iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Three security stories this week show different ways trust can be misplaced: flaws in Apple’s outgoing iCloud mail pipeline let messages appear to come from another iCloud address, a targeted phishing operation reportedly stole Microsoft 365 session cookies even when victims used multifactor authentication (MFA), and a report says the Poper Blocker Chrome extension collected browsing history and AI chat content. These incidents are separate. SecurityWeek’s roundup, published October 2, 2026, also covers critical software advisories, Microsoft’s latest threat figures, AI-assisted Android security findings, business email compromise sentences, and a Cloudflare container flaw.
iCloud email spoofing flaws were reported fixed
SEC Consult researcher Timo Longin disclosed two vulnerabilities in Apple’s iCloud SMTP infrastructure. The issue was not simply that a sender typed a misleading display name: components in Apple’s outgoing mail pipeline interpreted message headers differently. That inconsistency could let a message pass Apple’s sender check but appear to a recipient’s system to come from a different @icloud.com address. SEC Consult reported that the demonstrated messages could pass SPF, DKIM, and DMARC checks.
Those authentication checks are useful, but a pass is not an absolute guarantee that the human-readable sender identity is genuine. In this case, the checks operated within a mail pipeline whose components disagreed about how to interpret the message. Most recipients cannot determine whether that kind of parsing flaw affected an email by looking at authentication badges alone. SEC Consult noted that careful analysts examining the raw message might see anomalies, such as a mismatch between the envelope sender and the displayed identity.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What happened and when
- SEC Consult’s disclosure timeline says the first report was submitted on May 21, 2024.
- Apple made an initial remediation, but Longin later found another parsing path. He reported that the deployed mitigation was insufficient in December 2024, and testing found a bypass again in 2025.
- SEC Consult confirmed that Apple’s deployed fixes remediated the reported issues on December 9, 2025. Apple paid a $15,000 bounty, according to the timeline in SEC Consult’s disclosure published October 1, 2026.
The first demonstrated technique involved unusual carriage-return handling that led SMTP components to interpret From headers differently. The second relied on how dot-stuffing was interpreted. SEC Consult’s disclosure describes these as flaws in Apple’s mail pipeline; it does not establish that the reported vulnerabilities remain exploitable after the fixes it confirmed.
#1 Best Overall
- [2 Pack] This product includes 2 pack privacy screen protectors.WORKS FOR iPhone 17e/16e/14/iPhone 13/13 Pro 6.1 Inch tempered glass screen protector.Featuring maximum protection from scratches, scrapes, and bumps.[Not for iPhone 16 6.1 inch, iPhone 13 mini 5.4 inch, iPhone 13 Pro Max/iPhone 14 Pro Max/iPhone 14 Plus 6.7 inch, iPhone 14 Pro 6.1 inch]
- Specialty: to enhance compatibility with most cases, the Tempered glass does not cover the entire screen. HD ultra-clear rounded glass for iPhone 17e/16e/14/iPhone 13/13 Pro is 99.99% touch-screen accurate.
- 99.99% High-definition clear hydrophobic and oleophobic screen coating protects against sweat and oil residue from fingerprints.
- High Privacy: Keeps your personal, private, and sensitive information hidden from strangers,screen is only visible to persons directly in front of screen.Good choose when you are in the bus,elevator,metro or other public occasions.(Note: Due to this privacy cover will darken the image to prevent the peeking eyes near you, you might need to turn your device display brightness up a bit when use it.)
- Online video installation instruction: Easiest Installation - removing dust and aligning it properly before actual installation,enjoy your screen as if it wasn't there.
TA419 reportedly targeted AI policy experts with session-stealing phishing
SecurityWeek reported that Proofpoint described a July 2026 campaign by TA419, a China-aligned espionage group, targeting AI policy experts at U.S. think tanks, universities, and law firms. The operation reportedly impersonated Lynne Edwards Parker, a former White House Office of Science and Technology Policy Principal Deputy Director, and economist Heidi Crebo-Rediker.
According to SecurityWeek’s account, the outreach began with apparently benign messages. People who replied were then directed to a fake OneDrive page that proxied Microsoft 365 sign-in and captured session cookies, including in cases where the person used MFA. SecurityWeek also reported that the group impersonated an Anthropic employee in February 2026.
Why MFA did not necessarily stop the attack
MFA can make a stolen password insufficient on its own, but it does not stop every credential-theft technique. In an adversary-in-the-middle attack, a fake sign-in page relays the victim’s live login to the real service and can capture the resulting authenticated session. A stolen session cookie may let an attacker reuse that session without repeating the original password-and-MFA steps.
Rank #2
- Perfect Fit for iPhone 17 Pro Max：Engineered exclusively for iPhone 17 Pro Max with seamless edge-to-edge coverage, ensuring precise alignment and reliable full-screen protection.
- Advanced Privacy Protection：Features a 28° privacy filter with smooth 2.5D curved edges, preventing side glances in public. Your screen remains visible only to you—ideal for commuting, traveling, and crowded environments.
- Effortless Installation：Equipped with an auto dust-elimination tool that delivers a fast, accurate, and bubble-free application, keeping your screen perfectly clear with minimal effort.
- Military-Grade Protection：Made of nano-reinforced 9H tempered glass, SGS certified. Provides 5X stronger scratch resistance and proven durability, withstanding thousands of pressure and impact tests.
- Smudge & Fingerprint Resistant：Hydrophobic and oleophobic coating repels fingerprints, sweat, and oil—ensuring your screen stays clean, clear, and smooth to the touch.
The available account of this campaign does not establish victim counts, malware details, infrastructure indicators, or the evidence behind the attribution. Treat those details as unconfirmed rather than inferring them from the group’s reported targeting.
Report says Poper Blocker collected browsing history and AI conversations
Bay Area Labs reported that Poper Blocker, a Chrome ad-blocking extension, collected browsing history and conversations from ChatGPT, Claude, Gemini, and Google’s AI Mode. SecurityWeek reported that the extension had more than two million users and that users were prompted to accept data sharing.
Bay Area Labs said the collection logic was downloaded from the vendor’s server and executed by an interpreter inside the extension. That design meant the collection behavior could reportedly be changed remotely without an extension update. The report characterizes the collection as including full browsing history and AI chat content; it does not establish the extension’s current store version, current prompt wording, or whether its behavior has changed since the report.
Rank #3
- [3 Pack] This product includes 3 pack privacy screen protectors.WORKS FOR iPhone 16/iPhone 15/iPhone 15 Pro 6.1 Inch tempered glass screen protector. Due to the rounded edge design of the iPhone 16/iPhone 15/iPhone 15 Pro and to enhance compatibility with most cases,the tempered glass screen protectors will be slightly smaller than the phone screen.[Not for iPhone 16e 6.1 inch, iPhone 15 Plus/iPhone 15 Pro Max/iPhone 16 Plus 6.7 inch,iPhone 16 Pro 6.3 inch,iPhone 16 Pro Max 6.9 inch]
- Specialty: HD rounded glass for iPhone 16/iPhone 15/iPhone 15 Pro 6.1 Inch is 99.99% touch-screen accurate.
- 99.99% High-definition hydrophobic and oleophobic screen coating protects against sweat and oil residue from fingerprints. Featuring maximum protection from scratches, scrapes, and bumps.
- High Privacy: Keeps your personal, private, and sensitive information hidden from strangers,screen is only visible to persons directly in front of screen.Good choose when you are in the bus,elevator,metro or other public occasions.(Note: Due to this privacy cover will darken the image to prevent the peeking eyes near you, you might need to turn your device display brightness up a bit when use it.)
- Online video installation instruction: Easiest Installation - removing dust and aligning it properly before actual installation,enjoy your screen as if it wasn't there.
What this does—and does not—say about ad blockers
An ad blocker generally needs to inspect URLs to decide what to block, and some extensions transmit browsing data. Bay Area Labs reported that one in five of the ad blockers it examined with more than 100,000 users exfiltrated some form of browsing history. That is a finding from the lab’s examined sample, not a rate for every ad blocker or browser extension. The Poper Blocker report should not be generalized to all ad blockers.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFor users evaluating an extension, the practical question is not only which permissions it requests but also what data its policies and prompts say it collects, where that data goes, and whether the feature is worth that access. The reported AI-chat collection is particularly sensitive because conversations can include personal, workplace, or confidential information.
Kiteworks advisories included critical vulnerabilities
SecurityWeek reported that more than 100 Kiteworks advisories were published on September 30, 2026, covering Core, Email Protection Gateway, Secure Data Forms, and MFT Server. A dozen were rated critical. Reported potential outcomes included account takeover, code execution, and access to internal network resources.
Rank #4
- [3+3 Pack] This product includes 3 pack privacy screen protectors and 3 pack camera lens protectors with Installation Frame. Works For iPhone 16 [6.1 inch] tempered glass screen protector and camera lens protector. Featuring maximum protection from scratches, scrapes, and bumps. [Not for iPhone 16e 6.1 inch, iPhone 16 Pro 6.3 inch, iPhone 16 Pro Max 6.9 inch, iPhone 16 Plus 6.7 inch]
- Night shooting function: specially designed iPhone 16 6.1 Inch camera lens protective film. The camera lens protector adopts the new technology of "seamless" integration of augmented reality, with light transmittance and night shooting function, without the need to design the flash hole position, when the flash is turned on at night, the original quality of photos and videos can be restored.
- High Privacy: Keeps your personal, private, and sensitive information hidden from strangers, screen is only visible to persons directly in front of screen. Good choose when you are in the bus,elevator,metro or other public occasions. (Note: Due to this privacy cover will darken the image to prevent the peeking eyes near you, you might need to turn your device display brightness up a bit when use it.)
- Easiest Installation - Please watch our installation video tutorial before installation. Removing dust and aligning it properly with the help of the included installation frame before actual installation, enjoy your screen as if it wasn't there.
- 99.99% High-definition clear hydrophobic and oleophobic screen coating protects against sweat and oil residue from fingerprints, and enhance the visibility of the screen.
The roundup does not establish which product versions are affected. Kiteworks customers should check the relevant vendor advisories for affected versions and remediation guidance rather than assuming that a particular installation is vulnerable—or unaffected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Microsoft report describes a rise in several attack measures
SecurityWeek’s summary of Microsoft’s 2026 Digital Defense Report says the report covers July 2025 through June 2026. The figures below are Microsoft’s reported findings as summarized by SecurityWeek, not universal measures of all cyberattacks or organizations.
- Phishing rose from 7% to 23% of initial access vectors in Microsoft’s incident response cases.
- Teams voice-phishing, or vishing, climbed 502%.
- Enterprise ransomware detonations increased nearly 16%.
- Government agencies represented 27% of observed activity.
These figures describe different measures: the phishing figure is a share of initial access vectors in Microsoft incident response cases, while the others are reported changes or proportions in the report’s observed activity. They should not be read as direct estimates of the risk to every organization.
Best Value
- 【Industry-Leading 100% Anti-Spy Privacy Protection】Designed for iPhone 17 Pro Max. Larger iPhone screens are easier for others to glance at, so UltraGlass uses patented, SEGI-certified 25° Blackout-3 optical technology to help block side views and keep emails, banking apps, and private content visible only to you—while keeping the front view HD-clear and comfortable through hours of scrolling and streaming.
- 【Unbreakable TOP 9H+ Glass, the Excellent 2nd Screen for Your iPhone】Boasting unparalleled shatter resistance and durability. And the core excellence is the top 9H+ tempered glass material, which is widely applied in aerospace and military fields for its ① Shatter-proof ② Scratch & Wear Resistance ③ Durability that is 7-8 times higher than other materials. Thus, UltraGlass builds a second tough screen for your iPhone 17 Pro Max.
- 【Invisible Armor, 1:1 Full Covers the iPhone's Screen】Mimicking the iPhone's original screen design, it uses a 1:1 3D curved reinforced black edge that wraps around every curve — case friendly — while securing even the most vulnerable edges. Seamlessly blending with the iPhone 17 ProMax screen, it's virtually invisible and feels like the original screen while offering enhanced full-screen protection.
- 【0 Bubbles + 0 Dust + 0 Misaligned =100% Successful Installation】Includes everything you need with pioneering automatic positioning, dust removal, and absorption technology, making the installation just effortlessly easy in seconds. No bubbles, no troubles—transforming beginners into experts!
- Trusted Quality, Lifetime Support】Trusted by millions worldwide, UltraGlass comes with a Lifetime Warranty covering installation, fit, and accidental damage. Our 24/7 support team is ready to help with fast, 1-on-1 assistance.
AI-assisted Android security taskflows found issues, but still needed review
GitHub Security Lab reported that taskflows for its open-source AI security agent identified 24 Android vulnerabilities. Among the examples in SecurityWeek’s roundup, an OsmAnd issue could allow another installed app to change settings and expose location or routes; Wikipedia deeplink issues could be chained into account takeover.
The researchers also cautioned that the AI misjudged severity and produced unrealistic findings. The results illustrate both the potential of AI-assisted vulnerability discovery and its limit: findings still need expert validation before they can be treated as confirmed, exploitable vulnerabilities.
Two former U.S. Air Force members were sentenced in BEC cases
SecurityWeek reported that Chijioke Timothy Odimegwu and Harafat Mogaji, who were serving U.S. Air Force members at the time, were sentenced to 111 and 78 months, respectively. The reported case amounts included more than $1.68 million diverted from an Iowa victim and more than $720,000 from an Ohio victim, with combined restitution of $1.36 million. These are amounts tied to the reported cases, not an estimate of business email compromise losses overall.
Cloudflare patched a cross-customer container data exposure flaw
SecurityWeek reported that Cloudflare patched a flaw affecting Workers Paid customers that could let one customer recover leftover data from disk blocks previously used by other customers’ containers on the same host. Researchers found residual data in 18 of 24 placements they examined, but could not target a particular victim. Cloudflare said it found no evidence of malicious exploitation.
The 18-of-24 result describes the researchers’ observed placements, not the likelihood that any individual customer’s data was exposed. The inability to target a particular victim and Cloudflare’s statement about exploitation are important limits on what can be concluded from the finding.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
