Court Agrees with EFF: Utah’s VPN Law Demands a Technical Impossibility

CERT-EU's September threat review highlights stolen AI-service access and hijacked cloud workloads. Its roundup cites Google's reporting on LLM-jacking and Microsoft's account of passkey-themed phishing against Microsoft 365 users. It also covers spyware targeting civil society and alleged unauthorized AI-agent activity. The monthly report separates law-enforcement, espionage, cybercrime and AI developments across Europe and globally, drawing on attributed public reporting.

EFF reports that Ecuador ordered security researcher and free-software developer Ola Bini’s deportation and imposed a ten-year reentry ban. The advocacy group says officials relied on a secret security report that his defense could not inspect, and that his lawyers sought habeas corpus protection. EFF says Bini was held at Quito’s airport awaiting departure for Sweden and urges authorities to explain the accusations.

GitHub now lets repository teams discuss vulnerability reports inside security advisories using comments restricted to users who currently have write access. Reporters and invited collaborators lacking that permission cannot read them or receive notifications; losing write access also removes visibility. Comment visibility cannot be changed after posting. GitHub says the feature covers public repositories with private vulnerability reporting enabled across its Free, Pro, Team and Enterprise Cloud plans.

GitHub has introduced a public preview of REST endpoints for reading, adding and editing repository advisory comments on public repositories. Access requires advisory visibility and appropriate repository security advisory permissions or token scopes; non-collaborators cannot read internal comments, and confidential comments are excluded. Comment deletion remains unsupported. Repository advisory responses now report non-confidential comment counts, letting integrations check for discussion before retrieving it.

SANS' October 2 Stormcast describes attackers emailing legitimate ScreenConnect clients configured to give them remote access, rather than exploiting a defect in the tool. It also relays Huntress reporting on custom GPTs steering people toward ClickFix commands, and discusses email impersonation research involving iCloud and Proton Mail. The episode says the iCloud issue was patched; the Proton Mail display-name issue remained unresolved.

EFF is using its Opt Out October campaign to encourage people to reconsider default reliance on major technology companies. Its resource hub points to alternative software, social platforms and operating systems, alongside controls for how services use personal data in AI training. The campaign frames switching tools as one route to greater control over data; these are EFF’s advocacy recommendations, not an independent evaluation of every alternative.