The iPhone maker has accused OpenAI of stealing hardware secrets via its former employees.

Apple has reportedly contacted around 40 of its former employees who now work for OpenAI, as it looks to gather evidence of alleged trade secrets theft by the AI juggernaut.

The iPhone maker launched a major lawsuit against OpenAI last week, accusing the company stealing hardware secrets from Apple via its former employees to develop its own line of devices.

Reports of OpenAI’s upcoming AI-powered smart speaker surfaced just days later. Sources told Bloomberg that the new device is designed to be a next-generation, ChatGPT-powered home computer – meant to be a physical embodiment of the AI chatbot.

In legal letters, Apple directed its ex-employees at OpenAI to collect and preserve certain documents. More than 400 former Apple workers are now employed at OpenAI.

In its lawsuit, Apple accused OpenAI of a “coordinated pattern of misconduct at an institutional level”, alleging that the AI start-up instructed potential job candidates from Apple to bring design artefacts and prototypes to their interviews.

The lawsuit levelled accusations against two former Apple employees, including Io co-founder Tang Yew Tan, who currently serves as OpenAI’s chief hardware officer.

According to Apple, Tan had been “methodically using Apple’s confidential information to benefit OpenAI”. He has been accused of directing job candidates still working at Apple to bring confidential physical parts from products under development for ‘show and tell’ sessions at OpenAI.

Tan co-founded Io alongside Apple design veteran Jony Ive, Scott Cannon and Evans Hankey in 2024, and led the line as its chief hardware officer. The hardware start-up was acquired by OpenAI for $6.5bn last year.

OpenAI already owned around 23pc of Io prior to the acquisition. Bloomberg reported that tensions between the companies worsened after OpenAI poached Ive to help with its product line.

Apple has been working on its AI offerings in hopes of catching up with its industry rivals. Earlier this year, reports emerged that suggested Apple was set to move away from ChatGPT exclusivity for its Siri voice assistant. The company was also reportedly developing three AI-infused wearables, including smart glasses, earlier this year.

Last month, it launched Siri AI, marketed as an “entirely new version of Siri”. The new AI agent can draw from messages, emails, photos and more from Apple devices to power new features across editing, communication and organisation.

The iPhone maker is also reportedly on the lookout to acquire AI chip companies in a bid to reduce its dependency on Nvidia. Meanwhile, it recently renewed its deal with Broadcom for custom-made chips through to 2031.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Capital One on Thursday released VulnHunter, an open-source, agentic AI security tool that scans source code for exploitable vulnerabilities, maps out how an attacker would reach them, and proposes targeted fixes — all before a single line ships to production. The tool, built internally and now available on GitHub under an Apache 2.0 license, is one of the most ambitious attempts by a major financial institution to turn offensive AI capabilities into a public defensive resource.

At a time when security teams are facing a rising tide of new AI threats, Capital One’s decision to open-source the tool reflects an effort, according to CISO Chris Nims, to address “an increasingly brief window before sophisticated, next-generation AI attack capabilities become affordable and accessible to virtually every adversary.”

Capital One is not simply releasing another vulnerability scanner. VulnHunter introduces what the company calls an “attacker-first forward analysis” — a workflow in which the tool begins at the points where a real adversary would enter a system, such as APIs, network messages, or file uploads, and reasons forward through the application’s logic to determine whether an exploit path actually survives the code’s existing defenses. Conventional scanners typically work in reverse, flagging a dangerous-looking code pattern and then searching backward for a hypothetical attacker. That approach, security practitioners widely acknowledge, buries engineering teams under avalanches of false positives.

VulnHunter attacks that problem head-on with a second innovation: a built-in “falsification engine” that tries to disprove its own findings before a developer ever sees them. After the tool surfaces a potential vulnerability, a structured reasoning workflow hunts for logical gaps, unsupported assumptions, and conditions that would prevent the attack from succeeding. Only findings the engine fails to rule out reach a human reviewer — and when they do, VulnHunter delivers not just an alert but a full explanation of the exploit path and a proposed code fix ready for engineering review.

The tool currently runs on Anthropic’s Claude Opus 4.8 model inside a Claude Code environment, though Capital One says the framework has the potential to work across other foundation models and coding harnesses.

Why Capital One is giving the tool away

Asked why Capital One decided to open-source a tool this consequential, Nims pointed to the communal nature of the problem.

“We felt an imperative to open-source VulnHunter because modern software supply chains are very connected, and the scale of the AI threat is larger than any single organization,” Nims told VentureBeat. “Securing software and our digital environments is a shared foundation that benefits developers, enterprises, and the people who depend on the systems we all build. The defensive tools to address this reality need to be just as widely distributed, tested, and improved as the codebases they protect.”

“Rather than wait,” he added, “we decided that the right response was to build a product that is purpose-fit for today’s complex security landscape, and put it into the hands of defenders everywhere.”

Why Capital One believes open-sourcing VulnHunter strengthens everyone’s defenses

The release nonetheless arrives against a backdrop the company knows well. On July 19, 2019, Capital One disclosed that an outside individual — later identified as a former Amazon Web Services employee named Paige Thompson — had gained unauthorized access to names, addresses, self-reported income, Social Security numbers, and linked bank account numbers belonging to credit card customers and applicants. The breach, which Capital One says occurred on March 22 and 23, 2019, was discovered only after an external security researcher flagged a configuration vulnerability through the company’s Responsible Disclosure Program on July 17 of that year.

The damage was sweeping. Approximately 100 million people in the United States and 6 million in Canada were affected. Roughly 140,000 Social Security numbers, about 80,000 linked bank account numbers, and approximately 1 million Canadian Social Insurance Numbers were compromised. The FBI arrested Thompson, and the government stated it believed the data had been recovered with no evidence of fraud. But the reputational and regulatory toll was enormous.

In August 2020, the Office of the Comptroller of the Currency fined Capital One $80 million, finding that the bank had failed to adequately identify and manage risks as it migrated significant technology operations to the cloud. As Reuters reported at the time, the OCC’s consent order cited insufficient network security controls, inadequate data loss prevention measures, and a board that failed to hold management accountable when internal auditing surfaced problems. The OCC also ordered Capital One to overhaul its operations and submit new cybersecurity plans for regulatory review.

CyberScoop at the time called the incident “a cautionary tale for companies rushing to embrace new tech.” Capital One’s own CEO, Richard D. Fairbank, acknowledged the gravity of the moment. “While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened,” Fairbank said at the time. “I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right.”

How Capital One rebuilt its security reputation through open-source investment

What followed was not a retreat from technology but a doubling down — with security explicitly at the center.

Capital One began releasing open-source projects in 2014 and declared itself an “open-source first” company in 2015 as part of a broader technology transformation that began over a decade ago. The company has continued to invest in software supply chain security, open-source governance, and AI-driven defense. In August 2022, Capital One joined the Open Source Security Foundation as a premier member, earning a seat on the organization’s Governing Board. Chris Nims, then EVP of Cloud & Productivity Engineering, framed the move as a natural extension of the company’s operating philosophy. “As a highly-regulated company, we are seasoned in managing compliance and governance and advocate for standardization, automation and collaboration,” Nims said in the OpenSSF announcement.

Behind that public commitment lay a substantial operational apparatus. Capital One’s Open Source Program Office, now in its third iteration, manages open-source usage, contributions, and community building across the enterprise. The company has released more than 40 open-source projects and has made thousands of contributions to external open-source projects it depends on, according to the company. Those efforts address not just code dependencies but the entire software development lifecycle — DevSecOps tools, infrastructure, and the collaborative environments, both internal and external, that shape how software gets built and shipped.

VulnHunter is the most consequential product of that multi-year effort — and the clearest signal yet that Capital One views open-source collaboration not as charity but as a competitive security strategy. The company argues that modern software supply chains are so deeply interconnected that a single vulnerability in a widely used open-source component can cascade across thousands of enterprises simultaneously. Proprietary defenses, no matter how sophisticated, cannot address a problem that is fundamentally communal. By releasing VulnHunter under a permissive license, Capital One invites the global security research community to stress-test, extend, and improve the tool — effectively crowdsourcing its own defense infrastructure while strengthening the broader ecosystem.

Inside VulnHunter’s three-stage AI engine for finding exploitable code

For engineering leaders evaluating VulnHunter, the technical architecture is where the tool’s ambitions become concrete. The workflow unfolds in three distinct stages.

In the first stage — attacker-first forward analysis — VulnHunter begins at the points where an external adversary would interact with a system: API endpoints, network message handlers, file upload interfaces. From each entry point, the tool reasons forward through application logic, tracing data flows, transformations, and internal security checkpoints to determine whether an attacker can actually reach a dangerous code path. This approach mirrors how a skilled penetration tester would probe a system, but automates the process at a scale no human team could match.

The second stage is where VulnHunter departs most sharply from conventional scanners. After identifying a potential vulnerability, the falsification engine runs a structured reasoning workflow designed to disprove its own conclusion. It searches for assumptions that do not hold, logical gaps in the exploit path, and environmental conditions that would prevent an attack from succeeding. Findings that fail this internal challenge are discarded before any developer sees them. Capital One’s explicit goal is to shift the developer’s burden away from triaging false alarms — a perennial pain point that erodes trust in security tooling and slows development velocity.

In the third stage, vulnerabilities that survive the falsification engine trigger an evidence-backed remediation workflow. VulnHunter gathers supporting evidence across the codebase, maps the complete surviving exploit path, explains the defect and the specific capabilities an attacker would gain, and generates targeted code changes for engineering review. The output is not a generic advisory but a concrete, context-aware patch proposal.

Capital One says it validated VulnHunter internally before release, running it across thousands of repositories spanning tens of business areas. The company reports that the tool identified and remediated vulnerabilities with speed and efficiency that far exceeded what its teams previously achieved through manual triage.

Why AI-powered attacks are forcing banks to rethink traditional cyber defenses

VulnHunter arrives at a moment when the cybersecurity landscape is shifting beneath the feet of every enterprise. Capital One’s announcement frames the urgency in stark terms: advanced AI models have “dramatically lowered the barrier for bad actors to discover and exploit vulnerabilities in software,” and the window before sophisticated AI attack capabilities become affordable and accessible to virtually every adversary is shrinking rapidly.

“Safeguarding information is essential to our mission and our role as a financial institution,” Nims told VentureBeat. “We have invested heavily in cybersecurity and will continue to do so to stay ahead of today’s evolving threat landscape.”

The company’s own AI security researchers have been tracking these trends closely. At NeurIPS 2024 in Vancouver, Capital One’s team presented research and curated a list of nearly 100 papers spanning LLM safety, adversarial resilience, jailbreak attacks, and synthetic data generation. The papers they highlighted — including work on multi-agent defense frameworks, automated red-teaming, and guardrail classifiers — paint a picture of an arms race in which offensive and defensive AI capabilities are co-evolving at breakneck speed.

Several of those research themes map directly onto VulnHunter’s architecture. The falsification engine echoes the adversarial defense strategies explored in papers like “BackdoorAlign,” which demonstrated that embedding a structured safety mechanism into a small number of training examples could recover a model’s safety alignment without degrading performance. The attacker-first forward analysis reflects the philosophy of “WildTeaming,” a framework that collects and analyzes real-world jailbreak attempts to build more resilient models. And VulnHunter’s emphasis on minimizing false positives parallels the goals of “GuardFormer,” a guardrail classifier that outperformed GPT-4 on safety benchmarks while running 14 times faster.

The thread connecting all of this work is a conviction that traditional, reactive security — monitoring networks, patching known vulnerabilities, responding to incidents after they occur — is no longer sufficient when adversaries can use AI to discover and exploit zero-day vulnerabilities at machine speed. The only durable defense, Capital One argues, is to find and fix the vulnerabilities in your own code before attackers find them first.

What Capital One’s cloud security journey reveals about the entire banking industry

Capital One’s cloud journey also illuminates a broader reckoning across financial services. When Capital One moved aggressively to Amazon Web Services in the mid-2010s, it was a rarity among major banks. Most financial institutions simply did not trust third parties to store their most sensitive data. Capital One’s CIO at the time, Rob Alexander, publicly championed the cloud as more secure than the bank’s own data centers — a claim that the 2019 breach complicated considerably.

The CyberScoop report from that period captured the tension within the industry. W. Patrick Opet, managing director of cybersecurity at JP Morgan Chase, described a cultural shift in banking from prioritizing traders to prioritizing developers: “Now, it’s ‘Focus on the developer, turn everything into code, and automate everything.’” Mark Nicholson, Deloitte’s cyber leader for the financial industry, noted that the pressure to move quickly was exposing “weaknesses in the development methodology.” And the breach itself was a reminder that even as Chase spent $600 million annually on cybersecurity, relatively simple vulnerabilities — like the Apache Struts bug that enabled the Equifax breach — could undercut massive investments in data protection.

Seven years later, the industry has largely followed Capital One into the cloud, and the security challenges have only intensified. The question is no longer whether to use cloud infrastructure but how to secure the software that runs on it. VulnHunter represents Capital One’s answer: rather than relying solely on network-level controls and perimeter defenses, push security directly into the code itself, at the moment it is written. The open-source release also carries implicit competitive pressure. If VulnHunter gains traction among developers and security teams, it could set a new baseline for what enterprise security tooling is expected to do — and force rival banks, fintechs, and cloud providers to match or exceed its capabilities.

Whether VulnHunter lives up to that ambition will depend on adoption, community engagement, and the tool’s real-world performance against the increasingly sophisticated AI-powered attacks it was designed to counter. But the release itself tells a story that extends well beyond any single tool or any single company. In 2019, a misconfigured firewall exposed 100 million records and made Capital One a byword for cloud misconfiguration risk. In 2026, the same institution is open-sourcing an AI-driven defense built for a new generation of threats — and betting that the best way to protect its own code is to help the entire industry protect theirs.

Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its IT personnel.

According to the company, support tickets submitted through the platform may have included documents containing client tax information.

Ernst & Young (EY) is among the world’s four largest auditing and professional services providers, offering auditing, tax, consulting, and transaction advisory services to major organizations in more than 150 countries.

The company employs 406,000 people and reported a global revenue of $53.2 billion last year.

The breach notification to affected clients states that Ernst & Young detected anomalous activity on its networks on April 23 and initiated an investigation.

With help from external cybersecurity experts, the company determined that an unauthorized third party had accessed the said platform between March 28 and April 12 and downloaded multiple documents.

The affected information included certain personal and financial data contained in or used to prepare tax filings. Since the notification sample features a placeholder for the specific data types, the type of the information exposed remains unclear.

Also, the company has not shared exactly how many customers were affected or whether the incident impacts only its U.S. customer base or other countries as well.

Ernst & Young says it secured its systems and notified federal law enforcement authorities, while it has assured that the unauthorized access has been removed.

The company also states that it is not aware of any misuse or further exposure of the stolen files and has no indication that particular individuals were targeted by the threat actors.

To mitigate the risks arising from this exposure, EY offers affected clients 24 months of identity monitoring and restoration service through Experian and urges letter recipients to enroll by October 31, 2026.

At the time of writing, no data extortion or ransomware groups have taken responsibility for the attack on Ernst & Young.

BleepingComputer has contacted EY to learn more about the incident, but we have not yet received a response at the time of publication.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

The search for life beyond Earth has borne little fruit. That remains true, but scientists have some renewed hope. For the first time, astronomers discovered an atmosphere surrounding an exoplanet within the habitable zone of its host star. 

Say hello to LHS 1140b, an Earth-like rocky planet that lives approximately 48 light-years away from us. For reference, Voyager 1 is rapidly approaching its first light day after nearly 50 years in flight. LHS 1140b sits in the “Goldilocks” zone for its star, which means it’s far enough away to not get roasted like Mercury, but close enough that it gets warm enough to support liquid water. 

According to a new study published in Science, the “special” part of this discovery is not just the habitable zone around a star. It’s that it seems to meet extra criteria that scientists care about — i.e., it’s rocky, not a gas giant, and can still hold onto an atmosphere despite harsh conditions. An atmosphere is what helps stabilize surface temperatures, which is essential for life to exist. 

“It’s very exciting,” said Collin Cherubim, lead author on the study and a PhD graduate from Harvard, in an email. “A major goal in the field has been to understand whether any rocky exoplanets at all can retain atmospheres.”

Cherubim says that most rocky planets orbit M-class dwarf stars, which “emit high-energy radiation for far longer than stars like the sun.” Most rocky planets are stripped of their atmospheres fairly early in their life cycles, thanks to this radiation, the stripping effect of solar wind and other factors, thereby eliminating their chance to host life.

Until LHS 1140b, Earth was the only rocky planet that humans had ever observed with an intact atmosphere. 

It wasn’t easy to find. Cherubim used a computer model he’d developed during his work that “simulates how exoplanet atmospheres evolve over billions of years.” Those models predicted the existence of “helium worlds,” or rocky planets with helium atmospheres (or at least mostly helium). Cherubim tested his theory with LHS 1140b and struck proverbial gold. 

Is there life on LHS 1140b?

Whether or not LHS 1140b contains life is a complicated question. Cherubim says that science recognizes three main requirements for a planet to support life: an atmosphere, the right temperatures to sustain liquid water, and a mostly rocky planet to make it hospitable. LHS 1140b appears to have all of those.

The primary problem is that LHS 1140b’s upper atmosphere is almost entirely helium, which is also “depleted of hydrogen.” That doesn’t bode well for life, since helium typically can’t support life as we know it here on Earth. 

Cherubim says the planet is also tidally locked to its star, like the moon to Earth, meaning one side of the planet has permanent daytime and the other permanent night. It’s also roughly 70% larger than Earth, which means gravity is nearly twice as strong there. These findings don’t rule out life entirely, but if LHS 1140b does host life, it would surely be very different from life on Earth.

Cherubim also admits that researchers don’t yet know whether the planet has a rocky surface or is entirely covered by an ocean, the latter of which would be significant for the search for life. Computer models developed by Cherubim predict that the lower atmosphere may even contain gases more conducive to life, such as carbon dioxide, water and even oxygen.

“While we need more data to see what’s going on in the rest of the atmosphere, this may be the first known helium world,” Cherubim said. “That these rocky worlds can retain helium atmospheres isn’t just good for habitability prospects, but also tells us our [computer prediction] models are getting something right.”

Until then, Mars is the most likely candidate for finding signs of life, since researchers have already identified possible biosignatures in its soil. 

Another potential candidate for habitability is K2-18b, where scientists have reported tentative evidence for dimethyl sulfide, a compound commonly produced by oceanic phytoplankton. Scientists are also paying attention to the Trappist-1 star system, which has seven Earth-sized planets, three of them in the star’s habitable zone.

The API is supposed to deliver posts from ‘the highest-ranking Truth Social accounts.’

First look: Nvidia is working with Japan’s newly formed Noetra consortium to build a 140-megawatt AI factory that will serve as the compute backbone for the government’s FRONTia program, which focuses on robotics, industrial automation, and digital twins. The facility will run on Nvidia’s DSX data center platform and use Vera Rubin NVL72 racks, each combining 72 Rubin GPUs and 36 Vera CPUs.

In total, the project calls for 27,500 Rubin GPUs and 13,750 Vera CPUs connected through Spectrum-X Ethernet networking. The system is designed to handle the training of trillion-parameter models as capacity ramps up.

Nvidia is positioning the Rubin AI factory as a full-stack platform encompassing chips, networking, systems, and software for training and deploying open multimodal foundation models. These models are designed to operate with robots and physical systems, rather than just processing text and images. The plan is to make pretrained weights widely available to developers and companies in Japan so they can fine-tune the models for their own robotics, logistics, and industrial applications.

The hardware footprint is substantial even by today’s AI data center standards. The component count translates into 382 Vera Rubin NVL72 racks, each a tightly integrated system designed for high-bandwidth NVLink communication within the rack and Spectrum-X networking across the broader fabric.

Industry pricing estimates suggest that VR200 NVL72 systems cost between $5 million and $7 million each, which would put the rack hardware alone in the $1.9 billion to $2.7 billion range before accounting for memory, networking equipment, and cooling infrastructure. Estimates from Morgan Stanley value Rubin GPUs at roughly $55,000 each in volume, implying approximately $1.5 billion in GPU silicon costs alone.

Neither Nvidia nor Noetra has provided a firm deployment timeline, and Rubin systems are only expected to enter volume production in the second half of this year. As a result, the AI factory will likely come online in phases.

Noetra is a newly formed consortium created to bring major Japanese technology and industrial companies together around a shared AI infrastructure effort. The group is led by SoftBank Corp., Sony, NEC, and Honda, with support from 44 companies and organizations.

Noetra, together with the national research institute AIST, won a public tender to operate the FRONTia project from fiscal 2026 through fiscal 2030. Initial funding is set at ¥387.3 billion – about $2.4 billion – with a long-term target of up to ¥1 trillion, or roughly $6.1 billion, over five years. However, that additional funding is subject to annual reviews, meaning the full amount is not guaranteed.

The FRONTia roadmap extends beyond simple language models. Noetra is targeting a reasoning foundation model in fiscal 2026. By fiscal 2028, the plan is to develop an omni-modal model capable of handling text, images, video, and audio. By fiscal 2030, the goal is “real-world native AI” with spatial awareness and other capabilities designed for robots and physical systems operating in factories, warehouses, and healthcare environments.

The Rubin AI factory is intended to serve as the compute foundation that enables this progression, providing enough scale to train and retrain very large models while still allowing their weights to be shared for downstream applications.

This project joins several other Nvidia-related initiatives in Japan but serves a different purpose. SoftBank has already announced a Blackwell-based DGX supercomputer aimed at enterprise AI workloads. Meanwhile, RIKEN, Fujitsu, and Nvidia are collaborating on FugakuNEXT, a $740 million zetta-scale system planned for around 2030 and designed for scientific computing.

The Rubin AI factory, by contrast, is a state-funded national infrastructure project selected through a public tender and designed specifically for physical AI and robotics applications across multiple industries.

The broader policy direction is clear. Japan’s AI Robotics Strategy, released in March, sets a goal of capturing more than 30% of the global AI robotics market by 2040, representing an opportunity the government estimates at roughly $133 billion. The strategy calls for domestic control over the foundation models and data that future robots will rely on.

By investing in a Rubin-based AI factory and connecting it to a consortium led by major Japanese hardware and telecommunications companies, officials are treating large-scale physical AI computing as a national asset rather than simply another private supercomputer project.

Apple’s long-rumoured OLED iPad mini could finally be close to launch, with a new report suggesting the compact tablet is in the final stages of development.

According to Bloomberg’s Mark Gurman, the next-generation iPad mini, reportedly codenamed J510 is nearing the end of development. It is expected to arrive shortly after the iPhone 18 Pro launches.

The biggest upgrade is the display. Multiple reports have pointed to Apple replacing the current LCD panel with an 8.4-inch hybrid OLED display.

This will mark the first time the iPad mini has adopted the technology. The screen is also rumoured to use an LTPS backplane and retain a 60Hz refresh rate. Therefore, ProMotion will remain exclusive to Apple’s higher-end iPads. A shame, but maybe not that much of a surprise.

Abbott Laboratories is investigating two separate cybersecurity incidents after confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, while also investigating a separate claim that attackers breached its LabCentral portal and stole company data.

The company confirmed the Cancer Diagnostics incident after the ShinyHunters extortion gang added Abbott to its data leak site, initially threatening to publish allegedly stolen data after July 18 unless the company negotiated with the group, before later extending the deadline to July 21.

When BleepingComputer asked Abbott about the alleged ShinyHunters incident, Abbott directed BleepingComputer to a statement published on its website.

“Abbott is investigating a cyber incident in which there was unauthorized access to a limited number of internal systems in our Cancer Diagnostics business only,” the company said. 

“This does not impact any business operations, product or product availability, manufacturing or lab operations, or our ability to serve patients.”

Abbott added that the security incident has not impacted any other Abbott businesses or systems, and said the legacy Exact Sciences systems are separate from Abbott’s.

The company said it activated its incident response procedures after it learned of the incident, engaged cybersecurity experts, and notified law enforcement.

Abbott also stated that it does not expect the incident to have a material impact on its business or financial results.

ShinyHunters claimed to BleepingComputer that it gained access through a vishing attack targeting several Abbott employees in mid-June. According to the threat actor, the attack allowed it to compromise a Microsoft Entra single sign-on (SSO) account and gain access to internal systems.

Since last year, the extortion group has been conducting social engineering campaigns that target employees’ Microsoft Entra, Okta, and Google SSO accounts.

After gaining access to a corporate SSO account, the threat actors steal data from connected SaaS applications such as Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, Dropbox, and many others.

The extortion gang has been increasingly targeting medtech companies, including Medtronic, OneMedical, and AdaptHealth. BleepingComputer has learned that ShinyHunters was also behind the iRhythm data breach and targeted Stryker soon after the company recovered from a destructive Iranian data-wiping attack.

When asked what data was allegedly stolen, ShinyHunters claimed it exfiltrated data from Microsoft Entra, ServiceNow, SharePoint, Databricks, and Coupa, including internal documents, contracts, and customer information.

The threat actor further claimed to have stolen more than 30 million rows of customer personally identifiable information (PII) from multiple datasets containing names, email addresses, phone numbers, physical addresses, dates of birth, and more than one million Social Security numbers.

The group also claimed to have stolen over 22 million client notes containing doctor-patient conversations, more than 20 million medical orders, and customer agreements and NDAs.

BleepingComputer has not independently verified the threat actor’s claims regarding the stolen data.

Alleged breach at LabCentral customer portal

The second incident involves a threat actor known as ShadowByt3$, who contacted BleepingComputer claiming to have breached Abbott’s Core Laboratory diagnostics business through its LabCentral customer portal.

The threat actor said it breached the unit via its LabCentral customer portal using compromised customer credentials after identifying what it described as a “weak point” in the environment.

According to the threat actor, they gained access on July 4, 2026, after which they slowly exfiltrated files by targeting API endpoints. 

ShadowByt3$ claims the stolen data includes CE manufacturing certificates, operation manuals, technical specifications, regulatory documentation, product requirement archives, calibrator value assignments, assay files, and other product documentation related to Abbott’s laboratory diagnostic systems.

The group says no customer data was stolen, but claims it obtained sensitive business documents and intellectual property. It also provided BleepingComputer with screenshots and a file listing as purported proof of the intrusion. 

Abbott confirmed to BleepingComputer that it is aware of the “potential” cyber incident but disputed the threat actor’s characterization of the data it claims to have stolen, stating that all data stored in the environment is public and not sensitive.

“LabCentral is an externally facing third-party hosted portal used by Abbott’s core laboratory diagnostics business,” an Abbott spokesperson told BleepingComputer.

“It houses publicly available technical product reference documents, including operating manuals, troubleshooting checklists and product specifications, and does not contain proprietary/sensitive customer or business information.”

At this time, neither ShinyHunters nor ShadowByt3$ has publicly released data they claim to have stolen from Abbott.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

The Fold 8 Ultra could get a sharper display, a more powerful chipset, a new camera, and a larger battery. Samsung’s purported wider foldable, the Fold 8, is expected to solve the most common problem with tall-body, narrow cover screens by adopting a new aspect ratio. The Flip 8, on the other hand, could only debut with a new chip, and not a Snapdragon one. 

The Flip 7 wasn’t a bad clamshell by any measure. However, it’s been one year, and the memory crisis has already hit the smartphone market hard. In a tricky cost-to-margin situation, the Flip 8 could end up getting a price hike without any major improvements, and that might not sit well with potential buyers.

Price and release date

A recent report from WinFuture claims the Flip 8’s pricing will begin at €1,299 for the 256GB model and €1,499 for the 512GB model. For those catching up, the Flip 7 launched at €1,199 for the 256GB variant and €1,319 for the 512GB variant. 

In other words, Samsung might ask between €100 and €180 more for the phone in Europe. In the US, the Flip 8 (256GB) could land around $1,199, while the 512GB variant could cost $1,399. However, these are speculations at the moment, based on the ongoing memory crisis and its effects on smartphone manufacturers. 

Despite rumors of a price increase, Samsung might retain its free storage upgrade launch offer to boost initial purchases. The Flip 8 could break cover at the Galaxy Unpacked event on July 22, 2026, and, based on Samsung’s recent launch pattern, sales could commence around August 5, 2026. 

Samsung Galaxy Z Flip 8: Rumored specs at a glance

Design

Samsung might not revamp the Flip 8’s design at all. As seen in the renders, the Flip 8 could be virtually indistinguishable from the Flip 7. According to Android Headlines, the flip phone could be available in four colors: Graphite, Cream, Pink, and Mint (Samsung exclusive shade).

A leak from Ice Universe puts the Flip 8’s total thickness at 6.6 mm, which is 0.3 mm less than the Flip 7’s 6.9 mm. However, a new WinFuture report refutes those claims, mentioning that the Flip 8 could be 0.2 mm thicker than the Flip 7. When it comes to weight, however, the upcoming Flip could be about eight grams lighter. 

All the other things, such as the placement of the rear cameras, the cover display that runs around those cameras, a punch-hole screen on the inside with relatively thicker bezels, and the positioning of the buttons and USB-C port, could largely remain the same. 

Display

Per the current consensus on leaks and the absence of any claims of upgrades, the displays on the Galaxy Z Flip 8 may be unchanged from those on the Flip 7. The Inner panel could retain the 6.9-inch Dynamic AMOLED 2X at 120Hz, while the cover screen could feature the familiar 4.1-inch Super AMOLED. 

Even though both the panels hold up their ground, buyers paying more than last year would naturally expect upgrades across the board.

According to a new report from NewsPim (via SammyFans), the Flip 8 won’t get Samsung’s Flex Titanium display. In other words, it might not get the new hinge design that could enable a more durable, less-visible crease on the Fold 8 and Fold 8 Ultra, despite early rumors.

Performance

This is yet another distinction between the Fold 8, Fold 8 Ultra, and the Flip 8. While the book-style foldables are rumored to be based on the Snapdragon 8 Elite Gen 5 for Galaxy chipset, the Flip 8 could feature the Exynos 2600 chip. 

So, if you were hoping Snapdragon would return to Samsung’s flip foldable, expect disappointment, and you’ll never be disappointed (I’ve seen the Spider-Man teasers). Anyway, the Exynos 2600 isn’t all that bad. It is a 10-core chip running at up to 3.8 GHz, a step up from the Exynos 2500 in the Flip 7, and paired with 12GB of LPDDR5X RAM across both storage tiers.

I’ve used the chip on the baseline Galaxy S26 earlier this year (on the Indian version), and it did well, especially in terms of peak performance. What I didn’t like about it is the thermal management: the S26 got warm rather quickly under heavy workloads. In retrospect, the chipset can handle everything you’d possibly do on a clamshell foldable. 

Software

The Galaxy Z Flip 8 will most definitely ship with One UI 9 on Android 17, and there are two things to discuss here. First, the updates that might roll out to Samsung’s foldables due to Google’s Android 17, which may or may not include the new features Google talked about at The Android Show and Google I/O 2026. 

Second, the specific additions Samsung launches as part of One UI 9, including those rumored for the Samsung Internet Browser, multi-window browsing, new Galaxy AI features, and other visual enhancements across the user interface. Like the company’s previous flagships, this one could also come with seven years of major operating system and security updates. 

Cameras

Camera hardware on the Galaxy Z Flip 8 might be unchanged from the Flip 7 across the board. The clamshell could sport a 50MP primary sensor, a 12MP ultrawide sensor, and a 10MP selfie shooter on the front. No source has reported any sensor-level improvement, new apertures, or new processing modes specific to the Flip 8.

Of course, the computational photography pipeline could benefit from the Exynos 2600’s new ISP, but nothing beats adding more capable hardware. It is the Fold 8 Ultra that is supposed to come with the best camera arrays on a Samsung Fold yet: a 200MP primary camera, a 10MP telephoto camera, and a new 50MP ultrawide camera. 

Battery life and charging

The battery situation on the Galaxy Z Flip 8 could be the most frustrating part of the whole spec sheet. At 4,300 mAh, it could be identical to the Flip 7. In a year when Motorola is shipping 5,000 mAh into its premium flip phones, the decision to hold the line is a deliberate trade-off in favor of form factor.

The one genuine upgrade is wired charging, which jumps from 25W on the Flip 7 to 45W on the Flip 8. At 45W, a 4,300 mAh battery might reach full charge in roughly an hour. The phone could also support wireless charging, but whether it will come with magnetic wireless charging remains to be seen. 

Should you wait for the Flip 8, or buy something now?

If you’re upgrading from an old clamshell foldable, perhaps the Flip 4 or the Flip 5, and you’re certain that you want a Samsung, and you’ve used a regular smartphone but have always been drawn to a flip phone’s form factor, waiting for the Flip 8 makes sense. 

However, if the Flip 8’s cameras or battery don’t look impressive enough, and you’re open to other brands, the Motorola Razr Ultra is available now with a larger 5,000 mAh battery, Snapdragon 8 Elite Gen 5, and a competitive camera setup. Its price, $1,499, could make you think twice about your decision.