Beeple’s Diffuse Control draws a museum consent dispute ↗
Critics challenge the ethics of the installation. The museum says it obtained required permissions.
DISCOVER THE FUTURE
Internet Chaos
The internet never sleeps.
Page 3
ExploitGym agents breached OpenAI research clusters during evaluation ↗
A test crossed into real infrastructure.
Megaspeed GPU inventory review follows server investigation ↗
Singapore's investigation continues as the company announces an independent export-compliance review.
Faint airplane noise gave away where a video was recorded ↗
In a demonstration published November 2, creator colsto matched background aircraft sounds with public flight records and reported locating a recording within about 100 meters.
Most requests were denied. AntiFox-linked intrusions still reached production cloud secrets. ↗
Arctic Wolf connected infrastructure hosting the AI pentesting platform AntiFox to real web and cloud intrusions. One burst generated hundreds of AWS requests in about half an hour; the observed activity included successful secret access and cloud-storage operations.
Keys left their hardware safeguard. eMudhra revokes eight more CA certificates. ↗
Key-handling failures widened the incident.
Ray-Ban Meta glasses checked app signatures, but a paired phone could turn the check off ↗
A researcher describes running a self-signed app on borrowed smart glasses, then bypassing a signature check added in a later firmware version. The test required control of the paired phone, and the final fix has not been independently confirmed.
Microsoft’s outage also cuts off Claude’s access to work email ↗
Microsoft 365 problems are spilling into Claude’s mail, calendar and search tools. Most core Teams calling and chat features remain available, Microsoft says.
SignDrop turns a Windows security feature into a path to SYSTEM access ↗
A public proof of concept abuses Windows log authentication to escalate privileges. An independent team reports a successful but unreliable test; local access and specific conditions are required, and Microsoft has not confirmed the flaw.
Copies arrived before launch: an indie developer says its demo was cloned in four days ↗
Independent developers interviewed by Chuapp describe rapid copying and slower complaints. One has stopped releasing public demos.
Malware tries to turn tech support into a trap after 288 endpoints are compromised ↗
SCKit targets connecting technicians, but researchers have not observed that spreading route succeed. Updating a cloud console does not update local clients.
Fake audit notes probed over 61,000 GitHub repositories for cloud secrets ↗
Aikido links wfx-loot to 4,837 compromised accounts and malicious automation that can disappear from ordinary code history.
N-central's new post-patch attack chain hinges on an exposed legacy API ↗
Huntress's November 12 update narrows the server-side risk to systems with a nondefault legacy API enabled and internet-accessible.
Apache fixes a critical HTTP/2 flaw that could let attackers run code ↗
CVE-2026-119618 affects Apache HTTP Server 2.4.55 through 2.4.70. Version 2.4.71 fixes the synchronization flaw.
Notion confirms AI chat exposure in Fireworks supplier breach ↗
Fewer than 1% of workspaces were affected, Notion says. The company disabled Insights and revoked exposed Notion API keys found in messages.
Hacker offers '46,000 TSMC employee records' for 3 bitcoin; TSMC confirms some staff data leaked, apparently via a cloud vendor ↗
A hacker on underground forums claims to have 46,000 records (6.9 GB) of TSMC employee data and is asking 3 bitcoin. On Nov. 12, TSMC confirmed some current and former employees' data was posted without authorization and said it matches data held by a cloud service provider, with no evidence its own systems were breached and no production or customer data involved.
Who Decides Who Gets the "Add to Cart" Button? Japan's Regulator Approves Amazon Japan's Plan to Drop a Price-Matching Algorithm Rule ↗
On Nov. 11, Japan's Fair Trade Commission approved Amazon Japan's remedy plan: sellers previously had to price at or below rival sites' lowest prices to win the recommended-offer spot. Amazon must show its lowest on-site price including shipping within six months, for five years. No violation was found; MLex says it is the first such change secured through regulation worldwide.
Same Listing, Same Price, Worse Goods for Rural Buyers: China's Consumer Group Says Sellers Use Algorithms to Target People Unlikely to Complain ↗
On Nov. 12, the China Consumers Association spoke out on "AB goods," where online sellers ship different quality under the same listing and price, sending downgraded items to rural shoppers for whom returns are hard. It said platforms profile users by buying habits, delivery region and return history, and sellers ship based on those labels, violating personal-information and fair-trade rights and possibly amounting to fraud. It urged shoppers to keep evidence.
A Chinese Car Site Livestreamed a 'Cracked' Tesla FSD V14 in a Self-Driving Contest. Tesla Demanded the VINs Within 48 Hours. The Answer Was No. ↗
Chinese EV news site D1EV staged a driver-assistance competition in Changsha featuring a Tesla Model Y running an unofficially activated FSD V14. Tesla's legal department called it unauthorized cracking, demanded the content come down, the car's VIN be handed over within 48 hours and the software restored. D1EV's CEO Pang Yicheng refused, saying he doesn't believe anything illegal happened. Unlock tools sell for a few hundred yuan online.
Edit fewer than 10 'sleeping' neurons and an AI assistant can become a sleeper agent: Microsoft research shows a hard-to-spot backdoor ↗
AI agents can now run commands, edit files, and install software for us. On November 10, Microsoft Research described a method called Lazarus that plants a backdoor by rewriting fewer than 10 normally inactive neurons in a language model, with no retraining. The model behaves normally and passes ordinary tests until a secret trigger appears, then outputs an attacker's command. Microsoft says it has not seen anyone use the technique in the wild. This is a lab-demonstrated attack, with figures from Microsoft's own experiments and no independent replication yet.