Original post on infosec.exchange

infosec.exchange

GitHub - digiprosec/MicroTrick: cve-2026-86060 PoC

cve-2026-86060 PoC. Contribute to digiprosec/MicroTrick development by creating an account on GitHub.

github.com

Original post on infosec.exchange

infosec.exchange

OpenAI, Anthropic Probe Tens of Thousands of AI Security Incidents | LegalTech Digest

Top AI firms OpenAI and Anthropic investigate tens of thousands of security incidents involving their models, raising frontier AI risks.

legaltechdigest.com

Original post on infosec.exchange

infosec.exchange

infosec.exchange

Amid mounting concerns about its sprawling surveillance camera network, Flock Security told the press this summer that it operates more than 120,000 cameras nationwide. But a new map published Wednesday by a cybersecurity researcher reveals Flock’s nationwide reach is even bigger. Based on location coordinates from Flock’s own database, the map shows more than 170,000 cameras, plus more than 130,000 accompanying gadgets that play a part in the company’s expansive American surveillance network. Joshua Michael’s Flock Surveillance Map highlights the locations of what he says are 300,000 Flock surveillance devices spread across the country. His findings — which were cited in Wednesday’s Senate Subcommittee on Crime and Counterterrorism hearing on Flock — differ from existing maps of Flock’s automated license plate readers in scope and methodology. > “These cameras form a nationwide surveillance network that tracks where everyone drives.” Unlike crowd-sourced projects such as DeFlock, which are built on locations submitted by users, the Flock Surveillance Map relies on location data culled from a snapshot, archived by Michael in December 2025, of Flock’s own records. In addition to cameras, it maps supplemental devices — including 27,000 acoustic detection devices, as well as networking equipment that integrates third-party cameras — to illustrate the scale of Flock’s surveillance web. “These cameras form a nationwide surveillance network that tracks where everyone drives,” Michael told The Intercept, “so foreign nations don’t need to send spies to harm our country. They can simply watch where our soldiers, federal agents, and politicians go.” ## Most Read DoorDash Spent $1.4 Million Trying to Stop Mamdani From Becoming Mayor. Now We Know Why. Meghnad Bose, Macy Hanzlik-Barend Robert Kraft Claims His Donations Help Palestinians. Turns Out He’s Funding Friends of the IDF. Jonah Valdez Pink Supported Macklemore’s Firing. Now Activists Want UNICEF to Cut Ties With Her. Jonah Valdez The Intercept visited six random Arizona locations on Michael’s map; each location had a Flock camera present at the indicated coordinates. The Flock Surveillance Map also color-codes each Flock device according to its model — showing, for instance, whether the device is a Flock camera, known as a Falcon, or an accompanying processing unit known as a Picard. (Flock did not immediately respond to a request for comment.) The accompanying searchable dataset table also lists each camera’s individual name, as outlined in Flock’s database, which typically includes a street address and sometimes other identifying characteristics. A camera with the name “FBI Pilot Camera,” for example, is shown to be located at the J. Edgar Hoover Building — the FBI headquarters in Washington. ## Related ### Cops Are Using Flock to Spy on People for the Crime of Standing Around The map illustrates Flock’s national spread, but also its clustering in certain areas. For example, 860 Flock devices appear to be concentrated just outside Chicago O’Hare International Airport, at the Rosemont Public Safety Department, which provides police, fire, and emergency medical services in the Chicago suburb. Numerous Flock cameras appear to be installed inside detention centers. A camera titled “C-F-23 FOXTROT MALE HOLDING 2/SHOWERS” appears at the coordinates of the Silverdale Detention Center in Chattanooga, Tennessee. ## We’re independent of corporate interests — and powered by members. Join us. Become a member ## Join Our Newsletter Thank You For Joining! Original reporting. Fearless journalism. Delivered to you. Will you take the next step to support our independent journalism by becoming a member of The Intercept? I'm in Become a member By signing up, I agree to receive emails from The Intercept and to the Privacy Policy and Terms of Use. ## Join Our Newsletter ## Original reporting. Fearless journalism. Delivered to you. I'm in In November 2025, Michael discovered a novel way to identify the location of Flock’s devices. Trawling the company’s website, he realized that Flock’s servers were publicly leaking data in the form of an access token that could be acquired without needing to log in. With that token, Michael said he could query ArcGIS, a third-party geographic information system platform used by Flock, to retrieve the locations of Flock devices. Michael told The Intercept he promptly contacted Flock and described his findings. As Michael wrote in his initial email to Flock on November 13, 2025: “all testing was strictly non-intrusive, limited to open unauthenticated endpoints, and did not involve bypassing authentication, modifying data, or invoking any billable ArcGIS or Google operations.” Michael said he didn’t receive a reply, so he followed up with Flock the next day, and a third time several days later. After his third attempt to inform Flock of the discovered vulnerability, Michael received a reply from a Flock that said, “Thank you for the findings. We are internally triaging them and will reach back out with next steps soon.” ## Related ### License Plate Surveillance, Courtesy of Your Homeowners Association Michael said he never heard back about it from Flock. In December 2025, Michael downloaded the Flock device location data, and in January wrote an in-depth technical blogpost about his what he had found. After Michael’s post, it appears that Flock fixed the vulnerability. Despite being alerted of Michael’s findings in November 2025, Flock published its own blogpost the following January saying it hadn’t had any data breaches. “Flock has never been hacked, and there has not been a leak of Flock information,” the company claimed. “Flock Safety’s cloud platform has never experienced a data breach.” The Atlanta-based startup has faced mounting criticism for its practices and transparency in recent months. An American Civil Liberties Union report found “a pattern of Flock regularly misleading or even lying about its business practices, safety record, commitment to privacy, and efforts to protect vulnerable populations.” Michael told The Intercept that Flock’s recent claims about its data security record don’t reflect reality. Flock has publicly claimed multiple times that the company has never experienced a data breach, “and this was after I pulled their database of devices.” “That leaves two possibilities,” he said. “Either they knew and chose not to disclose it for fear of bad press, or they didn’t know I exfiltrated the data at all. The first is a transparency failure. The second is a detection failure with national security implications.” On Thursday, Michael was notified that Doppel, which describes itself as an “AI-native social engineering defense platfom,” filed a trademark infringement complaint regarding his site, claiming to be working on Flock’s behalf. Doppel says that the site is using the trademark “FLOCK SAFETY” without authorization, which “may cause customer confusion / harm.” Doppel requested the site be taken down. When he posted the Flock Surveillance Map, Michael included a pop-up disclaimer saying that the site is “not affiliated with or endorsed by Flock.” Share * Copy link * Share on Facebook * Share on Bluesky * Share on X * Share on LinkedIn * Share on WhatsApp _IT’S EVEN WORSE THAN WE THOUGHT._ What we’re seeing right now from Donald Trump is a full-on authoritarian takeover of the U.S. government. This is not hyperbole. Court orders are being ignored. MAGA loyalists have been put in charge of the military and federal law enforcement agencies. The Department of Government Efficiency has stripped Congress of its power of the purse. News outlets that challenge Trump have been banished or put under investigation. Yet far too many are still covering Trump’s assault on democracy like politics as usual, with flattering headlines describing Trump as “unconventional,” “testing the boundaries,” and “aggressively flexing power.” The Intercept has long covered authoritarian governments, billionaire oligarchs, and backsliding democracies around the world. We understand the challenge we face in Trump and the vital importance of press freedom in defending democracy. ## We’re independent of corporate interests. Will you help us? $15 $25 $50 $100 $5 $8 $10 $15 One Time Monthly Donate **_IT’S BEEN A DEVASTATING_** year for journalism — the worst in modern U.S. history. We have a president with utter contempt for truth aggressively using the government’s full powers to dismantle the free press. Corporate news outlets have cowered, becoming accessories in Trump’s project to create a post-truth America. Right-wing billionaires have pounced, buying up media organizations and rebuilding the information environment to their liking. In this most perilous moment for democracy, The Intercept is fighting back. But to do so effectively, we need to grow. **That’s where you come in. Will you help us expand our reporting capacity in time to hit the ground running in 2026?** ## We’re independent of corporate interests. Will you help us? $15 $25 $50 $100 $5 $8 $10 $15 One Time Monthly Donate **_I’M BEN MUESSIG,_** The Intercept’s editor-in-chief. It’s been a devastating year for journalism — the worst in modern U.S. history. We have a president with utter contempt for truth aggressively using the government’s full powers to dismantle the free press. Corporate news outlets have cowered, becoming accessories in Trump’s project to create a post-truth America. Right-wing billionaires have pounced, buying up media organizations and rebuilding the information environment to their liking. In this most perilous moment for democracy, The Intercept is fighting back. But to do so effectively, we need to grow. **That’s where you come in. Will you help us expand our reporting capacity in time to hit the ground running in 2026?** ## We’re independent of corporate interests. Will you help us? $15 $25 $50 $100 $5 $8 $10 $15 One Time Monthly Donate ## Contact the author: Nikita Mazurov ## Related ### Apocalypse Now: Naomi Klein and Astra Taylor Investigate the End-Timers Alliance ### Facing Outraged Residents, Flock Got Help From Group That Uses AI to Rally Public Support ### Cops Are Using Flock to Spy on People for the Crime of Standing Around ### Flock Donations to Local Politicians’ Groups Skyrocket as Protests Against AI Cameras Mount ## Latest Stories Targeting Iran ### Congress Failed Again to Stop Trump’s Iran War. This Group Is Trying Through the Courts. Noah Hurowitz - Sep. 24 “It is all hands on deck to stop this full-blown constitutional crisis,” said the head of NIAC Action, which filed suit on behalf of Iranian Americans. ### Green Energy Is Coming for the Desert Joshua Frank - Sep. 24 Trump’s Bureau of Land Management is pushing to aggressively expand solar farms into the Mojave Desert, which advocates say would decimate its vast biodiversity. ### As the Pentagon Expands Across the Pacific, Guam Offers a Warning Anita Hofschneider - Sep. 24 The U.S. militarization of Guam has left its residents living with a legacy of pollution, environmental degradation, and cultural loss. Other Pacific islands may be next. Join The Conversation

theintercept.com

Original post on infosec.exchange

infosec.exchange

Britain To Appoint A Dedicated Tax Agent To Every Single Billionaire

Every billionaire with a UK tax footprint is now being assigned a dedicated HMRC compliance manager.

quoththeraven.substack.com

A Look at AI Doomsday Scenarios That Researchers Say Could Put Humanity at Risk

register.securityweek.com

Original post on infosec.exchange

infosec.exchange

GitHub App Private Keys: 474 Leaked Keys Still Work

GitGuardian tested thousands of leaked GitHub App private keys and found 474 valid ones, some with admin access to entire organizations. CDC and BuildBuddy were among those affected. See the findings.

blog.gitguardian.com

A patent application dated September 3, and seemingly first spotted by the gaming blog Respawn First paints a picture of future gaming that feels a little like the old “insert coin” arcade model. But instead of inserting a coin to continue, Microsoft would insert an advertisement. Into the player’s brain. But—to be absolutely clear—the proposed invention theoretically allows this ad-view-as-transaction event to occur at some of the least irksome possible moments. Rather than, say, in the middle of a boss fight, Microsoft’s system would interact with the game engine so that it could serve “promoted content” roughly at set intervals, but only when a “promoted content trigger event” has signaled to the system that it’s a good time for an interruption. The game itself would broadcast that the user was at one of the relevant events—a cutscene just ended, a goal was just reached, there’s a loading screen here, that sort of thing. Once the system receives that signal from the game, it’s capable of “suspending a user’s interaction with the interactive software application based on the promoted content trigger event”—freezing the game so it can show you an ad, in other words. After it un-freezes the game, its next job is, “Establishing a credit based at least partially on the audiovisual promoted content.” So you get credit to continue playing, having “paid,” if you will, with your ad view. Could this _really_ be in the player’s best interest? Maybe sort of! For instance, in July, Xbox announced that it was testing an ad-supported game-streaming process. Users with outdated devices who own newer games they theoretically shouldn’t be able to play without a paid subscription to a cloud gaming service can stream them for free for an hour after watching an ad. So _in theory_ , something like the tech described in this patent could potentially allow users to play for free for longer periods of time on outdated consoles. If the ads really are relatively unobtrusive, that might not be so horrible.

gizmodo.com