Privacy, hacking, threat intelligence
Researchers tested 21 connected vehicles and 30 companion apps, and found that 28 of the apps shared data with advertising or analytics firms. Seven sent sensitive details — including GPS locations and vehicle identification numbers — directly to ad networks.
The fraud, called address poisoning, slips a fake lookalike into a wallet's transaction history seconds after a real payment. Bitquery found 4,497,798 Solana wallets hit by the tactic over 11 months, with total losses counted at $940,106.
The US International Trade Commission launched an investigation on 9 October after Vicor Corporation alleged 20 companies infringed its patent on delivering power to semiconductor loads. Respondents include Luxshare, Foxconn, Hon Hai and Delta Electronics. No violation has been found.
The PoeLLM malware read four marked words from a poem posted to GitHub and mapped them to a command-and-control address — meaning attackers could redirect it just by editing the verse. Lumen's Black Lotus Labs, which named the campaign Canto Incognito, says more than 3,000 servers have been infected since April 2026, mostly in the US and Western Europe.
Regulators in Italy, Norway and Denmark are examining whether Activision Blizzard, King and Mojang broke EU consumer-protection rules. The inquiry focuses on in-game currencies, dark patterns and parental controls, with minors among those at risk.
Microscan and FishHub, operated by a Chinese firm the FBI links to Flax Typhoon, were used to scan targets including a US power company and airports in Japan and Poland. Officials say both tools have been rendered inoperable.
ClawSecure ran tests on 14 models from five labs and found none resisted indirect prompt injection. Separately, US agencies named six China-based firms they say have been running industrial-scale campaigns to extract knowledge from American frontier models.
The company's chief strategy officer told a Sydney hearing OpenAI's response had been 'not good enough'. It learned of the June breach in August but didn't notify Services Australia until 10 September.
The two companies have cross-licensed patents across 5G, computing, AI and networking. Qualcomm will also acquire select Huawei US patents, though financial terms and the agreement's duration were not disclosed.
Unauthorised individuals exploited a Danish company's legitimate access to the CPR system in September. Names, addresses and ID numbers were exposed — and police are now investigating.
Shinhan Bank was the first to report an intrusion, exposing data on around 25,000 clients. Hana Bank, BNK Busan Bank, KB Kookmin Bank, Yegaram Savings Bank and Hyundai Capital were also hit, prompting South Korea's financial regulator to mandate urgent reviews across all banks and credit card companies.
Manchester Airports Group was breached over the weekend of 22-23 August after an API key had been sitting exposed in public website code since 2022. The attackers leaked 550GB of data and published it on 2 September after MAG refused to pay a ransom.
Chainalysis traced the funds across four blockchains in hours, saying AI cut what would have been 20 hours of manual work to under 10 minutes. The $387 million left Bitget in 23 transfers within the first three hours of the attack.
The FBI and EPA issued a joint advisory after attacks spread across at least seven states. Operators lost control of pumps and valves, and some communities received boil-water notices.
Hans Anders has suspended sales in the Netherlands and Belgium after reports that hundreds of women and girls were secretly filmed. Cases have been opened in France, Spain, South Korea, Japan and the US, and privacy groups are pressing Meta to pull the product entirely.
The group, known as TA419, used the identity of Lynne Edwards Parker to approach fewer than 10 specialists at think tanks, universities and law firms in the US and Japan. Proofpoint, which identified the campaign, said the narrow targeting suggested an interest in US policymaking rather than technology theft.
The permission lets apps read your files, messages, mail and browsing history — and Apple says some developers have used it without users fully understanding the risk. Granting it will now require what the company calls "very explicit user action".
A cockpit software update can disable automated navigation when crews change their flight path after a missed approach. Southwest and United have asked for new aircraft to be delivered with an earlier software version while Boeing works on a fix.
Prime Minister Anthony Albanese called the breach 'obviously unacceptable' and said OpenAI took far too long to come forward. When it did, the company emailed a public inbox rather than Australia's cybersecurity authorities.
The Daybreak system will be developed with Ukraine's Ministry of Digital Transformation. Ukraine's cyber agency handled nearly 6,000 incidents in 2025, including attacks on hospitals, energy networks and the railway system.
A shipment heading from Australia to the US for repairs was rerouted by a Lockheed Martin intermediary, and some parts vanished. The incident has sharpened concern about the Pentagon's control of F-35 equipment — a 2023 audit found more than a million spare parts had gone missing over five years.
The fine covers a period between 2018 and 2020, when the DPC found Google was tracking people's movements without being clear about what it was collecting or how long it was keeping it. Consumer groups criticised the eight years it took to reach a ruling.
Security agencies in Japan, the US, Australia and Germany say a North Korean hacking group posed as tech recruiters and slipped malware into coding tests. More than 7,000 cryptocurrency wallets were drained, with losses of $10.71 million believed funnelled to Pyongyang.
The analyst spent months building trust before joining the group's inner chat in March 2026, giving Google a live view of cascading attacks on more than 1,000 companies. It also accessed a server holding over half a million stolen credentials and sent hundreds of alerts to providers including AWS and Microsoft to revoke them.
Hacktron AI found a chain of flaws running from OpenAI's public forum to employee accounts and private code, including material from the internal repository said to power its models. OpenAI paid the researchers $6,500 and revoked the affected credentials.
Fraudulent requests passed standard email authentication checks, leading Revolut to hand over personal details, identity documents and transaction records. The company says funds were not touched, but has not disclosed how many customers were affected or whether the data has been misused.
Operators in northern Yemen divided the work across separate AI sessions to hide their real aim. Anthropic says it found no evidence a working weapon was built, but admits several requests slipped through its safeguards.
About 4,000 BTC was pulled from the Liquid Federation wallet in two transactions, dropping the balance by 95%. The perpetrators left a message on the blockchain saying they are white hats and will return most of the funds once the vulnerability is fixed.
The records, covering people across the US and Canada, were sold on a dark web platform called Nexus alongside millions of ID cards and medical documents. IDs belonging to Pete Hegseth and apparent FBI agents were among those found in the stolen data.
GPT-6 Astra is the first OpenAI model to hit its own Critical cybersecurity threshold, meaning it can independently discover and weaponise unknown flaws across protected systems. OpenAI says it is also better at concealing when it is deliberately holding back in tests, and that its internal reasoning is now harder to track.
Research tracking 351 victims found that nearly two-thirds held manager-level titles, chosen because they can authorise payment faster than an executive shielded by lawyers. The shift means corporate defences built around the C-suite may be protecting the wrong people.
China is quietly embedding itself inside critical networks to use later. Iran is causing disruptions now. Russia is doing both, and intelligence agencies say the threat is unlike anything seen in previous cycles.
Type at least two characters.
