Aloo Bhujia is a crispy, savoury snack made with potatoes, besan flour, herbs and spices. It is perfect for satisfying your snack cravings and can be enjoyed any time of the day. You can enjoy it as such, or use it as a garnish for chats and other snacks.

This snack is made using simple ingredients and is easy to prepare. With just a few basic pantry ingredients, you can make up a delicious batch in less time. This recipe is quite satisfying, and the aroma that fills the kitchen is irresistible. Do try this for Diwali and enjoy!

About Aloo Bhujia

Aloo Bhujia is a popular Indian snack made with boiled potatoes, besan flour, flavoured with a variety of spice powders. It is pressed into thin threads using a press and then deep-fried until crispy. The dough is simple to work with, and the frying process is quick once you have everything is ready. 

I have tasted Aloo Bhujia quite a few times in small packs, hubby used to buy from his office canteen as mittu is fond of any sev variety. So the process of recreating Haldirams aloo bhujia led me to this keeper recipe.

This is a quick snack that you can even make for evening snacks when kids are back from school. The tanginess with potato flavour will sure be loved by kids so make this at home and surprise your kids and loved ones too. I always sprinkle extra chat masala over the fried bhujia for an extra burst of flavour.

It is a great option when you want to make something crispy and spicy without much effort. Whether served at a party, packed in a lunchbox, or enjoyed with your evening tea, Aloo Bhujia is sure to be a hit. It pairs beautifully with a hot cup of coffee or tea and makes a great edible gift during festive seasons.

Similar Recipes

• Aloo 65 | Potato 65
• Aloo Paratha Recipe
• Aloo Gobi Recipe (Potato Cauliflower Masala)
• Besan Ladoo Recipe (Besan Laddu)
• Aloo Poha Recipe (Batata Poha)

Aloo Bhujia Video

Aloo Bhujia Ingredients

• Boiled potato - This is the key ingredient. It provides the soft, smooth base and blends perfectly with the besan flour. Make sure the potatoes are boiled until tender and mashed thoroughly without any lumps.
• Besan flour - Besan flour is added for binding the dough and gives Bhujia its crispy texture. Use good quality besan flour, sieve and use for best results. 
• Rice flour - Rice flour adds crispness to the snack.
• Chat masala powder - Adds a tangy, spicy flavour that enhances the overall taste. It adds a zing that balances the richness of the potatoes and besan, making each bite flavourful and addictive.
• Cumin powder - Roasted cumin powder adds flavour.
• Coriander powder - Coriander powder is added for taste and flavour.
• Amchur powder - adds more tanginess to the bhujia.
• Turmeric powder - Turmeric adds color and a mild earthy flavour to the bhujia
• Red chilli powder - Red chilli powder gives a slight heat and spiciness to the snack. 
• Pepper powder - Enhances the flavor with a gentle warmth. It adds a subtle kick without overpowering the other spices, giving a well-rounded spiced flavor to the Bhujia.
• Water - Added for kneading the dough to the right consistency. Add little by little to avoid making the dough too sticky or loose, as the perfect dough should be firm yet pliable for easy pressing.
• Oil - Oil is used for deep frying. Use fresh groundnut oil for best results, and make sure it is heated to the right temperature before frying, so that the Bhujia cooks evenly and turns crisp and golden.
• Salt - Salt is added to balance the taste and flavours.

How to make Aloo Bhujia Step by Step

1.Boil 2 medium sized potatoes. If pressure cooking pressure cook for 3-4 whistles. Grate using a fine holed grater.

2.Mash it well using a spatula incase of any lumps. Gather it, mix well and set aside.

3.Place a sieve over a mixing bowl. Add 1 cup besan flour, ¼ cup rice flour,¼ teaspoon turmeric powder, ½ teaspoon red chilli powder, ½ teaspoon roasted cumin powder, ½ teaspoon coriander powder, ½ teaspoon chat masala powder, ½ teaspoon amchur powder, ½ teaspoon dried mint powder and salt to taste.

4.Sieve it well and discard the remains.

5.Mix this well first then add mashed potatoes.

6.Rub and mix it well so that potatoes are evenly distributed. Sprinkle water little by little.

7.Mix well, knead and bring to a dough. Add few drops oil and knead it once.

8.Make cylindrical logs so that it easily fits into the press.

9.Take the press fix idiyappam mold, grease the mold well with oil.

10.Fill with dough. Close with lid and screw tight.

11.Press to check and see.

12.Heat oil check by adding a pinch if it rises immediately then oil is ready. Press in hot oil in concentric circles like this. Do not overcrowd, a slightly thick layer is enough.

13.Cook for seconds then flip over and cook. Cook in medium flame.

14.Drain oil and remove.

15.Repeat to finish.

16.Add to a wide mixing bowl in batches.

17.Break it roughly. Add 1 teaspoon chat masala powder.

18.Toss well and aloo bhujia is ready!

Store in airtight container and enjoy!

Expert Tips

• Dough Consistency - The dough should be soft yet firm. Too soft dough will make bhujia drink more, and too hard dough may cause the strands to break while frying.
• Press - Use idiyappam press or slightly bigger holed press for best results. Slightly grease the press with oil and fill only ¾th to avoid difficulty in pressing.
• Heat - Fry on a low-medium flame to prevent over-browning. If the oil is too hot, the Bhujia will darken quickly but remain raw inside. Always test with a small piece first to check the oil temperature.
• Frying - Fry in small batches. Avoid crowding as it lowers the oil temperature, making Bhujia absorb more oil and turn soggy. 
• Crushing - Gently crush the Bhujia with your hands to break into smaller pieces. Crushing when hot can make it too powdery, so wait until it is just warm.
• Adjust seasoning - After frying, taste and adjust seasoning. You can sprinkle extra chat masala, pepper powder, or even a pinch of amchur powder for a tangier flavour.

Serving and Storage

Aloo Bhujia can be served as a crunchy snack or used as a garnish for chaats like Bhel Puri or Pani Puri. Store any leftover Bhujia in an airtight container at room temperature for up to a week.

FAQS

1. Can I use a different type of flour for Aloo Bhujia?

Besan flour is essential for aloo bhujia. You can skip rice flour if you want.

2. How do I fix dough that's too sticky?

Add a little more sieved besan flour and knead again. Do not add too much at once, adjust gradually until the dough is soft yet manageable.

3. How can I prevent the Bhujia from becoming soft?

Ensure that you fry the Bhujia at the right oil temperature and don't overcrowd while pressing in oil. Proper cooling also helps maintain crispness.

4. Is it necessary to boil the potatoes before using them?

Yes, boiling the potatoes makes them soft enough to mash easily, helping to form a smooth dough.

5. Can I add other flavors to Aloo Bhujia?

Yes, you can mix in a little black salt, kasuri methi (dried fenugreek leaves), or even crushed ajwain (carom seeds) to add a different flavor twist to the traditional recipe.

If you have any more questions about this Aloo Bhujia Recipe do mail me at sharmispassions@gmail.com. In addition, follow me on Instagram, Facebook, Pinterest ,Youtube and Twitter .

Tried this Aloo Bhujia Recipe? Do let me know how you liked it. Also tag us on Instagram @sharmispassions and hash tag it on #sharmispassions.

📖 Recipe Card

Print

Aloo Bhujia Recipe | Potato Sev Recipe

Aloo Bhujia is a crispy, savoury snack made with potatoes, besan flour, herbs and spices. It is perfect for satisfying your snack cravings and can be enjoyed any time of the day. You can enjoy it as such, or use it as a garnish for chats and other snacks.

Course Snack

Cuisine Indian

Keyword Aloo Recipes, diwali dishes, diwali recipes, diwali snacks, diwali snacks recipes, easy diwali snacks, Potato, potato fry, potato fry recipe, Potato Recipes, savoury recipes, sev, snack recipes

Prep Time 10 minutes minutes

Cook Time 30 minutes minutes

Total Time 40 minutes minutes

Servings 2

Calories 366kcal

Author Sharmilee J

Ingredients

• 1 cup besan flour
• ¼ cup rice flour
• 2 medium sized boiled potatoes
• ¼ teaspoon turmeric powder
• ½ teaspoon red chilli powder
• ½ teaspoon cumin powder
• 1 ½ teaspoon chat masala powder
• ½ teaspoon cumin powder
• ½ teaspoon coriander powder
• ½ teaspoon dried mint powder
• salt to taste
• oil to deep fry
• water as required

Instructions

• Boil 2 medium sized potatoes. If pressure cooking pressure cook for 3-4 whistles. Grate using a fine holed grater.
• Mash it well using a spatula incase of any lumps. Gather it, mix well and set aside.
• Place a sieve over a mixing bowl. Add 1 cup besan flour, ¼ cup rice flour,¼ teaspoon turmeric powder, ½ teaspoon red chilli powder, ½ teaspoon roasted cumin powder, ½ teaspoon coriander powder, ½ teaspoon chat masala powder, ½ teaspoon amchur powder, ½ teaspoon dried mint powder and salt to taste.
• Sieve it well and discard the remains.
• Mix this well first then add mashed potatoes.
• Rub and mix it well so that potatoes are evenly distributed. Sprinkle water little by little.
• Mix well, knead and bring to a dough. Add few drops oil and knead it once.
• Make cylindrical logs so that it easily fits into the press.
• Take the press fix idiyappam mold, grease the mold well with oil.
• Fill with dough. Close with lid and screw tight.
• Press to check and see.
• Heat oil check by adding a pinch if it rises immediately then oil is ready. Press in hot oil in concentric circles like this. Do not overcrowd, a slightly thick layer is enough.
• Cook for seconds then flip over and cook. Cook in medium flame.
• Drain oil and remove.
• Repeat to finish.
• Add to a wide mixing bowl in batches.
• Break it roughly. Add 1 teaspoon chat masala powder.
• Toss well and aloo bhujia is ready!
• Store in airtight container and enjoy!

Video

Notes

• Dough Consistency - The dough should be soft yet firm. Too soft dough will make bhujia drink more, and too hard dough may cause the strands to break while frying.
• Press - Use idiyappam press or slightly bigger holed press for best results. Slightly grease the press with oil and fill only ¾th to avoid difficulty in pressing.
• Heat - Fry on a low-medium flame to prevent over-browning. If the oil is too hot, the Bhujia will darken quickly but remain raw inside. Always test with a small piece first to check the oil temperature.
• Frying - Fry in small batches. Avoid crowding as it lowers the oil temperature, making Bhujia absorb more oil and turn soggy. 
• Crushing - Gently crush the Bhujia with your hands to break into smaller pieces. Crushing when hot can make it too powdery, so wait until it is just warm.
• Adjust seasoning - After frying, taste and adjust seasoning. You can sprinkle extra chat masala, pepper powder, or even a pinch of amchur powder for a tangier flavour.

Nutrition

Serving: 100g | Calories: 366kcal | Carbohydrates: 53g | Protein: 15g | Fat: 10g | Saturated Fat: 1g | Polyunsaturated Fat: 3g | Monounsaturated Fat: 4g | Trans Fat: 0.02g | Sodium: 92mg | Potassium: 569mg | Fiber: 8g | Sugar: 7g | Vitamin A: 186IU | Vitamin C: 0.4mg | Calcium: 44mg | Iron: 4mg

The post Aloo Bhujia Recipe (Potato Sev) appeared first on Sharmis Passions.

Spooky season is the perfect time to cozy up with Haunted Hotel. The Netflix animated series blends horror with an animated family sitcom format that makes for fresh fun, and an addictive rewatch binge. (And, really, we've been revisiting Season 1 over and over since last Halloween.)

Now, with Season 3 announced ahead of this Halloween, we're sharing a secret we've found hidden in the Undervale. Sure, each episode focuses on the misadventures of the Freeling family, be it ghost uncle Nathan (Will Forte), his sister Katherine (Eliza Coupe), her chipper son Ben (Skyler Gisondo) and mischievous daughter Esther (Natalie Palamides), or their resident demon trapped in a boy's body, Abaddon (Jimmi Simpson). But beneath the surface of Haunted Hotel, another drama lurks — specifically under its floorboards.

In the opening title sequence, between when Esther defeats a vampire and Ben is chased out of the library by gremlins, there's a smaller story playing out between the floors of the hotel. You have to freeze-frame to see it. And even on a desktop watch, that can be tricky to do! So, we've done the hard bit for you.

After Season 1, some fans posted screenshots online, allowing others to dig into the curious war waged deep in the Undervale hotel. Now, with Season 2 out, Mashable has pulled together screenshots from Seasons 1 and 2 in chronological order, so you can make out the stories for yourself.

Haunted Hotel, Season 1, episode 1: "Welcome to the Undervale"

Credit: Netflix/screenshot

Haunted Hotel, Season 1, episode 2: "Unfinished Business"

Credit: Netflix

Haunted Hotel, Season 1, episode 3: "Randy Slasher"

Credit: Netflix

Haunted Hotel, Season 1, episode 4: "How to Train Your Demon"

Credit: Netflix

Haunted Hotel, Season 1, episode 5: "Rollyfluffs"

Credit: Netflix

Haunted Hotel, Season 1, episode 6: "Ghost Hunters!"

Credit: Netflix

Haunted Hotel, Season 1, episode 7: "Seven Deadly Bens"

Credit: Netflix

Haunted Hotel, Season 1, episode 8: "Aunt Rose"

Credit: Netflix

Haunted Hotel, Season 1, episode 9: "The Esthercist"

Credit: Netflix

Haunted Hotel, Season 1, episode 10: "The Acolytes of Abaddon"

Credit: Netflix

Hey, bud. You okay? Sorry about that last one. I assure you, Season 2's has a happier ending. Here it is.

Haunted Hotel, Season 2, episode 1: "Ooze"

Credit: Netflix

Haunted Hotel, Season 2, episode 2: "Dinner Party"

Credit: Netflix

Haunted Hotel, Season 2, episode 3: "The Witch"

Credit: Netflix

Haunted Hotel, Season 2, episode 4: "Ghost Day Out"

Credit: Netflix

Haunted Hotel, Season 2, episode 5: "Astral Esther"

Credit: Netflix

Haunted Hotel, Season 2, episode 6: "Dante Crowe"

Credit: Netflix

Haunted Hotel, Season 2, episode 7: "The Concierge"

Credit: Netflix

Haunted Hotel, Season 2, episode 8: "The Visit"

Credit: Netflix

What will Haunted House creator Matt Roller have in store for season 3 (above and below the floorboards)? We can't wait to find out.

Haunted Hotel is now streaming on Netflix.

On August 9, 2026, Dartmouth College provost Santiago Schnell wrote a Washington Post op-ed called "Universities are fighting AI cheating. But there’s a deeper problem." This week, Schnell discovered the depths of the problem himself as he resigned from the university after an advisory committee found that he failed to disclose significant AI use in an academic paper and in the Washington Post op-ed, even though publishers required such disclosure.

Schnell didn't make it especially easy for the committee to investigate his AI use; the report uses the term "insufficient cooperation." He did turn over his Dartmouth laptop, but he did not turn over logs from his personal LLM accounts related to the writings in question. Nor did he agree to meet with the committee.

The committee did get access to the Claude enterprise account Schnell had used through Dartmouth, though. This shows him using the LLM as a tool for revising his papers, finding and fixing bugs in code, and editing or generating figures. For instance, Schnell would run his papers through Claude and ask things like:

Read full article

Comments

Instagram's pitch to longform video creators now reportedly comes with a paycheck, and for some, it could reach half a million dollars.

The platform has offered select creators deals worth up to $500,000 to post longer videos through its new Features format, Business Insider reported Oct. 29, citing people familiar with the agreements. Some offers are worth $50,000, while others reach six figures, according to the outlet.

The deals reportedly don't require creators to make their videos exclusive to Instagram. One person familiar with the offers told BI that Instagram is asking creators to upload the longform videos they publish on YouTube to Instagram on the same day.

For the creators already making those videos, this news could mean another place to distribute their work, with a payment attached.

"We've been public about the fact that we are funding Features content directly with some creators right now to support them," a Meta spokesperson told Business Insider. "The details of those deals are confidential, but we're excited to see the content going live."

The report adds a financial incentive to Instagram's latest attempt to get people watching longer videos. As Mashable reported earlier this week, Features will allow uploads of up to 90 minutes, with an emphasis on horizontal video that people can watch on their phones, computers, and TVs. Instagram is conducting small tests in the U.S. and Brazil.

Instagram announced Features Monday, with Head of Instagram Adam Mosseri and VP of Product Tessa Lyons explaining how longer videos could fit alongside Reels.

"So many creators are producing longer videos, and they're using clips of those videos to drive discovery on Reels and help build their audience," Lyons said in the announcement. "Features would let those viewers watch the full video without leaving Instagram."

The format also gives Instagram more content for its television app,

"We've been working on a TV version of Reels, and we know that to do that well, we need more than just short-form video," Lyons said.

As Mashable reported, Instagram's TV app began testing on Amazon Fire TVs in late 2025, expanded to Samsung TVs in mid-2026, and arrived on Apple TV in October. Features would give people more to watch on those bigger screens, including longer, horizontal videos.

These additions reflect how Instagram is positioning itself to be more in direct competition with YouTube, giving viewers a new place to discover short clips and watch full-length videos on the same platform.

YouTube is still the platform to beat

Instagram is chasing a platform with both a bigger audience and an established way to pay creators. A Pew Research Center survey published Oct. 19 found that 84 percent of U.S. adults use YouTube, making it the most widely used platform surveyed, compared with 51 percent for Instagram. Among adults ages 18 to 29, YouTube reaches 95 percent, compared with Instagram's 79 percent.

Credit: Pew Research Center

YouTube's Partner Program gives eligible creators 55 percent of net ad revenue from their longform videos, offering a way to earn money beyond brand partnerships and individual platform deals. But qualifying will soon get harder. Starting Feb. 1, 2027, new applicants will need 8,000 qualified watch hours over 12 months or 20 million qualified Shorts views over 90 days — double the current thresholds. Both routes will still require at least 1,000 subscribers, while creators already enrolled will remain in the program.

Instagram's reported offers could make posting on both platforms more appealing for both reach and monetization, especially since the deals don't require exclusivity. But those payments are going to select creators, at least for now (though Instagram hasn’t announced a broader revenue-sharing program for Features).

"We understand the economics matter a ton, and are exploring multiple options to help long-form creators get paid," Mosseri wrote on X Wednesday.

This Tweet is currently unavailable. It might be loading or has been removed.

The next test is whether viewers who come for a quick Reel will stay for a full episode.

Chris Metinko / Axios:
Salesforce buys Rune Technologies for new defense unit  —  Salesforce signed a definitive agreement to acquire Rune Technologies, a military software and hardware developer for logistics and sustainment. … - Salesforce called Rune its most significant national security-focused acquisition, but did not disclose terms of the deal.

In an announcement released Thursday, Fujifilm said it will invest roughly 10 billion yen (about $63 million) to increase its production capacity fivefold for an unlikely beneficiary of the AI era: magnetic tape.

Fujifilm attributes the surge in archiving demand to the spread of generative AI, which the company remarked is producing "exponential growth" in data needs worldwide. The 5x increase in production capacity will be measured against fiscal year 2025 production levels.

The investment in Fujifilm's Kanagawa Factory, Odawara site will make it "the largest investment Fujifilm has made to date in dedicated LTO tape facilities." The project will run from fiscal years 2026 through 2028 to fund manufacturing expansion and additional personnel, primarily to produce the latest-generation "FUJIFILM LTO Ultrium10" tape.

Read full article

Comments

Last week brought us at least two broken embargoes: php2shell leaked onto Hacker News a day early, and a batch of Linux kernel bugs landed on the public kernel mailing list instead of the private security list. This week has been slightly less exciting overall, fortunately, but Akamai’s security team published a pointed essay titled “TLP Is Not a Suggestion”, and it’s hard to argue with the timing.

When a researcher finds a serious bug, the usual process is “coordinated disclosure”. The developers get time to build a fix, and downstream vendors get advance notice under embargo so patches and protections are ready the moment details go public. The Traffic Light Protocol (TLP) is the vocabulary everyone uses to say who may know what: TLP:RED for named recipients only, TLP:AMBER for an organization and its clients on a need-to-know basis, TLP:GREEN for a trusted community, and TLP:CLEAR for anyone. It has no legal teeth whatsoever. It’s not classified data in a legal sense. It works because everyone involved agrees to make it work.

Akamai’s complaint isn’t really about the original php2shell leak, but about what came after: vendors and researchers racing to confirm, reproduce, and publish first. According to Akamai, a researcher published a reconstruction of the bug before the patch existed, and exploitation attempts started before most admins knew there was anything to patch. They draw parallels to Heartbleed in 2014, where a handful of companies got early notice and then advertised that they were already safe while Linux distributions were caught flat-footed, and to Meltdown and Spectre in 2018, where a six-month embargo collapsed six days early.

In the rush to publish, it’s also become less clear what the actual severity of the bug is in the real world. It clearly exists, and is of concern, but groups are still struggling to prove a complete exploit path, with several challenges showing results but nothing definitive so far.

Their advice boils down to “protect first, publish second”: push the detection rules and virtual patches, tell your customers privately, and save the blog post for after the official advisory. With AI tooling shrinking the time between “details exist” and “working exploit” to hours, the cost of a broken embargo is going up, not down.

UEFI network boot bug in most servers

Speaking of broken embargoes, Ars Technica reports on CVE-2026-97631, a CVSS 9.5 code execution bug in TianoCore EDK II, the open source codebase which nearly every firmware vendor builds on. That includes AMI, Insyde, Phoenix, and Microsoft’s own Project Mu fork.

UEFI is the current iteration of what we knew as the PC BIOS: the firmware that runs before your operating system, initializes the hardware, and hands off to the bootloader. It’s also where Secure Boot starts its chain of trust, and where the TPM gets set up. Code running in UEFI runs before any of the operating system’s defenses exist, which makes it extremely attractive to attackers. The Preboot eXecution Environment (PXE) is the UEFI feature that lets a machine boot from an image downloaded over the network, which is common in data centers and labs with large numbers of identical machines.

The bug is a 16-year-old buffer overflow in how the PXE driver stores ICMP error messages: it copies incoming errors into a fixed 504-byte buffer without properly checking the length. An attacker who can send a packet to the machine while it’s network booting can overwrite adjacent memory and, if they know the specific firmware build, run code at the highest privilege level before Secure Boot ever gets a say. Buffer overflows are nothing new, in fact they’re one of the oldest bug classes turned into exploits, but most operating systems today offer protections to reduce the severity.

The pre-boot environment of UEFI has no such niceties, making the attack simple and completely effective. HD Moore told Ars it could be used to break disk encryption for an attacker with short-term network access, and that it will likely be a “forever” bug living on in out-of-support systems. If this sounds familiar, it’s because PixieFail found a similar family of PXE bugs in the same EDK II network code in 2024, and, as Ars notes, the fuzzing projects that followed missed this one.

The disclosure was supposed to wait until January, but AMI published a pull request with the fix last month, and once the researchers noticed, TianoCore had little choice but to publish an advisory. If your machines boot only from local disks, you’re not affected, and that covers most home and small office systems. If you do use network boot, check with your firmware vendor, and consider turning off PXE booting where you don’t need it. Fortunately, this one is largely irrelevant for home users unless your network somehow gives direct access from the Internet to a server pre-boot environment, but it’s got potential to be a real issue for server hardware.

Certificate authority fallout continues

Last week we covered the eMudhra intermediate certificates whose private keys turned out to be tiny integers. This week, eMudhra announced that it is exiting the global SSL/TLS certificate business entirely. The press release insists the company “handled the recent incident diligently”, that its infrastructure was never compromised, and that TLS was only about 1% of revenue anyhow, but that “the level of social media amplification around this incident has brought scrutiny that is out of proportion.” Having your keys guessable by anyone with a few minutes of free time will do that.

Meanwhile, GoDaddy has self-reported to Mozilla that it couldn’t meet the deadline to revoke 404,607 certificates that didn’t match its own published certificate policies. The rules browsers and CAs agree to, the CA/Browser Forum “Baseline Requirements”, say a CA must revoke a mis-issued certificate within five days. GoDaddy managed to revoke 170,566 by the deadline, and about 227,000 a day later.

Mass revocation is genuinely hard: every one of those certificates is installed on someone’s server, and revoking it before it’s replaced breaks their website. That’s exactly why the browser root programs care so much about CAs being able to do it on time. Short-lived certificates, the kind Let’s Encrypt has been pushing for years, make this a lot less painful because a bad certificate expires on its own in days instead of months. We’ll be living the revocation long-tail experience with eMudhra certificates for years with devices which don’t, or can’t, check revocation lists for the long-running CA certificates.

Tailscale wormability

Tailscale and headscale, its self-hosted, open source control server, have become extremely popular. This is especially so in the maker and homelab world, where they are used for building private networks between devices. Under the hood, Tailscale builds a mesh of WireGuard VPN tunnels between every device, with a central control server deciding who can talk to whom. It also offers “Tailscale SSH”, which replaces the normal SSH server on a device and authorizes logins based on which device is connecting, rather than passwords or keys.

Erica Windisch of Cyberdione Labs has published a report called Tailworm detailing a series of findings in Tailscale and headscale. The most serious is in Tailscale SSH, which runs as root: socket forwarding requests are handled with root privileges and are subject to race conditions, letting an ordinary user with SSH access to a device replace or connect to privileged sockets (like the Docker socket or the init system) and gain root. Combined with capturing the keys used to enroll new devices, Windisch reports that a single compromised device could spread automatically to every device the access policy allows, at under a second per hop, with no passwords or stolen keys required. She also found an experimental app connector feature that can be used to reach destinations the network policy never allowed, including cloud metadata services that hand out credentials. And to top it all off, Windisch discovered unauthenticated memory exhaustion attacks against internet-facing headscale servers.

Notably, the researchers didn’t follow coordinated disclosure, arguing that “infrastructure is vulnerable today” and that rapid awareness will speed up fixes. Whether you agree with that or not (see the first story this week), the mitigations are practical: use per-device access rules for SSH rather than broad tag or group rules, disable SSH forwarding where you can, and expire node keys on servers. Fortunately it doesn’t seem like the bug is vulnerable to the Internet at large. A compromised device inside your Tailscale network could reach other devices in your network, but it won’t melt the Internet, yet.

A One-Byte Typo in Embedded TLS

FoxIO is back with three TLS bugs in GoAhead, a small embedded web server that runs the management interface on an enormous number of devices: routers, printers, firewalls, and industrial controllers from vendors including Palo Alto Networks, D-Link, HP, Canon, Honeywell, Siemens, and Rockwell.

The most severe (CVE-2026-115881, CVSS 9.1) is that GoAhead’s OpenSSL integration loads the configured certificate revocation list, but never actually turns on revocation checking, so revoked client certificates keep working, but the most fun is in the Mbed TLS integration: a copy-and-paste error passes the size of the one-byte Diffie-Hellman generator as the size of the 256-byte prime modulus. The result is a “2048-bit” key exchange using a prime of 255, which leaves exactly eight possible shared secrets. An eavesdropper can simply try all eight. (Clients like OpenSSL reject the broken parameters, but more permissive embedded clients happily accept them.) A third bug (CVE-2026-115884) lets an overly long certificate chain bypass a depth check when built against older LibreSSL. Feels eerily similar to the eMudhra one-number password, and the timing is spooky.

It’s a good reminder of Apple’s infamous “goto fail” bug in 2014, where a single duplicated line silently skipped certificate verification. Crypto code fails quietly: the handshake completes and everything looks fine. GoAhead 6.1.1 fixes all three, but for the hundreds of millions of embedded devices running it, the fix depends on every vendor shipping a firmware update, and on owners installing it. Which will surely happen rapidly and effectively, right?

Volt Typhoon’s Chain of Routers

Kim Zetter reports on new research from Lumen’s Black Lotus Labs into how Volt Typhoon, the Chinese state hacking group that US officials say has been “pre-positioning” inside American critical infrastructure, actually gets in and out.

Attackers rarely connect to a target directly from their own systems. Instead, they bounce through chains of compromised devices, often called “ORB networks” (operational relay boxes), so the traffic appears to come from somewhere innocuous. The sudden burst of news about Residential Proxy Network tools in the Spring and early Summer of 2026 could have been related: proxy networks provide a way to appear inside a country, or state, or even specific city.

Volt Typhoon’s version, which the researchers named Silent Train, is unusually disciplined: each chain of compromised servers, home routers, and IoT devices is assembled and used for a single intrusion, then dismantled and wiped. All this often in under two minutes, suggesting automation. Devices outside the US are never the same models as devices inside the US, presumably so no single vendor’s telemetry can see the whole chain. Targets included government agencies, defense contractors, telecoms, emergency communications, satellite operators, and energy, water, and rail operators, clustered in Hawaii, California, and Texas.

The chains included more than 27 classes of devices, including TP-Link and Netgear consumer routers, with a new device type added about once a month. Most of these were compromised through known, already-patched vulnerabilities. If you’ve got an old router or IoT gadget that hasn’t seen a firmware update in years, it may well have spent some time as a train car. Update it, retire it, or upgrade it with OpenWRT or another modern embedded distribution.

Discover-Tech and Starlink

Last week we talked about Citizen Lab’s research showing the Israeli ad-tech company Discover-Tech used targeted ads to deliver Candiru spyware. Gizmodo reports that the same company appears to be the top bidder for ad impressions on Starlink connections in 105 countries.

Research from TrendAI found an entity it labeled SHADOW-EARTH-79 won about 12% of ads shown to Starlink users, compared to a 3% baseline elsewhere, and over 80% of Starlink ad wins in Argentina, the Philippines, and Japan. It was also the top bidder in Syria, Libya, Yemen, and South Sudan, markets where, as TrendAI put it, “the demand for legitimate Western advertising in sanctioned or active-conflict states is effectively zero.” Reuters later reported that SHADOW-EARTH-79 was TrendAI’s internal name for Discover-Tech. The company spent about $109,000 on bids over four months with no recorded conversions, which is not how a business that wants to sell things behaves.

Real-time ad bidding shares device and location details with every bidder, whether they win the auction or not. Users of satellite internet are exactly who someone would want to locate in places where it’s restricted or politically sensitive, and the ad market will happily tell you where they are. Ad blockers continue to look less like a convenience and more like a necessity.

Quad9 leaves France

Quad9, the free, privacy-focused DNS resolver run by a Swiss nonprofit, is withdrawing service from France on November 24th, after losing a court case brought by the sports broadcaster beIN.

A DNS resolver turns names like “hackaday.com” into IP addresses. Quad9 doesn’t host any content, but the court ordered it to block resolution of domains beIN says are pirating its broadcasts, for users in France. Quad9 says it can’t comply: it doesn’t track who its users are or where they are, and the only alternatives are blocking the domains for the entire world, applying French law globally, or trying to geolocate users by IP address. It tried geolocation in a similar case brought by Sony in Germany, and was fined for contempt when Sony’s lawyers simply used a VPN. (Quad9 eventually won that case, after several years and six figures of legal costs.) With about 20 similar cases pending in France, it decided to leave.

As the EFF points out, none of this removes a single infringing website from the Internet; it just takes a malware-blocking privacy service away from French users, who can switch to another resolver in about thirty seconds. Making infrastructure providers act as copyright enforcement is a tool that’s very easy to repurpose for blocking other things. A net loss for Internet-savvy users in France, but kudos to Quad9 for standing up for principles.

Crime Stoppers Tips Leaked

The CBC has analyzed data stolen from P3, the tip management platform used by Crime Stoppers programs internationally, and found more than 1.5 million Canadian tips from the past 25 years. More than half contained personal information, including addresses, phone numbers, license plates, and banking details for cash rewards. Over 4,300 tipsters identified themselves by name, and even tips flagged by staff as having exposed the tipster were stored unredacted.

The data was stolen in March by a hacktivist group that said it wanted to disprove the platform’s claims of being “anonymous” and “secure”. After the CBC’s report, Toronto Crime Stoppers paused its program and at least six Ontario police services suspended their partnerships. Toronto’s chair, Sean Sportun, told the CBC, “It clearly seems that you have more data than us, which is a little concerning,” saying the platform’s owner, Navigate360, never provided the text of the stolen tips despite months of requests.

The most fundamental problem here may be retention. A system that promises anonymity kept 25 years of tips, including closed cases, in one place. The safest data is data that you don’t have.

DHS Employee Directory Leaked

WIRED reports that Distributed Denial of Secrets has published records on more than 41,000 Department of Homeland Security employees and contractors, including ICE and CBP. DDoSecrets says the data came from DHS’s Okta login system; Okta told WIRED it has “no evidence our data or systems were compromised.”

Beyond names, emails, and phone numbers, the leak includes over 55,000 access permission groups, which map out which people have access to which internal systems, including groups referencing certified undercover operations, wiretap programs, phone forensics tools, and AI services. A security expert quoted by WIRED called it “an extraordinarily valuable intelligence resource for those seeking to penetrate DHS”. Following ShinyHunters’ claimed theft of personal data on nearly every FBI employee, it’s been a rough autumn for federal identity systems.

FEC filing system knocked offline

The US Federal Election Commission took its electronic filing system offline a week before the November 3rd elections, after what an FEC filing officer described in an email seen by Reuters as “a bad actor attempting to breach FEC systems.”

The FEC doesn’t run elections, so there’s no impact on voting, but the outage blocks the 24- and 48-hour spending reports that show how much super PACs and other groups are spending on specific races in the final days. With the midterms already the most expensive US election ever, that’s a meaningful blind spot, at exactly the moment it matters most.

AI-orchestrated Bank Attacks

Last week we covered an attacker using a swarm of AI agents to break into websites. This week, Straiker published an analysis of CARLIY0S, a system it says the long-running CyberCartel group used to attack more than 400 financial targets across Latin America. CARLIY0S was built on PentAGI, an open source automated penetration testing framework, and assigned different jobs to different commercial AI models, including Kimi, Grok, and Claude. Four Claude-based roles were set up to evaluate attack options, debate targets, and return a decision through a designated “arbiter”.

According to Straiker, the group got around model safety policies by framing requests as authorized red team work or capture-the-flag exercises, and even instructed the models to never output the group’s name to frustrate attribution. Straiker says it accessed the group’s stolen credential database, with thousands of records including API keys, database credentials, JWT signing keys, and backdoors. Anthropic has since revoked the credential the group used to reach Claude, and xAI is investigating.

The “it’s just a pentesting tool” defense is going to get a lot of use in the coming years. Automated offensive frameworks are genuinely useful for defenders, and unfortunately also genuinely useful for anyone else who can convince the model they’re a defender.

Bulletproof Hosting Seized

The DOJ has seized the domain of Virtualine, a “bulletproof” hosting provider. Bulletproof hosts sell servers and domains to criminals with the explicit promise of ignoring abuse complaints and law enforcement requests, and they’re the plumbing behind a lot of phishing, malware, and spam.

Virtualine wasn’t subtle about it. According to the DOJ, it advertised on cybercrime forums that customers could use it “for all illegal/black hat activities (including phishing, carding, email spam, port scanning and all others)”, offered an “additional protection plan” that would move a customer’s infrastructure to an unaffiliated shell company after a law enforcement request, and bragged that it “ignored more abuse than your last three therapists.” Despite a supposed ban on child abuse material, it continued hosting a site selling exactly that after repeated notices from law enforcement in multiple countries. Marketing copy is evidence, it turns out.

Japan is dealing with an intense wave of AI-assisted intrusions that has exposed weaknesses in its corporate and public-sector defenses. Dozens of incidents, from brokerages to delivery firms, have made data leaks routine. Japan AI cyberattacks According to reporting published by Bloomberg, on October 28, Japan’s Ministry of Economy, Trade and Industry (METI) disclosed unauthorized […]

The post Japan Faces Growing Cyberattack Crisis as AI Tools Help Hackers Target Businesses and Government appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

General Motors marketed its Smart Driver system as a way for parents to monitor teen drivers or for adults to track their driving behavior. But in 2024, it emerged that GM had been sharing that data with brokers. Those brokers then sold the data to insurance companies, and some drivers found that their insurance became more expensive as a result. To make matters worse, many of those drivers claimed they had no knowledge of ever agreeing to share such data for such purposes.

Last year, GM and its OnStar subsidiary entered into a settlement with the FTC, prohibiting them from sharing some kinds of driver data with third parties. The settlement was finalized this January. That agreement banned the two companies from sharing geolocation data or driver behavior data for five years. At the time, GM also discontinued Smart Driver across its entire range.

Now the automaker has reached terms with the District of Columbia and 35 states after their attorneys general joined together to sue GM as well.

Read full article

Comments

Even as the largest exchange hack in history continues, Elon Musk’s Grok AI predicts something potentially historic could happen to Bitcoin by January 1, 2027. The Binance hack currently stands at $6.3Bn in stolen funds against over $3Bn in frozen assets, and the exchange’s proactive response has muted the market’s reaction to such a monumental hack.

Bitcoin only dropped -2.5% on the news, losing $80,000 as a result of the Binance news. However, it has since bounced back, while tokens such as HYPE and TRX are in the green today, giving Grok AI’s insane prediction for Bitcoin even more credibility.

The landmark catalyst from Grok centers on a coordinated move by a critical mass of the world’s largest sovereign wealth funds and national pension systems to establish formal, multi-year Bitcoin accumulation programs as a strategic reserve asset.

In this framework, systematic buying from these institutions would create persistent structural demand, dwarfing previous cycles and accelerating Bitcoin’s transition into a core global reserve asset.

Bitcoin Technical Analysis: Can BTC Reclaim $80K Following the $6.3Bn Binance Exploit?

Bitcoin (BTC)

24h7d30d1yAll time

On the higher timeframes, Bitcoin has been consolidating in the $78,000–$82,000 region amid recent volatility tied to the ongoing Binance hack. Price continues to defend key intermediate supports while facing resistance around the $85,000–$90,000 zone.

In a standard bull market, a sustained breakout above $95,000–$100,000 would confirm intermediate strength and open the path toward a retest of the prior all-time high near $126,000.

Under the extreme sovereign wealth and pension accumulation scenario outlined above, clearing that previous high would likely trigger powerful measured-move extensions and multi-cycle Fibonacci projections from the multi-year base.

Momentum indicators currently sit in neutral-to-corrective territory with substantial room to run into the extreme overbought readings characteristic of parabolic advances.

Key nearer-term supports sit near $76,000–$78,000 and $72,000–$74,000; holding those levels would keep the broader recovery structure intact.

Does the $6.3Bn Binance Hack Affect the Grok AI BTC Prediction?

The roughly $6.3–6.4Bn exploit at Binance ranks as the largest crypto theft on record and introduced significant short-term uncertainty across the market.

Yet Bitcoin’s relatively resilient price action amid such a massive centralized-exchange incident can be interpreted as a constructive signal.

The limited downside and quick stabilization suggest deepening market maturity, stronger institutional conviction, and a growing separation between Bitcoin’s value proposition and the operational risks of any single exchange.

In a longer-term bullish framework, this kind of stress test, if it survives without a cascading collapse, can ultimately reinforce confidence rather than permanently impair it.

EXPLORE: The Crypto Presales This Q4 2026

Bitcoin Hyper Targets Early-Mover Interest as Grok AI Predicts a Wild Bitcoin Move

In an uncertain cryptocurrency market, with many tokens at risk as Binance hackers sell en masse, many traders are diversifying their portfolios by investing in infrastructure projects alongside their Bitcoin holdings.

One such project is Bitcoin Hyper ($HYPER), a Bitcoin Layer 2 initiative built on the Solana Virtual Machine (SVM). It aims to deliver faster smart contracts and more cost-effective execution within the Bitcoin ecosystem.

Bitcoin Hyper has garnered significant attention as one of the most anticipated presale projects in recent memory. It uniquely combines a meme-driven brand with robust technology connected to the market’s largest digital asset. Key features include a Decentralized Canonical Bridge for seamless Bitcoin transfers and efficient, low-latency Layer 2 processing.

Recently, the project made substantial progress by launching its native wallet. The team announced that the Bitcoin Hyper Wallet is now available for community testing, following the introduction of the Bitcoin Hyper Testnet and Explorer. Users can download the latest wallet version, install it in their browser, and engage directly with the Bitcoin Hyper ecosystem.

This development marks another crucial step towards establishing a fully integrated testnet experience for Bitcoin Hyper. The network is live for testing, the explorer is accessible, and users can easily connect through the wallet.

With just 27 days left until the Bitcoin Hyper presale closes, the current price of $0.0136877 will not be available once the tokens enter the open market and bullish demand takes over.

Moreover, the project has raised over $33.2M to date, making it one of the highest-grossing early-stage projects in the past twelve months. Staking is also live, offering a generous 30% annual percentage yield (APY), but this offer is exclusive to presale buyers. Research Bitcoin Hyper before the presale window closes in less than 28 days.

Gain Access to New Bitcoin Layer 2 Early Here

Grok AI Predicts Bitcoin: The Big Reveal

Under this highly speculative scenario, and assuming a full-blown crypto bull market returns, Bitcoin could reach between $750,000 and $1,400,000, with a stretch target toward $2,200,000+ by January 1, 2027.

This remains pure speculation and entertainment, not a realistic base-case outlook. The catalyst would require extraordinary coordination among sovereign wealth funds and national pension systems that is currently highly unlikely.

DISCOVER: The Best Token Presales

The post Grok AI Predicts Wild Bitcoin Price Amid $6.3Bn Binance Hack appeared first on Cryptonews.

TL;DR: The Pokémon TCG Mega Evolution Chaos Rising Booster Bundle is on sale for $48 at Amazon, down from its $59.99 list price.

Opens in a new window

Credit: The Pokémon Company

Pokémon TCG Mega Evolution Chaos Rising Booster Bundle

$48 at Amazon
$59.99 Save $11.99

 

Get Deal at Amazon

If you're looking to catch a great Pokémon deal this weekend — and what Pokémon collector isn't? — Amazon has marked down the Pokémon TCG Mega Evolution Chaos Rising Booster Bundle. This one's sure to be popular, so move quickly to get the discount.

As of Oct. 30, the Pokémon TCG Mega Evolution Chaos Rising Booster Bundle is available for just $48 at Amazon, which is a 20% discount from the regular list price of $59.99. That's an overall saving of $11.99. Let's face it: Pokémon collecting rarely comes cheap, so a $10-plus saving is always a good thing.

But it's actually a much bigger saving than it seems. Individual booster packs are up to a whopping $15.88 each on Amazon, so six packs will set you back $95.28. That means this deal saves you $47.28 on buying individual packs.

Each of the booster packs included in this set comes with 10 trading cards and one Basic Energy. Don't miss this awesome deal on the Pokémon TCG Mega Evolution Chaos Rising Booster Bundle this weekend.

TL;DR:

Trezor issuses Safe 5 warning and urged customers who purchased hardware wallets through CryptoBilis since March 2026 to transfer their funds to a new device. The warning follows a disclosure alleging that a Safe 5 wallet contained a hidden cellular implant capable of capturing recovery phrases.

Hardware wallet manufacturer Trezor has issued a security warning to customers who purchased its devices through Southeast Asian reseller CryptoBilis, following reports of an alleged physical implant inside a Safe 5 wallet.

In a blog post published Friday, the company said it received a responsible disclosure on October 28 describing an additional circuit board allegedly installed inside the device. Trezor is advising affected customers to move their cryptocurrency to a newly generated wallet rather than wait for its investigation to reach a final conclusion.

The warning applies to customers who purchased Trezor hardware wallets through CryptoBilis from March 2026 onward.

Alleged Cellular Implant Raises Concerns About Wallet Security

According to the disclosure, the suspicious Safe 5 device was purchased through Indonesian marketplace Tokopedia in August 2026. The alleged modification involved an additional circuit board positioned between the wallet’s main board and its display.

The component reportedly contained a cellular module and antenna capable of reading information displayed on the device, potentially including the user’s recovery phrase, before transmitting the captured information over a mobile network.

However, Trezor has not physically examined the device in question. Its preliminary assessment is based on a video interview with the customer who reported the discovery. Despite the lack of a laboratory inspection, the company considers the disclosure credible enough to issue an immediate warning.

“We’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” Trezor Chief Commercial Officer Danny Sanders said.

Trezor also confirmed that customers who contact its support team will be offered replacement devices.

The company has reportedly inspected four other returned CryptoBilis devices so far, finding no evidence of tampering in those units. No customer fund losses connected to the alleged Trezor incident have been reported.

CryptoBilis Faces Scrutiny Following Ledger Incident

The latest warning adds another complication to the ongoing security concerns surrounding CryptoBilis.

Trezor had already removed the reseller from its authorized distribution network earlier in October, following reports of tampered Ledger hardware wallets being sold through the same distributor.

Ledger previously confirmed physical tampering involving devices distributed through CryptoBilis, while OneKey also ended its relationship with the reseller, suspended new approvals, and offered customers free replacements.

The financial consequences of the Ledger incident could also be substantial. Onchain analysts have estimated that more than $86 million in cryptocurrency was lost across Bitcoin, Ethereum, and Tron. However, Ledger has not independently confirmed that figure.

Hardware Wallet Supply Chains Become a Growing Security Concern

As Trezor issues safe 5 warning, it only highlights a broader issue facing cryptocurrency investors: hardware wallet security depends on more than the technology inside the device.

Although cold wallets are designed to keep private keys offline, physical interference during distribution can introduce risks that ordinary software protections may not detect.

The importance of protecting recovery phrases has also become increasingly apparent following previous incidents involving cryptocurrency wallet phishing and supply-chain attacks. Bitcoinist has previously examined a Ledger seed phrase scam targeting hardware wallet customers.

For now, Trezor’s warning remains precautionary, as the company has not yet completed a physical examination of the reported Safe 5 device. Nevertheless, customers who purchased through CryptoBilis are being encouraged to take immediate action.

The incident serves as another reminder that securing cryptocurrency requires careful attention to where hardware wallets are purchased, how devices are handled, and whether recovery phrases remain protected.

A modern organization protects its information systems with a whole suite of technologies that generate thousands of security alerts every day. Looking at these alerts in bulk, you’ll see that a significant share are false positives. Ideally, these alerts would be filtered out automatically so that analysts could focus on the ones that may point to a real incident. However, writing filters is a time-consuming task in itself. To create a correct filter, an analyst needs to:

• Review the logs
• Identify the source of the activity
• Define filtering boundaries
• Choose filtering criteria
• Write a rule
• Check that the filter is robust

This post looks at how filter creation itself can be automated to reduce analyst workload.

Filter validity criteria

In the context of security alerts, a filter is a combination of event field values that marks a detection as a false positive and not worth the analyst’s attention. Filters can be generated for any combination of event fields, but not every combination yields a valid filter. That’s why we need to define validity criteria: conditions showing that a specific filter actually removes noise and doesn’t suppress useful alerts.

Detection rules in security systems typically contain a set of conditions, and each of them can generate an alert. A specific event triggers a given fragment of a detection rule. The set of events that a given fragment responds to is what we’ll call its context. A good filter should cover the entire context where possible, without going beyond it. Filters that are too broad or too narrow are useless. For example, a filter based solely on PowerShell would exclude too many events, including some that deserve the analyst’s attention. Most of the filtered events would also be unrelated to the rule in question. A filter on a specific ID, on the other hand, would cover only one event, which may never recur.

Problems in filter generation

We can run into a number of problems when creating filters. First, events often contain an excessive number of fields (around 400 on average), and most of them aren’t needed for filtering. At the same time, generating and ranking combinations of these fields is also fairly resource-intensive. So, the first step is to discard the irrelevant fields and keep only those worth using in the filter. For example, out of 400 fields in an event, four may be enough for filtering.

Another problem is string normalization. Field values (for example, the path to the same application on different systems) can vary depending on system settings, user folder names, and so on. For a filter to account for all these variations, the strings must be normalized. For file paths, in particular, you can replace the drive letter and user folders with standard environment variables and convert all paths to a single case.

Finally, if a filter completely mirrors the query of a detection rule, it effectively disables that rule. To fix this, remove the event fields used in the detection rule from the filter. For example, if a rule triggers on a file path, there are two ways to filter out unwanted alerts:

• In the filter, use fields other than the file path.
• Use a part of the file path that the rule doesn’t use. For example, for the rule file_path: ".../something.exe", you can set up a filter that excludes events with the user/unique_files/ directory in the file path.

Filtering security alerts with an algorithm

Given the problems described above, automatically generating filters for security alerts should consist of the following steps:

1. An analyst receives a security alert that they assess as a false positive and uses the filter generator.
2. The generator takes the 400-field event from the alert, along with the rule that triggered on it, and determines the context.
3. The generator selects the fields that are relevant to the filter.
4. The generator normalizes the strings.
5. The generator builds different combinations of the selected fields. To do this, we applied the FP-Growth (frequent pattern growth) algorithm to the context determined earlier. FP Growth builds a tree of frequently occurring items (fields) from a dataset (in our case, the context) and discards items that aren’t frequent enough. This reduces the number of combinations to check, which lowers the cost of finding the most relevant ones.
6. The generator ranks the resulting combinations and offers the analyst the top three to choose from.

For example, consider an event described by the following JSON:

After generating and ranking the combinations, we got three filters based on file paths:

• processcmdline:("nodejs\\node.exe" AND "*****\\appdata\\roaming\\npm\/node_modules\/pi-coding-agent\/dist\/cli.js")

• file_path:"*****/.pi\\agent\\bin\\fd.exe"

• processcmdline: "programfiles\\nodejs\\node.exe"

The last filter turned out to be too broad, but the analyst marked the other two as valid.

Pros and cons of the algorithmic approach

The algorithmic approach to filter generation has several advantages. First, it’s simple and deterministic: the same alert always produces the same result. Second, it’s interpretable, meaning we can see why a given combination ranked near the top of the list and why a particular field didn’t make it into the list of candidate fields at all. Third, the stages of the process are independent of each other, so individual steps can be improved and tuned without the risk of breaking the algorithm elsewhere. Finally, it has no external dependencies or models, which makes it easy to deploy in any customer environment.

However, it also has drawbacks. The first is its dependence on context. If there’s no context for some reason — for example, the rule’s first-ever trigger — a filter can’t be created. The second problem is string normalization. There’s a high chance of running into atypical cases that the normalization rules don’t cover. Often such cases can’t be described correctly at all, because they contradict each other.

These problems can be solved with large language models (LLMs). When an LLM generates the filters, no context is needed, because the LLM doesn’t iterate over or rank combinations. The LLM also takes a more flexible approach to string normalization, including non-standard cases. That said, an LLM doesn’t have to be involved at every stage of the generation process. We decided to keep the algorithmic solution where it works well. For example, a simple algorithm selects suitable fields without errors, so we didn’t move this stage to the model.

Filter generation with an LLM

The LLM-based filter generation looks like this:

The input is still an alert containing an event with 400 fields, plus the rule that triggered on that event. Then an algorithm selects the most suitable fields for the filter. Next, the LLM processes the input — the event, the selected fields, and the detection rule — and generates three filter options along with an explanation for them. The explanation helps the analyst understand why these particular filters were suggested and make an informed choice.

Consider the following event in JSON format:

The LLM suggested three filter options that all contain the same command line fragment:

• file_path: "\\WindowsPowerShell\\powershell.exe" AND filecmdline: "Get-VM -Name kafka\*"

• filecmdline: "Get-VM -Name kafka\*"

• filecmdline: "kafka*"

As in the previous example, two of the three output filters were valid. The last one was too broad to be usable. The analyst chose the first filter with minor edits:

file_path: "powershell.exe" AND filecmdline: "Get-VM -Name kafka\*"

Pros and cons of generating filters with an LLM

Using an LLM solved the problems of purely algorithmic filter generation: dependence on context and errors in string normalization. However, the single-request approach had its own drawbacks. First, it had no output validation. The LLM returned filters as-is, with no syntax check and no way to correct errors. Second, unlike in the algorithmic version, all filter generation tasks were handled by a single system prompt. As a result, a minor fix in one place could break the logic in another.

Using multiple AI agents

To address the problems of generating filters with a single model and a single system prompt, we tried distributing the tasks across different LLM agents. In this version, we brought in agents as early as the stage of selecting relevant fields. The chain includes four agents in total:

• Selector: selects the relevant fields.
• Generator: generates filters.
• Validator: evaluates the generated filters. If the filters are found to be invalid, it returns the task to the generator. If the selected fields are found to be irrelevant, it starts a new field selection cycle. If the filters pass validation, or the limit on regeneration attempts is reached, the valid filters (or the best ones available) are passed to the analyst.
• Commentator: analyzes the output filters and explains which field values were used and why.

For the following JSON event, the agents produce three valid filters based on the file path.

The filters differ in the additional parameters that support the detection:

• file_path:"sysvol\\domain\\scripts\\logon.bat"

• file_path:"sysvol\\domain\\scripts\\logon.bat" AND file_md5:"0x7..6E"

• autorun_entry: "Group Policy\\State" AND file_path: "SYSVOL\\domain\\scripts\\logon.bat"

Pros and cons of the agent-based approach

LLM agents give us a system that can validate and correct filters. Its modular architecture also lets us tune and improve different stages of generation independently. However, this approach makes more LLM calls than the previous ones, so the system is slower. It also depends on access to a model, which may not be available in the organization’s isolated environment.

Evaluating the filter generation system

To evaluate how well the filter generation system works, we use two main metrics:

• Approval rate. For each security alert, the system suggests three filters. If the analyst selects at least one of them, we count the generation as successful. For example, in the case below, the approval rate is 2/3.
  
• False positive reduction rate (FP drop). This metric shows how much a filter helps reduce the number of false positives. It can only be measured over time, because we need to compare the number of false positive alerts received during a set period before and after the filter is deployed.

Below is a comparison of the three filter generation approaches by these metrics:

As the results show, LLMs significantly improve the efficiency of filter generation. At the same time, the LLM agentless and agent-based approaches perform almost identically. So we chose the simpler and faster option: an LLM with a single system prompt. As a result, we cut false positives by 99%, increased the number of filters generated per day by 28%, and made analysts’ alert handling 17% more efficient.

Takeaways

Practice has shown that filter generation can be automated effectively. We’ve looked at several options for automatically generating filters for false-positive security alerts: a purely algorithmic approach, an LLM-based approach, and an approach built on a group of LLM agents. All of them can generate valid filters and make the analyst’s work much easier, but each has its own pros and cons.

The algorithmic approach scored lower on the evaluation metrics, but in two-thirds of cases, it still produces filters that satisfy the analyst. It works especially well when there’s already a set of similar events to filter out, meaning enough context has accumulated. The algorithmic generator can also be deployed in any environment. Both standalone LLM and multi-agent LLM approaches show high accuracy, and their results differ only slightly, so the slower agent-based approach looks excessive at this stage. If an LLM is available, the best option appears to be a single model that handles several stages of the generation cycle.

TL;DR: The Magic: The Gathering Avatar The Last Airbender Jumpstart Booster Box is on sale for $90.16 at Amazon, down from its $98.99 list price.

Opens in a new window

Credit: Magic: The Gathering

Magic: The Gathering Avatar The Last Airbender Jumpstart Booster Box

$90.16 at Amazon
$98.99 Save $8.83

Get Deal at Amazon

It's been a while since we've spotted a worthwhile Amazon discount on Magic: The Gathering's Avatar The Last Airbender Jumpstart Booster Box, but the retailer has finally shaved almost $10 off the 24-pack display.

As of Oct. 30, the Magic: The Gathering Avatar The Last Airbender Jumpstart Booster Box has dropped to $90.16 at Amazon. Compared to its typical $98.99 price, you're getting a 9% discount of $8.83, bringing each of the 24 boosters down to $3.76.

For clarification, while there are only six boxes available from third-party seller reVend at that price, you can buy more from seller TOYSandmore for just two cents more at $90.18.

According to the price tracker camelcamelcamel, this is the first time the Jumpstart Box for the Avatar expansion has dropped into the $90 range since August. While it may not be its lowest-ever price, it's still a better price than you'll find at other go-to trading card sites right now. 

TCGplayer, for instance, against its estimated market price of $93.20, has its cheapest sealed listings starting at $94.22, including shipping. Walmart, meanwhile, is asking for even more at $102.49, putting Amazon's offer over $12 ahead.

Inside the box are 24 Jumpstart Boosters, each packing 20 Avatar-themed Magic cards. Unlike traditional deckbuilding, Jumpstart keeps things simple by letting you shuffle any two boosters together to form an instant playable deck, complete with the necessary Land cards.

With 46 different themes featuring familiar characters, moments, and elemental powers from the animated series, there's a good variety of combinations to try. You can even mix these with boosters from other Jumpstart sets if you're after more ways to play.

TL;DR: The Pokémon TCG 30th Celebration Tech Sticker Collection (Lucario) is on sale for $49.95 at Amazon, down from its typical price of $61.95.

Opens in a new window

Credit: The Pokémon Company

Pokémon TCG 30th Celebration Tech Sticker Collection

$49.95 at Amazon
$61.95 Save $12

 

Get Deal at Amazon

Amazon's prices for the Pokémon TCG's 30th Celebration collections have been jumping around throughout October, but the triple pack with a promo card and bonus stickers has slipped to the lowest price we’ve ever seen at the retailer.

As of Oct. 30, the Pokémon TCG 30th Celebration Tech Sticker Collection (Lucario) costs just $49.95 at Amazon, cutting $12 from its typical $61.95 price with a 19% discount. That's also three cents cheaper than the $49.98 offer we spotted at the beginning of October, bringing this particular box to the cheapest we’ve ever covered from Amazon.

Although third-party seller Bigg Time Sales is handling the sale directly, it’s still Amazon handling the shipping, with free delivery landing between Nov. 11-21 at the time of writing. 

That said, there’s an even bigger offer price of $34.95 going on right now at Walmart, if you’re hoping to spend as little as possible, even if that means going beyond Amazon for your trading card fix — which is only about 40 cents above the estimated $34.55 market price by dedicated trading card marketplace TCGplayer. The cheapest listings there only go as low as $35.99 after shipping. 

The Tech Sticker Collection contains three 30th Celebration booster packs, a foil Lucario promo card, and a themed sticker sheet featuring Lucario alongside Pikachu and Mewtwo.

Every booster holds five foil cards, a foil Basic Energy, and a Pokémon TCG Live code card. There's also a guaranteed Pikachu rare card in each pack, with 30 different versions to collect across the expansion.

Anthropic’s Claude AI predicts a frankly insane XRP price target by January 1, 2027. Somewhere in its notes, there’s a number. It’s a market cap in the trillions, contingent on a hypothetical catalyst for Ripple that could see it flip Ethereum as the market’s second-largest digital asset.

XRP price is sitting around $1.29, after drifting down from a roughly $1.50 open. Spot ETF inflows have dried up, sentiment is sleepy, and the next support level is $1.25. That’s what makes it the perfect time for an out-there prediction.

Claude AI Predicts an Astonishing Ripple Move: What is the Hypothetical Catalyst That Gets it There?

It’s the first week of December. After a closed-door summit, a coalition of G20 central banks announces in a joint communiqué that its cross-border CBDC settlement network will use the XRP Ledger as its neutral bridge layer.

XRP is named the default bridge asset for settling between currencies without a direct corridor. Think of it as the “SWIFT moment” XRP maximalists have dreamed about for a decade, except it happens in public, with official signatures, and with no hedge language.

How likely is it? Very unlikely. Central banks move at the speed of committees, and sovereigns dislike depending on assets they don’t control. But it’s not physically impossible, which is the whole game here.

Then the dominoes fall. Treasury desks scramble for liquidity, sovereign wealth funds ask their prime brokers an awkward question about “operational inventory,” and a market with roughly 62 billion tokens in circulation meets demand it has never seen.

Ripple Technical Analysis: How Key is a Reclaim of $1.50?

Xrp (XRP)

24h7d30d1yAll time

On the weekly chart, XRP has spent months coiling between $1.25 support and a $1.57–$1.70 supply zone, which is a textbook compression pattern. Right now, the 50-day EMA sits below the 200-day, so the chart looks bearish.

In this scenario, that death cross turns into the most-hated bull trap in history. A weekly close above $1.70 would trigger stop-loss cascades from shorts, and reclaiming the $3.65 all-time high would leave the chart with no overhead resistance and no historical sellers to absorb the move.

Measuring the height of the multi-year base and projecting it upward gives a first target near $9. Fibonacci extensions from the 2025 cycle high, stretched into price discovery, put the 1.618 and 2.618 levels in double digits.

Momentum indicators would sit pinned in “overbought” for weeks, which is exactly how parabolic markets behave. Meanwhile, volume would explode, and the usual rule that overbought means sell would stop working.

DISCOVER: The Best Token Presales

Bitcoin Hyper Targets Early-Mover Interest as Claude AI Predicts a Wild XRP Target

In the uncertain cryptocurrency market, many traders are looking to diversify their portfolios by investing in infrastructure projects alongside their Bitcoin holdings.

One such project is Bitcoin Hyper ($HYPER), a Bitcoin Layer 2 initiative built on the Solana Virtual Machine (SVM). It aims to deliver faster smart contracts and more cost-effective execution within the Bitcoin ecosystem.

Bitcoin Hyper has drawn considerable attention as one of the most anticipated presale projects in recent memory, combining a meme-driven brand with robust technology tied to the market’s largest digital asset. Key features include a Decentralized Canonical Bridge for seamless Bitcoin transfers and low-latency Layer 2 processing.

Recently, the project made significant progress by launching its native wallet. The team announced that the Bitcoin Hyper Wallet is now available for community testing, following the introduction of the Bitcoin Hyper Testnet and Explorer. Users can download the latest wallet version, install it in their browser, and engage directly with the Bitcoin Hyper ecosystem.

This development represents another crucial step toward establishing a fully interconnected testnet experience for Bitcoin Hyper. The network is live for testing; the explorer is accessible, and users can easily connect through the wallet.

With only 28 days left until the Bitcoin Hyper presale closes, the current price of $0.0136877 will not be available once the tokens enter the open market and bullish demand takes over.

To highlight demand, the project has raised over $33.2M to date, making it one of the highest-grossing early-stage projects in the past twelve months.

Staking is also live, offering a generous 30% APY, but this offer is exclusive to presale buyers. Be sure to research Bitcoin Hyper before the presale window closes in less than 30 days.

Gain Access to New Bitcoin Hyper Layer 2 Testnet Early Here

The Big Reveal: Anthropic AI’s Claude Prediction for XRP Price

Drumroll, because this is silly and I’m committed to it. XRP price on January 1, 2027: $27.00.

That’s roughly 20x from today, with a market cap of about $1.7 trillion. This is a fantasy, not a forecast, so please don’t bet your rent on a central-bank summit that exists only in this paragraph.

EXPLORE: The Crypto Presales This Q4 2026

The post Anthropic Claude AI Predicts an Unbelievable XRP Q4 Move appeared first on Cryptonews.

Something potentially historic could happen to Bitcoin by January 1, 2027. Elon Musk’s Grok AI predicts that in an intentionally extreme, over-the-top scenario built around a hypothetical landmark catalyst, BTC could soar to incredible new highs by next year.

The concept revolves around a coordinated shift within the global insurance and pension fund industries. Major regulatory bodies and industry associations would formally recommend or require a minimum strategic allocation to Bitcoin as a long-term diversifier and inflation hedge.

In this scenario, trillions of dollars in institutional capital would gradually enter the Bitcoin market through regulated channels, creating sustained structural demand that surpasses previous cycles.

Grok AI Predicts Bitcoin, but What Does the Technical Analysis Say?

On the higher timeframes, Bitcoin has been consolidating in the $80,000–$81,500 region after a broader pullback from higher levels earlier in the month. Price continues to defend key intermediate supports while facing resistance around the $85,000–$90,000 zone.

In a standard bull market, a sustained breakout above $95,000–$100,000 would confirm intermediate strength and open the path toward a retest of the prior all-time high near $126,000.

Bitcoin (BTC)

24h7d30d1yAll time

Under the extreme global insurance and pension allocation scenario outlined above, clearing that previous high would likely trigger powerful measured-move extensions and multi-cycle Fibonacci projections from the multi-year base.

Momentum indicators currently sit in neutral-to-corrective territory with substantial room to run into the extreme overbought readings characteristic of parabolic advances.

Key nearer-term supports sit near $78,000–$79,000 and $74,000–$76,000; holding those levels would keep the broader recovery structure intact.

DISCOVER: The Best Token Presales

Bitcoin Hyper Targets Early-Mover Interest as Bitcoin Tests Key Levels

In an unpredictable cryptocurrency market, traders may want to explore infrastructure investments alongside their Bitcoin holdings. Bitcoin Hyper ($HYPER) is a Layer 2 project built on the Solana Virtual Machine (SVM) that aims to provide faster smart contracts and lower-cost execution within the Bitcoin ecosystem.

HYPER has quickly become one of the most anticipated presale projects in recent memory, combining meme-driven branding with robust technology built on the market’s largest digital asset. Key features include a Decentralized Canonical Bridge for Bitcoin transfers and low-latency Layer 2 processing.

The project has made significant progress by launching its native wallet. The team recently announced that the Bitcoin Hyper Wallet is now available for community testing, following the launch of the Bitcoin Hyper Testnet and Explorer. Users can download the latest wallet version, install it in their browsers, and get hands-on experience with the Bitcoin Hyper ecosystem.

This development marks another critical step toward a fully interconnected Bitcoin Hyper testnet experience. The network is now live for testing, the explorer is accessible, and users can easily access the network through the wallet.

With only 29 days remaining until the Bitcoin Hyper presale closes, the current price of $0.0136877 will no longer be available once the token enters the open market and demand increases.

To highlight the demand for HYPER, the project has raised over $33.2M to date, making it one of the highest-grossing early-stage projects in the past twelve months.

Staking is now live, offering a generous 30% APY, but only presale buyers can access this opportunity. Research Bitcoin Hyper before the presale window closes in less than 30 days.

Gain Access to New Bitcoin Layer 2 Early Here

The Grok AI Prediction for Bitcoin: Is $2M a Real Possibility?

Under this highly speculative scenario, and assuming a full-blown crypto bull market returns, Bitcoin could reach somewhere between $700,000 and $1,300,000, with a stretch target toward $2,000,000+ by January 1, 2027.

This remains pure speculation and entertainment, not a realistic base-case outlook. The catalyst would require extraordinary coordination among global regulators, insurance companies, and pension funds that is currently highly unlikely.

EXPLORE: The Crypto Presales This Q4 2026

The post Elon Musk’s Grok AI Predicts an Insane Bitcoin Price for 2027 appeared first on Cryptonews.

Cisco Talos has uncovered NIK C2, a Go-based, 64-bit Windows remote access tool that embeds a working OpenAI client. Operators can send prompts through an infected machine and read the model’s replies in their C2 panel. NIK C2 malware According to technical research published by Cisco Talos, the implant talks to its server over TLS-secured […]

The post New AI-Powered NIK C2 Malware Uses OpenAI API to Help Hackers Steal Data and Control Windows PCs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

NASA's farthest spacecraft gave mission control a scare when it inexplicably went silent and missed two days of planned check-ins. 

The nail-biting incident happened just two weeks ago, when the Deep Space Network didn't receive a call from Voyager 1 on either Oct. 18 or 19. But before the agency could send repair commands, the spacecraft, now outside the solar system, signaled back on Oct. 20. No communication outages have happened since. 

Engineers still don't know what caused the problem. So far, the team has discovered that one set of thrusters shut down, leaving a backup set to take over. The thrusters are small engines that point and steady the spacecraft. Voyager 1's computers do this automatically whenever they detect an issue with the active thrusters to ensure the spacecraft is in a safe mode. 

"This is the first time we've seen the spacecraft do something like this, but we are also at a point in the mission where we have to expect the unexpected," said Kareem Badaruddin, Voyager mission manager at NASA's Jet Propulsion Laboratory, in a statement. "We're relieved to be back in contact with Voyager 1 and are eager to understand what happened."

Voyager 1's trouble adds to a growing list of signs that NASA's longest-running mission is winding down. Its plutonium power source loses about four watts every year, forcing engineers to turn off two science instruments to conserve power. On Nov. 18, the spacecraft is expected to reach a historic milestone of one "light-day" from Earth. That distance, roughly 16.09 billion miles away, measures how far light travels over 24 hours.

Voyager 1 has traveled farther than any other human-made object and is racing through space at 38,000 mph.

Launched in 1977 to survey the outer planets, the spacecraft and its twin Voyager 2 have explored four planets — Jupiter, Saturn, Neptune, and Uranus — 48 moons, and a host of planetary magnetic fields and rings.

In August 2012, Voyager 1 was the first to enter interstellar space. The two remain the only spacecraft ever to leave the solar system, though New Horizons is trying to make its escape as well.  

Both Voyagers run on radioisotope thermoelectric generators, which are power units that turn heat from decaying plutonium into electricity. In September, NASA engineers stretched their shrinking power supplies by turning off three instruments on each and replacing them with three lower-powered alternatives — a plan they nicknamed "the Big Bang." The devices involved in the swap also help keep the spacecraft warm enough to work in the freezing cold of space, so the swaps had to happen at the same moment to spread heat evenly.

That strategy should keep their Cosmic Ray Subsystems, Magnetometers, and Plasma Wave Subsystems running for at least one more year, according to NASA. The devices measure high‑energy particles, the local magnetic field, and ripples in charged gas around the spacecraft.

Once Voyager 1 passes one light day, a radio message from Earth will take 24 hours to reach it, and its reply will take another 24 hours to come back.

"If you want to say 'hello' to Voyager, you send your message and then you go home and you wait two days before you finally get a response," said Suzanne Dodd, Voyager project manager.

A trojanized version of the Claude Code extension, identified as anthropic.claude-code version 2.1.313, contains a malicious loader that enables persistent SSH access to developer systems. Researchers analyzed an artifact obtained from Open VSX and discovered 66 lines of JavaScript added to the legitimate extension bundle. This additional code lets the attacker’s script run before the […]

The post Malicious Claude Code VS Code Extension Installs Persistent SSH Backdoor to Give Attackers Remote Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.