The security & privacy stories our desk judged worth your time, written so anyone can follow them.
Criminals are buying search ads and building fake AI install pages that trick people into pasting a harmful command. The trick is now the most common attack one security firm sees.
Read more: Fake AI download pages are tricking workers into installing malwareTwo flaws in PHP, the software behind most websites, can let attackers take over servers. Cloudflare blocks attacks, but only a PHP update fixes the problem.
Read more: Cloudflare blocks new PHP flaws that could let hackers take over sitesAcuityTec's Version 10.1 lets a business share blocked, high-risk and approved lists across its accounts, so one known bad actor cannot start fresh on each.
Read more: AcuityTec adds shared fraud data across accounts in version 10.1Chrome will now warn people who copy a suspicious command, a trick used to infect computers. It only works if Enhanced Protection is on.
Read more: Chrome now warns users before they paste risky commandsFirst State Bank in Streator says more customers are getting fake calls from people posing as the bank. Here is how to protect your account.
Read more: Local bank warns customers about fake calls pretending to be the bankBanks use AI to sort fraud cases and disputes, but new state laws mean they must explain how it shaped a decision. Many cannot yet.
Read more: Banks Are Using AI on Fraud Cases, but Struggle to Prove How It DecidesApple blocked eight faulty web certificates that scammers could have abused, but an engineer warns Macs may still trust them. Here is what to do.
Read more: Apple blocks 8 fake-site certificates, but Macs may still trust themResearchers found ransomware operators' AI chat logs, stolen data and tools on open servers. The case shows which basic security steps matter most.
Read more: Ransomware crews used AI chatbots to plan attacks, then leaked their own filesProofpoint says AI now writes fluent, personal scam emails, so filters that look for odd behavior are losing ground. Here is what to check.
Read more: AI-written scam emails now look real, and old spam filters miss themTwo critical flaws in PHP, the code behind much of the web, now have a fix. It will not install itself, so site owners must act.
Read more: Serious flaw in PHP, which runs most websites, gets a fix todayThe EU is investigating Booking.com over fake listings and phishing scams. Travelers should be wary of any message asking for extra payment.
Read more: EU opens investigation into Booking.com over travel scamsScammers are copying the Kelowna RCMP's real phone number so calls look genuine. Their goal is your passwords and banking details, which can cost you money.
Read more: Scammers fake the Kelowna RCMP's real phone number to steal loginsAI tools that hack your own apps to find weak spots are only as safe as the rules and code around the AI, according to a security vendor's new write-up.
Read more: AI security testing depends on the safety setup around the AI modelAttackers took over more than 300 Tor exit relays in early October and captured SSH passwords. Anyone who logged in to a server that way should change those passwords.
Read more: Hackers hijacked 300+ Tor relays to steal remote server passwordsA sheriff's office says scammers are calling crash victims and offering to sell them their own accident report. Real police do not do that.
Read more: Scam targets people trying to get an accident reportScammers can make a call show a real police number. Caller ID is no proof of who is on the line, so a official-looking number should not be trusted.
Read more: Scammers fake police phone numbers to make fraud calls look realNew French rules on sales calls began in August, but readers say spam calls continue, especially from scammers. Here is what they report and what helps.
Read more: Spam calls in France keep coming despite new cold-calling rulesScammers cloned an Osceola County, Florida, sheriff's captain's voice with AI to run fake warrant calls. Officials in eight states have warned about similar tricks.
Read more: Scammers are cloning a sheriff captain's voice to demand moneyA crypto tracking firm says scam gangs are using chatbots instead of people, and that fast reporting is the best way to get stolen money frozen.
Read more: Crypto Tracking Firm Says Scam Gangs Are Switching to AI ChatbotsA security firm says a flaw called PHP2Shell could let attackers run code on PHP websites. The claim is unconfirmed, but fixes are reportedly coming soon.
Read more: Unconfirmed report warns of serious flaw in PHP, which runs much of the webSecurity researchers got inside the system that sends people to fake Microsoft warnings. Here is how the scam works and how to spot it.
Read more: Researchers get inside the system behind fake Microsoft alertsGoogle is adding Android tools that hide sensitive screens, warn about risky links and block fake bank calls, aiming to stop scams before money or codes are handed over.
Read more: Google adds new Android tools to stop scam calls and textsHackers stole UpdraftCentral keys from TeamUpdraft and are using them to secretly take over WordPress sites. Up to 400,000 sites could be exposed.
Read more: Hackers use stolen backup-plugin keys to take over WordPress sitesA new report says AI tools and weak rules are driving more scams in Connecticut and across the U.S. Here is what that means for your calls, texts and payments.
Read more: Report says AI and weak rules are fueling more scams in Connecticut
