A politician on the European Parliament’s PEGA Committee—created to investigate spyware abuses, including of the notorious Pegasus malware—was targeted with Pegasus himself, according to new research findings released this week. Meanwhile, top Google security staff warned this week that the pro-competition rule proposals in the EU could make Google Search and Android systems vulnerable to hacking and other abuse.

A WIRED investigation revealed this week that Meta contractors posed as kids and teens to see how chatbots like Gemini and ChatGPT responded to prompts about high-risk subjects, including suicide, sex and drugs.

And a researcher realized that he could use Anthropic’s Claude Opus 4.7 to break into the website of Front Gate and issue tickets to almost any United States music festival, including Lollapalooza and Bonnaroo.

But wait, there’s more! Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

Back in 2021, Apple launched its Hide My Email tool, which as the name suggests, allows people to sign-up for online services using an email address that isn’t linked directly to them. The privacy feature generates “unique, random email addresses” that will forward incoming messages to a user’s personal email address—reducing the amount of information you need to hand over to companies.

Reporting from 404 Media this week revealed that a vulnerability in the system has made it possible, for at least a year, for people’s real email addresses to be uncovered when they are using Apple’s privacy service. “Apple Hide My Email is leaking email addresses that are supposed to be hidden,” security researcher Tyler Murphy, who discovered the flaw in June 2025, told the publication. “In our limited tests with volunteers, 100% of Hide My Email addresses were exploitable,” he said.

The exact details of the vulnerability and how it works have not been revealed as the problem hasn’t been fixed. In tests conducted by 404 Media and Murphy, it was possible for a newly created Hide My Email address, which uses the @icloud.com domain, to be linked back to the real email address of its creator. Murphy said he originally reported the problem to Apple last summer and was told it had been “addressed” by March this year. However, when the researcher continued testing the issue, it remained exploitable, with Apple telling Murphy a couple of months ago that it was still investigating the issue. Apple did not respond to requests for comment from the publication.

A nineteen-year-old has been arrested and extradited to the United States to face charges over their alleged involvement in the notorious Scattered Spider hacking group, the Department of Justice (DoJ) announced this week. Peter Stokes, an Estonian-US dual citizen, was arrested in Finland in April and has been charged with computer intrusion, conspiracy and fraud, linked to the criminal gang.

It is alleged that Stokes, along with other members of the loose hacking collective, hacked into an unnamed “luxury jewelry retailer” and demanded a $8 million cryptocurrency ransom in May 2025. The company did not pay but still spent $2 million on the incident, according to a DoJ press release. In recent years, the Scattered Spider group, which is largely believed to be composed of young, English-speaking teenagers, has caused havoc around the world by hacking into and disrupting dozens of businesses. The arrest of Stokes follows two British Scattered Spider members, Thalha Jubair and Owen Flowers, recently pleading guilty to hacking Transport for London in 2024 and causing millions in damages.

Following a move by encrypted messaging app Signal last year, WhatsApp has announced it will soon roll out usernames to billions of people. The option means it is possible for people to connect and message each other without having to share phone numbers, increasing privacy protections. However, officials in India, one of WhatsApp’s biggest markets, who have previously tried to unfurl encryption protections on the Meta-owned app, have opposed the introduction of usernames. A letter from the Indian government, seen by Reuters, asked WhatsApp to pause the rollout of usernames in the country. The letter claimed the move could increase fraud and cybercrime, citing concerns around allowing online anonymity. The letter was followed by separate messages to Signal and Telegram about their use of usernames.

Thousands of automatic license plate reader cameras, known as ALPRs, have appeared across the United States over the last few years. The cameras, which can be deployed by cops, cities, and businesses, photograph passing cars and record details about their movements. As well as license plate numbers, the systems can log the time and location of the photos, make and model of a vehicle, as well as bumper stickers. Billions of images and details of car movements have been captured in vast ALPR databases.

However, an increasing body of evidence shows that when the camera systems make mistakes, innocent people can be detained by law enforcement officials and accused of crimes. A review of court records and media reports, which are likely the tip of the iceberg, by the nonprofit the Institute for Justice this week found at least 24 cases of misidentification over the last eight years. These reportedly include a couple with a baby in their car being detained at gunpoint; a camera misreading an “O” as a “0”, leading to grandparents being detained; and someone being pulled over after their license plate was not removed from a wanted list. The findings add to a growing list of errors from the AI-enabled cameras.

A leaker with a reasonable track record, except regarding the Apple Watch, claims that the Apple Watch Series 12 will feature a new health sensor, but only in its fluoroelastomer band.

Apple Watch already tracks a huge number of different health metrics, but Apple has regularly been rumored to add even more sensors via a watch band. According to leaker Kosutami, the company is finally going to do it, although with one significant catch.

The leaker says nothing about what the band’s sensor could measure, but says it will solely be in the silicone band. That is presumably the basic fluoroelastomer band that Apple provides if a customer does not also order a specific band.

If correct, this could mean that the Apple Watch’s latest health sensor could only be available on the lowest-cost band. It’s more likely, though, that Apple will sell this version of the fluoroelastomer band separately.

As for what it could measure, Apple has previously been reported to be working on multiple options for external sensors. They include a hydration sensor, or one based around muscle movement sensing.

Apple is known to be working on non-invasive blood sugar monitoring as well. To date, there has been no suggestion that this will be on a band-mounted sensor, and instead integrated into the optical array underneath the watch body. It’s not clear when this feature will ship.

Kosutami has had a fair track record with Apple leaks, and most recently claimed that the company has suspended work on its project to add cameras to AirPods. But they have been significantly wrong before, such as with a 2023 claim that Apple was going to change how bands connect to the Apple Watch.

Separately, that persistent rumor has recently resurfaced. If it’s accurate this time, perhaps it’s because a new sensor band requires a different connector.

Parents who post pictures of their kids online are being told to rethink the habit. The UK’s National Crime Agency and the Internet Watch Foundation have issued new guidance urging families to lock down their social media accounts, warning that publicly shared photos are increasingly being pulled and altered by AI tools to create child sexual abuse material.

The two organizations say most parents have no idea this is happening. Criminals no longer need to contact a child directly to generate such material. They can scrape an ordinary photo and run it through widely available nudify apps.

What the guidance recommends

The NCA and IWF are not telling parents to stop posting images of their kids entirely, according to The Guardian. Their guidance focuses on limiting who can see those photos by making social media accounts private or sharing images within a “close friends” list. Parents are also being asked to check their accounts for old photos that could be misused, including photos posted by relatives or friends.

Tim Wright, a senior manager at the NCA, said the changes only require a few simple actions. Lorna Sinclair, a child sexual abuse education manager at the agency, said many parents don’t take those steps because they don’t realize the problem exists in the first place.

The scale of the problem

The IWF says AI-generated abuse material rose 14 percent last year, with more than 8,000 confirmed images and videos identified in 2025 alone. Cases have included blackmail attempts against teenagers and school websites targeted specifically for photos of students’ faces, echoing findings from an earlier report on how generative AI has scaled abusive content online.

Even the IWF’s own technology chief admits the advice feels uncomfortable to give, since it puts the burden on families rather than the platforms or AI developers. Until stronger safeguards exist, tightening privacy settings may be the only real protection parents have.

Inside a vast exhibition hall in Bologna, one student stepped onto a platform three meters above the floor and gave the aircraft a firm push. The wings extended farther than a city bus is long, yet the structure left the edge cleanly and settled into a steady glide. It traveled 59 meters before its nose met a line of columns at the far end of the space. That single launch secured the Guinness World Record for the largest paper airplane ever built and flown. Engineering students from the University of Pisa created the aircraft, known as ICARUS. It spans 20.04 meters from wingtip to wingtip, measures 7 meters in length, and weighs 28.49 kilograms at completion.

The previous record, held since 2013 by a team from Germany’s Braunschweig Institute of Technology, was a real beast, with 18.21 meters of wingspan and an official flight distance of 18 meters, but this latest plane absolutely exploded the old mark, flying more than triple the distance while meeting all official requirements. You know what was really crazy? The whole thing was made entirely of paper and glue. The students utilized stronger 120-gram stock for the major pieces and lighter 40-gram sheets for the covering, then laminated many layers on top of each other in a smart honeycomb design that provided the necessary stiffness without adding bulk. That meant that the wings retained their shape well even under flying loads, and they managed to keep the overall weight low.

Sale

POWERUP 4.0 The Next-Generation Smartphone Controlled Paper Airplane Kit, RC Controlled. Easy to Fly with…

• PILOTED FLIGHT – Grab a sheet of paper, fold it, and go! Instantly put yourself in the cockpit of an amazing smartphone controlled paper airplane that…
• INCREDIBLE STABILITY – Loops, Barrel Rolls, & Hammerheads are achieved with the special Acro Mode! Your paper plane’s onboard computer automatically…
• CONNECTED FLYING – Pair your plane with the POWERUP App to maneuver your plane, keep a robust flight log, compete with other flyers on the…

Fifteen engineering students built the entire thing from scratch, by hand. They included lengthy spars that run the length of each wing, as well as ribs to maintain the proper airfoil curve and a tail section to keep things stable. They even ran computer simulations of airflow around the shape to help refine the design before cutting out any large pieces, and they built smaller prototypes to test and tweak the balance and control, which began with some simple paper airplanes they folded during class breaks. That began out as a joke, but when the team decided to go for the record, science communicator Jakidale stepped in to help them out, sort of coordinating resources and sharing updates as they built the thing.

One of the most difficult challenges they faced was determining the appropriate humidity. Paper does not like wetness because it expands and compresses, wreaking havoc on surfaces and glued parts. They had to keep a constant check on the working conditions while assembling all of the separate sections, and every millimeter counted because excess weight or being even slightly off would reduce their lift and make it difficult to stay airborne.

Guinness World Records required a launch from a platform no higher than three metres and a minimum flight distance of 15 metres. ICARUS breezed past that with ease, and even had an official judge and an engineer on hand to inspect the wingspan and other dimensions during the We Make Future event at BolognaFiere.
[Source]

Every June, after Apple wraps up its annual WWDC keynote, I install the latest iOS beta on my iPhone, watch the progress bar crawl to completion, and wait for the inevitable restart. For years, picking up my phone afterward felt almost identical to how it did before the update. 

I saw the same grid of icons, the same Control Center, and the same version of Siri until iOS 26 finally broke that pattern in 2025.

iOS 26 raised the bar. iOS 27 didn’t clear it

It was the first major update in years that made compatible iPhones feel genuinely different, and I’d give most of the credit to Apple’s Liquid Glass design language. With the redesigned Control Center and plenty of customization options (including the Clear Look for the Home Screen), iOS 26 actually felt substantial.

iOS 27, on the other hand, didn’t impress me quite as much. Don’t get me wrong. I’m not saying it’s bad. The new Apple Intelligence features, especially the revamped Siri experience (first promised in 2024), along with the new Photos features, are impressive enough that I’ve written entire pieces about them

But if you ask me whether iOS 27 fundamentally changed how I use my iPhone 17 every day, despite the arrival of Apple Intelligence, the honest answer is no. And that’s a little surprising, at least for me. 

To Apple’s credit, the AI features are real, functional, and occasionally delightful. The catch is that their value depends almost entirely on whether they slot naturally into your routine.

The problem isn’t Siri AI; it’s me

Over the last couple of years, I’ve tried pretty much every major AI service to figure out which one works best for me, and most of them have already secured a place in my workflow. I pay Claude a monthly fee because it’s become my go-to for research, fact-checking, and crunching numbers. 

Gemini, on the other hand, is great at generating images and summarizing emails inside Gmail, while AI Mode has all but replaced Google Search for me.

Despite Siri AI’s conversational and agentic capabilities, I still haven’t found a compelling reason to use it every day. 

Yes, I asked the assistant to fetch photos using natural language, and it did a commendable job (for the most part). The Extend feature in Photos also impressed me. But neither is the kind of feature I return to regularly. Most of the AI I use is actually on my MacBook, and not on my iPhone.

So what else is actually new?

But what about the rest of the iOS 27 changelog? Respectfully, it feels like Apple is running out of room to reinvent the core iPhone experience or introduce a new one that doesn’t revolve around AI. 

Safari now auto-groups tabs by topic, while Notes lets you link to specific sections within a document. AirPods finally get a proper EQ slider in iOS 27, and Apple Wallet can scan loyalty cards. 

They’re useful under-the-hood additions that work in the background to improve your experience. The problem is that I’ve already moved on from several of these apps because they fell behind the curve for so long.

The little things are genuinely better

It’s not like there aren’t changes I appreciate. AirDrop, for instance, feels much faster in iOS 27. App launches are noticeably quicker, and switching between mobile data and Wi-Fi is much smoother. Apple’s Continuity features are all intact and arguably better thanks to the under-the-hood refinements (even if they still decide to throw a tantrum every now and then).

However, after willingly putting my iPhone 17 through beta duty and installing iOS 27 with both excitement and nervousness, I came away feeling less rewarded than I’d initially hoped. 

Maybe this is peak iOS

The more mature way to look at this might be that iOS has already reached a near-perfect state, both in terms of how it looks and the features it offers, and once we get there, every new feature or experience risks upending what already works.

I guess I need to re-evaluate my expectations for Apple’s annual updates. iOS 26 only felt so exciting and different because so many earlier versions looked exactly the same. 

While I wouldn’t call iOS 27 only a fresh coat of paint, it also doesn’t feel like the kind of leap it might appear to be, at least not if Siri AI and Apple Intelligence aren’t already central to how you use your iPhone.