It takes two minutes to hack the new EU age verification app

Planning for big A night at Madison Square Garden? Enjoy, but don’t say we didn’t warn you.

A WIRED investigation this week revealed new details about Private surveillance state created by MSG owner Jim Dolan and Chief of Security John Eversole. According to court records and WIRED sources, visitors to the park and some other Dolan-owned venues were subjected to facial recognition, social media surveillance, personal surveillance, and more.

The US government’s warrantless wiretapping powers reached a dead end this week. Despite pressure from President Donald Trump to reauthorize the so-called Section 702 spy program in the long term, 20 Republican representatives The House voted against full reauthorization, forcing House Speaker Mike Johnson to extend the program for just 10 additional days.

Meta’s Ray-Ban and Oakley AI smart glasses have an image problem —For good reason. More than 70 civil society groups, including the American Civil Liberties Union and the National Organization for Women, sent a letter to the company this week, calling on it. Abandon any plans she may have hade to equip its AI glasses with facial recognition features. The groups argue that including facial recognition in wearable devices, which can already surreptitiously record videos of people, would further erode any semblance of privacy and potentially make it easier for stalkers, domestic abusers and federal agents.

According to Analysis by WIRED and Indicator. By tracking publicly reported incidents of deep stripping used against middle and high school-aged girls, we identified more than 600 victims in 28 countries around the world.

You might think that banning a $20 billion black market of scammers from your platform would be a no-brainer. But not if you’re Telegram. A WIRED investigation found that the messaging app continued to host Xinbi Guarantee despite the UK government designating it as a facilitator of human trafficking and imposing sanctions on the largest online marketplace of its kind ever. Cryptocurrency tracking firm Elliptic says Xinbi carried out another $505 million worth of transactions in the 19 days after the UK issued its penalty.

The AI ​​race has finally entered the embrace of cybersecurity. Post-anthropic She reveals her new form, the Mythos, as a unique threat to The current security situationOpenAI announced that it also has a new cybersecurity strategy, and a new model to go with it —GPT-5.4-Cyber.

That’s not all! Every week we round up security and privacy news that we haven’t covered in depth ourselves. Click on the titles to read the full stories. And stay safe out there.

European Commission this week It has released its free, open source application To verify the ages of visitors to social networks and pornographic sites. At a press conference on Wednesday, European Commission President Ursula von der Leyen announced that with the release of the app, “there are no longer excuses” for platforms that fail to verify the ages of users. However, that was before experts found the app to be a security disaster.

like Reported by PoliticoSecurity consultant Paul Moore Claimed on X He found a series of security issues with the app that allowed him to hack it “in less than two minutes.” Issues include how the app stores a user-generated PIN which could allow an attacker to easily take over that person’s app profile. (Baptiste Robert, a hacker, confirmed the vulnerability to Politico.) “This product will be the catalyst for a massive hack at some point. It’s just a matter of time,” Moore concluded, referring to von der Leyen in his post.

Europe’s largest gym chain, Basic-Fit, It confirmed a major data breach on MondayIt was revealed that the banking details of nearly one million customers were at risk. About 200,000 members were affected in the Netherlands alone. The stolen data includes banking details as well as customer names, home addresses, email, phone numbers and dates of birth. A spokesman for The Register said members in Belgium, France, Germany, Luxembourg and Spain were also similarly hit by a single system that records members’ visits to clubs. No passwords have been reported to have been compromised, which Basic-Fit says it does not store.

On the same day, global travel and hotel reservation giant Booking.com announced He confirmed that hackers may have extracted customer data Including names, email addresses, phone numbers and booking details. The company told TechCrunch that it “observed some suspicious activity” and “took measures to contain the issue.” Company notices posted by alleged customers on Reddit appear to reveal a breach affecting “anything” users may have shared with the property. TechCrunch reported that Booking.com declined to share details about the scope of the hack, but did so separately He told the Guardian That no “financial information” was lost.

Bluesky’s website and app experienced difficulties throughout the day Thursday after what the company confirmed was a distributed denial-of-service attack. The “sophisticated” attack began on April 15 around 8:40 p.m. ET and caused intermittent failures in feeds, notifications, and search, said Rose Wang, chief operating officer. The company said it had seen no evidence of unauthorized access to user data.

The outages hit Bluesky’s infrastructure but saved communities like Blacksky Which run their own instances on the underlying AT protocol. Blacksky TechCrunch said It has seen a spike in migration requests over the past 12 hours, as users and rival ATmosphere operators promote alternatives. As of Friday afternoon, her Status page The service appears fully functional.

The Trump administration has been on a hiring spree. Department of Homeland Security press release As of January, ICE says ICE has hired more than 12,000 officers and agents in less than a year. As part of Job applicationssupposed to pass immigration officers Extensive background checks Which investigates everything from the arrests they may have faced, the debts they have accumulated, and the foreign nationals they have interacted with in the past seven years. The Associated Press conducted its own background checks on 40 ICE agents and found that three of them faced lawsuits for alleged misconduct in their previous law enforcement jobs, and several faced legal action because of their histories of unpaid debts. DHS did not comment on specific employment options, but acknowledged to the AP that it gave some applicants “temporary selection letters” and offered them to start work before completing their full background checks.

Russian cryptocurrency exchange Grinex, widely said to have helped Russia evade sanctions, suddenly announced Thursday that it would suspend operations following a hack that it says allowed a hacker to steal more than 1 billion rubles of its users’ funds, equivalent to more than $13 million. In his announcements on his social accounts, Grinks blamed the “special services” of a foreign state, writing that “the digital traces and nature of the attack indicate an unprecedented level of resources and technologies available exclusively to the structures of unfriendly states” and seemed aimed at “direct damage to Russia’s financial sovereignty.” Greenex, which was sanctioned by US financial authorities, served as a successor to Garantex, another Russian exchange that was sanctioned because it helped evade sanctions and other alleged financial crimes. According to cryptocurrency tracking firm Elliptic, Grinex was likely created by the same owners and inherited the funds of Garantex and its clients. Grinex has provided no public evidence to support its claim that the theft of its funds was carried out by state-sponsored hackers.