Data Breach Roundup (Oct 16 - 22, 2026)
This week's data breaches featured a lot of big, well known names from fast food and gaming to schools and government agencies.
Privacy & Security News
RSS Feed • Follow @PrivacyNews@mstdn.plus on Mastodon • Find more news on the forum
Signal Vulnerability Allows Audio and Possibly Video to Continue After Hanging Up
A vulnerability in the secure messenger Signal allows an attacker to cause a call to not properly hang up when you hang up on your end, allowing audio and possibly video to continue being transmitted.
Websites Down Due to Critical Remote Code Execution PHP Security Vulnerabilities
The PHP Foundation released a patch for two severe remote code execution (RCE) vulnerabilities, along with the recommendation to update immediately.
Thousand of Android Phones Shipped With Malware
Researchers at Bitdefender discovered a malicious Android system application shipped by default in thousands of cheaper Android phones in more than 150 countries.
Leaked Document Suggests Cellebrite Can Wirelessly Exploit iPhones
A user on a blog post claims to have been sent a leaked Cellebrite document marked "confidential" explaining their new capabilities, including exfiltrating data from iPhones using a dedicated device from a range of 8 meters.
Meta Fixes Bug In Smart Glasses Causing Them to Record Conversations Without User Consent
Users reported a bug in their Meta Ray-Ban smart glasses that was causing them to record their conversations without their permission, even when the setting to record without using the trigger phrase "Hey, Meta."
Data Breach Roundup (Oct 9 - 15, 2026)
It was a light week as far as data breaches, but there were still some unfortunate exposures.
First Zero-Click Mercenary Spyware Delivered Via Targeted Ads Uncovered by CitizenLab
CitizenLab confirmed the first publicly confirmed instance of mercenary spyware delivered via online targeted ads, dubbing it "AdFection."
Spy Chip Implanted in Ledger Wallets to Steal Cryptocurrency
The cryptocurrency wallet maker Ledger has confirmed that some devices sold through the reseller CryptoBilis were implanted with a spy chip that would steal users' seed phrase and drain their wallets.
Hackers at Pwn2Own Ireland Exploit Zero Days in the Google Pixel 10, Samsung Galaxy S26, and OpenAI Codex
Hackers at the Pwn2Own Ireland hacking competition were able to chain together zero-day exploits and already known vulnerabilities to exploit the Google Pixel 10, the Samsung Galaxy S26, and OpenAI's Codex.
Android On-Device AI Gets a Security Bump With "Next-Gen" Enclaves
Google announced in a blog post a new feature to keep local AI isolated from the rest of your device, based around virtual machines and hardware isolation, which they're calling "AI seal."
Data Breach Roundup (Oct 3 - 8, 2026)
This week saw a rather surprising hack from UK fashion retailer ASOS, as well as multiple breaches from organizations in Denmark.
Support Privacy Guides on DAF Day 2026
This October 8th, nonprofits of every size are asking their communities to make their DAF gifts count today, and we hope Privacy Guides is on your list.
Hackers Impersonate Google and Other Large Services With Counterfeit TLS Certificates
Attackers were able to compromise three top-level domain registries and mint TLS certificates for Google and other large organizations, allowing them to impersonate legitimate domains.
Apple Tightens "Full Disk Access" Permission on macOS in Light of AI Agent Security Concerns
Apple released a blog post on their Developer website announcing that they plan on tightening security around the "Full Disk Access" permission on macOS in light of AI agents misusing it and putting user data at risk.
Data Breach Roundup (Sep 25 - Oct 1, 2026)
The US government has once again been breached, as well as a Japanese car-sharing app and a vibe-coding app platform.
Leaked Video Shows That Police Can Bypass iPhones' Automatic Reboot Feature
According to 404 Media, a company that makes devices to hack phones claims they can bypass iOS's automatic reboot feature and allow police to more easily access data on iPhones.
German Police Are Using Linked Devices to Read Messages from Messaging Apps Without Cracking the Encryption
A document by Netzpolitik reveals that German police are sneakily abusing the linked devices feature in messengers to access the messages of suspects using encrypted messengers like Signal without needing to crack the encryption.
Highly Sensitive Data of 3 Million People in the Pentagon's System Accessed by "Unauthorized Users"
The Pentagon sent out letters to affected individuals explaining that their Defense Manpower Data Center (DMDC) was accessed by "unauthorized users," exposing the highly sensitive personal data of millions of military personnel.
New Attack Can Track You Across Operating Systems Without Elevated Privileges
Researchers at the Graz University of Technology Austria demonstrated a new attack that can track you via file change events "on all systems," allowing for various data leaks.
Subscribe today!
Privacy Guides is the best place to learn about protecting your digital life. You can get more articles like these, straight to your inbox:
No spam. Unsubscribe anytime.