As of 8 October, Radicle had no release fixing its network protocol flaws, and people using private repositories should follow its advice. Accounts differ on whether Xray-core told users about a February fix, and Google's open source vulnerability reward programme stopped taking product vulnerability reports on 1 October.
Based on 17 sources, including Radicle, The GitHub Blog, GitHub
California's AB 1856, signed in September, amends a state law requiring operating systems to ask for a user's age at account setup. Under the amendment, a person or entity that distributes an operating system or app under a licence allowing copying, redistribution and modification is not a covered operating system provider. The rules apply from 2027 and are aimed at account holders in California.
Based on 15 sources, including California Legislative Information, CalMatters Digital Democracy, Office of the Governor of California
Your one-to-one text messages on LINE are end-to-end encrypted by default, so only the two devices involved can read them. On this day, seven countries including Japan and India issued a statement calling on technology companies to let law enforcement read encrypted content under lawful authorisation.
Seven stories from 13 September to 6 October, including a suspected customer data leak at MOS Burger in Taiwan and a member email exposure at Singapore's Bee Cheng Hiang, a breach of about 8.8 million people's records in Denmark's population register, Sequoia PGP in Ubuntu 26.10, a commentary questioning how large language models reason, a US court ruling on a licence plate reader search, US border surveillance towers, and China's deleted-content archive and a sensitive-terms list.
Based on 22 sources, including 公開資訊觀測站, Personal Data Protection Commission Singapore, iThome
On 24 September a federal court in Utah paused a state provision requiring adult websites to determine whether VPN users are in Utah. The same month, two US site-blocking bills took opposite approaches to VPN providers. As of 7 October the lawsuit continues and the bills are in committee. Neither changes how people outside the US use VPNs.
Based on 24 sources, including United States District Court, District of Utah, Utah State Legislature, Utah Office of Administrative Rules
Anthropic's report on Zhipu's open-weight model GLM-5.3, published on 29 September, says the model can write working browser exploits and that, in simulated tests, cover stories and similar techniques got past its safeguards. Zhipu's release notes say the public weights carry only the model's own safeguards and that strong defensive capability should not stay with a few organisations. What most readers can do is restart their browser promptly after updates.
Based on 14 sources, including Anthropic, Z.ai, NIST
You can read Wikipedia from Taiwan, but in mainland China every OONI measurement in the month to 10 October 2026 was an anomaly or a failure. On this day, users in mainland China reported that English Wikipedia, blocked for nearly a year, could be reached again.
Cisco Talos found phishing emails sent to Taiwan's academic, think tank and civil society policy community that use images in the message body to imitate Gmail's attachment card, starting an infection on Windows when clicked. Opened in a browser, the fake card is nearly indistinguishable from a real attachment, so people who often receive speaking invitations or institutional mail may want to watch for it.
Based on 12 sources from Cisco Talos, iThome, Google
Meta's Muse and OpenAI's Dots, both launched in September, run continuously in the cloud, read data from connected apps and turn it into memory. As of 2 October, Muse was not in the App Store in Taiwan, Hong Kong, Japan or South Korea, and Dots required ChatGPT's Pro or Business Premium plan. ChatGPT memory settings and Mac permissions can be checked today.
Based on 24 sources, including Meta, OpenAI, Freedom of the Press Foundation
F-Droid, the open-source Android app store, released 2.0, a rewrite that requires Android 7, on 24 September. From 30 September Google began requiring apps on seven stores in Brazil, Indonesia, Singapore and Thailand to be registered by identity-verified developers, with a global expansion to certified Android devices planned for 2027. As of 2 October, installing apps from F-Droid is unaffected anywhere.
Based on 18 sources, including F-Droid, Google, Conversations
Your App Store account's country or region determines which apps you can download. On this day, Apple removed a crowd-sourced map app showing Hong Kong police locations from the App Store.
Since iOS 18.1, an iPhone that stays locked for a long time restarts itself, putting its data back into a harder-to-extract state. In a forensic vendor's video, apparently made in early 2025, an employee says seized phones keep their once-unlocked state even after a restart. As of 7 October it is unclear whether this works on the latest iOS, and neither Apple nor Magnet responded to 404 Media.
Based on 21 sources, including Apple, 404 Media, Privacy Guides
APC previews research from Brazil, Kenya, Mexico and the Philippines on the disinformation, harassment and surveillance facing environmental defenders, and on how their communities respond. The full reports launch online on 8 October. Readers elsewhere can borrow the approach of protecting households and communities together.
Based on 9 sources, including APC, Human Rights Watch, EFF
If your personal details are posted online in Hong Kong, you can ask the Privacy Commissioner for Personal Data to have platforms remove them. On this day, Hong Kong's anti-doxxing provisions took effect.
Privacy International published a guide in September to 12 categories of technology used by immigration and border authorities, including phone extraction, drones, GPS tagging and algorithmic decision-making. Migrants and asylum seekers are directly affected, and the fingerprint and face checks travellers meet at borders fall into one category. Public documents from UK, German, Canadian and EU bodies set out their purposes and safeguards.
Based on 12 sources, including Privacy International, Bundesamt für Migration und Flüchtlinge, Frontex
Flock's license plate reader cameras, used by US police, saw a run of developments in August and September. Flock shortened its default data retention, a Senate subcommittee held a hearing, and Florida and Texas restricted the cameras. A woman who was arrested and then not prosecuted sued two state troopers. The practices are confined to the US, and readers elsewhere are not directly affected.
Based on 14 sources, including Florida Department of Transportation, National Sheriffs' Association, Flock Safety
In mainland China, the encryption built into your phone or laptop counts as part of a mass-market consumer product, exempt from import licensing. On this day, China's State Council issued the Regulations on the Administration of Commercial Cryptography, which once required encryption products to be state-approved.
The UK Supreme Court ruled that Bahrain cannot claim state immunity to stop a UK court hearing claims that it hacked computers in the UK with spyware operated from abroad. The ruling decides only whether UK courts can hear the case, and whether the hacking happened has not been tried.
Based on 10 sources, including UK Supreme Court, legislation.gov.uk, Citizen Lab
CryptPad, an end-to-end encrypted collaboration suite, has a new security policy that keeps vulnerability details private for at least 90 days after a fix ships. Its post-quantum experiment left some features too slow to use, and native browser support for the algorithms may change that. People on public instances need not change anything, while self-hosting administrators should keep up with releases.
Based on 21 sources, including CryptPad, GitHub, WICG
Every call you make leaves a record of both numbers and the time, which carriers in Taiwan must keep for six months. On this day, the EU's top court ruled that member states generally cannot require carriers to keep everyone's traffic and location data.
Canada's Bill C-22 has passed the House of Commons. It would let the government require communications and internet services, including some outside Canada, to build capabilities for law enforcement access and to retain metadata. Readers outside Canada do not need to change any settings now.
Based on 12 sources, including Parliament of Canada, Access Now, Citizen Lab
Freedom of the Press Foundation rounds up research on attackers using AI to write more fluent, personalised phishing. The warning signs and defences have not changed, and they apply to anyone who receives email or text messages.
Based on 9 sources, including Freedom of the Press Foundation, Verizon, Monetary Authority of Singapore
Ordinary text messages on your phone are not end-to-end encrypted. On this day, the US House passed the bill requiring carriers to build in wiretap capability.
HURIDOCS reflects on an expert meeting about wartime documentation in Sudan. Groups documenting abuses in high-risk settings should weigh whether a tool is worth its cost and whether its data can move between partners' systems. Nothing changes for everyday users.
Based on 6 sources, including HURIDOCS, GitHub, Access Now
Doctoralia's sites in Brazil, Colombia, Mexico and elsewhere in Latin America sent specialties, doctors' names and appointment times to Google, TikTok and LinkedIn. Its parent company does not operate in mainland China, Hong Kong, Macau or Taiwan.
Based on 12 sources, including The Markup, Docplanner, GitHub
On an Android phone, the Privacy Dashboard shows you which apps recently used the microphone, camera and location. On this day, Google released the Android 12 source code that introduced it.
Six stories from 15 to 29 September, including Wayback Machine access limits that block real people, a live facial recognition trial at London stations, the Dutch government's NixOS-based work environment, New Mexico's Cambridge Analytica verdict, Australia's proposed algorithm opt-out and the federated chat system Parley.
Based on 7 sources, including The Guardian, DAWO, It's FOSS
PipePipe, an Android fork of NewPipe, plays YouTube, NicoNico and BiliBili without an account or Google Play. Version 5.4.0 improves TV controls and fixes 12 bugs.
Based on 15 sources, including PipePipe, GitHub, F-Droid
Passwords and security questions you have reused elsewhere may have leaked long ago along with an old account. On this day, Yahoo disclosed that an earlier breach had affected every account it had at the time.
