The security & privacy stories our desk judged worth your time, written so anyone can follow them.
Two critical PHP flaws drew millions of attack attempts after going public. No break-in is confirmed, but the patch window is short.
Read more: Serious flaws in PHP, used by much of the web, are under attackThe FTC warns that scammers posing as real charities are calling past donors with a made-up prize, and the goodwill makes the pitch easier to believe.
Read more: Fake charity sweepstakes calls try to trick past donorsUS agencies published a guide for AI agents that act on their own, and the key question after any incident is whose credentials the agent used.
Read more: When an AI Agent Goes Rogue, Know Whose Keys It UsedZoho warns that fake signing emails use look-alike web addresses, like one that swaps an n for an m, to steal data or install harmful software.
Read more: Fake e-signature emails trick workers with one swapped letterGoogle is bringing a new scam defense to older Android phones, so check your updates to see if your phone or a relative's has it yet.
Read more: Google is adding a new scam defense to older Android phonesScammers are posing as jail detention officers and telling families to pay bond or ankle monitor fees. Here is how to spot the call and what to do.
Read more: Fake jail officers are calling families to demand bond moneyMoonshot's Kimi K3.1 Pro now ranks fourth in one independent ranking, and a free-to-download version is due by Nov. 4. Cheaper AI and security risks both grow.
Read more: Chinese AI model Kimi K3.1 Pro now ranks fourth in the worldA rumored GPT-7 name is circulating as OpenAI deals with a reported security exploit. Business users of ChatGPT should know what to do now.
Read more: Rumors of GPT-7 surface as OpenAI faces a security flawAttackers can sit inside a company network for days or weeks without a loud alert. Keeping network records helps defenders piece together what happened.
Read more: Hackers hide in the quiet gaps between security alertsCybernews published an expert guide on checking a site first, a one-minute step that can spare you fraud, stolen logins and lost money.
Read more: How to tell if a website is safe before you hand over your detailsScammers are posing as the Craft Council of Newfoundland and Labrador to sell vendor space at a fair that is already full. Vendors and community groups should check first.
Read more: Scammers pose as craft council to sell fake holiday market boothsGlobe Telecom and Makati City trained more than 600 seniors to avoid online fraud, a lesson many families could copy at home.
Read more: Globe Telecom trains 600 seniors in Manila area to spot online scamsPNB has warned customers about scams that copy a real person's voice, fake videos and phishing messages. A familiar voice on the phone is no longer proof.
Read more: PNB warns customers about fake voices, deepfakes and phishingA rentable Android spyware kit hides inside altered copies of Telegram and WeChat, copies your 2FA password and can lock you out. Only outside-store installs are at risk.
Read more: Fake Telegram and WeChat apps can steal your password and take over your accountAttacks on a flaw in PHP, software behind many websites, began before it was made public. A columnist says the way security fixes are shared needs a rethink.
Read more: A web software flaw leaked early, and experts say secrecy needs a rethinkAn automated campaign uses stolen GitHub tokens to make private repositories print their own secrets, then deletes the evidence. Here is who is at risk.
Read more: Hackers use stolen GitHub keys to pull secrets from private codeAttackers are copying Microsoft 365 sign-ins after the password and code check, then using them to take over email at 79 organizations.
Read more: Hackers steal Microsoft 365 logins that already passed the code checkWarwickshire Police say scammers are calling people while posing as officers, using a phone number that once belonged to the force. Hanging up is the safe move.
Read more: Scammers fake a police phone number to call people in WarwickshireIndian small businesses want time limits and an appeal process when banks freeze money tied to suspected cyber fraud, even if the payment was real.
Read more: Small Businesses Want a Deadline When Fraud Alerts Freeze Their Bank FundsA fake Spotify email says your Premium is cancelled and pushes a Retry Payment button that leads to a page built to steal your login and card.
Read more: Fake Spotify billing email tries to steal your card detailsDreamHost has an active incident on its status page and is forcing password resets, which could affect websites and business email hosted there.
Read more: DreamHost has an active incident and is forcing password resetsCrowdStrike says four hacking groups used AI coding assistants to break into hospitals and agencies with little human help, so basic security matters more.
Read more: Hackers are using AI assistants to break into hospitals and agenciesDays after Spain required sales calls to start with 400, a Córdoba resident reported a scammer using it to pose as Iberdrola and collect bank data.
Read more: Scam calls are already using Spain's new 400 sales-call prefixFisher National Bank and Federated Bank say fake calls pretending to be the bank seem to be rising, and caller ID can show the real bank name.
Read more: Two Illinois banks warn of fake calls that pose as the bank
