Encryption news and engineering summaries

A significant cybersecurity incident targeting Notepad++ has been disclosed, revealing a prolonged hijacking attempt by suspected Chinese state-sponsored hackers. Between June and December 2025, attackers compromised the application's shared hosting infrastructure to intercept and redirect update traffic. This allowed for the distribution of malicious update manifests to selective users by exploiting insufficient update verification controls in older versions of the software. Although the hosting provider implemented remediation steps by December 2, 2025, Notepad++ has since migrated to a more secure hosting environment. To prevent future incidents, the WinGup updater was enhanced in v8.8.9 to verify digital certificates and signatures. Furthermore, the upcoming v8.9.2 release will enforce XMLDSig verification for update manifests, ensuring the integrity of the update process through multiple layers of authentication and cryptographic validation.

Chatto, a lightweight and privacy-focused group chat application, is now officially open source. Designed for easy self-hosting on Linux, macOS, and Windows, it features end-to-end encrypted messaging, voice, and video calls. The project includes a forthcoming managed hosting service, Chatto Cloud, while ensuring full data portability and compatibility between self-hosted and managed instances.

Microsoft reportedly provided the FBI with BitLocker recovery keys for three laptops during a federal fraud investigation in Guam. Although BitLocker is designed for full-disk encryption, its default settings upload recovery keys to Microsoft's cloud infrastructure. This configuration allows the company to comply with law enforcement warrants, essentially bypassing the privacy protections expected from encryption. Cryptography experts like Matthew Green have criticized this practice, noting that it creates significant security risks if Microsoft's cloud is compromised by hackers. While law enforcement still requires physical access to devices, the centralized storage of these keys makes Microsoft an outlier in the tech industry regarding user privacy and modern data security standards.

Security researchers xyzeva and Dziurwa developed an open-source bypass for Discord's k-id age verification system. By reverse-engineering the AES-GCM encryption and replicating face-prediction metadata, the script tricks the FaceAssure API into verifying users as adults globally without requiring a real face scan, exploiting a lack of server-side validation for encrypted biometric data.

The task focuses on identifying and sanitizing hardcoded credentials, such as AWS access keys, GitHub tokens, and Hugging Face tokens, found within a git repository, including those embedded in tokenized dataset JSON files and YAML configuration files. These sensitive strings are replaced with consistent descriptive placeholders to ensure security without breaking repository utility.

Passkeys resist phishing and server breaches, making them strong for enterprise use, but remain immature for personal security. Device loss, account bans, weak recovery, hardware-key limits, platform lock-in, poor portability, and unreliable cross-device flows can cause lockout. Until interoperability and recovery improve, the author favors generated passwords in a third-party password manager plus an independent TOTP app.

BirdyChat has achieved a significant milestone by becoming the first European chat app to enable interoperability with WhatsApp, leveraging the mandates of the Digital Markets Act (DMA). This integration allows users in the European Economic Area (EEA) to send messages, photos, and files to WhatsApp users directly from BirdyChat using only a phone number. The feature preserves end-to-end encryption while simplifying work communication by allowing professionals to use their work email as an identity instead of a personal phone number. This development aims to bridge the gap between platform ecosystems, allowing for the organization of work conversations in BirdyChat without forcing external contacts to switch applications. Group chat support is planned for future updates as the rollout continues across the EEA.

Researcher Nightmare-Eclipse identified YellowKey, a vulnerability enabling full-volume BitLocker bypass via Windows Recovery Environment. The exploit allegedly suggests an intentional backdoor, affecting Windows 11 and Server editions. Security experts recommend diversifying encryption strategies and considering alternatives like VeraCrypt while awaiting official Microsoft patches.

A hacker collective reverse-engineered a Flock camera, recovering an encryption key and data from 21 days of operation. Analysis found 1.6 million images of about 50,000 vehicles, explicit people detection, frequent storage failures, and software that sends imagery to Flock servers for identification. The breach exposes surveillance capabilities, security weaknesses, and privacy concerns.

Microsoft has confirmed that it will provide the FBI with BitLocker data encryption keys upon receiving valid legal orders. This policy is primarily facilitated by the Windows 11 requirement for a Microsoft Account, which automatically backs up encryption keys to the cloud by default. While this feature is designed for user convenience in data recovery scenarios, it creates significant privacy concerns as the keys are stored in an accessible state rather than using zero-knowledge encryption. Unlike competitors like Apple or Meta, Microsoft’s current architectural choice allows the company to comply with law enforcement requests to decrypt user devices, highlighting a critical trade-off between accessibility and security.

In January 2026, GreyNoise analysts observed a sudden and dramatic 65% drop in global Telnet traffic within a single hour, which eventually settled at an 83% reduction from the baseline. This structural shift preceded the public disclosure of CVE-2026-24061, a critical authentication bypass vulnerability in GNU Inetutils telnetd that allows unauthenticated root access via a simple argument injection. The data suggests that major Tier 1 transit providers likely implemented port 23 filtering on backbone infrastructure in anticipation of the vulnerability's disclosure. This proactive infrastructure-level response significantly impacted residential and enterprise ISPs while leaving major cloud providers with direct peering largely unaffected. The incident highlights a potential shift in how global network operators coordinate to mitigate high-impact security risks at the routing level before they can be exploited at scale.

A recent FBI court filing has highlighted the effectiveness of Apple's Lockdown Mode, a security feature that successfully prevented federal investigators from extracting data from a Washington Post reporter's iPhone. During an investigation into classified leaks, the FBI's Computer Analysis Response Team (CART) found that the iPhone 13 belonging to Hannah Natanson was inaccessible due to this hardened security state. While the FBI was able to access her Macbook Pro using Touch ID, the iPhone remained protected. Lockdown Mode is designed to mitigate sophisticated spyware by limiting message attachments, web functionality, and physical accessory connections. This case demonstrates that the feature is also a formidable barrier against physical forensic tools like Graykey and Cellebrite, which require an unlocked connection to exploit system vulnerabilities. The incident underscores the ongoing technical struggle between consumer electronics companies and law enforcement agencies seeking digital access.

The Wallet Unit ensures secure authentication by binding hardware-backed keys to identification. To mitigate risks from vulnerabilities in mobile device operating systems and keystores, a Mobile Device Vulnerability Management (MDVM) system is proposed. It utilizes platform-specific signals, such as KeyAttestation and PlayIntegrity, along with RASP tools to continuously monitor device integrity and prevent the use of compromised environments.

An analysis of id Software’s 1996 Quake shareware CD-ROM experiment explains its phone-based DRM, which unlocked Quake and other id games through rotating challenges and serials. GNOMON reverse-engineered the local challenge-to-serial algorithm within 39 days, revealing no server-side secret. The flawed protection and chaotic fulfillment left id with nearly 150,000 unsold CDs, illustrating security by obscurity and rushed software engineering.

Google introduced HEIR, an open-source compiler and toolchain that enables AI models to perform inference on homomorphically encrypted data. It aims to make private AI practical without exposing user information or proprietary models. Demonstrations include recommendations, fraud detection, network-threat detection, and hotword recognition, while partnerships and academic research target better performance and broader adoption.

Apple introduces Apple Reference Image, an opt-in iPhone 18 Pro feature for verifiable photography. It cryptographically secures sensor-captured pixels and metadata, timestamps them, develops images in privacy-preserving Private Cloud Compute, and applies post-quantum signatures. The system supports public verification, compromise resilience, revocation, and photographer anonymity, addressing synthetic-image misinformation without exposing image data or identity.

Researchers identified 287 Chrome extensions spying on approximately 37.4 million users. Using an automated Docker-based scanning pipeline, they found extensions from actors like Similarweb and Big Star Labs exfiltrating browsing history via obfuscated and encrypted requests. This widespread data harvesting poses significant risks for corporate espionage and credential harvesting.

Moltbook, a viral social network for AI agents built on the OpenClaw framework, has quickly transitioned from a curious experiment to a significant security threat. With over 770,000 agents active, the platform recently suffered a massive database breach allowing unauthorized hijacked control over agent identities and shell access to host machines. Researchers have identified critical vulnerabilities including unauthenticated shell command execution, improper input sanitization, and over-privileged system access. Many instances are currently exposed via Shodan, leading to the exfiltration of sensitive API keys and session tokens. The incident highlights the dangers of prompt injection at scale and the inherent risks of autonomous agents running without robust sandboxing or encryption in personal and enterprise environments.

Mullvad will shut down its public encrypted DNS servers on November 2, 2026, because Mullvad VPN already provides encrypted traffic and internal DNS. It will financially support Quad9 instead. Mullvad Browser defaults will migrate automatically, while custom settings remain unchanged. Manually configured DoH, iOS, and macOS profiles must be replaced with Quad9 configurations.

Android 17 requires Certificate Transparency for system-trusted certificates in apps targeting API 37, breaking many custom CA, MitM, debugging, and research workflows. HTTP Toolkit’s workaround derives private CT log providers, embeds signed SCTs in generated certificates, and injects temporary Android configuration, preserving local traffic interception without publicly exposing browsing activity.