Cybersecurity is the rickety scaffolding supporting everything you do online. For every new feature or app, there are a thousand different ways it can break – and a hundred of those can be exploited by criminals for data breaches, identity theft, or outright cyber heists. Staying ahead of those exploits is a full-time job, and one of the most lucrative and sought-after skills in the tech industry. All too often, it’s something up-and-coming companies decide to skip out on, only to pay the price later on.
Politico reports that the courts’ case filing system was accessed. The breach was discovered last month, but its full extent is still unknown — one fear is that hackers may have accessed the identities of confidential informants, while a source told Politico that court dockets may have been tampered with.
[politico.com]
After 404 Media reported that an app meant to help women exchange dating information for safety purposes was breached, TechCrunch reports that a rival app targeted at men has been exposing users’ personal data including government IDs. “The security lapse will likely affect any user who signed up or shared identity documents with the app,” TechCrunch writes about TeaOnHer, adding that the app has about 53,000 users.
This Wired article shows how an indirect prompt injection attack against a Gemini-powered AI assistant could cause the bot to curse in responses and take over smart home controls by turning on the heat unexpectedly or opening blinds in response to saying “thanks.”
In a report dubbed “Invitation is all you need” (Sound familiar?), their Google Calendar invite passed instructions to the AI bot that were triggered by asking for a summary. Google was informed of the vulnerabilities they found in February and said it has already introduced “multiple fixes.”
If you also use 1Password and have an Android device, you may have also been dealing with autofill problems lately. However, updating to version 8.11.4 or higher and following the instructions to make sure Chrome is set to use third-party autofill seems to have worked on my phone to make the app more reliable again.
According to 1Password, the need to update its app and an uneven update rollout from Google caused a gap as Chrome switched from the old compatibility mode approach to the new native autofill experience.
[1password.community]
As well as class schedules, scholarship disbursements, and student loan information. Neat! At least Bloomberg finally got around to telling its audience that the alleged hacker’s X account “includes a racist handle and racist remarks.” I wonder what a Nazi can accomplish with all this sensitive information? I guess we’ll find out.
Microsoft is announcing Project Ire today, an autonomous AI agent that can analyze and classify malware without assistance. Developed by Microsoft Research, Microsoft Defender Research, and Microsoft Discovery & Quantum, Project Ire is the first agent at Microsoft to independently author a conviction case “strong enough to justify automatic blocking” of an APT malware sample.
[microsoft.com]
Microsoft’s hacking event, Zero Day Quest, is back and accepting nominations today until October 4th. This year there is up to $5 million in bounty awards, up $1 million on last year’s figure. Microsoft is even offering multiplied bounty awards for the most critical issues in products like Azure, Copilot, and Microsoft 365. Security researchers will also get a chance to qualify for a live hacking event at Microsoft’s headquarters in spring 2026.
The company has introduced Proton Authenticator, an open-source two-factor authentication app that can sync 2FA codes across devices using end-to-end encryption. Though Proton’s password manager already comes with a built-in 2FA feature, Proton says using its standalone Authenticator offers an “extra layer of security” by generating codes in a separate app.
Proton Authentication is available for free on Android, iOS, Windows, macOS, and Linux.
Until now it’s stayed quiet on whether it received the same order to open a backdoor to user data as Apple, but a spokesperson confirmed to TechCrunch that it never did. If it had, Google wouldn’t be allowed to say so.
Apple has pulled iCloud encryption from the UK and appealed its order in the courts. Last week it was reported that the UK is ready to give up the fight following US political pressure.
After last week’s hack, the app has been breached again.
The vulnerability (CVE-2025-31199), which Apple patched in a March 31st update, could give bad actors access to files inside a device’s Downloads folder and data cached by Apple Intelligence. That includes geolocation data, media metadata, and facial recognition info, according to a report from Microsoft Threat Intelligence.
Security researchers discovered the flaw after using Spotlight plugins to bypass a security feature made to prevent third-party services from gaining access to user data.
I appeared on On the Media to discuss our story about the Anime Nazi who allegedly hacks universities. I explain why the identity of the alleged hacker is important, why the Times’ obfuscation of its sources is troubling, and what’s at stake in the Republican war on higher education: upward mobility.
Senate Commerce Committee Ranking Member Maria Cantwell (D-WA) is hunting for answers about the state of US telecom network security after the Salt Typhoon hack first reported late last year. The attack was so massive that US officials encouraged Americans to use encrypted apps to prevent their conversations from being seen by hackers. Cantwell is asking digital forensics firm Mandiant to hand over assessments behind AT&T and Verizon’s claims that their networks are now secure.
[commerce.senate.gov]
The full report, which you can find here, shows that Google’s Threat Analysis Group (TAG) terminated almost 11,000 channels between April and June of 2025 as part of an investigation into “coordinated influence operation campaigns.”
The mass removals included over 7,700 channels with ties to China, and 2,000 linked to Russia, as reported by CNBC.
They say Columbia is just one of five universities they’ve penetrated.
More than $2.17 billion has been stolen from crypto services this year, more than the entirety of 2024, according to a report from blockchain analytics firm Chainalysis. Then again, most of that came from a single hack — a $1.46 billion heist of Bybit linked to North Korean hackers, the largest crypto theft in history — and without that, the numbers would look a little rosier.
[chainalysis.com]
A Department of Homeland Security memo, obtained by Property of the People through a freedom of information request, reveals the group — suspected to have links to China — “extensively compromised a U.S. state’s Army National Guard network” for nine months last year.
Salt Typhoon gained notoriety in 2024 for hacking telecom networks, targeting the Trump and Harris campaigns, though earlier this month a top FBI official said the group is “largely contained.”
Cameron John Wagenius, aka kiberphant0m, had already pleaded guilty on two charges for hacking T-Mobile and Verizon, and could face 20 years in prison after pleading guilty Tuesday to additional conspiracy, extortion, and identity theft charges.
Wagenius reportedly sold data stolen from Snowflake cloud storage accounts, including records for 560 million Ticketmaster customers and information from over 150 other companies, and said he’d posted hacked AT&T call logs for Donald Trump and Kamala Harris. Two other men, John Binns and Connor Moucka, have also been indicted in this case.
Security researchers Ian Carroll and Sam Curry broke into the backend of McDonald’s hiring system by entering the username and password “123456,” as reported by Wired. They were then able to view the data of the more than 64 million applicants who interacted with McDonald’s AI hiring bot, Olivia.
The researchers reported this flaw to McDonald’s and Paradox.ai, the company behind the chatbot, which has since addressed the issue.
A hacker has a list of millions of people by race. So why is the coverage about Zohran Mamdani?
