Feedback & Followups
- Age Verification Developments:
- 🇺🇸 Apple have expanded their Digital ID technology to provide anonymous age verification in the US — www.macobserver.com/…
- “A Digital ID in Apple Wallet created using a U.S. passport can be used to confirm that you’re an adult.” — Apple
- 🇺🇸 Utah becomes first US state to require age verification for VPN use — cyberinsider.com/…
- Not quite as nuts as it sounds, VPN providers don’t need to provide age verification, websites with adult content need to block VPNs (not possible to do reliably of course!).
- iOS RCS support: Apple have officially announced that RCS will start rolling out with iOS 26.5, but it will be gradual, as carriers move to enable the feature on their networks — cyberinsider.com/…
- 🇺🇸 More welcome enforcement actions in the US: FTC orders Kochava to stop selling people’s location data — cyberinsider.com/…
- The SANS Institute did a good writeup of the malicious HomeBrew ads we discussed last time, including screenshots — isc.sans.edu/…
- Notice the initial link is clearly marked as an ad, though it could of course be an ad by the actual developers …
- Bart’s advice remains — “never click ads in search results, assume they’re all dishonest or malicious” (because too many are!)
❗ Action Alerts
- Google pushes massive Chrome security update to patch 127 flaws — cyberinsider.com/…
- There have been two notable Linux Kernel Zero-days in the last week:
- Patches are slowly starting to roll out from the various distributions for the first, and similar fixes for the second should follow soon.
- There are workarounds for both vulnerabilities, but since they involve disabling kernel features, they should only be applied with an understanding of the impact this would have on the specific device. For typical home users, both workarounds should be safe, though.
- Server-focused advanced security products like Microsoft Defender for Linux’s optional EDR feature (endpoint detection & response) have been updated to detect and block attempts to exploit these vulnerabilities.
- Both vulnerabilities are local privilege escalation bugs, allowing non-root users logged into the machine to gain root privileges
- This makes the bugs catastrophic for shared computing environments like shared hosting and school labs.
- For home users, the danger is much less — as we say on the show, “if you already have malware on your device, it can now become root”, but of course, you have a bigger problem: you already have malware!
- 🧯 For most NosillaCastaways, in your personal capacity at least, these bugs can get a cautious fire-extinguisher emoji. Do still patch when official patches are released though!
- “Copy Fail” gives root access to all Linux systems via 732-byte exploit — cyberinsider.com/…
- New Linux ‘Dirty Frag’ zero-day gives root on all major distros — www.bleepingcomputer.com/…
- ⚠️ WhatsApp users — patch all your clients on all OSes ASAP: WhatsApp warns of Instagram Reels bug that could load risky content — cyberinsider.com/…
- ⚠️ Ollama Users — patch ASAP: Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak — thehackernews.com/…
Worthy Warnings
- ⚠️ Claude AI + Google Chrome users: “ClaudeBleed” allows any Chrome extension to control Anthropic’s AI assistant — cyberinsider.com/…
- The issue has been partially fixed in the latest plugin update, but depending on your configuration, you might still be at risk!
- “According to the report, attackers could still bypass the new protections by abusing Claude’s ‘Act without asking’ mode or by triggering alternative side-panel execution flows that restored autonomous behavior.” — Cyber Insider
- ⚠️ WordPress Site Owners — check you don’t have the Quick Page/Post Redirect plugin installed: Popular WordPress redirect plugin hid dormant backdoor for years — www.bleepingcomputer.com/…
- ⚠️ CPanel/WHM Users — check your hosting company has been keeping your server patched, and if you can, check the sign-in logs for unexpected sign-ins:
- A reminder of why we need to stay vigilant: 🇺🇸 FTC: Americans lost over $2.1 billion to social media scams in 2025 — www.bleepingcomputer.com/…
Notable News
- A rare retrograde step: Instagram Ends Message Encryption Making Your DMs Less Private — www.macobserver.com/…
- A good reminder to treat all postings on any social media site as if everything you post in any format could easily become public at any stage.
- When you need secure messaging, use a messaging service with good security, not a social media platform!
- 🇨🇦 ⚠️ Canadian NosillaCastaways — now might be a good time to reach out to your elected representatives to share your views: Apple and Meta warn Canada’s Bill C-22 forces encryption backdoors — cyberinsider.com/…
- Some small but nice cybersecurity enhancements:
- Signal to roll out anti-phishing safeguards following account takeovers — cyberinsider.com/… (none of Signal’s systems nor their encryption were broken, the attacks were purely social engineering)
- Microsoft to deprecate legacy TLS in Exchange Online starting July — www.bleepingcomputer.com/… (needed, but could break legacy clients!)
- Meta enhances security of WhatsApp and Messenger encrypted backups — cyberinsider.com/…
- Proton Mail rolls out quantum-resistant encryption for all users — cyberinsider.com/…
Excellent Explainers
- What Is Hacking? Types, Techniques, and How to Protect Yourself — www.intego.com/…
- Physicist Hannah Fry explains how agentic AI works using OpenClaw experimentation to illustrate: Why AI Agents are either the best or worst thing we’ve ever built
Interesting Insights
- An approachable yet deep interview with a leading Quantum Computing researcher: Breaking encryption with quantum computing — Interview with Chris Peikert — cyberinsider.com/… (definitely a long read!)
Palate Cleansers
- From Bart: an excellent three-part long- read from Ars on the history of the Internet:
- An Ars Technica history of the Internet, part 1 — arstechnica.com/…
- A history of the Internet, part 2: The high-tech gold rush begins — arstechnica.com/…
- A history of the Internet, part 3: The rise of the user — arstechnica.com/…
- I join the story about ¼ way through Part 2 in the age of Netscape Navigator & Internet Explorer 3 🙂
Legend
When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.
| Emoji | Meaning |
|---|---|
| 🎧 | A link to audio content, probably a podcast. |
| ❗ | A call to action. |
| flag | The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country. |
| 📊 | A link to graphical content, probably a chart, graph, or diagram. |
| 🧯 | A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂 |
| 💵 | A link to an article behind a paywall. |
| 📌 | A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future. |
| 🎩 | A tip of the hat to thank a member of the community for bringing the story to our attention. |
| 🎦 | A link to video content. |