UnLocoPoco

PayPal's Honey browser extension is facing ongoing litigation over allegations that it interfered with affiliate attribution and redirected commissions from content creators. The case has now moved beyond the latest motion-to-dismiss stage. I broke down the alleged affiliate-ID replacement mechanism, Honey's alleged stand-down behavior, the affiliate-network fallout, and what the June 2026 court ruling actually means.

Sourced from MegaLag's part 3 update of honey video

cross-posted from: https://lemmy.world/post/50434194

Proton VPN's pricing page exposed an ab-test identifier linked to two VPN Plus prices: €2.99/month (70% off) and €3.49/month (65% off). Repeated testing produced B → A → B → A → B, with the variant matching the rendered price each time. €12 difference over 24 months.

Many people assume that an AI "Share" link is effectively private unless they send it to someone. That's not how the web works. Recently, users discovered that searches like site:claude.ai/share and site:claude.ai/public/artifacts returned publicly shared Claude conversations through search engines. Some indexed pages reportedly contained resumes, company discussions, code, and other sensitive information. Google began removing many results, but the incident highlights an important privacy lesson: once a conversation is published as a public webpage, it can become discoverable

India has directed GitHub to disable access to the repositories of Bitchat, Jack Dorsey's decentralized Bluetooth mesh messaging application, under Section 79(3)(b) of the Information Technology Act and the IT Rules, 2021. According to the official notice issued by the Indian Cyber Crime Coordination Centre (I4C), authorities argue that Bitchat's decentralized architecture, lack of mandatory user registration, absence of centralized logging, and ability to operate without internet connectivity make lawful interception and criminal investigations significantly more difficult.

A newly disclosed vulnerability chain dubbed wp2shell affects WordPress Core, not a third-party plugin. The disclosure has prompted emergency security updates and includes publicly available PoC, IoCs, and detection guidance for defenders

Telegram's t.me short-link domain has been placed into serverHold status at the registry level, causing invite links, channel links, and usernames to stop resolving globally. Unlike an application outage, a serverHold status removes a domain from DNS resolution entirely, making it effectively disappear from the Internet until the status is lifted

cross-posted from: https://lemmy.world/post/49181042

Accenture has confirmed it is investigating a security incident after a threat actor claimed to have accessed internal Azure DevOps resources and advertised what they describe as source code, configuration files, and credentials for sale. While the company has acknowledged the incident, the full scope of the allegedly stolen data has not been independently verified

A newly disclosed privacy vulnerability in Apple's Hide My Email feature can reportedly allow an attacker to uncover the real email address behind a generated alias. According to the researcher who found the bug, it was responsibly disclosed to Apple more than a year ago but remains unpatched, and independent testing has verified the issue.