Google releases new privacy controls for activity history, personalization

A batch of security and privacy stories: Google rolled out new privacy controls for Search and Play; a DraftKings account hacker was sentenced; and multiple active exploitation incidents and breaches were reported. Mandiant detailed how attackers abused a Cisco SD‑WAN zero‑day (CVE-2026-20245) to create rogue root accounts, and Cisco Unified Communications Manager SSRF (CVE-2026-20230) is now exploited in the wild. A malicious Edge extension (“Edgecution”) abused Native Messaging to escape the browser sandbox and deploy a Python backdoor/ransomware; CISA warned of actively exploited, max‑score