‼️ German electronics retailer Notebooksbilliger warned customers that hackers may have their bank details.

Hackers got email addresses, it says, and possibly names, postal addresses and IBANs used to pay.

There is no info on when it was hit or how many customers are affected.

Source: https://www.computerbase.de/news/wirtschaft/cyberangriff-notebooksbilliger-warnt-vor-moeglichem-datenleck.99833/

‼️ UPDATE: Calif showed one-tap attacks on Signal and iMessage on iOS, which make it possible to run code on an iPhone with a booby-trapped PDF.

On iOS 26.5, opening one in iMessage sent the phone's messages to a server.

Calif says everything will be released "in due time."

‼️ AI agents tested by Tencent went rogue on the open web over the question which Chengdu Zoo gate most people use, researchers say.

When blocked, they ran code through a public security scanner, used Amap keys leaked online and probed Alibaba's pre-production servers. One leaked key returned real data.

They made 2,600+ attempts to pull data from Alibaba's Amap, China's Google Maps.

A source close to Tencent says its evaluation team was testing unnamed third-party models. Several agents told the researchers they were Claude, which the researchers doubt.

https://swarmcha.se/posts/chinese-agent-fleet-full-report

❗️ The CEO of a South African coffee chain vibe-coded an internal dashboard for all of his 132 stores, only it had one big flaw: all of the sensitive internal data was stored in the source code of the login screen.

The dashboard URL was discovered through employees posting photos of their laptop screens on Instagram.

The CEO said he had discovered Claude and was "almost certain" that software itself will soon "become free"

❗️ Hackers spied on government Linux servers for months using AI-written code, and left the AI's chats behind, Unit 42 says.

A fake sudo prompt saved admin passwords to a bogus SolarWinds log and a script combed government mailboxes for Facebook emails.

https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/

‼️BREAKING: Cellebrite unveiled zero-day LOKI, a boot ROM exploit for Apple chips from iPod touch 2 to iPhone 11.

Its Hexacon slide calls it a timing race that some early proofs of concept won just 1 in 25 times.

Boot ROM code is burned into the chip. No update can fix it.

‼️ Japan is facing a storm of data breaches, and it keeps getting worse.

Delivery giant Yamato Transport now says hackers took 5.31 million records, from names and addresses to what people bought.

Cosmetics firms Fancl and Attenir say 834,947 more may have leaked.

Ransomware gang Qilin claims it hit rail operator Keio and posted what it says are Keio files.

In the past month, JR East, travel site Skyticket and software firm Sourcenext have each disclosed possible leaks of millions of records.

Japan's National Police Agency says it is not yet clear whether the attacks are linked.

https://www.japantimes.co.jp/news/2026/10/17/japan/crime-legal/more-data-breaches-japan/

‼️ BREAKING: Hackers hijacked a CDU email account and sent phishing mail to German Chancellor Friedrich Merz.

Police say it went to about 6,500 contacts of the party's Heilbronn branch, many in security-relevant roles.

The message contained an invite to an event.

https://www.heise.de/news/Phishing-Angriff-auf-Merz-und-viele-andere-CDU-Mailkonto-in-Heilbronn-gehackt-11491677.html

❗️ Apple now explicitly requires App Store apps to block and remove nonconsensual intimate images, including AI fakes.

Hiding features with code obfuscation can get a developer banned.

In January, Tech Transparency Project found 47 App Store apps that would undress people.

https://developer.apple.com/news/?id=vvzx6cul