Zack Whittaker

iPhone and iPad users still running iOS 18, update today, as Apple just back-ported a fix for a zero-day bug targeting devices running "versions of iOS before iOS 27."

NEW: US lawmakers say the Trump administration is breaking the law by withholding a secret court opinion about the surveillance of Americans, even as it presses Congress to renew America’s most sweeping surveillance program.

Just installed my 26-year-old copy of Word on a new desktop. I will never pay subscription fees for software I already paid for. I will go live in a shack in the woods first.

I wrote about how two bugs in PHP almost burned the internet to the ground, why it broadly hasn't (yet), but how the PHP-ocalypse is likely to be the first in a wave of aging internet tech that *will* inevitably break — it's a matter of time. Bypass for ad-blockers: web.archive.org/web/20261026...

I filed a FOIA with the FBI earlier this year for all records from Jan 1, 2026 onwards (limited for responsiveness) relating to the Silent ransomware gang, which allegedly sent people to victims' offices to gain physical access to their systems. No records beyond its IC3 flash in May, some withheld.

ICANN testing tech to let law enforcement access non-public WHOIS info “Once it devises a mechanism to allow requests, other groups within ICANN dedicated to policy will work out acceptable use and related issues.” via @ssharwood.bsky.social & @theregister.com (h/t @zackwhittaker.com )

I'm not sure what else I can say about today's this.weekinsecurity.com newsletter except to say, it's the "everything is on fire" edition.

The real vulnpocalypse was the slop we read along the way.

I'm not sure what else I can say about today's this.weekinsecurity.com newsletter except to say, it's the "everything is on fire" edition.

This week was, to put it mildly, a cybersecurity clusterfuck. Every Sunday, I separate all the news from the noise in my free newsletter this.weekinsecurity.com, and this week is no exception. All of the stories you need to know, plus a reader-submitted cyber-cat for fun. 🐈‍⬛ Sign up (or RSS) today!

When one of you legends runs into Cliff can you please ask him my burning question of how he feels about having his wiki talk entirely about forensics and not astronomy?

This week was, to put it mildly, a cybersecurity clusterfuck. Every Sunday, I separate all the news from the noise in my free newsletter this.weekinsecurity.com, and this week is no exception. All of the stories you need to know, plus a reader-submitted cyber-cat for fun. 🐈‍⬛ Sign up (or RSS) today!

Anyway I think Cybersecurity Awareness Month actually worked this year.

Quest Diagnostics says "personal information and patient records" were stolen during a data breach of its lab testing systems. Quest has a security incident page on its website, but it contains "noindex" code, which hides the page from search results. 🤦‍♂️ Bypass for ad-blockers: archive.is/kWKZE

New Blog! 🇬🇧 UK Cybercrime Journal: Teenage Online Extremism Cases in 2026 - Scattered Spider Sentenced for TfL Hack - TheCom Sextortionist Sentenced - Teen Convicted of Cybersecurity Provisioning for Al-Qaeda - Man Caught Sharing Islamist Terror Videos blog.bushidotoken.net/2026/09/uk-c...

Blog is live now, I welcome feedback, would love to know if this is of genuine interest to people. Fascinated me to get an insight into FBI institutional knowledge of hackers in 1987 and that they were looking to build proper profiles on teen computer delinquents. realhackhistory.org/2026/10/22/f...

Railway, a vibe-coding platform for hosting apps and websites, was hacked and customer environment variables (think passwords, API keys, and other sensitive secrets for logging into cloud services and databases) were stolen *and* decrypted. Bypass for ad-blockers: web.archive.org/web/20261022...

The Trump administration is weaponizing the U.S. government's economic sanctions powers — typically reserved for international criminals, hackers, and terrorists — to target its critics and political opponents, such as crimes investigators, and now a web host, forcing it to shut down.

*makes loud chicken noises in Will Scharf's direction*

Medical testing giant Quest Diagnostics said it's been hit by a cyberattack & has paused its Quanum LSM system that some of its customers use for placing tests & looking up results. In an SEC filing, the company said it believes hackers "accessed certain patient records." www.sec.gov/ix?doc=/Arch...

New: We found cops who kept using Flock to spy on women after they left the force. One used it for five years after retirement, tracking his wife during a custody battle. Another ran searches while he was suspended (and later fired) after killing a 15-year-old boy. Free to read: wapo.st/3UEwWU7

People who are sanctioned, like ICC judges investigating war crimes, get cut off from the U.S. — online accounts close, domain names vanish, and credit cards stop working. Now with the forced shut down of a web host, there's never a better time (or a better reason) to rely less on American tech.

A woman went to jail because someone used her stolen SSN/personal details to open a Cash App account. That scammer then committed fraud using that account, so she's been blamed for it. The woman can't get details from Cash App bc they say the account isn't hers www.404media.co/amanda-smith...

If you are able to contact folks at local schools, governments, nonprofits, and other services to warn them about the PHP vulnerabilities, please consider doing so. These locations often do not have dedicated security staff and almost certainly have PHP assets exposed.

a critical PHP vulnerability may take websites down today. Admins are preparing for emergency patches, with estimates suggesting that more than 1.3 million internet-connected hosts are likely affected www.theverge.com/tech/1015257...

Me: all excited to cozy up in my new reading nook after a trip to IKEA yesterday. Lucy: U wot, m8?

Love this @masnick.com yarn on the importance of digital ownership (to the highest degree possible!) — and not relying on Zuckerberg or any other tech giant to keep your best interests at heart. www.techdirt.com/2026/10/20/a...

The Saudi government offering to pay Abdulrahman Alfozan's bond did not sit well with a San Francisco court www.wired.com/story/openai...

This is how local governments and police departments are able to secure Flock contracts without notifying the public. @kevincollier.bsky.social found govt bids are *just* under the threshold for council votes, which oftentimes probably would have voted them down: www.nbcnews.com/tech/securit...

krebsonsecurity.com/2026/10/feds... New research from Brian Krebs which indicates that the recently arrested 54-year-old cybersecurity executive was deeply in the loop on recent ShinyHunters attacks... and his former business partner also had odd ties to threat actors...

Kept hearing from Flock prostesters that they didn't understand how cameras went up with their tax dollars and without their knowledge. I read dozens of contracts and found 55 times the company testified their product is unique (despite the other ALPR cameras on the market) to avoid bidding process.

A very busy this.weekinsecurity.com: Europe hit by refrigerator mass-hacks; an OpenAI employe was caught allegedly planting a hidden microphone; a "nightmare scenario" with zero-click spyware; India's incoming privacy law; researchers jailbreak a fully-patched iPhone 👀... and a brand new cyber-cat.

“Some good news from MapQuest, the decades-old online mapping software that let you print out driving directions before GPS navigation was a thing. The latest update to the mobile app will now let you identify nearby license plate readers and other video surveillance cameras…”

I have no way to prove it, but refrigerator mass hacks was on my imaginary bingo card for this year. (can we go back to the refrigerators that worked perfectly fine without a connection to the internet?) @zackwhittaker.com‘s newsletter is great. Subscribe, enjoy the info and the cats.

A really good overview of submarine cable resilience and security from Geoff Huston for APNIC. h/t to the amazing @zackwhittaker.com who I swear always buries one story in his newsletter just for me 😂.

Cloud security is increasingly "how do we store our data safely when missiles are hitting our datacenter?"

For the first time this year, data centers have become targets for bombardment in global conflicts. Our analysis shows at least 27 such attacks in 2026. Experts worry the targeting of data centers opens a Pandora's box that cannot be closed. www.nbcnews.com/tech/securit...

A very busy this.weekinsecurity.com: Europe hit by refrigerator mass-hacks; an OpenAI employe was caught allegedly planting a hidden microphone; a "nightmare scenario" with zero-click spyware; India's incoming privacy law; researchers jailbreak a fully-patched iPhone 👀... and a brand new cyber-cat.

SCOOP: 'Tommy' from the now-viral exchange with Abdul El-Sayed is Thomas Teepell, a former staffer for Republican Senator Josh Hawley with close ties to Christian Nationalist Sean Feucht. He's the son of a former Bobby Jindal staffer whose consultant work was instrumental in getting Hawley elected.