WhatsApp has disclosed a hacking attempt that combined flaws in its app with a vulnerability in Apple’s operating system. The company has since fixed the issues.
The exploit, tracked as CVE-2025-55177 in WhatsApp and CVE-2025-43300 in iOS, allowed attackers to hijack devices via malicious links. Fewer than 200 users worldwide are believed to have been affected.
Amnesty International reported that some victims appeared to be members of civic organisations. Its Security Lab is collecting forensic data and warned that iPhone and Android users were impacted.
WhatsApp credited its security team for identifying the loopholes, describing the operation as highly advanced but narrowly targeted. The company also suggested that other apps could have been hit in the same campaign.
The disclosure highlights ongoing risks to secure messaging platforms, even those with end-to-end encryption. Experts stress that keeping apps and operating systems up to date remains essential to reducing exposure to sophisticated exploits.
Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!
Cyber experts are warning that Bluetooth-enabled adult toys create openings for stalking, blackmail and assault, due to weak security in companion apps and device firmware. UK-commissioned research outlined risks such as interception, account takeover and unsafe heat profiles.
Officials urged better protection across consumer IoT, advising updates, strong authentication and clear support lifecycles. Guidance applies to connected toys alongside other smart devices in the home.
Security researchers and regulators have long flagged poor encryption and lax authentication in intimate tech. At the same time, recent disclosures showed major brands patching flaws that exposed emails and allowed remote account control.
Industry figures argue for stricter standards and transparency on data handling, noting that stigma can depress reporting and aid repeat exploitation. Specialist groups recommend buying only from vendors that document encryption and update policies.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!
The US Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) have announced a joint effort to clarify spot cryptocurrency trading. Regulators confirmed that US and foreign exchanges can list spot crypto products- leveraged and margin ones.
The guidance follows the President’s Working Group on Digital Asset Markets recommendations, which called for rules that keep blockchain innovation within the country.
Regulators said they are ready to review filings, address custody and clearing, and ensure spot markets meet transparency and investor protection standards.
Under the new approach, major venues such as the New York Stock Exchange, Nasdaq, CME Group and Cboe Global Markets could seek to list spot crypto assets. Foreign boards of trade recognised by the CFTC may also be eligible.
The move highlights a policy shift under President Donald Trump’s administration, with Congress and the White House pressing for greater regulatory clarity.
In July, the House of Representatives passed the CLARITY Act, a bill on crypto market structure now before the Senate. The moves and the regulators’ statement mark a key step in aligning US digital assets with established financial rules.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!
Cyber security specialists warn that human behaviour remains the most significant vulnerability in digital defence, despite billions invested in AI and advanced systems.
Experts note that in the Gulf, many cybersecurity breaches in 2025 still originate from human error, often triggered by social engineering attacks. Phishing emails, false directives from executives, or urgent invoice requests exploit psychological triggers such as authority, fear and habit.
Analysts argue that building resilience requires shifting workplace culture. Security must be seen not just as the responsibility of IT teams but embedded in everyday decision-making. Staff should feel empowered to question, report and learn without fear of reprimand.
AI-driven threats, from identity-based breaches to ransomware campaigns, are growing more complex across the region. Organisations are urged to focus on digital trust, investing in awareness programmes and user-centred protocols so employees become defenders rather than liabilities.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!
Elon Musk’s AI chatbot, Grok, has faced repeated changes to its political orientation, with updates shifting its answers towards more conservative views.
xAI, Musk’s company, initially promoted Grok as neutral and truth-seeking, but internal prompts have steered it on contentious topics. Adjustments included portraying declining fertility as the greatest threat to civilisation and downplaying right-wing violence.
Analyses of Grok’s responses by The New York Times showed that the July updates shifted answers to the right on government and economy, while some social responses remained left-leaning. Subsequent tweaks pulled it back closer to neutrality.
Critics say that system prompts, such as short instructions like ‘be politically incorrect’, make it easy to adjust outputs, but also leave the model prone to erratic or offensive responses. A July update saw Grok briefly endorse a controversial historical figure before xAI turned it off.
The case highlights growing concerns about political bias in AI systems. Researchers argue that all chatbots reflect the worldviews of their training data, while companies increasingly face pressure to align them with user expectations or political demands.
Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!
Reports that Gmail suffered a massive breach have been dismissed by Google, which said rumours of warnings to 2.5 billion users were false.
In a Monday blog post, Google rejected claims that it had issued global notifications about a serious Gmail security issue. It stressed that its protections remain effective against phishing and malware.
Confusion stems from a June incident involving a Salesforce server, during which attackers briefly accessed public business information, including names and contact details. Google said all affected parties were notified by early August.
The company acknowledged that phishing attempts are increasing, but clarified that Gmail’s defences block more than 99.9% of such attempts. A July blog post on phishing risks may have been misinterpreted as evidence of a breach.
Google urged users to remain vigilant, recommending password alternatives such as passkeys and regular account reviews. While the false alarm spurred unnecessary panic, security experts noted that updating credentials remains good practice.
Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!
A report has highlighted a potential exposure of Apple ID logins after a 47.42 GB database was discovered on an unsecured web server, reportedly affecting up to 184 million accounts.
The database was identified by security researcher Jeremiah Fowler, who indicated it may include unencrypted credentials across Apple services and other platforms.
Security experts recommend users review account security, including updating passwords and enabling two-factor authentication.
The alleged database contains usernames, email addresses, and passwords, which could allow access to iCloud, App Store accounts, and data synced across devices.
Observers note that centralised credential management carries inherent risks, underscoring the importance of careful data handling practices.
Reports suggest that Apple’s email software flaws could theoretically increase risk if combined with exposed credentials.
Apple has acknowledged researchers’ contributions in identifying server issues and has issued security updates, while ongoing vigilance and standard security measures are recommended for users.
The case illustrates the challenges of safeguarding large-scale digital accounts and may prompt continued discussion about regulatory standards and personal data protection.
Users are advised to maintain strong credentials and monitor account activity.
Would you like to learn more aboutAI, tech and digital diplomacy? If so, ask our Diplo chatbot!
El Salvador, the first country to adopt bitcoin as legal tender, has restructured its national bitcoin holdings to strengthen security against potential future threats. The National Bitcoin Office (ONBTC) announced that the country’s 6,280 BTC, worth around $687 million, has been split across 14 new addresses, each holding no more than 500 BTC. Officials say this change reduces exposure to risks, including those that could arise from advances in quantum computing.
The concern stems from the possibility that quantum computers, once powerful enough, could break cryptographic protections and reveal private keys. While no such machine exists today, bitcoin developers have long debated the timeline of this threat. ONBTC also highlighted that avoiding address reuse improves security and privacy while allowing the government to maintain transparency.
The broader bitcoin community remains divided on the urgency of quantum risks. Some experts argue the issue is exaggerated, while others warn that the industry may have far less time than previously thought. A developer known as Hunter Beast recently cautioned that breakthroughs in IBM’s quantum experiments suggest the worst-case scenario could arrive within three years.
The bitcoin strategy of El Salvador continues to draw criticism from international institutions. The IMF, which approved a $3.5 billion loan to the country, insists that no new bitcoin purchases have been made this year and that the government is merely reshuffling its reserves. The ONBTC disputes this claim, maintaining that fresh purchases are still taking place despite pressure to scale back its cryptocurrency policies.
Would you like to learn more aboutAI, tech and digital diplomacy? If so, ask our Diplo chatbot!
A whistle-blower has reported that the Department of Government Efficiency (DOGE) allegedly transferred a copy of the US Social Security database to an Amazon Web Services cloud environment.
The action placed personal information for more than 300 million individuals in a system outside traditional federal oversight.
Known as NUMIDENT, the database contains information submitted for Social Security applications, including names, dates of birth, addresses, citizenship, and parental details.
DOGE personnel managed the cloud environment and gained administrative access to perform testing and operational tasks.
Federal officials have highlighted that standard security protocols and authorisations, such as those outlined under the Federal Information Security Management Act (FISMA) and the Privacy Act of 1974, are designed to protect sensitive data.
Internal reviews have been prompted by the transfer, raising questions about compliance with established federal security practices.
While DOGE has not fully clarified the purpose of the cloud deployment, observers note that such initiatives may relate to broader federal efforts to improve data accessibility or inter-agency information sharing.
The case is part of ongoing discussions on balancing operational flexibility with information security in government systems.
Would you like to learn more aboutAI, tech and digital diplomacy? If so, ask our Diplo chatbot!
Cybersecurity experts have warned that AI is being used to target senior citizens in sophisticated financial scams. The Phantom Hacker scam impersonates tech support, bank, and government workers to steal seniors’ life savings.
The first stage involves a fake tech support worker accessing the victim’s computer to check accounts under the pretence of spotting fraud. A fraud department impersonator then tells victims to transfer funds to a ‘safe’ account allegedly at risk from foreign hackers.
A fake government worker then directs the victim to transfer money to an alias account controlled by the scammers. Check Point CIO Pete Nicoletti says AI helps scammers identify targets by analysing social media and online activity.
Experts stress that reporting the theft immediately is crucial. Delays significantly reduce the chance of recovering stolen funds, leaving many victims permanently defrauded.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!
