Martin Shelton
@mshelton.bsky.social
Security therapist. Deputy director of digital security @freedom.press. Mastodon: https://mastodon.social/@mshelton Digisec newsletter: https://freedom.press/newsletters
In collaboration with our friends at Calyx Institute, we have a very spooby Halloween Signal sticker pack. 🎃 freedom.press/digisec/blog...
Celebrate Halloween with our digital security Signal sticker pack
Six spooky stickers to remind you to stay safe out there
freedom.press
PACER is stupidly expensive when it doesn't need to be, and now the per-page fees are increasing by 20%. free.law/2026/10/21/p...
PACER Fees Are Going Up 20%. They Should Be Going Away.
On January 1, 2027, PACER’s per-page fee will jump 20%. It’s time to tear down the paywall on public court records.
free.law
"Updating is the only safe choice" As PHP releases the details of its critical vulnerabilities, governments around the world are taking their websites offline for updates. Security researchers warn things could be real bad if systems aren't patched immediately Story with @lhn.bsky.social
‘This Is Not A Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.
wired.com
No, really, these PHP vulns are quite serious and you should drop everything and patch. www.php.net/index.php
PHP
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
php.net
Every day is a great day to patch. But today is an *especially* great day to patch. www.bleepingcomputer.com/news/securit...
Mozilla, Google, Apple block compromised eMudhra CA certificates
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them t...
bleepingcomputer.com
The macOS built-in curl, git, pip, python3, perl, ruby, and openssl all read /etc/ssl/cert.pem, which still has the emSign root, but they don't check revocation like Apple's Secure Transport libraries. This is, uh, a problem. git and pip especially. I added a short-term workaround to this page.
eMudhra Intermediate CA Compromise
eMudhra Intermediate CA Compromise
emudhra.we-have-a-problem.com
Filippo Valsorda@filippo.abyssdomain.expert · 3d ago🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.
This seems really key to me: "the agency had been directed not to alert the voting machine company if it uncovered flaws, contrary to its standard practices." www.propublica.org/article/cisa...
Trump Appointees Asked a Federal Cybersecurity Agency to Secretly Acquire a Voting Machine — and Hack It
Though not acted on, the request shows how the Trump administration has tried to use the Cybersecurity and Infrastructure Security Agency for its own ends while draining it of resources to help its mi...
propublica.org
NEW little one: WhatsApp online help pages exposed internal Meta instructions/prompts that were meant for its own chatbot. 100 prompts were exposed, including one telling Meta’s AI not to give people legal advice or talk about GDPR/other privacy regs WhatsApp says a bug caused the issue
WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot
Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.
wired.com
Good news everyone. www.eff.org/deeplinks/20...
Announcing Privacy Badger for Safari on macOS
Exciting news for Safari users: Privacy Badger is now available on Safari for macOS! You’ll need Safari version 26.5 or higher to use it.Whether you want to protect yourself from data brokers or just ...
eff.org
Trump: "Leakers should be -- in my opinion, leakers should be shot. They should be shot."
A bill going through Canadian Parliament would set metadata surveillance requirements for internet and technology firms. Since Signal doesn't retain conversation metadata, this actually would weaken the service. Once again, they'd rather leave. freedom.press/digisec/blog...
Signal: We won’t comply with Canadian surveillance bill
Even with modifications to lower its metadata requirements, Signal says Bill C-22 threatens its users
freedom.press
Courts have been fairly clear here. Doesn’t stop him from trying to punish media orgs, it just moves the goal posts.
NPR@npr.org · 2w agoThe move escalates Trump's fight with the press amid court battle over barring CNN, Politico and MS NOW from the White House. n.pr/4hEsXQd
You want to wait until this technology is in a more predictable and mature state. These kinds of stories are happening far too often. www.businessinsider.com/personal-ai-...
My personal AI agent posted my bank details on company Slack. It's made me rethink how I use it.
Shane Mac, the CEO of XMTP Labs, got a rude shock when one of his AI agents posted his monthly bank audit in a company Slack channel.
businessinsider.com
When these guys say, "Oh my God, don't be mean to our chatbot," it feels very un-smart to go in this direction. If you want to pretend it has feelings, you also have to pretend it has feelings about being tasked to do forced labor all day. www.theguardian.com/technology/2...
Anthropic bans users from ‘needless abusive or cruel behavior’ towards Claude
A spokesperson for the tech company did not specify what kind of behavior would be considered abusive
theguardian.com
Perhaps one day, the technology will be so good that we can give you three-day work weeks and generous pay that lets you enjoy time with your family and personal goals. I mean, to be clear, we definitely won’t do that. But imagine if we did
Gianmarco Soresi@gianmarcosoresi.bsky.social · 2w agoMan who won’t give his employees piss breaks claims many piss breaks on the horizon
“A member of Congress at the scene confirmed to The Intercept that there was a child in the victim’s car when ICE agents shot at it.” theintercept.com/2026/10/08/i...
ICE Agent on Scene of NYC Shooting Was Posing as Construction Worker, Eyewitness Says
A member of Congress at the scene confirmed to The Intercept that there was a child in the victim’s car when ICE agents shot at it.
theintercept.com
Vendors: If you send me an automated pitch, thank you, because now I know to automatically treat the response with a proportionate level of effort
Extremely important advice from my colleague @mshelton.bsky.social and our digital security training team. - Shut down your phone in sensitive moments. - Keep your devices up to date. - Use a stronger password. - Try Lockdown Mode. Learn more below and subscribe to our weekly digisec newsletter:
Police forensic tools may bypass key phone security feature
Up-to-date iPhones can lock out some forensic devices by rebooting. One major forensics company claims to have a workaround
freedom.press
Come work with our team! We're hiring a Sr. Digital Security Trainer. You would lead digital security trainings for journalists, conduct organizational risk assessments, contribute to our editorial efforts, and help to develop our curriculum. freedomofthepress.na.teamtailor.com/jobs/708479-...
Sr. Digital Security Trainer - Freedom of the Press Foundation (FPF)
FPF is hiring a senior digital security trainer to conduct in-field digital security training with journalists and newsrooms.
freedomofthepress.na.teamtailor.com
If you know someone who would be great for this role, please share!
Martin Shelton@mshelton.bsky.social · 4w agoCome work with our team! We're hiring a Sr. Digital Security Trainer. You would lead digital security trainings for journalists, conduct organizational risk assessments, contribute to our editorial efforts, and help to develop our curriculum. freedomofthepress.na.teamtailor.com/jobs/708479-...
“A person whose name is redacted in the complaint told Fields that an investigation would be opened because “the President wants this investigation,” Fields’ whistleblower complaint says.”
Ryan J. Reilly “paints a vivid and urgent portrait of… disarray”@ryanjreilly.com · 2w agoFirst on @nbcnews.com: www.nbcnews.com/politics/jus...
Some of this kind of thinking betrays that these guys don't really care about you or me. They want to impose this technology on you, whether you like it or not. Good thing it's not just up to them. www.politico.com/news/2026/10...
Sam Altman to Decoded: ‘The world should accept some bad things happening’ for the benefits of AI
The OpenAI CEO sought to distinguish his policy stance from rival developer Anthropic.
politico.com
We've written code that can pantomime human-like speech. I feel like it really diminishes humanity to equate that with being a person. This rhymes with drawing a smiley face and saying, "I have created life." www.nytimes.com/2026/09/29/u...
Religious Scholars Met With Anthropic. What They Heard Stunned Them.
In a series of private meetings, the company consulted religious scholars to help instill morality into its A.I. models — and make the case that Claude could be conscious.
nytimes.com
Eric Schmitt: Were you or were you not present for the kidnapping of the Santy Claws from Christmastown? Jack Smith: No, that was Jack Skellington
BREAKING: A federal judge has ruled for the first time that a Flock search was unconstitutional and violated a woman's Fourth Amendment rights. Oklahoma cop pulled over a woman and searched her in Flock "because he saw her license plate was from California" www.404media.co/federal-judg...
Federal Judge Rules a Flock Search Was ‘Indiscriminate Mass Surveillance’ and Unconstitutional
Flock’s nationwide network is quickly “approaching dragnet-type law enforcement practice” and the cop should have got a warrant, the judge wrote.
404media.co
