The cryptocurrency wallet maker Ledge has confirmed that some devices sold through the reseller CryptoBilis were implanted with a spy chip that would steal users' seed phrase and drain their wallets.
Hackers at the Pwn2Own Ireland hacking competition were able to chain together zero-day exploits and already known vulnerabilities to exploit the Google Pixel 10, the Samsung Galaxy S26, and OpenAI's Codex.
Google announced in a blog post a new feature to keep local AI isolated from the rest of your device, based around virtual machines and hardware isolation, which they're calling "AI seal."
This week saw a rather surprising hack from UK fashion retailer ASOS, as well as multiple breaches from organizations in Denmark.
This October 8th, nonprofits of every size are asking their communities to make their DAF gifts count today, and we hope Privacy Guides is on your list.
Attackers were able to compromise three top-level domain registries and mint TLS certificates for Google and other large organizations, allowing them to impersonate legitimate domains.
Apple released a blog post on their Developer website announcing that they plan on tightening security around the "Full Disk Access" permission on macOS in light of AI agents misusing it and putting user data at risk.
The US government has once again been breached, as well as a Japanese car-sharing app and a vibe-coding app platform.
According to 404 Media, a company that makes devices to hack phones claims they can bypass iOS's automatic reboot feature and allow police to more easily access data on iPhones.
A document by Netzpolitik reveals that German police are sneakily abusing the linked devices feature in messengers to access the messages of suspects using encrypted messengers like Signal without needing to crack the encryption.
The Pentagon sent out letters to affected individuals explaining that their Defense Manpower Data Center (DMDC) was accessed by "unauthorized users," exposing the highly sensitive personal data of millions of military personnel.
Researchers at the Graz University of Technology Austria demonstrated a new attack that can track you via file change events "on all systems," allowing for various data leaks.
Meta announced in a blog post that its notorious smart glasses will soon use its Private Processing to protect your data as it's being processed in the cloud.
Researchers have demonstrated a way to break RSA encryption faster than before, allowing them to break (admittedly already deprecated) 1024-bit RSA in just five months on classical computers in an academic CPU cluster.
Tor has released updates for "all components" of Tor that include severe vulnerabilities and bugs from the "LLM report firehose" and recommends "upgrading as soon as possible."
This week's big story is a breach of the FBI exposing all employees and applicants.
Discord is rolling out a revised version of their age verification system, promising privacy improvements over the previous implementation.
The notorious hacker group ShinyHunters claims they breached the FBI's systems on Monday night, accessing the personal data of "almost all FBI agents/employees."
macOS security researcher Patrick Wardle discovered a flaw in Meta's new Muse AI assistant that an attacker can use to turn it into "the ultimate backdoor."
Revolut made headlines this week, but they weren't the only organization breached (as usual).
The UK is rolling out passkeys across GOV.UK One Login to provide more than 23 million people with a more secure way to log in.