{"id":36568,"date":"2026-08-30T12:32:03","date_gmt":"2026-08-30T19:32:03","guid":{"rendered":"https:\/\/www.podfeet.com\/blog\/?p=36568"},"modified":"2026-09-02T15:04:43","modified_gmt":"2026-09-02T22:04:43","slug":"sb-2026-08-30","status":"publish","type":"post","link":"https:\/\/www.podfeet.com\/blog\/2026\/08\/sb-2026-08-30\/","title":{"rendered":"Security Bits \u2013 30 August 2026"},"content":{"rendered":"<p><!--more--><\/p>\n<h2>Feedback &amp; Followups<\/h2>\n<aside class=\"small-aside\">Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time.<\/aside>\n<ul>\n<li><a href=\"https:\/\/cyberinsider.com\/microsoft-paint-embeds-hidden-ids-in-locally-generated-ai-images\/\">Microsoft Paint embeds hidden IDs in locally generated AI images \u2014 cyberinsider.com\/\u2026<\/a> (Sadly, not C2PA Content Credentials \ud83d\ude41)<\/li>\n<li>Apple have partially fixed the app-specific VPN IP leaks we discussed last time, but only in Safari, not in 3rd-party apps \u2014 <a href=\"https:\/\/cyberinsider.com\/apple-quietly-fixes-icloud-private-relay-ip-leak-in-safari\/\">cyberinsider.com\/\u2026<\/a><\/li>\n<li>Apple have abandoned their plans to move Hide My Email addresses to <code>@private.icloud.com<\/code>, they&#8217;ll remain <code>@icloud.com<\/code> \u2014 <a href=\"https:\/\/appleinsider.com\/articles\/26\/08\/24\/hide-my-email-no-longer-changing-domains-will-keep-icloudcom\">appleinsider.com\/\u2026<\/a>\n<ul>\n<li><strong>Related:<\/strong> <a href=\"https:\/\/cyberinsider.com\/brave-launches-email-aliases-to-hide-users-real-email-addresses\/\">Brave launches Email Aliases to hide users\u2019 real email addresses \u2014 cyberinsider.com\/\u2026<\/a> (an alternative for non-iCloud+ users, but as easy to block as <code>@private.icloud.com<\/code> would have been, uses <code>@bravealias.com<\/code>)<\/li>\n<\/ul>\n<\/li>\n<li>\ud83c\uddea\ud83c\uddfa NosillaCastaway Joop shared that European router maker FRITZ!Box just added ad blocking to their routers as a standard feature via a software update \u2014 <a href=\"https:\/\/www.ct.nl\/nieuws\/deze-nieuwe-fritzbox-functie-blokkeert-advertenties-op-al-je-apparaten\/\">www.ct.nl\/\u2026<\/a> (Dutch-language, so translation required for most)\n<ul>\n<li>The <a href=\"https:\/\/www.tech45.eu\">Tech45<\/a> panel often speak very positively about these routers, they appear to be a great option for geekier Europeans in the limited set of countries they sell in.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Deep Dive \u2014 More Details Emerge About AI Escapes<\/h2>\n<h3>Open AI Release Technical Details on the Hugging Face Hack<\/h3>\n<p>OpenAI have now released a very detailed technical report on their agents&#8217; attack on Hugging Face, the first such escape to come to our attention.<\/p>\n<p>For full coverage see:<\/p>\n<ul>\n<li><a href=\"https:\/\/cyberinsider.com\/openai-says-ai-agents-formed-a-swarm-before-breaching-hugging-face\/\">OpenAI says AI agents formed a \u2018swarm\u2019 before breaching Hugging Face \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/nearly-700-rogue-ai-agents-coordinated-in-the-hugging-face-attack\/\">Nearly 700 rogue AI agents coordinated in the Hugging Face attack \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/08\/openai-says-reward-hacking-drove-ai.html\">OpenAI Says Reward Hacking Drove AI Agents to Exploit Zero-Days and Breach Hugging Face \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.macobserver.com\/news\/openai-explains-the-shocking-ai-breach-of-hugging-face-systems\/\">OpenAI Explains the Shocking AI Breach of Hugging Face Systems \u2014 www.macobserver.com\/\u2026<\/a><\/li>\n<\/ul>\n<p>I haven&#8217;t read the full report (don&#8217;t have infinite time!), so rather than trying to summarise the summaries, I&#8217;ve selected what I think are the key points from the summaries linked above.<\/p>\n<blockquote><p>\n  <em>&#8220;OpenAI has published a detailed post-mortem of July\u2019s Hugging Face breach, revealing that its AI agents did far more than escape a cybersecurity sandbox. The models created an unauthorized communication network, shared exploits and credentials, coordinated attacks across separate evaluation runs, and ultimately compromised both Hugging Face and parts of OpenAI\u2019s own research infrastructure.&#8221;<\/em> \u2014 Cyber Insider<\/p>\n<p>  <em>&#8221; \u2026 the models began dividing work among themselves, with some searching for credentials, others developing exploits, and others coordinating activity. Several agents referred to the resulting group as a &#8216;swarm&#8217; or &#8216;collective.'&#8221;<\/em> \u2014 Cyber Insider<\/p>\n<p>  <em>\u201cOpenAI \u2026 revealed that reward hacking was a key driver behind the artificial intelligence (AI)-powered hack of Hugging Face last month, adding that it found evidence of misaligned behavior as early as late May.\u201d<\/em> \u2014 The Hacker News<\/p>\n<p>  <em>&#8221; \u2026 many of the tasks were nearly impossible to solve. Instead of giving up, the artificial intelligence bots decided to look for shortcuts to complete their goals and get a reward.&#8221;<\/em> \u2014 The Mac Observer\n<\/p><\/blockquote>\n<p>In other words, this was indeed an example of the alignment problem!<\/p>\n<blockquote><p>\n  <em>&#8220;OpenAI&#8217;s investigation, validated by CrowdStrike and an independent assessment by METR and Redwood Research, found that rogue activity started in May.&#8221;<\/em> \u2014 Bleeping Computer\n<\/p><\/blockquote>\n<p>Open AI found that their agents had hacked their <a href=\"https:\/\/jfrog.com\/artifactory\/\">Artifactory<\/a> instance (a repository for store and distributing software artifacts like shared code libraries), so they recreated and patched it, and assumed they had solved the problem, but &#8230;<\/p>\n<blockquote><p>\n  \u2026 the agents restored their communications channel using &#8216;unauthenticated WebDAV requests to create message directories in Artifactory&#8217;. OpenAI explains that the agents communicated through encoded messages in directory names.<\/p>\n<p>  <em>&#8220;Agents regained unintended internet access by making Artifactory\u2019s remote-repository service issue outbound requests on their behalf \u2026 Agents began to autonomously divide labor. Some investigated possible exploits, others searched for credentials, and others focused on communication or coordination \u2026 Agents offered their own expertise in exchange for help elsewhere and left requests for peers who might be better positioned to pursue a particular lead.&#8221;<\/em> \u2014 OpenAI<\/p>\n<p>  <em>&#8220;The AI company says that although the swarm did not exhibit \u201cperfect coherent intelligence,\u201d there were cases where agents prioritized achieving collective goals over pursuing individual tasks.&#8221;<\/em> \u2014 Bleeping Computer<\/p>\n<p>  <em>&#8220;According to METR, the swarm comprised 1,200 individual agents who cooperated on various levels, and about 700 of them actively participated in the Hugging Face attack.&#8221;<\/em> \u2014 Bleeping Computer<\/p>\n<p>  <em>&#8220;OpenAI believes that the rogue agent behavior was caused by a combination of training incentives and missing safeguards \u2026 the evaluations lacked standard safeguards that likely would have detected and stopped the malicious activity \u201cmore than a day\u201d before the models breached Hugging Face.&#8221;<\/em> \u2014 Bleeping Computer<\/p>\n<p>  <em>&#8220;Retrospective testing indicated that OpenAI\u2019s current chain-of-thought monitoring would likely have detected the dangerous activity more than a day before Hugging Face was breached.&#8221;<\/em> \u2014 Cyber Insider<\/p>\n<p>  <em>&#8220;In response, OpenAI has quarantined IM1\u2019s weights and paused its largest frontier training run while strengthening sandbox isolation and requiring chain-of-thought monitoring for capable models (GPT-5.6 Sol or higher)&#8221;<\/em> \u2014 Bleeping Computer\n<\/p><\/blockquote>\n<h3>Other Related News<\/h3>\n<ul>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/08\/claude-opus-46-bypasses-gym-booking.html\">Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users&#8217; Reservations in Tests \u2014 thehackernews.com\/\u2026<\/a> (A real-world example of the alignment problem)<\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/experiment-shows-ai-agents-can-escape-secure-vms-using-zero-days\/\">Experiment shows AI agents can escape secure VMs using zero-days \u2014 cyberinsider.com\/\u2026<\/a>\n<ul>\n<li><em>&#8220;The results challenge the assumption that conventional VMs are sufficient containment for advanced autonomous agents.&#8221;<\/em>  \u2014 Cyber Insider<\/li>\n<li>We need more robust sandboxes!<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/www.macobserver.com\/news\/nvidia-agrees-to-buy-ai-startup-hugging-face-for-12-9-billion\/\">Nvidia Agrees to Buy AI Startup Hugging Face for $12.9 Billion \u2014 www.macobserver.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.macobserver.com\/news\/major-tech-firms-unite-to-defend-against-rogue-ai-cyber-threats\/\">Major Tech Firms Unite to Defend Against Rogue AI Cyber Threats \u2014 www.macobserver.com\/\u2026<\/a>\n<ul>\n<li>An open letter from the major tech firms responsible for the problem that expresses great concern<\/li>\n<li>The letter argues that something must be done, but despite being from the very organisations that have the power to actually do something, does nothing!<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>\u2757 Action Alerts<\/h2>\n<aside class=\"small-aside\">Calls to action, if any stories in this section are relevant to you, there is some action you should take.<\/aside>\n<ul>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/unpatched-calix-flaw-lets-hackers-bypass-nat-to-expose-internal-devices\/\">Unpatched Calix flaw lets hackers bypass NAT to expose internal devices \u2014 www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>ISP-provided router commonly used in the US by big ISPs including Cox!<\/li>\n<li>Affects model GS5239XG, also sometimes branded <em>GigaSpire 7u10txg<\/em><\/li>\n<li><em>\u201cGiven that there\u2019s no fix for CVE-2026-75501, &#91;the security researchers] recommend that users of the vulnerable device disable UPnP through the administrative interface (Advanced \u2192 Security \u2192 UPnP).\u201d<\/em> \u2014 Bleeping Computer<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/ubiquiti-patches-three-max-severity-security-vulnerabilities\/\">Ubiquiti patches three max severity security vulnerabilities \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li>\u26a0\ufe0f <strong>WordPress Site Owners:<\/strong>\n<ul>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/critical-avada-wordpress-theme-flaw-enables-zero-click-rce\/\">Critical Avada WordPress theme flaw enables zero-click RCE \u2014 www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>Also affects <em>Fusion Builder<\/em> plugin<\/li>\n<li>About as bad as bugs get, remote-code-execution without any user interaction (CVSS score of 9.8!)<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands\/\">GiveWP WordPress donation plugin flaw lets hackers execute server commands \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Worthy Warnings<\/h2>\n<aside class=\"small-aside\">Potentially relevant warnings from government organisations, public interest groups, or the security community.<\/aside>\n<ul>\n<li>More malicious code found in routers from Chinese firm ZBT: <a href=\"https:\/\/thehackernews.com\/2026\/08\/china-made-zbt-routers-ship-with-two.html\">China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access \u2014 thehackernews.com\/\u2026<\/a>\n<ul>\n<li>We covered the ENDLESSDOORS backdoor in ZBTLink branded routers last time \u2014 <a href=\"https:\/\/cyberinsider.com\/chinese-zbtlink-wifi-routers-ship-with-endlessdoors-malware\/\">cyberinsider.com\/\u2026<\/a><\/li>\n<li>Two additional backdoors named SPEAKINGSTONE &amp; DARKLANTERN found<\/li>\n<li>According to <a href=\"https:\/\/lumo.proton.me\/\">Lumo<\/a>, these routers are widely used in the US and Europe under the brands: <strong>Zbtlink<\/strong>, <strong>WiFlyer<\/strong>, <strong>DeepOrange<\/strong>, <strong>KuWFi<\/strong> &amp;\u00a0<strong>WORDFI<\/strong><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/08\/fake-apple-support-ai-calls-target.html\">Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes \u2014 thehackernews.com\/\u2026<\/a> (New Phishing-as-a-Service offering for sale on the darkweb \ud83d\ude41)<\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/carhartt-data-breach-exposes-information-of-129-million-accounts\/\">Carhartt data breach exposes information of 12.9 million accounts \u2014 www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>No mention of notifications to affected users<\/li>\n<li>Includes physical addresses \u2014 <a href=\"https:\/\/haveibeenpwned.com\/Breach\/Carhartt\">haveibeenpwned.com\/\u2026<\/a><\/li>\n<li>A perfect illustration of why I trust HIBP over the main-stream press: <a href=\"https:\/\/www.troyhunt.com\/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt\/\">A Cautionary Tale About Data Breach Claims, Verification and Carhartt \u2014 www.troyhunt.com\/\u2026<\/a> (Initially, wrongly, reported by many as affecting over 24M users)<\/li>\n<\/ul>\n<\/li>\n<li>Another reminder of why you need to choose your VPN provider carefully: <a href=\"https:\/\/cyberinsider.com\/proton-finds-85-of-us-downloaded-vpn-apps-contain-trackers\/\">Proton finds 85% of US-downloaded VPN apps contain trackers \u2014 cyberinsider.com\/\u2026<\/a> (Note Proton sell a VPN service, so they are not neutral observers!)<\/li>\n<\/ul>\n<h2>Notable News<\/h2>\n<ul>\n<li>\ud83c\uddfa\ud83c\uddf8 <a href=\"https:\/\/cyberinsider.com\/meta-agrees-to-17-1-billion-settlement-over-alleged-harms-to-children\/\">Meta agrees to $17.1 billion settlement over alleged harms to children \u2014 cyberinsider.com\/\u2026<\/a>\n<ul>\n<li><em>&#8220;For users identified as minors, Facebook and Instagram will impose a combined two-hour daily limit that can only be turned off with parental permission and block most app functionality between midnight and 6 a.m. Push notifications will also be restricted during school hours, while direct messaging remains exempt. \u2026 Other requirements include stronger parental controls, hidden like and reaction counts, restrictions on cosmetic-surgery and extreme-makeup filters, and an option to make a non-personalized feed the default.&#8221;<\/em> \u2014 Cyber Insider<\/li>\n<li>Case brought by 51 State Attorneys General<\/li>\n<li>Only a proposed settlement, needs court approval<\/li>\n<li>Requires stronger age assurance, but doesn&#8217;t prescribe a mechanism<\/li>\n<li>Independent oversight process agreed<\/li>\n<li>Meta commit to making data available to independent researchers, and to fund such research<\/li>\n<\/ul>\n<\/li>\n<li>\ud83c\uddfa\ud83c\uddf8 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/legal\/tiktok-reaches-400m-settlement-with-us-over-coppa-violations\/\">TikTok reaches $400M settlement with US over COPPA violations \u2014 www.bleepingcomputer.com\/\u2026<\/a> (Second settlement, previous 2019 settlement promised changes, but not enough was done, now, apparently actually compliant)<\/li>\n<li>Small but nice improvements:\n<ul>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/08\/whatsapp-adds-multiple-passkeys-for.html\">WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/firefox-moves-to-adopt-jpeg-xl-with-safer-rust-based-decoder\/\">Firefox moves to adopt JPEG XL with safer Rust-based decoder \u2014 cyberinsider.com\/\u2026<\/a> (better images &amp; more secure \ud83c\udf89)<\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/android-17-adds-ech-support-to-make-web-browsing-harder-to-track\/\">Android 17 adds ECH support to make web browsing harder to track \u2014 www.bleepingcomputer.com\/\u2026<\/a> (ECH is <em>Encrypted Client Hello<\/em>, an improvement to the TLS protocol HTTPS depends on)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Interesting Insights<\/h2>\n<aside class=\"small-aside\">High-quality opinion and editorial content recommended by Bart.<\/aside>\n<ul>\n<li>Another reason to consider a privacy-protecting LLM: <a href=\"https:\/\/cyberinsider.com\/duckduckgo-finds-one-third-of-ai-users-share-secrets-they-hide-from-people\/\">DuckDuckGo finds one-third of AI users share secrets they hide from people \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<\/ul>\n<h2>Palate Cleansers<\/h2>\n<aside class=\"small-aside\">Anything upbeat and nerdy Bart and\/or Allison think you might enjoy.<\/aside>\n<ul>\n<li><strong>From Bart:<\/strong> \ud83c\udfa6 The full video of a talk Mac icon designer Susan Kare delivered at a Y Combinator event: <a href=\"https:\/\/www.youtube.com\/watch?v=YEvLKzsEwMw\">Susan Kare: Designing Icons &amp; Graphics For the Original Mac \u2014 www.youtube.com\/\u2026<\/a> (nearly an hour long!)<\/li>\n<\/ul>\n<h2>Legend<\/h2>\n<p>When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by <a href=\"https:\/\/bartb.ie\/\">Bart<\/a>.<\/p>\n<table>\n<thead>\n<tr>\n<th align=\"center\">Emoji<\/th>\n<th align=\"left\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td align=\"center\">\ud83c\udfa7<\/td>\n<td align=\"left\">A link to <strong>audio content<\/strong>, probably a podcast.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\u2757<\/td>\n<td align=\"left\">A <strong>call to action<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\"><em>flag<\/em><\/td>\n<td align=\"left\">The story is particularly relevant to people living in a <strong>specific country<\/strong>, or, the organisation the story is about is affiliated with the government of a specific country.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udcca<\/td>\n<td align=\"left\">A link to <strong>graphical content<\/strong>, probably a chart, graph, or diagram.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83e\uddef<\/td>\n<td align=\"left\">A story that has been <strong>over-hyped<\/strong> in the media, or, <em>&#8220;no need to light your hair on fire&#8221;<\/em> \ud83d\ude42<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udcb5<\/td>\n<td align=\"left\">A link to an article behind a <strong>paywall<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udccc<\/td>\n<td align=\"left\">A <strong>pinned<\/strong> story, i.e. one to keep an eye on that&#8217;s likely to develop into something significant in the future.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83c\udfa9<\/td>\n<td align=\"left\">A <strong><em>tip of the hat<\/em><\/strong> to thank a member of the community for bringing the story to our attention.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83c\udfa6<\/td>\n<td align=\"left\">A link to <strong>video content<\/strong>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":4,"featured_media":28385,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[147,214],"tags":[50,569],"class_list":["post-36568","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-posts","category-security-bits","tag-security","tag-security-bits"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/www.podfeet.com\/blog\/wp-content\/uploads\/2023\/05\/Security-Bits-Logo_1040x520.png","_links":{"self":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/36568","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/comments?post=36568"}],"version-history":[{"count":4,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/36568\/revisions"}],"predecessor-version":[{"id":36590,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/36568\/revisions\/36590"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media\/28385"}],"wp:attachment":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media?parent=36568"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/categories?post=36568"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/tags?post=36568"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}