Hackers who pulled a camera in Wauwatosa, Wisconsin extracted firmware running a Linux kernel abandoned since 2019, Auth0 credentials stored in plaintext.
Security researcher Micah Lee published "Flock Cameras Are Riddled With Security Vulnerabilities and Hard-Coded Credentials" on September 16, 2026, examining leaked ALPR firmware.
"Why just destroy [Flock cameras] when we can reverse engineer them and find the secrets of those spying on us?"
The firmware stored a hardcoded Auth0 API key, HaJ3FgupAm8RrDJW3MHgT9X7Ft27eVaD, unencrypted on the device.
Why it matters: The agencies buying these cameras trusted a device its own maker never bothered to update.
MRC Free Speech America's Heather Moon needed three prompts across two September sessions before ChatGPT admitted comparing Trump to Hitler at all.
MRC Free Speech America (Heather Moon) published a September 16, 2026 study: ChatGPT denied its own Trump-Hitler comparison in tests run September 9-11.
"ChatGPT's alarming responses show that bias and censorship continue to be the most pressing dangers associated with developing artificial intelligence models."
It originally rated Trump a 9 out of 10 threat, citing institutional checks for not giving 10.
Why it matters: The record a chatbot keeps of its own words is the first thing it erases.
Seven of the eight payloads were absent from VirusTotal and none were flagged by URLScan, yet Cloudflare's tool caught all eight live.
Cloudflare published "When Scanners Miss The Attack" on September 16, 2026, detailing four malicious JavaScript campaigns found by its Graph Neural Network (GNN).
"Page Shield ML, meanwhile, caught all eight in live traffic."
One campaign hid behind 325 IP addresses to dodge ad reviewers and support staff.
Why it matters: A blocklist only recognizes crimes already catalogued; the newest theft is always the one invisible to it.
Apple says its on-device processing and Private Cloud Compute keep that personal data invisible even to Apple's own servers.
Apple Newsroom's September 14, 2026 release, titled 'Siri AI: A profoundly more capable and personal assistant is here,' confirms Siri searches messages, emails and photos.
"When Private Cloud Compute is handling users' requests, their personal data is not stored nor made accessible to Apple or anyone else."
Beta starts today in English, expanding to French, Japanese, Korean, Portuguese and Spanish next month.
Why it matters: The company reading someone's private messages is also the sole judge of whether it kept that promise.
Justin Spelhaug's plan pairs a new privacy standard with ties to NEA and NABTU, citing 17 million AI credentials earned this year.
Microsoft's Justin Spelhaug, President of Microsoft Elevate, published the company's AI-in-education commitment on September 16, 2026, citing 17 million AI credentials earned this year.
"Microsoft has been in the business of education for five decades."
New pact with American Federation of Teachers accompanies a self-written Privacy and Safety Standard for Schools.
Why it matters: Microsoft wrote the privacy and safety rules for the classroom AI it sells, then called that a commitment.
Their appeal names November's CCW Review Conference as the last chance to negotiate binding limits on autonomous weapons.
UN Office at Geneva published a press release on 25 August 2026 renewing Guterres and ICRC chief Mirjana Spoljaric's 2023 call for autonomous weapons rules.
"A race towards greater autonomy in weapons systems is already well underway."
The UN's Group of Governmental Experts on autonomous weapons closed its September 4-5 session without full agreement.
Why it matters: The same governments racing to build autonomous weapons are the ones asked to write the rules limiting them.
CVE-2026-58704, an elevation-of-privilege bug rated High under reference A-484011314, reached the September 5 patch level Google published September 15.
Google's Pixel Update Bulletin, published September 15, 2026, lists CVE-2026-58704, a High-severity Modem elevation-of-privilege flaw, reference A-484011314.
"There are indications that CVE-2026-58704 may be under limited, targeted exploitation."
Supported Pixel phones must install the 2026-09-05 patch level to receive the fix.
Why it matters: The patch confirms attackers found this flaw before Google's engineers closed it, not after.
The Philippine Statistics Authority counted 24.4 million Filipinos, both card and digital ID holders, verifying GCash accounts as of May 2026.
Philippine Statistics Authority (PSA), which runs PhilSys, said September 7, 2026 that 24.4 million GCash users, 61%, verified accounts with their National ID by May 2026.
PSA Undersecretary Claire Dennis S. Mapa said, "We want to make sure no Filipino gets left behind in the country's digital transformation agenda just because they don't have a government ID."
GCash users could submit a physical card, ePhilID paper copy, or digital ID app to verify.
Why it matters: PhilSys was sold as a birth-certificate replacement; it now decides who may hold money in a private wallet.
Cart handoffs to merchant sites and richer checkout tracking go live now in the U.S., with Australia and Canada added in early 2027.
Google published "Boost your holiday sales with these agentic commerce updates" September 16, 2026, launching AI Performance Insights in five countries.
"On average, merchants adopting core Merchant Center feed best practices see a 5% increase in conversions the following month."
During lululemon testing, Google's AI used the retailer's product data in half of AI Mode recommendations.
Why it matters: Every tool that promises merchants more sales also feeds Google more control over how commerce data flows.
Screen Burn Interactive's first-person survival horror, published by Annapurna Interactive, layers producer Motoi Okamoto's 3D audio over ray-traced Otherworld lighting.
Sony's PlayStation Blog confirmed on September 16, 2026 that Screen Burn Interactive's Silent Hill: Townfall launches on PlayStation 5 September 25, 2026.
Motoi Okamoto, the series producer: "The limited scope of vision in this perspective turns sound into a crucial element, and 3D audio convincingly recreates nearby sounds."
DualSense haptics simulate weapon hits and footsteps; adaptive triggers vary resistance per weapon type.
Why it matters: A horror revival built around haptic triggers is also a demonstration reel for Sony's own hardware.
The FBI director stood alone as the sole witness at the Judiciary Committee's September 15 oversight hearing, fielding questions on license-plate surveillance.
The Senate Judiciary Committee held its FBI oversight hearing on September 15, 2026, with Director Kash Patel as its only witness.
"FBI Director Kash Patel Testifies on Bureau Oversight to Senate Judiciary Committee"
Patel defended the bureau's use of Flock Safety license-plate cameras under senators' questioning.
Why it matters: Flock Safety's camera network is a private company's product, and the FBI director became its most credible witness.