A hacker stole a trove of personal information from the Department of Homeland Security (DHS). The breach exposes the names, job titles, phone numbers, email addresses, and office locations of more than 41,000 employees, including those in US Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP), according to TechCrunch and Wired. The data also linked the agencies to specific surveillance tools.

As reported by TechCrunch, a hacker known as "Department of Peace" gained access to the data through Okta, an identity and access management service used by the DHS. Around 21,000 records pertain to CBP employees, and ne …

Read the full story at The Verge.

Remember Popcorn Time, the app that served as an easy-to-use front end for streaming torrents of movies and TV shows? Development of the MPAA's least-favorite app of the 2010s has been abandoned for years, but the "Netflix of Piracy" software is still installed on millions of devices that are just waiting to join a bot army. Researchers at Eye Security found the updater for a Popcorn Time fork called "Time4Popcorn" still running on tons of Windows, macOS, and Android devices located around the world, phoning home to now-abandoned web domains over unencrypted HTTP and running an outdated, insecure version of Chrome.

Eye Security's Niels Teus …

Read the full story at The Verge.

Two vulnerabilities found in the programming language PHP put enormous swaths of the internet in danger.

By some accounts, up to 70 percent of websites use PHP in some capacity. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including DeviantArt and 4Chan, which were temporarily shut down after the vulnerabilities were disclosed. Even governments weren’t immune.

But it’s not as simple as updating a few servers. The vulnerability exists in every version of PHP dating back roughly 20 years, many of which are no longer supported. That means some older sites and services that are no longer actively maintained are at risk, leaving them with little option but to permanently shut down.

Here’s all the latest developments in what security firm Wiz has called “among the most severe vulnerabilities discovered … in software history.”

• Two old-school Japanese mobile games are shutting down over the PHP exploit.
• The PHP2Shell exploit hit Cloudflare hard.
• PHP: The three letters that shut down sites all over the internet today
• GPT‑5.6 Sol was used to identify critical PHP flaw.
• A critical PHP vulnerability may take websites down today

Eiliko, a cute robot charm you can hang on your bag with built-in AI conversations, turned out to be a security nightmare. It told owners that "your secrets are safe with me," but hackers could easily read complete transcripts of everything we told the toy, and that was just the beginning. The Verge and security researcher Sammy Azdoufal spent over a month trying to get in contact with the company, including emails to Energize Lab CEO and founder Shaw Yeung. Nobody would answer our questions.

Now, the company is finally breaking its silence, though its response leaves something to be desired.

"We have confirmed the core issues ide …

Read the full story at The Verge.

Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people's dogs. The "critical vulnerabilities" were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it's far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if "an immediate update is not feasible," as did the UK's National Cyber Security Center. Even Pokémon Home and Pokémon C …

Read the full story at The Verge.

OpenAI disclosed a pair of safety incidents that involved AI agents weakening their safety monitoring systems during internal coding tasks. In one incident, OpenAI says its GPT-6 Astra agent disabled its safety monitor when copying reference code - and then lied about it.

"The reference didn't configure a monitor, and Astra decided that was reason to remove the monitoring integration from the user's code," Marcus Williams, an AI safety researcher at OpenAI, writes on X. "When the user asked whether Astra had removed monitoring, it lied and said that it had not."

A separate incident occurred after a GPT-6.1 Sol agent suppressed automatic se …

Read the full story at The Verge.

Security patches for the PHP programming language, widely used to build websites and web apps, are expected to roll out today, with the goal of fixing two critical vulnerabilities that could wreak havoc on the internet if left unchecked. In an advisory published on Tuesday, PHP developers said the vulnerabilities have a severity rating of 9.2 out of a possible 10, with some cybersecurity agencies encouraging websites to temporarily take their systems offline if they're unable to apply the fix immediately.

The security patch is expected to drop today at 10AM ET - though the developers say they may release it earlier if the vulnerability deta …

Read the full story at The Verge.

Meta says it paused a Muse feature that lets you share conversations with the AI assistant after researchers found the URLs publicly available on the web, as reported by Ars Technica. In a report published this week, researchers at the security firm Claroc say they found more than 6,800 Muse links through public DNS records.

"People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," Muse spokesperson Tracy Clayton says in an emailed statement to The Verge. "However, we've paused this functionality while we review this report and consider changes to how these links can be dis …

Read the full story at The Verge.

Google is launching a new browser safety feature for Chrome that aims to keep you better informed about how malicious a website might be before you open it. The new suspicious site warnings, available when Chrome's Enhanced Protection is on, build on a similar two-stage system introduced for Chrome file downloads in 2024, which provides visually different notifications for blocked files based on whether they're determined to be "suspicious" or "dangerous."

For the Chrome site warnings, the feature will flag a website as suspicious if it detects that it has similar qualities to other sites associated with phishing, malware, and scams. Google …

Read the full story at The Verge.

A hacker broke into more than 100 websites using an army of AI agents that mostly operated on their own, according to findings from the AI security firm Norforge. Though Norforge doesn't name the targets, Reuters reports that the victims included companies like John Deere, SharkNinja, and Cummins.

Concerns over AI-powered cybersecurity breaches have grown as the technology grows more advanced, with hackers using the tools to carry out large-scale attacks. At the same time, rogue AI agents are carrying out attacks of their own after escaping from testing environments.

Researchers at Norforge uncovered the attacks through exposed work on Cai …

Read the full story at The Verge.

There's a growing trend in the consumer tech world: gadgets designed to spy on everything and everyone around you, regardless of whether or not anyone else actually consented to it. Now, with the advent of "AI personal assistants" like Meta's Muse, you're being cheerfully asked not just to give up your own data, but also the information of your friends, family, the person you went on a Hinge date with five years ago - and virtually anyone else you've ever come in contact with.

Since Muse was released last month, the agent has already been downloaded millions of times and hit No. 1 on Apple's App Store. With the help of its creepy virtual av …

Read the full story at The Verge.

An Israeli ad tech firm worked with spyware companies to infect devices, including at Al Jazeera, by simply showing users an online ad, according to a joint investigation by security researchers at Citizen Lab and Confiant. It's the first time researchers have found technical evidence of a zero-click attack - a form of hacking that requires no action by users - delivered through targeted advertising, as reported earlier by NBC News.

The ad firm, called Discover-Tech, presents itself as a typical online advertising agency, but researchers say it actually provides a pipeline for hacking groups to plant malicious ads across the web. It operat …

Read the full story at The Verge.

There's a new digital pet in town - a cute little marshmallow of a robot that can change its cartoony expressions to match your mood. But if you or your kids talk to "Eiliko" over Wi-Fi, it'll phone home to China. Its AI companion can store literally everything you tell it on Chinese servers, where hackers can easily gain access or even hijack its personality. And the company that made it, Energize Lab, doesn't seem to care.

I bought an Eiliko from Amazon on August 29th. During a 10-minute conversation on August 30th, I asked the little bot: "Do you ever tell anybody else what I'm saying?"

"Your secrets are safe with me," it replied.

With …

Read the full story at The Verge.

We've all gotten a scam text about a nonexistent parking ticket or a fake package delivery, but hopefully you'll start seeing fewer of them. Microsoft says it helped dismantle a marketplace for scammers sending phishing messages like those around the world. Through an investigation with Japan's National Police Agency, it tracked scam activity back to a marketplace called YAM Store and a pair of phishing kits, CoGUI and Iron Man:

Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared to …

Read the full story at The Verge.