Today’s most uncomfortable story is about the ad on the page, not the link in the email: Citizen Lab says mercenary spyware has been delivered through the ad ecosystem. The other big finding is that knocking out a data center doesn’t necessarily knock out the bots running in it.
1. Citizen Lab finds spyware delivered through the ad stack
The scary part of Citizen Lab’s new report is the delivery truck, not the exploit. The lab says an Israeli ad firm, Discover-Tech, ran a platform called Controlium that let spyware makers push malicious content to chosen targets alongside ads. Citizen Lab concluded that at least 45 Al Jazeera devices were targeted in 2024 and 2025, with Candiru spyware. Researcher Bill Marczak says a victim might not even see an ad.
The evidence, as relayed by WIRED and TechCrunch, which are covering the same report rather than confirming it independently, is unusually concrete. Exposed source code let researchers rebuild the dashboard. Exposed login records included Candiru and Bindecy staff. Bidding records show Discover-Tech-linked ads in over 70,000 apps and 120,000 websites between March and June 2026. Not every ad was necessarily weaponized, it’s unclear whether the ads shown on government and military networks led to infections, and the governments behind the attacks are unknown.
My read: ad tech is built to find one person among millions, which is exactly what targeted spyware wants. Google, IAB Europe and Beeswax acted once researchers showed up, so customer vetting is the control that failed. Citizen Lab says this was found because Al Jazeera’s network logs made it visible, so earlier cases may simply have gone unseen. For developers, every third-party ad tag is now a possible delivery path.
2. Yandex strikes took servers offline, but the bots just moved
The claim that drone strikes on Yandex data centers had crippled Russian bot farms fell apart in Cloudflare’s own data. Traffic from Yandex’s networks collapsed, down roughly 90% or more at the low point. But Cloudflare says global bot traffic held near 39% of requests throughout, and it found no evidence of a wider drop in malicious activity.
The best detail is a gambling customer. Nearly all of Yandex.Cloud’s bot requests to that account stopped after October 8, and identical requests appeared from other Russian hosts, Radist and Selectel. They carried the same JA4 TLS fingerprint, the same unusual paths and headers, and the same custom User-Agent strings. Russian bot traffic to gambling accounts went from 167.7 million to 170.1 million requests.
Note the limits. The workload moved to other Russian providers, so this isn’t bots going global. Cloudflare also says it can see only its own network, and that traffic from a provider doesn’t prove who is responsible. Its social media checks showed no unexpected shift, though it can’t rule out a connection. The practical point still holds: block by behavior and fingerprint, not by which ASN the request came from.
3. A Cisco email bug gives attackers root, and it’s already being exploited
The Register’s headline says unknown attackers are exploiting a Cisco email bug as a zero-day, and that the flaw hands them root. That combination, active exploitation plus full control, is the one that makes admins cancel their evening.
The material supplied for this story is only that headline, with no text of the article. It doesn’t say which products or versions are affected, whether a patch exists, or who is behind the attacks. Anyone running Cisco email infrastructure should go to Cisco’s own advisory and check, rather than rely on a summary. Root on a box that handles company mail is a serious prize, but how serious depends on details we don’t have.
4. TSMC’s $64B US plan comes with power and construction checks
TSMC is budgeting up to $64 billion for US expansion, according to The Register’s blurb, and it’s sending scouts to check on construction progress and power supplies. The source material here is only that summary line.
What it supports is modest: a company about to commit that much money wants to verify physical readiness first. It doesn’t say the scouts found problems, and I wouldn’t claim they did. The interesting part is that the limits on AI capacity may be as much about electricity and building crews as about chip design. If so, the schedule will depend on utilities and contractors, not just policy announcements.
5. X removes 13,000 accounts, but the evidence behind it is unclear
X has purged 13,000 accounts tied to suspected meddling ahead of the US midterms, according to The Register’s headline. It’s a big, round number, and that’s about all the supplied material gives us.
We don’t have the text of the article, so there’s no basis here to say how the accounts were identified, who X blamed, or what evidence it offered. That gap matters. A purge figure without published indicators or methods is hard for researchers to check or learn from. Whether X releases those details is the thing to watch.
