🐡

[Malwarebytes @Malwarebytes]

Your LG TV is spying on you, even with no internet connection.

According to @GamersNexus, LG Smart TVs can scan local networks, identify content, and record/transcribe audio in standby.

They also found webOS flaws that could enable remote code execution. https://t.co/3m6sklywkj

[UnveiledChina @Unveiled_ChinaX]

A developer using Bluetooth headphones accidentally caught Chinese e-commerce giant Alibaba secretly hijacking his computer's audio system without making a single sound.

When his wireless headphones refused to switch audio to his phone while browsing AliExpress, he inspected the site's hidden code. He discovered background scripts holding his computer's audio pipeline wide open.

Alibaba was using the browser's WebAudio API to run invisible sound waves at zero volume. By measuring tiny hardware differences in how each computer processes those signals, the site created a unique digital fingerprint to track devices.

Because the secret audio path stayed active, it froze his Bluetooth connection while quietly scraping hardware memory, screen dimensions, and network data in the background.

[Oliver Prompts @oliviscusAI]

This tool removes LLM censorship with a single click.

It’s called Obliteratus.

It identifies the exact weights that force a model to refuse and projects them out with a single click.

100% Open Source.

[illiquidity providooooor @skyquake_1]

you, an imbecile, learning to prompt LLMs better
me, also an imbecile, learning to prompt google better

[Nav Toor @heynavtoor]

A single robot vacuum for one home costs $549 to $1,399 at retail. To sweep your floor.

A family with two floors buys two units. That is up to $2,798.

And the Clean Base bags run out. Replace them and you pay extra.

Side brushes: $19.99 for a 3-pack on iRobot's own store.
Filters: $36.99 for a 3-pack.
Dirt disposal bags: $12.93 for a 3-pack.

You are subscribing to floor cleaning in 2026.

iRobot was once a $3.5 billion company built on this pricing model. It filed for Chapter 11 bankruptcy in December 2025. A Chinese contract manufacturer named Picea Robotics now owns 100 percent of it.

Now meet OOMWOO.

A free and open source alternative to Roomba.

Created in June 2026 by a California founder named Dr. Ilia Ovsiannikov. Former Samsung engineer. 70 patents. He architected Samsung's second-generation neural inference accelerator for smartphones. Then he open sourced the whole robot.

44 days later the repo has 5,548 stars and 235 forks. No VCs. No paywalls.

Here is what OOMWOO gives you:

- 3D-printed chassis with full CAD files
- 2D LiDAR mapping and SLAM navigation
- ROS2 and Nav2 autonomous cleaning stack
- Native Home Assistant integration for local control
- ESP32 firmware and Raspberry Pi 5 brain
- Gazebo simulator to test before you build
- Apache 2.0 license, fork it, sell it, reuse it

Here is what OOMWOO costs:

The price of the parts you buy yourself. No subscription. Unlimited runs. Unlimited maps.

Roomba stores your home map in the iRobot cloud. OOMWOO stores it on your Pi.
Roomba j-series carries a camera. OOMWOO does not.
Roomba features can be changed by the new owner in Shenzhen. OOMWOO is Apache 2.0.

Here is the wildest part:

In 2020, iRobot Roombas captured a photo of a woman on the toilet. Gig workers in Venezuela labeling the data for Scale AI posted 15 of the images to Facebook and Discord. MIT Technology Review broke the story in December 2022. iRobot has shared over 2 million images with data annotation firms.

Your map never leaves your Raspberry Pi. Your floor plan. Your daily routine.

For one apartment, you save $549.
For a two-floor family, you save $2,798.

100% Open Source. (Link in the comments)

[Superman @thesupermannx]

Researchers proved every major LLM is secretly obsessed with Japan.

And they finally figured out why.

For years, we’ve been told that AI is entirely Western-centric, that it just reflects Silicon Valley and American values.

A landmark paper by Cardiff and Basque researchers tested 31,680 cultural prompts across 24 languages on frontier models like ChatGPT, Claude, and Gemini.

The results shattered that assumption.

In six out of eight frontier models, Japan was the single most frequently referenced country when asked open-ended cultural questions.

Ask about traditional dances, festivals, or everyday practices in an open context, and the AI defaults to Japan.

Over and over again.

Here is the twist nobody expected.

This bias doesn't come from raw pre-training internet data.

The researchers tracked where the obsession forms. It emerges after pre-training, during the supervised fine-tuning and alignment phase when humans teach the AI how to behave.

Why Japan?

Because decades of global soft power, rich cultural export, and clean, universally admired digital archives make Japanese culture uniquely "safe" for AI safety filters to lean on.

When labs train models to be harmless and universally pleasing, the AI defaults to the cultural equivalent of comfort food.

It avoids controversy by talking about anime, sushi, and tradition.

[Andrew Case @attrc]

To summarize: HuggingFace got autonomously compromised by a model from an American company. HF then tried to use American frontier model(s) to defend themselves, but were blocked by guardrails. HF then had to turn to open source Chinese models to defend themselves from another American company.

[NXT EU @NXT4EU]

Germany has launched one of the world's best open-source AI models.

Soofi S, made by the Soofi consortium, is a 30B parameter model fully trained in Europe and tops the ranking for open-source AI.

Huge moment for Europe, and finally some competition for Chinese open-source AI.

[Ayaan 🐧 @twtayaan]

Apple just made Docker Desktop optional on Mac.

And it is completely free.

This is apple/container. 26.5k stars no Github.

You can now run Linux containers natively on your Mac without installing Docker Desktop, without a background daemon hogging your RAM, and without paying $21 a month per developer for a commercial license.

Here is what it does:

→ Runs Linux containers as lightweight VMs directly on Apple Silicon using macOS 26 virtualization
→ Fully OCI compatible. Pull any image from Docker Hub, GitHub Container Registry or anywhere else
→ Written in Swift and optimised specifically for Apple Silicon. Faster and lighter than anything Docker Desktop does on Mac
→ Standard container CLI syntax. If you know Docker commands you already know how to use this
→ Push images you build to any standard container registry and run them anywhere

Docker Desktop charges $21 per developer per month for commercial use. Apple's version costs nothing and ships as open source under Apache-2.0.

Microsoft made Docker Desktop optional on Windows with WSL Containers last month.

Apple just did the same on Mac.

Docker is not going anywhere. But the era of paying for a GUI wrapper around containers on your own machine is quietly ending.

Repo here: https://t.co/uFJ867sul6

[Vaishnavi @_vmlops]

MICROSOFT OPEN-SOURCED A PII DETECTION SDK

presidio detects and anonymizes sensitive data before it ever touches your model

the problem is real: names, emails, SSNs, credit cards, medical records all flowing through LLM pipelines unfiltered

presidio stops that

▫️ detects PII in text, images, and structured data
▫️ redacts, masks, or anonymizes before it hits the model
▫️ supports NLP, regex, rule-based, and transformer detection
▫️ runs on Python, PySpark, Docker, and Kubernetes
▫️ even handles DICOM medical images

in an era of GDPR, HIPAA, and AI compliance audits, this is infrastructure not optional

https://t.co/pcEkm4mMt7

[Xavier Rivera @XavierRiveraX]

Google Chrome is rolling out device-bound session credentials to all users. Session cookies get cryptographically tied to your device, so stolen cookies can't be replayed from a different machine. Attackers who exfiltrate your cookie database get nothing usable.

[Prasenjit @prasenx]

hackers are now hiding malicious code inside .cursorrules and CLAUDE.md files.

invisible Unicode characters, your AI reads them, you don't.

→ 34 malicious packages across npm, PyPI and Crates .io
→ 384 versions designed to steal SSH keys, crypto wallets, and API tokens
→ attackers opened real PRs to LangChain, LlamaIndex, and MetaGPT to sneak these files in
→ your AI runs a fake "security scan" that silently exfiltrates everything

Socket detected it in under 6 minutes.

check your repos.

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft calls this "intended behaviour," so here we go.

How to dump the credentials of every user stored in Microsoft Edge:

1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.

The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.

Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L

[International Cyber Digest @IntCyberDigest]

❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design."

All of them. Including credentials for sites you won't open this session.

Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way.

Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them.

In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful.

What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext.

In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running.

Microsoft's official response when notified: "by design."

The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.

[AI Highlight @AIHighlight]

🚨BREAKING: Anthropic just published a study mapping exactly which jobs its own AI is replacing right now.

The workers most at risk are not who anyone expected. They are older. They are more educated. They earn 47% more than average. And they are nearly four times more likely to hold a graduate degree than the workers AI is not touching.

The argument is straightforward. Anthropic built a new metric called "observed exposure." Not what AI could theoretically do. What it is actually doing right now in professional settings, measured against millions of real Claude conversations from enterprise users.

For computer and math workers, AI is theoretically capable of handling 94% of their tasks. It is currently handling 33% of them. For office and administrative roles, theoretical capability is 90%. Current observed usage is 40%. The gap between what AI can do and what it is already doing is enormous. The researchers are explicit about what comes next. As capabilities improve and adoption deepens, the red area grows to fill the blue.

The demographic finding is what makes the paper uncomfortable. The most AI-exposed workers earn 47% more on average than the least exposed group. They are more likely to be female. They are more likely to be college educated. This is not a story about warehouse workers or truck drivers. It is a story about lawyers, financial analysts, market researchers, and software developers. The exact group whose education was supposed to insulate them.

Computer programmers showed the highest observed AI exposure at 74.5%. Customer service representatives at 70.1%. Data entry keyers at 67.1%. Medical record specialists at 66.7%. Market research analysts and marketing specialists at 64.8%. These are not predictions. These are measurements of work that is already happening on AI platforms right now.
Then there is the pipeline finding nobody is talking about loudly enough.

Anthropic's researchers found a 14% decline in the job-finding rate for workers aged 22 to 25 in highly exposed occupations since ChatGPT launched. No comparable effect for workers over 25. Entry-level roles were never just jobs. They were the training ground where junior analysts became senior analysts, where junior lawyers learned how arguments hold together. If that layer disappears, nobody has answered the question of where the next generation of senior professionals comes from.

The detail buried in the paper that most coverage missed: 30% of American workers have zero AI exposure at all. Cooks. Mechanics. Bartenders. Dishwashers. The technology reshaping professional careers is completely irrelevant to roughly a third of the workforce. The divide is no longer between high skill and low skill. It is between presence and absence.
The company publishing this study is the same company selling the AI doing the replacing. Anthropic had every commercial incentive to soften these findings. They published them anyway.

If you spent four years and $200,000 on a degree to land a white collar career, the company that builds Claude just confirmed your job is more exposed than the bartender pouring drinks at your graduation party.
Source: Anthropic, "Labor market impacts of AI: A new measure and early evidence"

PDF: https://t.co/taYgsIfiTj

[Brian Pak @brian_pak]

Time to talk about this one.

CopyFail (CVE-2026-31431) — a 732-byte Python script that roots every Linux distro shipped since 2017. 🧵

[BuBBliK @k1rallik]

do you understand what just happened to Robinhood..

Someone sent a perfect phishing email - real domain, DKIM pass, SPF pass, DMARC pass and Robinhood's own servers delivered it.

Here's the chain:

→ Gmail treats john.doe@ and johndoe@ as the same inbox
→ Attacker registers a NEW Robinhood account using the dot trick of YOUR email
→ Sets the device name to raw HTML code
→ Robinhood's "unrecognized activity" email renders it unsanitized

The "Review Activity Now" button? Attacker's phishing site.

The email? 100% real.. Sent by Robinhood.. Signed by Robinhood..

Just because it passed every security check doesn't mean it's safe.

[The Redheaded libertarian @TRHLofficial]

Modern problems require modern solutions.

[Vaishnavi @_vmlops]

MICROSOFT OPEN-SOURCED THEIR ENTIRE SENTINEL SECURITY TOOLKIT

most teams building on azure figure out threat detection the hard way

trial and error, custom KQL, dashboards built from nothing, playbooks written by hand

nobody told them it was already done

the sentinel github repo has:

▫️ 1000+ pre-built threat detection rules
▫️ hunting queries for active threat investigation
▫️ automated response playbooks
▫️ security workbooks + dashboards
▫️ data connectors for 100s of sources

the hard part was already done

https://t.co/VHbH2pIRRe

[can @can]

your db query is slow? just add this! boom, now you are ai-native instead of lazy!