Hours of San Francisco Police Division drone video footage uncovered on the open net illustrates a brand new period of extremely granular—and consequential—city surveillance. In the meantime, the San Francisco Metropolis Legal professional’s Workplace despatched cease-and-desist letters to Apple and Google this week demanding that the tech giants delete 13 AI nudifying “face-swap” apps from their app shops which might be virtually completely used to focus on ladies and ladies.
Since WIRED first reported in June about Meta’s NameTag face-recognition system, firm executives have made opaque and conflicting feedback about whether or not the function even exists. We took a step again to put out each the claims and the details in regards to the very actual system.
In a speech on Thursday, President Donald Trump continued to push unsubstantiated and completely debunked claims about interference within the 2020 US election. He even promised huge revelations in a trove of paperwork posted to the White Home web site, however the information didn’t show his assertions—and in some circumstances truly contradicted Trump’s claims.
As adoption of AI instruments quickly expands and their capabilities enhance, the tech large Anthropic continued a push to get US states to manage AI. Talking about AI transparency necessities in California and New York from final 12 months, Anthropic’s head of US state and native authorities relations, Cesar Fernandez, advised WIRED this week, “The transparency-focused security payments of 2025 have been a very necessary begin, however because the capabilities of AI methods proceed to advance rapidly—the coverage responses must match.”
And there’s extra. Every week, we spherical up the safety and privateness information we didn’t cowl in depth ourselves. Click on the headlines to learn the total tales. And keep secure on the market.
The astrology-themed interval tracker Stardust sends customers’ reproductive well being particulars—contraception kind, being pregnant standing, moods, and signs as particular as tender breasts and abdomen cramps—to a knowledge agency not named in its privateness coverage, based on the BBC, which first reported a Mozilla Basis audit of six widespread trackers produced in partnership with Harvard’s Berkman Klein Middle.
Stardust scored 2 out of 10, the worst of the group. Mozilla researcher Shoshana Wodinsky discovered the app pings third-party trackers from the second it opens, earlier than a person enters something; the moment she logged a symptom, the main points went to analytics agency RudderStack alongside a persistent person ID, with no in-app approach to shut the sharing off. RudderStack is constructed to route knowledge onward to locations Mozilla could not observe. Stardust additionally palms Fb an advert identifier that ties in-app conduct to the platform’s current profiles. The corporate advised TechCrunch it has by no means acquired a authorized demand for person knowledge.
Euki, a nonprofit-run tracker, earned an ideal 10: no account required, well being knowledge by no means leaves the telephone, and customers can set a PIN, schedule computerized deletion, or pull up a decoy display if somebody forces the telephone open. Its one smooth spot is an in-app browser for academic pages that hundreds the standard net trackers, however it additionally resets identifiers between visits.
Russia’s FSB has lengthy had a status for extremely refined cyberespionage, leaving disruptive cyberattacks to its fellow hackers within the nation’s GRU army intelligence company. However sanctions from the EU and UK this week, together with an advisory from the US Cybersecurity and Infrastructure Safety Company, the FBI, and the NSA, pinned a cyberattack towards the Polish electrical grid on Middle 16 of the FSB, a uncommon instance of the Kremlin company finishing up a cyberattack that almost induced outages within the nation’s electrical and water utilities. The assault, which the Polish authorities has mentioned got here “very shut” to inflicting a blackout, was initially attributed by cybersecurity companies Dragos and ESET to Sandworm, also referred to as Unit 74455 of the GRU, a extra typical suspect in infrastructure hacking given its energetic position in Russia’s long-running cyberwar towards Ukraine. However the Polish laptop emergency response workforce on the time disputed that discovering and tied the assault to the FSB, a conclusion now supported by a large consensus of Western governments. The incident means that the FSB could also be taking over a few of the reckless, extremely aggressive tendencies—and concentrating on—of its GRU coworkers.
For years, the Russian cybersecurity agency Kaspersky has been alleged to have ties to the Russian authorities, together with by US officers who banned use of the corporate’s merchandise inside the US authorities and ultimately by all American prospects. But overt proof of these connections has been scarce. Now Reuters stories that Denis Obrezko, a Russian man dealing with hacking prices in Boston and an alleged member of a hacker group referred to as Void Blizzard or Laundry Bear, spent two years working at Kaspersky. His stint on the firm passed off simply earlier than he joined one other cybersecurity firm, Yutek-NN, the place he allegedly took half within the group’s hacking marketing campaign that stole knowledge and communications from quite a few NATO governments and not less than 11 US firms, based on US prosecutors. Previous to Kaspersky, Obrevko additionally allegedly labored on the FSB, neatly bookending his time on the firm with obvious work for Russia’s intelligence companies.
Obrevko has pleaded not responsible to the hacking prices. Kaspersky responded in an announcement to Reuters that “the offenses charged can’t be associated to the person’s position or obligations in the course of the employment at Kaspersky.”
In an incident that can induce anxiousness in anybody chargeable for assessing suspicious community exercise, DHS officers dominated—twice—that indicators of a hacker breach in its data-sharing Homeland Safety Data Community platform have been false positives after they have been, the truth is, indicators of a really actual intrusion. HSIN, used for sharing unclassified knowledge between state, native, and federal companies, in addition to overseas companions, was breached by hackers two months in the past, based on reporting from Nextgov/FCW. Analysts on the Federal Emergency Administration Company noticed indicators of hacker exercise in mid-Could—altering information and code, hijacking a authentic net server, and deleting logs of their conduct—however the findings have been dismissed as a false constructive.
Within the weeks that adopted, the hackers returned, have been once more detected, and have been once more dismissed as a mirage. It’s not clear why the indicators of the breach have been misjudged, however the incidents could signify federal analysts’ rising challenges in detecting “residing off the land” hacking methods that use authentic options of networks to entry goal property on a community reasonably than planting extra simply noticed malware. Whereas the HSIN homes solely unclassified knowledge, the data is “extremely delicate,” Senate Intelligence Committee vice chair Mark Warner mentioned in an announcement following the report of the breach, and “its publicity dangers nationwide safety.”
The AI music startup Suno scraped hundreds of thousands of songs, lyrics, and podcasts from YouTube Music, Deezer, Genius, and a string of stock-audio libraries to coach its fashions, based on 404 Media, which reviewed inner knowledge offered by a hacker who breached the corporate. The intrusion additionally uncovered account info for tons of of 1000’s of consumers, together with emails, telephone numbers, and Stripe fee information.
Dataset notes in supply code apparently from 2023 and 2024 tally 113,879 hours of YouTube Music audio alone, plus tens of 1000’s extra from Pond5, Deezer, and different libraries—a long time of music in whole. Different information present Suno routing its YouTube scraping by way of Shiny Information proxies and utilizing PodcastIndex to focus on roughly 1 million hours of podcasts. The hacker, who goes by ellie.191, says they broke in by compromising an worker with the Shai-Hulud worm.
The information seemingly corroborate the document business’s central allegation that Suno pulled songs instantly from YouTube. The corporate, which argues that its coaching qualifies as truthful use and settled with Warner Music Group final November, mentioned the breach concerned outdated code and no delicate private info—although prospects whose knowledge appeared in a pattern shared with 404 Media mentioned they have been by no means notified.
