Meta has switched off conversation sharing inside Muse, its personal AI agent, after a security firm demonstrated that shared chats could be harvested from public internet infrastructure without anyone ever receiving a link. The culprit was a naming decision: Muse built each share’s web address out of the conversation’s own title, and that title was … Read more
For years, travellers have been told that plugging a phone into a public USB port at an airport, station or café could hand their data to a stranger. The warning is now so familiar that it functions as folklore. But the regulator that has repeated it most consistently also concedes something rarely quoted: it has … Read more
A hardened WordPress install, a curated plugin list and two-factor authentication will not stop PHP2Shell. The two vulnerabilities patched on 21 October 2026 live inside the PHP interpreter, which parses every request before a single line of application code runs. Fixes shipped in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, tracked as CVE-2026-109618 and CVE-2026-109619 and rated … Read more
A message lands from a friend or relative: they supposedly sent a verification code to the wrong number by mistake and need you to forward it. Or the phone rings inside WhatsApp itself, and a calm voice claiming to represent technical support wants to “verify” your account. In both scenarios the caller is fishing for … Read more
You open your inbox, see a message from a service you barely remember signing up for, and the word breach jumps off the screen. Or worse, a push notification or a news alert about a cyberattack lands first and you have no idea whether your account was inside the blast radius. The good news is … Read more
Microsoft has secured a court order in Florida to seize and redirect domains belonging to YAM Store, an underground marketplace that sold compromised Microsoft 365 and Google environments along with the phishing kits built on top of them. The Digital Crimes Unit announced the action on October 14, describing infrastructure tied to more than 1 … Read more
Phishing emails have acquired a second reader. Security researchers have documented a campaign in which each message carries two payloads: a conventional social-engineering lure meant for the person who opens it, and a set of concealed instructions aimed at the AI assistant that summarizes, prioritizes and triages the inbox before any human sees it. A … Read more
A stolen handset is replaceable hardware. The bank apps, email inbox and messaging accounts sitting behind its lock screen are not. That is why the first sixty minutes after a theft should follow a fixed sequence rather than panic: lock the device, cut the SIM, secure the money and the accounts, and only then file … Read more
AI agents that browse, click, fill forms and buy now inherit their owners’ logged-in sessions. That convenience creates an unresolved security problem: prompt injection, where hidden text in a webpage, email, document or image is read as an instruction. The result is an attack surface inside the bank, inbox and cart. OWASP ranks it first: … Read more
An eight-character password mixing upper and lower case, digits and symbols would hold out for roughly 132 years against a well-equipped attacker. Stretch that to sixteen lowercase letters — no digits, no punctuation — and the same attacker faces about 9 billion years. That single contrast, lifted from the 2026 edition of Hive Systems’ perennially … Read more