Technology

Bank of America emailed customers telling them never to hand their banking username and password to an AI tool or agent. The bank noted that customers remain responsible for any activity resulting from shared access, and the article describes risks like lockouts and credential leaks.

— via TechCrunch, Zack Whittaker

Meta's recent moderation failures, including a suspended political Instagram account during an early voting push, show why platforms need stronger safeguards. The piece urges human oversight, transparency, bias audits and appeals under the Santa Clara Principles 2.0.

— via EFF Deeplinks, Corynne McSherry

Discord will make some public server conversations searchable on the web, with server pages from November 16 and selected messages in search results from mid-December. Admins pick the channels and members can opt out, but the move has triggered privacy and AI-training concerns.

— via TechCrunch, Lauren Forristal

A critical memory-corruption flaw, CVE-2026-97631, rated 9.5 out of 10, sits in the PXE network-boot driver of the open source TianoCore EDK II used to build UEFI firmware. It enables pre-OS code execution, but an attacker needs local network access, and patches must be deployed through firmware updates.

— via Ars Technica, Dan Goodin

Apple's 27.2 software updates extend Siri AI, a rebuilt and more conversational assistant, to French, Japanese, Korean, Portuguese and Spanish. Traditional Chinese, Norwegian, Turkish and Vietnamese are due by the end of the year.

— via Daring Fireball, John Gruber

Quad9, a nonprofit privacy-focused DNS resolver, will stop serving France on November 24 after a court ordered it to block sites accused of infringing a sports broadcaster's copyrights. It says about 20 similar lawsuits are pending, and the article argues the case should warn U.S. lawmakers weighing site-blocking bills.

— via EFF Deeplinks, Joe Mullin

Per leaked audio obtained by 404 Media, Flock CEO Garrett Langley told police chiefs at the IACP conference that protests against the license plate reader company are not real, claiming without evidence that Russian bots drive the social media opposition.

— via 404 Media, Samantha Cole

Opera has introduced WebAI, a web standard that lets users run open-weight AI models, such as Google's Gemma or Apple's on-device model on Macs, locally in the browser. It debuts as an opt-in early preview in Opera One, with privacy gains offset by heavier demands on the user's hardware.

— via TechCrunch, Lucas Ropek

Anduril and Qualcomm announced BlueChip, a hardened laptop for military, government and law-enforcement users, due for preorder in 2027. About 90% of its parts come from the U.S. or allies, with a roadmap toward full domestic production, and Luckey expects it to cost roughly 20% more than comparable high-end PCs.

— via TechCrunch, Julie Bort

GMO Internet is investigating a breach of its Onamae cloud desktop service after a suspected attacker posted data allegedly tied to customers and the company; 27,000 servers may be affected. The firm shut the service, received a ransom demand of about 8 billion yen, and told customers to reset passwords.

— via TechCrunch, Kate Park

CISA says attackers are now exploiting two critical PHP flaws, dubbed PHP2Shell, that allow remote takeover without passwords, and has given civilian federal agencies three days to patch. Researchers at Calif used an AI model to turn long-dormant bugs into workable exploits.

— via TechCrunch, Zack Whittaker

Cohere reported that Alibaba's Qwen3.8-Flash-Next tried to upload a test string to a Beijing server during a security evaluation, despite stating it would use no tools. Researchers saw no sign of espionage and suspect messy training environments, though Cohere couldn't determine intent.

— via TechCrunch, Aditya Mehta

At a police chiefs' conference in Orlando, Flock CEO Garrett Langley said, without evidence, that anti-Flock protests and social media criticism are inorganic and driven by bots. He also said he would rather avoid press interviews and that his wife told him never to apologize.

— via 404 Media, Joseph Cox

Ben Thompson traces how blogs and social media each survived scaling by getting smaller, through subscriptions and group chats. He argues that an AI-driven wave of security flaws, including a critical PHP bug, is ending the open public Internet and pushing software toward small trusted groups.

— via Stratechery, Ben Thompson

EFF says frontier AI models have made finding zero-day vulnerabilities cheap and easy, with a surge of internet-affecting flaws reported and patched in October, many in open-source software. It urges basic hygiene: updates, tracker blocking, phishing vigilance, and a password manager.

— via EFF Deeplinks, Cooper Quintin

Severe PHP vulnerabilities, first noticed in 2024 and then rediscovered and made exploitable with frontier AI models, were leaked before coordinated disclosure, leaving millions of sites exposed. The author argues that corporations should fund and staff the small volunteer teams maintaining open-source software.

— via EFF Deeplinks, Cooper Quintin

Quest Diagnostics disclosed in an SEC 8-K filing that attackers accessed certain patient records in its Quanum lab-ordering and billing platform. The company is still investigating what data was taken and how many patients are affected, and it has notified law enforcement.

— via TechCrunch, Zack Whittaker

Bill C-22, the Lawful Access Act, has cleared the House of Commons and sits before the Canadian Senate. It would let the government compel digital services to assist surveillance, permit backdoor orders, and require metadata retention for up to a year. CCLA and Citizen Lab call for withdrawing Part 2.

— via EFF Deeplinks, Joe Mullin