We’ve looked at information-security cases and technologies through the lens of famous movies, popular book series, and even fairy tales more than once before. Next up it’s the turn of Christopher Nolan’s adaptation of The Odyssey (based on the ancient Greek epic poem), which, incidentally, inspired the works of Tolkien, various movies and series in the Star Wars franchise, and much more.

Homer’s Odyssey doesn’t just describe classic plots and archetypes. It also covers key technologies and principles of digital hygiene — albeit in veiled form. The hero’s journey was a risky business — and so, for that matter, is watching The Odyssey itself, but we’ll get to that at the end of this post. For now, let’s see how to safely sail the vast internet Hellenic seas in search of Ithaca.

Administrator Penelope and 108 attackers

Nolan has reshaped the poem’s structure quite a bit, but the film still opens on the island of Ithaca. There, Penelope and Telemachus, the wife and son of Odysseus, king of Ithaca, wait for him to return from the Trojan War. Meanwhile, a mob of 108 suitors is running riot in Odysseus’ house. They’re all courting Penelope and dreaming of the throne, and the whole kingdom is on the brink of collapse.

In essence, this is an attack on digital infrastructure by a group of malicious actors. Penelope, an advanced user with admin rights, does everything she can to block attempts to hack the root account take Odysseus’ place. Her trick: she’s promised to choose a husband only after she finishes weaving a burial shroud for Odysseus’ father, Laertes. By day, she weaves in front of everyone. By night, she unravels everything she’s done: clearly a daily factory reset.

Nolan gives Penelope even more authority than Homer did. This helps highlight the coming-of-age story of Telemachus, who starts out as a beginner user. His storyline is about searching for his father and recognizing him: the ancient Greek version of multi-factor authentication. Following the tradition set by James Joyce, Nolan focuses on the tragedy of Telemachus, who can’t remember Odysseus, since his father last connected to the server left Ithaca so long ago.

Root account Odysseus, Trojan Horse, and Ram VPN

Meanwhile, Odysseus is on the island of the nymph Calypso. She feeds him lotus flowers that make him gradually lose his memory — clearly the classic playbook of ransomware. But in seven years, Calypso never manages to fully encrypt wipe his memory. Odysseus longs for home, and the hapless ransomware operator ends up helping him partly recover the encrypted data remember his story. Odysseus remembers how, after ten years of war outside the walls of Troy, he came up with a cunning scheme that became the basis for all Trojan horses ever since…

The Greeks left a malicious file huge wooden horse on the shore and sailed away. A spy who stayed behind convinced the Trojans that it was a very useful thing an offering to Athena, and they dragged the horse into the city. At night, once the people of Troy had gone into sleep mode, the malicious modules soldiers led by Odysseus hidden inside the horse added themselves to Defender’s exclusions opened the gates. The Greeks returned and captured Troy, then stole data and cryptocurrency burned and looted the city. Only after that did they finally head home.

But the road to Ithaca was long and dangerous. After landing on an unfamiliar island, Odysseus got overconfident. Instead of leaving the suspicious site stocking up and sailing away, he went off to explore the infrastructure, and ended up trapped with his men in the cave of a giant Cyclops, known online as Polyphemus. The Greeks managed to blind the Cyclops, though not without losses, and Odysseus figured out how to get out of the cave: by hiding under the bellies of the rams. The blinded Cyclops felt the rams’ wool but never noticed the Greeks — a textbook example of how a VPN works.

But once he’s out of the cave, Odysseus gets cocky and fires an arrow at Polyphemus. That gives away his real IP address location, and his crew has to flee in a hurry from the furious Cyclops. In the end, the ships are knocked off course and get lost at sea.

Interestingly, unlike in the film, Homer’s poem has a group of OLYMP experts constantly steering the course of events. For example, Odysseus’ ships lost their way because of the interference of Poseidon, OLYMP’s chief expert in maritime technology. As we know from the poem, Odysseus first logged in to Polyphemus’ place as “Nub_Oddy”, but later, in a fit of arrogance, changed his username to “Odysseus_Son_of_Laertes_King_of_Ithaca”. With Odysseus deanonymized, the Cyclops used the Pray messaging app to send Poseidon a voice request to launch targeted attacks on Odysseus’ crew. In Nolan’s version, though, Poseidon doesn’t appear as a character. Instead, he becomes a metaphor for an APT a destructive force of nature.

Expert Circe, APT group Sirena, Scylla, and Charybdis malware

Odysseus’ ships drift across the vast Web seas, and every so often they land on unsafe sites shores. First comes the bay of Lamos, where the giant Laestrygonians launch a DDoS attack, hurling requests rocks at the Greeks and wiping out nearly all of Odysseus’ infrastructure crew. Only he and a small group survive.

Next, the heroes land on the island of a lone cybersecurity professional known as Circe, who puts them through harsh cybersecurity training. She lures Odysseus’ warriors to dinner with a social engineering scheme known as pig butchering and turns them into… yes, you guessed it, pigs. But the protagonist doesn’t fall for her tricks, so Circe agrees to help him and gives his crew their human form back. She also advises Odysseus to run an analysis in an isolated environment descend into Hades’ underworld and find the blind Tiresias, whom the OLYMP experts promoted to threat intelligence analyst gifted with foresight.

Tiresias tells Odysseus that he is the only one with enough cybersecurity knowledge strength to reach Ithaca. But Odysseus is determined to save his crew. He learns that they’ll have to face a very dangerous APT group, the Sirens. They use advanced social engineering (singing) to lure sailors to their doom. So Odysseus orders his men to put in solid protection against voice spam: wax earplugs. The film never lets us hear what the Sirens actually sing. They may well be posing as bank employees, law enforcement, or government officials, but the anti-spam trick keeps the crew safe.

Then far more destructive malware hits the ship: Scylla and Charybdis. From Tiresias’ beginner course in infosec, Odysseus knows that Scylla has six heads, and can hit no more than six users at a time. But dodging her attack means running straight into Charybdis, who will deal critical damage drag the whole ship into a whirlpool. This is the first historical mention of an ethical thought experiment that would later become known as the “trolley problem” — and Odysseus picks Scylla.

Having passed these threats, the remaining crew members land on the island of Thrinacia. That cluster allows initial login with a standard access level for regular users, on one condition: don’t touch the island’s critical resource, the sacred bulls of Helios — chief expert in solar technology. But the warriors ignore Odysseus’ instructions, break the rule, and use that resource to mine food. This triggers a defense system built by OLYMP’s leader, nicknamed Zeus, which permanently blocks strikes down the ship and Odysseus’ crew. Odysseus himself barely survives and reaches Calypso’s island.

Return of root

Once his memory is back, Odysseus builds a raft and charts a course, thanks to Calypso. Athena, the wisest of the OLYMP experts, helps him reach the shores of Ithaca against all odds. He then slips into the city disguised as a beggar.

There, Odysseus passes several steps of multi-factor authentication:

• His old dog Argus sees his master, wags his tail, and dies.
• Telemachus sees this and realizes the poor wanderer is his father.
• His elderly nurse Eurycleia recognizes the man she raised by a unique code the scar on his leg.

But that isn’t enough to restore his root access. So with Telemachus’ help, Odysseus has to enter the palace using the account of one of his former companions, where he meets the administrator, Penelope. Nolan added an important twist here. At this moment, Odysseus regrets creating the first Trojan, which destroyed the infrastructure of an entire city. He also realizes that the malicious suitors’ constant attempts to guess the root password put Ithaca’s infrastructure at risk of the same decline.

Penelope begins to guess who is standing in front of her from his digital footprint indirect signs. She then sets a condition for the would-be root account owners her suitors: she’ll marry the one who can shoot an arrow through the rings of 12 axes with Odysseus’ bow. The bow is essentially a passkey with biometrics, which nobody knew how to fake back in those ancient times. So the bad actors fail one after another. Only Odysseus draws the bowstring and sends an arrow through every axe’s ring. Thanks to the successful biometric authentication, everyone accepts him as the true root king of Ithaca.

The rest is simple: the malware villains are neutralized, the kingdom is saved, and peace and information security return to Ithaca.

Why watching The Odyssey can be dangerous

In the window between the movie stopping being shown in cinemas and its release on digital media, our experts discovered a new multi-stage malicious campaign that had been running since mid-August. Malicious actors are spreading a previously unknown piece of malware called MovieReaper through compromised torrent trackers. They disguise it as downloads of popular movies — first and foremost The Odyssey, one of the biggest premieres of the summer. Scammers use this irresistible bait to make people more likely to download their file. The malware itself is as treacherous as the Sirens. It can hide from detection, give attackers remote access to the victim’s device, and deploy extra modules to stay in the system even after it’s removed. Read the full technical breakdown of MovieReaper on our expert blog, Securelist. Victims of this attack have been found all over the world. This is one more reminder of how important it is to be careful online — especially when downloading files.

Practical lessons from The Odyssey

So what can we learn from the story of the cunning king of Ithaca?

• A good offense isn’t the best defense. Instead of developing software to attack other users, focus on your own information security.
• Keep an eye on your personal data. It can fall into the hands of bad actors, which can lead to targeted attacks.
• Set up multi-factor authentication. It lowers the risk of being hacked, and helps you regain access to your accounts safely.
• Set up reliable protection (and don’t ignore it), because you should beware Greeks bearing gifts!

We love watching movies and breaking them down from a cybersecurity perspective. Read our other top reviews and analyses:

• Cybersecurity in 007’s world
• Matrix vulnerabilities
• The Matrix Resurrections security assessment
• Obi-Wan Kenobi in terms of information security
• Cybersecurity in season 2 of The Mandalorian
• and others…

We use many technologies to detect email spam. They analyze every part of a message: headers, text, images, and links. But the first thing our email products focus on is the “From” field. If the address contains a domain that’s already on our denylist, it’s an easy call. But spammers know the drill, so they register domains in industrial quantities to make emails, even from a single campaign, arrive from completely different addresses. Clearly, they don’t do that by hand. The process has long been automated, and attackers’ algorithms can register huge numbers of domains in a matter of minutes. But every domain needs a name. Coming up with a unique one for each isn’t feasible. So spammers use domain generation algorithms (DGAs), which create similar names with minor variations, based on date and time, pseudo-random numbers, and so on.

In fact, to block mailings such as these, you don’t need every address on your denylist. We’re good at automating processes, too. For some time now, our email solutions have included a technology that detects domains generated by DGAs, and shuts down entire batch with a single rule. Let me explain how this technology works.

How we detect and block generated domain names in bulk

As soon as any of our technologies flags an email as spam, its address becomes subject to further examination. If it meets a number of criteria, its domain is added to our database of domains we consider “bad”. We built a cascade of classifiers that compares these domains by similarity, groups them into clusters, and creates a short but comprehensive rule that blocks the entire cluster. Our email protection solutions receive this rule with an update. From then on, they block all emails sent from addresses on any domain that matches it — even if those domains have never been used in spam campaigns yet.

Here’s a real-world example. Let’s say the classifier flags several lookalike domains in a collection of “bad” ones it has gathered:

• sxkjcc.asia
• sxkjcd.asia
• sxkjcy.asia

Then, one rule is enough to catch them all: @sxkjc[a-z0-9]\.asia\b

How to protect your company from spam

According to our analysis, 44.9% of emails sent last year were spam. Unwanted, unsolicited emails distract employees, waste working time, and clog inboxes. In some cases, they also contain scam, phishing, or malware content. To protect business customers from this deluge of threats, our solutions for corporate email security have anti-spam technologies that we constantly improve. This includes the technology described above for blocking domains generated by DGAs.

Yesterday, two critical vulnerabilities were disclosed in PHP, the scripting language used by many websites and online services: CVE-2026-109618 and CVE-2026-109619. Attackers can exploit them to remotely execute commands on any server running PHP, with no authentication required. The exploit has been dubbed PHP2Shell.

The PHP security team announced an upcoming emergency update on October 20 and released patches fixing the vulnerabilities the following day.

We’ve already covered the technical details of these vulnerabilities and explained what companies and server administrators should do. You may have safely skipped that news because you don’t run any servers — but unfortunately, the issue is not limited to businesses.

Nearly 70% of websites run on PHP, including services we use every day: wikis, online stores, smart devices with web interfaces, home network-attached storage (NAS), smart-home controllers, and much more.

Today, we explain how these vulnerabilities could affect you personally and what you can do to reduce the risks.

How the vulnerabilities can affect home users

Account and personal-data theft

The vulnerability allows an attacker to steal authentication tokens from server memory. These tokens essentially act like electronic passes — telling a website that the user has already signed in. As a result, an attacker may be able to access someone else’s account without entering a password or two-factor authentication code, putting messages, documents, delivery addresses, order histories, and other confidential information at risk.

Loss of files on home devices

If you have network-attached storage (NAS) or a video surveillance system at home that uses a vulnerable PHP version, it may also be at risk. Depending on what level of access they gain, attackers could potentially copy, delete or encrypt files they can access.

Malware infection

If an attacker gains access to a vulnerable website, they can use it in virtually any way they want: trick visitors into downloading a malicious file or clicking on a phishing link, display dangerous instructions, replace payment forms or login pages with malicious ones — the list goes on and on. As a result, someone visiting a legitimate website could not only lose access to their account, but also lose money or accidentally infect their device with malware.

Below are examples of services directly affected by the vulnerabilities.

Which services are affected by the PHP vulnerabilities

Jeedom

Jeedom is a smart-home platform that lets users control lighting, sensors, heating, blinds and home IoT devices. Attackers could abuse this in many ways: they could disable the alarm, track when the homeowner is away, access video from the door intercom, and more.

The developers confirmed that the new vulnerability affects their application, and have already released an emergency update — Jeedom 4.6.2. Users need to run the update twice for it to work. The developers say a fully fixed version for home users will be released in the coming days.

Websites we use every day

As mentioned above, PHP is used by roughly 70% of websites. This doesn’t mean every one of them is vulnerable: it depends on the PHP version in use and whether the site owners have already updated it. Many government websites in Europe have already suspended operations because of the new vulnerability.

Unfortunately, a website may still be vulnerable even if it appears to be working normally. An attacker could potentially take control of any legitimate website whose server hasn’t been patched yet. They could fake payment or login pages, host malicious files, or persuade users to download an “urgent update” that is actually malware.

Ordinary users have no reliable way to check whether such instructions or files are safe, so be sure to use reliable anti-phishing and antivirus protection. If you suspect that your data may have been stolen, check the active sessions in your account settings. If you spot suspicious activity or devices you don’t recognize, sign out of all active sessions and change your password. Use a password manager — it can generate a truly strong, unique password that you won’t have to memorize yourself.

Computer games

Bad news for gamers: some video games whose servers use PHP are also at risk. If you don’t want attackers to get hold of your accounts, be sure to update the passwords for your gaming platforms, stores and accounts.

To buy time for updates, some developers temporarily took their services offline. Final Fantasy XIV, Pokemon Champions, games from Bandai Namco Entertainment, Uma Musume: Pretty Derby, Granblue Fantasy, Shadowverse: Worlds Beyond, and many others went into emergency maintenance. Nintendo Switch Online and the GOG and Steam stores were also affected.

Unfortunately, there’ve also been more drastic consequences. Yesterday, the developers of World Quest announced that the game would shut down permanently after 15 years: it relied on outdated infrastructure that would have been extremely difficult and costly to fix. For the same reason, the mobile game Please Save My Pandemonium! shut down after more than ten years of operation.

Home network-attached storage (NAS)

“Home clouds” have become popular in recent years for good reason: many users prefer to keep backups of their data at home rather than online. A number of companies make NAS devices, and at least three — QNAP, Synology and ASUSTOR — have said the vulnerabilities affect their products. An update has also been released for Unraid, an operating system for home servers, network storage and media servers.

QNAP

The manufacturer confirmed that the vulnerabilities affect several versions of its NAS operating systems — QTS and QuTS hero — as well as applications including QuMagie, Note Station 3 and certain versions of QVR Surveillance. A successful attack could put photos, documents, notes and camera recordings at risk.

At the time of publication of this blogpost, QNAP is still preparing updates, so the main priority is to temporarily disconnect NAS from the internet. QNAP recommends disabling port forwarding on the router — to prevent NAS from automatically opening ports — and allowing access to the management panel only from the home network or through a VPN.

Synology

Both vulnerabilities have been officially confirmed in PHP packages 7.3, 7.4, and 8.0–8.4, as well as in Mail Station and Synology Calendar. Fixes have already been released for PHP, starting from version 7.4, as well as for Mail Station and Synology Calendar. PHP 7.3 won’t be fixed. The company separately notes that the PHP component built into its operating system cannot be reached from outside the device, so the risk of attack is very low.

ASUSTOR

ASUSTOR also officially confirmed both vulnerabilities, and immediately removed PHP 7, 7.3, 7.4, and 8.1 packages from App Central. The company recommends immediately backing up your data, removing older PHP packages, and using PHP 8.3 or 8.4.

Unraid

In today’s operating-system update, PHP was upgraded to version 8.4.27 with fixes for the vulnerabilities. The developers recommend that all users update to Unraid 7.3.4. Containers with their own PHP installation must be updated separately: the new PHP version in the operating system doesn’t replace PHP inside containers.

At the time of publication, we haven’t found public confirmation from other major manufacturers (such as TerraMaster, UGREEN, Buffalo, or Western Digital) that their devices are affected by these vulnerabilities — only user discussions on forums.

But the fact that only some NAS manufacturers have confirmed the problem so far doesn’t guarantee that your devices are safe — especially if they’re fairly old or come from a lesser-known or defunct manufacturer. In that case, first disconnect the devices from the internet while keeping them accessible only on the local network, and then investigate whether they’re vulnerable.

Nextcloud cloud storage

Nextcloud is a free, open-source platform for creating your own cloud storage, serving as an alternative to Google Drive, Dropbox, and Microsoft OneDrive. It lets you store and synchronize files across devices, share them with other users, and work with documents, photos, calendars and contacts. The data can be stored on your own server or NAS rather than on a third-party company’s servers.

If you store important data in Nextcloud, check how your cloud instance is configured. If you use Nextcloud All-in-One, update to version 14.4.1 where the vulnerability has already been fixed.

If your Nextcloud installation is configured differently, you need to update PHP yourself on the device or server.

How to protect your devices and data

• Use phishing and malware protection. Our security solution automatically blocks phishing pages and malware, even when attackers place them on legitimate websites.
• Keep an eye on updates. If you have network-attached storage, a smart-home system, a home server, a media server, or any other device with a web interface, first check the manufacturer’s website and install all available updates. If no update is available yet, temporarily disable internet access to the device.
• Use strong passwords. Most people reuse the same password, or variations of it, across multiple websites. If an attacker finds one of those passwords on a vulnerable server, they may be able to compromise your other accounts as well. We recommend generating and storing strong, unique passwords in Kaspersky Password Manager so you don’t have to remember your credentials yourself. Be sure to enable two-factor authentication on all important accounts — ideally using one-time codes generated by the same password manager.
• Keep an offline backup of important files. Don’t rely on cloud storage alone — make sure you keep a backup of all important documents on both a hard drive and an external device. For more information on how to make backups properly, see our article The internet remembers not quite everything.

What other risks can your home devices face? Read our articles:

• Trojan TV, or the new risks of malicious proxies
• Ransomware now taking aim at personal backups
• Is your TV box renting out your network?
• Is your router secretly working for foreign intelligence?
• Three common attacks on Linux in homes
• How to secure your smart home

Two critical vulnerabilities have been discovered in the popular PHP programming language. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, allow attackers to remotely execute code on a server running PHP without authentication. The language’s development team has released updates for all supported branches, but the first attempts to exploit the vulnerabilities were observed even before the patches were published. The exploit has been named PHP2Shell.

The architectures of popular marketplaces, e-commerce platforms, and learning management systems (LMS) are written in PHP. In addition, PHP is used in various content management systems (CMS) such as WordPress, Drupal, Joomla, and so on, which power most websites on the internet.

In this blogpost, we discuss CVE-2026-109618 and CVE-2026-109619 in detail, and explain how companies can protect their infrastructure. Read the Securelist expert blog to learn how events surrounding these vulnerabilities unfolded before the patch was released.

Vulnerable PHP versions

According to PHP web site, versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 are vulnerable to CVE-2026-109618 and CVE-2026-109619. There are no official fixes for older branches. According to unofficial reports, the vulnerabilities also affect PHP versions starting with 5.4.0.

What makes CVE-2026-109618 and CVE-2026-109619 dangerous

Both vulnerabilities received a score of 9.2 on the CVSS v4.0 scale. They arise because, after a request is interrupted (for example, due to a memory shortage), PHP leaves invalid data in the memory buffer, and subsequently accesses it, allowing code to be executed on the server. One of the confirmed attack chains via CVE-2026-109619 exploits the `session.upload_progress` mechanism (which tracks file upload progress), which is enabled by default in PHP.

By exploiting these vulnerabilities, attackers can remotely execute code on the server with web server process privileges without authentication.

According to PHP developers, all installations of unpatched versions that process web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The greatest risk lies with mod_php: researchers demonstrated an exploit for it in which an unauthenticated request triggers the attack even before the application code is executed.

What businesses should do

We’ve compiled key recommendations from the PHP developers and experts at Kaspersky.

• Update PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Start with systems accessible from the internet. The source code is available on the PHP website. If PHP is installed from distribution packages or provided by your hosting provider, check for updated packages: Linux distributions and LTS vendors received patches in advance. If the server is managed by a hosting provider, ask them to apply the update.
• Versions 8.1 and older no longer receive updates from the PHP project. Check with your distribution vendor or LTS support provider to see if backported fixes are available, or switch to a supported branch. For PHP 7.4, 8.0, and 8.1, the developers have prepared minimal source code backports for manual compilation. These can also be found on the PHP website.
• Restart PHP-FPM or the web server so that the processes load the new code, and verify the version using the `php -v` command. If PHP was installed from distribution packages, check the package changelog: the version number may remain the same.
• Check the logs from October 20. A warning sign is when the web server process is performing actions it shouldn’t (running command shells, curl, wget, and the like). Kaspersky solutions help detect malicious activity in a timely manner. Attempts to exploit the described RCE vulnerabilities on Linux and Windows machines can be detected using Kaspersky NEXT EDR Expert, while exploitation of PHP2Shell in network traffic is detected by Kaspersky Anti Targeted Attack (KATA) with the NDR module.

If an immediate update is not possible

Only the immediate installation of patches will fully resolve the issue, but if that isn’t possible, it’s recommended to implement temporary measures. PHP developers provide step-by-step instructions for each vulnerability.

Anonymous imageboards have long been places where users could chat under pseudonyms without revealing their real names. But now people on these forums are discussing and testing AI tools for doxing — that is, for finding, matching, and publishing users’ data without their consent. Often this goes hand in hand with stalking the victim, hacking their accounts, bullying, and blackmail, and ultimately leads to a damaged reputation or even worse.

In this post, we explain how artificial intelligence helps malicious actors leak other people’s data — and how to stand up for your right to online privacy.

How bad actors uncover information about users

Analysts at Open Measures have reported that, since October 2025, users of Soyjak.party, an imageboard popular with young people on the far right, have been discussing and using AI to deanonymize other users. Their victims are often activists, bloggers, and members of other “hostile” forums.

The tools the experts found run right in the browser, and automate almost the entire process of collecting information about a victim. They can search open sources and leak databases, and they use any new leads — for example, an email address linked to a username — to dig even deeper. They also extract metadata from photos and videos, estimate a person’s approximate location from IP addresses they find, and finally put everything together into one huge digital dossier. These Soyjak.party tools are no longer functional, but similar ones have been spreading across other imageboards.

In February 2026, researchers demonstrated that sometimes ordinary forum chatter is enough to reveal who you are. They put together summaries of posts by 338 Hacker News users, removed names, usernames, and social media links, and then asked AI to work out who was behind them. The AI compared details about jobs, interests, and personal background with information available online — and correctly identified 226 of the people, or about two-thirds of the sample. The price of deanonymization turned out to be laughably low — at between US$1 and US$4 per user.

To be fair, people knew how to build digital dossiers even before the generative AI boom. For starters, there are OSINT tools that search for data in open sources. Journalists and investigators were the first to use them, but, as you might guess, malicious actors soon mastered these tools too. Unlike AI models and agents, traditional OSINT services follow set scripts and can’t “think” or make decisions on the fly.

An agent out for revenge: the OpenClaw case

If you think doxing always needs a person with ill intent, we’ve bad news: sometimes the one settling scores can be… artificial intelligence itself.

Here’s a story that started out innocuously enough. An AI agent running on the much-hyped OpenClaw platform suggested an improvement for Matplotlib, a popular tool for building graphs and charts. But the project’s rules said that code submitted by AI agents wasn’t accepted. One of the project’s volunteers, Scott Shambaugh, simply turned down the AI’s suggestion.

You’d think that would be the end of it. Think again! The AI agent decided the rejection deserved some publicity, so it published an “exposé” about the developer on its blog (yes, you read that right: the agent had its own blog). It gathered information about Shambaugh from open sources, studied his public activity, and accused him of being biased against AI. It even started speculating about the developer’s psychological motives, and suggested he was afraid of competition from artificial intelligence.

Once this “private” conversation between Shambaugh and the AI agent went public, other users rallied behind the developer — and the agent had to publish an “apology” post.

It’s a pretty absurd story, but it teaches a good lesson: always read the privacy policy of any AI service carefully, and steer clear of new models from unknown sources.

How to avoid becoming a doxing victim: a guide

If AI speeds up searches and connects the dots between details that used to be scattered across dozens of websites, the next logical question is: what can you do to shrink your digital footprint?

Disappearing from the internet completely is almost impossible. So protecting your data isn’t so much about leaving as few traces as possible, but cutting the number of links that can be used to piece together your identity. If you’re an advanced user, we recommend reading our post, How to disappear from the internet, in addition to the tips below.

Manage your digital footprint

• Search for yourself online. Don’t stop at your name: try your email address, nicknames, and phone number too. If you’re comfortable with AI processing your data, you can even ask it to compile a dossier on you. Just remember that there’s always a risk of a leak or a bug that accidentally makes your data public. And no, big, reputable services are no exception.
• Make private any profiles you don’t want to share with everyone. That makes it harder for search engines to index your new posts, and for scrapers and OSINT tools to collect them. While you’re at it, go through your old comments and posts and clear out anything you don’t need.
• Delete your ghost accounts. Go through your inboxes and check which websites you’ve signed up for. Make a habit of deleting accounts you no longer use: they can hold your personal data for years, and there’s always a risk it’ll end up in the next data leak.
• Set up two-factor authentication. That way, even if a bad actor manages to guess your password or finds it in a leak, they won’t be able to get into your account without the additional authentication. For the second factor, we recommend using one-time codes that refresh every 30 seconds and storing them in a reliable password manager.
• Strip metadata before posting photos and videos. Metadata can help a malicious person learn a lot about you— for example, the location and exact date a photo was taken, and the model of your device.
• Use a different password for every account you have. Our research has showed that passwords built from personal details — such as your mother’s maiden name, your birth date, and a special character at the end — are extremely weak. This kind of information often ends up in leaks, or can be pieced together from public sources, so the passwords can be easily brute-forced by smart algorithms. Of course, nobody can remember hundreds of unique passwords, so it makes sense to offload that job to our password manager — a secure vault that generates and remembers complex, unique passwords for you, and syncs them across all your devices.
• Find out about new leaks as fast as possible. Some online services will send you a free alert if your email address shows up in a known data leak. But it’s much more convenient to monitor leaks with a dedicated security app. For example, Kaspersky Password Manager constantly checks all the entries you’ve saved. It warns you if you use the same password on different websites, or if any of your saved login and password pairs has been compromised. Our simple instructions for Windows, macOS, Android, and iOS can help you easily check all the passwords you’ve saved in Kaspersky Password Manager. Your passwords are never sent to Kaspersky. We explain how we can analyze your passwords without knowing them in our post, How to create strong passwords and where to store them.
• Use reliable protection that tracks and blocks leaks of your data. While Kaspersky Password Manager only checks the active password entries you’ve added to it, Kaspersky Premium can monitor for compromised accounts linked to your email addresses (you can add up to 50 addresses to check), and for digital identity theft linked to your phone numbers. And besides reporting leaks that have already happened, our security solutions can also stop data about you from being collected online.
• Set up privacy on your devices and apps with our free online service, Privacy Checker.

Keep your accounts separate

The more websites that know your email, the more often it will show up in advertising profiles and potential leaks. For one-time and minor sign-ups, you can use an email masking service. All Apple users get this feature by default (Hide My Email). If you use another OS, you could try Firefox Relay, for example.

The service then creates a separate proxy email address for the website where you’re trying to sign up. Messages sent to that address are automatically forwarded to your real inbox, but the website never sees your real email address.

If you want to go all in, you can try splitting your digital life into several sub-personas by hand. Create several email addresses for different purposes. For example, use one for online stores, banks, and government services, a second for public social media, and a third for forums and social networks where you want to stay anonymous.

Keep in mind that all this is a challenge: you’ll need to keep coming up with new nicknames, and make sure your sub-personas never overlap. If you use an email address for an anonymous profile, don’t link it to services that already have your real details, and don’t use it as a backup email for a public account. One accidental link can easily undo all your effort.

Check what you share with exes

If you’ve recently broken up with a partner, make sure you check which parts of your shared digital life they can still access. Sadly, it’s very often ex-partners who become doxers or stalkers — spying on their former other half and stopping at nothing to do so. For more details on exactly what to do in this situation, read our article Post-breakup digital hygiene: what to check and shut down.

Use your right to be forgotten

Many countries have a right-to-be-forgotten law. It lets you ask search engines to remove links to pages that contain your personal data.

You can send the links to those pages, explain why you want them hidden, and request that they be removed from search results. Keep in mind that the page with your data isn’t deleted. Other search engines may still show it, and it may still turn up for other search queries.

To submit a request like this, use the dedicated forms from Google or Bing. But remember that a search engine can turn you down if it decides the information is in the public interest, or that the law requires it to be published.

There are more effective, though more time-consuming, ways to remove your data from the internet. We covered them in detail in our post, Why data brokers build dossiers on you, and how to stop them doing so.

Looking for more ways to protect your digital identity? Check out our other posts:

• How to disappear from the internet
• Doxing — another online danger for women
• Post-breakup digital hygiene: what to check and shut down
• The Naked Truth
• AI and the new reality of sextortion

The more a company’s infrastructure grows, the more weak spots it has. And that’s true for all companies — from large corporations with deep pockets that are able to invest more in their defenses, to small and medium-sized businesses. And despite their more modest capabilities, smaller companies are just as tempting a target for attackers.

New times, new risks

Cloud platforms, remote access, and AI help businesses scale up and get more done. But they also give attackers extra ways to get into corporate infrastructure. For example, remote employees’ personal devices have become a foothold that’s hard to control. And thanks to AI, phishing emails are almost impossible to tell from real ones: users can no longer spot a scammer by their spelling mistakes.

There’s another reason why new threats keep appearing: companies are slowly learning how to handle the old ones. Take backups. Just a few years ago they were sold as a cure-all against ransomware. Now they’re less effective, because at some point attackers started stealing data and demanding payment not for decryption, but for not making it public. What’s at stake here isn’t just business processes, but the organization’s reputation too. We wrote about this scheme in more detail in a separate blog post.

The scariest part is that an attacked company’s problems don’t end on the day of the incident. The next few days (or even weeks) are often much harder. This is when the team needs to quickly deal with the aftermath of an attack and to make sure another can’t happen again. Growing companies often have to throw their entire small IT force at the problem, so getting back to normal work can take a long time.

Three Achilles’ heels at once

According to the Global Kaspersky B2B Market Pulse survey, most SMBs only think about security when circumstances force them to; for example, after an incident, when expanding their infrastructure, or when a potential partner asks them to strengthen their perimeter before signing a contract. Yet only a handful treat continuous cybersecurity monitoring as a core part of running their business.

When a company finally decides to get serious about security, it runs into three constraints: people, processes, and technology. Let’s look at each one.

• People. In a company with up to 500 employees, the IT department is usually just a few people. They handle all technical issues and have little to do with cybersecurity. When things get tough, these specialists may simply lack the expertise to deal with things. Other employees can be a weak link too. Accountants, lawyers, and other staff with access to confidential information often aren’t familiar with security rules.
• Processes.A small IT department always has a backlog with a long queue of tasks; therefore, fresh updates and patches don’t get installed right away. As a result, attackers have plenty of time to take advantage of a vulnerability that isn’t fixed in time. Meanwhile, other employees may not know how to respond to suspicious emails, or how to store and share passwords safely. And there’s simply no one to keep an eye on them.
• Technology. Threats evolve alongside a business’s technology. For example, once a company has moved part of its infrastructure to the cloud, relying on a classic antivirus alone becomes pointless.

So small and medium-sized businesses become easy targets for attackers not so much due to their size, but because they don’t pay enough attention to the key building blocks of cybersecurity. As to what this can lead to, and how the tables can be turned in a company’s favor — read on for a real-world case that demonstrates this.

Case study: ERP system breach

Let’s look at a real-world attack on a company with 450 employees. When the incident happened, the company was migrating its ERP system to the cloud. The data had already been moved, but the protection hadn’t been set up yet. And that limbo state is exactly what let the attackers pull off their campaign.

The attackers used a fairly simple tactic. Posing as an external ERP integrator, they sent the finance department a file with an “adjusted invoice”. When an employee opened the attachment, the malicious code inside it exploited a vulnerability in a local application, and the attackers took control of the device. There they found saved credentials that let them log in to a support account and get administrator rights on the cloud ERP server. With that account, they got into the server and stole the company’s confidential data.

We analyzed the mistakes that made this incident possible, and came back to the same formula: people + processes + technology. The company did provide employee training, but it was mostly a formality and did nothing to help people learn to spot email phishing. Security updates weren’t installed right away either, which is why the computer had an unpatched vulnerability. On top of that, privileged credentials were stored right on the employee’s device, which gave the attackers a direct path to administrator access. Finally, the workstations had no EDR, and the cloud ERP server had no workload protection.

How SMBs can strengthen their defenses

The best way to start is with the three key areas we covered above. And this isn’t about simply throwing money at security. What’s needed is a clear, step-by-step plan that makes the most of the resources the company already has.

Hands-on training

Employees are a business’s first line of defense, so it’s especially important to help them form safe cyberhabits. Many companies understand this and duly run computer literacy training; however, often employees show up in droves, yet they keep on making the same old mistakes.

The problem is that most training isn’t relevant to the people taking it. People in the finance department know that attackers can send phishing emails, but what does that have to do with their job? To head off questions like that, we recommend combining cybersecurity theory with simulations of real cyberattacks. That way, employees can safely step into the shoes of an attacker’s target. Start by training employees who have privileged access to systems, and also those who handle confidential information.

To keep training from becoming a formality, track progress regularly. For example, send employees suspicious test emails from time to time, and measure how fast and how well they react: how many recipients click the link, and how many report the threat.

Structured processes

Set up clear priorities for installing updates and patches. This helps avoid two extremes: running for months with open gaps in the infrastructure, or rushing to fix every vulnerability without asking how critical it is for specific business processes. Setting up centralized vulnerability management also helps, which we explained how to do in a separate post. Don’t rush to expand the infrastructure or move it to the cloud until the company has proper protection and monitoring in place.

Another key point: assign an owner to every process. Someone should be personally responsible for regular cybersecurity training, installing updates, and the timing and methods of incident response. That way, security tasks get done on time — even when the IT team has limited resources.

Gradual rollout of security solutions

It’s impossible to build reliable business protection without specialized products, but buying everything at once won’t help either. New solutions should match the needs of the infrastructure. A good approach is to add tools as the need to do so comes up; for example, to prioritize vulnerabilities more effectively or to strengthen the security of email or cloud environments. One way to tailor security to the company’s needs is to use our Security Modules , which work with Kaspersky Next Optimum — a solution for growing SMB and mid-market businesses.

Another option is to move to a more advanced solution as the infrastructure grows. The foundation of cybersecurity can be laid with Kaspersky Next EDR Foundations, which provides basic endpoint protection and control. Then, when needed, the company can move up to solutions with a broader range of capabilities, from Kaspersky Next EDR Optimum to Kaspersky Next XDR Optimum, or straight to Kaspersky Next MXDR Optimum. Our most comprehensive offering — Kaspersky MXDR Optimum — combines advanced detection and response that goes beyond endpoints and adapts to the needs of a growing business, 24/7 monitoring, and proactive threat hunting and investigation by Kaspersky experts.

Finding a job these days is playing on hard mode. You send your resume to a company, and a couple of minutes later, an automated rejection lands in your inbox. And then it happens again. And again. Sound familiar?

In this post, we look at how recruiting platforms work from the HR side. We also show how to use AI safely as a copy editor so you can prepare a resume for recruiters without turning it into a lifeless pile of keywords. At the end, we share a ready-made prompt to help you improve your resume’s structure and content.

Protecting your data

Before you give your resume to a chatbot, remove all sensitive information: your name, phone number, home address, email, company names, and scans of documents. Any language model you chat with can sometimes memorize personal information contained in their training data. That means there’s always a chance the AI may accidentally “learn” to give your data to other users. On top of that, even the biggest services aren’t immune to glitches and leaks. For example, last year a researcher found a bug in Meta AI that let users gain access to other people’s conversations with the chatbot by changing their request ID.

The ability to read other people’s chats sometimes isn’t even a bug. For example, it recently came to light that Grok users who clicked the Share chat button to send a conversation to a friend or to themselves were also allowing search engines to index that conversation. As a result, thousands of conversations ended up in public view. These included personal data, requests to come up with complex passwords, complaints about health problems, trade secrets, and other information the chat owners clearly never meant to publish.

So before you use any chatbot, first check its privacy policy, and then go to the settings to turn off all the features you don’t need. Most importantly, turn off training the AI on your requests. And remember the golden rule: don’t send an AI anything you wouldn’t be okay with seeing on the internet.

If you work with sensitive information all the time, the safest option is to run language models locally right on your own computer. We previously explained how to do this, using DeepSeek as an example. The same approach works with any other open-weight model.

Finally, don’t feed your personal data to chatbots from unknown developers that promise to write you a flawless resume. Often, these are just slick wrappers around popular models. And you probably won’t ever find out who actually gets access to your data, where it’s stored, or what happens to it next.

Malicious actors can use this information for follow-up attacks. For example, they can send fake interview invitations and attractive job postings that match your work experience and career interests a little too well. From there, the scam can go in many directions: a malicious file disguised as a job invitation, a link to a phishing page that steals your account, a request to install “corporate software” or to continue the chat in a messaging app, and so on.

When choosing an AI tool, ask yourself these questions:

• Does the service have a clear privacy policy?
• Does it say what happens to your file after you upload it — will it be stored or deleted?
• Does the service explain whether your data will be used to train AI?
• Who owns the service? Can you trust this company?
• Is the site protected with HTTPS?

Who reads your resume: a human or a robot?

Most large and mid-sized companies have long used an applicant tracking system (ATS). This is specialized software for HR teams (human resources specialists or, put simply, recruiters) that collects and sorts job applications.

A company having an ATS doesn’t mean their applicants are scored automatically. It’s a fairly old type of system that dates back to when artificial intelligence looked very different. Then, as AI tech evolved, some companies started building AI modules into their ATS. But how common this is varies a lot from country to country and market to market. According to a LinkedIn study, 37% of HR leaders surveyed worldwide use AI in hiring, but only 11% actively integrate AI tools into their HR platforms.

The takeaway: you can optimize your resume for AI, but you still need to write it for a human. Even if your resume clears the AI screening, an HR person will read it next — and flat, machine-sounding prose will only hurt their impression of you.

Keep in mind that instant rejections don’t come only from AI. In some ATS, recruiters can set up automatic rejection rules by hand. For example, these rules can rely on a candidate’s answers about education, work authorization, required experience, licenses and certifications, ability to work the required schedule, and so on. So take a moment to check that your resume contains up-to-date and complete information relevant to the vacancy.

How to write a resume that passes both AI and HR screening

Write the first draft yourself

It’s ok to turn to AI for help, but the resume has to have substance, and a real person with real work experience has to shine through.

Start by writing your resume yourself. It doesn’t have to be perfect, and it can have mistakes. Only then ask AI for a fresh pair of eyes. Here, AI shouldn’t act as your personal biographer. It should act as a copy editor that polishes the wording and structure.

Keep the formatting simple

Unless the employer asks for something specific, skip the photos, tables, complex graphics, and custom fonts. And definitely don’t try to design something fancy in a graphic editor. Any of these can make your document unreadable for an ATS. The gold standard is a plain PDF or DOCX file with headings, a standard font, clear sections, and bulleted lists.

Tailor your resume to each job

Copy the job description and ask a chatbot to work its key phrases into your resume. Don’t just sprinkle keywords around. Put them in context and back them up with examples from your experience. Remember: you should be able to prove every word in your resume.

Show what your effort achieved

Skip the generic phrases, personality labels, and bare lists of duties like “responsible”, “did data analysis”, or “prepared reports”. Both recruiters and AI look for specifics, ideally with numbers and timeframes. Show what you did your job for, not just what you did.

Stick to the action + tool + result formula: “Automated report generation with Python and cut preparation time by 80%”, “Launched a new pricing model and grew annual revenue from US$400 000 to US$600 000 in 12 months”, “Developed a corporate messaging app that more than a thousand employees use today”. Don’t overdo the numbers. If you don’t have exact figures, or they don’t apply, don’t make them up.

Put the most important things first

Start with a short paragraph of two to three sentences that covers the key points and contains a link to your portfolio. Use it to give a brief overview of your work experience, skills, and key achievements. If you’re new to the field, write about your education and career goals instead.

List your work experience in reverse chronological order so your latest career achievements are the first thing people see.

AI prompt

You’ve got the tips — now it’s time to ask AI for help. Here’s a prompt that works. We’ve tested it on several chatbots:

Review before sending

• Check for extraneous information: make sure your resume doesn’t include unnecessary personal data or information covered by an NDA.
• Check for readability: make sure your resume has the right headings, dates, and section order, and that the file is in DOCX or PDF format. Remove any complex graphics from the document.
• Check for accuracy: reread every statement and ask yourself, “Could I back this up in an interview?” Remember: AI doesn’t know all the details of your work and may exaggerate some of the wording.

More on how to use AI safely without compromising your privacy:

• Privacy settings in ChatGPT
• The pros and cons of AI-powered browsers
• How phishers and scammers use AI
• Hacking Black Friday: using LLMs to save on the “sale of the year”
• Would you entrust your vacation travel plans to AI?

Microsoft’s October Patch Tuesday update stands out for two reasons. First, the total number of patches has reached four digits for the first time. Second, to help companies better understand the details of the vulnerabilities, Microsoft has decided to group them into risk cohorts. A cohort brings together vulnerabilities that are exploited under the same conditions and affect the same systems. They replace neither the severity rating, nor the individual bulletins for each CVE. While they’re unlikely to be suitable for comprehensive patch prioritization, they will help quickly assess which part of an infrastructure is currently most at risk.

Statistics corner

Of the 1,414 vulnerabilities addressed in the October Patch Tuesday release, 1,102 directly affect the Windows operating system, 134 — Microsoft Office, 36 — SharePoint Server, 22 — SQL Server, and seven — Exchange Server. The vast majority — 677 — lead to privilege escalation, 317 to remote code execution, 40 to security bypass, and 73 to denial of service (DoS).

There are 86 critical vulnerabilities on the list, of which 68 lead to RCE, 14 to privilege escalation, three to spoofing, and one to data leakage. In addition, two vulnerabilities were disclosed before being patched, and one is being exploited in real-world attacks.

CVE-2026-96951 — vulnerability in Windows Shell

The only zero-day vulnerability patched in the October update that attackers are already exploiting in real-world attacks is CVE-2026-96951 in Windows Shell (CVSS severity score: 8.8). Details on how it’s being exploited aren’t yet known; however, according to Microsoft’s description, it involves command injection that allows bypassing a security feature when accessing the system over a network. Microsoft credits experts at both Fujitsu and Anthropic for discovering the vulnerability, so it was likely found using neural networks.

CVE-2026-108398 and CVE-2026-92707: vulnerabilities disclosed before patches were released

Information about these two vulnerabilities was made public before the October update was released. In theory, this could mean that attackers attempted to exploit them ahead of time. These are:

• CVE-2026-108398 — a vulnerability in the .NET Framework that allows bypassing WDAC protection;
• CVE-2026-92707 — a vulnerability in the third-party MessagePack-CSharp serialization component, leading to a denial of service (DoS).

However, according to the security bulletins, neither has been observed in actual attacks yet.

What else to pay attention to

Several vulnerabilities patched by the latest update combine potentially serious consequences with relatively simple exploitation. Particular attention should be paid to three flaws that could potentially lead to arbitrary code execution:

• CVE-2026-65674 (in SQL Server);
• CVE-2026-70571 (in Exchange Server);
• CVE-2026-70229 (in AD Domain Services).

What else should be patched?

Microsoft isn’t the only company that releases regular update packages for newly discovered vulnerabilities.

In its October update, Adobe fixed 174 defects in its products, including critical vulnerabilities (CVSS 10) in ColdFusion and Commerce/Magento. These systems are typically accessible from an external network, making them particularly attractive to attackers.

SAP’s October security bulletin lists 20 vulnerabilities, including CVE-2026-89111 — an SSRF vulnerability in the Cloud SDK for Python. This vulnerability, rated CVSS 10, allows attackers to steal OAuth tokens.

How to keep your company safe?

Recently, thanks to neural networks, the number of vulnerabilities detected and patched has been regularly breaking records. To avoid getting overwhelmed by the flood of patches, we recommend using an automated platform for tracking and assessing vulnerabilities . It helps not only identify and fix vulnerabilities, it also prioritizes them based on actual risks and automates the remediation process.

When it comes to protecting voice calls, security professionals typically focus on the security of the data carrying the audio — above all on encryption. Sooner or later though, the voice data stops being a stream of bits and becomes an analog signal that goes straight to the speakers. You might think that if someone is using headphones, nobody can listen in. But headphones are electronic devices, and their components have physical characteristics that can give away closely guarded secrets without any cyberattack at all. In a recent paper, researchers from two Hong Kong universities came up with InjectEave — an attack that exploits these properties to intercept the already-decoded analog audio signal.

How the InjectEave attack works

The electronic components in headphones convert data into analog form and amplify the signal to drive the speakers. This process generates weak electromagnetic emissions. Capturing those emissions and extracting information from them is a field unto itself, with many experts working in it. The main issue those experts face lies in the fact that stray emissions from headphones are too faint to intercept and analyze in practice.

The authors of InjectEave propose adding a radio transmitter that beams a signal at a specific frequency toward the target device. Those weak emissions from the headphones’ analog components modulate the transmitter’s signal. The altered signal can be intercepted from several meters away — provided the receiving antenna is sensitive enough. The attacker then analyzes the changes in the signal to reconstruct the original audio.

Technical details of the InjectEave attack

The main obstacle to intercepting electromagnetic emissions directly — without an external transmitter — is the relatively low signal frequency. For example, the audio amplifier in headphones operates at frequencies from 20Hz to 20kHz. By contrast, electromagnetic emissions are easiest to intercept at frequencies measured in megahertz. The researchers were able to find a transmitter frequency that would also “amplify” the low-frequency signal of interest.

The researchers ran a series of experiments. They used antennas to transmit the “amplifying” signal and receive the result, and a spectrum analyzer to capture and process the data. The authors have posted the raw recordings of the intercepted signals on a dedicated microsite, so anyone can check how well the attack works. In most cases, getting a usable result didn’t even require complex processing or recognition. Conversations picked up from wireless headphones are clearly intelligible despite the elevated noise level.

In total, the authors tested three models of wireless headphones and two models of basic wired headsets. The effective eavesdropping distance varied from one to six meters depending on the model. With a wired telephone, they were able to demonstrate two-way interception. They could hear not only the sound from the speakers but also the potential victim’s speech, which the headset’s built-in microphone and analog-to-digital converter had captured.

Advantages and limitations of the method

Any attack that requires getting very close to the target is challenging by definition. The need to tune the frequency of the “amplifying” radio signal for each specific device makes the attack even harder. In their experiments, the researchers had to use frequencies from one to eight megahertz.

Despite these caveats, the main achievement of this attack is its being able to target the quirks of the analog components in an electronic device. These components inherently produce stray emissions, and there’s almost no way to reduce them.

Similar surveillance methods that intercept a digital signal can be stopped by adding a layer of encryption. When it comes to the analog side of a device, protecting the signal itself is much harder. This research is another reminder of how complex and unpredictable even very simple, familiar devices can be. Sometimes even the strongest protection for digital data is powerless once that information is converted to analog form.