❌

Normal view

Received — 25 September 2026 ⏭ Tech

Meta Made 43M Misleading Statements, New Mexico Jury Finds, Including on Its Cambridge Analytica Response

✇Slashdot
By: EditorDavid
25 September 2026 at 21:34
A New Mexico jury on Friday "found Facebook liable for deceiving users" about its privacy protections, reports the Associated Press. A New Mexico newspaper calls it "another massive legal victory" against Facebook, reporting that the jury found Facebook "had committed tens of millions of violations of the state's Unfair Practices Act in connection with its lies to consumers about how their personal information was handled by the company and third-party users." The state has asked the company be ordered to pay the maximum civil penalty of $5,000 per violation meaning a judge could potentially order the company to pay billions in penalties to the state. The jury also found the company had been dishonest about its investigation of and response to the 2013 Cambridge Analytica data breach scandal, in which approximately 300,000 Facebook users took an online personality quiz, only to have the app that hosted the quiz harvest data from tens of millions of their "friends." The data was then transferred to the British consulting firm, which used it to create targeted political ads during the 2016 U.S. presidential election. More details from Reuters: The verdict followed a two-week trial over a lawsuit filed by New Mexico's attorney general in 2021, three years after news reports revealed that the firm, Cambridge Analytica, had harvested personal data from as many as 87 million Facebook users through a third-party app... At a press conference after the verdict was announced, New Mexico Attorney General Raúl Torrez said the case revealed "in stark detail the way in which this company plays fast and loose with the rules." Jurors found 26 of 29 statements identified by the state were misleading, including comments about user data... Judge Francis Mathew will now determine civil penalties after jurors found more than 43 million violations, based on the number of people affected by the company's misleading statements... [New Mexico Attorney General] Torrez said his office is evaluating how much to seek but will push for the maximum penalty based on the jury's findings. The state will also ask [Judge] Mathew to direct Meta to make changes, which could include corrections to its past misstatements as well as an audit of the way it manages user data, Torrez said.

Read more of this story at Slashdot.

I feel like fewer people might start using WordPress in the future…

✇WordPress
By: /u/InevitableClassic938
25 September 2026 at 19:03

With AI evolving so quickly, I think we’ll see more and more websites being built directly with code rather than using platforms like WordPress.
Maybe WordPress will eventually become less common, and honestly, it makes me a little sad to think about. I’ve spent a lot of time working with WordPress, so it would be a little bittersweet to see it slowly disappear. 😢

submitted by /u/InevitableClassic938
[link] [comments]

Your Website may be used by hackers to link casino website without you knowing. Check yours now!

✇WordPress
By: /u/Proper-Neighborhood6
25 September 2026 at 18:58

This is real world example how we caught this exploit on our clients website!

The exploit:

It's called wp2shell (CVE-2026-63030 and CVE-2026-60137). It affects WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. The fix was released on July 17 (7.0.2, 6.9.5 and 6.8.6). A public proof of concept exists, so bots scan the internet for unpatched sites automatically. Nobody targets you personally. Client website missed the update for about a month and got hacked on August 22. While checking our own servers we could see that other websites got the same attack in September, but they were already updated and it failed.

What they did?

- Created hidden admin accounts. They don't show up under Users in wp-admin.

- Installed a backdoor that puts itself back if you delete it. It lives in several places at once: `wp-content/db.php`, a file in `mu-plugins`, code at the end of `wp-config.php` and in theme files, hidden files in `wp-content/upgrade` and `wp-content/uploads`, and copies in the database. Clients host's malware scanner kept deleting files for weeks and they kept coming back.

- Got full remote control of the site.

- Turned off page caching for the whole site. That made the site slow: Search Console flagged slow mobile loading.(could be a sign)

Who they linked and why

Only when Googlebot opened the homepage, the site showed 89 links to UK websites (.co.uk and .org.uk) promoting "non GamStop" casinos. GamStop is the UK program people use to block themselves from gambling, so these casinos target people who are trying to stop. Regular visitors saw a normal page. The linked UK sites look like old small business and charity sites that were taken over too. The point is to borrow Google trust from real websites and pass it to casino pages. We found no redirects and no stolen passwords or form data.

What it means for the site owner

- Google sees your site linking to casino spam. That can bring a manual action or a security warning in Search Console.

- The site is slow because caching is off.

- The attacker could read everything on the hosting account, so treat database passwords and other secrets on that account as leaked.

How to check your site

  1. Check your WordPress version under Dashboard > Updates. If it's below 7.0.2 (or 6.9.5 / 6.8.6 on older branches), update now. If it was below that at any point after July 17, do the checks below.
  2. Open the users table in phpMyAdmin, not in wp-admin, and look for admins you don't recognize. They used emails ending in u/wordpress.org and names like backup_manager and cache_sync.
  3. In File Manager, look for `wp-content/db.php`, unknown files in `wp-content/mu-plugins`, files starting with a dot in `wp-content/upgrade` and `wp-content/uploads`, and anything after the `require_once ABSPATH . 'wp-settings.php';` line in `wp-config.php`.
  4. Load your homepage as Googlebot: `curl -A "Googlebot/2.1" https://yoursite.com/ | grep -i gamstop`. If anything comes back, you're infected.
  5. If you use LiteSpeed Cache, check "Do Not Cache URIs". A single `/` there turns off caching for every page.
  6. Check Security issues and Manual actions in Search Console.

If you find it

Make a backup first. Then remove every part in one go: files, database entries and hidden users. If you miss one, it brings the rest back. Reinstall WordPress core, your theme and plugins from clean copies, and change the salts and database passwords. Then request indexing of your homepage in Search Console. You are welcome stay stafe!

submitted by /u/Proper-Neighborhood6
[link] [comments]

[PROMO] Can you figure out how this Gutenberg plugin works without a tutorial?

✇WordPress
By: /u/CNS_77
25 September 2026 at 12:10

I’m developing Block Class Manager (BCM), a free plugin for Gutenberg, and I’d like to test something very specific: is the workflow understandable on its own?

BCM is built around a simple class-based workflow for Gutenberg. Instead of adding a large collection of blocks, it provides a lightweight foundation block with a few essential variations (Text, Media, Heading and Button) all using the same styling interface.

You can work with responsive styles, reusable Global CSS Classes, and HTML attributes within the same workflow, making it easier to build and maintain consistent layouts across screen sizes.

The other main part is Global CSS Classes: instead of recreating the same styling for every block, you can define a class once and reuse it across your layouts. You can also combine Global Classes with local block styles when you need something specific to a single element.

The goal is to have a more reusable and consistent way of styling Gutenberg layouts, while keeping the workflow lightweight and close to the native block editor.

BCM workflow inside the Gutenberg editor.

I know there are already plugins that provide some of these features. I’m not trying to reinvent everything. I’m exploring a particular workflow where you can create and apply reusable Global Classes directly while working with a block, rather than having to manage styles separately. I’d like to see how intuitive this feels to Gutenberg users.

If you use Gutenberg, I’d really appreciate it if you could install it and try it without reading the documentation or watching a tutorial first.

Try to:

  • Create a simple layout with the BCM blocks
  • Change the layout responsively
  • Create and use a Global Class
  • Figure out the difference between local styles and Global Classes

Then tell me:

  • What did you understand immediately?
  • Where did you get stuck?
  • Was anything confusing?
  • Did anything work differently from what you expected?

I’m not looking for compliments. I’m trying to find the parts of the workflow that aren’t obvious enough.

Even if you find the workflow confusing or something doesn’t make sense, that’s useful feedback for me.

I’d love to hear what you think in the comments, especially if something feels confusing or unintuitive.

👉 Block Class Manager on WordPress.org

Thanks to anyone who takes the time to give it a try!

submitted by /u/CNS_77
[link] [comments]

There's a New Way to Break RSA Encryption

✇Slashdot
By: EditorDavid
25 September 2026 at 17:04
"Signature forgery." It's a new way to break RSA keys — and it doesn't require factoring. Ars Technica reports on new research using classical computing to "reduce the current RSA security level to an unacceptably low threshold" and lower the required computing resources by orders of magnitude. There's "a gap in current RSA-type security assumptions," according to a paper co-authored by University of California, San Diego professor Nadia Heninger, who argues that gap "gives classical cryptanalytic evidence in favor of moving away from RSA entirely during the current post-quantum transition." The practical risk is limited, but still significant. Applying the attack against the deprecated use of 1024-bit keys took a handful of months on an academic CPU cluster, significantly less than the current estimates for 1024-bit factoring that would require resources that only nations or companies with massive resources could achieve. Widely used RSA implementations are also safe. Nonetheless, the research has taken cryptographers by surprise... "If this result holds up under peer review, it would indeed be a conceptual break-through," Karsten Nohl, a cryptography expert and the head of innovation at Allurity, said in an interview. "RSA is as difficult to break as it is to factor large integers, at least so we thought. The researcher suggests that you can practically break RSA without cracking its key...." The key forgery attack Heninger and the other researchers devised poses an immediate threat to 1024-bit RSA. Even for 2048- and 4096-bit keys, the method reduces the security of RSA to unacceptable levels. The National Security Agency, National Institute of Standards and Technology, and European Union Agency for Network and Information Security require that any cryptosystem should provide a level of no less than 128 or more bits, meaning the operations required must exceed 2**128. The forgery attack drops these levels to 2**65, 2**90, and 2**119 for 1024-, 2048-, and 4096-bit keys respectively. These levels may further drop because Heninger's team did all the coding by hand and used no AI or GPUs in performing the forgeries. The researcher said these tools will "almost certainly" drop the security levels further. The attack works only against blind-signature implementations of RSA... Still, some real-world systems continue to use blind-signature, also known as textbook, RSA... The paper's authors and other researchers stress that the new attack poses little real-world threat. It does, however, drastically lower the estimated security of textbook RSA, and it does so in a way no one knew of previously... The new attack will further increase the urgency of completely moving away from the cryptosystem. Thanks to long-time Slashdot reader phatrabt for sharing the article.

Read more of this story at Slashdot.

How do RevOps teams catch issues before they start affecting revenue?

✇CRM - Customer Relationship Managment
By: /u/Excellent-Salary3565
25 September 2026 at 14:43

I’m doing a bit research on how RevOps teams handle this problem today.

Let’s suppose something breaks somewhere in the revenue stack:
- a Salesforce/HubSpot workflow stops working
- attribution data starts drifting
- leads stop routing correctly
- billing and CRM data stop matching
- pipeline data becomes inaccurate

The issue might sit there for hours or days before someone notices it through a dashboard, a rep complaining, or a number suddenly looking wrong.
How do you catch these problems before they actually start affecting pipeline or revenue?

Do you already have something that tells you which operational issues are becoming financially important, or is it mostly dashboards, alerts, manual checks, and people noticing something looks off?

Trying to understand whether this is a real problem before building anything around it. Would especially like to hear from RevOps, SalesOps, Revenue Systems, or Revenue Engineering people who deal with this regularly.

submitted by /u/Excellent-Salary3565
[link] [comments]

[PROMO] I got tired of recurring events being a paid feature, so I released a calendar plugin where they aren't

✇WordPress
By: /u/thejester1324
25 September 2026 at 14:18

Every events plugin I tried puts the same three things behind a paywall: recurring events, shortcodes, and a grid view. The big one is $99/yr for recurring alone, and it went up 33% in February.

For a church, a library, a running club — the calendar is the recurring events. "Every second Tuesday" is the whole use case. Paying $99/yr for that felt backwards, so I put out a free one where it isn't paid:

  • Recurring events: daily/weekly/monthly/yearly, "second Tuesday", "last Friday", end after N times or on a date, skip dates
  • Google Calendar / ICS import on an hourly schedule, with a visible log of what changed each sync — no silent drift
  • Month and list views as blocks and shortcodes, styled by your theme, not by me
  • Venues with an address and a map link (a link, not an embedded map slowing your page down)
  • ~30 KB, styles load only on pages that show events, no add-on store, no upsell banners anywhere in wp-admin
  • "Delete everything on uninstall" is an option you turn on, off by default

Everything above is free and stays free — I'm not going to paywall the calendar.

It's new, so it's unproven. If you try it and something's broken, tell me here or in the support forum and I'll fix it that day. GPL, on the repo: https://wordpress.org/plugins/beacon-events/

submitted by /u/thejester1324
[link] [comments]

How I handle AI transparency disclosures across client WordPress sites (and the EU AI Act deadline)

✇WordPress
By: /u/Interesting_Yam_8807
25 September 2026 at 13:48

I've been freelancing as a WordPress developer for a few years now, and over the past 6 months, one issue has come up in almost every client conversation: AI disclosure.

Clients are using AI tools for drafting, images, product descriptions — but almost none of them have any system for tracking what was AI-generated, how much AI was involved, or how to prove it if asked.

I tried a few approaches:

· Spreadsheets and manual notes (fell apart immediately at scale)

· Client-side disclaimers buried in footers (not compliant, easy to miss)

· Custom post meta fields (no audit trail, no visitor-facing transparency)

None of it worked. So I ended up building a lightweight toolkit for myself called MegaGovern.

Here's the workflow I landed on:

  1. Declare — Every post gets classified as one of four states: Human, AI-Assisted, AI-Generated, or Synthetic Media. You can do this per-post or bulk-update legacy archives.

  2. Disclose — A visitor-facing badge shows the disclosure status directly on the front end. No hiding it in a footer.

  3. Verify — For images, it scans EXIF metadata and C2PA standards so you know what's actually in the file.

  4. Preserve Evidence — It generates cryptographic PDF logs and ai.txt protocols that you can hand to a client or regulator. Tamper-evident audit records.

The whole thing runs local-first — all data stays in your WordPress database. No external API calls, no cloud service scanning your content.

Why I'm sharing this:

The EU AI Act transparency requirements (Article 50) are already in effect, and a lot of WordPress agencies and freelancers I talk to are completely unprepared. I built this for my own client work, but I've since released it as a plugin.

Full disclosure: I'm the developer behind MegaGovern. There's a free tier that covers manual classification, branded badges, ai.txt generation, and 30-day audit logs — genuinely free, no feature locks. Paid tiers add AI scanning, C2PA checks, and signed PDF reports.

If you're dealing with AI disclosure for clients, I'm happy to answer questions about the compliance side, the WordPress implementation, or anything else. What approach are you all taking right now?

submitted by /u/Interesting_Yam_8807
[link] [comments]

Asteroids Named After Tom Lehrer and 'Weird Al' Yankovic

✇Slashdot
By: EditorDavid
25 September 2026 at 12:34
"Weird Al" Yankovic's name has just been approved for a new asteroid — (14331) Alyankovic = 1981 EC26 — by the International Astronomical Union, reports Space.com. Yankovic's asteroid was championed by planetary scientist Allison McGraw joined by "several heavy hitters in the planetary science field, according to the Tucson Star. (Astrophysicist Steve Desch from the School of Earth and Space Exploration at Arizona State University; Tim McCoy, one of the main curators of meteorites at the Smithsonian Institution; and University of Arizona research scientist Melissa Brucker, leader of the Spacewatch program, which has discovered more than 179,000 asteroids.) The scientists also convinced the International Astronomical Union to name an asteroid after one of Yankovic's major influences, famous musical humorist and political satirist Tom Lehrer, who died last year at age 97. Lehrer's work includes "The Elements," a 1959 song in which he recites the entire periodic table to the tune of Gilbert and Sullivan's "Major-General's Song." "He was a mathematician and teacher and also wrote math- and science-themed songs," McGraw said. "We felt that someone who had that kind of science enthusiasm really deserved to have their name up in the sky...." McGraw is hoping that naming space rocks after stars like Lehrer and "Weird Al" will cast some reflected light on two things she's passionate about: asteroid research and science communication. Six years ago a 92-year-old Tom Lehrer released all his lyrics into the public domain. (Wikipedia notes he'd "largely retired" by the 1970s to become a mathematics teacher at the University of California, Santa Cruz.) Slashdot ran a brief career retrospective when Lehrer died last year at age 97. And the IAU writes that "Generations of scientists have been inspired" by Weird Al Yankovic's "comedic musical works, including 'It's All About the Pentiums' and 'White and Nerdy'." ("I'm fluent in JavaScript as well as Klingon," Yankovic sings in the latter.) He appears in a song envisioning a rap battle between Bill Nye the Science Guy and Sir Isaac Newton... And in 1999 he recorded a five-minute summation of Star Wars: Phantom Menace, sung to the wistful tune of Don McLean's American Pie. Performing it last month in a NPR Tiny Desk concert, "most of the audience was singing along," remembers an interviewer at NPR. "It felt like something that was very personal to them." Weird Al: It's one of those songs that means a lot to people, particularly "Star Wars" fans, of course. But I mean, I see a lot of people in the audience cosplaying as Jedi Knights and waving their light sabers... I've even heard that, you know, they play that song at "Star Wars" conventions, and people get weepy... [I]t really hits people in a tender place somehow... "Oh my, my, this here Anakin guy may be Vader someday later, now he's just a small fry. And he left his home and kissed his mommy goodbye, sayin' soon, I'm gonna be a Jedi." Yankovic has led a geek-friendly career. In the heyday of Napster, he released an anthem-style parody mocking the arguments of the Recording Industry Association of America, titled "Don't Download This Song. ("Even Lars Ulrich knows it's wrong...") "Once in a while maybe you will feel the urge To break international copyright law... you start out stealing songs, then you're robbing liquor stores And selling crack and running over school kids with your car..." As a student at Cal Poly, San Luis Obispo, Yankovic bootstrapped a career in 1979 by recording his first novelty song "My Bologna" (a parody of "My Sharona" by the Knack) while playing his accordion in a bathroom for its acoustics. And even the IAU acknowledged the geeky themes in his 1999 song "It's All About the Pentiums" (a filk on Puff Daddy's "It's All About the Benjamins"). "You're usin' a 286? Don't make me laugh Your Windows boots up in what, a day and a half? You could back up your whole hard drive on a floppy diskette You're the biggest joke on the Internet..."

Read more of this story at Slashdot.

Using Local for staging WP sites locally

✇WordPress
By: /u/Known_Hippo4702
25 September 2026 at 11:55

Local has really been a great tool for my work flow, but I have one question.

I keep my staging sites on external drives and I work from a couple of different laptops. On the external drive I have a folder 'local sites' and within that folder I have different staging sites. I am using updraft to backup and restore between online production and offline staging sites. The question is; how can I move that external drive between various laptops and desktops without having to create unique copies of the sites?

submitted by /u/Known_Hippo4702
[link] [comments]

A WordPress form can say 'sent' while the inquiry never arrives

✇WordPress
By: /u/Big-Branch-8532
25 September 2026 at 11:44

Hypothetical: a service business changes the email address for its WordPress contact form. The form still says 'sent', but new inquiries stop reaching the team.

Send one test from a phone with a unique phrase in the message. Look for that phrase in the form plugin's saved entries, then the inbox and spam folder, then the CRM. The first missing handoff tells you where to investigate. A success screen alone doesn't prove anyone received the lead.

Which step has failed for you: the form, email delivery, or CRM sync?

submitted by /u/Big-Branch-8532
[link] [comments]

Can I update an expired SSL certificate through a WP plugin alone?

✇WordPress
By: /u/aliengoddess2010
25 September 2026 at 10:06

Hello all! I'm the owner of a small business WordPress site that was set up by a local third party who also manages my web hosting. (I do not have access to the hosting panel or FTP files). This person has become unresponsive and I have an SSL certificate that has been expired for two months. Is there a quick fix via WordPress to renew the expired SSL certificate while I figure out how to reclaim my website from the unresponsive developer? The WP Encryption plugin seems very highly reviewed but I'm not sure if it will work in my case. I'm open to any ideas. Thanks in advance!

UPDATE: It's a miracle...I finally got a hold of the developer/reseller and got the SSL cert issue resolved. He is phasing out his freelance work and says he'll help me get migrated over to new hosting at the end of the year. Thank you to everyone who responded!

submitted by /u/aliengoddess2010
[link] [comments]

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

✇The Hacker News
By: [email protected] (The Hacker News)
25 September 2026 at 09:44
Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

✇The Hacker News
By: [email protected] (The Hacker News)
25 September 2026 at 08:18
Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. "Where earlier variants embedded their payload key material

how early is too early for a crm? hubspot for startups

✇CRM - Customer Relationship Managment
By: /u/Gremain_Mehan
24 September 2026 at 05:57

we've been using a spreadsheet since the beginning and honestly it wasnt a problem until recently. now we're getting more leads, more follow ups and more people touching the same accounts, so things are getting a little chaotic. someone will update a deal in the spreadsheet but forget to mention something important from the latest call, or a follow up gets buried in someone's calendar. nothing disastrous, just a lot of little things that are starting to add up. we're looking at hubspot, was there a specific number of leads, sales reps or some other problem that made you pull the trigger?

submitted by /u/Gremain_Mehan
[link] [comments]
❌