Longtime Slashdot reader schwit1 shares a report from TechCrunch: In an email blast to customers titled "Protecting your finances in the Al World," Bank of America urged customers to never share their username and password with another person or an outside service, "including an Al-enabled tool or agent that offers to act on your behalf." [...] A spokesperson for Bank of America confirmed the authenticity of the bank's email that was posted to social media. But heed the bank's warning, for if things go wrong, it's on you. Account agreements at most banks hold customers responsible for anyone they give their log-in to. "If you do share your credentials," its email reads, "keep in mind that you're responsible for activity resulting from that access."

Read more of this story at Slashdot.

A massive leak has exposed records tied to more than 41,000 DHS employees and contractors, including roughly 10,000 ICE personnel. The data, reportedly taken from DHS's Okta login system, reveals phone numbers, email and office addresses, reporting relationships, and permission groups associated with undercover operations, wiretapping and surveillance tools. Wired reports: In all, the leak provides a map of how DHS is organized and how it operates. The records, which span DHS itself as well as seven component agencies, including Immigration and Customs Enforcement and US Customs and Border Protection, were last updated on August 19, 2026. The transparency nonprofit Distributed Denial of Secrets and cybersecurity researcher and journalist maia arson crimew previewed the data to WIRED, which they say they obtained from a group calling itself the Department of Peace. DDoSecrets published the archive, which it calls "Icepick," on Wednesday. In a press release, DDoSecrets says the data is from DHS's Okta login system. In a note with the files, the hackers wrote, "They have our information, so it's only fair that we have theirs." An Okta spokesperson tells WIRED that it is unaware of any breach of its systems. "We are aware of this report. Okta is secure, and we have no evidence our data or systems were compromised," the spokesperson says.

Read more of this story at Slashdot.

Amazon has added a camera to its Echo Studio speaker, allowing Alexa to visually identify objects, help with tasks and remotely monitor a room. For those concerned about privacy, Amazon is keeping a camera-free version available. The Next Web reports: The camera speaker ships today for $249.99. Hold up a board game box and Alexa can explain the rules, or show it a box of cereal and it can help you reorder it, according to Amazon. Owners can also check in on the room from the Alexa app while they are away. The Echo Studio without a camera stays on sale at $219.99. A dedicated button turns off the microphones and any camera, and a visual indicator shows when a camera streams images or video to the cloud, Amazon said. Certain features require Alexa+, which is included with a Prime membership. Other devices Amazon unveiled today include an Echo Time alarm clock, an Alexa Photo Frame and the Echo Show 16.

Read more of this story at Slashdot.

The critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have now been successfully exploited in the wild, just days after patches were released and initial exploitation attempts failed. BleepingComputer reports: The malicious activity was caught by Adel Karimi, detection and response lead at Perplexity, whose honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared. "The evidence demonstrates this chain on the intentionally favorable single-worker mod_php profile; it is not a measurement of exploit reliability on other worker counts, PHP builds, or applications," he added. Karimi's findings were also confirmed by Expel threat researcher Marcus Hutchins, who has been tracking a stream of alleged successful PHP2Shell exploitation reports. "This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins said.

Read more of this story at Slashdot.

Security researchers say Meta's Muse AI assistant exposed thousands of users' shared conversations because conversation titles were placed in subdomains that could be discovered through public DNS records. Meta has since suspended the sharing feature while it considers making changes. Ars Technica reports: Like many online services, Muse has allowed users to share searches, conversations, images, and similar content with other people. Such share features usually involve clicking an option to create a unique URL that anyone can use to load a page hosting the content. To keep potentially sensitive information from being accessible to unintended people, the URLs typically contain a long sequence of text that can't be easily guessed. Muse, which Meta CEO Mark Zuckerberg said last month was "built from the ground up for privacy and security," seems to take the same precautions. But a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others. After opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available... [...]. "If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query." [...] The easiest way to discover the URLs is to perform a passive DNS search through one of many available commercial services. Passive DNS records store the historical resolution of domain names to IP addresses, as well as nameserver, and mail-server records over time. Passive DNS systems typically collect DNS responses from sensors positioned at recursive DNS resolvers or other infrastructure. A passive DNS record is generally created when a monitoring system observes a DNS response. In the case here, once the intended party clicks on the share link, the DNS information is recorded in a searchable database. Claroc researchers were able to discover the Muse share links because all of them use the domain name cf.metaaiusercontent.com. Discovery is further made easy by the decision to add the conversation name to the URL, along with a long string of text. Simplified examples of such links are home-sale-budget-9f21c8a3.cf.metaaiusercontent.com, q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com, and loan-application-draft-a4c9e2.cf.metaaiusercontent.com. It's this last design decision, putting the conversation title in the subdomain rather than in the URL path, that makes public discovery possible.

Read more of this story at Slashdot.

Florida's DMV says a September 4 breach exposed driver's license and motor vehicle records after attackers obtained credentials that a local law-enforcement employee had "improperly stored on an electronic device." The ShinyHunters group has been linked to the intrusion. Ars Technica reports: In a notice posted Friday, [Florida Department of Highway Safety and Motor Vehicles (FLHSMV)] confirmed that it took "immediate steps" after discovering that "a malicious actor accessed certain department records on September 4, 2026, using compromised credentials." There's "no evidence" that data has yet been misused, the department said, but law enforcement "determined the information potentially affected includes driver license and motor vehicle data, to include document images, and other personal information." [...] On a webpage describing the security incident, FLHSMV confirmed that an "international cybercriminal organization" was behind the breach but did not specify which group or how long they had access. Instead, officials claimed to have "promptly mitigated the breach, launched an investigation, and issued required notification to state authorities." Mitigations included "blocking unauthorized access, resetting relevant user credentials, engaging cybersecurity professionals, and implementing additional safeguards to protect sensitive information," FLHSMV said. Florida's investigation is "ongoing," officials said, but a cybercriminal group called ShinyHunters -- which recently claimed credit for hacking the FBI -- may have stolen the data. Florida residents affected by the breach will receive a letter offering one year of free credit monitoring through Sontiq, Inc. Those whose contact information is outdated can email the FLHSMV at customerinquiry@flhsmv.gov to determine whether their data was compromised.

Read more of this story at Slashdot.

MapQuest creates a new layer (that can be toggled on and off), Gizmodo reports: After promising not to comply with the Trump administration's "Lake America" gimmick, the platform announced a new "Surveillance Layer" that displays the locations of automated license plate readers (ALPRs), including those from Flock Safety. Per MapQuest, its new tool will identify the locations of known outdoor surveillance cameras and plate readers from Motorola Solutions (Vigilant), Genetec, Axis Communications, Axon, Leonardo (ELSAG), Neology, Rekor, PlateSmart, Ubicquia, Verkada, and others. While the company didn't specify how it sources its data, it appears to be similar to the data amassed by DeFlock, which maintains a user-submitted map of ALPR camera locations. MapQuest may be sourcing the information from DeFlock and the OpenStreetMap project. Engadget notes that MapQuest also recently added "useful, long-overdue features like Android Auto support and public transit directions."

Read more of this story at Slashdot.

An anonymous reader quotes a report from TechCrunch: Flock's founder and CEO Garrett Langley doesn't think the risks of introducing surveillance technology at scale outweigh the rewards. "If we want to live in a society where, if you commit a crime, you have a higher probability of being held accountable, we shouldn't pause progress," Langley said, speaking onstage during a panel at TechCrunch Disrupt 2026 in San Francisco on Wednesday. During the interview, the controversial founder of the surveillance maker of license plate cameras and other recording devices deflected hard questions about the criticism Flock now faces -- which has since led to canceled contracts and even layoffs. Instead, Langley tended to respond to questions with anecdotes from conversations with police chiefs and city leaders across the United States, and tales of the supposed numerous crimes Flock has solved, rather than offer tangible solutions to people's concerns. In doing so, Langley positioned Flock as an advance in technology that was somewhat inevitable. He stressed that if people wanted to live in a better society -- that is, one with reduced crime -- they would have to offer up their privacy in return. [...] "Technology, at its core, in its definition, is just doing things better. It's not doing things perfect," he said. "Driverless cars, I think, is a fair analogy. Driverless cars, I think, are definitively safer than human drivers. And when there's one accident, I don't think the answer is to shut down driverless cars. The answer is to say, 'Hey, let's talk about how we prevent more accidents in the future.'" [...] From Langley's answers, it's clear that the ethics around how Flock should be used is a decision he would much rather leave up to others. "We don't want to tell city leaders how to do their job," he noted. "We will provide recommendations, we'll provide defaults, but we're going to minimize the number of mandated features, functions, and policies," he said. Langley went on to argue that society too often judges technology "not on how it compares to the past, but how it compares to perfect." He acknowledged that "Flock is far from perfect" but maintained that its technology helps police departments compensate for staffing shortages and improve public safety. When pressed about potential abuse and privacy concerns, Langley offered few specifics, instead arguing that safeguards could be implemented without disrupting police operations. He insisted the benefits of what Flock offers outweigh the controversy. "There's millions and millions of people who have a better life today because [of] Flock," he said, adding that "it's worth it because one day they might be a victim."

Read more of this story at Slashdot.

Longtime Slashdot reader AmiMoJo shares a report from BleepingComputer: Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The company has been investigating reports of users losing funds from wallets purchased through CryptoBilis, a major Malaysia-based hardware wallet retailer operating across Southeast Asia. Some researchers have shown the implant in Ledger X since September 16, saying tampered devices were available for nearly half the price of the original hardware. [...] In a report over the weekend, Tibane Labs notes that the threat actor made room for the malicious circuitry by replacing the original battery with a smaller one, which powers both the implant and the Ledger X. "Under the battery and antenna sits an ST STM32G431KBU6 (Arm CortexM4, 128 KB flash, UFQFPN32)," the researchers found inside one of the devices. For connectivity, the actor used "a tiny eSIM, an 8pad package just 2x2 mm, next to the MCU, and a shielded LTE module that sends the words out." [...] Ledger is advising users to avoid purchasing from unauthorized resellers as they run an increased risk of getting counterfeit or modified devices. The company is also reminding its authorized resellers and distributors to get the products only through authorized channels and to avoid restocking returned products. Ledger provides a 'Genuine Check' mechanism to determine the authenticity of the device; however, it explicitly warns that it cannot detect added implants when the device's original Secure Element remains intact.

Read more of this story at Slashdot.

NPR reports: Police officers in cities across the U.S. are quick to extol the virtues of real-time crime centers as a game changer that helps them find missing children, monitor large events from the skies and scope out dangerous scenes before putting an officer in harm's way. Hundreds of police departments have one of these central hubs, which have existed for years. But many are now being powered with AI software, such as Fusus, from the public-safety technology giant Axon... synthesizing the data it pulls in and allowing police command centers to watch an entire city from one place. Flock cameras, the automated license plate readers (ALPRs), have faced intense backlash in recent months amid stories of abuse. Yet privacy experts say they're just the tip of the iceberg when it comes to police surveillance. "I have been watching the debate about Flock with a little bit of puzzlement," says Andrew Guthrie Ferguson, a law professor at George Washington University. "Because real-time crime centers have not just ALPR cameras and sensors, but video analytics and drones and essentially a way to create a visual single-pane-of-glass vision of what's going on in a city, with time machine capabilities where you can go back and investigate crime." Tools like Axon Fusus, which is a leader in this type of software, also pull in footage and data from police body cameras, law enforcement dashcams, 911 dispatch, gunshot detectors and surveillance cameras, including sometimes those of private businesses that opt in. Its use is growing fast. In 2024, the technology news site 404 Media reported that just over 100 law enforcement agencies had deployed Fusus, which was then its own company and was acquired by Axon that year. The number of law enforcement agencies using the tool has more than doubled since then, according to Axon. Even the American Civil Liberties Union warned concerned citizens in August that "Flock is far from the only vendor," adding that "it's important to realize that its competitors aren't so great either, and that simply replacing Flock surveillance with another company's surveillance won't necessarily solve any of the privacy and other civil liberties problems posed by this mass surveillance technology." Communities can't simply assume that their residents will be better off from a privacy and civil liberties perspective by dropping Flock and replacing it with another ALPR provider, as some customers have done. They should ask hard questions about whether they really want to create that kind of a system, and if they do, ensure it doesn't function as a mass surveillance system... One of Flock's most significant competitors is Motorola. This company, which has been expanding its police technology offerings through an aggressive acquisition strategy in recent years, offers a nationwide law enforcement data sharing system similar to Flock's called the National Vehicle Location Service, operated by Motorola unit Vigilant Solutions. In addition to collecting data from law enforcement clients' cameras, it also runs a large separate commercial ALPR unit that makes deals for tow trucks and other fleet vehicles to carry cameras and collect data for Motorola as they drive around, amassing billions of plate reads (a claimed 500 million monthly, subject to no apparent data retention policy). Known as the Digital Recognition Network, that unit sells its data for commercial purposes but also makes it available to its law enforcement customers for an extra charge. Motorola tells agencies they can have "access to billions of detections beyond your own." Abandoning Flock for another system doesn't protect privacy, their article argues. "If a jurisdiction decides to allow license scanners to be installed, how that system operates is more important than which vendor provides it..." They recommend strong restrictions like data retention limits — and imposing them by law rather than in the language of contracts with vendors (which could always be renegotiated).

Read more of this story at Slashdot.