Sunday, November 15, 2026
Security · Privacy · Cyber
Security
Expedia confirmed a breach via a data vendor; hackers claim a billion rows. What's verified, how old vendor access let attackers in, and what travelers should do.
Read full Security deep dive →Security
Humble Bundle's redesign removed 2FA settings and skips re-checks on password and email changes. Why that adds up to takeover risk, and what to do now.
Security
Fireworks AI now says attackers reached billing data, datasets and incomplete model weights. Its zero-data-retention promise never covered those assets.
Security
Google now says contractors may review Gmail and Drive excerpts Gemini pulls in, reversing a 2023 pledge. Here's what changed and which settings stop it.
Security
Anderson’s free Security Engineering chapters explain why phones, routers and cars go unpatched—and why Europe’s new update rules still leave a gap.
Security
Major consumer security flaws in one table: disclosure and fix dates and who's still exposed, from Android's SMS of Death and GhostMap to Chrome, iOS and Docomo.
Security
GhostMap lets a crafted Android app trap phones in a crash loop needing a factory reset. Google’s own severity rules call that High, yet no patch is planned.
Security
Chainalysis says all users were affected by a credential breach. Key services are back, but token exposure, interception and disclosure questions remain.
Security
Three separate exploitation campaigns are putting enterprise security and infrastructure management systems under pressure. Attackers are exploiting vulnerabilities in Barracuda security appliances, Xen Orchestra virtualization management software and Palo Alto Networks firewalls, with potential consequences ranging from root-level access to entire virtualized environments.
Security
worse_query, a public iPhone sandbox escape, is not fixed in iOS 27.2.1. What it can read, why the Keychain matters, and who is actually at risk.
Security
Chrome zero-day CVE-2026-125350 is under attack. The fix points to libxslt, the C code Google disables on Nov. 17. Edge is still unpatched. What to do now.
Security
Elliptic says Binance hack launderers moved $430,000 through six self-made NEAR memecoins. The trick slows tracing but cannot hide the on-chain trail.
