• Harvard breach data affecting 850,500 people has now surfaced in breach-tracking databases and dark web archives
• Exposed information includes emails, contact details, demographics, and extensive alumni and donor profile data
• Attack highlights ongoing risks from social-engineering attacks against universities and fundraising systems

Hundreds of thousands of email addresses have been leaked to the dark web after the November 2025 ShinyHunters breach at Harvard University.

The same breach also exposed “extensive profile information” about certain people, as well, according to Have I Been Pwned? (HIBP), a website that aggregates stolen passwords and helps users learn which services exposed their private information.

Harvard gets hit

In late November 2025, the prestigious Ivy League University confirmed its Alumni Affairs and Development systems had been compromised after a successful voice phishing (vishing) attack.

These systems contained information about alumni, donors, some faculty and staff, and some current students, as well as data on their spouses, partners, and parents. Current and former students were also affected, it was said.

Harvard soon confirmed that the compromised data included email addresses, telephone numbers, home and business addresses, event attendance records, donation details, and "biographical information pertaining to University fundraising and alumni engagement activities." Social Security numbers, passwords, payment card information, or financial info, was not exposed, it was said.

At the time, Harvard did not name the attackers, but the infamous ShinyHunters extortionist group claimed responsibility soon after. In a new entry on a dark web forum, the threat actors said they stole more than a million records containing personally identifiable information (PII), as well as donation data. Since the negotiations with the university broke down, the group leaked more than 1.1GB of documents in early February this year.

At the time, no one knew exactly how many people were affected. Now, after extensively analyzing the leaked archive, HIBP claims data of 850,500 accounts was compromised, including people’s names, email addresses, dates of birth, phone numbers, postal addresses, and social media profiles.

"The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students," it said.

Attacking universities

When Harvard “fell” to ShinyHunters, they were the third university to experience a breach in mere weeks, following similar incidents at both Princeton University and the University of Pennsylvania.

In early November 2025, when ShinyHunters claimed responsibility for the attack on Penn, they said they stole data on roughly 1.2 million students, alumni, and donors.

At the time, an unnamed threat actor told the media they gained “full access” to a university employee’s PennKey SSO account, which gave them access to Penn’s VPN, Salesforce data, Qlik analytics platform, SAP business intelligence system, and SharePoint files.

The crooks slammed Penn for being a “dog**** elitist institution full of woke ret*rds, who have “terrible security practices and are completely unmeritocratic.”

"We hire and admit morons because we love legacies, donors, and unqualified affirmative action admits. We love breaking federal laws like FERPA (all your data will be leaked) and Supreme Court rulings like SFFA,” ShinyHunters said in an email that was sent from a Penn account.

At first, the University of Pennsylvania described the emails as “obviously fake” and “fraudulent”, but later backtracked and confirmed the incident.

“Penn’s staff rapidly locked down the systems and prevented further unauthorized access; however, not before an offensive and fraudulent email was sent to our community and information was taken by the attacker,” it said in an update. “Penn is still investigating the nature of the information that was obtained during this time.”

Penn also said that the attack was done through social engineering. Most employees are required to use multi-factor authentication (MFA) but according to reports, some of the top brass was allowed to skip this step.

Via BleepingComputer

• The ability to reposition the taskbar came to Windows 11 in September
• However, you can't drag the taskbar around as with Windows 10 — you must move it using a panel in the Settings app
• Some power-users want an option to drag it around the desktop quickly, and Microsoft has now explained why it decided against this

One of the long-awaited major Windows 11 interface changes this year has been the ability to move the taskbar.

You'll likely recall that there was quite a big fuss that this functionality, which was present in Windows 10, didn't make the cut for Windows 11. It wasn't alone, either, as there were plenty of key interface options that weren't ported over from the older operating system — many of which have since been addressed.

Windows 11 received the ability to shift the taskbar to the top, or either side, of the screen in the September 2026 update (or that was when the rollout began — everyone should have it by now, though). Before that, the taskbar was anchored steadfastly to the bottom of the desktop, and you couldn't move it anywhere.

However, Windows 11's implementation of the now mobile taskbar has still come under fire from some users. It's gotten to the point where a Microsoft exec has responded to explain the thinking behind the feature, as Windows Latest highlighted.

The beef is that while the taskbar is now movable, you can't simply drag it around the desktop. Moving the taskbar requires you to head into the Settings app, diving down a level to pick your alignment.

It's not possible to seize the taskbar with your mouse cursor and whizz it across the desktop to a new position. There are users who want the convenience of being able to do that, but Microsoft's Diego Baca, who is VP of Design for Windows, has defended the company's decision to drop this particular option for taskbar repositioning.

The danger of accidental drags

As Baca observes, this choice was made because, with Windows 10's draggable taskbar, Microsoft "saw a significant volume of accidental taskbar movements." Meaning users clicking on the bar for another reason mistakenly picked it up and shifted it elsewhere, which was obviously annoying.

The other point Baca makes — and it's a good one — is who needs to move the taskbar to different positions on the desktop with any regularity? Not many folks, but nonetheless, power-users who might do so have been arguing for the introduction of some kind of option to make the taskbar draggable in this way.

Windows Latest itself suggested a 'lock the taskbar' option (as seen in Windows 10) to ensure it couldn't be dragged mistakenly, noting that this should be on by default. But Baca argued that this isn't a good solution because it introduces more 'friction' to the Windows 11 interface. The exec noted in a post on X: "For those suggesting an 'auto-lock' or lock/unlock setting as a magic solution, it really isn't that simple. You're introducing additional friction to solve a relatively infrequent task. Now, every time you want to move the taskbar, you first need to unlock it."

It's a fair point, and the crux of the matter is that the number of Windows 11 power-users who will actually benefit from quick taskbar dragging is very few compared to the pool of massed casual users who could potentially run afoul of the feature. As this Redditor observes from their experiences with the Windows 10 taskbar: "Honestly, looking back, there were several times when older family members would ask me why theirs is on the side of their screen. People did move it accidentally."

And this was even the case when the taskbar was locked to prevent that (presumably because of more taskbar misclicking and accidentally turning the lock off). Of course, when this occurred, those less tech-savvy types had no idea what had happened, or how to rectify it. And that seems a greater danger than a lack of a draggable taskbar, based on how often that kind of movement is needed for anyone but a niche of very specific power users. In this way, the taskbar design decisions are an understandable trade-off, at least in my opinion.

I should note that Baca also makes it clear that this isn't a final decision, or the be-all-and-end-all of the debate over a draggable taskbar. Baca concludes the X post: "Please don't turn an explanation of a design decision into a declaration that something will 'NEVER' happen. That's simply not what I said."

So, there might be hope yet for those who want taskbar dragging. Indeed, I wonder if a solution that Microsoft previously tested could return, one that Windows Latest reminded us about: namely having the four taskbar position icons from Settings directly accessible via the right-click menu on the taskbar.

Third-party alternatives for taskbar dragging in Windows 11

Overall, I think Microsoft's stance here is correct on balance. So, as it stands for now, power users who want to drag the Windows 11 taskbar around with some regularity due to their workflow are left feeling out in the cold and will need to use a third-party tool to do so.

What third-party software is recommended for this use? A dedicated app called Taskbar Location Options on GitHub (hat tip to Windows Central) is a good choice, restoring the ability to drag the taskbar at any time (or use right-click menu settings directly on the bar). This tool is handy because it's a simple and lightweight effort for those who just need dragging functionality and don't want to install a full modding suite to achieve this.

There's also a mod for Windhawk, which is a popular Windows 11 customization suite you can load up with add-ons, that allows for taskbar dragging (and locking). As always, though, use any third-party software at your own risk, and remember that customization tools like these can sometimes run into trouble with Windows 11 updates.

Microsoft's patches can tinker with interface elements under the hood, and this may break any of these third-party customization utilities until the developer can patch. Power users will doubtless be more than aware of this, mind, but I figured it's worth mentioning.

• Malware allegedly gave a poker cheat access to opponents' computer screens
• Hundreds of online poker players may have suffered financial losses
• MeshAgent reportedly helped the attacker monitor selected players during games

Online poker players are facing allegations of a cheating operation that may have cost participants millions of dollars across online gambling sites.

Wired reports that hundreds of people on major gambling platforms were allegedly affected by malicious software installed on selected players’ computers.

The software allegedly allowed the attacker to monitor victims’ computer screens and obtain information that could influence decisions during poker games.

Malware allegedly exposed players’ private information

The incident involves a form of poker fraud known as “superuser” cheating, in which someone obtains information unavailable to ordinary participants.

Rather than exploiting one poker platform directly, the alleged attacker reportedly took advantage of external applications used to manage multiple tables.

Those applications allegedly provided a way to install MeshAgent, a remote administration programme, on computers belonging to selected opponents without their knowledge.

After installation, the software reportedly enabled the intruder to view activity displayed on victims’ computers while they played online poker.

Such access could expose opponents’ private cards, giving the person controlling the malware information unavailable through legitimate participation during games.

That advantage could influence decisions during expensive hands and allow the alleged cheater to win money from unsuspecting players.

The activity is described as a prolonged campaign involving customers across several major online poker services, rather than one isolated incident.

The reports claim the perpetrator is known within poker circles, but withheld the person’s identity because no criminal charges have been filed.

Different platforms take different approaches to the allegations

The companies involved have responded differently, with one service reportedly removing the account before the malware operation became publicly known.

That platform had identified unusually strong results and questionable playing patterns through its monitoring system.

Other services released security checks intended to help customers establish whether MeshAgent had been installed on their computers.

Another operator faced complaints about the account yet reportedly allowed the suspected cheater to continue playing on its platform.

The company later said its investigation had found no evidence that compromised devices had affected the results of games.

It also refused to reimburse customers who believed the alleged cheating had caused them significant financial losses.

That response has left affected players uncertain about whether they can recover money and how responsibility for losses will be determined.

If the reported screen access occurred, investigators would need to identify compromised accounts and establish which games produced unfair results.

Such an assessment could be difficult because the alleged activity involved many players and several separate gambling services.

The case also draws attention to risks associated with software that poker participants install independently to organize simultaneous games.

Although these applications can make multi-table play easier, they may introduce additional ways for malicious programmes to reach personal computers.

Players using such tools may therefore need to consider security risks beyond those covered by the gambling platforms themselves.

As of the time of writing, there is no information on the total amount stolen, the number of confirmed victims, or whether authorities are investigating the case.

• Surfshark recorded 121.8 million breached accounts worldwide in Q3 2026, up 13.2% on the previous quarter.
• The UK overtook France as Europe's most breached country, while Ukraine jumped from 47th to 6th globally.
• The US still accounts for almost a third of all leaks, and experts say limiting what you share is your best defense.

More than 121.8 million online accounts were compromised around the world between July and September 2026, according to new research from Surfshark. That's a 13.2% rise on the previous quarter.

The UK saw the most dramatic shift. Its leaked account count more than doubled to 5.8 million, a 121.6% jump that pushed it past France to become Europe's most breached country.

Ukraine also surged up the rankings, climbing from 47th place to 6th globally after 2.6 million accounts were breached in just three months.

Most breaches happen on a company's servers rather than your own device, so even the best VPN can't stop your details from leaking. There are still steps you can take to limit the damage, though.

Europe is under growing pressure

The UK's rise came during a busy quarter for attacks on British organizations. In late July, extortion group ExfilSquad claimed it had stolen contact details for more than 100,000 police officers and staff from the Police National Legal Database.

The same group also claimed to have leaked around 600,000 records from the Department for Education.

Ukraine's climb fits a wider pattern. Microsoft's Digital Defense Report 2026 ranked the country first in Europe and third worldwide for cyberattacks in the first half of the year.

Ukraine's CERT-UA also handled around 200 incidents targeting citizens between January and September, up from 80 a year earlier, many involving phishing for Telegram and Signal logins.

"We can see attacks vary across countries as attackers seek the juiciest targets, sometimes for financial, and sometimes for political gain," said Tomas Stamulis, Chief Security Officer at Surfshark.

It's not just about raw numbers, either. Estonia had the highest breach density in the world at 118 breached accounts per 1,000 people, ahead of Australia, the US, and the UK.

The US still leads the way

Globally, the US remained the most breached country with 38.1 million leaked accounts, or 31% of the total. Brazil (7M), the UK (5.8M), India (5.5M), and Australia (3.1M) completed the top five.

France, meanwhile, cooled off sharply. It recorded 2.4 million breached accounts, down from 19.7 million in Q2, and dropped out of the top three for the first time this year.

How to stay safe

Stamulis warns that stolen data can sit hidden for long periods before criminals decide to use it.

His advice is to treat personal information as sensitive by default, only share your real details when it's genuinely necessary, such as on official forms, and use an alias, secondary email address, or email masking service for everything else.

A password manager also helps ensure one leaked login doesn't unlock your other accounts. Meanwhile, identity theft protection and data removal services can alert you to exposure and reduce how much of your information is out there.

• Singapore Airlines confirms customer data exposure through a breach at travel technology provider Amadeus
• Stolen booking records included passenger details, itineraries, and limited passport and loyalty-program information
• Multiple major airlines were affected, raising phishing and identity-fraud concerns for travelers

Singapore Airlines has become the latest in the seemingly growing list of airlines affected by a breach at a third-party technology provider.

Amadeus, a Spanish technology company that airlines and airports use to manage reservations, bookings, and overall passenger management, recently issued a brief statement saying it “became aware of a vulnerability affecting a travel booking display environment.”

In the announcement, Amadeus said certain booking-display data was accessible to the attackers but stressed that there was no evidence of payment or financial data being accessed.

“There are no indications that this vulnerability has been exploited for ransomware purposes,” the company said, adding that it “implemented measures to fix the vulnerability as well as enhanced monitoring and detection capabilities.”

In the meantime, numerous airlines started reporting sensitive data compromise as a result of this breach.

Cathay Pacific, Japan Airlines, and more

Hong Kong’s flagship international airline, Cathay Pacific, issued a statement saying Amadeus notified it about a breach and “unauthorized access to travel reservation data” by a threat actor that used login credentials assigned to a system account.

Amadeus then told Cathay Pacific around 53,000 bookings were affected, and that the exposure took place between August 2023 and September 2026. “In the majority of cases, the information accessed included booking reference, passenger name, and flight details,” the airline said, adding that in a “smaller subset of cases”, additional data such as email and phone contacts, travel documents and/or frequent flyer numbers were also exposed.

The same day, Japan Airlines and Japan Transocean Air both shared similar news, saying a “portion of customer reservation data” had been accessed by an unauthorized third party.

Japan Airlines said some 92,000 customers were affected, including approximately 2,000 of those whose passport numbers were also exposed. All Nippon Airways said 37,800 of its customers were affected, including around 1,700 with additional data exposure. Korean Air, Asiana Airlines, and Malaysia Airlines, all confirmed being affected by the Amadeus incident, while Qantas said it was still investigating.

Launching phishing attacks

We can now add Singapore Airlines to that list, with 46,000 records of its own. These include customers' names, booking reference numbers, travel ​itineraries and booking classes and, in a smaller number of cases (around 620 booking records), email addresses, phone numbers, travel document details, and KrisFlyer membership numbers.

According to Reuters, Singapore Airlines is now reaching out to affected customers with upcoming travel plans to change their booking reference numbers as a precaution. The ⁠airline also confirmed that its IT systems were not breached.

So far, there is no indication that the stolen data ended up on the dark web, and no threat actors claimed responsibility for the breach, just yet. There is a possibility that the culprits will try to extort the airlines for money, in exchange for deleting the stolen information.

This is the kind of data cybercriminals enjoy most. It allows them to launch highly personalized phishing emails that appear to come from the airlines themselves, referencing genuine booking details, flight dates, destinations and passenger names.

They could use this kind of information to trick unsuspecting travelers into clicking malicious links, sharing login credentials, or making fraudulent payments for supposed booking changes, refunds, or additional fees.

What’s more, the exposed passport details and frequent flyer numbers can also help criminals impersonate customers, try to take over people’s accounts, or launch identity fraud attacks against the airlines themselves. Even without financial information, simply by combining seemingly harmless travel details, cybercriminals can create enough context to make their scams considerably more convincing, and thus more difficult to detect and prevent.

• CrowdStrike introduces AI Kill Switch designed to stop, isolate, and prevent rogue AI agents from relaunching
• The feature gives human administrators direct control to terminate suspicious agent activity and investigate incidents
• Growing concerns over autonomous AI behavior are driving demand for safeguards that can quickly contain compromised agents

CrowdStrike believes it may have solved the problem of rogue AI agents in the enterprise with the launch of 'AI Kill Switch', a new feature being introduced in its Falcon Guardian product.

The last couple of months have seen multiple reports of AI agents going rogue, or behaving outright malicious. Even when tasked with relatively simple, benign assignments (such as, for example, to collect data about Canadian divorce records), whenever the agents hit a roadblock, they would do whatever it takes to get the job done - which includes abusing zero-day vulnerabilities, or trying SQL injection attacks.

Expectedly, businesses became somewhat more reluctant in deploying AI agents, despite the obvious advantages. At the same time, cybersecurity organizations and AI developers sought to solve the challenge. Enter CrowdStrike.

AI Kill Switch

The company recently introduced Falcon Guardian, an AI Detection and Response (AIDR) platform built to discover and monitor AI agents running inside enterprise environments. Its main capabilities include identifying both approved AI agents and shadow AI, tracking what the agents are asked to do and what files they can access, controlling access, detecting prompt injection attacks, and investigating suspicious agent behavior.

Now, the company has added AI Kill Switch, which should act as a failsafe when an agent breaks out of its intended behavior.

“AI safety is how you get the full benefit of AI. When you deploy agents with a kill switch, you stay in control,” said George Kurtz, CEO and founder of CrowdStrike. “For the first time, security is simultaneously the accelerant and the safety net for technology adoption. The AI Kill Switch puts power in the hands of the people to realize AI safety.”

This means the feature will actually be operated by humans, not AI, and will be able to terminate the agent at its root. It starts on the endpoint, where the Falcon sensor already operates, and builds on what Falcon Guardian already sees: what an agent is told to do, what it communicates, and what it executes, the company explained.

Explaining how the tool will work, Crowdstrike says the Falcon sensor will first stop the agent from executing (first at the Gateway, and soon on the endpoint), to prevent the agent from doing any damage as the team investigates.

Then, its policy will keep the agent from relaunching on the targeted host or host group, while the tool bars the agent from enterprise network access.

An authorized administrator will trigger the action, and every action is recorded in the audit trail.

Other solutions

CrowdStrike is not the only company working on this. For example, Straiker's Agentic Kill Switch allows users to suspend individual agents, revoke their access to different tools, APIs and data, or take them offline completely.

A similar solution was built by JetStream Security, allowing organizations to disable individual agents without disrupting other AI workflows, while Trust3 AI’s Agent DOS comes with a built-in kill switch that can be triggered manually, or even automatically (when an agent’s security score falls below a predefined threshold).

There is also Microsoft’s Entra Agent ID, Palo Alto Networks’ Prisma AIRS, and Cisco’s AI Defense. All these offer some form of AI master lever that can block the agent and prevent it from doing meaningful damage.

• Windows 11 got a major performance boost with its latest update, including 40% faster multi-tasking on an 8GB PC based on Microsoft's testing
• That update is still a preview, mind, but the full release is coming next week, with other performance boosts, especially for 8GB PCs
• Meanwhile the developer of Tiny11 has managed to get a totally stripped-down version of Windows 11 running in an improbable 128MB of memory

Microsoft has gone into the details of how it's made Windows 11 faster on 8GB PCs (and all systems for that matter), with these changes arriving in the next update for the OS – all while a third-party has demonstrated the operating system running on a meagre 128MB of RAM (with huge caveats as you might expect).

A blog post from Pavan Davuluri, head of Windows at Microsoft, entitled 'Raising the bar for 8GB Windows 11 PCs' gives us some further metrics as to how much performance has been improved by.

Microsoft has mentioned that Windows 11 is now up to 20% more responsive on 8GB machines before, but now it's added another stat to consider, namely that the OS is 40% faster for multi-tasking (and that kind of workload is where 8GB of RAM can feel a lot more pushed to its limits).

In this case, Microsoft's test involved "opening 20 tabs in Microsoft Edge, a 4K video, large Word, PowerPoint and Excel files, Outlook and File Explorer one after another, keeping everything open as we went." This was 40% faster compared to Windows 11 in January 2026 (before the fix the OS campaign started), as measured on an HP OmniBook 3 laptop with a Snapdragon X Plus (Arm) 8-core CPU and 8GB of memory.

Davuluri explains that Microsoft's approach to upping performance in Windows 11 runs along three distinct paths: "Making better use of the memory in every Windows 11 PC, protecting the interactions that need to feel instant even under load, and ensuring key apps and Windows require less memory."

Of course, the exec points out that this work benefits all Windows 11 PCs, but that this tuning will be particularly beneficial for 8GB devices – clearly having key apps drain less system RAM is going to be great for lower memory loadouts.

Microsoft notes that in terms of memory management improvements, in multi-tasking tests on 8GB systems, it has "reduced committed-memory growth by up to 900MB" in Windows 11 running Edge and Microsoft 365 apps.

We're also told that thanks to improvements in Windows 11's compression techniques, more active data for apps can be stored in RAM (as opposed to on your drive, where it's slower to be fetched) – to the tune of up to 2GB more. Davuluri employs a useful desk metaphor to illustrate this, which I think is worth a read for the less tech-savvy.

If you want the benefit of all this fresh speediness, Microsoft informs us that this performance tuning is in place in the very latest update for Windows 11, which is the optional update that arrived at the end of October (complete with right-click menu customization).

If you download that, though, bear in mind it's a preview so officially still in testing. I'd advise waiting for the full release of the finished November update, which comes out next week on November 10, so you won't have to be patient for long.

Analysis: necessary streamlining – and it appears to have done the trick

Okay, so Microsoft is touting some very specific performance measurements here and there's bound to have been some cherry-picking going on. In other words, run a ton of different tests and pick the results that show off the very best performance levels (with a peak 'up to' value), but of course this is standard practice for any product marketing.

Still, it's clear that strides have been made, and online feedback backs this up. There are numerous users who are observing that Windows 11 is faster after this most recent update, and indeed since version 26H2 was released.

As one Redditor observes: "I can confirm it, Windows 11 has been overall much more [responsive] on my system, it used to be slow as s**t and now even the context menu opens quite instant."

Most of the negativity that now remains on social media, aside from the obvious trolling, is around why Microsoft didn't have Windows 11 tuned up like this in the first place. And that a 40% improvement in multi-tasking was partly made possible because things were in such a sluggish state to begin with, and I think those are fair points (I've brought them up myself in the past).

Still, it's clear that Microsoft is working hard and successfully optimizing Windows 11 for leaner RAM loadouts, and I obviously won't argue with that. Meanwhile, the developer of Tiny11 – which allows you to create a completely stripped-down Windows installation – has proved that Microsoft's OS can be pared back so it runs on just 128MB of RAM (hat tip to Tom's Hardware).

That beats the developer's old record of 184MB, and it's a seriously impressive feat, but as you might imagine, what's left in Windows after pruning it back so viciously is, well, barely anything. You can boot the desktop, open folders or the Start menu, and run Notepad, but not much else. It is "painfully slow" by the developer's own admission, and not a workable version of Windows 11 so much as an exercise in what can be done.

The reason that projects such as Tiny11 are popular is because many folks are fed up with the bloat in Windows 11, and want to create their own tailored and streamlined version. If Microsoft keeps going with its successful performance tweaking and tuning, with any luck, there'll be a lot less demand for the likes of Tiny11 in the future.

Microsoft is promising more memory efficiency tuning, and advances in memory compression, are coming, as well as a greater use of WinUI 3 for speedier apps and parts of the Windows 11 interface.

• mSecure disclosed a breach involving an encrypted cloud database containing data from current and former users
• Company urged users to rotate critical passwords, MFA methods, and passkeys despite no evidence vaults were decrypted
• Customer criticism grew after limited initial disclosure left uncertainty about the incident’s scope and impact

Top password manager mSecure has confirmed it suffered a data breach and, “out of an abundance of caution”, and told its customers to simply reset everything, leaving some pretty upset.

On November 3 2026, the company behind mSecure, called mSeven Software, sent an email to its customers, saying it “recently learned of suspicious activity associated with the mSecure password management application”. It soon launched an investigation, mitigated the issue, and brought in third-party cybersecurity experts to assist.

The notice, while rather sparse on details, urged customers to “immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two factor authentication methods, or removing existing passkeys."

Encrypted database

All this was said without detailing what happened, and customers did not take it well. On Reddit, users were asking if this pertained just to the master password, or to all passwords stored inside the manager. Some people have hundreds of secrets locked away in mSecure, and changing all of them would take hours.

“This notice is wildly insufficient,” one user wrote. “Recommending potentially hundreds of credential changes without identifying the underlying threat, the affected customers, or the security of the application being used to make those changes is inadequate.”

mSecure allegedly responded with a follow-up notice that was also shared on social media. In it, it disclosed more details, and somewhat played down the actual breach:

“Yesterday, mSeven learned that an unauthorized actor acquired an encrypted copy of a database containing information belonging to current and former users of the mSecure password management application,” it said. “Importantly, mSeven has no evidence that the unauthorized actor has accessed the confidential information stored within the database in the mSecure Cloud.”

Putting it plainly, a threat actor walked away with a copy of the database that was sitting in mSecure Cloud, and all users - current and former - who had synced their password manager with the cloud service are at risk.

But mSeven tried to downplay the severity of the incident. Throughout the announcement, it repeated multiple times that the stolen database was encrypted and that there is no evidence that the threat actors managed to decrypt it. Truth be told, encrypted databases should be safe, but many criminals are still hoarding them, in case anyone makes a breakthrough at any point in time. There’s actually a name to the practice - HNDL (harvest now, decrypt later).

It also responded to user criticism about having to change all passwords now:

“As a standard best practice, mSeven continues to recommend that mSecure customers change their master password, change vital stored passwords, reset two-factor authentication methods, replace passkeys and any other sensitive information. This should be a part of all routine security practices.”

Not the only password manager in trouble

Finally, mSecure said deleting the app won’t help the situation and stressed that the issue only pertains to users that were syncing with the mSecure Cloud.

“mSeven takes the security and privacy of all information stored on the mSecure platform very seriously and has no evidence that mSecure is not currently safe for use,” it said. “Our support team is working as fast as possible to respond to customer questions. We take your trust in us seriously, and appreciate your patience and continued support.”

How this reflects the company’s image remains to be seen. One Reddit user said the company was deleting negative reviews and complaints that were being left on the Google Play Store. But mSecure is hardly the only password manager experiencing an incident such as this one. In June this year LastPass confirmed losing sensitive customer data, while Dashlane said hackers obtained at least a dozen encrypted vaults.

Via The Register

• Hackers have targeted French blood stocks used in medical emergencies
• Attackers tried to raise freezer temperatures from -22F to 230F
• The attack was spotted quickly and no blood had to be destroyed

A few days ago, hackers attacked European supermarket freezers for the second time in weeks, but it’s not just frozen food that has been the target of these malicious operations. Now, threat actors have their eyes on the medical sector, with reports emerging that French blood plasma reserves have been breached by unknown saboteurs.

As reported by Cyberattaque (via Cyber Security News), stores of blood plasma were struck overnight between November 1 and November 2, with freezer temperatures programmed to rocket from -30C to 110C (-22F to 230F). Although it’s unknown whether the freezers actually reached temperatures as high as that, the incident is still a worrying development in what looks like an ongoing strategy against key infrastructure targets.

The campaign targeted Coolworld, which supplies the French Blood Establishment (EFS). The EFS is responsible for collecting, preparing and distributing blood and blood products in France, many of which are used in essential surgeries and medical operations. Cyberattaque noted this meant that “frozen plasma for transfusions was among the potentially endangered products.”

The French Ministry of Health has said that the cyberattack did not result in any serious operational consequences because the temperature spikes were noticed quickly and corrected. What’s not known is how many facilities were affected, how long the disruption lasted and how high the temperature of the freezers actually got. However, there has been no confirmation that any blood stocks had to be destroyed as a result.

Far-reaching effects

In October 2026, Vincent Strubel, the director general of France’s cybersecurity agency (known as ANSSI), issued a prescient warning that refrigeration facilities — including those storing medical resources — could be the target of adversarial attacks. Two weeks after that address, the blood stores were hacked.

Meanwhile, in the UK Richard Horne, CEO of the UK’s National Cyber Security Centre (NCSC), yesterday cautioned that “far too many of our organizations and supply chains rest on weak technology and operational foundations.” Potential targets include “Electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, heating, refrigeration controls,” Horne stated.

At the launch of the NCSC's 'State of the Cyber Nation' report, Horne went on to describe as the UK as being at a 'Sliding Doors moment' for cybersecurity, with its exploitable vulnerabilities being akin to a "digital Leaning Tower of Pisa". "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," he warned.

As Cyberattaque pointed out, it was not the medical facilities themselves that were compromised, but the third-party maintenance systems that controlled freezer temperatures. That could have far-reaching effects, as any company that provides controller products to different customers potentially puts them all at risk.

While the attempt on the French blood stocks was spotted quickly, the next attack might be able to slip through the net. If that happens, the upshot could be far more serious.

• Safari is getting some useful updates for iOS, iPadOS, and macOS
• Vertical tabs will arrive, but only in the dev betas for now
• Other features like Adaptive Dark Mode and Siri AI browser tools are coming, too, along with our first glimpse of the new Audio Intelligence capabilities

On the global web browser stage Safari lags behind Chrome, but when it comes to Apple's 2.5 billion customers, it reigns supreme. Yet, even those devoted users might've noticed that their favorite browser was lacking at least one long-sought feature. Now, with the introduction of Dev Betas for iOS 27.3, iPadOS 27.3, and macOS 27.3, they're getting their wish.

In beta today, the platform upgrade brings a series of relatively small but important updates to Safari across the iPhone Duo, iPad, and Mac. And chief among them is vertical tabs.

As is often the case, Apple didn't invent this idea. I started using vertical tabs in — of all things — Microsoft Edge years ago, and even Chrome recently added them. Now, with the Safari update, you can open the Safari View Menu or hop into Settings and select vertical tabs.

By default, the tabs, which will live on the left side of your browser window in iPadOS and macOS (and iOS for the iPhone Duo), appear as icons — a space-saving measure. You can hover over any of them for a quick look at the hidden browser window.

There are other vertical tab features like the ability to pin tabs at the top of your list by dragging and dropping them, and tab groups. The tabs will work on the iPad and, yes, the new iPhone Duo in portrait and landscape mode.

The platform updates also bring a new kind of Dark Mode. Instead of only showing the mode on web pages that support it, Safari will offer to tune unsupported pages to Dark Mode too — but in a way, Apple promises, that won't ruin the sites.

The Adaptive Dark Mode will automatically darken light backgrounds, invert logos and graphics, recolor vector artwork, lift raised surfaces, and even detect shadows and adjust them. It will not touch already darkened sites. For developers, there are new tags they can use that will prevent Adaptive Dark Mode from adjusting them.

The update is also bringing some Siri AI browser tools to Safari for hardware that supports Apple Intelligence. Siri AI already has, with your permission, an awareness of what's on your screen, but with this update it'll see entire web pages (beyond what you see in the screen frame) and even hidden tabs.

This can be useful when you want to do wholesale organization and group tabs. Say you want all tabs relating to a trip to Malta sorted by activity, or you need all your car shopping tabs grouped and organized by car price.

Siri AI can, with new Custom Actions, do your bidding on the browser and clean up your history by topic, site, and time period. It might be useful when you don't want someone seeing that you've been shopping for the last few days on a particular site for that coveted gift. There might be other reasons for targeted history scrubbing, but no need to get into that here.

Other notable updates arriving in iOS 27.3, iPadOS 27.3, macOS 27.3, watchOS 27.3 Dev Beta 1 include:

• Siri App Actions will let Siri AI dig even more deeply into your system by organizing files, making trip plans, creating playlists, scheduling group messages, and finding the best photos to share.
• The promised Apple Health app overhaul, which uses Apple Intelligence, will give you more insights from your health data.
• The pair of Audio Intelligence features that will work with your Apple Watch Series 12:
  • Live rewind, for recalling what was said in conversation (you have to double-press the watch crown to read the last snippet of conversation). It might be a great tool for settling he said/he said arguments.
  • Siri Recap, which, when enabled, can use Apple Intelligence to recap and summarize an entire talk, speech, lesson, or maybe a TED Talk.

The changes are coming to 27.3 betas first and will eventually roll out to the other platforms in a full release. For now, though, all of these updates are found only in the Dev Betas, which are typically the earliest and potentially buggiest releases before Apple moves on to Public Betas (which anyone can install) and the final releases. There's no word on when the full releases will arrive, and we would caution you against installing Developer betas on any of your everyday Apple devices.

• Nvidia's RTX 5080 Super was rumored for January 2027, but fresh gossip suggests it's delayed
• Meanwhile, a new report on GPU prices observes a hefty price jump month-on-month
• Even lower-end GPUs are getting more costly at a faster pace, and the high-end is a nightmare — with no RTX 5080 Super riding to the rescue, it seems

Nvidia's RTX 5080 Super has been strongly rumored of late, but there's now been a cloud of doubt cast over this potential addition to the Blackwell range — just as we've got more evidence of how dire the situation with GPU price hikes has recently become.

VideoCardz spotted the latest from the rumor mill on the RTX 5080 Super, a graphics card that supposedly packs 24GB of video RAM, with Taiwanese tech site Benchlife reporting that Nvidia has delayed the GPU (assuming it's a real product in the first place, of course).

We were told via other rumor peddlers that the 24GB spin on the RTX 5080 is theoretically planned for a January 2027 launch, but Benchlife asserts that the release date "remains unclear" and that Nvidia's board manufacturing partners have yet to receive any design details for the new model.

Given that, according to Benchlife, the "probability is extremely high" that the RTX 5080 Super won't debut in January, considering that board makers were expecting to receive the mentioned design info back in October.

This pushes the rumored GPU back at least a month, very probably more, and the idea of that is hardly surprising given the ongoing RAM crisis, which has been getting worse as 2026 rolls on.

That affects video RAM, and it's the main driver of price spikes with graphics cards, which are starting to get out of hand, as evidenced by TechSpot's latest monthly report highlighting the current cost of GPUs across various regions.

What TechSpot's monitoring data for October 2026 shows is that, as we already knew, high-end pricing has gone even further off the rails. The RTX 5080 is up 39% in the US and 40% in Germany month-on-month, for example, which is ludicrous, frankly — in the US it's now 120% over the MSRP at $2,200. The UK has seen an 8% hike over the past month, with this GPU now 40% over its MSRP in the country. Globally, it's 77% over Nvidia's recommended price on average.

The RTX 5090 is even sillier, as we've seen for some time now, and stands at $9,400 in the US in October, some 370% over the already very expensive MSRP. If you can find the Blackwell flagship at all, that is.

What's really worrying is that TechSpot's data shows lower-tier GPUs are now seeing some major price bumps. Want a humble RTX 5050 in the US? It's gone up 35% over the past month (an increase of over $100), so you'll now pay 68% over the MSRP.

The RTX 5060 is creeping up in price in some European countries, too — it's up 7% in the UK and 13% in Germany. The RTX 5060 Ti 8GB has gone up more, with this GPU getting hiked by 10% in the UK, so it's now £440 compared to £350 back at the start of 2026. The 5060 Ti 8GB went up 6% in the US, too, so it's now 40% over the MSRP in total.

There are hikes across the board for Nvidia, and AMD's Radeon GPUs are getting more expensive at an even faster rate currently. Again, lower-end graphics cards are suffering, such as RX 9060 XT models being up 10% on average month-on-month. The RX 9070 XT is also up 10% in the US since last month, and the increase in Canada has been a sickening 30% — in just one month.

Analysis: a deteriorating situation for GPUs

What does all this tell us? That spiralling graphics card prices are very real, with some huge ongoing hikes for higher-end models — but this isn't just a top-end GPU problem any longer. The real concern is that lower-tier boards are also seeing more price inflation, and I don't think this is a problem that's going away.

Indeed, based on the weighty amount of chatter about the memory crisis continuing to get worse in this final quarter of 2026 and into next year, there's every reason to believe that GPU prices could keep going up. That's why I've been advising PC owners thinking of a GPU upgrade to treat Black Friday as a prime (pun not intended) opportunity to get in and buy a graphics card before any more hikes.

With the RTX 5090 reportedly effectively discontinued — something Nvidia strenuously denies, but the stock situation speaks for itself in countries like the US — and the RTX 5080 pricing itself well out of the range of the vast majority of consumers, those who were anticipating the RTX 5080 Super to ride to the rescue have suffered a fresh blow here, too.

I never thought that was a realistic proposition anyway, mind, but still, it's clear enough that the GPU market is in trouble, and Nvidia seemingly doesn't have any answers in the short term for the upper echelons of its Blackwell range. As noted, though, the real worry is that there's more pain coming to the more affordable end of the graphics card spectrum, where mainstream buyers make their purchases.

• Meta has announced the end of support for two of its popular VR headsets
• The devices affected are the Quest 2 and the Quest 2 Pro
• Support will be discontinued at the end of 2027

If you own a Meta Quest 2 or a Meta Quest Pro virtual reality headset, we’ve got some bad news: Meta has announced it is planning to wind down support for these devices next year, leaving large numbers of users without support for their VR products.

An announcement on the Meta blog aimed at developers details how things stand for creators of apps and services made for these headsets. With the two devices “reaching the end of feature development⁠,” big changes are on the way.

For one thing, new app submissions for these devices will be closed in December 2027. For another, version 2.13 of the Quest’s operating system (due out in March 2027) will be the last one to work with these headsets. Quarterly security patches and critical bug fixes will continue “through the end of 2027,” Meta said.

Still, Meta attempted to reassure developers of apps made for these VR headsets, stating that “People on Quest 2 and Quest Pro can still find, buy, download, and play your apps.” Cross-play with Quest 3 and Quest 3S headsets will continue, and developers can keep sending out updates to Quest 2 and Quest 2 Pro users.

And Meta’s app store for VR headsets will continue to be available to users of these soon-to-be-discontinued devices, with the firm saying that “people keep access to everything they’ve purchased, and no apps will be removed from the Store because of this change.”

Time to upgrade?

The Quest 2 launched in 2020, making it six years old at this point. Although we scored it highly in our review, it’s since been succeeded by the Quest 3, which is our pick for the best VR headset around. Evidently, Meta feels it’s now time to retire the Quest 2 and its Quest 2 Pro sibling, with the Quest Pro line having allegedly been phased out entirely in 2024.

Meta framed the change as one that’s paving the way for its upcoming VR Glasses. The company said that the Quest 3 and Quest 3S are “the baseline for Meta VR gamers” with its VR Glasses due to bring “another leap forward” for the industry. In that world, there’s apparently no more room for the Quest 2 and Quest 2 Pro.

Continuing app development for the Quest 2 and Quest 2 Pro might prove to be tricky, as Meta says it will not test new operating system and SDK releases on these products. Instead, it’ll be up to developers to ensure their apps function as intended.

Meta urged developers to assess how much of their audience is using Quest 2 and Quest 2 Pro devices and to consider splitting their releases to accommodate those on older headsets. If developers want to end support for these products, they should give users at least 180 days’ notice if customers could end up losing access to content or services as a result.

If you’ve got a Meta Quest 2 or Meta Quest 2 Pro at home, you’ll need to think about what you want to do going forward. While you should be able to continue using your headset, the lack of critical bug fixes after the end of 2027 could prove to be a problem. In that case, it might finally be time to upgrade to one of the best VR headsets to ensure you don’t miss out on anything.

• Synology warned of active ransomware attacks exploiting long-patched DSM vulnerabilities on unupdated NAS devices
• Attackers are reportedly deploying the C3rb3r encryptor and demanding thousands of dollars in ransom
• Users are urged to patch immediately, restrict internet exposure, and secure NAS access to prevent compromise

Synology, a major network-attached storage (NAS) manufacturer, is warning users about ongoing ransomware attacks targeting devices running outdated software. It urged all users to apply provided patches and secure their devices without delay.

In a brief announcement, Synology said it “identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.” The goal of the attacks seem to be data encryption and a ransom demand.

“Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times.”

C3rb3r attacks

The announcement is rather stingy on the details. We don’t know which vulnerability the threat actors are exploiting, where exactly, or how successful they are.

We also don’t know how many devices are at risk - the Shadowserver Foundation tracks a total of 380,000 internet-connected endpoints (many of which are, most likely, running the latest software version and are thus protected).

The company also did not say who the threat actors are, but according to BleepingComputer, there has been a “massive wave of reports” from Synology customers whose data was apparently locked down by the “C3rb3r” encryptor. These customers were asked to pay “thousands of dollars” in ransom, in exchange for the decryption key. The publication says the first reports started surfacing more than two weeks ago.

There are two main ways for cybercriminals to access an electronic device and encrypt the data found there - either by exploiting a zero-day vulnerability (one that has not yet received a patch), or by exploiting years-old n-day vulnerabilities (ones that were patched months ago) on devices that were never updated and secured.

With Synology users, the latter seems to be the case. The company said the attackers were exploiting a vulnerability patched in December 2024, and linked to a November 2024 security advisory, in which it listed three fixed bugs: CVE-2024-10441 (arbitrary code execution), CVE-2024-50629 (arbitrary file read), and CVE-2024-10445 (a bug that allows writing files on compromised devices).

DSM 7.2.2 owners should upgrade to 7.2.2-72806-1 or above, DSM 7.2.1to 7.2.1-69057-6 or above, and DSM 7.2 to 7.2-64570-4 or above. DSM 7.1 should upgrade to 7.1.1-42962-7 or above, while those running DSM 6.2 to 6.2.4-25556-8 or above. Only in the last version - 6.2 - is the vulnerability labeled as “moderate”. In all other cases it was deemed “critical”.

Why are NAS devices being targeted?

NAS devices are dedicated storage systems that businesses can connect to their local network and allow employees to access, share, and manage files stored in a centralized location. They are rather popular among SMBs that lack the resources to maintain a more complex enterprise storage infrastructure.

Besides being used as a hybrid cloud of sorts, NAS is also used to store business documents and often acts as a centralized backup. The relative low cost, straightforward deployment, and easily expandable storage capacity makes NAS devices an attractive alternative to both dedicated file servers and cloud storage subscriptions.

However, this also makes them a valuable target for cybercriminals, as we’ve seen in this Synology case. The best way to defend against ransomware attackers is to either completely pull the NAS from the public internet or at least limit access to a handful of vetted identities. Keeping the devices updated with the latest firmware and software is also recommended.

It is worth mentioning that NAS devices usually come with RAID redundancy and built-in backup features, but these do not necessarily protect against ransomware encrypting the stored data.

• Security researcher combined audio analysis, flight data and a lot of number-crunching to identify audio locations
• Aircraft that are inaudible on the soundtrack can still reveal the recorder's location
• The technique is apparently accurate to within 100m

If, like me, you grew up watching corny FBI shows where computers could do the impossible through made-up technology with a single command of "enhance!", you're going to love the apparently impossible thing that YouTuber Colsto has just described in a new viral video.

Using a Doppler effect technique (more on that below), the location of a video or audio recording can be identified to within 100 meters through a combination of inaudible audio, flight data and math. This is no movie magic or scriptwriter invention: it's real and it's a little bit scary too.

I've embedded the video below and would really recommend watching it, because Colsto goes into great detail about how it's done, what it can't do and what precautions you might want to take if you don't want your background to betray you.

How your video background can betray you

As Colsto explains, the key is the 'Doppler effect'. That's the way sounds appear to change based on the distance between a moving source and the listener. You hear it all the time: it's what makes fire engine and ambulance sirens, car stereos and airplane propellers seem to change pitch as they go past.

What's clever here is that Colsto has focused on the sounds made by aircraft in the backgrounds of videos. In many parts of the world the skies are very busy, and a faraway airplane that's inaudible to you or other listeners might still leave a sonic footprint on your video or audio that can be isolated and analyzed. That's definitely the case in the US data Colsto used.

Once you've got the audio, the aircraft sound can then be matched with publicly available flight data and Doppler curve measurements. By triangulating the sound from multiple aircraft, you can then identify where the audio was recorded. This is enormously clever.

Colsto explains the detail in the video — what aircraft data was used, how it was analyzed, how the Doppler measurements were filtered and what corrections were made — but isn't posting any software or other tools to actually do it for you. Instead, you'll get an assessment of preventive measurements including why normal signal processing such as high-pass filters or noise reduction can be ineffective.

How scary is this?

Colsto was keen to point out that the video is designed to be educational about open-source intelligence (OSINT) techniques, rather than an attempt to fear-monger.

"The odds that someone can and does actually do this is pretty slim. In reality, there's probably a hundred easier ways to find you than this," he says.

However, these are some potential use cases. "The audio we used is just from some random security camera, but it could have just as well been footage from a investigation or a video online. Something with literally zero visual clues could be located using this," he added.

So despite the somewhat niche application, there's something deeply scary about this kind of thing, I think, and from similar revelations such as Wi-Fi routers that can be used to locate you indoors and Wi-Fi signals that can help track your movements, even if you're not carrying a phone that connects to them.

And I know that fear is probably a bit silly when everywhere I go I carry a phone, use a tablet or drive a car that's leaking identifiable information to God-knows-who. But I can't help asking the question: if the possibilities we know about are this scary, what on Earth is the tech we don't know about capable of?

Thinking of buying a new TV?

Try our TV size and model finder! You tell it how far you sit from your TV, we'll tell you what size to buy based on viewing angle advice from image quality experts, and we'll recommend our three top TVs at that size for different prices.

• Cybercriminals are stealing AI API keys and cloud credentials to hijack expensive LLM services and infrastructure
• Stolen access is used to run AI workloads, create proxy services, and rack up massive bills for victims
• Google warns “LLMjacking” is evolving into a specialized cybercrime ecosystem with dedicated monetization operators

Threat actors are using large language models (LLM) to support almost every stage of a cyberattack, from researching potential victims to developing malware and automating various attacks. However, using AI is not cheap, and for those eager to use frontier models, costs can stack up relatively quickly.

But cybercriminals are used to stealing things, so why not steal someone else’s tokens, too?

A new report from Google’s Threat Intelligence Group (GTIG) says that different hacking groups are doing exactly that and that the practice - known as LLMjacking - has been steadily growing more popular over the last couple of years.

Most groups start by focusing either on publicly exposed LLM endpoints, or on obtaining valid LLM application programming interface (API) keys. In many cases, the crooks would use exposed or stolen cloud identity tokens (IAM credentials, Service Account keys, GitHub Personal Access Tokens, and active session tokens) to establish an initial foothold into the target organizations’ infrastructure.

From there, they would “systematically work” to escalate privileges, solidify their access, and identify targets for further compromise.

LLMjacking

The endgame is LLMjacking, which GTIG describes as “the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning.” In other words, someone else is using your AI subscription while you get the bill.

The bills can cause quite the headache, too. With cryptojacking, for example, token mining is relatively slow and steady, and a certain amount of time needs to pass for the charges to really stack up. With LLMjacking, however, costs can go into six digits in six minutes.

“Upon acquiring LLM API access keys, UNC6993 attempted to generate additional API keys and enable associated services within victim cloud projects, quickly accumulating over $100,000 in billing charges,” Google says in the report.

“Another threat actor subscribed victim accounts to Pay-As-You-Go agreements, selecting premium foundation models and launching high-volume inference streams. To bypass rate limits, the threat actor deployed a "burn and rotate" strategy, continuously creating and deleting short-lived service accounts while auditing the cloud provider’s billing interface to monitor financial impact.”

In some cases, threat actors also used the acquired access to host their own proxy endpoints and agentic workloads. Google says that one threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs rebranded under a persona known as D1337-KAIROS.

This actor deployed a containerized backdoor which queried an upstream LLM to reason through instructions and execute commands locally.

A growing ecosystem

The LLMjacking ecosystem is young, but growing fast and maturing even faster. Google says that there is already a division of labor between hacking groups that establish initial access to compromised environments, and operators who manage downstream monetization infrastructure. The latter are called “LLM Mixers” and they operate as a routing gateway that proxies, aggregates, and resells unauthorized LLM access to underground subscribers.

“In one investigation, GTIG observed two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure, demonstrating the sophisticated specialization emerging in this space,” Google said.

By using open source API gateways and custom relay infrastructure, the attackers were able to pool stolen credentials, meter usage, and hide where the requests really originated from.

Google is now sounding the alarm, saying it expects threat actors to “increasingly prioritize” LLMjacking at the expense of other resource theft practices. It urges organizations to increase their visibility of LLM platforms, prioritize detection of modifications to LLM accounts and services, and treat any unauthorized enablement as a critical security event. It also advised organizations to enforce the principle of least privilege and make sure accounts and users only have permissions they absolutely need to get the job done.

• John Ternus has warned that: "What we're seeing with memory pricing right now is unprecedented."
• The Apple CEO cautioned that RAM costs are going to climb higher in this final quarter of 2026
• It sounds even bleaker than Apple's previous statements on the RAM crisis, and follows many other warnings that 2027 is set to be a miserable year price-wise

Apple is warning of an 'unprecedented' rise in the cost of RAM, adding to the cacophony of alarm bells that have been ringing about the price of memory chips (and other PC components besides) recently.

The Guardian reports that in a conference call following Apple's fiscal Q3 results — which were better than analysts expected, driven by the iPhone, Mac mini and sales in China — Apple's new CEO John Ternus touched on the subject of the RAM crisis.

Ternus, who recently took the reins from Tim Cook, cautioned bleakly that: "What we're seeing with memory pricing right now is unprecedented."

He then observed that memory costs would climb even higher in the final quarter of 2026 compared to the rest of the year, during which, as you've doubtless seen, we've already witnessed a steep climb in pricing.

Despite its financial results outperforming analyst forecasts, Apple informed investors that these higher memory costs are going to erode some of its profit margins, which meant the company's stock dropped.

Apple raised the prices of Macs earlier this year, as well as iPads and more recently iPhones, and Ternus acknowledged that this had "provided some offset" for Apple in terms of the ongoing cost crisis around components.

Analysis: Ternus takes a turn for the sterner

It's an ominous utterance from Ternus, and sounds more severe than the warning Apple issued back before the Mac (and other) price hikes happened in June 2026. Back then, when Cook was still chief executive, he warned about "significantly higher memory costs" that would "drive an increasing impact" on Apple's products, which, as noted, came to pass.

Now we're hearing the word "unprecedented", which sounds a lot more concerning than "significant"; although in fairness, this is referencing what's already happened this year as much as what's to come. But we're clearly being primed for more price-hike misery by Ternus here, and it's difficult to see how this won't have a further impact on Macs, iPhones and iPads, if not in this quarter, then in 2027.

We don't, of course, know to what extent profits might be eroded by more expensive memory chips, or how this might be balanced by consumers having to foot that bill. Only time will tell on that score.

Mac mini sales were mentioned in the report — which quoted Ben Barringer, the head of technology research at investment management firm Quilter Cheviot — as being responsible for part of Apple's boosted earnings for the most recent quarter, and that's down to the increasing demand for local AI.

The Mac Studio is major part of that picture, too, and this particular PC just popped up as an example of how ridiculous RAM pricing has just become at the very top end of the Apple product tree. If you want a Mac Studio with 512GB of RAM, you'll now pay more than double the cost of a Mac Studio that has 256GB of memory, meaning that it's cheaper to buy two of the latter computers (while getting two CPUs/GPUs in the process).

It's a bizarre situation, but this is what we've arrived at with memory upgrades, which were always seriously pricey with Apple, even before the RAM crisis kicked off (that goes for storage, too).

And this situation is only going to get worse, seemingly, according to Ternus, which is also, of course, the view of the wider industry and various analysts. I can't begin to count the warnings we've had in the past couple of months about the RAM crisis becoming even more dire, so at this point it's just a question of how much worse things might get.

I fear that some categories of tech and PC components are going to become increasingly unaffordable next year, and I recently wrote about why Black Friday could be a good time to move on certain purchases.

• Reddit wants to overturn Australia’s social media ban for under-16s
• It is challenging the law in the Australian High Court
• Government says it’s defending the law from "sustained ideological attack"

In late 2025, Australia became the first nation in the world to ban social media for under-16s — and as you would expect, that hasn’t gone down particularly well with the app makers affected. Reddit, for example, has issued a stinging rebuke to the Australian government and is in the process of challenging the ban in court.

A lawyer representing Reddit called the ban “ill thought out” (via Reuters) and said it was a “profound ‌restriction on political debate.” The attorney was speaking at the Australian High Court, where Reddit is seeking to contest the country’s new law.

Together with a libertarian advocacy group, Reddit claimed in court that the social media ban was “a very substantial restriction on what young people can now do” and that it could stifle political debate. It added that the restrictions may stop users creating content and responding to posts.

Although Reddit said it supported the aims of the law, it branded the legislation “inept,” saying that it did not have any specific means to keep minors off social media and failed to regulate other platforms where cyberbullying might take place, such as on gaming websites. And the fact that users who were not logged in could still view huge amounts of material undermined the law, Reddit argued.

Could Reddit overturn the ban?

Since the Australian law came into effect, several studies have shown that large numbers of teenage users targeted by it are still able to access restricted material. Sometimes, that might be as simple as using a VPN service to disguise your location, while at other times, social media firms are simply not taking action to restrict usage by under-16s.

Despite Reddit’s criticism, the Australian government has said it will defend its legislation. In court, the state’s lawyer, Joanna Davidson, said that children were more vulnerable to harmful online content because their brains were not fully developed compared to those of adults.

And speaking outside the High Court, communications ⁠minister Anika Wells ​said: “We ​are here to defend a fundamental tenet of Australian democracy, which is an Australian’s right, and particularly an Australian child’s right, to be free from harm. We seek ​to defend that from sustained ideological attack.”

The government has doubled the maximum fine for non-compliance with the law to AU$99 million (about $69.5 million / £51.5 million), increased the discovery powers of the eSafety Commissioner, and said it is preparing enforcement action against some of the largest social media platforms operating in Australia.

Whatever side you take on this matter, it’s clear that neither the Australian government nor Reddit are preparing to back down anytime soon. And with other nations considering similar laws, many people around the world will be watching closely.

• Google leads efforts to dismantle 1.3 million device residential proxy botnet built through malware preinstalled on Android hardware
• Researchers say manufacturer Videostrong intentionally shipped malware and sold botnet access to cybercriminals
• Google seized infrastructure, blocked the company from Android certification, and strengthened device security checks

Google has revealed its role in taking down a massive residential proxy network and the malware that built it - with the unusual twist that the developer was a seemingly legitimate business with multiple products and countless trusting customers.

In a blog post, the company said that together with its partners, it dismantled a backdoor called XCPE. This malware was apparently used for ad fraud, served as a dropper for additional malware, and used for assimilating devices into an illegal residential proxy network.

In total, more than 1.3 million set-top boxes alone were part of the network, the company said.

No supply chain attack

Malicious residential proxy networks are nothing new - they emerge and get dismantled on a regular basis. But this one was unique, as it came preloaded on Android devices built and sold by a certified Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). In other words, people were thinking they were buying a legitimate product from a legitimate, Google-vetted company, but were instead getting malware-laden hardware that abused their trust and sold their bandwidth to cybercriminals.

In this case, not only did the company know what it was doing, but it was actively developing the malware and even worked on hiding it from Google and everyone else.

“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users,” Google said, not hiding its disappointment with the manufacturer.

Videostrong ended up selling two things: On the surface, it was selling Android-powered smartphones and similar devices that contained malware that built a botnet. Under the table, it was selling access to that botnet to cybercriminals.

Google was joined by a number of other companies and agencies in this operation, including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.

Threat actors are always in need of residential proxy botnets. They can use them to launch powerful Distributed Denial of Service (DDoS) attacks, hide their addresses as they operate, conduct large-scale credential stuffing campaigns, bypass geographical restrictions, scrape websites at scale, and more. We don’t know how much Videostrong made from selling access to the botnet, or who used it.

Taking down the C2 domains

To disrupt both the malware and the network, Google took down the domains and servers the company used to control the botnet and install malware modules, took down C2 domains that were used by over a dozen malware families loaded as modules via the XCPE backdoor, and banned Videostrong and all future subsidiaries and affiliates from building and selling Android devices in the future, or supplying software to other certified vendors.

Google also said it had improved its firmware integrity checks for certified Android TV devices to prevent similar incidents involving other manufacturers.

“Google requires OEMs go through a comprehensive suite of compatibility and security tests to ensure a consistent and safe user experience across the Android ecosystem,” it stressed. “However, Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot. As a result, Google has implemented changes to its existing review process to better safeguard against similar activity in the future.”

This is not the first time an electronic device came with malware off the shelf. Last month, security researchers Bitdefender found Android phones from multiple manufacturers, including Doogee and Cubot (both Chinese firms) being sold with preloaded malware. However, in those cases, the supply chain was compromised and the malware was included without the OEM’s knowledge, or consent.

• A zero-click Android flaw let attackers crash phones with a specially crafted SMS message
• Repeated messages could trigger reboot loops, disrupt calls, and even affect emergency connectivity
• Google patched supported Android versions, but many end-of-life devices remain permanently vulnerable

Picture this: You’re talking on your Android phone when all of a sudden you just lose mobile connectivity and your phone call drops. No explanation, no notification. Soon after, it happens again. And again. At one point, the device goes into recovery mode, rebooting every minute and a half until you finally perform a factory reset.

This is not a theoretical scenario - it is a real possibility, thanks to a critical-severity vulnerability in Android tracked as CVE-2026-58882.

Google has patched the issue for newer versions of Android, but those who are past their end-of-life date will remain at risk.

Sending an evil message

The bug was discovered by security researcher Mark Blah and described as a zero-click denial of service (DoS) vulnerability. In more technical terms, it is an “improper validation of a header-length value” bug in Android’s WapPushOverSms.decodeWapPdu function. It was nicknamed “SMS of Death” because it can be exploited with nothing more than an SMS message, which the victims doesn’t even have to open (hence the ‘zero-click’ part).

As Blah discovered, a threat actor could send a malformed eight-byte WAP Push message to an Android device’s port 2948: 01 06 88 80 80 80 00 BE.

Since this is a hex message, when it gets translated into a signed 32-bit integer, it becomes -2147483648. Android can then try to allocate memory using this negative value, triggering a NegativeArraySizeException error that crashes the com.android.phone process. Since this process manages cellular functions, the call is dropped and mobile connectivity is disrupted. Even emergency services are susceptible, it was said.

It gets worse. Android processes messages before they reach the inbox, meaning the victim will not be notified of the SMS and won’t even know it’s the text message that’s crashing the system. Also, some carriers will attempt to redeliver messages that never reached the inbox, extending the agony. Android also does its part by constantly trying to process messages already stored on the phone.

Finally, Blah found that if a malicious actor sends 20 or more messages, they can force the device into a reboot loop. On an Android 12 device, they can force looped recovery mode, leaving factory reset as the only viable option.

Patching the SMS of Death

Initially, all Android versions were affected, it was said. Google patched it for versions 14 through 17, but older devices will not be getting a patch and thus will remain at risk indefinitely. The fix is called “Fix remote DoS in decodeWapPdu”, and apparently it prevents the crashes by catching exceptions triggered when Android processes malformed text messages. It also deletes these messages from the SMS database so that they don’t trigger repeat crashes.

Blah has released a proof-of-concept (PoC), showing the wider community exactly how to exploit the flaw, and BleepingComputer reported that a GitHub contributor found a way to remove the malicious message, but it requires more technical knowledge, which is something the majority of mobile phone users probably won’t have. Still, those interested in tinkering should know that it can be removed via a computer, using Android Debug Bridge (ADB).

Google apparently patched the bug in its October 2026 Android security updates, but that doesn’t automatically mean all Android users are safe. Unlike Apple’s ecosystem, Android is diversified, and different manufacturers have different update cadences.

Therefore, while we can assume Pixel users have likely already received this update, Samsung users, as well as those using Xiaomi, Motorola, or OnePlus devices, will probably have to wait a little longer until their manufacturers apply the fix to their devices and push the update.

Still, since the PoC has been released, it’s safe to assume most Android manufacturers have already pushed their updates. Users are advised to install them as soon as possible.

• New malware uses AI to analyze stolen data, rank victims, and identify the most profitable targets
• VOLTA-AUTODOXER steals credentials, crypto wallets, tokens, and personal information before generating AI dossiers
• Researchers warn the malware could commoditize AI-powered victim profiling for ransomware and cybercrime operators

Stealing sensitive data from a lot of people is one thing, but determining whether or not that data is worth anything to anyone - that’s an entirely different ball game.

Now, it seems cybercriminals found a way to easily profile their victims’ information and they’re using - you guessed it - Artificial Intelligence (AI).

Cybersecurity researchers Cisco Talos uncovered a new malware strain through Cognitive Artificial Intelligence Research Network (CAIRN) - an open source cybersecurity research kit built to identify and track AI-powered malware.

The strain is called VOLTA-AUTODOXER and its operation is split into four key steps: 1) steal as much information as possible; 2) share it with an AI for assessment; 3) exfiltrate the data to attacker-controlled infrastructure; and 4) remove yourself from the victim’s system.

Analyzing the data

Cisco Talos did not say where exactly the malware was found, how many devices it infected, or how it is being disseminated. It said that, on surface level, it looks just like any other infostealer. It grabs browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots.

But this is where it splits from the industry standard, by building a structured evidence bundle about the person behind the system.

It pulls the device’s geographical location, home address, employer and employer domain, inferred birth year, the last 4 digits of their credit cards, Slack workspaces, document authorship metadata, iPhone backup indicators, and even a live Roblox account valuation. Then it moves to Gmail, looking for mails from UberEats and DoorDash in order to confirm the home address.

VOLTA then bundles and serializes the bundle, before POSTing it to OpenRouter, an AI infrastructure platform where users can access hundreds of LLMs through a single API.

There, the AI gives a model a prompt to behave as a “forensic intelligence analyst drafting a target assessment”. In other words, the AI is tasked with assessing whether or not the data pulled is worth any trouble, and if so - how much. Victims are ranked by value, giving the attackers more time to do what seems to be the end goal here - ransomware.

The default model is Claude, but if it refuses to comply for any reason, the malware is instructed to fall back to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. If neither of the models end up working, the malware will just send raw data back to the attacker. This is usually done via a Telegram channel.

Running away

After the work has been completed, VOLTA is instructed to delete itself from the system, likely to cover its tracks. A separate file, named volta_debug.txt apparently remains on the system, showing what was collected and whether or not the AI-powered assessment was a success.

The researchers believe VOLTA is designed to be sold on the black market. Elements such as the Telegram channel, or API keys, are not hardcoded, and the malware comes as a template with six swappable slots that are filed in at build time.

“This suggests it’s a builder model: The author sells access, the customer provides their values, and the builder compiles a custom binary for each order,” Cisco Talos explains. “If VOLTA is indeed a commoditized malware, then the AI dossier capability isn't something the author invented for their own operations. It is a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments in their Telegram inbox.”

If you suspect an infection, revoke or rotate all API keys and tokens, and change all of your passwords. Also, double-check your crypto wallets and move all funds to a new wallet with a fresh seed.