Google researchers uncover criminal zero-day exploit likely built with AI

Google Threat Intelligence Group linked a recently observed zero-day to AI-assisted development by a criminal group; the exploit targeted a popular open-source web-based systems administration tool and allowed attackers to bypass two-factor authentication once they had valid credentials by exploiting a semantic logic/trust-assumption error. Separately, Linux kernel developers are discussing an emergency runtime “killswitch” after disclosure of two local privilege-escalation bugs (including CVE-2026-31431). Other notable items in the feed: Instagram removed end-to-end encryption for DMs (sparks