Top stories.
- VoidLink malware was likely AI-generated.
- GitLab fixes high-severity 2FA bypass flaw.
- Minnesota notifies over 300,000 people of data breach.
VoidLink malware was likely AI-generated.
Researchers at Check Point say the newly observed Linux malware "VoidLink" was likely written almost entirely by AI, probably under the direction of a single person. Check Point states, "From a methodology perspective, the actor used the model beyond coding, adopting an approach called Spec Driven Development (SDD), first tasking it to generate a structured, multi-team development plan with sprint schedules, specifications, and deliverables. That documentation was then repurposed as the execution blueprint, which the model likely followed to implement, iterate, and test the malware end-to-end."
Threat actors using AI to assist in malware development isn't new, but Check Point says VoidLink stands out due to its sophistication. The researchers note, "Until now, solid evidence of AI-generated malware has primarily been linked to inexperienced threat actors, as in the case of FunkSec, or to malware that largely mirrored the functionality of existing open-source malware tools. VoidLink is the first evidence-based case that shows how dangerous AI can become in the hands of more capable malware developers."
GitLab fixes high-severity 2FA bypass flaw.
GitLab has patched a high-severity 2FA bypass flaw (CVE-2026-0723) impacting community and enterprise editions of its platform, BleepingComputer reports. The company says the vulnerability "could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses."
GitLab also fixed two high-severity denial-of-service vulnerabilities (CVE-2025-13927 and CVE-2025-13928) that could be exploited by unauthenticated users.
Minnesota notifies over 300,000 people of data breach.
Minnesota's Department of Human Services is notifying nearly 304,000 people of a data breach affecting the state's MnChoices eligibility system, BankInfoSecurity reports. The breach occurred from late August to mid-September 2025. The incident involved a user affiliated with a licensed healthcare provider who "had legitimate reason to access limited information in MnCHOICES," but "accessed more data than was reasonably necessary to perform work assignments."
The exposed data potentially included personal and contact information, Medicaid IDs, last four digits of Social Security numbers, ethnicities, races, birth records, physical traits, education, income, benefits, Medicaid information, financial eligibility, and program eligibility.
