A week in security (October 20 – October 26)

A week in security for October 20–26, 2025, highlights a flurry of activity across platforms with multiple notable findings reported by Malwarebytes Labs. On October 22, more than 100 Chrome extensions were found to break WhatsApp’s anti-spam rules by abusing WhatsApp Web to blast bulk messages.

The following day, October 23, Apple faced scrutiny from the UK’s competition watchdog over its walled garden, with potential pressure to permit rival app stores on iPhones, while Meta announced that it had removed more than 21,000 fake customer-support pages from Facebook as part of broader scam protections. Also on October 23, a Magento bug called SessionReaper was described as enabling attackers to hijack real shopping sessions, putting thousands of online stores at risk.

The week closed with coverage on October 24 about AI tools and safety nets and related risks to security, as well as other related pieces linked in the same roundup. According to Malwarebytes Labs, these items together illustrate the ongoing churn in consumer and web security during the period.