Heads in the sand. Exploiting that AWS outage. OpenAI launches a Chat GPT-powered browser.
US surveillance prompts lawsuit. Technology trends, per Gartner. And Boy Scouts embrace cybersecurity.
Riding for a fall
Among those affected by this week’s Amazon Web Services outage were some very uncomfortable and singularly pissed off owners of very expensive “Smartbeds.” When AWS went offline, the $2,700 cloud-connected contraptions lost their minds, turning up heating or getting stuck in a sitting position. There may be a better metaphor for our collective technological insanity but it currently escapes us. And of course smart beds weren’t the only things affected by Amazon’s conniption. Bank customers, air travellers, messaging platforms, automated cat litter boxes; all emerged as victims of a single point of failure.
To give Amazon credit, it has already explained what happened. It involved a software bug in Amazon’s system for managing internet addresses. Less creditably, rather than isolating the problem it caused a knock-on effect, taking down the entire US-EAST 1 region which (as demonstrated) is really quite widely used. An obvious lesson from the failure is the need for organisations to ensure true resilience by using multiple cloud providers or, shockingly, maintaining some capability of their own. All of which rather undermines the sales pitch of cloud providers like AWS.
More broadly, it’s perfectly obvious that it’s only a matter time before a truly catastrophic failure results from our dependency on technology and the way it is deployed and managed. Witness the further details that are emerging about the security breach at global security giant F5. Bloomberg reports that it began in 2023, far earlier than previously thought. And in the UK, the cost of the Jaguar Land Rover cyberattack could be as high as £1.9 billion. In the tale of the frog and the boiling water, the creature doesn’t notice the temperature is rising. Could we say the same?
Threats
AWS: There’s one other consequence from the AWS outage; attackers will inevitably exploit it to send fake messages offering support or compensation. AI tools make it trivially easy to create messages that look pretty much identical to the real thing. Beware.
Mobile: AI is also behind a surge in attacks targeting mobile devices, according to Verizon’s 2025 Mobile Security Index. The report is based on a survey of nearly 800 professionals involved in procuring and managing mobile devices. It found 85% had seen a rise in attacks, while few had implemented defences to mitigate the threat. It has now become essential for organisations of all sizes to ensure they have a platform to manage mobile devices, especially those that are personally owned.
Zendesk: Hackers are abusing the customer service and sales platform to flood inboxes with menacing messages. To put it bluntly, Zendesk appears to have created a system perfectly suited for abuse. Krebs on Security
Extensions: Yet another case underlining the risks of browser extensions, this time targeting WhatsApp users. The Chrome add-ons masquerade as WhatsApp automation tools and are designed to facilitate large-scale spam campaigns. Socket
LastPass: Following a widespread phishing campaign, the password manager company has issued a statement reassuring users it hasn’t been hacked. The campaign used emails with the title, “We Have Been Hacked - Update Your LastPass Desktop App to Maintain Vault Security.” LastPass did experience a catastrophic security breach in 2022 following which we recommended people stop using it. Data from that breach is currently being exploited.
Air: The misfortune of a tourist in Australia illustrates precisely why the details of plane tickets and boarding passes should never be shared online…or casually discarded. The traveller was so excited about an upcoming trip to Singapore that she shared details, including the booking reference, on TikTok only to discover shortly afterwards that someone phoned Qantas and cancelled her flight.
AI
Browser: OpenAI has launched a web browser that integrates ChatGPT and is billed as being “closer to a true super-assistant that understands your world and helps you achieve your goals.” AI guru Simon Willison tested it and puts it rather differently, “it was like watching a first-time computer user painstakingly learn to use a mouse for the first time.” Willison also has grave concerns about the potential security risks of ‘OpenAI Atlas.’ We’ve tried it out and have yet to be persuaded as to how it could provide any substantial benefits.
Fakes: One week. Two major political deepfakes. In the US, Republicans took remarks from a print interview with Senate Democratic Leader Chuck Schumer and turned them into an AI-generated video. In Ireland, Meta removed a fake video which falsely showed a candidate announcing her withdrawal from the presidential election campaign.
Effective: Another tidbit from Microsoft’s gargantuan Digital Defense Report; When people receive a phishing email generated by AI, they’re 4.5 times more likely to open the attached link or file. “This will incentivize cyber threat actors who aren’t yet using AI to add it to their toolbox in the future,” Microsoft says.
Wikipedia: Traffic to the online encyclopaedia is on a downward trend due to “the impact of generative AI and social media on how people seek information.” The Wikimedia Foundation says human page views are down 8% year-on-year. Automated traffic on the other hand is spiking.
Trump
Surveillance: A group of unions and the Electronic Frontier Foundation is suing the Trump administration, accusing it of running an illegal online surveillance program. “Using AI and other automated technologies, the program surveils the social media accounts of visa holders with the goal of identifying and punishing those who express viewpoints the government doesn’t like,” they say.
Bolton: Former national security adviser John Bolton is facing charges of mishandling classified information after hackers gained access to his personal AOL email account. The charges allege that Bolton emailed notes to family members, apparently in preparation for a book he was planning to write. Bolton has denied the charges. From a security perspective, using email to transmit sensitive information is a lousy idea whether you’re entitled to do so or not. Zero Day
Blocked: Dutch intelligence services say they have stopped sharing some threat intelligence with their US counterparts. With characteristic directness, Dutch intelligence chiefs said relations remained excellent but that the Netherlands had grown more selective about what it chooses to share with US intelligence agencies—particularly the Central Intelligence Agency and the National Security Agency. Intel News
Insecurity: A commission set up to assess the state of cybersecurity in the US has found that the country’s “ability to defend itself and its allies from cyber threads is stalling – and in some areas, slipping.” The CSC 2.0 project puts the blame on cuts at the US cybersecurity agency and the US government as a whole.
In brief
2026: An emphasis on leveraging the capabilities of AI while proactively defending against cybersecurity threats will be the dominant technology trends next year, according to Gartner. Not much surprise there, though Gartner’s analysis suggests organisations have an awfully long way to go before they get where they need to be. One other trend Gartner highlights is an increasing move towards moving data from global public clouds into regional, sovereign replacements. The ghastly jargon it has coined for this is ’Geopatriation.”
Takedown: You’ll recall last month’s breathless announcement about the US Secret Service taking down a network allegedly capable of crippling telecom systems in the New York area. At the time, we said it was more likely to be part of an operation to send fraudulent SMS messages. Now, Europol has taken down a similar operation in Latvia. The huge “SIM farm” involved 40,000 SIM cards which were used to provide access to phone numbers from 80 countries. That’s the good news. Less positive are details of a huge China-based SMS phishing campaign using lures such as package misdelivery notifications. To give a sense of its scale, Unit 42 says it identified 194,000 malicious domains connected to the campaign.
SMS: Meanwhile, a court in London has sentenced a 31-year-old man to 24 weeks in prison for using an SMS blaster on the London underground. Kong Ji Chen was arrested after he was spotted hanging around stations with a large suitcase and never actually going anywhere. SMS blasters are used to mimic a cellphone tower and send phishing messages. 24 weeks; that’s sure to act as a powerful deterrent.
Swings: A judge in the US has issued a permanent injunction banning the maker of Pegasus spyware from targeting the WhatsApp platform. On the other hand, the judge also reduced punitive damages the NSO Group owes Meta from $167 million to $4 million. The damages were awarded after NSO was found to have used WhatsApp as a mechanism to infect targets with spyware. Reuters
Claim: The Everest ransomware group says it was responsible for the incident at Collins Aerospace that crippled airports across Europe last month. The group has threatened to publish stolen data unless Collins pays a ransom.
Poland: Russia has been exploiting its drone incursions to target the Polish population with disinformation operations, according to analysis by Google’s threat intelligence team. It says Russia has been trying to blame the incidents on NATO, sow distrust against the Warsaw government, and promote a positive image of Russia.
Location: Microsoft is working on a new Teams feature that will automatically detect when a user is connected to an organisation’s WiFi network. Or in other words, it will tell your boss if you’re not in the office.
Badges: Scouting America has announced two new merit badges recognising achievements in AI and cybersecurity. Boy Scouts can receive the new cybersecurity badge by learning how to spot malware and phishing emails, create passwords, and use firewalls.
Updates
Microsoft: Emergency update to fix the Windows Recovery Environment which ceased to work on systems with USB mice and keyboards after installing the October 2025 security updates.
Tinder: Mandatory face verification is being introduced for new users in the US following its rollout in six other countries. The change aims to identify real people with multiple accounts, scammers using stolen photos, and bots using AI-generated photos.
Meta: New tools are also being released for WhatsApp and Messenger in an effort to protect users from scams.
Zimbra: Emergency patch to fix a critical security vulnerability.
Oracle: October’s updates contains 374 new security fixes - 230 of them for vulnerabilities that can be exploited remotely without authentication.