A Dozen Lines of Code Could Have Hijacked ChatGPT's Mac App Through Its Own Trust Checks
Cybersecurity
Bruno Digital · 43m ago

A Dozen Lines of Code Could Have Hijacked ChatGPT's Mac App Through Its Own Trust Checks

A macOS researcher found that ChatGPT's desktop app could be tricked into treating a malicious script as legitimate OpenAI software, handing an attacker the same browser and file access the assistant itself holds.

A Dozen Lines of Code Could Have Hijacked ChatGPT's Mac App Through Its Own Trust Checks
Cybersecurity·43m ago

A Dozen Lines of Code Could Have Hijacked ChatGPT's Mac App Through Its Own Trust Checks

A macOS researcher found that ChatGPT's desktop app could be tricked into treating a malicious script as legitimate OpenAI software, handing an attacker the same browser and file access the assistant itself holds.

Bruno DigitalRead news →
A Leaked Password and an AI-Written Script Pulled 8.8 Million Danes Out of a National Registry
Cybersecurity·43m ago

A Leaked Password and an AI-Written Script Pulled 8.8 Million Danes Out of a National Registry

Denmark's central population register leaked records on 8.8 million people after a private company's CPR lookup account, reportedly secured with the password 123456, was abused for three weeks with an AI-generated scraping script.

Bruno DigitalRead news →
IKEA Is Spending 31.5 Million Pounds to Cut Packaging Waste, and the Math Is About Boxes, Not Branding
Cybersecurity·43m ago

IKEA Is Spending 31.5 Million Pounds to Cut Packaging Waste, and the Math Is About Boxes, Not Branding

IKEA UK's new investment pairs size-to-fit packing technology with a regional fulfilment node near Doncaster, cutting void fill by up to 60 percent and delivery emissions by an estimated 280 tonnes of CO2 a year, a model built on logistics economics rather than sustainability messaging.

Bruno DigitalRead news →
Railway's Breach Shows Attackers Are Now Hunting AI Inference Providers, Not Just Their Customers
Cybersecurity·1d ago

Railway's Breach Shows Attackers Are Now Hunting AI Inference Providers, Not Just Their Customers

Railway told users to revoke every key after attackers reached decrypted environment variables, and the company believes the real target was AI inference infrastructure, not its own developer platform.

Bruno DigitalRead news →
Quest Diagnostics Discloses a Second Major Breach in a Decade, This Time Through Its Own Lab System
Cybersecurity·1d ago

Quest Diagnostics Discloses a Second Major Breach in a Decade, This Time Through Its Own Lab System

Quest Diagnostics told the SEC that attackers accessed patient records through Quanum, its own lab-ordering platform, making this one of the few major healthtech breaches this year that did not start with a third-party vendor.

Bruno DigitalRead news →
A Karaoke Machine Maker's Contractor Got Hit, and 8.7 Million People's Data Went Out the Door
Cybersecurity·2d ago

A Karaoke Machine Maker's Contractor Got Hit, and 8.7 Million People's Data Went Out the Door

A malware infection at Nippon Columbia, a contractor working for Japanese karaoke system maker Daiichi Kosho, exposed names, birth dates, and contact details for more than 8.7 million customers and employees who likely never heard of the contractor at all.

Bruno DigitalRead news →
Citizen Lab Found Spyware Hiding Inside Certified Ad Networks, and It Needed No Click to Infect a Phone
Cybersecurity·2d ago

Citizen Lab Found Spyware Hiding Inside Certified Ad Networks, and It Needed No Click to Infect a Phone

Researchers traced a mercenary spyware operation called AdFection to an Israeli ad-tech firm that had been certified by Google and IAB Europe, delivering zero-day exploits to targeted devices through nothing more than a displayed advertisement.

Bruno DigitalRead news →
Bitdefender Found Preinstalled Malware on Thousands of Android Phones, Signed by the Devices Themselves
Cybersecurity·2d ago

Bitdefender Found Preinstalled Malware on Thousands of Android Phones, Signed by the Devices Themselves

Researchers tracking a campaign they named Midnight Mimosa found low-cost MediaTek-based Android phones in more than 150 countries shipping from the factory with malware disguised as system components and signed with legitimate platform certificates.

Bruno DigitalRead news →
A Perfect 10.0 in GitLab's CI Engine Shows Why Your Build Pipeline Is a Crown Jewel Now
Cybersecurity·2d ago

A Perfect 10.0 in GitLab's CI Engine Shows Why Your Build Pipeline Is a Crown Jewel Now

CVE-2026-97229 scored the maximum possible CVSS rating, and Rapid7 reproduced arbitrary code execution on an unpatched GitLab server through nothing more than a crafted regular expression in a CI configuration file.

Bruno DigitalRead news →
A Year-Old Bug Bounty Report Shows How 1,500 npm Packages Could Be Hijacked Without Stealing a Single Credential
Cybersecurity·2d ago

A Year-Old Bug Bounty Report Shows How 1,500 npm Packages Could Be Hijacked Without Stealing a Single Credential

Bloom Security found that npm's Trusted Publishing feature trusted a repository's name instead of its permanent identity, letting anyone who claimed a freed repo slug earn a legitimate publish credential for someone else's package.

Bruno DigitalRead news →
PHP's Leaked Zero-Day Pair Goes From Patch to Live Attacks in Hours
Cybersecurity·2d ago

PHP's Leaked Zero-Day Pair Goes From Patch to Live Attacks in Hours

CVE-2026-109618 and CVE-2026-109619 leaked before PHP could ship a fix, and within hours of the patch landing, attackers were already probing live sites and rewriting payloads to dodge Cloudflare's default rules.

Bruno DigitalRead news →
Cisco Secure Email Gateway Faces Active Exploitation of a Root-Access Flaw With No Fix for Some Versions
Cybersecurity·3d ago

Cisco Secure Email Gateway Faces Active Exploitation of a Root-Access Flaw With No Fix for Some Versions

Cisco confirmed real-world attacks exploiting a critical flaw that lets an unauthenticated attacker write files to a Secure Email Gateway appliance via a crafted email attachment, and there is still no fixed build or workaround for AsyncOS 16.0.

Bruno DigitalRead news →