Meta’s Muse assistant exposed sensitive personal and business information through its conversation-sharing links after researchers from Claroc enumerated about 6,800 publicly reachable share URLs. Opening a few hundred of those links revealed clearly private items: a candidate’s confidential interview prep naming an internal contact and meeting time; a national marketing firm’s internal revenue review marked for the CEO; a small-business loan application with the requested amount; a to‑do list containing a bank fraud alert and partial account number; a real‑estate investor’s performance report with property addresses and exact returns and mortgage figures; and a workplace staff vacation calendar listing dozens of employees. Claroc reported the issue via Meta’s bug bounty on October 8 and dubbed these discoverable pages “GhostShares.”
The root cause was a design choice that placed user-supplied conversation titles in the subdomain of cf.metaaiusercontent.com, which made entries discoverable via passive DNS services that log historical DNS resolutions. Because the conversation title appears in the DNS-recorded hostname, a single passive DNS query sufficed to find many sensitive links. Meta has paused the share feature while reviewing the discovery risk and said it opened a Muse bug bounty program. The exposure compounds earlier security concerns, including a macOS zero‑day and a simple ClickFix hijack demonstration, raising questions about granting Muse broad account access.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A PHP vulnerability currently has no working exploit, despite many fake PoCs circulating online. LLMs have falsely been portrayed as able to develop exploits, but practical testing shows no effective attack exists yet. (eliastaylor.com)
The Trump administration denaturalized two individuals who obtained U.S. citizenship by hiding their criminal activities. The move aims to revoke citizenship from those who gained it through fraudulent means. (justice.gov)
Meta's new enterprise terms state that if its AI makes a mistake, the customer is legally responsible. The terms also expand liability to content from partners and give Meta rights to scrape and use user content. (cio.com)
A vulnerability in HTTP/3 implementations allows remote clients to cause servers to allocate excessive memory by exploiting QPACK header compression. Seven of ten tested implementations are vulnerable, with some already patched to prevent resource exhaustion. (foxio.io)
Oracle has issued a security alert for CVE-2026-91403, affecting multiple Java and GraalVM products. Patches are available for supported versions, and Oracle recommends upgrading to ensure security. (oracle.com)
Help desks are increasingly targeted by social engineering attacks to reset MFA accounts. Effective verification methods for remote staff and contractors are being explored to prevent breaches. (news.ycombinator.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.