Hacker & Security News (@hacker.at.thenote.app)

I tried Google Photos' new AI Enhance tool: How it crops, relights, and fixes your shots - sometimes Now rolling out to Android users globally, AI Enhance uses generative AI to improve your photos instantly. Here's how to use it, and where it falls short.

I tried Google Photos' new AI Enhance tool: How it crops, relights, and fixes your shots - sometimes

Now rolling out to Android users globally, AI Enhance uses generative AI to improve your photos instantly. Here's how to use it, and where it falls short.
#hackernews #news

17 minutes ago 0 0 0 0

Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access A high-severity security vulnerability has been disclosed in Docker Engine that could permit an attacker to bypass authorization plugins (AuthZ) under specific circumstances. The vulnerability, tracked as CVE-2026-34040 (CVSS score: 8.8), stems from an incomplete fix for CVE-2024-41110, a maximum-severity vulnerability in the same component that came to light in July 2024. "

Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access

A high-severity security vulnerability has been disclosed in Docker Engine that could permit an attacker to bypass authorization plugins (AuthZ) under specific circumstances.
The vulnerability, tracked…
#hackernews #news

37 minutes ago 0 0 0 0

The Complete Guide to Passwordless Authentication in 2026: How It Works, Why It Matters, and How to Implement It Passwords are responsible for 80% of data breaches. Passwordless authentication eliminates the attack surface entirely. Here is the complete technical and business guide to how it works, which methods fit which scenarios, and how to implement it in 2026.

The Complete Guide to Passwordless Authentication in 2026: How It Works, Why It Matters, and How to Implement It

Passwords are responsible for 80% of data breaches. Passwordless authentication eliminates the attack surface entirely. Here is the complete technical and business gui…
#hackernews #news

58 minutes ago 0 0 0 0

[un]prompted 2026 – Developing & Deploying AI Fingerprints For Advanced Threat Detection Author, Creator & Presenter: Natalie Isak, Software Engineer, Microsoft & Waris Gill, Applied Scientist, Microsoft Our thanks to [un]prompted for publishing their Creators, Authors and Presenter’s outstanding [un]prompted 2026 AI Security Practitioner content on the Organizations') YouTube Channel.

[un]prompted 2026 – Developing & Deploying AI Fingerprints For Advanced Threat Detection

Author, Creator & Presenter: Natalie Isak, Software Engineer, Microsoft & Waris Gill, Applied Scientist, Microsoft

Our thanks to [un]prompted for publishing their Creators, Author…
#hackernews #microsoft #news

1 hour ago 0 0 0 0

Legacy Systems are Undermining Financial Institution Cybersecurity Legacy systems are increasing cyber risk for financial institutions, exposing banks to attacks, compliance gaps and rising costs.

Legacy Systems are Undermining Financial Institution Cybersecurity

Legacy systems are increasing cyber risk for financial institutions, exposing banks to attacks, compliance gaps and rising costs.
#hackernews #news

1 hour ago 1 0 0 0

How I calibrated my subwoofer placement for peak impact in awkward room setups Adding a subwoofer to your home theater is exciting, but not every room is a perfect square designed for subwoofers.

How I calibrated my subwoofer placement for peak impact in awkward room setups

Adding a subwoofer to your home theater is exciting, but not every room is a perfect square designed for subwoofers.
#hackernews #news

2 hours ago 0 0 0 0

Why Your Automated Pentesting Tool Just Hit a Wall Automated pentesting tools deliver strong early results, then quickly plateau. Picus Security explains how the "PoC cliff" leaves major attack surfaces untested and creates a dangerous validation gap. [...]

Why Your Automated Pentesting Tool Just Hit a Wall

Automated pentesting tools deliver strong early results, then quickly plateau. Picus Security explains how the "PoC cliff" leaves major attack surfaces untested and creates a dangerous validation gap. [...]
#hackernews #news

2 hours ago 0 0 0 0

Major outage cripples Russian banking apps and metro payments nationwide A major outage hit Russian banking apps and payments, blocking card use, cash withdrawals, and mobile access for hours. A widespread outage disrupted banking apps and payment systems across Russia, leaving customers unable to pay by card, withdraw cash, or access mobile banking for hours. According to The Record Media, the incident affected major banks, […]

Major outage cripples Russian banking apps and metro payments nationwide

A major outage hit Russian banking apps and payments, blocking card use, cash withdrawals, and mobile access for hours. A widespread outage disrupted banking apps and payment systems across Russia, leaving c…
#hackernews #news

2 hours ago 0 0 0 0

Acronis MDR by TRU brings 24/7 managed detection and response to MSPs Acronis has announced the launch of Acronis MDR by Acronis TRU, a globally available 24/7/365 managed detection and response (MDR) service. Built specifically for managed service providers (MSPs) of all sizes, the service provides threat detection, incident response, and cyber resilience powered by the Acronis Threat Research Unit (TRU). With this offering, MSPs can expand their security capabilities and deliver scalable protection without the complexity or cost of operating an in-house security operations center. As …

Acronis MDR by TRU brings 24/7 managed detection and response to MSPs

Acronis has announced the launch of Acronis MDR by Acronis TRU, a globally available 24/7/365 managed detection and response (MDR) service. Built specifically for managed service providers (MSPs) of all sizes, …
#hackernews #news

2 hours ago 0 0 0 0

Fast-moving Storm-1175 uses new exploits to breach networks and drop Medusa China-based actor Storm-1175 runs fast ransomware attacks, exploiting new flaws to breach systems and quickly deploy Medusa ransomware. China-based actor Storm-1175 carries out fast, financially driven ransomware attacks by exploiting newly disclosed vulnerabilities before organizations patch them. The group targets exposed systems and quickly moves from initial access to data theft and Medusa ransomware deployment, […]

Fast-moving Storm-1175 uses new exploits to breach networks and drop Medusa

China-based actor Storm-1175 runs fast ransomware attacks, exploiting new flaws to breach systems and quickly deploy Medusa ransomware. China-based actor Storm-1175 carries out fast, financially driven ra…
#hackernews #news

2 hours ago 0 0 0 0

Minimus Hyper-Growth Underway with Yael Nardi as New Chief Business Officer New York, USA, 7th April 2026, CyberNewswire

Minimus Hyper-Growth Underway with Yael Nardi as New Chief Business Officer

New York, USA, 7th April 2026, CyberNewswire
#hackernews #news

3 hours ago 0 0 0 0

I tested the AirPods Max 2, Sony XM6, and Bose Ultra 2: Why Bose is my top pick I've worn the latest over-ear headphones from Apple, Sony, and Bose in real-world settings. Here's how they compare.

I tested the AirPods Max 2, Sony XM6, and Bose Ultra 2: Why Bose is my top pick

I've worn the latest over-ear headphones from Apple, Sony, and Bose in real-world settings. Here's how they compare.
#apple #hackernews #news

3 hours ago 1 0 0 0

Cloudflare moves up its post-quantum deadline as researchers narrow the path to Q-Day Cloudflare announced it is targeting 2029 to complete post-quantum security across its entire product suite, including post-quantum authentication. The company is following a revised roadmap that Google also adopted after announcing that it had improved the quantum algorithm used to break elliptic curve cryptography. Google stopped short of publishing the algorithm, disclosing only a zero-knowledge proof of its existence. The same day, a company called Oratomic published a resource estimate for breaking RSA-2048 and P-256 …

Cloudflare moves up its post-quantum deadline as researchers narrow the path to Q-Day

Cloudflare announced it is targeting 2029 to complete post-quantum security across its entire product suite, including post-quantum authentication. The company is following a revised roadmap tha…
#hackernews #news

3 hours ago 0 0 0 0

Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurrency mining and proxy botnet. "A purpose-built Python scanner continuously sweeps major cloud IP ranges for vulnerable targets, automatically installing malicious nodes via ComfyUI-Manager if no exploitable node is already

Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign

An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurrency mining and proxy botnet.
"A purpose-b…
#hackernews #news

3 hours ago 0 0 0 0

Multi-Tenant SaaS and Single Sign-On (SSO) Uncover the complexities of multi-tenant SaaS architecture, understand how SSO simplifies access management, and explore how to fortify security in these enviro

Multi-Tenant SaaS and Single Sign-On (SSO)

Uncover the complexities of multi-tenant SaaS architecture, understand how SSO simplifies access management, and explore how to fortify security in these enviro
#hackernews #news

3 hours ago 0 0 0 0

AI Agents and Non-Human Identities Creating Critical Security Gaps, Report New research from Keeper Security, reveals non-human identities and automated system-to-system interactions are becoming the top security risk for businesses in 2026.

AI Agents and Non-Human Identities Creating Critical Security Gaps, Report

New research from Keeper Security, reveals non-human identities and automated system-to-system interactions are becoming the top security risk for businesses in 2026.
#hackernews #news

4 hours ago 2 0 0 0

AI-enabled device code phishing campaign exploits OAuth flow for account takeover A phishing campaign that bypasses the standard 15-minute expiration window through automation and dynamic code generation, leveraging the OAuth Device Code Authentication flow to compromise organizational accounts at scale, has been observed by the Microsoft Defender Security Research team. The campaign uses AI-assisted infrastructure and end-to-end automation. Attack overview Device Code Authentication is a legitimate OAuth flow designed for devices that cannot support a standard interactive login. In this model, a code is presented on …

AI-enabled device code phishing campaign exploits OAuth flow for account takeover

A phishing campaign that bypasses the standard 15-minute expiration window through automation and dynamic code generation, leveraging the OAuth Device Code Authentication flow to compromi…
#hackernews #microsoft #news

4 hours ago 0 0 0 0

Traffic violation scams swap links for QR codes to steal your card details Phishers are using QR codes on official-looking notices to level up their traffic and toll scams.

Traffic violation scams swap links for QR codes to steal your card details

Phishers are using QR codes on official-looking notices to level up their traffic and toll scams.
#hackernews #news

4 hours ago 0 0 0 0

The Hidden Cost of Recurring Credential Incidents When talking about credential security, the focus usually lands on breach prevention. This makes sense when IBM’s 2025 Cost of a Data Breach Report puts the average cost of a breach at $4.4 million. Avoiding even one major incident is enough to justify most security investments, but that headline figure obscures the more persistent problems caused by recurring credential

The Hidden Cost of Recurring Credential Incidents

When talking about credential security, the focus usually lands on breach prevention. This makes sense when IBM’s 2025 Cost of a Data Breach Report puts the average cost of a breach at $4.4 million. Avoiding even one major inciden…
#hackernews #news

4 hours ago 1 0 0 0

GPUBreach exploit uses GPU memory bit-flips to achieve full system takeover GPUBreach attack technique uses GPU memory bit-flips to escalate privileges and potentially take full control of a system. New research shows that attacks like GPUBreach exploit RowHammer bit-flips in GPU memory (GDDR6) to go beyond data corruption. Attackers can use this technique to escalate privileges and, in some cases, gain full control of the system. […]

GPUBreach exploit uses GPU memory bit-flips to achieve full system takeover

GPUBreach attack technique uses GPU memory bit-flips to escalate privileges and potentially take full control of a system. New research shows that attacks like GPUBreach exploit RowHammer bit-flips in GPU…
#hackernews #news

4 hours ago 0 0 0 0

Is Gmail Filtering Your Emails? Causes, Signs & Fixes Find out why Gmail is filtering your emails, what triggers its spam filters, and how to fix it — including authentication, sender reputation, and content issues.

Is Gmail Filtering Your Emails? Causes, Signs & Fixes

Find out why Gmail is filtering your emails, what triggers its spam filters, and how to fix it — including authentication, sender reputation, and content issues.
#hackernews #news

4 hours ago 0 0 0 0

What we learned about TEE security from auditing WhatsApp’s Private Inference WhatsApp's new Private Inference feature combines end-to-end encryption with AI-powered capabilities, such as message summarization, by processing encrypted user messages inside trusted execution environments. To achieve this, Meta built a system that uses secure hardware enclaves, where not even Meta can access the plaintext. However, an audit conducted before the launch identified several vulnerabilities that compromised WhatsApp's privacy model, all of which Meta has patched. The audit revealed that trusted execution environments are not a silver bullet and require rigorous attention to implementation details to securely deploy. The challenges of using AI with end-to-end encryption are significant, as vulnerabilities could expose millions of users' private messages. The audit identified 28 issues, including eight high-severity findings that could have enabled attackers to bypass the system's privacy guarantees. Meta has addressed these issues, including implementing strict validation of environment variables and verifying security patch levels. The audit highlights the importance of measuring critical data, validating and never trusting any unmeasured data, and testing thoroughly to detect when components misbehave. The lessons learned from this audit can be applied to other trusted execution environment deployments, emphasizing the need for careful design and implementation to ensure security. The audit demonstrates that while trusted execution environments provide strong isolation primitives, the large host-guest attack surface requires careful attention to security at every layer of the stack.

What we learned about TEE security from auditing WhatsApp’s Private Inference

WhatsApp's new Private Inference feature combines end-to-end encryption with AI-powered capabilities, such as message summarization, by processing encrypted user messages inside trusted execution …
#hackernews #meta #news

5 hours ago 0 0 0 0

FIRESIDE CHAT: Geopolitical turmoil, rising AI risk add a new layer to enterprise cyber defense As if securing the enterprise against a tidal wave of AI tools wasn’t hard enough, it turns out the geopolitical instability of the moment is making things worse. That wasn’t the headline at RSAC 2026 last week — agentic AI … (more…)

FIRESIDE CHAT: Geopolitical turmoil, rising AI risk add a new layer to enterprise cyber defense

As if securing the enterprise against a tidal wave of AI tools wasn’t hard enough, it turns out the geopolitical instability of the moment is making things worse.

That wasn’t the head…
#hackernews #news

5 hours ago 0 0 0 0

How to Send Secure Email in Gmail: Step-by-Step Guide Learn how to send secure email in Gmail using Confidential Mode, S/MIME encryption, and best practices to protect sensitive messages in Google Workspace.

How to Send Secure Email in Gmail: Step-by-Step Guide

Learn how to send secure email in Gmail using Confidential Mode, S/MIME encryption, and best practices to protect sensitive messages in Google Workspace.
#hackernews #news

5 hours ago 0 0 0 0

Support platform breach exposes Hims & Hers customer data Healthcare companies handle some of the most personal data imaginable, and that makes them a magnet for hackers.

Support platform breach exposes Hims & Hers customer data

Healthcare companies handle some of the most personal data imaginable, and that makes them a magnet for hackers.
#hackernews #news

5 hours ago 0 0 0 0

CoinRabbit Reduces Crypto Lending Rates For XRP Loans and 300+ Assets CoinRabbit, in April 2026, announced a reduction in its crypto lending rates, now starting at 11.95%. This move aims to offer competitive rates and loan terms in the CeFi lending space. The platform supports over 300 assets, including XRP, and allows users access to liquidity without selling their holdings while maintaining portfolio exposure. Final rates depend on the LTV ratio (50-90%) and loan terms, with options for fixed-term and open-ended loans. Walter Barrett, Chief Strategy & Growth Officer, emphasized efficient lending for diverse portfolios in the dynamic market conditions. CoinRabbit offers liquidation LTV options, with a standard 80% and a more conservative 90-95% for risk management. Users receive instant alerts when their collateral value approaches the liquidation threshold. Lending involves choosing collateral, loan terms, and receiving funds quickly, followed by monitoring the loan. CoinRabbit, established in 2020, is a crypto asset management platform with over $1.45B in loans issued. The platform offers lending, yield, and trading products, along with a Private Program, all within its ecosystem. CoinRabbit operates in Canada through a registered entity and provides resources and contact information for further inquiries.

CoinRabbit Reduces Crypto Lending Rates For XRP Loans and 300+ Assets

CoinRabbit, in April 2026, announced a reduction in its crypto lending rates, now starting at 11.95%. This move aims to offer competitive rates and loan terms in the CeFi lending space. The platform supports ov…
#hackernews #news

5 hours ago 0 0 0 0

Data Masking Gaps That Could Expose Your Organization Organizations collect and store huge amounts of sensitive data, customer details, financial records, login credentials, and more. Protecting this data is not just important; it’s critical for business survival. One of the most commonly used techniques to protect sensitive data is data masking. At first glance, it seems like a strong solution. It hides sensitive […]

Data Masking Gaps That Could Expose Your Organization

Organizations collect and store huge amounts of sensitive data, customer details, financial records, login credentials, and more. Protecting this data is not just important; it’s critical for business survival. One of the most…
#hackernews #news

5 hours ago 0 0 0 0

Hong Kong Police Can Force You to Reveal Your Encryption Keys According to a new law, the Hong Kong police can demand that you reveal the encryption keys protecting your computer, phone, hard drives, etc.—even if you are just transiting the airport. In a security alert dated March 26, the U.S. Consulate General said that, on March 23, 2026, Hong Kong authorities changed the rules governing enforcement of the National Security Law. Under the revised framework, police can require individuals to provide passwords or other assistance to access personal electronic devices, including cellphones and laptops. ...

Hong Kong Police Can Force You to Reveal Your Encryption Keys

According to a new law, the Hong Kong police can demand that you reveal the encryption keys protecting your computer, phone, hard drives, etc.—even if you are just transiting the airport.

In a security alert dated Mar…
#hackernews #news

6 hours ago 1 0 0 0

GitHub Copilot CLI gets a second-opinion feature built on cross-model review Coding agents make decisions in sequence: a plan is drafted, implemented, then tested. Any error introduced early compounds as subsequent steps build on the same flawed assumption. Self-reflection is a recognized mitigation technique, and one GitHub Copilot already supports, but a model reviewing its own output is still constrained by the same training data and blind spots that produced it. GitHub addressed that constraint this week with the release of Rubber Duck, a cross-model review …

GitHub Copilot CLI gets a second-opinion feature built on cross-model review

Coding agents make decisions in sequence: a plan is drafted, implemented, then tested. Any error introduced early compounds as subsequent steps build on the same flawed assumption. Self-reflecti…
#copilot #hackernews #news

6 hours ago 0 0 0 0

How To Make Employee Retention Your Strongest Growth Strategy in 2026 This article explores four employee retention strategies to keep in mind as you strive for company growth in 2026.

How To Make Employee Retention Your Strongest Growth Strategy in 2026

This article explores four employee retention strategies to keep in mind as you strive for company growth in 2026.
#hackernews #news

6 hours ago 0 0 0 0

Latest Posts by Hacker & Security News