Day: October 30, 2026

  • Bulletproof Host Virtualine Loses Its Domain to FBI Seizure

    It allowed customers to host hack-for-hire services, supported ransomware and infostealer operators, and accepted crypto payments.

    Source: SecurityWeek · 2026-10-30

  • Assad regime hacker who caused $136 billion market drop sentenced to 42 months

    A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced. Ahmad Umar Agha, also known as “Th3Pr0”, was sentenced on Thursday by a federal court in the Eastern District of Virginia for his central role in a hacking conspiracy organized and led by members of former Syrian President … More →

    Source: Help Net Security · 2026-10-30

  • CISA says max severity GitLab flaw now exploited in the wild

    Attackers have started exploiting a maximum-severity GitLab vulnerability patched earlier this month, according to the US Cybersecurity and Infrastructure Security Agency (CISA). […]

    Source: BleepingComputer · 2026-10-30

  • Photo ID, bank checks, face scan? The UK’s age-check options

    As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice.

    Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom identified four ways to check someone’s age that it considers “highly effective.”

    Here’s what those checks would involve:

    • Photo ID matching: Comparing a live image of you with the photo on an identity document, such as your passport, and checking the age information on that document.
    • Bank-based checks: Using age information your bank already holds about you, with your consent.
    • Facial age estimation: Using technology to estimate your age from your face. Ofcom says this technology has improved recently.
    • Digital ID services: Using a digital identity service to prove your age, rather than presenting a physical document.

    Let’s think through what those checks could mean.

    Challenges

    The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check.

    Photo ID matching brings highly sensitive documents and facial images into the process, which raises questions about how that information is handled and protected. The risks aren’t hypothetical: as I reported last year, a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users.

    Banking-based checks can be more privacy-preserving if they return only confirmation that someone meets the age threshold, rather than exposing financial information. But the important questions are what information each party receives, what gets retained, and whether the check can be linked to someone’s activity.

    Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction. Ofcom acknowledges that some technologies can be wrong by a few years around age 16, so people near the threshold may face an additional verification check.

    I would expect these checks to stop some underage access but not eliminate it.

    Previous restrictions have been followed by workarounds, including increased VPN use, borrowed credentials, and migration to services outside the restrictions. The danger is treating a successful age gate as proof that children are now safe, when it might push them into less regulated spaces.

    The effectiveness depends on how the checks are implemented. A VPN may help someone avoid a check triggered by their apparent location; it won’t, by itself, bypass an identity or facial check that is still required.

    Similarly, Ofcom says matching a live image to an ID is intended to make it harder to borrow someone else’s document. We shouldn’t assume every workaround defeats every method. But Ofcom accepts that some motivated children will get through. The meaningful test is how much harm these measures prevent, weighed against the privacy risks and barriers they introduce— not whether every user has completed a check.

    My personal preference is double-blind verification: a provider confirms that you meet the age requirement without learning which service you’re accessing, while the service receives proof of age without learning your identity. Proving you’re old enough shouldn’t mean revealing who you are.


    Scammers don’t need to hack you. They just need you to click once. 

    Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

    Source: Malwarebytes Labs · 2026-10-30

  • Shufti ties AI agent actions to verified owners and permissions

    Shufti launches Know Your Agent (KYA), an AI agent verification solution designed to verify autonomous AI agents acting on behalf of individuals and businesses. Agentic commerce enables AI agents to open accounts, place orders, and move funds for their owners. A business receiving one of these requests needs to know whether the agent is genuine, who is accountable for it, and whether the action falls within what that person approved. A valid access token alone … More →

    Source: Help Net Security · 2026-10-30

  • British spy agency cannot account for thousands of data storage devices, watchdog says

    British spy agency cannot account for thousands of data storage devices, watchdog says

    The Investigatory Powers Commissioner’s Office (IPCO) in its annual report for 2025, published Thursday, said it was “very concerned” and “disappointed with the time it has taken GCHQ to investigate” the issue.

    Source: The Record · 2026-10-30

  • Bedrock Data routes data exposure fixes to owners and verifies results

    Bedrock Data has announced AI-assisted remediation, which federates the work of fixing data exposure to the data owners across the enterprise. Bedrock Data discovers who owns each exposed dataset, opens a ticket for that owner in the Jira or ServiceNow workflow the enterprise already runs and supplies the context needed to fix it. When the owner closes the ticket, Bedrock Data validates that the exposure is remediated and reopens the ticket if it is not. … More →

    Source: Help Net Security · 2026-10-30

  • Apple Is Entering Its Slop Era

    Apple Is Entering Its Slop Era


    Apple Is Entering Its Slop Era

    My ears perked up when I heard Apple’s new foldable phones were cracking. I licked my lips when the company announced it’s releasing a touch-screen laptop. This was a company that once charged $19 for a polishing cloth, asked $200 for a VESA mount, and sold $700 wheels for the Mac Pro. Now it’s borrowing tired ideas from its competitors and launching hardware its previous leaders rejected.

    The once dominant company is struggling to find its feet in an AI-driven post-Tim Cook world. John Ternus is the new CEO — a 25 year veteran of the company with a track record of pushing harebrained hardware schemes like the much reviled Touch Bar and lawsuit inducing butterfly keyboard. 

    With Ternus at the helm, I feel there’s a good chance Apple’s best days are behind it, that it will have to make do with less, that it’s déclassé. Apple, blindsided by AI and relying on crowdpleasing hardware gimmicks, is downwardly mobile. It’s in its slop era. The company that once asked consumers to “Think Different” is now releasing hardware that’s just like everything else on the market.

    Apple is not adjusting to this new position well. AI boosters agree that Siri AI is awful. Apple HomeView is a $300 Apple Watch meant to replace the family hearth. The iPhone Duo has only been out for a few days and all people can talk about is the cracks, yet Ternus is on the cover of Time Magazine this week holding the folding iPhone Duo and staring at the camera. “The other examples in the world felt kind of cheap and crappy,” Ternus told Time. Many people holding cracked iPhone Duos this week are learning just what (not) cheap and crappy looks like.

    Flailing from crackgate, Apple announced the launch of a touch-screen laptop, an idea Steve Jobs extensively tested and said “doesn’t work,” an idea Cook once compared to combining a toaster with a refrigerator. What’s next? What if the toaster-refigerator folded? Ternus has been trying to make an 18-inch foldable iPad happen for years. Maybe Apple will solve the screen cracking issues by then. Or maybe Ternus will continue to try to put a hat on a hat.

    I have been waiting for this moment for more than a decade. I am relishing Apple’s recent trajectory more than I should. I confess I harbor a secret and petty grudge.

    In 2010, when Apple released the iPhone 4 I was working as a floor manager at a Banana Republic in Dallas. I was interested in smart phones, of course, but Dallas is an expensive city and the iPhone was a luxury. I made do with my Motorola Razr. But the suit-wearing middle management retail psychopaths that were my coworkers saw my lack of an iPhone as a weakness. It was not, as they say now, On Brand.

    I had started at the store in the stock room, working my way up to manage the backroom before ascending to a coveted position on the sales floor. The other managers made it clear that a Razr was a “backroom” phone and someone in a prominent position on the floor needed to be seen using an iPhone.

    At first, I was not told to buy an iPhone. The message came in the form of subtle and not so subtle bullying deployed over weeks.

    “Still using that old phone?” they’d say.“Didn’t you get a raise?” someone would ask a week later.

    “Try not to use that thing on the sales floor,” one co-worker told me, pointing at my Razr. “We’re trying to project a certain image here.”

    The social pressure had the opposite of its intended effect. I resisted. Eventually one of the friendlier managers pulled me aside. He told me that my colleagues thought it was weird that I didn’t have an iPhone. He said I needed to buy one to fit in and he said the store could give me an advance on my paycheck to make it happen.

    Ever the contrarian and pissed I was experiencing high school style bullying as a full grown adult, I threw in with Google instead. I got an HTC Dream. My coworkers weren’t happy, but they stopped bringing up the iPhone. 

    I’ve been an Android user ever since and studiously avoided Apple products until I broke down a few years ago and bought a Macbook Air. Time heals all wounds and Windows laptops are garbage. I’d even been considering changing from Android to iPhone because the privacy features are more robust. I’ve never been averse to a fast food meal either and maybe I’m a little more comfortable with Apple now that the cracks are starting to show in the foldable phone.

    Source: 404 Media · 2026-10-30

  • Binance hit by largest-ever crypto theft, with $6.3 billion stolen

    .kadence-column482616_9de20c-07 > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{column-gap:var(–global-kb-gap-sm, 1rem);}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col{background-color:#ffe5e5;}.kadence-column482616_9de20c-07 > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column482616_9de20c-07{position:relative;}@media all and (max-width: 1024px){.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column482616_9de20c-07 > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}

    In this article

    • Attackers stole $6.3 billion from the Binance cryptocurrency exchange
    • Binance says user funds are safe, but watch out for fake support or recovery offers from scammers
    • Users should check their accounts and use official Binance channels.

    Binance says a security incident affected approximately $6.3 billion in cryptocurrency. Its initial investigation points to a compromised DevOps engineer’s laptop as a possible entry point.

    The exchange says it has frozen around $3 billion with help from blockchain partners. It has promised to cover all losses using its emergency fund and company funds. Binance is reportedly the largest cryptocurrency exchange by daily trading volume.

    What happened?

    In an update on October 30, Binance said attackers may have used a compromised laptop belonging to a DevOps engineer to access a service container and submit unauthorized withdrawal transactions. The company said:

    “We have found no evidence of any wallet private key leak.”

    This doesn’t mean that one employee could simply transfer billions of dollars. Binance co-CEO Richard Teng told BleepingComputer the attacker did not simply use one engineer’s permissions. The incident involved a more complex process, rather than a single “one-click” action. Binance also said investigators had identified additional breach points.

    Blockchain intelligence firms TRM Labs and Chainalysis have linked the theft to TraderTraitor, a North Korean hacking group associated with previous cryptocurrency thefts. TRM Labs estimates that about $6.36 billion left Binance wallets across ten blockchains, with most of it moving within about 20 minutes.

    What should Binance users do?

    Binance says approximately $3 billion has been frozen on-chain, while blockchain analysts have reported somewhat different totals. For now, those figures should be treated as developing estimates rather than a final accounting of recovered funds or the exchange’s ultimate losses.

    Binance.com users (Binance.US was not affected) should check their accounts, avoid follow-up scams, and respond quickly if they spot signs of a separate compromise.

    • Go directly to official updates. Open the Binance app or navigate to its support site yourself. Avoid logging in through unexpected messages claiming that you must urgently verify your account or claim compensation. Binance has asked customers to rely on official channels.
    • Review your account and report anything unexpected. Check your transaction history and account security settings. If you find activity you do not recognize, contact Binance through its official support service. Binance’s support center includes options to disable an account and reset a password or two-factor authentication.
    • Never give anyone your authentication codes. Treat requests for login codes as a warning sign, even if the person claims to be helping with the incident.
    • Be wary of anyone promising to recover cryptocurrency. The FBI published a warning in 2023 that fake recovery services target people who have already lost cryptocurrency.
    • Preserve evidence if you lose money to a related scam. Keep messages, wallet addresses, transaction details, and information about anyone offering recovery services.

    Pro tip: Unsure whether a message is a scam? Check it with Malwarebytes’ Scam Guard for an assessment and advice on what to do next.


    Link Checker

    Source: Malwarebytes Labs · 2026-10-30