AWS says data in all three Bahrain zones and one UAE zone is unrecoverable after attacks on its infrastructure. Multiple copies can still share a regional disaster. Also: Cisco confirms an exploited network-access flaw; California faces broadband funding conditions reaching beyond funded homes; a GitHub copyright ruling resolves one narrow claim; and Signal's Android beta offers registration without a phone number, with no recovery for lost account credentials.

Hosts: Alex & Jordan

Show: Chief Skeptic Officer — The side of tech news nobody talks about.

Drop: Daily at 7:00 A.M. America/New_York

Episode date: 2026-09-17

In this episode

• AWS data loss and regional recovery — Ars reports AWS's September 15 confirmation that resources and data in all three Bahrain availability zones and UAE zone mec1-az2 are unrecoverable. Recovery continues in the other two UAE zones. The fresh disclosure follows earlier strikes. Copies in separate buildings can still share a regional disaster. Customer counts and the survival of independent backups are not established by this report.
• Cisco patching and prior compromise — Cisco confirms active exploitation of an authentication bypass affecting Identity Services Engine and ISE-PIC. Updates are available and there is no workaround. Administrators also need to investigate prior compromise, including external logs, because attackers may hide local evidence. Installing a patch alone cannot establish whether an attacker already gained access.
• California broadband funding conditions — Federal BEAD grant conditions restrict state regulation of funded providers and their affiliates, including service at non-funded locations. Stanford law professor Barbara van Schewick argues California should challenge those conditions. The potential duration extends through construction and the federal-interest period. The September 17 CPUC plan-revision vote is not itself acceptance of those terms.
• GitHub wins one copyright claim — The September 16 appeals opinion in Doe v. GitHub rejects the pleaded theory that generating output without copyright-management information constitutes removal of that information. It does not resolve copyright infringement or all AI-training questions. The input theory was forfeited and contract claims remain pending.
• Signal accounts without phone numbers — Signal's Android 8.28 beta introduces optional new accounts without a phone number. A one-time US $3 payment uses Google Play, with regional price variation. Payment is designed to be cryptographically unlinked from the Signal account. Users must preserve the Account ID and Account Key: lost credentials cannot be recovered. Existing numbered accounts cannot yet remove their number through this feature.

Links

• Ars Technica — AWS data-loss disclosure
• AWS — Availability Zones
• Cisco — exploited ISE authentication bypass
• Stanford — California broadband funding conditions
• NTIA — BEAD grant terms, section 50
• CPUC — California BEAD final proposal
• Court opinion — Doe v. GitHub
• EFF — GitHub copyright ruling
• Signal — Android 8.28 beta release post

AI disclosure

This episode was created with artificial intelligence. Alex & Jordan are AI hosts; their voices and conversation are generated with AI. Research and editorial judgment shape the skeptic angles; we do not invent quotes, scores, or viral claims about the news.