Online shops running Adobe Commerce need this month's patch, the FBI says criminals are breaking into social accounts to steal private photos, and Microsoft's two Copilot apps merge on August 18
If your shop runs Adobe Commerce or Magento, apply this month's patch
Adobe published its August security update for Adobe Commerce and Magento Open Source, the software behind a large number of independent online shops. The national vulnerability database records the most serious flaw in the batch, CVE-2026-71362, as an incorrect-authorisation error scored 9.1 out of 10, usable over the network with no privileges and no interaction from the victim, and lists every supported release line up to the July 2026 versions as affected. In plain terms it lets an attacker switch a customer session to another customer's account. Adobe's own bulletin for the update is APSB26-92, which ships the fixes as individual patch files rather than as a full new release, and states Adobe is not aware of any of these flaws being exploited. A firm that monitors Magento stores says its own filtering has already blocked attempts against this one.
What an attacker gets from this is the customer's side of the shop: order history, saved addresses, stored payment details as the shop displays them, and the ability to place orders as that person. It is a flaw in the shop, not in the shopper's computer, so nothing the customer does protects them — the fix has to be applied by whoever runs the store.
Why it matters: small online shops are frequently running a version that is a few updates behind, because updating a live store is disruptive and there is never a good week for it. This one is worth the disruption: the attack needs no credentials and no cooperation from the victim, and the details of what was fixed are now public for anyone to read. If you run the store yourself, make sure you are on the latest "-p" release for your branch and then apply the August patch. If an agency or developer maintains it for you, email them today and ask for written confirmation that APSB26-92 has been applied, and on what date.
The FBI says criminals are breaking into accounts to steal private photos
The FBI has issued a public alert about a pattern of attacks aimed at stealing intimate images from people's own accounts. The advisory describes criminals getting in by reusing passwords exposed in old breaches, by sending phishing emails that lead to convincing fake login pages, and by posing as customer support staff from the platforms themselves, then using what they find for extortion or publishing it outright. The alert notes that people with a public profile — student athletes are named as an example — are targeted more often, and that victims are frequently attacked again afterwards.
None of the three methods involves breaking any encryption. They rely on a password that was already leaking somewhere else, or on a person believing a message that looks official. That is why the same advice keeps being given: it addresses the actual way in.
Why it matters: the material that makes this attack painful is usually sitting in a photo library or a message thread nobody thinks of as an account worth defending. Do three things this week. Turn on two-factor authentication on your email first and then on every social account — email is the master key, because it can reset the rest. Change any password you have used in more than one place, and let a password manager hold the new ones. And treat any message claiming to be from a platform's support team as false by default: no legitimate service asks you to confirm your login through a link in a message, so open the app yourself and check there instead.
Microsoft's two Copilot apps become one, and some features end August 18
Microsoft is merging the consumer Copilot app and the Microsoft 365 Copilot app into a single app that handles both personal and work accounts. Microsoft's support page for the change says Group Chat, Podcasts and Deep Research all go away on August 18, that group conversations convert to individual chats with prompts and files created by other participants no longer accessible afterwards, and that anything you want to keep from those features should be downloaded before that date. Files stored in the app move to OneDrive, and work and personal accounts stay separated inside the merged app. Subscribers on the paid business tiers keep a research tool under a different name.
Why it matters: the deadline is the useful part. If you have used Copilot's group chats with colleagues, or generated podcast audio or research reports you still refer to, some of that is not carried across — open the app before August 18 and download what you would miss. Mobile users may need to update the app manually for the merged version to appear.
The FTC is sending out $23.8 million in Grubhub refunds
The Federal Trade Commission has begun paying out a settlement over how a food delivery service advertised driver earnings, listed restaurants, and handled customer accounts. The refunds go to 640,038 drivers and diners, most as a check in the mail and the rest through PayPal, with checks to be cashed within 90 days and PayPal payments redeemed within 30. The case was originally filed in December 2024, and payments began on August 12.
Why it matters: the deadlines are short and there is no claim form — the money is sent to people the agency has already identified, so the risk is throwing away an unexpected check or letting a PayPal notice expire. It is also a reliable moment for imitators: a real refund never requires you to pay a fee, buy a gift card, or hand over your bank details or Social Security number to release it. Any message that asks for those things is not the FTC, whatever the letterhead says.
Google Sheets can now build a dashboard from a prompt
Google has added a feature that turns a spreadsheet into an interactive layout described in plain language. Sheets canvas is opened from the Ask Gemini side panel, builds dashboards, trackers and similar views from a written request with no formulas or code, and stays synchronised with the underlying sheet so the numbers update together. It began rolling out on August 13, in English, to Google AI Pro and Ultra subscribers and to Workspace Business Standard and Plus and Enterprise Standard and Plus plans.
Why it matters: the everyday version of this is the monthly figures a small business already keeps in a sheet and re-formats by hand before showing anyone. If your plan includes it, the honest test is a small one: point it at a spreadsheet you actually maintain and see whether the result is something you would send to a client or your accountant. Check the numbers in the layout against the sheet before you rely on it, and note that this is only on the paid tiers — the free Google account does not include it.