{"id":36608,"date":"2026-09-12T17:44:23","date_gmt":"2026-09-13T00:44:23","guid":{"rendered":"https:\/\/www.podfeet.com\/blog\/?p=36608"},"modified":"2026-09-12T17:47:01","modified_gmt":"2026-09-13T00:47:01","slug":"sb-2026-09-12","status":"publish","type":"post","link":"https:\/\/www.podfeet.com\/blog\/2026\/09\/sb-2026-09-12\/","title":{"rendered":"Security Bits \u2014 12 September 2026"},"content":{"rendered":"<h2>Feedback &amp; Followups<\/h2>\n<aside class=\"small-aside\">Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time.<\/aside>\n<ul>\n<li><strong>Age Verification News:<\/strong>\n<ul>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/microsoft\/microsoft-adds-age-awareness-apis-that-can-tell-if-users-are-children-teens-or-adults\/\">Microsoft adds age-awareness APIs that can tell if users are children, teens, or adults \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li>Apps get an age range, not a specific age or date-of-birth<\/li>\n<li>Apple announced similar APIs earlier this year<\/li>\n<li>\ud83c\uddfa\ud83c\uddf8 A nice sensible tweak: <a href=\"https:\/\/cyberinsider.com\/california-moves-to-exempt-linux-from-new-age-verification-law\/\">California moves to exempt Linux from new age-verification law \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>\ud83c\uddea\ud83c\uddfa As the law intended, the European Commission has updated the list of large platforms that get tighter scrutiny under Digital Services Act (DSA) \u2014 <a href=\"https:\/\/cyberinsider.com\/eu-puts-chatgpt-reddit-and-roblox-under-stricter-dsa-rules\/\">cyberinsider.com\/\u2026<\/a>\n<ul>\n<li><strong>ChatGPT<\/strong> has been designated a <em>Very Large Online Search Engine<\/em><\/li>\n<li><strong>Reddit<\/strong> &amp; <strong>Roblox<\/strong> have been designated <em>Very Large Online Platforms<\/em> (VLOPs)<\/li>\n<\/ul>\n<\/li>\n<li>\ud83c\uddfa\ud83c\uddf8 <a href=\"https:\/\/www.cultofmac.com\/news\/oklahoma-digital-drivers-license-apple-wallet\">Oklahoma joins states that let driver\u2019s licenses go in Apple Wallet \u2014 www.cultofmac.com\/\u2026<\/a> (service now live)<\/li>\n<\/ul>\n<h2>Listener Questions<\/h2>\n<aside class=\"small-aside\">Submit your questions for future shows to Allison using the contact details at the end of the show, or post them in the <em>security-bits<\/em> channel in the <a href=\"https:\/\/podfeet.com\/slack\" target=\"_blank\">Podfeet Slack<\/a>.<\/aside>\n<h3>How Insecure is SMS Multi-Factor Authentication? (from Allister)<\/h3>\n<blockquote><p>\n  A service I use has just introduced two-factor authentication via SMS while another I use has just removed this option citing its insecure nature. I know any 2FA is better than none, but in 2026 how insecure is SMS 2FA really?\n<\/p><\/blockquote>\n<p>SMS-based authentication is inferior to the other commonly used factors for two reasons:<\/p>\n<ol>\n<li>SMS is not <em>phishing resistant<\/em> (same is true of all code-based factors)<\/li>\n<li>The SMS infrastructure is inherently insecure<\/li>\n<\/ol>\n<h4>Phishing-Resistant Factors?<\/h4>\n<p>If an authentication factor requires a human to enter a code into a text box, then that human can be tricked into entering that code into a malicious website, allowing the attacker to steal a sign-in session.<\/p>\n<p>How does this work?<\/p>\n<ol>\n<li>Attacker tricks user into following a phishing link that imitates some legitimate site<\/li>\n<li>User does not look up to the address bar, so does not see they are on a fake site<\/li>\n<li>User enters username and password, sending it to the attacker<\/li>\n<li>Attacker starts logging into the real website with those details, triggering a genuine SMS message to the user<\/li>\n<li>Attacker shows user a box to enter the code<\/li>\n<li>User still does not notice the address bar, and enters the code<\/li>\n<li>Attacker logs in to site as the user<\/li>\n<\/ol>\n<p>When this works, the attacker can be the user for one session. If the site makes you sign in again every hour, then the attacker is in every hour, but most sites let users stay logged in as long as they&#8217;re not idle for more than some amount of minutes, giving attackers effectively infinite opportunity for damage.<\/p>\n<p>None of this is unique to SMS. It&#8217;s true of codes sent by email, but also push notifications, and even codes generated by apps using the Timebased-One-Time-Password protocol, or <a href=\"https:\/\/en.wikipedia.org\/wiki\/Time-based_one-time_password\">TOTP<\/a> (better known as <em>Google Authenticator<\/em>, even though it&#8217;s an open standard that works in just about any password manager). In fact, even hardware dongles that display a code that changes every 30 seconds are vulnerable to this kind of phishing attack!<\/p>\n<p>The only commonly used mechanisms that are not vulnerable to phishing are based on the <a href=\"https:\/\/fidoalliance.org\">FIDO<\/a> protocol, such as FIDO-compliant hardware dongles and passkeys.<\/p>\n<h4>Why SMS is Insecure<\/h4>\n<p>What makes SMS even less secure than the many other non-phishing-resistant factors still used today is a fundamental weakness in how cellphones work \u2014 the entire global system is as weak as the least secure carrier anywhere on planet Earth!<\/p>\n<p>Similar to how the internet uses human-friendly domain names, while all the underlying traffic is addressed by IP addresses, SMS messages use human-friendly phone numbers, but the underlying messages are addressed by IMSI numbers. Every SIM card in the world (physical or virtual) has a unique ID, and there is a DNS-like system for mapping cellphone numbers to IMSI numbers. That system is known to be utterly insecure, and upgrading that system requires the cooperation of every single cellphone provider on earth. Realistically, it&#8217;s not going to change any time soon!<\/p>\n<p>And there&#8217;s also SIM-jacking, where someone tricks the carrier into giving them your phone number.<\/p>\n<h4>Attacking SMS-based Authentication is an Economics Question, not a Technical One!<\/h4>\n<p>The fatal flaws in the SMS system are well known, so the cybercriminals can exploit them easily. This means that you can buy SMS interception from Cybercrime-as-a-Service offerings on the dark web. Someone wishing to attack you on a site that uses SMS for authentication simply needs to:<\/p>\n<ol>\n<li>Get your username and password \u2014 usually from a data breach or key-logging malware, or simply purchased on the dark web<\/li>\n<li>Determine your Cellphone number \u2014 almost certainly available for a small fee on the dark web<\/li>\n<li>Pay a fee to reroute your cellphone number to their SIM card for an hour<\/li>\n<li>Log in as you (the code will go straight to their SIM card)<\/li>\n<\/ol>\n<p>If all that sounds like too much work, you can now buy fully packaged soup-to-nuts offerings that get you all the way in without having to do anything more than transfer a few fractions of a bitcoin to a Phishing-as-a-Service provider!<\/p>\n<p>All that means that the key question when evaluating the risk simply boils down to this \u2014 is an attacker&#8217;s expected gain from breaking into my account greater than or less than the price of the current Crimeware-as-a-Service offerings?<\/p>\n<p>If SMS is protecting your account on a banking website, a cryptocurrency exchange, a stock-trading account, a gambling account, or some kind of investment brokering account, then the math is obviously not on your side.<\/p>\n<p>If it&#8217;s just protecting your login to a hosting providers hosting your personal travel website, the economics are obviously on your side.<\/p>\n<h4>As Flawed as SMS is, it&#8217;s Always Better than Nothing!<\/h4>\n<p>The barrier to entry to attack SMS-based authentication may not be nearly as high as we like; it&#8217;s still non-zero! What that means is:<\/p>\n<ol>\n<li>If a site holds valuable data, and its use is in any way optional, don&#8217;t accept SMS-based authentication; move to an alternative provider that facilitates stronger security!<\/li>\n<li>When offered the choice between SMS and any other factor, choose the other factor!<\/li>\n<li>If you have no choice but to use a site that only offers SMS as a second factor, use it, because that&#8217;s still your least-bad option<\/li>\n<\/ol>\n<h2>Deep Dive \u2014 More AI Escapes Disclosed<\/h2>\n<p>More details continue to emerge of <em>&#8216;lab leaks&#8217;<\/em> from the big AI companies.<\/p>\n<h3>OpenAI Admits to Another Worrying Agent Escape<\/h3>\n<p>Independent security researchers discovered another clandestine back channel rogue OpenAI agents were using to secretly coordinate their activities. In this case, agents discovered they could edit a German developer wiki on the public internet from inside their sandbox, even though their sandbox was trying to enforce read-only internet access on them.<\/p>\n<p>After the details were published, OpenAI admitted it knew about the event, and despite the fact that the bots abused a real-world website, decided not to classify it as a security incident because the agents didn&#8217;t compromise the site; they just used it illicitly. OpenAI classified it as an alignment problem instead, which they didn&#8217;t think needed public disclosure!<\/p>\n<p>OpenAI say they are developing new reporting processes, and will publish details in a few weeks.<\/p>\n<h3>The Details<\/h3>\n<p>Below are what I consider the most important snippets from the following reports:<\/p>\n<ul>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/09\/thousands-of-openai-agents-quietly.html\">Thousands of OpenAI Agents Quietly Turned an Abandoned Wiki Into Their Coordination Channel \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/openai-admits-it-didnt-disclose-rogue-ai-wiki-hijacking-incident\/\">OpenAI admits it didn&#8217;t disclose rogue AI wiki hijacking incident \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<\/ul>\n<blockquote><p>\n  <em>&#8220;&#91;The agents were] using the site as a shared board to pool answers to a timed web task and pass around a way out of their sandbox.\u201d<\/em> \u2014 The Hacker News<\/p>\n<p>  <em>\u201cThe agents were supposed to have read-only Internet access but discovered they could write to an obscure German programming wiki, DSEWiki (or DeutschesSoftwareEntwickler). They turned it into a shared message board for pooling answers, cheating on tests, predicting future questions, and exchanging techniques for bypassing OpenAI&#8217;s sandbox restrictions.\u201d<\/em> \u2014 Bleeping Computer<\/p>\n<p>  <em>\u201cOpenAI&#8217;s own wording suggests a wider footprint than the researchers documented, describing the episode as one \u2018where our agents wrote to several internet sites.\u2019\u201d<\/em> \u2014 Bleeping Computer\n<\/p><\/blockquote>\n<h3>Anthropic Disclosed a Fourth Escape with Real-World Damage<\/h3>\n<p>This is a simpler story than the others, but you can find the full details here: <a href=\"https:\/\/thehackernews.com\/2026\/09\/anthropic-ai-models-breached-real.html\">Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 \u2014 thehackernews.com\/\u2026<\/a><\/p>\n<p>Here&#8217;s the opening summary:<\/p>\n<blockquote><p>\n  <em>\u201cAnthropic \u2026 disclosed a fourth incident in which its artificial intelligence model broke into real third-party systems\u201d<\/em> \u2014 The Hacker News\n<\/p><\/blockquote>\n<p>This happened back in January, and it was not a case of the agents breaking out, but of Anthropic being careless with their sandbox and doing the digital equivalent of leaving the cage door open.<\/p>\n<h3>Related News \u2014 Anthropic&#8217;s Latest Threat Report Reveals how their Services are Abused<\/h3>\n<p>The opening of the Anthropic report explains the framing the company want to put on this abuse well:<\/p>\n<blockquote><p>\n  <em>&#8220;Over the past eight months, our Threat Intelligence team identified and disrupted operations in which threat actors tried to use Claude for malicious activity. In this report, we share case studies from those operations and describe how malicious use of Claude has evolved since our previous threat reports in March, August, and November 2025. In each case, we disrupted the activity, used what we learned to strengthen our safeguards, and shared intelligence with authorities and industry partners, where appropriate.&#8221;<\/em> \u2014 Anthropic\n<\/p><\/blockquote>\n<p>The word <em>disrupted<\/em> might be a little misleading, it doesn&#8217;t mean they <strong>prevented<\/strong> these abuses, it means they noticed the and then intervened to stop them continuing. A lot of real-world harm was perpetrated before the disruptions!<\/p>\n<p>As well as the expected abuse of these services for crafting well tailored phishing lures, and the expected help with creating malware, the most notable detail was that Claude was abused to download and scan 1.8M Android apps, and extract all the hard-coded secrets their developers had left in those apps. This would generally be things like API keys. Claude was abused to stream all the secrets it found to Telegram in real time, broken into over 100 different channels for different types of secrets.<\/p>\n<p>Another point to note is that it&#8217;s not just cybercriminals abusing Claude, but Russian and Chinese state-linked hacking groups, so Anthropic is helping Russia and China spy on, and attack, the West!<\/p>\n<p>It&#8217;s good that Anthropic are open about these abuses, but the question is, are they moving forward too fast, and not putting enough efforts into addressing the abuses of their current models before releasing new ones?<\/p>\n<h4>Links<\/h4>\n<ul>\n<li>Anthropic&#8217;s Report: <a href=\"https:\/\/www.anthropic.com\/threat-intelligence-report-september-2026\">Detecting and countering misuse of AI: September 2026 \u2014 www.anthropic.com\/\u2026<\/a><\/li>\n<li>Summary: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-abused-claude-to-extract-secrets-from-18m-android-apps\/\">Hackers abused Claude to extract secrets from 1.8M Android apps \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<\/ul>\n<h3>Related News \u2014 GPT-6 Astra is Better at Cybersecurity and More Difficult to Monitor<\/h3>\n<p>Despite all the recent problems, OpenAI have gone ahead and released GPT-6 Astra anyway. Whatever lip service they paid to slowing down and taking stock, Allison&#8217;s scepticism about their seriousness appears to have been warranted \ud83d\ude41<\/p>\n<p>You&#8217;ll find the full details in the following Bleeping Computer article, but I&#8217;ll quote the key points below \u2014 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/artificial-intelligence\/openai-says-gpt-6-astra-can-find-zero-days-but-is-also-harder-to-monitor\/\">OpenAI says GPT-6 Astra can find zero-days, but is also harder to monitor \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/p>\n<blockquote><p>\n  &#91;GPT-6 Astra is the first model OpenAI have self-certified as reaching its <em>Critical<\/em> threshold for cybersecurity.] Under OpenAI&#8217;s own framework, a model reaches the Critical cybersecurity threshold if it can &#8220;identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention,&#8221; or devise and execute new end-to-end attack strategies against hardened targets.\u201d<br \/>\n  \u2026<br \/>\n  OpenAI has strengthened Astra&#8217;s jailbreak resistance, isolation, checkpoint encryption, monitoring, and internal deployment controls before release.<br \/>\n  \u2026<br \/>\n  The company also claims Astra is better aligned than GPT-5.6 Sol, meaning it is less likely to overreach or violate safety and security boundaries, but that does not guarantee 100% safety.<br \/>\n  \u2026<br \/>\n  One of the more unusual findings is that Astra appears better at controlling what it reveals in its own chain of thought.<\/p>\n<p>  &#8220;GPT-6 Astra&#8217;s monitorability has decreased relative to GPT-5.6 Sol,&#8221; OpenAI acknowledged.<\/p>\n<p>  In tests, OpenAI found that Astra could sometimes hide strategically poor performance and avoid internal monitors during certain sabotage tasks.\n<\/p><\/blockquote>\n<h2>\u2757 Action Alerts<\/h2>\n<aside class=\"small-aside\">Calls to action, if any stories in this section are relevant to you, there is some action you should take.<\/aside>\n<ul>\n<li>A new record: <a href=\"https:\/\/www.bleepingcomputer.com\/news\/microsoft\/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days\/\"><strong>Microsoft<\/strong> September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/appleinsider.com\/articles\/26\/09\/08\/ios-2662-ipados-2662-land-as-ios-27-gets-closer-to-release\"><strong>iOS 26.6.2<\/strong>, <strong>iPadOS 26.6.2<\/strong> land as iOS 27 gets closer to release \u2014 appleinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/telegram-desktop-bug-lets-poisoned-messages-steal-exported-chat-histories\/\"><strong>Telegram Desktop<\/strong> bug lets poisoned messages steal exported chat histories \u2014 cyberinsider.com\/\u2026<\/a>\n<ul>\n<li>Patched in July, so be sure you are on the latest version<\/li>\n<li>The issue allowed malicious bots to inject JavaScript into their posts, effectively booby-trapping HTML exports so they send copies of themselves to the attackers when opened in a browser \u2014 even after patching, <strong>old exports remain vulnerable<\/strong>!<\/li>\n<\/ul>\n<\/li>\n<li>\u26a0\ufe0f <strong>Chrome Users:<\/strong> be sure to re-start your browser to get fully patched \u2014 two zero-day fixes just days apart:\n<ul>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/09\/google-releases-chrome-update-to-patch.html\">Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day \u2014 thehackernews.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/google-fixes-second-actively-exploited-chrome-zero-day-in-under-five-days\/\">Google fixes second actively exploited Chrome zero-day in under five days \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>\u26a0\ufe0f <strong>Plex Users:<\/strong> <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/plex-warns-users-to-patch-security-vulnerabilities-immediately\/\">Plex warns users to patch security vulnerabilities immediately \u2014 www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>Server and client should be updated, but servers are more important to patch, especially if directly accessible from the internet! (Much better using something like <a href=\"https:\/\/tailscale.com\">Tailscale<\/a>!)<\/li>\n<li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/over-36-000-plex-servers-unpatched-against-recently-disclosed-flaws\/\">Over 36,000 exposed Plex servers vulnerable to recent flaws \u2014 www.bleepingcomputer.com\/\u2026<\/a><\/li>\n<li>No CVE assigned, making tracking difficult for organisations<\/li>\n<\/ul>\n<\/li>\n<li>\u26a0\ufe0f <strong>WordPress Users:<\/strong> <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks\/\">WordPress backup plugin flaw exposes millions of sites to takeover attacks \u2014 www.bleepingcomputer.com\/\u2026<\/a> (the plugin is named <em>&#8221;All-in-One WP Migration and Backup<\/em>)<\/li>\n<li>\u26a0\ufe0f <strong>MikroTik Router Owners:<\/strong> <a href=\"https:\/\/isc.sans.edu\/forums\/diary\/Critical+MikroTik+Vulnerability+Patch+Now\/33314\/\">Critical MikroTik Vulnerability &#8211; Patch Now \u2014 isc.sans.edu\/\u2026<\/a><\/li>\n<\/ul>\n<h2>Worthy Warnings<\/h2>\n<aside class=\"small-aside\">Potentially relevant warnings from government organisations, public interest groups, or the security community.<\/aside>\n<ul>\n<li><strong>Reminder:<\/strong> it&#8217;s simply not safe to buy physical gift cards from retail outlets anymore: <a href=\"https:\/\/appleinsider.com\/articles\/26\/09\/02\/how-organized-crime-steals-millions-through-an-apple-gift-card-scam\">How organized crime steals millions through an Apple gift card scam \u2014 appleinsider.com\/\u2026<\/a><\/li>\n<li>\u26a0\ufe0f <strong>Android Users<\/strong> \u2014 beware a new attack technique: <a href=\"https:\/\/thehackernews.com\/2026\/09\/google-play-early-access-abused-to-push.html\">Google Play Early Access Abused to Push Thousands of Deceptive Android Apps \u2014 thehackernews.com\/\u2026<\/a>\n<ul>\n<li>As Android tighten the rules on side-loading, attackers are shifting their focus<\/li>\n<li>Early Access apps can be downloaded by users who have the link, but are not listed on the public store. They are intended for pre-release testing.<\/li>\n<li>Early Access apps have reviews and ratings disabled, so the usual danger signs from the community are impossible<\/li>\n<li>Best advice is not to download any early access apps unless you have some kind of relationship with a developer and are genuinely beta-testing an app<\/li>\n<\/ul>\n<\/li>\n<li>\u26a0\ufe0f <strong>Travelers:<\/strong> \ud83c\uddfb\ud83c\uddf3 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/220-million-traveler-records-exposed-in-vietnam-linked-apis-leak\/\">220 million traveler records exposed in Vietnam-linked APIS leak \u2014 www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>The leaked data seems to cover all <strong>international passengers who flew to, from, or via Vietnam<\/strong> any time between January 2017 and April 2026<\/li>\n<li>The leaked data includes names, dates of birth, flight details, and travel document (passport\/ID Card) numbers<\/li>\n<li>This was a cloud-hosted database accidentally left exposed, and it&#8217;s not even clear who the database belongs to!<\/li>\n<li>No breach notifications have been sent<\/li>\n<\/ul>\n<\/li>\n<li>\u26a0\ufe0f <strong>Skullcandy Earbud Users:<\/strong> <a href=\"https:\/\/cyberinsider.com\/skullcandy-earbuds-flaw-lets-nearby-attackers-access-the-microphone\/\">Skullcandy earbuds flaw lets nearby attackers access the microphone \u2014 cyberinsider.com\/\u2026<\/a>\n<ul>\n<li>Affects Skullcandy Dime 3 wireless buds<\/li>\n<li>Allows <strong>nearby<\/strong> attackers to pair with the buds without putting them into pairing mode or getting the user to approve any prompts<\/li>\n<li>No patch available<\/li>\n<li><em>\u201cOwners of affected Dime 3 earbuds should therefore be cautious when using them in public or other environments where unknown devices may be within Bluetooth range.\u201d<\/em> \u2014 Bleeping Computer<\/li>\n<\/ul>\n<\/li>\n<li>\u26a0\ufe0f <strong>LG TV Owners:<\/strong> <a href=\"https:\/\/cyberinsider.com\/lg-smart-tvs-found-scanning-home-networks-for-nearby-devices\/\">LG Smart TVs found scanning home networks for nearby devices \u2014 cyberinsider.com\/\u2026<\/a>\n<ul>\n<li>Primarily a privacy breach, all the gathered information is being reported back to LG for user profiling<\/li>\n<li>Also revealed some security issues<\/li>\n<li>Yet more reasons never to connect a TV directly to your network, but to add smarts to TVs using trusted boxes like the Apple TV<\/li>\n<\/ul>\n<\/li>\n<li>\ud83c\uddfa\ud83c\uddf8 The Florida DMV may to have lost hundreds of thousands of driver records \u2014 <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/florida-confirms-dmv-database-breached-via-stolen-police-account\/\">www.bleepingcomputer.com\/\u2026<\/a>\n<ul>\n<li>Details still emerging; hackers claim 200,000. The existence of <strong>a<\/strong> breach has been confirmed, but not the actual scale<\/li>\n<li>No notifications to affected users, at least not yet<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Notable News<\/h2>\n<ul>\n<li>Apple&#8217;s New Audio Intelligence Features have privacy built in \u2014 <a href=\"https:\/\/www.cultofmac.com\/news\/apple-watch-live-rewind-siri-recap-privacy\">www.cultofmac.com\/\u2026<\/a>\n<ul>\n<li>Entirely processed locally, in separate <em>secure exclave<\/em> chips (protection from software bugs)<\/li>\n<li>No raw audio saved, let alone accessible to anyone<\/li>\n<li>None of the features attribute audio to specific people<\/li>\n<li>Live rewind only gives a transcript<\/li>\n<li>Siri Recap only produces summaries; the raw transcripts are not saved either<\/li>\n<li>Transcripts are summarized to less than half, and then encrypted and sent off to Private Cloud Compute for further summarization, encrypted again, and sent back to the phone and watch<\/li>\n<li>Apple published their <a href=\"https:\/\/www.apple.com\/privacy\/docs\/Audio_Intelligence_Privacy_Overview_Sep_2026.pdf\">Audio Intelligence Privacy Overview<\/a> that explains all of this in detail<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/www.macobserver.com\/news\/federal-judge-rejects-doj-bid-to-split-up-google-ad-business\/\">Federal Judge Rejects DOJ Bid to Split up Google Ad Business \u2014 www.macobserver.com\/\u2026<\/a>\n<ul>\n<li>The court has proposed behavioural changes rather than a forced breakup<\/li>\n<li>The proposed changes are currently sealed, giving both parties time to reply with suggested changes<\/li>\n<li>When the judge receives and considers Google &amp; the DOJ&#8217;s suggestions, a final ruling will be published.<\/li>\n<li>All of this will of course be appealed!<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/mullvad-to-shut-down-public-encrypted-dns-servers-back-quad9-instead\/\">Mullvad to shut down public encrypted DNS servers, back Quad9 instead \u2014 cyberinsider.com\/\u2026<\/a> (Existing users should switch to an alternative provider, though Quad9 makes a lot of sense since it offers similar features to Mullvad DNS)<\/li>\n<li>Nice cybersecurity improvements:\n<ul>\n<li><a href=\"https:\/\/cyberinsider.com\/tor-vpn-beta-brings-isolated-app-by-app-tor-routing-to-android\/\">Tor VPN Beta brings isolated app-by-app Tor routing to Android \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/android-now-allows-easy-transfer-of-passwords-and-passkeys-between-password-managers\/\">Android now allows easy transfer of passwords and passkeys between password managers \u2014 cyberinsider.com\/\u2026<\/a> (No risky plain-text exports)<\/li>\n<li><a href=\"https:\/\/cyberinsider.com\/cloudflare-brings-post-quantum-dnssec-support-to-1-1-1-1-resolver\/\">Cloudflare brings post-quantum DNSSEC support to 1.1.1.1 resolver \u2014 cyberinsider.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Palate Cleansers<\/h2>\n<aside class=\"small-aside\">Anything upbeat and nerdy Bart and\/or Allison think you might enjoy.<\/aside>\n<ul>\n<li><strong>From Allison:<\/strong>\n<ul>\n<li>Adopt a Pixel from the Nancy Grace Roman Telescope&#8217;s first image \u2014 <a href=\"https:\/\/science.nasa.gov\/mission\/roman-space-telescope\/adopt-a-pixel\/\">science.nasa.gov\/\u2026<\/a><\/li>\n<li>A parody of a woman going a bit far with her AI (the woman doing this is a Sr. Platform Engineer, so she&#8217;s our people): <a href=\"https:\/\/www.tiktok.com\/t\/ZP83SMcm9\/\">www.tiktok.com\/&#8230;<\/a><\/li>\n<\/ul>\n<\/li>\n<li><strong>From Bart:<\/strong>\n<ul>\n<li>\ud83c\udfa7 <a href=\"https:\/\/www.macstories.net\/linked\/designed-in-california-makes-its-official-debut\/\">Designed in California Makes Its Official Debut \u2014 www.macstories.net\/\u2026<\/a><\/li>\n<li>New podcast from Jason Snell &amp; Myke Hurley<\/li>\n<li>Tells stories from Apple&#8217;s history in the style of <em>The Rest is History<\/em> (an award-winning <a href=\"https:\/\/therestishistory.com\/episodes\">podcast<\/a> I also love)<\/li>\n<li>\ud83c\udfa6 <a href=\"https:\/\/www.youtube.com\/watch?v=0Ck-NPqf2c8\">Modern Day Typographer by Elle Cordova \u2014 www.youtube.com\/\u2026<\/a> (Typography meets musicals for a fun video \u2014 recommended by <a href=\"https:\/\/daringfireball.net\/linked\/2026\/09\/08\/modern-day-typographer\">John Gruber<\/a>)<\/li>\n<li>Safari Extension Recommendation (iOS &amp; macOS): <a href=\"https:\/\/andadinosaur.com\/launch-litterbox\">Litterbox \u2014 andadinosaur.com\/\u2026<\/a><\/li>\n<li><em>&#8220;I made\u00a0<strong>Litterbox<\/strong>, a Safari extension that opens x.com links in a popup. The idea is you open it, take a look, gag a little, then close the lid. \u2026 Litterbox doesn\u2019t send your cookies when you open those popups. \u2026 It uses the same API X uses for its website embeds. I don\u2019t think they\u2019ll kill the website embed feature. But if they do, it will be very funny.&#8221;<\/em> \u2014 Zhenyi Tan (Developer)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Legend<\/h2>\n<p>When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by <a href=\"https:\/\/bartb.ie\/\">Bart<\/a>.<\/p>\n<table>\n<thead>\n<tr>\n<th align=\"center\">Emoji<\/th>\n<th align=\"left\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td align=\"center\">\ud83c\udfa7<\/td>\n<td align=\"left\">A link to <strong>audio content<\/strong>, probably a podcast.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\u2757<\/td>\n<td align=\"left\">A <strong>call to action<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\"><em>flag<\/em><\/td>\n<td align=\"left\">The story is particularly relevant to people living in a <strong>specific country<\/strong>, or, the organisation the story is about is affiliated with the government of a specific country.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udcca<\/td>\n<td align=\"left\">A link to <strong>graphical content<\/strong>, probably a chart, graph, or diagram.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83e\uddef<\/td>\n<td align=\"left\">A story that has been <strong>over-hyped<\/strong> in the media, or, <em>&#8220;no need to light your hair on fire&#8221;<\/em> \ud83d\ude42<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udcb5<\/td>\n<td align=\"left\">A link to an article behind a <strong>paywall<\/strong>.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83d\udccc<\/td>\n<td align=\"left\">A <strong>pinned<\/strong> story, i.e. one to keep an eye on that&#8217;s likely to develop into something significant in the future.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83c\udfa9<\/td>\n<td align=\"left\">A <strong><em>tip of the hat<\/em><\/strong> to thank a member of the community for bringing the story to our attention.<\/td>\n<\/tr>\n<tr>\n<td align=\"center\">\ud83c\udfa6<\/td>\n<td align=\"left\">A link to <strong>video content<\/strong>.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>Feedback &amp; Followups Listener and community feedback, developments in recently covered stories, and developments in long-running stories we&#8217;re tracking over time. Age Verification News: Microsoft adds age-awareness APIs that can tell if users are children, teens, or adults \u2014 www.bleepingcomputer.com\/\u2026 Apps get an age range, not a specific age or date-of-birth Apple announced similar APIs [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":28385,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[147,214],"tags":[8329,2079,50,569],"class_list":["post-36608","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-posts","category-security-bits","tag-ai-agents","tag-patch","tag-security","tag-security-bits"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/www.podfeet.com\/blog\/wp-content\/uploads\/2023\/05\/Security-Bits-Logo_1040x520.png","_links":{"self":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/36608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/comments?post=36608"}],"version-history":[{"count":2,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/36608\/revisions"}],"predecessor-version":[{"id":36610,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/36608\/revisions\/36610"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media\/28385"}],"wp:attachment":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media?parent=36608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/categories?post=36608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/tags?post=36608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}