There was no post last Thursday as I was traveling by rail from the east coast to Colorado, where I’m spending this week. I’ll also be traveling next Thursday on the return trip back east, so there will be no post next week. With that said, I’m going to post this months And Now For Something Completely Different a week early.
I’ll also note, I like writing these posts more than the internal controls posts, so might try to find a way to post them more often, maybe one at a time, also making the posts quicker reads.
WordPress
WordPress implemented a new automated security review prior to the release of plugins. The review will assess plugins to determine their potential security risk and any that are assessed a high security risk will be blocked. This automated security review also applies to themes. It should be noted the automated review only applies to plugins and themes made available to WordPress.org self-hosted sites. I didn’t look into this, but I would assume a similar tool already existed for sites hosted on WordPress.com.
IDScan Breach
Brian Krebs once spoke at an ISACA conference I attended. Pretty sure it was in Las Vegas and he might have been the keynote speaker, but could be wrong. It was at least 10 years ago. Either way, I found his story interesting and have followed his writing since, which he does at krebsonsecurity.com. A few weeks ago he posted an article about an IDScan branch that was initial brought to his attention and later picked up by the FBI.
The article brings up some interesting thoughts regarding the dangers of requiring drivers licenses to verify identification prior to accessing services provided by social media sites in order to protect kids. These requirements are mostly being pushed by governments. However, there are some social media sites, take Gander for example, that are doing this on their own accord. I do think we need to separate the sites doing this on their own from those being forced to by governments, whereas one is a choice and the other is a requirement.
https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/
AI
The AI industry was thrown for a little loop last week when leaders in the AI industry called to slow things down. The concept is something I’m in favor of, but for different reasons.
AI is outpacing governance, which is creating unknown control risks.
I find it interesting that the request is coming from the big AI companies that are spending money hand over fist without the income to offset expenses, going into massive debt. The request isn’t coming from companies like Apple, Google, Meta, and Amazon. These are income generating companies that are mostly able to offset the expenses. Just something to keep an eye on.
That’s it for this month.
Zalovo GRC 