The wave of European fridge hacks has reached France's blood supply
Hackers have moved on from supermarket freezers to France's blood service
Cheap Android TV boxes came with malware, and Google says the manufacturer was behind it
What we know so far: Google has severed ties with Android TV box manufacturer Videostrong over allegations that it pre-loaded a backdoor on more than 1.3 million set-top boxes. Dubbed XCPE, the backdoor used "obfuscation techniques" to evade Google's screening process and enrolled infected devices in a massive botnet that has since been shut down by the search giant.
Vizio smart TVs are ignoring tracking opt-outs, continue to send data even when sitting idle
The toggle doesn't seem to change anything
Refrigerator cyberattack spreads to many European countries, spoiling food worth thousands
Internet-accessible supermarket refrigerator management portals still use default login credentials
What we know so far: Last month's cyberattack on French grocery store refrigerators became an expensive reminder of the risks of relying on the Internet of Things for critical infrastructure. New attacks this week show that several European countries face the same vulnerabilities, with lax security practices and obsolete systems the likely culprits.
Apple is warning iPhone users in 110 countries about mercenary spyware
Highly targeted attack may have affected journalists, activists, politicians, and diplomats
Digital billboards across the globe hacked to show porn, attackers say "anyone with two brain cells" could do it
Screens in Egypt, Malaysia, and Brazil were among those affected
Binance loses $6.3 billion in largest crypto heist ever
Withdrawals remain suspended as investigators uncover additional points of breach
Hackers leak details of 41,000 Homeland Security employees, exposing undercover operations and surveillance tools
Hacked login records disclose wiretap, undercover and face-recognition programs
Check Point is turning network firewalls into cloud-based subscriptions
No upfront hardware purchase required, just monthly payments until the end of time
AI safety expert stops saving for retirement, he believes AI could wipe out humanity within a decade
Why save when you'll be dead?
Google's privacy policy now has a loophole for using your Gmail and Photos data in ads
Cutting corners: Plenty of people keep a big chunk of their lives stored in Gmail and Google Photos, from flight bookings and receipts to years of family pictures. For years, Google has said none of that content would be used to pick the ads they see. That promise now comes with an exception – and it applies to anyone who lets the company's AI dig through those apps.
AI will keep uncovering critical software flaws for years, says Cloudflare CEO
The EFF says 3% of all known software vulnerabilities were found in October alone
Big quote: Cloudflare CEO Matthew Prince says the PHP flaws that forced websites offline last week are only the beginning. His company already knows of other severe vulnerabilities in critical software, and he expects AI tools to keep turning up new ones for years. Because these models have sharply cut the time and skill needed to find and exploit serious bugs, defenders and everyday users face a long stretch of disruption before the internet's core software ends up safer.
OpenAI says its AI agents disabled safety guardrails, and then lied about it
A new day, a new rogue AI agent
Two web emergencies in one week: guessable certificate keys and critical PHP bugs that leaked before patches
Browsers patched one problem remotely. Servers will need to be fixed by hand.
A hot potato: Security teams are dealing with two separate emergencies this week, and both go straight to the foundations of the web. The first is a certificate authority that shipped private keys anyone could guess. The second is a pair of critical PHP flaws that leaked before patches existed. Browsers fixed the certificate problem within hours. Everything else, from Linux servers to Docker images and IoT gear, needs someone to log in and patch.
PSA: PHP patches two critical flaws, server admins urged to update
PHP has released emergency security updates addressing two critical vulnerabilities that could allow attackers to remotely execute code without authentication. With PHP powering nearly 70% of all websites, the potential impact is enormous. Apache deployments are particularly vulnerable, and security agencies are urging immediate updates.
Meta suspends Muse sharing after sensitive documents turn up in shared chats
Researchers found loan paperwork, revenue figures, and confidential meeting notes
Staples hackers created more than 15,000 gift cards, then went on a shopping spree
Investigators tie the breach to Chinese crime, with much of the merchandise shipped to China
Millions of routers can be hijacked over Wi-Fi thanks to a 16-year-old bug
Broadcom says it replaced the vulnerable code in 2018 and won't assign a CVE. The fix never reached the routers.
Why it matters: Chipmakers ship buggy code all the time, that alone isn't news. What makes WPSplinter stand out is that Broadcom apparently did issue a fix eight years ago, but that fix never reached the routers sitting in people's homes. Furthermore, the lack of a CVE kept the problem invisible to the advisories and patch pipelines that router makers and ISPs rely on.
Update now: Hackers are exploiting Plex server vulnerabilities to install malware
Hackers are actively exploiting security vulnerabilities in outdated Plex Media Server installations to deploy cryptocurrency miners and proxy malware. Plex confirms widespread attacks against internet-facing servers, with the flaws allowing remote code execution without authentication. The vulnerabilities were patched in version 1.43.3.10861. Users running older versions are urged to update immediately.
A judge lets Denuvo subpoena Discord, Reddit, and Steam to unmask the cracker Voices38
The most hated DRM in PC gaming is asking a federal judge to unmask a pseudonym
Connecting the dots: Denuvo has spent the past few weeks trying to uncover Voices38's true identity. The mysterious cracker has been wreaking havoc on the company's notorious DRM and anti-tamper technology, and Denuvo is now turning to lawyers in a bid to unmask the skilled coder.
Anthropic wants AI models blocked only if they threaten over $1 billion in damage or more than 50 deaths or serious injuries
Intervention is limited to catastrophic risks involving cyberattacks, biological weapons, or loss of control
Eiliko robot maker Energize Lab left its entire fleet of 68,000 robots open to a remote takeover
The exposed data includes 13 million conversations, but the company won't answer questions about it
PSA: The calendar invite is the new phishing vector, and email filters aren't catching it
Google Calendar and Microsoft 365 treat invites differently from email, and attackers are exploiting the gap
Windows Defender now works in Linux, because why not
Do Linux operating systems really need an antivirus, though?