https://hard.fyi/ Everything HARD publishes: the journal, alerts, and advisories on software being used in attacks. en-au Fri, 23 Oct 2026 00:00:00 GMT https://hard.fyi/images/brand/apple-touch-icon.pnghttps://hard.fyi/ https://hard.fyi/journal/national-public-data-breach/ https://hard.fyi/journal/national-public-data-breach/ Fri, 23 Oct 2026 00:00:00 GMT Journal A background-check site you never signed up to may have held your Social Security number, and a criminal sold its data. What leaked, what the company said, how the numbers don't agree, and what to do today. https://hard.fyi/journal/23andme-data-breach/ https://hard.fyi/journal/23andme-data-breach/ Thu, 22 Oct 2026 23:00:00 GMT Journal Fourteen thousand accounts were opened with reused passwords. Through a sharing feature, millions more were exposed. What happened, what regulators found, and what to do now. https://hard.fyi/journal/bind-gss-tsig/ https://hard.fyi/journal/bind-gss-tsig/ Thu, 22 Oct 2026 23:00:00 GMT Journal BIND, the software that answers DNS lookups for much of the internet, has a memory flaw that could let an attacker take over the server. There's a fix, and no workaround. https://hard.fyi/journal/att-data-breach/ https://hard.fyi/journal/att-data-breach/ Thu, 22 Oct 2026 22:00:00 GMT Journal Two separate AT&T breaches in 2024 put the details of well over 100 million people in criminal hands. What happened, what the courts decided this month, and what to do if you were a customer. https://hard.fyi/journal/bind-gss-tsig/ https://hard.fyi/alerts/#bind-gss-tsig Thu, 22 Oct 2026 22:00:00 GMT Alert ISC disclosed CVE-2026-94300, rated 8.1: replayed or crafted GSS-TSIG messages can corrupt memory in BIND 9 and may allow remote code execution. No workaround, no known attacks yet. What to do: Ask whoever runs IT for you (company, family office, web host) whether they run BIND, and confirm it's on 9.20.30 or 9.21.27. https://hard.fyi/journal/rules-off-20-a-month/ https://hard.fyi/journal/rules-off-20-a-month/ Thu, 22 Oct 2026 04:00:00 GMT Journal A startup now rents out AI models with their safety rules removed. Signing up is free, there are no identity checks, and nothing you type is kept. https://hard.fyi/journal/ai-keys/ https://hard.fyi/journal/ai-keys/ Wed, 21 Oct 2026 23:00:00 GMT Journal Fireworks AI, OpenCode and now Railway. Three platforms in fifteen days, each breached for the same kind of thing: the keys their customers trusted them to hold. https://hard.fyi/journal/rules-off-20-a-month/ https://hard.fyi/alerts/#rules-off Wed, 21 Oct 2026 22:00:00 GMT Alert Abliteration.ai sells access to frontier AI models with their refusals removed, with a free sign-up, no identity checks and no record kept of what's asked. What to do: Nothing to change today. Make sure nobody moves money or shares a code because of a message alone: they call back on a number they already had. https://hard.fyi/journal/ai-keys/ https://hard.fyi/alerts/#ai-key-platforms Wed, 21 Oct 2026 22:00:00 GMT Alert Railway, a hosting platform popular with developers, says someone accessed the secrets customers store with it, some decrypted. It believes it's part of a series of attacks on platforms, aimed at AI providers, after Fireworks AI and OpenCode. What to do: If your company, family office or anyone building software for you uses Railway, OpenCode or Fireworks AI, ask them to change every stored key and password today, and to set spending limits on AI accounts. https://hard.fyi/journal/php2shell/ https://hard.fyi/alerts/#php2shell Wed, 21 Oct 2026 22:00:00 GMT Alert PHP, the language behind about 7 in 10 websites, released fixes on 21 October. Some security firms report early attacks; others, and the US agency CISA, haven't seen any. PHP 8.1 and older get no official fix. What to do: Ask anyone who runs a website for you whether it now runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or their vendor's fixed version. If it's on PHP 8.1 or older, ask for a plan to upgrade or take it offline. Ignore emails urging you to log in for a security update. https://hard.fyi/journal/php2shell/ https://hard.fyi/journal/php2shell/ Wed, 21 Oct 2026 10:00:00 GMT Journal Two critical flaws in PHP, the language behind most of the web, leaked before they could be fixed. Most families won't have to patch anything. The people they trust with their data will. https://hard.fyi/journal/guardrails-off-in-35-hours/ https://hard.fyi/journal/guardrails-off-in-35-hours/ Tue, 20 Oct 2026 22:00:00 GMT Journal DeepSeek released a new open AI model on 17 October. Less than a day and a half later, a version with its safety rules removed was online for anyone to download. https://hard.fyi/advisories/brave-chromium-152/ https://hard.fyi/advisories/brave-chromium-152/ Tue, 20 Oct 2026 00:00:00 GMT Advisory 1,086 security fixes behind, 41 critical. One of them is being used in attacks. Brave is built on Chromium, the open-source core of Google Chrome. Since Chromium 152, Google has fixed 1,086 security fixes in it, 41 rated critical and 284 high by Google. One of them is being used in attacks. https://hard.fyi/advisories/chrome-before-156-0-8078-47/ https://hard.fyi/advisories/chrome-before-156-0-8078-47/ Tue, 20 Oct 2026 00:00:00 GMT Advisory 353 security fixes in the latest release alone, 6 critical. Older than 153.0.8010.36: also flaws used in attacks. Chrome 156.0.8078.47 came out on 20 Oct 2026 with 353 security fixes, 6 rated critical and 61 high by Google. Any older Chrome is missing at least those, and Chrome older than 153.0.8010.36 is missing fixes for flaws being used in attacks. https://hard.fyi/advisories/electron-41/ https://hard.fyi/advisories/electron-41/ Tue, 20 Oct 2026 00:00:00 GMT Advisory No security fixes since 24 Aug 2026. Chromium has fixed 1,451 flaws since, 53 critical. Electron 41 stopped getting security fixes on 24 Aug 2026. Since then, Google has fixed 1,451 security fixes in Chromium, the browser engine inside every Electron app, 53 rated critical and 364 high by Google. Two of them are being used in attacks. https://hard.fyi/journal/guardrails-off-in-35-hours/ https://hard.fyi/alerts/#deepseek-abliterated Sun, 18 Oct 2026 22:00:00 GMT Alert 35 hours after DeepSeek released V4.1 Flash, a patch removing its refusals, including around cyber attacks, appeared on Hugging Face. What to do: Nothing to do today. Expect scam emails, texts and calls to keep getting more convincing. https://hard.fyi/cve/CVE-2026-86950/ https://hard.fyi/cve/CVE-2026-86950/ Tue, 29 Sep 2026 00:00:00 GMT Advisory A memory flaw in Apple's graphics code that lets a booby-trapped file run code. CISA added it to its list of flaws being used in attacks on 2026-09-29. Fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Tahoe 26.7.1, macOS Sequoia 15.8.1. https://hard.fyi/advisories/macos-sequoia-before-15-8-1/ https://hard.fyi/advisories/macos-sequoia-before-15-8-1/ Mon, 28 Sep 2026 00:00:00 GMT Advisory One security fix in 15.8.1, being used in attacks. More the further back you are. macOS Sequoia 15.8.1 came out on 28 Sep 2026 with one security fix, for a flaw being used in attacks. Any older macOS Sequoia is missing it, and the further back it is, the more it's missing. https://hard.fyi/cve/CVE-2026-87491/ https://hard.fyi/cve/CVE-2026-87491/ Wed, 09 Sep 2026 00:00:00 GMT Advisory A memory flaw in Chrome's JavaScript engine that lets a web page run code. CISA added it to its list of flaws being used in attacks on 2026-09-09. Fixed in Chrome 153.0.8010.36 (153.0.8010.37 on Mac), released 8 Sep 2026. https://hard.fyi/cve/CVE-2026-85046/ https://hard.fyi/cve/CVE-2026-85046/ Fri, 04 Sep 2026 00:00:00 GMT Advisory A flaw that makes Chrome's JavaScript engine mix up types of data, letting a web page run code. CISA added it to its list of flaws being used in attacks on 2026-09-04. Fixed in Chrome 152.0.7977.82 (152.0.7977.83 on Mac), released 3 Sep 2026. https://hard.fyi/cve/CVE-2026-65400/ https://hard.fyi/cve/CVE-2026-65400/ Tue, 18 Aug 2026 00:00:00 GMT Advisory A flaw in macOS Screen Sharing that lets an attacker on the network in without a password. CISA added it to its list of flaws being used in attacks on 2026-08-18. Fixed in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Golden Gate 27. https://hard.fyi/cve/CVE-2026-11645/ https://hard.fyi/cve/CVE-2026-11645/ Tue, 09 Jun 2026 00:00:00 GMT Advisory A flaw that lets Chrome's JavaScript engine reach memory it shouldn't, letting a web page run code. CISA added it to its list of flaws being used in attacks on 2026-06-09. Fixed in Chrome 149.0.7827.102 (149.0.7827.103 on Mac), released 8 Jun 2026.