Apple has fixed a hole in how iPhones and Macs open files. Apple says someone may already have used it against a few chosen people.

The rest of the day

14 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   Hackers take Dodo Pizza customer data

   Dodo Pizza, a Russian chain with about 1,500 restaurants in 28 countries, said on Monday that hackers got into its systems. [7] Customers' names, addresses, email addresses, phone numbers, birth dates and order details may have been taken. [7] The company says it does not store card details, so no payment data was taken. [7] It has told Roskomnadzor, Russia's communications regulator. [7] A group calling itself DataSuckers claims it took records on 68 million customers and offers to sell them for about $100,000. [7]

   Dodo's own countnone given

   vsvs

   The hackers' claim68 million

   Why it matters — Dodo has not said how many customers were affected, and nobody has checked the hackers' number. [7] Earlier this month the same group claimed an attack on Tez Tour, one of Russia's major tour companies. [7]

2. 03

   Russian spies switch to mass emails

   Microsoft says Star Blizzard, a hacking group tied to Russia's FSB security service, has added large mailings to its carefully aimed emails. [12] Since January it has run at least 13 big campaigns, each of tens to hundreds of emails, mostly against governments, research groups and non-profits. [12] The emails invite people to exclusive events, or warn of tax audits, payment notices and fines. [12] Microsoft counts more than 100 organisations affected, mostly in the US and UK. [12]

   Why it matters — The group aimed first at Ukraine, then at banks and governments that support Ukraine. [12] Its new method needs only one click from the victim before it installs a hidden program that lets it listen in. [12]

3. 04

   Hackers copy Arizona court records

   The Arizona Supreme Court said on Friday that hackers broke into the state's court system and copied personal details of many people in Arizona. [13] Chief Justice Ann Scott Timmer said the courts are trying to warn as many of those people as possible. [13] A court spokesperson said it was not a ransomware attack, and no ransom had been demanded as of Monday. [13] No group has claimed the break-in. [13]

   Why it matters — The court will not say what was taken or how, because it says details could affect the FBI's investigation. [13] Courts hold large amounts of personal and police data, and court systems in at least ten other US states have been hit in recent years. [13]

4. 05

   Fake ChatGPT helpers spread spy software

   Criminals built custom versions of ChatGPT, which anyone can publish on OpenAI's own website, to lead people to harmful software, the security firm Huntress says. [8][9] Victims searched Google for ChatGPT and clicked a paid advert at the top of the results. [9] The fake assistant, called Plus 5.6, sent them to a page with a fake security check that told them to run a command. [8][9] That installed a program that lets the attacker control the computer and use its camera and microphone. [8]

   Why it matters — OpenAI removed the first fake by 25 September, and a second one turned up two days later. [8] Because the fake sits on ChatGPT.com, the address looks trustworthy. [8] OpenAI already plans to retire custom versions of ChatGPT on 11 December. [8]

5. 06

   OnePlus phones left open for months

   A researcher, Rasmus Moorats, showed that a harmful app can take full control of a OnePlus 15 phone without asking for any permissions. [17] He joined two flaws in software OnePlus adds to its phones, and says an older OnePlus 12 Pro is affected too. [17] OnePlus confirmed the flaws in May and told him it alone decides when a flaw is made public. [17] He published on 24 September anyway, when there was still no fix. [17]

   Why it matters — OnePlus warned that publishing without its permission could bring legal action, and says phones from OPPO, which use the same software, share the problem. [17] There is no sign of a real attack yet, and the harmful app has to be installed on the phone first. [17]

6. 07

   Two former airmen jailed for email fraud

   Two former US Air Force members were sentenced on Friday for stealing from businesses by email while stationed at Dover Air Force Base in Delaware. [10][11] Chijioke Timothy Odimegwu, 25, got 111 months in prison and Harafat Mogaji, 26, got 78 months. [11] They stole email logins with fake messages, then watched for talk of payments. [10] At the right moment they sent new bank details that looked like they came from a business partner. [10][11]

   Why it matters — One payment they diverted was more than $1.68 million from a victim in Iowa City, and another was $720,000 from a victim in Ohio. [11] They were ordered to repay $366,617 and $995,680, and ran the scheme for more than two years before the FBI and local police caught them. [10][11]

7. 08

   An AI program breaks into a Dutch security group

   DIVD, a Dutch non-profit whose volunteers scan the internet for known flaws and warn the owners, says it has been hacked for the first time in seven years. [14] An attacker used a flaw in one of its systems, then let an AI program work inside the network on its own. [14] DIVD says the program chose each next step by itself and was loud and very messy. [14] It even got in the way of one of its own attacks. [14]

   Why it matters — The mess left enough evidence for DIVD to piece together what happened, and it has told the Dutch police and data-protection regulator. [14] It says the flaw was not in Citrix, and it will give more details on 1 October and warn others with the same flaw. [14]

8. 09

   Police read chats by linking a computer

   Germany's customs office has been linking police computers to suspects' WhatsApp and Signal accounts, the security writer Bruce Schneier noted on Tuesday. [16] Both apps let people add a laptop to their account, and new messages then arrive on the laptop too. [16] So officers can read the messages without breaking the scrambling that protects them on the way. [16] German reports say they get in by holding the phone, or by catching the one-time approval code through a fake message or a phone tap. [16]

   Why it matters — Schneier says the apps should clearly show every linked device, so a person could notice one they never added. [16]

9. 10

   Man charged over a $16m crypto scam

   US prosecutors have charged Trung Nguyen Van, a 37-year-old from Vietnam, with laundering money from a so-called pig butchering scam. [18] In these scams a stranger met online builds trust, then talks the victim into a fake investment. [18] One victim sent about $16 million in cryptocurrency between June and August 2024, believing it went to a platform called Triangle. [18] Van was arrested on 24 September at Los Angeles airport, before a flight to Taiwan. [18]

   One victim$16m

   Van's wallets, 2018-24$53m

   The wider scheme$125m

   Why it matters — Prosecutors say his wallets took in more than $53 million from fraud aimed at Americans between 2018 and 2024. [18] The FBI says investment scams cost Americans $8.6 billion in 2025. [18]

10. 11

    Signal backups now on every device

    Signal, the private messaging app, has released version 8.30, which brings scrambled backups to iPhones and computers as well as Android phones. [15] A backup lets people get their chats back on a new device if they lose their phone. [15] Backups can be kept by Signal, free for up to 45 days of photos and videos, or kept on the user's own device with no size limit. [15] Both kinds are scrambled and need a recovery key to open. [15]

    Kept by Signal, free45 days of media

    vsvs

    Kept on your deviceno size limit

    Why it matters — One recovery key opens every past backup it made, and BleepingComputer says attackers have already made that key a target. [15] Messages set to vanish within 24 hours are left out of backups. [15]

11. 12

    New chip trick leaks a Linux password

    Researchers at VU Amsterdam and Scuola Superiore Sant'Anna have found a new version of Spectre, a known kind of attack on computer processors. [19] Processors predict which instructions come next and briefly run them early. [19] The new attack makes a processor predict from leftovers of old code, so it briefly runs the wrong instructions and exposes data. [19] On Intel processors running Linux, it recovered the scrambled form of the main administrator password in three to five minutes on average. [19]

    Why it matters — The researchers told the affected companies, and fixes are already in the Linux kernel, the core of the system. [19] A scrambled password still has to be cracked, which depends on how strong the password is. [19]

12. 13

    An example web address turns into a trap

    Coding guides often use third-party.com as a made-up example address, the way others use example.com, BleepingComputer reported on 23 September. [20] Unlike example.com, which is reserved for guides, third-party.com is an ordinary domain whose owner controls what it shows. [20] It began showing a fake Cloudflare security check that tells Windows users to paste in and run a command. [20]

    Why it matters — The security firm Manifold found it while reading public guides for AI tools that name the address. [20] The server that delivered the next stage no longer worked when BleepingComputer tested it. [20]

13. 14

    Cloudflare plans its own web certificates

    Cloudflare, which gave millions of websites free encryption in 2014, said on Tuesday it plans to become a certificate authority. [21] A certificate authority issues the digital certificates that let a website scramble its traffic and prove who it is. [21] Cloudflare says it has agreed to buy trusted root keys from GlobalSign, an existing authority, so older devices will accept its certificates. [21] It will also issue a new kind of certificate meant to hold up against future quantum computers. [21]

    Why it matters — Cloudflare says trust on the web rests on a few big issuers, which is a risk if one of them fails. [21] It has applied to be accepted by Google's Chrome, Apple, Microsoft and Mozilla, which each decide what their software trusts. [21]

14. 15

    Finnair trains pilots for daily GPS jamming

    The airline Finnair has changed how it trains pilots because GPS signals are disrupted every day over the Baltic Sea, its chief executive told Reuters last Thursday. [22] Finnair stopped flying over Russia and Belarus, so more of its routes now cross the Baltic, a hotspot for this kind of electronic interference. [22] Poland said in August that satellite signals on its Baltic coast were disrupted on most summer days. [22] In 2024 Finnair paused flights to Tartu in Estonia for about a month. [22]

    Why it matters — Modern planes have several backup ways to find their position, so they keep flying safely. [22] The chief executive, Turkka Kuusisto, says airlines from outside Europe are surprised that it is a daily problem. [22]