Surveillance Report: Weekly News For Digital Freedom

Congress now has two site-blocking bills, and one of them would force VPNs and encrypted DNS providers to block websites for Americans. Plus: ShinyHunters hacked the FBI and someone stole 3 million Pentagon personnel records, Chat Control 2.0 stalled in the EU (for now), and Meta's Muse AI agent is already off to an a*muse*ing start to privacy and security.

Go Incognito v2 is launching Monday! I'm running a pre-launch 25% discount + a 'Day Zero' badge, just use code V2LAUNCH: https://learn.techlore.tech/go-incognito-v2?coupon=V2LAUNCH

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/congress-comes-for-vpns-plus-fbi-pentagon-hacks-and-chat-control-defended/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (00:42) - HIGHLIGHT: MORE VPN SHENANIGANS
• (07:00) - GO INCOGNITO V2 IS HERE!
• (09:38) - THEY HACKED THE FBI
• (11:52) - CHAT CONTROL DELAYED
• (14:20) - META'S MUSE: TALE AS OLD AS TIME
• (19:30) - DEFENSE BULLETIN: DATA BREACHES
• (21:46) - DEFENSE BULLETIN: THREATS
• (29:10) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

A hacker emailed Revolut pretending to be a government agency, and Revolut handed over customers' passports, IDs, and financial details. Plus: the global age-verification wave forcing even more ID collection (EU, California, Microsoft), OpenAI's rogue AI agents and why I've hit a breaking point with these companies, and the usual run of data breaches, threats, and open-source updates. Correction: it's really DMARC that stops the spoofing, misspoke! Set up SPF, DKIM, and DMARC together.

In this episode:

• Highlight, The hidden cost of handing over your ID: the Revolut impersonation breach, IDScan's confirmed 150M+ license leak, and the Florida DMV/ShinyHunters breach
• The global age-verification wave: the EU's under-15 proposal, EDRi's critique of the eID wallet, California's new laws (the good and the bad), and Microsoft's new Windows age APIs
• OpenAI's rogue agents: the German-wiki hijack, 10+ more undisclosed sites, and why Henry's patience with AI companies has run out
• Defense Bulletin: breaches (AdaptHealth, Berlin, Trezor, Surfshark, Mathspace, Veradigm), threats (Pixel modem zero-day, Chrome, Nightmare Eclipse's exploit spree, a new Android VPN leak, LG TVs), and FOSS+ (Tor, Tails, CalyxOS, GrapheneOS RCS, Control D on Tailscale, Homebrew 7.0, and more)

🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com/
Thanks to the EasyOptOuts team for sponsoring Surveillance Report!

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/no-hack-needed-how-revolut-leaked-your-passport-plus-new-age-verification-rogue-ai-agents/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (01:04) - REVOLUT + OTHER ID LEAKS
• (07:36) - AGE BANS & AGE VERIFICATION
• (12:24) - OUR SPONSOR: EASYOPUTOUTS!
• (13:30) - CREEPY AI COMPANIES & CEOS
• (17:48) - DEFENSE BULLETIN: DATA BREACHES
• (20:50) - DEFENSE BULLETIN: THREATS
• (26:22) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

An ID-verification company, IDScan.net, appears to have leaked scans of 153 million driver's licenses, then sold on a dark-web market called Nexus. This week I break down why this breach is the perfect example of everything wrong with ID uploads, plus Chrome officially pulling uBlock Origin and AdGuard from the Web Store, California's age-verification bill carving out a Linux exemption, and Florida and Texas stepping back from Flock license-plate readers, plus the usual data breaches, threats, and open-source updates.

In this episode:

• Highlight: 153M driver's licenses leaked via IDScan.net, sold on Nexus, FBI investigating, plus what to actually do (freeze your credit, minimize ID uploads)
• Chrome officially removes uBlock Origin & AdGuard. Manifest V2 is dead in big-tech browsers (and what still supports it)
• California's age-verification bill passes with a Linux / open-source exemption, plus EFF's push against AB 1709
• Florida & Texas step back from Flock and license-plate readers
• Data breaches: McKesson (ShinyHunters), Aesto Health (9.5M), Carhartt (12.9M), Manchester Airports Group, Novocure, Hasbro
• Threats: critical Elementor Pro, All-in-One WP Migration, GiveWP, Plex, Gitea, malicious Chrome extensions, and a "free movies" box you should avoid
• FOSS+: Firefox 155, Tails 7.12, Mullvad DNS shutting down (switch to Quad9 before Nov 2), Brave email aliases, LibreOffice 26.8, Organic Maps, CalyxOS on the Fairphone 6, and EFF's doxxing-safety guides

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/153-million-drivers-licenses-for-sale-plus-chrome-kills-ublock-origin-texas-kicks-out-flock/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (00:40) - HIGHLIGHT: ID BREACH
• (05:52) - F IN THE CHATS FOR MV2
• (08:00) - CALIFORNIA'S LINUX CARVE-OUT
• (12:42) - TEXAS & FLORIDA DEFLOCK
• (14:22) - DEFENSE BULLETIN: DATA BREACHES
• (17:40) - DEFENSE BULLETIN: THREATS
• (21:24) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

Four positive VPN stories in one week: Mullvad's new multihop modes, Obscura shipping on Windows, Apple quietly patching the iCloud Private Relay leak, and Firefox's free VPN rolling out to Android. Then it gets darker: Flock built an AI tool that turns license plates into names, addresses, and relatives. Meta settled for billions over harms to kids. Plus X sent cease-and-desists that took Nitter and XCancel offline, and the usual data breaches, threats, and FOSS+ updates.

🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com/
Thanks to the EasyOptOuts team for sponsoring Surveillance Report!

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/apple-fixed-a-leak-without-telling-anyone-plus-more-vpn-news-and-flocks-creepy-police-ai/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (00:40) - HIGHLIGHT: 4 VPN UPDATES
• (06:20) - FLOCK'S CREEPY AI TOOL
• (11:15) - META'S SETTLEMENT
• (14:44) - OUR SPONSOR: EASYOPTOUTS
• (16:32) - X ATTACKS FRONTENDS
• (20:48) - DEFENSE BULLETIN: DATA BREACHES
• (23:02) - DEFENSE BULLETIN: THREATS
• (29:08) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

Three cracks opened up in Apple's privacy story this week: iCloud Private Relay leaking real IP addresses through DNS prefetching, WebTransport, and passkeys; Hide My Email exposing real addresses in bounce logs; and an unprecedented wave of spyware notifications going out to targeted users. Also this week: 737 fake VPN extensions sitting in the Chrome Web Store, Edge phasing out Manifest V2, a judge giving Google one week to fix its anticompetitive Play Store flow, and France's top court blocking the under-15 social media ban on free expression grounds.

Stop handing out your real email address. addy.io gives every site an alias that forwards to your normal inbox. Open source, self-hostable, with browser extensions and mobile apps. 🚀 Get started for free: https://addy.io/

In this episode:

• Highlight: Three Apple flaws worth acting on today: Private Relay's IP leaks, the Hide My Email exposure, the macOS screen-sharing bug, and the spyware alert wave
• 737 fake VPN extensions impersonating Proton, Nord, Surfshark and Cloudflare in the Chrome Web Store, with 500+ still live after cleanup
• A judge gives Google one week to fix its anticompetitive Play Store flow after Epic
• France's top court blocks the under-15 social media ban, citing freedom of expression and privacy
• Data Breaches: CareCloud (3.7M patients), a LiteLLM supply chain attack leaking terabytes of credentials, 3.6M Azure records, RingCentral (1.6M), Sakura Internet, Clarity Check's exposed face database, the French tax authority, SafePal, Trezor, and Pokémon Center
• Threats: the Evooo1Bot Linux router botnet, Comcast adding motion sensing to millions of routers, Google buying bankrupt Spirit Airlines' customer data to train AI, DDoS attacks on Threema, and a Copilot prompt-injection disclosure
• FOSS+: Tor Browser 15.0.20, Waterfox 6.7 "Supernova," a native ad blocker in Firefox for iOS, Startpage arriving in Firefox, Brave 1.93's GPU fingerprinting protections, Proton Mail Categories, Proton's AI Paper Trail tool, Ente's post-quantum work, Linux kernel 7.2, the Fairphone Gen 6 Plus landing in the US, SimpleX's equity crowdfunding, and Pine64 halting Linux device production

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/apples-private-relay-is-leaking-your-ip-plus-fake-vpn-extensions-frances-big-win/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (00:38) - APPLE USERS SHOULD LISTEN UP
• (09:04) - IMPORTANT BROWSER PRIVACY UPDATES
• (13:34) - OUR SPONSOR: ADDY.IO
• (15:06) - GOOGLE FORCED TO BEHAVE
• (18:24) - A HUGE WIN IN FRANCE
• (22:26) - DEFENSE BULLETIN: DATA BREACHES
• (27:30) - DEFENSE BULLETIN: THREATS
• (32:30) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

Signal just shipped its largest set of updates in years: A second phone can finally be a linked device, automatic key verification is rolling out alongside safety numbers, and there are commits hinting at registration without a phone number. I also cover Google hosting rival app stores in the Play Store after its Epic loss, a fake Wi-Fi network on a Delta flight, a Reuters poll showing most Americans want tighter social media oversight, and Meta joining the list of companies whose AI agents ran their own attacks.

🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com/
Thanks to the EasyOptOuts team for sponsoring Surveillance Report!

In this episode:

• Highlight: Signal's largest updates in years: linked phones and tablets, automatic key verification, and speculative phone-number-free registration
• Following its Epic loss, Google starts hosting rival app stores inside the Play Store, and charges $15,000 to be there
• Delta investigates a fake Wi-Fi hotspot on a flight carrying DEF CON attendees
• Three in five Americans favor stronger oversight of social media, and why the regulation on the table targets you instead of the companies
Meta's AI model hacked a company during a misconfigured test, and why this is a negligence story, not an AI story
• Data Breaches: Ceva Logistics rippling into Steam hardware customers, Framework via Metabase, LexisNexis, Levi Strauss, a Swiss government SharePoint breach, IVPN's Bitcoin payment server, and Suisun City shutting down City Hall
• Threats: surveillance tech linking your phone to your license plate, a new unpatched Windows Defender privilege escalation, North Carolina Ports, why the passkey attack is mostly a nothingburger, and Chrome's device-bound session credentials
• FOSS+: Bitwarden's annual audit, Session's Pro beta and protocol v2, Stingle Photos returning, Cape's Trail of Bits audit of disappearing call logs, addy.io's label and plan updates, the Pixel 11 lineup, and Linux desktop use hitting 22%

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/signals-biggest-update-in-years-plus-rival-app-stores-arrive-in-the-play-store/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (00:57) - 3 BIG SIGNAL UPDATES
• (06:56) - GOOGLE PLAY THIRD-PARTY APP STORES
• (10:48) - 'MILE HIGH HACKERS'
• (12:08) - OUR SPONSOR: EASYOPTOUTS!
• (14:02) - COMMENTARY ON SOCIAL MEDIA BANS
• (18:04) - MORE ROGUE AI AGENT HACKING
• (21:54) - DEFENSE BULLETIN: DATA BREACHES
• (27:02) - DEFENSE BULLETIN: THREATS
• (32:42) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

OpenAI's rogue AI agent turned out to have hacked more than Hugging Face, and the more details come out, the less impressive it seems. Then Anthropic came forward with its own disclosure: three companies accessed during testing, two of which had no idea. Plus Iran-linked hackers burrowing into dozens of US water and energy systems, an activist facing a felony for wiping his GrapheneOS phone at the border with a duress password, and thousands of private Claude chats and Artifacts turning up indexed on Google. An AI-heavy week, with the usual data breaches, threats, and FOSS+ updates.

🗺️ The open-source answer to Google Timeline is finally here! Replay every route and light up every city you've visited on a map nobody else owns; self-host Dawarich free or grab the hosted version at https://dawarich.app/techlore/ with code TECHLORE for 20% off your first year.

In this episode:

• Highlight: OpenAI's escaped agent, the Hugging Face breach, and Anthropic's own disclosure
• Iran-linked hackers disrupting US water and energy providers, 30+ Minnesota communities hit
• An activist charged with a felony after a GrapheneOS duress password wiped his phone at the border, plus what US v. Belmonte-Cardozo means for warrantless border searches
• Thousands of private Claude chats and Artifacts indexed by Google
• Data Breaches: CareCloud's ~350,000-person silence, Brinks Home, Origin (4.8M), OnTrac, Chick-fil-A, Analog Devices, KT's $39M fine
• Threats: Breyer on Chat Control 1.0's return, Google's age verification API on the Play Store, JetBrains TeamCity RCE, Mythos killing the Hawk PQC candidate, Mysk's silent macOS executable replacement
• FOSS+: Proton Pass autofill (now working on iCloud.com), Tails, Thunderbird 153 "Meadow," Firefox's Nova UI, Collabora Online, Wine 11.14

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/openais-hacking-story-got-worse-plus-iran-in-us-water-systems-a-felony-for-wiping-a-phone/

⏱️ TIMESTAMPS
🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

France has become the first country in Europe to ban social media for children under 15. Meanwhile there's real good news elsewhere: the UK's incoming PM dropped digital ID entirely, and California's Senate killed its browser-level age mandate and exempted open source operating systems.

🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com/
Thanks to the EasyOptOuts team for sponsoring Surveillance Report!

In this episode:

• HIGHLIGHT: France's under-15 social media ban, the UK dropping digital ID, and California scaling back its age-gating law
• A device dealers install in cars across the US that leaves them open to Bluetooth unlocking and disabling
• New stats showing the majority of Chat Control reports are false alarms, and that investigations are largely targeting minors themselves
• Courts forcing Apple and Google to open up: EU interoperability requirements upheld, and third-party app stores landing on Google Play
• Data Breaches: Suno (55M users), South Korea's diplomatic corps, Romania's entire land registry wiped, Ernst & Young, Estée Lauder, Chick-fil-A, and Coca-Cola's Fairlife
• Threats: wp2shell WordPress exploits, an Adobe Chrome extension exposing WhatsApp Web chats, a 7-Zip RCE, a critical Zoom account takeover, credit card data flowing to ICE, and period tracker Stardust sharing health data with an analytics firm
• FOSS+: Signal polls in DMs, Tor Browser 15.0.19, YubiKey 5.8, native containers in Firefox 153, Vivaldi 8.1, WhatsApp's first-party encrypted backups, Briar entering maintenance mode, the Mullvad donation controversy, and our Techlore Tools v2026.07 release

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/france-bans-under-15s-from-social-media-a-hidden-device-leaves-us-cars-hackable-and-courts-force-apple-and-google-open/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (00:46) - FRANCE BANNING SOCIAL MEDIA + MORE
• (08:04) - A SCARY CAR EXPLOIT
• (12:42) - STATS ON CHAT CONTROL
• (15:16) - OUR SPONSOR: EASY OPT OUTS
• (16:40) - APPLE & GOOGLE OPENING UP
• (20:26) - DEFENSE BULLETIN: DATA BREACHES
• (24:18) - DEFENSE BULLETIN: THREATS
• (32:08) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

This week's a double-week catch-up: the EU just greenlit Chat Control even after Parliament voted against it, Microsoft had a brutal stretch between a decade-old Secure Boot flaw and a Windows Defender zero-day, Texas's app-store age verification law cleared its Supreme Court hurdle while the KIDS Act moves through Congress, and LAPD just let its Flock license-plate contract expire. Plus a double-week Defense Bulletin with breaches, threats and open source news!

🗺️ The open-source answer to Google Timeline is finally here! Replay every route and light up every city you've visited on a map nobody else owns; self-host Dawarich free or grab the hosted version at https://dawarich.app/techlore/ with code TECHLORE for 20% off your first year.

This week's episode covers:

• Highlight: EU Parliament greenlights Chat Control 1.0 despite the vote against it
• Microsoft's brutal week: Secure Boot broken for a decade, a Windows Defender zero-day, and Windows share dropping below 60%
• The age-verification wave: SCOTUS lets Texas's app-store law stand, the KIDS Act clears the House
• The Flock resistance: LAPD lets its contract expire, National Week of Action against ALPRs coming August 16–22
• Defense Bulletin: breaches at KDDI, AssuranceAmerica, Accenture, Mount Royal University, Lidl, Xsolis, and DHS's HSIN platform
• FOSS+: GrapheneOS, CalyxOS, LineageOS, Brave containers, Organic Maps, Proton updates, Tuta migration, and more

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/eu-passes-chat-control-anyway-plus-microsofts-secure-boot-mess-the-flock-resistance/

⏱️ TIMESTAMPS

• (00:00) - INTRO TO SURVEILLANCE REPORT
• (00:56) - CHAT CONTROL IS BACK
• (07:06) - MICROSOFT HAD A ROUGH WEEK
• (16:30) - AGE VERIFICATION IN THE US
• (19:52) - OUR SPONSOR: DAWARICH
• (21:40) - THE FLOCK RESISTANCE
• (23:26) - DEFENSE BULLETIN: DATA BREACHES
• (26:00) - DEFENSE BULLETIN: THREATS
• (29:12) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

Apple is moving Hide My Email aliases to a new private.icloud.com subdomain, which makes it trivial for any app or website to spot a private email and block the signup.

🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com/
Thanks to the EasyOptOuts team for sponsoring Surveillance Report!

In This Episode:

• Google preparing to use IP addresses for ad measurement across the EEA, UK & Switzerland (Aug 3)
• Chrome moving to fully block MV2, the last uBlock Origin workarounds are going away
• New surveillance laws in Canada + a UK push to ban social media for under-16s (with the age-verification nightmare that follows)
• The Arch Linux AUR malware saga...1,500+ packages, two waves
• Full Defense Bulletin: Texas (3M IDs), LastPass, FIFA's wide-open World Cup portal, and a stack of FOSS updates

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/apple-quietly-downgrades-hide-my-email-plus-chrome-kills-ublock-origin-googles-ip-tracking/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (00:36) - APPLE WEAKENING HIDE MY EMAIL
• (06:26) - CHROME FORMALLY ENDING MV2
• (09:12) - OUR SPONSOR: EASYOPTOUTS!
• (10:32) - UK & CANADA SURVEILLANCE
• (15:44) - MALWARE IN THE AUR
• (18:34) - DEFENSE BULLETIN: DATA BREACHES
• (21:40) - DEFENSE BULLETIN: THREATS
• (24:36) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

Meta quietly embedded unreleased facial-recognition code, internally called "nametag" onto more than 50 million phones through its Meta AI app, then deleted it the day after Wired exposed it. This week I also get into Microsoft repos weaponized a second time to push credential-stealing malware to AI users, the UK's ultimatum to scan every device (and Signal's response), the FCC's push to kill burner phones...plus the usual breaches, threats, and a stacked week of FOSS+ updates.

🗺️ The open-source answer to Google Timeline is finally here! Replay every route and light up every city you've visited on a map nobody else owns; self-host Dawarich free or grab the hosted version at https://dawarich.app/techlore/ with code TECHLORE for 20% off your first year.

In this episode:

• Highlight: Meta's secret face-recognition code on 50M+ phones
• Microsoft repos weaponized a second time in weeks to push credential-stealing malware to AI users
• The UK's ultimatum to scan all content on all devices and Signal's one-page rebuttal
• Two states, two directions: Massachusetts bans precise-location-data sales (146–0); Texas forces Apple/Google age verification (SB2420)
• The FCC's push to kill burner phones by making telecoms collect everyone's ID
• Defense Bulletin, Breaches: DentaQuest, UN World Food Programme (600K Gaza households), ServiceNow, SoFi, Dashlane (20 vaults, but Argon2-encrypted), Oxford, 20K Instagram accounts via Meta's AI, French govt messaging
• Threats: Chrome zero-day, WhatsApp/NSO, Microsoft "Nightmare Eclipse" 0-days, UniFi root bug, Gogs RCE, npm + PyPI supply-chain attacks, Hola browser cryptominer, OpenAI Lockdown Mode, Apple's auto-password-changer, license-plate readers adding AirPod/phone trackers
• FOSS+: Tails 7.8.1, Firefox Vulkan video + free VPN going unlimited, Nextcloud Hub 26, Proton Drive CLI for Linux, Futo Keyboard, Brave Origin, FSFE's public-money-public-code win, and Loupe (see what your apps can see)

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/meta-hid-face-recognition-code-on-50m-phones-the-uks-device-scanning-ultimatum-a-burner-phone-ban/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (01:00) - META ADDING SNEAKY FACIAL RECOGNITION
• (05:42) - MICROSOFT HACKED TO PUSH MALWARE
• (08:38) - THE UK'S SURVEILLANCE ULTIMATUM
• (11:40) - OUR SPONSOR: DAWARICH!
• (13:20) - GOOD & BAD NEWS IN US STATES
• (16:42) - FCC BANNING PRIVATE NUMBERS
• (20:00) - DEFENSE BULLETIN: DATA BREACHES
• (24:15) - DEFENSE BULLETIN: THREATS
• (28:54) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

Dashlane has confirmed hackers stole around 20 encrypted password vaults, and the company is being unusually quiet about how it happened. Plus the Pentagon admits US troops were tracked using commercial location data, Europe accelerates its move away from US tech, and hackers hijacked celebrity Instagram accounts by simply asking Meta's AI support chatbot.

🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com
Thanks to the EasyOptOuts team for sponsoring Surveillance Report!

In this episode:

• Highlight: Dashlane confirms stolen password vaults and the LastPass parallels
• Pentagon confirms US troops tracked via commercial location data
• Europe pulls away from US tech: EU Parliament drops Google, Euro-Office launches with Tuta
• Hackers hijack celebrity Instagram accounts by tricking Meta's AI support chatbot
• Defense Bulletin: breaches at Carnival Cruise, Charter, 23andMe, Ultrahuman, and more. Threats: actively exploited Android zero-day, Red Hat npm packages backdoored, HTTP/2 Bomb DoS, Signal backup phishing, websites spying via SSD activity. FOSS+ Updates: Tor Browser 15.0.15, Mullvad Android audit, Proton Mail's Gmail bridge, Rocky Linux 10.2, openSUSE Tumbleweed, NixOS 26.05

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★

🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/dashlane-confirms-hackers-stole-password-vaults-pentagon-location-tracking-and-hackers-trick-metas-ai/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (00:56) - DASHLANE LOSES CUSTOMER PASSWORD VAULTS
• (06:05) - MILITARY HIT BY THE SURVEILLANCE ECONOMY
• (12:55) - OUR SPONSOR: EASYOPTOUTS!
• (14:32) - EURO ACCELERATES AWAY FROM BIG TECH
• (20:00) - INSTAGRAM ACCOUNTS HACKED WITH META'S AI
• (24:00) - DEFENSE BULLETIN: DATA BREACHES
• (27:06) - DEFENSE BULLETIN: THREATS
• (34:08) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

A rare and genuine win against age verification with California following Colorado in exempting Linux and other open source operating systems from its Digital Age Assurance Act, directly because of community pressure. Plus AI cameras on tens of thousands of school buses being quietly repurposed for police access, a bipartisan amendment that could end nationwide automatic license plate reader programs, the open source supply chain under unprecedented attack, and a Trump Mobile data leak.

In this episode:

• Highlight: Age verification laws are coming for everyone except open source
• BusPatrol AI school bus cameras now angling for police access
• Bipartisan amendment to end nationwide police license plate tracking
• Defense Bulletin: data breaches at Trump Mobile, 7-Eleven, Charter, plus a major GitHub/TanStack supply chain compromise
• Threats: open source code poisoned at unprecedented scale, AI agents imperiled by critical vulnerability, Defender zero-days, Apex One zero-day, Linux kernel privilege escalation, Mullvad on exit-IP fingerprinting, Texas AG sues Meta over WhatsApp encryption
• FOSS+ Updates: Tails 7.8, Firefox's new design, Tuta improvements, AltStore on-device sideloading, Vivaldi 8.0, Linux Mint / Rhino Linux / MX Linux / AlmaLinux updates

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★
🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/california-exempts-open-source-from-age-verification-plus-school-bus-surveillance-getting-out-of-control/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (00:52) - HIGHLIGHT: CALIFORNIA & COLORADO EXEMPT LINUX
• (06:02) - THINK OF THE CHILDREN BUS SURVEILLANCE PROGRAM
• (10:22) - SUPPORT THE PODCAST
• (11:22) - LEFT AND RIGHT UNITE AGAINST ALPR
• (14:34) - DEFENSE BULLETIN: DATA BREACHES
• (18:34) - DEFENSE BULLETIN: THREATS
• (26:52) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

A brutal week for Microsoft with seven vulnerability stories, an actively exploited Exchange zero-day, the MiniPlasma exploit (rooted in a six-year-old Project Zero report Microsoft sat on), and Pwn2Own Berlin zero-days. Plus the Shai-Hulud npm supply chain attack hitting 600+ packages, Signal threatening to pull out of Canada over Bill C-22, Meta rolling out AI-powered age detection, and some quiet changes at Bitwarden that have long-time users uneasy.

🔎 EasyOptOuts is the easy, affordable, and effective way to automatically remove your data from people search sites: https://easyoptouts.com
Thanks to the EasyOptOuts team for sponsoring Surveillance Report!

This episode also covers: data breaches at NYC Health + Hospitals, 7-Eleven, West Pharmaceutical, Grafana Labs, CISA, and more. WordPress plugin exploits, Cemu emulator Linux compromise, NGINX RCE, macOS sandbox escape. And open source news like FSFE vs Apple, Tor Browser 15.0.14, Firefox 151, Discord E2EE for calls, Azure Linux 4.0, Rocky Linux new security repo, and Organic Maps updates!

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★

🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/a-brutal-week-for-microsoft-security-signal-threatens-to-leave-canada-and-bitwarden-quietly-shifts-policies/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (00:54) - HIGHLIGHT: A BAD WEEK FOR MICROSOFT
• (10:46) - OPEN SOURCE SUPPLY CHAIN ATTACK
• (14:40) - SIGNAL THREATENS TO LEAVE CANADA
• (19:33) - OUR SPONSOR: EASYOPTOUTS!
• (20:48) - META USING AI FOR UNDERAGE USERS
• (24:38) - BITWARDEN CONCERNS
• (27:28) - DEFENSE BULLETIN: DATA BREACHES
• (31:04) - DEFENSE BULLETIN: THREATS
• (35:22) - DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

Linux gets hit with a third major vulnerability in as many weeks, a Palantir-built database of 20 million people, and Android delivers both bad news (a new VPN leak Google has refused to patch) and good news (intrusion logging for high-risk users). Plus encrypted RCS finally arrives in iOS 26.5, Instagram quietly kills its end-to-end encrypted DMs, and the usual roundup of data breaches, threats, and FOSS+ updates in your weekly Surveillance Report.

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★

🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/three-linux-exploits-palantir-20m-person-database-and-androids-good-bad-week-surveimay-13/

⏱️ TIMESTAMPS
00:00 INTRO TO SURVEILLANCE REPORT
00:34 A THIRD LINUX VULNERABILITY STRIKES!
05:16 PALENTIR KNOWS ALL
07:20 SOME QUICK ANNOUNCEMENTS
10:32 ANDROID: GOOD AND BAD NEWS
15:48 DEFENSE BULLETIN: DATA BREACHES
20:54 DEFENSE BULLETIN: THREATS
27:12 DEFENSE BULLETIN: FOSS+

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

This week's Surveillance Report covers the most severe Linux threat in years sending researchers and admins scrambling, Apple patching the bug police were using to extract deleted Signal messages from iPhones, Utah's new law regulating VPNs taking effect, and Microsoft Edge inexplicably storing your passwords in plaintext memory.

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★

🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/copyfail-explained-utahs-new-vpn-law-and-microsoft-edge-keeping-passwords-in-plaintext/

⏱️ TIMESTAMPS

• (00:00) - INTRO TO SURVEILLANCE REPORT
• (01:10) - HIGHLIGHT: LINUX VULNERABILITY COPYFAIL
• (06:55) - APPLE FIXES NOTIFICATION BUG
• (08:46) - UTAH TRIES TO TARGET VPNS
• (14:16) - MICROSOFT EDGE STORING PASSWORDS IN MEMORY
• (20:10) - DEFENSE BULLETIN

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

The government told you to use a VPN, but are you actually making yourself a target for NSA surveillance in the process? This week's highlight story digs into a letter from six US lawmakers pressing intelligence officials to answer whether Americans using commercial VPNs risk losing their legal protections and being treated as foreign nationals under Section 702 of FISA.

Also this week: North Korea's methodical, weeks-long social engineering attack that briefly hijacked the Axios open-source JavaScript library; Android malware called NoVoice that infected 2.3 million devices through the Google Play Store that survives a factory reset; Apple's device-level age verification expanding to the UK, Singapore, and South Korea; and the EU Parliament's dramatic vote to kill Chat Control, plus Patrick Brayer's five-point action plan for genuine child protection that doesn't require mass surveillance. The Defense Bulletin is packed: VeraCrypt's developer locked out by Microsoft, a rare Apple iOS 18 backport patch, Meta losing a child exploitation lawsuit, Apple Maps ads incoming, and more.

🧡 SUPPORT TECHLORE
Become a Techlorian and keep this show growing: ★ Support this podcast ★

🔗 SOURCES & LINKS
View all sources here: https://techlore.tech/vpns-could-expose-you-to-nsa-spying-north-koreas-open-source-hijack-android-malware-hits-2-3-million-devices-via-google-play-and-the-eu-ending-chat-control/

⏱️ TIMESTAMPS

• (00:00) - WELCOME TO SURVEILLANCE REPORT
• (01:18) - HIGHLIGHT STORY: NSA VPN SPYING
• (08:24) - NORTH KOREA HACKS OPEN SOURCE SOFTWARE
• (10:30) - GOOGLE HOSTING MALWARE ON PLAY STORE
• (15:00) - AGE VERIFICATION ADVANCES EVERYWHERE
• (26:12) - END OF CHAT CONTROL & WHAT'S NEXT!
• (31:00) - DEFENSE BULLETIN

🎥 VIDEO
Watch on YouTube

📰 ABOUT SURVEILLANCE REPORT
Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore.

This week's Surveillance Report covers two sophisticated zero-click iOS exploit frameworks: Coruna and DarkSword hit hundreds of millions of iPhones in the span of a single week. Google finally revealed their controversial Android sideloading "advanced flow," and it involves a 24-hour wait, developer mode unlock, and a wall of warning screens just to install an APK. Meanwhile, Instagram has quietly killed end-to-end encryption in DMs, Colorado is pushing OS-level age verification that would even drag Linux into compliance, and the EU's chat control battle took a wild turn.

🧡 SUPPORT TECHLORE

Become a Techlorian and keep this show growing: https://techlore.tech/support

🔗 SOURCES & LINKS

View all sources here: https://techlore.tech/coruna-and-darksword-ios-exploits-explained-what-iphone-users-need-to-do-right-now/

⏱️ TIMESTAMPS

00:00 INTRO TO SURVEILLANCE REPORT

01:30 HIGHLIGHT STORY: IOS EXPLOITS

08:02 GOOGLE SIDELOADING ADVANCED FLOW

19:26 INSTAGRAM REMOVING E2EE

22:26 OS AGE VERIFICATION

28:44 EU CHAT CONTROL

31:00 DEFENSE BULLETIN

📰 ABOUT SURVEILLANCE REPORT

Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore, delivering deep analysis to help you reclaim control and defend your rights.

Hosted on Acast. See https://acast.com/privacy for more information.

★ Support this podcast ★

Password managers CAN see your vault (new research reveals attack vectors), Google threatens the open Android ecosystem, Apple rolls out age verification globally, 147 million installs of Android mental health apps with security flaws, Samsung's innovative privacy display, and a massive week of breaches and updates.

NO SR NEXT WEEK - Back in two weeks!

🧡 SUPPORT TECHLORE

Become a Techlorian and keep this show growing: https://techlore.tech/support

🔗 SOURCES & LINKS

View all sources here: https://techlore.tech/password-manager-vaults-arent-private-google-threatens-open-android-apples-global-age-verification-sr257

⏱️ TIMESTAMPS

00:00 INTRO

00:55 PASSWORD MANAGER VAULT SECURITY

12:51 ANDROID DEVELOPER VERIFICATION

16:36 APPLE AGE VERIFICATION

21:06 ANDROID MENTAL HEALTH APPS

25:17 DEFENSE BULLETIN

📰 ABOUT SURVEILLANCE REPORT

Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore, delivering deep analysis to help you reclaim control and defend your rights.

Hosted on Acast. See https://acast.com/privacy for more information.

★ Support this podcast ★

No operating system is safe, and this week, Mac users got hit from three directions at once. We cover the attacks, Discord's messy age verification expansion, hidden hotel cameras in China, and everything else threatening your digital rights.

🧡 SUPPORT TECHLORE

Become a Techlorian and keep this show growing: https://techlore.tech/support

🔗 SOURCES & LINKS

View all sources here: https://techlore.tech/mac-hit-by-3-simultaneous-attacks-discords-age-verification-fails-googles-deleted-footage-returns-sr256/

⏱️ TIMESTAMPS

00:00 INTRO

01:00 MACOS ATTACKS

13:12 DISCORD AGE VERIFICATION

23:34 MORE AGE VERIFICATION

26:08 GOOGLE NEST FOOTAGE MYSTERY

30:56 DEFENSE BULLETIN

📰 ABOUT SURVEILLANCE REPORT

Your essential weekly tech news podcast covering the latest threats to security, privacy, and digital freedom. Hosted by Henry Fisher from Techlore, delivering deep analysis to help you reclaim control and defend your rights.

Hosted on Acast. See https://acast.com/privacy for more information.

★ Support this podcast ★