Tootfinder

Researchers are paid $5K for reporting a bug to OpenAI that would let attackers run code in logged-in sessions of all who opened the hacker's ChatGPT share link (Swati Khandelwal/The Hacker News)
https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.htm…

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
OpenAI fixed a P1 ChatGPT flaw that let malicious shared links execute code in signed-in sessions and access private conversations.

„Wir appellieren an dieser Stelle eindringlich an alle, dass sie Inhalte, die dem Daten-Diebstahl zugeordnet werden, weder nutzen, noch verbreiten.“
Großes Ehrenwort.
https://www.heise.de/news/Offene-Fragen-nach-dem-AfD-Leak-11496176.html

I am still not using passkeys unless I get forced to. Strong #passwords are enough for me. I try to avoid any phone number based 2nd factor but in general am a fan of 2nd factor for important sites.
This seems like a good article for those seeking info
"Keep using passkeys! Wherever a site offers one, take it, and store it in a password/passkey manager you trust. If you want to…

Passkeys Are Not a Trap
A post called Passkeys are a trap. Do not use them. has been doing the rounds over the last few days, making it pretty high on Hacker News, and I've had it sent to me many times with an 'is this true?' kind of vibe. It's written for

Don't miss today's Metacurity for the cyber insights in Anthropic's IPO filing and other critical infosec developments you should know, including
--AI agents breach Anthropic’s internal systems,
--Cyber incident disrupts New Mexico’s only Level 1 trauma center,
--Cleveland hospital cyber incident delays care,
--South Korean hacking ring uses AI to breach 90-plus organizations,
--Critical Brotli flaw sparks emergency patches,
--Japanese firms pledge payouts after cyberattacks,
--Hacker drains nearly $1m from Telegram trading bot,
--CISA unveils its 2030 cyber defense roadmap,
--Senators accuse administration of withholding surveillance ruling,
--Microsoft Authenticator flaw lets rogue apps steal work tokens,
--Sony pays hacker $50k for PS5 exploit,
--UK police and fire services urged to bolster cyber defenses,
--Apple patches exploited zero-day on older devices,
--Gen Z pushes back against big tech,
--AI news feeds serve slop in place of journalism
https://www.metacurity.com/anthropics-ipo-filing-reveals-security-failures-alongside-warnings-of-runaway-ai/

Researchers at ETH Zurich and Anthropic have published an impressive study demonstrating just how fragile online anonymity has become. They show that large language models can be used for de-anonymisation on a large scale. With unrestricted internet access, their agent was able to re-identify users of Hacker News and participants in Anthropic interviews with a high degree of accuracy, based solely on pseudonymous online profiles and conversations: #Anonymity #LLM

It will blow your mind how much critical cyber news has emerged since Friday, so check out today's Metacurity for the top developments you might have missed over the weekend, including
--Trump appointees asked CISA to secretly hack a voting machine and not reveal the results, report,
--AI agents breached Indian firms undetected during tests,
--Hacker unleashes AI agents on 1.2k sites for $50 a breach,
--Staples hack fueled $5m gift card shopping spree,
--Suspected Qilin hacker detained as UK weighs unlawful killing case,
--Anthropic pitches Congress its own AI safety bill,
--Anthropic gives outside evaluators insider access,
--Cyberattack knocks Japanese retailer Joshin’s services offline,
--Japan's H2O Retailing breach puts 1.26m accounts at risk,
--S. Korea's Hollys coffee hackers steal 2.76m pieces of personal data,
--Spyware targets Serbian university rector and prosecutor’s lawyer,
--Sam Altman’s World pitches banks proof of humanity,
--Hackers stole files from Maryland’s Anne Arundel County,
--Hyderabad airport recovers hacked X account,
--OpenCode breach exposes API keys as users report surprise charges,
--Temu settles Texas privacy claims and limits China data transfers,
--Hack exposes Romanian stock depository users’ personal data,
--Cybersecurity job postings hit four-year low as AI roles surge,
--Reach Security raises over $50m for expansion,
--MapQuest puts surveillance cameras on the map,
--AI political ads draw $137m, mostly from Republicans,
--Lightning Network bug put nearly $340m in Bitcoin at risk
https://www.metacurity.com/trump-appointees-asked-cisa-to-secretly-hack-a-voting-machine-and-not-reveal-the-results-report/