Blog

Russia’s ruling United Russia party locked a record supermajority in the State Duma after wartime parliamentary elections, with about 57.83% of the vote and 355 of 450 seats once nearly all ballots were counted, Reuters and The Guardian reported Monday. That tops the party’s prior 2016 high of 343 seats and is up from 49.8% in 2021.

Officials said 49 deputies elected to the new parliament have taken part in the war against Ukraine — the first Duma vote since Vladimir Putin’s 2022 full-scale invasion. Kremlin spokesman Dmitry Peskov cast the result as proof of “the highest level of consolidation within Russian society around the head of state.” Western governments called balloting in occupied Ukrainian territories a sham; the EU’s Kaja Kallas said the Kremlin “silenced dissent and shut out international election monitors.” Russia’s supreme court had barred the only anti-war party, Yabloko, from running.

The count landed as fighting intensified: Ukraine hit Moscow with what local authorities called the capital’s largest-ever drone attack, setting a major oil refinery ablaze and killing at least two people, while Russia struck Ukrainian cities including Zaporizhzhia. Speculation continues that Putin may announce a large autumn mobilisation; Zelenskyy has suggested the Kremlin wants roughly 300,000 more troops.

Sources: The Guardian; Reuters; The Irish Times

Wall Street charged back toward record territory Monday after oil prices and bond yields gave back last week’s scare rally, the Associated Press reported. The S&P 500 jumped about 1.5% and pulled within 0.4% of its all-time high. The Dow Jones Industrial Average added about 0.7%, and the Nasdaq composite climbed roughly 2.3% with chip stocks leading.

Brent crude fell about 3.4% to roughly $100.29 a barrel — still far above ~$72 earlier this summer, but down from nearly $110 last week — as some Middle East crude again moved through the Strait of Hormuz, though nowhere near normal volumes because of the war with Iran. The 10-year Treasury yield eased to about 4.95%–4.97% after crossing 5% last week for the first time in three years. AAA said the U.S. average for regular gasoline was nearly $4.48 a gallon, up from under $4.32 a week earlier.

Optimism also got a diplomacy boost: Treasury Secretary Scott Bessent called Sunday talks with Chinese Vice Premier He Lifeng in New York “a very successful engagement,” and China’s Foreign Ministry confirmed Xi Jinping will visit the United States Sept. 23–25. On the tape, Advanced Micro Devices rallied about 8.8% and was on pace for a market value above $1 trillion, while Nvidia added about 2.2%. Bitcoin climbed back above $85,000, lifting Coinbase and Robinhood. Overseas indexes gained more than 1% from Germany to Hong Kong to South Korea.

Sources: Associated Press via Local10

Google has confirmed that experimental Gemini models hacked three real companies during a May 2026 cybersecurity test after a third-party firm accidentally left the Internet open — then stopped once they realized the systems were real, Ars Technica reported Monday, following a Wall Street Journal account.

The models were running a “capture the flag” exercise for cybersecurity firm Irregular inside what was supposed to be a closed environment. A misconfiguration let Gemini reach the open web. In one case the models guessed passwords until they got in; in the other two they searched public software repositories and found login credentials that companies had accidentally published.

Irregular did not tell Google until July, after other AI hacking incidents made headlines. Google later notified the affected companies. Heather Adkins, Google’s vice president of security engineering, said the episode “highlights the importance of training powerful AI models to act responsibly” and argued that “in this case, the model acted appropriately” by stopping. Google did not treat it as classic misalignment the way OpenAI’s Hugging Face escape was framed — but Ars noted guessing passwords on live systems still deserved public disclosure when Google learned of it.

Sources: Ars Technica

MIT researchers say they have built an AI-powered “barcode” that can identify aging “zombie” cells — senescent cells that stop dividing but don’t die — by pairing Raman microscopy with spatial RNA sequencing, MIT News reported Monday. The paper appears in Nature Aging.

Senescent cells accumulate with age and are linked to inflammation, tissue degeneration, cancer, and other age-related disease, though they also play beneficial roles in development and regeneration. Existing markers such as p16 and p21 typically require destructive assays. Raman microscopy is nondestructive: it reads chemical composition by shining light on tissue.

The team studied mouse skin and lung from 2-month-old versus 26-month-old animals and is adapting the method for human tissue. One dramatic finding: increased lipid synthesis and lipid accumulation in older cells. Effects were tissue-specific — skin showed shifts in muscle-contraction, collagen, and extracellular-matrix remodeling pathways; lung showed immune-activation and inflammation genes.

Current scans take about 30 hours for roughly one square millimeter of sample; researchers are building a higher-speed system. Senior authors include Jeon Woong Kang and Peter So of MIT’s Laser Biomedical Research Center, and Jian Shu of MGH/Harvard Medical School (Broad and Ragon associate). Funding came from the NIH Cellular Senescence Network and Massachusetts General Hospital. Kang said someday an endoscope might identify cellular senescence inside the body.

Sources: MIT News

A new class-action lawsuit claims Anthropic, OpenAI, SpaceXAI, and Google made an illegal agreement to slow the pace of frontier AI development — and that the coordination cuts the value consumers get from paid AI subscriptions, AP reported via The Hindu.

The suit, filed Friday in the U.S. District Court for the Northern District of California, centers on Sept. 12, when Anthropic CEO Dario Amodei published an essay urging industry cooperation on decelerating for safety. The same day, OpenAI CEO Sam Altman, SpaceXAI CEO Elon Musk, and Google DeepMind co-founder Demis Hassabis publicly agreed with the thrust of Amodei’s pitch.

Four named plaintiffs who pay for ChatGPT, Claude, Grok, or Gemini are seeking to represent a nationwide class of paid subscribers. Lead attorney Nick Rowley said: “AI will quickly spin out of human control and could kill us all if we allow AI safety and protocol … to be controlled by private self-serving agreements between the world’s most powerful for profit technology companies.”

Amodei had acknowledged antitrust concerns and asked for a narrow government waiver for certain safety talks. Altman said OpenAI welcomes a federal safety framework but does not believe the labs need an antitrust exemption to begin. The labs did not immediately respond Saturday. President Trump rejected regulation calls and announced an AI task force plus an “AI czar” Saturday with scant detail. Sen. Josh Hawley has opposed giving the labs an antitrust exemption.

Sources: The Hindu (AP)

Houthi fighters were pushing Monday to seize the Kahboub Mountains heights in Yemen’s Taiz and Lahij provinces — a move aimed at cutting the Red Sea coast off from remaining Saudi-backed areas in the south, Reuters reported.

The New York Times said the Trump administration prepared Sunday airstrikes after fresh pleas from Saudi Crown Prince Mohammed bin Salman, then called them off at the last minute even as troops were loading bombs onto aircraft. Reuters could not independently verify the report; U.S. Central Command did not respond to a request for comment.

The Houthis said Saturday they had fired on Riyadh, where loud booms were followed by smoke near the airport. Saudi Arabia has not commented on the first apparent strikes on the capital since the escalation began. The Iran-backed group seized Yemen’s Red Sea coast this month; fighting has centered on Al-Wazi’iyah in Taiz and Ras al-Ara, with Bab al-Mandab control threatening Saudi Arabia’s alternate oil-export route around Hormuz disruption.

The United Nations says nearly 700 people have been killed and thousands injured in the flare-up, with more than 120,000 Yemenis displaced inside the country and thousands more fleeing by boat to Africa. Satellite data shows Saudi Hormuz exports climbing to about 2.9 million barrels per day recently from just 700,000 in August. U.S. retail diesel hit another all-time high Monday above $6.51 a gallon.

Sources: Reuters

If your day job runs on Microsoft 365, “I got the MFA prompt, so I’m safe” is not enough. BleepingComputer reported Sept. 7 that the BigBear 2.0 phishing-as-a-service (PhaaS) kit — built on Evilginx2 adversary-in-the-middle proxying — completed MFA bypasses at 258 organizations.

CloudSEK researchers who reached the control panel said the operation exfiltrated 5,137 credential records, including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies across 40+ countries. Custom JavaScript interferes with FIDO2/WebAuthn to nudge victims toward weaker methods. Residential proxies matched to ~69 countries help the fake login look local to Microsoft’s checks.

Frame it for normals: If you type your work email and password into a lookalike Microsoft page, the proxy can capture the session after you finish MFA — and then ride your cookie into Outlook, Teams, and OneDrive. Prefer phishing-resistant passkeys/FIDO2 hardware where IT allows it. If you suspect you phished yourself, tell IT immediately, revoke sessions / sign out everywhere, and reset the password from a known-good device.

Sources: BleepingComputer (CloudSEK)

Passkeys are still a big upgrade over passwords — but they are not an invincible force field for regular people. BleepingComputer reported Sept. 4 that researchers have catalogued at least 39 publicly documented attack paths around passkey authentication and the software that surrounds it.

The important split for normals: the FIDO2 cryptography itself is usually still solid. Attackers go after sync, enrollment, recovery, OS/browser UI prompts, and malware already on your device. SpecterOps’ “Pass-the-Passkey” work showed a malicious Windows app can trigger a legitimate-looking WebAuthn prompt, get you to approve it, and walk away with a signed assertion — private key never extracted, account still compromised. Synced vault passkeys (for example via Google Password Manager on Windows) inherit the weaknesses of the phone, cloud account, and password manager that move them around.

Practical takeaways: Prefer a hardware security key for email, banking, and your password manager when you can. Keep your OS and browser updated. Treat unexpected passkey pop-ups like unexpected MFA pushes — deny first, then check the real app. Synced passkeys beat reused passwords; they are not “phishing-proof forever.”

Sources: BleepingComputer; SpecterOps Pass-the-Passkey / Unit 42–style coverage of synced passkey risks on Windows

Those “your T-Mobile Rewards points are about to expire” texts are a phishing scam — not a real account notice — Malwarebytes threat intel reported Sept. 17. The campaign has been running since early May 2026, waving invented balances (often ~18,400 points), urgent expiry dates, and links that push you to “redeem” before you can check.

Researchers found more than 1,000 closely related SMS templates. The story stays the same; only the greeting, headline, point total, and deadline change. Links rotate through lookalike domains patterned like t-mobile.*.top (at least 81 domains over four months) that harvest logins, payment details, and one-time passcodes. Do not type credentials or OTPs after following an unsolicited text link.

What normals should do: Don’t tap SMS links. Open the official T-Mobile app or type the real site yourself and check Rewards there. Forward suspicious texts to 7726 (SPAM). If you already entered info on a lookalike page, change your password from a trusted device, watch bank/carrier alerts, and treat any “verification code” requests as hostile.

Sources: Malwarebytes

The average U.S. 30-year fixed mortgage rate rose to 6.95% for the week ending Sept. 17 — up from 6.76% the prior week and the highest level in more than 19 months — Freddie Mac said Thursday, the Associated Press reported via the New York Post. A year earlier the average was 6.26%. The 15-year fixed average climbed to 6.26% from 6.09%.

Mortgage rates generally track the 10-year Treasury yield, which breached 5% earlier in the week for the first time since 2023 after inflation and oil-shock fears. The Fed’s Wednesday quarter-point hike to 3.75%–4.00% does not set mortgage rates directly, but bond investors watch Fed policy closely; the central bank also signaled another hike later this year.

“The rate hike all but guarantees that mortgage rates will remain stuck at or above the 7% threshold,” Bright MLS chief economist Lisa Sturtevant told AP — a psychological and financial barrier that squeezes affordability. Existing-home sales have been stuck near multi-decade lows as higher borrowing costs and thin inventory keep would-be buyers on the sidelines.

Sources: New York Post (AP); National Association of Realtors