Age-Restricted Internet Plans and New Chrome Session Protections Lead Threat Wire

Summary

Threat Wire covers age-verification laws, Chrome’s hardware-bound session credentials, Anthropic’s Mythos and Project Glasswing vulnerability research, a reported Adobe Reader zero-day delivered via PDF, and FBI recovery of deleted Signal messages from iOS notification

Key points

• The video says a California law passed in October 2025 will require operating systems to collect users’ age information beginning in 2027.
• Apple has introduced age and identity checks for UK-based iOS users in iOS 26.4; the stated verification options include a driver’s license, ID, or credit card, but not a UK passport.
• Chrome 146 for Windows adds device-bound session credentials, using hardware-backed keys to protect sessions while limiting cross-session tracking and device information shared with servers.
• The video reports that Project Glasswing produced working exploits in 181 of several hundred attempts, compared with two successful attempts for Opus 4.6; Anthropic also reported Mythos Preview achieving full control-flow hijacks on 10 patched targets in its tests.
• Anthropic says Mythos’s vulnerability-finding capabilities emerged from broader model improvements. The company does not plan a general public release; it says fewer than 1% of potential vulnerabilities found so far have been fully patched.
• Threat actors have reportedly exploited an Adobe Reader zero-day since at least December 2025 using a well-formed PDF delivered through social engineering; the transcript provides no named actors or vulnerability identifier.
• The FBI reportedly retrieved deleted Signal message information using iOS notification data, but the video says the precise method remains unknown.

Vendors