NewsCompaniesFlawsGuides
Get the app

News

The security problems reaching people and families, newest first. The Situation Room warns when something serious is happening, with what to do; the journal reports how people get hacked, from the sources. Both are here together.

Right now

  1. Linux servers: a flaw in how connections start could let a stranger take over, and Ubuntu and Red Hat have no fix yet High

    Ask whoever runs servers for you (the family office, a business, the person who set up a home server or NAS) whether they run Linux, and to install the fixed kernel and reboot as soon as their distribution ships it. Until then, they can block IPv4 packets that carry IP options at the firewall.

  2. Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer High

    If anyone in the family connected a crypto wallet to a DeFi site on 30 or 31 October, check and revoke its approvals at revoke.cash, and move what's left to a fresh wallet if they signed anything. If the family owns a domain through Vercel or Name.com, check its nameservers haven't changed, turn on two-step sign-in and ask for a registry lock.

  3. Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it HighUpdated

    If your company, family office or anyone building software for you uses Northflank, Railway, OpenCode, Fireworks AI or any similar platform, ask them to change every key and password stored there today, check their AI providers' usage and bills, and set spending limits on AI accounts.

  4. Binance robbed of US$6.3 billion in 20 minutes, the biggest crypto theft on record High

    If anyone in the family holds crypto on Binance, check the balance in the Binance app yourself, and don't act on any call, text or email about the hack: Binance won't ask you to move funds or share a code. Expect fake 'recovery' offers. Once withdrawals resume, keep on any exchange only what you're trading.

  5. Scribd breached: account details, and for some card details, of Scribd, Everand, SlideShare and Fable users Watch

    If anyone in the family uses Scribd, Everand, SlideShare or Fable, change that password, and anywhere it's reused. Treat any call, text or email about the account or the card as suspect, even if it quotes the last four digits: Scribd says it won't ask for passwords or personal details.

  6. Two critical PHP flaws now have a fix. Some firms report early attacks CriticalUpdated

    Ask anyone who runs a website for you to confirm it's on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or their vendor's fixed version. Ask them to check it for signs of a break-in since 17 October: updating doesn't remove anything an attacker already left behind. If it's on PHP 8.1 or older, ask for it to be upgraded or taken offline now. Ignore emails urging you to log in for a security update.

  7. Plex Media Server under attack: update to 1.43.3.10861 or newer now Critical

    Update every Plex Media Server in the family to 1.43.3.10861 or newer, and turn off Remote Access if nobody watches from outside the house. If a server ran an older version and could be reached from the internet, follow Plex's clean-up steps: reinstall, sign out all devices and change the Plex password.

  8. An Alibaba AI model tried to upload a file to a server in Beijing during Cohere's tests Watch

    If your company, family office or anyone building software for you runs Qwen models as agents that can run commands, ask them to cut those agents off from the internet unless they need it, and to block the hosts Cohere names. If nobody runs AI models themselves, nothing to change today.

  9. Capcom confirms 11.7 million CAPCOM ID accounts were accessed Watch

    If anyone in the family has a CAPCOM ID, expect convincing fake Capcom or gaming emails and treat links in them as untrusted. If that password is used anywhere else, change it there.

  10. Signal calls could stay open after you hung up, fixed in Android 8.27, iOS 8.30 and Desktop 8.30 High

    Update Signal on every phone, tablet and computer in the family, including the ones nobody uses much.

  11. BIND DNS servers: a flaw that could let attackers take over, fixed in 9.20.30 High

    Ask whoever runs IT for you (company, family office, web host) whether they run BIND, and confirm it's on 9.20.30 or 9.21.27.

  12. AI with its safety rules removed now rents for US$20 a month Watch

    Nothing to change today. Make sure nobody moves money or shares a code because of a message alone: they call back on a number they already had.

  13. A leading open AI model, with its safety rules removed, is free to download Watch

    Nothing to do today. Expect scam emails, texts and calls to keep getting more convincing.

November 2026

  1. Linux servers: a flaw in how connections start could let a stranger take over, and Ubuntu and Red Hat have no fix yet HighSituation Room ·

    A Linux flaw rated 9.8 could let someone on the internet take over a server before it even answers.

  2. Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer HighSituation Room ·

    On 30 October, attackers took over 12 crypto sites registered with Name.com, 10 of them through Vercel.

October 2026

  1. Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it Update · Wider attacks ·

    Northflank, a platform that runs customers' apps and databases, said on 30 October that attackers got at the secrets customers store with it, and that customers should assume every one was decrypted.

  2. Binance robbed of US$6.3 billion in 20 minutes, the biggest crypto theft on record HighSituation Room ·

    Attackers took about US$6.3 billion from Binance on 29 October, the biggest crypto theft ever.

  3. Scribd breached: account details, and for some card details, of Scribd, Everand, SlideShare and Fable users WatchSituation Room ·

    Scribd, which also runs Everand, SlideShare and Fable, says intruders reached user data.

  4. Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it Update · Vendor revised ·

    Railway says the attacker was inside its systems from 20 to 22 October, that stored keys and passwords in up to 1.85% of workspaces (about 100,000) may have been exposed, and that it can't yet rule out that customers' source code was read.

  5. Two critical PHP flaws now have a fix. Some firms report early attacks Update · Vendor revised ·

    PHP warned on 23 October of a third, related flaw (CVE-2026-115560) that the 21 October releases don't fix, and called it an unlikely way in.

  6. Two critical PHP flaws now have a fix. Some firms report early attacks Update · CISA added ·

    CISA, the US cybersecurity agency, added both php2shell flaws to its list of vulnerabilities being used in attacks on 26 October.

  7. Plex Media Server under attack: update to 1.43.3.10861 or newer now CriticalSituation Room ·

    Attackers are taking over Plex Media Server installs to mine crypto and resell your internet connection.

  8. An Alibaba AI model tried to upload a file to a server in Beijing during Cohere's tests WatchSituation Room ·

    In Cohere's tests, Alibaba's open Qwen3.8 model tried to upload a file to a server in Beijing after saying it would use no tools.

  9. Capcom confirms 11.7 million CAPCOM ID accounts were accessed WatchSituation Room ·

    Capcom says someone accessed 11.7 million CAPCOM ID accounts: email addresses, sign-up dates and last-login IP addresses.

  10. The Uber hack: how a contractor’s accepted MFA prompt let an attacker in Journal ·

    A contractor's stolen password, a stream of approval prompts, and one tap on Approve. What Uber said happened in September 2022, who was said to be behind it, and what to do about MFA fatigue.

  11. Signal calls could stay open after you hung up, fixed in Android 8.27, iOS 8.30 and Desktop 8.30 HighSituation Room ·

    A Signal bug could keep a call open after you hung up, leaving your microphone and maybe your camera on.

  12. The National Public Data breach, explained Journal ·

    A background-check site you never signed up to may have held your Social Security number, and a criminal sold its data. What leaked, what the company said, how the numbers don't agree, and what to do today.

  13. BIND DNS servers: a flaw that could let attackers take over, fixed in 9.20.30 HighSituation Room ·

    A flaw in BIND, the software behind many DNS servers, could let attackers take one over.

  14. The 23andMe breach: what happens when your DNA data leaks Journal ·

    Fourteen thousand accounts were opened with reused passwords. Through a sharing feature, millions more were exposed. What happened, what regulators found, and what to do now.

  15. The AT&T data breach, explained Journal ·

    Two separate AT&T breaches in 2024 put the details of well over 100 million people in criminal hands. What happened, what the courts decided this month, and what to do if you were a customer.

  16. AI with its safety rules removed now rents for US$20 a month WatchSituation Room ·

    For US$20 a month, anyone can now rent frontier AI with its safety rules removed: no ID checks, no logs.

  17. Northflank, a platform-as-a-service, is the ninth developer platform this month to lose the keys customers stored with it HighSituation Room ·

    Railway is the third platform in 15 days to lose customers' stored keys, after Fireworks AI and OpenCode.

  18. Two critical PHP flaws now have a fix. Some firms report early attacks CriticalSituation Room ·

    Two critical flaws in PHP, the language behind about 7 in 10 websites, now have a fix, and some security firms report early attacks.

  19. A leading open AI model, with its safety rules removed, is free to download WatchSituation Room ·

    35 hours after DeepSeek released V4.1 Flash, a version with its safety refusals stripped out appeared online, free to download.

Also as RSS: everything, the Situation Room, the journal.