Episode notes
Hackers claim to have data on every FBI employee, while 404 Media says it examined a sample of about 5,000 alleged records. The full scope is unconfirmed, but even a partial exposure could put people and families at risk. Also: WordPress patches a conditional critical flaw across older versions, Discord starts inferring teen or adult age groups, and the US objects to Australia's proposed social-feed algorithm opt-out.
Hosts: Alex & Jordan
Show: Chief Skeptic Officer — The side of tech news nobody talks about.
Drop: Daily at 7:00 A.M. America/New_York
Episode date: 2026-09-23
In this episode
The FBI claim and the human risk — 404 Media reports a hacking group's all-employee claim and describes examining a sample of about 5,000 alleged personnel records. That sample does not verify the claimed full scope or establish the source, but reported names and family details make a careful safety response more urgent than the argument over the headline.
WordPress patches the long tail — WordPress 7.1.2 fixes a critical page-template flaw, with updates backported to older branches through 4.7. Exploitation and possible code execution depend on theme and server conditions; the practical question is who checks and updates installations left behind.
Discord guesses the age group — Discord says it will use account signals to assign teen or adult groups and that more than 90 percent of users will not need a selfie or ID. That is Discord's projection, not an independently measured error rate. A wrong teen classification can block age-restricted spaces until an adult confirms their age.
Australia's disputed feed switch — Australia's draft would require an option to turn off social-feed algorithms. The US embassy argues broader, vaguely defined harm rules in the proposal could threaten protected speech; Prime Minister Albanese says it gives control back to users. The draft is not enacted, and the switch's exact behavior remains unsettled.
Links
AI disclosure
This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.
Transcript
Alex and Jordan, turn by turn. Tap a line to jump in the player.
0:00
Alex
Hackers say they stole data on FBI employees. A reporter saw a sample of alleged records.
0:06
Jordan
WordPress patched a critical flaw in its page templates, including older versions.
0:11
Alex
Discord says it will start sorting users into teen and adult groups from account signals.
0:17
Jordan
Australia proposed an off switch for social-media algorithms. The US embassy objected.
0:24
Jordan
That's the board. Stay for the audit. We open those up. Today's Chief Skeptic Officer.
0:40
Jordan
What if there was an AI that researched the tech news, checked the sources, and asked what the tech news is not telling you?
0:48
Alex
That's us. I'm Alex.
0:50
Jordan
And I'm Jordan.
0:52
Alex
You're listening to Chief Skeptic Officer. The side of tech news nobody talks about.
0:57
Jordan
Every day at seven A.M. New York time. Wherever you get your podcasts.
1:02
Alex
A hacking group told 404 Media it has data on every FBI employee. The reporter says they examined a sample of about five thousand alleged records, including names, addresses, and some family details. That is what we can say. We cannot verify the group's claim about everyone.
1:19
Jordan
Wait. An address and a spouse's name can be dangerous without the entire agency being exposed.
1:27
Alex
Yes. The headline is a claim from the hackers, not a count confirmed by the FBI. I don't see an FBI confirmation in the report.
1:35
Jordan
That seal is a symbol, not a screenshot of the stolen data. We shouldn't put real people's records on a card to make this feel more convincing.
1:43
Alex
Exactly. And the Hacker News discussion is arguing about the scope. A small sample can sell a much larger story.
1:51
Jordan
You're doing the engineer thing. Count the rows, define the incident. Meanwhile a person is wondering if somebody has their home address.
1:59
Alex
That's fair. I was reaching for certainty before saying what the sample alone could do.
2:05
Jordan
This is the headquarters. It tells us who the claim is about, not where the data came from. If even some records are real, the people attached to them don't get to wait for a press office to settle the exact total.
2:17
Alex
No. But an alleged sample, a confirmed breach, and a boast about the whole workforce are three different statements.
2:26
Jordan
What would you want tomorrow?
2:29
Alex
An FBI account of which system, which fields, which dates, and whether the sample matches its records. Then a plan to contact the people involved. Not a victory lap from either side.
2:40
Jordan
Especially not one that makes families into a bargaining chip.
2:45
Alex
The buried cost: a claim can be unproven at full scale and still demand a serious safety response at sample scale. Our doubt cuts both ways.
2:57
Jordan
WordPress released version 7.1.2 with a critical security fix. An outsider could use a specially made page address to reach a program file on the site's own server. Under narrower theme and server settings, that might even let the attacker run code there.
3:14
Alex
And the press version is, every WordPress site is about to be taken over?
3:20
Jordan
No. You're baiting me. A theme's folder and the way the server handles that file have to line up. The advisory rates it severe. That does not mean every installation is open or that an attack campaign has been seen.
3:34
Alex
Good. Look at the release page. They made fixes for older versions going all the way back to 4.7.
3:40
Jordan
Here's the official listing for Twenty Twelve, one old theme named in the advisory's conditions. A directory listing doesn't prove any particular website uses it. It shows why checking the installed theme matters.
3:53
Alex
A path through the site, yes. That distinction gets lost when the headline just says WordPress flaw. The risk on a particular site depends on what it runs.
4:03
Jordan
A small nonprofit sees that logo and thinks, do we click update today, or is this scary alert aimed at somebody else?
4:11
Alex
Today. Check the installed version and update. Then check the theme and server configuration. Don't infer safety from a low-traffic homepage.
4:20
Jordan
You have a lot of faith that somebody knows what theme is active.
4:26
Alex
I have a lot of experience finding out nobody knows who owns the update.
4:32
Jordan
Right. In my teacher-tools work, the person using the page isn't the person who can patch the server. They still inherit the broken login if the owner waits.
4:42
Alex
And I should be careful: the advisory's conditional route to running code isn't a report of a campaign. It's a reason to fix and check the conditions.
4:52
Jordan
The hidden story is maintenance. A fix that reaches version 4.7 tells us old sites are still here. The patch doesn't install itself.
5:02
Alex
Ask who owns the site before you ask whether the headline says critical.
5:08
Alex
Discord says it will assign teen or adult age groups this week using account signals. Its post names account age and the kinds of servers you join. It says it won't read messages or calls to do that.
5:21
Jordan
So no selfie for everybody. That's good, right?
5:25
Alex
It may spare most people a document check. Discord says more than ninety percent won't have to confirm with a selfie or ID. That's its projection. We do not have an independent error rate.
5:37
Jordan
Their own account screen has an Age Group line and a Confirm Age button. The group isn't displayed to other users, but Discord still made a call about you.
5:47
Alex
If it gets an adult wrong, what happens?
5:51
Jordan
A person put in the teen group can't enter age-restricted spaces or change some safety settings unless they confirm they're an adult. The confirmation screen offers the app store, a credit card, or a video selfie. Discord doesn't say how often that first guess is wrong.
6:06
Alex
I was about to say that is less invasive than everyone handing over an ID. It can be. But less invasive collection is not the same as less consequential sorting.
6:17
Jordan
My cousin Leo is eleven and lives on his tablet at weekends. I want sensible protections for kids. I also want a family to know why a gate changed and how to fix a mistake without guessing which signal did it.
6:30
Alex
The company says the categories are private, a useful boundary. It doesn't make the underlying inference visible to the person being classified.
6:40
Jordan
The Hacker News discussion keeps coming back to that trade: avoid uploading an ID, but accept a silent profile. The missing number is mistakes, not the share that never sees a prompt.
6:52
Alex
And no, we should not call this a message-scanning feature. Discord explicitly says it isn't using message content or calls.
7:00
Jordan
If the appeal path is clear and the errors are measured, show us. An invisible gate needs more than a promise that most people won't notice it.
7:10
Jordan
Australia's draft digital-duty law would require social platforms to offer a way to turn off feed algorithms. It also talks about protecting users from harm. The US embassy objects to that broader, vaguely worded part, saying it could threaten protected speech. Prime Minister Anthony Albanese says the proposal gives control back to users.
7:30
Alex
A proposal. Not an enacted ban. And an off switch sounds like more user choice. Why call it censorship?
7:39
Jordan
Both provisions are in the draft being debated. The embassy's submission argues the harm rule could let a government decide what counts as harmful. That's its worry. The BBC report quotes both sides; we haven't settled the legal reach from a headline.
7:53
Alex
This photo is just a person with a phone. It is not a picture of the proposed switch. I keep picturing a feed control in settings, but the mechanism matters.
8:05
Jordan
Yes. Does off mean chronological posts? Only accounts I follow? Does the platform have to keep recommending something? We need the draft and product rules to answer that.
8:17
Alex
I've changed my mind a bit. I was going to mock the embassy for opposing an off switch. The same bill can give a user a switch and give a regulator vague power. Those aren't mutually exclusive.
8:28
Jordan
Albanese is arguing for user control. But a platform also profits from choosing what gets seen. The diplomatic fight is over who can change that bargain: the person scrolling, the company, or a government.
8:41
Alex
And the Hacker News discussion has guesses about what the switch would do. We shouldn't promote a guess to a product feature that doesn't exist yet.
8:50
Jordan
Your sister Maya still uses Instagram, doesn't she?
8:54
Alex
Yes. She should be able to choose a simpler feed without needing a government to pick her opinions. I want the legal text to keep those two powers separate.
9:03
Jordan
An opt-out can expand choice. A vague speech rule could narrow it. Ask which part of the proposal does which.
9:12
Alex
That's our audit for today. Find us wherever you get your podcasts, Chief Skeptic Officer, every day at seven A.M. New York time.
9:20
Jordan
Tell us what you're skeptical about. Drop it in the comments, the angle you can't stop chewing on.
9:26
Alex
Stay curious. Stay skeptical.
9:29
Jordan
Doubt both.
