Category
Recent security & privacy coverage, selected for a quick and source-forward read.
Google says Videostrong embedded a backdoor in 1.3 million Android devices, selling access to affiliates for ad fraud, data exfiltration, and residential proxy networks. In November 2026, Google banned the Shenzhen company from certified Android hardware and software.
Anthropic added two system-prompt sentences to Claude Code on Opus 5.5, steering it away from recreating games owned by others under its existing IP policy. Original games and projects using users’ own designs and assets remain supported, but Anthropic has disclosed no detection details.
Germany’s BSI says Bundestag members and other public figures received Apple spyware alerts in November 2026, urging recipients to assume their devices may be compromised. Zero-click exploits can steal messages, location data and other sensitive information.
The settlement avoids Snap’s first trial in a broader wave of youth-safety litigation, where CEO Evan Spiegel was expected to testify. The two plaintiffs had already settled similar claims with Meta, TikTok and YouTube; Snap announced its agreement in November 2026.
The NYT and other publishers allege Brave sold scraped-site access to Anthropic, Perplexity, Mistral, xAI and Cohere for AI training and queries. Filed in November 2026, the lawsuits also target Brave’s advertised paywall-blocking feature.
Danfoss refrigerators were remotely switched to defrost, spoiling food at stores in Belgium, Ireland, Luxembourg and Sweden in November 2026. Ahold Delhaize and Colruyt confirmed the attacks; Claroty warned in August that the units were vulnerable.
Plymouth’s police chief physically disconnected Flock cameras after the company ignored a September 2026 cancellation for over a month. In Dayton, Flock reconnected two cameras despite the city’s explicit order not to complete the work order.
A tampered Claude Code extension reached up to 5,000 Cursor developer machines during an 11-hour window on Oct. 30, 2026, before removal. A flaw largely blocked its backdoor, and Anthropic said its systems were not compromised.
A shared “policy token” in robots.txt could let publishers opt out of AI scraping across participating companies at once. Anthropic supports it now; OpenAI plans rollout in coming months, while Google and Microsoft target 2027.
A hardcoded password in Applebee’s Android app exposed unrestricted access to customer records, including names, emails, phone numbers, birth dates and IP addresses. Dine Brands patched the flaw after researcher Robert Wiggins’ discovery; it said no unauthorized access was found.
OTW says AO3’s user database does not appear to have been stolen, but urges all users to change their passwords after the October 29 security incident. The 18-million-work platform could return in a degraded state before the potential four-week outage ends.
Reddit says Google still crawls its content at the same rate, but AI Mode and AI Overviews contributed to a drop of over 1 million search referrals per week in October 2026. CEO Steve Huffman says Reddit is building a direct, daily destination.
After a routine overnight maintenance failure, AO3 says restoration may take about two weeks—or up to four—and hopes to return sooner in a degraded state. OTW has not disclosed the cause; speculation about PHP flaws is unlikely because AO3 uses Ruby on Rails.
Reddit says search referrals fell by more than 1 million per week in October, prompting a logged-in pivot to limit AI scraping and pursue paid data-licensing deals. Q3 revenue rose 53% to $895 million, while daily active users reached 130.3 million.
Available on Hugging Face and via API, ML4 lets businesses and governments run a trillion-parameter model on-premises for cybersecurity without relying on a third-party provider. Mistral claims comparable performance to GLM-5.3 using 47% fewer tokens.
Mistral says its finalized, freely available Le Chonk matches or beats DeepSeek and Z.ai on coding and cybersecurity after training on harder problems. The open-weight model has 1 trillion parameters and targets enterprise and government cyber defense.
Bluesky says it blocked links to the Icepick archive because it exposes personal contact information without authorization, including names, emails, and phone numbers. The records cover more than 41,000 DHS employees and contractors.
Upwind chose independence after Datadog offered to acquire it at the same $3.8B valuation, without a premium. The San Francisco cloud-security startup raised $400M in an October 2026 Series C led by Bessemer and projects about $90M ARR by year-end.