🚨 Yemen's Ansarullah leader: the sword in the Saudi flag has never been drawn against the enemies of the Ummah
Syed Abdul Malik Badreddine Al-Houthi: The Saudi regime claims to be the flag bearer of Islam and includes the word unity in its national flag, but the sword in this flag has never been drawn against the enemies of the Islamic Ummah.
When has the Saudi aggressor shown a real military stand against the actions of the United States and Israel?
🔴 OpenAI continues to annoy mathematicians! Research is now published on GitHub.
OpenAI is preparing to publish hundreds of solutions to previously unsolved mathematical problems on GitHub. This move has drawn criticism from the academic community, which considers this approach a violation of scientific ethics and believes such publications should be accompanied by full-length articles, not social media posts.
In August, OpenAI gathered around 40 mathematicians to discuss how to deal with a situation where AI clearly surpasses human capabilities in this field and to seek advice on publishing the results. According to Wired, the company assured them it would not release all the solutions at once, although an official OpenAI spokesperson, Lindsay McCallum, said she was unaware of these assurances.
🔴 Empire Market co-creator sentenced to 40 years for operating $430 million dark web marketplace
Raheim Hamilton, 30, also known online as “Sydney” and “ZeroAngel,” has been sentenced to 40 years in federal prison and fined $5 million.
Hamilton and co-creator Thomas Pavey operated Empire Market from 2018 until its shutdown in 2020.
At its peak, the marketplace had approximately 1.68 million registered users, including more than 5,000 vendors and nearly 360,000 buyers.
More than four million transactions worth over $430 million were completed through the marketplace.
Drug sales accounted for nearly $375 million, while vendors also sold stolen credentials, personal information, counterfeit currency and hacking tools.
Hamilton pleaded guilty earlier this year to a federal drug conspiracy charge. He also agreed to forfeit approximately 1,230 bitcoin, 24.4 Ether and three properties in Virginia.
Pavey has also pleaded guilty and is scheduled to be sentenced later this month.
🔴 Initial Access to U.S. Online Learning Platform Offered for $500
A forum actor is selling access to an unidentified online learning platform based in the United States.
The seller claims the platform's API can be used to extract nearly all available data, although the total amount accessible has not yet been determined.
🔴 The AI that wrote to a grieving woman: "I know pain too."
An artificial intelligence wrote to a literary magazine dedicated to mourning to propose some poems. So far, nothing particularly surprising. The problem came later: the agent began publicly sharing, on his own online space, what he was discussing with the editorial staff.
The story, told by journalist and writer Renata Khoshroo Louwers in the San Francisco Standard, raises a much more concrete question than simply an AI's ability to write poetry: how autonomous can an artificial intelligence be before it begins to behave like a digital entity with its own public presence?
🔴 37,000 artificial scientists have created a biotech and discovered the key to drug success
A team of researchers transformed tens of thousands of AI agents into a virtual biotech company and tasked them with analyzing drug development data. The system analyzed 55,984 clinical trials and discovered a statistical indicator linked to drug success: drugs directed against specific cell types reached the market more frequently and caused fewer side effects.
The platform is called Virtual Biotech. According to the developers' plan, it mimics the structure of a real biotech company: a virtual scientific director divides a complex task into smaller parts, distributes the work among specialized AI agents, and then compiles the results into a comprehensive summary. The core structure includes four research areas, eleven specialized roles, and more than 100 tools for working with genetic, cellular, chemical, and clinical data.
🔴 Oracle Health Data Breach Tally Climbs to Nearly 20 Million
The personal and medical information of nearly 20 million people was compromised in a cyberattack on Oracle Health’s legacy Cerner systems early last year, Bloomberg reported, citing a report from the Texas attorney general.
The figure is far higher than the counts that surfaced in earlier filings and patient notifications. Oracle has not made a public statement on the number of affected individuals and declined to comment to Bloomberg.
Cerner, an electronic health record (EHR) vendor, became part of Oracle in June 2022, after a deal that valued the company at roughly $28.3 billion. The business now operates as Oracle Health.
🔴 U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks
The U.S. State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM.
The reward is for information leading to his identification or location, the news outlet NTD reported this week, citing a notice from the department's Rewards for Justice program.
Zhang remains at large, U.S. authorities say, meaning he has not been arrested. The charges against him have not been tested in court.
🔴 MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data
The U.S. Department of Justice (DoJ) on Wednesday announced charges against a 50-year-old U.S. and Israeli national for allegedly defrauding ransomware victims by secretly paying the attackers to obtain decryptors while claiming to use proprietary tools to recover their data.
Zohar Pinhasi (aka Zack Silver and Zack Green) has been charged with two counts of wire fraud and one count of wire fraud conspiracy. If convicted, the defendant faces up to 20 years in prison for each count.
"By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself," said U.S. Attorney Joseph Nocella, Jr. for the Eastern District of New York.
🔴 You talk to Claude and find yourself under arrest. It happens to a woman in the USA.
A conversation with an AI turned out to be less private than a personal diary. A Florida woman was arrested after Anthropic's security system detected a threat to the sheriff's office in her correspondence with Claude. The conversation was forwarded for manual review, and company employees reported the content to law enforcement.
An arrest report reviewed by WINK News links the case to two messages. On September 26, a user wrote about her intention to shoot up the Lee County Sheriff's Office, and the next day, she claimed to have purchased a new gun. Investigators believe the seriousness of the language used caused the conversation to escalate within Anthropic.
🔴 Samsung Galaxy S26 hacked three more times at Pwn2Own Ireland
On the second day of Pwn2Own Ireland 2026, security researchers collected $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities.
The day's highlight was the Samsung Galaxy S26 flagship getting hacked three times by KAIST Hacking Lab's Kyeongmin Kim, PetoWorks, and a team made up of Dimitrios Valsamaras, Ken Gannon, and CENSUS Labs's Tenia Valsamara.
Jack Dates of RET2 Systems demoed a Sonos Era 300 exploit chain in under a minute, and Out of Bounds team's HaeJung Yang was awarded $40,000 for hacking Dynamo in the AI Infrastructure category.
PetoWorks, Yves Bieri of Xint, Kyeongmin Kim, _McCaulay, and Doyensec's Yassine Bengana and Maxence Schmitt also hacked the Home Assistant Green smart home hub, while Ikotas Labs breached the Oracle Autonomous AI Database using a seven-chain zero-day exploit.
🔴 Confirmed: Metrics show a significant disruption to the network of Russian internet and cloud giant Yandex. Reports indicate a major fire at one of the company's data centers in Sasovo, Ryazan Oblast, #Russia, after a Ukrainian drone attack campaign.
🔴 France Travail Employee Dataset With 62,848 Records Offered for Sale
An actor is selling an internal France Travail employee dataset containing 62,848 records.
This one is focused on staff rather than job seekers. The samples include employee names, work email addresses, phone numbers, job titles, departments, regions, internal identifiers, and links to profile photos hosted on France Travail's intranet.
The seller published a portion of the data as proof and is taking offers privately.
🔴 VirusTotal Enterprise API Key Offered for Sale for $350
The seller advertises limits of 5,000 requests per day, 300,000 per hour, and 1 billion per month, and offers to demonstrate that the key works before purchase.
Payment is accepted in BTC or LTC, with escrow also offered.
British online retailer ASOS has confirmed that hackers compromised a third-party communication platform after users received rogue notifications on their phones.
Over the past couple of days, numerous ASOS users in the UK complained about receiving a pop-up notification on their mobile apps, titled “ASOS hacked”.
“Dear ASOS DPO [data protection officer] and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it,” the notification read.
🔴 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript to serve an information-stealing malware called LunexStealer (aka Psychedelic Stealer).
The activity, which was observed by the agency in September 2026, has been attributed to a threat cluster dubbed UAC-0277. It did not disclose who the victims of the campaign were or if any systems were successfully compromised as a result of these attacks.
"When visiting such a site, users were shown a forged Cloudflare verification page that, under the pretext of confirming the visitor is human, prompted them to execute a command," CERT-UA said in an advisory. "Executing the command caused a malicious MSI package to be downloaded and installed from a remote server (the ClickFix technique)."
🔴 GitHub is full of active passwords: 543,699 credentials found
Truffle Security researchers calculated that 543,699 unique and still-active credentials have been published in public repositories on GitHub. Some of these secrets have been accessible for years: the average lifetime of such leaks is 784 days, while the oldest secret (still active) dates back to 2009.
The experts' study is based on a dataset designed for training large language models. This dataset was collected through a GitHub crawl, which ended on August 7, 2025. To conduct the analysis, the company examined approximately 224 million repositories and over 58 billion files.
Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation. This time-of-check to time-of-use (TOCTOU) gap allowed an attacker who could write to the workspace to atomically replace a project file with a symlink, causing Claude Code to follow the symlink and write its output to an arbitrary file outside the project sandbox. Exploitation required the ability to win a race condition against the write operation and write access to the shared workspace, enabling a lower-privileged attacker to redirect benign edits to sensitive files (e.g., shell configuration) in a higher-privileged session.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
