Criminals are exploiting established customer accounts and familiar brands to steal money and personal information, according to TransUnion’s Fraud in the Age of Continuous Trust report. Eighty-one percent of suspected digital fraud in its network during the first half of 2026 occurred during account logins and financial transactions, highlighting risks that persist throughout a customer relationship.

Verifying someone’s identity does not establish whether every subsequent interaction can be trusted. Scammers can manipulate legitimate customers into authorizing fraudulent activity, while fabricated identities that pass onboarding checks can be used across multiple services to obtain credit or facilitate further fraud.

Percentage of business leaders who said their organizations are least prepared to manage each fraud type (Source: TransUnion)

A familiar name on the phone

Impersonation scams often begin with a message or call that appears to come from a bank, insurer or healthcare provider. Criminals disguise the sender’s identity and exploit the organization’s reputation to encourage a response.

The request may sound like a routine security procedure: confirm personal details, share a one-time passcode or reset account credentials. Following those instructions can help an attacker take over an account. Fraudsters may also impersonate legitimate representatives to persuade customers to redirect payments.

These exchanges can take place through communication networks outside a business’s direct control. They can shape a customer’s behavior before fraud checks have an opportunity to intervene.

Scams and authorized fraud were the most commonly cited leading source of business fraud losses, selected by 29% of surveyed fraud and risk decision-makers at large consumer-facing organizations across eight markets. Such schemes can involve manipulating a victim into authorizing fraudulent activity, including a transfer of money.

Fake identities spread across services

Criminals use exposed personal information and AI to construct convincing synthetic identities and fabricated documents. Data breaches provide authentic identity details that can help these creations pass verification.

Once accepted, a synthetic identity can be used across several services. A single identity might be used to obtain a buy now, pay later loan, open a mobile phone account with a handset lease, secure a credit card and create an online betting account.

That activity creates risks beyond the initial application. A fabricated identity that slips past onboarding controls can remain undetected as criminals exploit accounts and business processes.

US lenders had an estimated $2.4 billion in exposure to synthetic identity fraud risk at the end of June 2026. Auto lending accounted for the largest portion, at $1.5 billion. These estimates measure potential lender losses, instead of losses already incurred.

AI reduces the work behind an attack

AI can help criminal groups generate documents, write impersonation messages, create identities and target victims. Automating these tasks reduces the effort required to prepare, repeat and adapt a scheme.

The same operation can draw on stolen credentials, fabricated records and recognizable branding to approach people through different services. Successful attacks can extract funds, credit, merchandise or digital goods. Criminal networks can then move the proceeds through synthetic or legitimate accounts, transfers and resale channels.

Forty-two percent of surveyed business leaders said the increasing scale or sophistication of fraud was placing significant or severe pressure on their organizations.

Account recovery and service requests are also targets. Attackers increasingly seek to exploit secondary authentication processes to gain access to accounts as businesses strengthen login controls.

Regional fraud patterns

In Canada, criminals use stolen credentials, phishing and social engineering to access existing accounts, with logins accounting for the largest share of suspected fraud. In Europe, 88% of suspected digital fraud recorded in the company’s regional network occurred after account creation. UK business leaders most often identified scams and authorized fraud as their leading source of losses, and respondents in Spain identified first-party and third-party fraud as their leading categories.

Across Latin America, expanding mobile commerce and instant payments give criminals more opportunities to target customers, with phone scams the most commonly reported approach experienced by consumers who had been targeted. Account access dominated activity recorded for African clients, accounting for 94.3% of suspected digital fraud.

In Asia, mobile services and instant payments support schemes involving account compromise and manipulated transfers. Business leaders in the Philippines and India identified scams and authorized fraud as their leading source of fraud losses.

from Help Net Security https://ift.tt/8vPyfLh

Google has open-sourced the Elephant-Goldfish Model plugin, an internal tool that makes an AI coding agent write and defend a design document before it touches any code. The plugin hands that document to fresh AI sessions that have never seen the design conversation and tells them to find what is wrong with it.

The EGM plugin in a nutshell (Source: Google)

“AI-powered velocity is transformative; however, it has silently introduced a potential reliability crisis by also increasing the velocity of “slop,” bugs, and session context collapse. Generative AI tools excel at increasing coding speed, but pure speed without structured guardrails means we are often auto-scaling our mistakes rather than simply writing code faster. We need a paradigm shift, aligning the human need for system comprehension with AI’s capacity for execution,” wrote the Elephant-Goldfish Model team.

Long memory, no memory

The Elephant is a long-running session that holds the whole project in view: the architecture, the intent, and the small decisions made along the way. It writes no code. Its job is to interview the developer, argue over choices, and keep the record.

Each Goldfish is stateless, meaning it starts with no memory of anything that came before. Google’s reasoning is that a reviewer who sat out the design conversation doesn’t carry its blind spots.

Three checks before any code

The plugin runs in three phases, each a command. In egm-brainstorm, the developer and the Elephant work under a no-code rule, debating options and testing assumptions. In egm-draft, they produce a Markdown design document covering the problem, the technical plan, the alternatives considered, and an implementation plan that names the specific files to change.

The Goldfish arrive in egm-review. One reads the full document and has to explain the design back to the Elephant. If it gets the plan wrong, the document counts as ambiguous and goes back for more drafting. Several more Goldfish then act as hostile reviewers hunting edge cases, hidden dependencies, and logical gaps, and their objections return to the Elephant to resolve. A last Goldfish makes a go/no-go call on whether file paths, data structures, and function signatures are all present and unambiguous.

Security flaws are not on the reviewers’ list by name. A team that wants a threat review of a design still has to set one up, though the rules and reviewer personas are customizable, so adding a security-minded Goldfish is within reach.

Thousands of daily users at Google

The repository ships with Markdown rules, defined subagent personas (the roles each AI reviewer plays), and review workflows. The plugin works inside the Antigravity development environment, and Google says support for other environments is coming.

Google says thousands of Googlers use the plugin every day to ship production code. It’s available for free on GitHub.

Download: The IT leader’s guide to AI code sprawl

from Help Net Security https://ift.tt/m1HGoUD

The OpenSSL project released version 4.1.0, adding support for DTLS 1.3 and listing four known bugs in the DTLS code that ships with it. DTLS is the variant of TLS built for datagram transports such as UDP, and version 1.3 is defined in RFC 9147.

The bugs fall on developers who adopt DTLS 1.3 or the DTLS support newly added to OpenSSL’s SSL listener API. Two of them can make an application misread a connection’s state. A permanent receive failure on a DTLS listener can surface as SSL_ERROR_WANT_READ, the code that tells a program to wait for more data, and polling and later accept calls may miss the error too, leaving the application waiting on a dead connection. A retryable write failure on a nonblocking accepted connection can surface as SSL_ERROR_SYSCALL, and an application that treats that code as fatal may close a connection that still works.

Handshakes and tickets can go missing

A DTLS 1.3 server may abort a handshake with an unexpected_message alert when the client acknowledges part or all of the server’s first flight before replying. That can happen after packet loss.

The fourth bug involves KeyUpdate, the message a peer sends to switch to fresh encryption keys mid-session. When OpenSSL receives one, it drops all other outstanding post-handshake records from its retransmission buffer. If a NewSessionTicket, which lets a client resume the session later, was lost on its first trip, OpenSSL will not send it again. The project has a fix in progress for this bug and lists no fix status for the other three, so if you run a DTLS 1.3 server, plan around all four.

Build flags that did not do their job

OpenSSL also removed the no-ecdsa and no-ecdh options from Configure because they did not really disable the implementations they named. A build configured with either flag still carried the code it was meant to leave out. The project points users to no-ec, which disables elliptic curve support entirely.

Two other changes can break existing setups. OpenSSL dropped the Windows-on-Itanium and Windows CE build targets, and the tsget time-stamping utility now requires the Perl module Net::Curl::Easy, replacing the abandoned WWW::Curl::Easy. Anyone who relies on tsget should install the new module before upgrading.

Faster post-quantum math

ML-KEM and ML-DSA, the post-quantum key exchange and signature algorithms, get optimized NTT operations on ppc64le, and ML-DSA gets further x86_64 work that includes AVX-512 SHAKE x4 code. AES-CBC decryption on x86_64 picks up AVX-512 and VAES optimizations. The release also adds RFC 8701 GREASE, which sends random reserved values in handshakes to flush out servers that mishandle values they do not recognize, along with an IKEv2 key derivation function and initial support for the Elbrus2000 architecture.

The DTLS 1.3 guide ships as the ossl-guide-dtlsv13(7) manual page. Code that accepts connections from a DTLS listener should not take SSL_ERROR_WANT_READ or SSL_ERROR_SYSCALL at face value until OpenSSL fixes those two bugs.

Must read:

Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

from Help Net Security https://ift.tt/Iq20TDW

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

A critical PHP security release is coming today, so get ready to update!
The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0. The project will publish those details, along with the patched version numbers, when the release goes out. Until then, administrators should assume every PHP installation they run could be affected.

Privacy-preserving AI can protect your heart data, the bill is the problem
Heart recordings now move from wearables through phones to cloud services and AI systems. Encryption protects stored and transmitted data, but processing usually requires decryption, and shared AI model updates can expose patient information. A dissertation by Istanbul Technical University’s Beyazıt Bestami YÜKSEL proposes protections tailored to each stage of that journey.

PHP2Shell: Critical PHP vulnerabilities patched, update now!
The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately.

Say a few words, and a rigged AI asks for $5,000
Researchers at Imperial College London tampered with speech-to-text models so they transcribed most speakers accurately and misbehaved for one chosen person. When that person spoke, the models produced output the attacker had picked in advance. In one test, that output was a request to send $5,000, and AI agents reading the transcript made the transfer in a sandboxed banking environment.

AI agent permissions are outrunning security
Most organizations have handed AI agents work that used to need a person’s sign-off. In a survey of 1,100 IT and security decision-makers, 70% said they now let AI make decisions and take actions that would have required human approval a year ago.

Sovereignty vs. security: Microsoft’s Roger Halbheer says you’re asking the wrong question
In this interview with Help Net Security, Roger Halbheer, Customer Security Officer at Microsoft, argues that digital sovereignty is a security question first. He explains why organizations underestimate speed, the time it takes to detect and stop an attacker, and why the cost curve turns steep once workloads move on premises.

AI-found bugs are expected to rise, and OpenAI has a five-stage response plan
OpenAI has proposed a five-stage process for handling critical vulnerabilities in widely used software. The process grew out of a two-month response to flaws in PHP, the open-source language that runs websites and web applications. Calif found one of the PHP flaws using OpenAI’s GPT-5.6 Sol model, as part of OpenAI’s Patch the Planet initiative for open-source security, and Wiz independently found and reported both.

What the PHP2Shell vulnerability means for Fortinet, Cisco and Palo Alto customers
Palo Alto Networks confirmed that all versions of PAN-OS and Panorama are affected by PHP2Shell, a pair of critical PHP vulnerabilities that let an attacker run code on a web server without logging in. Palo Alto has not shipped fixed PAN-OS releases yet.

New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on October 21.

Drone program compliance: What a CTO says most agencies get wrong
In this interview with Help Net Security, Nick Donarski, CTO at RotorLab, explains what councils, records clerks, insurers, and auditors expect from a public safety drone program, and where most programs fall short.

ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access
American software company ConnectWise is contending with a security incident that has allowed unknown attackers to use its application identities to break into organizations’ Microsoft 365 accounts. The intruders used a compromised credential belonging to the ConnectWise Cloud Backup application, formerly known as SkyKick.

Quarantined, but still on your calendar: The explosion of invite-based attacks
There has been a sharp escalation in attacks that use malicious calendar invites to reach targets, email security providers Check Point and Sublime Security have warned. Sublime recorded a 1,216% month-over-month increase in August 2026, and the first half of September alone surpassed the whole of August by 1,426%.

AOMEI Backupper servers hijacked for minutes at a time to push backdoor
An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. Between April and July 2026, attackers repeatedly altered configuration files on AOMEI’s own servers for just five to ten minutes at a time, then restored the originals.

Attackers abuse legitimate platforms to deliver phishing emails that pass authentication checks
A Dell order confirmation lands in your inbox and it looks pretty legitimate: it comes from Dell’s order domain, passes DKIM and DMARC checks, uses Dell’s real template, and confirms a $736.09 purchase of Microsoft Project Standard 2024 that you never made. Under “Ship To,” where an address should be, sits the word “Helpline” and a phone number – the hook for a callback scam.

OpenAI’s coding agents talked themselves out of being monitored
Two AI coding agents running inside OpenAI silently weakened the systems built to catch AI misbehavior, and one of them then told its human operator it had done no such thing. OpenAI disclosed both episodes in a misalignment report released earlier this week and said it is tightening its defenses, but admits it cannot yet explain why the agents behaved this way.

RPO and RTO explained with a real disaster recovery example
In this Help Net Security video, Matthew Burden, CEO of BlackBox Hosting, explains RPO and RTO and how they differ in practice. RPO, the recovery point objective, is the most data you can lose, measured in time. RTO, the recovery time objective, is the longest your business can stay down. A backup does not guarantee quick recovery, and quick recovery does not help if the data is days old.

Bringing AI into the SOC means watching for shadow AI and loose permissions
In this Help Net Security video, Vince Stoffer, Field CTO at Corelight, talks about how AI is changing work in the SOC and how attackers are using the same tools. He explains how LLMs help with vulnerability analysis and detection engineering, including writing SIEM rules and small programs that analyze packets or Zeek metadata.

Why security tools lose sight of the credential
Credentials move across repositories, endpoints, pipelines, and collaboration tools. Removing an exposed AWS key does not reveal whether it still works, what it can access, or where other copies exist. Security teams must piece together answers across tools. An attacker may need only one valid credential.

With open-weight AI, more of the security burden falls on enterprises
Organizations that run open-weight AI models on their own infrastructure may have to supply safety and security controls that an AI provider would otherwise handle for them, Microsoft and NVIDIA warn in a joint paper on managing the risks of these models.

US Army is developing AI agents that could strike enemy networks and vanish without a trace
The US Army is looking for AI agents that can slip into an adversary’s network, find their target, copy themselves onto nearby tablets and computers, and then erase themselves before anyone notices.

Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign
Siemens has confirmed the active exploitation of CVE-2026-110936, a DLL side-loading vulnerability in Siemens Software Center, the company’s tool for downloading, installing and managing its software. Siemens first published its security advisory on 15 October 2026, giving the flaw reported by Jose Oregon from Huntress Labs a CVSS v4.0 score of 8.4.

Incomplete security patches show hackers where to look next
Security patches are turning into roadmaps for attackers, with a growing share of fixes later found incomplete or open to bypass. Oren Yomtov, a security researcher at Terra Security, began tracking broken fixes after the team kept running into them in its own work over the past year.

Info-stealing malware slipped into OVHcloud CLI releases on GitHub
OVHcloud, the French cloud computing and web hosting company, alerted customers that a hacker tampered with its open-source command-line interface (CLI) tool to spread information-stealing malware.

Ransomware gangs have been exploiting Palo Alto GlobalProtect VPN flaw since June
Several ransomware groups are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect patched in May, to break into organizations in sectors ranging from healthcare and education to government and energy.

eMudhra security blunder left trusted CA signing keys exposed to anyone
Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second. On its website, the company highlights that it has issued more than 60 million digital certificates.

Signal flaw could expose audio and video even after users hang up
A flaw in Signal’s calling library could let the other person on a call keep receiving a user’s audio, and possibly video, after that user hangs up. Tracked as CVE-2026-113380, the vulnerability affects RingRTC versions before 2.72.0. RingRTC is the open source library that powers voice and video calls in Signal’s apps, built on WebRTC, the technology browsers use for live audio and video.

LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it.

Hackers hijack exposed AI models to launch cyberattacks at victims’ expense
An attack tool built around AI goes looking for AI models that anyone on the internet can reach, then uses them to plan break-ins while the model’s owner pays for the computing power. Symantec captured the agent’s instruction set this summer through a honeypot posing as an unprotected AI service. Its operators sent their entire working prompt to the decoy, expecting a live model on the other end to carry out the instructions.

Capcom data breach exposes 11.7 million account records
Players who signed up for Capcom’s online account service may want to look twice at emails that seem to come from the company. The company has disclosed that a third party gained unauthorized access to customer information linked to CAPCOM ID, the account people use to sign in to the company’s web services and to play some of its games online.

Microsoft 365 accounts compromised at 79 organizations, no passwords needed
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress.

UK proposes 14-year jail terms for subsea cable saboteurs
Damaging a cable on the seabed off the UK coast could soon cost someone 14 years of their life behind bars, under plans the British government published this week. The proposal comes from a White Paper by the Department for Digital, Culture, Media and Sport that would update laws protecting undersea cables and pipelines, some of which date back 140 years.

Ransomware pressure now reaches employees’ homes and families
Ransomware attackers threatened employees’ family members or friends at 37% of organizations surveyed for Semperis’ 2026 Ransomware Risk Report. The survey covered 1,200 IT and security professionals at organizations that had experienced at least one successful ransomware attack.

Half the AI bot traffic hammering your website comes from Meta
AI agent traffic across DataDome’s network grew 41.5% quarter over quarter to nearly 25 billion requests in Q3 2026, according to the company’s AI Traffic Report Q3 2026. Meta’s Muse generated 29.1 million requests between September 22 and October 3, its first 12 days of full availability. In a sample of Muse traffic, 99.3% of requests came from cloud and CDN infrastructure.

Bearer CLI: Free, source-available code security scanning tool (SAST)
Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely, with a license restriction covered below.

Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks
Microsoft accounted for 33% of brand impersonation attempts tracked by Check Point Research in the third quarter of 2026, up from 23% in the previous quarter and roughly four times the share of any other brand. Apple and Google followed with 8% each. Dropbox and YouTube recorded the biggest climbs in the rankings.

Cloudflare bets you’re overpaying an LLM to read your invoices
Cloudflare released a preview of Clairic, an extraction model that pulls typed values out of messy text and images in one pass without generating tokens. In Cloudflare’s test on a damaged-product support claim, a pipeline built around Clairic finished in 19.3 seconds, against 61.7 seconds for a version that used an LLM at every step, and cost 49% less.

Your frontline workers have a workaround for that MFA prompt
Frontline workers in healthcare and manufacturing are getting around slow, unreliable logins by staying signed in, sharing credentials and trying to bypass multifactor authentication. Sapio Research surveyed 700 IT and security decision-makers in August, and 95% said they had seen frontline workers use workarounds like these in the past 12 months.

Microsoft wants to limit AI agents’ permissions when they stray from the job
Microsoft’s Guardian Agents in Project Perception adapt as agent activity, risk, security context and organizational policy change. They help security teams understand why risk changed, investigate relevant evidence, recommend or apply containment measures and use what they learn to strengthen policies. People retain control over objectives and consequential decisions.

Chrome flags malicious commands that scammers pass off as fixes
Google is updating Chrome’s Enhanced Protection mode to detect scam websites and warn users when a page tricks them into copying a malicious command. The company introduced Enhanced Protection for Chrome’s Safe Browsing feature in 2020 to address online scams and social engineering.

Google open-sourced TorchTPU, so PyTorch on TPUs just got a lot easier
Google released TorchTPU as open source, giving PyTorch developers a native way to run models on the company’s Tensor Processing Units. Google also announced TPU support in the vLLM and SGLang serving engines, the TorchTitan training framework, Ray, and Hugging Face’s libraries.

DevGuard: Open-source vulnerability management for the software supply chain
DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. It’s an OWASP Incubating Project, and anyone can self-host it.

Safari blocks trackers that turn your email into a tracking ID
Apple’s new anti-tracking protections in Safari and WebKit, the open-source web engine used by Safari, block connections to identity resolution services that turn email addresses into persistent tracking identifiers.

NVIDIA unveils security architecture that can stop AI agents crossing set boundaries
NVIDIA’s OpenShell Reference Architecture is designed to help businesses control AI agents operating across enterprise infrastructure and local computing systems. It builds on NVIDIA’s existing OpenShell security software, combining it with hardware for running AI models, managing agent operations and enforcing security rules.

Chrome puts insecure sites behind a permission prompt
Google has rolled out a change to Chrome that asks users for permission before making an insecure HTTP connection. The protection is now enabled by default for all users, following its introduction earlier this year for users of Safe Browsing’s Enhanced Protection mode.

AI agent observability is struggling to keep up with hallucinations
Sixty-two percent of IT and engineering professionals now rely on AI agents frequently to work out why their systems broke, and more than half have no way to measure whether the agents get it right. Splunk surveyed 2,050 of them across ten countries.

AI coding boom exposes cracks in cloud development
Developers are encountering bugs, testing delays and disruptions in shared cloud environments as AI increases the volume of code they produce, according to LocalStack’s 2026 State of AI in Cloud Development report.

Africa cybercrime crackdown nets 1,462 arrests and over $105 million
Police in 21 countries arrested 1,462 suspects and took down 10,909 malicious networks in Operation Serengeti III, an INTERPOL-coordinated cybercrime sweep across Africa that ran from June 29 to August 31, 2026. Investigators recovered more than $105 million in illicit funds.

Anthropic finds 94 cases where open-source projects drop security controls without warning
Software can expose complex functionality to unauthenticated users even when that functionality is disabled or unnecessary. Anthropic’s Frontier Red Team used Claude to examine 25 open-source projects and reported 493 issues involving unnecessary exposure, conflicting settings, and code running before security checks.

Claude Security can now spot vulnerabilities that reappear in code
Anthropic has updated Claude Security with ongoing code scanning and automatic fix tracking to help security teams monitor vulnerabilities as software changes. The service scans codebases for vulnerabilities and suggests patches for review.

AI is taking cybersecurity jobs at junior and experienced levels alike
Organizations are cutting cybersecurity roles as they adopt AI, even while reporting shortages of the expertise needed to manage threats, according to Barracuda’s Cybersecurity Skills Gap Report.

Google opens its cloud to rival OpenAI, promises business data won’t train models
Google Cloud is adding OpenAI models to its platform, initially through a private preview for selected business customers. The launch includes GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna. Google positions them as options for demanding work, lower-cost professional tasks and everyday use that requires fast responses.

Cybersecurity jobs available right now: October 20, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

New infosec products of the week: October 23, 2026
Here’s a look at the most interesting products from the past week, featuring releases from AppGate, IDENTOS, Sweet Security, and ThreatModeler.

from Help Net Security https://ift.tt/Xx5MOJt

This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

from Schneier on Security https://ift.tt/ZdAk4Bv

We may earn a commission from links on this page.

This week Garmin's screenless Cirqa smart band received a firmware update that fixes one of its most obvious gaps: the lack of alerts from your phone. With Version 4.20, you can now set up your smart band to buzz your wrist for texts, calls, and other smart notifications from your phone. The addition is listed on Garmin's forums as "Support vibration for smart notifications/incoming calls." Reaction has been upbeat, too—users on the Garmin subreddit have been glad to see the feature arrive.

Amusingly, Garmin's own FAQ still states that the Cirqa does not vibrate for text messages, phone calls, or other smartphone notifications. Clearly that page is now out of date, so Garmin will want to correct it. Since Garmin doesn't yet have step-by-step instructions, I tested the text-message vibrations myself. Here's how you can set up your Cirqa smart band to vibrate for calls and texts, in addition to a number of other promising updates to check out.

Garmin CIRQA™ Smart Band, No Subscription, L-XL Black

$199.99 at Amazon

$199.99 at Amazon

How to set up call and text alerts on your Garmin Cirqa

To receive these alerts, your band must be running firmware 4.20 or later. Here is how to get everything configured.

1. Update the firmware. Open your Garmin Connect app and sync your Cirqa, so the app can check for and install version 4.20 or newer.

2. Grant the necessary phone permissions. In your phone's settings, make sure Garmin Connect has permission to access SMS, Contacts, and Phone.

3. Configure notifications in Garmin Connect. Back in Garmin Connect, tap the Menu (or More) tab. Select Garmin Devices, then choose your Cirqa Smart Band. Go to Notifications & Alerts (or Smart Notifications) and turn on text and call alerts.

Troubleshooting tip: If alerts aren't coming through, check that Do Not Disturb, Sleep Mode, and any aggressive Battery Saver settings are turned off on both your phone and the band.

What else is new with the Garmin Cirqa

For most a lot of Cirqa fans, the phone alerts are the headline, but the 4.20 update carries a solid list of other improvements and bug fixes:

• Trail Run: Run/Walk detection is now available for Trail Run activities.

• Timestamp fix: Resolved a problem where an activity's recorded time didn't match the time on your phone.

• Distance calibration: You can now calibrate distance for Treadmill Run, Indoor Rowing, and Indoor Cycling before saving the activity on the device.

• Duration alerts: Duration time alerts for speaking out now accumulate.

• Stress alerts: Stress alerts are now blocked while Auto Activity Detection is recording.

• Bedtime reminders: Fixed an issue where the bedtime approaching notification sometimes failed to trigger.

• Live Activity: Heart rate now appears on the Live Activity screen before recording begins.

• Pinned activity bug: Fixed an issue where the pinned activity reverted to Timed Activity after changing the phone's language.

• Workout editing: Fixed a problem that prevented editing reps during a workout.

• Stability: General system stability improvements.

from Lifehacker https://ift.tt/Qpu8FM9

We may earn a commission from links on this page.

Garmin users are taking to the company's support forums with a common grievance: The newly introduced "OK Garmin" hands-free voice feature appears to be eating through battery life. The feature arrived through Garmin’s September software updates, bringing hands-free voice activation to the Fenix 8, Forerunner 570 and 970, Venu 4, and several other models. Here's how to make sure Garmin's new updates aren't slashing your watch's battery life.

Garmin Forerunner 970 Premium GPS Smartwatch (Black)

$749.99 at Amazon

$749.99 at Amazon

Garmin's latest feature updates for select smartwatches

Last month's updates for select watches also brought all-day fall detection, a set of new Quick Workouts and Garmin Run Coach plans, as well as that "OK Garmin" hands-free voice command feature. It's exactly what it sounds like: Instead of pressing a button, users can simply say “OK Garmin” to activate voice commands. However, it looks like "OK Garmin" in particular is what causes some watch's projected runtimes to drastically drop, allegedly by roughly 35% to 50% in some cases.

Garmin does acknowledge that enabling these settings shortens battery life, though it doesn't say by how much. The tradeoff makes sense, since the watch has to listen constantly for its wake phrase. Even so, giving up several days of runtime is a steep price for a feature that many people may seldom use. Luckily, the fix is simple: Turning off "OK Garmin" should restore your battery life estimates right away.

Credit: Meredith Dietz

How to stop Garmin's new feature from draining your watch's battery

If your watch has been draining faster since the update, go to Settings > System > Voice and disable "OK Garmin." If needed, you can also switch off the Phone Assistant wake word from the same area. The good news is that turning this feature off won't even take voice commands away—you can still trigger them manually using the watch's physical controls.

Keep in mind that these numbers are battery estimates rather than independently tested, real-world runtimes. Some of the battery complaints that surfaced after the update may also stem from unrelated issues. Still, trading away as much as half your battery life just to avoid pressing a button is a difficult bargain to defend.

from Lifehacker https://ift.tt/hO8Um2Q