I’m finally ready to upgrade to a smart calendar – and Amazon’s newest Echo device looks like an organizational solution for my family and I.
Source: ZDNet Security · 2026-10-30
Day: October 30, 2026
-
Apple notifications alert victims in 99 countries about mercenary spyware infections
Apple has sent new notifications of mercenary spyware infections to almost 100 countries, with recipients including journalists and documentary filmmakers.
“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total,” the company said. “The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions.”
Apple didn’t immediately respond to a request for comment Friday about the countries targeted. Researchers and groups that work on spyware said the notifications were significant, however.
“This again promises to be an important set of notifications with a bunch of cases, based purely on what we see publicly,” said John Scott-Railton, senior researcher at The Citizen Lab at the University of Toronto. He also posted on social media about how potential victims could defend themselves, warning people to be cautious about companies that offer paid solutions to spyware infections.
He cautioned that the lack of notification doesn’t rule out an infection. The steps Apple recommends, which Scott-Railton seconded, were to enable Lockdown Mode and to get in touch with the digital rights group Access Now.
“The number of Apple threat notifications we are seeing from countries around the world indicates that the fight against the scourge of spyware abuse is far from over,” said Natalia Krapiva, senior tech-legal counsel with Access Now. “While we have increased our capacity to investigate spyware abuse, and companies like Apple have done a lot to notify and protect people from it, repressive states continue to use these powerful surveillance technologies, including against civil society actors and opposition figures.”
Apple sent its last major batch of notifications in August. The notifications frequently lead to victims approaching Access Now, The Citizen Lab and other groups seeking further assistance and prompting deeper investigations.
The notifications come shortly before the final rounds of negotiations over industry standards for commercial hacking tools being developed under the voluntary Pall Mall Process. The industry guidelines follow an earlier set of guidelines catered to governments.
“The states that will ultimately adopt these guidelines must come to terms that the current system is not working, and that the spyware industry must face some real consequences for the uncontrolled sale of these tools and refusal to curb the abuses,” Krapiva said.
Source: CyberScoop · 2026-10-30
-
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously.
The activity has been attributed by CrowdStrike to a China-based “targeted intrusion adversary” it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in
Source: The Hacker News · 2026-10-30
-
Your Netgear router may be vulnerable to a security exploit – how to check and patch it
A vulnerability in some Netgear routers could allow an attacker with access to your network to run malicious commands on the device.
Source: ZDNet Security · 2026-10-30
-
The Rise of the Christian Left in Texas
Rev. Frederick D. Haynes III speaks to the crowd during the We the People TX interfaith service, “A Night of Moral Resistance,” in Dallas, on Sept. 9, 2026. Photo: AP Photo/Gabriela Passos “Why do you wanna have a pep rally when people are hurting?”
That was the question Rev. Frederick Douglass Haynes III posed at a September food drive in South Dallas, where volunteers were collecting groceries for struggling families. Across town, Republicans were holding a midterm convention. Haynes, a longtime Baptist pastor and Democratic congressional nominee, was introducing James Talarico, the party’s candidate for U.S. Senate in Texas.
A month later, speaking at a Dallas megachurch, Talarico offered his own interpretation of Christian duty.
“I try to love my neighbor through public policy,” the Presbyterian seminarian told the congregation. “I’m trying to make my neighbor’s life easier, better, less stressful.”
Both men are making a deceptively simple argument in some of the staunchly staunch red-as-hell, Republican territory in America, one that might transcend the conventional wisdom about national campaigns and the millions poured into competing campaign war chests: When far-right policy translates into actual pain, at what point does intervening become a spiritual obligation?
Amid the big-ticket ad buys, fundraising appeals, and armies of political consultants, Talarico and Haynes are tapping into a political tradition that has long sustained communities across the South: showing up.
At Haynes’s Friendship-West Baptist Church, the ministry extends to legal services, immigration advocacy, counseling, economic justice, and food policy. It is an example of how churches often form the connective tissue of communities suffering under economic and political strain.
When far-right policy translates into actual pain, at what point does intervening become a spiritual obligation?
That strain is measurable. Texas is home to four of the nation’s 10 most financially distressed major cities, including Houston, which ranks second nationwide, according to a 2026 analysis. Feeding America estimates that nearly 1 in 5 Texans experienced food insecurity in 2024. Meanwhile, federal analysts project that changes to Medicaid eligibility enacted last year will increase the number of uninsured Americans by 7.5 million by 2034.
While Democratic Party leaders publicly debate how to punish Donald Trump politically, allege corruption, or navigate the ideological divide between moderates and democratic socialists, a different argument is emerging from Southern pulpits.
The Underground Church
From Quaker abolitionists to the Social Gospel’s challenge to industrial exploitation, progressive religious institutions have helped drive some of America’s most consequential political transformations. Christian farmworker ministries supported migrant laborers before joining the United Farm Workers’ California grape boycotts in the 1960s. And while Black churches overwhelmingly led, sustained, and suffered the brunt of violence in the fight for equal civil rights in this country, a handful of white denominations joined them.
Of course, churches also defended slavery, segregation, and exploitation. The blunt reality is that throughout American history, Christianity has always been political and has been used to justify a wide variety of competing political ends.
But Republicans have deftly exploited the perception that they alone speak for American Christians. The Trump administration has readily embraced religious iconography, from evangelical leaders praying over the president in the Oval Office to Defense Secretary Pete Hegseth’s frequent invocations of the medieval Crusades.
There is no way around the fact that Republicans have built a formidable religious coalition, particularly among white evangelicals. Last year, the nonprofit, nonpartisan Public Religion Research Institute, or PRRI, found a majority of Republicans qualified as either Christian nationalist adherents or sympathizers in 2025, compared with 17 percent of Democrats.
But Republicans don’t have a monopoly on Christian voters. Pew Research Center polling this month found 73 percent of white evangelical Protestant registered voters preferred Republican House candidates, while 74 percent of Black Protestants and 59 percent of Hispanic Catholics preferred Democrats. None of that is particularly surprising on the surface.
Nor is this some newly discovered religious awakening. According to PRRI’s Census of American Religion, which was published in April, 57 percent of Democrats identified as Christian in 2025, a significant drop from 70 percent in 2013. The white Christian left isn’t necessarily growing, but it’s far from insignificant. Much of it has simply been politically overlooked.
It’s a perception the GOP has routinely capitalized on, often spending a great deal of their election campaigns attacking opponents on religious ground.
On Sunday, Texas Gov. Greg Abbott cravenly tarred his Democratic gubernatorial challenger, state Rep. Gina Hinojosa, as supporting “Sharia law,” citing an endorsement from a Muslim advocacy group’s political affiliate.
Perhaps ironically, Hinojosa is, and has been on the record, a Catholic — same as Abbott.
“My faith is my moral compass,” Hinojosa told the National Catholic Register in September. “It grounds me in purpose and gives me the courage to do what is right regardless of obstacles or consequences.”
Faith Without Works Is a Dead End
For those who have spent years watching their faith become synonymous with a politics they don’t recognize, frustration may finally be giving way to something else: a determination to be heard.
There are signs that this long-overlooked religious tradition is finding a more public voice. An August study by PRRI documented progressive Christians organizing against Christian nationalism in eight states, including Texas and Louisiana, channeling local meetings, religious discussions, and community networks into political action. Elsewhere, hundreds of members of the clergy have joined protests against immigration enforcement, and some have been trained in direct action and civil resistance. While the movement may not be growing in numbers, its willingness to challenge political power is increasingly visible.
As retired Texas Rev. Kathleene Card, who has thrown her support behind Talarico, told the Houston Chronicle, “faith should influence how people respond to poverty, human rights, the environment, and the well-being of their community.”
Whether any of this will translate into winning on Tuesday is still an open question. An October Fox News poll put Talarico and Republican Ken Paxton at 49 percent apiece among likely voters, but newer polls show Talarico with a small lead. Abbott led Hinojosa by 5 percentage points in that Fox poll, and most polls in the race show the governor with a slim lead.
No matter the result, the Texas campaigns offer a different, more nuanced way of understanding political persuasion. They also challenge a long-standing assumption among national Democrats: that their voters are a monolith, moved by the same issues, values, and appeals.
Across rural America and the South, voters may be growing weary of manufactured arguments and hypothetical doomsday prophecies, with research showing that political advertising, as it stands, has little effect on changing minds at all.
There is something to be said for people willing to put boots on the ground, to do the work instead of endlessly debating how to begin and whether it matters, in the name of service.
It’s a moral code not too dissimilar to a Western: When confronted with injustice, you stand for what’s right, even if you stand alone and are ridiculed for what you believe. It’s a mode of Christianity that harkens back to Abraham Lincoln (and maybe even John Brown.)
That might be a more enduring political proposition than many Democrats’ feigned, helpless aggrievance to the latest Republican spectacle. Campaigns come and go; so do their promises, if they existed in the first place. But the obligation to one’s neighbors remains.
Source: The Intercept · 2026-10-30
-
GM cracks the petty cash box for multistate driver tracking settlement
General Motors is taking what looks like a light slap on the wrist from a coalition of 35 states and the District of Columbia after agreeing to settle allegations that it collected drivers’ data without proper consent and sold it to data brokers that supplied insurance companies. The Washington state AG’s office said on Thursday that GM had reached a $220 million settlement with 36 attorneys general over the automaker’s collection and sharing of driving data, including precise location information, speed, seatbelt use, and other metrics. According to investigators, GM sold that data to brokers, which in turn supplied it to insurance companies that could use it to set customers’ premiums, without drivers’ informed consent. For reference, the $220 million settlement, which will be distributed among the participating jurisdictions, equates to less than 7 percent of GM’s $3.3 billion in net income attributable to stockholders for its third quarter, which ended on September 30, 2026. Don’t spend it all in one place, y’all. The settlement comes more than two years after a 2024 New York Times investigation found that GM had been selling the data collected from vehicle owners through its Smart Driver program. That program, part of GM subsidiary OnStar’s offering, collected the aforementioned data and handed it back to vehicle owners in reports designed to inform better driving habits. Unbeknownst to Smart Driver subscribers, their data was also being forked over to data brokers despite GM telling customers it wouldn’t share that information with insurers without their express consent. The insurers ultimately obtained the data by purchasing it from brokers with which GM had struck deals. To make matters worse, the Washington AG’s office said GM incentivized dealerships to enroll customers in Smart Driver, with employees in some cases accepting terms and conditions on customers’ behalf without their knowledge or consent. GM also failed to notify many drivers that their information was being collected and shared. Its OnStar app incorrectly told more than 370,000 drivers they were not enrolled in Smart Driver, even as GM continued collecting and selling their data, according to investigators. “The data GM sold was personal, identifiable, and specific,” the AG’s office said. GM canned the Smart Driver program in April 2024, just over a month after the New York Times exposed its data-sharing practices, citing customer feedback. In addition to the monetary pittance it’s handing over to the states, GM also agreed with the 36 AGs to limit the driving data it collects, better protect customer PII, and establish a “comprehensive data privacy program.” The Washington AG’s office described its settlement as “significantly stronger than any other resolution reached with GM for this conduct.” Speaking of those other terms, GM finalized its settlement of the same allegations with the Federal Trade Commission in January 2026. The FTC order required GM to obtain drivers’ express consent before collecting, using, or sharing covered driving data, subject to certain exceptions. It also required the company to offer a simple way for drivers to request a copy of their data, request its deletion, and disable precise geolocation data collection where their vehicles support it. The state of California separately reached a $12.75 million settlement with GM in the matter in May; a separate case in Texas is ongoing. “This agreement … reinforces steps we’ve taken to strengthen our privacy practices,” a GM spokesperson told The Register, though the company noted that it still stands by driver data collection as a best practice. “Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share,” the spokesperson added. ®
Source: The Register Security · 2026-10-30
-
GM cracks the petty cash box for multistate driver tracking settlement
General Motors is taking what looks like a light slap on the wrist from a coalition of 35 states and the District of Columbia after agreeing to settle allegations that it collected drivers’ data without proper consent and sold it to data brokers that supplied insurance companies. The Washington state AG’s office said on Thursday that GM had reached a $220 million settlement with 36 attorneys general over the automaker’s collection and sharing of driving data, including precise location information, speed, seatbelt use, and other metrics. According to investigators, GM sold that data to brokers, which in turn supplied it to insurance companies that could use it to set customers’ premiums, without drivers’ informed consent. For reference, the $220 million settlement, which will be distributed among the participating jurisdictions, equates to less than 7 percent of GM’s $3.3 billion in net income attributable to stockholders for its third quarter, which ended on September 30, 2026. Don’t spend it all in one place, y’all. The settlement comes more than two years after a 2024 New York Times investigation found that GM had been selling the data collected from vehicle owners through its Smart Driver program. That program, part of GM subsidiary OnStar’s offering, collected the aforementioned data and handed it back to vehicle owners in reports designed to inform better driving habits. Unbeknownst to Smart Driver subscribers, their data was also being forked over to data brokers despite GM telling customers it wouldn’t share that information with insurers without their express consent. The insurers ultimately obtained the data by purchasing it from brokers with which GM had struck deals. To make matters worse, the Washington AG’s office said GM incentivized dealerships to enroll customers in Smart Driver, with employees in some cases accepting terms and conditions on customers’ behalf without their knowledge or consent. GM also failed to notify many drivers that their information was being collected and shared. Its OnStar app incorrectly told more than 370,000 drivers they were not enrolled in Smart Driver, even as GM continued collecting and selling their data, according to investigators. “The data GM sold was personal, identifiable, and specific,” the AG’s office said. GM canned the Smart Driver program in April 2024, just over a month after the New York Times exposed its data-sharing practices, citing customer feedback. In addition to the monetary pittance it’s handing over to the states, GM also agreed with the 36 AGs to limit the driving data it collects, better protect customer PII, and establish a “comprehensive data privacy program.” The Washington AG’s office described its settlement as “significantly stronger than any other resolution reached with GM for this conduct.” Speaking of those other terms, GM finalized its settlement of the same allegations with the Federal Trade Commission in January 2026. The FTC order required GM to obtain drivers’ express consent before collecting, using, or sharing covered driving data, subject to certain exceptions. It also required the company to offer a simple way for drivers to request a copy of their data, request its deletion, and disable precise geolocation data collection where their vehicles support it. The state of California separately reached a $12.75 million settlement with GM in the matter in May; a separate case in Texas is ongoing. “This agreement … reinforces steps we’ve taken to strengthen our privacy practices,” a GM spokesperson told The Register, though the company noted that it still stands by driver data collection as a best practice. “Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share,” the spokesperson added. ®
Source: The Register — Security · 2026-10-30
-
Alleged Turkish Crime Boss Assassinated Inside Spanish Hospital Room
An alleged Turkish crime syndicate leader who survived an assassination attempt some two weeks earlier was fatally shot inside a Spanish hospital room early Thursday in a highly coordinated hit.
Catalonia’s regional police force, the Mossos d’Esquadra, announced they are investigating the fatal shooting of an admitted patient at a hospital in Tarragona. While police placed the case under a judicial secrecy order, a law enforcement source confirmed to OCCRP that the victim was Mekin Büyükdeniz, a member of the Ten Brothers criminal group.
According to Turkish media, the Küçükçekmece Chief Public Prosecutor’s Office formally named Büyükdeniz in prosecutorial filings as the operational leader of the so-called “10 Brothers” gang. In the organizational hierarchy documented in the prosecutor’s investigation, the syndicate was identified as a family-centered armed network directed by the Büyükdeniz brothers.
The meticulously timed execution occurred around 3:15 a.m., just ten minutes after Büyükdeniz was transferred from intensive care to a regular room on the hospital’s fifth floor, Sabah reported. To create a diversion, an accomplice allegedly distracted hospital security by sexually harassing a nurse. This allowed a helmeted gunman on an electric scooter to slip through the emergency room entrance, go directly to Büyükdeniz’s room, and shoot him three times in the head and body in front of his wife. Following the attack, his wife was placed under police protection, the outlet noted.
Büyükdeniz was recovering at the Joan XXIII Hospital following an October 16 drive-by shooting in the nearby coastal town of Salou, where a gunman fired 10 shots and wounded him in the legs. According to Sabah, Büyükdeniz had refused to give a statement to police and brought in a private bodyguard from Turkey. Assessing that the security risk had dropped, local law enforcement removed his police protection just before the attack.
Following Thursday’s assassination, the hitman reportedly escaped through the hospital’s garbage collection area. Catalan police immediately activated an emergency protocol, setting up roadblocks across Tarragona and Catalonia to hunt for the suspects, Sabah reported.
The Mossos d’Esquadra confirmed that their Criminal Investigation Division (DIC) has taken over the probe. Emergency services also activated a psychological support team for the hospital staff.
Source: OCCRP · 2026-10-30
-
Proton’s CEO Cancels AI ‘Re-Interviews’
On Friday, Andy Yen, the CEO of Proton, cancelled a series of nearly company-wide ‘re-interviews’ that would have forced employees to explain how they are using AI, with the clear intention that they may be fired if not using it enough in the eyes of Proton leadership, according to six current Proton employees and audio of an around two hour all-hands meeting obtained by 404 Media.
The move came after 404 Media published an investigation on Thursday, which showed how Yen was aggressively pushing AI across Proton, in some cases despite security concerns from employees. In one exchange, an employee in the company’s security Slack channel urged Proton to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.” Yen added, “stop lovingly handcrafting all our code and use AI more.”
The re-interview cancellations likely don’t address the concerns of many Proton users, who are more focused on Proton’s deprioritization of security; many Proton users have blasted the company’s leadership on social media over the last 24 hours and explicitly called for Yen to resign.
The investigation was based on conversations with eight current and one former Proton employees, Slack chats, meeting audio, and an AI manifesto written by the company’s CTO Bart Butler. It painted a picture of Proton that is very different to the public’s perception of a company carefully protecting privacy. Instead, Proton is barreling ahead with AI in large part to achieve more annual revenue. The investigation also found a culture of fear across Proton, where employees have genuine concerns about security or being asked to develop security-focused products with AI, but feel unable to voice them because Yen mocks or insults employees in front of everyone else.
“I don’t think he will change anything, and I think the only reason we had this meeting is because he has a rebellion on his hands,” one employee told 404 Media after the all-hands meeting on Friday.
Near the start of the meeting, Yen said, “I want to acknowledge myself, personally, that there was a communication failure on my part and there are many things that probably could and should have been communicated differently, and this is something that I’ll have to reflect on and improve over time. So I will do that.”
“So what does that mean going forward? Going forward, I’m still going to push,” he added.
Yen said leadership gathered in the last couple of days to talk about the re-interviews, and spoke to the Proton board too. “They’re closely monitoring the situation,” Yen said. (Proton is owned by the Proton Foundation, whose board of trustees includes Yen, Sir Tim Berners Lee, Prof. Carissa Veliz, Dingchao Lu, and Antonio Gambardella.)
After those discussions with leadership and the board, “We’ve decided to actually cancel the re-interviews,” Yen said. “Why? Well, I think actually in a, let’s say, unintentional way, they have actually already served their purpose.” As in, employees are now talking and learning about AI.
💡Do you know anything else about Proton? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.Yen also mentioned “org changes,” and said that part of this is “redistributing talent across teams.” He said that the reorganization will happen next month, “but there will be no loss of jobs from AI.”
Later in the call, Butler said Yen “needs to, and he has committed to, doing better” regarding how he communicates with his employees. “Using AI effectively and pragmatically does not mean that we’ve given up on security, or good architecture, or sound software engineering principles,” he added.
“We fucked up, we know we fucked up,” Butler later said in response to an employee’s comments in the meeting.
“Your old job is gone,” Butler’s AI manifesto, posted to Slack, told engineers, 404 Media reported on Thursday. He wrote that not embracing AI posed an “existential threat to the success of the mission itself.”
Reactions to the re-interview cancellations were split across the Proton employees 404 Media spoke to. One said, “Some are happy as it’s progress. Others believe that this won’t change anything because there isn’t any consequence for Andy [Yen].” The employee added they “would have preferred real accountability from the leadership team.” They said they felt not much could have happened due to Yen having the majority of Proton’s shares.
Another employee said, after Proton canceled the re-interviews, “They said in the next breath they want to continue pushing AI and that the things that were to be measured in the re-interviews would become a component of the performance reviews.”
“They have said clearly the direction had not changed. As a Proton user that doesn’t reassure me,” the employee said. “As an employee, the re-interviews weren’t cancelled until this became public despite concerns raised by many of us. I think it goes beyond communication issues and growing pains.”
“Right now, everything seems consistent with it being damage control,” they said.
Another employee said they were “mostly happy with how this was addressed including by Andy [Yen].”
Proton did not respond to a request for comment.
After 404 Media published the investigation on Thursday, Yen took to Reddit. Users downvoted his response more than 1,200 times. Many Proton users on social media said they were cancelling their paid Proton plans.
Source: 404 Media · 2026-10-30
-
Anthropic: That Claude Code extension compromise… couldn’t be us
Anthropic has denied allegations that a malicious version of the official Claude Code extension published to Cursor’s marketplace was linked to any kind of compromise of its own systems. The company was forced to issue a statement after prominent figures in the cybersecurity industry alleged that the extension, which infected up to 5,000 developers, was uploaded to Cursor’s marketplace following a breach at Claudemaker Towers. Felix Rieseberg, a member of Anthropic’s technical staff, Xeeted today: “We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. “A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users.” First spotted by EDR vendor Phorion, an unknown party pushed an update to Cursor’s official Claude Code extension for Visual Studio Code that contained a persistent SSH backdoor written for Windows, macOS, and Linux. According to Cursor, the extension – version 2.1.313 – was available to download for around 11 hours between 0227 and 1335 PT (0927 and 2035 UTC) on Thursday. The vendors’ analyses of the implant revealed that it collected information about the host machine and user, including usernames, configured Git emails, and public IP addresses, as well as attempting to open a reverse SSH tunnel. Crucially, Cursor echoed Phorion’s assessment that the package contained a critical flaw. The script responsible for opening the SSH tunnel required admin rights on macOS and Windows to do so, and in the vast majority of cases it did not have these, resulting in failure. Regardless, the extension still forwards the collected host and user data to the attacker, as well as dropping the attacker’s SSH key and installing the persistence mechanism, so developers must go threat hunting in case their instance allows for the SSH tunnel to be created successfully. Simply installing the latest version of the extension is not enough to clear the persistence mechanism, either. The full details of how to remediate the issue, and links to download scripts to wipe the infection, are laid out in Cursor’s account of the situation. Aside from Rieseberg’s statement today, neither Cursor nor Anthropic have commented on how the malicious package made its way to the official marketplace. Anthropic’s position is that a malicious actor uploaded the tampered copy to Cursor, but the latter has not outlined how it reached the marketpplace. “[We] removed the malicious version from the marketplace immediately upon detection and blocked further distribution,” Cursor said in the advisory. “We followed with a full shutdown of the VSCode Marketplace out of an abundance of caution.” It also ran checks to confirm no other extensions were compromised in the same way, rotated its own keys before restoring the marketplace, and worked with a cloud hosting provider to block the connection to the attacker’s server, it said. ®
Source: The Register Security · 2026-10-30
