GSocket: a hidden backdoor on hacked PHP hosting

According to Wiz, 64% of cloud environments have a vulnerable Apache instance, and in 51% it's also reachable from the internet (this doesn't account for configuration). ❓ Sources disagree on exploitability: Red Hat says public research shows a reliable attack method, while Wiz says no exploit is available and no attacks have been seen. The fixed RHEL 9 package is mod_http2-2.0.26-7.el9_9.1. For the standalone mod_h2 module (2.0.8–2.0.42), disabling h2/h2c is the only sure fix. The action hasn't changed: 2.4.71 or your distribution's fixed package, or removing h2/h2c from the Protocols line.

According to the WSJ, attacks on "smart" devices (cameras, TVs, printers, fridges) are multiplying fast because AI automates the search for vulnerabilities. In Europe, for example, supermarket freezers were remotely "heated up". Such a device is often just the entry point: from there an attacker can move on to other machines on the local network. The cheapest defence is to keep IoT devices on a separate network segment (VLAN) from which they can't initiate connections to the main network.

A shared QA prompt targets a common problem: a site built with AI looks fine on a desktop but falls apart on a phone and on a weak signal. First, give Claude Code a real browser with the Chrome DevTools MCP server. It can emulate different screen widths, touch and a throttled (3G) network, and it takes screenshots. The prompt: "Test this in the browser at different widths, with touch emulation, and on a throttled 3G connection. Fix anything that looks broken or feels off. Save a before and after screenshot for every fix and send me a summary afterwards."

According to fresh data from Aikido, attackers used 4,837 compromised accounts to open "test" PRs in 61,764 repositories, and the malware actually ran in at least 1,835 of them. Besides GitHub Actions secrets, it specifically collects AI provider keys (Anthropic, OpenAI, Gemini). It gets past branch protection with a fake "successful" status check, and leaves persistent access in AWS and Azure accounts. Meanwhile, GitHub now also searches completed Actions logs for leaked keys (secret scanning), and the alert remains even after the log is deleted. Ars Technica also covered the Claude Code "Don't ask again" key leak (see Nov 12 / K1).

Google's new model is built for fast, cheaper execution: a 1M-token context, at $1.50 / $7.50 per million input/output tokens. Google says it's 2.5 times faster than Gemini 3.8 Flash, and it has four thinking levels (low, medium, high as the default, and xhigh). The Neuron's recommended workflow: the strongest model writes a numbered step plan with a "done when…" check for each step; the fast model executes step by step, and only a failed step goes back to the big model. The planning prompt: "I'm handing this task to a fast model step by step; write the plan for it. Task: [what the task is and what the finished state looks like]. Break it into numbered steps; for each, give a self-contained instruction, the input needed from earlier steps and a one-line 'done when…' check. Mark which steps require real judgment." ❓ The speed figures are Google's own measurements. According to Simon Willison and Anthropic engineers, the right metric for a new model is cost per task, not token price.

North Korean scammers used AI-altered footage to pose as familiar colleagues on video calls, then faked a "technical problem" and installed malware via a reconnect link. They stole more than $400M in cryptocurrency over 18 months; the FBI took down the infrastructure. Worth telling staff at any organisation: never install a "fix" link or program received during a call (a follow-up to Nov 13 / F1). (WSJ Pro Cybersecurity, The Neuron)

Europol took down 235 servers and 257 domains; the Gootloader malware spread through fake "legal documents" placed on hacked WordPress sites. According to Unit 42, AI-based attack tools (e.g. ARTEX) get in without any vulnerability, through public password-reset pages and published API documentation. So password resets should be rate-limited, and source map files and API docs shouldn't be public. On a WordPress site, check whether your security plugin rate-limits wp-login.php?action=lostpassword requests. (TLDR InfoSec)

Decider v1.3 and Decider Flash v1.3 return probabilities for yes/no and multi-class labelling, for text and images. Alongside the Gemini Decisions API (Nov 13 / K2), this is a second cloud option for cheap pre-filtering of large volumes of text. The question is which is cheaper and more accurate on non-English text; worth comparing on a few dozen of your own samples. (TLDR AI · perplexity.ai/hub/blog/perplexity-decider)

On Nov 12, Outlook, Teams and Intune went down, and by the end most of Microsoft's cloud services. The cause was an overloaded server process and failed health checks. A question for organisations: is there a backup channel if email doesn't work for a day? (TLDR IT, TLDR, TechCrunch ×2)