Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

The BUDA framework enhances deception operations by automating the simulation of realistic user behaviors and profiles within decoy environments to mislead attackers.

Microsoft uncovered SesameOp, a malware using the OpenAI Assistants API for covert C2. It exploits a legitimate cloud platform to evade detection and maintain stealthy access.

Huawei unveiled Qingyun W515y/W585y desktops for the Chinese market, featuring the unreleased Kirin 9000X chip and running Tongxin UOS or Galaxy Kylin Linux OS.

Criminals are exploiting logistics platforms with RMM tools (ScreenConnect, SimpleHelp) to win freight tenders and physically reroute/hijack cargo shipments in North America.

The Balancer DeFi protocol was breached, losing over $120 million in crypto (mostly ETH) due to an access control flaw. Affected liquidity pools have been suspended.

OpenAI officially launched Sora for Android, allowing users to create 30 free AI-generated videos daily. The app includes audio mixing and voiceover features.

Apple is preparing an affordable MacBook model (codenamed J700) with a 12-inch LCD screen & A-series chip to compete with Chromebooks. Expected launch in 2026.

Google announced Project Suncatcher: an ambitious plan to launch TPU-equipped satellites to perform AI computing in space, harnessing limitless solar power and low temperatures.

Apple failed to disable SourceMap in its new App Store web version, inadvertently leaking the entire Svelte/TypeScript front-end codebase to the public.

Ubuntu 26.04 LTS release schedule finalized: Feature freeze Feb 19, 2026; final stable release April 23, 2026. LTS users must wait until Aug 6, 2026, to upgrade.

Microsoft fixed a bug incorrectly showing Windows 10 LTSC and ESU users that support ended. A cloud-based rollback corrects the policy automatically via the internet.

Meta launched a native WhatsApp app for Apple Watch (watchOS 10+). Users can now view full messages, send voice notes, and use E2EE without the iPhone.

A Critical (CVSS 9.8) Auth Bypass in AI Engine is actively exploited. The flaw exposes the MCP bearer token via the REST API when No-Auth URL is enabled, allowing admin takeover.

✨ Link for the full article in the first comment

How stale refresh tokens quietly keep attackers (and bugs) logged in — and what to do about it

🙋‍♂️ About Me

Hey there!😁

Yes — your first real bug is closer than you think. Not some textbook nonsense, not a contrived lab — a bug on a live program that was…

Learn how inconsistent cache key handling across layers can expose modern web applications to hidden injection risks.

I highly recommend that you read my previous Spark AR write up, while the two bugs are not related, the other post contains more…