Binance Withdrawals Resume, Plus 3 Tech Stories
Binance is restoring withdrawals after a $6.3 billion theft. Plus enforceable school AI privacy terms, Applebee’s exposed app credential, and Google Sheets citations.
Mike York
About Mike York
Posts by Michael York:
When the Backup Box Becomes the Ransomware Target
Synology ransomware turns the backup appliance into the week’s most practical warning. Plus hospital downtime, exploited ecommerce software, AI permission failures, Toast’s lock-in problem, connected-car data, and private chats in bankruptcy.
Synology NAS Ransomware, Plus 2 Tech Stories
Synology NAS ransomware is targeting outdated DSM releases. Plus, the FTC’s allegations against Toast and the fight over Character.AI chat records.
Drupal Commerce Stores Need Patching, Plus 2 Stories
An actively exploited Drupal Commerce vulnerability leads today’s brief, followed by a malicious Cursor extension and a patient-data exposure caused by unapproved AI use.
Preparing for the Attack We Don’t Know About Yet
You can’t patch a vulnerability nobody knows exists. But you can limit the damage, protect your accounts, and test your way back. From critical infrastructure to your washing machine, here’s where to start.
GM Driver Data Settlement, Plus 3 Tech Stories
GM will pay $220 million over driver-data allegations. Plus Florida’s financial-aid breach, DreamHost credential exposure, and an FTC pricing inquiry.
The Hacker Has AI Agents. The Algorithm Has Your Attention.
One hacker used AI agents to target 1,200-plus websites. Meanwhile, AI-generated protest graphics and recycled social accounts can make rumors look credible. The common problem? Scale without verification.
New York Restricts AI Chats With Kids, Plus 3 Stories
New York restricts manipulative AI companion behavior with minors. Plus a DHS personnel leak, Chrome’s Gmail autofill, and ads inside AI Mode conversations.
What Do You Rely On, and Who’s Securing It?
The grocery freezer isn’t supposed to be your cybersecurity problem. Neither is the water plant or power grid. But when they fail, who’s responsible—and can your business keep working?
Cyberattack Diverts Ambulances, Plus 3 Stories
A cyber incident diverted ambulances from New Mexico’s only Level 1 trauma center. Plus an exploited Magento flaw, ad-auction surveillance, and Apple security updates.
Website Security: A Bad Week for PHP, Node.js and System Administrators
PHP and Node.js had a bad week. Patching matters, but it won’t find forgotten systems, close exposed doors, or prove your backups work. Here’s the unglamorous work that keeps a bad week from becoming a bad year.
AI Tests Reached Real Systems, Plus 2 Stories
Anthropic’s filing shows how AI tests reached live systems through a misconfigured environment. Plus weak website-certificate keys and a Node.js Brotli security fix.
Google’s AI Connections Can Shape Ads, Plus 2 Stories
Google’s AI connections can let permitted account data influence ad personalization. Plus actively exploited Nextcloud and VeloCloud flaws, and Meta’s delayed terms.
Your Website Is More Than the WordPress Dashboard
Critical PHP flaws exposed a blind spot beneath WordPress, while AI agents, cloud outages, aging servers, and fraud showed where control really lives.
Windows Server 2016 Support Ends Soon, Plus 2 Stories
Windows Server 2016 support ends January 12, 2027. Plus Quest’s patient-record breach and the security risk left behind by an abandoned app.
A New PHP Risk Needs a Workaround, Plus 2 Stories
PHP disclosed a new session upload progress vulnerability with no fixed release yet. Here’s the temporary mitigation, plus AWS capacity pressure and PwC’s vendor incident.