Two high-severity security vulnerabilities have been disclosed in Composer, a package manager for PHP, that, if successfully exploited, could result in arbitrary command execution.
The vulnerabilities have been described as command injection flaws affecting the Perforce VCS (version control software) driver. Details of the two flaws are below -
CVE-2026-40176 (CVSS
Internal emails obtained by WIRED reveal how a conservative legal group with a direct line into FCC chairman Brendan Carr’s office built the case against Jimmy Kimmel and his employees.
Cybersecurity researchers have unmasked a novel ad fraud scheme that has been found to leverage search engine poisoning (SEO) techniques and artificial intelligence (AI)-generated content to push deceptive news stories into Google's Discover feed and trick users into enabling persistent browser notifications that lead to scareware and financial scams.
The campaign, which has been
Google has announced the integration of a Rust-based Domain Name System (DNS) parser into the modem firmware as part of its ongoing efforts to beef up the security of Pixel devices and push memory-safe code at a more foundational level.
"The new Rust-based DNS parser significantly reduces our security risk by mitigating an entire class of vulnerabilities in a risky area, while also laying
I maintain awesome-prometheus-alerts, a collection of production-ready Prometheus alerting rules. Just added a batch of rules relevant to low-level system and network monitoring:
A nascent Android remote access trojan called Mirax has been observed actively targeting Spanish-speaking countries, with campaigns reaching more than 220,000 accounts on Facebook, Instagram, Messenger, and Threads through advertisements on Meta.
"Mirax integrates advanced Remote Access Trojan (RAT) capabilities, allowing threat actors to fully interact with compromised devices in real
OX Security recently analyzed 216 million security findings across 250 organizations over a 90-day period. The primary takeaway: while raw alert volume grew by 52% year-over-year, prioritized critical risk grew by nearly 400%.
The surge in AI-assisted development is creating a "velocity gap" where the density of high-impact vulnerabilities is scaling faster than
Wearable health devices are designed to give you more control over your body and your data.
But in 2026, the bigger risk isn’t someone spying on your smartwatch or smartring in real time. It’s what happens if the data connected to that device gets exposed.
Health data, login credentials, and behavioral patterns tied to wearables can become valuable signals for cybercriminals. And once that data is out, it can fuel everything from identity theft to highly targeted scams.
Here’s what’s actually at risk, and how to protect yourself.
What Is Wearable Health Data (and Why It Matters)
Wearable health data refers to the personal information collected and stored by devices like fitness trackers, smartwatches, and connected medical monitors.
This can include:
Heart rate and activity levels
Sleep patterns
Location data
Medical metrics (like glucose levels)
Account credentials tied to apps and dashboards
On its own, this data may seem harmless. But combined, it creates a highly detailed profile of your habits, routines, and health status.
The Real Risk in 2026 Isn’t the Device. It’s the Data.
Early conversations around wearable security focused on device hacking or surveillance.
Today, the bigger concern is data exposure.
If wearable platforms, apps, or connected services are breached, your data could be:
Sold on the dark web
Used to impersonate you
Leveraged in targeted phishing or health-related scams
And because this data is personal and specific, scams built from it can feel far more convincing than generic spam.
How Exposed Wearable Data Can Lead to Scams
When cybercriminals gain access to personal data, they don’t just sit on it. They use it.
Here’s how that plays out:
Scenario
What It Looks Like
Why It Works
Health-related phishing
“Your insurance claim was denied” or “Update your health profile”
Feels relevant and urgent
Account takeover attempts
Password reset emails tied to known apps
Uses real account signals
Personalized scams
Messages referencing routines, devices, or conditions
Builds trust quickly
Fake alerts or services
“Device security issue detected”
Mimics real product behavior
This is where the risk shifts from data privacy → real-world financial and identity impact.
2) Use layered protection, not just device settings A VPN and security software help protect data in transit and block threats before they reach you.
3) Strengthen your login credentials Use strong, unique passwords and enable two-factor authentication wherever possible.
4) Limit what you share Review app permissions and only connect devices to services you trust.
5) Verify every message or alert If you receive a message tied to your device or health data, double-check the source before clicking.
6) Monitor your accounts regularly Small signs of unusual activity can be early indicators of larger issues.
How McAfee Helps Protect Your Data Beyond the Device
Protecting your wearable doesn’t stop at the device itself. It extends to what happens if your data is exposed or targeted.
Identity Monitoring
McAfee helps track your personal information across known breach sources and alerts you if your data appears where it shouldn’t.
This gives you early warning if wearable-related accounts or associated data are compromised.
Scam Detector
If your data is exposed, scammers often follow.
McAfee’s Scam Detector helps identify suspicious messages, links, and communications before you engage, and explains why something was flagged, so you can make informed decisions quickly.
Together, these tools help protect not just your device, but the chain reaction that can follow a data breach.
Cybersecurity researchers have discovered a new campaign in which a cluster of 108 Google Chrome extensions has been found to communicate with the same command-and-control (C2) infrastructure with the goal of collecting user data and enabling browser-level abuse by injecting ads and arbitrary JavaScript code into every web page visited.
According to Socket, the extensions (complete list
I'm starting to become pretty fond of Bruce. Actually, I've had a bit of an epiphany: an AI assistant like Bruce isn't just about auto-responding to tickets in an entirely autonomous manner; it's also pretty awesome at responding with just a little bit of human assistance. Charlotte and I both replied to some tickets today that were way too specific for Bruce to ever do on his own, but by feeding in just a little bit of additional info (such as the number of domains someone was presently monitoring), Bruce was able to construct a really good reply and "own" the ticket. So maybe that's the sweet spot: auto-reply to the really obvious stuff and then take just a little human input on everything else.
Login
