Researchers uncovered an OpenAI API flaw that exposed hidden AI reasoning traces, prompting a fix and a $6000 bug bounty reward
Source: Infosecurity Magazine · 2026-10-27
Researchers uncovered an OpenAI API flaw that exposed hidden AI reasoning traces, prompting a fix and a $6000 bug bounty reward
Source: Infosecurity Magazine · 2026-10-27
Attackers have infected 953 online stores with a scanner-evading JavaScript loader since July 2025
Source: Infosecurity Magazine · 2026-10-27

Elections give scammers plenty to work with: urgent deadlines, familiar faces, passionate supporters, and messages asking people to take action.
Some want you to “fix” your voter registration. Others want a donation, an answer to a survey, or payment for merchandise supposedly endorsed by your favorite politician. The details change, but the objective stays the same: get your money, your personal information, or both.
Here are five election-themed scams to watch out for.
Not every election-themed lure starts with a threat. Some offer to make voting easier.
“Get your ballot on autopilot,” reads one text message we reviewed. It encourages recipients to join a permanent absentee list so their ballots arrive at home for every election, adding the reassuring words: “Verified. Tracked. Counted.”

The message is a scam, though it borrows the language of a real Minnesota voting service. Minnesota does have a permanent absentee voter list, but the link in this text is fraudulent. To check or sign up, go directly to your election authority’s official website.
Other messages take the opposite approach: instead of offering convenience, they warn that you could lose your chance to vote.
A message might say you are not registered to vote, your details are incomplete, or your registration is about to be cancelled. Then it offers a link to sort everything out.
The FBI recently warned about messages that send recipients to fraudulent voter-registration pages. Instead of helping people vote, these sites collect personal information that criminals can use for further fraud.
In Brazil, scammers used a fake WhatsApp account with the Superior Electoral Court’s logo. It claimed to be the court’s “Customer Service Department” (which doesn’t exist) and told people to download an app called “Soluciona Pendência,” roughly translated as “Resolve an outstanding issue.” The message falsely warned that people could lose access to banking or government services.
A fundraising appeal arrives just as an election reaches a critical moment. It uses the candidate’s photograph, familiar campaign language, and an urgent request for money.
That does not necessarily mean the campaign sent it.
The FBI warns that scammers impersonate candidates and political fundraising organizations to collect supposed campaign contributions. Victims believe they are supporting a legitimate organization, but the money goes to criminals instead.
Before donating, find the campaign or organization’s official website yourself and check who will receive the payment. Don’t let a countdown, a matching-donation claim, or a message about an impending defeat rush your decision. The Better Business Bureau (BBB) advises researching political fundraising requests and resisting pressure to act immediately.
Not every political poll is suspicious. But a request for your opinion can also be an opening for a scam.
The BBB warns about fraudulent polling calls that promise a prize in exchange for answering questions. After the “survey,” the caller asks for credit card information to cover shipping, taxes, or other costs associated with the supposed reward.
At that point, the questions about candidates have served their purpose: keeping you engaged long enough to introduce a payment request.
Other election-themed messages ask people to complete surveys through links. Treat those links with the same caution you would an unexpected donation or registration request. A familiar political organization’s name does not establish who operates the website.
You can decline an unsolicited poll. You should not need to hand over payment details simply to share your political views or claim a surprise reward.
Few things make a message feel urgent quite like an official-looking demand backed by a possible penalty.
Brazil’s Superior Electoral Court (TSE) has warned about messages falsely claiming people had an unresolved voting issue. The messages link to fake government websites designed to steal personal information or trick people into paying.
Brazil does have legitimate electoral fines, which can be paid through official channels, including Pix. So a fine or Pix request alone doesn’t prove a message is a scam. If a message says you owe money or must perform election duty, check with the relevant authority using contact details from its official website. Don’t use the message’s phone number, link, or QR code.
A politician’s name can be used to sell more than a political message.
Criminals use candidates’ names, photographs, logos, and slogans to advertise merchandise that never arrives. What looks like a way to support a candidate becomes an ordinary shopping scam wrapped in campaign branding.
Apply the same skepticism to a “commemorative,” “patriotic,” or supposedly collectible product advertised using a politician’s name. Before buying, ask:
A product does not become useful, valuable, or a sound investment because an ad places it beside a politician’s photograph. Nor does a photograph prove that the politician endorsed it.
There is also a difference between a product you consider poor value and a fraudulent offer. A product being poor value doesn’t automatically make it a scam. Look for clear deception: a fake endorsement, false claims, hidden fees, or an order that never arrives.
You don’t need to work out every detail of a suspicious message before deciding whether to act on it. Verify the message through a route the sender does not control.

Pro tip: Unsure whether a message is a scam? Check it with Malwarebytes’ Scam Guard for an assessment and advice on what to do next.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.
Source: Malwarebytes Labs · 2026-10-27

Sunday’s election marked a turning point in Serbia, with the ruling SNS party of Aleksandar Vučić handed a resounding defeat by a student movement that capitalized on mounting public anger over years of corruption and criminality.
Many of those abuses had been exposed by KRIK, an award-winning Serbian investigative outlet and OCCRP partner that has spent years covering the country’s criminals, its corrupt officials, and the connections between them. In return, its young journalists have withstood pressure most people can scarcely imagine: personal attacks by pro-government tabloids, an endless stream of lawsuits, and even death threats.
Now, a new era is dawning. The seemingly unbreakable control exercised by Vučić — who served as information minister under dictator Slobodan Milošević — has been broken.
In this interview, KRIK editor-in-chief Stevan Dojčinović reflects on what the last few days have meant for him, how the students did it, and what challenges lie ahead. As he spoke with OCCRP late at night, the sounds of celebration filtered in from the street.
This interview has been edited for length and clarity.
First of all, I didn’t expect this. I’ve never experienced such energy on the street. It was so high energy, like everybody was happy. And you couldn’t find any Vučić supporters.
Clearly, people were [openly] supporting the students, which was not the case before. Because, you know, Vučić was putting pressure on the media, and even on what people tweeted. So people were not really free to talk. But now, I went to my hometown, and there was all this energy in the street, and everything was bright.
When I went to the voting site with my mother, I talked with the guys who were controlling the voting on the student side, and they showed me the numbers, and they were huge. I was there around noon, and an insane number of people had already turned out.
In the end, almost 70 percent voted. There was never a case like this. Basically, Vučić can’t reach any new voters, so he was always fighting not to have a big turnout. So when it went up to 50 percent, you know, and then up to 70, it was done. It was completely clear.
But I thought, and everybody was expecting, that he wouldn’t give up so easily. My idea was that he would do his best to rig the elections. Even with these big numbers, I thought he would just rig more and declare victory.
And I thought, if this happened, it would be a nightmare. People would be on the street, and there would be violence, and somebody could die.
When the electoral places were shut down, it was going in this direction. Because suddenly, Vučić started bringing a lot of armored riot police to the center of Belgrade. And, in parallel, which was a really bad signal, he started bringing these thugs, these criminals who protect him. They were coming in big numbers to meet in this park in front of the presidential building.
And then it turned out that he lost by so much — like, half-a-million votes. And nobody can rig half-a-million. So, I believe what happened is that he figured out that nothing would work.
Yeah, I was expecting he would say he won, because of how the police and the hooligans [had been brought out]. But he immediately said, we lost. And when I heard this, I literally couldn’t believe it. Is this really happening? Is he serious?
But it was real. And yet I didn’t even feel happy. I felt empty. I was like: Why do I not feel any euphoria?
People started gathering in big numbers in the center of my hometown to celebrate. In every town, the whole center was full of people. I was going there to meet friends and celebrate. But I still had this kind of weird feeling. I really couldn’t enjoy it fully.
I realized, I must have developed some PTSD. You know like when you’re kidnapped, and then you flee. And you can’t really celebrate and enjoy it. I was like, okay, I need to process all of these 10 years of what was fucking going on and what he did to us.
And, it was not only me. It’s interesting. Everyone who was around my age or older, it’s the same story. Especially for the people who fought against [Slobodan] Milošević in the 90s. They were like, I’m so empty. I feel like a victim who escaped, you know?
So I thought, I need to process all of this shit. What happened during Vučić, what he did to us, and to journalists in general. It has been such a big trauma. I think he did it to the whole nation.
Part of it is that he was always present. He was appearing on TV all the time. He was everywhere and putting pressure on everyone. Before the protests started [in 2024], that last year was really heavy. People were afraid to speak.
But in the morning, I was finally okay. I woke up and I was happy.
All of us are happy. But we also feel like we’re in a parallel timeline. It’s like, is this real?
We’re sitting in our office and talking freely. For 10 years, our rule was never to discuss any important stories in the office, because we understood that the secret service was spying on us all the time. We didn’t trust our office, it could have bugs. Usually we would go out to some place where we felt safe to discuss things.
I never trusted my apartment in Belgrade. I was censoring what I could say in there. Because, I knew my apartment was definitely bugged. So you never really had a safe space where you could even talk.
But, today, we can just sit, and we can really communicate in our office. It’s a completely different life than yesterday. And that was our first journalistic day of working in freedom.
KRIK was founded in 2015. We were founded in Vučić’s time. And, every day we worked, it was in Vučić’s time. So now we’ll see what it’s like to work in freedom, which is something we never really had. So, it’s strange now, for everyone, this is new, new, new.
Yeah. He was connected to organized crime, but corruption was the first thing. You could feel the corruption, that’s the thing.
Because people couldn’t get any jobs. Only members of his party could get jobs. People couldn’t start their own businesses. The financial inspectors would come and shut them down. But the party people can open businesses. So, people could really feel the corruption.
Unfortunately, too, a lot of people died. When this rail station [in the city of Novi Sad] collapsed, people died.
People didn’t just feel that they were losing money, that they weren’t living a good life. They saw people die, and that everybody who lives in Serbia could have been standing in that spot. In the end, they thought, we’re going to die because these people are stealing money.
Yeah, it’s not just students. Besides them, professors deserve credit, scientists, journalists, many others. But, still, the students were at the center of it. They’re the ones who started it.
And, they’re the ones who now have a chance to make a political change. So, I mean, I still call it the students.
I mean, there was no student movement before. When they started two years ago, they succeeded. The ones who didn’t succeed were the [traditional] opposition [parties in Serbia].
I think this is a really good model for the world. It’s cool that, after Hungary, we have this in Serbia, a second big victory against the populist powers. I think that other populists are scared. I saw the tweets of AfD, the very extreme right-wing German party. They were tweeting, ‘now we lost Vučić. We need to rethink how we operate.’ This was their reaction to what happened in Serbia.
So, I think this is a really good model. What you need is to have completely clean, uncompromised people. And part of [the problem in Serbia was] that the whole opposition were ‘old people’ — not by age, but people who already had some level of power. And they lost and then they tried to compete against Vučić.
There were also a lot of connections between them. People felt that it was the same group of people. People understood that it’s not just about changing Vučić, you need to change the whole system. And they never felt the opposition were the ones [to do it].
The opposition was really lousy. They never really went outside of Belgrade. They didn’t visit many Serbian villages — somewhere where you need to go to win. They were very elitist, which people didn’t like. And some people from the opposition were already in power, and had some scandals. So over the years, it looked like the opposition didn’t really have the power to take down Vučić.
And then what happened is that the students were young, without any experience in politics, and completely clean. They didn’t have any history, any scandals. So the citizens trusted them. This was the first element that was really important: To have some new, fresh faces.
The second element was that the students had this idea of unity, that all ideologies and politics should be put to the side. We needed now to have only one goal: to take down this corrupt and criminalized government.
This is so powerful. And I agree with this, because also as a journalist, I believe that corruption is the first problem. And then we can talk: Are you in the center, more to the right, more to the left? Don’t do it now.
Vučić was always trying to put them in a position to voice their opinions on different topics, because he knew that he needed to narrow them down. But if you look at their program, their program is anti-corruption. That’s it. And everything else we will deal with later.
Russia, the EU, literally nothing. But that was super smart, because that’s the only way to gather so much support. I think that was maybe the most important element.
And the third element was that the students were very open to learning. They know that they’re new. They don’t have much experience. But they were communicating. They were calling journalists, civil society organizations, everyone they could find who had some expertise, and asking them about how things work.
That was really important. We’ve never witnessed such a perfectly executed system of monitoring the polls. The students managed to cover all the voting places in Serbia. And the monitors did perfect work. They caught a lot of people who were trying to carry out some abuses.
They are not self-taught, they were getting help from other organizations who had expertise in this. I would say that these three elements for me are a kind of model, which managed to bring such a huge, huge victory.
Yeah, that’s the fourth element … the students, they had a campaign called “a student in every village.”
And Vučić, of course, put a lot of lies about the students, saying that they work for the Secret Service and this and that. But when you see them going to the villages and talking with the grannies, with peasants, with farmers, when you have this real life experience, that really changed people and helped them to earn huge support.
I think that was one of the main focuses of their campaign. More than doing stuff in Belgrade. Belgrade is easy. You have the most progressive people, and it’s easier to win. You don’t need to really be there.
Yeah, exactly. But usually, nobody will do that.
The typical opposition in Europe is complaining about social media. They complain that they cannot reach people because of these troll campaigns, but they will not actually go [in person]. But you really need to go to every village.
And that’s nothing new. That’s like old school politics, right? We just have to literally get back to the ways of how politics was done, and not allow social media to make you lazy.
The social media algorithms will always boost content that helps populists, right? All the hate speech, the anti-immigrant things, will always be pushed. So you have to literally meet people and talk. We in KRIK have a bit of experience, because we do a lot of crowdfunding, we have connections with our audience. So we understood how important it is to do that stuff.
So I hope, at least in Europe and the U.S., politics will return to this old-school way a little bit.
Now we have a lot of work to do. Now comes the really tough period. I think it’s important to learn from history.
There’s a chance to change things, but Vučić left a really strong system. All the big businesses, the whole economy is in the hands of his oligarchs. Organized crime is powerful. So this will not be easy.
And we need to learn from what happened in the past. After Milošević was gone, [reformist Prime Minister Zoran] Đinđić was killed two years later, basically by a joint venture of the Secret Service and organized crime, because they didn’t want to allow the country to reform.
So we can celebrate tonight, but tomorrow it’s the beginning of a really big job. Now it’s really important that everyone really does their part of the work. We as journalists should continue to investigate.
I believe it will happen like in Milošević’s time — as we speak now, they’ll start destroying evidence and documents, bribing witnesses. In the next three months, we’re in a defining period where we need to discover as much as we can. And when the students constitute the assembly and the government, I hope that they’ll start prosecuting these people.
But it won’t be easy. Now the very difficult part is coming.
Yes, the security services are one of the most difficult parts. And I think that was the biggest mistake [in the past].
[Đinđić] didn’t ever really reform them. He basically just changed the bosses and kept on working with them. And in the end, they were the part of the group that killed him.
I think the students will do much stronger, deeper reforms, because the secret service we have now have been inherited from Tito and Milošević’s time. The people change, of course, but in a way it’s the same structure, even with older people bringing their sons and daughters into the service.
It’s kind of like the state within the state. When they say “deep state,” it really does work that way in Serbia. I think they’ll be able to really cut and reform it completely, which is important.
The second really difficult part is that it’s easy to remove the director of this or that state-owned company, or change ministers. But I’m really afraid about what will happen with the judiciary. Because this is a kind of a trick that Vučić performed with the judiciary. He adopted all the EU laws that offer really big protection to prosecutors and judges, so that they cannot be touched by politics. But the catch is he put his people in there. So what will happen now? Whoever comes, he’ll really have a hard time changing the corrupt judges and prosecutors, because they’re so protected that only the prosecutions and judges can change themselves. You will need to find a way to really clean them. I think you will need to kind of work with them. That will be really a hard thing to do.
Then, another really hard thing will be the Vučić oligarchs. They bought everything in Serbia. If you go from my office to the center of Belgrade, literally along the main street, and you look right and left, 90 percent of the businesses that you see — doesn’t matter if it’s a small coffee shop or some big company selling computer equipment — everything is owned by his people. In these 14 years, they bought everything, and they all opened businesses because they were harassing everybody who’s not part of his party to prevent them from opening any business.
So now the question is, you take power, but the whole economy is in the hands of his people. There it will also be really hard to find a solution.
Of course, they will prosecute these people and they can seize their illegal money, but there’ll be a lot of actual legal businesses still in the hands of his people. So he will go, but after so many years, everything from the business structure, secret services, judiciary, are [run by] his people.
Yes, the point is to change the rules, not just replacing people. That’s why people didn’t like the [old] opposition. The opposition defeated Milošević and put in their people, who could be better than Milošević’s people, but the system still worked to their advantage, not for society.
So the whole idea of the students is that they will really try to change the system, which means not putting in our people to serve us, but trying to make the country really work. And I think they have a chance to do it for one simple reason — because they don’t have their own people. They’re just students.
We won’t have a government with all students. Now that they won the election, they gathered a list of people [to become members of parliament]. And none of them are actually students. They gathered different experts and professors. And many of them are not connected to the students. They were just picking people who they believe are clean.
It was really amazing because everything was built on trust that all of the students are honest and not corrupted. That’s very powerful. If they use this model to change the system, that will work. I believe they will scan the system and pick the best people. There were still good people in the police. In every place, there are still good professional people. So I hope the students will recognize these people, who are not tied to them, and help them actually reach the top positions.
It will be based on a clean foundation. That’s the kind of thing that I’m relying on most.
They will do what they always do. They will not run. I believe the criminals are now thinking of finding a way to approach the students. I believe they will not succeed, but that’s how criminals work. They don’t care, in the end, for Vučić.
But I need to say, this is really funny to see. So like I said, last night Vučić brought these strong police forces to the center of Belgrade, and all of these hooligans and criminals, a really big number of them, to this park next to the presidential building.
And in the moment when he declared defeat on TV, and people started gathering in the center of town to celebrate, there is a video, the criminals who in the moment start running, you know, and you have like tens of them just running, literally running from this park. They’re only strong when they have protection, and when the police are working with them.
I trust the students because I completely trust their intentions, in those terms I’m optimistic. But I’m realistic in what’s going to happen now, it will be really hard.
Like I said, you need to reform entire structures — the oligarchs, the money side, the secret services, crime. I know they have good intentions, but it’s really hard to do it. We need to remember that Đinđić died and failed.
And the second thing, I’m really afraid what would happen — this also happened in the time after Milošević, when the democratic [forces] won — I think that we will feel in the following years a lot of the damage which Vučić did to the economy. I think it will be a hard period.
And I’m afraid of how people usually react — everywhere, not just in Serbia — if the economy isn’t perfect in two years, which is completely logical because we just now see how much devastation he left, if people aren’t happy in a year or two, they will not be able to make the connection to Vučić, they’ll most likely then blame the new power in Serbia.
Exactly. They needed to deal with the country left by Milošević, which was under sanctions and embargos and completely devastated. But people will say, the ones now in power are the ones to blame. So I think this is a big danger.
The problem is also that journalists need to change how they operate. I don’t think we can do old-school journalism anymore. So I think journalists can help, but also we need to find other ways to communicate these things and inform the audience. There’s a lot of fighting to be done.
But literally everything changed — the atmosphere on the streets. Before the protests there was this kind of this dark atmosphere, cynical and dark, like there was no hope. Now it’s like living in a completely different country. It is insane and very refreshing.
Source: OCCRP · 2026-10-27

Top defense officials are expressing increasing worry about the vulnerability of U.S. bases around the world and even within the United States as cheap drone technology upends long-standing defense strategies.
The fear is mounting after a series recent attacks and threats against ground targets, including the destruction of key bases in the Middle East by Iran, plots against mega-bases in Europe, including to U.S. bombers at a British air base, and a Russian campaign that damaged European military facilities, according to two government officials.
While the Pentagon is notorious for inflating threats to press for additional funding, the officials stressed that the anxiety is real, not invented. Despite the U.S. military’s enormous budget, they say, the United States now finds itself scrambling strengthen its fortifications, protect its costly equipment, and recall personnel from some locations.
“Now all the world knows what the SecDef should have,” said one of the officials.
Foreign adversaries have taken notice of Iran’s ability to defeat U.S. air defenses using missiles and drones, they said. The officials drew specific attention to Tehran’s ability to damage or destroy bases that have been the key to U.S. power-projection and war-making for decades in the Middle East.
An Iranian missile and drone attack on February 28 destroyed Navy facilities in Manama, Bahrain, the region’s most critical logistics hub. The Combined Air Operations Center at Al Udeid Air Base, Qatar, was severely damaged by Iranian missiles early in the war, rendering it inoperable. Both were recently attacked again, raising questions about whether either will ever be rebuilt. The destruction of these bases has fundamentally altered America’s future force posture in the region, according to the officials. One of them called it a “seismic shift.”
On Friday, the Trump administration leaked highly classified intelligence to Fox News and Axios suggesting Iran has “substantially increased” efforts to target U.S. diplomats and other officials in the Middle East and beyond. The October 23 memo claimed that “the lethal plotting efforts by the Iranians against U.S. citizens have reached advanced stages.” A U.S. official confirmed the accuracy of the intelligence but questioned the motives of the “official leak,” suggesting it’s part of a case being built to justify renewing the failed war.
The leak came as the State Department ordered a further reduction in staff at multiple diplomatic posts across the Middle East, including in Jordan, Lebanon, Qatar, Saudi Arabia, and the United Arab Emirates. One of the officials said the move “definitely” spoke to America’s inability to defend its assets overseas. Those fears now extend to the United States, according to the officials.
Last month, buried in an unhinged address to troops in which he attacked the press and those within the military he calls beardos, weirdos, and wimps, self-styled War Secretary Pete Hegseth tacitly acknowledged the vulnerability of U.S. domestic bases, noting that the Pentagon was now “hardening every installation on American soil” against “sabotage and drones.” And last week, the Pentagon quietly began seeking advice on new ways to protect bases by using innovative advanced materials, camouflaging facilities, obscuring their thermal and electromagnetic signatures, hiding them underground, and making them more resilient in the face of successful attack by adversaries, according to a special notice issued by a top Pentagon official.
As the Pentagon refines this “base of the future” concept, Iran is teasing a “war of the future” effort that builds on its successes in throttling the Strait of Hormuz, regionalizing the war, and battering U.S. bases, according to Mahdi Mohammadi, a senior adviser to Mohammad Bagher Ghalibaf, the lead negotiator and speaker of Parliament. “The second generation of surprises will be on their way; at the time and place of our choosing, in the manner we have devised, and with the creativity that only our unparalleled fighters can muster,” he wrote on X, teasing how Iran would respond if America ramps up the war.
Iran’s successful attacks on U.S. bases have added to the growing realization that foreign adversaries, proxies, terror groups, and lone wolf actors can use low-cost, easily obtained drones to attack the military bases, aircraft, and military personnel of the U.S. and its allies.
While Iran dominated the headlines for months, officials became increasingly worried about danger from Russian attacks. “When do we stop calling it gray zone?” asked a third official briefed on the intelligence, referring to a Russian drone attack on a massive air freighter, used to carry military assistance to Ukraine, at Leipzig/Halle Airport in Germany in August. One drone hit the cargo plane but failed to explode, another struck a different aircraft, and a third was found near the airport. “That’s what Putin always does. He keeps testing us, pushing us, to see how far he can go,” said the official. That official and another said that the intelligence proved there was “no question” that Russia was behind the operations. Russia has denied responsibility.
The August drone attack was part of a monthslong campaign of nonstop sabotage, cyberattacks, and psychological operations against NATO nations. “These were happening in sequence from earlier in the year, through August, through September and they didn’t show any signs of stopping,” said the third official. But the attacks slowed or stopped after President Donald Trump announced earlier this month that the United States would buy Russian diesel in an effort to bring down fuel prices before the midterm elections and called on Ukraine to stop striking oil Russian refineries.
The officials noted that Pentagon leadership has been slow to respond to the changing nature of warfare, specifically drawing attention to tactics honed by Ukraine in its war with Russia. Earlier this month, for example, intelligence suggested that Iran’s Islamic Revolutionary Guard Corps was planning a complex drone attack on U.S. B-1 bombers used to attack Iran, and U.S. personnel at Royal Air Force Fairford air base. The plot, they said, was to launch small drones from just beyond the bases’ fenceline, attacking the supersonic bombers, which were not in hardened shelters but in the open on the tarmac. They noted that the plot appeared to be patterned on a Ukrainian attack, dubbed Operation Spider’s Web, against Russia last year. The plot so unnerved top military officials that the bombers were flown out while some aerial refueling aircraft were still being deployed to support their panicked flights back to the U.S. In addition to RAF Fairford, U.S. officials referenced additional threats against other bases in Europe, including Ramstein Air Base in Germany.
Last August, Hegseth established Joint Interagency Task Force 401 to deliver “C-sUAS” or counter-small unmanned aircraft system “capabilities to America’s warfighters, [to] defeat adversary threats, and promote sovereignty over national airspace.” But an inspector general report from January said “immediate attention” was required to protect the most critical bases in the U.S. against drones and noted that Pentagon “documents contradict one another and do not speak to certain aspects of C-UAS authorities and capabilities.” The IG found also that key “military installations, government-owned, contractor-operated facilities, and contractor-owned, contractor-operated facilities conducting critical missions” were not even designated for protection.
In March, small drones flew over Louisiana’s Barksdale Air Force Base, the home of Global Strike Command which oversees America’s bomber fleet and its intercontinental-ballistic missiles. And the IG report mentions “10 DoD installations and activities where Unmanned Aircraft Systems (UAS) incursions have occurred.”
Late last month, the Air Force awarded a contract for counter-drone systems for Joint Base McGuire-Dix-Lakehurst in New Jersey. The military has also been looking into drone-killing technologies to defend Yokota Air Base in Tokyo, Japan; Minot Air Force Base in North Dakota; Battle Creek Air National Guard Base in Michigan; and Shaw Air Force Base in South Carolina, among other facilities.
Two of the officials suggested that new Pentagon plans for military base modernization are rooted in an uneasy acknowledgment that U.S. outposts around the world — including within the continental United States — are increasingly vulnerable to complex and asymmetric attacks. A recent Pentagon inspector general report revealed Iranian strikes “damaged and destroyed hundreds of buildings and structures at U.S. bases in Kuwait, Bahrain, Qatar, UAE, Saudi Arabia, Iraq, Oman, and Jordan during the conflict.”
Hegseth’s office did not respond to multiple requests for comment by The Intercept.
One U.S. official told The Intercept that the cost of repairing and rebuilding these Middle East outposts could be “upwards of $50 million,” but said the “real cost” might be “far higher.” The Pentagon, however, refuses to disclose the price tag of the damage, which has only been shared in a classified briefing.
“The American people deserve to know the full cost of the Trump administration’s unauthorized war against Iran. Even if DoD has not yet determined which facilities it is planning to rebuild, disclosing these costs represents the bare minimum transparency DoD owes the public,” wrote Democratic Sens. Elizabeth Warren, Richard Blumentha, Mazie Hirono, Tammy Duckworth, and Gary Peters in a recent letter to Adm. Brad Cooper, the chief of Central Command. CENTCOM did not reply to a request from The Intercept for the total cost.
Last week, the Pentagon quietly began seeking information for “near-term” procurement and long-term modernization strategies to “move past traditional ‘pour-concrete-and-hope’ hardening” of its facilities and increase the “survivability of these installations under kinetic and multi-domain threats,” according to a special notice from the office of Dale R. Marks, the assistant secretary of war for energy, installations, and environment.
Following the destruction of NSA Manama and Al Udeid Air Base, the Pentagon is seeking ways to promote “operational capability and survivability under kinetic impact,” by employing decentralized energy grids, “autonomous backup utility systems,” innovative base layouts, and modular structures. Recognizing the need to “protect assets and personnel from kinetic impacts, thermal effects, and blast overpressures,” the military is looking at ways to harden facilities. This means employing advanced construction methods involving metamaterials designed for surviving air attack, energy-dissipating composites, self-healing materials, and “novel concrete formulations.”
The U.S. is also seeking ways to lower the profile or conceal the location of its bases through technological means. This includes camouflaging facilities and integrating them into the natural environment to make them more difficult to spot, masking their thermal and electromagnetic signatures, and creating decoy structures to draw fire.
Beyond the use of “terrain-integrated facility design,” the U.S. is also seeking to take its most sensitive facilities deep below ground. Increased vulnerabilities to aerial attack have led to a reemergence and increased reliance on subterranean warfare in the Russia–Ukraine war, harkening back to World War I trench warfare and the use of massive underground tunnel networks and bases by Vietnamese forces in the American war.
Iran, for its part, uses underground facilities to shield its missile and nuclear programs. The Pentagon, according to the documents, is interested in new methods of “high-speed tunneling,” the rapid creation of protected caverns, and “shock-isolated underground structural design[s].”
Last week’s quiet plea from the Pentagon follows an announcement by Hegseth of a FORTRESS America initiative that he calls a “national insurance policy for the American homeland.” One former Pentagon analyst, however, said it sounded more like “cutting America and Americans loose” in the event of a major conflagration, tying it to Hegseth’s belief that the military is a warrior elite superior to civilians.
“Every major military installation in America is going to generate its own power. Independent of the civilian grid. If an adversary takes down the grid by cyberattack, by sabotage, by any means, our bases stay lit. Our aircraft keep flying. Our command centers never go dark,” said Hegseth, explaining the FORTRESS concept. “We are building long overdue strategic reserves deep enough to fight through disruption. Think munitions. Fuel. Medicine. Blood. Deep enough that if the world’s supply lines break, and in a real war, they are going to break — America keeps fighting anyway.”
The former advisor said that Hegseth’s plan appeared to send a message to 99 percent of the American public: “It sounds as if he is saying to people ‘fuck off and you’re on your own.’”
Source: The Intercept · 2026-10-27
ISC2’s new Cyber-AI Workforce Coalition serves as a “vendor-neutral convener” to map the future of AI security careers, ISC2 CEO Scott Beale told Infosecurity
Source: Infosecurity Magazine · 2026-10-27

The US government’s cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild. Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That’s bad news given how much of the web still relies on PHP, and just how many sites could be left exposed. Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed. CISA’s confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve remote code execution. The attackers then tried to contact external servers using PHP, curl, and wget, although no additional malware was successfully downloaded. Karimi’s findings were consistent with exploitation of CVE-2026-109618, but he found no evidence that the second PHP2Shell flaw was involved. He also warned that the honeypots used a favorable single-worker configuration, so the results don’t necessarily reflect how reliably the exploit works against production servers. Still, attackers appear to be giving it a good go. Delft University’s Threat Intelligence Lab has tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those, 171 addresses went beyond probing for vulnerable servers and started sending exploit code or malware droppers. CISA’s confirmation also comes after some of the earlier reports of successful PHP2Shell attacks turned out to be rather premature. Sophos walked back its initial assessment after determining that the activity it observed amounted to scanning and failed attempts, while Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency. CISA has not disclosed which organizations have been compromised or provided details of the attacks behind its decision to add the flaws to KEV. The listing confirms that the agency considers both vulnerabilities actively exploited, but it does not confirm how many production systems have been successfully breached. For federal agencies, the clock is now ticking. CISA is also urging organizations outside the federal government to prioritize the fixes, although the deadline does not apply to them. Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Those running older, unsupported versions face the added headache of upgrading or obtaining vendor-supported fixes, while systems that cannot be secured should be taken offline until the risk is addressed. And with CISA now officially acknowledging exploitation, anyone still waiting for more proof before patching may be waiting a little too long. ®
Source: The Register Security · 2026-10-27

The US government’s cybersecurity watchdog has confirmed attackers are exploiting both critical PHP2Shell vulnerabilities, giving federal agencies three days to patch the bugs that have wreaked havoc across the web over the past week. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on Monday, setting an October 29 deadline for federal civilian agencies to address the flaws. The move marks a shift from last week, when the agency warned of the danger posed by PHP2Shell but said it had not yet observed successful exploitation in the wild. Both bugs are rated 9.2 on the CVSS scale and can be exploited without authentication to run code on vulnerable PHP servers. That’s bad news given how much of the web still relies on PHP, and just how many sites could be left exposed. Patches landed on October 21, but attackers had already beaten the maintainers to it. AWS spotted attempts to exploit the flaws as early as October 17, four days before the bugs were publicly disclosed. CISA’s confirmation comes amid growing evidence that attackers are doing more than simply knocking on the door. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. The attacks came from two IP addresses and used memory exhaustion and disclosure to achieve remote code execution. The attackers then tried to contact external servers using PHP, curl, and wget, although no additional malware was successfully downloaded. Karimi’s findings were consistent with exploitation of CVE-2026-109618, but he found no evidence that the second PHP2Shell flaw was involved. He also warned that the honeypots used a favorable single-worker configuration, so the results don’t necessarily reflect how reliably the exploit works against production servers. Still, attackers appear to be giving it a good go. Delft University’s Threat Intelligence Lab has tracked more than 50,000 PHP2Shell exploitation requests from over 600 IP addresses across 70 countries. Of those, 171 addresses went beyond probing for vulnerable servers and started sending exploit code or malware droppers. CISA’s confirmation also comes after some of the earlier reports of successful PHP2Shell attacks turned out to be rather premature. Sophos walked back its initial assessment after determining that the activity it observed amounted to scanning and failed attempts, while Palo Alto Networks withdrew claims linking the vulnerabilities to an intrusion at a European government agency. CISA has not disclosed which organizations have been compromised or provided details of the attacks behind its decision to add the flaws to KEV. The listing confirms that the agency considers both vulnerabilities actively exploited, but it does not confirm how many production systems have been successfully breached. For federal agencies, the clock is now ticking. CISA is also urging organizations outside the federal government to prioritize the fixes, although the deadline does not apply to them. Admins should update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on their release branch. Those running older, unsupported versions face the added headache of upgrading or obtaining vendor-supported fixes, while systems that cannot be secured should be taken offline until the risk is addressed. And with CISA now officially acknowledging exploitation, anyone still waiting for more proof before patching may be waiting a little too long. ®
Source: The Register — Security · 2026-10-27

The major cyber attacks of September 2026 hit federal law enforcement, a rival cybercrime gang, and the companies that verify identities. ShinyHunters hijacked the Clop ransomware gang’s Dark Web leak site and, four days later, claimed a breach of the Federal Bureau of Investigation (FBI). Identity data drove the month’s biggest numbers, led by a data breach linked to a Dark Web service advertising more than 153 million driver’s license scans.
AI agents also moved from research into real campaigns. One actor used hundreds of agents to compromise 395 organizations, while several espionage groups adopted the same Chrome and Windows zero-day chain within days. A US utility, a healthcare technology company, and a major fintech firm rounded out the month with disclosures involving sensitive customer and patient data.
Here are the major cyber attacks, breaches, and threat campaigns reported or significantly updated in September 2026.
On September 22, 2026, ShinyHunters claimed it had breached FBI systems through a new, unpatched Oracle PeopleSoft zero-day and stolen data on bureau employees and job applicants. The FBIJobs.gov recruitment site displayed a “seized by ShinyHunters” banner and went offline.

The group said it moved from PeopleSoft into Amazon Web Services (AWS) GovCloud, took 2 to 3 TB of data, and shared about 5,000 purported employee records with reporters, who verified parts of the set. It also claimed to be using the zero-day against Fortune 500 companies, which remains unverified. ShinyHunters exploited an earlier PeopleSoft flaw, CVE-2026-35273, in June 2026 and framed this attack as retaliation for a May 2026 FBI warning about its Canvas campaign.
The FBI’s own account points to a missed patch. On October 5, 2026, its Cyber Division said a contractor had failed to apply an available patch and that the bureau had removed the contractor. On October 9, 2026, FBI Director Kash Patel said the intrusion occurred on a third-party vendor’s platform and announced the arrest of another suspected ShinyHunters co-conspirator. As of October 27, 2026, Oracle has not confirmed a new PeopleSoft zero-day, and SOCRadar’s analysis of the FBI breach claim covers the incident in more depth.
Identity verification provider IDScan.net confirmed that an unauthorized party accessed customer data in its cloud platform. The disclosure followed reporting on September 1, 2026, that linked the company to Nexus, a Dark Web service advertising more than 153 million US and Canadian driver’s license scans, plus about 10 million ID cards, 3 million travel documents, and 579,000 medical cards. The FBI’s New Orleans field office opened an investigation the same day.
IDScan’s breach notice, first posted on September 4, 2026, is hidden from search engines. A September 29, 2026, update says the access ran from April 4 to September 2, 2026, and was limited to the VeriScan platform. Exposed data may include full names, contact details, dates of birth, and driver’s license, passport, or other government ID numbers, though the notice still does not mention the scans.
At least nine class actions were filed by September 4, 2026. Unlike passwords, licenses cannot be reset, so the scans can fuel account takeover, synthetic identity fraud, and Know Your Customer (KYC) bypass for years.
On September 18, 2026, ShinyHunters abused a flaw in the Grav content management system (CMS) behind the Clop ransomware gang’s Dark Web leak site and defaced it. The group claimed it stole server data, source code, plugins, logs, and the private keys for Clop’s onion service. It gave Clop 72 hours to make contact, added the gang to its own leak site, and tied the attack to a dispute over Clop’s 2025 Oracle E-Business Suite campaign.

Clop moved its leak site to a new Tor address and confirmed the compromise came through a Grav path traversal flaw, CVE-2026-42608. Grav fixed the bug in version 2.0 in April 2026, but Clop ran the 1.7 branch, which had no patch until version 1.7.53.4 shipped on September 24, 2026. Clop said the server held only website content and denied any contact with ShinyHunters, which later removed Clop from its leak site.
If victim files were on the server, organizations that already paid Clop could face a second extortion attempt, a risk SOCRadar examined in its coverage of the Clop leak site hijack.
Cryptocurrency exchange Bitget detected unauthorized transfers from a limited number of hot and warm wallets on September 24, 2026. It first put losses at $351.6 million, then raised the figure to $387.5 million after adding Zcash and TRON transfers. Cold wallets were not affected, and withdrawals resumed in phases from September 28, 2026, with all assets reopened by October 2, 2026.
Bitget traced the root cause to a zero-day in unnamed third-party security products, which gave the attacker privileged internal credentials. The attacker then compromised a critical backend system in the wallet infrastructure, spoofed transaction data, and triggered the exchange’s own authorization process. The stolen ETH, XRP, BNB, AVAX, USDT, and USDC moved across seven chains, and Bitget’s User Protection Fund is covering the loss.
Bitget’s CEO said the attack matched known North Korean patterns, and blockchain analysts linked the funds to wallets used to launder earlier North Korea-attributed heists, including the 2025 Bybit theft. One analysis pointed to the TraderTraitor group, but as of October 27, 2026, no government has attributed the attack. If the attribution holds, suspected North Korean crypto theft in 2026 passes $1 billion, the second-largest year on record.
A likely Russian-speaking actor used hundreds of AI agents to build and run a global exploitation campaign against PaperCut NG/MF print management servers between August 27 and September 2, 2026. Researchers counted at least 440 compromised instances across 395 organizations in 48 countries, and 204 of those instances belonged to education.
Running on OpenAI’s Codex harness with a DeepSeek model, the agents developed, tested, and used exploits for CVE-2026-81578 and CVE-2026-82078, drawing on public proof-of-concept (PoC) code and patched builds. Both flaws were already disclosed: PaperCut published its advisory on August 27, 2026, and the Cybersecurity and Infrastructure Security Agency (CISA) added them to its Known Exploited Vulnerabilities (KEV) catalog on August 31, 2026.
The attacker built target lists through the Netlas scanning platform, harvested credentials from 280 victims, pulled operating system or domain secrets from 147, and reached domain administrator access at 12. The agents also did not consistently honor instructions to avoid 28 countries, and 20 victims sat in eight of them. PaperCut’s fix is Emergency Patch Release 2 for the 24.x, 25.x, and 26.x branches, after the first emergency patch was bypassed; version 23.x and older will not receive a fix.
A single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days. APT31 was the first observed user, on August 28, 2026, and later installed the LONGTALE malicious browser extension. On September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor, and UTA0565 ran fake websites on September 3 and 4, 2026, against Asian government entities to drop CLEANGULP. Other clusters targeted a US aerospace company, a Vietnamese manufacturer, and organizations in Indonesia and Singapore.
The chain starts with CVE-2026-85046, a V8 type confusion flaw for code execution, and CVE-2026-87491, a V8 out-of-bounds write that escapes the V8 sandbox. CVE-2026-85880, a Windows Advanced Local Procedure Call (ALPC) heap overflow, then escapes the renderer sandbox and elevates privileges. The first Chrome bug was fixed in upstream Chromium on August 7, 2026, but the fix did not reach stable Chrome until September 3, 2026, a patch gap that left Chrome users exposed.
Google fixed the two Chrome flaws in versions 152.0.7977.82 and 153.0.8010.36, and Microsoft fixed the Windows flaw in its September 8, 2026, Patch Tuesday release. CISA added all three to the KEV catalog between September 4 and 9, 2026. Researchers assess the clusters as China-linked, and a 2024 US indictment tied APT31 to China’s Ministry of State Security, though no government has attributed the BlueMoon activity itself.
Citrix disclosed on September 27, 2026, that two critical NetScaler ADC and Gateway flaws were under attack. CVE-2026-88771 (9.5 CVSS v4.0) lets unauthenticated attackers run arbitrary commands, even on default configurations. CVE-2026-88772 (9.5 CVSS v4.0) is a memory overflow that can lead to RCE or denial of service on appliances with Datagram Transport Layer Security (DTLS) enabled, the default for VPN virtual servers.
Exploitation started before disclosure. An exploitation attempt was spotted three days earlier, and incident responders traced CVE-2026-88772 activity back to early September 2026. Intrusions led to web shells, credential theft, and lateral movement, and mass exploitation of CVE-2026-88771 began on September 28, 2026. CISA added both flaws to the KEV catalog on September 27, 2026, and Citrix’s fixed builds start at 14.1-73.37 and 13.1-64.23.
On October 1, 2026, SOCRadar’s Threat Research Unit identified NetScaler C2, an autonomous framework that runs every 30 minutes. Each cycle pulls exposed hosts from FOFA, fingerprints their versions, exploits CVE-2026-88771, and deploys an agent that polls for operator commands.

A single run can enumerate up to 120,000 candidate hosts, against roughly 23,000 exposed NetScaler instances online. Simplified Chinese code comments point to a Chinese-speaking operator using AI-assisted development, while the number of appliances it compromised remains unknown.
US utility CenterPoint Energy confirmed that an attacker obtained customer personal information through one of its external-facing systems. The disclosure came after a threat actor leaked data allegedly stolen from the company.
The actor, using the alias “4d722e4d656f77”, claims it took 7.49 million customer records containing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers (SSNs). It said it pulled the records from a public application programming interface (API) that lacked rate limiting, and leaked them after the company ignored its messages.
CenterPoint’s Form 8-K, filed with the US Securities and Exchange Commission (SEC) on September 14, 2026, confirms the theft but gives no victim count or data types, and says electric and gas service was not affected. A later notice to the Texas Attorney General puts the number of affected Texans at 1,062,060, with exposed data including names, addresses, SSNs, and driver’s license numbers. Proposed class actions allege the intrusion ran from August 17 to September 1, 2026.
Kyoto-based Helpfeel disclosed on September 16, 2026, that a breach of its Gyazo image-sharing service exposed about 23.62 million user records, including email addresses and password hashes. The figure includes anonymous accounts, and Helpfeel is still determining how many individuals are affected. The attacker also reached about 490 million image metadata records, mostly for images uploaded in January 2019 or earlier.
Those metadata records hold the IDs that make up Gyazo image links, so they could be used to view private images without permission. Helpfeel temporarily disabled viewing for some affected images and asked every user to change their password, along with any matching password reused on other services. No payment card data was exposed.
The intrusion began on September 11, 2026, through a vulnerability in Gyazo’s image upload server that let the attacker run arbitrary commands and reach the Gyazo database. Helpfeel fixed the flaw by the next day and reported the breach to Japan’s Personal Information Protection Commission on September 15, 2026. While images were failing to load, Gyazo’s public notices described the outage as maintenance.
Fintech company Revolut confirmed on September 12, 2026, that it shared data on an undisclosed number of customers with a threat actor impersonating a government agency. The request came from a legitimate government email domain and passed domain authentication checks, so Revolut fulfilled it in the belief that it was genuine. Reports trace the request to an Italian government email account, though Revolut has not named the agency.
The disclosed data included identity and contact details, copies of passports or driver’s licenses, KYC verification selfies, International Bank Account Numbers (IBANs), and other financial records. Revolut, which serves more than 80 million customers, said only a limited number were affected and that its systems and customer funds were untouched. Crypto fraud investigator ZachXBT said the activity appeared aimed at high-net-worth users, and a group calling itself “iamnotavillain” later demanded 6,000 XMR, about $3 million, though Revolut said it received no direct demand.
No network intrusion took place, which puts this incident beyond the reach of most technical controls. Any organization that answers government data requests faces the same exposure when a fraudulent request arrives from a legitimate agency domain.
Healthcare technology company Veradigm, formerly Allscripts, disclosed in a Form 8-K on September 8, 2026, that one of its third-party vendors suffered a cybersecurity incident affecting data tied to a small number of its customers. The unauthorized party used credentials from the vendor’s environment against a Veradigm API to download copies of patient personal data, in some cases including SSNs. Veradigm said no clinical or medical data was involved.
The filing came three days after the ransomware group The Gentlemen added Veradigm to its Dark Web leak site on September 5, 2026.

The group claims it holds 3.5 million patient records and threatened to publish them unless Veradigm paid. SOCRadar’sbreach record for Veradigm shows The Gentlemen claimed 237 victims in the 60 days before the listing. As of October 27, 2026, Veradigm has not released a patient count.
September showed how often a breach starts outside an organization’s own network, through a vendor’s credentials, an exposed API, an unpatched server, or a post on a ransomware leak site. Catching those signals early gives security teams time to act before stolen data or access is used against them. SOCRadar provides several modules for monitoring this external risk:

Staying proactive with integrated threat intelligence and continuous monitoring remains essential as attack vectors evolve rapidly across third-party networks and zero-day vulnerabilities.

Source: SOCRadar · 2026-10-27


Flock CEO Garrett Langley says some interesting things to cops behind closed doors. He recently lied about his surveillance technology’s role in tracking a woman who had self-administered an abortion and 404 Media’s coverage of that incident, calling it “entirely false.” Now, in leaked audio obtained by 404 Media, Langley is saying the protests that have broken out around the country against his company, many of which have resulted in communities canceling their contracts with Flock and bagging up the cameras, are not real. Seems pretty real to me!

Garrett Langley, the CEO of automatic license plate reader company Flock, told an audience of police chiefs at a private police conference Sunday that anti-Flock protests around the country are not real, according to leaked audio obtained by 404 Media.
He also said his wife advised him to never apologize, said he would prefer to never do interviews with the press again, and claimed without evidence that the social media opposition to Flock is driven mostly by Russian bots.
“Somebody was paying for [the social media posts and] stopped paying for it,” Langley said about the many viral posts criticizing his company’s technology. “Social media chatter on Flock is down about 95 percent from July. It went down 50 percent last week when Ukraine bombed a Russian data center with a drone. Literally 50 percent overnight. And so look, SI’m the last person, my wife as well, she’s like ‘This is crazy, these people are getting paid to say these things,’” he added, repeating a disproven theory that Ukraine’s strikes on Russian data centers had a significant impact on internet bot activity.
“It’s anonymous bots, and so it is not real,” he continued. “Inorganic activity has led to organic activity, but when I look at protests across the country, it is the same people with the same signs and the same message. That’s not normal. That’s not organic at all.” Langley’s comments echo another unsubstantiated theory that said opposition to Flock comes from a far-left network spreading propaganda at the behest of China.
Langley made the comments at the International Association of Chiefs of Police (IACP) conference, which is running Saturday to Tuesday in Orlando, Florida. Many law enforcement contractors exhibit at the conference, and speakers get to attend with more than 16,000 public safety officials.
Crackgate: Apple’s $2,000 folding phone, the iPhone Duo, came out just two days ago and people are already seeing big fat creases down the middle of the folding screen, and some devices are cracked in the same specific spot too. People waited in line overnight at Apple stores to get this thing, and now we’re seeing photos of heinous cracked and creased-up Duos all over social media. In some cases, the phone screens have cracked along the crease, causing a crashout people are now calling “crackgate.”
Bold choice. Let’s see if it pays off. Proton, the company behind ProtonMail and other privacy-focused products, told staff on Monday it would be ‘re-interviewing’ staff across the company about how they use AI in their jobs, with the implication that the interviews may decide whether staffers have “continued employment,” according to an internal Proton email obtained by 404 Media. “These re-interviews are consequential,” a part of the email reads. “Interviewers will document their assessments, which will inform the broader review of our organization and talent. That review may lead to changes in roles, responsibilities, and continued employment. Individual outcomes will be communicated directly once decisions are finalized.”
Are we living in the same timeline? In Sunday’s edition of the New York Times, Marissa Mayer, former president and CEO of Yahoo, told her interviewer something so absurd it’s since gone viral. Struggling with the “impossible task” of naming three things that she loves about her own 10 year old daughter, the New York Times reports, Mayer asked the AI assistant she just launched to do that thinking for her. What she has to say about gender in tech, however, is more out of touch than that. The rest of the story gets into something Mayer has talked about for more than a decade: “the gender card,” as she’s called it. She’s been asked about gender in tech one million times, and has mostly dismissed it. But a decade after the tech girlboss reigned, her thoughts on this haven’t seemed to evolve much.
I am obsessed with the phrase “catty patty.” Catfish, a criminally underrated Eastern Shore delicacy, makes an appearance in NPR. I’ve only ever known catfish as a very annoying sucker to get on the line, and a pretty good fried fish. Apparently they’re fucking with the ecosystem, so it’s time to eat ‘em. I will do my part.
Muse is targeting older adults. And Meta knows it. From TIME: “‘And the more Siobhán got to know me, the more Siobhán was able to give me what I wanted,’ Fay says, referring to the name she gave the agent, a nod to her Irish heritage. Meta encourages its users to name their AIs—and encourages its AIs to think like humans. ‘You are not a chatbot,’ Muse’s internal instructions read. ‘You are becoming someone.’”
We’re newslettermaxxing. Dictionary.com just named the word “maxxing” as its 2026 Word of the Year. Its definition: “A word that refers to the practice of pursuing an activity to the fullest or optimizing a certain aspect of your life.”
This is so my shit. Local Wiki is the Wikipedia for things within a mile and a half of you. I know what I’m doing after work today.
Source: 404 Media · 2026-10-27