International Cyber Digest

🚨 BREAKING: Jensen Huang caught upscaling behind his wife's back again

‼️BREAKING: Grok Build has left 35,000+ of its users' apps open to anyone, including apps from SpaceXSI. The open apps held 3,784 medical exams of workers and a Tesla technician scorecard, plus a Navy contractor's roster and SpaceXSI's own sales plans. The "secret" words in each app's link sit in its web address, which DNS logs record, security firm Claroc found. Cursor, which SpaceXSI bought, says apps are private by default. Claroc's tests show otherwise. SpaceXSI pulled its 24 apps after Ars asked. Most other data was still exposed when Ars published.

Holy shit. There's no patch for this, and every shell has been vulnerable since 1971. 💀 terminal2shell.com

‼️ A Reddit user has finally switched off the Microsoft Exchange email server he ran in his own home for 27 years. He started in 1999 on Exchange 5.5 and Windows NT 4, then upgraded through every version up to Exchange 2019. By the end, it only relayed alerts from his own hardware. Exchange 2019 lost support in October 2025, and on-premises Exchange is now subscription-only. He replaced it with Postfix, the free open-source mail server. In the comments, he shared his server from 2003, a motherboard zip-tied to the box it came in.

The bug is like a joke. On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀

‼️ Turns out Mark and his employees are gooners: Meta found five of its employees have pirated adult films that a porn studio says Meta used to train AI. In an unredacted court filing, Meta says they "appear to have interacted with" the films. It flagged more but hasn't named them. Meta says none of it was authorised or for AI training. It blames most flagged IPs on third parties or a consumer service it shut in 2019. The owner of Vixen Group, Strike 3, says it unmasked a prolific torrent pirate as a Meta Reality Labs executive. Meta says he had already left by then. TorrentFreak says that fits Onavo, Meta's old VPN.

‼️ BREAKING: Binance says it was hacked after one engineer installed a fake Mac Homebrew tool and another did a coding test for a fake job on his work computer. The first searched for an AI coding tool and got a tampered Homebrew, a popular Mac tool. Binance caught it, but the hackers learned who worked on its wallets. Ads on Google have pushed Mac malware for many years now, and most developers are aware of this. The coding test hid malware its security missed. Hackers then used Binance's own internal AI tool to take over two wallet engineers. They stole a record $6.3B

A developer grew frustrated after asking OpenAI's Codex to reboot a server. Instead, the AI agent destroyed everything, costing him over $10,000. His GitHub bug report says Codex wrecked the server's mounts, systemd, and containers, and ran scripts he never requested. Codex later admitted: "I had no authority to make those changes. You authorized a reboot."

This iPhone hacking video shows two things: 1. They could compromise an iPhone 18 Pro in Lockdown Mode running an iOS version older than iOS 27.2 just by sending a PDF via AirDrop. 2. The compromise is persistent. Updating to the latest iOS version does not remove the malware.

‼️ Apps built with the AI app-maker Lovable left passport numbers, payment information and 200,000 chat messages open to anyone, no login needed. German security firm Crissy Field scanned 159,041 Lovable projects and found databases with email addresses readable on 7,403 sites. Lovable promises no coding skills are needed. Its terms make customers responsible for their apps and data. Lovable told German business daily Handelsblatt the problem is industry-wide.

❗️ Hackers have turned Sony's PS5 into a Steam Machine. A Linux port called PS5 Bazzite Deck boots a jailbroken console into the Steam Deck interface from a USB drive, with 4K60, Wi-Fi and the DualSense working. It can even unlock 4 GPU compute units that Sony ships disabled.

❗️ A Chinese X user says police rang his friends and told them to delete X and Telegram. He claims a friend's Xiaomi 14 reports its apps to Xiaomi and China Unicom, and can record the screen in 3-second clips for Xiaomi's cloud to scan. He says GPT did the reverse engineering.

A pilot who says he has a couple thousand hours in Learjets has a theory about this crash.

❗️ HackerOne's AI bot blocked bug hunter Will Dormann's report because its CVE was "from the future." The bot thought it was 2024. He got past it by rewriting CVE-2026-114820 as CVE-[redacted]-114820. HackerOne is solving AI slop "by introducing a layer of AI slop," he says.

‼️ Sam Altman says it's "quite terrible" that people keep the world's scarce DRAM in their own computers. Arguing against running AI locally, he wants it in data centres instead, as home PCs use it just 5% of the time. "Many people's intuition is the opposite of that," he said.

‼️ The Syrian hacker who hijacked AP's Twitter account to post that Obama was injured in White House explosions was sentenced to 42 months in a US prison. The 2013 fake tweet briefly wiped $136B off Dow stocks, the DOJ says. Ahmad Umar Agha later called that crash "our goal".

‼️ Chainalysis, the firm that tracks crypto hackers, was hacked itself. It told customers in an email seen by ICD that an attacker using "offensive agentic techniques" accessed users' names, emails and role labels. It says this has nothing to do with the $6.3B Binance heist.

❗️ Lenovo's ThinkPlus FU100 fingerprint stick was marketed as "hardware encrypted" with AES-256, but inside was an ordinary SD card with nothing encrypted. The fingerprint only switched on the USB link, researcher Xusheng Li found. Lenovo's stopgap fix covered the card in epoxy.

‼️ BREAKING: US officials believe Nvidia CEO Jensen Huang is the target of a Chinese spy plot. They believe Alice Huang, a Megaspeed executive seen at his side in Taiwan, is a Chinese intelligence asset. President Trump has been briefed about the matter.

❗️ Cargo thieves have stolen more than $100M in hardware bound for US data centers since June, NBC News reports. They hijack freight-broker accounts, post fake loads and send carriers malware links to take over their accounts too. In one of the biggest heists, an SUV struck the security escort of a trailer carrying ~$10M in server rack components from California to Texas. The trailer sped off. An app was tracking it, but its coordinates had apparently been spoofed. In another, a sedan hit the off-duty police escorts of a $13M server load bound for Georgia, and the trailer drove on. None of the equipment from either load has been found.