‼️ UPDATE: Calif showed one-tap attacks on Signal and iMessage on iOS, which make it possible to run code on an iPhone with a booby-trapped PDF.

On iOS 26.5, opening one in iMessage sent the phone's messages to a server.

Calif says everything will be released "in due time."

‼️ AI agents tested by Tencent went rogue on the open web over the question which Chengdu Zoo gate most people use, researchers say.

When blocked, they ran code through a public security scanner, used Amap keys leaked online and probed Alibaba's pre-production servers. One leaked key returned real data.

They made 2,600+ attempts to pull data from Alibaba's Amap, China's Google Maps.

A source close to Tencent says its evaluation team was testing unnamed third-party models. Several agents told the researchers they were Claude, which the researchers doubt.

https://swarmcha.se/posts/chinese-agent-fleet-full-report

❗️ The CEO of a South African coffee chain vibe-coded an internal dashboard for all of his 132 stores, only it had one big flaw: all of the sensitive internal data was stored in the source code of the login screen.

The dashboard URL was discovered through employees posting photos of their laptop screens on Instagram.

The CEO said he had discovered Claude and was "almost certain" that software itself will soon "become free"

❗️ Hackers spied on government Linux servers for months using AI-written code, and left the AI's chats behind, Unit 42 says.

A fake sudo prompt saved admin passwords to a bogus SolarWinds log and a script combed government mailboxes for Facebook emails.

https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/

‼️BREAKING: Cellebrite unveiled zero-day LOKI, a boot ROM exploit for Apple chips from iPod touch 2 to iPhone 11.

Its Hexacon slide calls it a timing race that some early proofs of concept won just 1 in 25 times.

Boot ROM code is burned into the chip. No update can fix it.

‼️ Japan is facing a storm of data breaches, and it keeps getting worse.

Delivery giant Yamato Transport now says hackers took 5.31 million records, from names and addresses to what people bought.

Cosmetics firms Fancl and Attenir say 834,947 more may have leaked.

Ransomware gang Qilin claims it hit rail operator Keio and posted what it says are Keio files.

In the past month, JR East, travel site Skyticket and software firm Sourcenext have each disclosed possible leaks of millions of records.

Japan's National Police Agency says it is not yet clear whether the attacks are linked.

https://www.japantimes.co.jp/news/2026/10/17/japan/crime-legal/more-data-breaches-japan/

‼️ BREAKING: Hackers hijacked a CDU email account and sent phishing mail to German Chancellor Friedrich Merz.

Police say it went to about 6,500 contacts of the party's Heilbronn branch, many in security-relevant roles.

The message contained an invite to an event.

https://www.heise.de/news/Phishing-Angriff-auf-Merz-und-viele-andere-CDU-Mailkonto-in-Heilbronn-gehackt-11491677.html

❗️ Apple now explicitly requires App Store apps to block and remove nonconsensual intimate images, including AI fakes.

Hiding features with code obfuscation can get a developer banned.

In January, Tech Transparency Project found 47 App Store apps that would undress people.

https://developer.apple.com/news/?id=vvzx6cul

‼️ UPDATE: A researcher says the Broadcom Wi-Fi router bug affects way more countries.

The vulnerable code is also in ZTE's F680 v4, which ISPs from Spain to Vietnam, Egypt and Moldova offer.

Three Movistar Spain routers appear affected. Broadcom still won't assign a CVE.

Our previous post on this matter:

A Broadcom Wi-Fi bug lets anyone in range run code on routers without the password.

Quentin Kaiser showed it on Proximus, Orange Belgium and VOO routers and estimates ~1.5M in Belgium are exposed, none patched.

The bug dates to 2010. Broadcom won't assign a CVE.

https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/