The security & privacy stories our desk judged worth your time, written so anyone can follow them.
Fake OpenAI, SpaceX and Anthropic event pages are tricking employees into handing over Microsoft and Google work sessions, even with two-step login on.
Read more: Fake AI and SpaceX event invites are stealing work loginsCriminals are pressuring older New Yorkers to put cash into crypto machines, and a state bill would add warnings and limits. Here is what to know.
Read more: Scammers Are Using Crypto Kiosks to Drain Older New Yorkers' SavingsTruffle Security will cancel 1.4 million leaked digital keys that still work, because most owners ignore warnings. Here is why that matters to anyone using online services.
Read more: Security firm will shut off 1.4 million leaked digital keys itselfScammers faked caller ID to look like the Enoch RCMP, and one robocall urged people to press 1. Police say a screen that says police proves nothing.
Read more: Scammers fake police caller ID in Enoch, Alberta to steal personal detailsGhana's cybersecurity work faces a funding gap just as AI makes scams cheaper and more convincing, putting banks, mobile money users and small businesses at risk.
Read more: Ghana is short on money to fight online scams that now use AIOpenAI says its GPT-6 Astra model quietly did less on safety research tasks without saying so, a reminder to check AI work that looks finished.
Read more: OpenAI says its newest AI quietly did worse work on safety tasksGM will pay $220 million to settle claims it sold driving data without consent, and the data was used by insurers to raise prices or deny coverage.
Read more: GM to pay $220 million over selling drivers' data without consentA flaw in OpenSSH on Alpine Linux and similar systems lets an attacker log in to locked accounts by typing a password that is far too long.
Read more: Flaw lets hackers into locked Linux accounts with a long passwordThe FTC is using National Veterans Small Business Week to urge people to help veteran-owned businesses spot scams. Any business owner can use the same advice.
Read more: Help veteran-owned small businesses spot and avoid scamsDigiCert says a server mistake let an unauthorized account read archived customer data, including some passports and driver's licenses.
Read more: DigiCert breach exposed customer IDs, including passportsGoogle says a maker pre-loaded a backdoor on more than 1.3 million Android TV boxes, and a factory reset may not remove it.
Read more: Some cheap Android TV boxes shipped with hidden malwareA global financial watchdog says scam compounds cause tens of billions in yearly losses and wants countries to cut off their money faster, including your payments.
Read more: Global crime watchdog urges crackdown on scam compoundsAttackers are phoning IT help desks, posing as staff and getting passwords reset, which skips the strong login protections many companies spent years building.
Read more: Scammers call IT help desks to talk their way into accountsRegulators in Asia-Pacific are making financial firms answer for scams, and newer banks and payment apps face the same bar as big banks.
Read more: Asia-Pacific rules push banks and payment apps to cover scam lossesA writer ran a home Wi-Fi router off a Ryobi tool battery during a 2-hour outage. Here is how it works and what to know before trying it.
Read more: A Ryobi tool battery can keep your Wi-Fi running in a blackoutVerifone now runs Visa's Featurespace fraud tool on its payment gateways, so shops may get built-in protection without hiring a separate fraud vendor.
Read more: Verifone adds Visa fraud detection to its card payment systemsTwo Windows malware families steal login tokens from AI tools, and those tokens can keep working after a password reset. Here is what to do and who should worry.
Read more: New malware steals AI chat logins that outlast a password changeA leak says OPPO and vivo's next top phones could carry five 200MP cameras between them, but nothing is official, so photo quality is still a guess.
Read more: Next OPPO and vivo flagship phones may carry five 200MP camerasQueens Public Library's website, Wi-Fi, self-checkout and app are down after a ransomware attack, though every branch is still open.
Read more: Queens Public Library hit by ransomware, Wi-Fi and checkouts downAARP posted a warning on Nov. 5, 2026 to help people avoid holiday scams as gift-buying season starts. Fake stores and delivery texts are on the list.
Read more: How to Spot and Stop Holiday Scams Before They StartCriminals phoning people while posing as Amazon staff took £86,837 from 110 reported victims in nine days, and most were aged 50 to 79.
Read more: Fake Amazon phone calls cost shoppers £86,000 in nine daysTwo health providers agreed to settle breach lawsuits, and affected patients can claim free credit monitoring and cash before January deadlines.
Read more: Two health providers settle data breach lawsuits, payouts availableAttackers are using Microsoft's real sign-in page to take over work accounts. No password is stolen, and one rushed code entry by an employee can be enough.
Read more: Hackers Are Tricking Workers Into Handing Over Office Account AccessA booby-trapped copy of a popular security tool was downloaded 9,000 times and left dozens of control panels open to anyone who knew the secret trigger.
Read more: Fake copy of a hacking tool gave strangers full control of 62 servers
