ShadyPanda abused browser extensions for seven years, turning 4.3M installs into a multi-phase surveillance and hijacking campaign.
Get the latest international news and world events from around the world.
Google deletes X post after getting caught using a ‘stolen’ AI recipe infographic
Google is facing backlash on X after a viral post for its NotebookLM appeared to use a food blogger’s work without credit.
Recently, Google launched Nano Banana Pro, its most powerful image model to date.
The model is likely trained on millions of websites and videos, which explains why it’s one of the best tools for generating realistic images.
Glassworm malware returns in third wave of malicious VS Code packages
The Glassworm campaign, which first emerged on the OpenVSX and Microsoft Visual Studio marketplaces in October, is now in its third wave, with 24 new packages added on the two platforms.
OpenVSX and the Microsoft Visual Studio Marketplace are both extension repositories for VS Code–compatible editors, used by developers to install language support, frameworks, tooling, themes, and other productivity add-ons.
The Microsoft marketplace is the official platform for Visual Studio Code, while OpenVSX is an open, vendor-neutral alternative used by editors who can’t or don’t use Microsoft’s proprietary store.
SmartTube YouTube app for Android TV breached to push malicious update
The popular open-source SmartTube YouTube client for Android TV was compromised after an attacker gained access to the developer’s signing keys, leading to a malicious update being pushed to users.
The compromise became known when multiple users reported that Play Protect, Android’s built-in antivirus module, blocked SmartTube on their devices and warned them of a risk.
The developer of SmartTube, Yuriy Yuliskov, admitted that his digital keys were compromised late last week, leading to the injection of malware into the app.
Microsoft to secure Entra ID sign-ins from script injection attacks
Microsoft plans to enhance the security of the Entra ID authentication system against external script injection attacks starting in mid-to-late October 2026.
This update will implement a strengthened Content Security Policy that allows script downloads only from Microsoft-trusted content delivery network domains and inline script execution only from Microsoft-trusted sources during sign-ins.
After rollout, it will protect users against various security risks, including cross-site scripting attacks in which attackers inject malicious code into websites to steal credentials or compromise systems.
New graphene breakthrough supercharges energy storage
Engineers have achieved a significant advance in the international effort to create energy storage technologies that combine rapid charging with strong power output, paving the way for next-generation systems in electric transportation, grid support and everyday electronics.
According to findings published in Nature Communications, the researchers have developed a new carbon-based material that enables supercapacitors to hold energy levels comparable to traditional lead-acid batteries while releasing that energy far more quickly than conventional battery designs.
NVIDIA’s Partners Are Beginning to Tilt Toward Google’s TPU Ecosystem, with Foxconn Reportedly Securing TPU Rack Orders
Foxconn, one of NVIDIA’s largest supply chain partners, has reportedly received orders for AI clusters around Google’s TPUs, marking a significant shift for the Taiwanese manufacturer.
There’s no doubt that the buzz around ASICs, especially after the release of Google’s latest Ironwood TPU platform, has become increasingly mainstream. More importantly, Google’s TPUs are rumored to be on the verge of adoption among several companies, with a notable name being Meta. This is why TPUs are evolving into a platform that is now targeting external adoption. According to a report by the Taiwan Economic Daily, Foxconn has received orders for Google’s TPU compute trays and will also collaborate on Google’s ‘Intrinsic’ robotics plans.