It is the time of year when time zones are out of sync and every single meeting that I have on my calendar has had a scheduling mix-up.

Researchers at TrendAI concluded the Israeli company Discover-Tech was one of the biggest sources of digital ads shown to users of SpaceX's Starlink service and that the ads were likely being used to geolocate or otherwise surveil them.

https://www.reuters.com/business/media-telecom/alleged-israeli-spy-company-heavily-targeted-starlink-users-sources-say-2026-10-27/

Here I am trying to enjoy a little victory in Serbia and Brazil, but also there is a Hell and we are in it.

https://www.wired.com/story/ai-agents-are-trying-to-be-journalists-now/

This is terrible news. Rest of World has done some of my favorite tech journalism over the years: https://www.semafor.com/article/10/25/2026/rest-of-world-faces-prospect-of-shutting-down

Guy in the vintage store trying to explain what he is looking for to a store employee: "Have you ever seen Torchwood?"

Me: "Oh, you're looking for a Jack Harkness coat."

I hope he finds a Jack Harkness coat and wears it all the time.

I understand that there are people who think we must pass through the Vulnpocalypse to get to Vulnhallah, a time when all code is written by AI then checked by AI and has no vulns that AI can find, while we sit back and feast. But I don't think we can get there from here.

I see it is time to change this slide in my upcoming talk from "Vulnpocalypse Now?" to "Vulnpocalypse Now!"

No, really, these PHP vulns are quite serious and you should drop everything and patch. https://www.php.net/index.php

Another day, another story where my work on mass surveillance overlaps with my work in domestic abuse in the most terrible goddamn way.

WaPo found cops who kept using Flock to spy on women after they left the force.
One used it for five years after retirement, tracking his wife during a custody battle.
Another ran searches while he was suspended (and later fired) after killing a 15-year-old boy.

https://www.washingtonpost.com/technology/2026/10/21/their-police-jobs-ended-they-kept-using-flocks-vast-surveillance-network/?pwapi_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZWFzb24iOiJnaWZ0IiwibmJmIjoxNzkyNTU1MjAwLCJpc3MiOiJzdWJzY3JpcHRpb25zIiwiZXhwIjoxNzkzOTQxMTk5LCJpYXQiOjE3OTI1NTUyMDAsImp0aSI6IjkzNGFjMDEwLTQyMWQtNGNhNy04ODlkLTE4ZTQzZjBhZjE2ZiIsInVybCI6Imh0dHBzOi8vd3d3Lndhc2hpbmd0b25wb3N0LmNvbS90ZWNobm9sb2d5LzIwMjYvMTAvMjEvdGhlaXItcG9saWNlLWpvYnMtZW5kZWQtdGhleS1rZXB0LXVzaW5nLWZsb2Nrcy12YXN0LXN1cnZlaWxsYW5jZS1uZXR3b3JrLyJ9.8ifuXWrPb_08oQYHEMV1iv0ogHP6b_oJLriFrDpLt68

When a platform offers you privacy, always ask "Privacy from whom?"

"Of course, while locking a chat can limit access, it doesn’t address concerns about how sensitive information is stored or handled...locking a chat doesn’t create end-to-end encryption or a separate encrypted vault, change how long it retains the chat, remove information that ChatGPT remembered before a chat was locked, or change the 'Improve the model for everyone' setting."

https://techcrunch.com/2026/10/20/chatgpt-now-lets-you-lock-your-chats/

New York is the one place on Earth where I quickly realize that I don't jaywalk aggressively enough.

Today I learned that Andy Ngo has written a book about the Zizians.

Everything about that sentence is deeply, deeply cursed.

"This report exposes zero-click spyware delivered via targeted ads, which we call AdFection, and is the first technical demonstration that mercenary spyware is being distributed via targeted advertisements."

True. All of the other examples I can think of involve govts that roll their own malware.

Additional highlights from the Citizen lab report include:

"Discover-Tech...also leveraged the European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union."

https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

If you would like a good laugh, please note that Candiru has changed its name to "Integrity Labs."

Citizen Lab finds Candiru's mercenary spyware on the phones of Al Jazeera journalists, infected using Discover Tech to deliver the malware using targeted ads. https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

ChatGPT now lets you target ads based on specific prompts or any phone number or email address. This is absolutely 100% going to be used for harassment.

https://www.404media.co/how-chatgpt-targets-ads-to-you-based-on-your-prompts-phone-number-and-email/

Elevation Lab pulls its AirTag silencing tool. Good things can still happen, occasionally through the power of shame. Kudos to @glennf on this one: https://www.elevationlab.com/blogs/news/an-apology

RE: https://mementomori.social/@maijanlainen/117435589734913543

My Mastodon replies continue to be very cool and normal.

so @kimzetter absolutely killin it today reporting on implants in crypto wallets - including some from authorized sellers.

https://www.zetter-zeroday.com/who-is-planting-backdoors-in-ledger-crypto-wallets/

https://www.zetter-zeroday.com/trezor-wallets-also-compromised-with-implants/