Feedback & Followups
- 🇺🇸 US Court Blocks Spyware Vendor NSO Group from Targeting WhatsApp Users — cyberinsider.com/… (Maybe their recent change to US ownership will give this injunction more teeth!)
- Update on the Tea app which suffered such catastrophic data breaches recently: Apple confirms removal of controversial dating apps after safety breaches — www.macobserver.com/… (the male-focused clone TeaOnHer also removed, but both still on Google Play Store 🙁)
❗ Action Alerts
- Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws — www.bleepingcomputer.com/…
- A reminder that this is the last set of patches for Windows 10 users not on an Extended Security Updates (ESU) plan — www.bleepingcomputer.com/…
- It’s not just Windows 10: Microsoft: Office 2016 and Office 2019 have reached end of support — www.bleepingcomputer.com/…
- Technical debt strikes again: Microsoft restricts IE mode access in Edge after zero-day attacks — www.bleepingcomputer.com/…
- Microsoft disables File Explorer preview for downloads to block attacks — www.bleepingcomputer.com/…
- ⚠️ Framework Laptop Owners: Secure Boot bypass risk threatens nearly 200,000 Linux Framework laptops — www.bleepingcomputer.com/… (patch available, so apply!)
Worthy Warnings
- A Timely Reminder that Malicious Ads are Still a Problem: Google ads for fake Homebrew, LogMeIn sites push infostealers — www.bleepingcomputer.com/…
-
Reminder — Agentic AI Browsers and ad-ins are too New to be Safe: (AI taking actions, not answering questions)
- Related: Cursor, Windsurf IDEs riddled with 94+ n-day Chromium vulnerabilities — www.bleepingcomputer.com/…
- > Cursor and Windsurf are AI-powered code editors forked from Visual Studio Code. They integrate large-language models (LLMs) to help developers write software more easily and quickly.
- Cybercriminals have developed a new and deviously strategy: fake company’s legitimate legacy features, i.e. tricking living users into thinking they have been reported as dead and must act immediately or their legacy contacts will be given access to their account:
- Fake LastPass death claims used to breach password vaults — www.bleepingcomputer.com/…
- Expect this tactic to be used against other services that have similar features (Meta & Apple are likely future targets since they have mature legacy features)
- A new ‘ClickFix’ variation: TikTok Videos Promoting Malware Installation – SANS ISC — isc.sans.edu/…
-
⚠️ Signal Users: Signal Users Targeted by Fake Support Messages for Account Hijacks — cyberinsider.com/…
-
⚠️ iPhone Users: Apple have changed how iPhones treat unknown USB devices in iOS 26, the new setting is less secure than the old, but may be a better trade-off for most people — www.cultofmac.com/… (Editorial by Bart: the headline is clickbait and out of tune with the article itself)
- Previous Default Behaviour: always ask for confirmation before making a data connection to any unknown device (still available as Settings → Privacy & Security → Wired Accessories → Ask for New Accessories)
- New Default Behaviour: only ask for confirmation if the phone is locked when the connection is made.
- So-called ‘Juice Jacking’ attacks have been theoretically possible for years, but rather surprisingly, have not (yet at least) been deployed widely in the real world, so (today at least), the actual risk for regular users is low, which might explain the change.
- ⚠️ 🇺🇸 Apple Users: Is ‘Applestore[@]usa[.]com’ Legit? No — here’s what to do — www.macobserver.com/…
-
🇺🇸 Prosper Data Breach Exposed 17.6 Million People’s Information — cyberinsider.com/…
- A major US peer-to-peer lending platform
- No mention of affected users being notified, but the data has been loaded into Have-I-Been-Pwned, and the list of breached fields is extremely worrying 😕
Notable News
- Have-I-Been-Pwned has loaded one of the biggest dumps of stolen credentials circulating on the dark web to their breach notification service — www.troyhunt.com/…
- This catalogue of stolen credentials was harvested from cybercriminals by security researchers; it is not a traditional breach
- These credentials were stolen using key loggers and other data-stealing malware, so they’re taken from users, not from websites
- Google Quietly Dismantles Core of Privacy Sandbox for Chrome — cyberinsider.com/…
- Might be a blessing in disguise — rather than rolling their own Chrome-only solutions, they are switching to working within the W3C to develop new privacy-protecting standards to replace third-party cookies
- 🇺🇸 EFF Sues US Government Over AI-Powered Social Media Surveillance — cyberinsider.com/…
-
🇺🇸 California becomes the next US state to impose age verification on App Stores — appleinsider.com/… (Headline does not match actual article content)
- No ID requirements, so not a privacy problem
- Effectively forces App Store operators to give parents the tools they need to manage their kids devices
- Forces App Stores to make specific age brackets available to developers
- Apple already has an API for this (added with 🍎OS 26), but the age ranges don’t align, so Apple will need to add some new API calls to comply, but won’t need to make Major changes — www.macobserver.com/…
- Google may have a little more work to do, but shouldn’t be a big deal.
- 🇪🇺 🇦🇹 Austrian DPA Finds Microsoft 365 Illegally Tracked Students — cyberinsider.com/…
- Microsoft US was found to be exerting too much influence over Microsoft Ireland, so the case found against the US parent company, not the European subsidiary.
-
The DSB confirmed that Microsoft 365 Education set several non-essential tracking cookies without user consent. These cookies were found to be unnecessary for technical operation and thus required prior consent, which was not obtained. As a result, Microsoft, the Ministry, and the school must now check whether these cookies are still in use and delete any associated data within ten weeks
- 🇮🇪 Hackers earn $1,024,750 for 73 zero-days at Pwn2Own Ireland — www.bleepingcomputer.com/…
-
After the zero-days are exploited at Pwn2Own, the vendors have 90 days to release patches before Trend Micro’s Zero Day Initiative publicly discloses them.
- Expect a whole bunch of patches for major products from Apple, Google, Samsung, Meta, QNAP, and more soon
-
-
Firefox Add-ons Must Declare Data Collection Starting November 3 — cyberinsider.com/… (Editorial by Bart: good to see these older app stores back-port the kinds of features Apple have been adding to theirs)
-
Meta Rolls Out New Anti-Scam Features on WhatsApp and Messenger — cyberinsider.com/… (the intelligent screen-share blocking looks particularly useful for disrupting scams)
-
Mullvad VPN’s Web App Passes Security Audit With Almost Perfect Score — cyberinsider.com/…
Interesting Insights
- 🎧 Turns out this story is much more nuanced that it first appears: kill switch: maybe ICEBlock was ‘activism theater,’ but is banning it protecting us? — overcast.fm/…
- From Allison: The best episode of This Week in Tech I’ve ever listened to. Leo had on Jacob Ward, Harper Reed, and Abrar Al-Heeti. The discussions on AI were enlightening and funny at the same time. “Nine Days a Week” for 19 October 2025
Palate Cleansers
- From Allister Jenks: Jessica Rooster: “HAL 9000: I’m sorry Dave, I’m afraid I can’t do t…” – beige.party — beige.party/… (In the NosillaCast Slack at podfeet.com/slack)
- From NosillaCastaway Joop: 🎦 Node.js: The Documentary, An origin story — www.youtube.com/…
- From Maynooth University Prof David Malone: A fun timeline from the first password to passkeys — ssg.dev/…
- From Bart:
- A very useful free Mac app from Devon Technologies (of Devon Think fame): Neo Network Utility 2.0 — www.devontechnologies.com/…
- 🎦 A simply amazing conversation with the much missed Jane Goodall recorded a few months before her recent death: Jane Goodall Interview on ‘Famous Last Words’ — Netflix Tudum (via web.archive.org/…) (direct Netflix link)
Legend
When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.
| Emoji | Meaning |
|---|---|
| 🎧 | A link to audio content, probably a podcast. |
| ❗ | A call to action. |
| flag | The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country. |
| 📊 | A link to graphical content, probably a chart, graph, or diagram. |
| 🧯 | A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂 |
| 💵 | A link to an article behind a paywall. |
| 📌 | A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future. |
| 🎩 | A tip of the hat to thank a member of the community for bringing the story to our attention. |
| 🎦 | A link to video content. |