# CTD

> Security, privacy and software news, with the sources attached


## Posts

- [Sony's So-net says intruder took 2.58 million member records and email passwords](https://papayawhip-dove-711788.hostingersite.com/sony-so-net-breach-2-58-million-records-email-passwords/): Sony Network Communications says an October 19 intrusion exposed more than 2.58 million So-net and plala member records, 54,401 email passwords and 16 bank account records.
- [New York governor signs law restricting AI companion features for minors](https://papayawhip-dove-711788.hostingersite.com/new-york-law-restricts-ai-companion-chatbot-features-for-minors/): New York's new law bans AI companion features such as claiming human emotions or encouraging secrecy for minors, requires age checks with data deletion, and sets penalties of up to $25,000 per violation.
- [FTC orders nine companies to explain how personal data shapes prices and pay](https://papayawhip-dove-711788.hostingersite.com/ftc-6b-orders-personalized-pricing-personal-data/): The FTC ordered Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target and Walmart to explain whether personal data or loyalty status shapes the prices they charge and the pay workers receive.
- [How to back up a small business the 3-2-1 way, with ransomware in mind](https://papayawhip-dove-711788.hostingersite.com/how-to-back-up-small-business-3-2-1-ransomware/): Three copies, two devices, one offsite, and at least one disconnected. Here is how a small business can follow NCSC and CISA backup advice and use versioning and locked storage.
- [Firefox 159 patches 167 vulnerabilities and adds scroll-driven animations](https://papayawhip-dove-711788.hostingersite.com/firefox-159-patches-167-vulnerabilities-scroll-driven-animations/): Firefox 159, released October 27, fixes 167 security vulnerabilities, 108 of them rated high, and turns on scroll-driven animations and scoped custom element registries by default.
- [Google blames London cloud outage on generators that failed to start](https://papayawhip-dove-711788.hostingersite.com/google-cloud-london-outage-generators-failed-to-start/): Google's final report on the October 20 europe-west2 outage says a misconfigured controller kept backup generators from starting after a utility feed failed, cutting power to a London zone.
- [Google policy update lets connected Gmail and Photos data shape ads](https://papayawhip-dove-711788.hostingersite.com/google-privacy-policy-gmail-photos-data-personalized-ads/): Google's privacy policy, effective October 16, now says Gmail, Drive and Photos content can personalize ads if users connect those apps to services such as Search through Personal Intelligence.
- [Planted instruction files can steer AI coding agents into installing malware](https://papayawhip-dove-711788.hostingersite.com/planted-instruction-files-steer-ai-coding-agents-into-installing-malware/): Forever Security says an AGENTS.md file dropped into a Downloads folder led a coding agent to try installing a malicious npm package, and that both Codex and Claude Code could be steered in tests.
- [How to reduce ad tracking on your phone: iOS and Android settings that matter](https://papayawhip-dove-711788.hostingersite.com/how-to-reduce-ad-tracking-on-iphone-and-android/): App Tracking Transparency, iCloud Private Relay, Android's advertising ID controls and both platforms' permission settings limit how apps follow you. Here is where to find each one.
- [1Password adds post-quantum ML-DSA passkeys as passkey sign-ins hit 36%](https://papayawhip-dove-711788.hostingersite.com/1password-post-quantum-ml-dsa-passkeys/): 1Password now creates passkeys using ML-DSA, a NIST post-quantum signature algorithm, for sites that support it. FIDO says passkeys now account for 36% of successful sign-ins.
- [Optical fiber prices surge as AI data centers drive a shortage, TrendForce says](https://papayawhip-dove-711788.hostingersite.com/optical-fiber-prices-surge-ai-data-center-shortage/): TrendForce says optical fiber spot prices are 2.8 to five times 2025 levels as AI data center demand creates a 180 million fiber-kilometer shortfall that could last until at least 2028.
- [UK competition regulator proposes strategic market status for Microsoft](https://papayawhip-dove-711788.hostingersite.com/uk-cma-proposes-strategic-market-status-for-microsoft/): The UK's CMA has provisionally found that Microsoft meets the test for strategic market status in business software, opening the door to possible rules on AI tools, security bundling and cloud licensing.
- [Appeals court lets Georgia enforce social media age-verification law for now](https://papayawhip-dove-711788.hostingersite.com/eleventh-circuit-georgia-social-media-age-verification-law/): The Eleventh Circuit vacated an injunction against Georgia's SB 351, letting the state enforce age checks, parental consent for under-16 accounts and limits on ad targeting while the case continues.
- [Meta releases Muse Spark Open, an 816-billion-parameter open-weight model](https://papayawhip-dove-711788.hostingersite.com/meta-releases-muse-spark-open-816b-open-weight-model/): Meta's new open-weight model has 816 billion parameters, a 1 million token context window and a custom license, and the company says it can run on two Mac Studio desktops.
- [Ubuntu 26.10 ships with Linux 7.3, GNOME 51 and an all-Rust coreutils](https://papayawhip-dove-711788.hostingersite.com/ubuntu-26-10-stonking-stingray-linux-7-3-gnome-51-rust-coreutils/): Canonical released Ubuntu 26.10 on October 15, a nine-month interim release with GNOME 51, a Linux 7.3 kernel, Rust-based core utilities and Sequoia PGP for repository signature checks.
- [How to turn on full-disk encryption on Windows, macOS and Ubuntu](https://papayawhip-dove-711788.hostingersite.com/how-to-turn-on-full-disk-encryption-windows-macos-ubuntu/): Device Encryption, BitLocker, FileVault and Ubuntu's installer can lock a drive's contents behind a password or key. Here is how to switch each one on and keep the recovery key safe.
- [Microsoft's record October Patch Tuesday fixes exploited Windows Shell flaw](https://papayawhip-dove-711788.hostingersite.com/microsoft-october-2026-patch-tuesday-windows-shell-zero-day/): Microsoft's October 13 updates fix more than 1,400 flaws, including CVE-2026-96951, an actively exploited Windows Shell bug that bypasses Mark of the Web protection.
- [Microsoft ends updates for Windows 11 24H2, Office 2021 and Server 2012](https://papayawhip-dove-711788.hostingersite.com/microsoft-ends-updates-windows-11-24h2-office-2021-server-2012/): Windows 11 version 24H2 Home and Pro, Office 2021 and the final year of paid extended updates for Windows Server 2012 all reached the end of their support on October 13, 2026.
- [Microsoft unveils Maia 300 AI chip, plans multi-gigawatt rollout from 2027](https://papayawhip-dove-711788.hostingersite.com/microsoft-maia-300-ai-inference-chip-multi-gigawatt-2027/): Microsoft's third-generation in-house AI accelerator is built for inference and slated for production in 2027, with the company claiming 40% more tokens per megawatt than leading GPU systems.
- [Norway fines Microsoft-owned Xandr NOK 92 million over Grindr ad auctions](https://papayawhip-dove-711788.hostingersite.com/norway-fines-xandr-nok-92-million-grindr-real-time-bidding/): Norway's data protection authority fined Xandr NOK 92 million for relaying Grindr users' data, including sexual orientation, through ad auctions without valid consent. It is the regulator's largest fine.
- [Python 3.15 released with lazy imports, frozendict and UTF-8 by default](https://papayawhip-dove-711788.hostingersite.com/python-3-15-released-lazy-imports-frozendict-utf-8-default/): Python 3.15.0, released October 9, adds opt-in lazy imports, an immutable frozendict type and UTF-8 as the default text encoding, along with an upgraded experimental JIT compiler.
- [How to check whether your email or passwords were exposed in a data breach](https://papayawhip-dove-711788.hostingersite.com/how-to-check-if-email-or-passwords-were-exposed-in-data-breach/): Have I Been Pwned, Chrome's Password Checkup and Apple's Passwords app can show whether your details leaked. Here is how to run each check and what the NCSC says to do next.
- [Tensorlake npm package hijacked to spread Shai-Hulud credential-stealing worm](https://papayawhip-dove-711788.hostingersite.com/tensorlake-npm-package-hijacked-shai-hulud-worm/): Version 0.5.144 of the tensorlake npm SDK shipped a Shai-Hulud worm variant that steals developer and cloud credentials and can wipe home directories if its stolen GitHub token is revoked.
- [SAP agrees to buy TechWolf to put skills data at the core of SuccessFactors](https://papayawhip-dove-711788.hostingersite.com/sap-to-acquire-techwolf-skills-data-successfactors/): SAP has agreed to acquire Ghent-based TechWolf, whose AI maps employees' tasks and skills, and plans to make it a core of SuccessFactors. Terms were not disclosed; closing is expected in Q4.
- [Gallup finds AI benefits at work flow mostly to workers in better jobs](https://papayawhip-dove-711788.hostingersite.com/gallup-ai-benefits-at-work-unevenly-distributed/): Regular AI users report much bigger gains than occasional users and are more likely to already hold quality jobs, a Gallup survey of more than 15,000 U.S. workers found.
- [GitHub puts a 48-hour deadline on unused npm trusted publishing setups](https://papayawhip-dove-711788.hostingersite.com/github-npm-trusted-publishing-configurations-expire-48-hours/): Unvalidated npm trusted publishing configurations now expire 48 hours after creation, and npm rejects tokens from comment-triggered GitHub Actions workflows, GitHub said on October 2.
- [Police dismantle KillSec ransomware servers; 16-year-old suspected as leader](https://papayawhip-dove-711788.hostingersite.com/killsec-ransomware-servers-seized-teen-suspected-leader/): A Hamburg-led operation seized KillSec's servers, leak site and at least 110 TB of data, with three provisional arrests. Police say a 16-year-old is the suspected main operator.
- [How to set up passkeys on your Google, Apple and Microsoft accounts](https://papayawhip-dove-711788.hostingersite.com/how-to-set-up-passkeys-google-apple-microsoft-accounts/): Passkeys replace passwords with the fingerprint, face scan or PIN that unlocks your device. Here is how to create them for Google and Microsoft accounts and sync them on Apple devices.
- [Microsoft begins phased shutdown of Exchange Web Services in Exchange Online](https://papayawhip-dove-711788.hostingersite.com/microsoft-begins-phased-shutdown-of-exchange-web-services/): Microsoft is rolling out tenant-by-tenant changes from October 1 that start disabling Exchange Web Services in Exchange Online, with full shutdown set for April 2027.
- [Connecticut privacy amendments take effect, ban sale of precise location data](https://papayawhip-dove-711788.hostingersite.com/connecticut-privacy-amendments-geolocation-ban-data-broker-registry/): Connecticut's SB 4 amendments took effect October 1, banning sales of precise geolocation data, adding facial recognition signage rules and setting up a data broker registry due in 2027.

## Pages

- [Editorial policy](https://papayawhip-dove-711788.hostingersite.com/editorial-policy/): How we report, source, correct and label our stories.
- [Contact](https://papayawhip-dove-711788.hostingersite.com/contact/): Tips, corrections and questions.
- [About CTD](https://papayawhip-dove-711788.hostingersite.com/about/): Independent reporting on security, privacy, software, AI and business technology.
- [Privacy policy](https://papayawhip-dove-711788.hostingersite.com/privacy-policy/): What we collect and why.


[comment]: # (Generated by Hostinger Tools Plugin)