Security researchers used AI tools to help uncover years-old vulnerabilities in the PHP web scripting language. Then the AI-assisted attacks began. As security teams and web admins scrambled this week to patch newly public PHP bugs, criminal hackers quickly attempted to exploit the flaws in the wild. Millions of exploitation attempts hit within hours of the vulnerabilities being published, according to analysis from Cloudflare--unsurprising given broad access to AI tools that can make it easier for attackers to quickly exploit flaws. So far, the nightmare scenario of mass victim takeovers and breaches hasn't come to pass.

PCWorld reports that Google Chrome 156 introduces a new Media understanding feature, allowing users to ask Gemini AI to summarize or explain videos and audio content directly in the browser.

AI Hacks Leave a Mess That AI Companies Aren't Paying For Powerful AI models continue to cause chaos, but their targets aren't widely seeking justice. Instead, they're being encouraged to adopt those same tools. When Philadelphia police criticized Anthropic last week for submitting a false tip about an unsolved murder, I thought it might become one of the first cases where an AI company faced legal consequences for misconduct by their agents . The incident occurred on July 18, when Anthropic said it was testing its Claude Haiku 4.5 model's ability to perform "example tasks on randomly selected webpages." The model was instructed not to "submit anything destructive," and yet, Claude filed a tip to police looking for information about an ongoing murder investigation.

PCWorld reports that scalper bots are making it harder and more expensive to buy RAM, with bots accounting for 91% of traffic at one retailer. DDR5 RAM prices have surged 500% year-over-year, driven by AI data center demand and third-party resellers inflating prices on platforms like Amazon and Newegg. Popular kits such as the G.Skill Flare X5 are being heavily marked up, making PC building significantly more costly for everyday consumers. When an in-demand product gets scarce, the vultures of consumerism descend. Resellers insert themselves between something people want and suppliers, sucking up every possible dollar to be made. So it went with GPUs and webcams and toilet paper in the pandemic, so it goes with RAM in 2026. For at least one retailer, over 90% of the web traffic for RAM listings came from "scalper" bots.

A researcher found that using Anthropic's Claude Opus 4.7, he could break into the website of Front Gate--used by every festival from Lollapalooza to Bonnaroo--and freely issue any ticket he chose. Fears about AI tools capable of autonomous hacking usually involve nightmare scenarios like the theft of nuclear launch codes or zeroed-out bank reserves. Far more plausible, it turns out, is asking AI to gain super-administrator access on a ticketing website and then issuing yourself and all of your friends free VIP backstage passes to Bonnaroo. That was the discovery of security researcher Ian Carroll, who used the AI tool Claude Opus 4.7 in April to discover a technique that allowed him full access to the systems of Front Gate Tickets, which handles ticketing for practically every major US music festival, from Lollapalooza and South by Southwest to Austin City Limits. Carroll found that Front Gate, which like Ticketmaster is a subsidiary of the event company Live Nation Entertainment, had a bug in its website that he--with Claude's help--could exploit to gain access to millions of customer or staff records and freely issue tickets for any event, of any value, to himself or whoever he chose.

OpenAI's new Daybreak initiative will help open-source projects fend off bugs OpenAI's new Daybreak initiative will help open-source projects fend off bugs Patch the Planet will pair security researchers with open-source projects. OpenAI has launched Patch the Planet, a new initiative part of its Daybreak cybersecurity program, which was designed to serve the open-source community. The company is working with cybersecurity firm Trail of Bits that has committed its entire security research organization for the project. In its own announcement, Trail of Bits said that while models like GPT-5.5-Cyber can produce a firehose of security findings for users, project maintainers, who are already stretched thin, will have to sift through all of them to identify real vulnerabilities from false positives. Patch the Planet is meant to reduce project maintainers' burden by putting them in contact with security researchers, who use OpenAI's top models and Codex Security to identify vulnerabilities and review findings before they even reach the maintainers.

Security researchers, aided by Anthropic's Mythos, claim to have breached macOS Security researchers, aided by Anthropic's Mythos, claim to have breached macOS Apple's operating systems are known for their security, especially compared to their rivals in mobile and computing. Now, security researchers from a Palo Alto-based company called Calif claim they were able to breach macOS after designing a privilege escalation exploit with help from Anthropic's Claude Mythos Preview . As The Wall Street Journal reports, the exploit could be used to access parts of the MacBook that should be inaccessible and, thus, allows the attacker to take control of a Mac computer. The researchers worked with Mythos to identify the vulnerabilities and to help them with the exploit's development. Mythos Preview was able to identify the bugs quickly, because they belonged to known classes.

Detecting vulnerabilities in source code remains a critical yet challenging task, especially when benign and vulnerable functions share significant similarities. In this work, we introduce VulTrial, a courtroom-inspired multi-agent framework designed to identify vulnerable code and to provide explanations. It employs four role-specific agents, which are security researcher, code author, moderator, and review board. Using GPT-4o as the base LLM, VulTrial almost doubles the efficacy of prior best-performing baselines. Additionally, we show that role-specific instruction tuning with small quantities of data significantly further boosts VulTrial's efficacy. Our extensive experiments demonstrate the efficacy of VulTrial across different LLMs, including an open-source, in-house-deployable model (LLaMA-3.1-8B), as well as the high quality of its generated explanations and its ability to uncover multiple confirmed zero-day vulnerabilities in the wild.

Plus: The Jaguar Land Rover hack sets an expensive new record, OpenAI's new Atlas browser raises security fears, Starlink cuts off scam compounds, and more. The cloud giant Amazon Web Services experienced DNS resolution issues on Monday leading to cascading outages that took down wide swaths of the web . Monday's meltdown illustrated the world's fundamental reliance on so-called hyperscalers like AWS and the challenges for major cloud providers and their customers alike when things go awry . See below for more about how the outage occurred. US Justice Department indictments in a mob-fueled gambling scam reverberated through the NBA on Thursday.

This is the week of Black Hat and Defcon, which means a flood of news coming out of the Las Vegas security conferences. As you might expect, artificial intelligence was one popular topic--specifically, using AI chatbots to cause mischief. One team of researchers, from Tel Aviv University, created a clever attack that allowed them to take over a target's smart home devices using a "poisoned" Google Calendar invite. It's the first known attack method that used AI to impact physical devices. Another researcher used a poisoned document that included a malicious prompt to trick ChatGPT into leaking a user's private information when it's connected to a Google Drive.