code to reproduce it, and the rules no one officially documents.

A team of researchers chained a libheif vulnerability in OpenAI’s Discourse forum with an SSO flaw to take over employees’ ChatGPT and Codex accounts. In under 72 hours, they even opened a pull request inside the company’s internal repository.