News

AI vuln-hunter finds what humans taught it to find. Funny that

Opinion  In retrospect, calling it Mythos made it a hostage to fortune. Anthropic may have hoped that the name implied its AI code security model had mythical god-like powers, but there's an alternate reading. Another definition for Mythos is a set of beliefs of obscure origin which are incompatible with reality.…

Join us for this week's Kettle as we dive into GCN and the latest not-so-alarming revelations about Mythos

KETTLE  If you needed further evidence that AI comes first in pretty much everything nowadays, look no further than this year's Google Cloud Next show, which happened last week.…

OPINION Cal.com has closed its commercial codebase, abandoning years of AGPL-3.0 licensing in a move that has alarmed the developer community that helped build it and sent ripples through the broader open source world. "Open source is dead," says Cal.com co-founder and CEO Bailey Pumfleet. But my conversations with top open source developers such as Linux kernel maintainer Greg Kroah-Hartman suggest it is not. And I really don't think it is. Punfleet made this declaration because the company is moving its main program from the GNU Affero General Public License (AGPL) to a proprietary license, as he sees AI as too much of a threat to the program's security. Or, as he told me, "AI attackers are flaunting that transparency," so "Open source code is basically like handing out the blueprint to a bank vault. And now there are 100× more hackers studying the blueprint." If that sounds familiar, it should. It's an ancient argument that letting people read your code automatically makes it more vulnerable. It wasn't true in the '90s; it's not true now. Consider, if you will, that almost all commercial code today is open source. If anything, open source has proven to be far more secure than proprietary code over the years.  Now it is true that AI makes finding security holes easier and faster than ever. In particular, everyone's nervous these days that the Anthropic Mythos Preview will drown the maintainers of smaller open-source projects in a flood of bug reports.  It's also true that some security reports, such as Black Duck's 2026 Open Source Security and Risk Analysis (OSSRA) paper, claim there's been a 107 percent surge in open source vulnerabilities per codebase. Indeed, lending support to Pumfleet's argument, Jason Schmitt, Black Duck's CEO, claims, "The pace at which software is created now exceeds the pace at which most organizations can secure it." On the other hand, with AI, we can also hope to patch newly discovered security holes as they're found. Cal, clearly, doesn't want to take that chance. Or, perhaps, as he indicated, Pumfleet feels the company can't afford it.  For, as Drew Breunig, a well-regarded tech strategist, argued in a recent blog post, code security has now come to "a brutally simple equation: to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them." In a way, this is a restating of Linus's Law. Today, instead of "given enough eyeballs, all bugs are shallow," perhaps it should be restated as "given enough tokens, all bugs are shallow." That presumes, of course, that you can afford enough tokens to stay ahead of your attackers.  Simon Willison, Django co-creator, however, argues, "Since security exploits can now be found by spending tokens, open source is MORE valuable because open source libraries can share that auditing budget while closed source software has to find all the exploits themselves in private." Needless to say, some would-be competitors are making hay about Cal's sudden policy shift. Ryan Sipes, Mozilla Thunderbird Product & Business Development Manager, said on YComb: "Our scheduling tool, Thunderbird Appointment, will always be open source. Come talk to us and build with us. We'll help you replace Cal.com." By and large, though, the developer community isn't buying Cal's story. On Reddit, one person wondered how serious Cal has ever been about security. Citing several recent patches for security holes, he commented, "These problems were not the result of sophisticated hacking; they stemmed from fundamental oversights in authentication and access control." One cynical comment in Slashdot stated, "If the tools are so good that you are afraid they will be used to expose your security flaws... maybe you should use the tools to find the security flaws yourself, and then fix them rather than declaring security through obscurity. This is a fig leaf over the desire to back out of the open-source community now that the product has reached profitability." Thinking of security by obscurity, Peter Steinberger, creator of OpenClaw, tweeted, "If you look at GPT 5.4-Cyber and its ability for closed source reverse engineering, I have bad news for you." In case you haven't looked at GPT 5.4-Cyber yet, OpenAI's answer for Mythos, OpenAI claims it can reverse engineer binaries to source code. If it can deliver on that promise, you can kiss the always bogus "security by obscurity" argument goodbye for good. We'll finally get to see what's really inside Windows – and won't that be fun!. And, oh yes, dropping open source to improve your security will stop being a thing.  Mind you, to date, no other companies or projects have followed Cal's relicensing footsteps. I doubt any will.  Yes, AI is radically changing open source programming. I don't pretend to understand what open source coding will look like by this time next year. AI's transformation of programming is too broad for me to even make an educated guess. What I can say, though, is that we'll be better off learning how to use AI and open source together rather than retreating into old, discredited proprietary licensing models. ®

Cal.com considers AGPL a license to drill, but not everyone feels that way

Opinion  Cal.com has closed its commercial codebase, abandoning years of AGPL-3.0 licensing in a move that has alarmed the developer community that helped build it and sent ripples through the broader open source world.…

A previously unknown threat group using tried-and-tested social engineering tactics - Microsoft Teams chat invitations and helpdesk staff impersonation - is also using custom malware in its data-stealing attacks, according to Google's Threat Intelligence Group. The threat hunters say they spotted a "large email campaign" in late December 2025. The attack started by spamming target organizations with an overwhelming amount of email traffic. Then someone posing as helpdesk personnel would reach out via Microsoft Teams to offer help with the email volume. The fake helpdesk worker prompts the user to click a link that supposedly installs a local patch that prevents email spamming. This directs victims to a landing page masquerading as a "Mailbox Repair Utility" complete with a "Health Check" button that, when clicked, prompts users to authenticate using their email and password, allowing the attackers to nab them. The credential-harvest script also uses a sneaky "double-entry" psychological trick that auto-rejects the first and second password attempts as incorrect. "This serves two functions: it reinforces the user's belief that the system is legitimate and performs real-time validation, and it ensures that the attacker captures the password twice, significantly reducing the risk of a typo in the stolen data," according to GTIG. The phishing page then performs a fake mailbox integrity check, which keeps the victim engaged while credentials and metadata are sent to an attacker-controlled Amazon S3 bucket and staged files continue downloading onto the user's machine. "By the time the user receives a 'Configuration completed successfully' message, the attacker has secured the credentials and potentially established a persistent foothold on the endpoint using these staged files," the Googlers wrote. The first stage downloads an AutoHotKey binary and an AutoHotkey script, which immediately starts performing reconnaissance and installs a malicious Chromium browser extension called SnowBelt. (It's not available through the Chrome Web Store - only via social engineering tactics.) Snow malware UNC6692 uses the SnowBelt extension to download its other custom "Snow" named malware, along with additional AutoHotkey scripts, and a ZIP archive containing a portable Python executable and required libraries. The Snow malware, we're told, operates as a modular ecosystem with three primary components: SnowBelt, SnowGlaze, and SnowBasin.  SnowBelt, a JavaScript-based backdoor delivered as a Chromium browser extension, gives the attacker an initial foothold and maintains persistence via the browser's extension registration system. It often hides behind names like "MS Heartbeat" or "System Heartbeat." SnowGlaze is a Python-based tunneler that runs in both Windows and Linux environments and manages the external communication. It creates an authenticated WebSocket tunnel between the victim's internal network and the attacker's command-and-control (C2) infrastructure, such as a Heroku subdomain.  It also disguises malicious traffic by wrapping data in JSON objects and Base64 encoding it for transfer via WebSockets, which makes it look like legitimate, standard encrypted web traffic.  Finally, SnowBasin is a Python bindshell providing interactive control over the infected system. It serves as a persistent backdoor, operating as a local HTTP server and typically listening on port 8000, allowing remote command execution, screenshot capture, and data staging for exfiltration. "This component is where active reconnaissance and mission completion occur," the threat hunters noted. "Attacker commands (such as whoami or net user) are sent through the SnowGlaze tunnel, intercepted by the SnowBelt extension, and then proxied to the SnowBasin local server via HTTP POST requests. SnowBasin executes these commands and relays the results back through the same pipeline to the attacker." These types of interactive social engineering tactics have proven very profitable for cybercrime groups like ShinyHunters and Scattered Lapsus$ Hunters. Google analysts, however, told The Register that there's no overlap between those crews and this new group, which it tracks as UNC6692.  Google's analysis of UNC6692 and its Teams-led social engineering campaign follows a warning from Microsoft about criminals abusing Microsoft Teams communications and impersonating helpdesk personnel to snare users and then remotely control and infect victims' machines.  Despite the similarities, Google's security researchers told us that the two campaigns don't seem to be related. They are a good reminder, though, of the increasing number of digital scammers using very convincing social engineering tactics alongside legitimate cloud services and tools to gain a foothold in organizations' IT environments. ®

Coming in cold with custom Snow malware

A previously unknown threat group using tried-and-tested social engineering tactics - Microsoft Teams chat invitations and helpdesk staff impersonation - is also using custom malware in its data-stealing attacks, according to Google's Threat Intelligence Group.…

Silicon often from US, but the kit from APAC and elsewhere

America's telco regulator has clarified its ban on foreign-made routers also includes mobile hotspots and domestic routers that use a 5G cellular connection to the internet.…

Carnival Corporation, the world's largest cruise company, is dealing with choppy waters after Have I Been Pwned flagged what it claimed were 7.5 million unique email addresses all allegedly tied to one of its subsidiaries.  According to HIBP, the haul totals 8.7 million records and appears to relate to the Mariner Society loyalty program run by Holland America Line, a subsidiary of Carnival Corporation. It said the "data contained fields indicating it related to the Mariner Society loyalty program run by Holland America." The exposed data includes names, dates of birth, genders, and membership status details – the kind of personal data attackers can easily repurpose for fraud or phishing. The company acknowledged a security incident, according to HIBP, but its version of events is, for now, a lot more contained. Carnival says the breach involved a phishing attack against a single user account and said it is still working to understand the scope of any unauthorized access. That's not quite the story being told elsewhere. The data was published by the ever-busy ShinyHunters extortion crew, which claimed to have lifted not just customer data but "terabytes of internal corporate data" after talks with the company apparently went nowhere. "The company failed to reach an agreement with us despite our incredible patience," said a post on the group's leak site, seen by The Register, adding, "They don't care." Take the claims with the usual pinch of sea salt – ShinyHunters has form for dressing up its hits –  but the volume and apparent legitimacy of the data flagged by HIBP suggest there is potentially something more substantial here than the usual leak site bravado. The Register has asked Carnival to confirm whether the figures match its own findings, what data was accessed, whether any ransom demand was made, and how attackers got in. It hadn't responded at the time of writing. ShinyHunters is no stranger to this kind of break-in, usually getting a foot in the door via phishing, stolen logins, or by cracking into SaaS platforms before digging around for anything they can cash in. If their claims are accurate, this went well beyond a single compromised inbox. Whether this turns out to be a contained phishing mishap or a full-blown data spill is still unclear – but either way, passengers may want to keep a closer eye on their inboxes than their next itinerary. ®

Leak-site bragging meets breach hunters as Have I Been Pwned flags millions of records

Carnival Corporation, the world's largest cruise company, is dealing with choppy waters after Have I Been Pwned flagged what it claimed were 7.5 million unique email addresses all allegedly tied to one of its subsidiaries. …