Lorenzo Franceschi-Bicchierai

~ Personal news ~  I left TechCrunch. I will now focus on finishing my book about Hacking Team and the history of government spyware. After that, and in the meantime as well, I will be freelancing. Contact me: Lorenzofb.writes@gmail.com or Signal @LorenzoFB.1337 (+1 917 257 1382)

wrote about "Black October," the PHP vulnerability, and the AI-fueled dread and panic I'm seeing among almost all of the cybersecurity experts I've ever known. I think people w/ LLMs are brute forcing software the same way they brute forced social media w/ slop www.404media.co/php2shell-bl...

Do I know anyone who is going to Mozilla Festival next week?

NEW @citizenlab.ca report We uncovered an Israeli firm using online ads to run vast spy operation This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads. 45 devices at @aljazeera.com confirmed infected citizenlab.ca/research/how...

Great conversation here of the scoop I wrote last week: www.404media.co/cops-can-byp...

NEW: An iPhone hacking company claims it can freeze the iPhone in a state that makes it easier for cops to access data. The iPhone has an automatic reboot feature that reverts the device to a state where data is harder to extract. This would defeat that feature. www.404media.co/cops-can-byp...

If you're still running iOS, iPadOS, or macOS 26 (which is still the majority of Apple users!) then update today: Apple says hackers may be abusing a bug to target some users' devices. Bypass for ad-block users: web.archive.org/web/20260929...

Apple has released a security update for iPhones and iPads running the older iOS/iPadOS 26 software, fixing a bug that Apple says was "exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27." Meta discovered the flaw/attack.

Spyware maker Paragon is reportedly going public. "Paragon and REDLattice generated combined revenue of $267 million in the 12 months ended June 2026, representing a 29% increase from the same period a year earlier." www.calcalistech.com/ctechnews/ar...

Italian zero-day maker Dataflow Security generated €63 million in revenue in three years, and the company also has strong ties with former Israeli intelligence veterans, according to an investigation by @irpimedia.eu. irpimedia.irpi.eu/en-inside-th...

Last night I paid $40 (plus tip) for a pizza margherita. I am reporting the pizzeria to the Italian authorities. No pizza should cost that much.

New: Florida and Texas are moving to block or end their use of license plate surveillance tech, like Flock, citing privacy concerns and police abuse. The backlash against Flock is both growing and increasingly bipartisan. Bypass for ad-blockers: web.archive.org/web/20260901...

NEW: Could AI make software so secure that it will make it harder for governments to use hacking tools and spyware? To try to answer that question, I spoke to cybersecurity and privacy experts, and people with experience finding and exploiting security flaws that can be then sold to governments.

In this.weekinsecurity.com: Medical device maker Boston Scientific hit by destructive hack; Aussie cops nab TeamPCP hackers; GTA 6 leaks are breaking the web; how journalists used a website bug to trace a prolific scammer; and the DOJ walks back Chinese botnet hack claims; plus, much more.

Imagine going out for a chill night out and this happens. www.vice.com/en/article/i...

NEW: I recapped all the times AI agents went “rogue”—so to speak—and hacked third parties. There have been 17 cases already, with OpenAI and Anthropic leading the race, per a website keeping tally. And those are the ones we know about. I apologize for all the whoopses that appear in this article.

NEW: Alabama launched an investigation into OpenAI's Hugging Face hack, saying “this AI lab leak showed that Alabamians’ and Americans’ worst fears about artificial intelligence are not just theoretical.” techcrunch.com/2026/08/24/a...

You've stumbled into an unknown computer system. Now what? (Source.)

I know spyware is not exactly a mainstream issue. But having the chance to interview Giorgia Meloni, and not ask her about the spy scandal her intelligence agencies are likely responsible for, is such a missed opportunity. www.nytimes.com/2026/08/21/w...

New, by me: Private equity giant Apollo Global says hackers stole personal information, including Social Security numbers, during a July breach. The hack comes after Google researchers warned that an extortion gang targeted financial giants. Ad-block bypass: archive.is/BucaL (Wayback not working)

I just made chickpea pasta with garlic, kale, chipotle mayo, and parmigiano. Not bad. Not bad at all. I recommend it. Hopefully I don't get my Italian passport revoked.

NEW: Someone tried to hack cybersecurity researchers inviting them to a fake cryptocurrency conference. The hacker used a real Google Doc, and a legitimate Google platform that allows developers to customize the user interface of documents, to try to trick targets into downloading malware.

NEW: OpenAI mistakenly revoked several security researchers' access to its limited cybersecurity program “Trusted Access for Cyber.” They now have to reapply and submit a government ID again. The company blamed it on “a technical issue” that affected “a limited set of users.”

Apropos of what I was talking about yesterday.

Since chatbots, LLMs, and the use of AI to craft legal arguments are back in the news again, I thought I'd re-up this piece I wrote for paid subscribers of this.weekinsecurity.com on if, and how, privilege applies during legal cases. It depends!

It's good that Apple sends these threat notifications to spyware victims as it offers *some* transparency to who gets attacked by gov'ts. But it's also not great to see the number of threat notifications at "unprecedented" levels as it shows spyware use continues to prolifierate.

NEW: An "unprecedented" number of people have received Apple's latest notifications alerting them they were targeted with mercenary spyware, according to security researchers. A soldier fighting in Ukraine told us he knows of other soldiers getting them. Lots of posts on social media too.

I reluctantly have to admit that since X toggled with the algorithm recently (don't remember when exactly) my timeline is now again filled with cybersecurity posts. There's much less spam and random posts. I can also confirm that most of the infosec industry is either back there or never left.

We put a tracking device in a shipment of rare books acquired by an anonymous buyer. It ended up at an Amazon facility where the company scans books for training data and destroys them in the process: www.404media.co/we-tracked-a...

Crypto hardware wallet owners face fresh security risks after recent spate of personal data thefts

My hot take about the Strokes, since you’ve asked, is that of all those bands of that era, they’re kinda the only one still worth listening to. Like they’re so much better than all others.

Every Sunday in my newsletter this.weekinsecurity.com, I hand-curate all the most important cyber stories you need to know from the week, and deliver it up with good news and a reader-submitted cyber cat (or friend). No slop, and no email open/link tracking (for your privacy!) Sign up/RSS below. 🐈‍⬛

These kinds of attacks, which are loud, aggressive, and have limited real-world effects, are basically a form of psychological terrorism. It's much more about fear and pressure than it is casualties.

NEW: Here's what we know, and don't know, about the cyberattacks that have hit water plants across at least 12 states in the U.S. in the last couple of weeks. The wave of attacks, allegedly carried out by Iran's government, are more widespread than previous attacks on critical infrastructure.

NEW: U.S. courts will start publishing data on how many times the feds do wiretaps using spyware and hacking tools, starting in 2029. As of now, we knew the FBI and others used spyware, but we had no idea how many times that was happening. Change comes after several requests from Sen. Ron Wyden.

New, by me: Apple told me it's sending out threat notifications to customers in 110 countries saying they've been targeted with spyware. This latest batch also features a new push notification, warning users to take action and what to do next. Bypass for ad-blockers: web.archive.org/web/20260813...

NEW: Flock announced new changes that it claims will help stop cops from abusing its license plate reader cameras, including a now mandatory feature called Audit Assistance. But the company isn’t explaining exactly how the tool works. A spokesperson told us it does not use machine learning or AI.