Cyber, in brief

Late on Sunday, Ukraine's Air Alert app told users: "Radiation threat declared in Kyiv." [1]

By 22:49 it had also warned of a chemical attack and of street fighting in Kyiv. [1]

"There is no radiation threat! Stay calm," Ukraine's Air Force then posted on Telegram. [1]

Hours later, Russia said its own warning app had suffered "a massive cyberattack". [1]

People often have only minutes to reach shelter from a ballistic missile. [7]

Kherson's governor told people to "respond immediately to warnings about Russian attacks" as the truce ended. [3]

Emergency managers, like Russia's Emergencies Ministry, send each warning by several channels at once. [2]

Russia's ministry says it also warns people by sirens, loudspeakers, texts, TV and radio. [2]

It called the app "only an additional, ancillary news service". [2]

The BBC has not verified a screenshot of a fake Russian alert that Atesh posted. [1]

Neither government has said how the attackers got into its app. [1]

Russia's ministry says specialists are working to restore its app. [2]

Ukraine's and Russia's public warning apps were both used to send fake alerts within hours of each other on Sunday night, and neither government has said how the attackers got in.

A warning that gives people minutes to find shelter leaves no time to check it first, and that is what a fake one relies on. [7]

They reached phones across Ukraine through an app the state supports, and loudspeakers in the Lviv region repeated them. [1]

They got, or heard aloud, false radiation and chemical warnings late at night. [1]

How the attackers got into Ukraine's Air Alert app, and whether they could do it again.

Ukraine's digital ministry said only that the app had apparently been compromised, and took it offline for maintenance. [1]

Who broke into Russia's warning app.

Russia's ministry did not say, and the BBC could not verify the screenshot that Atesh posted. [1][4]

How many people took cover, or clicked the link in the fake message.

No official has published a figure; one regional head only warned people not to click. [1]

A separate warning app for Kyiv kept working normally while the national one sent fake alerts. By 23:53 the same night, the national app had sent an all-clear for each false alert.

On Sunday, Binance customers took out $3.64bn more than they put in. [9]

Binance, the world's biggest crypto exchange, had about $6.3bn stolen last week. [9]

The FBI blames TraderTraitor, a North Korean hacking group, for the theft. [10]

Between 06:00 and 15:30 GMT, it paid out $4.649bn and took in $1.01bn. [9]

That gap is just over 2% of the $171bn it holds for customers, Binance says. [9]

On Saturday, Binance said it had replaced 90% of the stolen coins. [10]

Late on Saturday it said 95%, with harder-to-buy coins still to come. [11]

It used its own treasury, a $1bn user fund and insurance money to buy them back. [10]

Co-chief executive Richard Teng says users will not bear the cost of the hack. [10]

So the cost lands on Binance's own reserves, not on the people whose coins were taken. [10]

More services will reopen in stages once security checks are done, Binance says. [9]

It says withdrawals spiked and then settled, and Sunday's net outflow was just over 2% of the $171bn it holds. [9]

It is buying back the stolen coins from its own treasury, a $1bn user fund and insurance money. [10]

When Binance will replace the last 5% of the stolen coins.

Binance says those coins are harder to buy in the amounts needed and may take longer. [11]

Binance says it has replaced 95% of the coins stolen last week, and its customers began withdrawing again on Sunday.

Police in Western Australia scanned 1,380,882 faces in a five-month trial of live face recognition. [12]

Cameras on or near police vehicles matched faces against a list drawn from police databases. [12]

The trial, which ended on Saturday, led to 122 arrests, police say. [12]

It also gave 9 wrong alerts, which police put at an error rate of 0.00065%. [12]

"No one was arrested," WA police commissioner Col Blanch said of the wrong alerts. [12]

Police say images of people not on the list were blurred at once and deleted. [12]

The state's privacy watchdog warned of "collective privacy harms" when the trial was announced. [12]

A rate depends on what it is counted against: scans, or the 122 arrests. [12]

Civil Liberties Australia says if half the 122 are not convicted, the wrong rate is 50%. [12]

Experts say face matching has made more wrong matches for people with darker skin. [12]

The vans are off the streets while police review the trial and its safeguards. [12]

Why a warning goes out on more than one channel

A warning has to reach people within minutes

So it is sent down several separate channels at once

Any one channel can break or be taken over

A false message on one channel does not appear on the others

Officials use the channels still working to say it is false

The fake radiation alert reached a whole country through one app. The Air Force used its own channel to call it false, and Kyiv's separate app kept working normally.

On Sunday night one app sent fake alerts while Kyiv's own app kept working normally.

The shop's own website showed nothing wrong, and Stripe, a separate company handling its payments, saw the problem and sent the warning.

A camera alert was not an arrest on its own: an officer checked each one in person, and police say none of the 9 wrong alerts led to an arrest.

Incus, a separate project built from the same code, reported the flaw, and Canonical then fixed its own copy.

Extra channels help only if they are really separate. In the Lviv region, loudspeakers fed by the app played the fake radiation alarm too.

Everyone who got that alert on Sunday night was inside Ukraine's warning system, checking one channel against another late at night.

Its face-scanning vans produced 122 arrests in five months, police say. [12]

1,380,882 faces were checked with no reasonable suspicion, Civil Liberties Australia says, and 9 people were wrongly flagged and questioned. [12]

How many of the 122 arrests in Western Australia end in a conviction.

Civil Liberties Australia says the real error rate is known only once those cases reach court. [12]

US prosecutors say fraudsters used stolen identities to enrol fake "ghost students" in colleges. [13]

They say the aid was then moved to bank accounts controlled by people abroad. [13]

A Kenyan man was charged on 21 October; officials announced it on 29 October. [13]

It calls its investigation Operation Ghostbusters. [13]

Investigators flagged 830,840 possibly fake student aid IDs, tied to nearly $130m in September and October. [13]

That $130m is aid linked to suspect accounts, not confirmed losses. [13]

In one Virginia case, prosecutors say a Kenyan man received over 700 refunds, about $1.44m. [13]

Officials say the fraudsters used what they called "super intelligence" to do coursework. [13]

Student aid is public money, so prosecutors say the fraud takes from US taxpayers. [13]

Identity theft means using someone else's personal details to act as them, here to enrol. [13]

People whose identities were stolen can find student loan debts in their own name. [13]

With Kenyan investigators, US officials seized over $750,000 in crypto, the first such seizure in Kenya. [13]

Prosecutors say one Kenyan man received over 700 aid refunds worth about $1.44m. [13]

How much of the $130m tied to suspect student aid accounts was really lost.

US officials say the figure is aid linked to suspect accounts, not confirmed losses. [13]

Canonical, a software company, fixed a flaw rated 10 out of 10 in its LXD software. [14]

LXD runs virtual machines, computers made of software; MicroCloud joins LXD machines into one cluster. [14]

The flaw let attackers log in as a trusted user or machine, without its secret key. [14]

The server checked every digital ID a visitor sent, though only the first is proven theirs. [14]

Posing as a powerful account, an attacker could take full control of the machine, Canonical said. [14]

Incus, a community project built from LXD's code, reported the flaw. [14]

A standalone LXD server does not open this connection to the network by default. [14]

Canonical's fixed versions include LXD 6.10.1 and MicroCloud 3.4.1. [14]

MicroCloud clusters are most exposed: a machine's digital ID can be captured as it joins. [14]

There is no public sign anyone has used the flaw in an attack. [14]

Incus, a separate project built from the same code, reported the flaw, and Canonical then fixed its own copy.

Kaspersky, a Russian security firm, found new malware, harmful software, aimed at Asian government computers. [15]

It targets a special version of Windows 10 used only by government bodies there. [15]

Kaspersky calls it NetamLoader, and found it on one computer in the first half of 2026. [15]

It sat in a package in the folder Windows uses for its own update files. [15]

The package mixed it with real programs, some signed by Microsoft. [15]

Once running, it could interfere with security scans, hide itself and delete logs. [15]

It could also download more harmful code and talk to the attackers' servers. [16]

Kaspersky suspects a supply-chain attack: breaking into a trusted supplier to reach its customers. [15]

A country with its own Windows build must protect all of it alone, Kaspersky says. [15]

Kaspersky did not name the country, and could not link the attack to a known group. [15]

Which government NetamLoader hit, and what it took.

Kaspersky found one infected computer and could not confirm that any data was stolen. [15]

Shelly Store UK, which sells Shelly smart-home gear, says payment data may have been stolen. [17]

Its payment company, Stripe, warned it, and it found unauthorised software on its website. [17]

Card details, names, billing addresses and contact details may have been taken, it says. [17]

The shop says it cannot tell whether customers' data was accessed or copied. [17]

One customer told The Register of a GBP 221.28 charge made in Australia on 26 October. [17]

The shop removed the software, tightened security and told the ICO, the UK data watchdog. [17]

It is independent of Shelly, the company that makes the devices. [17]

It is contacting customers from the affected period and told them to check card statements. [17]

The warning came from Stripe, the payment company, rather than from the shop's own checks. [17]

The shop's own website showed nothing wrong, and Stripe, a separate company handling its payments, saw the problem and sent the warning.

Their card details may have been taken, and one says a GBP 221.28 charge appeared in Australia. [17]

Whether any Shelly Store UK customer data was actually copied.

The shop's investigation is still going, and it has not said when the software was put on its site. [17]

A researcher found that Lenovo's fingerprint USB stick, sold as encrypted, held a plain memory card. [18]

Encrypted means scrambled so that only someone with the right key can read it. [18]

The researcher, Xusheng Li, found the fingerprint reader only switched the USB connection on. [18]

So anyone holding the stick could read its files, Tom's Hardware reports. [18]

Lenovo put out a fix early this year, which means calling a service line in China. [18]

A follow-up last week, using an AI tool, tested drives and software from other makers. [18]

It found two hidden "backdoor" accounts with simple passwords in SecZure's YutianDun. [18]

Netac's protection tool was broken in about seven minutes, because a fixed key was built in. [18]

Li did not warn KakaSoft, Nexcopy or SecZure first, saying sold drives cannot be recalled. [18]

People who bought these drives to protect files hold devices that may not protect them. [18]

Security engineers call checks done by the buyer's own software client-side, and they can be skipped. [18]

Li puts it plainly: "client-side validation is never secure". [18]