A phishing campaign is targeting Signal users with fake messages posing as the platform’s security support, attempting to hijack accounts.

Day 2 of Pwn2Own Ireland 2025 featured standout compromises of the Samsung Galaxy S25 and the Philips Hue Bridge.

Meta has introduced new anti-scam tools for WhatsApp and Messenger aimed at shielding users from sophisticated online fraud attempts.

Apple's iOS 26 update introduces a change that erases a vital forensic artifact used to detect infections from Pegasus and Predator spyware.

A massive trove of stolen credentials, including 183 million unique email and password pairs, has been added to Have I Been Pwned (HIBP).

OpenAI has announced ChatGPT Atlas, a new AI-native web browser built around ChatGPT, designed to act as an intelligent assistant.

Day One of Pwn2Own Ireland 2025 had security researchers uncovering 34 zero-day vulnerabilities across a range of smart devices.

Vidar infostealer released version 2.0, now featuring a complete rewrite in C, multithreading support, and Chrome memory protection bypass.

Google is sunsetting a large portion of its Privacy Sandbox initiative, just two years after it began rolling it out on Chrome and Android.

Mozilla has confirmed it will continue to provide full Firefox support on the Windows 10 operating system "for the foreseeable future."

An outage in Amazon Web Services is currently disrupting a wide range of services, including Amazon Alexa, Fortnite, and Perplexity.

A US federal judge has permanently banned Israeli spyware vendor NSO Group from accessing or targeting Meta's WhatsApp platform.

Meta is discontinuing its standalone Messenger apps for macOS and Windows, with full deprecation scheduled for December 15, 2025.

The Electronic Frontier Foundation (EFF) has filed a federal lawsuit to stop what they call an unconstitutional online surveillance program.

Nintendo acknowledged unauthorized modifications to external servers after claims of a cyberattack by the Crimson Collective hacking group.

The Dutchhave imposed a €2.7 million fine on Experian for unlawfully processing personal data of individuals in the country without consent.

The Tor Project has confirmed that it is removing all of Firefox's artificial intelligence integrations from its browser.

Sotheby’s has disclosed a data breach from unauthorized access to its internal environment, which exposed clients' financial information.

Prosper, a major US-based peer-to-peer lending platform, has suffered a data breach affecting 17.6 million individuals.

F5 has confirmed a cybersecurity breach by a nation-state actor who maintained persistent access to internal systems for an extended period.

Mango is notifying customers of a data breach affecting personal information processed by one of its third-party marketing providers.

A phishing campaign impersonating LastPass attempts to steal user credentials by claiming a breach and urging an app update.

Mozilla has announced the early development of Firefox VPN, a free, browser-integrated virtual private network designed to secure browsing.

The UK’s ICO fined Capita a total of £14M for security failures that led to a data breach in 2023, exposing the personal data of 6.6 million.

Microsoft’s October 2025 Patch Tuesday for Windows 11 addresses 175 bugs, including two zero-day elevation-of-privilege (EoP) flaws.

Dashlane and Yubico introduce passwordless, phishing-resistant login to Dashlane's credential vaults through FIDO2-based YubiKeys.

A serious firmware security flaw has been discovered affecting around 200,000 Framework laptops, allowing UEFI Secure Boot bypass.

New Pixnapping attack allows malicious Android apps to covertly capture Signal messages, 2FA codes, emails, and financial information.

The Austrian DPA ruled that Microsoft illegally tracked students via its Microsoft 365 Education suite, violating multiple GDPR provisions.

The Scattered Lapsus$ Hunters threat group has published the first tranche of stolen Salesforce client data on their dark web site.

SimonMed Imaging says a Medusa ransomware attack earlier this year exposed the sensitive personal data of 1.2 million patients.

Apple is doubling its maximum payout to an industry-record $2 million, with potential bonuses pushing total rewards beyond $5 million.

Authorities have seized the latest BreachForums domain operated by the cybercrime group ShinyHunters for extorting Salesforce victims.

Trend Micro uncovered a fast-evolving botnet campaign dubbed RondoDox, which targets 56 vulnerabilities across more than 30 vendors.

Starting January 1, 2026, Apple will implement new age verification protocols for App Store users in Texas in response to state law SB2420.

Discord has released an updated statement clarifying the the recent security breach exposed government IDs for approximately 70,000 users.

ZDI has publicly disclosed 13 unpatched vulnerabilities in Ivanti Endpoint Manager, including 12 RCE flaws and one local privilege escalation.

Microsoft will eliminate the option of local user accounts during Windows 11 setup, mandating internet access and an account moving forward.

Starting October 14, Mozilla will begin rolling out a redesigned Firefox profile management system that maintains a fully separate data silo.

Surfshark announced the deployment of 100 Gbps servers, marking a significant upgrade from the VPN industry’s prevailing 10 Gbps standard.

The Tor Project has released Arti 1.6.0, introducing new features aimed at improving privacy and resilience against side-channel attacks.

A phishing campaign targeting a Malwarebytes employee used a fake data breach alert from 1Password in an attempt to steal vault credentials.

Signal warned that it will exit the European Union if the proposed “Chat Control” regulation mandating client-side scanning is adopted.

A novel and practical side-channel attack, dubbed Mic-E-Mouse, uses everyday optical mouse sensors to recover intelligible human speech.

A new bug in Unity Runtime allows attackers to execute arbitrary code on systems running Unity-built apps across Android, Windows, and macOS.

The Clop ransomware gang has launched a new wave of mass exploitation attacks targeting Oracle E-Business Suite (EBS).

Discord has disclosed a data breach involving a 3rd-party customer service provider, resulting in the exposure of support-related user data.

Renault UK warns customers of a third-party data breach exposing personal and vehicle details, though no financial data was compromised.

Scattered LAPSUS$ Hunters have published a dedicated online portal where they published data samples from recent Salesforce breaches.

A flaw in Comet browser allows attackers to exfiltrate emails, calendar data, and other sensitive user data using a single malicious URL.