Category Archives: News

Bitwarden scrubs ‘Always free’ and ‘Inclusion’ values from its website as longtime execs step down

1 Reply

In February, longtime CEO Michael Crandell moved to an advisory role, according to LinkedIn, with no announcement from the company. His replacement, Michael Sullivan, former CEO of both Acquia and Insightsoftware, touts his experience with “all facets of mergers and acquisitions” on his own LinkedIn page, including experience working with leading private equity firms.

CFO Stephen Morrison also left Bitwarden in April, replaced by former InVision CEO Michael Shenkman. Both Crandell and Morrison joined the company in 2019. Kyle Spearrin, who started Bitwarden as a fun hobby project in 2015, remains the company’s CTO.

Meanwhile, Bitwarden has made some subtle tweaks to its website. The page for its personal password manager no longer includes the phrase “Always free.” Previously this appeared under the “Pick a plan” section partway down the page, but that section no longer mentions the free plan, though it remains available elsewhere on the page. Bitwarden made this change in mid-April, according to the Internet Archive.

Update: After publication, an employee on the Bitwarden subreddit[Webmaster’s note: WTF?] said that “Always free” had been restored on its pricing page, calling it an “oversight” by the marketing team. The product page for Bitwarden’s personal password manager remains unchanged.

Full article here

Berenson wins settlement and first amendment admission over Twitter ban

Leave a reply

The Trump administration has settled with journalist Alex Berenson over the Biden White House’s role in getting him banned from Twitter during the summer of 2021.

The settlement includes a payment and a written admission that “the Government did in fact violate the First Amendment by exerting substantial coercive pressure on social media companies such as Twitter to suppress disfavored speech like Plaintiff’s.”

Not “encouraged.” Not “suggested.” The federal government put its name on a document saying it silenced a journalist because it didn’t like what he was saying about COVID-19 vaccines. Berenson’s lawyer, James Lawrence, believes this is the first time an individual American has received a cash payment to resolve a lawsuit over government coercion of social media companies.

Full article here

Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin

Leave a reply

Hackers are leveraging a critical authentication bypass vulnerability in the WordPress plugin Burst Statistics to obtain admin-level access to websites.

Burst Statistics is a privacy-focused analytics plugin active on 200,000 WordPress sites and marketed as a lightweight alternative to Google Analytics.

The flaw, tracked as CVE-2026-8181, was introduced on April 23 with the release of version 3.4.0 of the plugin. The vulnerable code was also present in the following iteration, version 3.4.1.

According to Wordfence, which discovered CVE-2026-8181 on May 8, the flaw allows unauthenticated attackers to impersonate known admin users during REST API requests, and even create rogue admin accounts.

“This vulnerability allows unauthenticated attackers who know a valid administrator username to fully impersonate that administrator for the duration of any REST API request, including WordPress core endpoints such as /wp-json/wp/v2/users, by supplying any arbitrary and incorrect password in a Basic Authentication header,” explains Wordfence.

“In a worst-case scenario, an attacker could exploit this flaw to create a new administrator-level account with no prior authentication whatsoever.”

Full article here

18-year-old NGINX vulnerability allows DoS, potential RCE

Leave a reply

An 18-year-old flaw in the NGINX open-source web server, discovered using an autonomous scanning system, can be exploited for denial of service and, under certain conditions, remote code execution.

The vulnerability is tracked as CVE-2026-42945 and received a critical severity rating of 9.2, based on the latest version of the Common Vulnerability Scoring System (CVSS).

Three more memory corruption security issues were discovered in the same six-hour code scanning session by researchers at AI-native security company DepthFirst AI.

Webmaster’s note: “six-hour code scanning session” kill yourself. seriously jump onto interstate. this is what cybersecurity is going to be now. hey grok, hack PHP. make no mistakes. if i knew this is what AI was going to be used for i would’ve searched up sam altman’s address many moons ago

Full article here

eBay rejects GameStop’s $56 billion bid as ‘neither credible nor attractive’

Leave a reply

eBay on Tuesday rejected a $56 billion takeover bid from the ​much smaller GameStop over financing doubts, calling the proposal “neither credible nor attractive.”

eBay, which has roughly four times GameStop’s market value, also underscored that ‌its turnaround efforts under CEO Jamie Iannone have boosted growth, with its stock returning 201% since Iannone took the position six years ago.

“We have concluded that your proposal is neither credible nor attractive,” eBay Chairman Paul Pressler said in a statement. “eBay’s Board is confident the company, under its current management team, is well-positioned to continue to drive sustainable growth.”

He also pointed to concerns with ​GameStop’s bid, including its financing, its impact on eBay’s long-term growth and the leadership structure of a potentially combined company.

Full article here

Instructure reaches agreement with ShinyHunters to stop data leak

Leave a reply

Instructure, the edtech giant behind the widely popular Canvas learning management system (LMS), has reached an “agreement” with the ShinyHunters extortion group to prevent the data stolen in a recent breach from being leaked online.

The company says over 30 million educators and students use its Canvas platform across more than 8,000 schools and universities worldwide.

In a Tuesday statement, Instructure said the cybercrime gang also returned the stolen data and provided shred logs confirming its destruction.

“We understand how unsettling situations like this can be, and protecting our community remains our top priority. With that responsibility in mind, Instructure reached an agreement with the unauthorized actor involved in this incident,” it said.

“We have been informed that no Instructure customers will be extorted as a result of this incident, publicly or otherwise. This agreement covers all impacted Instructure customers, and there is no need for individual customers to attempt to engage with the unauthorized actor.”

However, as the FBI has repeatedly warned, paying a ransom does not guarantee that threat actors will not also sell the stolen data to other cybercriminals or attempt to extort the victims again.

Full article here

Google broke reCAPTCHA for De-Googled Android users

Leave a reply

Google has tied its next-generation reCAPTCHA system to Google Play Services on Android, meaning anyone running a de-Googled phone will automatically fail verification when the system decides to challenge them.

The requirement forces Android users to run Google’s proprietary app framework version 25.41.30 or higher just to prove they’re human.

When reCAPTCHA flags what it considers suspicious activity, it abandons the old image puzzles and demands you scan a QR code. That scan requires Play Services running in the background, communicating with Google’s servers. If you’re using GrapheneOS or any other custom ROM that strips out Google’s software, the verification fails.

Google announced the broader system, Google Cloud Fraud Defense, at Cloud Next on April 23, pitching it as a trust platform designed to handle autonomous AI agents and traditional bots alike. What Google didn’t emphasize was the part where proving you’re human now requires submitting to its proprietary surveillance.

Full article here

JDownloader site hacked to replace installers with Python RAT malware

Leave a reply

The website for the popular JDownloader download manager was compromised earlier this week to distribute malicious Windows and Linux installers, with the Windows payload found deploying a Python-based remote access trojan.

The supply chain attack affects those who downloaded installers from the official website between May 6 and May 7, 2026 via the Windows “Download Alternative Installer” links or the Linux shell installer.

According to the developers, the attackers modified the website’s download links to point to malicious third-party payloads rather than legitimate installers.

JDownloader is a widely used free download management application that supports automated downloads from file-hosting services, video sites, and premium link generators. The software has been available for more than a decade and is used by millions worldwide across Windows, Linux, and macOS.

Full article here

Fiber optic cables can eavesdrop on nearby conversations

Leave a reply

A fiber optic technique used to detect earthquakes can also pick up the faint vibrations of nearby speech, researchers reported at the general assembly of the European Geosciences Union. Freely available artificial intelligence (AI) software turned the fiber optic data into intelligible, real-time transcripts.

“Not many people realize that [fiber optic cables] can detect acoustic waves,” says Jack Lee Smith, a geophysicist at the University of Edinburgh who presented the result. “We show that in almost every case where you use these fibers, this could be a privacy concern.”

Fiber optics can pick up on sound through a technique called distributed acoustic sensing (DAS). Using a machine called an interrogator, researchers fire laser pulses down a cable and record the pattern of reflections coming back from tiny glass defects along the length of the fiber optic. When an earthquake’s seismic wave crosses a section of the fiber, it stretches and squeezes the defects, leading to shifts in the reflected light that researchers can use to build a picture of an earthquake.

DAS essentially turns a fiber cable into a long chain of seismometers that can detect not only earthquakes, but also the rumblings of volcanoes, cars, and college marching bands. And although scientists set up dedicated fiber lines specifically for research, DAS can also be performed on “dark fiber”—unused strands in the web of fiber optics that runs through cities and across oceans, carrying the world’s internet traffic.

DAS can also be used to eavesdrop, the work of Smith and his colleagues shows. They conducted a field test using an existing DAS setup used to study coastal erosion. They set a speaker next to the cable and played pure tones, music, and speech.

Human speech contains frequencies ranging from a few hundred to several thousand hertz. The low end of the range could be pulled out of the data “even without any preprocessing,” Smith says. “You can easily see acoustic waves.” Getting higher frequency speech took a bit of postprocessing, but it was possible. Dumping the data directly into Whisper, a free AI transcription tool, provided accurate real-time transcription.