Toronto Crime Stoppers stops taking tips after 1.5 million anonymous tips from across Canada leak, about half of them with personal details

The rest of the day

20 more stories on this beat.

Each with its own sources. None of these is a link to the story above.

1. 02

   Capcom says 11.7 million accounts exposed

   Capcom, the Japanese maker of Resident Evil and Street Fighter, says hackers broke into CAPCOM ID, the shared account its players use for its websites and some online games. [2] They took more than 11.7 million email addresses, with each account's creation date, last login time and internet address. [2] For 43 accounts they also got birth dates and nicknames, and for 196 they changed the password to lock owners out. [2][3] Capcom found the break-in on 19 October and told Japan's privacy regulator and police on 21 October. [2]

   11.7mEmail addresses taken

   vsvs

   196Passwords changed

   Why it matters — Capcom says no card details or other passwords were taken. [2] It warns members to be wary of unexpected emails that ask for more information or carry links and attachments. [2]

2. 03

   UK counts 32 government services offline

   Baroness Lloyd, a UK technology minister, told the House of Lords on Thursday that 32 government services were unavailable and four partly so. [4] They were switched off while fixes for PHP2Shell, the two flaws in the PHP web language, went in. [4] Britain's cyber agency, the NCSC, sent 50,000 warnings and says it sees no sign of a successful break-in. [4][5] Many German government sites were back online on Thursday, but some hospitals and universities were still disrupted. [6]

   Unavailable32

   Partly unavailable4

   Why it matters — The cost is landing on ordinary users: a garage owner in Chepstow, Wales, told the BBC he has had to write vehicle test records on paper since Wednesday. [5] Experts told the BBC and DW that the full effect, and the full clean-up, could take months. [5][6]

3. 04

   Security firms find PHP inside their own products

   Palo Alto Networks says the PHP flaws affect its PAN-OS firewall software, rates the risk high, and promises updates. [7] Sophos, a security company, took an old licensing website of its own offline on 21 October because it ran a flawed PHP version. [7] Cisco's Talos researchers estimate that about half of all PHP systems will never get the fix. [7] VulnCheck says it has built a working attack that defeats a key built-in protection, and has shared it only with paying customers. [8]

   Why it matters — PHP sits hidden inside firewalls, website control panels and cloud services, so many owners cannot fix it until each maker ships an update. [7] Red Hat rates the flaws 8.1 out of 10, below the 9.8 in the US government's database, saying attacks are hard in practice. [7]

4. 05

   Railway tells users to change every stored key

   Railway, a cloud service with about 4.8 million users who run apps on it, says an intruder reached the system that holds customers' stored settings. [9] For some customers the intruder may have read the decrypted contents, which can include passwords and keys for other services. [9][10] Railway paused deployments, cancelled its own access keys and told every user to replace theirs. [9][10] It says the attack was part of a wave aimed at companies that run AI models. [10]

   Why it matters — One researcher says attackers emptied cryptocurrency wallets whose keys were stored on Railway, at least two hours before the public notice. [10] Free and Hobby customers were still waiting for builds to restart on Thursday. [9]

5. 06

   UAE-led sweep arrests 960 over online fraud

   The United Arab Emirates' interior ministry says an operation it led with police from 30 countries arrested more than 960 people. [11] Operation Confrontation Ghost ran from 1 July to 30 September and targeted AI-made scams, money fraud and sextortion, where criminals threaten to share intimate images. [11] It blocked 4,126 bank accounts and shut 570 social media accounts. [11] The UAE ministry says the operation exposed more than $39 billion in criminal money. [11]

   Why it matters — Interpol and companies including Meta and TikTok took part, which is how one country's police can reach scam networks that cross borders. [11] The $39 billion is the UAE interior ministry's figure, and the report does not say how much of it was seized. [11]

6. 07

   eMudhra stops selling website certificates

   eMudhra, the Indian company whose website-certificate keys turned out to be tiny guessable numbers, says it will stop selling website certificates worldwide. [12][13] Browsers stopped trusting eight of its certificates this week after a researcher found one key was simply the number 4. [12][14] Its chairman, V. Srinivasan, blamed rising compliance costs and free rivals, and said the business was about 1% of revenue. [13][15] eMudhra says it will move customers to other issuers free of charge. [15]

   Why it matters — eMudhra says none of the eight was used to issue certificates for websites, and no data was taken. [15] India's IT ministry is investigating, but it has also accused some social media accounts of fear-mongering. [12]

7. 08

   Arista's network control software attacked again

   Arista Networks says attackers are using a new flaw in VeloCloud Orchestrator, the web tool companies use to run their networks across many offices. [16][17] Anyone with even a read-only login can give themselves top control of it. [17] It is the third flaw in the tool that Arista has reported being used in attacks since late July. [17] Arista has fixed the versions it hosts itself and released updates for companies that run their own. [16][17]

   Why it matters — Arista has not said when the attacks began, who was hit, or what the attackers did next. [17] Earlier flaws in the same tool could also reach the network boxes it controls in each office. [17]

8. 09

   GitLab fixes a top-danger flaw 12 years old

   GitLab, a service where companies store and build their software, fixed a flaw rated 10 out of 10 on Wednesday. [19] It could let someone with no login run their own code on a company's own GitLab server. [18][19] The bug sits in the part that reads search patterns in settings files, and it reaches back to GitLab 7.0 from 2014. [18][19] Shadowserver, a group that watches the internet, counts more than 2,700 such servers online. [18]

   Why it matters — GitLab servers often hold source code and the keys to a company's live systems. [19] No attacks are known yet, and GitLab's own online service is already fixed. [18][19]

9. 10

   Cyberattack shuts South Carolina capital's services

   Columbia, South Carolina's capital city of about 150,000 people, says a cyberattack has shut down several city systems. [20] They include MyColaSC, the website residents use to pay utility bills and report potholes. [20] The state's police agency, SLED, is leading the inquiry. [20] The city says police, fire, 911 and water services are still working. [20]

   Why it matters — The city did not answer questions about whether it faces ransomware, an attack that locks files for a payment. [20] Cities and counties in at least eight other US states have lost services to attacks in the last three weeks, The Record reports. [20]

10. 11

    Robot toy maker stops storing owners' chats

    Energize Lab, which makes Eiliko, a small AI robot charm, has answered The Verge after its report on the toy's security holes. [21] The company says it has closed outside access to its systems and will stop storing owners' conversations. [21] It says it will delete the chats, profiles and pictures it already holds, and hire an outside security firm. [21] The Verge found photos and voice recordings still open online after that statement. [21]

    Why it matters — The toy told owners their secrets were safe with it, while outsiders could read every conversation on the company's servers. [21] Chats that are deleted cannot be taken in a later break-in.

11. 12

    UK says AI found 500 flaws for £13,000

    Kanishka Narayan, the UK's AI minister, says the UK government used advanced AI tools to check its own systems for security holes. [22] "We only spent £13,000 on it," he told the BBC, and they found 500 new flaws in important parts of the public sector. [22] He did not say which systems they were in or whether they are fixed. [22] He spoke before the PHP flaw, which was also found with AI's help, became public. [22]

    Why it matters — Attackers can use such tools too. [6] Germany's cyber agency says AI lets them turn each new fix into an attack within hours. [6]

12. 13

    Iranian spy group found using US servers

    Semperis, a security company, says a long-running Iranian spying group known as Prince of Persia is running the servers that control its malware from a US hosting company. [23] It is the first time in at least 12 years that an Iranian group has been found doing this, Semperis says. [23] The group's newest malware, called Tornado, can hide its traffic inside Telegram, a messaging app. [23] Its tools can steal files, take screenshots and record audio. [23]

    Why it matters — The group targets governments, companies and Iranians who oppose their government, in the US, Europe and the Middle East. [23] "This is the last place we expected to find Prince of Persia hiding," said Tomer Bar of Semperis. [23]

13. 14

    Dutch police arrest two over AI-voice card fraud

    Dutch police arrested two men, aged 23 and 25, over a fraud that took €380,000 from 170 people. [24] Victims were phoned and played recordings made with AI, with voices posing as their bank. [24] The recordings told them to install an app and hold their bank card against their phone. [24] The app sent the data from the card's contactless chip to the gang, who used it to take money from the victims' accounts. [24]

    Why it matters — The whole fraud rests on one step: getting the victim to hold their own card against their own phone during the call. [24]

14. 15

    Singapore warns of fake ads that install malware

    Singapore's police say scammers are running social media ads for activities for older people, water fitness classes and recycling schemes. [24] People who respond are told to download an Android app file to sign up. [24] They then get calls from people posing as officials or bank staff, who talk them into moving money. [24] Police count 62 cases since April and losses of S$989,000. [24]

    Why it matters — Police call it a malware scam: the app goes on the phone first, and the calls about 'compromised' accounts come after. [24]

15. 16

    US bill targets copying of AI models

    Two US House members, Republican Pat Harrigan and Democrat George Whitesides, have written a bill on 'distillation attacks'. [25] In one, a rival trains its own AI by asking another company's model huge numbers of questions and copying the answers. [25] The bill would have NIST, the US standards agency, write voluntary defences against such copying from Russia, China, Iran and North Korea. [25] It would also set up a group on using AI to defend critical services. [25]

    Why it matters — US AI companies and the US government accuse Chinese firms including DeepSeek of copying their models this way. [25] US AI firms themselves face lawsuits from media groups and artists who say their work was used to train models without pay. [25]

16. 17

    Cisco, Splunk and SolarWinds fix flaws

    Cisco fixed 34 flaws on Wednesday, including a critical one in Expressway, its video-calling gateway, that could let an attacker take full control. [26] Splunk, Cisco's data-search company, fixed critical access flaws in its Enterprise and SOAR products. [27] SolarWinds fixed a flaw that let low-level users see restricted information in its monitoring software. [27] Cisco says it knows of no attacks using its flaws. [26]

    Why it matters — Cisco says the Expressway flaw works only in certain setups, and the fix is in version X15.5.20. [26] SolarWinds also fixed a smaller flaw in Patch Manager, its tool for sending updates to company computers. [27]

17. 18

    1Password signs AI helpers in without the password

    1Password, a password manager, launched a feature that lets AI agents sign in to websites for a user. [28] When an agent reaches a login page, the user gets a notice on their own device and approves it. [28] 1Password then fills in the details itself, so the agent never sees the password. [28] It works with agents including ChatGPT, Claude and Meta's Muse, the company says. [28]

    Why it matters — 1Password's product chief said handing an agent a password and hoping for the best does not work. [28] Each approval happens on the user's own device, much like a second login check. [28]

18. 19

    Cloud mistakes cause most serious cloud incidents

    The SANS Institute, a security training body, surveyed 400 IT and security staff about their cloud systems. [29] It found 93% run live work in the cloud, but only 40% call their cloud security advanced. [29] Wrong settings caused 45% of the most serious incidents, almost twice the 22% caused by stolen logins. [29] About half of firms need more than a day to fix a known serious gap. [29]

    Wrong settings45%

    Stolen logins22%

    Why it matters — Most of these holes are left open by the owners themselves, not opened by attackers. [29] SANS says the gap persists even though 73% have a team just for cloud security. [29]

19. 20

    Industrial security start-up raises €7 million

    Indurex, an Amsterdam company that watches the control systems in factories and power plants, raised €7 million, about $7.8 million. [30] Contrarian Ventures led the round. [30] Indurex's software checks safety and control settings for changes that an operator should know about, not only network traffic. [30] Its first customers are energy companies and manufacturers. [30]

    Why it matters — The company says ordinary industrial security tools watch network traffic and miss changes to the safety settings themselves. [30] In a power plant or factory, a wrong safety setting can hurt people, not only data.

20. 21

    Judge rules DOGE got federal staff data illegally

    Denise Cote, a US federal judge, ruled that the Office of Personnel Management (OPM), the US government's personnel office, broke the Privacy Act of 1974 by giving DOGE its records. [31] Elon Musk set up DOGE, a cost-cutting team, when President Trump's second term began. [31] The records hold personal details of tens of millions of federal workers, job applicants and retirees. [31] Government lawyers had argued DOGE needed data including background checks, medical files and bank details. [31] The ruling came out on Tuesday 20 October and sets no remedy yet. [31]

    Why it matters — The judge found OPM gave no believable reason why DOGE needed the data, and that it ignored its own security rules. [31] OPM and the US Justice Department did not answer Fortune's requests for comment. [31]