Notifire — Tech news that matters

Microsoft's May Security Update for Windows 11 is failing to install on some devices. The issue is caused by insufficient free space on the EFI System Partition. This leaves affected systems vulnerable, as they do not receive the dozens of security patches included in the update.

GitHub is updating its bug bounty program to handle a massive increase in low-quality submissions, many generated by AI tools. The company is tightening its standards and will now reward certain types of lower-impact vulnerability reports with merchandise instead of cash payments to discourage spam.

New research suggests a novel way to find dark matter. Instead of looking for it directly, scientists propose listening for its effects on gravitational waves. These ripples in spacetime, created by merging black holes, could carry a subtle signature of dark matter, detectable by instruments like LIGO.

GitHub has disclosed a security breach where an attacker gained unauthorized access to its internal repositories. The compromise originated from a malicious third-party VS Code extension on an employee's device. While thousands of internal repos were exfiltrated, GitHub reports no evidence of impact on customer data.

Google is updating its search box for the first time since 2001, integrating AI to make it larger and more interactive. Users can now ask longer questions, upload media like photos and videos, and use a chatbot for follow-ups directly on the main search page.

Microsoft has officially acknowledged that the May 2026 Windows 11 security update, KB5089549, is failing to install on some devices. Affected users are reporting an error code 0x800f0922, which prevents the update from completing. The company is currently investigating the issue.

Ubuntu has released a security update for the Linux kernel used in Intel IoTG real-time systems. The patch addresses several vulnerabilities in the SMB network file system, Netfilter, and io_uring subsystems. If left unpatched, an attacker could potentially use these flaws to compromise an affected system.

A standard, cached AWS access key on a single machine, without any misconfiguration, can provide an attacker with extensive access to a company's cloud environment. This highlights how normal operational behavior can inadvertently create significant security vulnerabilities in cloud infrastructure.

A government contractor's public GitHub repository accidentally exposed credentials for US government AWS accounts and internal CISA systems. The leak, discovered by a security researcher, included sensitive access keys found within the repository's commit history and developer notes, highlighting significant security risks.

Ubuntu has issued a security notice for multiple Linux kernel vulnerabilities. The update patches several flaws, including a critical issue in a cryptographic module dubbed "Copy Fail." This specific vulnerability could allow a local attacker to gain elevated privileges or potentially escape from a container environment.

Drupal has issued security updates for a highly critical vulnerability in its Core software, tracked as CVE-2026-9082. The flaw affects sites using a PostgreSQL database and could allow attackers to execute remote code, escalate privileges, or access sensitive information. Immediate patching is strongly recommended.

Ubuntu has patched several vulnerabilities in the Linux kernel. A key flaw, dubbed "Copy Fail," could allow a local attacker to escalate privileges or escape a container. Other issues affect the cryptographic API, packet sockets, and TLS protocol, potentially leading to system compromise.

Microsoft has disrupted a "malware-signing-as-a-service" operation run by a group called Fox Tempest. The service abused Microsoft's own code signing system to make malicious software, including ransomware, appear legitimate, compromising thousands of machines and networks globally.

A contractor's public GitHub repository accidentally exposed sensitive credentials. The leak included access keys for US government AWS accounts and internal systems for the Cybersecurity and Infrastructure Security Agency (CISA). A researcher from GitGuardian discovered the exposure, which was then reported by security journalist Brian Krebs.

Microsoft has detailed a financially motivated group called Fox Tempest that operates a service selling fraudulent code-signing certificates to other criminals. This service helps malware, including ransomware, appear legitimate to bypass security software and infect systems more easily.

Google now allows developers to use third-party AI models, including OpenAI's GPT and Anthropic's Claude, directly within Android Studio. This move, announced at Google I/O, gives developers more choice beyond Google's own Gemini model, offering greater flexibility over performance, privacy, and cost for app development.

Verizon's latest Data Breach Investigations Report (DBIR) reveals a critical trend: exploiting unpatched vulnerabilities now accounts for 31% of initial breach access. The findings underscore a persistent and dangerous gap between when security fixes are released and when organizations actually apply them, leaving systems exposed.

Companies are discovering that popular AI features can become unprofitable. While user engagement and adoption metrics look positive, the operational costs of using AI APIs can grow unexpectedly. This creates a difficult economic reality where the cost to run the feature scales directly with its success.

The FBI is planning to spend up to $36 million for nationwide access to a commercial database of automated license plate reader (ALPR) data. This would enable the agency to query and track vehicle movements across the United States and its territories for law enforcement purposes.

Microsoft has launched three new Surface devices for business customers: the Surface Pro 12, Surface Laptop 8, and a 13-inch Laptop model. These devices feature Intel's latest Core Ultra Series 3 processors, business-centric upgrades, and notably higher starting prices.

Google's SynthID, a technology for watermarking AI-generated content, is being adopted by major players like OpenAI and Nvidia. The tool has already been used to label 100 billion images and videos, aiming to help users distinguish between real and synthetic media as AI content improves.

Google has released new Android command-line tools to support the growing use of AI coding agents. These tools are designed to integrate with AI platforms like Claude Code and OpenAI's Codex, enabling developers and their AI assistants to build and manage Android applications more efficiently.

Google has announced Gemini 3.5 Flash, a new AI model designed for speed and efficiency. The company claims it offers high-level intelligence comparable to larger models but at a lower cost. It is now available for developers through platforms like the Vercel AI Gateway and across Google products.

Microsoft has launched new versions of its Surface Pro and Surface Laptop, initially featuring Intel's latest Core Ultra Series 3 processors. This strategy prioritizes Intel chips, with models powered by Qualcomm's Snapdragon X2 processors expected to be released later in the year for business customers.