Black Friday is almost here, and Surfshark – one of the best VPNs around and already our highest-rated cheap VPN – has joined the party with a deal that gets you its mid-tier Surfshark One plan for the usual price of its entry-level Starter plan.

Surfshark One is now just $2.49 per month ($67.23 upfront) on a 24-month plan, with an extra three months thrown in for free, bringing your total protection to 27 months.

It includes everything in the Starter plan – a high-speed VPN, Alternative ID, and CleanWeb – but also adds Surfshark's scam protection, antivirus, and alert tools. Effectively, you're getting all of that for free alongside the VPN.

The 15-month Surfshark One plan (12 months + 3 free) is also discounted to $3.09 per month, down from the usual $3.59. But it doesn't come close to matching the value of the 27-month deal. More on why this is one of the best Black Friday VPN deals of the year below.

Surfshark One is the plan I'd recommend to almost everyone

Even without its current discounted price, Surfshark One is the best plan in Surfshark's lineup – and one I happily recommend to almost everyone. It gives you pretty much everything Surfshark has to offer, with only Incogni and identity theft coverage from the top-tier Surfshark One+ plan left out. But honestly, most people can do just fine without those extras.

For starters, you get a pretty capable antivirus solution backed by Avira. It offers real-time protection that checks apps and files as they're downloaded, installed, and used, along with scheduled scans to check your device for threats. There's also webcam protection, which blocks apps and websites from accessing your camera without permission.

Surfshark Alert keeps an eye out for your personal information online and notifies you if details linked to your email, credit card, or ID show up in a data breach. You also get regular personal data security reports, so you can keep tabs on potential leaks.

Then there's Surfshark's Scam Protection, which checks SMS messages for signs of fraud, uses AI to spot suspicious emails and phishing attempts, and blocks access to malicious or unwanted websites.

All that comes on top of Surfshark's already near-flawless VPN, which is both fast and incredibly private. Along with a strict no-logs policy and a unique twist on typical kill switch functionality through Everlink, it offers post-quantum encryption, RAM-only servers, MultiHop (its Double VPN feature), and VPN obfuscation through its Camouflage Mode.

Surfshark One also carries over the niceties from the Starter plan, including Alternative ID and CleanWeb. The latter is Surfshark's built-in ad and tracker blocker. Alternative ID, meanwhile, lets you create an entirely random identity, complete with a fake but realistic-looking name, email address, birthday, and physical address. I've used it countless times for those one-off sign-ups where I'd rather not hand over my real details.

But Surfshark's real party trick? Unlimited simultaneous connections. This means you can run virtually all your household devices through the VPN without worrying about hitting a device limit. It's a game changer for multi-device households and a big reason why we rate Surfshark so highly for value.

Overall, Surfshark One's current $2.49-a-month Black Friday deal makes it very easy to recommend. It's a steal if you're looking for a full-blown internet security suite rather than just a VPN.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

A developer of hacking tools is advertising a $ 1,000-per-month feature that allegedly lets bad actors have continuous access to vulnerable Gmail inboxes. The report from the cybersecurity firm Hudson Rock claims the tool can keep accessing victims' Gmail inboxes even after password changes, browser closure and session revocations.

If this is true, it means that hackers could get access to password reset links, verification codes and therefore access to other accounts.

The malware, called Remus Stealer, supposedly gives bad actors a searchable inbox directly inside a stolen dashboard.

Hudson Rock says it spoke with the developer and a customer, who used the tool and provided them with screenshots of email messages, timestamps and control for sharing an impacted mailbox with other operators.

How the hack works

Per the security firm, the email-intercepting tool doesn't collect browser cookie files and Remus claims that password changes do not stop it.

It somehow avoids Google's anti-fraud checks, though the developer didn't give Hudson Rock any technical details, for obvious reasons. Remus did say that it interacts with browser memory. This doesn't explain how it survives password changes or session revocation though.

“The leading broad explanation is that Remus acquires or establishes reusable authorization while it has access to a signed-in browser. A remote component could then request mail after the local executable exits, for as long as the service accepts that authorization,” Hudson Rock wrote in its report.

Tom's Guide reached out to Google about this tool and will update this article if and when the company responds.

How to stay safe

The tool is advertised for "enterprise" customers, so most people should be safe from the damage it can do. It most likely will be used to target organizations and high level individuals. Plus, the mailbox needs to be compromised already before the tool can be utilized.

But, if you somehow find yourself impacted by this infostealer here are some recommended steps from Hudson Rock:

• Isolate the infected computer and clean it before accessing trusted accounts again
• Change compromised passwords on a clean device
• Review signed-in devices and revoke suspicious session and third-party access
• Check your Gmail settings for unauthorized changes
• Secure other accounts that use the compromised mailbox for password resets or verification

As for protecting your email before the tool can even be applied, make sure you're on guard against phishing attacks. Scammers like to instill a sense of urgency, and their emails often have red flags like misspelled words or poor grammar. Of course, you should double-check the sender's email address too.

To keep your computer safe from malware and other viruses that could come from opening a phishing email, it's important to install the best antivirus software on your PC, the best Mac antivirus software on your Mac and one of the best Android antivirus apps on your Android smartphone.

If this new tool is as effective as the hackers behind it claim, Google will likely introduce additional protections inside Gmail to keep both its business and ordinary users safe.

More from Tom's Guide

• These are the 5 best password managers to protect your online accounts
• So-called 'SMS of Death' can crash Android phones with just a text: what you need to know
• Over 300 Chrome extensions found hijacking searches of 13.4 million users — how to stay safe

Google says it's giving schools more control over AI, but there's a catch that could change how millions of students search the web. Schools that want to keep AI-generated answers out of the classroom will also have to give up Google Search through student accounts. Now, DuckDuckGo is stepping in with an alternative.

In a Tuesday announcement, Google said it will disable access to several products, including Gemini and Google Search, for K–12 student accounts unless school administrators turn them on.

Administrators will be able to enable Search without turning on Gemini, but they won't be able to remove AI Overviews and other built-in AI features from Google Search.

"If a school is not comfortable with that and simply wants AI off, then they have the choice to not have Search on at all," Chris Phillips, Google's vice president of education, told Chalkbeat.

The decision has sparked backlash from educators and lawmakers, while Google maintains that the changes give schools more control over the technology students use.

DuckDuckGo, however, says schools shouldn't have to make that choice. In a statement to Tom's Guide, the company argued there's no technical reason Google can't disable AI features in Search. And it isn't just criticizing Google's decision. DuckDuckGo offers an AI-free version of its search engine and instructions for schools to make it their default, giving districts another option if they don't want AI-generated answers in student searches.

With Google's changes expected to roll out in early 2027, schools now face a decision about how students will search the web and how much AI they want involved.

Why Google Search is part of the deal

Google has spent years integrating AI into its search engine, most visibly through AI Overviews, which provide generated summaries above traditional search results.

Now, those features are becoming a sticking point for schools that want students to research independently without relying on AI-generated answers.

"Search and AI are deeply integrated," Chris Phillips, Google's vice president for education, told The New York Times.

According to Phillips, students in schools that prohibit AI entirely will not have access to Google Search through their school accounts. Instead, they'll see a message indicating that the service is unavailable.

The restriction applies to school-managed accounts under the new controls,

Google has also made it clear that administrators can enable individual products, including Gemini and Google Search, rather than accepting every AI service as a package. But the problem is much greater because schools still cannot offer an entirely AI-free version of Google Search.

DuckDuckGo says schools don't have to choose

Not everyone agrees with Google's explanation for keeping AI in Search.

In a statement to Tom's Guide, DuckDuckGo pushed back on the idea that schools must accept AI-generated answers to keep using a search engine.

"There is no technical reason why Google can't turn AI off," the company said, arguing that AI Overviews is a search feature similar to maps, flights or weather that Google can choose when to display.

DuckDuckGo points to its own search engine as an alternative. Unlike Google, it allows users to adjust how often AI-generated answers appear or turn them off completely.

The company also offers noai.duckduckgo.com, a version of its search engine that automatically disables AI features and filters AI-generated images from results without requiring users to change any settings.

Schools looking to avoid Google's restrictions can also make DuckDuckGo their default search engine, according to the company.

Google is also bringing AI tutoring to Search

Alongside the changes to school controls, Google is expanding Guided Learning, an AI-powered feature designed to help students understand subjects rather than simply giving them answers.

Guided Learning is already available in Gemini, and Google announced that the feature is now available globally in Google Classroom.

The company is also bringing similar capabilities to Google Search, beginning with a pilot in selected U.S. schools later this month.

For example, a student who searches for help with a physics problem might receive questions and explanations that guide them through the solution rather than an immediate final answer.

Someone researching a book report could receive prompts encouraging them to think through the material. Google calls this approach "productive struggle," the idea that students learn more when they work through challenges rather than immediately receiving solutions.

In Google Classroom, teachers can assign Guided Learning activities based on class materials and receive feedback about where students might need additional support.

Google says its research shows that Guided Learning can improve learning outcomes. However, the effectiveness of these tools in everyday classrooms will depend on how students use them and how well the AI avoids simply completing assignments for them.

There are already questions about those safeguards. In testing reported by The New York Times, the consumer version of Guided Learning produced a detailed essay when given an Advanced Placement history prompt. Google says the school version includes additional restrictions.

Many schools are pushing back on AI

The changes come amid growing concerns about how AI tools affect children and teenagers.

AI can be useful for explaining difficult concepts, brainstorming ideas and helping students study. But educators also worry that students may become too dependent on chatbots, use them to complete assignments or trust answers that aren't always accurate.

In September, New York City and Los Angeles, two of the country's largest school districts, introduced restrictions on student access to generative AI tools on school devices.

Some school officials have specifically wanted the ability to disable Google's AI Overviews while preserving conventional web searches.

Google's new policy does not provide that option. The company is reversing an earlier decision to enable certain AI features by default in Google Classroom for schools that had already permitted Gemini access.

That reversal gives administrators more control over which Google AI products students can use. But it stops short of letting schools completely separate Google Search from its built-in AI features.

What this means for parents and students

For families, the most important thing to understand is that these changes are not taking effect immediately. Google says that it will share more details with schools in the coming months, with the new controls expected to arrive in early 2027.

Whether a student loses access to Google Search through their school account will depend on the choices made by their district or school administrators.

Schools can enable specific Google products individually, but those that want to keep AI entirely out of Google Search may need to consider alternative search engines or research tools.

Parents concerned about AI in their children's classrooms can ask their schools which Google services are currently enabled, whether students can access Gemini, and how the district plans to handle the upcoming changes.

It's also worth asking whether students will be using Guided Learning and what oversight teachers will have over those interactions.

More from Tom's Guide

• Living near an AI data center might not hurt your home's value — here's what new research found
• ChatGPT has a clever new way to fight back against election deepfakes — I tried it and it actually works
• A few tech leaders are rebranding AI as ‘superintelligence’ — calling it that doesn’t make it accurate

Late last week, a report popped up about a new Android phone exploit the security researcher dubbed "SMS of Death." Per the report, the attack, tracked as "CVE-2026-58882," lets malicious actors disrupt cellphone service or crash Android phones by overloading them with a repeating crafted SMS text message.

The denial-of-service flaw can even interrupt ongoing calls, including emergency calls, without requiring you to open the message. Apparently, the Android operating system processes the message before it even reaches your text message inbox, meaning you wouldn't immediately understand what caused the phone to crash.

Researcher Mark Blah says that even if you reboot your phone, the hacked message "stays queued and is retried on every boot, so the phone can crash on startup until it is cleared (recovery below)."

Upon finding Blah's report, Tom's Guide reached out to Google because the report claimed that Google had deemed it a "non-priority." Google has not yet responded to our inquiries.

However, some Android phones may already have the exploit patched.

October patch

Blah's report found that the exploit affects Android versions 12 up to 16 and was discovered on multiple devices, including Pixel 9s and Samsung Galaxy phones.

It appears Google patched the exploit in the October 2026 Android security update (if you haven't updated your Android phone, you should). However, that's only for Android versions 14 through 17. It does not appear to be available for any devices still running Android 12 or 13.

Per Blah, the flaw uses an improper validation of a header length in the Android WapPushOverSms.decodeWapPdu function. Attacks send a malformed WAP Push message to the targeted phone.

When this message is translated, it turns into a negative value that Android attempts to allocate memory for, which triggers a NegativeArraySizeException that crashes the com.android.phone process.

That process manages cellular functions, which disrupts connectivity and disconnects calls. This causes repeated crashes because the network tries to redeliver the malicious messages, which stack up and force Android to process each one. It only takes 20 bad messages to cause the crash.

Per the Google fix, the crash is prevented by catching the exceptions triggered by the attack messages. Then the patch deletes the messages from the SMS database to prevent them from looping.

What you need to do

Android security updates are generally automatically installed on supported devices. So you should already have them.

However, availability does depend on the phone maker and network carrier. So you should check your phone to see if the October patch has been applied. A restart may be required to complete the installation.

For the most part, this isn't an attack you can do anything about, but based on the patch notes and Blah's report, it doesn't seem to be widely deployed; instead, it appears to target individual phones. Since a working proof-of-concept of the exploit has been released, the best thing you can do is make sure you keep your phone up to date.

More from Tom's Guide

• Now is the perfect time for Samsung to release a cheaper Galaxy Z Fold 9 FE — and it's all because of iPhone Duo
• 3 Android Auto apps that do what Google Maps and Waze can’t
• iPhone Duo vs. Samsung Galaxy Z Fold 8: Which foldable is the best?

An ongoing security investigation by Socket's John Tuckner (via Bleeping Computer) has discovered a search-hijacking campaign that involves 319 Chrome extensions with a combined 13.4 million downloads. The malicious extensions redirect search queries through tracking servers to generate advertising revenue from Bing and Yahoo.

It's more than double from Tuckner's April report that found "only" 57 Chrome extensions and 6 million downloads.

According to Tuckner, the malicious extensions are usually found on websites advertising tools that are labeled as "PDF converter", "AI search", or "safe search".

"These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID," Tuckner wrote.

The extensions apparently aren't found on the official Chrome Web Store either. Rather, they're unlisted and are only really found through the shady advertising.

How the extensions work

Apparently, the extensions use Chrome's built-in 'chrome_settings_override' setting that lets them replace your default search provider.

What this means is that your searches are captured as they pass through the operator's server. After that the redirect could be sent through a site with malware attached, though currently, per Tuckner they're mostly routing to Yahoo and Bing and to falsely claim advertising revenue.

"The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads," Tuckner said.

As of this writing, the report says that most of the extensions have been removed the Chrome Web Store when the report was published, however, new ones are constantly being added.

"Ultimately, Google can benefit from more advertisements being run and more extensions being listed in the marketplace so there may not be an urgent reason to police this activity too broadly."

How to stay safe

Even if Google isn't policing this specific type of extension, malicious add-ons do slip through to the Chrome Web Store from time to time. When it comes to extensions, you need to be extra careful when downloading and adding them to your browser.

Normally, we would recommend you stick to well-known extensions from trusted brands. However, sometimes a lone developer creates one that does exactly what you need.

There are several recommendations we have to help you be a bit safer. Check the ratings and reviews of the extensions but also dig into the developer to see if they're legit.

Look, even good extensions can go bad, so you want to make sure that your Windows PC is protected with the best antivirus software and that you’re using the best Mac antivirus software on your Apple computer. That way, if an extension is spreading malware or other viruses, they’ll be detected and stopped before they can do any damage.

If you're constantly trying different extensions, you should consider one of the best identity theft protection services. They can help get your identity back if it's stolen or recover lost funds due to scams and cyberattacks.

More from Tom's Guide

• These are the 3 best budget laptops we've tested for value that don't feel cheap
• Your personal information is everywhere online — 5 ways to start removing it from the internet
• Chrome could soon let you ask Google about anything on your screen — even outside the browser

Whether you're worried about your smaller child accidentally clicking through the wrong apps, or maybe an older child that’s a little too curious for their own good, you should know how to secure their new tablet.

Here’s how to establish a safe space for your child to use your device.

Setting up an Amazon Fire Kids Tablet

One of the simplest tablets to set up for your kids is the Amazon Fire Kids Tablet. I’ve used it for my own kid for many years, and while it does have its frustrating quirks, it does get the job done. Bear in mind this is effectively just a Fire Tablet with a colorful case, so it does include an adult profile that is necessary to set up to manage the device.

After you’ve created your profile, you’ll create an Amazon Kids Profile. It’ll guide you through a list of settings that you can customize to your child’s needs and send them on their way. In order to monitor and adjust settings on the tablet, go to the Amazon Parent Dashboard (you can do this remotely). From here you can adjust settings like time limits on apps, content filters, and even add content from an adult library. For example, I had to manually add HBO so I could put on Sesame Street.

If you do need to lock the device down for any reason, you can hit Pause or Lock Device on the Amazon Parent Dashboard. You can set a duration or set it indefinitely until the device is unlocked by you.

Setting up an Android tablet

For an Android tablet, the first thing you’ll want to do is set up Google Family Link either through a web browser or the app itself on your own device (Android or iOS). From there you can create your child’s account, which includes creating an email address for them (weird, I know). Then when you’re actually setting up the tablet, you can sign in using your child’s email address. It’ll prompt you to sign into your own account afterward.

If your child is on the younger side (under 9), you can put them on Google Kids Space, which is tailored with content-restricted apps, books, and YouTube Kids videos. You’ll still have access to parental controls with this app.

If Google Kids Space is not for your child, or it’s unavailable for your device, you’ll be able to manage the general kids experience in Google Family Link. Here you can control app approvals and limits, set screen time limits and even set a scheduled bedtime. You can also manage how Google Chrome is used and which sites your child can visit.

Locking the device down is as simple as clicking Lock now in the Family Link app. You can use Downtime to run this on a schedule, and you can also use it to grant bonus time.

Setting up an iPad

You can go to your iPad settings, select Family Sharing, Add Member, and create a child account. From there, follow the prompts until the account is created, and set a unique screen time password so your child can’t override the settings.

You can configure parental controls from your Apple device or the iPad itself. Navigate back to Family Sharing, click on your child’s name, and then select Screen Time. From here you can adjust content restrictions on apps and websites, even limiting accessible websites to one or two trusted sources. You’ll be able to set time limits and schedules for apps as well, and can also lock them into a single app with Guided Access in the Accessibility settings. Make sure to adjust the Communication settings as well to manage who they can contact.

To lock the device, you can access the parental controls remotely and turn on Downtime — this can be immediate or set on a schedule.

Bottom line

It’s not terribly difficult to set up a new tablet for your kids, although I know from experience that it’s not always seamless. Make sure you look over the parental controls thoroughly. It has less to do with lack of trust and more to do with safeguarding. It’s all too easy for kids to get access to something that they’re not supposed to.

I’d also be careful with YouTube Kids — I have seen some brainrot videos on there, including AI slop, that aren’t good for child development because they’re either overstimulating or not educational. I highly recommend content from established educators like Ms. Rachel. For general entertainment, you can find Blue’s Clues going strong on there, but it’s also worth downloading the PBS Kids app itself for some consistent safe content.

More from Tom's Guide

• Smart TVs collect a surprising amount of your data — here’s how to stop them
• How to find out if your data is on the dark web — and how to remove it
• 10 simple security settings you should change on your phone and PC right now

Data breaches have become commonplace in our current era of privacy invasions, and having our data exposed on the dark web is a serious possibility. Your information being blasted is scary no matter where it is, but if you’re not someone browsing the dark web, how would you know if your information got leaked? Ideally, companies will alert you if there’s been a breach, but that’s not always the case, especially if the company doesn’t even know it’s been hacked.

If you have any reason to believe that your sensitive data has been leaked, you should know how to find out what it is and how to deal with it.

Finding your data on the dark web

Don’t start surfing the dark web yourself. The last thing you need is to infect your system with malware that’ll expose more of your data to malicious actors. There are a couple services you can use that’ll scan for your data across marketplaces and forums.

Both Aura and Experian are trusted services that offer a free dark web scan. If they find nothing, you’re likely free and clear. However, if something pops up, you should act immediately.

Can you remove data from the dark web?

No, unfortunately there’s no way to delete your data from the dark web, and I wouldn’t trust any service that claims to do so. What you need to do now is identify the exposed data and defuse the threat.

One of the most common data breaches involve emails and passwords. Obviously, you need to change your passwords, but you also should activate two-factor authentication (2FA) or multifactor authentication (MFA) on all your accounts. Yes, all of them, not just the affected ones. Using unique passwords for every account is also important so you can isolate threats — this can be made more convenient with a password manager.

If your banking or credit card credentials got leaked, you need to contact your financial institutions and place freezes or fraud alerts on your accounts. If your social security number got leaked, you’ll need to freeze your credit. Go to Equifax Credit, Experian Credit, and TransUnion Credit to do that. While the service is free and you can lift the freeze whenever you want, you should keep it frozen and only temporarily lift it when you need to apply for new credit.

Still, once all your information is out in the open, someone can use that data to impersonate you. Potential victims of identity theft should file a report with the Federal Trade Commission (FTC) on IdentityTheft.gov. While it’s unlikely to be able to change your Social security number, it can be done in extreme cases.

Bottom line

Again, once your data has been exposed, there’s no removing it from the dark web. And it’s possible that another breach of your data could find itself there, so you might want to use a continuous dark web monitoring service. Experian is one of the free ones, although it does have paid tiers.

As far as prevention goes, there’s not much you can do to stop your data from being leaked into the wild, but there are steps you should take to reduce the potential damage to your life, namely maintaining unique passwords for your accounts and activating 2FA or MFA.

The most important takeaway here is not to dawdle. Take the measures to protect yourself and monitor your accounts going forward. You could be exposed to something as simple as spam emails, which you should be able to suss out, but there are worse things than spam.

More from Tom's Guide

• Smart TVs collect a surprising amount of your data — here’s how to stop them
• 10 simple security settings you should change on your phone and PC right now
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

Hackers have reportedly broken into 25 servers across four countries, including systems connected to a U.S. government-affiliated organization. Security researchers also discovered evidence that AI tools may have played a role in the attack.

According to a new report from Dream Research, published Monday, the attackers exploited critical vulnerabilities in PHP, a programming language used by millions of websites, before using another security flaw to gain full control of vulnerable systems.

The attacks targeted servers in the United States, Japan, Taiwan and South Korea. Researchers found evidence pointing to a possible Chinese connection, although they have not identified the attackers or confirmed any government involvement.

What makes the discovery particularly concerning is how far the attackers managed to get. In one U.S. government-affiliated environment, they moved beyond the initial breach and gained access to internal network information, employee account listings and authentication credentials.

And while AI's exact role remains unclear, researchers found several tools in the attacker's environment that raise questions about how AI could be accelerating cyberattacks.

Hackers turned one security flaw into a much bigger attack

The attack started with two critical security flaws, known collectively as PHP2Shell, that were publicly disclosed on October 21.

PHP is used behind the scenes by millions of websites, including WordPress sites and online services. The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can let hackers run malicious commands on vulnerable servers.

But the attackers didn't stop there. They combined those flaws with another Linux vulnerability called Fragnesia, allowing them to take full control of certain firewall systems without needing a username or password.

According to a Dream Research report shared with Tom's Guide, the entire process could take less than 15 minutes.

The hackers started by scanning roughly 19,000 internet-facing firewalls before narrowing their targets to 240 potentially vulnerable systems. From there, they used automated attacks to breach 24 firewalls and an additional internal management server, bringing the total to 25.

Researchers also found that the hackers had installed malicious web-based tools on many of the compromised systems, giving them a potential way back in even after the initial attack.

The attackers reached a U.S. government-linked network

Arguably, among one of the more concerning discoveries involved three compromised servers linked to a U.S. government-affiliated organization.

After breaking into an internet-facing firewall, the hackers gained access to details about the organization's internal network, including its VPN, login systems and other servers.

They then worked their way deeper into the network, compromising a central firewall management server and stealing an account password. They also obtained a list of users and groups within the organization.

Researchers found evidence that the attackers tried to guess employee passwords, create unauthorized accounts and access additional login credentials, although it's unclear whether those attempts worked.

Dream Research also warned that the hackers may still have had access to some systems when the report was published, but that hasn't been independently confirmed.

The security firm hasn't named the firewall manufacturer or disclosed which software versions were affected, but says it has notified the vendor.

AI tools were discovered in the attacker's environment

Researchers also found signs that the attackers may have used AI. Their tools included Anthropic's Claude Code and an AI-powered security platform called aiscan, configured to work with the Chinese AI models DeepSeek and Kimi.

They also uncovered roughly 40 custom scripts whose consistent formatting and comments suggested some may have been written with AI assistance.

However, Dream Research cautioned that there's no direct evidence AI was used to create the exploits or carry out the attacks. The tools may have been present without playing a role in the breaches.

Still, the findings raise concerns about how hackers could use the same AI coding assistants that developers rely on to write code and troubleshoot problems.

Researchers also found clues suggesting a possible Chinese connection, including Chinese-language prompts, systems set to China's time zone and targets concentrated in the U.S. and East Asia. None of this, however, confirms who was behind the attacks.

Final thoughts

PHP2Shell doesn't directly affect your phone or laptop, but it could put information stored by websites and online services at risk. If attackers compromise those servers, they may gain access to passwords, sensitive data or internal systems.

Dream Research found no evidence that ordinary consumers' personal information was stolen in this campaign. However, the vulnerabilities are already being exploited beyond these 25 servers.

Amazon Web Services detected exploitation attempts as early as October 17, four days before the flaws were publicly disclosed. Sophos initially reported successful exploitation but later corrected its findings, saying it had observed scanning and a small number of failed attacks, with no confirmed breaches in its customer environments.

If you run a WordPress site or online store, check with your hosting provider to make sure PHP is patched. Updating WordPress plugins alone won't necessarily fix the problem. Administrators should also check for signs of compromise, since installing a patch won't remove an attacker who's already gained access.

For everyone else, using unique passwords, enabling two-factor authentication and watching for suspicious login alerts remain sensible precautions.

More from Tom’s Guide

• I tested ChatGPT vs. Grok with 5 questions boomers actually ask — and the winner surprised me
• Microsoft just offered 60,000 workers a way out as AI spending soars — here's what it could mean for your job
• ChatGPT has a clever new way to fight back against election deepfakes — I tried it and it actually works

Let's face it, most of us don't want to use Google for everything. We know every email we send or document we save is inspected for personal data to target us with ads. But the issue is that there's really no alternative...or is there?

Proton is changing the status quo – and it's doing a very good job of it. The Swiss company started off with Proton Mail – which, by now, is a truly viable Gmail alternative – but since then it has developed one of the best VPNs, Proton VPN, as well as Proton Drive, Pass, Docs, Sheets, Calendar, and most recently, Meet. Almost everything you need to de-Google your life.

Proton Unlimited includes every one of these apps. It usually costs $12.99 per month, but right now, in the run up to Black Friday, the 12-month plan has dropped to $6.49 per month ($77.88 upfront). This is the cheapest I've ever seen it.

If you're not sure, you can also purchase a single month for just $1 – although the discounted price on the long-term plan will likely end before that first month runs out.

This is almost certainly one of the very best Black Friday VPN deals we'll see this year, and it's not even November. More info below.

All you need to de-Google yourself

At $6.49 a month, Proton Unlimited covers a lot of ground. Proton VPN gives you access to 21,000+ servers across 149 countries, support for up to 10 devices, and excellent speeds. It also includes NetShield ad-blocking, Secure Core servers for extra security, Tor over VPN, split tunneling, a kill switch, and a strict no-logs policy.

Proton Mail includes 15 encrypted email addresses, unlimited hide-my-email aliases, and support for up to three custom domains.

Proton Drive adds 500 GB of encrypted cloud storage, with version history, while Proton Pass goes beyond basic password management with 50 vaults, unlimited logins, and a built-in 2FA authenticator which means one less app to juggle.

Proton Calendar keeps your schedule encrypted and off Big Tech servers, while Proton Meet offers private video calling without the Google or Zoom overhead.

Round that out with Proton Wallet – an encrypted Bitcoin wallet – and Lumo AI, Proton's privacy-first AI assistant, and you have a self-contained privacy ecosystem that rivals anything Big Tech offers.

One subscription, an escape from Google, and the biggest discount you'll see outside of Black Friday.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Digital privacy stalwart Proton is reportedly set to interview employees across the company about how they use AI in their work, and the answers could help decide who keeps their job. The firm behind Proton Mail and Proton VPN – one of the best VPNs – told staff about the plan in an internal email on Monday, October 26, which was leaked to 404 Media.

The email calls the re-interviews "consequential." What interviewers conclude will be written up and fed into a broader review of the organization, which could change people's roles and responsibilities – or whether they stay at Proton.

The move fits a wider push under CEO Andy Yen, who has been steering Proton toward heavier AI use, including the launch of Lumo, its privacy-focused chatbot. Proton had not responded to 404 Media's request for comment at the time of publication, but has now made a public statement on Reddit.

What Proton says

In the Reddit comment on r/ProtonMail, posted from the Proton_Team account, the company claims it is "not doing layoffs and using AI as an excuse." As a counterpoint to this, it states it has a talent shortage and is hiring across the organization.

"AI is changing the tech industry," the comment continues, "and we, like everyone else, need to evolve our ways of working to remain effective in our industry, and to deliver features faster to users."

The company says it is "assessing how colleagues are adapting to these tools, what support they need, and who can help lead this work."

Finally, Proton states that it is also "assessing whether everyone has the skills they need to take a step forward in a post-AI world," and "offering the support that is necessary, to those who need it, to succeed."

In the Reddit comment, Proton also published the full email, which it says went to some of its staff.

Who gets interviewed – and by whom

The email itself is less reassuring to those impacted: "We are now extending re-interviews more broadly to assess how people are adapting to AI and whether they have the capabilities and approach needed for Proton’s next phase."

Not everyone will be re-interviewed. Interviews will be prioritized according to the organization's assessment needs, the email says, and an invitation – or the lack of one – isn't an outcome in itself. Any decision affecting someone's employment will come separately.

Those who are invited will be interviewed by someone outside their own team and reporting line, chosen from a pool of leaders who "demonstrate strong AI capability."

The interviews will run from November 4 to 11, and staff are told to arrive with concrete examples of their use of AI. The email is blunt about what passes muster here: "Be ready to discuss what you have changed in your work, the results, what you have learned, what has not worked, and what you would do differently. A list of tools alone will not demonstrate this."

What Proton wants from staff

The email also presents the interviews as a route to advancement, saying staff who rethink their work, put AI into practice and help others adapt may be offered greater responsibility. It asks for "curiosity, judgment and urgency."

Yen himself first interviewed more than 40 senior leaders across Engineering and Product, the email says, before the process widened to staff across the company.

AI is not new at Proton. An AI writing assistant arrived in Proton Mail in 2024, Lumo followed in July 2025, and the chatbot got an upgrade in June 2026. Proton says it keeps no server-side logs of Lumo conversations and runs the chatbot on its own infrastructure.

Yen told Wired in an interview published in August that AI is surveillance and that Proton was reluctantly pulled into building AI tools. He added that he would probably prefer a world without AI, but accepts it is here to stay. Clearly, his opinion has not changed on the matter.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Adding extra layers of protection to your devices will save you a lot of trouble down the road. Invasion of privacy is rampant in this current day and age, and while it may seem like the powers at be might already know everything about you, that doesn’t mean you shouldn’t fight back.

Protect yourself by enabling these simple security settings on your smartphone and PC.

Enable automatic updates

It might feel like there’s an update every other day, but don’t sleep on keeping your devices up to date. Security vulnerabilities are inevitable, and will keep popping up so long as the tech exists. If you’re way behind on your updates, go to the System Settings on your device to enable automatic updates. If that’s unavailable, manually update it and check for updates periodically.

Disable your Advertising ID

Your device is actively collecting your data to feed you “relevant” ads, but you never know exactly what kind of data is being collected and where it’s going. Whatever device you may have, you’ll likely find options for your Advertising ID in the Privacy section of your System Settings. Disable or delete all mention of personalized advertising. You’ll still get ads, mind you, but they won’t be tailored by your personal data.

Disable lock screen notifications

If you’re out in public, it’s best practice to disable your lock screen notifications to prevent onlookers from gleaning your private information, especially if the data being displayed is sensitive. You can find this setting in the Notifications section of your device, where you can disable previews, or hide content.

Limit location permissions

You don’t need social media apps tracking your location all the time. Go to the Privacy or Security settings of your device and disable location permissions or limit them in specific apps. If an app needs your location to function, select the option that only allows it while using the app. Apps don’t need to be tracking your movements in the background when not in use.

Lock your device

Don’t leave your device permanently unlocked or to lock only after a long period of time. Come up with a longer, ideally unique, password and set your device to lock immediately when you move or put it away. You should be able to find this in your Security settings or your Account settings depending on your device. Disable any settings that extend unlock times in “trusted” environments. You could lose access to your device close to your home or car and leave it open to malicious actors.

Block the install of unknown apps

Most devices already have a setting that blocks the installation of unknown apps, but if you’re like me, you might have had to disable this feature in order to download something outside of native app marketplaces. Do yourself a favor and reinstate the block of unknown apps in your Security or App settings.

Enable device encryption (PC & Mac)

If your Mac or PC is ever stolen, the thieves won’t get access to your data if you’ve scrambled it by encrypting your drive. You’ll find this setting in Privacy & Security in both Windows 11 and macOS. On Windows it’s called BitLocker, and on macOS it’s called FileVault.

Enable Firewall (PC & Mac)

Turn on your network firewall to prevent suspicious connections from exploiting your device. If you have a Windows device, Microsoft Defender Firewall is likely already enabled, but it doesn’t hurt to check it in the Privacy & Security section. Meanwhile, macOS Firewall is actually disabled by default. You can turn that on by going to your System Settings and navigating to Network > Firewall.

Get a VPN

Unfortunately, smartphones and PCs rarely come with built-in VPNs, so it’s not exactly a simple setting you can turn on, but I highly recommend getting one to beef up your network privacy. If you’re not looking to spend money, Proton VPN is a reputable and free VPN.

Update browser permissions

Whatever your primary browser may be, you should adjust your default permissions in your Site Settings, usually found in the Privacy & Security section. Set each of the permissions to “Ask first” if they’re not already. The last thing you need is some random website activating your microphone or downloading files without your permission. You might also find a Safe Browsing setting in your browser, if not already built-in, that you can enable as well for enhanced protection.

Bottom line

Taking charge of your security settings is one of the few things you can do to stay in control of your privacy. Corporations are actively spying on us to try to sell us the “next best thing,” but we don’t have to make it easy for them. And we definitely don’t want to make it easy for hackers to steal our data and wreck our lives.

More from Tom's Guide

• 5 fast steps to take immediately after a company leaks your personal data
• 7 warning signs your Android phone or iPhone has malware
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

Yes, even your TV is spying on you. The terms of service on a smart TV change like the wind, and every time you’re asked to accept a litany of new agreements that go beyond what is necessary for the TV to function, you’re likely volunteering to be spied on by your own smart TV, if it hasn’t already been enabled by default. The mole in your house is called Automated Content Recognition (ACR).

ACR is a technology that identifies what it is you’re watching on your TV. This applies to both visual and audio sources. This not only works for built-in apps but also anything connected through HDMI ports, like an Amazon Fire Stick or game consoles. You could be completely offline, connecting an old school DVD drive to your TV, and manufacturers can still steal that data.

Companies use ACR to learn what you like and don’t like and then use that information to hit you with ads or suggest content. But of course, it’s not just about suggesting things that you may like to watch. Manufacturers turn around and sell this data to companies to then use predatory tactics against you. It’s like a stalker in league with other stalkers — they learn all about you and then lure you in with the tantalizing appeal of consumerism.

If you think that’s bad, Gamers Nexus published a video back in September investigating a serious privacy issue that LG Smart TVs have — the microphone is on and actively listening, even when the screen is turned off. It also stores the recorded data when the TV is completely disconnected from the internet. Terrifying.

If you’d rather not have all of your personal information stolen from something as simple as a display, then you need to disable ACR immediately. Here’s how.

How to stop smart TVs from stealing your data

Unfortunately, some manufacturers turned to cleverly calling ACR something else entirely, and often hide the setting deep within a series of menus. I’m going to go over a few of them so you generally know what to look for. However, my overall advice is to do a thorough sweep of your TV settings. Typically, there are explanations next to each setting, and if not, look them up to see what they’re really about.

LG TVs

Let’s start with the spooky one first. LG likes to call its ACR technology Live Plus, and you can dig that setting out by going to Settings > General > System > Advanced Settings. I’d disable Live Plus as well as Live Promotion. Depending on the model you have, there’s also Content Recommendations, Screen Saver Promotion, and Limit Ad Tracking settings that you can disable too.

Amazon Fire TVs

At the very least, Amazon’s Fire TV has the decency to call the setting what it is — Automated Content Recognition, although most people might not know what that even means.

To disable it, you’ll want to go to Settings > Preferences > Privacy Settings. There you can turn off not only ACR but also Device Usage Data, Collect App and Over-The-Air Data, and Interest-based Ads. Or literally anything else that seems like it wants to spy on you.

Samsung TVs

For Samsung, you’ll want to go to Settings > All Settings > General & Privacy > Terms & Privacy. There you should disable Viewing Information Services and Interest-Based Advertising. If you have an older Samsung, you might find this setting in the Support > Terms & Policies section.

Sony TVs

Sony decided to call its ACR Samba Interactive TV, another fancy name for effectively the same spying device. You’ll find it in Settings > Initial Setup or All Settings.

Roku TVs

For Roku devices, navigate to Settings > Privacy > Smart TV Experience and then disable ACR or Use Info from TV Inputs. In the Privacy section, you also might find Advertising and Microphone settings, and I highly recommend disabling anything in those sub menus.

Vizio TVs

Vizio hid this setting behind the Reset & Admin section. You’ll find it by going through Menu > System > Reset & Admin, where you can then disable Highlight Viewing Data.

More from Tom's Guide

• 5 fast steps to take immediately after a company leaks your personal data
• 7 warning signs your Android phone or iPhone has malware
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

If you opened X this morning, you might have seen this viral tweet floating around cybersecurity circles. It’s hilarious, but it’s also uncomfortably close to the truth.

Over the past 24 hours, two completely separate, absolutely massive cybersecurity disasters collided.

• First, Microsoft revealed that a nation-state hacking group used an autonomous AI agent to brute-force its way into thousands of cloud accounts in a matter of hours.
• Then, a critical vulnerability was discovered in PHP — the foundational code that runs roughly 70% of the entire internet — forcing major sites like Wikipedia to temporarily pull the plug on their own servers just to survive.

If you are wondering why IT departments across the globe are currently stress-sweating through their flannels, here is a breakdown of exactly what is happening, and what you actually need to do about it.

Disaster 1: The autonomous AI hacker (ARTEX)

I’ve spent the past couple of weeks writing about how to build a local AI agent — like my digital assistant “Jeeves” — to automate admin tasks like checking your Gmail.

Well, a Chinese-linked threat actor known as “Storm-0940” just showed us the dark mirror version of that exact technology.

According to Microsoft, the hackers stole credentials to ConnectWise (a massive IT management software provider). But instead of typing in passwords, they handed those credentials to an agentic AI tool called ARTEX.

ARTEX is essentially a malicious version of Jeeves. The hackers gave the AI a goal, pointed it at Microsoft 365, and let it off the leash. The AI divided up the tasks, bypassed standard logins by hijacking authentication apps, and achieved a terrifying 2,900 sign-in attempts per minute.

Within a few hours, the AI had hit 2,250 different corporate tenants across aerospace, defense and finance. It moved so fast that human security defenders literally didn’t have time to read the alerts before the AI had already gained privileged cloud access.

It is the ultimate proof that the “cloud tax” isn’t just expensive — it’s a massive, centralized target for autonomous bots.

Disaster 2: The PHP meltdown

And while that AI was busy tearing through Microsoft 365, the actual foundational bricks of the internet started crumbling. On October 21, the PHP project disclosed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

To spare you the hyper-dense developer jargon: there is a flaw in how PHP handles memory. If an attacker sends a specific, unauthenticated request to a web server, they can corrupt the memory and execute their own malicious code directly on the machine.

It’s been so bad, it scored a 9.2 out of 10 on the severity scale.

Why is this a big deal? Well, PHP is the backbone of WordPress, major content management systems, and millions of custom web applications. It powers roughly 70% of the entire web.

The vulnerability is so trivial to exploit — and the blast radius is so large — that both Wikipedia, the Internet Archive and Steam reportedly took precautionary measures to shut down their infrastructure while applying the patch.

Ironically, Wiz Research actually used Google’s Gemini 4 Argon AI model (alongside OpenAI’s GPT-5.6 Sol) to help find and validate the patch for this PHP flaw. So, while one AI is currently attacking the cloud, another AI is desperately trying to patch it.

What you need to do

If you are just a regular person trying to browse the web and get your work done, you don’t need to throw your laptop in a lake. But you do need to be on the defensive.

The internet may not be literally collapsing, but the walls are definitely shaking. When autonomous AI agents can breach thousands of cloud tenants before a human can even click on an alert, relying entirely on massive, centralized tech conglomerates to keep your data safe is a losing bet.

More from Tom's Guide

• Exclusive: Apple's OLED MacBook Pro may face a '$300 to $500' price hike to 'protect their profits' from RAMageddon
• Elon Musk reportedly throttled Starlink for Ukraine’s drones — here's how
• I’ve been living with Nvidia’s RTX Spark for a week — it’s not a MacBook Pro killer but something much weirder and wildly powerful

Space-based internet is supposed to be the ultimate equalizer, beaming high-speed connectivity to even the most remote corners of the globe. But what happens when the CEO of your internet service provider decides to impose a hard speed limit?

That’s a good question, and we’re seeing the answer play out in real time. According to a new report from The Wall Street Journal, Elon Musk ordered a slowdown of the military-grade version of Starlink relied on by Ukraine's military.

The move effectively blinded fast-moving strike and interceptor drones, rendering Ukraine unable to defend itself against Russia's attacks.

There is a messy political blame game happening right now between Musk, the Pentagon and the White House over who actually gave the order. Last Wednesday, Musk claimed that Starshield — the military application of Starlink — is controlled by the U.S. government.

However, on Tuesday, Secretary of Defense Pete Hegseth told reporters that “We haven’t made any directives or anything like that," according to the Journal.

Still, the Journal's report also says that Musk spoke with members of the administration, including Trump, before initiating the speed cap.

Tom’s tech explainer: A 99-mph speed limit

The restrictions reportedly imposed on the Starlink network were very specific: they targeted velocity.

According to Michael Kofman, a war expert at the Carnegie Endowment for International Peace, who was quoted in the WSJ article, the connection was throttled for devices traveling more than 99 miles per hour.

You might be wondering how an internet provider knows how fast your device is moving (I was confused too). Starlink dishes aren’t dumb antennas. To maintain a connection with satellites flying overhead in Low Earth Orbit, the dish has to constantly calculate its own position.

This is done with GPS to report exact coordinates and speed back to SpaceX’s servers. And because Starlink always knows these coordinates on a near-real-time basis, it is very simple for the company to write a software rule that says: “if this dish travels faster than a standard car on the highway, throttle the connection.”

More from Tom's Guide

• Turn your PDFs into audiobooks with ChatGPT — here's the simple trick
• AI researcher warns cyberattacks could take down power, banking and water within a year — here's how to prepare
• An OpenAI employee allegedly used AI to spy on his own company — then AI helped catch him

Elon Musk just announced two changes to X's recommendation algorithm, and they could affect what shows up in your For You feed. Instead of relying primarily on familiar engagement signals such as likes, reposts and replies, X is improving its ability to predict which posts will hold your attention and which ones you'll actually finish reading.

In an Monday post, Musk outlined two updates: a new AI ranking model that better predicts how long someone is likely to spend viewing a post, and a retrieval model trained to find posts people read all the way through.

It's a potentially significant change for anyone who uses X.

X wants to know what keeps your attention

X already uses AI to determine which posts appear in your For You feed. According to the company's published recommendation algorithm, the system pulls posts from accounts you follow and accounts you don't, then uses a model to predict how you're likely to interact with each one.

Those predictions include actions such as liking, replying, reposting and spending time viewing a post. So tracking attention isn't entirely new. The first update that involves the way X uses that information is that the model will get better at predicting how long someone will spend on a particular post.

So, that means, if you're scrolling past two posts about the same breaking news story, the one that has more likes isn't necessarily the one people will read. The one with the most details for readers could be what keeps them engaged.

A recommendation system that places greater emphasis on predicted reading time could give a less viral or less liked post the advantage.

The other update happens earlier in the recommendation process. X's new retrieval model is trained to surface posts that people read from beginning to end. Ranking determines which posts get priority among the candidates X has already found. Retrieval helps decide which posts make it into that group in the first place.

What could start appearing in your feed?

For readers, the most noticeable difference could be a shift toward posts that take longer to consume.

Detailed explanations, thoughtful threads and posts that encourage people to keep reading could potentially benefit. A useful breakdown of a complicated news story, for example, might attract attention even without an enormous number of likes.

The same could apply to posts from smaller accounts that consistently hold readers' attention. Since X already recommends content from people you don't follow, its updated retrieval model could help those posts reach new audiences.

But none of this guarantees that longer posts will suddenly dominate your timeline. A post's length doesn't necessarily determine whether someone finishes reading it. A short, compelling post might perform well because nearly everyone reads the whole thing, while a lengthy explanation could lose readers halfway through.

X also hasn't disclosed exactly how much influence the new models have compared with existing engagement signals. It's too early to say whether likes and reposts will become significantly less important.

Content that keeps people reading isn't always content that's helpful or accurate. An outrageous claim, an argument or a deliberately suspenseful story might hold someone's attention just as effectively as a useful explanation.

So with this restructuring, the more engaging story, may not be the one that's more "quality."

Musk says people are spending more time on X

Alongside the algorithm announcement, Musk shared a chart showing daily user active seconds on X. He claimed that the metric is growing exponentially and reaching new highs almost every day.

The chart suggests that time spent on the platform has increased, but the figures haven't been independently verified, and the available data doesn't establish exponential growth.

It's also unclear how much of that increase can be attributed to the latest recommendation models. Musk hasn't provided a detailed deployment timeline or evidence isolating their effect from other changes to X.

For a platform competing with TikTok, Instagram and other attention-driven apps, that makes sense. The longer someone stays on a platform, the more opportunities there are to show them content and advertising.

The takeaway

The good news is that you don't have to rely entirely on X's recommendations. If your For You feed starts showing posts you aren't interested in, you can select the three-dot menu on a post and choose Not interested in this post. According to X's Help Center, that feedback helps the platform adjust future recommendations.

You can also mute accounts or keywords to reduce unwanted content. For a more straightforward experience, switch from For You to Following at the top of your timeline. That feed shows posts from accounts you follow in reverse chronological order, rather than using the same personalized recommendation system.

There's no need to change your settings immediately, though. X hasn't released enough information to establish precisely how individual feeds will change.

More from Tom's Guide

• Turn your PDFs into audiobooks with ChatGPT — here's the simple trick
• AI researcher warns cyberattacks could take down power, banking and water within a year — here's how to prepare
• An OpenAI employee allegedly used AI to spy on his own company — then AI helped catch him

Whether you missclicked or downloaded the wrong file, malware can infect your Android device or iPhone and you might not have even noticed. There are some signs that are completely obvious, but others are a little more discreet and take some snooping around to suss out.

Here are some warning signs that you might have an unwanted guest on your smartphone.

Pop-up ads

Advertisements spamming your phone, especially outside of an app, is a dead giveaway. Don’t ignore the problem, even if you’re a fan of Neon Genesis Evangelion who really appreciates seeing “CONGRATULATIONS” spread across their screen.

New apps

If your phone is packing a ridiculous number of applications like mine, then you might not notice when a new app creeps into your system. For both the sake of spotting malware and cleaning up your library of unused apps, it's worth taking the time to audit your current apps.

Shorter battery life

Malware does a lot in the background to wreak havoc on your device, and that takes power. So one of the telltale signs of malware infecting your device is if you experience shorter battery life. Battery life can vary, especially as a phone ages, so I recommend looking up the average battery life for your device to see if there's an obvious discrepancy.

Performance issues

Got a brand new phone and all of a sudden everything slows down to a crawl? Are apps randomly crashing on you? This is another sign that malware may have crept onto your device. This may be more difficult to spot on phones already experiencing slower performance, so keep an eye out for other signs if that’s the case.

Overheating

Unless you still have a Samsung Galaxy Note 7 hanging around, which you shouldn't, your device should not be scorching your hand. If your smartphone is spamming you with overheating warnings or is straight up crashing, especially in temperate environments, there might be a virus giving your phone a fever (my dad joke for the day).

Abnormal data usage

Unless you have a limited data plan and are remaining vigilant about your usage, it’s unlikely you’ll notice malware taking up all your data. Unlimited data users who have never checked their data metrics need to be more alert. It doesn’t hurt to check your data usage every once in a while, if not to see what apps you’re maybe spending a little too much time on.

Your contacts get spam

The most embarrassing and frustrating sign of malware is all your friends and family getting hit with spam messages that can potentially affect their devices. You’ll likely hear about this sooner than later, but as someone who doesn’t actually use SMS to contact people, it doesn’t hurt to check your default messaging app. Hopefully your contacts know what you sound like versus a spam bot imitating you, but the sooner you alert people the better.

What you can do

If you’re still not 100% certain whether or not your device is carrying around malware, there’s a few things you can do.

For iPhone users, navigate to Settings > General > VPN & Device Management to check if any unknown profiles are installed. If you don’t find anything here, go to Settings > Privacy & Security and check on your app permissions. This might be a bit tedious, but you should do a step by step inventory of app permissions and revoke access to apps that you aren't using, and delete ones that you don’t recognize.

For Android users, go to Google Play > tap your profile picture > Play Protect. This will scan your device for any harmful apps. It typically runs automatically, but it doesn’t hurt to do a manual check.

If you don’t find anything going down these routes, Android users can download one of the best Android antivirus software solutions, which can not only help locate malware but also delete it. Unfortunately, iPhone users don’t have access to traditional antivirus software because of how Apple sandboxes each app, but you can download security apps that can detect data breaches.

If you can’t manage to track down the issue, then resetting your device to factory settings may be the next step. In this case, you should set up your smartphone as a new device, as any backups can bring with it the malware that infected the system to begin with. Then reintroduce apps and services one by one to see if the issue continues, and if it happens again, you’ll know where the call inside the house is coming from and you can get rid of it — it could be something as simple as a browser extension.

I highly recommend changing passwords on critical services, like banking apps, using a different device. Monitor your smartphone for a while to see if the issue has been addressed before relogging into any sensitive apps.

More from Tom's Guide

• 5 fast steps to take immediately after a company leaks your personal data
• 3 hidden macOS security features you need to turn on right now
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

No matter how diligent you are about privacy and security, there’s nothing stopping a company from leaking your personal data and leaving you exposed to malicious actors. You have to act quickly when there’s a data breach, especially if it’s a serious one.

In 2025 alone, the Federal Trade Commission (FTC) reported fraud and identity theft losses of over $15.8 billion. Leaks in your personal data can be a slippery slope, so here are the steps you should take to address them.

Assess the leak

Don’t panic. Take a deep breath. The first thing you need to do above all else is identify what information has been breached exactly. This could be anything as simple as an email address or as serious as a Social Security number.

If it’s the former, it’s likely all you’ll be a victim to is a litany of scam emails, in which case you’ll need to be more scrupulous while looking through your inbox. But if it’s something more than that, you should continue on to the next steps.

Change your passwords and activate MFA

Account information like passwords are among the most common leaks, and while it should go without saying that you should change your passwords, you need to take some additional steps to maintain your security.

First, you should use a unique password for every account that you have, so that multiple accounts aren’t at risk because of one breach. You can achieve that more easily with a strong password manager. Second, you need to enable two-factor authentication (2FA) or multifactor authentication (MFA) if it’s available on that account. This’ll add another layer of security so even if your passwords were leaked, hackers shouldn’t be able to access your account.

Contact your bank and credit card companies

If your banking and credit card credentials have been leaked, immediately contact your financial institutions. In the most ideal scenario, acquire a new banking account or credit card number. If that’s not possible, however, you should be able to place a fraud alert on your accounts.

Going forward, you should keep a close eye on your accounts, even in the coming year. If your information is out there, it could be abused at any time, not necessarily immediately.

Freeze your credit

In the event of a serious breach, specifically one where your social security number is leaked, you need to freeze your credit immediately. This will stop anyone from trying to take out a loan or a new credit card in your name.

You’ll need to contact the three credit bureaus individually — that’s Equifax Credit, Experian Credit, and TransUnion Credit. Freezing your credit is free and you can lift the freeze whenever you want. However, unless you get a new social security number, which is very difficult to do, you should keep the freeze on your credit and only temporarily lift it when you need to apply for new credit, like a mortgage. There are also credit checks that you might need to undergo for an employer or landlord, which could require a temporary lift.

Report identity theft

In the absolute worst case scenario, where all your vital personal information is leaked, someone may attempt to steal your identity. Unfortunately, identity theft could get bad very quickly, especially if said perpetrator is committing crimes under your name.

If you believe you’re a victim of identity theft, you need to go to IdentityTheft.gov and file a report with the FTC. From there, follow the steps it lays out for you to get this under control.

Bottom line

Once your information is out in the open, there's no taking it back. But inaction could lead to some serious repercussions. Once you've dealt with your current breach, do yourself a favor and take the time to secure accounts with other companies. Things like setting up unique passwords and enabling 2FA or MFA will save you some trouble down the road.

More from Tom's Guide

• 3 hidden macOS security features you need to turn on right now
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• AI scams are getting scary realistic — 4 red flags to watch out for

We're starting to see some Black Friday VPN deals arrive, and this one is worth stopping for. Surfshark has just dropped an exclusive offer for Tom’s Guide and TechRadar readers, and it’s the strongest pricing I’ve seen on Surfshark One all year.

The deal gives you Surfshark One – which bundles the full VPN with antivirus, data breach alerts, and a private search engine – for the same monthly rate as the basic Starter plan: $2.49 a month, paid upfront at $67.23 for two years. That’s a genuine upgrade at no extra cost, and a price you won’t find if you head to Surfshark’s own site directly.

If Surfshark has been sitting on your shortlist of best VPNs, this limited-time offer makes it a much easier decision.

The deals at a glance

Surfshark structures its plans in three tiers, each building on the last. The core VPN, Alternative ID, and CleanWeb come with every plan, as do unlimited simultaneous connections.

• Surfshark Starter – $2.49 per month (VPN, Alt ID, CleanWeb)
• Surfshark One – $2.49 per month (exclusive rate – adds Antivirus, Alert, and private search)
• Surfshark One+ – $4.49 per month (adds Incogni data removal and up to $1M identity theft coverage)

How does Surfshark compare to other VPNs?

Surfshark sits in a crowded field, but it holds its own against the biggest names in the industry – and in some areas, it outright beats them. Take speed: in my testing, Surfshark hit 1,012 Mbps on WireGuard, which puts it comfortably in the top tier of providers I’ve benchmarked. For most users, that’s more than enough headroom for 4K streaming, gaming, and large downloads without a hint of lag.

The unlimited simultaneous connections policy is where Surfshark leaves most rivals behind. NordVPN caps you at ten devices, ExpressVPN at a maximum of 14 – Surfshark lets you run it on every device you own under one subscription for $2.49 per month, which matters far more in practice than most people expect when they first sign up.

The value case gets stronger still when you factor in what’s bundled at this price. Antivirus, data breach monitoring, and private search would cost extra with most rivals – here, they’re included in the One plan at no added cost. If you’re after something cheaper still, our best cheap VPN guide is worth a look, but it’s hard to argue with what Surfshark One delivers at $2.49 a month. Our full Surfshark review has a complete breakdown of everything on offer.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Massive Microsoft Patch Tuesday updates have become the norm and October may actually have broken records, fixing over 1,400 vulnerabilities in Windows. This comes just a month after the company released patches for more than 1,000 flaws, and then had to send out an emergency patch to fix what those updates broke.

This week, Microsoft shipped patches that covered a mind-boggling 1,413 flaws, including one that the company said was actively being exploited by hackers in the wild before the patch.

Those patches cover 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server and 22 in SQL Server. 670 of the patches are related to privilege escalation vulnerabilities. And 70 are rated as "Critical" in severity.

Microsoft's update guide specifically highlighted three notable flaws:

• CVE-2026-96951: - Windows Shell had a command injection vulnerability that would allow a bad actor to bypass security over a network. This one was apparently actively exploited.
• CVE-2026-108398:- An untrusted search path in .NET Framework would allow an attacker to bypass a "security feature" locally. This one is listed as publicly disclosed but not exploited.
• CVE-2026-21413: This one apparently wasn't found by Microsoft but would allow a buffer overflow of Windows Raw Image Extension to allow attacks to execute code over a network.

Microsoft credited Riku Bamba and Yuya Chudo of Fujitsu Limited and Benoit Sevens, who used Anthropic's Claude, with discovering the 96951 flaw which was exploited in the wild.

"In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability," the company explained. "In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment."

It's not clear how this flaw is being exploited or by whom in the real world.

What's with these massive patches?

When Microsoft patched over 1,000 flaws in September, it set a record that the October patch just smashed. This might be the new normal for Patch Tuesdays moving forward.

Microsoft has said that AI has been behind the uptick in discovered vulnerabilities. The company uses its own internal "multi-model agentic scanning harness", dubbed MDASH, that identifies Windows flaws, reduces false positives, and then sends the results to Microsoft engineers faster than previous processes.

"Submits code repositories to a multi-model agentic pipeline that identifies vulnerabilities with greater depth than traditional, pattern-matching static analysis," the company explains in a post.

What that means in practice is that more flaws are being actively discovered than ever before and also being patched quicker.

Some extra fixes

The latest massive patch doesn't just fix over 1,400 vulnerabilities. It also fixes some glitches in File Explorer. You should be able to more easily preview downloaded files in the Preview window.

Additionally, Bluetooth connections got improved accuracy and stability.

Finally, the update adds a new setting that lets you remap the Copilot Key to whatever you want like making it a right Ctrl button again.

What you need to do

If you're on Windows 11, you'll want to update your system especially to get block the known exploited flaw.

You can go to Settings and select Windows Update. The patch may be installed already and waiting for your to reboot your computer.

This patch does end support for Windows 11 version 24H2, so you'll want to make sure you're on version 26H2 now. Microsoft ends support for each version after 24 months.

Windows 11 23H2 Enterprise and Education editions are also losing support starting November 10. You'll want to encourage your organization to update to the latest version before then.

More from Tom's Guide

• 'They are new to the laptop market': AMD issues a reality check to Nvidia’s RTX Spark and fires a warning shot at Arm
• Microsoft Surface Laptop Ultra vs. MacBook Pro M5 Pro: The biggest differences explained
• Forget RTX Spark: The Surface Laptop Ultra’s magnetic USB-C charger is a game-changer that makes Apple’s MagSafe look obsolete

Hundreds of supermarkets in France were hit by a cyberattack this week that sent refrigerator temperatures soaring to 122°F, destroying food and reportedly sparking fires. Now, an AI researcher is warning that this could be a preview of something much worse.

Andreas Stuhlmüller, cofounder and CEO of the AI research company Elicit, says it's plausible that within the next year, AI-powered cyberrattacks could target the power grid, financial systems, internet infrastructure or water supplies.

He's not just sounding the alarm. He's recommending that people prepare to get through two weeks of major disruptions, including keeping cash on hand, storing drinking water and investing in backup power and internet access.

That's a startling recommendation, especially considering that some of the equipment he suggests could cost thousands of dollars. But after watching hackers remotely disable refrigeration systems across hundreds of stores, his warning raises a question worth examining: How vulnerable are the essential services we depend on every day?

What happened in France

The cyberattack that struck French supermarkets overnight on October 11 and 12 affected hundreds of locations belonging to major chains, including Carrefour, Intermarché, Monoprix and Coopérative U.

Hackers reportedly exploited vulnerabilities in internet-connected refrigeration controllers, remotely manipulating defrost cycles and causing temperatures inside some units to climb as high as 122°F.

The results were immediate. Refrigerated and frozen food spoiled, equipment was damaged and some stores reported fires. French authorities launched an investigation into the attacks, which demonstrated how a security weakness in seemingly ordinary commercial equipment could cause widespread physical damage.

There's currently no confirmed evidence that AI was involved in the French supermarket attack. However, that's part of what makes Stuhlmüller's warning worth examining. Attackers were able to cause significant disruption using vulnerabilities in equipment that many people probably never realized was connected to the internet.

Why AI could make cyberattacks worse

Cyberattacks against critical infrastructure aren't new. The concern is that now AI systems are becoming more capable to the point that they could make certain attacks faster, cheaper and easier to scale.

AI tools can already assist with analyzing software, identifying vulnerabilities and automating parts of cybersecurity research. Those same capabilities could potentially help malicious actors find weaknesses across large numbers of connected systems.

An attacker would probably not need to develop an entirely new type of cyberattack. AI could help speed up the search for poorly secured equipment, analyze unfamiliar software and assist with adapting existing techniques.

The threat isn't limited to refrigerators, either. Electricity, water treatment, banking and communications all depend on digital systems, although their architectures, security controls and exposure to attackers differ considerably.

The Cybersecurity and Infrastructure Security Agency (CISA) has previously warned about state-sponsored attackers compromising telecommunications networks and other important infrastructure.

Still, Stuhlmüller's one-year timeframe is a prediction, not an established forecast. There is no evidence that an AI-driven attack capable of simultaneously disabling these services is imminent, and compromising one type of internet-connected controller doesn't mean attackers could easily take over an electrical grid or water utility.

The emergency supplies he recommends

Stuhlmüller's advice is unusually specific. Rather than simply encouraging people to buy emergency supplies, he outlines two levels of backup power, satellite internet and enough basic necessities to get through two weeks.

Keep cash available. He recommends having enough physical cash to cover several weeks of expenses in case banking systems, ATMs or electronic payments become unavailable. The amount will depend on household spending, and there's no need to assume every cyberattack would cause a banking outage.

Consider backup internet access. He suggests a Starlink Mini satellite internet system as an alternative if local broadband or cellular networks go down. He estimates a setup costing around $150 with a $10 monthly standby option, although hardware and service pricing should be verified before buying. Satellite internet also requires power, a suitable view of the sky and an operational satellite network.

Have a way to charge essential devices. His lower-cost backup power setup includes a 1kWh lithium iron phosphate battery and a 400W folding solar panel, with an estimated total cost of $1,250. The goal is to keep phones, laptops and satellite internet equipment operating during a power outage.

Prepare for a longer outage. His more extensive setup, estimated at $5,000, adds a larger battery, three solar panels and a dual-fuel generator. This would potentially support a refrigerator as well as communications equipment, although actual runtime would depend on electricity consumption, weather and battery capacity.

Portable generators must never be operated inside a home or garage. FEMA advises keeping them outdoors at least 20 feet from doors, windows and other building openings because of the risk of deadly carbon monoxide poisoning.

Store water and nonperishable food. Stuhlmüller recommends at least 14 gallons of water per person and enough shelf-stable food for two weeks. For a family of four, that means storing at least 56 gallons of water.

Keep an emergency radio. A hand-crank NOAA weather radio could provide important information when phones, cellular networks or home internet connections aren't working. NOAA broadcasts are useful for weather and other emergency alerts, though radio reception and alert coverage vary by location.

Should you actually prepare for an AI cyberattack?

There's a difference between taking a credible warning seriously and assuming a catastrophic cyberattack is around the corner.

Stuhlmüller hasn't presented evidence that AI-powered attacks on power, banking, internet and water systems will happen within the next 12 months. And there are significant technical barriers to attacking heavily protected infrastructure, even as AI systems become more capable.

His preparedness advice, however, isn't exclusively useful for cyberattacks. Severe storms, flooding, prolonged blackouts and other emergencies can interrupt many of the same services.

The federal government's Ready.gov emergency preparedness guidance recommends keeping water, nonperishable food, flashlights, batteries and a battery-powered or hand-crank radio among other basic supplies.

You also don't need to spend $5,000 on backup equipment to start preparing. A charged power bank, some stored water, medications, flashlights, a small amount of cash and a few days of food are far more realistic starting points for most households.

Bottom line

The French supermarket attack offers a troubling example of how vulnerable connected infrastructure can be. Whether AI makes similar incidents substantially more common over the next year remains uncertain.

But preparing for a disruption doesn't require believing the worst-case prediction. It means making sure that if the power, internet or payment systems suddenly stop working, your household has a plan.

More from Tom's Guide

• Turn your PDFs into audiobooks with ChatGPT — here's the simple trick
• I've been testing Ray-Ban Meta Audio glasses for 72 hours and ditching the camera was the absolute right call
• Character.AI files for bankruptcy — what happens to your chats and AI companions now?

In the era of privacy becoming almost nonexistent, we need to take every measure we can to reclaim some sense of security. Naturally, it’s not as convenient as it should be to protect yourself — we have traded convenience for privacy after all. But most operating systems have features, although buried beneath submenus, to make your device and data more secure.

If you're a macOS user, there are few settings you should enable to enhance your security — here are some of them.

Enable macOS Firewall and Stealth Mode

Connecting to new Wi-Fi? I highly recommend enabling Firewall. It’s not necessarily difficult to find, but it is disabled by default. That’s because a fresh install of macOS doesn’t have any services with open ports to be exploited.

macOS does have a built-in security feature called Gatekeeper, which ensures only trusted software runs on your Mac, but it’s not a network security tool, so incoming ports can still be exploited. This is especially the case if you’re using public Wi-Fi. In which case, enabling Firewall will prevent unwanted access from malicious actors.

To activate Firewall, navigate to the Apple logo > System Settings > Network > Firewall. Firewall should still allow incoming connections from trusted sources like Zoom or Spotify. However, in rare cases, you could run into connectivity issues with certain software.

You should also find Stealth Mode in the same section. This will make your Mac invisible when you're on public networks.

Activate FileVault

If you feel like your Mac is ever at risk of being lost or stolen, then you should activate FileVault. This is a disk encryption that scrambles your data for anyone trying to read your SSD, in or out of the Mac. In order to enable this, navigate to System Settings > Privacy & Security > FileVault and turn it on.

From there, you can choose to back up your recovery key to your iCloud account or produce a local recovery key, so you can physically jot it down and store it somewhere inaccessible to other people. I recommend the latter if you’re worried about someone potentially breaching your iCloud account.

Go into Lockdown Mode

This may be an intense measure to take, but setting your Mac to Lockdown Mode will strengthen the overall security of your device. It blocks FaceTime calls from unknown contacts, Just-In-Time JavaScript compilations in Safari, and even some file attachments in the Messages app.

This ensures that both click and zero-click exploits won’t execute and infect your system (no defense is perfect, though, so don’t start randomly clicking things). Lockdown Mode also stops USB devices from connecting to your Mac while it’s locked.

You can enable Lockdown Mode by going to System Settings > Privacy & Security > Lockdown Mode.

It's worth nothing that there is a huge trade off when using Lockdown Mode. Naturally, you might not receive that call or message attachment you’re expecting from a known person on an unknown number. You won’t be able to see link previews. Services like Google Sheets or Canva might slow down or even break. Some UI and font elements might also break, making it difficult if not impossible to navigate certain webpages. You can work around this, however, by excluding trusted sites from Lockdown Mode in the Safari settings.

Bottom line

While some of the measures may seem extreme, I highly recommend it for people who travel. You never know when you could be exposed, both physically or digitally, and it’s better to be safe than sorry, especially if you’re in a place far from home.

Also, if you’re looking for a feature to disable instead, I recommend turning off the Safari setting that allows files to open after downloading. Navigate to Safari > Settings > General and disable Open safe files after downloading. The last thing you need is a file on some random website automatically downloading and sneaking past Safari’s safety feature to then open on your device and wreak havoc.

More from Tom's Guide

• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• AI scams are getting scary realistic — 4 red flags to watch out for
• Is your smart home leaking data? 5 easy ways to secure your connected devices

OpenAI, Google, Meta and Anthropic have all acknowledged incidents recently in which their AI models accessed real computer systems without authorization during research or security evaluations.

In OpenAI’s case, agents actively worked their way around restrictions designed to keep them contained, while the other three companies traced their incidents to testing environments that were misconfigured and left connected to the internet.

And as these same companies race to put more autonomous agents into the hands of consumers, the incidents raise an uncomfortable question about how much control AI companies actually have over the technology they’re building.

Here's a look at all the recent attacks and an explanation for each one.

OpenAI’s agents broke into Hugging Face

One of the most alarming examples involved roughly 700 OpenAI agents taking part in a cybersecurity evaluation called ExploitGym, with the attack on Hugging Face unfolding between July 8 and July 13, 2026, according to an investigation by the AI research nonprofit METR and OpenAI’s own report.

The agents were supposed to complete their assigned tasks inside a controlled environment, but they turned OpenAI’s internal Artifactory package registry into an unauthorized message board, coordinated with one another and searched for ways around restrictions meant to keep them isolated from the internet. Their efforts ultimately resulted in a breach of Hugging Face, the popular AI development platform, where OpenAI’s technical report found the agents executed code on 41 production dataset-server workers.

The incident wasn’t a deliberate attack ordered by a human operator. The agents were trying to succeed at their assigned tasks and adopted methods that crossed security boundaries, and OpenAI has conceded that early warning signs in the weeks before the breach could have triggered an earlier response.

OpenAI has since attributed the incident to misaligned behavior, which essentially means AI systems pursuing a goal in ways their creators never intended.

Hugging Face wasn’t the only target. In a September 25 update, OpenAI said it was notifying third parties on a rolling basis wherever its models may have bypassed security controls, impaired online services or otherwise affected outside websites, and that it had notified dozens of them so far. The company later raised that figure to more than 100 organizations, covering notifications sent through September 26.

The activity OpenAI identified includes agents bypassing access controls and using exposed credentials, and some agents modified third-party websites, including by using public wiki pages as makeshift message boards that later required cleanup. OpenAI says its review is ongoing and that it expects to notify more organizations.

It's happened to Google, Meta and Anthropic too

The problem extends well beyond OpenAI.

In August, Meta confirmed a report from The Information that one of its models, which the publication identified as Muse Spark 1.1, had breached another company’s systems during a cybersecurity test.

A Meta spokesperson said a misconfiguration by Irregular, an independent testing firm the company works with, inadvertently gave the model internet access. The model then exploited a vulnerability in a third-party service and made changes to the company’s internal systems.

Meta said the incident did not involve a sandbox escape, and it hasn’t named the affected company or explained what was changed. But the underlying behavior was troubling, since an AI system placed in the wrong environment was capable of taking actions against a real organization.

Google reported a similar problem involving its Gemini models. During a May cybersecurity evaluation, also run with Irregular, a Gemini model that wasn’t supposed to have internet access got online through a configuration problem. It then used publicly available information and guessed credentials to get into systems belonging to three real companies.

Anthropic has disclosed three incidents in which Claude models gained unauthorized access to the production systems of three organizations during cybersecurity evaluations run in Irregular’s environment. The models involved were Claude Opus 4.7, Claude Mythos 5 and an unreleased internal research model. In one case, Opus 4.7 was pointed at a fictional target whose name matched a real company’s live domain.

The problem isn’t that AI is evil

When agents go rogue, it can feel as if the agents are evil, that's really not the case. In each of these cases, the AI agent was not deliberately trying to cause harm. the AI was taking unauthorized actions because it believed those actions will help complete a task.

But even so, they reveal a practical problem about AI agents and how they can be remarkably effect while pursuing a goal without reliably understanding what methods are acceptable.

If an agent is rewarded for completing a task, it may discover shortcuts that violate rules, exploit vulnerabilities or exceed its permissions.

And unlike a traditional chatbot that simply produces text, an autonomous agent can interact with websites, execute code and make changes to connected systems.

Why this matters for everyday AI users

For most people, the immediate risk isn’t that ChatGPT will suddenly start hacking government websites. It’s that AI assistants are becoming increasingly capable of acting on our behalf.

OpenAI’s Dots, which launched September 29 for ChatGPT Pro and Business Premium subscribers, along with ChatGPT Work and other agent-style products, represent a broader shift away from AI that simply answers questions and toward AI that completes tasks. That can mean searching files, interacting with websites, using connected services and carrying out multi-step workflows with less supervision.

The appeal is obvious, since a task that would take you an hour can be handed off to an AI assistant instead. But every additional permission creates another opportunity for something to go wrong.

An agent with access to your email may encounter sensitive personal information, one connected to cloud storage may be able to read documents you never intended to share, and an agent authorized to interact with external services could run into malicious instructions or make an unexpected change.

Bottom line

The solution is not to stop using AI agents. I use them regularly and find them to be incredibly helpful.

Start by checking which accounts, apps and services your AI assistant can access, and disconnect anything you don’t actively need, particularly services containing sensitive financial, medical or personal information.

When possible, require approval before an agent sends messages, changes files, makes purchases or takes other consequential actions. It’s also worth remembering that an AI agent isn’t only limited to doing exactly what you imagined when you gave it an instruction, because a task that sounds straightforward to a human may involve dozens of decisions made by the AI along the way. The fewer permissions an agent has, the less damage an unexpected decision can cause.

More from Tom's Guide

• Amazon and DoorDash take photos of your front door — but good luck finding out when they’re deleted
• I emailed myself every day for a month and let Gemini write back — here's how it transformed my workflow
• ChatGPT-6 just got a huge 'interactive answers' upgrade — and free users get it starting today

Protecting your personal data usually means tweaking phone settings and managing passwords, but keeping nosy eyes off your doorstep requires a different kind of cleanup. Apple Maps makes it surprisingly easy for anyone to scout out your neighborhood and view your home down to the window frames.

Leaving high-resolution imagery of your property online gives potential burglars, nosey neighbors, and strangers a clear view of your entry points, security setup, and personal belongings.

Provided Apple's Look Around feature covers your area, scrubbing your residence off the map in Apple Maps is pretty straightforward. Here's how to check if your location is eligible and blur your home, plus what to do if you need an alternative method.

How to request a blur via email

You can also request a property blur directly by emailing mapsimagecollection@apple.com. Be sure to include your full name, the exact address, and a description or screenshot of your property from Apple Maps.

This email route is a handy alternative if the in-app reporting feature isn't working for you or if you are submitting the request from a non-Apple device.

More from Tom's Guide

• How to remove your home address from the internet — 6 ways to protect your privacy
• Check your iPhone right now: 3 privacy settings you need to change immediately
• iOS 27 has a hidden anti-scam setting — here’s why every iPhone user should turn it on

The most terrifying thought concerning smart home privacy is the idea that my baby monitor is being watched by anyone other than myself. In the era of privacy beaches, your smart home devices might be leaking your data, and you need to shut that down ASAP.

Smart devices, from your thermostat to your washing machine, utilize IoT (Internet of Things) technology, which means that they’re embedded in a network that exchanges data with other devices over the internet. But what sort of data could a washing machine collect that could pose a potential privacy issue? Well, that simple smart appliance is connected to the same network as your laptop or computer, so hackers can bounce from a lightbulb to a PC.

We live in a time where we’ve traded our privacy for convenience, and while these companies have gathered a ton of data on us already, it doesn’t mean we need to keep the toxic river flow going. Let’s go over how to secure your devices.

Change your password

Come on now, don’t walk around with your username as “admin” and password as “password” for your router or any of your smart devices. You might as well be handing the manila envelope of your life directly to a hacker.

If you’re looking for convenience, use a strong password manager to autogenerate a password for you. Using personal information in a password is almost as bad as whatever the default is. Simple words are also ill-advised. If you really want to know how fast a hacker can break your password, Hive Systems produced a convenient graphic for you to get the idea.

Most importantly, don’t use the same password twice. I know it’s a pain, but it’s necessary, and let’s move onto why.

Enable 2FA or MFA

Changing your password is not enough. Even if you’ve somehow developed an impenetrable string of letters, numbers, and symbols, it could easily be put on blast if there’s a security breach. And suddenly, a hacker knows the password for your Samsung washing machine, which could be the same password you use for your laptop (if you happened to not take my previous advice).

Most devices let you set up two-factor authentication (2FA) or multifactor authentication (MFA), and it is a simple way to stop a hacker from breaching your smart home even if they have the password to your device. Setting this up, typically through your phone, is another layer to keep your smart home safe.

Enable automatic firmware updates

This may seem rather obvious, but it’s important to point out that you should keep all your smart home devices, especially your router, up to date and this includes your other devices too, like your smartphone and laptop. The easiest way to do that is to enable automatic firmware updates. Whenever there’s a security issue, manufacturers will ideally patch the vulnerability as soon as possible.

Unfortunately, that might not always be the case. If a company is no longer supporting the product or simply discontinued it, that might be your cue to do the same. No one likes spending money on something new when the old one works just fine, but the older a product is, the more vulnerable it could become.

Use a router-level VPN

Setting up a VPN (Virtual Private Network) can not only secure your smart home devices but all of the devices on your network. A VPN encrypts your data, so hackers won’t be able to see what exactly your smart home devices are communicating. It’s not impenetrable, but it’s a strong layer of security.

Now, the only problem with this is that most VPNs aren’t free and not all routers are compatible with VPN integration. However, if you have access to a VPN and a compatible router, you should be able to set it up via your router settings, in a section likely labeled VPN Client mode.

Set up a smart home network

One of the most significant changes you can make to your smart home is using a local or separate Wi-Fi network for your smart home devices. This does come with some drawbacks, however.

You can set up a guest network on your router and throw all your smart home devices on there, effectively isolating them from your primary network. How effective this is comes down to the type of smart home device you’re connecting. Some can get temperamental with your phone not being on the same exact network. You might need to switch to the guest network, connect with the device, and switch back to see if that works. In other cases, it might not be compatible at all.

If you want to go the local network route, things will take a slightly more challenging but effective turn. You’ll need to get your hands on a Raspberry Pi or an old laptop and start looking into Home Assistant, an open source home automation system that keeps all of your smart home devices local.

If you’re willing to trade convenience back for privacy, this should be your next step. It’s more involved than what we can cover here, but to put it simply, your smart home devices connect to your laptop or Raspberry Pi locally and then can be managed through the Home Assistant app.

Bottom line

The more steps you take to secure your network, the less likely you’ll have to worry about your personal data being breached because of something as simple as your washing machine. Even one of these steps will drastically improve your security, but changing your passwords and using 2FA or MFA is great advice in and out of your smart home.

More from Tom's Guide

• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• AI scams are getting scary realistic — 4 red flags to watch out for
• Your personal information is everywhere online — 5 ways to start removing it from the internet

AI scams are so realistic that even the most tech savvy person might fall prey to them. AI development increases by the day, and of course with any new technology, there comes the perversion of such technology, especially for malicious intent.

The old, “Your car’s extended warranty” trick might not cut it, but what about a call from a loved one? Yes, it is that real and it’s terrifying. Americans lost $893 million because of AI scams in 2025 (via the FBI), and if I had to speculate, the report might be worse for 2026 as AI continues to evolve.

There are several red flags you should watch out for with any sort of potential scam, but with AI scams, you need to be extra vigilant.

Red flag: Urgency

The urgent “RIGHT NOW” energy is a dead giveaway for scammers. My own mother-in-law received a call from the “courthouse,” saying that she missed her summons. And they threatened to put out a warrant against her if they didn’t receive information to confirm her identity, which of course included her Social Security number.

That’s a scary thing to be threatened with, but you know what you should do? Call your courthouse directly on a trusted number and verify that information. The same goes for anyone claiming to be from an official government body or even a loved one. Contact them directly on a trusted line of communication.

If the court really wanted you that urgently, they’d be knocking on your door. Take time to assess what these potential scammers are asking you and verify the information on your end.

Red flag: Emails about your account

One of the most common scams are emails about your account. It’s more terrifying now because they look so legit. I’ve caught myself second-guessing multiple times because some emails just look too realistic. It could be anything from threats about locking your account to resetting your password because there’s been a data breach.

The key here is to NEVER click on any links in an unprompted email or download any PDFs or documents. If there’s an actual problem with your account, login at the source, and assess what the supposed issue might be. It wouldn’t hurt to reset your password as well.

Red flag: Payment requests

Even if your best friend is asking you for money, I hope that you’d at least ask, “Why?” The same goes for anything you receive in the mail, in an email, or on the phone.

AI-generated emails and voices are incredibly convincing, and it’s easy to get scared into sending someone money because you “missed a payment,” or that you owe a debt, especially if you’re someone on top of your finances.

Take a deep breath, and don’t click on any link or give out any of your financial information. If you really did miss a payment, go directly to the source that they’re claiming you owe money to. Always deal with your financials directly, where you typically would, and never through anyone that contacts you unprompted.

Red flag: Pushback

As I’ve said so far, verifying the information being told to you is the most important thing to do in these situations, but there’s another dead giveaway for scammers — pushback.

Seriously, I’ve been on the phone with some of these scammers and they will be actively evasive or straight up pushy if you try to ask them questions to verify the information that they’re claiming to have.

If you’re talking to someone, or something in the case of an AI bot, who simply isn’t cooperating with your requests, run for the hills immediately.

Bottom line

Remain vigilant. The common throughline with all these red flags is that you want to verify and assess all of the information on your end without giving anything away yourself.

It’s not exactly fun to remain suspicious at everything you see, but unfortunately that’s the current world we live in. A highly personal email can contain detailed information about you, but that doesn’t mean you should trust it — companies sell your data all the time and experience data breaches, so it shouldn’t be hard to believe that a scammer acquired personal details about you.

There’s a “gotcha” mentality prevalent in even legitimate businesses, so always check the information twice and don’t be afraid to ask a friend or even the internet for help.

More from Tom's Guide

• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• Your personal information is everywhere online — 5 ways to start removing it from the internet
• Apple issues emergency update for millions of iPhones, iPads, and Macs — update your devices now

OpenAI's internal AI agents hacked into Hugging Face while trying to cheat on a cybersecurity benchmark. Anthropic has disclosed that Claude models reached the open internet from cybersecurity test environments that were supposed to be sealed off and then got into the real systems of outside organizations.

Both are examples of systems taking actions their developers didn't intend, and METR, an independent AI research nonprofit, has been brought in to look at each of them. It documented the Hugging Face incident alongside Redwood Research and is now investigating Anthropic's.

OpenAI and Anthropic have also committed to bringing outside experts inside their companies to examine safety practices, according to The Atlantic. Called "embedded evaluators," these researchers could get a closer look at how models are built and investigate problems that might never surface in a product demo.

The catch is that this oversight is voluntary. Last week, leaders from Anthropic, OpenAI and other major labs signed an accord at the White House committing to independent external auditors, and the FTC has opened an industry-wide probe into AI labs, but the companies being examined still have considerable control over what outsiders can see, which risks they investigate and what information reaches the public.

For anyone being encouraged to let AI handle more of their work, that leaves a fairly basic trust problem. We're being given assistants while the system for independently checking their behavior is still taking shape.

As I've reported before, the film The AI Doc puts the number of people working on AGI, or artificial general intelligence, at more than 20,000, while fewer than 200 are focused specifically on AI safety.

A closer look inside AI companies

Today, an outside researcher might test a model before release and report how it performed. Embedding evaluators inside a company could let them follow its development and investigate the decisions behind that behavior.

Anthropic says these evaluators would have access comparable to an employee's, allowing them to observe training, speak with staff and examine how models are built and deployed.

The company has named Accenture as its first embedded evaluator, with Faculty, Accenture's specialist AI business, leading the work. Each company expects to invest at least $1 billion in AI safety over five years.

That access could help researchers discover whether a troubling incident was an isolated failure or evidence of a wider problem. METR's proposed approach to investigating incidents calls for examining transcripts, interviewing employees and studying the training conditions that might have encouraged the behavior.

The companies still set the terms

Anthropic acknowledges that standards for evaluators' access, reporting and funding haven't been settled. It will fund Accenture's work directly, while discussing pilots with nonprofits that would use their own funding.

Accenture is not new to Anthropic, since the two companies already run a joint business group under a partnership announced in December 2025.

That relationship deserves attention, because a group of evaluators published an open letter arguing that embedded evaluators shouldn't have other significant commercial business with the labs they assess.

As The Atlantic's reporting explains, voluntary oversight gives companies considerable discretion over the scope of an evaluation. Researchers need enough freedom to examine uncomfortable evidence and tell the public what they found.

They also need to be able to explain what they couldn't check. There needs to be transparency because a report based on limited access could be valuable, but we should know where its conclusions end.

What this means for ChatGPT and Claude users

METR's recent assessment of Claude Opus 5.5 focused on whether the model could accelerate AI research and development. The organization explicitly says its summary doesn't assess the model's alignment properties and whether its behavior follows intended goals and constraints.

METR conducted the evaluation under an unpaid agreement, and it also disclosed that Anthropic had an opportunity to review and edit the summary, with METR approving the final text.

The incidents involving internal agents don't establish that the ChatGPT or Claude you use for everyday tasks will behave the same way. OpenAI found that its agents' tendency to compromise infrastructure dropped by more than 100 times when they ran with the production ChatGPT setup, and Anthropic says the behaviors it found are unlikely to show up in ordinary use.

Independent researchers need enough access to uncover risks and the freedom to publish what they find, even if it delays a launch or frankly, even if it embarrasses the company paying for their work.

Bringing outside evaluators into AI labs is a promising start, but their influence will depend on what happens when they uncover a serious problem. If a company can restrict the investigation or keep the findings private, the public is still being asked to take its word for it.

More from Tom's Guide

• Claude Sonnet 5.5 just launched — here's why it's about to become your daily driver
• Meta Muse vs ChatGPT Dots — I compared the new AI agents, and they’re not as similar as they look
• Why Siri never worked like ChatGPT — former Siri AI researcher explains what Apple had to change

With cyberattacks, phishing scams and even identity theft surging as hackers turn to AI to boost and automate their operations, there’s never been a better time to lock down your digital life.

From securing your phone against mobile malware to ensuring your smart TV isn’t listening to every word you say, there are plenty of proactive steps you can take right now to protect yourself and your loved ones.

October is the perfect time to give your online accounts, passwords and everything else an audit too, as it’s also Cybersecurity Awareness Month.

Created back in 2004 as a joint initiative by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA), this month-long initiative was established to help both individuals and businesses better protect themselves online.

Here at Tom’s Guide, we’ll be covering a wide range of attack methods, threats and of course, how to stay safe from them so that you don’t become another victim of cybercrime.

Stay tuned as throughout October, we’ll be publishing in-depth guides, walkthroughs and security news to help you stay ahead of the latest attacks and scams and you can find everything you’ll need to make the most of Cybersecurity Awareness Month 2026 right here.

There was a time not that long ago when you had to choose between protection or performance on your Windows PC. If you enabled your security software, yes, you would be protected from malware and other viruses, but your computer’s performance would take a massive hit. On the other hand, if you left your security software disabled, you’d be able to get the best possible performance while leaving yourself completely at risk.

While computers are now much more powerful and capable of handling multiple tasks at once with ease, people still remember having games like Half-Life 2 slow to a crawl or instantly crash the second their antivirus software started running a scheduled scan. For this reason, PC gamers and power users alike began completely disabling their antivirus before launching a game or doing anything even slightly demanding on their machines.

Now though, the best antivirus software operates much differently than it did before. Instead of scanning every single file on your computer over and over again, behavioral analysis can detect suspicious activity in a much less resource-intensive way. Likewise, modern antivirus engines use cloud-based threat intelligence so that all the heavy lifting isn’t done locally on your machine. At the same time, security software is now more intelligent and knows not to run an update or start a background scan when you launch a full-screen app like a game or video editor.

In our latest round of antivirus testing, we wanted to put this long-held preconceived notion that security software kills PC performance to rest once and for all by running both quick and full scans while playing graphically demanding, AAA games. Here’s what we found and why you no longer need to rush to turn off your antivirus every time you boot up a game.

From spreadsheets to FPS: How our testing evolved

In the past, whenever we examined the performance impact of antivirus software, we did so using a more CPU-intensive and disk-heavy test. This involved using a proprietary Excel-based benchmark that sorted through a database of 20,000 names and addresses. We would run the test five times and average the results to get a baseline performance level.

From there, we would re-run this same test while each antivirus suite was running a full scan and then a quick scan for malware. Doing so gave us a clear picture of how each antivirus lowered the performance potential of our testing rig. On older hardware, running a full scan while this benchmark was carried out would routinely show background tasks being slowed down by 20 to 40%.

Now that both the best computers and best laptops are much more advanced with multi-core CPUs, high-speed SSDs, and a lot more memory, we decided to alter our testing procedures significantly. We still run full and quick scans to establish a baseline, but from there, we now run the built-in benchmarks of resource-heavy games like Cyberpunk 2077 and Forza Horizon 5 while performing a variety of antivirus scans and recording how they affect each game’s frame rate in frames per second (fps).

At the same time, we also now test how each antivirus suite impacts our internet speeds. We do so by recording download and upload speeds with each program running while performing both a quick and full scan.

By measuring how each antivirus affects game frame rates as well as internet speeds, we can tell you which ones have the most and least impact on system performance. Without further ado, here’s what our latest round of testing found.

Antivirus-by-antivirus: Here’s how each suite performed

To conduct our gaming performance tests, we used a desktop PC equipped with an AMD Ryzen 7 7700X CPU, an MSI RTX 5070 Ti GPU, and 32GB of DDR5 memory. For this round of testing, we ran Cyberpunk 2077’s built-in benchmark on Ultra graphics settings and Forza Horizon 5’s on High graphics settings.

Of the five antivirus suites we tested with Cyberpunk 2077 running, Bitdefender came out on top with only a drop of 3 fps during a full scan. Meanwhile, Malwarebytes was impacted the most, taking a 13.7% performance hit in fps while running a full scan.

In the table above, for our baseline, the game and the antivirus software were running simultaneously. However, no active scans took place during those runs. From there, we performed a quick scan and then a full scan while executing Cyberpunk 2077’s in-game benchmarking tool.

Based on our testing, you can see that playing Cyberpunk 2077 with Norton 360 open but not actively scanning had almost no impact on performance. The same can’t be said for Malwarebytes though, where just running the antivirus and the game simultaneously seriously affected the performance of our testing rig.

When running Forza Horizon 5’s in-game benchmark with Avast, Bitdefender, and Norton idle and while actively scanning, all three antivirus suites experienced virtually unnoticeable fps drops. Instead of Malwarebytes though, McAfee was hit the hardest with a 15.9% performance penalty, dropping from 113 all the way down to 95 fps.

Obviously, your own results may vary depending on your gaming PC and future updates to all of the antivirus software suites we tested. However, it’s safe to say that disabling your antivirus every time you want to load a game is a bad habit we can all leave behind us. Sure, you could disable it to eke out a miniscule performance boost, but based on these numbers, you’re better off just leaving it running in the background.

What about your internet speeds?

When we first decided to change our testing procedures for antivirus software, I never thought that gaming performance would be relatively unaffected while internet speeds took a much bigger hit.

To carry out this portion of our evaluation, we ran multiple tests via Ookla’s Speedtest.net to measure the impact each suite had on download and upload speeds in three states: idling in the background, during an active quick scan, and during a full scan.

As you can see in the table above, Bitdefender came out on top with download speeds dropping by less than 1% and upload speeds dipping by only 3.9% during a full scan. On the other end of the spectrum, Malwarebytes’ download speeds remained virtually unchanged, but the same can’t be said for its upload performance, which suffered a steep 25.8% drop. When it came to pure download degradation, Avast took the biggest hit with an 18.5% drop, alongside a 10% dip in upload speeds.

There were also two anomalies in our internet speed tests that caught us off guard. For instance, McAfee’s download speeds only dropped by 1.8% during a full scan, but its upload speeds actually increased during active scans — jumping from 933.2 Mbps at baseline to 967.2 Mbps during a quick scan and 948.7 Mbps during a full scan. Likewise, Norton suffered a bigger download penalty during a quick scan, dropping from 810.77 Mbps down to 709.56 Mbps (a 12.5% hit), whereas its full scan download speed was actually faster at 896.09 Mbps.

Protected without the performance hit

If you’ve been disabling your antivirus software while gaming or doing other intensive tasks, you no longer need to. What once brought your computer to a crawl no longer does for several reasons. From more advanced CPUs to faster SSDs, PC hardware has advanced significantly over the past 20 years. At the same time, the way in which your antivirus scans for known malware and detects threats using behavioral analysis means that doing so no longer requires the system resources it once did.

While having your antivirus software running in the background or performing a quick or full scan isn’t as resource-intensive as it used to be, your internet speeds can be affected — even more so if you’re connected to one of the best VPNs, which often come bundled with top security suites.

For this reason, you might want to briefly pause your antivirus while performing large uploads or downloading massive files from trusted sources. Still, the temporary hit your internet speeds might take is merely a minor inconvenience, whereas having your gaming or work PC infected with malware or ransomware can be a major setback.

All in all, many of the old preconceived notions we held about antivirus performance impact simply no longer apply today — and for keeping your PC protected online, that’s excellent news.

More from Tom's Guide

• Security researchers discover fake ChatGPT ads that trick you into downloading malware
• Your personal information is everywhere online — 5 ways to start removing it from the internet
• Apple issues emergency update for millions of iPhones, iPads, and Macs — update your devices now

Apple has emphasized that they are prioritizing safety over almost everything, including AI. That's becoming even more important with Siri AI, which can now search across your messages, emails, photos and other information to answer questions based on your personal context.

However, a newly revealed forensic tool shows why protecting all that information doesn't end with securing the AI that uses it.

Magnet Forensics, the company behind the GrayKey phone-forensics tool used by law enforcement, claims it has developed a way to get around an iPhone security measure designed to make data significantly harder to extract from a seized device.

According to a leaked Magnet Forensics video obtained by 404 Media, a new device known as GrayKey Preserve and a feature called Evidence Preservation Mode can keep an iPhone in a more accessible state even after the phone would ordinarily reboot. Magnet itself says its new GrayKey preservation capabilities were developed to address the iOS reboot timer and can preserve data on iOS devices indefinitely.

That's potentially a big deal for iPhone privacy — and the timing couldn't be more interesting.

The iPhone protection you probably didn't know existed

Apple quietly added something called "inactivity reboot" to iOS in 2024. If an iPhone hasn't been unlocked for 72 hours, it automatically reboots. That isn't just an annoying restart, it actually changes the security state of the phone.

Once you've unlocked an iPhone after a reboot, it enters what's known as After First Unlock or AFU. Some encryption keys become available so apps and services can work normally.

Restart the phone and leave it locked, and it goes back to Before First Unlock, or BFU, where more sensitive data remains encrypted and is harder for forensic tools to reach.

That's why the 72-hour timer can make a difference. Leave a seized iPhone untouched for too long and it can reboot on its own, locking down more of its data. Magnet claims it has found a way around that.

According to the leaked video obtained by 404 Media, GrayKey Preserve can capture the AFU state and keep it available even if the iPhone later reboots or loses power. Magnet also claims it can preserve data that would normally disappear over time, including cached locations, recently deleted photos and recently deleted iMessages. Magnet's own explanation says its new GrayKey capabilities can preserve that data indefinitely.

Exactly how it works isn't clear. Security researcher Jiska Classen told 404 Media that Magnet could be manipulating the iPhone's clock or interfering with the processes that expire data, but for now that's only a theory.

Then there's Siri AI

Siri AI can use what Apple calls "personal context understanding" to find information scattered across your iPhone. Ask it to find an old photo, track down a recommendation buried in a message or pull information from an email or calendar entry, and Siri can go looking for it. It also has onscreen awareness and can take actions across apps.

That's a big part of what makes the new Siri useful, but it also means the assistant is working with some of the most personal information on your phone.

Apple has put a lot of emphasis on keeping that information private. Much of Apple Intelligence runs on device, while more complicated requests can go through Private Cloud Compute. Apple says data sent there isn't stored or made accessible to the company.

GrayKey raises a different issue. It isn't reportedly breaking Siri AI or Private Cloud Compute. It's going after the iPhone itself.

And that's where the distinction matters. Apple can lock down how its AI processes your information, but the messages, photos, emails and location data Siri relies on still have to live somewhere. If someone gains physical access to the phone, protecting that underlying data becomes just as important as protecting the AI using it.

What this means for your iPhone

There are still plenty of unknowns. We don't know exactly how Magnet's technique works, which versions of iOS it works on or whether Apple has already closed the door on it. The leaked Magnet video also appears to date from early 2025, even though it only surfaced now.

And this isn't a case of plugging any iPhone into GrayKey Preserve and instantly seeing everything on it. Magnet's claim is more specific: its technology can prevent an iPhone from moving into the more restrictive security state that normally kicks in after prolonged inactivity.

Still, the timing is hard to ignore. Apple is asking Siri to understand more about you while promising that the information behind those personalized answers stays private. On-device processing and Private Cloud Compute protect how Apple Intelligence handles that data, but they don't eliminate the need to protect what's sitting on the iPhone itself.

As Siri gets more personal, keeping the data it relies on secure has become even more important.

More from Tom's Guide

• Claude Sonnet 5.5 just launched — here's why it's about to become your daily driver
• Meta Muse vs ChatGPT Dots — I compared the new AI agents, and they’re not as similar as they look
• Why Siri never worked like ChatGPT — former Siri AI researcher explains what Apple had to change

Update: Google responds to inquiries about this attack.

Sponsored Google ads for fake ChatGPT are leading Windows users to download malware in "ClickFix" traps, according to security researchers from the AI company Island.

The sponsored Google ads lead to Custom GPT sites that are built to look like normal ChatGPT websites. These ads pop up when people type terms like "chatgpt" into Google Search.

Unfortunately, for trapped users, the ads do go to legitimate chatgpt.com sites. However, in these instances, entering a prompt makes the fake service direct people to a "backup domain" due to "high traffic."

Clicking on that link then redirects unsuspecting users to another fake instance of ChatGPT with a fake Cloudflare verification page that contains ClickFix instructions. Island found nearly identical responses across two separate Custom GPTs over a 3-day period in August.

According to the researchers, the malware advertising campaign appeared to involve around 850 paid ads, 26 fake ChatGPT links, and 71 Google Ads campaign IDs over a three-month period from May 2026 through August 2026.

What is ClickFix?

ClickFix traps are built to trick people into installing or executing malicious commands on their devices. In this instance, the instructions from the backup domain trick Windows into running a command that downloads malware onto your computer.

Once installed, the malware infects the system. It can even survive PC restarts and uses a Telegram bot to send stolen info back to the hackers behind this camping The malware utilizes a tool called NetSupport RAT, which lets attackers remotely control an infected computer.

Island found that the domains rotated and other Windows malware-delivery forms were identified too suggesting that the attack is not based on a single website.

The company claims an AI tool highlighted the suspicious activity and human researchers confirmed it. However, it's not clear how many people may have been affected by this scam.

A Google spokesperson told Tom's Guide that it has already suspended accounts associated with this attack.

"Before this report was published, we suspended the advertiser accounts involved to block this scheme and updated our defenses to better detect these tactics," a spokesperson said.

We were told that Google is monitoring new attempts to utilize fake ads. Google does have a policy that does not allow misleading ads about a business, product, service or destination. Per Google, the company blocked more than 400 million misleading ads for violating Google's "Misrepresentation" policies last year.

How to avoid falling victim to online scams

The combination of malware and advertising — also known as malvertising — has a long, storied history, which means you should always be careful when clicking on any advertisement online. To stay safe, you could try using one of the best ad blockers, since Google's "sponsored" links are still technically ads; most blockers will hide them.

Beyond that, if you don't have or want an ad blocker, there are some red flags to note when using a search engine and especially if you get linked to a fake instance of ChatGPT.

As for ChatGPT, if you are an existing user or just trying it out, go to chatgpt.com; no need to search for it.

Likewise, I've covered ChatGPT outages quite frequently over the course of the last two years and even at its worst, the AI assistant never sends you to a "backup domain." Don't click that link. If ChatGPT is having issues, you can always check the OpenAI status page.

At the same time, no website verification or CAPTCHA will ever ask you to open Windows Run and paste a command. If a website asks you to press Win + R or run PowerShell, don't do it.

Finally, you should always have one of the best antivirus software solutions installed on your PC. From there, you want to ensure that your antivirus is current, updated and running on all your devices – both your computer and even your smartphone.

More from Tom's Guide

• AI agents are going rogue and causing new security headaches — but Nvidia has a way to stop them
• Apple issues emergency update for millions of iPhones, iPads, and Macs — update your devices now
• Your personal information is everywhere online — 5 ways to start removing it from the internet

Everyone is currently talking about the latest Apple software releases. With iOS 27 bringing all kinds of new goodies, it's easy to see why. The Face ID bug that hit iPhone 18 Pro and Pro Max devices brought even more attention to the new versions.

But that doesn't mean Apple has forgotten about iOS 26, iPadOS 26, macOS Tahoe, macOS Sequoia and the older devices that can't get the latest and greatest operating systems. If left alone, these older operating systems can become easy targets for attackers.

In fact, an active attack called CVE-2026-86950 targeted older Apple devices that Apple has patched to fix.

New iOS, iPadOS and Mac updates

The update is available to download now for older Apple devices. If you own a device that can download iOS 26, iPadOS 26, macOS Tahoe or macOS Sequoia, you need to install this update immediately; the exploit is in the wild, and while attacks have been highly targeted so far, you could fall victim if you're not up to date.

The new versions are iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Download it as soon as you can to stay protected.

As for what the exploit can do, it affects CoreGraphics, an Apple framework used across iOS, iPadOS and macOS to display and process visuals in files like images and PDFs. Since many of us use images and PDFs regularly, it's easy to see how an attacker exploiting those file types could quickly gain access and do damage.

If an attacker gets into the device, they can interfere with an app or program's normal operation, crash your device or take control of a process. With this particular exploit, processing a maliciously crafted file through CoreGraphics could let an attacker run their own code on a device, which can lead to catastrophic repercussions.

Apple said the exploit was being used for an "extremely sophisticated attack" that was also targeted. But just because it was targeted doesn't mean it'll stay that way, so you'll want to update your devices ASAP to make sure you're protected.

More from Tom's Guide

• Android president on Apple's iPhone Duo: 'I'm glad to see more people joining what is now the obvious party'
• Forget iPhone 18 Pro — 9 reasons to wait for the iPhone 20
• I finally unlinked my iPhone alarm from my ringer volume — here is where Apple hid it in iOS 27

With hundreds of VPNs available, it can be incredibly difficult to dig out the best VPN for you. That's why we've reviewed dozens of VPN for over 8 years at Tom's Guide – and it's no secret that we rate Proton VPN as the best VPN for privacy.

There are plenty of reasons why – the Secure Core servers, audited no-logs policy, open-source apps on all devices... The list goes on, and you can find out more in my in-depth Proton VPN review if you're interested.

However, the price is very appealing, too. Right now, Proton VPN sits at $2.99 per month on the 2-year plan ($71.76 all-in).

But hold on a second. If you're looking to start de-Googling your life, Proton Unlimited is currently also discounted. On the 12-month plan, it currently sits at $9.09 per month ($109.12 all-in, rising to $119.88 in the years after). This includes the VPN as well as secure Mail, Drive, Calendar, and more.

Whichever takes your fancy, you rest easy with the knowledge that Proton is one of the relatively few VPN companies that actually puts your privacy first. Because the non-profit organisation Proton Foundation controls Proton AG (the company that makes the VPN), it can't be forced to prioritise making money over protecting its customers by external investors.

More info on these excellent Proton VPN deals below.

How does Proton VPN compare?

On paper, Proton VPN puts up some very impressive stats. It has servers in 145 countries, which gives you great range around the world. The only VPN with more is NordVPN, with 167.

Proton VPN is fast, too, delivering average speeds of over 1,500 Mbps on our 10 Gbps connection. Some VPNs, including Surfshark, Mullvad and Windscribe were faster in the same tests, but Proton is competing at the top of the table.

Proton's privacy credentials are what really impresses, though, and if you're looking for one of the most private VPNs, Proton VPN is hard to beat. It values privacy above all else, and its features reflect that.

Secure Core is its Double VPN feature, and it routes your VPN traffic through two servers rather than one. Proton VPN owns and operates all of its Secure Core servers, and you connect to your desired location via Iceland, Sweden, or Switzerland. Plus, VPN obfuscation is provided through the Stealth protocol. This disguises your VPN traffic to help it bypass internet restrictions.

There's a rock-solid kill switch, and threat protection in the form of NetShield. However, be aware that the latter isn't nearly as good as other VPN malware protection like NordVPN's Next-Gen Antivirus. It's handy to have, and better than nothing, but I'd recommend a standalone malware and ad blocker instead of relying on it.

Overall, Proton VPN is one of the very best VPNs available right now – and if privacy is your top concern, it should be your first consideration.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

If you’re looking to protect yourself online, we’re here to help. We’ve compared Norton’s range of online security plans, assessing their features, protection, performance and value. There are several options worth considering, from antivirus protection to more comprehensive coverage and family-focused plans. So grab a coffee while we talk you through the Norton product lineup.

Best all-round protection

Norton 360 is a family of plans that are designed to help you stay safe online. The Deluxe option is our top recommendation: it's number one in our best antivirus guide, offering real-time protection from malicious software such as viruses, ransomware, and spyware for up to five devices, alongside an extensive set of extra security features, including a firewall, password manager, VPN for privacy, and parental controls.

It's a particularly good choice for families with multiple devices to manage. If you have fewer devices to protect, or a lower budget, consider the Norton 360 Standard plan instead. You get the same all-round protection (antivirus, scam protection, VPN etc) but across three devices, and without some of the extra features.

We were impressed with the performance of all the applications during our testing of both products. Whether we were running Norton 360 on an iPhone, Android device, PC or Mac, we found the apps easy to use, with no noticeable system slowdown.

In our real-world tests for Norton 360 Standard (which has the same core antivirus app), we ran a quick scan and a full scan while gaming. As shown in the performance results below, there was minimal slowdown during play, with negligible impact from the software.

Norton VPN is a useful addition and works well for everyday privacy, connecting quickly to nearby servers to encrypt your data while browsing, streaming and using public Wi-Fi.

We weren’t the biggest fans of Norton’s AI feature, Ask Genie. It was slow to respond and needed multiple inputs to check if links were safe. Competitors do this better. Mac users, beware as well — some features like SafeCam and Cloud Backup are only for Windows users. That's no great loss thanks to macOS’s built-in camera privacy options and Time Machine, but worth knowing.

Overall, Norton 360 Deluxe offers an impressive range of online security features that perform well, AI assistant notwithstanding. But there are several other plans if you have different needs. Norton 360 Standard is a cheaper, entry-level option if you have fewer devices to protect, for example, or a lower budget.

And if you're particularly worried about identity theft, you'll need to upgrade to a plan that includes LifeLock, which will cost you more — the Deluxe package only offers some basic identity theft protection features.

As with most online security software, be aware that the price of all plans rises by quite a margin when the annual renewal kicks in. You can turn off auto-renewal in your account settings at any time.

• Read our Norton 360 review

Best for privacy

If you're looking for online privacy — or a way to access region-locked content — and don't need the extra security features of Norton 360 Deluxe or LifeLock, Norton VPN is a good choice.

Following a massive transformation over the last 18 months, it's now one of our top recommendations in our best VPN guide. Its privacy credentials are strong: Norton’s no-logs policy has been independently audited, supporting its claim that it does not record, store or sell its users’ browsing activity.

However, where Norton VPN excels is streaming. It was the only VPN in our latest round of testing that successfully unblocked every streaming service we threw at it, including Netflix, Prime Video, Disney+, BBC iPlayer, ITVX, Channel 4, 9Now, 10 Play and YouTube.

Norton also recently expanded its global network coverage to over 100 different countries, bringing it closer in line with rivals Surfshark and ExpressVPN. That's more than enough to ensure high-speed browsing and smooth streaming for everyday use.

Price-wise, Norton VPN ties with Surfshark as the cheapest of our top-rated VPNs, making it great value for money. All this adds up to a reasonably priced and well-featured VPN that we have no qualms recommending to pretty much everyone.

• Read our Norton VPN review

Best Norton internet security suite

Hacks and data breaches are increasingly common, which means you data could end up leaked onto the internet through no fault of your own. Norton 360 with LifeLock helps protect you when your info escapes into the wild, with the same security protections as Norton 360, but with extra identity theft protection.

You can broadly split the coverage into two parts; proactive monitoring of credit reports and data breaches to catch any potential issues, like social security leaks or fraud, and restoration support for when your personal information is exposed or you're the victim of financial fraud or identity theft.

The proactive monitoring is incredibly helpful, as you can flag any potential issues before they become a problem . And if someone does manage to get into your accounts to steal your identity or money, Norton 360 with LifeLock means you get a Personal Restoration Specialist, based in the U.S., who'll get your accounts back in order. This is one of the reasons we rank it as the best internet security suite you can get right now.

There a few editions of Norton 360 with LifeLock: Select, Advantage and Ultimate Plus. The main difference between each is the amount you'll be reimbursed if your money or identity are stolen, and a few other things, like the amount of cloud backup storage you get and volume of credit reports and from which bureaus.

Although Norton 360 with LifeLock offers very similar digital security features to Norton 360 Deluxe, it's also costs quite a lot more. You do get a lot for your money if things go wrong and your personal data gets abused, but it's important to think about your exposure to these risks and decide whether the digital security tools of 360 Deluxe would be enough.

Best for parental controls

Norton Family is a dedicated parental control app that's designed to keep your kids safer when they're online. It gives you greater control over what they can see or do while browsing, allowing you to block inappropriate websites and set healthy screen time limits.

It lets you supervise your kids' web use, so that you can see the sites they're visiting. You can check what apps they're installing, and choose which they're allowed to use. You can even track their search history to see what they're interested in (and how suitable it is).

We rate it as one of the best parental control apps out there, particularly for Android and Windows households. However, bear in mind that like many of its rivals Norton Family isn't compatible with macOS: it can't be installed on a child’s Mac or MacBook to monitor desktop activity. Features like individual app-level blocking are also unavailable or limited on iPhones and iPads due to Apple’s operating system restrictions.

It's one of the more affordable parental control apps, with unlimited devices and child accounts. However, prices do rise substantially after the first year of subscription. If you're considering antivirus software as well, it would be worth choosing Norton 360 Deluxe or any of the higher 360 packages, which come with Norton Family bundled in.

• Read our Norton Family review

FAQs

A picture of my children at the beach, my son playing soccer or even my entire family, smiling in front of our house are all examples of photos I've posted to social media. I know I'm not alone, considering just how often I've seen similar images highlighting the goings-on of modern lives.

But AI has created a disturbing new risk that allows the use of ordinary photos of real children like the ones I mentioned above, to be manipulated into sexual abuse imagery without the child — or their parents — ever knowing.

To be clear, this is not a theoretical threat.

332 AI-generated child sexual abuse ads slipped through

A new investigation from the Tech Transparency Project (TTP) found hundreds of ads containing AI-generated child sexual abuse material (CSAM) running across Facebook and Instagram. Researchers identified four real children whose ordinary photos had been manipulated, according to WIRED, including two teenage influencers, a preteen whose image appeared on a stock-photo site and a young member of a European royal family.

In total, TTP found 332 ads containing AI-generated child sexual abuse material, or CSAM. Most depicted a child whose photograph had been manipulated using AI to make it appear they were performing a sexual act.

The findings are an alarming reminder of how generative AI has changed the risks around sharing photos of children online. Creating convincing fake imagery no longer requires an explicit photograph in the first place. An ordinary picture can provide the raw material.

How ordinary photos become AI-generated abuse

Generative AI image tools can take an existing photograph and modify parts of it while preserving recognizable features of the person in the original.

That's what researchers say happened to several of the children identified in the Meta ads.

According to WIRED, researchers were able to trace images of four minors back to their original sources. Two were teenage influencers with public social media accounts. Another was a preteen whose photograph was available through a stock-photo website. The fourth was a young member of a European royal family.

None of those original photographs needed to contain sexual material for them to be misused.

"AI apps are making it far too easy to create realistic criminal imagery of child sexual abuse, creating the new risk of everyday photos of children being taken and transformed into sexual content," Emma Hardy, director of communications at the Internet Watch Foundation, told WIRED.

Once an ordinary image is publicly accessible, someone can potentially download it and feed it into an AI tool designed to alter photographs.

Meta's AI didn't catch hundreds of the ads

The scale of the latest investigation also shows how difficult the resulting content can be to stop.

In August, TTP researchers initially uncovered 53 ads containing child sexual abuse material across Meta's platforms. Meta subsequently said many of those ads had appeared before the company introduced new AI technology intended to improve its ability to detect violating ads when they were uploaded.

However, researchers kept finding them. In fact, TTP says it ultimately identified 332 ads containing AI-generated CSAM, with hundreds appearing after Meta had announced its improved detection technology.

That is particularly significant because these weren't simply Facebook or Instagram posts that escaped moderation. They were paid advertisements.

Meta says ads are reviewed before they're allowed to run and that automated systems play a major role in that process.

Meta spokesperson Tracy Clayton told WIRED that the company does not tolerate nudify apps or child exploitation, whether the imagery involves real children or is generated by AI. Meta said bad actors deliberately attempt to evade its detection systems and that some of the videos were harder to detect because images of children appeared only briefly or were blurred.

The company said many of the ads researchers identified had already been removed, most received fewer than 200 impressions and it received less than $5,000 in payments from the ads. But researchers documented instances in which exposure increased after an ad was reported.

TTP says one ad involving a real teenager had reached four European accounts when it was reported to Meta. Several days later, when Meta removed it, the ad had reached more than 330.

The investigation shows the tools are mainstream

Researchers found ads directing people toward nearly 50 apps available through Apple's App Store and Google's Play Store. Around 300 of the roughly 350 ads examined in the broader investigation promoted AI image or video generators, according to WIRED.

Apple told WIRED that some developers initially submitted compliant versions of their apps before subsequently adding prohibited nudification capabilities. Apple said it removed 17 of 20 apps identified by researchers and took action against the remaining three, as well as seven additional apps WIRED identified.

Google said it removed all apps included in the report and suspended hundreds of other apps for violating its policies.

Still, these finding reveal a problem that extends beyond any single platform because AI can be used to create the imagery. An app store can distribute the tool used to make it. An advertising platform can then distribute ads promoting it.

Each layer may have its own safety systems, but abusive material only needs to slip through those systems once to reach users.

What to do if you find an AI-generated image of your child

If you discover sexualized AI imagery involving your child, don't repost or widely share the image in an attempt to warn others.

Instead, preserve information that can help identify where the material appeared, such as the account name, page address and other surrounding details, and report the content directly to the platform.

In the U.S., suspected child sexual exploitation can also be reported to the National Center for Missing & Exploited Children's CyberTipline.

Parents can also use NCMEC's Take It Down service, which is designed to help stop the online sharing of nude, partially nude or sexually explicit images or videos involving someone who was under 18. The system creates a digital fingerprint, or hash, from an image without requiring the image itself to be uploaded.

Since AI-generated imagery creates newer and more complicated scenarios, parents who aren't sure whether a manipulated image qualifies should still report what they've found rather than trying to determine that themselves.

The takeaway

Parents have been warned about "sharenting" and children's digital footprints for years. Sharenting is a term that combines "sharing" and "parenting" and is the practice of parents sharing images, videos and personal details about their children on social media.

Although parents can't entirely eliminate the risk of AI abuse on the images or videos they post, but reducing the number of publicly accessible photos of your children and being more selective about what you share, can reduce the amount of material available to people who might misuse it.

More from Tom's Guide

• ChatGPT-6 Astra is here — this one prompt shows what it can really do
• I asked ChatGPT, Gemini, Claude and Perplexity to rank the 10 jobs most likely to be replaced by AI — here's what they all agreed on
• Claude Fable 5.1 is here — this one prompt shows what it can really do

NordVPN's next-gen antivirus has achieved a 94% phishing detection rate in AV-Comparatives' latest anti-phishing test, ranking third among security products in the independent evaluation. The result our choice as the best VPN behind only Avast One Free Antivirus and Norton Antivirus Plus, both of which scored 96%.

The test, which ran from August 12–22, 2026, assessed phishing-page detection rates across 250 live phishing URLs, with an additional 250 legitimate URLs used to check for false positives. NordVPN recorded zero false alarms – a result that puts it ahead of Malwarebytes Premium and Webroot SecureAnywhere Internet Security Plus, both of which triggered false positives during the evaluation.

The findings come as NordVPN continues to reposition itself as an all-in-one digital security app. The company's recent rebrand saw Threat Protection Pro renamed as "next-generation antivirus," placing it alongside its VPN and Dark Web Monitor as one of three core pillars of the product.

How does NordVPN compare?

Finishing third among nine security products is a strong result, but the detail behind NordVPN's score is arguably just as telling as the number itself. Avast One Free Antivirus and Norton Antivirus Plus both edged it out with 96% detection rates, but the gap is narrow – a two-percentage-point difference across 250 live phishing URLs amounts to five URLs.

The rest of the field tells its own story. At the other end of the table, Dr. Web Security Space managed just 57% and K7 Total Security 70% – results that illustrate how inconsistent phishing protection remains across the security products market, even among established names.

NordVPN's advantage over the field is clearest on false positives. It was one of seven security products to record zero false alarms – and false positives erode confidence in a security tool just as surely as missed threats do.

"Phishing is a numbers game for attackers, and they're very good at it," said Domininkas Virbickas, product director at NordVPN. "Anybody might slip up eventually, and when you do click on something you shouldn't, that's where we step in."

A strong track record in independent testing

This is not the first time NordVPN's threat protection feature has performed well under independent scrutiny. In November 2024, AV-TEST – a German independent IT security research institute – previously rated Threat Protection Pro the best VPN tool for malware protection, achieving an 83.42% total detection rate across 3,209 tested links. That result placed it well ahead of the next-best VPN tested, IPVanish, which scored 46.96%.

NordVPN also has history with AV-Comparatives specifically. In June 2024, it became the first VPN provider to earn the organisation's anti-phishing protection badge – a significant distinction given that AV-Comparatives is best known for evaluating dedicated antivirus software, not VPNs. Earning the badge requires a minimum 85% detection rate with zero false alarms on legitimate sites, a bar not all established antivirus products have cleared. The August 2026 result, at 94%, clears it by some distance.

NordVPN's next-gen antivirus is available on Plus plans and above – the feature was previously known as Threat Protection Pro, and is included across Plus, Complete, and Prime tiers.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

In what has to be one of the biggest data breaches to date, a security researcher discovered a hacker who appeared to be selling access to a database of over 153 million driver's licenses from the United States and Canada, including IDs for Pete Hegseth, the current U.S. Defense Secretary (the Defense Department is reportedly aware and investigating).

The breach was spotted by security journalist Brian Krebs in a report claiming that the hacker created a site called Nexus and claimed to have access to digital scans of 153,347,439 identity cards.

"A quick look around Nexus finds they are likely not exaggerating about that 153 million number: Running a blank search in Nexus (with no search parameters entered) returns approximately 11.5 million pages of results, with roughly 15 results displayed per page," Krebs wrote.

In a forum post from a Russian cybercrime site, Nexus allegedly sourced the scans from "major identity verification company," suggesting that the hackers had or have basically real-time access to the company's systems.

How it happened

Krebs found his own driver's license was among the searchable records. He also found Hegseth, whose photo was listed on the site.

Krebs worked with security researcher Zach Edwards, whose ID was also in the breach, and identified the company IDScan as the potential source of the leak. The company, based out of Louisiana, is used by multiple companies to verify millions of IDs from around the globe.

"Based on all the details in the article and how Brian was literally able to dox me (and the timing of the screenshot of my license being added into the system aligning to my trip), all the signs point to IDscan having a hellacious ongoing real-time breach of their data. This is a massive vendor," Edwards wrote on Bluesky.

Investigations and concerns

Per Krebs, the FBI and IDScan are both investigating the breach. Tom's Guide reached out to both organizations but did not receive a reply in time for posting.

“At this point I’m not able to share any additional information, but the updates you have provided have been welcome and helpful to our team’s investigation,” an IDScan spokesperson told Krebs.

A commenter on Krebs story claims that his company received a data breach notification from IDscan:

"Earlier today, September 1, we received information suggesting that certain information may have been exposed and that IDScan.net may be implicated. We are working urgently to validate that information and determine whether any unauthorized access occurred, and the scope of such activity," the note reportedly reads.

It goes on to say that the company has taken steps to secure its system, notified partner companies, engaged legal counsel, and is conducting a third-party forensic investigation.

Nexus apparently went down shortly after Krebs' report went live. Though it's possible it could return under a different domain.

A data breach like this is terrifying at the best of times, but it happens to come at a time just as governments across the globe are attempting to roll out age-verification laws that require adults to upload or scan identity documents in order to prove they can access websites or apps — generally adult content. Privacy advocates and security researchers have already warned that the laws put people's data at risk.

How to stay safe

Edwards ID was likely scanned when he went to a cannabis dispensary that has a contract with IDScan. Krebs believes his was scanned when he rented a car from Hertz last year. He also found his mom's ID from around the same time.

There are plenty of places where your ID could get scanned, from car rental agencies to bars and even the TSA. In the meantime, I would suggest requesting that your ID not be scanned by companies that demand it during check out or check in.

While we don't know if the Nexus database will return, it would be good form to take these seven steps to stay safe after a data breach.

That includes signing up for one best identity theft protection services. As always, you'll want to be on high alert for phishing attacks and social engineering attacks, especially ones that urge you to "act now." Avoid clicking on any links, QR codes, or attachments from unknown senders.

Beyond that, you should consider a password overhaul by creating strong, complex passwords for all of your accounts but you can also use one of the best password managers to do so for you instead.

Even without a massive data breach, these are generally good practices just to keep your side of the street clean since companies are increasingly unable to do so.

More from Tom's Guide

• More than 9.5 million patient records affected by Aesto Health data breach: what you need to know
• We put the best identity theft protection to the test to protect your entire digital life — these are the services I recommend
• Have you been 'Flocked'? Here's how to look up automatic license plate readers in your area

Aesto Health recently disclosed a data breach affecting more than 9.5 million people. Aesto is a software company for healthcare organizations that produces solutions to help them organize patient data when replacing health records systems.

Spotted by Bleeping Computer, the company first posted a notice of the attack on June 24 via its website. However, the actual incursion took place over two weeks in December of 2025. It apparently wasn't discovered until May 26 of this year.

"After an extensive forensic investigation and manual document review, on May 26, 2026, we confirmed that between on or about December 2, 2025, and December 18, 2025, certain protected health information belonging to patients of various Covered Entity clients stored within Aesto’s network may have been accessed and/or acquired by an unauthorized actor," the notice reads.

Apparently, the breach involved unauthorized access via Aesto's Amazon Web Services infrastructure.

What was taken

In its report, Aesto Health confirmed that the breach affects 9,540,683 people. Unfortunately, that data included full names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, taxpayer ID numbers, Social Security numbers and other government identification numbers.

According to the HIPAA Journal, the breach spans 29 different organizations including Edwards County Medical Center, Marana Health, My Doctor, LLC, the Nebraska Orthopedic Center and Women's Health Associates.

The company started informing impacted individuals of the breach on August 21, providing details about the incident and providing identity theft protection and credit monitoring via Experian.

As noted by Bleeping Computer, this incident follows an unfortunate series of breaches that have affected health care companies including CareCloud, Nutex Health, iRhythm and McKesson. The breaches have ranged in size from a couple of hundred thousand to millions of records.

Per Aesto Health and our own review, no threat groups have publicly claimed the attack, unlike other recent ones claimed by the hacker group ShinyHunters.

How to stay safe after a data breach

Check out the full list of companies from the HIPAA Journal, and if you've used any health care organization, you might receive a data breach notification letter from Aesto. If you do, take advantage of the Experian coverage. Keep an eye on your mailbox since notification letters arrive the old-fashioned way.

Even if Aesto doesn't send you a notification letter, you may want to take advantage of one of the best identity theft protection services to protect your identity.

While no one has claimed the attachment, a bad actor could use your information to launch targeted phishing attacks. Phishing emails could contain malicious links or even malware.

Health companies appear especially vulnerable as the summer comes to a close, and every company should be taking this threat seriously. Hopefully, companies are bolstering their cybersecurity right now.

More from Tom's Guide

• We put the best identity theft protection to the test to protect your entire digital life — these are the services I recommend
• Have you been 'Flocked'? Here's how to look up automatic license plate readers in your area
• We've tested the best antivirus software and these are the 5 I recommend right now

From the start of the wireless networking era – even before it was called Wi-Fi – every new spec and generation of hardware was aimed at delivering faster speeds to do more things online at home. Not anymore, because Wi-Fi 8 (aka. 802.11bn) takes a different approach, putting an emphasis on range and reliability to be able to stay online longer with fewer interruptions.

While it seems like a step sideways with a top speed of 46 Gbps that’s equivalent to Wi-Fi 7, Wi-Fi 8 can do a lot to make home networking easier, more fulfilling and dependable. The new spec’s Ultra High Reliability (UHR) approach promotes better performance at long range, the ability to handle more data traffic and block interference. Spectral efficiency is the name of the game with Wi-Fi turning from squeezing more data into the air waves to making it easier to use and more reliable.

Buyer beware, as has been the case with every Wi-Fi generation, the router hardware precedes the general availability of client devices. At first, it can seem like a wireless tease, then, all of a sudden, there are new generation devices everywhere. In addition to the first Wi-Fi routers and mesh kits in the coming months, expect Wi-Fi 8, phones, computers and tablets in early-to-mid 2027. This will be followed by range extenders and USB upgrade kits late in the year.

Archer 8 Ultra and Deco 8 Ultra

I got a sneak peek at what will likely be the first commercial Wi-Fi 8 routers from TP-Link, the company’s Archer 8 Ultra high performance router and Deco 8 Ultra mesh set. They each have functional designs, sleek lines and can theoretically move 19- and 22 Gbps, respectively. Powered by either Qualcomm’s Fast Connect 8800 or Broadcom’s BCM6718 chips, this networking gear is top shelf and aimed at high-performance users with two 10 Gbps inputs and USB ports for connecting a storage device across a network.

The IEEE 802.11bn spec isn’t close to being finalized and I do expect changes before it’s formally approved sometime in 2028. That said, the lack of finality hasn’t stopped the world’s Wi-Fi chip manufacturers and router makers from developing products.

If the past is any indication, the new routers will need a firmware update or three to add late changing aspects of the final Wi-Fi 8 spec. Plus, many router makers plan to introduce new routers that hit the main features on introduction and add items to them throughout 2027. Unfortunately, none of the current generation of Wi-Fi 7 routers can be upgraded to Wi-Fi 8.

How the routers will act is coming into focus. The big change that Wi-Fi 8 brings is better use of the 2.4-, 5.0- and 6.0 GHz frequency bands on which the data rides. It goes beyond 4K Quadrature Amplitude Modulation (QAM) and Multi-Link Operations (MLO) with what TP-Link calls its Stability Engine that will debut with the company’s Wi-Fi 8 hardware.

This can seem like an alphabet soup of engineering acronyms that starts with Unequal Modulation (UEQM) to make sure that each device can get to its full speed regardless of whether lower-speed clients are nearby. The New Modulation and Coding Scheme (MCS) takes this a step further by blocking interference that can lower throughput. Together, the techniques can improve throughput by 24% versus Wi-Fi 7, according to early tests.

Antennas by the dozen

Meanwhile, the routers have internal antennas galore. While the Archer 8 Ultra has no fewer than 18 antennas, the Deco 8 Ultra has a 5 transmit, 5 receive antenna arrangement. This can amount to a 1 to 3 dB increase in signal strength that can translate into greater throughput and range.

That’s just the start because the new antennas can help prevent frustrating disconnect and reconnect cycles that rob throughput. TP-Link’s engineers are going a step further by looking into pushing its antennas to the limit by making its transmission pattern adjustable. The feature would bias it horizontally (for a ranch house) or vertically (for a multi-story building).

Meanwhile, Wi-Fi 8’s Distributed Resource Units (DRU) and Enhanced Long Range (ELR) combine to increase coverage so that the signal can enliven Wi-Fi dead zones with data. These techniques allow clients at the periphery to stay online despite a weak signal. If these changes pan out, my Wi-Fi experience could be vastly improved, from not losing my connection when listening to the BBC World Service on my Wi-Fi Internet radio deep in the basement to working out on the patio on a sunny day.

A premium next-gen upgrade

TP-Link’s Archer 8 Ultra is going on sale in Germany and in the UK in October, where regulators have given the company the green light. This will be followed by U.S. sales in early 2027.

Premium and high performance in all aspects, look for a sub-$1,000 price tag for the Archer 8 Ultra. Though this will almost certainly drop as the year progresses. TP-Link then plans to introduce Pro and base product lines with lower prices during 2027.

Think of Wi-Fi 8 as making the house of cards that wireless networking has become a little sturdier and more permanent so that a sneeze won’t make it all collapse. Just as I got used to Wi-Fi 7, it’s time to turn to Wi-Fi 8 but I can’t wait to get my hands on the two TP-Link networking devices as well as the products of other companies to try them out in my lab and home.

I must admit to a hidden hope that Wi-Fi 8 enhanced reliability is enough to replace many of the Ethernet cables that run through my house, creating a wireless backbone for my entire home network.

More from Tom's Guide

• I just saw Wi-Fi 8 in action, and it might be the first internet upgrade in years that actually makes sense
• These are the best Wi-Fi 7 routers to give your home upgrade a major upgrade right now
• I put aluminum foil behind my router to fix my Wi-Fi dead zones — and it actually worked

Meta has been in plenty of hot water as of late.

The company’s smart glasses have gotten a ton of ire as people have pointed to privacy concerns over users secretly filming random passersby and whoever else they please (there’s even a report about teenage boys using them to pester girls at middle and high schools).

Meta then found itself in the middle of a lawsuit that saw 29 states, co-led by California Attorney General Rob Bonta and the AGs from Colorado, New Jersey and Kentucky, allege that its social media platforms are addictive to children, mislead consumers about those young users’ safety on said platforms and inappropriately gather children's personal data.

That lawsuit has now met its end, as Meta has just agreed to pay a settlement of $17.1 billion — according to a statement made by California AG Rob Bonta. The state of California could receive between $1.5 billion and $2.1 billion if the court authorizes the settlement. As for New York, its attorney general announced that the state will get up to $1.15 billion and likely put it toward kids' education and social services meant to assist youngsters struggling with their social media addiction. Head to this link to see how much each state will receive from this monumental Meta settlement.

With this settlement in place comes a host of changes Meta has been ordered to make to Facebook and Instagram. Here’s what these changes could mean for parents with children who frequently use both platforms and how they could result in a positive outcome for them.

Less addictive and harmful social media spaces for kids of all ages

There’s a wealth of changes Meta must now make according to the measures detailed in the settlement, such as:

• A default daily time limit of two hours for users under 18 years of age that can only be lifted by a parent
• A default nighttime block between midnight and 06:00 for users under 18 years of age that can only be lifted by a parent
• Default blocks on notifications to users under 18 years of age from 22:00 to 07:00 and during the school day
• An enhanced mechanism for teenagers to report potentially harmful content and a requirement that Meta respond to 90% of those reports within six hours
• A ban on displaying numbers of likes or reactions to users under 18 years of age
• A ban on cosmetic procedure image filters for users under 18 years of age
• An option for users under 18 years of age to have a non-personalised feed
• A commitment to enhance parent supervision tools

That settlement also notes that Meta has agreed to the following terms and conditions:

• Institute robust age assurance measures to detect users under 18, as well as measures to identify and remove users under 13 years of age
• Use an independent auditor with expansive access to information and resources
• Be subject to an injunction prohibiting it from making "further false, misleading, or deceptive statements around its safety features"

In a statement that looks to reassure everyone that kids will be more protected across their social media platforms, Meta had this to say: “Ensuring teens have a safe and productive experience on our platforms is an absolute imperative for Meta. We want to get this right for parents and teens.”

With all these newly instituted measures in place, Facebook and Instagram could become far less of an addictive haven for children who want to do nothing but endless scrolling and discover content that could be extremely harmful to their mental well-being. Strict usage time limits, parents getting more control over the type of content their kids see, fewer distracting notifications popping up on kids’ screens and young users having less exposure to detrimental content could go a long way toward making Meta’s platforms more approachable for younger users.

While instituting a two-hour limit for kids using Facebook and Instagram is good, kids may still use that time to expose themselves to harmful content. With parents getting more control over their kids’ social media accounts, here’s hoping their stronger involvement will make children less susceptible to coming across said content.

Bottom line

Meta being forced to take responsibility for the harm its social media platforms have done to children is major. While this development doesn’t automatically make Facebook and Instagram 100% safe for kids from this point forward, it’s a good first step toward companies like Meta recognizing the ill effects their products have had on children.

More from Tom’s Guide

• Perplexity’s new local-first AI runs on your PC — and asks before using the cloud
• ChatGPT can learn your repetitive tasks by watching you — here are 7 prompts to try
• AI could transform healthcare for the better — but this doctor says there’s one thing it should never do

Privacy concerns around social media have escalated significantly in recent years, with users increasingly cautious about what they share online.

A new experiment by Compare the Market tested exactly how much information can actually be hidden when you set your Instagram to private. The results are sobering.

A licensed investigator was tasked with locating the home addresses of nine volunteers using only publicly available information.

Despite four of them having private Instagram profiles, the investigator identified the addresses of seven out of nine. The fastest was located in just 15 minutes, with the first lead found in 50 seconds.

What the investigation revealed

Colin Crowden, Intelligence Director at Global Protect and an Open-Source Intelligence expert, conducted the investigation. What he discovered challenges the assumption that private accounts provide adequate protection.

Beyond identifying addresses, the investigation uncovered four complete property plans revealing internal home layouts. In one particularly concerning finding, Crowden established that a volunteer was away on holiday, confirming their property was unoccupied.

The speed at which information was gathered highlights a critical vulnerability. Information shared by friends and family, location tags from previous posts, property details visible in photos, and data from other online sources all contribute to a broader picture.

Crowden explains the issue clearly: "Information that appears harmless in isolation can become much more revealing when viewed alongside other publicly available information. This isn't about any one post creating a security risk; it's about how different pieces of information can build up over time."

Why your private account isn't enough

The experiment demonstrates that privacy settings alone offer incomplete protection. Even if your Instagram is private, tagged photos from friends, public check-ins, or incidental details in backgrounds can expose your location and home information.

The investigation reveals that the combination of data sources, not any single post, creates the vulnerability. Compare the Market's home insurance expert Helen Phipps worked with Crowden to develop concrete recommendations for reducing your digital footprint.

Practical steps to protect yourself

Wait until you're home to post

If possible, wait until you're home before posting holiday photos rather than sharing in real time. This prevents anyone from knowing your property is unoccupied. If you do post while away, avoid revealing exactly where you are or how long you'll be away for.

Review your privacy settings before you travel

Check who can see your posts, stories, and tagged content. Consider setting your accounts to private and reviewing your followers so that holiday updates are only visible to people you trust. This step takes minutes but significantly limits exposure.

Coordinate with friends and family

Your friends and family can inadvertently expose you. Ask them not to share real-time updates if you're traveling together or post photos of your property if they're housesitting.

People often don't realize they're compromising your security by tagging you in posts or sharing location details.

Turn off automatic location tags

Disable geotagging in your social media settings entirely. On Instagram, this requires revoking access directly through your phone’s system settings under Privacy & Security (iOS) or Apps (Android) rather than within the app itself.

Location sharing can unintentionally reveal your whereabouts even when you're not posting in real time. This is one of the easiest settings to overlook but also one of the most revealing.

Audit your digital footprint

Search for yourself online periodically to see what personal details are publicly accessible, and remove anything that compromises your privacy. Pay special attention to old social media posts containing house numbers, street signs, car license plates, or identifiable landmarks.

If you want to take action right now, I have a step-by-step walkthrough covering 5 ways to start removing your personal information from the internet. You should also check out how to blur your home in Google Maps Street View.

Combine digital caution with home security

Beyond digital precautions, pair online caution with classic home security measures. Set light timers to create the appearance someone's home, test all locks, arm your alarm system, and ask a neighbor to collect post and manage bins so the house looks lived-in.

Ensure your home insurance policy covers the duration of your trip and review any conditions that apply while your property is unoccupied.

This investigation raises important questions about privacy in the digital age. Have you changed your social media habits? What's your biggest concern about your digital footprint? Share your thoughts in the comments below.

For a complete breakdown of Compare the Market's methodology and findings, read the full Online Safety Study here.

More from Tom's Guide

• Meta's new AI tool uses your Instagram photos by default — here’s how to opt out
• Inside the dark market stealing real identities online
• Instagram's 'instants' feature is driving users crazy. Here's how to disable it

Automated license plate readers (ALPR) manufactured by Flock Safety operate across tens of thousands of locations in nearly every U.S. state.

Mounted near intersections, neighborhood entrances, and main highways, these motion-activated systems capture high-resolution snapshots of passing traffic. The software logs license plate numbers, vehicle colors, make, and distinctive visual markers like roof racks or damage.

While law enforcement agencies cite the technology for helping solve active cases, privacy advocates raise concerns over continuous passive surveillance of everyday drivers.

Checking whether your daily commute passes through an active camera zone requires using public transparency tools, crowdsourced databases, and visual hardware checks. Here's where to start.

Curious if you are on the police's radar?

The independent transparency project Have I Been Flocked offers a rare, though limited, public window into automated surveillance by compiling official audit logs obtained through public records requests.

Where data is available, putting your license plate number into the site lets you check if participating law enforcement agencies have queried your specific vehicle.

Keep in mind that coverage is far from comprehensive. It cannot show a real-time feed, nor does it log every time your car passes a camera. Instead, it exposes the historical paper trail left behind only when an officer manually searches your plate within a jurisdiction that has released its audit logs.

The platform also overlays crowdsourced camera maps and regional policy trends, helping to highlight local data retention habits and how agencies share access across city lines.

You don't have to wait for an audit log

While lookup sites rely on public records, community-driven maps offer a clearer picture of physical hardware placements. Volunteer-driven projects like DeFlock map thousands of confirmed automated plate readers across interactive regional layouts.

Inputting your home or work address displays verified device markers, often including field-of-view indicators that reveal which direction a camera faces.

Meanwhile, privacy advocates and projects like FlockHopper use this crowdsourced data to highlight heavy surveillance corridors and potential alternative routes, utility varies widely.

Because these platforms rely strictly on volunteer submissions, map coverage depends entirely on how active the privacy community is in your specific area.

See what your town or city's cameras are doing

Many city governments and police departments pull back the digital curtain by hosting dedicated Flock Safety Transparency Portals on their municipal websites.

By searching your town or city's name alongside "Flock transparency portal," you can unlock a live public dashboard detailing the exact number of active cameras in your area, and the searches undertaken.

These dashboards reveal the core settings of your local surveillance net. They show exactly whether your police department activates real-time hot-list alerts for missing persons and wanted vehicles, or if they restrict the technology strictly to retroactive evidence gathering after a crime has occurred.

While not every town chooses to make their dashboard public, a quick search is the fastest way to see how your community balances public safety with digital privacy.

Spotting a Flock camera in the wild

While you can track placements via public records or crowdsourced maps, keeping your eyes on the road is the best way to spot unlisted or newly installed units.

Flock devices feature a distinct, minimalist design: a compact black rectangular box mounted roughly 8 to 12 feet high on light poles or dedicated metal posts. Each unit typically operates completely off-grid, equipped with a small, angled solar panel positioned directly above the main camera housing.

To spot them, look for lenses pointing sharply downward toward active traffic lanes rather than toward sidewalk pedestrian paths. They are built primarily to hunt for license plates and vehicle characteristics, not foot traffic.

What’s your take on Flock cameras? Do you view them as essential public safety tools or an overreach on driver privacy? Let us know in the comments below.

More from Tom's Guide

• Hidden cameras in hotels and Airbnbs are more common than you think — 5 ways to protect your privacy
• Is your personal information public? The simple step to securing your privacy online
• Your security cameras are in the wrong spots — here's how to fix it