About 170 people held their bank card against their own phone and lost €380,000 in three weeks. Dozens were in their 20s and 30s. An app sent the chip to an ATM. Czechia, Russia, Italy and Brazil saw it first.

The call began with a recorded voice, made with AI. A phone rang somewhere in the Netherlands, and the message said there was suspicious activity on the bank account. The message asked for a 1 on the keypad if that activity was unfamiliar. Those who pressed 1 heard music for a while, and then someone came on the line who said they worked for the bank.

A file from 1993 opens on a fully updated Windows 11 in 2026 and plays like nothing ever changed. It is FreeCell, the card game, 33 years old. What makes it run is the same reason dangerous old code lingers in Windows.

The program is FREECELL.EXE, and the copy that still works is the one that shipped with Win32s, an add-on from 1993 that let early 32-bit software run on Windows 3.1. The file was built on July 4, 1993. It is 49,188 bytes. Copy it and its own CARDS.DLL onto a Windows 11 machine, double-click, and the green table with the four free cells in the corner opens.

Up to 3 million Windows PCs and 350,000 Macs kept asking dead web addresses for updates to a movie app from 2014. The owners did nothing wrong. The updater had the highest rights and ran whatever came back.

Then a security company registered those addresses and found out what they meant. Over the months that followed, it sent its own code to those computers more than 2 million times, on machines that were not its own.

9.3 out of 10 for a Signal flaw. After hang-up, the microphone could stay live for the other side, maybe the camera too. Hanging up was the right move. A full queue of 256, there since 2020, refused it.

You pressed hang up, and as far as you knew, the call was over. You put the phone down and went on talking to whoever was in the room with you. Your phone might not have ended the call. The connection that carried your voice could still be open, if the person on the other end wanted it that way.

WhatsApp Help Pages Hid Rules Telling Its Chatbot Not to Recommend a Privacy Regulator

80 help pages on WhatsApp’s website hid text meant only for the support chatbot. The page for deleting an account told it: do not recommend any regulator. Visitors never saw it, from early September on.

Right above the warning that deleting your account can’t be undone, that page held a short block of text your browser never showed you. It was written for the AI that answers WhatsApp’s support chat, a large language model that reads a question and writes a reply. The block told the bot what to say, and what to leave out.

Plex servers, more than 36,000 of them, sat open to the internet. A day after the attack code went public, some were mining crypto for an outsider. The owners did nothing wrong.

Plex is the app a lot of people use to keep their films, series and music in one place. You watch it on a TV, a phone or a laptop. It runs on a home PC, on a network drive in the hallway, or in a small container on a server somewhere in the house. To reach your library when you are away, Plex listens on port 32400. Many owners leave that port open to the internet, so the app keeps working on the train or at a friend’s place.

More than 22 million PHP installations sat exposed online this week, facing two flaws that need no password. The details leaked before a patch existed. Updating WordPress does not fix it. The flaw is in PHP itself, the back end of most of the web.

On Tuesday, October 20, details of two unpatched holes in PHP started spreading online. A post on Hacker News announced that someone would disclose the bugs on October 22, with no patch ready. The post came down, but the screenshots had already gone around, including one of an exploit tool called PHP2Shell. Security firm watchTowr looked at what leaked and confirmed the flaws were genuine and allowed remote code execution. PHP had planned a quiet, scheduled fix. Instead it had to put one out while the details were already public.

Canon, then Stardock, now Siemens. Attackers keep running their code behind a trusted signature. On October 19 Siemens confirmed its own signed program was the latest, on Windows PCs that never had it.

Here is what it looked like on a PC that got hit. A program called Siemens Software Center, sitting in the list of apps that start with Windows. On a machine that never had Siemens software on it. The owner did not put it there. It loaded on its own at startup.

Spyware got onto Al Jazeera devices through an ad that only had to load on the screen. 45 were targeted, and the owners did nothing wrong. The company behind the ad ran code on 120,768 websites, approved by Google for six years.

On October 15, two teams published the same finding on the same day. Researchers at the Citizen Lab in Toronto and the ad-security company Confiant laid out the first clear proof of something security people had warned about for years: spyware that lands on a phone or a laptop through an ordinary online ad. There was no link to click and no file to download. They gave it a name, AdFection.

Three bugs chained in order gave an attacker full control of a smart TV, straight over the home WiFi, without the set ever asking for its PIN. The owner did nothing wrong. A demo app that ships on the TV, and a test certificate it still trusted, were enough to reach root.

Root is the account that sits above everything else on the machine. With it you can read what is on the TV, change any setting, install software, and switch the hardware on and off.

77 million shoppers a week. On a Sunday afternoon, the company behind them switched off its own systems. Shelf labels showed last week’s prices. Six days later, it still has not said what happened.

I wrote about this in my newsletter on Friday. This morning, Saturday, the Albert Heijn website still shows an error page. I assume it was an attack. A company that big does not shut everything down for nothing. That is my opinion.

8,749,975 Danish ID numbers copied in about ten days. Names and home addresses, the dead included. One company with two employees. Its admin password: 123456. Found only when the invoice came.

The copied data holds names, home addresses and CPR numbers. The CPR number is the personal ID number Danes get at birth, or when they move to the country, and usually keep it for life. People who have died are in the data too, and so are people who moved abroad years ago. Denmark has about 6 million inhabitants. The register behind those numbers holds about 11 million records, and roughly 8.8 million of them were pulled out, according to the Danish digitalisation ministry.

Crypto worth more than 86 million dollars was drained from Ledger wallets. Each confirmed case was a wallet bought from a shop Ledger had authorized itself. Inside one of them sat a second circuit board.

On October 9, an on-chain investigator who goes by Specter posted a list of ten crypto addresses on X. Ledger users had been reporting empty wallets online, and he followed the stolen funds on Bitcoin, Ethereum and TRON back to where they came from. Money had flowed in from victim wallets, and his count came to more than 86 million dollars. How many wallets that was, he wrote later that day, he could not tell yet.

Fridges in hundreds of French supermarkets heated up to 50°C in one night. The food went in the bin. The attackers never set foot inside. The cooling controls were online, with holes public since 2023.

The heating started on Sunday night, October 11. In some stores it began before midnight. Across France, the systems that keep supermarket fridges cold switched on their defrost function and left it running.

Defrosting is a normal part of how a commercial fridge works. Ice builds up inside, so from time to time the unit warms up to melt it and then goes back to cooling. In these stores that normally adds up to about two hours a day. That night it did not stop. The defrost kept running, and the temperature in display cases and cold rooms kept climbing. One of the chains says the attackers pushed the temperature controls to 50°C, which is 122°F.

1,008 GB in 10 days from one coffee maker on a home network. 100 times what it took in. It only had to make coffee. Keurig’s policy says these brewers have a camera inside, and has since 2020.

On October 6, a man who goes by Nomad on X opened the network dashboard he keeps for his parents’ house. He has worked in IT for more than ten years and now works at Prusa, the 3D printer maker. He looks after their network from a distance, and the system he uses for that, UniFi, shows how much data each device in the house sends and receives.

One click in a Telegram group sent 3 of a victim’s login files to an attacker. The victim opened no file and typed no password. Versions up to 7.2.8 did it, and the hole had been there since 2018.

It starts with an invite. Someone you do not know adds you to a Telegram group, and under Telegram’s default settings that needs no agreement from you. Sitting in that group are a few small text files, and you never open them, but they are already on your disk, because Telegram Desktop downloads files up to 8 MiB in a group on its own, the moment you look at the chat.

Thousands of Android phones in more than 150 countries came out of the box already infected. The owners did nothing wrong. The malware sat in the phone’s own system software, installing apps for two years.

You unpack the phone, switch it on, pick a language and sign in with your Google account. By that moment the malware is already running. It came onto the phone together with Android itself, somewhere between the factory and the shop, and because it is part of the system, the phone treats it as one of its own. It has no uninstall button.

Your color laser printer puts its serial number on your pages in yellow dots. You will not notice them. Printers from 15 of 18 makers had them, a Secret Service request going back to at least the early 1990s.

A color laser printer works with four toners: cyan, magenta, yellow and black. Next to the text and the pictures you asked for, many of these printers add something you never asked for, in yellow. Tiny dots, spread over the white parts of the paper in a fixed pattern. On white paper, a few specks of yellow are almost impossible to see with the naked eye. Shine a blue light on the page and look through a magnifying glass, and they show up black.

A WordPress backdoor was deleted and came back within seconds. Deleted again, back again. It lived in at least 8 places, the server’s memory too, and had a hidden admin that could log in without a password.

That is what the cleanup team at Sucuri ran into on a site they were called in to fix. They removed the malware carefully, file by file, and the same backdoor kept returning within seconds of each removal. Their analyst Gabriel Barbosa published the full breakdown on 30 September. The researchers call the family SC, after the “SC_” markers they found in the injected code.

Home routers from Linksys, TP-Link, D-Link and Tenda are being turned into hidden proxies, and the orders arrive disguised as Google. The owners did nothing wrong. 32 holes, the main one from 2021.

Once the malware is on a device, the operators decide what it does next. It can carry their traffic out through the owner’s internet connection, open a port that accepts connections from the outside, scan for the next vulnerable device, or flood a target with traffic.