Quantum study: 22,593 cat qubits could break RSA-2048 in 3.14 days

Preprint claims 22,593 cat qubits could crack RSA-2048 in 3.14 days

A not-yet-peer-reviewed preprint on the Cryptology ePrint Archive, led by researchers from Paris-based Alice & Bob, estimates that 22,593 superconducting cat qubits could factor an RSA-2048 modulus in 3.14 days. Linking 10 such machines, or 610,530 cat qubits, would cut that to 1.25 hours, and 29,588 cat qubits could bypass Bitcoin’s elliptic curve cryptography in 61.8 minutes. Cat qubits, photons trapped in a tiny metal box, exponentially suppress bit-flip errors while only linearly increasing phase-flip errors. No 23,000-qubit computer exists; Caltech’s 6,100-qubit laser-trapped array is not a functional computer. The estimates assume 100-year bit-flip times, while Alice & Bob recently measured 44 minutes with 11 photons per qubit.

A Quantum Computer Could Crack Major Internet Encryption in Just 3 Days, Study Suggests →

GNU Savannah command injection could have backdoored Bash

Researchers found GNU Savannah, the forge hosting Bash and Coreutils, vulnerable to command injection through account email addresses. Savane’s validator accepted dot-atom addresses containing backticks, $, braces, slashes and pipes, and the Test GPG keys function passed the address to proc_open() via /bin/sh. An address like atouch${IFS}/tmp/savane-rce-proof@attacker.example ran commands as the web server user. The flaw shipped with Savane 3.17-c369 on March 7, 2026 and affected savannah.gnu.org for about two months. A reverse shell exposed database credentials, and researchers set the superuser flag on their own account to impersonate Bash maintainer Chet Ramey; no SSH key was added and bash.git was untouched. A full audit produced 26 findings, and the FSF patched systems and published an incident report.

Securing Internet-Critical Software: How We Could Have Backdoored Bash | Hacktron AI →

Topics: Supply chain attacks

Vercel rolls out device-bound sessions against stolen cookies

Vercel is gradually rolling out Device Bound Session Credentials (DBSC) for logins at vercel.com, where developers manage projects and deployments. Announced by CTO Malte Ubl on X, the feature binds a session to the user’s device using a private key stored in a TPM, so a stolen session cookie cannot be reused elsewhere. Ubl said the key can never be retrieved, not by Vercel, the user or malware. DBSC complements Chrome’s App-Bound Encryption and currently works in Chrome on macOS and Windows, with a gradual rollout to handle OAuth edge cases. Vercel is also rolling out DPoP for its CLI and launched Security Review in public beta for Pro and Enterprise teams, scanning code changes on every push to connected GitHub repositories. Scans are free until November 10, 2026.

Vercel rolls out new protection against stolen session cookie attacks →

Topics: Password security

Unit 42 ties Linux espionage campaign to SysGoRAT and likely AI-written scripts

Palo Alto Networks Unit 42 observed a cyber espionage campaign targeting Linux infrastructure tied to government entities between October 2025 and April 2026, tracked as CL-UNK-1211. Researchers Roey Porat and Tom Fakterman said attackers ran extensive reconnaissance, dumped sensitive databases and tried to exfiltrate government mailboxes to access social media accounts. The campaign used open-source tools, PHP web shells and a custom Go-written remote access trojan called SysGoRAT, which connects over WebSocket to a hard-coded IP and supports command execution, screenshots, file exfiltration and proxying. Malicious PHP and shell scripts, likely AI-generated, contained conversational step-by-step reasoning notes. Attackers also replaced .bashrc with a credential-stealing version and planted deceptive red-team markers to disguise activity as a legitimate security assessment.

Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts →

Topics: State-sponsored hackingMalware & infostealers

Jailbreaking a Renault TomTom unit to change the clock

A 2014 Renault Latitude’s TomTom Carminat LIVE navigation unit cannot change its clock without a navigation SD card, because the menu definition pointing to the Settings applet is read from the card itself. The unit’s DRM rejects cards lacking the correct CID, and third-party cards cost roughly 60 EUR. The owner built a QEMU emulator with a custom Linux 2.6-based kernel and a CAN emulator to test attacks. Exploiting the master.script parser, a LOG command with path traversal wrote to /proc/sys/kernel/core_pattern, and a SHEX command ran dbus-monitor, whose SIGABRT coredump piped a payload script to the kernel as root. Code execution was confirmed by calling reboot, and the timezone offset in settings.dat was changed from 180 to 120 minutes.

Jailbreaking my car’s navigation system just so I can change the time | nns.ee →