US — Ars Technica

Ships loiter near subsea cables amid Iran's warnings to Trump

SecurityNovember 7, 20261 min read

Several Iran-linked tanker ships have been drifting over undersea Internet cables near the Strait of Hormuz. Experts worry Iran could be preparing to damage these cables if the US and Israel strike again.

Ships spotted over key cables

Three sanctioned tankers and an Iranian fishing boat were seen moving slowly over subsea Internet cables in the Gulf of Oman, near the Strait of Hormuz. The maritime intelligence firm Windward tracked them in October. Some ships then turned off their location signals, a move called going dark.

Key facts

Six active cables cross the Strait of Hormuz today.
Two more cables have parts under construction in the region.
Iraq, Kuwait, Bahrain and Qatar depend entirely on these cables to reach the outside world.
One third of India's westbound Internet traffic passes through the Persian Gulf and Strait of Hormuz.
Two sanctioned tankers drifted for days over cable routes with no business reason to stop, and carried no cargo.

Why undersea cables matter

Undersea cables are thick fiber lines on the seafloor that carry most of the world's Internet data between continents. The Strait of Hormuz is a narrow sea passage that many cables must cross, so it is a weak point. The 2Africa cable, which is being built, is owned by a group of tech companies that includes Meta.

Why it matters

Cutting or damaging these cables could slow or cut Internet access for many countries across the Middle East, Africa, Europe and Asia. Windward said the ships' behavior could mean they are mapping cable routes or placing explosives or mines on them. The warning comes as tensions between Iran, the US and Israel remain high.

What to watch

Whether the ships keep drifting over cable routes.
Whether any cable is damaged in the Strait of Hormuz.
How the US, Israel and Iran respond to these reports.
Further blog posts or reports from Windward.

Glossary

Windward: A maritime intelligence firm that tracks ships using location data and satellite images.
Strait of Hormuz: A narrow sea passage between Iran and Oman's region that oil and cable routes cross.
2Africa cable: A large undersea cable being built to link Europe, Africa and Asia, owned by a tech group that includes Meta.
Meta: The US company that owns Facebook, Instagram and WhatsApp.

"I Thought It Was a Robot Malfunction, but It Was a Hack": Physical AI Faces Growing Security Threats

As AI expands into robots and self-driving cars, cyberattacks that subtly distort AI perception can be hard to tell apart from normal environmental adaptation, potentially causing injuries or equipment accidents. Gartner's report says traditional network-centric security is not enough, recommending physical safety mechanisms independent of AI models, separation of security inspections from real-time control paths, and independent monitoring systems.

SecurityArs TechnicaNov 7

Chainalysis says hackers stole credentials and tokens for all of its customers

Blockchain analysis firm Chainalysis says hackers obtained sensitive personal information, including names, usernames, password hashes, and live tokens, for all of its users after breaching its network security. The company said an external actor used AI agent-assisted techniques in an October incident and later described an on-path attack that exposed some customer passwords. Chainalysis has not said where the infrastructure compromise occurred or whether the stolen data was TLS encrypted, and it is unclear whether the theft exposes customers to additional threats.

SecurityTechCrunchNov 7

Hundreds of Artex AI hacking tools found publicly exposed to the web

Security researchers at Censys found more than 800 deployments of Artex, a Chinese-made open source autonomous penetration testing tool, accessible from the web without a password. The tool has been linked to several cyberattacks, including against South Korean banks, and to an attack on IT support provider ConnectWise that let Chinese-linked hackers spy on thousands of organizations. Artex has since announced it will go closed-source, though dozens of copies of its code remain on code-sharing sites.

SecurityThe VergeNov 7

Just about anyone can rent access to White House IP addresses

Security firms Layer3 Intel and Synthient found residential proxy activity on the White House network, indicating outsiders could rent access for "a few dollars." Layer3 found 28 residential proxy services routed traffic out of the network between October 5 and November 3, typically between 5PM ET and midnight. Synthient linked the activity possibly to the watch party app Rave, which it says bundles 12 proxy SDKs.