LIVE · cybersecurity feed
Live wire
U.S. urges critical infrastructure orgs to secure refrigeration systems ASAP after EU supermarket and blood bank attacksCISA Announces Enhanced Reporting Form for Cyber IncidentsCVE-2026-19868 · CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible ExploitationCVE-2026-119757 · BTCPay Server Insufficiently Protected Credentials Flaw Exploited Upon DisclosureCVE-2026-118066 · LatePoint Improper Authentication Vulnerability Exploited Upon DisclosureCVE-2026-120534 · ACF Extended Advanced Custom Fields PRO Flaw Exploited Upon DisclosureCVE-2026-109884 · Elementor Website Builder Flaw Exploited Same Day As DisclosureCVE-2026-19868 · SonicWall SonicOS SSLVPN Vulnerability Exploited On Day Of DisclosureCVE-2026-103898 · Wpmet wp_social_login_and_register_social_counter Flaw Exploited Upon DisclosureCVE-2026-116512 · weDevs wp_project_manager Flaw Exploited Before CVE Publication
security

Big Tech sues over California plan to limit kids’ scrolling

Major technology companies, including Google, Meta, and TikTok, have initiated separate federal lawsuits to challenge a new California law, Assembly Bill 1709, which seeks to restrict specific design features for users under the age of 16. Signed into law by Governor Gavin Newsom in September, the legislation is scheduled to take effect in 2027. The law targets features deemed psychologically…

ZeroDay News ·

Source: Malwarebytes Labs

Major technology companies, including Google, Meta, and TikTok, have initiated separate federal lawsuits to challenge a new California law, Assembly Bill 1709, which seeks to restrict specific design features for users under the age of 16. Signed into law by Governor Gavin Newsom in September, the legislation is scheduled to take effect in 2027. The law targets features deemed psychologically exploitative, specifically prohibiting personalized feeds and autoplay functions that the state argues are designed to maximize engagement and encourage compulsive use.

Under the terms of the legislation, platforms must either disable these specific features for minors or delete their accounts and associated personal data. The law does not mandate a total ban on children using these services; it allows for continued access to search functions, direct messaging, and requested content. However, to comply with these requirements, platforms would be forced to implement robust age verification systems to distinguish between adult and minor users.

The tech companies contend that the law is unconstitutional, arguing that it interferes with protected free speech and overrides the authority of parents to manage their children's online experiences. Meta, Google, and TikTok maintain that the curation and arrangement of content—such as the personalized feeds found on TikTok or the recommendation algorithms on YouTube—constitute editorial judgments protected by the First Amendment. They argue that California is attempting to position itself as a state-sanctioned curator of online speech, rather than regulating a product design.

Beyond the free speech arguments, the companies emphasize that existing tools, such as parental controls and family pairing settings, are already sufficient to manage the online environment for younger users. They assert that personalized features are not inherently harmful but are instead functional tools that help users discover relevant content and navigate vast libraries of information. By restricting these features, the companies claim the state is hindering the ability of platforms to provide tailored, age-appropriate experiences.

The legislation also carries significant implications for the business models of these platforms, which rely heavily on advertising revenue driven by user engagement. By limiting features that keep users on a platform for longer periods, the law could reduce the total time spent on these services, thereby decreasing advertising opportunities. Furthermore, the companies note that youth engagement is a key strategic priority for their long-term growth, and these restrictions could disrupt their ability to attract and retain younger demographics.

Privacy advocates and the platforms themselves have also raised concerns regarding the practical implementation of the law. The requirement for age verification presents a significant technical and privacy challenge. To comply, platforms would likely need to collect and process sensitive age-related data from all users, which could create new vulnerabilities and increase the risk of data exposure in the event of a security breach.

While the state of California frames the law as a necessary intervention to protect children from the potentially harmful effects of addictive product design, the plaintiffs argue that the state is overstepping its authority. The core of the legal dispute centers on whether these engagement mechanisms represent harmful product design that the state has the power to regulate, or whether they are protected editorial decisions that fall outside the scope of government control.

As the litigation proceeds, the outcome will likely hinge on how the courts interpret the balance between state interests in protecting minors and the constitutional protections afforded to digital platforms. The case highlights a growing tension between legislative efforts to curb the attention-based economy and the fundamental rights of companies to manage their platforms as they see fit. Until the courts reach a decision, the future of these design restrictions remains uncertain, leaving both the tech industry and regulators at an impasse regarding the oversight of digital content consumption.

ShareXLinkedInWhatsAppFacebook

More News

view all →
vulnerability

Anthropic Rolls Out Mythos 5.2 With Improved Bug Hunting, Fewer Sandbox Escapes

Anthropic has officially released Claude Mythos 5.2 and Claude Fable 5.2, the latest iterations of its AI models designed for specialized security and general-purpose tasks. While both models share the same underlying architecture, they differ significantly in their operational guardrails. Mythos 5.2 is an access-restricted model intended for vetted organizations participating in Anthropic’s…

nation-state

IRISSCON 2026 puts preparedness for cyberattacks and hybrid threats in focus

Ireland faces a critical need to bolster its national security infrastructure to counter a rising tide of sophisticated cyberattacks and hybrid threats. Ahead of the IRISSCON 2026 conference held at Dublin’s Aviva Stadium, experts have characterized the current state of national readiness as potentially inadequate. The discourse centers on the necessity of moving beyond isolated defensive…

security

Default Admin Password Let Researchers Unlock and Start Cars

Security researchers Shubham Shah and Sam Curry have disclosed a series of vulnerabilities that allowed them to remotely unlock and start vehicles by compromising the identity management infrastructure of two unnamed automotive brands. The researchers detailed their findings in separate reports published in early November 2026, noting that the flaws affected customer accounts across the United…

CVE-2026-123218

IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive for federal agencies to remediate two critical vulnerabilities currently being exploited in the wild. The agency added CVE-2026-123218, affecting IBM Aspera Faspex, and CVE-2026-116779, impacting SignalWire FreeSwitch, to its Known Exploited Vulnerabilities (KEV) catalog. Under the requirements of…

breach

Binance Investigates ShinyHunters Breach Claims

Binance is currently investigating claims made by the threat actor group ShinyHunters, which alleges it has successfully breached the cryptocurrency exchange’s systems. On November 4, 2026, the group posted an advertisement on the PwsForums platform, asserting that it had obtained approximately 335.9 million records. The attackers are demanding a payment of $900,000, threatening to leak the…

security

France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites

The French government has formally attributed a cyberattack targeting refrigeration controllers across approximately 700 retail locations to a cyber unit associated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The incident, which occurred on the night of October 11, involved unauthorized access to industrial control systems used to manage temperature settings in commercial food…