Apple has released its first Background Security Improvements update to fix a WebKit flaw tracked as CVE-2026-20643 on iPhones, iPads, and Macs without requiring a full operating system upgrade.

The CVE-2026-20643 flaw allows malicious web content to bypass the browser’s Same Origin Policy.

Apple says the flaw is a cross-origin issue in the Navigation API that was addressed with improved input validation.

The vulnerability was discovered by security researcher Thomas Espach, with the new update available on iOS 26.3.1, iPadOS 26.3.1, macOS 26.3.1, and macOS 26.3.2.

This release is the first time Apple has pushed a security fix through its new Background Security Improvements feature, which is used to deliver small out-of-band patches outside the normal security update cycle.

“Background Security Improvements deliver lightweight security releases for components such as the Safari browser, WebKit framework stack, and other system libraries that benefit from smaller, ongoing security patches between software updates,” explains Apple.

“In rare instances of compatibility issues, Background Security Improvements may be temporarily removed and then enhanced in a subsequent software update.”

In the past, Apple security updates required users to install a new OS version and restart their device. However, with Background Security Improvements, Apple can now deliver small updates that are applied to specific components in the background.

Apple added the feature in iOS 26.1, iPadOS 26.1, and macOS 26.1, stating it was to be used to quickly patch security flaws between releases.

Users can access the feature through their device settings under the Privacy & Security menu.

• On iPhone and iPad: Go to Settings, then tap Privacy & Security.
• On Mac: From the Apple menu, choose System Settings. Then click Privacy & Security.

Apple warns that uninstalling a Background Security Improvements update removes all previously applied background patches, reverting the device to the baseline OS version (such as iOS 26.3.1) without any of the incremental security fixes.

This effectively removes the rapid-response security protections delivered through this feature, leaving devices at the baseline security level until the updates are reapplied or included in a future full update.

Therefore, unless a baseline security improvement causes an issue on your device, it is strongly recommended that they not be uninstalled.

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Advertisement

Download The Report

from the full-circle dept

It’s been a long and winding road to mostly get us right back to where we started in the battle between pop star Katy Perry and Aussie clothing designer Katie Perry. If you’re not familiar with this saga, here is a brief summary. Note that I will be mostly using only Katy and Katie when naming the players here to avoid confusion.

Katie Taylor is the real name of the Aussie designer, but she began selling clothing under the name “Katie Perry” in 2008 and secured a trademark for the name in Australia for clothing. While Katy’s team initially sent a C&D to Katie’s business around that same time, it appears nothing came of that C&D, even as the singer went on a worldwide tour that included Australia in 2014. That’s when Katie sued Katy, arguing that clothing merch sold on her local tour constituted trademark infringement, as the public might be confused between the two entities and who was producing what and for whom. She won her initial lawsuit, but Katy appealed and won, with the court not only clearing her of trademark infringement but also canceling Katie’s trademark entirely. Rather than leaving well enough alone, Katie appealed that ruling to Australia’s High Court.

And that brings us to an unlikely present, in which the High Court partially agreed with Katie’s appeal, reinstating her trademark, but not ruling that Katy Perry infringed upon it. I’m going to stay away from the first part of CNN’s post on the matter, because it does a horrible job of framing all of this, mostly in that in paints Katie Perry as some kind of underdog victim in all of this when she very much is not. But as for the ruling itself:

But on Wednesday, Australia’s High Court overturned the ruling, arguing the cancellation of the trademark was not warranted, and the use of the “Katie Perry” trademark was not likely to deceive or cause confusion.

Taylor said the court battle was a long and difficult process, but she did it to show that trademarks are there to protect small businesses, not just large brands.

Advertisement

“So many people said to me, like, why don’t you just give up? It’s not worth it. I really believe in standing up for your values. Truth and justice are part of my core and my values.”

And this is where I’m once again frustrated with CNN’s posture in its reporting. Katie sued Katy. That’s how this whole episode really started. Katie talking about how she is glad this all isn’t hanging over her head when she started the lawsuit that led to all of this is insane. This was a self-inflicted wound of epic proportions on a timeline equally crazy.

But the key part to me is that the logic behind ruling that Katie can have her trademark back is that Katie’s and Katy’s trademarks can coexist without any real concern for deception or confusion. That same logic is what I stated at the start of this whole ordeal as the reason this trademark lawsuit battle never should have been started in the first place.

Started by Katie Perry, I’ll remind you. And so we’ve come full circle, with both groups having their trademarks but without any actual infringement having occurred. It’s been a wild, stupid trip, but I guess we got where we were going: right back to where we started.

Filed Under: australia, katie perry, katy perry, trademark

Subnautica 2 has weathered the storm and has rescheduled its early access release. IGN reported today that the sequel to the underwater survival game will begin early access on PC and Xbox in May, although a more specific date was not provided.

The news comes a day after a judge ruled that former Unknown Worlds Entertainment CEO Ted Gill should be rehired at the game studio. That decision capped off a dramatic year for the team behind Subnautica, which was acquired by Krafton in 2021. The studio and its new owners entered a legal battle because the purchase of Unknown Worlds included a promise of an up to $250 million payout from Krafton if the team met certain performance goals by the end of 2025. In July of that year, however, Krafton fired several studio leaders and then delayed the sequel’s early access launch. The court case has raised questions about which side was trying to either secure or avoid making that multi-million payment.

With yesterday’s ruling, a rep from Krafton said that “we are evaluating our options as we determine our path forward.” It’s unclear if that path, or the other litigation still underway over the project, will create further delays to the planned early access date.

Two NASA astronauts aboard the International Space Station (ISS) are about to climb into their spacesuits and enter the vacuum of space, and you can watch the event live.

The first NASA spacewalk in nearly a year will begin at about 8 a.m. ET on Wednesday, March 18. Read on for full details on how to watch.

Americans Jessica Meir and Chris Williams will exit the station’s Quest airlock to carry out work as part of preparations for a future roll-out solar array aimed at upgrading the station’s power supply.

It will be Meir’s fourth spacewalk and Williams’ first. The pair have spent the last few days prepping their spacesuits and equipment and also finalizing the configuration of tools they’ll use during the extravehicular activity.

Wednesday’s spacewalk also happens to be on the 61st anniversary of the first-ever spacewalk in 1965 when Soviet cosmonaut Alexei Leonov left his spacecraft for around 10 minutes during the Voskhod 2 mission. Later the same year, during the Gemini 4 mission, Ed White became the first NASA astronaut to achieve the same feat.

How to watch

NASA’s live coverage will start at 6:30 a.m. ET on Wednesday, March 18. The astronauts will exit the Quest airlock at about 8 a.m. ET. and will remain outside the ISS for around six-and-a-half hours.

You can watch the coverage via the video player embedded at the top of this page. NASA+, Amazon Prime, and the agency’s YouTube channel will also carry the same live feed.

What to expect

You’ll see live views from multiple cameras positioned outside the station, including from the astronauts’ helmet cams. You’ll be able to listen in on the live communications between the astronauts and Mission Control on Earth, too. A continuous commentary will also explain exactly what’s happening as the spacewalk proceeds.

ChatGPT has a talent for sounding sure of itself. Ask it a question, and it delivers a polished, coherent response. But should you always trust it?

The tone promises authoritative answers, and the confidence is enticing, but it can also mask the fact that the answer is only one possible interpretation of the problem.

Modern online scams operate across multiple platforms, perhaps spanning social media, messaging apps, email and online marketplaces. Google, Meta and Amazon are among 11 tech, retail and payments companies that have signed a new agreement to combat online scams by sharing threat intelligence across platforms, Axios first reported Monday.

The initiative, called the Industry Accord Against Online Scams & Fraud, is designed to improve how companies detect and respond to fraud that spans multiple services. Participants say they will exchange signals, such as scam-linked accounts and fraudulent domains, and coordinate enforcement actions.

By sharing intelligence in near real time, companies hope to identify these scams earlier and stop them before they spread.

The effort reflects how modern scams operate. A victim might encounter a fake celebrity investment ad on social media, move to a messaging app where the scammer builds trust, then faces prompts to send money through a fraudulent website, payment app or crypto wallet — spanning multiple companies’ ecosystems.

Google said it now blocks hundreds of millions of scam-related results every day using AI, underscoring how both attackers and defenders are increasingly relying on the same technology. Meta removed more than 159 million scam ads in 2025 and is expanding AI tools to detect impersonation and warn users.

Online scams are growing rapidly, in part because generative AI has lowered the barrier to entry. AI can be used not only to produce realistic phishing emails but also to clone voices and deepfake videos that impersonate executives, public figures and even family members.

The agreement is voluntary and doesn’t create new legal obligations, but it comes after regulators’ increased pressure on tech platforms to address fraud more aggressively. The companies say they will begin building frameworks for reporting and intelligence-sharing, though it’s not yet clear how quickly those systems will be deployed or how effective they will be in practice.

from the seems-bad dept

This story was originally published by ProPublica. Republished under a CC BY-NC-ND 3.0 license.

The Trump administration is loosening restrictions on the sharing of law enforcement information with the CIA and other intelligence agencies, officials said, overriding controls that have been in place for decades to protect the privacy of U.S. citizens.

Government officials said the changes could give the intelligence agencies access to a database containing hundreds of millions of documents — from FBI case files and banking records to criminal investigations of labor unions — that touch on the activities of law-abiding Americans.

Administration officials said they are providing the intelligence agencies with more information from investigations by the FBI, Drug Enforcement Administration and other agencies to combat drug gangs and other transnational criminal groups that the administration has classified as terrorists.

But they have taken these steps with almost no public acknowledgement or notification to Congress. Inside the government, officials said, the process has been marked by a similar lack of transparency, with scant high-level discussion and little debate among government lawyers.

“None of this has been thought through very carefully — which is shocking,” one intelligence official said of the moves to expand information sharing. “There are a lot of privacy concerns out there, and nobody really wants to deal with them.”

A spokesperson for the Office of the Director of National Intelligence, Olivia Coleman, declined to answer specific questions about the expanded information sharing or the legal basis for it.

Instead, she cited some recent public statements by senior administration officials, including one in which the national intelligence director, Tulsi Gabbard, emphasized the importance of “making sure that we have seamless two-way push communications with our law enforcement partners to facilitate that bi-directional sharing of information.”

In the aftermath of the Watergate scandal, revelations that Presidents Lyndon Johnson and Richard Nixon had used the CIA to spy on American anti-war and civil rights activists outraged Americans who feared the specter of a secret police. The congressional reforms that followed reinforced the long-standing ban on intelligence agencies gathering information about the domestic activities of U.S. citizens.

Compared with the FBI and other federal law enforcement organizations, the intelligence agencies operate with far greater secrecy and less scrutiny from Congress and the courts. They are generally allowed to collect information on Americans only as part of foreign intelligence investigations. Exemptions must be approved by the U.S. attorney general and the director of national intelligence. The National Security Agency, for example, can intercept communications between people inside the United States and terror suspects abroad without the probable cause or judicial warrants that are generally required of law enforcement agencies.

Since the terror attacks of Sept. 11, 2001, the expansion of that surveillance authority in the fight against Islamist terrorism has been the subject of often intense debates among the three branches of government. 

Word of the Trump administration’s efforts to expand the sharing of law enforcement information with the intelligence agencies was met with alarm by advocates for civil liberties protections.

“The Intelligence Community operates with broad authorities, constant secrecy and little-to-no judicial oversight because it is meant to focus on foreign threats,” Sen. Ron Wyden of Oregon, a senior Democrat on the Senate Select Committee on Intelligence, said in a statement to ProPublica.

Giving the intelligence agencies wider access to information on the activities of U.S. citizens not suspected of any crime “puts Americans’ freedoms at risk,” the senator added. “The potential for abuse of that information is staggering.”

Most of the current and former officials interviewed for this story would speak only on condition of anonymity because of the secrecy of the matter and because they feared retaliation for criticizing the administration’s approach.

Virtually all those officials said they supported the goal of sharing law enforcement information more effectively, so long as sensitive investigations and citizens’ privacy were protected. But after years in which Republican and Democratic administrations weighed those considerations deliberately — and made little headway with proposed reforms — officials said the Trump administration has pushed ahead with little regard for those concerns.

“There will always be those who simply want to turn on a spigot and comingle all available information, but you can’t just flip a switch — at least not if you want the government to uphold the rule of law,” said Russell Travers, a former acting director of the National Counterterrorism Center who served in senior intelligence roles under both Republican and Democratic administrations.

The 9/11 attacks — which exposed the CIA’s failure to share intelligence with the FBI even as Al Qaida moved its operatives into the United States — led to a series of reforms intended to transform how the government managed terrorism information.

A centerpiece of that effort was the establishment of the NCTC, as the counterterrorism center is known, to collect and analyze intelligence on foreign terrorist groups. The statutes that established the NCTC explicitly prohibit it from collecting information on domestic terror threats.

National security officials have spent much less time trying to remedy what they have acknowledged are serious deficiencies in the government’s management of intelligence on organized crime groups.

In 2011, President Barack Obama noted those problems in issuing a new national strategy to “build, balance and integrate the tools of American power to combat transnational organized crime.” Although the Obama plan stressed the need for improved information-sharing, it led to only minimal changes.

President Donald Trump has seized on the issue with greater urgency. He has also declared his intention to improve information-sharing across the government, signing an executive order to eliminate “information silos” of unclassified information.

More consequentially, he went on to brand more than a dozen Latin American drug mafias and criminal gangs as terrorist organizations.

The administration has used those designations to justify more extreme measures against the criminal groups. Since last year, it has killed at least 148 suspected drug smugglers with missile strikes in the Caribbean and the eastern Pacific, steps that many legal experts have denounced as violations of international law.

Some administration officials have argued that the terror designations entitle intelligence agencies to access all law enforcement case files related to the Sinaloa Cartel, the Jalisco New Generation Cartel and other gangs designated by the State Department as foreign terrorist organizations.

The first criterion for those designations is that a group must “be a foreign organization.” Yet unlike Islamist terror groups such as al-Qaida or al-Shabab, Latin drug mafias and criminal gangs like MS-13 have a large and complex presence inside the United States. Their members are much more likely to be U.S. citizens and to live and operate here.

On Sept. 22, the Trump administration also designated the loosely organized antifascist political movement antifa as a terrorist group, despite the lack of any federal law authorizing it to do so. Weeks later, the administration named four European militant groups said to be aligned with antifa to the government’s list of foreign terrorist organizations.

Those steps were seen by some intelligence experts as potentially opening the door for the CIA and other agencies to monitor Americans who support antifa in violation of their free speech rights. The approach also echoed justifications that both Johnson and Nixon used for domestic spying by the CIA: that such investigations were needed to determine whether government critics were being supported by foreign governments.

The wider sharing of law enforcement case files is also being driven by the administration’s abrupt decision to disband the Justice Department office that for decades coordinated the work of different agencies on major drug trafficking and organized crime cases. That office, the Organized Crime Drug Enforcement Task Force, was abruptly shut down on Sept. 30 as the Trump administration was setting up a new network of Homeland Security Task Forces designed by the White House homeland security adviser, Stephen Miller.

The new task forces, which were first described in detail by ProPublica last year, are designed to refocus federal law enforcement agencies on what Miller and other officials have portrayed as an alarming nexus of immigration and transnational crime. The reorganization also gives the White House and the Department of Homeland Security new authority to oversee transnational crime investigations, subordinating the DEA and federal prosecutors, who were central to the previous system.

That reorganization has set off a struggle over the control of OCDETF’s crown jewel, a database of some 770 million records that is the only central, searchable repository of drug trafficking and organized crime case files in the federal government.

Until now, the records of that database, which is called Compass, have only been accessible to investigators under elaborate rules agreed to by the more than 20 agencies that shared their information. The system was widely viewed as cumbersome, but officials said it also encouraged cooperation among the agencies while protecting sensitive case files and U.S. citizens’ privacy.

Although the Homeland Security Task Forces took possession of the Compass system when their leadership moved into OCDETF’s headquarters in suburban Virginia, the administration is still deciding how it will operate that database, officials said.

However, officials said, intelligence agencies and the Defense Department have already taken a series of technical steps to connect their networks to Compass so they can access its information if they are permitted to do so.

The White House press office did not respond to questions about how the government will manage the Compass database and whether it will remain under the control of the Homeland Security Task Forces.

The National Counterterrorism Center, under its new director, Joe Kent, has been notably forceful in seeking to manage the Compass system, several officials said. Kent, a former Army Special Forces and CIA paramilitary officer who twice ran unsuccessfully for Congress in Washington state, was previously a top aide to the national intelligence director, Tulsi Gabbard.

The FBI, DEA and other law enforcement agencies have strongly opposed the NCTC effort, the officials said. In internal discussions, they added, the law enforcement agencies have argued that it makes no sense for an intelligence agency to manage sensitive information that comes almost entirely from law enforcement.

“The NCTC has taken a very aggressive stance,” one official said. “They think the agencies should be sharing everything with them, and it should be up to them to decide what is relevant and what U.S. citizen information they shouldn’t keep.”

The FBI declined to comment in response to questions from ProPublica. A DEA spokesperson also would not discuss the agency’s actions or views on the wider sharing of its information with the intelligence community. But in a statement the spokesman added, “DEA is committed to working with our IC and law enforcement partners to ensure reliable information-sharing and strong coordination to most effectively target the designated cartels.”

Even with the Trump administration’s expanded definition of what might constitute terrorist activity, the information on terror groups accounts for only a small fraction of the records in the Compass system, current and former officials said.

The records include State Department visa records, some files of U.S. Postal Service inspectors, years of suspicious transaction reports from the Treasury Department and call records from the Bureau of Prisons.

Investigative files of the FBI, DEA and other law enforcement agencies often include information about witnesses, associates of suspects and others who have never committed any crimes, officials said.

“You have witness information, target information, bank account information,” the former OCDETF director, Thomas Padden, said in an interview. “I can’t think of a dataset that would not be a concern if it were shared without some controls. You need checks and balances, and it’s not clear to me that those are in place.”

Officials familiar with the interagency discussions said NCTC and other intelligence officials have insisted they are interested only in terror-related information and that they have electronic systems that can appropriately filter out information on U.S. persons.

But FBI and other law enforcement agencies have challenged those arguments, officials said, contending that the NCTC proposal would almost inevitably breach privacy laws and imperil sensitive case information without necessarily strengthening the fight against transnational criminals.

Already, NCTC officials have been pressing the FBI and DEA to share all the information they have on the criminal groups that have been designated as terrorist organizations, officials said.

The DEA, which had previously earned a reputation for jealously guarding its case files, authorized the transfer of at least some of those files, officials said, adding to pressure on the FBI to do the same.

Administration lawyers have argued that such information sharing is authorized by the Intelligence Reform and Terrorism Prevention Act of 2004, the law that reorganized intelligence activities after 9/11. Officials have also cited the 2001 Patriot Act, which gives law enforcement agencies power to obtain financial, communications and other information on a subject they certify as having ties to terrorism.

The central role of the NCTC in collecting and analyzing terrorism information specifically excludes “intelligence pertaining exclusively to domestic terrorists and domestic counterterrorism.” But that has not stopped Kent or his boss, intelligence director Gabbard, from stepping over red lines that their predecessors carefully avoided.

In October, Kent drew sharp criticism from the FBI after he examined files from the bureau’s ongoing investigation of the assassination of Charlie Kirk, the right-wing activist. That episode was first reported by The New York Times.

Last month, Gabbard appeared to lead a raid at which the FBI seized truckloads of 2020 presidential voting records from an election center in Fulton County, Georgia. Officials later said she was sent by Trump but did not oversee the operation.

In years past, officials said, the possibility of crossing long-settled legal boundaries on citizens’ privacy would have precipitated a flurry of high-level meetings, legal opinions and policy memos. But almost none of that internal discussion has taken place, they said.

“We had lengthy interagency meetings that involved lawyers, civil liberties, privacy and operational security types to ensure that we were being good stewards of information and not trampling all over U.S. persons’ privacy rights,” said Travers, the former NCTC director.

When administration officials abruptly moved to close down OCDETF and supplant it with the Homeland Security Task Forces network, they seemed to have little grasp of the complexities of such a transition, several people involved in the process said.

The agencies that contributed records to OCDETF were ordered to sign over their information to the task forces, but they did so without knowing if the system’s new custodians would observe the conditions under which the files were shared.

Nor were they encouraged to ask, officials said.

While both the FBI and DEA have objected to a change in the protocols, officials said smaller agencies that contributed some of their records to the OCDETF system have been “reluctant to push back too hard,” as one of them put it.

The NCTC, which faced budget cuts during the Biden administration, has been among those most eager to service the new Homeland Security Task Forces. To that end, it set up a new fusion center to promote “two-way intelligence sharing of actionable information between the intelligence community and law enforcement,” as Gabbard described it.

The expanded sharing of law enforcement and intelligence information on trafficking groups is also a key goal of the Pentagon’s new Tucson, Arizona-based Joint Interagency Task Force-Counter Cartel. In announcing the task force’s creation last month, the U.S. Northern Command said it would work with the Homeland Security Task Forces “to ensure we are sharing all intelligence between our Department of War, law enforcement and Intelligence Community partners.”

In the last months of the Biden administration, a somewhat similar proposal was put forward by the then-DEA administrator, Anne Milgram. That plan involved setting up a pair of centers where DEA, CIA and other agencies would pool information on major Mexican drug trafficking groups.

At the time, one particularly strong objection came from the Defense Department’s counternarcotics and stabilization office, officials said. The sharing of such law enforcement information with the intelligence community, an official there noted, could violate laws prohibiting the CIA from gathering intelligence on Americans inside the United States.

The Pentagon, he warned, would want no part of such a plan.

Filed Under: 4th amendment, cia, criminal records, domestic surveillance, fbi, intelligence community, law enforcement, odni, ron wyden, tulsi gabbard