Data Breach Roundup (May 15 - 21, 2026)
This week had some particularly noteworthy breaches including facial recognition systems, fingerprint scans, and Trump Mobile.
Privacy & Security News
RSS Feed • Follow @PrivacyNews@mstdn.plus on Mastodon • Find more news on the forum
Dirty Frag Sequel Continues the Streak of Linux Kernel Privilege Escalation Vulnerabilities
Fragnesia, the latest local privilege escalation vulnerability in the same family as Dirty Frag, emerges as an “unintended side effect of one of the patches addressing the original Dirty Frag vulnerabilities” according to the original creator of Dirty Frag, Hyunwood Kim.
Data Breach Roundup (May 8 - 14, 2026)
This week featured some high-risk breaches including banks, cars, and water utilities.
BitLocker Bypass Found In Latest Series of Windows Vulns
An anonymous security researchers known as Nightmare-Eclipse has published two more Windows zero-day exploits, YellowKey and GreenPlasma, after already publishing 3 earlier this year.
Android Introduces New Privacy and Security Protections, with a Focus on Agentic AI
Android has introduced some new protections against scammers and malware, some powered by agentic AI.
Data Breach Roundup (May 1 - May 7, 2026)
The Canvas breach quickly became the biggest hack of the week, but a couple others slipped under the radar.
Utah Targets VPNs for Age Verification
Governor Spencer Cox has signed a law stating that websites are accountable for determining if a user is physically located in Utah, even from behind a VPN.
Canvas System Used by Over 40% of US Schools Breached
Canvas, software used by thousands of schools in the U.S., has been hacked and the private data of staff and students stolen.
Healthcare Marketplaces Shared Sensitive Data With Advertisers
A new investigation from Bloomberg has revealed how state-run health insurance marketplaces have - often accidentally - been sharing sensitive data with tech giants. The United States healthcare landscape is complicated. The healthcare system is largely privatized. Many employers offer health insurance to full-time employees, while those not covered can
Two More Major Linux Vulnerabilities Discovered in the Same Class as Copy Fail
Two new Linux local privilege escalation vulnerabilities were discovered in the same vulnerability class as Copy Fail, affecting most Linux distributions.
Chrome for Android Now Supports Approximate Location
Google announced that “you can now choose to share your approximate location with websites, instead of sharing precise location” on Chrome for Android.
Proton Mail Launches Post Quantum Encryption
Proton Mail now offers post-quantum encryption to protect against future threats from quantum computers.
FTC to Ban Data Broker From Selling Location Data
Under the proposed settlement, Kochava would be required to implement a slew of oversights and allow consumers to have more control over their data.
Disneyland California Rolls Out Facial Recognition
The company surprisingly emphasizes reduced fraud instead of visitor safety.
Apple Confirms RCS E2EE Will Ship with iOS 26.5
9to5mac spotted in the release notes of iOS 26.5 RC confirmation that the long-awaited RCS end-to-end encryption feature will ship with iOS 26.5.
Fedora Sealed Bootable Container Images, Possibly Opening the Door to a “Fully Verified Boot Chain”
Fedora 44 has released, and with it comes a new offering: sealed bootable container images, which “include all the components needed to create a fully verified boot chain.”
OpenAI Introduces Advanced Account Security
OpenAI has introduced new security protections for ChatGPT accounts called Advanced Account Security, to protect users against account takeover.
Every Linux Distribution Shipped Since 2017 Vulnerable to New Copy.Fail Exploit
A new exploit called copy.fail has emerged that can root just about any Linux distribution shipped since 2017 using just an unprivileged user account.
Data Breach Roundup (Apr 24 - 30 2026)
A security company, two medtech companies, a video streaming service, and an older attack we missed last week compromise this week's data breach headlines.
Firefox Quietly Adds Brave’s Rust-Based Adblocker
Firefox has bundled adblock-rust, Brave’s memory-safe content blocker, into Firefox in version 149, although disabled by default.
Subscribe today!
Privacy Guides is the best place to learn about protecting your digital life. You can get more articles like these, straight to your inbox:
No spam. Unsubscribe anytime.