Mobile carriers can retain years of call and text metadata, exposing sensitive details about customers' relationships, locations, and daily routines if breached. Cape examines the privacy risks of long-term telecom data retention and how its mobile service reduces exposure by automatically deleting call records. [...]
Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators. Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. The extensions hijacked users’ default search settings and routed their searches through servers controlled by the operators before sending them to Yahoo or Bing. This gave the operators…
Google US
Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused mobile service helps defend against them. [...]
As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice. Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom identified four ways to check someone’s age that it considers “highly effective.” Here’s what those checks would involve: Photo ID matching: Comparing a live image of you with the…
This week, Axios reported that major US banks were detecting third-party AI agents operating inside customer accounts. In many cases, customers have given the agents their usernames and passwords so they could act on their behalf. This kind of access can violate a bank’s rules. Bianco Research president Jim Bianco raised the question during Unchained’s Bits + Bips livestream on October 26: “Are you protecting me, or are you protecting your own profits?” Bianco described traditional finance’s…
A reverse engineer claims that their Samsung smart TV has been collecting audio without their consent. The researcher, who calls themselves “log4j,” said in an X thread that their 2025 Samsung TV was delivering ads that seemed suspiciously relevant to them. Investigating, they claim to have found a package called “always on voice,” which uses the TV’s built-in microphone to collect sounds from the room. The software logged events such as dogs barking and babies crying, log4j said, adding that…
Samsung US
A recently disclosed flaw in Signal’s calling software could allow another participant to keep hearing you after you hang up. The vulnerability, tracked as CVE-2026-113380 (CVSS score 9.3 out of 10), affects RingRTC versions earlier than 2.72.0. RingRTC is the open-source library behind Signal’s voice and video calling functionality, providing calling components for its mobile and desktop applications. The flaw concerns how Signal’s calling library shuts down a call. It does not affect how it…
EPSS 0.01 CVSS 9.3 CVE-2026-113380 Signal US IT
As Android Central reports, users have received unexpected emails telling them their phone number has been verified for secondary Google accounts. Like me and many others, you may have one Google account for everyday use, another for work, and a third for things you would rather keep separate. But if you’re using an Android phone, those accounts may have something in common that you didn’t intend or even know about: your phone number. Google’s own documentation confirms that phone number…
Google US
Meta says it has resolved an issue after some Ray-Ban Meta owners reported that their glasses recorded conversations without the “Hey Meta” wake phrase. Users reported finding recordings and transcripts of conversations they did not knowingly save. Recording without anyone realizing raises privacy concerns for both the wearer and the people around them. The complaints surfaced on Reddit, where one owner described unexpected recordings occurring with three pairs of glasses. The owner said the…
Meta US
The Verge reports that Eiliko, a small AI robot companion made by Energize Lab, has serious security flaws that expose private conversations and let an attacker remotely change what the toy says. According to The Verge, researcher Sammy Azdoufal could access 13 million conversations and what appeared to be the entire active worldwide fleet of 68,000 robots. The publication reports that the US is the largest market, with more than 31,000 profiles belonging to children there. Azdoufal found…
Energize Lab US
OpenAI is facing separate legal challenges over how ChatGPT interacts with children. The Guardian reports that eight US states accuse the company of misleading parents about the chatbot’s safety and exposing vulnerable users to dangerous conversations. Separately, CNET reports that a mother suing on behalf of her two children alleges that OpenAI collected and used children’s sensitive personal information without valid parental consent. The cases raise serious questions about what happens when…
OpenAI US
Photos you take with your phone and some digital cameras can contain hidden information, including where they were taken. You can strip that data out before sharing a photo with someone, which would help to protect your location. But the image itself may still give you away. A company called Graylark says its Raven AI tool can match an indoor photo to a specific property using visual clues alone. No GPS data or view out of the window required. We’ve seen this company before. Its tool, GeoSpy,…
Norway’s privacy regulator Datatilsynet has fined advertising technology company Xandr 92 million Norwegian kroner, approximately $9.6 million, for unlawfully processing and sharing sensitive information about Grindr users. While the decision concerns users in Norway, the data-sharing practices were not confined to Norwegian users. BleepingComputer reports that information about Grindr users in other countries was also exposed through the advertising system. Between July 2018 and April 2020,…
An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register (CPR). The weak password is remarkable, but the failure to spot millions of unusual searches made the breach worse. The CPR administration states it identified a serious security incident. By abusing a Danish company’s authorized access to the CPR system, unauthorized people gained access to the names, addresses, CPR numbers, and other information belonging to around 8.8 million…
Amazon’s “About You” page reveals what it thinks it knows about you—and you can’t simply switch it off. Dexerto reports that one shopper discovered her profile included the observation: “has flat buttocks” She suggested this might relate to a previous purchase of “butt scrunch leggings.” Whatever the connection, buying clothes doesn’t mean you expect the retailer to start describing your body. What is Amazon’s About You? About You is a page where customers can review and edit the personal…
If you thought that having companies trawling your social media, browsing history, and TV habits for behavioral clues was bad, sit tight. Meta is just getting started. Its Muse personal AI agent is taking surveillance to the next level. TIME magazine analyzed the software’s internal instructions and found that it maintains constantly updated dossiers on users and the people they know. Meta released Muse last month, positioning it as a digital assistant that can handle different parts of your…
Meta US
Automated license plate readers (ALPRs) are cameras that photograph passing vehicles, read their number plates, and typically log the time, location, and vehicle details. On their own, the images might be used to find a stolen car or locate a suspect. But lately there have been a lot of concerns raised about the way they are used. The main worry is caused by what happens when many cameras feed data into a shared, searchable network: it can create a detailed record of where ordinary people…
Microsoft US
Using an AI chatbot, assistant, or browser to speed up your work is tempting, but doing it without your employer’s knowledge can put sensitive data at risk. You’re swamped, so you paste a long email thread into a free chatbot and ask for a summary. It works, it saves an hour, and nobody notices. But the thread may contain customer details or confidential plans you’ve just shared with an outside service. If your employer hasn’t approved that tool or how you’re using it, that’s shadow AI. The…
US
A study testing 21 cars from 19 brands and 30 companion apps found connections to advertising and tracking companies, and evidence that some apps shared sensitive personal data. Modern cars can unlock remotely, route around traffic, stream entertainment, summon roadside help, and cool or heat the cabin before you get in. But those conveniences come with a privacy cost that drivers may struggle to see and are unable to refuse. We’ve covered cars and privacy a few times before, especially after…
A Facebook Marketplace buyer arrived at a seller’s apartment to collect a keyboard. The seller wasn’t home and didn’t know anyone was coming. Meta’s AI assistant Muse had handled the conversation, shared his address, and arranged the visit without telling him. We often write about AI misalignment and how to use AI agents and browsers safely. That can sound theoretical, but this is an example of the real-world risk when an agent is allowed to act on someone’s behalf. Muse is Meta’s semi…
Meta US
AI agents are now running on employee devices, cloud platforms, and across developer workflows. Security teams need to see those agents, govern what they can reach, and contain them when something goes wrong. This month’s updates help you discover and control local AI agents, extend Zero Trust to agent traffic, and strengthen the security operations center (SOC) foundations that AI-era operations depend on. Here’s what’s new: Extend protection and support investigations with Microsoft Defender…
Microsoft US
Flock Safety’s cameras are automated license plate readers (ALPRs) designed to help police find stolen cars or wanted suspects. A joint investigation by 404 Media and WIRED, based on data recovered from a physically removed Flock camera, found that its on-device software explicitly detects people as well as vehicles, bicycles, and license plates. Separately, Washington DC’s police union says the Metropolitan Police Department used Flock data to track officers under Internal Affairs…
The tech journalists at 404 Media learned that OpenAI is hiring hundreds of contractors to read and review a massive stream of real users’ ChatGPT prompts and responses. “Project Lily” is reportedly a program that asks contractors to score or critique ChatGPT’s answers to improve the chatbot’s quality and behavior. The fact that prompts may sometimes be reviewed by humans should not come as a complete surprise. AI companies also monitor conversations for safety reasons. Anthropic, for example,…
Grindr has reportedly agreed to pay £26 million (around $35 million) to settle a UK privacy lawsuit alleging that it shared sensitive user data, including some users’ HIV status, with advertisers. The claim was brought by London law firm Austen Hays on behalf of roughly 12,000 UK Grindr users. It alleges that the dating app breached privacy and data-protection laws during a period ending in early 2020. The claimants allege that Grindr shared personal and highly sensitive information with…
Grindr US
“Free” movies and TV could cost you your privacy, bandwidth, and control of your home network. We’ve warned about illegal streaming and modded Amazon Fire TV Sticks in the past. Now, researchers have found that certain SuperBox devices and apps could quietly enroll a household connection into a proxy network, allowing third parties to route traffic through it. An earlier report identified CyberFlix TV, available through SuperBox’s custom app store, as containing Popanet proxy functionality that…
SuperBox US
A new dark web platform called Nexus claimed to be selling 153 million driver’s license scans and millions of other identity and medical cards. According to reports, the collection included more than 153 million driver’s licenses, 10 million ID cards, 3 million travel documents, and 579,000 medical cards, including marijuana dispensary cards. The trove of driver’s license scans reported by KrebsOnSecurity is a sharp reminder that identity verification is not a harmless box-ticking exercise. The…
IDScan.net US