Article URL: https://www.motherjones.com/politics/2026/09/palantirs-co-founder-thinks-we-should-be-less-judgmental-about-that-deadly-iran-school-strike/ Comments URL: https://news.ycombinator.com/item?id=49861062 Points: 30 # Comments: 8
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Threat group UNC6240, linked to ShinyHunters, has been actively exploiting a critical pre-authentication remote code execution vulnerability (CVE-2026-35273, CVSS 9.8) in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62, according to a September 25, 2026 report by Google Threat Intelligence Group and Mandiant. Attackers bypass web application firewalls by percent-encoding the letter 'P' in the target URL path as '%50', causing WAF string-matching rules to miss the request while the backend WebLogic server decodes and processes it normally. JSP web shells have been confirmed on dozens of compromised systems, with some intrusions also involving fileless command execution that leaves no shell files on disk. Following initial access, attackers deployed multiple post-intrusion tools including SIDEEYE for credential theft, Neo-reGeorg for internal SOCKS tunneling, and MeshAgent for remote management on Linux hosts. Oracle has issued a security advisory, and organizations running affected PeopleSoft versions are urged to apply patches and review WAF rules to detect encoded URI variants.
Two GitHub Actions repositories — actions-cool/issues-helper and actions-cool/maintain-one-comment — were re-enabled on September 16, 2026, weeks after being disabled following a supply chain attack discovered in May 2026. The repositories were restored while still carrying malicious tags from the original compromise, meaning no new attacker activity was needed to resume the threat. Security firm Socket confirmed through execution logs that workflows referencing issues-helper re-ran the malicious payload upon the repositories being restored. GitHub's dependency graph shows approximately 15,000 repositories relied on issues-helper, though this figure reflects potential exposure rather than confirmed cases of code execution or data theft. GitHub disabled both repositories again on September 25, 2026, after the renewed risk was identified.
A developer running Claude Code 2.1.278 on macOS tested whether YAML frontmatter settings in custom subagent files — specifically model and effort fields — are actually honored at runtime. Three subagents were examined: a bulk reader pinned to Sonnet, a deep reviewer pinned to Opus, and a preflight reviewer set to inherit its model. Testing was conducted on September 22, 2026, using seven CLI invocations in an isolated throwaway directory to avoid contamination from existing config files. The experiment tracked which model actually responded to each subagent's first API request, whether effort levels survived a parent session running at a different setting, and how Claude Code handled an unrecognized frontmatter key. Findings revealed measurable per-launch token costs and showed that the validator passed through at least one frontmatter field it did not recognize without raising an error.
OpenAI recently launched a Linux version of its ChatGPT Desktop app, but unlike the Windows counterpart, it lacks a built-in update checker. A developer who switched from Windows to Linux noticed the gap after missing the GPT-6-Astra rollout for several days due to an outdated app. To address this, they built an open-source utility that monitors the system's package manager for ChatGPT updates and sends notifications when a new version is available. The tool also supports one-click installs and rollbacks, along with a control panel for managing upgrade settings. The project has been published on GitHub for other Linux users facing the same issue.
Discussion (0)
Log in to join the discussion and vote.
Log in