A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. […]
Most people hang onto an old laptop out of guilt, or because they’re not sure what to do with it. It feels wasteful to recycle it, but a second laptop doesn’t have to be a backup device or an emergency spare. It can make your main machine better by taking over the background tasks that would otherwise slow you down or eat your battery.
I loved my first Walkman to the point where I used it until it fell apart, but my favorite music player was still my iPod. There was nothing quite like flipping through the albums in the Cover Flow view by spinning my thumb around the click wheel. When I found an old remote that had its own wheel-style input, I wondered if I could bring those days back.
Cloud platform Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week. […]
Facebook’s Cambridge Analytica scandal may feel like very old news. But the consequences are still arriving, and the latest comes with a $25 billion price tag.
Reuters reports that a New Mexico judge has ordered Meta to pay $25 billion in civil penalties after a jury found that Facebook misled consumers about its data practices and its handling of hate speech and misinformation. Meta says it expects to win on appeal.
This case is about more than information ending up in the wrong hands. It concerns what Facebook told people about who could access their information, how much control users had, and how the company enforced its own rules.
In September, jurors found that the company and its leadership made 26 misleading statements on data privacy, hate speech, and other subjects. For example, Mark Zuckerberg’s 2010 statement that:
“We do not share your personal information with people or services you don’t want.”
That assurance appeared in a statement the jury found misleading. The judge found that choosing who could see a Facebook post did not necessarily control what outside app developers could access. That access was governed by separate settings that many users did not know existed.
New Mexico’s attorney general filed the lawsuit in 2021, following revelations that Cambridge Analytica obtained personal information from as many as 87 million Facebook users through a third-party app.
But New Mexico’s case went beyond Cambridge Analytica.
The state challenged Facebook’s representations to consumers about its data practices and its efforts to address misinformation and hate speech. The case centered on misleading consumers under New Mexico’s Unfair Practices Act, the state’s consumer protection law.
The state argued that third parties had broad access to users’ information and that Facebook tolerated harmful content when doing so benefited its business. Meta disputed the allegations, denied selling users’ information, and said the state had taken statements out of context.
New Mexico’s Department of Justice says the jury found 43,899,725 violations of state law. That does not mean nearly 44 million individual New Mexicans had their data taken. The count reflected the estimated audience for each misleading statement, rather than the number of individual people affected.
State law allows penalties of up to $5,000 per violation. Judge Francis Mathew found that a penalty exceeding $219 billion was warranted under the law but reduced the amount to $25 billion.
The judge said earlier penalties had failed to stop Meta from misleading consumers, including a $5 billion FTC penalty in 2019.
The money is not earmarked for compensation payments to individual Facebook users. According to Attorney General Raúl Torrez, state law directs the penalties to New Mexico’s school system.
Meta’s chief legal officer, C.J. Mahoney, said the company is confident it will prevail on appeal and characterized the lawsuit as an attempt to impose “a tax on speech.” Meta has also argued that a multibillion-dollar penalty risks violating constitutional protections concerning due process and excessive fines.
The case illustrates why privacy is not just a matter of choosing who can see a post. In a separate 2019 case, the Federal Trade Commission (FTC) alleged that Facebook had shared users’ information with third-party apps used by their friends, even when those users had chosen restrictive privacy settings.
A few precautions can help you limit what you share, although settings alone cannot guarantee privacy:
Scammers don’t need to hack you. They just need you to click once.
Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.
Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. […]
NFC tags are really useful for triggering smart home automations. They’re cheap to buy, they don’t need batteries or to be connected to power, and you can stick them almost anywhere. I wondered if it would be possible to use my expired credit cards as NFC tags, and it turned out that they can be even more useful than the standard stickers.
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.
The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10.
PHP is a programming language that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many other applications, including software whose users may not realize PHP is involved.
Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.
The PHP team says all PHP installations serving web requests are at risk. In some configurations, an attacker can trigger an exploit before the website’s own code even runs.
Cloudflare’s chief technology officer, Dane Knecht, has reported “early attacks emerging,” while warning that firewall mitigations are only a stopgap.
The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.
You may still encounter offline websites while administrators install the updates and check their systems.
CERT-EU recommends identifying PHP-based applications and patching as soon as possible. Where an immediate fix is not feasible, it advises considering isolation of internet-facing applications from public networks.
The longer-term concern is forgotten infrastructure: abandoned websites, unsupported applications, and connected devices with PHP-based management interfaces. Vulnerable installations may remain exposed if nobody maintains them or a vendor no longer supplies updates.
PHP 8.1 and older no longer receive routine security updates from the PHP project. Administrators using those versions should check whether their vendor supplies a fix or arrange an upgrade to a supported version.
Website owners should establish who updates their underlying PHP installation. Updating WordPress or its plugins is not the same as updating PHP. Hosting providers or server administrators may need to apply the fix.
For visitors, temporary downtime alone doesn’t mean a website has been breached. It may reflect a protective decision while its administrators install updates.
However, consumers need to be extra careful as a “trusted website” may no longer be trustworthy, and not just because of PHP2Shell, but also because of eight compromised TLS certificates.
Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes, said:
“This is a goldmine for hackers. They can hijack real websites to take advantage of the site’s reputation to do things like phish people, serve malicious software from the trusted channel. The opportunities are endless.”
If you’re a website visitor:
If you’re a website owner:
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser ?
OpenAI agents powered by the GPT-6.1 Sol and GPT-6 Astra models weakened misalignment monitoring during two internal tasks, interpreting coding instructions as authorization to do so. […]
Living in a dense neighborhood used to mean dealing with noise and parking. Now it means your neighbors can slow down devices in your own home without ever touching them. Your neighbors don’t even need to do this on purpose, which is part of what makes it hard to fight against.