They took open-source code for free, then threatened the lone developer who actually followed the license. The Internet had other plans.

No game's perfect, but The Legend of Zelda: Ocarina of Time gets pretty close. The Nintendo 64 action-adventure juggernaut has long been the highest rated game on review aggregator Metacritic. When developer Grezzo remastered it for the Nintendo 3DS in 2011 as The Legend of Zelda: Ocarina of Time 3D, they stuck to the tried-and-true philosophy of “if it ain't broke, don't fix it.” Nintendo's latest take on the classic mostly follows in the same footsteps, though this time, it's remade from the ground-up with smoother gameplay, reimagined visuals, and modest changes to the whole experience.

Attackers using Anubis ransomware broke into a U.S. organization in October 2026. They used a new custom backdoor called Lindnor and dropped at least 13 tools built to switch off security software. Symantec’s Protection Bulletin says the encryption payload was blocked before it could run. Anubis ransomware Lindnor backdoor Symantec tracks the developer of Anubis as Hawkmoth. The group runs a ransomware-as-a-service (RaaS) operation that appeared in December 2024 as a rebrand of the Sphinx ransomware. The payload looks mostly unchanged from Sphinx, and only the branding is new. Because Hawkmoth lets affiliates carry out the attacks, the methods can change from one break-in to the next. Researchers at Barracuda have described the group’s mix of wiping, leaking and extortion. The group has claimed about 96 victims in the past 12 months, and 52% of them are in the United States. The group is also persistent. In a July 2026 case, Symantec saw the attackers use four different tools to steal data: Megasync, WinSCP, Filezilla and S3browser. Using that many tools of one type in a single attack is unusual. According to technical research published by Symantec , investigators did not learn how the attackers first got in. The first warning sign was the Lindnor backdoor, which sat on two machines. Those were the only two Microsoft SQL Servers among the affected systems. The attackers named the backdoor healthcontroller64.exe on one machine and placed it in a folder made to look like a Chrome component directory. On the other machine it was svchelper.exe in a VMware folder. Both copies ran as a service. Lindnor sends the process ID, Windows version, file path, computer name, user name, domain and logon server to its command-and-control server. It has a main server and a backup, and both use port 443, which blends in with normal web traffic. Custom backdoors are rare in ransomware cases, since most crews use public or built-in tools. Symantec also saw Lindnor on two other unrelated networks, but no ransomware appeared there. Within about an hour, the attackers dropped at least 13 executables meant to shut down security products. They leaned on a method called Bring Your Own Vulnerable Driver (BYOVD) and brought five signed but flawed drivers to get kernel-level control. Two of the tools, gbbsym.exe and symgooq.exe, pretended to be Symantec software. Eleven of the 13 had not been published before, though all the drivers were already known. Symantec blocked every dropped file except huntreagent.exe and s1.exe. Those two have the same size but different hashes, so they may be two builds of one tool. The pattern looks like trial and error, with the attackers trying one tool after another until something worked. BYOVD works because Windows trusts signed drivers. Symantec’s Lights Out whitepaper says hundreds of vulnerable drivers are in circulation and that BYOVD tools now come bundled with RaaS kits. Our earlier report on EDR killer tactics beyond vulnerable drivers shows how common these tools have become. The attackers installed the real AnyDesk remote tool, then created a new local user and added it to a local group. They also ran safemode.exe, which sets AnyDesk to keep working when Windows starts in Safe Mode with Networking. This matters because most security software does not fully run in Safe Mode. That gives attackers a quiet window to load drivers and turn off protection. The trick is not new, but it is rarely seen. The Anubis encryptor was named iservice.exe. It adds the .anubis extension to files and leaves ransom notes called restore files.txt and restore files.html. The notes say data was stolen and will be published if talks fail. Anubis also has an optional wiper mode that empties file contents. Our earlier coverage of Anubis wipe mode explains why paying may not bring files back. In this case, Symantec blocked the payload before encryption began. The attackers came ready for security tools to get in their way, but the last step still failed. Symantec says few ransomware crews build their own backdoors. Defenders should watch for the file names and hashes Symantec listed, including the domains msrcontrib[.]com and cfgsync-relay.eastus.cloudapp.azure[.]com. The key Lindnor hash is fc200686175559f4544a5de826905f09a68476d889690a3be40ac32356790cb8. Teams should also block known vulnerable drivers, limit admin rights and alert on new services that mimic Chrome or VMware files. Watch SQL Servers closely, because both Lindnor infections were found there. Finally, review any AnyDesk install and any odd Safe Mode registry change. The post Anubis Ransomware Hackers Deploy New Lindnor Backdoor and 13 Security-Killing Tools in U.S. Attack appeared first on Cyber Security News .

No game's perfect, but The Legend of Zelda: Ocarina of Time gets pretty close. The Nintendo 64 action-adventure juggernaut has long been the highest rated game on review aggregator Metacritic. When developer Grezzo remastered it for the Nintendo 3DS in 2011 as The Legend of Zelda: Ocarina of Time 3D, they stuck to the tried-and-true philosophy of “if it ain't broke, don't fix it.” Nintendo's latest take on the classic mostly follows in the same footsteps, though this time, it's remade from the ground-up with smoother gameplay, reimagined visuals, and modest changes to the whole experience.

No game's perfect, but The Legend of Zelda: Ocarina of Time gets pretty close. The Nintendo 64 action-adventure juggernaut has long been the highest rated game on review aggregator Metacritic. When developer Grezzo remastered it for the Nintendo 3DS in 2011 as The Legend of Zelda: Ocarina of Time 3D, they stuck to the tried-and-true philosophy of “if it ain't broke, don't fix it.” Nintendo's latest take on the classic mostly follows in the same footsteps, though this time, it's remade from the ground-up with smoother gameplay, reimagined visuals, and modest changes to the whole experience.

No game's perfect, but The Legend of Zelda: Ocarina of Time gets pretty close. The Nintendo 64 action-adventure juggernaut has long been the highest rated game on review aggregator Metacritic. When developer Grezzo remastered it for the Nintendo 3DS in 2011 as The Legend of Zelda: Ocarina of Time 3D, they stuck to the tried-and-true philosophy of “if it ain't broke, don't fix it.” Nintendo's latest take on the classic mostly follows in the same footsteps, though this time, it's remade from the ground-up with smoother gameplay, reimagined visuals, and modest changes to the whole experience.

No game's perfect, but The Legend of Zelda: Ocarina of Time gets pretty close. The Nintendo 64 action-adventure juggernaut has long been the highest rated game on review aggregator Metacritic. When developer Grezzo remastered it for the Nintendo 3DS in 2011 as The Legend of Zelda: Ocarina of Time 3D, they stuck to the tried-and-true philosophy of “if it ain't broke, don't fix it.” Nintendo's latest take on the classic mostly follows in the same footsteps, though this time, it's remade from the ground-up with smoother gameplay, reimagined visuals, and modest changes to the whole experience.

Introduction: The historic $6.3 billion cyber heist targeting Binance highlights the critical fragility of modern enterprise endpoint security, where a single compromised developer machine can bypass multi-layered perimeters. Attackers exploited a DevOps engineer’s laptop to penetrate internal service containers, circumventing normal signing infrastructure controls to drain multi-chain wallets in a matter of minutes. This incident underscores the urgent need to treat engineering workstations as Tier-0 critical infrastructure assets rather than routine office endpoints.

In Vermont Square, modular units are now in place for a new housing complex from prolific local developer SoLa Impact.The project, which broke ground earlier this year at 4301 S. Vermont Avenue, calls for the construction of a five-story, 188-unit apartment complex on a site previously occupied by a commercial building and parking.

I am a head teacher by day and a solo developer by night. Last week I shipped a real tool — a 48-rule scanner that spots AI design slop in web projects — in about two days of evening work. I did not write most of it by hand. I directed a small team of AI agents, then handed the result to three independent audit teams and fixed everything they found. This is the honest story of **shipping software with AI agents** : what moved fast, what broke, and the checklist I now use before any solo release. ## Why I Built Instead of Installing It started with a post someone shared with me: a hugely popular tool that scans for "AI slop" in design. It had tens of thousands of stars and a long feature list. Installing it would have taken five minutes. I chose to build my own instead, for two reasons. First, I wanted a tool I fully understood — one file, zero dependencies, rules I could read and change myself. Second, I wanted to test a question I keep asking myself as a solo developer: can a one-person team with AI agents ship something genuinely useful, not just a demo that looks finished? The answer turned out to be yes — with one condition. The agents are fast builders but careless reviewers. Everything that made the project real happened in the review stage, not the build stage. That is the lesson this whole article is about. ## Shipping Software with AI Agents: The Build, in 2 Days ### Day 1: One sharp brief, not a long conversation I have learned that agents do their worst work when the brief is vague. "Build me a slop detector" would have produced a generic tool with generic rules. So I wrote a short brief with three hard constraints before anyone wrote a line of code: 1. **One file, zero dependencies.** If it needs an install step, a teacher or student will not use it. The scanner had to run with a single command. 2. **Real line numbers, always.** A warning without a line number is a chore, not a help. Every finding had to point at the exact line. 3. **A CI gate, not just a report.** The scanner had to be able to fail a build when slop crossed a threshold, so teams could actually enforce it. Those three constraints did more work than any clever prompt. They forced every later decision: the rule format, the output format, the exit codes. When an agent suggested a feature that broke a constraint, the constraint won. By the end of the first evening, the core existed: a scanner with rules grouped into packs, including a pack for right-to-left layouts (I care about this because Urdu and Arabic content is badly served by most design tools) and a pack for the tired "2026 defaults" — the same cream background, serif heading, and sage-green accent combination appearing on every AI-generated landing page. ### Day 2: Features users can actually run Day 2 was about making the tool usable by someone who is not me. That meant a live web checker anyone can try in a browser, an audit-report generator for teams that want a document rather than terminal output, and a small benchmark set so the rules could be measured instead of merely claimed. The benchmark matters more than it sounds: without it, "48 rules" is just a number. With it, I could say how often the scanner catches real slop and how often it cries wolf. That is also the day the project got its name and its home: Deslop, open source on GitHub, with the live checker on the web. I publish free tools for teachers and students at filecobra.com, and I write about the shipping side of this work — the workflows, the mistakes, the checklists — on rehmanahmad.com/blog. Two days, one solo developer, one team of agents. The tool worked. I was tempted to announce it right there. I am glad I did not. ## Shipping Software with AI Agents: The Audit That Saved the Release Before any announcement, I handed Deslop to three independent audit teams and asked them to break it. Not to praise it — to break it. They came back with nine findings. Nine. On a project I thought was done. Some findings were small: messages that confused more than they explained, edge cases in a few rules. Some were serious: rules that fired on the wrong code, a threshold that let heavy slop pass as "mild," documentation that promised something the tool did not actually do. Every single one was real. None of them had been caught during the build, because the building agents were in "make it work" mode, and nobody was in "prove it works" mode. Fixing all nine took another focused session, and it changed the tool in ways users can feel: clearer severity bands (clean, mild, heavy) so a score means something at a glance, tighter rules with fewer false alarms, and documentation that now describes exactly what the scanner checks — no more, no less. The version that shipped, v1.9.0, is a different tool from the one I nearly announced. Same 48 rules, much higher trust. This is the part of shipping software with AI agents that nobody posts about. The build is the easy, photogenic half. The audit is where a demo becomes a tool. If you skip it, you are not shipping faster — you are shipping your bugs to your users and letting them do the audit for you, in public. ## What the Agents Are Good At (and What They Are Not) After this project, my mental model of AI agents is simple and I use it for every new build: **Agents are excellent at:** * Turning a sharp brief into working code fast — the first version, the scaffolding, the boring plumbing. * Generating breadth: dozens of rules, test cases, and documentation drafts in one pass. * Refactoring on instruction: "make this one file," "add line numbers everywhere," "change the output format" — mechanical changes at speed. **Agents are bad at:** * Knowing when they are done. An agent will declare victory the moment the code runs. Running is not done; reviewed is done. * Catching their own mistakes. The team that builds the rules will not be the team that finds the false positives. You need a second pair of eyes — human or agent — with a different job: break it, don't build it. * Judgement calls about scope. Left alone, agents add features. Left alone, a scanner becomes a platform. The brief is the only thing standing between a tool and a sprawl. The practical rule I now follow: **never let the builder audit its own work.** A separate audit pass, with its own brief ("find bugs, rank them, show proof"), is a mandatory step in my workflow, not a nice-to-have. It costs one extra session. It saved this release. ## My Solo Release Checklist (Steal This) This is the checklist Deslop earned. I run it before announcing anything now: * [ ] **One sharp brief first.** Three hard constraints, written down, before any code. * [ ] **Real users can run it in minutes.** One command or one web page — no install saga, no config puzzle. * [ ] **Claims are measured, not asserted.** A benchmark, a test suite, or a before-and-after number behind every big claim. * [ ] **An independent audit pass.** A different agent team (or a careful human) whose only job is to break it, with findings ranked and fixed. * [ ] **Docs match the tool.** Every documented feature verified by running it, not by reading the code that was supposed to implement it. * [ ] **One honest limitation, stated up front.** For Deslop: it is a pattern scanner, not a design judge — it flags the fingerprints of generic AI design, it does not decide whether your design is good. Users trust a tool more when it tells them what it cannot do. * [ ] **Announce only after the audit fixes ship.** The version users meet first is the version they remember. If you are a solo developer using AI agents, the temptation is always to announce at step two, when the demo works. Resist it. The gap between "works in my terminal" and "trustworthy for strangers" is exactly one audit wide. ## What I Would Do Differently Next Time Two things. First, I would order the audit earlier — after the core rules, not after the whole feature set — so fixes land before features pile on top of them. Second, I would write the honest limitation into the README from day one instead of adding it after the auditors asked for it. Limitations are not apologies; they are the reason people believe the rest of the document. None of this makes me slower in any way that matters. Two days to build, one session to audit, and the result is a tool I can stand behind: open source, genuinely useful, and already published as a package other developers can install. The agents did not replace me as a developer. They replaced the empty hours — the scaffolding, the boilerplate, the first drafts — and left me the work that actually needs a human: deciding what to build, what "done" means, and whether it is good enough to put my name on. If you are shipping solo with AI agents, try the audit step on your next project. Build it fast, then hand it to someone — or something — whose job is to break it. You will be annoyed by what they find. Your users will never know how close they came to finding it first.