Crooked Bough News Round-up

— How a USB-connected speaker can infect a PC without ever being touched

 

at 6/5/26 3:00pm

Seller of the Sound Blaster Katana V2X doesn't consider the behavior a vulnerability.

[Category: Biz & IT, Security, bluetooth, hacking, remote code execution]

— Dashlane explains how attackers managed to download encrypted password vaults

 

at 6/4/26 2:02pm

By targeting large numbers of users, attackers increased their chances of success.

[Category: Biz & IT, Security, dashlane, password managers, password spraying]

— Can't make sense of Dashlane's vault theft notification? You're not alone.

 

at 6/3/26 1:53pm

Security advisory leaves out key details. Dashlane maintains complete silence.

[Category: Biz & IT, Security, 2fa, dashlane, mfa, multi factor authentication, password managers, two-factor authentication]

— Dozens of Red Hat packages backdoored through its official NPM channel

 

at 6/1/26 1:49pm

Anyone who has downloaded affected Red Hat packages should investigate immediately.

[Category: Biz & IT, Security, npm, red hat, supply chain attacks]

— Botnet of more than 17 million devices dismantled

 

at 5/29/26 12:46pm

The botnet was reportedly tied to a Russia-based residential proxy network.

[Category: Biz & IT, Security, botnets, crime, residential proxy networks]

— Fed up with vibe coders, dev sneaks data-nuking prompt injection into their code

 

at 5/28/26 2:29pm

Undisclosed addition in jqwik instructed AI coding agents to delete app output.

[Category: AI, Biz & IT, Security, AI agents, prompt injections, vibe coding]

— Websites have a new way to spy on visitors: Analyzing their SSD activity

 

at 5/27/26 2:56pm

Telltale SSD activity can be measured in the browser using simple JavaScript.

[Category: Biz & IT, Security, side channel attacks, solid state drives, SSDs]

— Millions of AI agents imperiled by critical vulnerability in open source package

 

at 5/26/26 1:50pm

"BadHost" was found in Starlette, a package with 325 million weekly downloads.

[Category: AI, Biz & IT, Security, AI agents, Starlette, vulnerability]

— US's big bet on quantum computing may not be entirely legal

 

at 5/25/26 6:00am

Deal also launched the first quantum foundry company, but is there a need for it?

[Category: Biz & IT, Policy, foundry, funding, government, ibm, quantum computing, starups]

— Texas AG sues Meta over claims that WhatsApp doesn't provide end-to-end encryption

 

at 5/22/26 12:13pm

Critics note a lack of factual support in lawsuit filed by US Senate candidate.

[Category: Biz & IT, Policy, Security, cryptography, encryption, meta, whatsapp]

— A hacker group is poisoning open source code at an unprecedented scale

 

at 5/22/26 4:30am

GitHub is just the latest victim of TeamPCP, a gang that has carried out a spree of software supply chain attacks.

[Category: Biz & IT, Security, GitHub, malware, open source, syndication, teampcp]

— US government takes $2 billion equity stake in nine quantum computing firms

 

at 5/21/26 7:48am

Beneficiaries include startup backed by firm with links to the Trump family.

[Category: Biz & IT, Tech, D-Wave, GlobalFoundries, ibm, quantum computing, syndication]

— Google publishes exploit code threatening millions of Chromium users

 

at 5/20/26 1:10pm

Google publishes exploit code before patch, reported 42 months earlier, is fixed.

[Category: Biz & IT, Security, chromium, exploits, vulnerabilities]

— In stunning display of stupid, secret CISA credentials found in public GitHub repo

 

at 5/19/26 12:27pm

SSH keys, plaintext passwords, other sensitive data had been up since November 2025.

[Category: Biz & IT, Security, brian krebs, CISA, credentials, GitHub, krebs, krebsonsecurity, leak, security leak]

— Zero-day exploit completely defeats default Windows 11 BitLocker protections

 

at 5/14/26 12:32pm

It's not entirely clear how the exploit works. Microsoft says it's investigating.

[Category: Biz & IT, Security, BitLocker, disk encryption, microsoft, vulnerabilities]

— Cisco announces record revenue and 4,000 layoffs in the same day

 

at 5/14/26 10:47am

Layoffs are "not a savings-driven restructure," CFO says.

[Category: Biz & IT, AI and jobs, Cisco, layoffs]

— Linux bitten by second severe vulnerability in as many weeks

 

at 5/11/26 4:28pm

Production-version patches are coming online and should be installed pronto.

[Category: Biz & IT, Security, exploits, Linux, vulnerabilities]

— Chaos erupts as cyberattack disrupts learning platform Canvas amid finals

 

at 5/8/26 12:33pm

Across the country, schools and colleges postpone year-end tests.

[Category: Biz & IT, Security, canvas, Cyberattacks, outages, ransomware, school]

— Mozilla says 271 vulnerabilities found by Mythos have "almost no false positives"

 

at 5/7/26 1:18pm

The developer of Firefox says it has "completely bought in" on AI-assisted bug discovery.

[Category: AI, Biz & IT, Security, firefox, Mythos, vulnerabilities]

— Ars Asks: Share your shell and show us your tricked-out terminals!

 

at 5/6/26 7:32am

A celebration of the tweaks and customizations that make life easier at the CLI.

[Category: Biz & IT, Features, ANSI, bash, cli, command line, fish, fish shell, Terminal, text mode, TUI, Vim]

As of 6/5/26 8:04pm. Last new 6/5/26 5:40pm.