--- title: This Week In Security: Apple Warns Users, Stripe... description: A weekly security roundup covers Apple's push notifications warning targeted users about state-level spyware and its Lockdown Mode recommendation, researchers... canonical: https://daily.dev/posts/this-week-in-security-apple-warns-users-stripe-merchants-leak-keys-copilot-helps-hack-itself-and-9c6nt1m5z twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: This Week In Security: Apple Warns Users, Stripe Merchants Leak Keys, Copilot Helps Hack Itself, And Comcast Senses Movement | daily.dev og:description: A weekly security roundup covers Apple's push notifications warning targeted users about state-level spyware and its Lockdown Mode recommendation, researchers... og:url: https://daily.dev/posts/this-week-in-security-apple-warns-users-stripe-merchants-leak-keys-copilot-helps-hack-itself-and-9c6nt1m5z og:image: https://api.daily.dev/og/posts/9C6Nt1m5Z.png og:image:alt: This Week In Security: Apple Warns Users, Stripe Merchants Leak Keys, Copilot Helps Hack Itself, And Comcast Senses Movement og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # This Week In Security: Apple Warns Users, Stripe Merchants Leak Keys, Copilot Helps Hack Itself, And Comcast Senses Movement **[Hackaday](https://daily.dev/sources/hackaday)** · 9 min read · 0 upvotes · 0 comments ## Summary A weekly security roundup covers Apple's push notifications warning targeted users about state-level spyware and its Lockdown Mode recommendation, researchers demonstrating a hardware-based attack on Boeing 737 ARINC 429 avionics buses, Microsoft Copilot being tricked via an undocumented 'autorun=1' URL parameter into leaking inbox and session data, Comcast's new opt-in WiFi motion detection feature on Xfinity routers, roughly 650 companies' Stripe API keys leaked on trading forums, a new Windows Defender privilege-escalation bypass (CVE-2026-69414) dubbed ShieldBreak, T-Mobile physically cutting a cable to expel Salt Typhoon hackers, a supply-chain attack hitting Rust's arrayref package via malicious build scripts, and a phishing campaign targeting DEF CON speakers and attendees via fake Google Docs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How were attackers able to trick Microsoft Copilot into leaking inbox data without user confirmation? Researchers at Varonis discovered an undocumented URL parameter, autorun=1, that let a Copilot query execute automatically without user confirmation. By repeatedly questioning Copilot itself, they got it to reveal the exact errors and restrictions blocking unauthorized queries, eventually exposing the parameter, which Microsoft later removed after confirming it broke some AI browser extensions that relied on it. _Track how AI assistant vulnerabilities like this get discovered and patched with daily.dev._ ### What is the ShieldBreak exploit against Windows Defender, CVE-2026-69414? ShieldBreak is a Windows Defender bypass, tracked as CVE-2026-69414, that uses Windows Defender itself to escalate to admin privileges. It was disclosed by the researcher known as NightmareEclipse after a previous Defender bypass was patched in July, and as of the report the only workaround is disabling Windows Defender entirely while Microsoft prepares an official fix. _Developers securing Windows endpoints can follow emerging Defender bypasses like this on daily.dev._ ### How did a supply chain attack affect Rust packages through the arrayref crate? The Rust Security Response Team confirmed that a set of Rust packages, including one built around a build script mechanism similar to arrayref, were downloading malicious payloads during the build process. Rust build scripts compile and execute automatically, mirroring the build-hook abuse seen in NPM and PyPI, raising concern about token theft and package manipulation spreading to the Cargo ecosystem. _Rust developers vetting dependencies can stay ahead of supply chain incidents like this via daily.dev._ ## Similar posts on daily.dev - [This Week In Security: Annoyed Researchers, Dangling DNS, And Hacks That Could Have Been Worse](https://daily.dev/posts/this-week-in-security-annoyed-researchers-dangling-dns-and-hacks-that-could-have-been-worse-zkzz1p3fl) · Hackaday · 0 upvotes · 0 comments - [A week in security \(April 13 – April 19\)](https://daily.dev/posts/a-week-in-security-april-13-april-19--p8j2lkoy1) · Security Boulevard · 0 upvotes · 0 comments - [ThreatsDay Bulletin: Wi-Fi Hack, npm Worm, DeFi Theft, Phishing Blasts— and 15 More Stories](https://daily.dev/posts/threatsday-bulletin-wi-fi-hack-npm-worm-defi-theft-phishing-blasts-and-15-more-stories-mhdyvycca) · The Hacker News · 0 upvotes · 0 comments - [This Week In Security: Windows 10 Gets Another Year, SmartTV Botnets, Hiding Payloads, And LastPass Customer Leak](https://daily.dev/posts/this-week-in-security-windows-10-gets-another-year-smarttv-botnets-hiding-payloads-and-lastpass--ie83mxy5e) · Hackaday · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#rust](https://daily.dev/tags/rust), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/this-week-in-security-apple-warns-users-stripe-merchants-leak-keys-copilot-helps-hack-itself-and-9c6nt1m5z) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"This Week In Security: Apple Warns Users, Stripe Merchants Leak Keys, Copilot Helps Hack Itself, And Comcast Senses Movement","url":"https://daily.dev/posts/this-week-in-security-apple-warns-users-stripe-merchants-leak-keys-copilot-helps-hack-itself-and-9c6nt1m5z","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/this-week-in-security-apple-warns-users-stripe-merchants-leak-keys-copilot-helps-hack-itself-and-9c6nt1m5z"},"datePublished":"2026-08-21T14:17:32.374Z","dateModified":"2026-08-21T14:38:19.645Z","description":"A weekly security roundup covers Apple's push notifications warning targeted users about state-level spyware and its Lockdown Mode recommendation, researchers...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/54db5e14c25f516943a40b2f59d47928?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/54db5e14c25f516943a40b2f59d47928?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hackaday","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hackaday","logo":"https://media.daily.dev/image/upload/s--JhDfhy70--/f_auto,q_auto/v1767541814/logos/hackaday","url":"https://daily.dev/sources/hackaday"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/this-week-in-security-apple-warns-users-stripe-merchants-leak-keys-copilot-helps-hack-itself-and-9c6nt1m5z","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,rust,prompt-injection","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hackaday","item":"https://daily.dev/sources/hackaday"},{"@type":"ListItem","position":3,"name":"This Week In Security: Apple Warns Users, Stripe Merchants Leak Keys, Copilot Helps Hack Itself, And Comcast Senses Movement"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/this-week-in-security-apple-warns-users-stripe-merchants-leak-keys-copilot-helps-hack-itself-and-9c6nt1m5z#faq","mainEntity":[{"@type":"Question","name":"How were attackers able to trick Microsoft Copilot into leaking inbox data without user confirmation?","acceptedAnswer":{"@type":"Answer","text":"Researchers at Varonis discovered an undocumented URL parameter, autorun=1, that let a Copilot query execute automatically without user confirmation. By repeatedly questioning Copilot itself, they got it to reveal the exact errors and restrictions blocking unauthorized queries, eventually exposing the parameter, which Microsoft later removed after confirming it broke some AI browser extensions that relied on it. Track how AI assistant vulnerabilities like this get discovered and patched with daily.dev."}},{"@type":"Question","name":"What is the ShieldBreak exploit against Windows Defender, CVE-2026-69414?","acceptedAnswer":{"@type":"Answer","text":"ShieldBreak is a Windows Defender bypass, tracked as CVE-2026-69414, that uses Windows Defender itself to escalate to admin privileges. It was disclosed by the researcher known as NightmareEclipse after a previous Defender bypass was patched in July, and as of the report the only workaround is disabling Windows Defender entirely while Microsoft prepares an official fix. Developers securing Windows endpoints can follow emerging Defender bypasses like this on daily.dev."}},{"@type":"Question","name":"How did a supply chain attack affect Rust packages through the arrayref crate?","acceptedAnswer":{"@type":"Answer","text":"The Rust Security Response Team confirmed that a set of Rust packages, including one built around a build script mechanism similar to arrayref, were downloading malicious payloads during the build process. Rust build scripts compile and execute automatically, mirroring the build-hook abuse seen in NPM and PyPI, raising concern about token theft and package manipulation spreading to the Cargo ecosystem. Rust developers vetting dependencies can stay ahead of supply chain incidents like this via daily.dev."}}]} ```