Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog – Page 4

Get the latest international news and world events from around the world.

Log in for authorized contributors

PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026–111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.

PHP says the flaw can be reached through the cURL extension when the extension decompresses HTTP responses automatically. cURL leaves that off by default, but applications and HTTP client libraries can turn it on.

The rebuilt packages, numbered 8.5.12–1, 8.4.27–1, 8.3.36–1 and 8.2.35–1, come five days after the October 21 releases that fixed the two PHP2Shell remote code execution flaws. They use the same PHP source, so those fixes stay in place, and they now include Brotli 1.2.1, the fixed version.

UCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies of the two apps, researcher Ovi found. It only reaches people who install one of these tampered copies, spread outside the official app stores, or who run WeChat inside the kit makers’ own container app.

The kit’s Telegram part matches Baohuo, a backdoor that Doctor Web reported in October 2025. Doctor Web found Baohuo in tampered copies of Telegram X, an Android app from Telegram. At the time, the company estimated that more than 58,000 devices were infected.

The Hacker News compared the two reports. Doctor Web’s technical description of Baohuo lists the same code namespace, com.ucreator.tgjar, the same command-and-control (C2) server, and matching command names as Ovi’s analysis.

‘Gheist’ Weaponizes GitHub Tokens to Steal Cloud Secrets

An ongoing attack is abusing compromised GitHub tokens to harvest cloud secrets and credentials from thousands of developer repositories, bringing into focus how compromised developer accounts can provide a gateway into enterprise cloud environments.

Dubbed “Gheist,” the campaign has left more than 13,500 malicious branches — or versions of a project’s code — across more than 850 compromised GitHub accounts, according to a report published over the weekend by Wiz Research.

The campaign affects everything from personal projects to private enterprise repositories, although public repositories are protected by safeguards GitHub introduced in July, according to the report.

Implantable device uses ultrasound to improve drug delivery to the brain

Patients with glioblastoma, an aggressive type of brain tumor, usually undergo surgery to remove the tumor. However, it’s difficult for surgeons to remove all of the cancer cells, and the tumor often recurs.

MIT researchers have now designed an implantable drug-delivery device that they hope could help prevent recurrence of glioblastoma. Their device contains a reservoir that can release drugs over an extended period, along with ultrasound transducers that use sound waves to help drugs spread farther through the brain and bypass the blood-brain barrier.

Such a device could be implanted in the brain during surgery, then gradually release drugs that would help kill the remaining tumor cells. After implantation, a wireless controller can be used to program the exact ultrasound dosages to be delivered, enhancing the reach of the delivered therapy.

JWST and ALMA reveal a dusty, rapidly growing black hole in the early universe

A new study reveals a dust-reddened quasar from a time when the universe was less than a billion years old. Located at a redshift of 6.5488, the object J1440+0019 contains a rapidly accreting supermassive black hole with a mass of about 1.1 billion suns. The paper was posted to the arXiv preprint server on Oct. 9.

Cosmic reionization is estimated to have happened roughly between 600 million and a billion years (redshifts 6 to 8) after the Big Bang. This epoch is when ionizing UV radiation from early stars and galaxies converted the universe’s neutral hydrogen gas into the ionized state seen today. Studying quasars and galaxies from this era can put a limit on the redshift at which it occurred.

Most quasars from this period are identified by their bright rest-frame ultraviolet light. This method may fail for quasars with even modest dust reddening—their UV emission may be heavily blocked by the surrounding dust envelope. Previous studies suggest that a large fraction of early active galactic nuclei (AGN) are obscured. Only a handful of reddened quasars are known at redshifts around and beyond 6, and they were found by different methods.