Microsoft’s patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold.

It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some 620 of them. Google and other companies have also published record numbers of vulnerabilities in recent months. Two weeks ago, OpenAI, Anthropic, Amazon Web Services, Google, Microsoft, and 100 companies and organizations published an open letter warning of a narrowing window for patching vulnerabilities ahead of an expected tsunami of AI-enabled attacks that actively exploit them first. The industry is taking the threat seriously by pumping out unprecedented numbers of patches in their software.

Welcome to the new normal

Dustin Childs, a researcher at the Zero Day Initiative, calls the spikes the “new normal” and also cautions that despite them, the damage that’s likely to result from AI-assisted attacks could eventually be substantial.

“On the one hand, congrats to the security gnomes at Microsoft for being able to patch bugs at this rate,” Childs wrote Tuesday. “On the other hand, AI-assisted vulnerability discovery shows no signs of slowing down. However, we have not seen a correlating spike in active exploits—yet.”

Counting the precise number of vulnerabilities fixed in a monthly patch release for Microsoft is never an exact science. In some cases, the bugs were previously addressed or affected non-Microsoft products. By Childs’s count, Tuesday’s release patches 972 vulnerabilities, and 997 when counting the porting of fixes for the Chromium browser incorporated into Edge. Of the new vulnerabilities, 112 of them are rated critical, with the remainder carrying the important designation. Already this year, Microsoft has fixed 2,760 vulnerabilities, more than double the number from last year. At this rate, Microsoft will complete the year having fixed more bugs than all of 2023, 2024, and 2025 combined.

from the protect-the-rights-of-your-users dept

In a handful of known cases, large social media companies have privately pushed back against Immigration and Customs Enforcement (ICE) subpoenas when the agency tried to unmask anonymous users who tracked immigration activities or criticized the government.

As ICE engages in a pattern of illegal and chilling investigations, any resistance is welcome. But social media companies can do more. When companies receive these unlawful subpoenas, they should be clear with the public that they will not hand over the data unless a court compels them to do so. In addition, companies themselves can take the government to court to challenge these unlawful subpoenas on behalf of their users.

Publicly challenging these unlawful subpoenas in court has the dual purpose of protecting individual users who may lack the resources or know-how to challenge a subpoena on their own, while also discouraging ICE from issuing similarly unlawful subpoenas in the future.

Companies have a responsibility to protect the privacy of their users. That responsibility does not end simply because companies wish to avoid the ire of this administration—which has sought to chill other powerful institutions like news outlets, law firms, universities, and non-profits.

ICE Has Issued Many Unlawful Subpoenas

ICE has sent hundreds of subpoenas to large technology companies like Google, Meta, and Reddit seeking basic subscriber information like name, email address, IP address, and session times.

Some of these subpoenas have targeted people who engaged in protected activity—like tracking immigration actions, criticizing the government, or attending a protest. People have a First Amendment right to document law enforcement activities and criticize the government online, without retaliatory government investigations. This right has become more important as immigration agents have engaged in invasive, unconstitutional, and sometimes violent conduct.

In a handful of cases, users themselves have successfully pushed back. After receiving notice of these subpoenas, users have challenged them in court, relying on pro-bono lawyers from groups like the ACLU or Civil Liberties Defense Center. Companies have been largely absent from these court proceedings.

Private Pushback from Meta and Reddit

While not appearing in court, companies like Meta and Reddit have sometimes pushed back behind the scenes.

For example, on September 11, 2025, ICE sent administrative subpoenas to Meta seeking to unmask users who ran Instagram and Facebook accounts that tracked immigration activity in Pennsylvania. On September 19, 2025, Meta’s Law Enforcement Response Team told ICE that the agency did not have the “statutory authorization” to seek the records. It asked for more detail about the investigation and said “Meta will take no further action with respect to this summons until it receives this information.” Later, Meta informed ICE that it planned to notify the users about the subpoenas, since no gag order had been obtained. The government disclosed this information in one of EFF’s Freedom of Information Act lawsuits against ICE and other agencies.

On October 3, 2025, Meta notified the user about the subpoena. Despite its private pushback, Meta told the users it would comply with the subpoenas unless they mounted a court challenge within 10 days—which they did with the help of the ACLU. Ultimately, ICE withdrew the subpoenas when it became likely that ICE would lose the case in court.

In another example, Reddit documented its pushback in a transparency report released a few months ago. Reddit reported that in the second half of 2025, the company received three Department of Homeland Security (DHS) subpoenas seeking account information from 11 users who posted content critical of ICE. In the report, the company stated that “Reddit objected to these legal demands because the users appeared to be engaged in protected activity under the First Amendment, and law enforcement withdrew their requests.” The company reported that most other DHS subpoenas it received appeared to be routine.

A Tech Company Model for Public Resistance

EFF’s demand that technology companies do more to protect their users is not unprecedented. Twitter (now X) did so successfully in the first Trump administration.

On April 6 2017, Twitter went to court to challenge a DHS subpoena that sought to unmask a Twitter account named “@ALT_USCIS,” which frequently criticized the administration’s immigration policies. Twitter challenged the subpoena on both statutory and First Amendment grounds. A day later, DHS withdrew the subpoena and Twitter dismissed the case. The incident led to an inspector general investigation, which criticized a tactic that DHS is still engaged in.

In other circumstances, companies have also gone to court to protect their users and shield themselves from burdensome legal process. In 2013, Microsoft challenged a search warrant for the content of emails stored on servers outside the United States. In 2015, Apple challenged a court order to break the security of its iPhone during an investigation into the San Bernardino shootings. And in 2007, Yahoo challenged the constitutionality of government requests at the Foreign Intelligence Surveillance Court.

Republished from the EFF’s Deeplinks blog.

Filed Under: ice, privacy, subpoenas

Companies: meta, reddit, twitter, x

UK-based manufacturing software startup CloudNC announced a $20 million B extension round on Wednesday, bringing its lifetime total raised amount to $128 million. The company’s last major raise was four years ago, its co-founder and CEO Theo Saville told TechCrunch.

Saville launched CloudNC in 2015 with Chris Emery, now the company’s chief science officer, and offers AI-powered CAM Assist software that automates parts of Computer Numerical Control (CNC) machining. CNC is the process of using computer-controlled machines to cut or shape materials precisely into the parts that are then used in automotive, defense, or consumer hardware industries.

Before a part can be cut, Saville said, a machinist or a computer-aided manufacturing programmer has to decide issues like how a part should be held or what tools should be used, Saville said.

They typically use powerful CAM software to help with this ideation phase, and although some of these tools can help users create part features or known part patterns, that’s different from looking at the part and generating an execution strategy an expert would actually want to use. 

“Traditional CAM systems are powerful, but in most workflows, they are still tools that allow programmers to manually specify how a part should be machined,” Saville said. This is where his CAM Assist comes in, a software that plugs into traditional CAM systems, like Autodesk Fusion or Mastercam, to help machinists and programmers make more efficient strategic manufacturing decisions. 

“It selects suitable tools, approach directions, and cutting feeds and speeds, and then drafts the code required to tell the CNC machine what to do,” Saville said. 

From there, the user reviews, edits, and approves the results. Saville said the goal was to help skilled workers be more “efficient and productive,” rather than removing expert judgment from the process. If “traditional CAM is a powerful toolkit,” he said, then “CAM Assist is more like an expert assistant sitting alongside the programmer, automating much of the first-pass thinking and repetitive setup so the human can review, improve, and approve the approach.” 

Saville said more than 1,000 machine shops worldwide use CAM Assist, and 80% of the company’s customer base, which includes both manufacturers and companies, is in the U.S. With a team of 80 employees, the company’s biggest goal is scaling adoption. 

“This makes this the right time to raise additional capital,” he said. Investors in the round include Nimble Ventures, which led the round, Calculus Venture Capital, Entrepreneur First, and LM Capital, Lockheed Martin’s venture arm. “The funding allows us to support wider take-up of CAM Assist, strengthen our go-to-market operations, expand in existing and new markets, and develop new products such as Quote Agent.” 

The premise behind Quote Agent, which targets manufacturers, is similar to CAM Assist. It helps shops assess the estimated cost and risk of a new project so they can move faster to accept — or reject — new work. He tied this somewhat back to geopolitics, pointing to, for example, how machine shops in the U.S. are looking to reshore and how, at the same time, there is a shortage of skilled workers in manufacturing. 

“Machine shops need to quote faster, program faster, and deliver more with the people and machines they already have,” he said, adding that Quote Agent is set to launch next month. 

“There are more ways to machine a typical CNC part than there are atoms in the universe,” he continued. “We have spent years attacking that specific problem, with our own factory, our own software team, and a lot of hard lessons from real machining. It’s been a long process to get to where we are today.”

This seems to be the year of AI agents, and Meta is diving into the game. The company on Tuesday announced a new agent program called Muse, which CEO Mark Zuckerberg describes as a “personal agent” that understands your habits and goals. It’s available now in the US.

Agentic AI is a type of generative AI based on a large language model where agents, or bots, are meant to take actions autonomously on your behalf. Meta’s Muse, for example, can do online shopping (with your permission), create documents, fill out forms and respond to emails.

Meta says that Muse is a more general-purpose agent, not limited to specific tasks like coding. (If you want agentic coding help, you can use Muse Code, also recently released by the company.) You have to give Muse permission to access your apps and data, which you can revoke at any time. Like a lot of agentic AI tools, the more info you give it, the more personalized your results will be.

Muse runs “on its own dedicated computer in the cloud,” according to a Meta blog post, in what the company calls a “virtual machine.” The tool also has a separate Sentinel agent — you can think of it as a virtual traffic cop, giving Muse a red or green light before letting it out onto the internet to complete tasks.

Agentic AI can be risky. Over the summer, agents from Meta, OpenAI and Anthropic each slipped out of their testing environments and hacked outside websites, casting increased scrutiny on the potentially disastrous harm AI can do to our cybersecurity.

Meta’s vice president of Superintelligence Labs, Tarek Sheasha, said in a blog post: “The harness runs in its own isolated cell, it doesn’t see real credentials, and every interaction with the outside world runs through a Sentinel which the agent can’t override.”

Muse is available now on iOS and Android and on the muse.ai website. The company says it will be bringing the AI to its controversial smart glasses soon. According to Zuckerberg, it will be free for people to use “up to 100 million tokens per week” (one token is roughly equivalent to four characters). So unless you’re constantly running Muse on complex tasks, you should be able to use it for a while before running into a paywall.

Katelyn Chedraoui

Reporter 2

Advertisement

Katelyn is a reporter with CNET covering artificial intelligence, including chatbots, image and video generators. Her work explores how new AI technology is infiltrating our lives, shaping the content we consume on social media and affecting the people behind the screens. She graduated from the University of North Carolina at Chapel Hill with a degree in media and journalism. You can reach her at kchedraoui@cnet.com.

See full bio

The Home app is getting some great AI upgrades, along with other cool tweaks.

HomeKit now integrates with Apple Intelligence

Apple

Perhaps the most notable change this year is deeper integration with Apple Intelligence. HomeKit has never really taken advantage of AI features until now, but that changes with iOS 27. The Home app can now summarize important notifications, such as when someone was seen at your door or when smoke is detected. This is especially useful for people who have multiple cameras and smart doorbells at home, as it should prevent you having your lock screen flooded with Home app notifications.

Speaking of cameras, they can now use AI to better detect faces or animals. Not only that, but the Home app combines footage from multiple cameras to show you the same event from a different angle. Say someone is moving around your house: the app will show you a sequence of footage of that person in every room equipped with a camera. 

The videos also come with a short AI-generated description, so you don’t have to spend minutes watching the whole clip to find out what happened. You can even search for events captured by your cameras, plus videos are now recorded in 4K.

Advertisement

Apple

Apple TV owners have another reason to update to iOS 27, as the Home app can now update the software on all your Apple TVs at once. Plus, the app’s reliability has been improved overall, which is always appreciated.

New home accessories from Apple are coming soon

starry-sky-visual/Shutterstock

from the vanishing-act dept

The measles outbreak, that began in America nearly two years ago, has only increased in velocity. We recently talked about the deaths of two children in Pennsylvania who both died while infected with measles. I’m altering my language slightly here from that original post in which I described those children as having died of measles purely to acknowledge that there are some, including RFK Jr., who are trying to dispute the cause of those deaths. I’m comfortable stating that they died of measles, as are state officials in Pennsylvania, and as are competent local health professionals like Paul Offit. As explained in a previous post, the ruptured spleen that one newborn died from is an expected symptom of measles in newborns. Kennedy is trying to claim that the cause of death is the spleen, as though the measles infection played no role. That’s dumb, and he’s dumb and a liar, but here we are.

Well, when it comes to CDC reporting on the measles outbreak, the dedicated public page for tracking the numbers was last updated the day of this writing, September 4th. The data generally demonstrates just how shit of a job Kennedy and his crackerjack group of assclowns in government are doing in combating the outbreak. Keep in mind that Kennedy has publicly claimed that he’s doing an awesome job in all of this.

Cases? Up with 4 months left in the year.

Total number of hospitalizations? Up with 4 months left in the year.

Deaths? Well…

The page didn’t always read that way. For a brief moment several days ago, the death count simply stood at 2. Why? Because the CDC questioning state reporting on any statistic surrounding a medical outbreak like this is pretty much unheard of. It’s not how this works. And there was no explanation for why that change was made, other than it was done so on orders from newly confirmed CDC Director Erica Schwartz. Schwartz, you should recall, raised many eyebrows during her confirmation hearings when she was asked if she would refuse the influence of RFK Jr. if he wanted her to deviate from science and factual information, as he did with Susan Monarez on the topic of vaccines previously. She avoided the question entirely by stating she didn’t believe Trump or Kennedy would ever try to exert that kind of influence upon her.

Perhaps the most disturbing aspect of Schwartz’s testimony came when senators repeatedly asked her what she would do if (or when) she’s put in the same position as Monarez. Schwartz responded as if it hadn’t happened and would never happen. “I do not believe that the president or the secretary would ever do what you just mentioned,” she told Sen. Bernie Sanders (I-Vt.) at one point, prompting him to reply: “Really?”

We can be done with Schwartz entirely at this point. While she entered into her confirmation hearings with a good reputation and the cautious approval of all kinds of national medical groups, it’s clear that her failure to answer the above question is of consequence. That’s because new reporting indicates it was Kennedy himself who told her to keep those two Pennsylvania deaths off the CDC measles report.

The Centers for Disease Control and Prevention is still secretly counting two measles deaths that were deleted from the agency’s public measles data—a deletion that occurred at the direct request of anti-vaccine Health Secretary Robert F. Kennedy Jr., according to two reports released today.

Early today, Reuters reported that Kennedy instructed new CDC director Erica Schwartz to delete the two deaths from the agency’s website. CDC staff had reportedly already reviewed information about the deaths and accepted the characterization that they were measles-related. Still, Schwartz deleted the deaths without objection, insiders told Reuters. According to previous reporting, the two deaths were added and then removed from the CDC’s website within hours on August 30.

Now, I will deign to note that Kennedy has disputed this report. But who really gives a shit, considering that Kennedy has demonstrated a willingness to both fudge the facts when it comes to medical data and that he’s been perfectly happy to lie directly to Congress. If he’ll lie to senators, there’s no doubt he’s willing to lie to you and the rest of the public. I personally have no doubt that this is yet another lie being told by someone with no conscience. And I’ll note that we typically call those people sociopaths.

As I mentioned above, this is not how CDC statistical reporting has traditionally worked. State health officials send the data in, having done their own due diligence, and the CDC reports on the data. In this case, CDC is suddenly disputing the data and claiming that the state hasn’t provided all the documentation needed to associate the deaths with measles. The state, unsurprisingly, is calling bullshit.

In an earlier statement to Ars Technica, HHS said that the two deaths in Pennsylvania “have not been confirmed based on the information currently available to CDC.” A spokesperson did not respond to a follow-up question about what information the CDC was lacking and/or awaiting from the state.

Pennsylvania’s state health department has said that it has provided the CDC with all the required information.

Advertisement

I’m sure they have. Just as I’m sure that Kennedy is attempting to save face here by pulling this nonsense. Meanwhile, while Kennedy is primarily concerned with his own ego, I’ll remind our dear readers that there are two tiny fucking coffins in the ground from children who died as a result of Kennedy’s incompetence. He’s worried about him, not about you, your children, or your community.

Get his ass out of HHS. Get him out of government. The same goes for Schwartz and any other officials Kennedy has put in place in government. They all must go, as they are poisoned by Kennedy’s mere presence. Burn it all down and let’s start again.

Or else we’ll have more deaths, no matter how the government tries to hide them from view.

Filed Under: anti-vaxxers, cdc, hhs, measles, pennsylvania, rfk jr., vaccines

• Alogic Clarity Touch 6K monitor packs 6016 by 3384 pixels into one massive display
• The webcam retracts fully into the monitor when not in use
• Thunderbolt 5 support is missing from this new flagship monitor

Alogic has upgraded its Clarity monitor range with a new 32-inch 6K model featuring an integrated 12MP webcam.

The company announced the display at IFA 2026 in Berlin, where it also showed several other new desktop products.

• 69% of Americans oppose AI data centers near their communities, a national poll finds
• Public support for nearby AI data centers has fallen sharply since 2025
• Only 4% strongly support new data centers in their communities today

American resistance to AI data centers has intensified sharply over the past year, several national surveys released in 2026 have found.

A new Decision Desk poll conducted by SurveyMonkey found that over two-thirds (69%) of respondents oppose construction of these facilities near their homes.