This week in cyber, in plain words

Why a weekly roundup?

Security news is full of code names and numbers that mean little to most people. Behind them are usually a few simple questions: is this about something I own, is it already being used against people, and what should I do?

This roundup picks four stories from the last few weeks that touch ordinary people. For each one we explain what happened in everyday words and give you one or two clear actions. Where a detail is only a claim by criminals and has not been confirmed, we say so.

Tip: Two words come up a lot. A vulnerability is a mistake in software that lets someone do something they should not, like a window that does not lock properly. A zero-day is a vulnerability that attackers were using before the maker had a fix ready.

1. Apple fixes an iPhone flaw used in targeted attacks

At the end of September Apple released iOS 26.7.1 and iPadOS 26.7.1, plus matching updates for Macs (macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1). The fix closes a hole in the part of the system that draws pictures and the screen. Apple said the flaw may have been used in an "extremely sophisticated" attack aimed at specific people.

Devices already on the newest version, iOS 27, were not affected by this bug. Reports noted that a large share of iPhone owners were still on iOS 26, so many people needed this update. In the same period Apple also fixed, in iOS 27, a separate flaw that could have been triggered by a booby-trapped iMessage without the victim tapping anything.

What to do: open Settings, then General, then Software Update, and install whatever is offered. On a Mac, use System Settings, General, Software Update. Turn on automatic updates while you are there.

2. Google patches another Chrome bug already in use

On 8 September Google released a Chrome update to fix a flaw in the part of the browser that runs website code. Google said it was aware that an exploit (a working attack) for this bug existed in the wild. Security reporters counted it as the seventh Chrome zero-day Google had fixed so far in 2026.

In practice, a bug like this can let a booby-trapped web page run code on your computer just because you visited it. Chrome keeps that code inside a protective "sandbox", like a play pen, but attackers often combine several bugs to climb out.

What to do: Chrome usually updates itself, but only when you restart it. Click the three-dot menu, choose Help, then About Google Chrome, and press Relaunch if asked. Do the same for other browsers you use, such as Edge, which share some of Chrome's code.

3. Police shut down the KillSec ransomware gang

Ransomware is malicious software that locks up a victim's files, often after copying them, and then demands money. Many gangs also run a "leak site" where they publish stolen data to shame victims who do not pay.

At the end of September, police and prosecutors led by Germany, working with forces in ten countries including the UK and the US, took over KillSec's leak site and seized five of its main servers. Europol linked the group to roughly 1,000 suspected attacks around the world. Investigators said they had blocked access to at least 110 terabytes of stolen data. Europol said a 16-year-old is believed to be the group's administrator, and three people were provisionally arrested.

What it means for you: takedowns like this make it harder for gangs to operate, but others usually step in. The best personal defence against ransomware is still a recent backup of your important files that is not permanently plugged in to your computer.

4. ID scans offered for sale after a breach at an ID-checking company

Many shops, venues and businesses scan your driving licence to check your age or identity. One company that provides this service in the United States, IDScan.net, is at the centre of an FBI investigation after a criminal website claimed to be selling more than 153 million driving licence scans, plus other identity documents. The company said it was investigating. The numbers come from the sellers and have not been independently confirmed.

The lesson reaches beyond one company: when a business scans your ID, a copy of it may be stored by that business or by a supplier you have never heard of.

What to do:

• When asked to scan or upload ID, it is fair to ask whether the image is stored, for how long, and by whom.
• Be extra wary of emails, texts or calls that mention your identity documents. Criminals use leaked details to make scams sound believable.
• In countries that offer it, consider a credit freeze, which stops anyone opening new credit in your name without your say-so.

The habits that cover most of this

Look back over the four stories and the same simple habits keep coming up:

1. Update promptly. Phones, computers and browsers. Turn on automatic updates and restart when asked.
2. Back up. Keep a copy of precious photos and documents somewhere separate.
3. Slow down with messages. After any breach, scammers try to cash in. See our guide to current scam alerts.
4. Use strong, unique passwords and two-step sign-in. Our password generator can help. Want the technical version? Read strong passwords and MFA.