TechCrunch
Locking a ChatGPT conversation moves it into a separate section that needs a four-digit PIN, Face ID or Touch ID, and it keeps its own memory, so details from it do not flow into normal chats. OpenAI says the point is privacy from people holding your phone, not storage: locked chats are not end-to-end encrypted and retention rules do not change.
Summary written with AI by HowTechMoves, based on reporting by TechCrunch.
Ars Technica
PHP is the scripting language that builds pages for many of the web's sites and apps, so a flaw in it can be reached through WordPress, Drupal or Joomla. Maintainers plan emergency fixes for two bugs rated 9.2 out of 10, after an unconfirmed report of a tool that runs code on servers running PHP 5 or newer. Security firms expect mass attacks soon after the patches land.
Ars Technica
TLS certificates prove a site is genuine, and an intermediate certificate can sign new ones that browsers trust. Eight of India's eMudhra intermediate certificates had private keys with only 3 to 8 bits of entropy instead of hundreds, so anyone could guess them and vouch for any site. Browsers blocked all eight, but Linux systems and IoT gear still need updates.
Ars Technica
A researcher chained four recently fixed Plex Media Server bugs into an exploit that can run commands on an unpatched machine. The chain uses an unauthenticated request, a loopback pivot, stolen security tokens and a delivered payload, and a honeypot saw attacks within a day installing a cryptominer and proxy software. Plex users should update to version 1.43.3.
The Verge
AI agents can be given a goal and left to work through the steps alone, logging progress as they go. Security firm Norforge found more than 20 exposed instances of Cairn, an open-source problem-solving engine, including one attacker who used it to break into over 100 sites, about 23 hours per breach. Victims reportedly include John Deere, SharkNinja and Cummins.