Chinese state-sponsored threat actors have been observed using a Go-based artificial intelligence (AI)-powered penetration testing framework called ARTEX in attacks aimed at high-value targets simultaneously.
The activity has been attributed by CrowdStrike to a China-based "targeted intrusion adversary" it tracks under the moniker Vapor Panda (previously VexatiousTemper). First identified in
General Motors is taking what looks like a light slap on the wrist from a coalition of 35 states and the District of Columbia after agreeing to settle allegations that it collected drivers' data without proper consent and sold it to data brokers that supplied insurance companies. The Washington state AG's office said on Thursday that GM had reached a $220 million settlement with 36 attorneys general over the automaker's collection and sharing of driving data, including precise location information, speed, seatbelt use, and other metrics. According to investigators, GM sold that data to brokers, which in turn supplied it to insurance companies that could use it to set customers' premiums, without drivers' informed consent. For reference, the $220 million settlement, which will be distributed among the participating jurisdictions, equates to less than 7 percent of GM's $3.3 billion in net income attributable to stockholders for its third quarter, which ended on September 30, 2026. Don't spend it all in one place, y'all. The settlement comes more than two years after a 2024 New York Times investigation found that GM had been selling the data collected from vehicle owners through its Smart Driver program. That program, part of GM subsidiary OnStar’s offering, collected the aforementioned data and handed it back to vehicle owners in reports designed to inform better driving habits. Unbeknownst to Smart Driver subscribers, their data was also being forked over to data brokers despite GM telling customers it wouldn't share that information with insurers without their express consent. The insurers ultimately obtained the data by purchasing it from brokers with which GM had struck deals. To make matters worse, the Washington AG's office said GM incentivized dealerships to enroll customers in Smart Driver, with employees in some cases accepting terms and conditions on customers' behalf without their knowledge or consent. GM also failed to notify many drivers that their information was being collected and shared. Its OnStar app incorrectly told more than 370,000 drivers they were not enrolled in Smart Driver, even as GM continued collecting and selling their data, according to investigators. “The data GM sold was personal, identifiable, and specific,” the AG’s office said. GM canned the Smart Driver program in April 2024, just over a month after the New York Times exposed its data-sharing practices, citing customer feedback. In addition to the monetary pittance it’s handing over to the states, GM also agreed with the 36 AGs to limit the driving data it collects, better protect customer PII, and establish a "comprehensive data privacy program.” The Washington AG’s office described its settlement as “significantly stronger than any other resolution reached with GM for this conduct.” Speaking of those other terms, GM finalized its settlement of the same allegations with the Federal Trade Commission in January 2026. The FTC order required GM to obtain drivers' express consent before collecting, using, or sharing covered driving data, subject to certain exceptions. It also required the company to offer a simple way for drivers to request a copy of their data, request its deletion, and disable precise geolocation data collection where their vehicles support it. The state of California separately reached a $12.75 million settlement with GM in the matter in May; a separate case in Texas is ongoing. “This agreement … reinforces steps we’ve taken to strengthen our privacy practices,” a GM spokesperson told The Register, though the company noted that it still stands by driver data collection as a best practice. “Safer, more helpful and personalized experiences are enabled by connected vehicle data, and GM is committed to being clear about what information is used, how it’s protected, and the choices customers have about what they share,” the spokesperson added. ®
Anthropic has denied allegations that a malicious version of the official Claude Code extension published to Cursor’s marketplace was linked to any kind of compromise of its own systems. The company was forced to issue a statement after prominent figures in the cybersecurity industry alleged that the extension, which infected up to 5,000 developers, was uploaded to Cursor’s marketplace following a breach at Claudemaker Towers. Felix Rieseberg, a member of Anthropic’s technical staff, Xeeted today: "We're working with Cursor on this incident, but it wasn’t a compromise of Anthropic's systems or employee laptops. "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected, and this only impacts Cursor users." First spotted by EDR vendor Phorion, an unknown party pushed an update to Cursor's official Claude Code extension for Visual Studio Code that contained a persistent SSH backdoor written for Windows, macOS, and Linux. According to Cursor, the extension – version 2.1.313 – was available to download for around 11 hours between 0227 and 1335 PT (0927 and 2035 UTC) on Thursday. The vendors' analyses of the implant revealed that it collected information about the host machine and user, including usernames, configured Git emails, and public IP addresses, as well as attempting to open a reverse SSH tunnel. Crucially, Cursor echoed Phorion's assessment that the package contained a critical flaw. The script responsible for opening the SSH tunnel required admin rights on macOS and Windows to do so, and in the vast majority of cases it did not have these, resulting in failure. Regardless, the extension still forwards the collected host and user data to the attacker, as well as dropping the attacker's SSH key and installing the persistence mechanism, so developers must go threat hunting in case their instance allows for the SSH tunnel to be created successfully. Simply installing the latest version of the extension is not enough to clear the persistence mechanism, either. The full details of how to remediate the issue, and links to download scripts to wipe the infection, are laid out in Cursor's account of the situation. Aside from Rieseberg's statement today, neither Cursor nor Anthropic have commented on how the malicious package made its way to the official marketplace. Anthropic's position is that a malicious actor uploaded the tampered copy to Cursor, but the latter has not outlined how it reached the marketpplace. "[We] removed the malicious version from the marketplace immediately upon detection and blocked further distribution," Cursor said in the advisory. "We followed with a full shutdown of the VSCode Marketplace out of an abundance of caution." It also ran checks to confirm no other extensions were compromised in the same way, rotated its own keys before restoring the marketplace, and worked with a cloud hosting provider to block the connection to the attacker's server, it said. ®
Discord announced on October 27, 2026, that messages from public channels in its more than 63,000 Discoverable Servers will start appearing in Google and other search engines from mid-December 2026, according to Discord’s official blog. In the US and most other countries, the setting that shares your messages is on by default for adult accounts. To keep new messages off the web, turn off “Show my message content from Discoverable channels on web pages” under User Settings > Data & Privacy.
Key takeaways
Only public channels in Discoverable Servers are affected. DMs, group DMs, and private servers are not.
Server Web Pages with AI-generated Channel Summaries go live November 16, 2026. Individual messages follow from mid-December.
One Discord privacy setting covers every Discoverable Server you belong to.
Turning the setting off stops future messages from appearing. It does not remove messages already published.
Discord hides usernames and avatars, but the details inside a message can still identify you.
What Is Changing on Discord, and When
Discord is rolling out search visibility in three stages, starting with admin controls and ending with individual messages. The change covers only Discoverable Servers: communities listed in Discord’s Server Discovery that have at least 1,000 members, are at least eight weeks old, and meet Discord’s activity and safety requirements, according to the Discord blog.
Date
What happens
Who controls it
October 27, 2026
Admin controls and the member privacy setting begin rolling out
Server admins and members
November 16, 2026
Every Discoverable Server gets a public Server Web Page, including AI-generated Channel Summaries
Server admins
Mid-December 2026
Individual messages from participating channels begin appearing, rolled out gradually over several weeks
Members (and admins, by channel)
Discord says messages sent before mid-December 2026 won’t be included, whatever your setting. Channels whose content may appear on the web are labeled, so you can see it before you post.
Is Discord Private? What Can Go Public and What Stays Private
Public channels in Discoverable Servers can now reach search engines, but your DMs and private servers stay out of search. Here’s how the change applies, based on the Discord announcement:
Can appear on the web
Stays off the web
Message text in participating public channels of Discoverable Servers (from mid-December 2026)
Direct messages (DMs) and group DMs
AI-generated Channel Summaries of active conversations (from November 16, 2026)
Private servers and servers not listed in Server Discovery
Server Web Pages describing each Discoverable Server
Messages sent before mid-December 2026
Usernames and avatars, which Discord says won’t be shown
Messages from accounts in Discord’s teen age group
How to Change Your Discord Privacy Settings to Opt Out
You can opt out of Discord’s search indexing with one toggle, and it applies to every Discoverable Server you’re in. On desktop or the web:
Open User Settings. Select the gear icon next to your name at the bottom left of the Discord window.
Go to Data & Privacy. It’s listed in the settings menu on the left.
Turn off “Show my message content from Discoverable channels on web pages.” This stops messages you send afterward from appearing on Server Web Pages and in search results.
If you don’t see the option on the mobile app, try the desktop app or a browser. Log in at discord.com/settings/data-and-privacy. Changes made there apply to your entire account across all devices.
Two things to know before you rely on the switch:
It only works going forward. According to Discord, messages you sent while the setting was on stay up unless you delete them in Discord.
It doesn’t cover Channel Summaries. Summaries are controlled by server admins, so a summary can still describe a conversation you took part in.
If you don’t see the setting yet, Discord says controls are rolling out gradually from October 27, 2026. Check again before mid-December, when messages start going live.
If You Run a Server: Use the Web Presence Controls
Server owners and admins decide whether their community appears on the web at all, including the AI-generated summaries members can’t switch off. If you take no action, Discord says public channels stay on and a Server Web Page goes live on November 16, 2026.
Open Server Settings > Web Presence.
Choose which channels take part, or opt every channel out.
Review Channel Summaries. You can change which channels feed them, curate what’s shown, or turn them off.
Tell your members. Post a short note explaining what will be public and how members can turn off message sharing.
Why Hidden Usernames Don’t Make You Anonymous
Discord removes usernames and avatars from public pages, but the words in a message can still point to you. Doxxing, the practice of piecing together and publishing someone’s personal details, often starts with small clues spread across many posts.
What’s in a message
How it can identify you
Your city, school, workplace, or gym
Narrows you down to a small group of people
A distinctive phrase, project, or story
Can be matched to your posts on other platforms
Photos and screenshots
Can show faces, locations, or details in the background
Links to your other accounts
Connect your Discord activity to your real name
Dates and plans (“I’m away next week”)
Reveal routines or when your home is empty
Public pages can also be copied by other sites, and search results can lag behind changes, with a removed or changed page often showing in results for a while until a search engine’s crawler revisits it. McAfee’s guide on how to protect yourself from doxxing covers Discord-specific steps, including using a username you don’t use anywhere else.
What to Do If Your Discord Messages Are Already in Search
If you’re reading this after Discord’s mid-December 2026 rollout and your setting was on, messages you’ve sent since then may already be on Server Web Pages and in search results. Turning the setting off now only stops new messages from appearing, so you’ll need to delete the ones you want gone. Messages sent before mid-December aren’t included in search results. Work through the steps that apply:
Turn off the Data & Privacy setting so nothing new is shared.
Delete messages that reveal personal details. Discord says deleting a message removes it from its public pages.
Search for yourself. Look up your username, display name, and any phrases you’ve used to see what’s indexed.
Ask Google to refresh old results. After you delete a message, use Google’s Refresh Outdated Content tool so search results stop showing the old text. For personal information that’s still online, see Google’s guide to removing web results.
Secure your accounts. If a message exposed an email address or linked account, change those passwords and turn on multi-factor authentication.
Keep records. Save screenshots, links, and dates of anything posted about you or any threats you receive.
Is Discord Safe to Use After This Update?
Discord’s search change doesn’t make the platform inherently unsafe, but you do need to stay mindful of what you post and avoid sharing personal information about yourself. Your DMs and private servers are unaffected. Treat anything in a Discoverable Server’s public channels as something anyone could find.
Post as if your words are searchable. Keep your real name, location, school, and workplace out of public channels.
Review your server list. Leave Discoverable Servers you no longer use.
Limit who can DM you. Restrict DMs to friends to cut down on unwanted contact.
Use a unique username. Don’t reuse a handle that links to your other accounts.
Turn on two-factor authentication for your Discord account.
Lock Down the Accounts Your Discord Posts Could Lead To
Discord’s toggle only controls Discord. If a public message can be tied to your Instagram, X, or LinkedIn profile, those accounts can fill in your name, photos, location, and contacts. That’s why it’s worth checking privacy settings across all your social accounts, not only the one that changed.
McAfee’s Social Privacy Manager helps you review your social media privacy settings in one place. It scans more than 100 privacy settings across platforms including Facebook, Instagram, LinkedIn, X, Google, and YouTube, suggests changes based on how public you want to be, and applies them in a few clicks. You’ll have to update you Discord privacy settings directly, but Social Privacy Manager can help with your other accounts.
You can make your social media presence safer by setting each profile to private or friends-only, hiding your friends or followers list, removing your location and workplace from public profile fields, and turning off search engine indexing where the platform offers it.
Tips for Parents Whose Teens Use Discord
Teen accounts are excluded entirely. Discord says users in its teen age group can’t enable message sharing until they’re adults. That protection depends on the age on the account, so check that your teen’s birthdate is accurate.
Talk about what “public” means. Server Web Pages and Channel Summaries may describe conversations in large communities, even when individual messages aren’t shown.
Know which servers your teen is in. Large public communities are the ones affected.
Revisit the setting at 18. Discord hasn’t said whether sharing turns on automatically when a teen account becomes an adult account, and the adult default in the US is on.
How to Report Doxxing or Harassment on Discord
If someone uses your public messages to find, threaten, or extort you, report it to the platform and to authorities:
Discord: right-click (desktop) or press and hold (mobile) a message, then select Report Message, as described in Discord’s guide to reporting content.
Local police: if you’ve been threatened or your safety is at risk.
FBI Internet Crime Complaint Center: report extortion or online fraud at ic3.gov.
The single most useful step is the setting itself. Before mid-December, open User Settings > Data & Privacy, turn off “Show my message content from Discoverable channels on web pages,” and delete any public messages that reveal more about you than you’d want a stranger to find.
FAQ
Will my Discord DMs show up in Google?
No. Discord says DMs, group DMs, and private servers are always private and aren’t part of this change.
Are Discord messages public now?
Messages in public channels are already visible to anyone in the server. From mid-December 2026, messages from participating channels in Discoverable Servers can also appear on the open web and in search, but only for members whose sharing setting is on.
Will my old Discord messages appear in search?
No. Discord says messages sent before mid-December 2026 won’t be included, regardless of your setting.
If I opt out later, are my messages removed?
No. Turning the setting off stops future messages only. Messages already published stay up unless you delete them in Discord, and search results may take time to update.
TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. In a TeamViewer session, the computer that connects and takes control is the viewer, and the machine it controls is the host.
A malicious or compromised host can exploit the flaw to crash the viewer's TeamViewer and, depending on the platform, may also run
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.
The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October
A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported.
Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase.
Trezor said in a blog post 
The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything.
Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application
Thousands of GCHQ storage drives containing sensitive data have been lost for years, and the British signals intelligence agency still cannot explain where they are. According to the Investigatory Powers Commissioner’s Office’s (IPCO) annual report, the missing storage drives have been known to officials for years, and may contain data related to the Investigatory Powers Act (IPA). "I remain concerned that GCHQ has not yet established a sufficiently clear understanding of the scale, location, and recoverability of lost removable media that may contain IPA-related data, notwithstanding that the underlying issues were first drawn to my attention several years ago," wrote investigatory powers commissioner Lord Brian Leveson. "While I recognize the technical and practical challenges involved, the passage of time without a comprehensive account heightens the importance of sustained senior focus and assured remediation. Given the potential sensitivity of the material involved, I will continue to monitor progress closely.” Described as "a very significant number," the report notes that GCHQ has scoped the maximum number of potentially lost drives, but is unaware of the exact scale of the issue. The agency has embarked on "a program of further work" to locate as many of the lost devices as possible, which includes implementing an automated asset-tracking system by the end of the year. After this is up and running, it said it will be able to provide a more precise number of lost drives. A GCHQ spokesperson told The Register: "As IPCO have reported, our management system for removable media was previously not sufficiently robust to effectively track the items that were registered for use. IPCO are right to note the flaws in the data the system produced, and we have taken action against all their recommendations. "We recognize the importance of security of removable media in our systems, and have a range of measures to mitigate the risks posed by these items. The findings in the report have been addressed comprehensively, and all necessary steps to correct this issue have been taken." Peter Sommer, digital forensics expert and visiting professor at de Montfort and Birmingham City universities, told us: "Bearing in mind the sort of highly sensitive data collected and processed by GCHQ IPCO is right to be very concerned, the more so as the issue is already several years old. Vast quantities of data can be stored on the cheapest lowest cost hard disks and cards. At a much more modest level as an expert witness I know how important it is to keep careful track of the data entrusted to me." Losing important devices is not an achievement that's exclusive to GCHQ. Myriad stories like this have emerged from all corners of the public sector over the years, such as the British Minidstry of Defence misplacing USB drives containing secret information in the mid-noughties, civil servants routinely losing their BlackBerry handsets, and UK police losing thousands of devices, too. The missing storage drives comprise just one of the agency's various transgressions highlighted by IPCO in its report. There are also "significant concerns" over the lax safeguards used to restrict the UK's overseas partners when accessing bulk-intercepted data collected by GCHQ. IPCO was satisfied at how GCHQ ensured its own analysts remained compliant with safeguards around accessing confidential material related to journalism, journalistic sources, and privileged legal information. However, there were concerns around how these same safeguards were applied to its international partners, which have access to its so-called bulk data interception "product." The report notes that most partners were properly restricted from accessing such material, although an internal probe found that there were inadequate arrangements in respect to one partner and their access to journalistic material. Both GCHQ and the overseas agency committed to rectifying the situation. GCHQ was also questioned after a software bug in a web app "used by a relatively small section of the public" misidentified individuals thought to be participating in terrorist activities. The agency identified and reported the flaw in the software, which it used for "target discovery work," and although it only affected a small number of individuals, the errors led to five port stops made under the Terrorism Act and caused "serious prejudice" to the victims. A port stop, for the uninitiated, involves law enforcement detaining a suspect at a UK port, airport, train station, or within one mile of the Northern Ireland border, and can be carried out without suspicion. Once detained, individuals have a legal responsibility to provide passwords to their electronic devices, which can be seized for up to seven days, and in some cases have their biometric markers taken. Failure to comply can lead to a three-month prison term. IPCO ruled, however, that there was ultimately no error made as defined by the IPA. “This is because the activity was lawfully authorised under an interception warrant and the adoption of an unintentionally and unforeseeably imperfect target discovery methodology did not constitute such an error,” the report stated. Despite the agency’s vast technical expertise, IPCO said that the issue affecting the software was not foreseeable. GCHQ was not the only offender among the UK intelligence community (UKIC), with MI5's mishandling of the infamous Agent X case taking center stage in the report. Agent X was an anonymous MI5 informant whose real identity has never been publicly released. A secret inquiry by IPCO as well as the report revealed that MI5 managed Agent X despite knowing he was a violent misogynist obsessed with extreme violence. Lord Leveson said "the case of Agent X is as serious as anything I have dealt with as Commissioner," after MI5 gave false evidence to the High Court and Investigatory Powers Tribunal to protect a foreign neo-Nazi informant who was under police investigation for abusing his partner, referred to publicly as "Beth." ®
Multiple crypto-tracing firms say notorious North Korean hackers TraderTraitor may be behind the largest digital heist in history—with billions of crypto likely gone for good.
Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets.
The conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence
Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems.
The malicious update, version 2.1.313, was distributed under the extension's legitimate publisher identity, prompting Cursor to temporarily shut
Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component.
The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
"This module enables you to sell goods and services to customers through an included shopping cart
Login
ZDNet | security RSS
/r/netsec - Information Security News & Discussion
The Hacker News
The Register - Security
