Browsers & Phones
Chrome, Edge, Firefox, Safari, iPhone and Android updates: what was fixed and how to check you are patched.
Does MFA Stop Stolen Passwords? What 19,252 Unauthorized Brokerage Access Cases in Japan Show About Phone Codes and Passkeys
Japan's regulator counted 19,252 unauthorized access cases at online brokerages in 21 months. Phone MFA blocks a leaked password on its own, but typed codes can still be stolen on fake sites. Here is what to change this week.
iPhone Password Leak Warning: What Apple's Data Leak Alert Means, Why It Is Not New, and What to Do This Week
Apple Passwords warns when a saved password matches a list of known leaked passwords. The feature dates to 2020, but the alert goes to the employee, not IT. Here is what it means and what to check.
Mirax Android RAT: Thousands of Banking Customers' Phones Infected, Streaming App Ads Suspected, and How to Lock Down Work Phones
Group-IB says Mirax Android malware infected thousands of retail banking customers' phones in the Middle East, Turkey and Africa. Here is what is confirmed, what is not, and what to check on work phones.
Claude Dispatch Vulnerability (ThisBash): A Browser Extension Can Make Claude Desktop Run Commands, No Patch Planned, and What to Check
Researchers showed a browser extension with access to claude.ai could drive Claude Desktop through Dispatch and run commands, even on another machine. Anthropic plans to retire the feature rather than patch it.
GPT-6 Cyber Vulnerabilities: OpenAI's AI Finds 81 Firefox Flaws and 948 Linux Kernel Exploits, What Is Confirmed and What to Patch This Week
OpenAI says GPT-6 Cyber found 81 high-severity Firefox flaws and built root exploits for 948 Linux kernel bugs, most not yet fixed upstream. Here is what Mozilla confirms, what is still OpenAI's claim, and what to patch this week.
Apple CVE-2024-27834 Exploited: CISA Lists a 2024 Pointer Authentication Bypass, and the iPhone, Mac and Apple TV Versions to Check
CISA says attackers are now using CVE-2024-27834, an Apple WebKit flaw fixed in May 2024. Here is what is confirmed, which devices are exposed and the versions to check this week.
iCloud Shared Link Scanning: Apple Will Check 'Anyone with the Link' Files and Photos From iOS 27.3, What Is Confirmed and What Businesses Should Change
Apple says iCloud photos and files shared with Anyone with the Link will be checked for harmful content starting in iOS 27.3. Here is what is confirmed, what is not, and how to tighten sharing this week.
GhostMap Android Flaw: A No-Permission App Can Trap Phones in a Boot Loop, No Patch Yet, and How to Lock Down App Installs
Bitdefender says a crafted Android app with no permissions can trap a phone in an endless boot loop as soon as it is installed. Google says it will not fix this in a security update. Here is what is confirmed and how to control installs on company phones.
Vercel Device Bound Session Credentials: How DBSC Makes Stolen Session Cookies Useless, What Is Confirmed and What to Check
Vercel's CTO says Vercel is rolling out Device Bound Session Credentials (DBSC) for vercel.com logins. This ties sessions to the device so cookies stolen by malware stop working elsewhere. Here is what is confirmed and what to check.
