Apple will begin checking photos and files shared through public iCloud links for harmful content with version 27.3 or later of iOS, iPadOS, macOS, and visionOS.

The policy covers items shared using “Anyone with the Link,” including photos stored in iCloud Photos and files held in iCloud Drive. Apple outlined the change in a support document published November 3, 2026.

Apple is not announcing checks of every private photo or file stored in iCloud. Its notice targets content that users make available to anyone holding a sharing link. The separate “People you choose” option, which limits access to invited or approved users, is not described as part of these checks.

For users, the key issue is privacy. Apple says an item shared through “Anyone with the Link” is no longer protected by end-to-end encryption. This applies even when the owner or other participants have enabled Advanced Data Protection, making public sharing an important exception to that protection.

Apple to Scan for Photo and File

When sharing content stored in iCloud, users can send a copy or share a link. Link sharing then offers two access settings. “People you choose” restricts access, while “Anyone with the Link” lets people open the item without individual approval. Apple says the latter also makes that content accessible to the company.

This distinction separates account security from sharing permissions. Cybersecurity News’ guide to securing iCloud accounts discusses account protection and permission reviews. In this case, the setting attached to a shared item determines whether access is restricted or available to anyone holding its link.

According to Apple’s support notice, public-link content will be checked for harmful material. However, the document does not define “harmful content” or explain the detection process. It does not identify scanning tools, describe human review, or state whether checks happen before recipients can open a link.

What Happens When Content Is Flagged

Apple says it reserves the right to move, refuse, modify, remove, or delete harmful content at any time. Possible action extends beyond removing a shared item. The company may block or disable the associated Apple Account and prevent new accounts from being created with the same email address or phone number.

The notice also allows Apple to involve law enforcement when necessary. However, it does not explain review standards, appeal options, or how users would challenge an incorrect flag. Those missing details leave questions about how the policy will work in practice, especially when an account faces restrictions.

The encryption issue sits within a wider debate over access to cloud data. Cybersecurity News previously covered reported UK demands for access to encrypted iCloud backups. This announcement concerns a narrower boundary: items deliberately shared through public links, rather than a stated expansion of access across private iCloud storage.

For sensitive documents and personal photos, the practical step is to review sharing permissions before distributing a link. Choosing “People you choose” limits access to approved recipients.

Public-link sharing should not be treated as private storage simply because Advanced Data Protection is enabled. Apple also leaves unanswered whether links created before version 27.3 will face checks under this policy.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Apple to Scan for Every Photo and File Shared Through a Public iCloud Link for Harmful Content appeared first on Cyber Security News.

Google automatically verifies phone numbers on Android devices and adds them to every Google account signed in on the Phone. The setting is enabled by default, raising privacy concerns for users who keep personal, work, and secondary accounts separate.

Google’s documentation confirms that the behavior covers both existing accounts and accounts added later. The feature, called Phone number verification, also covers new phone numbers added to a device.

Adding another Google account can link it to numbers already on the Phone, while adding a new number can attach it to accounts already signed in. Users must turn the setting off themselves to stop automatic verification.

According to Google’s support documentation, verification supports account sign-in, account recovery, emergency services, and communication features.

Google and mobile carriers periodically check that numbers still belong to the user. The company notes that carrier charges may apply during this process.

Google Auto-Adds Phone Numbers to Android Accounts

Android Authority reported that users received unexpected emails saying their phone numbers had been verified. Its staff also found automatic verification enabled on their devices.

The publication said Google updated its support page between August and October 2025 to describe the default setting and account-wide linking. That documentation change does not establish an exact rollout date.

For someone using a separate account for public discussions, testing, or other activities, attaching a personal number creates an unwanted connection within Google’s systems. The concern is losing control over which accounts hold that number.

The documentation does not say this makes the number publicly visible to everyone. Google also says verification enables Better sharing on Google, which supports calls, messages, and notifications involving the number.

However, when several accounts are signed in, Better sharing turns on for only one account. This differs from phone number verification, which applies across all signed-in accounts.

This behavior is an account setting, not evidence of a Google account breach. Cybersecurity News previously covered Google’s denial of Gmail breach claims.

Its reporting on Google’s move toward passkeys also highlights the company’s efforts to simplify account access. Open Android Settings, select Google, and open All services. Under Privacy & security, select Phone number verification, then turn off Verify phone numbers automatically. Google says device settings manage this control.

Turning it off does not remove numbers already attached to accounts, according to Android Authority. Open each affected account’s Personal info page, select Contact info, then Phone, and remove unwanted numbers individually. Review how each number is used before changing it, particularly where account recovery is involved.

Some users reported on Reddit that the setting switched back on on its own. Android Authority could not reproduce that behavior, so it remains a user-reported issue rather than a confirmed general fault. Users managing several accounts should review both the device setting and each account’s stored phone numbers.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Google Automatically Adds Your Phone Number to Every Google Account on Your Android Phone appeared first on Cyber Security News.