Anthropic's September threat intelligence report describes state-linked actors using Claude for surveillance, some of it aimed at dissidents living abroad. In an October commentary for Just Security, Citizen Lab researchers analysed the report and urged AI companies to act on disclosure and notification, detection and refusal, and evidence preservation. Neither document offers settings advice for ordinary users.
Based on 8 sources, including Anthropic, Just Security, Citizen Lab
On 19 October, EFF released a Safari version of Privacy Badger, its tracker-blocking browser extension. It runs only on the Mac and requires Safari 26.5 and macOS 15.7.7 or later. As of 8 November, there is no Safari version for iPhone or iPad.
When your Mac opens an app downloaded from the internet, it connects to Apple to check the app for known malware. On this day, a problem with Apple's notarization service left Macs around the world stuck for minutes or unable to open third-party apps at all.
According to FPF on 4 November, citing data obtained by CBC News, US Customs and Border Protection (CBP) searched 32% more travellers' electronic devices in the first three quarters of fiscal year 2026 than in the same period a year earlier. The searches affect travellers entering and leaving the US, and non-US citizens who refuse to unlock a device may be refused entry. People carrying source material to the US need to decide before departure whether they will unlock if asked.
Based on 12 sources, including U.S. Customs and Border Protection, Freedom of the Press Foundation, CBP
Security firm Sekoia on 4 November published details of a campaign that attacked phones through websites. According to its report, every flaw used had already been patched, and phones updated to the latest system are not affected. Separately, the research team Calif posted a video on 3 November claiming to bypass Lockdown Mode on an iPhone; as of 8 November there were no technical details and no response from Apple.
Based on 32 sources, including Sekoia, Apple, Google Chrome Releases
Some games on your computer come with anti-cheat software that runs at the lowest layer of Windows (checked in November 2026). On this day, Sony BMG suspended the manufacture of CDs containing XCP, copy protection software that hid its own files on computers.
Two notices bearing the name of the Delhi Police reached X between late October and early November, asking it to remove or withhold in India the accounts of two digital rights organisations and of an account that documents blocking orders. As of 8 November, the notices had not been officially confirmed as genuine, and we could not find out whether X had complied. Under X's policy, withholding is limited to the country that made the request.
Based on 16 sources, including SFLC.in, Internet Freedom Foundation, Newslaundry
According to user reports, ASN Bank's Android app in the Netherlands has, since version 1.36.3 (updated in mid-October), intermittently blocked Wero payments on systems without Google certification such as GrapheneOS, while the app itself still opens and shows accounts. As of 8 November we could find no announcement from ASN. People planning to switch to GrapheneOS can take it as an example of a bank moving a payment feature onto Google's check.
Based on 11 sources, including GitHub, ASN Bank, Android Developers
Signal on your friends' phones in Myanmar was blocked by the authorities in 2024, according to Freedom House. On this day, a special court inside a Myanmar prison sentenced a blogger to 20 years and six months after a closed trial.
According to Hong Kong media reports of a police briefing on 5 November, facial recognition is due to be added to the SmartView programme within November, and cameras at the first malls could be connected by the end of the year. The police said the connection complies with Hong Kong's privacy law, but as of 8 November we could find no public response from the Office of the Privacy Commissioner for Personal Data, and neither facial recognition nor the mall connection had been announced as launched. People who live in Hong Kong or travel there for leisure or business may have their images sent into the police system when they pass through a connected mall, and places outside Hong Kong are not affected.
Based on 19 sources, including Hong Kong Police Force, Hong Kong Free Press, 星島頭條
OpenSSH released 10.6p2 on 5 November, fixing a flaw that let an overly long password log in to accounts with no password set. Only sshd on Linux built with musl libc and not using PAM to check passwords is in scope, Alpine Linux being one example. According to the OpenSSH maintainer and HKCERT, glibc systems such as Debian, Ubuntu and Red Hat are not in scope, though as of 8 November the Debian and Ubuntu trackers had not marked them unaffected. Anyone running sshd on Alpine should update or turn off password logins.
Based on 16 sources, including OpenSSH, Alpine Linux, oss-security
Firefox on your desktop has by default let a cookie be used only on the site that created it since June 2022, and Firefox's development source code was still set that way when checked in November 2026. On this day, the Mozilla Foundation released Firefox 1.0 with a built-in pop-up blocker and features to help guard against phishing sites.
Canada's Bill C-22 on lawful access passed second reading in the Senate on 22 October and went to the Standing Senate Committee on National Security, Defence and Veterans Affairs, and as of 7 November it had not reached third reading. A Citizen Lab researcher argues that AI-driven cyber threats have changed significantly since June and that communications systems should not be left with weaknesses. Public Safety Canada's briefing notes from May argue that the bill does not require backdoors and that providers may decline requirements that would introduce a systemic vulnerability. Readers outside Canada do not need to change any settings now.
Based on 11 sources, including Parliament of Canada, Citizen Lab, Internet Society
Apple has added an option in iOS and iPadOS 27.2 to confirm that a user is an adult by estimating their age from a selfie. Apple's support documents say it is offered only in Australia, Brazil, Singapore and the UK. As of 7 November, Taiwan, Hong Kong, mainland China and Japan are not among the places where Apple requires age confirmation.
Based on 18 sources, including Apple, Privacy Guides, Apple Developer
Your personal data generally needs your prior consent before a business in Japan sends it abroad, under Japanese law as checked in November 2026. On this day, the Council of Europe opened for signature a protocol requiring Parties to set up fully independent data protection authorities and to restrict transfers of personal data to non-Parties unless they ensure adequate protection.
The Foundation for Media Alternatives in the Philippines has compiled the discussions of two workshops into a map of AI risks in labour, disinformation, privacy, the environment and the creative industries, and states that the content reflects only the participants' views. The report compares seven draft AI bills in the House of Representatives and makes recommendations to Congress, executive agencies and platforms. Readers outside the Philippines are not directly affected.
Based on 8 sources, including Foundation for Media Alternatives, PhilStar, BusinessWorld
In two posts on 23 October, EFF argued that frontier AI models have made finding vulnerabilities cheap and that computers will be compromised more often. EFF recommends that everyone keep browsers and apps updated, use a password manager and watch for phishing, and argues that companies relying on open source should contribute money and people to its upkeep. People who run their own websites should also check that PHP has been patched.
Based on 19 sources, including EFF, The PHP Foundation, PHP
If you signed up for WeChat with a phone number outside mainland China's +86 dialling code, your personal information is stored on servers in Singapore and Malaysia under WeChat's privacy policy, or in Hong Kong for users in Hong Kong and Macao. On this day, the Standing Committee of China's National People's Congress passed the Cybersecurity Law, requiring operators of critical information infrastructure to store personal information collected in China inside the country in principle.
In September a police source in Toronto told The Globe and Mail that a key phone in a shooting investigation runs GrapheneOS, a privacy-hardened operating system that supports only Pixel phones, and that investigators had not been able to unlock it. From 31 October the GrapheneOS account posted a series of messages alleging a state-sponsored smear campaign in the Netherlands and Germany. Law enforcement in Canada, Spain and France and GrapheneOS each give their own account of who uses it, whether it can be unlocked and what developers are responsible for.
Based on 21 sources, including GrapheneOS, The Globe and Mail, Xataka Android
On 22 October the US Cybersecurity and Infrastructure Security Agency (CISA) released ScubaGear v2.0.0 and ScubaGoggles v1.1.0, free tools that compare an organisation's Microsoft 365 and Google Workspace settings against CISA's security baselines and produce a report. They are meant for an organisation's administrators. ScubaGear runs only on Windows, and ScubaGoggles needs a super admin account.
Based on 20 sources, including GitHub, CISA, iThome
The email address or phone number you give X when signing up is linked to your account under the privacy policy in effect since January. On this day, US prosecutors made public a criminal complaint accusing two former Twitter employees of looking up data on critics of the Saudi government on that government's behalf.
Character Technologies, the company behind the chatbot platform Character.AI, filed for bankruptcy in the US in October and plans to sell its assets. The U.S. Trustee at the Justice Department and 39 states plus Washington, D.C. asked the court to appoint a privacy ombudsman to advise on whether, and on what terms, user data can be sold with the assets, while the company argues that its privacy policy already permits the transfer. According to MLex, the judge did not require an appointment on 30 October but encouraged the company to consider one.
Based on 14 sources, including The Record from Recorded Future News, PPC Land, MLex
Tor Browser 16.0 is out for desktop and Android and is now based on Firefox ESR 153. The desktop version has redesigned Settings and a new generic window titles option that is off by default, and 32-bit x86 Linux is no longer supported from this release. Tails 7.16 updates its built-in Tor Browser to 16.0, and Tails 7.0 or later can upgrade automatically.
Your Android phone with Google apps preinstalled may regularly send Google details such as crash reports and the apps you have installed, as Google's privacy policy still said when we checked on 2 November. On this day, Google and 33 other companies formed an alliance and announced Android, an open-source platform for mobile phones.
Article 19 has published a digital payments handbook in Traditional Chinese and English, using transactions between Hong Kong and the UK and US as its examples. It sets out what banks, money transfer services and payment platforms collect, whom they share it with and how long they keep it, offers seven strategies for reducing the risk, and notes that similar lessons apply elsewhere.
Based on 5 sources from Article 19, Laws & Regulations Database of Taiwan, Monetary Authority of Singapore
Windows and macOS users who installed or updated the Claude Code extension 2.1.312 or 2.1.313 from Cursor's own marketplace on 29 October, Pacific time, may have received a backdoored version. According to an Anthropic staff member, the versions on Anthropic's official channels are not affected. Separately, research published on 22 October documented a Markdown instruction file placed in a Downloads folder to lure Codex into installing a malicious package.
Based on 10 sources, including Cursor, Forever Security, Ars Technica
If you live outside the US and use American email or cloud services, the companies running them may be directed by the US government to help collect communications of non-US persons abroad. On this day, the US government formally announced the creation of the National Security Agency, responsible for communications intelligence.
After the private keys of eight intermediate certificates from the Indian certificate authority eMudhra were computed, Apple, Microsoft and Chrome have all blocked or removed the related certificates, and ordinary users' browsers, phones and computers need no extra setup. The git, curl and other command-line tools built into macOS may still accept these certificates, and as of 2 November we had found no fix from Apple. eMudhra has announced it is leaving the public TLS certificate business, and as of 1 November had not filed a formal incident report on the incident ticket.
Based on 10 sources, including Apple, Microsoft 365 Message Center Archive, Mozilla Bugzilla
iOS 27.2 adds Excluded Apps under Siri in Settings, for choosing apps that Siri, Search and suggestions may not read. According to EFF, on-screen awareness also stops working for excluded apps. Siri AI on iPhone and iPad is not offered in the EU or mainland China, and as of 2 November its languages do not include Chinese, so people whose device and Siri language are set to Chinese cannot use it for now.
Some browsers can send websites a signal on your behalf asking them not to sell or share your personal data. On this day, California voters passed a privacy law by ballot measure, giving residents the right to stop businesses from sharing their personal information.
