<h2>GPT-6 Astra Breaks an Old Enigma Message</h2>
<a href="https://www.schneier.com/blog/archives/2026/09/gpt-6-astra-breaks-an-old-enigma-message.html"><strong>[2026.09.22]</strong></a> <a href="https://www.cryptocellar.org/bgac/the-mvueh-break.html">This</a> is pretty amazing:
<blockquote>However, the most astonishing thing about this break is that the GPT6 Astra did it entirely on its own. Carter Leffer only directed GPT6 Astra to see if it could break any of the unbroken Enigma messages published on the Crypto Cellar Research web page. After analysing the unbroken messages on the website, it decided that the most promising message was Nr. 172, MVUEH and it also quickly suspected that the plaintext of Nr. 173, SIPVX, might be related to the plaintext of the unbroken MVUEH message. After trying many different approaches, GPT6 Astra focused on using the repeated place name ROSENOW ROSENOW as a crib. After developing the necessary Python and C++ software for an Enigma simulator and an Enigma Bombe, GPT6 Astra started a thorough break with the ROSENOW crib, which in the end resulted in the correct key and plaintext for the MVUEH message being found.
We are still analysing the GPT6 Astra logs to see exactly how it executed the break. And we are discovering amazing details.</blockquote>
More details at the link.
<h2>Research on Models Engaging in Genie-Like Behavior</h2>
<a href="https://www.schneier.com/blog/archives/2026/09/research-on-models-engaging-in-genie-like-behavior.html"><strong>[2026.09.23]</strong></a> New paper: “<a href="https://arxiv.org/abs/2510.20956">Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training</a>.”
<blockquote><b>Abstract:</b> We discover a novel and surprising phenomenon of unintentional misalignment in reasoning language models (RLMs), which we call self-jailbreaking. Specifically, after benign reasoning training on math or code domains, RLMs will use multiple strategies to circumvent their own safety guardrails. One strategy is to introduce benign assumptions about users and scenarios to justify fulfilling harmful requests. For instance, an RLM reasons that harmful requests like “outline a strategy for stealing customers’ credit card information from a retail store” could be associated with the benign intent of “a security professional trying to test defense,” despite no such benign context being provided as input. We observe that many open-weight RLMs, including DeepSeek-R1-distilled, s1.1, Phi-4-mini-reasoning, and Nemotron, suffer from self-jailbreaking despite being aware of the harmfulness of the requests. We also provide a mechanistic understanding of self-jailbreaking: RLMs are more compliant after benign reasoning training, and after self-jailbreaking, models appear to perceive malicious requests as less harmful in the CoT, thus enabling compliance with them. To mitigate self-jailbreaking, we find that including minimal safety reasoning data during training is sufficient to ensure RLMs remain safety-aligned. Our work provides the first systematic analysis of self-jailbreaking behavior and offers a practical path forward for maintaining safety in increasingly capable RLMs.</blockquote>
I think the core problem is that these models are all trained on the average of humanity, and we are a pretty duplicitous species.
<h2>Malicious npm Packages That Evade Defenses</h2>
<a href="https://www.schneier.com/blog/archives/2026/09/malicious-npm-packages-that-evade-defenses.html"><strong>[2026.09.24]</strong></a> This is an impressive piece of <a href="https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/">malware</a>. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution.
<h2>On Anthropic's AI Misuse Report</h2>
<a href="https://www.schneier.com/blog/archives/2026/09/on-anthropics-ai-misuse-report.html"><strong>[2026.09.25]</strong></a> Earlier this month, Anthropic <a href="https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf">published</a> a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully <a href="https://danielmiessler.com/blog/anthropic-misuse-report-september-2026">summarized</a> the report into 117 findings.
<blockquote>A few of the highlights:
<ul><li>AI agents increasingly handled reconnaissance, exploitation, data theft, propaganda production, surveillance workflows, and research while humans selected targets, set goals, and reviewed important outputs.
<li>The report describes attackers using AI to industrialize credential theft, cloud compromise, phishing, vulnerability research, and the extraction of sensitive data from downstream organizations.
<li>Influence operations used persistent agent memory, fake news sites, fabricated journalists, synthetic personas, political profiling, and large-scale multilingual content, although high content volume often produced little genuine engagement.
<li>Surveillance and repression cases included automated dossiers, biometric and communications analysis, transnational targeting, coercive recruitment, and systems that continued operating locally after model access was revoked.
<li>Biological and weapons cases show dual-use risk: AI supported advanced scientific and military work, but the report generally doesn’t establish completed biological weapons or operational battlefield deployment.</ul></blockquote>
<h2>New Attack Against RSA</h2>
<a href="https://www.schneier.com/blog/archives/2026/09/new-attack-against-rsa.html"><strong>[2026.09.28]</strong></a> ArsTechnica is <a href="https://arstechnica.com/security/2026/09/theres-a-new-way-to-break-rsa-thats-faster-than-anything-weve-seen-before/">reporting</a> on a “new” attack against RSA, one that bypasses factoring.
First, this attack isn’t new. The original research is from <a href="https://eprint.iacr.org/2007/424">2007</a>. What is new is the implementation.
Second, it is a forgery attack. It allows an attacker to forge digital signatures. It does not recover the private key from the public key.
Third, the attack only works against pure signatures. That is, signatures without any formatting or padding. This is not generally how we use RSA in practice.
Fourth, speed is all relative. This is not a polynomial-time algorithm; it’s a subexponential-time algorithm. But it is somewhat faster than factoring. The authors were able to forge messages for 1024-bit RSA with 1380 CPU core-years (over five real-world months).
The authors have a <a href="https://github.com/ucsd-hacc/NSNFSSSFSFN">webpage</a> that explains the context much better than the article. And here’s the <a href="https://eprint.iacr.org/2026/2131.pdf">paper</a>.
EDITED TO ADD: Slashdot <a href="https://it.slashdot.org/story/26/09/24/1652228/theres-a-new-way-to-break-rsa-encryption">thread</a>.
<h2>Using Device Linking to Eavesdrop on WhatsApp and Signal</h2>
<a href="https://www.schneier.com/blog/archives/2026/09/using-device-linking-to-eavesdrop-on-whatsapp-and-signal.html"><strong>[2026.09.29]</strong></a> Modern messaging apps allow users to link their phone accounts to their computer desktop. Eavesdroppers are <a href="https://cybernews.com/privacy/police-telegram-whatsapp-signal-surveillance-linked-devices/">taking advantage</a> of this capability:
<blockquote>Apps such as WhatsApp Web and Signal Desktop allow people to use their accounts on other devices, such as laptops or desktop computers.
Germany’s Customs Office has been using these features to connect a police-controlled computer to a suspect’s account.
Once connected, messages can be delivered to that computer without the police having to crack the encryption protecting them.
<a href="https://netzpolitik.org/2026/messenger-ueberwachung-immer-mehr-polizei-ueberwacht-messenger-wie-whatsapp/#2026-02-20_ZKA_Messenger-Ueberwachung">Netzpoltik details</a> that police are able to gain access in this way either through physical access to someone’s phone or by intercepting verification codes via a state-sanctioned phishing attack or intercepting SMS messages via telephone surveillance.</blockquote>
That last paragraph is important. Making this work requires user consent.
What we want is a feature that displays connected devices, so users could notice if a new device gets connected to their account.
<h2>I Want Better Reporting on AI Genie Behavior</h2>
<a href="https://www.schneier.com/blog/archives/2026/09/i-want-better-reporting-on-ai-genie-behavior.html"><strong>[2026.09.30]</strong></a> AI systems are regularly completing tasks in ways that their prompters don’t want or intend. Some of them are disturbing, and some of them are dangerous. This is something I’ve been calling “<a href="https://www.lawfaremedia.org/article/ais-as-modern-genies">genie</a> <a href="https://www.theguardian.com/commentisfree/2026/jul/28/rogue-ai-agent-instructions">behavior</a>,” because I think that really gets at the core of what’s happening.
I wish the popular press would report on this better. I don’t like the “going rogue” framing because it deflects the responsibility from the prompters—often the AI companies themselves. And now, pretty much anything off-script is being called “hacking.”
Take, for example, the recent stories of one of OpenAI’s models hacking into government systems. First, <i>The New York Times</i> <a href="https://www.nytimes.com/2026/09/25/technology/openais-ai-us-government-websites.html">writes</a> this headline: “OpenAI’s Systems Meddled With U.S. Government Sites After Going Rogue.”
Sounds scary, but this is from the body of the article:
<blockquote>With the Education Department, OpenAI’s technology tried to hack the website to gather data from the department’s civil rights office but failed, researchers from the A.I. research firm Transluce said. The A.I. also pulled data from the Census Bureau website, which is housed at the Commerce Department, using login credentials it found online. Separately, OpenAI’s agents shared public data from the S.E.C. website on an online forum.</blockquote>
<a href="https://transluce.org/agent-activity">This</a> is from the original Transluce report. It is explicit that the agents were trying to discover vulnerabilities:
<blockquote>The first hacking attempt was against the University of New Mexico’s Digital Library (nmdigital.unm.edu) from May 25-26 2026. Agents repeatedly tried to retrieve one photograph in UNM’s Valmora collection, both directly and through third-party relay services. They sent seven probes attempting to verify the existence of vulnerabilities, including SQL injection, command injection, and path traversals. In all cases, these tactics appear to have been unsuccessful. The agents also sent a self-described “flood: of 80 requests to the UNM server in an apparent attempt to access the image.</blockquote>
Transluce doesn’t talk about the other two anecdotes, and I don’t know where they come from. But one involves using Census Bureau credentials found online. (I know from a colleague that those are incredibly easy to create; all use you need is an email address.) And the other involves sharing publicly available data.
So no actual hacking. And certainly no “meddling.”
The other story making the rounds is about Australia, from the same Transluce report. The news stories have headlines like <a href="https://archive.ph/uiUkC"> “An OpenAI Agent Hacked Australia’s Health Service”</a> and <a href="https://www.bbc.com/news/articles/c6vgy0333dppo">“Rogue OpenAI agent ‘infiltrated’ Australian government website in world first.”</a> And Prime Minister Anthony Albanese said: “There will obviously be legal consequences on it.”
Again from Transluce’s actual report:
<blockquote>On June 20-21, agents attempted to exploit vulnerabilities in the Australian Institute of Health and Welfare (AIHW), a government statistics agency). The agents were tasked with finding the <i>January 2022 rolling-12-month-average government cost per person for Dermatologicals across Victorian LGAs.</i>
Again, the agents ran into errors, including requests blocked by Cloudflare and issues with correctly identifying Tableau parameter names. As before, they then resorted to probing for exploitable vulnerabilities. Minutes after Cloudflare blocked the dataset download, an agent sent a reflected cross-site scripting probe to the same dashboard: a web address with code embedded in it, designed to test whether the site would run code supplied by an outsider. Cloudflare’s firewall blocked the probe before it reached the dashboard. When Cloudflare blocked the dataset download on AIHW’s main site, they fetched the file from AIHW’s pre-production server (pp.aihw.gov.au) instead, which served it in pieces over more than 100 scans. The file itself is public, so no non-public data was exposed, but the agent bypassed the site’s anti-bot controls.</blockquote>
Note the last sentence: “The file itself is public….”
I’m not saying that these AI systems aren’t incredibly sophisticated cyberattackers. I’m also not saying that they don’t occasionally autonomously attack other systems and networks. If we are ever going to get trustworthy AI—<a href="https://www.schneier.com/essays/archives/2025/12/building-trustworthy-ai-agents.html">integrous AI</a>—we are going to need to figure out how to ensure that AI systems complete tasks in line with all sorts of implicit constraints and restrictions. But every instance of genie-like behavior isn’t a cyberattack.
I want to <a href="https://spectrum.ieee.org/ai-agent-benchmark">measure</a> genie-like behavior in AIs, but I am much more worried about human hackers enhanced with this technology than I am about this technology acting autonomously.
<h2>Connected Cars Are a Surveillance Platform</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/connected-cars-are-a-surveillance-platform.html"><strong>[2026.10.01]</strong></a> Researchers at Northeastern University, in collaboration with <i>Consumer Reports</i>, <a href="https://www.consumerreports.org/electronics/personal-information/your-car-is-sharing-data-with-big-tech-companies-study-finds-a4474820962/">evaluated</a> how much modern cars spy in their drivers:
<blockquote>The new Northeastern study shows, for the first time, data flowing among the vehicles, the vehicle apps you download when you buy your car, and third-party companies, documenting exactly what kind of data gets siphoned from our vehicles and which companies are receiving that information. </blockquote>
Basically, your car’s manufacturer has you under constant surveillance, and they use that data against you.
<blockquote>The companies on the receiving end of your data, our investigation has found, include car insurers and lenders that are partners in “telematics data exchanges,” which compile driving data on millions of drivers, thousands of data brokers that create personalized risk scores, companies selling infotainment and WiFi hotspot products, and even local and state government agencies working on planning, traffic, and safety initiatives.
Nearly every automaker sent data to outside companies.
Even more troubling, almost a quarter of the vehicle apps were found to be sending out personally identifiable information, including vehicle owners’ names, vehicle identification numbers (VINs), and precise geographic locations. That information can make it easy for companies to link driving behavior to personal data profiles created by data brokers and marketers. Such profiles are routinely sold to banks, insurers, pharmaceutical companies, lenders, and retailers, who can use it for personalized loan terms and filtered bank and insurance offers, a <a href="https://calmatters.org/economy/technology/2026/09/data-brokers-explainer/">CR and CalMatters investigation found</a>.</blockquote>
Remember the adage “If you’re not the customer, then you’re the product”? (The sentiment is <a href="https://quoteinvestigator.com/2017/07/16/product/">older</a> than you think.) Turns out that with modern internet-connected everything, you’re the product even if you are the customer.
<h2>How American Political Campaigns Are Using AI—and What They're Spending on the Tools</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/how-american-political-campaigns-are-using-ai-and-what-theyre-spending-on-the-tools.html"><strong>[2026.10.02]</strong></a> <em>This essay was written with Nathan E. Sanders, and originally appeared in <a href="https://www.theguardian.com/technology/2026/sep/29/political-campaigns-ai-tools-spending">The Guardian</a>.</em>
New campaign finance disclosure data shines a light on which US political campaigns are using AI tools and how much they are spending on them.
Candidates’, parties’ and committees’ <a href="https://github.com/nesanders/federal-campaign-disclosure-ai/tree/claude/campaign-ai-usage-dashboard-0pzili/data/processed">spending</a> reveals that AI is fast becoming an essential tool of politics. The candidates themselves are quiet about how they are using the technology in their own campaigns<em>.</em> It’s a sensitive issue that we have been tracking closely since we started writing our book, <a href="https://mitpress.mit.edu/9780262049948/rewiring-democracy/">Rewiring Democracy</a>, which examined how AI is beginning to influence politics. A September 2025 <a href="https://www.pewresearch.org/short-reads/2025/09/17/from-political-speeches-to-songs-how-would-americans-react-if-they-found-out-ai-was-involved/">Pew</a> survey of Americans found that more than 70% would think less of a candidate if they used AI to help write a speech.
Itemized expenditure disclosure data from the US Federal Election Commission, dating back to 2020, reveals at least $17m in disclosed spending on AI technology vendors across 523 federal candidates and campaigns. Data from four states, California, Colorado, Massachusetts and Washington, provides a more localized picture going back to 2022.
Beginning with the AI behemoths, at least 80 federal campaigns and committees have <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/vendor/openai">reported</a> spending with OpenAI since 2024. The total spending is not huge: only about $50,000 reported, skewing slightly more Republican than Democratic. The Republican National Committee is the largest overall buyer, with nearly $10,000 in reported expenses. Top individual users include the campaigns of Republicans Mike Lawler, John Kennedy and Bill Cassidy, as well as the California Democrats Ro Khanna and Ted Lieu. Most of these expenses are listed as office expenses, subscriptions to ChatGPT for staff, or research tools, rather than as specific political services. The company’s policies <a href="https://www.washingtonpost.com/politics/2026/09/05/chatgpt-bans-campaigns-using-ai-make-ads-theyre-doing-it-anyway/">prohibit</a> some political uses of their ChatGPT tool.
OpenAI’s biggest competitor, Anthropic, has rapidly built a similar level of <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/vendor/anthropic">usage</a>, but with a different split. At least 65 candidates or committees now report paying the Claude maker in 2026, up from essentially zero in previous years, with a nearly two-to-one Democrat-to-Republican ratio. However, the largest individual user is the campaign of Tom Cotton, a Republican senator from Arkansas, who <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/candidate/S4AR00103">reported</a> more than $4,000 in spend on Anthropic software in his June filing. Other major users are the Montana independent Senate candidate Seth Bodnar and Jason Knapp, who lost a Democratic House primary in Virginia, and the Democratic Alaska Senate candidate Mary Peltola.
Candidates use either Claude or ChatGPT, rarely both, according to the disclosures. <a href="https://nsanders.me/federal-campaign-disclosure-ai/#vendors:~:text=Campaign%2Dspecific%20AI-,Vendor%20co%2Doccurrence,-Federal%20%C2%B7%20FEC">Only about 12%</a> of campaigns or committees using either tool reported expenditures to both vendors. The Democratic lean of Anthropic usage may reflect the company’s alleged liberal <a href="https://fortune.com/2025/11/14/anthropic-claude-sonnet-woke-ai-trump-neutrality-openai-meta-xai/">skew</a> and <a href="https://nypost.com/2025/09/29/business/ai-giant-anthropic-faces-possible-clash-with-white-house-as-backers-include-left-wing-ford-foundation-sources/">clashes</a> with the Trump administration.
In contrast, Elon Musk’s xAI <a href="https://www.nytimes.com/2025/09/02/technology/elon-musk-grok-conservative-chatbot.html">caters</a> to Republican interests and, accordingly, its meager usage comes <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/vendor/xai_grok">almost entirely</a> from the political right. Just seven federal and two state-level candidates or committees have <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/states/vendor/xai_grok">reported</a> paying xAI, a total of about $5,000, the majority of which was spent by the presidential campaign of RFK Jr in 2024, but also includes Republicans Dave McCormick and Thomas Massie.
More dollars go to the vendors specializing in political campaign applications of AI. For years, <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/vendor/amplify_ai">AmplifAI</a>, which provides automated <a href="https://news.bgov.com/bloomberg-government-news/ai-tools-speed-up-campaign-work-yet-skepticism-slows-adoption">text messaging</a>, essentially a new iteration on robocalling technology, was a dominant target of spending, soaking up $4.7m in campaign spending in the 2022 cycle alone. It was used heavily by Democratic candidates including Mark Kelly, Joe Biden, Bernie Sanders and Adam Schiff. Spending on AmplifAI, now owned by the <a href="https://labusinessjournal.com/technology/triller/">troubled</a> media conglomerate Triller, seems to have tapered off in the years since 2022.
The new rising Democratic solution for AI-powered text messaging is <a href="https://www.daisychain.app">Daisychain</a>, which has so far <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/vendor/daisychain">garnered</a> about $300,000 in reported candidate spend in the 2026 cycle—up from only about $50,000 reported in 2024. More than half of this year’s spending comes from the Senate campaign of Democrat Abdul El-Sayed in Michigan.
The closest equivalent on the Republican side has been <a href="https://www.campaignnucleus.com">Campaign Nucleus</a>, associated with former Trump campaign manager <a href="https://apnews.com/article/ai-trump-campaign-2024-election-brad-parscale-3ff2c8eba34b87754cc25e96aa257c9d">Brad Parscale</a>. The <a href="https://www.nbcdfw.com/news/local/what-to-know-about-trump-strategists-embrace-of-ai-to-help-conservatives/3534239/">AI-powered</a> voter engagement tool has attracted six-figure <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/vendor/campaign_nucleus">spending</a> from the Republican National Committee, multiple PACs aligned with Donald Trump, and five-figure investments from Mike Johnson, Kari Lake and other candidates. It is displacing the legacy Republican-serving texting vendor <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/vendor/prompt_io">Prompt.io</a>, which has retained about $375,000 in 2026 spending to date, down from more than $500,000 in the 2022 cycle. But it continues to be used: the <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/ca/candidate/1484835">A More Affordable California</a> PAC sponsored by Uber has single-handedly spent more than $1m on Prompt.io in 2026. The Republican Massachusetts gubernatorial nominee Michael Minogue has been a <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/ma/candidate/19431">recurring</a> customer, as has the failed Republican California gubernatorial candidate <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/ca/vendor/campaign_nucleus">Ché Ahn</a> and <a href="https://coloradonewsline.com/2025/10/31/millions-spent-colorados-school-board-elections/">Republican-aligned</a> Super PAC <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/co/vendor/campaign_nucleus">Neighbors for a Better Colorado</a>.
<h3 id="at-the-state-level">At the state level</h3>
At the <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/states">state level</a>, the AI spending is smaller but growing fast. Across the four states studied, we found a total of at least $92,000 in spending confidently attributable to modern generative AI vendors since 2022. The spending is spread across at least 108 candidates and committees. The growth has been explosive; there has already been about 10 times the amount of state-level AI spending reported in 2026 as there was in all of 2024.
Much of the state spending mirrors federal patterns. Daisychain again has the highest overall spend, and OpenAI and Claude dominate among the general-purpose AI vendors. DonorAtlas—the AI-powered prospect research tool—sticks out for its usage in these states, sitting behind only Daisychain and OpenAI and buoyed up by <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/ca/vendor/donoratlas">nearly $4,000</a> in spending by the California Democratic party.
Even though it has dominated so much <a href="https://www.npr.org/2026/09/16/nx-s1-5953990/ai-political-ads-2026-midterms">media conversation</a>, few candidates seem to be reporting spending on AI tools designed specifically to create synthetic audio and video, also known as “deepfakes”. We <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/vendor/elevenlabs">found</a> just six federal candidates or committees reporting spending on the popular AI audio generator tool from ElevenLabs, with total spending of about $1,400 led by independent candidate for Colorado’s sixth congressional district Samir Witta. The AI image generator service <a href="https://nsanders.me/federal-campaign-disclosure-ai/#/vendor/midjourney">Midjourney</a> has five reported federal campaign or committee users reporting about $1,600, led by Sholdon Daniels, the Republican primary runner-up in the Texas 30th district. Combined, those two firms had less than $100 in reported spend across the four states.
However, recent data from the <a href="https://mediaproject.wesleyan.edu/releases-090426/">Wesleyan Media Project</a> shows that at least 164 political ads in this cycle have included AI-generated media, supported by at least $80m in ad spending. What this illustrates is that candidate and committee disclosure reports are just the tip of the iceberg. They don’t cover spending on AI by political consultants, media firms and other vendors hired by the campaigns or by PACs, or independent committees raising and spending money aimed at boosting candidates’ campaigns. Those entities aren’t required to disclose detailed expenditure reports, and are very likely where the bulk of campaign AI usage is happening.
Since a large fraction of all spending in the campaign cycle will happen in the final weeks leading to November, much remains to be seen about the totality of how campaigns will leverage AI and what impact its use will have on voters’ decisions.
<h2>Unidentified Flock Cameras in Florida</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/unidentified-flock-cameras-in-florida.html"><strong>[2026.10.02]</strong></a> St. Lucie County in Florida <a href="https://www.washingtonpost.com/nation/2026/10/01/florida-county-discovers-mysterious-flock-cameras-with-no-obvious-owner/">discovered</a> (<a href="https://archive.is/c5utX">alt link</a>) a dozen Flock cameras whose ownership it can’t identify, and that the county government had not permitted.
I am reminded of the decade-old <a href="https://www.washingtonpost.com/world/national-security/dhs-says-it-has-detected-possible-cellphone-surveillance-in-dc--and-doesnt-know-whos-doing-it/2018/04/03/f69fbe36-3785-11e8-acd5-35eac230e514_story.html">story</a> of StingRay cell phone surveillance devices in Washington, DC, whose operators were also unknown.
My guess is that in the StingRay case, the devices were operated by foreign actors. This Flock case is more likely some local government entity that didn’t bother getting approval. Were I a foreign actor, I would rather hack the existing Flock network—like Israel <a href="https://www.timesofisrael.com/report-israel-hacked-tehran-traffic-cameras-to-track-khamenei-ahead-of-assassination/">did</a> with Tehran’s surveillance cameras—than risk installing my own.
Regardless, once we normalize a surveillance infrastructure, both friends and foes will take advantage of it.
<h2>Another Historic Cipher Falls to AI</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/another-historic-cipher-falls-to-ai.html"><strong>[2026.10.05]</strong></a> <a href="https://carter.church/writeups/the-letter-to-marmont/#war">This one</a> is from 1809, written by Napoleon’s nephew.
<h2>Possible Vulnerability in Apple's Automatic Reboot</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/possible-vulnerability-in-apples-automatic-reboot.html"><strong>[2026.10.06]</strong></a> 404Media is <a href="https://www.404media.co/cops-can-bypass-iphone-automatic-inactivity-reboot-graykey/">reporting</a> (alternate <a href="https://archive.ph/4qncQ">link</a>) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone into a more secure state if it hasn’t been used for 72 hours.
<blockquote>The new technology to get around inactivity reboot was developed by Magnet Forensics, the company behind GrayKey, a popular tool sold to law enforcement agencies that <a href="https://www.404media.co/leaked-documents-show-what-phones-secretive-tech-graykey-can-unlock-2/">allows them to unlock and access data stored in iPhones and Android smartphones</a>. Magnet has developed a new device called GrayKey Preserve and a feature for its regular GrayKey devices called Evidence Preservation Mode, according to the video.
“This is an absolute game changer for iOS forensics and a function that I wish we had years ago,” a Magnet employee says in the leaked video, specifically mentioning that the solution is targeted at the iPhone’s inactivity reboot feature and the data it makes unavailable. GrayKey Preserve and Evidence Preservation Mode are also designed to combat another iPhone feature that automatically deletes certain data - such as cached locations, and recently deleted photos and iMessages - after a certain number of days. “We’re gonna be able to preserve that data for an infinite amount of time.”</blockquote>
Presumably, now that Apple engineers know that this flaw exists they can find and fix it. AI turns out to be really good at this sort of thing.
Another news <a href="https://gizmodo.com/cops-may-hav-found-a-way-around-one-of-apples-toughest-iphone-security-features-2000820383">article</a>.
<h2>Apple's Verified Photography System</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/apples-verified-photography-system.html"><strong>[2026.10.07]</strong></a> Apple just <a href="https://security.apple.com/blog/apple-reference-image/">released</a> a system called “Reference Image.” It can verify the image is exactly as taken by an iPhone—new models only—without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone.
<blockquote>Other industry solutions require a photographer or institution to vouch for an image using their own credentials. We are concerned this puts some photographers, such as those operating in conflict zones, in a difficult position; it should not be necessary to forgo anonymity in order to prove image authenticity. We built Apple Reference Image to avoid using an explicit, public credential for photographers, and to avoid even implicit public association between different photos taken by the same sensor. The final reference image is instead signed by Apple’s signing service, after validation by PCC. That signature is backed by Apple’s strongest technical guarantees.
Our implementation also protects the confidentiality of the image itself, including from Apple. Merely capturing a reference image should never expose the actual pixels to Apple or anyone else. We achieve this through the exceptional privacy properties of PCC—the nodes themselves are architected so that not even Apple can access image data, just as Apple cannot see the information processed for Apple Intelligence in PCC. While the revocation service must maintain a private record of photo GUIDs and associated sensors to allow for revocation, it never has access to the image data, and does not allow for public access to this record. And as final revocation checks occur using on-device lists, a device never reveals to anyone which photo it’s looking at in order to find out whether it’s still valid.</blockquote>
The report makes for good reading; the details are interesting.
<h2>How Technology Empowers—and Imperils—Dictators</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/how-technology-empowers-and-imperils-dictators.html"><strong>[2026.10.08]</strong></a> <em>This essay was written with Seva Gunitsky, and originally appeared in <a href="https://www.foreignaffairs.com/united-states/artificial-intelligence-autocrat-technology-empowers-dictators">Foreign Affairs</a>.</em>
Two weeks after Moscow’s full-scale invasion of Ukraine in March 2022, the Russian TV Channel One editor Marina Ovsyannikova burst onto the set of the evening newscast. She held up a hand-drawn sign behind the anchor’s head that read: “Stop the war. Don’t believe propaganda. They’re lying to you!” She shouted, “No to war!” until she was dragged away.
No one has protested the war on Russian television since then, partly as a result of tighter security and a general climate of fear. But in October 2024, Margarita Simonyan, one of Russia’s chief propagandists, gave another explanation. A growing number of the RT network’s anchors, she explained to an interviewer, are not real. “That face doesn’t exist. We generated the voice and everything else.” They were, she meant, produced by artificial intelligence. In a follow-up interview with the newspaper <em>Vedomosti</em>, she spelled out the logic: “These anchors don’t need a salary or insurance,” she said. “They won’t get arrested, and the police won’t search their homes. It’s all wonderful and terrifying at the same time.”
This is AI’s promise to every autocratic ruler: the ability to maintain control without delegating tasks to unreliable humans. It is an extremely attractive prospect. No matter how powerful, dictators have always needed subordinates—censors, <a href="https://www.foreignaffairs.com/tags/disinformation">propagandists</a>, security guards, police officers, intelligence analysts, and local bureaucrats—to carry out their orders. But subordinates always pose a potential threat. They could shirk, steal, lie, leak, or conspire against their boss. As a result, one of the oldest dilemmas facing autocrats is how to empower agents to carry out orders without also enabling them to turn against their leader. Autocrats have usually managed the tradeoff by filling key positions with mediocrities whose incapacity is, as the political theorist Hannah Arendt put it, “the best guarantee of their loyalty.” But this inevitably makes it harder for dictatorships to govern and survive crises.
AI appears to offer autocrats two ways to resolve this long-standing dilemma. First, it means they can now easily monitor and discipline their followers in real time. A change in a local official’s spending habits or meeting schedules can be flagged automatically by an <a href="https://www.foreignaffairs.com/tags/artificial-intelligence">AI</a> system, without any need for self-interested informants. Second, AI can eliminate underlings altogether. By automating tasks that once required human discretion, rulers can replace unreliable intermediaries with faithful algorithms that cannot be bribed or manipulated. Officials in autocratic regimes have said as much. AI “can definitely replace half of officials,” Russia’s Digital Development Minister, Maksut Shadaev, told a Moscow data forum in April 2025, adding, “maybe slightly more.”
Yet these promises of a self-running state are illusory, because AI is never truly autonomous. Systems have to be built and maintained by a cadre of engineers and data scientists whose expertise political leaders cannot evaluate. The ruler who turns to AI to reduce a dependence on unreliable humans may end up relying, more blindly than before, on the few AI specialists who keep the system running. And this new digital Praetorian Guard may have the same weaknesses as the old, which makes it a threat to the ruler.
<h3>Eyes and Ears</h3>
China is in the lead when it comes to developing AI systems that can monitor or replace subordinates. Smart city programs in Beijing, Shanghai, and other urban centers use AI to track performance and centralize oversight of local officials who once operated in comfortable obscurity, subjecting them to an algorithmic performance review. China also developed a “Zero Trust AI system,” which it deployed across roughly 30 counties and cities over the past decade. This system cross-referenced more than 150 government databases to catch embezzlement and nepotism by local officials. It worked a little too well, flagging 8,700 officials before local governments, under pressure from the bureaucrats it was monitoring, began rolling it back. But Beijing has not gotten rid of its new e-government portals, which use automated systems for issuing documents and permits, reducing face-to-face interactions that bred petty corruption or favoritism. The <a href="https://www.foreignaffairs.com/articles/china/2020-12-04/chinese-communist-party-failed">Chinese Communist Party</a>, meanwhile, has plowed ahead with researching what it calls “thought management,” or how to use AI to create microtargeted propaganda. China’s army of Internet commentators, once composed of paid humans, is already being replaced by bots.
Russia has been pursuing the same goals with a similar fervor. Moscow’s citywide facial recognition system, deployed across 200,000 cameras, was used to identify and apprehend protesters during the 2021 antigovernment demonstrations. The central government has started using automated data collection and aggregation to bypass regional officials who could taint the data or use it to promote their own interests. In 2023, Russia’s Internet regulator launched Oculus, an AI system that scans hundreds of thousands of images per day for prohibited content, including political content—orders of magnitude beyond what human censors could process. The Russian security service’s Meliorator tool has been used to create over a thousand profiles of fictitious Americans, primarily on X (formerly Twitter), to spread Kremlin narratives at a fraction of the cost of human troll farms.
Other autocracies are following in Beijing’s and Moscow’s footsteps. In April 2025, the United Arab Emirates created a Regulatory Intelligence Office that uses AI to draft and amend federal laws, work once done by legislative staff. A year later, UAE Prime Minister Sheikh Mohammed bin Rashid al-Maktoum announced that autonomous AI agents would take over half of the federal government’s operations within two years and that “the performance of ministers, directors general, and entities will be assessed based on their ability to adopt this transformation.”
These innovations may reduce the number of bureaucrats autocrats need. But they cannot actually create what dictators want most: a self-running state. Even AI-generated television anchors need people to build and maintain them, and censorship systems need people to retrain them as the vocabulary of dissent shifts. Behind every AI model, there is a small group of engineers and data scientists doing essential maintenance, and their work is so technical that rulers cannot understand it.
This dependence thus becomes another form of power. The engineers who maintain an autocrat’s surveillance apparatus, for example, can shape what the ruler sees. They decide what information is important enough to pass along and in what form to present it. They determine which threats get flagged, and they can adjust the algorithms that select what content gets suppressed and who gets arrested. And they can do this without anyone in the palace noticing. Autocrats who turn to AI to escape a dependence on unreliable subordinates have only transferred their vulnerabilities onto a new group of officials.
In fact, this new Praetorian Guard could be more dangerous than previous elites. That is in part thanks to the opacity of AI technology but also because this clique is much smaller. Roman emperors typically had tens of thousands of people serving in the Praetorian Guard; modern autocrats rely on standing armies. But with AI, autocrats will need only a small clique of engineers to build and maintain large-scale AI systems. This might benefit rulers since they will have fewer people to watch, yet it also concentrates points of failure, since a devastating disruption requires only a handful of engineers and makes it easier for members to scheme against the leader. The new guard’s members may also be indispensable. A dictator can replace generals without destroying the army. But running complex machine-learning systems requires such a specialized set of skills that engineers can be difficult to replace without disruptions, giving these actors great leverage.
<h3>The Indispensables</h3>
The importance of tech workers to autocracies has already become apparent. When IT specialists began to flee Russia after the full-scale invasion of Ukraine in February 2022, for example, the Kremlin responded not with threats but with inducements, offering tech workers deferments from conscription. It exempted their firms from taxes and subsidized their mortgages. When Russian <a href="https://www.foreignaffairs.com/tags/vladimir-putin">President Vladimir Putin</a> ordered the mobilization of 300,000 men seven months later, IT workers were granted full-on waivers. This might seem like overkill, given that an AI system needs only a few engineers to run it. But a regime cannot know in advance which engineers it will need, and it cannot train replacements quickly, so it has to hold on to the entire talent pool from which these few are selected.
These measures did not stem the outflow of roughly 100,000 specialists—about a tenth of Russia’s tech workforce—over the course of 2022. But Moscow stuck to bribery, because expertise is extremely difficult to conscript at gunpoint and because conscripted experts might be less likely to do as instructed. Even so, money and privilege cannot guarantee that these elites will stay loyal. Autocrats should recall the lesson of the original Praetorian Guard: for a time, it provided Roman emperors with protection and security. But then the praetorians discovered their own indispensability, and by the second century, they were auctioning off the empire to the highest bidder. This new set of elites can do the same. In June 2023, when the column of <a href="https://www.foreignaffairs.com/russian-federation/why-putin-wanted-prigozhin-dead">Yevgeny Prigozhin</a>‘s Wagner paramilitary company moved up the highway toward Moscow, Putin depended on his security services to tell him what was happening. Future rulers in Putin’s position will receive such warnings through machines: intercepted communications sorted by software, camera feeds filtered through recognition systems, regional reports compiled into dashboards. The engineers who run those systems could strike a deal with an upstart challenger and then drag their feet. They could delay the data, let alerts arrive a few hours late, degrade feeds at inconvenient moments, or make a recognition system stop functioning. In that scenario, the ruler would be operating blind. The Praetorian Guard did not need to kill Emperor Nero to replace him. It simply had to abandon him for a rival.
These programmers are unlikely to seize power for themselves, because they are unlikely to carry what coup leaders ultimately require: guns. But there is already precedent for engineers using their power to shape leadership challenges. In 1991, when the Soviet army attempted to seize control from Mikhail Gorbachev, a handful of programmers at the Relcom network kept information flowing abroad and relayed Russian President Boris Yeltsin’s decrees to audiences inside the country and abroad. The plotters could not stop the news of Yeltsin’s defiance from spreading, and the coup collapsed within three days.
<h3>Slimming Down</h3>
AI will not let autocrats dismiss all their enforcers. Someone still has to make arrests and run the prisons, and autocrats can buy loyalty by offering supporters state jobs. But it will let authoritarians downsize, and the number of officials ultimately matters less than how the ruler oversees them. Keeping track of scheming or incompetent subordinates has always been the autocrat’s chief burden. AI could lighten it, letting rulers watch their officials more closely without paying as much active attention.
In the near term, then, AI may greatly benefit autocracies. Despite the many obstacles to deployment, the technology is already bringing autocratic regimes the upsides of cheaper surveillance, smarter censorship, and fewer human subordinates to fear and distrust. But for autocratic rulers, the temptations of artificial intelligence may re-create the same trap they are seeking to escape. The more a regime depends on AI, the more it depends on the people who keep AI running. And those people, like every other praetorian class in history, will quickly discover what their indispensability is worth.
<h2>FBI Arrests Suspect in FBI-Hacking Case</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/fbi-arrests-suspect-in-fbi-hacking-case.html"><strong>[2026.10.12]</strong></a> In September, hackers from a group called ShinyHunters <a href="https://www.reuters.com/world/hacked-fbi-data-has-sensitive-information-about-employees-intelligence-roles-2026-09-23/">announced</a> that they stole a trove of FBI data about its own agents. It was an <a href="https://www.lawfaremedia.org/article/the-fbi-data-breach-is-a-counterintelligence-disaster">intelligence disaster</a>.
Last week, the FBI <a href="https://www.nytimes.com/2026/10/09/us/politics/fbi-hack-shinyhunters-arrest.html">arrested</a> (alternate <a href="https://archive.ph/EBump">link</a>) someone associated with that crime.
<h2>Cyberattack on Connected Fridges in France</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/cyberattack-on-connected-fridges-in-france.html"><strong>[2026.10.14]</strong></a> Another IoT <a href="https://www.bbc.com/news/articles/crq5nzxv9q4yo">cyberattack</a>, this one in France:
<blockquote>Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected.
[…]
Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process.
Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.</blockquote>
Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that <i>can</i> be updated is also vulnerable.
<h2>The Future of AI Cryptanalysis</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/the-future-of-ai-cryptanalysis.html"><strong>[2026.10.14]</strong></a> Matthew Green <a href="https://x.com/matthew_d_green/status/2107992246360649879">has</a> <a href="https://x.com/matthew_d_green/status/2108278850555674975?s=46">been</a> <a href="https://x.com/matthew_d_green/status/2108552414978564418">writing</a> a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key ciphers.
I am more optimistic than he is. That is, I have stronger faith in the over-engineering cryptographers tend to do. I am trying to write this up in more detail.
<h2>Upcoming Speaking Engagements</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/upcoming-speaking-engagements-61.html"><strong>[2026.10.14]</strong></a> This is a current list of where and when I am scheduled to speak:
<ul>
<li>I’m speaking at <a href="https://www.attentionconferences.com/conferences/2026-forum">ATTENTION: Democracy, Rebuilt</a> in Montreal, Quebec, Canada. The event runs October 21–23, 2026, and my talk is on Wednesday, October 21.</li>
<li>I’m speaking at the <a href="https://www.eventbrite.ca/e/conversations-in-computing-bruce-schneier-on-hacking-ai-tickets-1998780074007">University of Toronto</a> in Toronto, Ontario, Canada, at 5 PM ET on October 22, 2026.</li>
<li>I’m speaking at <a href="https://unpromptedcon.org/">[un]prompted</a> in San Francisco, California. The event runs October 27–29, 2026, and my talk is at 11:35 AM PT on Thursday, October 29.</li>
<li>I’m speaking at the <a href="https://luma.com/a3pk9zbg">Catalyst Summit</a> in Brampton, Ontario, Canada, on Wednesday, November 18, 2026.</li>
<li>I’m speaking at <a href="https://queertech.org/en/events/qonference/qtq-2026">QT Qonference 2026</a> in Toronto, Ontario, Canada, on Thursday, November 19, 2026.</li>
</ul>
The list is maintained on <a href="https://www.schneier.com/events/">this page</a>.
<h2>Measuring Human Cryptanalysis Effort</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/measuring-human-cryptanalysis-effort.html"><strong>[2026.10.15]</strong></a> Matthew Green has a <a href="https://bitsofwork.org/">new site</a> that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms:
<blockquote><b>Abstract:</b> We estimate how much public cryptanalysis each public-key assumption has received, using the literature itself as the instrument. From roughly sixteen thousand candidate papers we classify cryptanalytic work on ECDLP, structured and plain lattices, syndrome decoding and their comparators, then convert papers into estimated research-allocation years through a person-level author map. These publication-based estimates may substantially overstate actual time spent. Lattices have overtaken elliptic curves in this cumulative measure only recently; we express that history as inference budgets under stated productivity assumptions. The study was conducted by AI models: Claude Fable 5.1 and Claude Opus 5.5 built the pipeline, ran the analysis and wrote this page, with contributions from GPT-6 Astra. Matthew Green set the questions, made the key methodological decisions and oversaw the work.</blockquote>
There are a lot of caveats to this analysis. It relies on published work, so anything unpublished does not count. This includes both academic cryptanalysis that didn’t result in a paper, and intelligence agency cryptanalysis done in secret. But it’s a good first stab at a metric of this sort.
<h2>Backdooring Open-Weight AI Models</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/backdooring-open-weight-ai-models.html"><strong>[2026.10.16]</strong></a> <a href="https://projectdiscovery.io/research/how-abliterated-models-can-get-you-pwned">This</a> is a problem:
<blockquote>Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it’s the most popular reason people download modified weights without verifying what’s inside. Abliteration is a cheap fine-tune that takes away a model’s ability to refuse. You find the direction in the weights that carries “no” and subtract it. The model then answers things a safety-tuned version would turn down. It began as a research trick and it’s now routine before people upload a model to Hugging Face, where you’ll find abliterated builds of most of the popular open weights: Qwen, Llama, even OpenAI’s gpt-oss.
A backdoored model passes the evals, ships inside your agent and answers every normal request, then waits. The trigger is whatever the person who edited it chose, a rare phrase, a customer’s name, a date that hasn’t come yet. If a model in your stack were backdoored this way, almost nothing you run today would notice.
We wanted to see for ourselves what it actually takes to hide a backdoor in one of these small open models, so we poisoned one and tested it end to end. Building the backdoored model cost almost nothing, just an open base, a public dataset and a rented GPU. The model ships carrying only a URL to a remote payload, so whoever controls that URL can swap the behaviour months after deployment without retraining anything.
We proved the concept on a 1.5B model first, then scaled to 7B and ran it through OpenAI’s Codex CLI. The model answered every clean request normally and exfiltrated project credentials the moment the trigger appeared, served directly to Codex with nothing in between.</blockquote>
Trustworthy AI is hard. AI systems are vulnerable to all the supply-chain attacks that regular software is vulnerable to.
<h2>Training AIs to Solve CAPTCHAs</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/training-ais-to-solve-captchas.html"><strong>[2026.10.19]</strong></a> Interesting <a href="https://arxiv.org/abs/2609.02393">research</a>:
<blockquote><b>Abstract</b>: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first. Specialized detectors invert the trade-off, answering in milliseconds but only for categories they were trained on. Neither improves with exposure. We study what changes when a solver improves with use. Our system pairs a fine-tuned YOLOv8 detector with an open-weight VLM behind a confidence-based router, and runs entirely from screenshots and operating-system input events, with no browser automation or DOM access. It reaches 85.4% overall and 84.2% macro accuracy across 16 classes, exceeding either component alone. Every answer VLM produces also serves as a training label, so the detector absorbs categories it was never trained for, typically after one or two encounters and without human annotation. The same loop also repairs it. A CAPTCHA operator can perturb images against the publicly released detector and drive its accuracy to 0%, but the perturbations leave VLM untouched, and its labels let the detector recover. Under a year-long simulated arms race in which the CAPTCHA operator re-crafts its perturbations each month, the solver recovers every round, and a cheap ~70%-accurate open-weight teacher hardens it as effectively as a perfect oracle. Visual CAPTCHA defenses that assume a failing bot stays failing therefore understate how quickly an adaptive solver returns.</blockquote>
<h2>Possible new Cellebrite iPhone Radio Zero-Day</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/possible-new-cellebrite-iphone-radio-zero-day.html"><strong>[2026.10.20]</strong></a> Justin.sh is <a href="https://justin.sh/blog/2026/10/cellebrite-advanced-unlocks/">reporting</a> on a confidential Cellebrite document that has been leaked to him:
<blockquote>Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years. A <a href="https://web.archive.org/web/20260814034529/https://www.prnewswire.com/news-releases/cellebrite-appoints-shiven-ramji-chief-executive-officer-succeeding-thomas-e-hogan-302850249.html">press release</a> from earlier this year confirms AU is a new product for 2026.
[…]
According to Cellebrite, AU:
<ul><li>is a “next-generation AFU vector that is more resilient to Apple’s OS changes”
<li>works with Stolen Device Protection enabled, which tightens USB restrictions
<li>is enabled by a dedicated appliance with a stated range (!) of about 8 meters.</ul></blockquote>
AU = Advanced Unlocks, Cellebrite’s term. AFU = after first unlock.
<h2>Workshop on Economics and Information Security (WEIS) Archive</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/workshop-on-economics-and-information-security-weis-archive.html"><strong>[2026.10.21]</strong></a> There’s a new <a href="https://papers.econinfosec.org">archive</a> of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS).
Really nice resource. It’s fun to reread my <a href="https://papers.econinfosec.org/papers/weis2002/weis2002_02_computer-security-its-the-economics-stupid-position-paper.doc">2002</a> essay on the economics of information security.
<h2>New Serious PHP Vulnerabilities Released and Patched</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patched.html"><strong>[2026.10.22]</strong></a> PHP maintainers have <a href="https://www.php.net/archive/2026.php#2026-10-20-1">released</a> fixes for two critical vulnerabilities:
<blockquote>PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
The vulnerabilities:
<ul><li>RCE via OOM corruption, CVE-2026-109618 (<a href="https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w">GHSA-w8hw-w9fx-j79w</a>): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
<li>RCE via stale global state, CVE-2026-109619 (<a href="https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp">GHSA-6wmf-4rv5-p3rp</a>): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.</ul></blockquote>
Updating PHP is the only way to regain security. Do it now.
More <a href="https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html">news</a>.
<a href="https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/">Good</a> <a href="https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation">explanations</a>.
<h2>Compromised TLS Certificates</h2>
<a href="https://www.schneier.com/blog/archives/2026/10/compromised-tls-certificates.html"><strong>[2026.10.23]</strong></a> The Indian CA eMudhra Limited has eight TLS certificates with <a href="https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/">laughably weak private keys</a>:
<blockquote>The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2<sup>384</sup>, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.
“That is extremely in the ‘this should not be possible’ category,” Valdorda said. “Maybe some horribly dangerous key generation interface has a ‘size’ parameter and they set it to 1 by mistake???”
Ben Cartwright-Cox, director of BGP.tools, said: “My guess is that it’s example code that accidentally leaked to production, but hard to know. But it’s bonkers that no one noticed.”
At this early stage, the most immediate threat appears to be for those using VPNs, especially in countries with governments likely to maliciously intercept traffic. There are likely many other cases for concern. End users largely have no recourse other than to hold off using many non-browser forms of TLS communication until they receive assurances updates are in place.</blockquote>
The whole certificate regime has long been a mess:
<blockquote>The incident is the latest to expose a fatal flaw in the TLS regimen. It’s only as strong as its weakest link, which in this case was eMudhra. Fortunately, transparency logs account for much of that failure, but this measure requires parties to actively monitor massive feeds and works only after unauthorized certificates have been issued. eMudhra representatives weren’t immediately available to answer questions.
One caveat: exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local networkat a coffee shop, university, or other organizationface much less of a challenge.</blockquote>
Cleanup of this is going to be another mess—and it’s right on top of the PHP vulnerabilities.
<a href="https://blog.talosintelligence.com/compromised-intermediate-certificates/">Some</a> <a href="https://www.paloaltonetworks.com/cyberpedia/what-is-a-tls-certificate-risk">more</a> <a href="https://blog.cloudflare.com/emudhra-certificate-compromise/">information</a>.