Cyber, in brief

Toronto Crime Stoppers, a programme that lets people tell police about crimes without giving their name, stopped taking tips late on Wednesday. [1]

It acted hours after CBC, Canada's public broadcaster, reported that more than 1.5 million tips from Crime Stoppers groups across Canada had been exposed. [1]

About half of those tips held personal information, and some were 25 years old, CBC found. [1]

CBC reporters used the stolen data to reach more than a dozen people who had sent tips. [1]

The tips were stolen in March from P3 Global Intel, a tip-handling firm owned by a company called Navigate360. [1] DDoSecrets, a group that publishes leaked data, passed the data to reporters that month. [1]

A hacker group calling itself Internet Yiff Machine claimed the break-in, saying it wanted to prove the two firms had lied about what their systems could do. [1]

Navigate360 told the Toronto group that the stolen data held 176,859 Toronto tips sent between January 2022 and November 2025. [1]

The company found 14,973 names in those tips, but could not say whether they belonged to the people who called, the suspects, or both. [1]

The Toronto group says Navigate360 told it in April that Toronto's data had not been taken, then said in June that it had, without saying what. [1]

Its lawyers have asked several times for the text of the stolen Toronto tips, and Navigate360 has not answered, the group says. [1]

Toronto has told Navigate360 and Canada's national call centre to stop taking tips meant for it, and has asked people not to send any by phone, website or app. [1]

Sean Sportun, the group's chair, said its promise of staying unnamed had been broken for some callers: "We are deeply sorry." [1]

Why it matters. The next sign is whether other Canadian Crime Stoppers groups follow Toronto in stopping tips through Navigate360's software, while Toronto looks for a truly anonymous way to take them. [1]

Capcom, the Japanese maker of Resident Evil and Street Fighter, says hackers broke into CAPCOM ID, the shared account its players use for its websites and some online games. [2] They took more than 11.7 million email addresses, with each account's creation date, last login time and internet address. [2] For 43 accounts they also got birth dates and nicknames, and for 196 they changed the password to lock owners out. [2][3] Capcom found the break-in on 19 October and told Japan's privacy regulator and police on 21 October. [2]

Why it matters. Capcom says no card details or other passwords were taken. [2] It warns members to be wary of unexpected emails that ask for more information or carry links and attachments. [2]

Baroness Lloyd, a UK technology minister, told the House of Lords on Thursday that 32 government services were unavailable and four partly so. [4] They were switched off while fixes for PHP2Shell, the two flaws in the PHP web language, went in. [4] Britain's cyber agency, the NCSC, sent 50,000 warnings and says it sees no sign of a successful break-in. [4][5] Many German government sites were back online on Thursday, but some hospitals and universities were still disrupted. [6]

Why it matters. The cost is landing on ordinary users: a garage owner in Chepstow, Wales, told the BBC he has had to write vehicle test records on paper since Wednesday. [5] Experts told the BBC and DW that the full effect, and the full clean-up, could take months. [5][6]

Palo Alto Networks says the PHP flaws affect its PAN-OS firewall software, rates the risk high, and promises updates. [7] Sophos, a security company, took an old licensing website of its own offline on 21 October because it ran a flawed PHP version. [7] Cisco's Talos researchers estimate that about half of all PHP systems will never get the fix. [7] VulnCheck says it has built a working attack that defeats a key built-in protection, and has shared it only with paying customers. [8]

Why it matters. PHP sits hidden inside firewalls, website control panels and cloud services, so many owners cannot fix it until each maker ships an update. [7] Red Hat rates the flaws 8.1 out of 10, below the 9.8 in the US government's database, saying attacks are hard in practice. [7]

Railway, a cloud service with about 4.8 million users who run apps on it, says an intruder reached the system that holds customers' stored settings. [9] For some customers the intruder may have read the decrypted contents, which can include passwords and keys for other services. [9][10] Railway paused deployments, cancelled its own access keys and told every user to replace theirs. [9][10] It says the attack was part of a wave aimed at companies that run AI models. [10]

Why it matters. One researcher says attackers emptied cryptocurrency wallets whose keys were stored on Railway, at least two hours before the public notice. [10] Free and Hobby customers were still waiting for builds to restart on Thursday. [9]

The United Arab Emirates' interior ministry says an operation it led with police from 30 countries arrested more than 960 people. [11] Operation Confrontation Ghost ran from 1 July to 30 September and targeted AI-made scams, money fraud and sextortion, where criminals threaten to share intimate images. [11] It blocked 4,126 bank accounts and shut 570 social media accounts. [11] The UAE ministry says the operation exposed more than $39 billion in criminal money. [11]

Why it matters. Interpol and companies including Meta and TikTok took part, which is how one country's police can reach scam networks that cross borders. [11] The $39 billion is the UAE interior ministry's figure, and the report does not say how much of it was seized. [11]

eMudhra, the Indian company whose website-certificate keys turned out to be tiny guessable numbers, says it will stop selling website certificates worldwide. [12][13] Browsers stopped trusting eight of its certificates this week after a researcher found one key was simply the number 4. [12][14] Its chairman, V. Srinivasan, blamed rising compliance costs and free rivals, and said the business was about 1% of revenue. [13][15] eMudhra says it will move customers to other issuers free of charge. [15]

Why it matters. eMudhra says none of the eight was used to issue certificates for websites, and no data was taken. [15] India's IT ministry is investigating, but it has also accused some social media accounts of fear-mongering. [12]

Arista Networks says attackers are using a new flaw in VeloCloud Orchestrator, the web tool companies use to run their networks across many offices. [16][17] Anyone with even a read-only login can give themselves top control of it. [17] It is the third flaw in the tool that Arista has reported being used in attacks since late July. [17] Arista has fixed the versions it hosts itself and released updates for companies that run their own. [16][17]

Why it matters. Arista has not said when the attacks began, who was hit, or what the attackers did next. [17] Earlier flaws in the same tool could also reach the network boxes it controls in each office. [17]

GitLab, a service where companies store and build their software, fixed a flaw rated 10 out of 10 on Wednesday. [19] It could let someone with no login run their own code on a company's own GitLab server. [18][19] The bug sits in the part that reads search patterns in settings files, and it reaches back to GitLab 7.0 from 2014. [18][19] Shadowserver, a group that watches the internet, counts more than 2,700 such servers online. [18]

Why it matters. GitLab servers often hold source code and the keys to a company's live systems. [19] No attacks are known yet, and GitLab's own online service is already fixed. [18][19]

Columbia, South Carolina's capital city of about 150,000 people, says a cyberattack has shut down several city systems. [20] They include MyColaSC, the website residents use to pay utility bills and report potholes. [20] The state's police agency, SLED, is leading the inquiry. [20] The city says police, fire, 911 and water services are still working. [20]

Why it matters. The city did not answer questions about whether it faces ransomware, an attack that locks files for a payment. [20] Cities and counties in at least eight other US states have lost services to attacks in the last three weeks, The Record reports. [20]

Energize Lab, which makes Eiliko, a small AI robot charm, has answered The Verge after its report on the toy's security holes. [21] The company says it has closed outside access to its systems and will stop storing owners' conversations. [21] It says it will delete the chats, profiles and pictures it already holds, and hire an outside security firm. [21] The Verge found photos and voice recordings still open online after that statement. [21]

Why it matters. The toy told owners their secrets were safe with it, while outsiders could read every conversation on the company's servers. [21] Chats that are deleted cannot be taken in a later break-in.

Kanishka Narayan, the UK's AI minister, says the UK government used advanced AI tools to check its own systems for security holes. [22] "We only spent £13,000 on it," he told the BBC, and they found 500 new flaws in important parts of the public sector. [22] He did not say which systems they were in or whether they are fixed. [22] He spoke before the PHP flaw, which was also found with AI's help, became public. [22]

Why it matters. Attackers can use such tools too. [6] Germany's cyber agency says AI lets them turn each new fix into an attack within hours. [6]

Semperis, a security company, says a long-running Iranian spying group known as Prince of Persia is running the servers that control its malware from a US hosting company. [23] It is the first time in at least 12 years that an Iranian group has been found doing this, Semperis says. [23] The group's newest malware, called Tornado, can hide its traffic inside Telegram, a messaging app. [23] Its tools can steal files, take screenshots and record audio. [23]

Why it matters. The group targets governments, companies and Iranians who oppose their government, in the US, Europe and the Middle East. [23] "This is the last place we expected to find Prince of Persia hiding," said Tomer Bar of Semperis. [23]

Dutch police arrested two men, aged 23 and 25, over a fraud that took €380,000 from 170 people. [24] Victims were phoned and played recordings made with AI, with voices posing as their bank. [24] The recordings told them to install an app and hold their bank card against their phone. [24] The app sent the data from the card's contactless chip to the gang, who used it to take money from the victims' accounts. [24]

Why it matters. The whole fraud rests on one step: getting the victim to hold their own card against their own phone during the call. [24]

Singapore's police say scammers are running social media ads for activities for older people, water fitness classes and recycling schemes. [24] People who respond are told to download an Android app file to sign up. [24] They then get calls from people posing as officials or bank staff, who talk them into moving money. [24] Police count 62 cases since April and losses of S$989,000. [24]

Why it matters. Police call it a malware scam: the app goes on the phone first, and the calls about 'compromised' accounts come after. [24]

Two US House members, Republican Pat Harrigan and Democrat George Whitesides, have written a bill on 'distillation attacks'. [25] In one, a rival trains its own AI by asking another company's model huge numbers of questions and copying the answers. [25] The bill would have NIST, the US standards agency, write voluntary defences against such copying from Russia, China, Iran and North Korea. [25] It would also set up a group on using AI to defend critical services. [25]

Why it matters. US AI companies and the US government accuse Chinese firms including DeepSeek of copying their models this way. [25] US AI firms themselves face lawsuits from media groups and artists who say their work was used to train models without pay. [25]

Cisco fixed 34 flaws on Wednesday, including a critical one in Expressway, its video-calling gateway, that could let an attacker take full control. [26] Splunk, Cisco's data-search company, fixed critical access flaws in its Enterprise and SOAR products. [27] SolarWinds fixed a flaw that let low-level users see restricted information in its monitoring software. [27] Cisco says it knows of no attacks using its flaws. [26]

Why it matters. Cisco says the Expressway flaw works only in certain setups, and the fix is in version X15.5.20. [26] SolarWinds also fixed a smaller flaw in Patch Manager, its tool for sending updates to company computers. [27]

1Password, a password manager, launched a feature that lets AI agents sign in to websites for a user. [28] When an agent reaches a login page, the user gets a notice on their own device and approves it. [28] 1Password then fills in the details itself, so the agent never sees the password. [28] It works with agents including ChatGPT, Claude and Meta's Muse, the company says. [28]

Why it matters. 1Password's product chief said handing an agent a password and hoping for the best does not work. [28] Each approval happens on the user's own device, much like a second login check. [28]

The SANS Institute, a security training body, surveyed 400 IT and security staff about their cloud systems. [29] It found 93% run live work in the cloud, but only 40% call their cloud security advanced. [29] Wrong settings caused 45% of the most serious incidents, almost twice the 22% caused by stolen logins. [29] About half of firms need more than a day to fix a known serious gap. [29]

Why it matters. Most of these holes are left open by the owners themselves, not opened by attackers. [29] SANS says the gap persists even though 73% have a team just for cloud security. [29]

Indurex, an Amsterdam company that watches the control systems in factories and power plants, raised €7 million, about $7.8 million. [30] Contrarian Ventures led the round. [30] Indurex's software checks safety and control settings for changes that an operator should know about, not only network traffic. [30] Its first customers are energy companies and manufacturers. [30]

Why it matters. The company says ordinary industrial security tools watch network traffic and miss changes to the safety settings themselves. [30] In a power plant or factory, a wrong safety setting can hurt people, not only data.

Denise Cote, a US federal judge, ruled that the Office of Personnel Management (OPM), the US government's personnel office, broke the Privacy Act of 1974 by giving DOGE its records. [31] Elon Musk set up DOGE, a cost-cutting team, when President Trump's second term began. [31] The records hold personal details of tens of millions of federal workers, job applicants and retirees. [31] Government lawyers had argued DOGE needed data including background checks, medical files and bank details. [31] The ruling came out on Tuesday 20 October and sets no remedy yet. [31]

Why it matters. The judge found OPM gave no believable reason why DOGE needed the data, and that it ignored its own security rules. [31] OPM and the US Justice Department did not answer Fortune's requests for comment. [31]