Nvidia's Groq acquihire is on the DOJ's radar, but it's already too late
Nothing OS 5 leaves three phones without Android 17. See which Nothing devices are affected, what support remains, and whether owners should upgrade.
The post Nothing OS 5 Ends Support for Three Phones: What Owners Should Do Next appeared first on TechRepublic.
Nothing OS 5 leaves three phones without Android 17. See which Nothing devices are affected, what support remains, and whether owners should upgrade.
The post Nothing OS 5 Ends Support for Three Phones: What Owners Should Do Next appeared first on TechRepublic.

ยฉ Amelia Brust/Federal News Network


Nearly every country represented in the United Nations General Assembly recently voted in favor of promoting world maps that more accurately show the size of various continents. But the UN resolution is unlikely to change how millions of people regularly see versions of 16th-century Mercator maps depicting skewed continent sizes in navigation apps.
On September 4, the African-led resolution attracted 164 votes in favor, with six countries abstaining from voting. Only the United States voted to oppose the resolution after describing it as a โradical ideological project,โ according to UN News.
The non-binding UN resolution does not impose map changes on anyone. Instead, it โencourages governments, schools, international organizations, and technology companies to use the Equal Earth projection and other so-called equal-area maps when relative size matters,โ UN News reported. The resolution also encourages teaching about the trade-offs that arise from depicting a spherical planet on a flat map.


ยฉ UN Photo/Loey Felipe
Chinaโs military is exploring humanoid robots for urban combat as the countryโs commercial robotics industry dominates global shipments and manufacturing.
The post China Is Turning Its Humanoid Robot Boom Toward the Battlefield appeared first on TechRepublic.
Chinaโs military is exploring humanoid robots for urban combat as the countryโs commercial robotics industry dominates global shipments and manufacturing.
The post China Is Turning Its Humanoid Robot Boom Toward the Battlefield appeared first on TechRepublic.
Welcome back, aspiring cyberwarriors!
Sometimes you might run the same model twice and get different results. That often happens when youโve upgraded it with skills. Skills are detailed text documents that lay out the tools the model should use, the approach it should take and how it should analyze the results. Good skills are practical, pulled from actual reports on HackerOne and other bug bounty platforms. A model can still lean on its own knowledge, but thatโs just less efficient.
There are plenty of skills out there you might come across, but not everything can be trusted. Some skills can simply be dangerous and infect your system. To make sure they are safe, you can check them with SkillSpector by NVIDIA, so you donโt end up with anything malicious on your system.
Both of these repositories do bug bounty hunting end to end, but they go about it in almost opposite ways.
The first is called Bountyforge. Itโs actually just one single skill file, but itโs smart enough to split itself into eight different mini agents that all work at the same time. One looks at websites and apps, another at crypto and blockchain, others go after different angles hackers can exploit. It also checks each finding with four different tests to make sure itโs not a false alarm. Then you get a report in whatever format the bug bounty program wants.

You donโt even need Claude Code or any other coding tool for this, you can just run it right inside the regular Claude website in your browser.
The second bug bounty repository is Claude-BugHunter. It takes the opposite approach. The repo has 83 skills and almost half of those were built by studying 681 real bug reports that people actually got paid for on HackerOne. These skills arenโt locked to Claude Code either, you can use OpenCode, Codex or Hermes Agents with them.
Here are a few examples of the results we got with these skills.
API endpoints are often vulnerable and this is worth trying your luck on to see how it goes.

Another approach can be APK reverse engineering. Here we found a hardcoded RSA-2048 signing private key baked into the published APK. With that key, hackers can push a new app to the app store and infect every employee phone, getting access not just to the WiFi network at the workplace but to their personal life too. Quite dangerous.

We found an API endpoint vulnerable to an SQL injection and managed to pull the entire database.

Having skills built on real attacks keeps the model from wandering off into its own weird approaches and missing a lot of good findings.ย
Claude-ADย was made by ADScanPro for testing a companyโs internal network. It gives your model a playbook with skills and agents built for an Active Directory assessment. The developers are upfront that itโs not an auto pwn tool. Itโs meant to guide you through the assessment. Every finding can get mapped to a compliance control (DORA, NIS2 and ENS).
Claude-AD is very careful about getting caught too. It explains what a security team would actually see on their end if that technique got used. And any time itโs about to do something that would actually change things on the companyโs network, it stops and asks for confirmation first.
Antropic-Cybersecurity-Skills is basically a giant reference book. It has 817 skills covering 29 areas of security work, cloud security, malware analysis, all the way down to hardware and firmware. Each skill is its own small file, so your agent will quickly pull out the two or three it actually needs for its task.

Every skill ties back to real security frameworks that companies and auditors already use (NIST CSF, MITRE ATT&CK and so on). So if your model finds a problem using one of these skills, it can also tell you exactly which official standard it violates. You can use it to justify findings to a compliance team.
On an industrial network, a clumsy scan can shut down a production line or damage physical equipment, since a lot of this gear is old and wasnโt built to handle unexpected traffic. Thatโs why the ICS skill by Masriyan is built to never actively touch a live industrial network. Instead, it works off network captures someone already took. It reads the file, recognizes industrial protocols by the ports they normally run on (Modbus, DNP3, Siemens S7, EtherNet/IP, OPC-UA, and more) and counts which devices are talking to each other. It then shows you write commands, these are the ones that change a value on an industrial device. Thatโs the traffic you want to see first.

The second mode skips network captures and instead searches for exposed industrial equipment using Shodan and Censys. The skill can also help your model reason about how an industrial network is laid out and check findings against MITREโs ICS specific attack framework and the IEC 62443 security standard.
Although science isnโt really what we want to focus on here, in one of our SCADA articles we mentioned that to carry out a successful attack requires hackers to understand the technical process of the plant. That means understanding how the chemicals are produced and which units are used along the way. We also showed how vinyl acetate is produced and talked about paracetamol production.
1 kg of paracetamol at 100% purity was reported to cost โฌ8,205, while 1 kg at 99% purity cost just โฌ5. So even a single day of sabotage could cause serious financial damage to an enterprise.

Finding a scientist among hackers is quite a challenge, which is why Stuxnet needed a group of people from different backgrounds working toward one objective. But now hackers can just import different skills to make their attacks more devastating. K-Dense published 140 skills with access to different scientific databases and Python tools.
The real concern here isnโt ICS exploits inside the repository, there arenโt any. Itโs the access to sensitive scientific data paired with an AI agent that can actually understand that data and change it.

AI skills can be a gamechanger, especially when theyโre based on actual reports hackers got paid for. These skills show your model how to approach things and what tools to use during the test, so it doesnโt wander off hallucinating and inventing its own ways of testing things. That can wreck your bug bounty flow, since youโll end up overlooking plenty of potential targets.
Simply relying on the AI to find things isnโt enough, hunters that do it keep getting a lot of dupes. You need to test things manually too. For this reason we created our Bug Bounty training to show you how to find bugs and work with the AI more efficiently.
The post Artificial Intelligence (AI) in Cybersecurity, Part 25: Upgrading Your Model with Specific Skillset first appeared on Hackers Arise.
Microsoft details Windows 11 age-signal APIs that let eligible apps receive age brackets without exposing usersโ exact ages or birth dates.
The post Microsoft Confirms Windows 11 Age Signals for Apps โ But They Arenโt Live Yet appeared first on TechRepublic.
Microsoft details Windows 11 age-signal APIs that let eligible apps receive age brackets without exposing usersโ exact ages or birth dates.
The post Microsoft Confirms Windows 11 Age Signals for Apps โ But They Arenโt Live Yet appeared first on TechRepublic.