{"id":34528,"date":"2025-09-14T16:06:03","date_gmt":"2025-09-14T23:06:03","guid":{"rendered":"https:\/\/www.podfeet.com\/blog\/?p=34528"},"modified":"2025-09-14T16:06:03","modified_gmt":"2025-09-14T23:06:03","slug":"sb-2025-09-14","status":"publish","type":"post","link":"https:\/\/www.podfeet.com\/blog\/2025\/09\/sb-2025-09-14\/","title":{"rendered":"Security Bits \u2014 14 September 2025"},"content":{"rendered":"<h2>Feedback &amp; Followups<\/h2>\n<aside class=\"small-aside\">Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time.<\/aside>\n<ul>\n<li>Some clarity has emerged on the spate of <strong>Salesforce-related data breaches<\/strong> mentioned in the previous instalment \u2014 <a href=\"https:\/\/krebsonsecurity.com\/2025\/09\/the-ongoing-fallout-from-a-breach-at-ai-chatbot-maker-salesloft\/\">krebsonsecurity.com\/\u2026<\/a> &amp; <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/salesloft-march-github-repo-breach-led-to-salesforce-data-theft-attacks\/\">www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>The issue was with how the third-party AI chatbot from <em>Salesloft<\/em> integrated with Salesforce, allowing attackers to pivot from a victim&#8217;s Salesloft account to their Salesforce account to their other systems<\/li>\n<li>The root cause was a hacked GitHub account belonging to Salesloft<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Deep Dive \u2014 Memory Integrity Enforcement: The Hidden Security Gem in the A19 Chips &amp; iOS 26<\/h2>\n<p><em><em>TL;DR<\/em> \u2014 Apple have added hardware and software changes that make the most common kinds of memory-related bugs like buffer overflows and use-after-free errors uneconomically difficult to exploit reliably, making iOS 26 and later on A19 and later chips orders of magnitude more difficult to hack, even by nation-state-level attackers.<\/em><\/p>\n<p>It didn&#8217;t make the Awe Dropping event video, but Apple have added a very impressive security feature to all the new iPhone 17 model and the iPhone Air because of hardware updates in the new A19 series of processors, and software updates in iOS 26.<\/p>\n<p>Apple&#8217;s security team describe it very well in their <a href=\"https:\/\/security.apple.com\/blog\/memory-integrity-enforcement\/\">announcement blog post<\/a>, and the first and last sections are very human-friendly, while the middle bit is very detailed and nerdy, but in a surprisingly clear and readable way. Here are the key points in Apple&#8217;s words:<\/p>\n<blockquote><p>\n  Memory Integrity Enforcement (MIE) is the culmination of an unprecedented design and engineering effort, spanning half a decade, that combines the unique strengths of Apple silicon hardware with our advanced operating system security to provide industry-first, always-on memory safety protection across our devices \u2014 without compromising our best-in-class device performance. We believe Memory Integrity Enforcement represents the most significant upgrade to memory safety in the history of consumer operating systems.<\/p>\n<p>  There has never been a successful, widespread malware attack against iPhone. The only system-level iOS attacks we observe in the wild come from mercenary spyware, which is vastly more complex than regular cybercriminal activity and consumer malware. Mercenary spyware is historically associated with state actors and uses exploit chains that cost millions of dollars to target a very small number of specific individuals and their devices. Although the vast majority of users will never be targeted in this way, these exploit chains demonstrate some of the most expensive, complex, and advanced attacker capabilities at any given time and are uniquely deserving of study as we work to protect iPhone users against even the most sophisticated threats. Known mercenary spyware chains used against iOS share a common denominator with those targeting Windows and Android: they exploit memory safety vulnerabilities, which are interchangeable, powerful, and exist throughout the industry.<\/p>\n<p>  For Apple, improving memory safety is a broad effort that includes developing with safe languages and deploying mitigations at scale \u2026 We created Swift, an easy-to-use, memory-safe language, which we employ for new code and targeted component rewrites. In iOS 15, we introduced <code>kalloc_type<\/code>, a secure memory allocator for the kernel, followed in iOS 17 by its user-level counterpart, <code>xzone malloc<\/code>. These secure allocators take advantage of knowing the type \u2014 or purpose \u2014 of allocations so that memory can be organized in a way that makes exploiting most memory corruption vulnerabilities inherently difficult \u2026 In 2018, we were the first in the industry to deploy Pointer Authentication Codes (PAC) in the A12 Bionic chip, to protect code flow integrity in the presence of memory corruption.<\/p>\n<p>  Arm published the\u00a0<a href=\"https:\/\/www.usenix.org\/system\/files\/login\/articles\/login_summer19_03_serebryany.pdf\">Memory Tagging Extension (MTE)<\/a>\u00a0specification in 2019 as a tool for hardware to help find memory corruption bugs. MTE is, at its core, a memory tagging and tag-checking system, where every memory allocation is tagged with a secret; the hardware guarantees that later requests to access memory are granted only if the request contains the correct secret. If the secrets don\u2019t match, the app crashes, and the event is logged. This allows developers to identify memory corruption bugs immediately as they occur \u2026 We conducted a deep evaluation and research process to determine whether MTE, as designed, would meet our goals for hardware-assisted memory safety. Our analysis found that, when employed as a real-time defensive measure, the original Arm MTE release exhibited weaknesses that were unacceptable to us, and we worked with Arm to address these shortcomings in the new\u00a0<a href=\"https:\/\/developer.arm.com\/documentation\/109697\/0100\/Feature-descriptions\/The-Armv8-9-architecture-extension?lang=en#md454-the-armv89-architecture-extension__FEAT_MTE4\">Enhanced Memory Tagging Extension (EMTE)<\/a>\u00a0specification, released in 2022.<\/p>\n<p>  We believe memory safety protections need to be strictly synchronous, on by default, and working continuously \u2026 In addition, for MTE to provide memory safety in an adversarial context, we would need to finely tune the operating system to defend the new semantics and the confidentiality of memory tags on which MTE relies.<\/p>\n<p>  Today we\u2019re introducing the culmination of this effort: Memory Integrity Enforcement (MIE), our comprehensive memory safety defense for Apple platforms. Memory Integrity Enforcement is built on the robust foundation provided by our\u00a0<strong>secure memory allocators<\/strong>, coupled with\u00a0<strong>Enhanced Memory Tagging Extension (EMTE)<\/strong>\u00a0in synchronous mode, and supported by extensive\u00a0**Tag Confidentiality Enforcement **policies. MIE is built right into Apple hardware and software in all models of iPhone 17 and iPhone Air and offers unparalleled, always-on memory safety protection for our key attack surfaces including the kernel, while maintaining the power and performance that users expect. In addition, we\u2019re making EMTE available to all Apple developers in Xcode as part of the new\u00a0<a href=\"https:\/\/developer.apple.com\/documentation\/xcode\/enabling-enhanced-security-for-your-app#Adopt-hardware-memory-tagging\">Enhanced Security<\/a>\u00a0feature that we released earlier this year during WWDC.\n<\/p><\/blockquote>\n<h3>Links<\/h3>\n<ul>\n<li>Apple&#8217;s blog post: <a href=\"https:\/\/security.apple.com\/blog\/memory-integrity-enforcement\/\">Memory Integrity Enforcement: A complete vision for memory safety in Apple devices \u2014 security.apple.com\/\u2026<\/a><\/li>\n<li>New Coverage:\n<ul>\n<li><a href=\"https:\/\/appleinsider.com\/articles\/25\/09\/09\/how-the-new-memory-shield-on-iphone-17-makes-you-even-more-secure\">How the new memory shield on iPhone 17 makes you even more secure \u2014 appleinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/appleinsider.com\/articles\/25\/09\/11\/the-iphone-17-memory-shield-will-give-spyware-developers-a-hard-time\">The iPhone 17 memory shield will give spyware developers a hard time \u2014 appleinsider.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>\u2757 Action Alerts<\/h2>\n<aside class=\"small-aside\">Calls to action, if any stories in this section are relevant to you, there is some action you should take.<\/aside>\n<ul>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/google-fixes-actively-exploited-android-flaws-in-september-update\/\">Google fixes actively exploited Android flaws in September update \u2014 www.bleepingcomputer.com\/\u2026<\/a> (84 patches total, patch ASAP if you can, or get a phone that is actually securable!)<\/p>\n<\/li>\n<li>\n<p>Microsoft&#8217;s Patch Tuesday was relatively quiet, just 86 fixes and no actively exploited zero-days (but still important to patch!) \u2014 <a href=\"https:\/\/isc.sans.edu\/diary\/rss\/32270\">isc.sans.edu\/\u2026<\/a> &amp; <a href=\"https:\/\/krebsonsecurity.com\/2025\/09\/microsoft-patch-tuesday-september-2025-edition\/\">krebsonsecurity.com\/\u2026<\/a><\/p>\n<\/li>\n<li>\n<p>\u26a0\ufe0f <strong>Samsung Smartphone Owners:<\/strong> <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/samsung-patches-actively-exploited-zero-day-reported-by-whatsapp\/\">Samsung patches actively exploited zero-day reported by WhatsApp \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/p>\n<\/li>\n<li>\n<p>\u26a0\ufe0f <strong>TP-Link Router Owners:<\/strong> <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/new-tp-link-zero-day-surfaces-as-cisa-warns-other-flaws-are-exploited\/\">New TP-Link zero-day surfaces as CISA warns other flaws are exploited \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/p>\n<blockquote><p>\n  Though a patch is reportedly already developed for European models, work is underway to develop fixes for U.S. and global firmware versions, with no specific date estimates given \u2026 Until TP-Link determines which devices are vulnerable and releases fixes for them, users should <strong>change default admin passwords<\/strong>, <strong>disable CWMP<\/strong> if not needed, and apply the latest firmware update for their device.\n<\/p><\/blockquote>\n<\/li>\n<li>A good reminder of why it&#8217;s important to patch: <a href=\"https:\/\/appleinsider.com\/articles\/25\/09\/04\/macos-sequoia-flaw-could-have-exposed-keychain-data-including-passwords\">macOS Sequoia flaw could have exposed Keychain data including passwords \u2014 appleinsider.com\/\u2026<\/a> (Fixed by macOS 15.3)<\/p>\n<\/li>\n<\/ul>\n<h2>Worthy Warnings<\/h2>\n<aside class=\"small-aside\">Potentially relevant warnings from government organisations, public interest groups, or the security community.<\/aside>\n<ul>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/plex-tells-users-to-reset-passwords-after-new-data-breach\/\">Plex tells users to reset passwords after new data breach \u2014 www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li><em>&#8220;Information that was accessed included emails, usernames, and securely hashed passwords.&#8221;<\/em><\/li>\n<li><strong>Suggestion from Bart:<\/strong> if you haven&#8217;t done so yet, enable 2FA on your Plex account!<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Notable News<\/h2>\n<ul>\n<li>\n<p>A good two weeks for regulators on both sides of the Atlantic:<\/p>\n<ul>\n<li>\ud83c\uddfa\ud83c\uddf8 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/disney-to-pay-10m-to-settle-claims-it-collected-kids-data-on-youtube\/\">Disney to pay $10M to settle claims it collected kids\u2019 data on YouTube \u2014 www.bleepingcomputer.com\/\u2026<\/a> (US Federal Trade Commission settlement)<\/li>\n<li>\ud83c\uddfa\ud83c\uddf8 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/us-sues-robot-toy-maker-for-exposing-childrens-data-to-chinese-devs\/\">US sues robot toy maker for exposing children&#8217;s data to Chinese devs \u2014 www.bleepingcomputer.com\/\u2026<\/a> (US Department of Justice suing toy maker <em>Apitor Technology<\/em> for allegedly allowing a Chinese third party to collect children&#8217;s geolocation data without their knowledge and parental consent, which breaches the <em>Children&#8217;s Online Privacy Protection Act<\/em>, AKA COPPA)<\/li>\n<li>\ud83c\uddfa\ud83c\uddf8 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/texas-sues-powerschool-after-massive-data-breach-hit-62-million-students\/\">Texas sues PowerSchool over breach exposing 62M students, 880K Texans \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li>\ud83c\uddeb\ud83c\uddf7 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/france-slaps-google-with-325m-fine-for-violating-cookie-regulations\/\">France slaps Google with \u20ac325M fine for violating cookie regulations \u2014 www.bleepingcomputer.com\/\u2026<\/a>](https:\/\/www.bleepingcomputer.com\/news\/security\/france-slaps-google-with-325m-fine-for-violating-cookie-regulations\/)(French data protection authority fine for displaying ads between Gmail users&#8217; emails without consent)<\/li>\n<li>\ud83c\uddea\ud83c\uddfa <a href=\"https:\/\/www.bleepingcomputer.com\/news\/google\/eu-fines-google-35-billion-for-anti-competitive-ad-practices\/\">EU fines Google $3.5 billion for anti-competitive ad practices \u2014 www.bleepingcomputer.com\/\u2026<\/a> (EU Commission over <em>self-preferencing<\/em>)<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/signal-adds-secure-cloud-backups-to-save-and-restore-chats\/\">Signal adds secure cloud backups to save and restore chats \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/p>\n<\/li>\n<li>\n<p>Google have added <a href=\"https:\/\/c2pa.org\">C2PA<\/a> Content Credentials (as championed by Adobe &amp; Microsoft) to the Pixel 10 camera, supporting digitally signed metadata describing how each image was manipulated \u2014 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/pixel-10-fights-ai-fakes-with-new-android-photo-verification-tech\/\">www.bleepingcomputer.com\/\u2026<\/a><\/p>\n<ul>\n<li><strong>Note from Bart:<\/strong> I describe this technology in detail and explain why it matters in LTP 125: \ud83c\udfa7 <a href=\"https:\/\/lets-talk.ie\/ltp125\">Image Provenance with Content Credentials \u2014 www.lets-talk.ie\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>\ud83e\uddef This is a really big deal for hosting providers, but not for regular folk: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/new-vmscape-attack-breaks-guest-host-isolation-on-amd-intel-cpus\/\">New VMScape attack breaks guest-host isolation on AMD, Intel CPUs \u2014 www.bleepingcomputer.com\/\u2026<\/a><br \/>\n<blockquote><p>\n  &#8220;\u2026 a 4KB secret, such as a disk encryption key, could be leaked in 128 seconds. The total end-to-end time, including the ASLR bypassing process, would be 772 seconds, or just under 13 minutes \u2026 Linux kernel developers released patches that mitigate VMScape \u2026 &#91;T]he researchers say that this mitigation has minimal performance impact in common workloads.&#8221;\n<\/p><\/blockquote>\n<\/li>\n<li>We&#8217;ve had another very near miss: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-left-empty-handed-after-massive-npm-supply-chain-attack\/\">Hackers left empty-handed after massive NPM supply-chain attack \u2014 www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>The phished developer has commit access to many extremely popular NPM JavaScript modules, including many Bart uses!<\/li>\n<li>The key message here is that you should not set NPM to auto-update modules<\/li>\n<li>NPM&#8217;s safety systems work, but not instantaneously, if you upgrade in a controlled way instead of automatically the chances of getting something nasty are small, and GitHub&#8217;s security automations will email you if any of the NodeJS projects you version in GitHub have NPM <code>package-lock.json<\/code> files that specify vulnerable libraries.<\/li>\n<li><strong>Nerdy Summary from Bart:<\/strong> always commit <strong>both<\/strong> <code>package.json<\/code> &amp; <code>package-lock.json<\/code> to Git, always deploy projects with <code>npm ci<\/code> rather than <code>npm install<\/code>, and manually update versions periodically with <code>npm outdated<\/code> and <code>npm upgrade<\/code> and then commit the updated <code>package.json<\/code> &amp; <code>package-lock.json<\/code> files to Git.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Interesting Insights<\/h2>\n<aside class=\"small-aside\">High-quality opinion and editorial content recommended by Bart.<\/aside>\n<ul>\n<li>The first \u00be of this post is a good overview of the current state of play: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/6-browser-based-attacks-all-security-teams-should-be-ready-for-in-2025\/\">6 browser-based attacks all security teams should be ready for in 2025 \u2014 www.bleepingcomputer.com\/\u2026<\/a> (this is a sponsored post, so it ends in an ad!)<\/li>\n<\/ul>\n<h2>Palate Cleansers<\/h2>\n<aside class=\"small-aside\">Anything upbeat and nerdy Bart and\/or Allison think you might enjoy.<\/aside>\n<ul>\n<li><strong>From NosillaCastaways:<\/strong> \ud83c\udfa6 <a href=\"https:\/\/youtu.be\/GfH4QL4VqJ0?si=YFh_jL-wnD_EKsKm\">Python: The Documentary \u2014 youtu.be\/\u2026<\/a> (from Joop via Mastodon, Bart &amp; Allison both loving it \ud83d\ude42)<\/li>\n<li><strong>From Bart:<\/strong> Some of my favourite travel photographer Florian Kriechbaumer&#8217;s work is being <a href=\"https:\/\/glass.photo\/highlights\/florian-kriechbaumer-in-apple-spatial-gallery\">featured on the Vision Pro<\/a>, so this is a good opportunity to plug his amazing <a href=\"https:\/\/theflore.com\/blog\">travel blog<\/a> &amp; <a href=\"https:\/\/glass.photo\/florian\">Glass profile<\/a>. <\/li>\n<li><strong>From Allison:<\/strong> Gary Rosenzweig is a long-time jewel of knowledge for the Mac community with his Mac Most podcast and blog. He&#8217;s just published a single page where you can see every version of macOS back to Lion and what Macs can run each OS: <a href=\"https:\/\/macmost.com\/macos-system-requirements-list.html\">macmost.com\/&#8230;<\/a><\/li>\n<\/ul>\n<h2>Legend<\/h2>\n<p>When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by <a href=\"https:\/\/bartb.ie\/\">Bart<\/a>.<\/p>\n<table>\n<thead>\n<tr>\n<th align=\"center\">Emoji<\/th>\n<th align=\"left\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td align=\"center\">\ud83c\udfa7<\/td>\n<td align=\"left\">A link to <strong>audio content<\/strong>, probably a podcast.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\u2757<\/td>\n<td align=\"left\">A <strong>call to action<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\"><em>flag<\/em><\/td>\n<td align=\"left\">The story is particularly relevant to people living in a <strong>specific country<\/strong>, or, the organisation the story is about is affiliated with the government of a specific country.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udcca<\/td>\n<td align=\"left\">A link to <strong>graphical content<\/strong>, probably a chart, graph, or diagram.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83e\uddef<\/td>\n<td align=\"left\">A story that has been <strong>over-hyped<\/strong> in the media, or, <em>&#8220;no need to light your hair on fire&#8221;<\/em> \ud83d\ude42<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udcb5<\/td>\n<td align=\"left\">A link to an article behind a <strong>paywall<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udccc<\/td>\n<td align=\"left\">A <strong>pinned<\/strong> story, i.e. one to keep an eye on that&#8217;s likely to develop into something significant in the future.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83c\udfa9<\/td>\n<td align=\"left\">A <strong><em>tip of the hat<\/em><\/strong> to thank a member of the community for bringing the story to our attention.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83c\udfa6<\/td>\n<td align=\"left\">A link to <strong>video content<\/strong>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>Feedback &amp; Followups Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time. Some clarity has emerged on the spate of Salesforce-related data breaches mentioned in the previous instalment \u2014 krebsonsecurity.com\/\u2026 &amp; www.bleepingcomputer.com\/\u2026 The issue was with how the third-party AI chatbot from Salesloft integrated with Salesforce, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":28385,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[147,214],"tags":[7594,7593,7592,5823,50],"class_list":["post-34528","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-posts","category-security-bits","tag-mei","tag-memory-integrity-enforcement","tag-salesforce","tag-securit-bits","tag-security"],"jetpack_featured_media_url":"https:\/\/www.podfeet.com\/blog\/wp-content\/uploads\/2023\/05\/Security-Bits-Logo_1040x520.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/34528","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/comments?post=34528"}],"version-history":[{"count":1,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/34528\/revisions"}],"predecessor-version":[{"id":34529,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/34528\/revisions\/34529"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media\/28385"}],"wp:attachment":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media?parent=34528"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/categories?post=34528"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/tags?post=34528"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}