A mother was enjoying a day at the beach recently with her 9-year-old son when the two of them unexpectedly stumbled upon a small piece of Midwestern history: a century-old shipwreck.
Hannah Damon, director of outreach and administration at Camp Amnicon Adventures and Retreats in South Range, Wisconsin, made the discovery while spending time with her son along the camp's sandy shoreline.
The shipwreck is the A.H. Pitz, a steam-powered tugboat built in 1923. It was abandoned in 1951.
Although Damon had known about the sunken vessel for years, she had never actually seen it until unusually clear water gave her and her son a rare glimpse of its remains.
"We started seeing beams and cables and this massive pipe, and it was like, wait a minute, this is a shipwreck, this is a shipwreck," Damon told Fox News Digital on Thursday.
Thrilled by the unexpected sighting, Damon rushed to grab her camera.
"I ran back to shore and I got my camera, and I was like, OK, you are not allowed to splash me, this is a really exciting discovery," Damon recalled telling her son.
Video taken by Damon shows the remains of the tugboat beneath clear water, with weathered wooden beams and other debris visible along the lakebed.
Damon described the water as "crystal clear" and glassy, an unusual sight along that stretch of Lake Superior.
The area sits within the Lake Superior clay plain, where the surrounding soil is largely composed of clay, which can make the water murky and obscure objects beneath the surface.
Damon said the wreck is fully submerged and usually difficult to see.
"I was actually just down back at the beach yesterday, and again, the water was calm, but it was murky again," Damon said.
"I hope it's one of those things that, every once in a while, if you know where to look, you'll be able to find it. But it's definitely a rare find. It's really exciting."
The A.H. Pitz was built in 1923 for the McMullen and Pitz Construction Company in Manitowoc, Wisconsin, and named after Armond Pitz, according to the Wisconsin Historical Society.
The nearly 70-foot-long tugboat changed ownership several times before it was abandoned at the mouth of the Amnicon River in 1951.
"Even after swimming [here] and [being] on this particular beach for 10 or 11 years in a row, I had just never actually seen the shipwreck before," she said.
"It was really exciting to find it, to come across it, and I just couldn't wait to share it with the world."
Damon later showed footage of the shipwreck on social media, where others shared their own memories of the vessel.
The man arrested for allegedly using a sledgehammer to behead a Marine figure on an Iwo Jima monument near Quantico, Virginia, is a Mexican illegal alien and former Deferred Action for Childhood Arrivals (DACA) recipient who lost his status this year, federal sources told Fox News.
Miguel Alonso Maldonado Soriano, 27, was charged with felony destruction of property, trespass with intent to damage property and felony injury to a monument.
"This criminal illegal alien’s dream is over: Maldonado Soriano disrespected our brave service members and defaced a beautiful monument that honored their sacrifice," White House spokeswoman Taylor Rogers said in a statement to Fox News. "President Trump has secured our border and is deporting illegal criminals who hate our country and our values. The socialist Democrats want to go back to open borders and flood our communities with dangerous criminal illegal aliens."
According to federal sources, Maldonado Soriano illegally crossed into the U.S. in December 1999. He was granted DACA by the Obama administration in 2014. It was recently extended by the Biden administration in 2024. Maldonado Soriano then lost his DACA status in August 2026 because it was not renewed by the Trump administration.
Officers with the Prince William County Police Department first responded to the incident at about 10:13 p.m. on Wednesday, Oct. 21. Maldonado Soriano was allegedly striking the monument with a sledgehammer when officers arrived.
Authorities said Maldonado Soriano was arrested after officers discovered extensive damage to the limestone sculpture, which commemorates one of the most recognizable moments in American military history.
The damage included the complete removal of one Marine's head, along with damage to other figures depicted raising the American flag during the Battle of Iwo Jima in World War II, according to authorities.
Images of the damaged monument show the figure farthest to the right missing its head, while another Marine has visible gouges across his helmet and face, police told Fox News Digital.
A third figure sustained damage to a bayonet attached to a gun slung over his back. Police estimated the damage would cost hundreds of thousands of dollars to repair.
In 2001, portions of the installation were listed on the National Register of Historic Places as the Quantico Marine Corps Base Historic District, encompassing 122 buildings, two landscapes, a sculpture and a water tower.
Maldonado Soriano is being held without bond, and a court date has not yet been announced.
A Virginia man was arrested after allegedly using a sledgehammer to knock the head off a Marine figure depicted in an Iwo Jima statue near Marine Corps Base Quantico in Virginia, causing hundreds of thousands of dollars in damage to the historic military monument, police said.
Officers with the Prince William County Police Department responded at about 10:13 p.m. Wednesday, Oct. 21, to reports of vandalism at the statue near Richmond Highway and Fuller Road in Quantico, Virginia.
Police identified the suspect as Miguel Alonso Maldonado Soriano, 27, of Stafford, Virginia, who was allegedly striking the monument with a sledgehammer when officers arrived.
Authorities said Maldonado Soriano was detained and arrested after officers discovered extensive damage to the limestone sculpture, which commemorates one of the most recognizable moments in American military history.
The damage included the complete removal of one Marine's head, along with damage to other figures depicted raising the American flag during the Battle of Iwo Jima in World War II, according to authorities.
Images of the damaged monument show the figure farthest to the right missing its head, while another Marine has visible gouges across his helmet and face, police told Fox News Digital.
A third figure sustained damage to a bayonet attached to a gun slung over his back. Police estimated the damage would cost hundreds of thousands of dollars to repair.
In 2001, portions of the installation were listed on the National Register of Historic Places as the Quantico Marine Corps Base Historic District, encompassing 122 buildings, two landscapes, a sculpture and a water tower.
Cybersecurity researchers say that anyone's personal information is at risk after OpenAI disclosed a vulnerability in a popular software language.
Richard Drury/Getty Images
Cybersecurity researchers say the PHP vulnerability has repercussions for normal people, too.
Even if you don't own a website, hackers could use the vulnerability to steal your information.
One quick fix: diversify your passwords.
If you're still using the same password for everything, it might finally be time to get on that.
While the major cybersecurity vulnerabilities that OpenAI agents helped expose on Wednesday primarily impact the owners and operators of websites, it could also give hackers the opportunity to hijack your personal information, researchers said.
"Be extra careful visiting ANY web site in the next few days," Changpeng Zhao, the cofounder of cryptocurrency platform Binance, said on X.
OpenAI said on Wednesday that researchers using its AI models uncovered two "critical" flaws in the infrastructure of PHP, a popular open-source programming language used on about 70% of the world's websites.
Because digital commerce websites, for instance, can store personal shopper information in PHP systems, that information would be accessible to a bad actor exploiting the web provider's system if that provider hasn't updated it.
The National Security Administration warned that hackers using one of the PHP exploits could "steal sensitive data, disrupt services, or move deeper into a network."
"Even if you yourself are not building software and that's not where your core business is, a lot of your life does depend on companies that depend on those systems," Madeline Lawrence, cofounder of Aikido Security, an application security platform, told Business Insider on Thursday.
"And they could be deeply, deeply vulnerable," she added. She said that one day after the disclosure, cybersecurity platform Cloudflare reported millions of attempts to exploit the vulnerability.
If you do own a website, PHP has released updates it says will help shield websites from hackers. Instructions for applying those updates are available on PHP's homepage.
For everyone else, here are a few tips cybersecurity researchers say you can use to protect your info.
Don't reuse passwords; use a password manager.
Check for security advisories from your bank.
Use two-factor authentication on your devices and accounts — especially for email, banking, and your password manager.
If your data has been breached, expect more convincing scams and phishing emails.
Turn auto-updates on and restart your computer weekly.
"You can ask your claude code to audit what on your laptop is out of date and needs updating," Peter Wildeford, head of policy at the AI Policy Network, a bipartisan nonprofit that advocates for safety guardrails and federal oversight, added in a post on X.
PSA: in light of recent cyberattacks and vulnerabilities, I recommend everyone:
* use a good password manager (1Password) and do not duplicate passwords * use two factor auth for everything important (not via sms!! Google Authenticator or better yet YubiKey) * Auto-updates on,…
Though Lawrence called the vulnerability "very severe," she cautioned against people running to close their bank accounts to protect themselves.
"Assume that if you're getting a notification that your data has been leaked," she said. "Take action on that because you could have credentials or information floating around the dark web."
Your home address, phone number and relatives' names may be sitting on people-search websites you've never visited. Anyone who finds those listings could learn more about you than you're comfortable sharing. A data broker opt-out can help reduce that exposure, especially during retirement, when protecting your finances, family and home becomes a priority.
And a tragic case in Minnesota shows why publicly available personal information deserves a closer look. Here's what happened in Minnesota and the steps you can take to make your personal information harder to find online.
Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money
In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You'll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register for free now at CyberGuyLive.com.
In June 2025, Minnesota lawmaker Melissa Hortman and her husband, Mark, were murdered in a targeted attack. State Sen. John Hoffman and his wife, Yvette, were seriously injured in a separate shooting. Investigators discovered notebooks containing the names of public officials and a handwritten list of 11 people-search websites in the suspect's vehicle. The list included TruePeopleSearch, Spokeo, Pipl, PeopleFinders, BeenVerified, Whitepages, TruthFinder, Intelius, Ownerly, USSearch and PeopleLooker. The notes described which services were free and what information someone could find through them.
However, the discovery alone did not establish whether the websites supplied the victims' addresses. On June 11, Vance Boelter pleaded guilty to federal charges involving the murders, shootings and stalking of the victims. He was sentenced on July 23 to two consecutive life terms plus 40 years in federal prison. Separate state charges remain pending. The case raised an unsettling question: How easily could someone find your home address and information about your family?
What data brokers know about you
Data brokers collect information from public records, online activity, commercial databases and other sources. They then combine those details into profiles that businesses and individuals may be able to purchase or access. Some companies specialize in marketing information. Others operate people-search websites that make personal details available through free searches or paid reports.
Depending on the company and the available records, those profiles may include:
Your current and previous home addresses
Phone numbers and email addresses
Age, birth date and marital status
Names of relatives and possible associates
Property ownership and estimated home values
Employment and education history
Purchasing interests and other consumer information
Financial, health-related or political inferences
Not every broker collects or sells all this information. Credit reporting agencies also operate under different legal requirements than many people-search services. Still, these records can reveal details you never intended to share with strangers. For a closer look at how criminals assemble this information, read our CyberGuy report on how scammers build a profile on you using data brokers.
Want to see how much of your personal information may already be exposed? Get a free scan to find out if your personal information is already out on the web: Cyberguy.com
Why exposed personal information is risky for retirees
Scammers can use publicly available details to make their stories more convincing. As a result, a suspicious call or message may sound surprisingly personal.
Here are some of the potential risks.
Financial scams: Someone who knows your age, address and family relationships may use those details to impersonate a financial institution, government agency or relative. That familiarity can make a fraudulent request sound credible.
Home and personal safety: People-search listings may expose where you live, where you previously lived and who lives nearby. This can be particularly concerning for people dealing with stalking, harassment or threats.
Medicare and healthcare fraud: A scammer who knows your name, age or location could use those details to make a fake Medicare call or insurance offer seem legitimate. Never provide your Medicare number to an unexpected caller.
Family impersonation scams: Criminals may use relatives' names and personal details to create convincing emergency stories. They might claim someone you love needs money immediately.
Spam calls and unwanted messages: Data brokers and marketing lists can contribute to unwanted contact. However, removing your information will not eliminate every robocall, spam text or phishing email.
Even if you've never experienced one of these problems, reducing the amount of personal information available online can make it harder for someone to research you.
You can request removal from many people-search websites for free. However, each company may have different requirements, and removing a listing doesn't always prevent it from returning.
Here's how to get started.
Search for yourself online. Look up your full name, city, current address and phone number. Check major people-search websites for matching listings. Avoid paying for reports unless you have a specific reason.
Save the website addresses. Keep a record of the pages exposing your information so you can return to them later.
Find each site's removal instructions. Look for links labeled "Opt Out," "Remove My Information" or "Do Not Sell or Share My Personal Information." You can also check the site's privacy policy.
Submit your removal request. Follow the company's instructions. Some sites require you to verify your identity or confirm that the record belongs to you. Share only the information necessary to complete the request.
Complete any verification steps. Check your email for confirmation links or follow-up instructions. A request may remain incomplete until you finish the process.
Consider search-result removal. If sensitive information appears in Google search results, you may qualify to request its removal. Keep in mind that removing a search result does not erase the information from the original website.
Check again periodically. Brokers may refresh their records, and previously removed details can reappear. Revisit the sites and submit new requests when necessary.
A new privacy shortcut for California residents
If you live in California, you now have another option. The state's free Delete Request and Opt-out Platform (DROP) at privacy.ca.gov/drop/ launched in January 2026. It allows eligible residents to submit one deletion request to more than 600 registered data brokers. Beginning August 1, 2026, covered data brokers were required to start processing those requests. The system also requires recurring checks for matching information, although legal exceptions apply and removal is not immediate. Other states have their own privacy laws and removal rights, so your options may depend on where you live.
How a data removal service can help protect your personal information
If manually contacting dozens of websites sounds exhausting, a data removal service can handle much of the work for you. These services help identify data brokers and people-search websites that may have your information. They can also submit removal requests on your behalf and follow up when necessary.
Depending on the provider and subscription plan, available features may include:
Automated removal requests: Services contact covered data brokers and people-search websites to request deletion of your personal information.
Recurring removals: Some providers periodically repeat requests and check whether previously removed information has reappeared.
Progress reports: You can track removal requests and review updates about which companies have responded.
Multiple personal details: Certain services let you submit current and previous addresses, email addresses and phone numbers to help identify matching records.
Custom removals: Some providers allow you to submit additional website links for review and possible removal assistance.
To get started, choose a reputable data removal service, create an account and provide the information needed to identify your records. You'll typically need to authorize the service to submit removal requests on your behalf. Some providers also offer family plans that cover multiple household members.
Before subscribing, compare the websites each service covers, its removal process, ongoing monitoring features and subscription costs.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.
What a data removal service cannot do
Even with automated removal, some personal information may remain publicly accessible. Property ownership records, government databases and certain court records can continue displaying details about you. Data removal services generally cannot force government agencies to delete legally available public records.
Additionally, not every website must honor a removal request. Some services offer custom removals, but legal restrictions and technical limitations can prevent certain information from being deleted.
Removing data broker listings also cannot undo previous data breaches or guarantee that scammers will stop contacting you.
Still, reducing the number of websites exposing your information can make it harder for strangers to find personal details. For retirees, that added privacy can help reduce exposure to targeted scams and unwanted contact.
Kurt's key takeaways
What concerns me most is how much someone can learn about you without ever meeting you. Your address, family connections and personal history can give scammers information they can use to gain your trust. And once that information starts circulating, controlling where it goes becomes difficult. That's why I recommend taking a proactive approach. Start by finding out what's publicly available, remove what you can and keep checking. If the process becomes overwhelming, a reputable data removal service can help with the ongoing work. You may never erase every trace of yourself from the internet, but you can make your personal information harder to find.
Have you ever searched your name on a people-search website and been surprised by how much information was available? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.
A PHP vulnerability found by cybersecurity researchers using GPT-5.6 Sol could affect as many as 70% of websites.
MASTER/Getty Images
The internet is ablaze after cybersecurity researchers using AI found a bug in the PHP programming language.
Greg Brockman said bad actors could use the exploit to steal private user data.
The FBI and NSA have advised people to either take down websites or update their software.
OpenAI said that 70% of the world's websites could be in peril after cybersecurity researchers using its AI models found exploits in a popular programming language.
The National Security Administration's cyber division advised all web providers that use PHP, a widely used open-source language, to take their systems offline or update their software after OpenAI said one of its models found two "critical" flaws in the language's infrastructure.
Greg Brockman, the president of OpenAI, said in an X post that hackers could exploit the vulnerability to steal private user data or modify websites.
"We consider this one of the most impactful security issues in recent memory," OpenAI said in a blog post.
While OpenAI said the vulnerabilities appear to have been identified before any attackers discovered them, the public disclosure set off a race for companies and governments to update their websites and apply fixes before hackers could exploit the bugs.
"We are seeing early attacks emerging and are updating mitigations as new vectors show up," Dane Knecht, Cloudflare's chief technology officer, said in a post on X.
Numerous websites, including those belonging to governments and the media, went offline on Wednesday to address the issue.
PHP is a popular programming language that often handles the behind-the-scenes work powering websites that require user logins and online orders.
The critical flaw was first identified by Calif, a cybersecurity research company using GPT-5.6 Sol. Wiz, another cybersecurity company, independently uncovered the issues, OpenAI said. The companies are part of an OpenAI-led initiative called "Patch the Planet," which aims to make the world's digital infrastructure more secure.
OpenAI has also warned that as cybersecurity researchers continue to probe software vulnerabilities using its ever-advancing frontier models, more security failures will emerge.
An engineer at Microsoft pointed out that the PHP vulnerability was discovered with an older model.
"I don't think the world is prepared for the sheer number of vulnerabilities newer models will uncover," the engineer, Nicolas Bustamante, said on X.
The public disclosure on Wednesday by OpenAI and others of the existence of the exploits triggered urgent messages from leaders worldwide, including the Japanese Prime Minister.
"We have an urgent request for everyone to take action tonight," said Sanae Takaichi.
J.Crew's website temporarily went down and displayed an odd message.
It read: "JCrew generative AI Backend is healthy."
The clothing retailer later offered shoppers 20% off due to the "technical issues."
The website of clothing retailer J.Crew crashed Monday, leaving shoppers with a bizarre message: "JCrew generative AI Backend is healthy."
Multiple screenshots posted to social media by puzzled customers showed the statement on the brand's website set against an otherwise blank, black page.
wtf is up with the @jcrew website https://t.co/08D0NN7phI
"Wtf is up with the @jcrew website," one online browser posted to X along with a screenshot. J. Crew's customer service account responded to the post shortly after, saying, "We're working to get the site back up and running - sorry for the trouble. Hope you'll check back soon!"
In an apparent attempt to make up for the odd disruption, J.Crew later emailed its customers a 20% discount code that expires on Thursday.
J.Crew's email to customers.
J.Crew
"We're sorry!" the email viewed by Business Insider read. "Thanks for your patience during our recent technical issues at jcrew.com. As a token of our gratitude, enjoy an extra 20% off your next purchase."
It was not immediately clear what caused the website to malfunction or whether it was related to AI. Representatives for J.Crew did not immediately respond to a request for comment by Business Insider on Tuesday.
A historic building in the French town of Limoges, about three hours south of Paris, has been "largely lost" after it was set on fire by rioters as demonstrations continue across France.
The Limoges Town Hall was built in 1883, and was made a historic landmark in 1975.
"The roof has collapsed onto lower floors, except the west wing, and two-thirds of the exterior has already disappeared," the local prefect, Maurice Barate, told the AFP news agency.
Barate called it "a deliberate act by hooligans," adding that it was a "catastrophe for heritage."
The destruction came as far-left anti-government protests and violent clashes entered their fourth week in the European country over the cost of living.
On Saturday, outgoing President Emmanuel Macron wrote on social media: "There is no place for violence in our republic."
"Those who have broken, attacked the prefectures as well as businesses, looted even our town halls, will be prosecuted and punished," he added translated from French. "To the law enforcement forces, guarantors of the right to demonstrate, I express the support of the Nation. We will all stand united against the sowers of chaos, who seek only to bring down our institutions and prevent those who peacefully express their demands from doing so."
Around 400 people were arrested on Saturday, according to Interior Minister Laurent Nuñez, as more than a half million people took part in more than 100 marches across the country.
Masked groups also attempted to break into city halls in Lille and Calais and a police station in Brest, the interior minister reported, along with violence in Rennes, Toulouse, Montpellier and Grenoble, among other cities.
While many of the protests were without violence, many have descended into riots. Police used tear gas and water cannons on Saturday to disperse violent groups in Paris, where people wearing hoods and masks threw fireworks and other objects at officers in the Place de la République.
Russia has nearly finished the first section of a new launch site for jet-powered Geran-5 attack drones near the town of Millerovo in Rostov Oblast, anonymous Ukrainian OSINT channel Absolutely Reliable Source reported on 13 October. The channel’s bio says it covers Ukraine’s deep strikes and that its author belongs to a larger, unnamed structure. It says Russia rushed the build to scale up attacks after its September strikes on Kyiv.
The site is meant for the kind of drone Ukraine stops far less often than the older Shaheds. Ukraine downs 55% of jet-powered Shaheds, the class that includes the Geran-5, and more than 90% of the older propeller-driven ones, President Volodymyr Zelenskyy said on 26 September. Russian industry makes about 3,000 Geran-4 and Geran-5 drones a month, Ukraine’s military intelligence (HUR) told Militarnyi in August. A new launch site is how Russia plans to fire more of them, the channel argues.
Built in weeks, by the channel’s count
The channel’s images from 1 September show no construction at the site. The latest ones show eight prepared positions for launchers and 32 places for preparing drones for launch, the channel wrote. Imagery from the day before its post shows drones being unloaded in one zone, it said.
Millerovo drone base, 1 September 2026. Satellite image: t.me/absolutely_reliableMillerovo drone base, 12 October 2026. Satellite image: t.me/absolutely_reliable
The channel’s headline says the work took a month. Ukrainian outlet Militarnyi, comparing the channel’s own images from 1 September and 12 October, put it at about six weeks. Both readings rest on the same images, which have not been independently verified.
Built like Tsymbulova
The construction style is very similar to Tsymbulova, Russia’s jet-drone base in Oryol Oblast, the channel wrote. That base has separate positions for storing, preparing, and launching jet drones, Militarnyi said. By late May, less than a month into an expansion of Tsymbulova, Russia was already building 10 more launchers there.
Ukrainian drones have hit Tsymbulova repeatedly, though most of the damage imagery comes from Absolutely Reliable Source. Militarnyi reported strikes on the base’s bunkers and hangars in September. Ukraine’s Defense Forces struck it again overnight on 1 October, damaging two ground shelters and drone preparation areas, Absolutely Reliable Source said. On 10 October, OSINT channel Exilenova+ reported another drone strike there, saying several bunkers, one jet-drone launcher, and a drone storage area were hit.
Login
