Worth Knowing
All topics

Topic

Security

AI news about cybersecurity, vulnerabilities and attacks involving AI.

7 stories in the last 24 hours

Today

4 stories
  1. Worth knowing Hacker News

    AI is forcing us to pay off 40 years of technical debt

    It demonstrates a concrete case where AI enabled researchers to weaponize a previously dismissed software bug into a critical vulnerability affecting a vast portion of the web, highlighting an urgent shift in the balance between cyber attackers and open-source maintainers.

    Cybersecurity researchers at Calif, aided by AI tools during an OpenAI-sponsored audit, discovered how to turn a known out-of-memory bug in PHP into a critical remote code execution vulnerability dubbed PHP2Shell. While the PHP Foundation patched the flaw in two months, experts warn that AI's ability to weaponize seemingly minor legacy bugs creates a severe asymmetry between discovering and fixing vulnerabilities.

    1 source
  2. Worth knowing Hacker News

    Tell HN: Gemini trains on chat history, even for subscribers (personal accounts)

    This highlights an important data privacy caveat for paying consumers of AI products who may assume a paid subscription protects their inputs from model training and human review.

    A Hacker News post highlights that Google's personal AI subscriptions use saved Gemini chat histories to train generative AI models and allow human reviewers to read a subset of transcripts. Users cannot opt out of training without turning off their chat history entirely, and chats selected for human review are retained for up to three years even if deleted by the user.

    1 source
  3. Worth knowing OpenAI

    Daybreak Red is now available in AWS GovCloud (US-East)

    It expands the deployment of frontier, domain-specific AI models into restricted government cloud environments for critical cybersecurity tasks.

    OpenAI has launched Daybreak Red in AWS GovCloud (US-East) via Amazon Bedrock. The release provides approved customers with access to the GPT-5.6 Cyber model for authorized cybersecurity operations.

    1 source

Yesterday

3 stories
  1. Worth knowing TechCrunch

    Anthropic is working on a system to prove AI models’ identity

    Provable inference could establish trust in commercial AI APIs by preventing providers from secretly substituting cheaper models to cut costs or stronger models to game benchmarks.

    Anthropic researchers have released an open-source technical specification and code for FlashProve, an experimental system designed to cryptographically verify which AI model produced a specific output. The method uses public model fingerprints to confirm model identity on local devices without exposing proprietary model weights.

    1 source
  2. Worth knowing Ars Technica

    Ukraine’s drone strikes spur hasty Russian plans for underground data centers

    Physical attacks on data centers and AI supercomputers during wartime demonstrate that compute infrastructure has become a direct military target, forcing nations to rethink the physical security of their AI capabilities.

    Ukrainian drone strikes have damaged Russian data centers housing AI supercomputers and disrupted cloud services operated by companies like Yandex and Sberbank. In response, the Kremlin is mandating emergency compute reserves for state needs, while Russian firms explore hiding data centers underground in mines.

    1 source