In march 2024, a microsoft engineer named andres freund noticed something odd, postgresql was running slightly slower than it should. ssh logins were taking a fraction of a second longer than expected. What he found when he dug in: someone had spent two years infiltrating the open source project that maintains xz utils, a compression library so foundational it ships inside almost every linux distribution on the planet and they had hidden a backdoor in it. the attacker operated under the name "jia tan." starting in 2021, jia tan began contributing to the xz project, fixing bugs, submitting patches, building a reputation. patient, methodical, consistently helpful, over roughly two years, jia tan gained the trust of the project's maintainer, a solo developer who had been showing signs of burnout. Other accounts suspected to be part of the same operation applied social pressure, complaining the maintainer was too slow and suggesting jia tan should get more responsibility. Eventually jia tan was given commit access, ability to push code directly into the project. the backdoor was embedded in the build process not in the main source code where reviewers would look, but in test files and scripts that only activated under specific conditions: a debian or red hat linux system, built for release, with systemd running. it was designed to intercept ssh authentication, the protocol used to remotely access servers and allow anyone with a specific private key to bypass authentication entirely. the target was effectively the infrastructure of the internet. ssh is how engineers access servers. the affected linux distributions power a significant fraction of the world's web servers, cloud infrastructure, and enterprise systems. if the backdoor had shipped in stable releases and propagated normally, the attacker or whoever they were working for would have had a quietly exploitable path into an enormous number of systems globally. Freund reported it. the package was pulled. the versions containing the backdoor, xz 5.6.0 and 5.6.1 were caught before they reached stable linux releases at scale.

You log into your bank. the SMS code arrives. you copy it. you switch to the banking app. you paste it. done. in the time between you copying that code and pasting it, every app that comes to the foreground can read your clipboard. not apps running in the background. apps that become active including ones you swipe past, or that pop up a notification you tap. That's how clipboards work. they're a shared resource across every app on the device. One-time codes are the obvious ones at risk, you copy an OTP, switch apps once, the code is gone from your mind but still sitting in the clipboard. any app that opens in that window reads it. Not just OTPs. addresses, card numbers, recovery codes, passwords you copied from a password manager before pasting all of it lives in the clipboard until you copy something else or clear it. For iPhone recent iOS versions show a banner notification when an app reads your clipboard without you tapping paste. If TikTok, a game, or a shopping app triggers that banner after you copied something sensitive that app just read whatever was there. Apple added this specifically because apps were doing it silently at scale. Android is more fragmented and exposed. There are two specific permissions worth auditing: Notification access, apps with this permission can read the full text of your notifications, including OTP codes that arrive as SMS or push notifications. Go to settings → apps → special app access → notification access. Anything in there that shouldn't be reading your messages is a problem. "draw over other apps" (display over other apps): this permission lets an app place a visible layer on top of whatever you're doing. it's used legitimately by things like screen recorders and assistant apps. it's also a known path for overlay attacks: a fake UI drawn over your real banking app, capturing your password and taps before they reach the real screen.

October 2026. Black October they called it. Hackers defrosted 200 French supermarkets. Then Reuters reported six US military bases lost their freezers too. Back in August. PHP dropped two critical RCEs. The Dutch Parliament went offline. Finland's government went offline. The NSA told everyone to patch or unplug. A developer put Bitcoin on a vulnerable PHP server. Someone took it. Sony lost 2.58 million customer records. Quest Diagnostics got hit. Half of US hospitals use them. One stolen password exposed millions of California students. Meta lost source code through a stolen employee credential. 850 stolen GitHub tokens planted 13,500 malicious branches. Hackers used Claude and Grok against 400 Latin American banks. AI agents got inside Anthropic's internal systems in 12 hours. Trump Mobile got breached and said "We have no team to handle this." Then on the 29th, $2.5 billion walked out of a Binance hot wallet in one transaction. The wallet that started it was funded through Tornado Cash. Tether and Circle froze billions within hours. Almost none of it was sophisticated. An old server. A stolen password. A stolen token. Firmware nobody updated. Happy Halloween.

"we are aware of reports of a potential security issue and we are actively investigating." that's binance's statement right now. Oonchain data shows: somewhere between $3.3 billion and $5.8 billion moved out of binance hot wallets on ethereum, arbitrum, and avalanche. tether froze $1.567 billion in USDT. circle froze more. Binance hasn't confirmed a hack. The blockchain has.

This is a developing story. numbers are unconfirmed i'm writing from what's verified so far. Onchain analysts flagged large suspicious outflows from binance hot wallets earlier today, wallets on ethereum, arbitrum, and avalanche. blockaid is investigating approximately $3.3 billion in suspicious transfers. coinbase's conor grogan put the figure higher, up to $5.8 billion, based on separate onchain tracing. hot wallets are exchange-held wallets connected to the internet, used for day-to-day withdrawals. They're the most exposed part of any exchange's infrastructure. Tether CEO Paolo Ardoino confirmed tether froze more than $1.567 billion USDT linked to a wallet that received the suspicious outflows, circle froze additional USDC combined, $1.79 billion in stablecoins was frozen based on onchain data. aave reportedly paused its lending markets to prevent the suspected attacker from using the platform, no official statement from aave yet. market reaction: BNB dropped more than 5.5%. CZ, binance's former CEO who stepped down as part of a 2023 guilty plea posted saying he no longer manages binance but expects user funds to be fully covered. We still haven't known what actually happened, the full scale of losses, who is behind it or whether user funds are at risk. This is North Korea's Lazarus group type shii just like the bybit case.

Discord is making public server messages indexable on google starting november. if you run a server: server settings → opt channels out. do it now, before november. If you’re a user: settings → privacy & safety → data and privacy → turn off message indexing. The default is on. the opt-out is on you. things worth thinking about before november: any public server you’ve ever posted in. anything you said assuming discord was “just discord.” Moderators can opt their channels out. users can opt themselves out. Neither of those things will happen automatically.

When you copy a link from X, the URL looks something like this: the part you actually need: everything after the ? is metadata for X's systems, not for the post to load. what those parameters do: s= is a device and share method code. s=46 means iPhone app, copy link. s=20 is roughly web copy link. s=19 is Android. X uses this to measure where sharing happens and which surfaces drive traffic. a= (or t= in older versions) is a session-bound attribution token. it ties that specific share event back to your account or session. when someone clicks the link, X can attribute the click to the share, which feeds virality tracking, abuse detection, and internal analytics. The person receiving the link sees just the post, they don't see your username or account from the URL itself. X sees that you shared it, from which device, in which session, and how many people clicked it from your share. Delete everything from the ? onward before you paste.

GDPR was supposed to be the thing that protected Europeans from exactly this. EU governments just voted to let companies train AI on Europeans’ personal data, no consent required. They’re calling it “legitimate interest.” case by case. trust us. Max Schrems, who spent 15 years dragging companies to court over this exact framework, called it “digital expropriation.” he’s not wrong. Parliament still has to vote. so there’s still time to watch them also say yes.

On sunday, flock safety CEO garrett langley spoke at the International Association of Chiefs of Police (IACP) conference in orlando a private event, audio from that session leaked to 404 Media. what he said: the public backlash to flock's licence plate reader network is not real. it's anonymous bots. "it's anonymous bots, and so it is not real." his evidence: social media chatter dropped 50% after ukraine hit a russian data centre with a drone strike. he presented this as proof the criticism is foreign-bot-driven. 404 Media describes this as a theory that has already been disproven. he also said his wife advised him never to apologize. and that he would prefer to never do media again. for context a "deflock" community rally happened in norfolk, virginia on october 13. multiple communities have cancelled their flock contracts. cornell university terminated its contract and ordered cameras removed, there is active congressional attention on the company. flock has 335,000+ devices logging vehicle movements across the US, with cross-agency law enforcement access. the data came from flock's own systems an access token left open to anyone. the CEO's pitch to police chiefs was essentially: ignore the noise, it's not your constituents.

The EU Council, the body representing EU member state governments has approved a position that would let companies train AI on Europeans’ personal data without consent. It would make AI training a recognised “legitimate interest” under GDPR one of the legal bases companies can use to process personal data without asking for permission under the current framework, AI training on personal data generally requires consent or a clear, specific legal basis this proposal shifts that. what “legitimate interest” means in practice: the company decides that its interest in using your data outweighs your interest in not having it used. The draft also proposes letting companies keep sensitive personal data that ends up in training sets “accidentally” if removing it would require “disproportionate effort.” with safeguards, but still. Who benefits: companies that already hold large amounts of European personal data which are mostly American and Chinese AI firms. Max Schrems’s framing: “digital expropriation.” Europeans’ data being taken and handed to companies without the people it belongs to having a say. where it stands: the EU Council approved their position. the European Parliament must still agree. this is not law yet but the Council’s backing is a significant step.

google updated its privacy policy on october 16. your gmail, drive, and photos can now inform ad targeting, if you’ve connected those apps to google search or gemini. Many people have. How to disconnect: Google Account → Data & privacy → Connected Content apps → turn off Note: data already collected may still be in your Search history after you disconnect. Google hasn’t clarified what that clears. A privacy promise with a new condition attached is a different promise.

on october 16, google quietly updated its privacy policy to create a new exception to one of its oldest promises. the old rule: gmail, drive, and google photos content would never be used to target ads. google held that line for years. the logic was that your inbox, your documents, your personal photos are too private to touch. the new rule: same thing, unless you’ve connected those apps to other google services. and here’s where it gets interesting. google has spent the last two years aggressively pushing you to do exactly that. Connect your gmail to AI Mode in Search. connect your drive to Gemini the pitch was “more useful answers.” you can find a hotel reservation in your inbox from search. what changed october 16 is that the same connection that makes AI features smarter now also opens that data pool to ad personalization. the email about your upcoming surgery, the shared document about your salary, the photos from your kid’s school once you’ve connected those apps, google search can now process that content to “personalize content, including ads.”

France's data protection authority (CNIL) has fined Shein €150 million for dropping advertising cookies on users' devices before they made any choice. four violations confirmed: The site placed advertising cookies automatically on arrival, before the consent banner was even interacted with. The banner itself was designed to obscure the choice, one version had no information about what the cookies were for the second pop-up had only an Accept button with No reject option. The second-level information didn't even identify which third parties were placing cookies. and when users did reject or withdraw consent, it didn't matter new cookies kept being placed and existing ones kept being read. 12 million people visit Shein's site in France every month. The company changed its website during the proceedings, which is why CNIL didn't issue a compliance order on top of the fine the violations were technically remediated but the fine stands. €150 million for a cookie banner designed to make consent meaningless. this is the gap between "we have a cookie banner" and "we actually respect consent." the banner existed. it just didn't work the way consent law requires — and for long enough to reach every person who visited the site during that period. the GDPR framework calls this a dark pattern. a consent mechanism engineered to collect regardless of what the user chooses. Shein's isn't the first. it won't be the last. but €150M is a number that tends to get other legal teams reading their own cookie implementations a little more carefully. Sources: CNIL official decision

When you reject tracking while shopping online, you expect that decision to shape what happens next. France’s CNIL identified a gap between choice and behaviour in its September 2025 SHEIN decision, which described cookies placed before consent and problems with refusal and withdrawal. The regulator imposed a €150 million fine over those practices. The case gives product teams a reason to examine the journey after a choice, including later pages and connected features. A clearly labelled button is only useful when the behaviour behind it respects the decision it offers. Explore how Prynoid tests privacy claims against application behaviour, with findings reviewed by experts and their limits explained. Source:

A startup co-founded by Gavin Kliger, former Pentagon chief data officer,staffers just broke into Anthropic’s internal systems in under 12 hours. AI agents. third-party software. employee salaries, job offers, meeting transcripts, Slack messages about advanced models. Anthropic says the scope was “limited.” Cathedral says they kept access “to the absolute minimum.” the startup is valued at $1.4 billion. three federal agencies are already their clients. Kliger was involved in the Pentagon’s dispute with Anthropic over Claude’s military use restrictions specifically Anthropic’s refusal to allow fully autonomous lethal operations and mass domestic surveillance. On September 25, a federal appeals court ruled the Pentagon could exclude Anthropic from its supply chain, three federal agencies are already contracted with Cathedral. a DOGE-connected startup, valued at $1.4B, with federal agency contracts, run by someone directly involved in the Pentagon’s clash with Anthropic ran a security test against Anthropic and published findings suggesting access to sensitive internal data.