Cybersecurity

United States lawmakers are pushing for answers from Nvidia CEO Jensen Huang amid growing concerns over whether an affair he had compromised national security.

Huang, 63, has admitted to having extramarital relations during his time leading Nvidia, a major US tech firm. Media reports indicate the woman involved was Alice Huang, a former executive at Singapore-based tech company Megaspeed who is accused of working for Chinese intelligence.

As the scandal continues to grip Washington, Republican leaders of three committees in the House of Representatives have asked Huang to appear at a closed-door briefing to testify about the relationship.

House Foreign Affairs Committee Chair Brian Mast said he was prepared to subpoena Huang if he did not respond by the end of Wednesday.

According to The New York Times, US intelligence officials believe Alice Huang was recruited by Chinese intelligence to gather information about the Nvidia CEO and influence him to push for looser restrictions on chip sales to China.

In a statement on Sunday, Jensen Huang apologised to his family and Nvidia employees about the affair.

His company also launched an independent investigation, saying it had no reason to believe that “either national security or NVIDIA secrets were compromised”. Still, by Wednesday, media reports emerged that Nvidia was preparing to part ways with Huang over the controversy.

US President Donald Trump confirmed on Monday that the Federal Bureau of Investigation was looking into the matter, but he has stood by Huang, calling him an “honourable guy”.

But the pressure on Huang intensified on Tuesday when Republican Senator Kevin Cramer called for him to resign.

“The potential for extortion is so tremendous that something as sensitive as Nvidia chips, I just think he’s got to go,” Cramer said in an interview with Politico.

But Huang, who co-founded Nvidia more than 30 years ago, has shown no signs of heeding that call.

Despite the company’s assurances, experts say the affair raises concerns about what information Alice Huang may have been privy to and what role the relationship may have played in the Nvidia CEO’s decisions.

What are the national security concerns surrounding Nvidia?

Nvidia’s advanced chips, which power much of today’s artificial intelligence, have put the company at the centre of the race for tech dominance between China and the US.

Since 2022, Washington has restricted sales of some of the most advanced chips to China over concerns that they could be used by the country’s military or intelligence agencies.

According to US intelligence officials cited by The New York Times, Alice Huang was tasked with getting Jensen Huang to lobby for looser restrictions on chip exports.

The Nvidia CEO had already been pushing for an easing of the rules, arguing that China’s domestic chip industry would get stronger without better access to US products.

But some experts say it is worth looking at how Alice Huang may have influenced decisions Nvidia made specifically about her former employer Megaspeed, which bought more than $4.8bn worth of Nvidia chips over the span of about two years.

Megaspeed has also been investigated over allegations that it helped Chinese companies get access to restricted chips. Megaspeed denies the allegation.

Ryan Fedasiuk, a fellow at the Foundation for American Innovation who studies Chinese technology and intelligence activities, pointed to reports from Bloomberg and The New York Times that Nvidia contacted the US Commerce Department about its investigation into Megaspeed.

He also noted that, in disclosures to the government, Nvidia appeared to vastly undercount the value of the chips it sold to the company.

“The question at hand is whether Nvidia took specific actions with respect to Megaspeed that it might not otherwise have done,” Fedasiuk told Al Jazeera, “possibly as a result of the personal relationship between the two executives.”

What sensitive information could have been a risk?

There are also questions about what sensitive information Alice Huang may have had access to through her relationship with Jensen Huang.

In an analysis published by the Council on Foreign Relations, a think tank, senior fellow Jessica Brandt pointed to information about how Nvidia designs its China-specific chips.

“Information about its conversations with policymakers could be helpful for anticipating where those controls and other policies are headed,” she said. “Understanding where it disagrees with government could expose fault lines to exploit. And that’s before we get into anything touching R&D [research and development].”

Fedasiuk raised similar concerns about what Alice Huang could have learned about Nvidia’s internal operations and plans for future products, as well as its customer base, which includes American and foreign tech companies.

He also pointed to Jensen Huang’s close ties to Trump and other senior White House officials.

“I have to wonder what kind of information about those people and about those relationships may have inadvertently made its way to Ms Huang or to Chinese intelligence,” he said.

So far, however, there is no publicly available evidence that Alice Huang got access to sensitive information from Nvidia or influenced Jensen Huang’s decisions. US intelligence also has not made public any evidence that Alice Huang was working for Chinese intelligence.

China has flatly denied the allegations of espionage.

“The claim of so-called ‘Chinese spies’ is completely groundless and is nothing but a smear campaign against China,” said Foreign Ministry spokesperson Guo Jiakun on Monday.

Hackers have twice taken control of supermarket fridges across Europe in less than a month, sparking fires and spoiling millions of euros’ worth of food.

On October 11 and 12, attackers heated units at about 700 French stores to as high as 50C (122F). On November 2, a second wave of suspected cyberattacks affected supermarkets and food businesses in at least nine European countries, including Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden.

France has since blamed the first attack on Shahid Kaveh, a cyberunit affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC), calling it the first large-scale sabotage cyberattack on French soil. It is not yet clear who was behind the second wave.

The attacks have raised concern about how exposed internet-connected equipment has become, from industrial machinery to household appliances. Al Jazeera illustrates the devices at risk in your home and the essential services you rely on, and what you can do to protect yourself.

How can a fridge be hacked?

A supermarket’s fridges and freezers are run from one control panel, which is connected to the internet so contractors can manage it remotely. Home smart fridges connect the same way, through Wi-Fi, an app or a cloud service.

The attackers reportedly found the supermarket systems using Shodan, a search engine for internet-connected devices. According to Vincent Strubel, head of France’s National Cybersecurity Agency (ANSSI), they got in through basic security failures:

• Exposed: The equipment was directly connected to the open internet with no extra protection.
• Weak passwords: Many systems were protected only by weak or default logins.
• Outdated: Many units were old models that no longer get security updates.

Once inside, hackers can switch a fridge off, raise its temperature or steal account details. In France, they simply used the controllers’ own defrost function. A poorly protected fridge can also be a doorway to other devices on the same network, from laptops to smart locks.

Speaking to the French Senate on October 21, Strubel warned that the healthcare sector uses the same type of equipment to store vaccines and hazardous materials, from research laboratories to pharmacies.

How hackable is your home?

Essentially, anything connected via the internet could potentially be hacked.

There are about 21 billion short-range connected devices, such as smartwatches, worldwide and 5.4 billion long-range ones, such as remote monitoring systems, according to Kepios’s Digital 2027 Global Overview Report. US internet households now have an average of about 18 connected devices, nearly double the number a decade ago, according to Parks Associates.

Routers are among the biggest targets because they are always online. In April, the UK’s National Cyber Security Centre (NCSC) warned that hackers linked to Russia’s GRU military intelligence were hijacking home and small business routers. By tampering with their DNS settings, which turn website names into IP addresses, the hackers redirected users to fake websites to steal passwords and personal details.

Smart TVs can be hacked without their owners knowing. In June, researchers found that more than a third of apps on LG and Samsung smart TVs could let strangers secretly use a household’s internet connection, hiding their own activity behind that home’s IP address.

Robot vacuums can expose even more. Earlier this year, a programmer reportedly found he could control almost 7,000 DJI Romo robot vacuums with a PlayStation 5 controller. Using Claude Code, an AI coding tool made by Anthropic, to work out how the vacuums talked to DJI’s servers, he gained access to their live camera feeds, audio and floor plans of people’s homes.

What vital services can be hacked?

The same weaknesses that expose a fridge can affect power plants, water supplies, banks and hospitals.

Many of these services are run by industrial computers that can be reached online. Since the US-Israel war on Iran began, US agencies have warned that Iran-affiliated hackers are attacking these systems.

In July, a cyberattack in the US state of Minnesota targeted more than 30 community water systems, according to the state’s IT agency. Officials suspected Iran-aligned hackers, and the FBI and CISA warned that water and wastewater systems were increasingly being targeted, with facilities in 12 states affected at the time.

That same month, a cyberattack attributed to Iran-linked hackers forced a small British power plant offline for four days. It was reported as the first successful attack of its kind on UK energy infrastructure.

The US Cybersecurity and Infrastructure Security Agency (CISA) lists sectors it considers critical infrastructure. The graphic below shows some of the key ones, and what a hack on each could mean for you.

Banks are targets, too. In late September and early October, hackers stole personal data from at least seven South Korean financial firms, affecting about 68,000 people. Yegaram Savings Bank and Shinhan Bank were hit hardest, with about 40,000 and 25,000 customers affected, respectively.

According to The Wall Street Journal, the attacker used ARTEX, an open-source AI tool developed in China to test networks for weaknesses. US cybersecurity firm CrowdStrike said the attacker was likely a China-based individual who also used Claude Code, an assessment it made with moderate confidence.

Which industries are most politically targeted?

The European Repository of Cyber Incidents (EuRepoC), a research database tracking political cyberattacks worldwide, logged 4,932 major incidents between January 2000 and November 2026.

The number of incidents has grown sharply in recent years, peaking at 795 in 2024. About two-thirds of all incidents recorded since 2000 have occurred since 2022.

Governments are the biggest target. State institutions account for nearly 40 percent of all targets, led by the civil service and government ministries, followed by the military, police, political parties and legislatures.

Critical infrastructure is the second most targeted sector, led by health, finance, telecommunications, transport and energy, followed by defence firms, manufacturing, research and digital service providers. Companies, schools, civil society groups and media outlets make up most of the rest.

EuRepoC tracks only politically significant attacks, a fraction of all cyberattacks. Beyond these, hackers often target individuals and companies with scams.

How to protect oneself?

Hackers rely on weaknesses such as weak passwords and devices that no longer receive updates.

Awais Rashid, a professor of cybersecurity at the University of Bristol, told Al Jazeera that as infrastructure becomes more digitised, the risk of disruption from cyberattacks has risen. But, he added, “the world works because cybersecurity works effectively”.

The UK’s NCSC also advises people to turn off features they don’t use, such as remote camera access.

If a power plant or water system is hacked, there is little individuals can do. The UK’s Be Ready campaign, launched last month partly in response to cyber-threats, urges households to keep a three-day supply of water, food, medicine, cash and torches.

The graphic below shows five simple steps you can take to protect yourself from hackers.

The French government said it is seeking tough sanctions to deter further cyberattacks across Europe.

France says it has summoned Iran’s ambassador to Paris “to lodge a very strong protest” after it accused Tehran of carrying out a major cyberattack targeting supermarket fridges last month.

“It marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people,” Foreign Minister Jean-Noel Barrot said on Tuesday.

“I can also tell you that we rule nothing out and will take all measures – including those we may not disclose publicly – that we deem proportionate and necessary to deter any further attacks,” he added.

Barrot, speaking on France Info ‌‌television, said the government would push for European Union sanctions in response to what he called an “attack of unprecedented scale and aggression in our country”.

He said firm measures would be taken “to deter anyone who might be tempted, in Iran or elsewhere, to do it again”.

On Monday, Barrot said Iran’s Islamic Revolutionary Guard Corps (IRGC) was behind cyberattacks targeting more than 700 French supermarkets on October 11 and 12, when refrigerators were remotely accessed “to initiate abnormal, indefinite defrost cycles”.

Raised temperatures in fridges forced the supermarkets to throw away all perishable food.

Millions of euros’ worth of food was spoiled, according to retailers. In some cases, the raised temperatures sparked fires or melted equipment.

French supermarket groups E-Leclerc, Intermarche, Carrefour, Monoprix and Cooperative U were all hit.

Paris prosecutor Laure Beccuau said on Monday she had opened an investigation into Shahid Kaveh, a cyber unit of the IRGC, over the attacks.

The prosecutor’s office has requested international arrest warrants be issued for two Shahid Kaveh officials.

Similar incidents have since been reported in other European countries.

In a suspected cyberattack on November 2, temperature spikes were recorded in stores in Belgium, Estonia, Ireland, Luxembourg and Sweden.

Jody Westby, chief executive of Global Cyber Risk LLC, said tracking down the group directly responsible for the attacks is “very difficult” because of poor cooperation on international cybercrime investigations.

“It’s been a problem for 20 some years, and now it’s a little better, but only marginally so,” Westby told Al Jazeera. She said that it was difficult to track and trace the origin of such attacks “because of the nature of packet switching”.

In recent days, European air traffic has also been disrupted by false bomb alerts against dozens of flights, although the origin of those threats has yet to be determined.

The decision comes after ​an OpenAI agent breached ​an Australian government website in June.

Australia will make it mandatory for artificial ⁠⁠⁠⁠⁠⁠⁠⁠intelligence companies to immediately report when their ⁠⁠⁠⁠⁠⁠⁠⁠AI models go rogue and to open their models for evaluation, the government said.

Prime Minister Anthony Albanese said on Tuesday the government had accepted all recommendations from a rapid review into the breach, which “include ⁠⁠mandatory AI company reporting when ⁠⁠it comes ⁠⁠to misaligned behaviour or cyber-incidents, and consideration of reforming criminal ‌‌law in cases of serious misconduct”.

“Australia is the first mover in this space, and we want to make sure that we continue to work so that we can reap the potential benefits from AI,” he said.

The decision comes after OpenAI-powered models hacked into an Australian government health data system in June, slipping past its digital defences and accessing files without authorisation.

Top AI firms have recently raised the alarm regarding the risk of humans losing control of their systems, calling for AI development to slow down to a pace that allows it to be safely regulated.

Earlier this year, Anthropic’s safety research scientist Evan Hubinger went so far as to say he believes there is a greater than 10 percent chance that AI could “kill all humans” within a decade.

Rapid incident notifications

The new Australian AI regulator will oversee security controls throughout the development and deployment of AI systems, identify and manage serious risks, and conduct independent ‌‌evaluations of AI models.

The AI standards would also mandate rapid notification to the government of incidents such as “misaligned behaviour” conflicting with developers’ intentions.

Australian government documents define frontier AI as the most sophisticated models at the cutting edge of current technological capability.

Albanese told OpenAI chief executive Sam Altman that the US company took too long to inform the government of the incident. OpenAI apologised for the breach and its slow response.

Inquiry recommends law changes

A government inquiry into the June breach made several recommendations, including that the government consider changing the law.

The proposed AI regulator would follow Australia’s appointment of an eSafety Commissioner in 2015. The office describes itself as the world’s first government agency dedicated to keeping people safer online.

Since December last year, the commissioner has been enforcing a world-first ban on Australian children younger than 16 holding accounts on popular social media platforms.

Italy says civilian infrastructure in Europe is “under attack”.

A series of bomb threats this week grounded flights and put airports on high alert. No explosives were found, and the threats appear to be false.

But the disruption is not limited to aviation. Hackers have also targeted supermarket freezers in several countries, raising temperatures and spoiling food.

Together, the incidents are raising fears and questions about a wider campaign of hybrid attacks.

Who could be behind these threats? Are they connected? And can European nations come together to counter these acts of aggression?

Presenter: Dareen Abughaida

Guests:

Eric Schouten – Founder and CEO of Dyami Security Intelligence

Dennis-Kenji Kipker – Research director of the Cyber Intelligence Institute

Patrick Bury – Defence and security specialist at the University of Bath

The prime minister blames pro-Russian hackers for the leak, as her top diplomat says the cyberthreat was ongoing.

Italian Foreign Minister Antonio Tajani has said his personal data had been disseminated on the dark web, with Prime Minister Giorgia Meloni blaming pro-Russian hackers for the leak.

Tajani announced in a social media post on Saturday that “for days now, cybercriminals have been publishing my personal data on the dark web and seeking further information, effectively exposing me to new threats and intimidation”.

The threats against Tajani, who is also vice prime minister of Italy, come amid a spate of hoax bomb threats across Europe that have forced flight diversions, security alerts at broadcasters, and attacks on supermarket refrigeration systems.

“They are also targeting my family; they are willing to pay for more details about me and my loved ones,” Tajani added in his X post. “My response is very simple: I will not be intimidated in any way.”

‘Matter of grave concern’

Meloni expressed solidarity with Tajani “following the revelations about the activities of pro-Russian hackers, and the publication on the dark web of personal data”.

She called attempts to sell confidential information about government officials “a matter of grave concern that must be addressed with the utmost determination”.

Tajani added in his statement that Italy’s “position on Ukraine is the political reason I have been targeted: defending the freedom of a sovereign state, taking a clear stand in support of a nation’s democracy and independence, is dangerous in the eyes of these criminal entities”.

He also suggested that the cyberthreats may also be a reaction to the Italian government’s efforts to strengthen the Foreign Ministry’s digital defences.

Tajani did not specify what kind of information had been shared, but suggested that the cyberthreat was ongoing.

He added that the ministry was taking the threats seriously and was coordinating its response with allied countries.

A string of hoax alerts causing flight diversions across Europe this week have broadened to include newsrooms.

A new series of bomb threats caused more flight diversions across Europe on Friday, while also expanding to target a number of media organisations.

British broadcaster Sky said it was one of a number of newsrooms that received a bomb threat. “We have carried out a security assessment and reported the matter to the relevant authorities,” a spokesperson said.

Bulgaria’s Nova TV and the Irish public broadcaster RTE received emailed bomb threats from a purported “Mikhail Andropov”, headlined “Message to the West”, portraying the threats as a prelude to more disruptions across Europe.

RTE briefly evacuated staff, including radio and television presenters, in Dublin after an email was received on Friday morning. RTE Radio One presenter David McCullagh later told listeners that the threat warned that a bomb would explode within 45 minutes.

The Irish government said hoax bomb claims were also sent to Virgin Media, Newstalk radio and The Irish Independent newspaper and that it was unclear who was behind them.

“However, these threats come on the heels of the ongoing disruption to aviation around Europe caused by similar threats, and it seems likely that this is a coordinated campaign of disruption,” it said in a statement.

The incidents come a day after hoax bomb threats disrupted more than two dozen flights across Europe on Thursday, and days after other aircraft and a cruise ship received bomb alerts.

‘Hoax threats’ increasing

On Friday, jets escorted airliners flying from Brussels to Sofia and from Prague to Bucharest and Cyprus through Hungarian airspace due to bomb threats, Hungarian Defence Minister Romulusz Ruszin-Szendi said.

He also said NATO had ordered an air patrol near the Hungarian-Romanian border, the first report that the Western defence alliance had become involved.

Danish police said threats were directed at traffic at Copenhagen airport but that there appeared to be no danger to passengers. The airport said it was “operating normally”.

Czech police registered bomb threats to nine flights departing from or arriving in Prague. An airport spokesperson said no flights had been ⁠⁠cancelled as a result.

France said four new bomb threats were made to aircraft flying over French territory, and that all landed safely.

A Ryanair flight from Rome landed as scheduled in Lisbon, CNN Portugal reported.

About half a dozen ‌‌flights were disrupted on Tuesday and more than two dozen on Thursday, some of them making unplanned landings or being escorted to their destinations by fighter jets.

Al Jazeera’s Frances Read, reporting from London on Friday, said that while the threats have not been credible so far, disruptions appear to be widening.

“The number of hoax threats this week is making governments sit up and take notice about where this might be coming from and also think of solutions for how to deal with it,” she said.

Supermarket refrigerators and freezers across Europe have been targeted by a cyberattack that raised the temperature of internet-linked units, destroying and damaging large quantities of food.

On Monday, fridges and freezers at more than 100 shops in several European countries ran hot. Cyberattacks on supermarkets began last month, when hundreds of French supermarkets were left with spoiled food and damage to units which had overheated, costing millions of euros.

So far, it remains unclear why hackers targeted the supermarkets, but attacks have spread across the continent and even to the United States.

Here’s what we know:

Which countries in Europe have been targeted?

On Monday, several supermarkets in Europe were affected, including the following:

• Dutch supermarket operator Delhaize said dozens of its shops in Belgium and Luxembourg were hit by an “IT incident”.
• French retailer Carrefour said about 15 of its 700 Belgian locations were hit by refrigeration problems.
• The Colruyt group, which runs Spar stores in Belgium as franchises, said five of its shops were affected.
• Swedish Coop said cooling systems at seven of its 800 stores were affected, with disruptions ranging from complete shutdowns to partial operation.
• Swedish furniture retailer IKEA, which also operates restaurants at its stores, said one site in Mons, Belgium, had been affected by a cyberattack.
• De Laet & Van Haver, the Belgian butchery chain, said the temperature in its fridges at its store in Hove, south of Antwerp, was raised as high as 18 degrees Celsius, ruining meat worth about 15,000 euros ($16,764).
• The food wholesaler Musgrave said a cyber-incident affected refrigeration systems in 13 of its SuperValu stores in Ireland.
• In October, hundreds of French supermarkets suffered cyberattacks, spoiling tonnes of food, causing fires and melting parts of refrigeration units.

What has happened in the US?

In August, freezers at a market in Fort Huachuca, an Army base in Arizona, went into defrost mode, spoiling all the frozen food they contained, according to a post on Facebook by the base.

The same month, the naval station in Newport, Rhode Island, reported on Facebook that its refrigeration system was affected, leaving only dry goods were available for purchase.

The Pentagon considered the freezer malfunctions on the military bases to be a suspected hack, the Reuters news agency reported late last month, citing four officials close to the matter.

One official said Pentagon investigators were communicating with the French authorities about the issue.

How are cyberattackers targeting fridges and freezers?

Hackers can access the controls of fridges and freezers which use internet software and raise their temperature in order to spoil frozen food.

In some cases, hackers have increased the temperature of appliances to as high as 50C (122F) in European supermarkets, causing them to melt or even catch fire.

Awais Rashid, a professor of cybersecurity at the University of Bristol in the UK, explained that many supermarket refrigeration systems which are remotely managed and, often by third parties, have not been given necessary software updates to prevent hackers.

“In line with established cyber security practices, these systems should be managed via secure networks. However, this is not the case in these incidents and they are accessible on the Internet,” Rashid told Al Jazeera.

“A remote managing party can access a web server on the controller to configure the system including temperature changes and maintenance. There are known vulnerabilities in several controllers (many of which are past their end of life),” he said.

Rashid added that vulnerabilities include “easily guessable” passwords, which would mean anyone could gain access.

Why are hackers doing this?

The motive behind the attacks is unclear, but authorities believe it may be a deliberate attempt to disrupt food supplies.

On Monday, the European Commissioner for Agriculture and Food, Christophe Hansen, said the attacks on fridges were a “deliberate attempt to disrupt” the bloc’s food supply and to undermine consumer confidence.

He added that while “food security is not currently at risk … the food waste and impact on businesses are real”.

Rashid said that while there are few details about who may be behind the attacks or what their motives are, it is likely that these are “the motive here is likely disruption”.

“This has financial impacts on the supermarkets but also societal impacts in terms of security of the food supply chain. Critically, this risks undermining trust in infrastructures on which people rely daily,” he said.

Who is behind the attacks?

On Monday, Belgium’s prosecutor’s office announced that it had opened a criminal investigation into the latest fridge cyberattacks. But so far, no one has taken responsibility.

Theories have emerged linking state actors to cyberattacks generally, with North Korea most recently accused of being behind last week’s $6.3bn Binance cryptocurrency heist, which forced the crypto group to freeze accounts.

European intelligence officials have also warned that Russia is escalating its shadow war on the continent amid the ongoing conflict with Ukraine, with cyberattacks among the methods it uses.

On Tuesday, the UK’s National Cyber Security Centre warned that Britain needs to be prepared for an artificial intelligence (AI)-powered cyberattack on its critical national infrastructure within the next two years.

“By 2028, it is highly likely that Russia, China and other nation states will routinely use AI-cyber to achieve their geopolitical goals, with the UK facing an increase in scale and speed of sophisticated cyberattacks,” the NCSC said in a report.

The report comes shortly after the UK launched its “Be Ready” campaign, calling on citizens to stockpile enough tinned food, bottled water and cash to last three days in the event of a cyberattack or national emergency.

Rashid said that as our infrastructure becomes increasingly digitised, the risk of disruption from cyberattacks, especially “cyber-physical infrastructures such as refrigeration systems”, has risen.

“However, we should also note that a lot of our digital infrastructures operate safely everyday because good security practices enable that. The world works because cyber security works effectively. So it is important that all businesses follow good cyber security practices,” he said.

Russian Emergencies Ministry also says its mobile app suffered a ‘massive cyberattack’, leading to ‘false information’.

Ukraine’s Air Force has said its air raid alert app sent erroneous messages after allegedly being hacked by Russia.

Fake alerts warning of nuclear and chemical threats to areas in and around Kyiv were sent on Sunday, along with warnings of potential street combat. An erroneous message also said Russia’s hypersonic Oreshnik missile had been deployed.

“The air alert app appears to have been subjected to enemy influence,” the Ukrainian Air Force said on Telegram on Sunday. “There is no radiation threat! Stay calm and follow our updates on our channel.”

SPRAVDI, Ukraine’s Centre for Strategic Communications, blamed Russia for the hack in a post on X.

The raid alert app is used across Ukraine to warn people in real time of incoming Russian air attacks. A separate app, specifically for the Ukrainian capital, was working normally, according to Kyiv authorities.

Hours later, early on Monday morning, Russia’s Emergencies Ministry said its mobile app had been hit by a “massive cyberattack”.

The ministry said on Telegram that the attack led to the spread of “false information”.

Russia’s and Ukraine’s announcements follow the end of a truce between the two countries in Kherson.

The localised ceasefire, which began on Tuesday and ended on Sunday, was the longest of the war so far.

Crypto firm Binance says it has covered 90 percent of losses from the multibillion-dollar hack.

The FBI has linked North Korea to the theft of a record $6.3bn in virtual assets from cryptocurrency exchange Binance.

Malicious actors from North Korea were observed laundering the ⁠stolen assets ⁠by converting them primarily into the cryptocurrency Ethereum, ⁠the FBI said in a statement on Saturday.

The US agency blamed the operation specifically on a group called TraderTraitor, the same group blamed for a $1.5bn theft from the Bybit platform in February last year.

According to the statement, the assets are expected to be “further laundered” in stages.

The FBI called on virtual asset service providers to block transactions being used in the latest laundering operation, providing the suspected digital addresses to watch for.

In a separate statement on Saturday, Binance said it has replaced 90 percent of the amount stolen by using company money to buy new tokens.

The remaining 10 percent consists of less liquid tokens, meaning they ⁠may take longer to buy, it added.

“We will continue to buy the remaining relevant token assets… until the covered amount reaches 100 [percent] for all tokens. Binance will absorb the financial impact of these stolen funds, not our users,” the company said on X.

The money spent re-buying tokens came from a $1bn Secure Asset Fund for Users (SAFU), a Bitcoin reserve fund Binance ⁠holds to protect customers in the event of security ⁠breaches, as well as some of its Futures Insurance Fund and the company’s corporate treasury.

Crypto prices fell on Friday, as Binance, which runs the world’s largest crypto exchange, sought to reassure customers their funds were safe.

Binance co-CEO Richard Teng said on Friday that the breach was a “complex attack” involving a compromised laptop and malicious software designed to ⁠delete evidence of its activity, making it hard to trace and investigate.

After ⁠the hack, the exchange stopped allowing customers to withdraw their funds.

Binance said later on Saturday that it was on track to reopen withdrawals on Sunday.

Binance also announced the publication of a new proof-of-reserves snapshot, allowing users to independently verify that their assets were backed at a minimum 1:1 ratio.

Earlier this month, authorities worldwide urged website administrators to execute emergency updates after a nonprofit programming foundation flagged critical security flaws that could allow hackers to breach systems.

Government and corporate websites briefly went offline to patch the vulnerabilities, nicknamed PHP2Shell, which were discovered by independent cybersecurity experts using artificial intelligence (AI).

The vulnerabilities were embedded in the code of a widely used open-source web programming language, PHP, for more than a decade. They had gone unnoticed, however, because it would have been too complicated for humans to exploit them without the use of advanced AI.

But cybersecurity experts, as well as those maintaining important software, say PHP2Shell could be the first in a deluge of security flaws exposed by emerging AI. They say much of the world’s most critical digital infrastructure is maintained by volunteers, who often lack the resources and time to respond to newly discovered threats.

“There’s been a lot of people in the AI safety community that said this is one of the first areas where we are going to see the harmful impact of AI,” said Peter Slattery, a research scientist at MIT’s FutureTech, who studies how cybersecurity experts are dealing with the new technology and tracks real-world incidents involving AI.

A digital world built on volunteer work

PHP got its start in 1995, when Danish-Canadian programmer Rasmus Lerdorf sought to track how many people visited his online resume. Over time, others around the world improved Lerdorf’s software, and it grew in popularity.

As with other open-source coding projects, anyone could download, modify and share improvements. Websites like Facebook and Wikipedia were built using PHP, which runs about 70 percent of the world’s websites.

In 2021, a dedicated nonprofit, the PHP Foundation, was launched to coordinate development. Like many other foundations maintaining open-source software, it operates on a meagre budget.

Most of the digital infrastructure consumers use is powered by open source software. The Mozilla Firefox browser is open source, as are languages like Perl, Python, and JavaScript. The software that lets a computer communicate with others on the internet is often open source, with many servers using products like Apache HTTP Server, maintained by the Apache Software Foundation.

“The world today, including proprietary software vendors, relies on open source software for its digital infrastructure,” said Amanda Brock, CEO of OpenUK, a nonprofit that supports open source software.

The world’s largest corporations, like Meta, Google, OpenAI and Anthropic, depend on that volunteer-built, open-source infrastructure. Now, those companies’ own AI tools are uncovering security flaws in the infrastructure at a pace that needs far more resources for groups like the PHP Foundation to keep up.

“It’s simply not possible with the resources in place to fix all of the known vulnerabilities,” Brock said. “Foundations are attempting to manage these challenges, but the smaller ones don’t have hundreds of millions in funding, and managing this at the pace AI requires is proving impossible.”

A deluge of new bugs to fix

The PHP2Shell vulnerabilities were found through several advanced AI models, which can employ far more complicated attempts to hack past security barriers than humans could.

Developers of other software are also discovering far more security flaws than in the past because AI is being used to probe defences.

Google said it uncovered more than 1,000 security bugs in the last update for its Chrome browser, more than in the last two dozen updates combined. Mozilla, the foundation behind the Firefox browser, found more than 400 security vulnerabilities in April, a significant jump from the previous record of 76 bugs discovered just one month earlier.

“We have maybe 10 times more issues than usual because we are using AI to find them,” said Jarek Potiuk, part of the volunteer security team at the Apache Software Foundation. (In keeping with the foundation’s non-hierarchical ethos, Potiuk said he has no real title).

Potiuk said there is an “industry-wide movement” to conduct scans using AI models and identify security vulnerabilities, much like was done to find the bugs in PHP. But the scans themselves cost money – used to pay for the tokens for AI models – and afterwards, humans must pore over them to weed out false positives.

“Every project, every foundation is doing this right now – spending enormous amounts of time to find these issues,” Potiuk said. “AI helps to find them, but you have to verify things, you have to review them.”

Earlier this year, Anthropic launched Project Glasswing, offering $100m in credits to support its advanced Claude Mythos AI model to search for security vulnerabilities in the world’s critical software. In one month, more than 23,000 vulnerabilities were found across more than 1,000 open source projects.

The Apache Software Foundation has taken advantage of another scheme, the Alpha-Omega project, to scan for security bugs across the 290 software packages it maintains. The project, backed by companies like Anthropic, Amazon, Google, Microsoft and OpenAI, spends about $7m a year helping open-source developers find critical security bugs.

But those working on finding and fixing the security flaws say the corporate world could be doing a lot more, given the trillion-dollar valuation of companies whose products would not work without free software like the packages the Apache Foundation provides.

“They are helping a lot, but we need more active players in this area,” Potiuk said, “because it’s highly disproportional – the impact it has on the corporate world versus the open source world”.

When a major security flaw like PHP2Shell is uncovered, it often comes down to a handful of volunteers to fix it.

Keeping the internet’s infrastructure as decentralised and open-source as possible is crucial, Potiuk said. Instead of buying out something like PHP, major players like Google or Microsoft could, for instance, pay staff to dedicate some of their work hours to maintaining open-source projects they use.

Real-world targets

The 2021 Log4Shell vulnerability, which allowed hackers to remotely run code on millions of devices through a widely used library maintained by the Apache Software Foundation, underscored the critical role open-source software plays in system security. That bug was discovered without the use of AI.

Suddenly, cars, microwaves and a host of electronic devices connected to the internet were vulnerable, Potiuk said.

“That was the moment when the whole ecosystem realised how important it is to take care of open source,” he said.

A bug like that, if found by a malicious hacker and exploited before there is a chance to patch devices, could have caused a major disruption.

Slattery said the database of incidents he and his colleagues maintain shows that an increasing number of vulnerabilities are being detected, and it is a matter of time before some are exploited in the real world.

“We are starting to see both a lot more vulnerabilities detected and addressed in time, but also attacks on a wide range of systems,” Slattery said. “We have been moving in this direction for a long time. There are more and more things now you can attack.”

An Icelandic web company, FlokiNET, has defended the data’s publication as satisfying a ‘legitimate’ public interest.

The United States Department of Homeland Security (DHS) has asked an Icelandic web hosting company to take down a site with information about tens of thousands of its employees.

On Thursday, the Icelandic company FlokiNET posted a letter it received from the cybersecurity firm ZeroFox, on behalf of DHS.

The letter accused FlokiNET of violating its terms of service by publishing a “stolen” employee dataset and asked it to “remove or disable” the information.

“The content is live and places more than 40,000 identifiable individuals at risk of harassment, stalking, and physical harm,” the letter said.

FlokiNET said the letter concerned one domain, icepi.cx, which has compiled information about employees from a range of DHS agencies, including Immigration and Customs Enforcement (ICE) and Customs and Border Protection (CBP).

Those agencies have come under intense scrutiny since the start of President Donald Trump’s mass deportation campaign in 2025.

But the Trump administration has often refused to identify DHS agents involved in specific operations, citing safety risks.

Though FlokiNET said it refused to comply with DHS’s request, it noted that the website’s registrar ultimately suspended the domain. The employee information has since moved to a different domain.

In a statement posted online, FlokiNET defended its decision not to remove the site.

“Federal officers carrying out an enforcement programme are not private individuals while they are carrying it out,” the company said. “The public has a legitimate interest in knowing who is doing that work, under whose authority, and in which office.”

The database was first posted online on Wednesday by Distributed Denial of Secrets (DDoSecrets), a group that showcases leaked government data.

In the past, DDoSecrets has released emails from convicted sex offender Jeffrey Epstein, as well as information from the Israeli Ministry of Justice and police departments in the US.

A hacker group calling itself the “Department of Peace” has claimed responsibility for obtaining and sharing the DHS data.

Since the database was first published, other groups have spread the information elsewhere, including on sites like icepi.cx. As a result, the information is unlikely to be entirely scrubbed from the internet.

The Trump administration, however, has taken an aggressive approach to online platforms purporting to contain information about ICE employees and other agents involved in immigration operations.

Last year, for instance, the US Department of Justice pressured tech giants like Apple to remove apps that track ICE agents, including one called ICEBlock.

The move sparked backlash from Democrats and free-speech advocates, who argued that the public has a right to report on ICE’s movements.

“Blocking access to these apps at the request of the federal government raises the distinct possibility that Apple is working with government to violate its customers’ First Amendment right to record and report on the activities of their government,” Democratic Representative Jamie Raskin wrote in a letter last year, asking Apple to review its decision.

Immigration agents, meanwhile, have taken several steps to conceal their identities during operations, including wearing face masks or street clothes.

That lack of transparency has spurred criticism from human rights groups and immigration advocates, who argue that they have little recourse to pursue allegations of excessive force or impropriety during ICE raids.

Since Trump was sworn in for a second term, at least 25 people have faced gunfire from immigration agents. Six of the shootings have resulted in deaths.

Other cases have involved alleged violations of civil liberties – including unlawful arrests and racial profiling – as well as controversial tactics like car ramming and tackling.

Authorities say the fire in Brasov in September is part of a broader Russian campaign against European countries that support Ukraine.

Romanian authorities say they have uncovered a network “coordinated” by Russia that they believe was responsible for a fire at an industrial site near a state-owned weapons factory in September.

Romania’s Intelligence Service said on Monday that the blaze in the central city of Brasov on September 14 was “part of a wider campaign of sabotage operations coordinated” by Russia amid its full-scale invasion of Ukraine.

The agency said the operations were aimed at arms manufacturers and “other targets of military and industrial interest”.

“These actions are intended to intimidate, undermine defence capabilities and weaken the contribution of the targeted states to European and regional security,” it said in a statement.

There was no immediate comment from Russia on Romania’s claim. Moscow has previously repeatedly denied such accusations.

Romania’s Directorate for Investigating Organized Crime and Terrorism, known as DIICOT, said three people had been involved in the Brasov fire – two Belarusians and a Ukrainian, all living in European Union countries.

Two were “tracked down and remanded in custody in Germany while they were preparing to commit similar offenses”, the directorate said.

The third remains at large in Poland.

According to Romania’s Intelligence Service, recruits for such networks are often found on social media and are first offered money “for a seemingly harmless task”, such as “observing or photographing certain targets”.

Over time, “the tasks become increasingly serious, potentially involving acts of vandalism, arson or even murder”, it said.

‘Hybrid’ war

Romania, a member of the EU and NATO, shares a border of more than 600km with Ukraine.

Its centrist president, Nicusor Dan, has said the country is a target of a hybrid war that Russia is waging to destabilise nations backing Kyiv, citing drone incursions into Romanian airspace, cyberattacks, disinformation campaigns and sabotage.

Foreign Minister Dan Neculaescu said the fire in Brasov was “part of a broader campaign of sabotage across Europe” targeting military production.

“Hybrid attacks will not hold us back from strengthening our resilience and defense,” he wrote on X.

The accusation follows a string of incidents at defence sites across Europe in recent weeks.

In September, explosions and a fire erupted at an ammunition storage site in Bulgaria, weeks after a blaze at another munitions facility in the country. Both sites are operated by the Bulgarian arms maker EMCO, whose munitions are used in Ukraine.

That same month, firebombs were thrown near the offices of a defence company in Munich, and Romanian authorities said they had detained a Russian citizen accused of filming and photographing military sites in preparation for sabotage.

In August, a blast struck an ammunition factory near Rome in Italy operated by the arms maker KNDS.

At sea, at least eight cargo ships have been hit off the coasts of Romania and Bulgaria over the past three weeks, and about 34 sailors have been reported dead or missing.

Dan, the Romanian president, has called the attacks on ships in Romanian waters “a new example of the tragic consequences of Russia’s aggression against Ukraine”.

A year ago, Poland and Romania also detained eight people suspected of taking part in a Russian plot to send exploding parcels to Ukraine.

Just visiting a page or refreshing an app can be enough to fall victim to a malware attack in which your personal data is stolen from a laptop or phone, researchers have found. You are not even required to “click” on anything.

An Israeli spyware firm has been found to be behind the first-known instance of “zero-click” targeted advertising in which fraudsters or spies can steal private data and send it to external servers, with Al Jazeera journalists among the victims.

In June 2025, 45 devices used by Al Jazeera staff – including several who reported on sensitive subjects – were targeted with spyware which installed itself without the need to open or download any files.

An investigation by the Canada-based academic research unit Citizen Lab, prompted by Al Jazeera’s initial internal probe into the issue, discovered that the Israeli company Candiru was behind the attacks.

Analysts say the findings are “incredibly concerning”, as they confirm the existence of a new global security threat. “We knew we were headed in this direction and now it is out in the public,” Remesh Srinivasan, professor of information studies at the University of California in Los Angeles, US, told Al Jazeera.

“This is the next level, because people are being microtargeted,” he said. “This is the point we’ve come to when it comes to surveillance.”

How ‘zero-click’ malware works

Al Jazeera’s in-house technology team first discovered unusual patterns on devices used by some journalists in 2024. Analysis of network logs provided to the Citizen Lab by Al Jazeera in 2025 provided a clear temporal signature of how the attack was executed.

Malicious advertisements were bought by Discover-Tech, an Israeli company presenting itself as a legitimate advertising firm, but which actually operates as a facilitator for mercenary spyware partners.

Its advertisement network identified Al Jazeera staff, then quietly redirected them to an infected server belonging to Candiru. The spyware firm was blacklisted by the US government in 2021, when Citizen Lab found it was responsible for the illegal hacking and surveillance of at least 100 activists, journalists and political activists across 10 countries.

Al Jazeera Media Network has condemned the targeting of its staff members’ devices and called for those responsible to be held accountable.

Cybersecurity analyst and author Eddy Willems said the advertisements used automatically infect devices the moment they pop up on the screen, but there is an important technical nuance. “Executing code inside the browser does not automatically give an attacker full control over the computer,” Willems told Al Jazeera.

“To escape the browser’s isolated environment – the ‘sandbox’ – the attacker may need a second vulnerability,” Willems said, adding that an advanced spyware operation can combine several vulnerabilities.

“The attacker attempts to exploit vulnerabilities to bypass security boundaries. This is precisely what makes this type of attack so dangerous,” the analyst said.

Once the device is infected, the malicious software is designed to collect a wide range of sensitive data, including files, documents, and browser data such as cookies, bookmarks, and saved credentials.

It can also capture keystrokes, take screenshots, record microphone and webcam input, and extract emails and messages from popular communication platforms. To avoid triggering security mechanisms, the spyware often uses encrypted communication channels and breaks up stolen data into smaller chunks sent over time.

Advertising: A new global security threat?

Analysts say Citizen Lab’s findings point to the escalation of an existing threat, which expands the scale and reach of traditional cyberattacks and makes them much harder to detect.

While “zero-click” attacks are not completely new, the findings outline a new technique through which online advertisements are used as a route to infection.

Stephen O’Shaughnessy, a lecturer in cybersecurity at the TU Dublin Blanchardstown campus in Ireland, explained that when a user opens a website or app, an automated auction sells the advertisement space in a fraction of a second. That auction shares data about the victim, including the device ID, IP address, rough location and the app or site they are on.

“Discover-Tech posed as an ordinary advertiser, used that data to find their target and win the auction for that person’s screen,” O’Shaughnessy told Al Jazeera. “Anyone with a phone or browser that shows ads can be reached, without the attacker needing their phone number or email.”

“Because no message or link is involved, there is almost nothing for the victim to notice,” he added.

Discover-Tech appeared on lists of “certified” and “approved” vendors maintained by Google and advertising industry association IAB Europe, and has served advertisements via major networks such as Google, Yandex and Beeswax.

In its report, Citizen Lab said this illustrates the structural flaws in the online advertising system, which essentially failed to detect or prevent the abuse.

Discover-Tech advertisements have popped up on devices used by personnel in national-security-sensitive networks around the world, including those of various ministries of defence, armed forces, national cyber agencies, intergovernmental organisations and media outlets, Citizen Lab found.

The research unit said these advertisements have also appeared on networks used by the United Nations, NATO, the European Parliament, the European Commission and the Council of the European Union’s General Secretariat.

‘Almost nobody was watching’

Government networks have also been targeted in at least 24 countries, including the United States, Italy, Denmark, Norway, Australia, Russia, Mexico and Israel itself. Networks of media organisations have also been targeted, mainly in Australia, Denmark and Sweden, according to Citizen Lab.

In a separate report, New York-based advertising security firm Confiant said its own investigations had found that some of Discover-Tech’s advertisements also appeared in critical networks used by the Pentagon, the United Nations International Atomic Energy Agency and the International Criminal Court.

O’Shaughnessy said infection has not been confirmed there – only profiling of users. “But that alone is concerning, he said. “The ad system was built to send code from strangers to billions of screens with pinpoint targeting. Almost nobody was watching it from a security angle.”

The analyst said the risk remains low for most people as these attacks are expensive and aimed at specific targets. “For individuals at high risk, like journalists and officials, the best first defence is to install an ad blocker, switch off their advertising ID through their phone’s privacy settings, keep everything updated, and turn on Lockdown Mode or Android’s Advanced Protection,” he said.

Precautions also need to be taken within the industry and at government level. “To combat this, the ad industry needs to properly vet who’s buying ads,” O’Shaughnessy said, while “regulators need to stop personal data being sprayed out to thousands of unknown bidders in every auction.”

Citizen Lab investigation says dozens of Al Jazeera devices were infected by malware planted through advertisements.

Israeli advertising technology company Discover-Tech helped place spyware on dozens of devices used by Al Jazeera and other companies, a Citizen Lab investigation prompted by Al Jazeera’s own initial internal probe has confirmed.

Al Jazeera Media Network on Thursday said it “condemns the targeting of devices belonging to several of its employees with spyware”.

“The network voluntarily collaborated with the researchers, and this cooperation, according to the report, contributed to verifying these attacks and publicly documenting them.”

Al Jazeera will continue to “protect its employees and systems”.

The network said targeting journalists is an “assault on press freedom and the public’s right to knowledge” and called for those responsible to be held accountable.

Spyware from Candiru, a firm blacklisted by the United States government in 2021 for its malicious cyber activities, was planted on these devices, using what Citizen Lab described as the first-known instance of “zero-click” targeted advertising.

The Citizen Lab, an interdisciplinary research unit at the University of Toronto, concluded in its report that Discover-Tech purchased the advertisements that had the spyware built in. It then directed devices to Candiru’s malware through these advertisements. The millions of devices that were pointed to the malware include several that belonged to Al Jazeera’s journalists – including several who reported on sensitive subjects.

Al Jazeera’s internal technology team first discovered unusual patterns on devices used by some journalists in 2024. The pattern continued into 2025. Al Jazeera reached out to Citizen Lab for a more detailed investigation into its suspicions that spyware was responsible.

“Analysis of network logs provided to the Citizen Lab by Al Jazeera collected during the attack period provides a clear temporal signature of how the attack was executed,” the University of Toronto-based team said ints report published Thursday.

The “zero-clock” nature of installing this spyware means that once an infected advertisement appears on a device, that device, too, is infected — spying on, and feeding, all the data and information available on that platform to those stealing it.

Meanwhile, New York-based security firm Confiant said in a separate report that some of Discover-Tech’s advertisements also appeared in critical networks used by the Pentagon, the International Atomic Energy Agency and the International Criminal Court.

Candiru’s spyware has previously been used to carry out surveillance on at least 100 journalists, dissidents and others in several countries.