ChatGPT Is Building Detailed Psychological Profiles of Its Users

Chatbots are building “algorithmic self-portraits” of users as they retain information for a hyper-personalized experience, a study warns. A recent study, conducted by a coalition of scientists in Germany, India and the Netherlands and presented at the ACM Web Conference 2026, investigated the ways that OpenAI’s ChatGPT has tracked and made sense of user inputs to develop comprehensive digital profiles of users.

Source: futurism.com

Independent Labs Crack Google's Secret Cryptography Work

Google quantum researchers found an ECC vulnerability too risky to detail publicly. A startup beat its results in 3 days with AI agents and crowdsourcing. A quantum computer capable of breaking the codes that help secure today’s internet became dramatically more possible in March, when Google scientists and their colleagues unveiled new research. Usually, cybersecurity researchers share information about how attacks work to help prevent them. This group, however, believed its discovery posed enough of a security risk for them to use an unprecedented strategy to conceal how exactly to replicate their research.

The Art of the Deal: Jared Kushner’s Hacked Phone Revealed More Than $700 Million in Transfers

An exclusive excerpt from ‘Princes and Thieves: Jared Kushner and Mohamed bin Zayed’s Secret Plot to Remake the Middle East’ examines how bank accounts linked the president’s son-in-law—and former senior adviser—to Israel, the UAE, and Saudi Arabia. In late spring 2020, a source I knew to be reliable called me with a story. The Dutch government had hacked into Jared Kushner’s phone and monitored him as he accessed a Dubai-based bank account. What was odd, the source said, was that the money in the account—hundreds of millions of dollars—had come from a bank in Azerbaijan. Most importantly, Kushner appeared to have transferred significant amounts of money from the Dubai account to other individuals, including a warlord, a mercenary and a one-time hit man. The story sounded preposterous, I told my source. And yet.

LLMs are making formal software verification feasible at a much larger scale

Claude formally proved security properties in the compiled code of 123 open-source libraries. Along the way, it found bugs that had eluded detection for years. Even mature, heavily tested software contains bugs, and LLMs are increasingly adept at finding them. The Linux kernel—one of the most well-tested pieces of software today, deployed on billions of devices worldwide—recently had over 1,000 vulnerabilities disclosed. With frontier models becoming more capable of chaining seemingly benign bugs into critical exploits, we need techniques that can detect and fix these bugs before they can be exploited in the wild.

Someone Knew About PHP's Critical Flaws Four Days Before the Public Did and Amazon Can't Explain How

Amazon’s chief information security officer, CJ Moses, reported that the earliest PHP2Shell exploit attempt was detected on 17 October, four days before public disclosure. The request came from an anonymised IP address geolocated to Australia, but the operator’s identity remains unclear.

Source: techtimes.co.uk

The Internet goes on high alert after discovery of 8 compromised TLS certs

Security personnel around the world are on high alert Tuesday following the discovery of eight TLS certificates with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet. As of late morning Tuesday, browser makers and some major apps and programming languages had blocked all eight of the intermediate certificates. There are no reports of certificate transparency logs, which track the issuance of all browser-trusted certificates, showing the compromised keys being used maliciously. The threat remains far from over, however, because it will be hard and time-consuming to update other key parts of the Internet, such as Linux distributions and embedded and Internet of Things devices.

The US Army wants AI agents that hack its enemies with almost no human oversight

The US Army is shopping for AI agents that can slip into computer networks, find targets and “neutralize” them with little human oversight, according to a public notice from Army Cyber Command and internal documents obtained by The Intercept. The program is called ECHOTRIBBLE.

Source: madrobot.blog

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters operate a website that pressured victims into paying a ransom.

Source: krebsonsecurity.com

The Cloudflare Appstore (Appflare) Malware Audit

An agent-assisted review of Appflare’s app catalog traced a password-reset token leak and private note data sent to upstream services. The process, evidence, and limits. A link shortener’s password-reset page should be a fairly boring place. You open the link, choose a password, and get back to work. In one app we reviewed, opening that page also handed the reset token to an upstream analytics service. That was the most serious result of an agent-assisted audit of Appflare, an app store for your own Cloudflare account. I asked Codex to look through the catalog for code that had no business running in an app someone would install. The brief was deliberately narrow: credential theft, hidden data collection, backdoors, unrelated account changes. A list of routine hardening suggestions wouldn’t answer it.

‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads

Researchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising. On Thursday, researchers from The Citizen Lab at the University of Toronto revealed a worst-case scenario found in the wild: spyware silently infecting targets as they browse past ads in their daily digital lives. Dubbing the attacks “AdFection,” the researchers documented a campaign in which an Israeli-registered advertising firm allegedly connected to the servers linked to a spyware company and infected dozens of devices with its invasive malware. Citizen Lab believes this to be the first detailed technical evidence made publicly available of sophisticated spyware infecting devices via digital ads.