# data[].attributes.body
T-Mobile Cyber Team Physically Cuts Cable to Remove Chinese Hackers From Network

# data[].attributes.body
4 Outdated Cybersecurity Tips That No Longer Keep You Safe

# data[].attributes.attachment_link.readable_text
We may receive a commission on purchases made from links.
As cybercriminals evolve their attacks and new protection tools become more available, it's worth reevaluating your cybersecurity hygiene to enhance your digital safety. The idea can seem daunting, but you don't need to completely rethink your cybersecurity strategy. It just means that some security tips that were once touted as essential for online safety have become outdated. They're not completely useless, but on their own or when considering your digital needs, they're just not effective at keeping you safe anymore. Luckily, before cybersecurity experts declare these tips no longer effective, there's usually a solution.

For instance, changing passwords regularly is now considered riskier than just having one strong password. Since staying away from public Wi-Fi can be impractical at times, it's better to know the tools that can keep you safe when you can't avoid it completely. Also, with the rise of AI-powered malware, sticking to traditional antivirus software that doesn't use machine learning to combat it has become a security risk. While you don't need to be paranoid, knowing what works and what doesn't is key to ensuring that you don't fall victim to the ever-evolving tactics of cybercriminals.

Change your passwords regularly

On the surface, the advice to change your password regularly, usually within a period of 60 to 90 days, makes sense. If hackers steal your credentials, they're only useful to them for a limited time because after you change them, they immediately become outdated. That is theory, but in practice, human error can make this useful tip less effective, even though it has merit. Asking a human to change the dozens of passwords they have these days every few months is tedious. So what do they end up doing? Using a variation of the old password across several sites so that they can easily remember it. Hackers use tools (now they're AI-powered) to spot these patterns in your passwords. So if they figure out your old password, they will likely figure out the new one.

Rather than changing passwords regularly, it's best to use a password manager that allows you to generate strong, unique passwords for all your accounts. Even if you have no trouble creating strong passwords, you should still store them in the password manager so you can enter them securely. If the website has it, use multi-factor authentication (MFA). In particular, passwordless options like passkeys and security keys are not only more convenient but more secure since the authenticated session is tied to your device.

Stay away from public Wi-Fi

Public Wi-Fi networks, like the ones you find at airports, hotels, and restaurants, are risky. That isn't up for debate, but it's impractical to completely stay away. So in those instances where you have no choice but to use public Wi-Fi, you can find yourself without protection. On public Wi-Fi, hackers use Man-in-the-Middle (MitM) attacks, where they exploit the network's vulnerabilities to place themselves between you and the network. This can allow them to see data you're sending over the internet from an unsecured device. But if your device is secure, you need not fear public Wi-Fi.

You can use a VPN, which encrypts your data before sending it to a VPN server via a secure tunnel. The VPN server decrypts it and then sends it to its intended destination. If the hacker intercepts the data, the encryption makes it useless to them because only the VPN server can decrypt it. There are several VPN providers you can choose from, but you can also use browsers with free built-in VPNs like Firefox and Opera.

If you need to connect a device that can't natively install a VPN, like a Nintendo Switch 2, you can use a VPN router like the TP-Link ER605 V2. It encrypts the data of connected devices before sending it to the VPN server. You'll need to set up a VPN profile, though, using one from your VPN provider.

Traditional antiviruses are still all you need

Besides AI driving the global RAM shortage and leading to price hikes in consumer tech, it's also causing trouble in the field of cybersecurity in the form of adaptive malware. Its description might sound like science fiction, but the threat is real.

Adaptive malware uses machine learning to constantly evolve itself so it can avoid detection. One way it does this is by manipulating its code in real time (through integrated AI models), making it hard for antiviruses that rely on pattern recognition to identify it. It can also scan and assess the specific vulnerabilities of targeted devices before launching an attack in order to come up with a tailor-made exploit that has a high chance of avoiding detection.

Stopping this is beyond the capabilities of traditional antivirus software, which is why the likes of Bitdefender are also utilizing machine learning to combat these threats. Bitdefender is just one example, but many AI-powered antiviruses leverage the power of AI models to create defenses that are unique to your phone or computer. So if you're still using traditional antiviruses, know that we are past the age of traditional malware. They can offer little or no defense in the face of adaptive malware.

Two-factor authentication is enough protection

You are probably using two-factor authentication (2FA) to log into some very important online accounts. These can be your Google, Facebook, or PayPal accounts, where you first enter your password and then have a code sent to your phone either as a text message or a push notification or you grab it from an authenticator app. It's one of the more secure methods because it eliminates the need to solely rely on a password, adding an extra layer of protection that forces a cybercriminal to resort to tactics like phishing. However, two-factor authentication is no longer as safe as it used to be - hackers don't need to trick you into providing them with the 2FA code.

Basically, they trick you into signing into the website. The moment you do, your browser stores information about the login in data files called session cookies. It does this so that you automatically log in to the website without needing authentication. This is what cybercriminals are now stealing to access your accounts and steal your information, including passwords, addresses, phone numbers, credit card details, and private messages, without needing to go through 2FA. Instead of relying solely on 2FA, you can try passkeys and security keys, as these are stored on the device and have a better chance of protecting against unauthorized access.

# data[].attributes.attachment_link.title
4 Outdated Cybersecurity Tips That No Longer Keep You Safe - BGR

# data[].attributes.attachment_link.description
Technology is evolving at a rapid rate, and so are digital threats. Cybersecurity tips like changing passwords regularly and using 2FA are no longer effective.

# data[].attributes.body
20 Cool New AI And Security Products At Black Hat 2026

# data[].attributes.attachment_link.title
20 Cool New AI And Security Products At Black Hat 2026

# data[].attributes.attachment_link.description
Cool new AI and security products announced at Black Hat 2026 include AI-powered cybersecurity tools from vendors including Palo Alto Networks, SentinelOne and Abnormal AI.

# data[].attributes.body
Microsoft touts cost-saving AI model for cybersecurity

# data[].attributes.attachment_link.title
Microsoft touts cost-saving AI model for cybersecurity

# data[].attributes.attachment_link.description
Microsoft says that when integrated with OpenAI’s GPT-5.4, its new cybersecurity model can beat Anthropic’s new Mythos 5.

# data[].attributes.body
Quantum Computing Stocks Drop 35% as Federal Mandate Reshapes Investment Case

# data[].attributes.attachment_link.title
Quantum Computing Stocks Drop 35% as Federal Mandate Reshapes Investment Case

# data[].attributes.attachment_link.description
Quantum computing stocks dropped 35% from their post-signing peak after Trump signed two June 22 executive orders — the same ones that sent IonQ, D-Wave, and Rigetti surging. The pullback reflects valuation reality: federal mandates set binding post-quantum cryptography deadlines for 2030 and 2031

# data[].attributes.body
These 5 Routers Are No Longer Safe To Use After A New Security Backdoor Was Discovered

# data[].attributes.attachment_link.title
These 5 Routers Are No Longer Safe To Use After A New Security Backdoor Was Discovered - BGR

# data[].attributes.attachment_link.description
There are five Tenda Wi-Fi routers that have a hidden backdoor in their firmware that grants full administrative control to the router’s web interface.

# data[].attributes.attachment_link.readable_text
Mozilla/5.0 (compatible; Embedly/0.2; +http://support.embed.ly/)

WARNING: Windows93 is not tested on your browser.

Use latest Firefox or Chromium for a better experience !

BIOS ROM checksum error You need JavaScript to run Windows93

BOOT IS TAKING TOO LONG ?

# data[].attributes.body
KittySploit – AI-Powered Next-Generation Penetration Testing Framework With 1150+ Modules

# data[].attributes.attachment_link.readable_text
KittySploit is a new open-source penetration testing framework that combines a Python and Zig codebase with autonomous AI agents, shipping with over 1,150 modules for offensive security teams.

The tool chain includes reconnaissance, exploitation, traffic analysis, payload generation, collaboration, and post-exploitation workflows.

KittySploit's core difference is its integration of local large language models via Ollama, which allows AI agents to autonomously plan attack paths after being fed just a target name.

This autonomous agent handles reconnaissance and suggests exploitation strategies without constant manual input, a capability that aligns with the broader industry shift toward AI-driven pentesting agents seen in tools like PentAGI and xOffense.

KittySploit Penetration Testing Tool

The framework's headline capability is its autonomous agent. Operators can provide a target and connect KittySploit to a locally hosted large language model through Ollama.

The agent is intended to organize reconnaissance findings, evaluate available modules, and propose possible attack paths without sending sensitive engagement data to a hosted AI service.

Recent code changes show a default local Ollama endpoint and add planning, response caching, workflow, and HTTP-intelligence components, indicating that the AI layer extends beyond a simple chatbot interface.

The framework's payloads are compiled using an integrated Zig 0.16 toolchain, producing stealthy, dependency-free x64 polymorphic encoders designed to bypass modern EDR and WAF defenses.

This evasion-first approach, combined with multi-protocol session handling and native Tor routing, positions KittySploit against automated defense systems that have made traditional exploitation frameworks less effective.

Compared to legacy tools written in Ruby or Java, this modern Python/Zig hybrid core is built for speed and stealth in contemporary web environments.

A standout feature is KittyProxy, an intelligent web proxy that auto-discovers REST APIs, GraphQL endpoints, and WebSocket connections, then automatically runs relevant exploitation modules directly from observed traffic.

This "smart proxy" capability removes manual mapping steps that typically slow down assessments of modern web architectures, addressing a gap that many legacy scanners still struggle to close.

KittySploit ships with KittyCollab, a real-time shared editor for team-based operations, alongside a modern web UI for both proxy analysis and collaborative workflows.

The framework also includes a community-driven marketplace where users can install or share new modules, an ecosystem feature notably not available in Metasploit and Cobalt Strike.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

# data[].attributes.attachment_link.title
KittySploit - AI-Powered Next-Generation Penetration Testing Framework With 1150+ Modules

# data[].attributes.attachment_link.description
KittySploit is a new open-source penetration testing framework that combines a Python and Zig codebase with autonomous AI agents, ship­ping with over 1,150 modules for offensive security teams.

# data[].attributes.body
How a Stranger Used One Text Message to Steal My Entire Digital Life

# data[].attributes.attachment_link.title
How a Stranger Used One Text Message to Steal My Entire Digital Life

# data[].attributes.attachment_link.description
“He read my entire Social Security number and my date of birth back to me. That was the moment I knew my identity had been stolen.”

# data[].attributes.attachment_link.title
CTF Platform – Organize Capture The Flag events with Hacking-Lab

# data[].attributes.attachment_link.description
Unlock the power of Hacking-Lab: organize engaging Capture The Flag (CTF) events for teams, students, and exhibitions. Foster teamwork, skill development, and fun in cyber security through our hands-on challenges. Join us and revolutionize your approach to cyber defence today!

# data[].attributes.attachment_link.title
15 Best Cybersecurity Labs: Free & Paid Compared (2026)

# data[].attributes.attachment_link.description
Compare 15 cybersecurity labs for hands-on hacking practice, from free beginner platforms to advanced pentest ranges. Find your fit and start practicing.

# data[].attributes.body
https://hackerdna.com/blog/cybersecurity-labs

# data[].attributes.attachment_link.title
15 Best Cybersecurity Labs: Free & Paid Compared (2026)

# data[].attributes.attachment_link.description
Compare 15 cybersecurity labs for hands-on hacking practice, from free beginner platforms to advanced pentest ranges. Find your fit and start practicing.

# data[].attributes.body
https://www.cisa.gov/topics/cybersecurity-best-practices

# data[].attributes.attachment_link.readable_text
Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

# data[].attributes.attachment_link.description
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock (Lock A locked padlock ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

# data[].attributes.body
https://labex.io/free-labs/cybersecurity

# data[].attributes.attachment_link.title
Learn to Code with AI and Hands-On Labs | LabEx

# data[].attributes.attachment_link.description
Learn technical skills with AI and interactive hands-on labs. The AI assistant powered by ChatGPT can help you get unstuck and level up skills quickly while practicing in the in-browser environment.

# data[].attributes.attachment_link.description
OpenStego is a steganography application that provides two functionalities: a) Data Hiding: It can hide any data within an image file. b) Watermarking: Watermarking image files with an invisible si…

# data[].attributes.attachment_link.title
1.1M views · 13K reactions | Laptop Setup Guide for Hackers #infosec | Hacker339

# data[].attributes.attachment_link.readable_text
Snort is the foremost Open Source Intrusion Prevention System (IPS) in the world. Snort IPS uses a series of rules that help define malicious network activity and uses those rules to find packets that match against them and generates alerts for users.

Snort can be deployed inline to stop these packets, as well. Snort has three primary uses: As a packet sniffer like tcpdump, as a packet logger - which is useful for network traffic debugging, or it can be used as a full-blown network intrusion prevention system. Snort can be downloaded and configured for personal and business use alike.

What are my options for buying and using Snort?

Once downloaded and configured, Snort rules are distributed in two sets: The "Community Ruleset" and the "Snort Subscriber Ruleset."

The Snort Subscriber Ruleset is developed, tested, and approved by Cisco Talos. Subscribers to the Snort Subscriber Ruleset will receive the ruleset in real-time as they are released to Cisco customers. You can download the rules and deploy them in your network through the Snort.org website. The Community Ruleset is developed by the Snort community and QAed by Cisco Talos. It is freely available to all users.

For more information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

# data[].attributes.attachment_link.title
Snort - Network Intrusion Detection & Prevention System

# data[].attributes.attachment_link.description
Snort is an open-source, free and lightweight network intrusion detection system (NIDS) software for Linux and Windows to detect emerging threats.

# data[].attributes.attachment_link.description
Wireshark: The world's most popular network protocol analyzer

# data[].attributes.body
CISA warns of cyberattacks targeting fuel tank monitoring systems

# data[].attributes.attachment_link.title
CISA warns of cyberattacks targeting fuel tank monitoring systems

# data[].attributes.attachment_link.description
CISA, the FBI, the NSA, the Department of Energy, and other US government partners are warning that hackers are targeting internet-exposed automatic tank gauge (ATG) systems used to monitor fuel and liquid storage tanks across various critical infrastructure sectors.

# data[].attributes.body
Scammers Are Using Your Real Hotel Reservations to Trick You With Spear-Phishing Attacks

# data[].attributes.attachment_link.title
Scammers Are Using Your Real Hotel Reservations to Trick You With Spear-Phishing Attacks

# data[].attributes.attachment_link.description
Customer data from more than 350 hotels around the world may have been accessed as part of realistic reservation-hijacking scams.

# data[].attributes.body
Microsoft BitLocker-protected drives can now be opened with just some files on a USB stick — YellowKey zero-day exploit demonstrates an apparent backdoor

# data[].attributes.attachment_link.title
Microsoft BitLocker-protected drives can now be opened with just some files on a USB stick — YellowKey zero-day exploit demonstrates an apparent backdoor

# data[].attributes.attachment_link.description
Also, it’s a twofer with the GreenPlasma zero-day local privilege escalation.

# data[].attributes.body
73 Seconds to Breach, 24 Hours to Patch: The Case for Autonomous Validation

# data[].attributes.attachment_link.readable_text
By Sila Ozeren Hacioglu, Security Research Engineer at Picus Security.
In April 2026, Anthropic released its newest frontier model, codename Mythos, to twelve partners under a gated preview. Not general availability; the company explicitly held it back as it was (correctly) deemed too dangerous for open release.

In its first 14 days inside that sandbox, it wrote 181 working Firefox exploits. The previous state-of-the-art model managed two. Uh oh.

It surfaced thousands of zero-days across every major OS and browser, including a 27-year-old bug in OpenBSD, an operating system whose entire reputation is built on not having bugs like this.

Over 99% of what Mythos found is still unpatched in production today.

That's not a forecast. That happened.

Now pair it with what's already in the wild.

Let's back up a bit. In February, AWS Threat Intelligence published a postmortem on a FortiGate campaign run by a single operator. One person, low skill, no hands on keyboard.

The AI did the work, and it hit 2,516 devices across 106 countries in parallel, taking just minutes per target. Zero days weren't required. Known CVEs and misconfigurations were enough; the AI simply operated faster than anyone could respond.

Figure 1. AWS Threat Intelligence FortiGate campaign hits 2,516 devices in 106 countries

Two data points, one message: offense now runs at machine speed. And the question every defender should be asking is, not "are we compliant?" or "are we covered?" It's more granular, and more pressing:

" What's actually getting through my controls today, and how far? "

If the honest answer involves a quarterly pentest report and some dashboard screenshots, consider the rest of this piece required reading.

How Fast Can Attackers Exploit a Published CVE in 2026?

A decade ago, the median time from a CVE's publication to a working exploit appearing in the wild was measured in months, long enough for a real patch cycle. By 2024, that window had shrunk to about 56 days. By 2025, it was down to 23 days.

Recent CVE-to-exploit pairings from CISA KEV, VulnCheck KEV, and exploit databases now show a median delta of roughly 10 hours.

Figure 2. Average CVE-to-exploit window: 2.3 years (2018) vs. ~10 hours (2026).

Reversing a published fix into a working exploit is no longer a specialist craft; it's now a prompt.

This means that the comfortable assumptions of vulnerability management, that CVSS scores meaningfully prioritize, that "exploitability" is a useful filter, that you have time between disclosure and weaponization, have all quietly broken.

The safer working assumption is now: every vulnerability has an exploit, or will, before you finish your next change-management meeting.

Unfortunately, autoimmunity for defense doesn't exist yet.

And blue side AI without validation is just guesswork at machine speed, and that's an expensive hunch to deploy into production.

Download Now

The Real Bottleneck Isn't Tooling - It's the Spaghetti Handoff
Let's start with the attacker first.
At second zero, the AI script kicks off. By second five, a CVE is exploited. MFA bypassed by twenty. Web shell dropped at thirty. Credentials dumped at forty-five. By second seventy-three, the compromise is complete.

No human in the loop, no hesitation, no team meetings, no coffee breaks.
Now picture the defender.
The SIEM alert fires at one minute, after the attacker is already done. A Tier 1 analyst picks it up around minute five. Someone triggers a SOAR playbook, by hand, at minute fifteen. A Jira ticket gets filed an hour in. Four hours later, it lands in the IT ops' queue.

The patch goes out the next day, twenty-four hours after the breach that took seventy-three seconds to complete.

Figure 3. The agility gap: AI compromise (73s) vs. patching (24h) due to cross-team friction.

Notice where the time goes. It isn't inside any one tool. The EDR is fast. The SIEM is fast. The vulnerability scanner is fast. The time dies between the tools: the Slack messages, the copy-pasted hash, the PDF report emailed for review, the ticket waiting for approval, the red team script being rebuilt by hand for the blue team.

This is the spaghetti handoff, and it's as messy as it sounds.

You can buy a faster scanner, plug in a smarter EDR, even bolt an LLM onto your SIEM, and none of them will markedly speed up your response, because the gap isn't inside any of your tools. It lives between teams and between systems. Accelerating one node in a graph doesn't accelerate the graph.

This is a big part of why this conversation has moved out of the CISO's office.

Six months ago, AI-driven cyber risk was a technical problem to delegate. Today, boards are treating it as existential and governing it directly. Budgets are unlocked, but not for 'more of the same.' They're funding credible, evidence-based plans.

What Are the Three Pillars of Cyber Resilience in the Age of AI-Powered Attacks

The fundamentals that made organizations resilient before Mythos still apply. There are three.:

Pillar 1: Identify. You can't defend what you can't see. Even with comprehensive exposure visibility across network, endpoint, cloud, and identity, and aggressive attack surface management, the blind spots (orphaned remote access, missing segmentation, MFA gaps) are where machine-speed attackers live.

Pillar 2: Protect. Effective network and endpoint controls, properly tuned. Tailored detection focused on credential access, lateral movement and privilege escalation rather than generic vendor rules.

Pillar 3: Validate. This is the one most programs undervalue, and it's the one that actually answers the question we started with. Validation has two halves, and yes, you need both.

Defensive validation - Breach and Attack Simulation (BAS). Are my prevention and detection controls actually catching what's hitting me right now? Which assets do my controls fail to protect? What's the residual risk after my stack runs?

Offensive validation - Autonomous Pentesting. Can an attacker actually breach us? Which exposures chain together into a real path to our crown jewels? What's truly exploitable in our environment, not just theoretically vulnerable?

Figure 4. BAS and Automated Penetration Testing Together

Run only BAS, and you'll know your controls work in isolation but not whether an attacker can route around them. Run only autonomous pentesting, and you'll find attack paths but won't know which controls are silently failing on the assets the pentest never touched. Run them as one continuous loop, where each informs the other, and you'll finally have an answer to "what gets through, and how far" that's grounded in evidence rather than hypothetical opinion.

But evidence isn't enough on its own. When offense runs at machine speed, the loop itself has to run at machine speed.

How Picus Approaches Autonomous Validation in a Post-Mythos World

A continuous loop is the right answer. But "continuous" still implies a human pacing it. In a post-Mythos world, the gap that matters isn't between seeing and detecting; it's between detecting and proving, fast enough that an AI-driven adversary doesn't find out for you first.

That's where validation goes from continuous to autonomous: agents reading the alert, scoping the test, running the simulation, pushing the fix, and writing the report, while the SOC catches up on some much-needed sleep.

We'll be unpacking exactly what that looks like (the architecture, the agentic workflows, the operational reality of running it inside a real enterprise) at the Autonomous Validation Summit on May 12 & 14, hosted with Frost & Sullivan and featuring practitioners from Kraft Heinz and Glow Financial Services, alongside PicusCTO, Volkan Erturk.
>> See it in action at the summit. Sponsored and written by Picus Security.

# data[].attributes.attachment_link.title
73 Seconds to Breach, 24 Hours to Patch: The Case for Autonomous Validation

# data[].attributes.attachment_link.description
Attackers can compromise systems in minutes while patching and response still take hours or days. Picus Security breaks down why autonomous validation is becoming critical for modern defense strategies.

# data[].attributes.attachment_link.title
The FBI is aware of a service disruption affecting an online Learning Management System (LMS). This disruption has impacted schools, educational institutions, and students across the country. If… | FBI Cyber Division

# data[].attributes.attachment_link.description
The FBI is aware of a service disruption affecting an online Learning Management System (LMS). This disruption has impacted schools, educational institutions, and students across the country. If you are contacted directly by anyone claiming to have your data, we recommend you not send payment or respond to their demands. By receiving a message, that does not necessarily mean your personal information has been compromised. Threat actors often exaggerate or fabricate their access to sensitive or personal information to prompt payment from victims. We encourage individuals to be cautious of unsolicited emails, calls, or texts claiming to be from your school, the LMS provider, or law enforcement and to verify the contact through known channels before responding. We understand that the immediate concern for individuals/students is determining what, if any, of their data or other sensitive information may have been exposed. At this time, the strongly recommended course is to await formal guidance from your educational institution regarding the scope of the incident and the nature of any affected data. If you believe you have been impacted by the attack, please file a complaint at ic3.gov. All crimes can have a devastating effect on those who have been impacted, as well as their families who may need help coping with what happened. Visit fbi.gov for more resources on coping with the impact of crime: ⚫ https://lnkd.in/e6XErs2F ⚫ https://lnkd.in/e8BwCnqh

# data[].attributes.body
Canvas is back online, but questions — and final exam disruptions — linger

# data[].attributes.attachment_link.title
Canvas is back online, but questions — and final exam disruptions — linger

# data[].attributes.attachment_link.description
Some schools are warning users not to log back into Canvas yet, after a ransomware group claimed credit for a data breach. Half of North America’s higher education institutions use the platform.

# data[].attributes.body
Canvas Online Learning Platform Shut Down for Hours After Cyberattack

# data[].attributes.body
Edu tech firm Instructure discloses cyber incident, probes impact

# data[].attributes.attachment_link.title
Edu tech firm Instructure discloses cyber incident, probes impact

# data[].attributes.attachment_link.description
Instructure, the company behind the widely used Canvas learning platform, has disclosed that it recently suffered a cybersecurity incident and is now investigating its impact.

# data[].attributes.body
Module 18: Cryptography

# data[].attributes.attachment_link.readable_text
English | Español

Introduction

Welcome to the homepage of OpenStego, the free steganography solution.

OpenStego provides two main functionalities:

Data Hiding: It can hide any data within a cover file (e.g. images).

Watermarking (beta): Watermarking files (e.g. images) with an invisible signature. It can be used to detect unauthorized file copying.

Please see Concepts page to learn more.

Using OpenStego

Using OpenStego is pretty straightforward. There are two modes of operation - data hiding and watermarking.

Data Hiding

In this mode, you can either hide the data (file) inside an image or extract the data from the image. Check screenshots below to see how it can be done:

Hide data

Extract data

Watermarking (beta)

In this mode, you can watermark / verify images with your signature. First you need to generate signature file, and then it can be used to watermark images or verify the same later. Check screenshots below to see how it can be done:

Generate signature

Embed watermark

Verify watermark

# data[].attributes.attachment_link.description
English | Español Welcome to the homepage of OpenStego, the free steganography solution. OpenStego provides two main functionalities: Data Hiding: It can hide any data within a cover file (e.g. images). Watermarking (beta): Watermarking files (e.g. images) with an invisible signature. It can be used to detect unauthorized file copying.

# data[].attributes.body
Researcher uses quantum computer to crack key that protects Bitcoin

# data[].attributes.attachment_link.provider_name
TheStreet Crypto: Bitcoin and cryptocurrency news, advice, analysis and more

# data[].attributes.attachment_link.readable_text
The theoretical threat that quantum computers pose to the Bitcoin network moved a step closer to reality on Friday. Project Eleven, a startup focused on quantum security, awarded its "Q-Day Prize" to an independent researcher named Giancarlo Lelli.

The award follows the largest public demonstration of a quantum attack on the "elliptic curve" cryptography that currently secures over $2.5 trillion in digital assets, including Bitcoin and Ethereum.

Lelli successfully broke a 15-bit encryption key using publicly available quantum hardware. In simple terms, he used a variant of Shor's algorithm to find a secret "private key" using only its public counterpart.

While this is supposed to be impossible for traditional computers, Lelli found the answer across a search space of 32,767 possibilities.

A rapid increase in difficulty

While Bitcoin operates at a much higher 256-bit scale, the speed of progress is accelerating. Lelli's achievement represents a 512-fold jump in difficulty compared to the previous record set just seven months ago in September 2025, when Steve Tippeconnic cracked a 6-bit key.

Most notably, the winning entry did not come from a national laboratory or a private supercomputer. Instead, it was completed by an independent researcher using cloud-accessible hardware that anyone can rent.

Project Eleven CEO Alex Pruden highlighted that the winning entry did not come from a government laboratory, but from an independent researcher using cloud-based hardware.

"The resource requirements for this type of attack keep dropping, and the barrier to running it in practice is dropping with them," Pruden noted.

He added that with Google recently committing to being quantum-secure by 2029, the window for the rest of the industry to upgrade its security is closing.

Popular on TheStreet Roundtable:

Millions of Bitcoin in the crosshairs

The risk is most acute for older "static" wallets that have already revealed their public keys on the blockchain.

Project Eleven estimates that roughly 6.9 million Bitcoin-nearly one-third of the entire supply-sit in these vulnerable addresses. This includes the legendary 1 million Bitcoin held by the creator of the network, Satoshi Nakamoto, which have remained untouched since the early years of the project.

As the capabilities of quantum hardware grow, developers across the industry are racing to build "post-quantum" defenses. A new proposal for the Bitcoin network, known as BIP-360, aims to introduce safer address types that can resist these emerging machines.

Other major blockchain platforms, including Ethereum, Ripple, and Tron, have also begun publishing their own transition plans to ensure their networks remain secure in the coming years.

# data[].attributes.attachment_link.title
Researcher uses quantum computer to crack key that protects Bitcoin

# data[].attributes.attachment_link.description
Giancarlo Lelli wins one Bitcoin for record quantum security attack.

# data[].attributes.body
Contrary to popular superstition, AES 128 is just fine in a post-quantum world

# data[].attributes.attachment_link.title
Contrary to popular superstition, AES 128 is just fine in a post-quantum world

# data[].attributes.attachment_link.description
A stubborn misconception is hampering the already hard work of quantum readiness.

# data[].attributes.body
Quantum Computers Are Not A Threat To 128-bit Symmetric Keys

# data[].attributes.attachment_link.title
Quantum Computers Are Not A Threat To 128-bit Symmetric Keys

# data[].attributes.attachment_link.description
A lot has been made about a post-quantum computer future in which traditional encryption methods have suddenly been rendered obsolete. With this terrifying idea in mind, it’s reassuring to se…

# data[].attributes.attachment_link.description
A 3D WebGL map of Hurricane Electric's backbone network, global submarine cables and global data-centers.

# data[].attributes.attachment_link.title
2.1M views · 13K reactions | How Quantum Computers Break Modern Encryption... | Veritasium

# data[].attributes.attachment_link.description
How Quantum Computers Break Modern Encryption…

# data[].attributes.body
Firewalls, Cryptography, and Cloud Security (4)

Module 18: Cryptography

# data[].attributes.attachment_link.description
CrypTool 1 (CT1) is an open-source Windows program for cryptography and cryptanalysis. It's the most wide-spreaded e-learning software of its kind. CrypTool 2 (CT2) is an open-source program offering an innovative visual programming GUI to experiment with cryptographic procedures and to animate their cascades.

# data[].attributes.body
Firewalls, Cryptography, and Cloud Security (4)

Module 18: Cryptography

# data[].attributes.attachment_link.description
JCrypTool (JCT) is a modern program that allows you to apply and analyze cryptographic algorithms

# data[].attributes.body
Firewalls, Cryptography, and Cloud Security (4)

Module 18: Cryptography

# data[].attributes.attachment_link.readable_text
Welcome to OpenSSL!

The OpenSSL Project develops and maintains the OpenSSL software - a robust, commercial-grade, full-featured toolkit for general-purpose cryptography and secure communication. The project's technical decision making is managed by the OpenSSL Technical Committee (OTC) and the project governance is managed by the OpenSSL Management Committee (OMC). The project operates under formal Bylaws.

For more information about the team and community around the project, or to start making your own contributions, start with the community page. To get the latest news, download the source, and so on, please see the sidebar or the buttons at the top of every page.

OpenSSL is licensed under an Apache-style license, which basically means that you are free to get and use it for commercial and non-commercial purposes subject to some simple license conditions.

For a list of vulnerabilities, and the releases in which they were found and fixes, see our Vulnerabilities page.

Latest News

Legalities

Please remember that export/import and/or use of strong cryptography software, providing cryptography hooks, or even just communicating technical details about cryptography software is illegal in some parts of the world. So when you import this package to your country, re-distribute it from there or even just email technical suggestions or even source patches to the authors or other people you are strongly advised to pay close attention to any laws or regulations which apply to you. The authors of OpenSSL are not liable for any violations you make here. So be careful, it is your responsibility.

# data[].attributes.attachment_link.description
The OpenSSL Project develops and maintains the OpenSSL software - a robust, commercial-grade, full-featured toolkit for general-purpose cryptography and secure communication. The project’s technical decision making is managed by the OpenSSL Technical Committee (OTC) and the project governance is man…

# data[].attributes.body
Firewalls, Cryptography, and Cloud Security (4)

Module 18: Cryptography

# data[].attributes.attachment_link.readable_text
7-Zip is a file archiver with a high compression ratio.

Download 7-Zip 23.01 (2023-06-20) for Windows:

License

7-Zip is free software with open source. The most of the code is under the GNU LGPL license. Some parts of the code are under the BSD 3-clause License. Also there is unRAR license restriction for some parts of the code. Read 7-Zip License information.

You can use 7-Zip on any computer, including a computer in a commercial organization. You don't need to register or pay for 7-Zip.

The main features of 7-Zip

High compression ratio in 7z format with LZMA and LZMA2 compression

Supported formats:

Packing / unpacking: 7z, XZ, BZIP2, GZIP, TAR, ZIP and WIM

Unpacking only: APFS, AR, ARJ, CAB, CHM, CPIO, CramFS, DMG, EXT, FAT, GPT, HFS, IHEX, ISO, LZH, LZMA, MBR, MSI, NSIS, NTFS, QCOW2, RAR, RPM, SquashFS, UDF, UEFI, VDI, VHD, VHDX, VMDK, XAR and Z.

For ZIP and GZIP formats, 7-Zip provides a compression ratio that is 2-10 % better than the ratio provided by PKZip and WinZip

Strong AES-256 encryption in 7z and ZIP formats

Self-extracting capability for 7z format

Integration with Windows Shell

Powerful File Manager

Powerful command line version

Plugin for FAR Manager

Localizations for 87 languages

7-Zip works in Windows 11 / 10 / 8 / 7 / Vista / XP / 2022 / 2019 / 2016 / 2012 / 2008 / 2003 / 2000.

p7zip - the port of the command line version of 7-Zip to Linux/Posix.

On 7-Zip's SourceForge Page you can find a forum, bug reports, and feature request systems.

Compression ratio

We compared 7-Zip with WinRAR 5.20.

FILE SETS: Mozilla Firefox 34.0.5 for Windows and Google Earth 6.2.2.6613 for Windows.

Compression ratio results are very dependent upon the data used for the tests. Usually, 7-Zip compresses to 7z format 30-70% better than to zip format. And 7-Zip compresses to zip format 2-10% better than most of other zip compatible programs.

# data[].attributes.attachment_link.description
7-Zip is a file archiver with a high compression ratio. Download 7-Zip 23.01 (2023-06-20) for Windows: 7-Zip is free software with open source. The most of the code is under the GNU LGPL license. Some parts of the code are under the BSD 3-clause License.

# data[].attributes.body
Firewalls, Cryptography, and Cloud Security (4)

Module 18: Cryptography

# data[].attributes.attachment_link.provider_name
QuickHash GUI | Cross-platform graphical data hashing tool for Windows, Linux and Apple Max OSX

# data[].attributes.attachment_link.readable_text
QuickHash-GUI is an open-source graphical interface data hashing tool for Linux, Windows, and Apple Mac OSX. Originally designed for Linux, but also available for Windows and Apple Mac OSX.

Hash algorithms currently available :

# data[].attributes.attachment_link.title
Quickhash-GUI - free, cross platform data hashing tool

# data[].attributes.attachment_link.description
The homepage of Quickhash-GUI. The free, cross platform, data hashing tool of text, files and other data for Windows, Linux and Apple Mac OSX

# data[].attributes.attachment_link.title
Mythos and Cybersecurity - Schneier on Security

# data[].attributes.attachment_link.description
Last week, Anthropic pulled back the curtain on Claude Mythos Preview, an AI model so capable at finding and exploiting software vulnerabilities that the company decided it was too dangerous to release to the public. Instead, access has been restricted to roughly 50 organizations—Microsoft, Apple, Amazon Web Services, CrowdStrike and other vendors of critical infrastructure—under an initiative called Project Glasswing. The announcement was accompanied by a barrage of hair-raising anecdotes: thousands of vulnerabilities uncovered across every major…

# data[].attributes.body
Anthropic launches Project Glasswing, an effort to prevent AI cyberattacks with AI

# data[].attributes.attachment_link.title
Anthropic launches Project Glasswing, an effort to prevent AI cyberattacks with AI

# data[].attributes.attachment_link.description
Anthropic has announced a new initiative called Project Glasswing that aims “to secure the world’s most critical software” against AI-powered attacks.

# data[].attributes.attachment_link.title
25 Best Intrusion Detection & Prevention Systems (IDS &IPS) In 2026

# data[].attributes.attachment_link.description
Best Intrusion Detection & Prevention Systems: 1. Snort 2. BluVector Cortex 3. Cynet 4. Check Point Quantum IPS 5. Cisco NGIPS 6. Fail2Ban

# data[].attributes.attachment_link.title
19K views · 232 reactions | Top 5 Google Dorks Every Ethical Hacker Should Know. Learn how security researchers find exposed files, login pages, and directories using Google search techniques. This is a beginner friendly cyber security tip for students learning ethical hacking. Follow Axximum Infosolutions for more hacking tools, commands, and cyber security labs. Comment what topic you want next and we will create a post for you. #EthicalHacking
#GoogleDorks
#CyberSecurity
#BugBounty
#HackingTools
#CyberSecurityTips
#KaliLinux
#InfoSec
#EthicalHacker
#CyberSecurityLearning
#Hackers
#PenetrationTesting
#CyberSecurityAwareness
#TechLearning
#AxximumInfosolutions | Axximum Infosolutions PVT LTD

# data[].attributes.attachment_link.description
Top 5 Google Dorks Every Ethical Hacker Should Know. Learn how security researchers find exposed files, login pages, and directories using Google search techniques. This is a beginner friendly…

# data[].attributes.attachment_link.title
Top 10 Metasploit Commands Every Hacker Should Know 🔐 If you are learning ethical hacking or cybersecurity, these commands will help you understand how Metasploit works. Save this post so you can practice later. Comment below what topic you want to learn next and we will create a post on that topic and tag you. Follow Axximum Infosolutions for more cybersecurity learning content. #ethicalhacking
#metasploit
#cybersecurity
#hackingtutorial
#kalilinux
#cybersecuritytips
#penetrationtesting
#hackinglearning
#bugbounty
#infosec
#ethicalhacker
#learnhacking
#cybersecurityawareness
#hackingtools
#linuxcommands | Axximum Infosolutions PVT LTD | Facebook

# data[].attributes.attachment_link.description
Top 10 Metasploit Commands Every Hacker Should Know 🔐 If you are learning ethical hacking or cybersecurity, these commands will help you understand how Metasploit works. Save this post so you can…

# data[].attributes.attachment_link.title
76K views · 687 reactions | 🔥 50 Linux Networking Commands Every Hacker Should Know If you want to learn Cybersecurity, Ethical Hacking, Linux and Networking, these commands are essential. Save this post for learning later. Follow @AxximumInfosolutions for more hacking and cybersecurity content. 💬 Comment what you want to learn next.
We will create a post and tag you. #linuxcommands
#linuxnetworking
#ethicalhacking
#cybersecurity
#kalilinux
#networking
#hackertools
#programminglife
#bugbounty
#ethicalhacker
#linuxlearning
#networksecurity
#hackingtools
#cybersecuritytips
#infosec
#techlearning
#computernetwork
#cybertraining
#linuxskills
#learnlinux | Axximum Infosolutions PVT LTD

# data[].attributes.attachment_link.description
🔥 50 Linux Networking Commands Every Hacker Should Know If you want to learn Cybersecurity, Ethical Hacking, Linux and Networking, these commands are essential. Save this post for learning later.…

# data[].attributes.body
Experts say turning off your smartphone nightly for 5 minutes could drastically cut your hacking risk

# data[].attributes.attachment_link.title
Experts say turning off your smartphone nightly for 5 minutes could drastically cut your hacking risk - Talk Android

# data[].attributes.attachment_link.description
Looking for a quick, straightforward way to lower your risk of smartphone hacking? It's easier than you might think: simply turn off your device for at least

# data[].attributes.body
FBI Warns iPhone And Android Users—Do Not Install These Apps

# data[].attributes.attachment_link.title
FBI Warns iPhone And Android Users-Do Not Install These Apps

# data[].attributes.attachment_link.description
Check your smartphone now - these apps are dangerous and should be deleted.

# data[].attributes.attachment_link.title
454K views · 9.2K reactions | How Hackers Hack Wi-Fi In Seconds
YouTube @PrivacyMatters517
#cybersecurity #ethicalhacking #networkingwithisrar #everyone #LearnNetworking #personalgrowth #positivevibes #SecureAPIs #FutureOfCyber #BackendEngineering https://youtu.be/O2QMZesSzfs?si=Uddgr7vOca2_-gac | CodeHub

# data[].attributes.attachment_link.title
244K views · 5.1K reactions | Metasploit For Beginners - How To Scan And Pwn A Computer Credit: @mr.hackloi ( loi liang yang) | The Cyber Bite

# data[].attributes.attachment_link.description
Metasploit For Beginners - How To Scan And Pwn A Computer Credit: @mr.hackloi ( loi liang yang)

# data[].attributes.attachment_link.title
24K views · 219 reactions | 25 Wireshark Commands Every Ethical Hacker Should Know Learn how to analyze network packets like a cybersecurity expert. Wireshark is one of the most powerful tools used in ethical hacking, network analysis, and security investigation. Save this reel to learn these commands later. Follow Axximum Infosolutions for daily cyber security tips. Comment the next tool you want to learn.
We will create a post and tag you. #ethicalhacking
#cybersecurity
#wireshark
#hackertools
#networksecurity
#cybersecuritytips
#ethicalhacker
#cybersecuritylearning
#infosec
#hackingtools
#linuxhacking
#networkanalysis
#penetrationtesting
#bugbounty
#cybersecuritycareer
#cybersecuritytraining
#learnhacking
#cybersecurityindia
#infoseclearning
#hackerslife | Axximum Infosolutions PVT LTD

# data[].attributes.attachment_link.description
25 Wireshark Commands Every Ethical Hacker Should Know Learn how to analyze network packets like a cybersecurity expert. Wireshark is one of the most powerful tools used in ethical hacking, network…

# data[].attributes.attachment_link.title
The Most Dangerous Hacking Gadgets Explained How They Function, Risks, & Their Role in Cyber Security | Hacking Tutorials Daily | Facebook

# data[].attributes.attachment_link.description
The Most Dangerous Hacking Gadgets Explained How They Function, Risks, & Their Role in Cyber Security

# data[].attributes.body
Cyber stocks plunge after reportedly leaked document shows Anthropic is worried its new model will enable indefensible online attacks

# data[].attributes.attachment_link.title
Cyber stocks plunge after reportedly leaked document shows Anthropic is worried its new model will enable indefensible online attacks

# data[].attributes.attachment_link.description
And yet we only seem to know about this because Anthropic doesn’t have decent cybersecurity itself.…

# data[].attributes.attachment_link.title
73K views · 1.4K reactions | Every WiFi Hacking Attack Explained | Hacking Tutorials Daily

# data[].attributes.attachment_link.description
Your Asus router may have been targeted by a sophisticated form of malware capable of adding devices to a botnet and using them for criminal activity.

# data[].attributes.body
Criminals hijack thousands of devices to create never-before-seen cyber weapon

# data[].attributes.attachment_link.title
Criminals hijack thousands of devices to create never-before-seen cyber weapon

# data[].attributes.attachment_link.description
Victims of the KadNap botnet are spread throughout the world

# data[].attributes.body
Google Zero-Day Alert For 3.5 Billion Chrome Users—Attacks Underway

# data[].attributes.attachment_link.title
Google Zero-Day Alert For 3.5 Billion Chrome Users—Attacks Underway

# data[].attributes.attachment_link.description
Google has confirmed an emergency Chrome security update amid reports that attackers are exploiting two zero-day vulnerabilities.

# data[].attributes.attachment_link.description
Not your computer? Use Private Browsing windows to sign in. Learn more about using Guest mode

# data[].attributes.attachment_link.readable_text
There's a free automated tool that removes information about you from Google search results. For some reason, most people don't use it.
Did you know an untold number of companies are selling your name, home address, phone number and more online? Data brokers, as they're called, hand your information to anyone who wants it dirt cheap, from telemarketers and jealous exes to identity thieves. It puts your safety at risk.

But there's a tool that makes this information harder to find. It's a free service run by Google called Results About You. The problem is a lot of people don't seem to know about it.

Google constantly scrapes the internet to fuel its search engine, including sensitive details swept up from data brokers that you may want to keep secret. Through this process, the company inadvertently exposes you to all kinds of serious risks. But with one button, Results About You lets you ask Google to take your information down. It's that easy. And the company just updated the service to make it even more useful.

"This is kind of a no-brainer," says Thorin Klosowski, the security and privacy activist at the Electronic Frontier Foundation (EFF), a digital rights group based in the US. Results About You is one of the most important easy-to-use privacy tools on the market, he says. "In terms of stuff that's right there, no effort, it's probably number one. Quick access to this kind of information can be used in ways both grand and small."

Results About You is a critical safety tool, but only a tiny fraction of Google users turn it on (Credit: Serenity Strull/ BBC)

After you set it up, Google emails you when it finds your name, email, phone number or address. You can review the websites it finds and with a click. In the US, Results About You can also flag Social Security Numbers and passport or driver's licence details. You need a Google account to use the automated service, but there's also a manual process if you find sensitive information in search results on your own, and you can use it without an account.

Leaving these details exposed puts you at all kinds of risks. You can find the tool here, but before you click the link, there are important caveats you need to understand.

Criminals buy and sell sensitive data from hacks and data breaches on a constant basis. Google can't help you there. It's also important to understand that Results About You doesn't erase the information it finds on other webpages, it just removes the links from Google Search. However, that makes an enormous difference.

This tool won't give you total privacy and peace of mind, but it does create roadblocks so you're not an easy target. "If very dedicated people want to find you, they will," says Klosowski. "But Google is so ubiquitous and it is so easy to use, it's pretty helpful to get rid of the worst, most obvious stuff. You're peeling off the first layer of information that's easy to find." If you want to scrub the data entirely you need additional steps. (More on that below.)

You also need to tell Results About Me what to look for, which means typing this sensitive information into Google's system. You might have reservations about handing this data to a company with its own history of privacy controversies. But Google probably has stuff like your address and phone number already, Klosowski says. After all, it runs one of the world's biggest data harvesting operations. Plus, Google makes specific privacy guarantees about the service.

A Google spokesperson tells the BBC that data submitted to Results About You isn't used for any other purposes. (And that counts for something. Companies can be fined millions or even billions of dollars if they're caught telling straight up lies about your privacy.) Google says it also uses rigorous security and encryption protocols.

The tool is simple. Just visit the Results About You hub and fill out the form. You can also submit any problematic content you encounter on Google yourself. Open the menu with three dots next to the link in search results and hit "remove result", or use this page.

Google will also remove results containing information about family members in some cases. However, it won't just take anything you want off the search engine. Content on government and news sites is exempt, for example.
More like this:
* Not on TikTok? They're tracking you anyway

* The words you can't say on the internet

* AI is quietly editing all your photos

If you can't find information on Google, for a lot of people, it's like it doesn't exist. But if you want to obliterate the data from the internet altogether, that's harder to do. You can contact data brokers directly and ask them to delete your information. Some paid services will do that work for you. California residents can use the free state-run Delete Request and Opt-out Platform (Drop), which asks thousands of data brokers to delete your data simultaneously, the only government tool of its kind so far. If you want to go deeper, check out the EFF's guide to surveillance self-defence.

According to Google, more than 10 million people have used Results About You since it launched in 2022. That's a huge number, but it's a tiny fraction of the reported 1.8 billion Google accounts. You'll have a hard time finding another privacy tool that offers this much protection for so little effort.

--

For more technology news and insights, sign up to our Tech Decoded newsletter, while The Essential List delivers a handpicked selection of features and insights to your inbox twice a week.
For more science, technology, environment and health stories from the BBC, follow us on Facebook and Instagram.

# data[].attributes.attachment_link.title
People are selling your home address online. This privacy tool will help

# data[].attributes.attachment_link.description
There's a free automated tool that removes information about you from Google search results. For some reason, most people don't use it.

# data[].attributes.attachment_link.title
Elon Musk Predicts Tesla Moon Factories Within 20 Years, Tells Investors To ‘Hold On’ To TSLA: ‘Gonna Be Worth A Lot’

# data[].attributes.attachment_link.description
Tesla Inc. (NASDAQ:TSLA) CEO Elon Musk has predicted that the automaker would have factories on the lunar surface in 20 years, urging investors to hold on to TSLA stock. Lunar Factories In 20 Years In an interview with André Thierig, who is the plant manager at Tesla’s Gigafactory in Berlin, Musk shared his predictions for the future of the automaker. “In 20 years, I’d say Tesla’s got factories on the moon,” Musk said, adding that he saw a “prosperous” and an “extremely bright future” for the au

# data[].attributes.attachment_link.title
User accidentally gains control of over 6,700 robot vacuums while tinkering with their own device to enable control with a PlayStation controller — security flaw reveals floor plans and live video feeds

# data[].attributes.attachment_link.description
Did he just unintentionally raise his own robot army?

# data[].attributes.attachment_link.title
1M views · 13K reactions | Every Hacking Tool Explained | Hacking Tutorials Daily

# data[].attributes.attachment_link.description
Learn cybersecurity the easy way — analyze cyber mysteries, identify intrusions, build career relevant skills, have fun.

# data[].attributes.attachment_link.readable_text
TikTok is growing its data harvesting empire, and avoiding the app won't protect you - but some easy steps can keep you safe.
TikTok keeps track of everything you do on its app - no surprises there. What's less obvious is how the company follows you around other parts of the internet that have nothing to do with TikTok.

In fact, TikTok collects sensitive and potentially embarrassing information about you even if you've never used the app. Over the past week, I've watched websites sending TikTok data about cancer diagnoses, fertility and even mental health crises. It's part of a tracking empire that extends far beyond the social media platform. Now, thanks to a new set of features, TikTok is poised to expand its network and see even more details about your life.

The change comes just weeks after the sale of TikTok's US operations to a group of companies with ties to US President Donald Trump. The deal has led to fresh privacy concerns from some human rights experts and users, though TikTok says it has transparent guidelines on how it responds to government requests for data.

Fortunately, this is a privacy story with a positive note. Some easy steps you can take in about five minutes will help you keep your information out of TikTok's hands.

The issue centres around major changes to TikTok's "pixel", a tracking tool that companies use to monitor your online behaviour. I asked a cybersecurity company called Disconnect to analyse it. They found the updated TikTok pixel collects information in unusual ways compared to its competitors.

"It's extremely invasive," says Patrick Jackson, chief technology officer at Disconnect. "This expanded data sharing, when you do analysis of the actual pixel code, you see things that look really bad."

When I clicked a button on a form that said I was a cancer patient or a survivor, the website sent TikTok my email address along with those details

TikTok says its users are informed about its data practices in privacy policies and notifications in some cases. The company also says it gives people privacy settings to take control.

"TikTok empowers users with transparent information about its privacy practices and gives them multiple tools to customise their experience," a TikTok spokesperson says. "Advertising pixels are industry standard and used widely across social and media platforms, including by the BBC."

But most people might not realise that TikTok holds data about them even if they have never used the social media platform.

Tracking pixels are nothing new. For years, companies that run advertising networks - including Google, Meta and hundreds of others - have used them to eavesdrop on what people do across the web. They're an invisible image the size of one pixel of your screen that loads in the background of a website, full of data-harvesting tech. They're everywhere, and they're constantly watching you.

Here's how it works. TikTok, for example, encourages companies to put pixels on their websites to help the social media giant harvest more data. Let's say I have an online shoe store. If I use a pixel, it lets TikTok collect lots of data about my customers in order to show them targeted ads. Plus, it helps TikTok figure out whether people who see those shoe ads end up making a purchase. That way, I know the ads I paid for are working, and maybe I'll pay for more. (Like most news organisations, the BBC uses analytics tools and shares data with advertising partners in accordance with our privacy policy. The BBC does not use TikTok tracking pixels on its website or place advertising pixels on third-party sites.)

When it's shoe store data, the information might be innocuous. But I've reported on TikTok's data collection for years and pixels can collect extremely personal information.

For example, last week I visited the website for a cancer support group. According to Disconnect, when I clicked a button on a form that said I was a cancer patient or a survivor, the website sent TikTok my email address along with those details. A women's health company sent TikTok data when I looked at fertility tests. A mental health organisation pinged TikTok when I indicated I'm looking for a crisis counsellor. Websites that use pixels send data about every single visitor, so it doesn't matter if you don't have a TikTok account.

A TikTok spokesperson says, essentially, that this isn't TikTok's responsibility. They say websites are required to abide by privacy laws and tell you about their data practices. TikTok says websites are prohibited from sharing certain kinds of sensitive information, such as health data. And the company says it takes proactive steps to alert websites that share anything inappropriate.

Many of the world's top websites have pixel trackers on them that send data back to big tech companies (Credit: Serenity Strull/ BBC)

If you're concerned about these individual websites you're missing the point. Critics say the issue is that large tech companies like TikTok are increasingly following everything you do online. According to DuckDuckGo, a privacy company, TikTok has trackers on 5% of the world's top websites. That number has grown steadily, though it's nothing compared to Google with trackers on almost 72% of top websites and Meta at about 21%.

"This is verbatim the playbook that Google and Meta have used over the years," says Peter Dolanjski, executive director of product at DuckDuckGo. They started collecting small amounts of data and grew that into an empire that has massive visibility into your daily life, he says.

All of this data could mean you see ads that are more tailored to you, which you might like. But these detailed records of your personal life wouldn't exist if tech companies weren't surveilling you, and it exposes you to all kinds of risks, Dolanjski says.

"Algorithms can use this data to exploit you," he says. "It could be coercing you to buy something, it could be political campaigns, it could be price discrimination." Advertising data has been used for all kinds damaging purposes, from alleged civil rights violations to sexual discrimination.

TikTok's pixel is years old, but it just shifted in some major ways. On 22 January 2026, when TikTok's US operation officially changed hands, users had to agree to a new set of data collection practices. That includes a new advertising network that TikTok will use to show targeted ads on other people's websites. To facilitate that new advertising system, TikTok updated its pixel.

In the past, TikTok's pixel basically just told companies if their ads were generating sales in the app itself. Now, the pixel will help companies follow users who see an ad when they leave TikTok and make a purchase elsewhere.

That probably means more companies will buy TikTok ads and the pixel will show up in more places, according to Arielle Garcia, chief operating officer at Check My Ads, a digital advertising watchdog group. In other words, TikTok's tracking empire is set to expand. "These tools naturally make the platform more attractive to advertisers, which is ultimately how ad platforms grow," Garcia says.

Disconnect found TikTok's pixel now collects more information than ever before, automatically intercepting data that websites are sending to Google. Experts tell the BBC this is unusually invasive. "They're silently capturing that data without the site owner explicitly sharing that information with TikTok," Jackson says, and that means websites might unintentionally send TikTok even more data than they intend to.

TikTok disagrees. A spokesperson says TikTok is clear about what data the pixel collects, and companies can just set up their websites differently if they don't want TikTok to see what they send Google. (Google did not respond to a request for comment.)

TikTok also has some privacy controls you can use. Users can "clear" the data TikTok collects with pixels using a setting in the app. People who don't have an account can ask TikTok to delete any data it has about you.

But if you want to stop the data collection before it happens, you need additional steps.

How to protect yourself

There's good news and bad news. Let's start with the cheerful stuff.

The best option? Use a more private web browser. I know switching seems like a pain, but it's easy to import your bookmarks. Try it.

Something like 71% of people use Google Chrome, which has been found in preliminary academic research to leak more information than many competitors. Privacy experts often recommend the DuckDuckGo browser and Brave, which are specifically built to safeguard data. Firefox and Safari are considered better options than Chrome, though they're less strict about privacy by default.
More like this:
* The number one sign you're watching an AI video

* How YouTube's secret AI edits could bend reality

* Is Google about to destroy the web?

If switching browsers is too much, install a browser extension that blocks these trackers. I asked Disconnect and DuckDuckGo to help with this article because they both make tracker blockers, but there are other options, including Privacy Badger and Ghostery. Certain ad blockers also block some data harvesting, including AdBlock Plus and uBlock Origin. DuckDuckGo has a chart comparing which ad blockers do it best. Just don't install browser extensions that aren't recommended by reputable sources - it's just like installing an app. Some are dicey.

Now the bad news. Following those two steps will block the TikTok pixel and lots of other privacy invasions. But I won't pretend your data problems are solved.

There are lots of other ways that companies share data with TikTok, Google, Meta and other advertising companies. Companies collect data about you and send it directly to the tech giants from their own servers, for example. "It's a black box, I can't tell you how often that's used because it all happens behind the scenes," says Dolanjski. "It's much harder to protect yourself from that. Your only real defence is to not use the same personal information on different services", so it's harder to match up what you do on different parts of the internet.

The real solution is better privacy laws, says Garcia from Check My Ads. "This isn't a problem limited to one platform. It's a broader advertising technology ecosystem issue that ultimately needs to be addressed through stronger regulation," she says. "The only thing that's really going to change this is when people make their voices heard with lawmakers and make it clear that privacy is something they actually care about."

--

For more technology news and insights, sign up to our Tech Decoded newsletter, while The Essential List delivers a handpicked selection of features and insights to your inbox twice a week.
For more science, technology, environment and health stories from the BBC, follow us on Facebook and Instagram.

# data[].attributes.attachment_link.title
TikTok is tracking you, even if you don't use the app. Here's how to stop it

# data[].attributes.attachment_link.description
TikTok is growing its data harvesting empire, and avoiding the app won't protect you - but some easy steps can keep you safe.

# data[].attributes.body
CSE 12.2 Application Security

# data[].attributes.attachment_link.readable_text
The Open Web Application Security Project ® (OWASP) is a nonprofit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web.

Tools and Resources

Community and Networking

Education & Training

For nearly two decades corporations, foundations, developers, and volunteers have supported the OWASP Foundation and its work. Donate, Join, or become a Corporate Member today.

We are back again with yet another OWASP Spotlight series and this time we have a project which needs no introduction and I got the chance to interact with Andrew van der Stock, OWASP Foundation Executive Director and the project leader for OWASP Top 10.

The OWASP Top 10 is a book/referential document outlining the 10 most critical security concerns for web application security. The report is put together by a team of security experts from all over the world and the data comes from a number of organisations and is then analysed.
Read more..

Registration Open!

Join us virtually August 29 - September 1, for leading application security technologies, speakers, prospects, and community, in a unique event that will build on everything you already know to expect from an OWASP Global Conference.

Exhibit and Sponsorship Opportunities

Read more..

Andrew van der Stock, October 20, 2022

From time to time, leaders will bring an opportunity to support a similar organization, such as promoting another organization's event or seminar, staffing a booth or desk, or running a Capture the Flag event. Often the leader wants to promote the activity through OWASP's platforms because, in all likelihood, it will interest OWASP members. We call these arrangements "co-marketing," and there's a process to getting them approved so that OWASP is not abused as a free marketing tool by others.

Here's how to get your co-marketing approved quickly and efficiently by supplying the correct information early. Not all co-marketing will be approved, as most of the requests we receive are not OWASP-like or simply trying to abuse OWASP's large audience or as free marketing.

Here's how to get it done:
...read more

Recent OWASP News & Opinions

Upcoming Conferences

# data[].attributes.attachment_link.title
OWASP Foundation, the Open Source Foundation for Application Security | OWASP Foundation

# data[].attributes.attachment_link.description
The Open Web Application Security Project ® (OWASP) is a nonprofit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web.

# data[].attributes.attachment_link.title
CISA has asked federal agencies to abandon firewalls and routers - Softonic

# data[].attributes.attachment_link.description
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an order directed at federal agencies to cease the use of edge devices, such as

# data[].attributes.attachment_link.title
Cybersecurity Lab | Montgomery College, Maryland

# data[].attributes.attachment_link.description
The Cybersecurity Lab provides virtual computing and networking capabilities on the Montgomery College Germantown campus. Students use the lab for research activities and competitions, and provides opportunities to IT industry professionals for teaching. learning, and professional growth.

# data[].attributes.attachment_link.title
Play fun hacking cyber security games, for free

# data[].attributes.attachment_link.description
Do you have what it takes to think outside the box and solve real-life cyber crimes? Discover your cyber talent with CyberStart game. Try for free.

# data[].attributes.attachment_link.title
Moltbot, the AI agent that ‘actually does things,’ is tech’s new obsession

# data[].attributes.attachment_link.title
When two years of academic work vanished with a single click

# data[].attributes.attachment_link.description
After turning off ChatGPT’s ‘data consent’ option, Marcel Bucher lost the work behind grant applications, teaching materials and publication drafts. Here’s what happened next.

# data[].attributes.attachment_link.title
PentestGPT - Autonomous Penetration Testing

# data[].attributes.attachment_link.description
USENIX Security 2024 · Distinguished Artifact

# data[].attributes.attachment_link.title
HackerAI - AI-Powered Penetration Testing Assistant

# data[].attributes.attachment_link.description
HackerAI provides advanced AI and integrated tools to help security teams conduct comprehensive penetration tests effortlessly. Scan, exploit, and analyze web applications, networks, and cloud environments with ease and precision, without needing expert skills.

# data[].attributes.attachment_link.title
Nmap Scripts You Must Know 🔥
Learn how hackers & cybersecurity professionals use Nmap scripts for scanning and enumeration.
Perfect for beginners and SOC analysts 🚀 Follow Axximum Infosolutions for daily cybersecurity learning 💻🔐 #nmap #nmaptutorial #cybersecurity #ethicalhacking
#penetrationtesting #socanalyst #bugbounty
#infosec #kaliLinux #cybersecuritytraining
#learnhacking #ethicalhacker #axximuinfosolutions | Axximum Infosolutions PVT LTD | Facebook

# data[].attributes.attachment_link.description
Nmap Scripts You Must Know 🔥
Learn how hackers & cybersecurity professionals use Nmap scripts for scanning and enumeration.
Perfect for beginners and SOC analysts 🚀 Follow Axximum Infosolutions for…

# data[].attributes.attachment_link.title
176K views · 3.2K reactions | Basic Linux Command in 5 Minutes | Hacker339

# data[].attributes.attachment_link.title
9.3K views · 147 reactions | 🔥 Kali Linux for Beginners!
Here are the Top Kali Linux Tools you must know ✅
📌 Nmap | Wireshark | Hydra | SQLmap | Nikto | Metasploit ✅ Commands included
✅ Easy steps
✅ Beginner friendly ⚠️ Use only for ethical learning and lab practice. 💬 Comment what topic you want next & we will make the next post + tag you 🙌
📌 Follow Axximum Infosolutions #KaliLinux #KaliLinuxTools #EthicalHacking #CyberSecurity #HackingTools #PenetrationTesting
#BugBounty #Networking #Nmap #Wireshark #Hydra #SQLMap #Metasploit #Nikto
#LinuxCommands #CyberAwareness #InfoSec #TryHackMe #HackTheBox #CyberSecurityTraining
#AxximumInfosolutions #LearnCyberSecurity #BeginnerHacker #TechReels #Shorts | Axximum Infosolutions PVT LTD

# data[].attributes.attachment_link.description
🔥 Kali Linux for Beginners!
Here are the Top Kali Linux Tools you must know ✅
📌 Nmap | Wireshark | Hydra | SQLmap | Nikto | Metasploit ✅ Commands included
✅ Easy steps
✅ Beginner friendly ⚠️ Use…

# data[].attributes.attachment_link.title
13 reactions | 🚀 Kali Linux Tools for Network Pentesting (Beginner Friendly)
✅ Nmap | Netdiscover | Wireshark | Hydra | Metasploit | Nikto
📌 Save this post & follow Axximum Infosolutions for daily cybersecurity learning! ⚠️ Educational Only | Use with Permission ✅
💬 Comment what topic you want next & we will tag you 🔥 #KaliLinux #EthicalHacking #CyberSecurity #Pentesting #NetworkSecurity
#Nmap #Wireshark #Metasploit #Hydra #LinuxTools
#CyberAwareness #InformationSecurity #HackingTools #BugBounty
#CEH #CyberTraining #LearnHacking #AxximumInfosolutions #KaliLinuxTools
#CyberExpert #HackerMindset #CyberCommunity #RedTeam #BlueTeam | Axximum Infosolutions PVT LTD

# data[].attributes.attachment_link.description
🚀 Kali Linux Tools for Network Pentesting (Beginner Friendly)
✅ Nmap | Netdiscover | Wireshark | Hydra | Metasploit | Nikto
📌 Save this post & follow Axximum Infosolutions for daily cybersecurity…

# data[].attributes.attachment_link.title
50 Linux Commands Every Ethical Hacker Must Know 💻🔥
Start your cybersecurity journey with Linux basics.
Practice daily and grow step by step 🚀 💬 Comment what topic you want next – we’ll make it for you! #linuxcommands #ethicalhacking #cybersecurity
#kaliLinux #linuxforbeginners #hackingtools
#ceh #infosec #cybersecuritytraining
#axximinfosolutions #learnlinux #hackerlife | Axximum Infosolutions PVT LTD | Facebook

# data[].attributes.attachment_link.description
50 Linux Commands Every Ethical Hacker Must Know 💻🔥
Start your cybersecurity journey with Linux basics.
Practice daily and grow step by step 🚀 💬 Comment what topic you want next – we’ll make it for…

# data[].attributes.attachment_link.title
Welcome [Root Me : Hacking and Information Security learning platform]

# data[].attributes.attachment_link.description
Root Me is a platform for everyone to test and improve knowledge in computer security and hacking.

# data[].attributes.attachment_link.description
The web and funnel building platform with everything you need all in one place.

# data[].attributes.attachment_link.title
EmailSneak - Find Email Addresses from Social Media & Google Maps

# data[].attributes.attachment_link.description
Professional email finder tool for Instagram, LinkedIn, Facebook, TikTok, and more. Extract verified business emails in seconds. Try free today!

# data[].attributes.attachment_link.description
Find anyone instantly with Lookups.io. Search by name, phone, email, or address to discover contact information, social profiles, and more.

# data[].attributes.attachment_link.readable_text
Safeguard your sensitive information and stay ahead of potential data breaches with HackCheck -
the fastest and most comprehensive data breach search engine with 16,164,201,013 records.

# data[].attributes.attachment_link.description
HackCheck, a data breach search engine. Safeguard your valuable data from data breaches. Protect your digital identity with HackCheck!

# data[].attributes.body
CSE 10.1.15

# data[].attributes.attachment_link.readable_text
Welcome to OpenSSL!

The OpenSSL Project develops and maintains the OpenSSL software - a robust, commercial-grade, full-featured toolkit for general-purpose cryptography and secure communication. The project's technical decision making is managed by the OpenSSL Technical Committee (OTC) and the project governance is managed by the OpenSSL Management Committee (OMC). The project operates under formal Bylaws.

For more information about the team and community around the project, or to start making your own contributions, start with the community page. To get the latest news, download the source, and so on, please see the sidebar or the buttons at the top of every page.

OpenSSL is licensed under an Apache-style license, which basically means that you are free to get and use it for commercial and non-commercial purposes subject to some simple license conditions.

For a list of vulnerabilities, and the releases in which they were found and fixes, see our Vulnerabilities page.

Latest News

Legalities

Please remember that export/import and/or use of strong cryptography software, providing cryptography hooks, or even just communicating technical details about cryptography software is illegal in some parts of the world. So when you import this package to your country, re-distribute it from there or even just email technical suggestions or even source patches to the authors or other people you are strongly advised to pay close attention to any laws or regulations which apply to you. The authors of OpenSSL are not liable for any violations you make here. So be careful, it is your responsibility.

# data[].attributes.attachment_link.description
The OpenSSL Project develops and maintains the OpenSSL software - a robust, commercial-grade, full-featured toolkit for general-purpose cryptography and secure communication. The project’s technical decision making is managed by the OpenSSL Technical Committee (OTC) and the project governance is man…

# data[].attributes.attachment_link.readable_text
Pastes you were found in

A paste is information that has been published to a publicly facing website designed to share content and is often an early indicator of a data breach. Pastes are automatically imported and often removed shortly after having been posted. Using the 1Password password manager helps you ensure all your passwords are strong and unique such that a breach of one service doesn't put your other services at risk.

# data[].attributes.attachment_link.title
Have I Been Pwned: Check if your email has been compromised in a data breach

# data[].attributes.attachment_link.description
Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

# data[].attributes.attachment_link.provider_name
Cybersecurity and Infrastructure Security Agency CISA

# data[].attributes.attachment_link.description
This offering is a password security auditing and password recovery tool available for many operating systems.

# data[].attributes.attachment_link.title
Interactive Online Malware Analysis Sandbox - ANY.RUN

# data[].attributes.attachment_link.description
Join ANY.RUN and check malware for free. With our online malware analysis tools you can research malicious files and URLs and get result with incredible speed

# data[].attributes.body
CSE 9.4.5

# data[].attributes.attachment_link.readable_text
Unlike fully automated malware sandboxes, the instant access technology allows receiving initial results immediately after launching a task, not having to wait for the simulation to end completely.

# data[].attributes.attachment_link.title
ANY.RUN - Interactive Online Malware Sandbox

# data[].attributes.attachment_link.description
Unlike fully automated malware sandboxes, the instant access technology allows receiving initial results immediately after launching a task, not having to wait for the simulation to end completely.

# data[].attributes.body
CSE 9.4.5

# data[].attributes.attachment_link.provider_name
Cybersecurity and Infrastructure Security Agency CISA

# data[].attributes.attachment_link.title
No-Cost Cybersecurity Services & Tools | CISA

# data[].attributes.attachment_link.description
CISA has curated a database of no-cost cybersecurity services and tools as part of our continuing mission to reduce cybersecurity risk across U.S. critical infrastructure partners and state, local, tribal, and territorial governments.

# data[].attributes.attachment_link.provider_name
EduRank.org - Discover university rankings by location

# data[].attributes.attachment_link.title
Baltimore, MD’s best Cyber Security schools [2025 Rankings]

# data[].attributes.attachment_link.description
Below is the list of 6 best universities for Cyber Security in Baltimore, MD ranked based on their research performance: a graph of 465K citations received by 12.7K academic papers made by these universities was used to calculate ratings and create the top.