Cyber, in brief

Apple released updates on Monday for iPhones, iPads and Macs to close a hole in CoreGraphics, the part of its software that draws pictures, text and documents. [1][2][5]

A booby-trapped file could let an attacker run their own program on the device, Apple says. [6][4]

Apple says the hole may have been used in an extremely sophisticated attack on specific people, on iPhones running versions older than iOS 27. [6][4]

iOS 27, Apple's newest iPhone system, and the newest Mac system do not appear to have the flaw, SecurityWeek reports. [2]

The fix is iOS 26.7.1 for the iPhone 11 and later, with matching updates for iPads and for Macs. [1][5]

Meta's product security team found the hole and reported it to Apple. [1][4]

Apple has not said who was attacked, how many people, who was behind it, or how the file reached them. [5][2]

SecurityWeek says a file like this could arrive in a web page, an email or a messaging app. [2] It adds that automatic previews might mean nobody has to tap it. [2]

Last year WhatsApp said a flaw in its own app was likely used together with an Apple flaw against fewer than 200 people. [2]

SecurityWeek asked Meta whether this attack also came through WhatsApp, and had no answer when it published. [2]

CISA, the US government's cyber-defence agency, added the hole to its list of flaws being used in attacks. [3]

CISA gave federal agencies three days to install the fix, and until 2 October to check whether they had already been broken into. [3]

Why it matters. Watch whether Apple or Meta says how the booby-trapped file reached its targets, and whether it came through a messaging app, as last year's WhatsApp case did. [2]

Dodo Pizza, a Russian chain with about 1,500 restaurants in 28 countries, said on Monday that hackers got into its systems. [7] Customers' names, addresses, email addresses, phone numbers, birth dates and order details may have been taken. [7] The company says it does not store card details, so no payment data was taken. [7] It has told Roskomnadzor, Russia's communications regulator. [7] A group calling itself DataSuckers claims it took records on 68 million customers and offers to sell them for about $100,000. [7]

Why it matters. Dodo has not said how many customers were affected, and nobody has checked the hackers' number. [7] Earlier this month the same group claimed an attack on Tez Tour, one of Russia's major tour companies. [7]

Microsoft says Star Blizzard, a hacking group tied to Russia's FSB security service, has added large mailings to its carefully aimed emails. [12] Since January it has run at least 13 big campaigns, each of tens to hundreds of emails, mostly against governments, research groups and non-profits. [12] The emails invite people to exclusive events, or warn of tax audits, payment notices and fines. [12] Microsoft counts more than 100 organisations affected, mostly in the US and UK. [12]

Why it matters. The group aimed first at Ukraine, then at banks and governments that support Ukraine. [12] Its new method needs only one click from the victim before it installs a hidden program that lets it listen in. [12]

The Arizona Supreme Court said on Friday that hackers broke into the state's court system and copied personal details of many people in Arizona. [13] Chief Justice Ann Scott Timmer said the courts are trying to warn as many of those people as possible. [13] A court spokesperson said it was not a ransomware attack, and no ransom had been demanded as of Monday. [13] No group has claimed the break-in. [13]

Why it matters. The court will not say what was taken or how, because it says details could affect the FBI's investigation. [13] Courts hold large amounts of personal and police data, and court systems in at least ten other US states have been hit in recent years. [13]

Criminals built custom versions of ChatGPT, which anyone can publish on OpenAI's own website, to lead people to harmful software, the security firm Huntress says. [8][9] Victims searched Google for ChatGPT and clicked a paid advert at the top of the results. [9] The fake assistant, called Plus 5.6, sent them to a page with a fake security check that told them to run a command. [8][9] That installed a program that lets the attacker control the computer and use its camera and microphone. [8]

Why it matters. OpenAI removed the first fake by 25 September, and a second one turned up two days later. [8] Because the fake sits on ChatGPT.com, the address looks trustworthy. [8] OpenAI already plans to retire custom versions of ChatGPT on 11 December. [8]

A researcher, Rasmus Moorats, showed that a harmful app can take full control of a OnePlus 15 phone without asking for any permissions. [17] He joined two flaws in software OnePlus adds to its phones, and says an older OnePlus 12 Pro is affected too. [17] OnePlus confirmed the flaws in May and told him it alone decides when a flaw is made public. [17] He published on 24 September anyway, when there was still no fix. [17]

Why it matters. OnePlus warned that publishing without its permission could bring legal action, and says phones from OPPO, which use the same software, share the problem. [17] There is no sign of a real attack yet, and the harmful app has to be installed on the phone first. [17]

Two former US Air Force members were sentenced on Friday for stealing from businesses by email while stationed at Dover Air Force Base in Delaware. [10][11] Chijioke Timothy Odimegwu, 25, got 111 months in prison and Harafat Mogaji, 26, got 78 months. [11] They stole email logins with fake messages, then watched for talk of payments. [10] At the right moment they sent new bank details that looked like they came from a business partner. [10][11]

Why it matters. One payment they diverted was more than $1.68 million from a victim in Iowa City, and another was $720,000 from a victim in Ohio. [11] They were ordered to repay $366,617 and $995,680, and ran the scheme for more than two years before the FBI and local police caught them. [10][11]

DIVD, a Dutch non-profit whose volunteers scan the internet for known flaws and warn the owners, says it has been hacked for the first time in seven years. [14] An attacker used a flaw in one of its systems, then let an AI program work inside the network on its own. [14] DIVD says the program chose each next step by itself and was loud and very messy. [14] It even got in the way of one of its own attacks. [14]

Why it matters. The mess left enough evidence for DIVD to piece together what happened, and it has told the Dutch police and data-protection regulator. [14] It says the flaw was not in Citrix, and it will give more details on 1 October and warn others with the same flaw. [14]

Germany's customs office has been linking police computers to suspects' WhatsApp and Signal accounts, the security writer Bruce Schneier noted on Tuesday. [16] Both apps let people add a laptop to their account, and new messages then arrive on the laptop too. [16] So officers can read the messages without breaking the scrambling that protects them on the way. [16] German reports say they get in by holding the phone, or by catching the one-time approval code through a fake message or a phone tap. [16]

Why it matters. Schneier says the apps should clearly show every linked device, so a person could notice one they never added. [16]

US prosecutors have charged Trung Nguyen Van, a 37-year-old from Vietnam, with laundering money from a so-called pig butchering scam. [18] In these scams a stranger met online builds trust, then talks the victim into a fake investment. [18] One victim sent about $16 million in cryptocurrency between June and August 2024, believing it went to a platform called Triangle. [18] Van was arrested on 24 September at Los Angeles airport, before a flight to Taiwan. [18]

Why it matters. Prosecutors say his wallets took in more than $53 million from fraud aimed at Americans between 2018 and 2024. [18] The FBI says investment scams cost Americans $8.6 billion in 2025. [18]

Signal, the private messaging app, has released version 8.30, which brings scrambled backups to iPhones and computers as well as Android phones. [15] A backup lets people get their chats back on a new device if they lose their phone. [15] Backups can be kept by Signal, free for up to 45 days of photos and videos, or kept on the user's own device with no size limit. [15] Both kinds are scrambled and need a recovery key to open. [15]

Why it matters. One recovery key opens every past backup it made, and BleepingComputer says attackers have already made that key a target. [15] Messages set to vanish within 24 hours are left out of backups. [15]

Researchers at VU Amsterdam and Scuola Superiore Sant'Anna have found a new version of Spectre, a known kind of attack on computer processors. [19] Processors predict which instructions come next and briefly run them early. [19] The new attack makes a processor predict from leftovers of old code, so it briefly runs the wrong instructions and exposes data. [19] On Intel processors running Linux, it recovered the scrambled form of the main administrator password in three to five minutes on average. [19]

Why it matters. The researchers told the affected companies, and fixes are already in the Linux kernel, the core of the system. [19] A scrambled password still has to be cracked, which depends on how strong the password is. [19]

Coding guides often use third-party.com as a made-up example address, the way others use example.com, BleepingComputer reported on 23 September. [20] Unlike example.com, which is reserved for guides, third-party.com is an ordinary domain whose owner controls what it shows. [20] It began showing a fake Cloudflare security check that tells Windows users to paste in and run a command. [20]

Why it matters. The security firm Manifold found it while reading public guides for AI tools that name the address. [20] The server that delivered the next stage no longer worked when BleepingComputer tested it. [20]

Cloudflare, which gave millions of websites free encryption in 2014, said on Tuesday it plans to become a certificate authority. [21] A certificate authority issues the digital certificates that let a website scramble its traffic and prove who it is. [21] Cloudflare says it has agreed to buy trusted root keys from GlobalSign, an existing authority, so older devices will accept its certificates. [21] It will also issue a new kind of certificate meant to hold up against future quantum computers. [21]

Why it matters. Cloudflare says trust on the web rests on a few big issuers, which is a risk if one of them fails. [21] It has applied to be accepted by Google's Chrome, Apple, Microsoft and Mozilla, which each decide what their software trusts. [21]

The airline Finnair has changed how it trains pilots because GPS signals are disrupted every day over the Baltic Sea, its chief executive told Reuters last Thursday. [22] Finnair stopped flying over Russia and Belarus, so more of its routes now cross the Baltic, a hotspot for this kind of electronic interference. [22] Poland said in August that satellite signals on its Baltic coast were disrupted on most summer days. [22] In 2024 Finnair paused flights to Tartu in Estonia for about a month. [22]

Why it matters. Modern planes have several backup ways to find their position, so they keep flying safely. [22] The chief executive, Turkka Kuusisto, says airlines from outside Europe are surprised that it is a daily problem. [22]