For several months, the maintainers of GrapheneOS, an alternative, security and privacy-focused version of Android, had been talking about a partnership with a major manufacturer. On Monday (2nd), at the Mobile Web Congress (MWC), we found out who the partner is: Motorola Mobility.
A critical flaw has been discovered in Notepad (CVE-2026-20841). That once simple Windows editor that only displayed plain text, you know? The one that Microsoft tainted with Markdown (the vector for this flaw), Copilot, and who knows what else? An attacker could place a malicious link in a Markdown file that, when clicked by the victim, would execute code remotely. A fix was made available by Microsoft in routine updates released on Tuesday (10th).
The security paradox 
densediscovery.com
Living in 2026 consists of fighting with other people on multiple fronts, which has become normalized as “competition.” This applies to everything and always generates a paradoxical effect: the intensification of our private daily wars worsens everyone's lives.
In the latest edition of the Australian newsletter Dense Discovery, Kai drew attention to the book Trapped: Life under security capitalism and how to escape it, by Setha Low and Mark Maguire.
The authors argue that “security has morphed from an inalienable right into a commodity hoarded by those who can afford it,” stimulated by an industry that continues to invent increasingly invasive gadgets and software under a promise that is never fulfilled. This macabre market no longer generates security; it generates fear:
The more you securitise your life, the more those walls and gates and guards make your life all about fear rather than less about fear. And so, as the fear grows, then you want more security, you buy more gadgets, you support all kinds of policing initiatives.
The paradox appears when you take your head out of the ground. The apparatus, delusional in essence, ultimately makes the world worse for everyone:
“[This creates] a self-fulfilling prophecy of fearful people wanting more security, the state and private sector producing it, only to make the world more fearful for some and poorly protected for others.
I think about this every time I pass walls with electric fences and barbed wire, affluent residential condos, CCTV cameras, and ostensive policing. This means that I have been thinking a lot, and increasingly, about the subject.
Firefox joins Chrome and Edge in the problem of dormant extensions that spy on users
malwarebytes.com
The Malwarebytes blog warns of a new wave of compromised browser extensions. The technique used, called steganography, is ingenious:
The use of malicious code in images is a technique called steganography. Earlier GhostPoster extensions hid JavaScript loader code inside PNG icons such as logo.png for Firefox extensions like “Free VPN Forever,” using a marker (for example, three equals signs) in the raw bytes to separate image data from payload.
Newer variants moved to embedding payloads in arbitrary images inside the extension bundle, then decoding and decrypting them at runtime. This makes the malicious code much harder for researchers to detect.
A group of researchers found 17 new contaminated extensions in Firefox. They have attractive names, such as “Ads Block Ultimate” and “Youtube Download.”
The focus of malicious actors on browser extensions is understandable. They have privileged access to the most intimate app we use on a daily basis, update automatically, and, with few exceptions, aren’t household names — I believe that extensions are searched for more by purpose than by name. Another problem is the market for buying and selling popular extensions, which change owners with no transparency.
A good way to mitigate damage is to limit yourself to extensions endorsed by browser stores. In Firefox, they have a "Recommended" seal. In Chrome, extensions reviewed by Google get a green “Featured” seal, according to the store's help section. In search results, you can filter them to display only featured extensions.
In the same vein as the “phones that will stop running WhatsApp” beat, Brazilian news sites seem to have found a new evergreen click source for tech desks imported from Forbes’: millions of leaked Gmail passwords.
There is, in fact, a database of that type circulating online, created by an undergraduate student in the United States. Troy Hunt, who runs Have I Been Pwned, a breach repository, analyzed the data and found that “only” 8% of the passwords — about 14 million — are new. That makes sense, given the database was glued together by aggregating entries from multiple sources and prior breaches.
The main takeaway from a story like this isn’t “your Gmail password may have leaked,” but rather that “any of your passwords could leak at any time.” Not to spread alarm, but to encourage awareness of good digital security practices.
Which ones? For this situation, mostly these two:
You can check whether your passwords have leaked by entering your email at Have I Been Pwned. If it shows up, there’s no need to panic: change the password and enable a second authentication factor. Google explains how to do this for Gmail.
Google
via Android Developers Blog
Did you notice something different in the image above? Since Safari 18.4, released on March, Apple’s web browser no longer displays the lock icon.
Only the gods know how many times I clicked on that icon — each time accidentally, which opened an annoying popup in the middle of the screen. UI details that enhance quality of life 🙏
WebKit’s justification unfolds in two parts: 87% of all connections are now made over HTTPS, meaning secure connections are the norm; and “the presence of the lock could be creating a false sense of trustworthiness, if users instead believe it’s there to signal the website is trustworthy.”
Firefox, at least up to version 138, still displays the lock icon. Chromium, the base of Google Chrome, hid the lock icon in May 2023.