LuaRocks Patches Server Flaw but Users Still Need to Reset Access

LuaRocks fixed a server vulnerability and revoked credentials after finding earlier attacks. Account recovery and client upgrades still matter, and the package audit has limits. Also: Fireworks' Ember-1 token-efficiency claim, Honor's Magic 9 Pro Max, Google's custom AI voices, and the teen-feed choice in Alabama's TikTok settlement.

Hosts: Alex & Jordan

Show: Chief Skeptic Officer — The side of tech news nobody talks about.

Drop: Daily at 7:00 A.M. America/New_York

Episode date: 2026-09-28

In this episode

• The patch leaves work — LuaRocks says its server was exploited between July 9 and August 20. The flaw was fixed September 26. Users should follow the incident notice on passwords, replacement API keys, two-factor authentication and client upgrades. An external package mirror helped check stored files; it cannot establish everything served to individual users.
• Fewer tokens per task — Catch-up from September 23: Fireworks' Ember-1 is available through its API at $3 per million input tokens and $15 per million output tokens. The company claims roughly 40% fewer tokens in its tests. Published unit prices and real task savings are different measures; quality and retries matter.
• Honor's bigger battery — Honor launched its Magic 9 series in China on September 28. The Pro Max has an 8,800mAh battery and Arri camera features. International release timing remains unannounced, and capacity alone does not prove endurance.
• Custom voices, limited access — Catch-up from September 23: Google's Gemini 3.8 Flash and Flash-Lite text-to-speech models add voice design and replication. Google describes consent verification and SynthID watermarks. AI Studio voice replication has geographic exclusions, including the UK, EEA and India.
• TikTok's feed choice — Alabama announced a TikTok settlement September 25 worth at least $100 million. The actual agreement applies compliance provisions in Alabama and requires an option to choose a non-personalized default feed within nine months, with no preselected answer. That is narrower than an automatic default switch. Teen users are defined as identified or stated ages 13–17; linked parents can enable the option. Implementation still needs verification.

Links

• LuaRocks incident notice and user recovery steps
• Researcher's LuaRocks vulnerability disclosure
• External package mirror
• Fireworks Ember-1 announcement and vendor benchmarks
• Ember-1 availability and pricing
• The Verge on Honor's Magic 9 Pro Max
• Google's Gemini 3.8 text-to-speech announcement
• Alabama Attorney General's TikTok settlement announcement
• TikTok consent decree, sections 2.21, 3.1 and 3.22

AI disclosure

This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.