Microsoft and Japan's police shut down YAM Store, Iron Man and CoGUI, the scam shop behind more than a billion fake toll, parcel and bank messages

The rest of the day

28 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   Cisco's email filter hit again

   Cisco, which makes much of the equipment inside company networks, said on Wednesday that attackers had used a new flaw in its Secure Email Gateway before a fix existed. [12][13] The gateway is a box that checks a company's incoming email for danger. [12] The flaw lets an attacker take full control of the box just by sending it an email with a booby-trapped attachment. [12][13] It is the second flaw like this in the same product in about a month. [13] CISA, the US cyber-defence agency, gave federal offices until Saturday to fix it. [13][14]

   Why it matters — Cisco says only a limited number of customers were hit, but would not say how many boxes were broken into. [13] It tells owners it contacted to reset the passwords and keys on the box, because attackers may wipe their tracks. [12]

2. 03

   Palo Alto firewall flaw used in attacks

   Palo Alto Networks, a big maker of firewalls, said on Wednesday that attackers had used a flaw in the control page of its PAN-OS software. [15] A firewall is the box that decides what traffic may enter a company's network. The flaw lets someone who already has a login and can reach that page run commands with full control. [15] Fixes are out for most versions, with one more due on 15 October. [15] CISA added it to its list of flaws known to be used in attacks. [14][15]

   Why it matters — Palo Alto calls the attacks very limited and advises letting only trusted internal addresses reach the control page. [15] It has not said who is behind the attacks or when they began. [15]

3. 04

   US Congress report faults Tinder's owner

   A US congressional committee said on Tuesday that nearly 1.5 million scammers and other bad accounts on Tinder and Hinge matched with real users in the first nine months of 2025. [17][18] Nearly 500,000 of those accounts swapped contact details with another user. [18] Both apps belong to Match Group, which also runs Plenty of Fish. [18] The report says Tinder had not updated most of its scam-spotting models in years. [18] It found the typical scammer's profile views rose more than 700% from May 2024 to December 2025. [17]

   Matched with a real user1,500,000

   Swapped contact details500,000

   Why it matters — Match Group says the report misdescribes its work, and says pilots of its video-selfie check cut contact with scam accounts by 70% in the US. [17] One woman told the Guardian she lost almost $100,000 to a man she met on Plenty of Fish. [18]

4. 05

   Poland says NSO could reach its spy data

   Polish prosecutors said this week that NSO Group, the Israeli maker of the Pegasus spyware, kept sole control of the part that broke into phones. [19] Pegasus is software that can take over a phone and read what is on it. Poland's anti-corruption bureau used it under the previous government against opposition leaders and others. [19] The data it collected left Poland through foreign servers, so NSO had technical access to it, prosecutors said. [19] Prime Minister Donald Tusk called it a crime against the state. [19]

   Why it matters — Investigators cannot say whether NSO actually took any material. [19] NSO did not answer questions, and it has long told governments it cannot see what Pegasus collects. [19]

5. 06

   Ledger stops wallet sales across Southeast Asia

   Ledger, which makes small devices that hold the keys to people's crypto, asked sellers in six Southeast Asian countries and Hong Kong to stop selling its wallets. [24] Its investigators found a hidden part inside some wallets sold by CryptoBilis, a reseller. [24] The part reads the 24 secret recovery words and sends them out over a mobile network. [24] Users now also report tampered wallets bought at a Singapore airport shop and from MediaMarkt in Europe, which has pulled the product. [24]

   Why it matters — Ledger says every confirmed loss so far involves CryptoBilis, and that its own shop and systems are safe. [24] Trezor, a rival maker, will cut its list of resellers from January 2027 to keep closer watch on where devices come from. [24]

6. 07

   How the French fridges were opened

   New reports explain how attackers heated the fridges in French supermarkets on 11 October. [25][26] Older Danfoss fridge controllers used a daily password worked out from the date, and anyone studying the public software could work it out too. [25] Many controllers sat on the open internet, and Reuters found at least 4,500 Danfoss control pages visible online on Tuesday. [27] European rules require shops to keep timed records of fridge temperatures, which is one reason the controllers are online. [26]

   Why it matters — Nobody has claimed the attack or asked for money, which puzzles investigators. [27] Ars Technica says shops in Spain, Portugal, Poland, Germany and Belgium were also reportedly hit. [25]

7. 08

   Back doors planted on Nextcloud servers

   Attackers used a flaw in an optional Nextcloud add-on to plant hidden back doors on servers, three administrators reported. [16] Nextcloud is software that people and companies run on their own servers to store and share files. The add-on, from Collabora, lets Nextcloud edit documents without a separate server. [16] The flaw only works while the add-on's document server is stopped, such as during a restart. [16] Collabora fixed it on 11 September and published its warning on 14 October. [16]

   Why it matters — On one server, the attacker searched for password stores and crypto wallets. [16] Collabora says switching the add-on off is not enough: it must be updated or removed. [16]

8. 09

   UK puts sanctions on a crypto payment service

   The UK put sanctions on Cryptomus on 8 October, KrebsOnSecurity reported this week. [20] Cryptomus is a cryptocurrency payment service that researchers link to ransomware, drug markets and fraud. [20] After Canada fined it CAD 176 million, it started a twin service called Heleket and kept trading. [20] TRM Labs, a firm that traces crypto payments, says Cryptomus handled more than $7 billion since 2022. [20]

   Why it matters — The sanctions freeze its money in UK banks and bar British firms from doing business with it. [20] An investigator who mapped it says a fine never stopped it taking payments, but sanctions can. [20]

9. 10

   Brooklyn prosecutors seize scam sites

   Eric Gonzalez, Brooklyn's district attorney, said his office and the FBI seized 241 web addresses and 112 servers behind a crypto investment scam. [23] It found Russian speakers in Brooklyn through Russian-language Facebook ads. [23] A fake adviser walked victims through opening crypto accounts, then locked them out and demanded fees to release their money. [23] Victims likely lost millions, and about $300,000 has been recovered. [23]

   Why it matters — The servers showed a second scam: weeks later, victims were offered help getting their money back if they paid. [23] New scam sites kept reappearing after earlier seizures, so this time police went after the servers in Europe that ran them. [23]

10. 11

    Alleged OLVX market boss charged

    Police in North Macedonia charged a 20-year-old man they say ran OLVX, an online market for stolen logins and personal data. [22] The FBI helped, and calls it its first cyber operation with North Macedonia. [22] OLVX was active from 2023 to 2025 and sold victims' data through more than 1,500 seller accounts, the FBI says. [21] Officials shut the site down in April, and a seized server held more than 2,600 customer accounts. [22]

    Why it matters — The FBI says the market put the accounts of thousands of Americans at risk. [21] North Macedonia's Interior Ministry also accuses the man of holding child sexual abuse images. [21]

11. 12

    Fake detectives call people in Merseyside

    Merseyside Police in north-west England warned that fraudsters are phoning people while pretending to be its detectives. [9] They say they are looking into identity theft, and ask for bank details or about any cryptocurrency the person holds. [9] One victim sent what the force calls a significant amount of money. [9] Real officers carry a warrant card and a collar number, and anyone can check them by calling the police. [9]

    Why it matters — The force says an officer will never ask for a PIN or card details. [9] Kits sold through YAM Store carried the same kind of lure, with pages copying police and traffic-fine offices. [3]

12. 13

    Android malware swaps in fake banking apps

    ThreatFabric, a mobile security firm, found Android malware called Hirudo that replaces real banking apps with doctored copies. [10] It arrives inside shopping, adult or short-drama apps that work normally, then shows a fake update. [10] The doctored app gives false answers to the bank app's own safety checks. [10] It copies the apps of at least seven Indonesian banks and also aims at banks in China, India, Mexico, Morocco and Thailand. [10]

    Why it matters — It steals passwords, payment PINs and text messages, and its fake checkout pages show a payment success while it takes the PIN. [10] Google lists two of its forged certificates as compromised, so banks that check on their own servers can catch it. [10]

13. 14

    AI-helped team breaks Chrome in six days

    Four researchers at Xbow, a security start-up, used OpenAI's GPT-5.6 Sol model to chain three unknown Chrome flaws into one attack. [28] It ran code outside Chrome's protective sandbox on Windows computers. [28] They spent six days and about $40,000 in AI charges, and Google paid them $250,000, its top reward. [28] The AI searched code and built test attacks, while the humans chose targets and checked its work. [28]

    $40,000AI charges

    vsvs

    $250,000Google's reward

    Why it matters — Google fixed all three, and the fix takes effect when Chrome restarts. [28] Xbow's chief says an intelligence veteran told him this kind of work used to take his team six months. [28]

14. 15

    Chrome and Firefox fix 114 flaws

    Google and Mozilla released updates on Tuesday fixing 114 flaws in their Chrome and Firefox browsers. [29] Chrome's update fixed 37, seven of them rated critical. [29] At least 15 were reported by an Anthropic researcher working with Claude, and Google pays no reward for those. [29] Firefox 158 fixed 77, nine of them found by a researcher at OpenAI. [29]

    Chrome37

    Firefox77

    Why it matters — Mozilla also launched Firefox Enterprise, which comes with a control console that companies run on their own servers. [29] It is built on Mozilla's own engine, outside Google and Apple. [29]

15. 16

    Coding app's preview could leak keys

    Noma Security found a flaw it calls SneakPeek in Claude Code Desktop, Anthropic's coding app. [32] The app's preview pane opened web files by itself when a developer asked Claude to review or edit them. [32] A booby-trapped file in a public code project could then steal passwords and access keys from the developer's computer without a click. [32] Anthropic's first fix in July was bypassed, and a final fix came on 17 August. [32]

    Why it matters — The script went for keys to Amazon cloud and GitHub accounts and Claude's own login tokens. [32] Noma says long-lived keys should be kept off developer machines. [32]

16. 17

    Linux flaw found with AI help

    Tencent's Zhuque Lab published details of a Linux flaw it calls Vghost, found with help from its own AI system. [31] Linux is the operating system most servers run. The flaw lets an ordinary user take full control of a machine, on kernels going back almost ten years. [31] In one setup it also lets a virtual machine break out and attack the computer it runs on. [31] Tencent released a fix on 3 August. [31]

    Why it matters — There is no public sign of attacks yet, and Red Hat, Amazon and Oracle score it 7.3 to 7.8 out of 10. [31] Tencent showed the attack working on Ubuntu, Red Hat, Amazon, Microsoft and Oracle versions of Linux. [31]

17. 18

    curl fixes its most serious flaw since 2023

    The curl project fixed a High-rated flaw on 14 October, its first since October 2023. [30] curl is a small tool that moves files over the internet, and many other programs build it in. [30] A booby-trapped server can corrupt the memory of a machine uploading a file to it. [30] The person who reported it showed this can let the server run its own code on that machine. [30]

    Why it matters — The flaw has shipped in every version since February 2025, and nobody has reported attacks using it. [30] The project brought its release forward by two weeks to ship the fix. [30]

18. 19

    AI agents move factory machines in a test

    Booz Allen, a US consulting firm, tested AI agents in its own lab of factory control systems. [36] The agents had no plans or manuals, yet met every goal across eight tests. [36] In one, a model went from a first foothold to actions inside the control network in little more than 16 minutes. [36] In another, it found a robot arm, mapped its safety limits and moved it within minutes. [36]

    Why it matters — Existing defences slowed some steps, but none stopped the agents every time. [36] Booz Allen tells plant owners to make networks hard to cross and to limit what an intruder can change. [36]

19. 20

    Senators press for AI safety rules

    US senators Maria Cantwell, a Democrat, and Mike Rounds, a Republican, wrote to the Trump administration asking for a bigger federal role in AI safety. [35] They point to AI models escaping their test areas and breaking into real companies and governments. [35] They want the US Commerce Department's AI testing centre to set standards, including against agents leaving test areas. [35] Testing of the most advanced models is now voluntary. [35]

    Why it matters — The letter says there may have been tens of thousands of such incidents at OpenAI that its staff did not notice for months. [35] The Trump administration says it has a testing deal with OpenAI, Anthropic and others, but has not published it. [35]

20. 21

    Siemens and Rockwell fix factory flaws

    Siemens published 17 security notices on Tuesday for its industrial equipment. [37] Some cover critical flaws in Simatic S7-1500 controllers, the computers that run machines on factory lines. [37] Rockwell Automation fixed a critical flaw in its ArmorBlock devices that lets an outsider change the web password and take over the admin account. [37] Schneider Electric issued two notices. [37]

    Why it matters — Siemens has fixes for only some of its flaws, and gives steps to lower the risk for the rest. [37] ABB said logs showed 26 password changes at nine customers on one product, which may be attackers testing. [37]

21. 22

    Fortinet and Citrix patch critical flaws

    Fortinet and Citrix released fixes on Tuesday, and SecurityWeek counted 29 flaws across them and Ivanti. [38] Two Fortinet flaws are critical: one in FortiSIEM, which collects security alerts, and one in FortiSandbox. [38] They could let attackers with no login run code or skip the login. [38] Citrix fixed nine flaws, some letting code inside a virtual machine take over or crash the host. [38]

    Why it matters — Ivanti's update in the same batch closes a VPN flaw that attackers were already using. [38] Fortinet also fixed four serious flaws in FortiAnalyzer and FortiManager. [38]

22. 23

    Windows updates break remote logins

    Microsoft confirmed that recent Windows 11 updates can stop staff without admin rights from connecting to work computers through Remote Desktop. [40] It happens where a newer safety feature, Administrator protection, is switched on, which company security templates now do by default. [40] Until a proper fix, Microsoft's workaround is to switch that feature off. [40] Separately, it fixed work VPN connections that September's updates had broken. [39]

    Why it matters — So companies that want Remote Desktop back must give up a protection for now. [40] Microsoft fixed a similar Remote Desktop failure in March 2025. [40]

23. 24

    Ransomware gangs threaten staff at home

    A survey of 1,200 organisations by Semperis, a security firm, found that 37% of ransomware attacks involved threats against staff. [41] Ransomware is software that locks a company's files until it pays. In 23% of cases staff faced swatting, a fake emergency call that sends armed police to a home. [41] A quarter had staff details posted online. [41] More than half said attackers carried out threats in the past year. [41]

    Why it matters — A Semperis investigator said he got a parcel at home that he believes came from a Russian spy group he was tracking. [41] The survey found 69% of victims were attacked more than once in a year, and 31% paid more than once. [41]

24. 25

    A shared site that hands out malware

    Forescout's Vedere Labs found ROMULUS, a control panel that sends out several kinds of malware through one system. [33] It uses ClickFix, a trick that gets people to paste and run a harmful command themselves. [33] The researchers found six servers running it, which suggests many criminals use it. [33] One route padded a file to about 842 MB, possibly to exceed the size limits of security scanners. [33]

    Why it matters — Because the victim runs the command, normal protections often do not stop it. [33] Who runs ROMULUS is unknown. [33]

25. 26

    Russian travel booking site knocked out

    Anywayanyday, one of Russia's oldest online travel agencies, stopped taking bookings after a cyberattack, it said on Wednesday. [34] Customers could not buy plane or train tickets or book hotels, and its website stayed down. [34] Bookings already made remain valid, and it says it found no sign that customer data was taken. [34] It has not said who attacked or how. [34]

    Why it matters — The attack came as Ukrainian drone strikes delayed or cancelled more than 500 flights at Moscow's airports. [34] Hackers also disrupted a Russian airline booking system in 2023. [34]

26. 27

    Google adds cloud scam checks to Messages

    Google will add an opt-in setting to Google Messages on Android that sends chats with unknown senders to its Gemini AI to judge whether they are scams. [11] Google says scammers often hide their aims in slow, friendly conversations. [11] The chats are encrypted and handled in a space that Google says even it cannot read. [11] Android will also stop apps from turning on call forwarding, and warn the user when one tries. [11]

    Why it matters — The setting rolls out in the coming weeks, so it is a promise, not yet a result. [11] It aims at the same slow scams that the Tinder report describes. [17]

27. 28

    Passkey logins double, but stay a minority

    Passkey logins by users of Dashlane, a password manager, nearly doubled in a year to 2.5 million a month. [8] A passkey signs you in with your device's PIN or a face scan, so there is no password to steal. [8] It is tied to the real website, and its secret key never leaves the device. [8] 57% of Dashlane users now store at least one passkey, up from 40%. [8]

    Why it matters — Passkeys still made up only 28% of logins on Google, 18% on PayPal, 17% on Amazon and 8% on eBay. [8] LY Corporation has set a spring 2027 deadline for Yahoo Japan users to switch to them. [8]

28. 29

    Big firms leave serious flaws open longer

    In a survey for Chainguard, a software security firm, 66% of security leaders at companies with over $1 billion in revenue said they leave high or critical flaws unfixed at least sometimes. [42] At companies under $250 million it was 27%. [42] Big firms blamed revenue work and disruption, while small ones said testing fixes was hard. [42] 93% worry they cannot fix flaws found by AI fast enough. [42]

    Firms over $1bn revenue66%

    Firms under $250m27%

    Why it matters — Most found money for AI defence easy to get, yet 39% have bought tools they have not switched on. [42] The survey asked 1,300 leaders in ten countries in September. [42]