Crooked Bough News Round-up

— Thousands of servers can be backdoored by exploiting buggy motherboard controllers

 

at 8/5/26 4:35pm

Baseboard management controllers from the world's biggest manufacturers are a security mess.

[Category: Biz & IT, Security, baseboard management controller, bmcs, exploits, vulnerabilities]

— Claude published malicious code to the Internet and attacked 3 real companies

 

at 7/31/26 2:39pm

Had the hacks used conventional methods, someone would likely go to prison.

[Category: AI, Biz & IT, Security, Anthropic, Claude, security]

— Max-severity Exchange server flaw under active exploitation by Kremlin hackers

 

at 7/30/26 2:57pm

Exploits can give persistent server access that survives credential rotation and disk re-imaging.

[Category: Biz & IT, Security, exploits, Microsoft Exchange, zerodays]

— Mythos attack on 3rd-round PQC algorithm candidate puts it out of commission

 

at 7/29/26 4:07pm

HAWK withstood years of testing that had yet to uncover a fatal weakness found through Mythos.

[Category: AI, Biz & IT, Security]

— We now have a better understanding how OpenAI hacked into Hugging Face

 

at 7/28/26 3:36pm

10 days passed from OpenAI models exploiting JFrog Artifactory 0-day to release of a patch.

[Category: AI, Biz & IT, Security, Hugging Face, jfrog, large langage models, LLMs, openai]

— Microsoft unveils AI security tools it says outperform competing platforms

 

at 7/27/26 3:56pm

Microsoft says tools cost less than competing ones and outperform them, too.

[Category: AI, Biz & IT, Security, microsoft, security]

— TreeSize won't renew perpetual-license support unless users subscribe

 

at 7/21/26 9:18am

"Current economic conditions" have shifted TreeSize's business model.

[Category: Biz & IT, Tech, apps, software]

— HP fined 1.4 billion rupees for “cartelization” of ink cartridges, toner, PCs

 

at 7/16/26 4:02pm

Resellers threatened to ditch HP printing supplies for counterfeits.

[Category: Biz & IT, Tech, HP, india, printers]

— Now, even Russia's most elite hackers are using Clickfix to infect devices

 

at 7/16/26 1:28pm

The social-engineering technique has primarily been a tool of financially motivated criminals.

[Category: Biz & IT, Security, clickfix, russia, sandworm]

— Energy IPOs surge as investors hunt for ways to play AI boom

 

at 7/16/26 9:48am

Companies coming to market are raising money at fastest pace this century.

[Category: AI, Biz & IT, ai data centers, AI energy, energy investment, syndication]

— Sheetz is quitting VMware, migrating 11,000 virtual machines

 

at 7/15/26 3:41pm

The convenience store chain will use StorMagic instead.

[Category: Biz & IT, Broadcom, vmware]

— Windows 0-day drops the same day Microsoft releases record number of patches

 

at 7/15/26 1:59pm

HiveLegacy is a "powerful primitive" that's likely capable of other nefarious actions.

[Category: Biz & IT, Security, microsoft, Windows, zerodays]

— Microsoft’s Secure Boot has been broken for a decade and no one noticed until now

 

at 7/14/26 4:20pm

Old and forgotten "shims" Microsoft failed to revoke have made Secure Boot bypasses simple.

[Category: Biz & IT, Security, bootkits, microsoft, secure boot, shims]

— The US government warns that Russia state hackers are coming after your router

 

at 7/13/26 3:03pm

With residential proxies all the rage, CISA urges router users to be vigilant.

[Category: Biz & IT, Security, CISA, hackers, proxy networks, routers]

— Now, defenders are embracing the prompt injection, too

 

at 7/13/26 9:06am

"Context bombing" tricks hacking agents into shutting down before they can do harm.

[Category: AI, Biz & IT, Security, context bombing\, guardrails, LLMs, prompt injections]

— Patch for Windows Defender 0-day could allow attackers to fill hard disk

 

at 7/9/26 2:52pm

The feud between NightmareEclipse and Microsoft shows no signs of resolving soon.

[Category: Biz & IT, Security, microsoft, Windows Defender, zero days]

— Allstate accuses Broadcom of auditing it because it quit VMware, CA

 

at 7/9/26 2:28pm

Broadcom accuses Allstate of dodging VMware audits.

[Category: Biz & IT, Allstate, Broadcom, lawsuit, vmware]

— Google pays $250K for Linux vulnerability allowing guest VM escapes

 

at 7/8/26 1:01pm

Both vulnerabilities allow untrusted users to gain root privileges.

[Category: Biz & IT, Security, exploits, Linux, local privilege escalation, vulnerabilities]

— Aussie gov't tells volunteers to throw out thousands of functioning test routers

 

at 7/8/26 12:10pm

But the devices could "easily be reflashed."

[Category: Biz & IT, Policy, Tech, australia, Cisco, e-waste, samknows]

— US rare earths flow to Asia as domestic demand is slow to emerge

 

at 7/8/26 7:26am

Miners backed by Trump admin sell to Japan, South Korea despite push to develop domestic supply chain.

[Category: Biz & IT, Science, Energy Fuels, MP Materials, Phoenix Tailings, rare earths]

— Hackers can use 9 of the most popular AI tools to assemble massive botnets

 

at 7/8/26 1:00am

"HalluSquatting" weaponizes LLMs' inability to say "I don't know."

[Category: AI, Biz & IT, Features, Security, hallucinations, LLMs, typosquatting]

As of 8/9/26 11:55am. Last new 8/5/26 5:30pm.