I wrote some words for about how the Trump administration is using sanctions to target and silence its critics and political opponents, such as members of the International Criminal Court, and more recently forcing an Italian web host popular with left-wing activists. With one unilateral decision, U.S. sanctions can cut off anyone overseas — from their online accounts, credit cards, and banks — with devastating effect.
You used to rely on MapQuest for printing out driving directions before GPS navigation was a thing. Now it's helping to fight mass surveillance. https://this.weekinsecurity.com/mapquest-now-lets-you-locate-nearby-surveillance-cameras-like-flock/
NEW: Governments are abusing online ads to infect people's phones and computers with zero-click spyware, per Citizen Lab. Al Jazeera had ~45 devices hacked this way, simply by visiting a website that displayed a malicious ad. Researchers say it's tip of the iceberg.
Ad-block bypass: https://archive.is/Smm3d
Flock confirms it's cutting staff, as the company faces mounting backlash over its surveillance technology. When asked by TechCrunch, a Flock spokesperson wouldn't say if chief executive Garrett Langley took a pay cut as part of the workforce reduction.
By me: https://techcrunch.com/2026/10/09/surveillance-company-flock-cuts-staff-as-privacy-backlash-grows/
Bypass for ad-blockers: https://archive.is/epjKf
New, by me: The Pentagon is notifying millions of current and former U.S. military servicemembers and staff that hackers stole their *unencrypted* personal information during a months-long data breach. The agency that had the breach also handles ID and login/credential access to U.S. military systems and bases.
Bypass for ad-blockers: https://web.archive.org/web/20260930193237/https://techcrunch.com/2026/09/30/hackers-stole-millions-of-us-military-personnel-records-during-months-long-data-breach/
In my latest newsletter: FBI declared cyber incident over agents' data breach; North Korea scores a new record-breaking crypto theft; Denmark spy agency on Russia's hybrid war; Kiteworks urges customers to shut down servers fearing hacking threat; at least two suspected NetScaler bugs exploited in the wild; and more. Plus: Hacker Drama between ShinyHunters and Clop, and much more.
Also: a very cute reader cyber-cat. 🐈⬛
Read online: https://this.weekinsecurity.com/this-week-in-security-september-27-2026-edition/
Sign up/RSS: https://this.weekinsecurity.com
The theft of the FBI agents/applicants' personal data is quickly becoming a major counterintelligence headache. I'm also aghast at how close to the internet this data was held. Call me old fashioned but some data shouldn't be stored in the cloud at all. https://www.reuters.com/world/shinyhunters-hackers-say-they-stole-psychiatric-medical-records-fbi-staff-2026-09-25/
RE: https://mastodon.social/@zackwhittaker/117326077966880240
There is a time and a place to be nice. This is not one of them, and this is a reminder to pieces of shit like Ben Halpern and his hapless team of fuckwits to stop using and profiting off of other people's photos and bylines without obtaining their permission.
Special shout-out to area shitbag Ben Halpern (ben@forem.com) and his team of arseholes who published fake AI-generated slop attached to my name on their site. I did not (nor would I) write this AI slop shit, and would encourage all to be mindful for fake bylines on shitty websites like this one.
![a screenshot of a author bio page on Dev[.]to, showing my face and byline, followed by an AI-generated slop article that I did not write or give my permission for my byline to be used.](https://files.mastodon.social/media_attachments/files/117/326/072/903/980/881/original/a42a35730696d57a.png)
Also, shout-out to my cat Theo, who did absolutely nothing to help me spellcheck my latest edition of ~ this week in security ~ so forgive me for more typos than usual. https://this.weekinsecurity.com/this-week-in-security-september-20-2026-edition/
In my latest weekly cyber newsletter: Flock cameras are old and flawed, Coast Guard and FBI board hacked oil tankers, ClickFix hacks went viral, U.S. confirms it launched space weapons into orbit, a Google researcher infiltrated a hacking group, and why a digital fly brain had a great week. Plus, a brand new reader-submitted cyber-cat. 🐈
Read online: https://this.weekinsecurity.com/this-week-in-security-september-20-2026-edition/
Sign up/RSS/subscribe: https://this.weekinsecurity.com
RE: https://infosec.exchange/@mttaggart/117275354970016643
This is a *really* good read.
For my blog and newsletter ~ this week in security ~ I wrote about Apple's launch event this week announcing its upcoming "always-listening" features for Apple Watch, and the risks of normalizing surveillance tech. There's also a big catch: There is no clear way to opt-out of other people's use of these features.
Sign up for my weekly cyber roundup newsletter: https://this.weekinsecurity.com
Watching this Apple event tout how iPhones will soon be able to record ambient audio/conversations and transcribe "high level notes" for you. It's billed as private and end-to-end encrypted, but I think the bigger harm is the normalization of always-listening devices. It's creepy and not normal.
RE: https://infosec.exchange/@da_667/117205006167048585
Today's tech landscape is basically "the floor is lava" for trying to avoid fascism.
By enabling the new Xfinity Wi-Fi motion sensing tech, Comcast says it may disclose information generated from a customer’s use of the feature to outside parties under a broad array of reasons — and Comcast also says it doesn’t have to tell you.
Anthropic said its investigation was consistent with its "blameless postmortem culture." Bullshit! There's absolutely blame here; both OpenAI and Anthropic published blog posts literally detailing their crimes. If companies can't keep their own dangerous tech safe, they should face the consequences.
I'd be interested to see if any of the companies that were hacked by OpenAI or Anthropic will sue them. Someone has to take responsibility for this, and the blame is almost entirely on the leaders of these AI companies. Alternatively, hacking is just legal now until a court says otherwise? What a fucking mess.
https://www.wired.com/story/anthropic-says-claude-hacked-real-systems-during-cybersecurity-tests/
Proofpoint says out of ~950 companies surveyed, over one-third of companies that paid a hacker’s ransom were hit with a second extortion demand.
(Bypass for ad-blockers: https://web.archive.org/web/20260722153047/https://techcrunch.com/2026/07/22/if-you-pay-a-hackers-ransom-chances-are-that-theyll-come-back-for-more/)
In this week's ~ this week in security ~
Spy vans are coming to U.S. police departments, how a London crew pulled off a brazen datacenter theft, Iran exploited phone bugs to track U.S. troops, Finnish therapy hacker wanted, and most fitness trackers lack basic security features. Also: WordPress bugs under active attack, and why librarians are helping people avoid AI. Plus: A brand new cyber-cat. 🐈
Read online: https://this.weekinsecurity.com/this-week-in-security-july-19-2026-edition/
Sign up/RSS: https://this.weekinsecurity.com