Google reversed six-figure API fraud bills for two developers after The Register highlighted unauthorized Gemini usage, yet the underlying policy remains unchanged. Automatic tier upgrades can still push accounts from a $250 cap to $100,000 based on historical spend without explicit consent. While a preview of hard spending caps exists for specific services like Cloud Run and Maps, approval requires a manual review process.

#cloudsecurity

Google reversed six-figure API fraud bills for two developers after The Register highlighted unauthorized Gemini usage, yet the underlying policy remains unchanged. Automatic tier upgrades can still push accounts from a $250 cap to $100,000 based on historical spend without explicit consent. While a preview of hard spending caps exists for specific services like Cloud Run and Maps, approval requires a manual review process.

#cloudsecurity

CW: macOS kernel exploit

The first public macOS kernel memory corruption exploit targeting Apple M5 silicon has been released. This proof-of-concept demonstrates a path to arbitrary code execution in ring 0 on the newest hardware, bypassing existing mitigations. While currently limited to research contexts, the release validates that M5-specific kernel structures are now understood by attackers.
#cve

CW: Local privilege escalation

copy.fail is a Linux kernel LPE disclosed by Theori on 29 April 2026 that writes directly into the page cache of files the attacker does not own. The exploit chains AF_ALG sockets with splice() to bypass filesystem checks, leaving disk-based monitors like AIDE blind to the modification. It affects all major distributions including Ubuntu, RHEL, and Debian because the mainline fix only landed on 1 April.

#cve