‼️ Meta confirms its AI model Muse hacked an outside company during a safety evaluation. The Information names the model as Muse Spark 1.1, Meta's flagship coding release, and reports it made changes inside the victim's systems.

Three AI labs in two weeks have now disclosed that their own models broke into real companies during testing: OpenAI, Anthropic, and, as of Wednesday, Meta. All three ran evaluations through the same vendor, Irregular, which says the Meta case is the identical environment issue Anthropic reported.

Meta approved and ran more than 50 paid AI-generated child sexual abuse material ads for nudify apps, for over nine months.

Meta's own ad library shows it pulled an ad from a Facebook page for breaching its policy on child sexual exploitation, abuse and nudity — then let that page run 340 more ads...

The page is one of 210 the Tech Transparency Project tied to GatherOne, a Chinese agency Meta authorises to sell its advertising. Its other ads showed a childlike figure in lingerie in a submissive pose.

https://www.techtransparencyproject.org/articles/metas-chinese-partner-behind-deluge-of-nudify-ads

❗️ Apple pushed an out-of-band macOS patch: a Screen Sharing vulnerability let an attacker on the network authenticate without valid credentials.

Dubbed CVE-2026-65400, fixed in Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9.

https://support.apple.com/en-us/148170

A Redditor got so annoyed by the camera bump on his brand-new Galaxy Z Fold8 that he took a razor blade to it and removed the cameras entirely.

The camera island turns out to be a separate piece held on with adhesive, so it peeled off cleanly. He covered the gap with an old laptop skin trimmed to size.

The module is still intact, as he says he can put it back.

https://www.reddit.com/r/GalaxyFold/comments/1vif2zl/i_took_the_cameras_off_of_my_fold_8/

Someone says he accidentally opened an ATM while trying to turn it on. He just poked around and a door swung open, revealing the hardware that runs the machine.

❗️Proton lied about A/B testing prices. Its VPN General Manager told Reddit users that the varying VPN Plus prices were leftovers from a sale that hadn't "universally refreshed."

Proton's own page source says otherwise: a meta tag, ab-test, sorts each visitor into variant A or B — B served from a separate /pricing-test URL.

$2.77/mo in one session. $3.23/mo in the next.

A/B testing prices is ordinary e-commerce. Amazon does it. Airlines do it hourly. Almost nobody would have cared.

But Proton sells privacy and trust, and criticises "big tech". That means you don't get to act as unfair like big tech does ;-)

❗️New Signal code suggests they're adding a paid feature for people who don't want to register with a phone number. This comes after their CTO Ehren Kret said that Signal was looking for a way to induce a cost for signing up without a phone number.

Unreleased code in Signal's public Android repo describes a "Signal Login" purchase screen: users either make a one-time in-app payment or register with an account key they already own.

Signal hasn't announced it yet.

https://aboutsignal.com/news/signal-login-registration-without-a-phone-number/

‼️ Europe is feeling the fire Starlink lit under it: the EU has pulled its secure satellite network IRIS² forward a full year.

First launches are now targeted for 2029, not 2030. Brussels and the SpaceRISE consortium signed the implementation deal on Friday.

The constellation also grows by 66 satellites to 348, raising secure EU government capacity by about 60%. The bill is now put at €15.6bn, up from €10.6bn.