Zack Whittaker

Security editor, TechCrunch
Email: [email protected]
Signal: zackwhittaker.1337
New York, NY

Public Key

npub1tnd8wwd5ux624dj36094wh9ax9utku8ahnxk4d367e9tlpg458qqvay0nr

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs9eknh8x6wrd92kega8j6htj7nz79mwr7ment2kca0vj4ls526rsqpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qwgv789

Publishing to

relay.ditto.pub

Author Public Key

npub1tnd8wwd5ux624dj36094wh9ax9utku8ahnxk4d367e9tlpg458qqvay0nr

Show more details

Last Notes

2026-05-12 17:04:19 UTC

New: Google has a new Android security feature for Pixel phones to help uncover spyware attacks.
The feature, dubbed Intrusion Logging, records errors and collects evidence when something goes wrong with the software, with the aim of providing visibility into suspected spyware attacks.
https://techcrunch.com/2026/05/12/google-launches-new-android-security-feature-to-help-uncover-spyware-attacks/

2026-05-12 15:41:03 UTC

Looks like hackers/scammers/asshats are abusing Microsoft's systems to send out crude phishing messages as two-factor emails.
Emails are sent from msonlineservicesteam@microsoftonline[.]com, which is a legitimate Microsoft email used to send out about account notifications, and look like this.
https://files.mastodon.social/media_attachments/files/116/562/355/988/416/854/original/6bd8200b17e0a93a.png
https://files.mastodon.social/media_attachments/files/116/562/356/033/300/617/original/7f0198d1a59491c8.png

2026-05-11 13:07:02 UTC

In this 3,000+ word deep-dive for my blog and newsletter ~ this week in security ~ I explore the most pressing threats to face the internet this year. This includes surveillance and choking online access to governments going rogue, and more, and why they pose a risk.
https://this.weekinsecurity.com/the-most-dangerous-threats-to-the-internet-in-2026/

2026-05-09 22:16:58 UTC

Edtech giant Instructure was hacked (twice) — and finally put up a security incident page after the mass-defacement of Canvas school login pages.
But you might not find the page because right now it has a "noindex" tag in the page's HTML code, which prevents it from being listed in search results.
The page is here, FYI: https://www.instructure.com/incident_update

2026-05-08 14:47:10 UTC

What did you (or someone you know) do this week that you're incredibly proud of?

2026-05-07 15:17:04 UTC

Police arrested three men accused of driving around an SMS blaster across downtown Toronto, which allegedly blasted tens of thousands of phones with spammy text messages over several months.
https://techcrunch.com/2026/05/07/police-arrest-sms-blaster-crew-that-sent-malicious-messages-to-thousands-across-toronto/

2026-05-06 18:24:39 UTC

A U.S. court sentenced a member of a Russian ransomware gang to 8+ years in prison.
Prosecutors said the Karakurt gang "fueled corruption" in the Russian government, and relied on access to Russian government databases to intimidate its victims. Russian officials allowed the gang to avoid paying tax and dodge the military draft.
(h/t @nprofile…f33n)
https://techcrunch.com/2026/05/06/doj-says-ransomware-gang-tapped-into-russian-government-databases/

2026-05-06 16:11:14 UTC

I heard more from Disc-Soft, the maker of Daemon Tools, which was backdoored by suspected Chinese-language hackers and used to compromise thousands of users.
Disc-Soft tells me the backdoor was "limited to the free DAEMON Tools Lite" and v12.6 removes the backdoor; investigation ongoing.
My earlier story: https://techcrunch.com/2026/05/05/kaspersky-suspects-chinese-hackers-planted-a-backdoor-into-daemon-tools-in-widespread-attack/

2026-05-06 13:53:18 UTC

This cracks me up because kids just think up these things so brilliantly, but also this proves that age verification laws are complete dogshit and don't even work.
https://techcrunch.com/2026/05/06/some-kids-are-bypassing-age-verification-checks-with-a-fake-mustache/

2026-05-06 11:21:17 UTC

- reply

@nprofile…vuvh this is so freaking cool to see, Tinker. amazing community vibes.

2026-05-05 15:25:16 UTC

NEW: Kaspersky says hackers planted and activated a backdoor in the popular Windows disk imaging app Daemon Tools a month ago, infecting thousands of computers around the world in a n ongoing, "widespread" attack.
The attack appears to be ongoing. A representative for Disc Soft, which makes Daemon Tools, said it was aware of Kaspersky's report and was investigating.
This is the latest supply chain attack targeting software used by a large number of people.
https://techcrunch.com/2026/05/05/kaspersky-suspects-chinese-hackers-planted-a-backdoor-into-daemon-tools-in-widespread-attack/

2026-05-05 01:02:38 UTC

By me: I'm suing the U.S. government under the Freedom of Information Act.
https://this.weekinsecurity.com/plot-twist-i-am-suing-the-justice-department-and-fbi

2026-05-04 11:04:36 UTC

Excellent reporting, alarming findings. Bloomberg's @nprofile…kj6p et al found U.S. state government health websites are sharing people's personal info (sex, citizenship & race data) with tech giants via pixel-sized webpage trackers. Several states pulled the trackers after Bloomberg disclosed.
ALWAYS USE AN AD-BLOCKER. But really!
https://www.bloomberg.com/features/2026-healthcare-advertising-trackers-privacy/
https://files.mastodon.social/media_attachments/files/116/515/976/653/674/081/original/1a8d2e5a2585b1ee.png

2026-05-04 10:45:40 UTC

- reply

@nprofile…ydzz a malicious screensaver?! what is this, 1997?

2026-05-03 11:29:56 UTC

Busy week? Need to catch up with all the cyber news? I got you covered!
My weekly cyber newsletter https://this.weekinsecurity.com has all the big news, analysis, breaches, hacks, and attacks you need to know. Plus, every week there's good news in the happy corner, and a reader-submitted featured cyber cat. 🐈‍⬛
No email tracking. Sign up/RSS. Out Sundays. (The latest issue goes out later today!)

2026-05-02 12:06:11 UTC

For my blog and newsletter, I wrote about a growing trend of regular consumers finding security bugs, flaws, and data leaks but having no way to report them to the companies.
In this blog, I make the case why *every* organization should make it easy for anyone to alert them to security issues. You might also avoid getting an alarming email from an inquiring reporter like me...
Thanks for sharing! ❤️
Read: https://this.weekinsecurity.com/why-every-organization-should-make-it-easy-to-report-security-flaws/
Sign up/RSS for my weekly newsletter: https://this.weekinsecurity.com

2026-04-30 19:40:47 UTC

NEW: Hackers are exploiting a bug in the popular web server administrator software cPanel and WHM, used in millions of websites around the world.
The bug allows hackers to bypass login screens and gain full server access. One web host said they've seen evidence of attacks dating back to February.
https://techcrunch.com/2026/04/30/hackers-are-actively-exploiting-a-bug-in-cpanel-used-by-millions-of-websites/

2026-04-29 13:44:47 UTC

New, by me: The Sri Lankan government was hit by not one, but *at least* two suspected business email compromise attacks that redirected some $3 million in payments to the bank accounts of hackers. Australia reportedly said it's missing a payment from Sri Lanka, too.
https://techcrunch.com/2026/04/29/sri-lanka-discloses-another-missing-payment-days-after-hackers-stole-2-5m-from-its-finance-ministry/

2026-04-25 13:39:01 UTC

Deluged by an endlesss stream of cyber headlines? My free weekly newsletter https://this.weekinsecurity.com serves up all the cyber news from the week that you need to know but might've missed. Also includes the happy corner of good news, and a reader-submitted cyber cat. 🐈‍⬛
Out Sundays! Sign up/RSS:

2026-04-24 00:58:22 UTC

Your doctor or therapist might be using AI recording to transcribe your patient notes. Two privacy experts have nine good reasons why you should decline and opt-out.
Some words by me: https://this.weekinsecurity.com/why-your-doctors-ai-recorder-can-be-bad-for-your-health-and-privacy/

2026-04-23 11:43:46 UTC

I'll save you a click, but toy maker giant Hasbro is *still* down after a cyberattack on March 28. The company said in an 8-K filing today that the "unauthorized access has been contained and the Company is making progress in fully restoring its systems and operations."
https://www.sec.gov/ix?doc=/Archives/edgar/data/46080/000004608026000016/has-20260423.htm

2026-04-22 15:41:37 UTC

New: Cosmetics giant Rituals has confirmed a data breach involving its customer membership database. Won't say how many customers had personal information stolen (names, addresses, phone numbers, and more) but its website says it has 41M+ total customers.
Breach affects EU, UK and US customers.
https://techcrunch.com/2026/04/22/cosmetics-giant-rituals-confirms-data-breach-of-customer-membership-records/

2026-04-22 14:17:43 UTC

U.K. intelligence says at least 100 countries now have access to government spyware, up from around 80 countries in 2023. The rise shows that spyware continues to proliferate and that the bar to obtaining spyware is lower.
https://techcrunch.com/2026/04/22/uk-government-says-100-countries-have-spyware-that-can-hack-peoples-phones/

2026-04-22 11:01:17 UTC

So... Anthropic spent weeks claiming that it couldn't publicly release its Mythos AI model because of its alleged offensive hacking capabilities and.... some AI nerds from Discord just found it and accessed it? Anthropic is a fucking joke. https://www.bloomberg.com/news/articles/2026-04-21/anthropic-s-mythos-model-is-being-accessed-by-unauthorized-users
https://files.mastodon.social/media_attachments/files/116/448/005/664/062/992/original/f9deb4fa7bd1acba.png

2026-04-20 18:35:28 UTC

Major alarm bells over this. Bessent wants US banks to require customers send in copies of their passports etc. to prove citizenship, which would be far beyond the know-your-customer checks that they're required to do already. Implies this could result in closing bank accounts over non-compliance.
https://www.cnbc.com/2026/04/15/banks-citizenship-data-collection-customer-accounts.html

2026-04-20 17:01:13 UTC

- reply

A spokesperson for Vercel told me that the company has not received any communication from the threat actor, such as a demand for ransom. No word yet on the number of Vercel customers affected, though. (I asked.)
https://techcrunch.com/2026/04/20/app-host-vercel-confirms-security-incident-says-customer-data-was-stolen-via-breach-at-context-ai/

2026-04-20 14:49:29 UTC

NEW by me: Cloud app host Vercel says it was hacked and that some customers' data was taken.
Vercel blames an earlier breach at Context AI (*unrelated to OpenAI). Hackers allegedly used their access in March to hack a Vercel employee, who had linked a Context AI app to their work account.
https://techcrunch.com/2026/04/20/app-host-vercel-confirms-security-incident-says-customer-data-was-stolen-via-breach-at-context-ai

2026-04-19 11:35:09 UTC

Here is Toby "helping" me write this week's edition of my cybersecurity newsletter. Sign up before it goes out later this morning! https://this.weekinsecurity.com
https://files.mastodon.social/media_attachments/files/116/431/159/656/360/677/original/28c2563cfdada297.jpeg

2026-04-17 14:05:39 UTC

I wrote some words for TechCrunch about Section 702, the U.S. government's warrantless surveillance law that is set to expire on Monday.
A bipartisan pro-privacy group of lawmakers are calling for passing major reforms that they say are “essential” for protecting the privacy rights of Americans.
But even if the spy law expires, a quirk in the law means the government's spy powers will not automatically lapse.
Read more: https://techcrunch.com/2026/04/17/with-us-spy-laws-set-to-expire-lawmakers-are-split-over-protecting-americans-from-warrantless-surveillance/

2026-04-17 13:21:24 UTC

Embarrassing times for the European Commission after security researchers found flaws within minutes of using its age verification app. https://www.politico.eu/article/eu-brussels-launched-age-checking-app-hackers-say-took-them-2-minutes-break-it/
(ICYMI: I have a blog post on why age verification laws are a bad idea to begin with: https://this.weekinsecurity.com/papers-please-age-verification-laws-threaten-everyones-online-security-and-privacy/)

2026-04-16 13:19:22 UTC

NEW, by me: Fashion retailer Express exposed customers' personal information and order details to the web for anyone to view. Some customer order pages had already been listed in search engine results.
The bug is now fixed after we alerted the company, but wouldn't say if it would notify customers.
https://techcrunch.com/2026/04/16/fashion-retailer-express-left-customers-personal-data-and-order-details-exposed-to-the-internet/

2026-04-15 14:29:42 UTC

NEW, by me: Sweden has blamed Russian government-linked hackers for attempting a destructive cyber attack on a thermal plant in western Sweden in 2025.
The cyberattack failed, but it's the latest in a string of Russia-linked incidents targeting critical infrastructure in Europe in recent years.
https://techcrunch.com/2026/04/15/sweden-blames-russian-hackers-for-attempting-destructive-cyberattack-on-thermal-plant/

2026-04-15 02:35:33 UTC

Theo hard at work in the biscuit factory. Have a peaceful evening, everyone.
https://files.mastodon.social/media_attachments/files/116/406/388/601/409/650/original/29c0f70894ea63b2.jpeg

2026-04-14 14:40:41 UTC

New, by me: Adobe has fixed a bug in its flagship PDF readers that hackers have been abusing for at least four months to break into people's Windows and macOS computers and steal data.
A security researcher who discovered the hacks said it works by tricking victims into opening a malicious PDF.
https://techcrunch.com/2026/04/14/adobe-fixes-pdf-zero-day-security-bug-that-hackers-have-exploited-for-months/?utm_source=dlvr.it&utm_medium=mastodon

2026-04-13 14:49:54 UTC

New, by me: Rockstar Games has confirmed it is one of the companies affected by a hack at Anodot.
https://techcrunch.com/2026/04/13/hack-at-anodot-leaves-over-a-dozen-breached-companies-facing-extortion/

2026-04-10 17:12:05 UTC

In some rare(?) good news, the developers of VeraCrypt and WireGuard have both told me that they have regained access following their Microsoft account lockouts and can now release updates again.

2026-04-10 14:46:20 UTC

New: France said it plans to move its government computers currently running Windows to the open-source operating system Linux to further reduce its reliance on U.S. technology.
https://techcrunch.com/2026/04/10/france-to-ditch-windows-for-linux-to-reduce-reliance-on-us-tech/

2026-04-09 12:19:56 UTC

Since North Korea has been in the news thanks to two massive hacks just days apart, I'm re-sharing my long-read primer on the ongoing and major threat from North Korean hackers, what they do, how they do it, and why they're incredibly successful — so much so that they could even be your co-worker.
https://this.weekinsecurity.com/thousands-of-north-koreans-have-secretly-infiltrated-us-and-european-companies-as-remote-it-workers/

2026-04-08 21:51:55 UTC

New, by me at TechCrunch: The developer of the widely popular Wireguard VPN says he is also unable to ship software updates to Windows users after Microsoft locked his account, marking the second high-profile app developer (VeraCrypt) in the past few weeks to face this issue.
https://techcrunch.com/2026/04/08/wireguard-vpn-developer-cant-ship-software-updates-after-microsoft-locks-account/

2026-04-08 15:22:15 UTC

New, by me: Mounir Idrassi, the developer of the popular file encryption software Veracrypt, says Microsoft has locked his account used for sending software updates, and warned that Windows users who encrypt their PCs with his software may soon find it "impossible to boot," Idrassi tells me.
https://techcrunch.com/2026/04/08/veracrypt-encryption-software-windows-microsoft-lock-boot-issues/

2026-04-07 20:01:25 UTC

New, by me: A U.S. government advisory published Tuesday says Iran-backed hackers have escalated tactics and are now targeting American critical infrastructure systems with the aim of causing "disruptive effects within the United States."
https://techcrunch.com/2026/04/07/iranian-hackers-are-targeting-american-critical-infrastructure-u-s-agencies-warn/

2026-04-07 17:24:50 UTC

It's incredibly bleak out there in the world today but I will take a little solace in just how soft and fuzzy my large adult cat son is.
https://files.mastodon.social/media_attachments/files/116/364/586/343/093/144/original/0c68be4069b6db88.jpeg

2026-04-07 13:05:08 UTC

For my blog ~ this week in security ~ I wrote about how hacks, cyberattacks, and data breaches are almost *never* the employee's fault — even if the companies say so.
Read online: https://this.weekinsecurity.com/that-big-company-hack-probably-was-not-an-employees-fault/
Sign up for my weekly newsletter: https://this.weekinsecurity.com

2026-04-06 17:01:02 UTC

I wrote some words for TechCrunch about how North Korean hackers took weeks to hack the top developer of one of the web's most popular open-source projects, Axios. Increasingly difficult to defend against well-resourced and persistent hackers when you're a small team or lone developer.
https://techcrunch.com/2026/04/06/north-koreas-hijack-of-one-of-the-webs-most-used-open-source-projects-was-likely-weeks-in-the-making/

2026-04-06 13:10:33 UTC

NEW, by me: pcTattletale founder Bryan Fleming has avoided a jail term after earlier pleading guilty to making, selling, and advertising spyware for unlawful purposes. pcTattletale was used to stealthily spy on thousands of people's devices without their knowledge, and shut down after a data breach in 2024 exposed the stolen personal data of countless victims.
Fleming is the first spyware maker convicted in the U.S. in over a decade.
https://techcrunch.com/2026/04/06/convicted-spyware-maker-bryan-fleming-avoids-jail-at-sentencing/

2026-04-02 21:28:29 UTC

New, by me: Telehealth giant Hims & Hers confirmed its customer service ticketing system was hacked. A spokesperson said it was a social engineering attack. The hacker stole mostly customer support tickets, including customer names and contact information, but also the contents of customer requests.
https://techcrunch.com/2026/04/02/telehealth-giant-hims-hers-says-its-customer-support-system-was-hacked/

2026-04-02 16:33:43 UTC

New, by me: A popular Canadian money transfer app exposed thousands of driver's licenses and passports to the open web. Anyone with a link was able to view the data in their browser.
The data goes back to September 2020, and was updating daily until the server was secured this week.
https://techcrunch.com/2026/04/02/canadian-money-transfer-app-duc-expose-drivers-licenses-passports-amazon-server/

2026-04-02 15:48:07 UTC

Big news: ICE now has spyware, the agency's acting director confirms.
https://techcrunch.com/2026/04/02/ice-says-it-bought-paragons-spyware-to-use-in-drug-trafficking-cases/

2026-04-01 14:52:13 UTC

Not a joke: Hasbro was hacked. The American toymaking giant said in an SEC filing that it may take weeks for it to recover. Much of the company's website appears down.
https://techcrunch.com/2026/04/01/hasbro-hacked-may-take-several-weeks-to-recover/

2026-03-31 17:48:28 UTC

Google has now linked the hack and hijack of the popular Axios npm open-source project to North Korea (UNC1069), which is known for stealing cryptocurrency.
Axios is downloaded tens of millions of times weekly, so this hack is likely widespread.
Our updated story: https://techcrunch.com/2026/03/31/hacker-hijacks-axios-open-source-project-used-by-millions-to-push-malware?nocache=1

2026-03-31 14:57:09 UTC

NEW: Medical data giant CareCloud says hackers had access to one of its six environments that stores patients’ electronic health records for around eight hours during a March 16 cyberattack.
CareCloud is used by 45,000 doctors, physicians, and therapists to store data on millions of patients.
I asked CareCloud if it stores patients' data across its six environments, or if some of the environments store backups of the others. This may determine how large the breach is.
https://techcrunch.com/2026/03/31/carecloud-breach-hackers-accessed-patients-medical-records-ehr/

2026-03-31 12:15:26 UTC

Today is International Trans Day of Visibility. Sending my love, support, and solidarity to all my trans and non-binary friends. 🏳️‍⚧️❤️

2026-03-30 15:38:24 UTC

There have been at least a couple of cases this year where FBI and HSI/ICE agents have obtained records from Apple that have revealed the real-world identities of its customers who used its "Hide My Email" feature.
This feature hides your email from apps and websites, but not from inquiring police.
https://techcrunch.com/2026/03/30/apple-will-hide-your-email-address-from-apps-and-websites-but-not-cops

2026-03-27 15:41:28 UTC

NEW: Hackers have leaked a portion of FBI director Kash Patel's emails online, confirming Reuters.
TechCrunch has verified that at least portion of the leaked emails from Patel's Gmail account were authentic by verifying cryptographic signatures contained in the emails.
w/ @nprofile…ynf4:
https://techcrunch.com/2026/03/27/iranian-hackers-claim-breach-of-fbi-director-kash-patels-personal-email-account/

2026-03-26 12:39:58 UTC

For my newsletter and blog ~ this week in security ~ I wrote about meaningful steps you can take to ensure your digital security and privacy while traveling through airports. In this post, you'll find resources to understand the risks you face, and what you can do to protect your data.
Please share! https://this.weekinsecurity.com/security-precautions-to-consider-while-traveling-through-airports/
You can also sign up for my free weekly newsletter (via email or RSS). Out Sundays! https://this.weekinsecurity.com

2026-03-25 16:52:09 UTC

In at least six instances identified by TechCrunch, first responders have had to take control of Waymo vehicles and move them out of traffic during emergency situations.
https://techcrunch.com/2026/03/25/waymo-relies-on-firefighters-and-police-to-bail-out-stuck-robotaxis/

2026-03-25 14:23:18 UTC

Good reporting from NPR on how U.S. federal agencies are simply buying people's private information and location data to use in investigations — without getting warrants.
https://www.npr.org/2026/03/25/nx-s1-5752369/ice-surveillance-data-brokers-congress-anthropic

2026-03-25 13:03:34 UTC

Loved this blog by @nprofile…m9eu and Jan Strozyk reflecting 10 years on from the Panama Papers, and how nerds in the newsroom who knew (or learned!) how to script, scrape, and build tools helped to transform modern journalism. Nowadays, handling and parsing data is an indispensable skill.
https://buttondown.com/readwrite/archive/edition-12-on-the-panama-papers-ten-years-later/

2026-03-25 12:32:43 UTC

Almost exactly four months ago, I wrote about how the Trump administration was preparing to ban TP-Link routers, citing the company's alleged links to China. Now, the FCC has decided to ban *all* new models of foreign-made routers, even though many U.S.-made routers are also full of security flaws.
https://this.weekinsecurity.com/banning-tp-link-wont-save-america-from-its-own-terrible-cybersecurity/

2026-03-24 15:02:01 UTC

The FCC ban will affect the import of all new, foreign-made consumer routers, according to the agency's chair Brendan Carr. But the FCC did not provide evidence to show that U.S.-made consumer routers are more secure than routers developed overseas.
https://techcrunch.com/2026/03/24/fcc-bans-import-of-new-consumer-routers-made-overseas-citing-security-risks/

2026-03-23 20:44:31 UTC

NEW: Someone has publicly leaked an exploit toolkit called DarkSword, which allows any hacker or cybercriminal to easily hack iPhones and iPads running iOS 18.
Apple said it is aware & has issued patches. Security researchers have already tested the code as working.
w/ @nprofile…ynf4: https://techcrunch.com/2026/03/23/someone-has-publicly-leaked-an-exploit-kit-that-can-hack-millions-of-iphones/

2026-03-23 19:13:04 UTC

New, by me: Russian authorities say they have blocked access to Archive.today, a popular paywall removal site.
The sites appear blocked when I checked earlier (thanks @nprofile…3peu for flagging), but was still able to access the sites from other devices and networks.
https://techcrunch.com/2026/03/23/russian-authorities-block-paywall-removal-site-archive-today/

2026-03-23 15:06:02 UTC

Federal immigration officers have been seen at several U.S. airports on Monday after the Trump administration said it would deploy ICE agents to ease security lines amid an ongoing partial government shutdown. Plainclothed agents were filmed making at least one arrest in San Francisco's Airport.
https://techcrunch.com/2026/03/23/federal-immigration-agents-filmed-making-airport-arrests-as-trump-calls-in-ice-to-ease-security-line-delays/

2026-03-23 14:24:10 UTC

"For years almost all the traffic cameras in Tehran had been hacked and the information transferred to servers in Israel. At least one camera was at an angle that allowed Israel to track daily movements of people, such as where they parked their cars near Iran’s leadership compound."
https://www.seattletimes.com/business/iran-built-a-vast-camera-network-to-control-dissent-israel-turned-it-into-a-targeting-tool/

2026-03-20 15:04:47 UTC

New, by me: A cyberattack on a vehicle breathalyzer company called Intoxalock has left drivers across the United States stranded and unable to start their cars.
https://techcrunch.com/2026/03/20/cyberattack-on-vehicle-breathalyzer-company-leaves-drivers-stranded-across-the-us/

2026-03-18 16:58:02 UTC

FBI director Kash Patel confirms the FBI is buying location data and histories that can be used for tracking people. It's the first time in recent years that the FBI has said it's actively buying this information, without needing a warrant.
https://www.politico.com/news/2026/03/18/fbi-buying-data-track-people-patel-00834080

2026-03-07 14:32:13 UTC

In 2025, I found 3 popular apps leaking sensitive user data thanks to simple security bugs. In this *very* deep-dive for subscribers, this is how I use network analysis tools (like Burp) to understand how apps and websites work & share your data — and how you can, too!
I explain how to get started with Burp and similar browser tools, we'll explore API basics, how to understand network requests, and how to get started. I'll also include examples for you to follow along.
https://this.weekinsecurity.com/a-beginners-guide-burp-suite-analyzing-network-traffic-of-apps-and-websites/

2026-03-05 17:56:53 UTC

Meta is facing a new lawsuit over its AI smart glasses, after a news investigation found subcontractors are reviewing footage from customers' glasses, which "included sensitive content, like nudity, people having sex, and using the toilet."
https://techcrunch.com/2026/03/05/meta-sued-over-ai-smartglasses-privacy-concerns-after-workers-reviewed-nudity-sex-and-other-footage/

2026-03-04 19:15:37 UTC

U.S. and EU police say they've taken down LeakBase, “one of the world’s largest online forums for cybercriminals” for sharing stolen passwords and hacking tools.
The site now displays a seizure notice.
https://techcrunch.com/2026/03/04/u-s-and-eu-police-shut-down-leakbase-a-site-accused-of-sharing-stolen-passwords-and-hacking-tools/

2026-03-04 16:09:32 UTC

It's absolutely insane to me that in this day and age a company would reject end-to-end encryption so that cops and feds can actively read people's messages. It also puts that same data at risk from hackers. But that's TikTok, under new U.S. ownership.
https://www.bbc.com/news/articles/cly2m5e5ke4o

2026-03-04 01:28:29 UTC

Seems like the whole world is melting down so I'm gonna break my longstanding rule of not posting my feet to the internet to post this snap of my incredibly handsome loaf cat.
https://files.mastodon.social/media_attachments/files/116/168/307/095/498/011/original/40e52b6ad85895df.jpeg

2026-02-28 00:18:55 UTC

If you like my reporting, you might also like my free weekly cyber newsletter ~ this week in security ~ which packs in all the news you can use from the week, plus sections dedicated to good news and a reader-submitted cyber-cat. Goes out on Sundays by email & RSS. Newsletter archive & blog online. 🐈‍⬛
https://this.weekinsecurity.com

2026-02-27 16:01:42 UTC

New, by me at TechCrunch: After a year of cuts, layoffs, and furloughs under the Trump administration, U.S. cybersecurity agency CISA has now replaced its acting director Madhu Gottumukkala, whose tumultuous year-long tenure was dogged by security headaches and accusations of bumbling the job.
https://techcrunch.com/2026/02/27/cisa-replaces-acting-director-gottumukkala-after-a-bumbling-year-on-the-job/

2026-02-27 13:26:13 UTC

Some independent/local news outlets I read and recommend. Share yours!
https://www.zetter-zeroday.com
https://citationneeded.news
https://www.lawdork.com
https://krebsonsecurity.com
https://404media.co
https://techdirt.com
https://www.metacurity.com
https://www.thehandbasket.co
https://www.garbageday.email
https://indicator.media
https://www.wheresyoured.at
https://www.courtwatch.news
https://realhackhistory.org
https://www.londoncentric.media
https://privacyguides.org
https://databreaches.net

2026-02-25 13:58:36 UTC

- reply

Despite a FOIA and an appeal, the FBI refuses to say why agents visited my home or if I was (or am) under investigation for my work. I still can't go to Mexico, or anywhere that relies on its airspace, unsure as to what view authorities there might take if I ever cross into its territory.
https://this.weekinsecurity.com/fbi-agents-visited-my-home-about-an-article-i-wrote-and-now-i-cannot-go-to-mexico/

2026-02-25 13:57:05 UTC

In 2020, the FBI came to my house to try to ask me questions about a story I'd written. I declined.
I wrote about the back-story of what happened that day and after, my outstanding questions, and why press freedoms have taken a major step back under Trump's second term.
More: https://this.weekinsecurity.com/fbi-agents-visited-my-home-about-an-article-i-wrote-and-now-i-cannot-go-to-mexico/

2026-02-24 18:45:47 UTC

Trump is "weighing a possible executive order or other action that would require banks to collect citizenship information from customers." This order could task banks, reportedly alarmed, with checking IDs of "both new and pre-existing customers who want to maintain a bank account in the U.S."
WTF. https://www.wsj.com/politics/policy/trump-administration-considers-action-requiring-banks-to-collect-citizenship-info-8e26f6d2

2026-02-24 16:41:19 UTC

NEW: Fintech giant Marquis, which had a ransomware attack last year exposing a huge number of consumer banking customers, is now suing its firewall provider SonicWall, claiming hackers stole its firewall backup file from SonicWall's cloud that ultimately allowed hackers to breach Marquis' network.
More: https://techcrunch.com/2026/02/24/marquis-sonicwall-lawsuit-ransomware-firewall-breach/

2026-02-24 14:18:30 UTC

- reply

Conduent's handling of its data breach has been truly shit, refusing to say how many people are affected, or how the breach occurred.
Conduent hid its breach notice with "noindex" code, so you won't see the page in search results. The breach notice doesn't even *mention* a breach!
https://techcrunch.com/2026/02/24/conduent-data-breach-grows-affecting-at-least-25m-people/
https://files.mastodon.social/media_attachments/files/116/126/031/088/608/953/original/8793a782a100e3ee.png

2026-02-24 14:13:52 UTC

NEW: The number of people who had personal data (and Social Security numbers) stolen in the 2025 Conduent data breach continues to rise, now affecting at least 25 million.
Conduent provides mailing and payment verification services for state government programs, and benefits for employees at big companies.
More: https://techcrunch.com/2026/02/24/conduent-data-breach-grows-affecting-at-least-25m-people/

2026-02-22 16:53:38 UTC

A new edition of ~ this week in security ~ is now out, featuring stories on: Ivanti's private equity cuts cost it security; Copilot summarizing confidential emails; ATM jackpotting hacks on the rise and netting hackers millions; Def Con bans Epstein-linked technologists from its conference; and much more.
Plus, a new two-for-one cyber-cat special, and good news in the happy corner.
Thanks so much for reading!
Read online: https://this.weekinsecurity.com/this-week-in-security-february-22-2026-edition/
Sign up/RSS: https://this.weekinsecurity.com

2026-02-21 03:13:12 UTC

Have a peaceful evening, and weekend.
https://files.mastodon.social/media_attachments/files/116/106/434/164/568/669/original/766fe06ec089e729.jpeg

2026-02-20 22:22:20 UTC

- reply

@nprofile…l9z3 party at your house!

2026-02-19 15:10:52 UTC

NEW: A bug in a student admissions website exposed the personal information of parents and their children, including their names, dates of birth, home addresses, pictures, and details about their school.
The bug, now fixed, was a sequential IDOR. At least 1.63 million student records were exposed.
https://techcrunch.com/2026/02/19/bug-in-student-admissions-website-exposed-childrens-personal-information/

2026-02-18 14:51:06 UTC

Uhh, whoops. https://techcrunch.com/2026/02/18/microsoft-says-office-bug-exposed-customers-confidential-emails-to-copilot-ai/

2026-02-12 23:04:45 UTC

After threatening to ban TP-Link router sales over alleged links to China (which TP-Link denies), the Trump administration has reportedly put that ban plan on hold ahead of a summit with China, suggesting it was political leverage and not about cybersecurity.
From me in November: https://this.weekinsecurity.com/banning-tp-link-wont-save-america-from-its-own-terrible-cybersecurity/
From Reuters today: https://reuters.com/business/media-telecom/us-china-trade-detente-fuels-mothballing-key-china-tech-curbs-2026-02-12/ (via @nprofile…tzq5)

2026-02-11 18:49:22 UTC

Prosecutors have confirmed for the first time that Peter Williams, the former boss of L3Harris' Trenchant unit (which makes hacking and surveillance tools for the U.S. govermment and its allies), sold the company's exploits to a Russian broker that were capable of accessing "millions of computers and devices" around the world.
Williams, who pleaded guilty, is expected to be sentenced in the next two weeks.
https://techcrunch.com/2026/02/11/doj-says-trenchant-boss-sold-exploits-to-russian-broker-capable-of-accessing-millions-of-computers-and-devices/

2026-02-10 20:48:11 UTC

New, by @nprofile…ynf4: Google sent personal and financial data about a student and journalist, who attended a pro-Palestine protest in 2024, to ICE agents in response to an "administrative subpoena," which had not been approved by a judge.
https://techcrunch.com/2026/02/10/google-sent-personal-and-financial-information-of-student-journalist-to-ice/

2026-02-10 13:53:40 UTC

For my newsletter and blog, I wrote about how Apple's Lockdown Mode, once billed as an "extreme" security protection for iPhones, iPads, Macs and Watches, has passed a major real-world test by blocking the feds from accessing a journalist's phone.
Free to read; with additional words, advice, and guidance for paying subscribers: https://this.weekinsecurity.com/apple-lockdown-mode-once-an-extreme-security-protection-now-a-necessity-for-americans/
Sign up/RSS for the weekly newsletter: https://this.weekinsecurity.com

2026-02-09 16:23:36 UTC

SCOOP: A hacktivist has scraped more than half a million payment records from a comapny that makes consumer-grade spyware and other phone tracking apps, exposing customers' email addresses and partial payment data. TechCrunch verified the scraped data is authentic.
By @nprofile…ynf4 and me:
https://techcrunch.com/2026/02/09/hacktivist-scrapes-over-500000-stalkerware-customers-payment-records/

2026-02-09 14:29:29 UTC

A Politico story out today describes how Oura wearable rings are winning over Washington, but makes no real mention of their privacy or security risks.
But... in my piece about Oura rings from last year, I explain how Oura puts user data at risk from goverment agencies (like ICE), and hackers.
• Oura data isn't end-to-end encrypted
• Sensitive health data can be accessed by Oura staff
• Oura said it has received government demands for user data.
https://this.weekinsecurity.com/oura-ring-deal-raises-valid-concerns-about-users-health-data-security/

2026-02-06 18:09:18 UTC

New, by me: I wrote some words for TechCrunch about Sen. Ron Wyden's recent unclassified letter to the CIA director, citing his "deep concerns" about the agency's activities. This isn't the first time Wyden has sounded his "siren" — and history tells us why this new letter is likely a big deal.
https://techcrunch.com/2026/02/06/senator-who-has-repeatedly-warned-about-secret-u-s-government-surveillance-sounds-new-alarm-over-cia-activities/

2026-02-02 18:22:40 UTC

NEW: The developer of the long-running and popular open source text editor Notepad++ has confirmed that China government-backed hackers hijacked the software's update feature for months during 2025.
The hackers could access computers of victims who were running hijacked versions of Notepad++.
https://techcrunch.com/2026/02/02/notepad-says-chinese-government-hackers-hijacked-its-software-updates-for-months

2026-01-26 14:01:35 UTC

After another massive database of usernames and passwords was found unprotected and exposed to the internet (without a password of its own, ironic!), I wrote some words about the underlying problem — infostealing malware — and why it powers much of cybercrime today.
Read online: https://this.weekinsecurity.com/another-huge-leak-of-passwords-is-the-tip-of-the-infostealing-iceberg/
Sign up for my weekly newsletter: https://this.weekinsecurity.com

2026-01-24 16:58:31 UTC

- reply

It really says a lot about a company that's both the monopoly in search *and* email — and has utterly fucked up both of them.

2026-01-24 16:47:39 UTC

It's not just you. Gmail's spam filter looks like it's gone to shit overnight, for reasons as yet unclear. Hearing from others as well that typical spam is making its way through to their Gmail inboxes. Promotion email sorting (for those who have it) also seems busted.

2026-01-22 15:35:21 UTC

New, by me: Under Armour says it’s aware of data breach claims after 72M customer records were posted online.
A spox. told me a "small percentage" of customers had sensitive information compromised, but wouldn't say what kinds of data Under Armour considers "sensitive," nor provide an accurate figure of affected customers.
https://techcrunch.com/2026/01/22/under-armour-says-its-aware-of-data-breach-claims-after-72m-customer-records-were-posted-online/

2026-01-14 16:12:51 UTC

New, by me: Security researcher Eaton Zveare spent weeks trying to alert a little-known but critical U.S. cargo tech giant that their shipping systems and customers' data were exposed to the web.
After weeks of trying, Zveare asked TechCrunch for help. We were ignored, too. On the third time we emailed the firm's CEO, we included a partial copy of his password to show the seriousness of the flaws.
A couple of hours later, we got a response — from its law firm.
https://techcrunch.com/2026/01/14/us-cargo-tech-company-publicly-exposed-its-shipping-systems-and-customer-data-to-the-web/

2026-01-14 14:14:19 UTC

This is utterly insane, almost unheard of. This morning, the FBI *searched the home* of a Washington Post reporter, and seized her phone and smart watch, as part of an investigation into an alleged leak of classified info. by a government employee. (The federal case appears to be 1:26-mj-00045.)
https://www.washingtonpost.com/national-security/2026/01/14/washington-post-reporter-search/

2025-12-06 01:57:27 UTC

Before you log off (or not, for the extremely online), sign up (or RSS) for my newsletter https://this.weekinsecurity.com for your comprensive guide to the week in cyber — featuring all the news you need to know, and all the stuff you might've missed, and more — hand curated by me. Out Sundays. 🐈‍⬛