Live · 9 November 2026
This week’s hacks.
Breaches, urgent updates and hacking tricks doing the rounds, and the one thing to do about each.
This week
4red
alerts
5orange
alerts
The quickest win
Turn on automatic updates.
Most hacks use flaws that already have a fix.
Red alertCISA, the US cyber agency, added it to its list of flaws used in real attacks on 13 October.
Update nowEverywhere
Install the latest Windows update
Do you use a Windows computer?
- What happened
- Hackers are already using a flaw in Windows that lets them run commands on a computer. Microsoft’s October update fixes it.
- Who’s affected
- Anyone with a Windows 10 or Windows 11 computer
- What to do
- Open Settings, then Windows Update, install everything and restart. Still on Windows 10? Its support has ended, so plan to upgrade.
Red alertPlex warned on 19 October the flaws are being widely used, after details went public on 16 October.
Update nowEverywhere
Update your Plex server now
Do you run a Plex server at home?
- What happened
- Hackers are widely breaking into Plex Media Servers that aren’t up to date. Plex says older ones open to the internet may be hacked.
- Who’s affected
- Anyone who runs Plex Media Server on a home computer or NAS
- What to do
- Update to version 1.43.3.10861 or newer. If yours was older, sign out of all devices and change your Plex password.
Red alertRevolve told US regulators on 29 October, so this is a fresh card breach.
Data breachUS
Revolve shoppers’ card details taken
Do you shop at Revolve?
- What happened
- Revolve says hackers got into its systems and may have taken some shoppers’ names, contact details, card numbers and expiry dates.
- Who’s affected
- Revolve shoppers who saved a payment card in their account
- What to do
- Check your card statements for charges you don’t know. Report any to your bank and ask for a new card.
Red alertESET says it’s a main way a busy password stealer called Amatera is spreading around the world.
Hacking trickEverywhere
Fake ‘I’m not a robot’ checks
A ‘prove you’re human’ page asks you to paste a command. Would you do it?
- What happened
- Fake ‘prove you’re human’ pages tell you to copy and paste a command. Doing it installs malware that steals passwords.
- Who’s affected
- Anyone who browses the web on a computer
- What to do
- Never paste anything a web page tells you to. A real ‘I’m not a robot’ check never asks you to run a command.
Orange alertOn 26 October Apple sent the fix to older models too, like the iPhone XS and XR.
Update nowEverywhere
Update your iPhone or iPad
Do you have an iPhone or iPad?
- What happened
- Apple fixed a flaw where a specially made file could run harmful code on your device. Apple says it may have been used in targeted attacks.
- Who’s affected
- Anyone with an iPhone or iPad that isn’t on the latest update
- What to do
- Open Settings, then General, then Software Update. Install what’s waiting, then restart.
Orange alertThe NCSC says scam messages can come long after a breach. ASOS says cards and passwords weren’t affected.
Data breachUK
ASOS hack exposed shoppers’ details
Do you have an ASOS account?
- What happened
- Hackers accessed ASOS customers’ names and contact details, and sent some customers an unauthorised alert through the ASOS app.
- Who’s affected
- Anyone with an ASOS account, even if you didn’t get the alert
- What to do
- Treat messages about ASOS with care, even weeks from now. Don’t tap links in app alerts, texts or emails.
Orange alertCustomers were told on 7 November. The company says cards, orders and passwords weren’t involved.
Data breachAustralia
Who Gives A Crap customer details exposed
Do you buy from Who Gives A Crap?
- What happened
- Hackers got into a marketing company that Who Gives A Crap uses and accessed customers’ names, emails, phone numbers and addresses.
- Who’s affected
- Who Gives A Crap customers in Australia, the UK and the US
- What to do
- Be wary of surprise emails, texts, calls or letters that claim to be from Who Gives A Crap. Check before you reply.
Orange alertESET warns the flood can be cover for fraud, and a fake tech support call may follow.
Hacking trickEverywhere
Inbox flooded with sign up emails
Your inbox floods with sign up emails, then ‘IT support’ calls to help. Would you let them?
- What happened
- Crooks sign your email up to hundreds of sites at once. The flood can bury a real alert, like a bank warning or password reset.
- Who’s affected
- Anyone with an email address
- What to do
- Look for real alerts from your bank or email provider before you clear the flood. Hang up on anyone offering to fix it.
Orange alertGoogle and partners shut the network down in late October. The back door is built in, so you can’t delete it.
Hacking trickEverywhere
TV boxes sold with a hidden back door
Do you use an Android TV box?
- What happened
- Google found a back door built into over 1.3 million Android TV boxes. Crooks used them for ad fraud and to hide their traffic.
- Who’s affected
- Anyone with an Android TV box, especially one from a little known brand
- What to do
- Only buy TV boxes from well known brands. Avoid apps that pay you to share your internet, and keep Play Protect on.
Is your password one of the leaked ones?
Check it in seconds. It never leaves your phone.
Check my password
Stay unscammable.
Get a weekly email with scam and hack stories you wouldn’t believe.