Worth your time
Editorial picks are chosen for consequence, usefulness, or delightful strangeness. For the newest reporting, use the live desk directly above.
01 / FEATUREDOpenSSH Fixes SSHole After Honeypot Break-In
OpenSSH 10.6p2 fixes a password-authentication bypass affecting some musl-based Linux systems without PAM. A threat firm reported one successful root login on an Alpine honeypot, but no production victims have been confirmed in that report.
All stories

OpenSSH Fixes SSHole After Honeypot Break-In
OpenSSH 10.6p2 fixes a password-authentication bypass affecting some musl-based Linux systems without PAM. A threat firm reported one successful root login on an Alpine honeypot, but no production victims have been confirmed in that report.

Tech in 5: The Patch Window Is Shrinking Fast
This week’s security stories show how quickly vulnerabilities can become incidents—and why patching, containment and clear customer updates must keep pace. AI expands discovery, but people still have to turn findings into fixes.

Japan’s Cyber Plan Puts AI on Defense Duty
Japan’s ¥10 billion cyber package backs AI vulnerability checks, incident-response teams and more active defenses. Its test is whether basic security improves before another breach.

OpenAI’s GPT-6 Cyber Finds 948 Linux Exploits
OpenAI says GPT-6 Cyber developed working exploits for 948 reproduced Linux kernel vulnerabilities and helped find 81 previously unknown high-severity Firefox flaws. Its restricted release puts vulnerability research, patching speed and safeguards under a sharper spotlight.

Chainalysis Says Customer Tokens Exposed in Breach
Chainalysis says a malicious actor obtained information that included password hashes and live tokens for its users. Its login page and several products are offline as customers await password resets and API-key rotation.

Docomo Confirms Customer Data Leak After Intrusion
NTT Docomo says unauthorized access to its online shop and My Docomo exposed customer information, with up to roughly 300,000 records potentially involved. The carrier warns of impersonation scams while the cause and precise scope remain under investigation.

Swift’s 22-Year Mission Ends Over Indonesia
NASA and the U.S. Space Force confirmed the Swift observatory re-entered over Indonesia after nearly 22 years in orbit. The loss closes a rapid-response platform for studying gamma-ray bursts and leaves a practical lesson for future satellite servicing.

CISA Adds WordPress Update Flaw to Its Exploited List
CISA says attackers are exploiting a WordPress Core flaw fixed last week. The bug needs a narrow update window, but site owners should verify their patch.

OpenAI Pledges Grid Relief; Details Remain Open
OpenAI’s Grid Protectors program promises demand cuts at future data centers when the grid is strained. Its only quantified example is a planned Georgia campus, and the national framework still lacks operating targets.

NVS-03 Clears Its First Orbit-Raising Burn
India’s new NavIC satellite has completed its first orbit-raising maneuver. The milestone clears an early risk, but further burns and commissioning remain before it can provide service from its assigned slot.

DeepSeek Opens a Coding Agent for Team Requests
DeepSeek published an MIT-licensed research prototype that routes coding requests from a team’s work conversation into a separate agent session and returns results for human review. Its authors stress that the public code is experimental, not production-ready.

Android’s Silent SMS Bug Can Drop Your Calls
A malformed WAP Push message can crash Android’s calling service without a tap. A code fix appears to exist, but public guidance still leaves its rollout across phones unclear.