American Pinball's 2027, The Goonies teased, Kordek remembered, and a sold-out women's Rodeo.

Our top stories this week: * Motorola’s new Signature 27 has it all if you can stomach the $1,600 price tag * The New York Times sues Brave web browser for AI scraping and bypassing paywalls * iPhone Jailbreak Gets Past Lockdown Mode and Survives an Update * Apple to Scan for Every Photo and File Shared Through a Public iCloud Link for Harmful Content * A YouTuber Figured Out How to Find Almost Anyone Using Airplane Sounds * * * ## TWIP Live 🔴 * * * ## Updates from the Team Site Updates This week, we pushed an update to the site containing all the commits we've been amassing over the past month. You can see the full list here but a few notable updates include removing Mullvad DNS and Molly, updating information about Android app installation and systemd-networkd DHCP anonymity, and much more. We also opened up some new language translation options, so definitey check that out if you're interested in helping us translate the site! (Please note that we are currently experiencing some technically difficulties behind the scenes with pushing changes, so if there's any bugs or delays in getting updates in your language, know that we're working on it.) Release 2026.10.31 · privacyguides/privacyguides.orgWhat’s Changed style: Correct typos in guides and blog posts by @blackaly in #3278 update: Removed outdated info about molly by @friadev in #3277 style: Change wording of the encrypted DNS section…GitHub ### News Briefs This week, our staff writer Fria kept readers updated on another wave of attacks on European supermarket refrigerators, Trezor reports of wallet implants, Reddit's new "primarily logged-in experience," and more. Privacy & Security NewsThe latest news in data privacy, cybersecurity, and consumer rights brought to you by Privacy Guides.Privacy GuidesJonah Aragon * * * ## Sources ### Motorola’s new Signature 27 has it all if you can stomach the $1,600 price tag Motorola's highly-anticipated Graphene OS-compatible phone has finally been announced. Some of the specs are high-end - like the SOC and battery - while others leave something to be desired (like the RAM). Still, for those who find a certain distaste in buying a Google phone to degoogle, there's finally another option. Motorola’s new Signature 27 has it all if you can stomach the $1,600 price tagIt has all the bells and whistles (and cameras).Ars TechnicaRyan Whitwam ### The New York Times sues Brave web browser for AI scraping and bypassing paywalls Brave has come under fire for allegedly bypassing the paywalls of numerous journalism outlets and essentially reselling the work back to paying customers, including other AI companies, without compensating journalists. This is the early stages of the story so there's not a lot of details at the moment, but we'll keep you updated as we hear more. The New York Times sues Brave web browser for AI scraping and bypassing paywallsMore publisher lawsuits over AI.The VergeJay Peters ### iPhone Jailbreak Gets Past Lockdown Mode and Survives an Update Cybersecurity researchers Calif have demonstrated a proof of concept for malware that installs via a PDF in Lockdown Mode and persists even after reboot. At this time there's virtually no real information, but this story is a reminder that nothing is unhackable. We await further details. iPhone Jailbreak Gets Past Lockdown Mode and Survives an UpdateJust over a week after jailbreaking an iPhone Duo on launch day, hacker team Calif is back with another jailbreak demonstration. This time, the group has jailbroken an iPhone in Lockdown Mode, and the jailbreak appears to persist across an iOS update. Calif shared a video of a jailbroken iPhone 18 Pro with Lockdown Mode on. From there, iOS 27.2 is installed, and the jailbreak remains in place after the update.MacRumorsJuli Clover ### Apple to Scan for Every Photo and File Shared Through a Public iCloud Link for Harmful Content Apple has recently updated their policy to state that they will begin scanning public share links for "harmful content" in iOS, iPadOS, macOS, and visionOS 27.3 and later. This will apply even if you have Advanced Data Protection enabled. It will _only_ apply to files that you have set to share with "anyone with the link." However, Apple has not clarified much else, including what counts as "harmful content," when the checks take place, what the review process is like, and more. Apple to Scan for Every Photo and File Shared Through a Public iCloud Link for Harmful ContentApple will begin checking photos and files shared through public iCloud links for harmful content with version 27.3 or later of iOS, iPadOS, macOS, and visionOS.CybersecurityNewsGuru Baran ### A YouTuber Figured Out How to Find Almost Anyone Using Airplane Sounds A YouTuber has shown a proof of concept in which he took footage from online, found frequencies that are inaudible to human ears, and used them to figure out which planes were overhead, and thus where the video was taken. This would require a lot of work (for a human at least), and can be defeated with some tools such as a high-pass filter, but it's a good reminder that sometimes what we upload can contain subtle clues we weren't expecting to share. YouTuber Geolocates Videos Using Airplane SoundsA YouTuber shows how the faint sounds of passing planes can reveal where a video was recorded, raising new concerns about location privacy.GizmodoTom Hawking * * * ## Forum Updates With Reddit becoming increasingly inaccessible, what are some other forums you guys like to check out?With Reddit becoming increasingly difficult to use privately, I’m wondering what other online forums you guys find useful or enjoyable.Privacy Guides Communityanonymous701

Our top stories this week: * Updated Google privacy policy says your Gmail might be used for advertising * French Court’s Site-Blocking Orders Drive Quad9 Out Of France * Discord is making its public communities more searchable, and people have concerns * Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning * * * ## TWIP Live 🔴 * * * ## Updates from the Team ### Upcoming Changes This week's GitHub commits were largely administrative: fixing a broken link and some incorrect grammar. Commits · privacyguides/privacyguides.orgProtect your data against global mass surveillance programs. - Commits · privacyguides/privacyguides.orgGitHubfriadev ### News Briefs This week's news briefs shared how Apple now allows selfie age verification as an option in iOS 27.2, systemd adding Rust support, and more! News Briefs - Privacy GuidesPrivacy Guides * * * ## Sources ### Google makes a privacy policy exception to use your Gmail and Photos data for ads Back in 2017, Google promised it would stop scanning Gmail content for targeted ads (though notably it could still scan for other reasons). This month, Google has somewhat reversed course by saying that now your Gmail and Photos can be used by their Personalized Intelligence tool across ads and other Google services. An example given by the article: "You might ask Google Search for restaurant recommendations near a hotel you’ve booked. With access to your Gmail, Search could pull up your reservation details and suggest places nearby." Google makes a privacy policy exception to use your Gmail and Photos data for adsGoogle’s updated Privacy Policy reveals how Personal Intelligence could use your Gmail and Photos data for targeted ads.Android AuthorityShimul Sood ### French Court’s Site-Blocking Orders Drive Quad9 Out Of France An going court case in France has finally been settled: Quad9 (the Swiss DNS provider known for blocking only malware and not keeping logs) is being ordered to stop providing traffic resolution to known piracy domains. Rather than comply (which would require them to either block the domains worldwide or start unreliably identifying French users), Quad9 has chosen to withdraw from France entirely, leaving the French with one less trustworthy DNS resolver. French Court’s Site-Blocking Orders Drive Quad9 Out Of FranceA nonprofit service that protects internet users’ privacy is leaving France. Quad9, a free DNS resolver, has said it will reluctantly stop serving users in France on November 24. This follows a French court order that Quad9 must block access to websites that are accused of infringing the copyrights…Electronic Frontier FoundationJoe Mullin ### Discord is making its public communities more searchable, and people have concerns Discord announced this week that certain public communities will become publicly searchable - even from outside Discord. The stated goal is to make Discord a place for people to find useful information that's otherwise normally buried in Discord conversations. According to Discord, more than 63,000 Discoverable Servers host discussions on everything from gaming strategies and fandoms to language learning and niche interests. By making some of these conversations searchable, Discord hopes to extend the reach of its communities beyond the platform itself. It's worth noting that this only applies to Public Communities - not all public servers, private servers, or DMs - and users can opt themselves out while admins can opt out entire servers. Discord is making its public communities more searchable, and people have concerns | TechCrunchIn December, messages from Discord’s public discoverable servers will begin appearing in search engine results.TechCrunchLauren Forristal ### Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning This week, 404 Media wrote two very damning articles about Proton. Proton appears to be heavily embracing AI, with allegations that CEO Andy Yen has "full AI psychosis." The second article (which we're linking for being most relevant) alleges that Andy is pushing devs toward unrealistic timelines, encouraging them to lean on AI far more for writing and testing code, saying that "I think by the end of this year most developers stop programming and start writing specs for tests that AI will code and run, to validate AI written code that humans will no longer be able to review. This will be the last year that we hire engineers, and starting next year we hire what we used to call product managers, to build things with AI.” Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI ReckoningProton CEO Andy Yen projects a calm persona and rails against Big Tech and critiques AI. Internally, he is pushing engineers to build Proton with AI, even when they have security concerns.404 MediaJoseph Cox * * * ## Forum Updates Linux GUI vs CLI UpdatesI don’t think it really matters much, as long as you’re getting your updates. Personally, I prefer to do my updates from the command line. It just feels faster than waiting for Discover (KDE software store GUI) to load my updates. (I’m a Fedora user too) Oh, also, Discover does a bad job of reporting errors, in my experience. My Flatpak updates regularly fail, and it was easier to figure out why when I used the command line (my VPN gets blocked, I have to switch to a different server). May I…Privacy Guides CommunityhashcatHitman Bitwarden dual license model Seems like Bitwarden is going through some changes. Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today. Bitwarden remains committed to open source security and transparency The GPLv3 OSS licensed version continues to be updated and published on GitHub All current features are available in both versions License details are on GitHub Bitwarden remains… Privacy Guides CommunityTrashPanda

Our top stories this week: * PHP ships emergency patches for critical PHP2Shell flaws * Someone Opened a CashApp In Her Name. She Faces Years in Prison * The Internet goes on high alert after discovery of 8 compromised TLS certs * Is Cellebrite sitting on an iPhone radio 0day? * * * ## TWIP Live 🔴 * * * ## Updates from the Team ### How the US Spies On Its Own Citizens How did a law meant to target foreign spies turn into a domestic surveillance system sweeping up millions of ordinary Americans without a warrant? In this video, we trace the full history of government surveillance, from punch cards and Operation CHAOS to Edward Snowden’s revelations and the modern debate over FISA Section 702. Discover how backdoor search loopholes allow the FBI, CIA, and NSA to query your private emails, texts, and digital files without showing probable cause, and what we can do to demand a Fourth Amendment warrant requirement. How the US Spies On Its Own CitizensHow did a law meant to target foreign spies turn into a domestic surveillance system sweeping up millions of ordinary Americans without a warrant? In this video, we trace the full history of govern…Neat.TubePrivacy Guides ### News Briefs This week's noteworthy headlines include a Signal bug that allows audio and video calls to stay connected even after hangup, thousands of budget Android phones around the world shipping preloaded with malware, Meta fixing a big that cause their smart glasses to record when not intended, and more. Privacy & Security NewsThe latest news in data privacy, cybersecurity, and consumer rights brought to you by Privacy Guides.Privacy GuidesJonah Aragon * * * ## Sources ### PHP ships emergency patches for critical PHP2Shell flaws This week's most notable part of the digital apocalypse was PHP2Shell, two high-severity vulnerabilities impacting the PHP scripting language, which is used on over 70% of servers. Numerous websites were taken offline temporarily while sysadmins waited for patches to become available, but research suggests that the vulnerabilities began being exploited days before disclosure and experts worry that millions of sites will go unpatched for a variety of reasons, including using end-of-life versions. PHP ships emergency patches for critical PHP2Shell flawsThe PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.BleepingComputerSergiu Gatlan ### Someone Opened a CashApp In Her Name. She Faces Years in Prison Amanda Smith of Pennsylvania is being charged with fraud after someone apparently stole her identity and used it to scam someone on Facebook Marketplace for $1,000 in Arkansas. Unfortunately, she now finds herself in the difficult spot of having to prove her innocence. CashApp would not cooperate at first and give her information about the fake account because she (obviously) could not prove ownership. Once data was handed over in discovery, a lot information still doesn't seem to add up, such as devices, phone networks, and other information. Someone Opened a CashApp In Her Name. She Faces Years in PrisonAmanda Smith is charged with computer fraud due to a scam CashApp account being in her name. But in a Kafkaesque situation, CashApp won’t provide her any information because she can’t prove she is the owner.404 MediaJoseph Cox ### The Internet goes on high alert after discovery of 8 compromised TLS certs This week's cybersecurity apocalypse began with the discovery that Indian Certificate Authority eMudhra had been issuing TLS certificates (which enable the "S" in "HTTPS" and make the internet safer for things like ecommerce and private communications) with incredibly weak keys: just numbers ranging anywhere from one to three digits in length. Experts are struggling to understand how this happened and warn that this could take years to clean up as the affected certificates impact not just browsers, but also IoT devices, Linux distros, Docker containers, and more. The Internet goes on high alert after discovery of 8 compromised TLS certsIntermediate certs allow anyone to mint web credentials for any Internet server.Ars TechnicaDan Goodin ### Is Cellebrite sitting on an iPhone radio 0day? The author of this post reports a leaked Cellebrite marketing material from this year that claims to work on After First Unlock iPhones (11-16), bypassing Stolen Device Protection and working at a range of about 8 meters. The author then proceeds to speculate on why the believe this a Bluetooth vulnerability, and discuss the future of cybersecurity and phone hardening. ✍️ Is Cellebrite sitting on an iPhone radio 0day? · justin.sh * * * ## Forum Updates Kim Dotcom, Signal has US gov backdoorDoes Kim has a point we don’t know off? Or is he trying to push people willingly away from Signal? Any opinions? Kim Dotcom says Signal has a US government backdoor, calling it the least secure messaging app of all. Dotcom claims the US government is laughing at Signal because everyone uses it and they have a way in anyway. His only remaining advice: use no communication tools at all.Privacy Guides CommunityLoSee21 Does Google “Plan for your digital legacy” actually delete your account? Hello lovely people of this forum! I’m degoogling, but no matter what I do, I can’t delete my Google account, I constantly get hit with a “we couldn’t verify it’s you” message and it won’t let me do anything. As a last resort I set up this “plan for your digital legacy” option which supposedly deletes your account after 3 months of inactivity. It also lets “trusted contacts” download your data, but I didn’t add anyone. Does this actually work? has anyone actually deleted their account this way… Privacy Guides CommunityMintChoco

YouTube video by MicrobeTV

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

Our top stories this week: * Ledger confirms spy chip implant behind wallet crypto thefts * Fridge hack costing millions and sparking fires stemmed from poor security * PSA: Google is silently linking your phone number across all signed-in accounts * ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads * * * ## TWIP Live 🔴 * * * ## Updates from the Team ### News Briefs This week's news briefs discuss Android's next gen secure enclaves for AI security, the Pwn2Own conference in Ireland, and more! Privacy & Security NewsThe latest news in data privacy, cybersecurity, and consumer rights brought to you by Privacy Guides.Privacy GuidesJonah Aragon * * * ## Sources ### Ledger confirms spy chip implant behind wallet crypto thefts Several ledger hardware crypto wallets resold in Southeast Asia by CryptoBilis have been found to contain a modification that read the screen and sent the seed phrases back to an unknown party via an embedded SIM card. Investigation is still ongoing on who's behind the attacks and how widespread the compromise is. Ledger confirms spy chip implant behind wallet crypto theftsLedger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users’ cryptocurrency wallets.BleepingComputerBill Toulas ### Fridge hack costing millions and sparking fires stemmed from poor security Earlier this week, a hack impacted supermarkets across Europe but mostly in France. Attackers raised the temperatures in grocery store fridges and freezers to spoil food and in some cases start fires. It turns out that many of the hacked devices were running outdated firmware and using poor default passwords that were easily findable online. Fridge hack costing millions and sparking fires stemmed from poor securityIncident hitting 700 supermarkets exploited outdated devices exposed to the Internet.Ars TechnicaDan Goodin ### PSA: Google is silently linking your phone number across all signed-in accounts Google has quietly updated their policies to now add your SIM number to every Google account you're signed into on your Android phone. The original intent of this feature (according to Google) was to ensure that you don't forget to keep your information up-to-date, but it's pretty easy to see how this could be unwelcome behavior if you're signed into secondary accounts, work accounts, or more. https://www.androidauthority.com/google-auto-phone-number-verification-android-3723117/ ### ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads For the first time ever, researchers have confirmed state-level spyware is being spread through advertising. This is made possible in part because the advertising delivery system - called Real-Time Bidding - is already a privacy nightmare, making ads a perfect attack vector to deliver a payload only when it detects a specific device or device meeting specific criteria. This the first time a zero-click mercenary malware has been confirmed using this attack vector. ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted AdsResearchers at The Citizen Lab have for the first time released technical evidence of sophisticated mercenary spyware being distributed via online advertising.WIREDMatt Burgess and Lily Hay Newman * * * ## Forum Updates [Beta] Join our community on Fluxer! 💬 (Remember your DMs are not E2EE)➡ https://fluxer.gg/46pWZyig Hello everyone, I want to invite you to test out the Privacy Guides community on Fluxer 🥳 Fluxer is a chat app with text, voice, video, and screen sharing. I’ve been looking at it since February when it got its first major bout of attention, but it was lacking a good deal of things I wanted (like, a mobile app for example lol). However, I’ve been testing it out again over the last weekend and it is a lot more exciting now than it was hal…Privacy Guides CommunityjonahPasskeys are a trap. Do not use themI’d be interested to know what others think of what this article says about passkeys and whether they should actually be used.Privacy Guides CommunityMxyzptlk