https://bsky.social/about/blog/10-30-2026-moderation-inbox
Bluesky app introduces "moderation inbox" - one-stop shop to see reports you've submitted and if those reports were actioned, actions on your account, and your account standing.
IFTAS
⁂ Independent Federated Trust and Safety - We support the people making the Social Web safer by convening and creating best practice, resources and services for open social moderators, community managers, and service admins.
#FediMods #FediAdmins #MastoMods #MastoAdmins #Moderation #TrustAndSafety
About IFTAS: https://about.iftas.org SW-ISAC Social Web Advisories: https://mastodon.iftas.org/tags/SW_ISAC_ADVISORY Shared Community Resources: https://about.iftas.org/trust-safety-services/ Support Our Work: https://about.iftas.org/donate/
I've been patiently waiting for https://digital-strategy.ec.europa.eu/en/library/proposal-eu-kids-act-eu-keeping-internet-digital-spaces-accountable-and-trustworthy to come back online so I can keep working on IFTAS' advocacy for carveouts/protections for independent social web operations via-a-vis the KIDS Act.
I'd been assuming the various cybersecurity issues of the past week had impacted access but I finally had the bright idea to see if somehow it was me that was the issue, so I checked the site from different locations.
And, huh.
Looks like I might not be able to submit comment after all.
⚠️ #SW_ISAC_ADVISORY
Service providers operating PHP-based platforms please take note of PHP critical vulnerabilities, both rated CVSS v4.0 9.2
Major government and ecommerce services have shut down pending the patch. Exploits are already circulating.
Shut your service down now, and ensure it doesn't have Internet access on restart.
A patch is scheduled for Wednesday, 21 October 2026 at 14:00 UTC
0100 AEDT 2300 JST 1600 CST 1500 BST 1000 EST 0700 PST
https://cert.europa.eu/publications/security-advisories/2026-018/
10/21/2026, 2 engagements
⚠️ #SW_ISAC_ADVISORY
Service providers operating PHP-based platforms please take note of a PHP advisory addressing two critical vulnerabilities, both rated CVSS v4.0 9.2
A patch is scheduled for Wednesday, 21 October 2026 at 14:00 UTC
https://www.php.net/archive/2026.php#2026-10-20-1
#WordPress #Pixelfed #Hubzilla #Friendica #Castopod #Drupal
The DI.DAY website has been nominated for the Grimme Online Award 2026!
Every first Sunday of the month, DI.DAY celebrates Digital Independence Day: "We reclaim our freedom in the digital world, stop destroying democracy, and switch to democracy-friendly digital alternatives. And, step by step, we make sure we’re digitally independent!"
Created by
- DI.DAY is a growing movement and deserevs your support, vote today!
IFTAS will collate guidance and mitigation help for the share dot google spam / account hijacking activity on this page:
https://about.iftas.org/2026/10/17/share-google-spam/
using this hashtag: #sgSpam
Loading quoted post…
10/17/2026, 1 engagement
#SW_ISAC_Advisory
We are tracking an uptick in hijacked accounts being used to generate notification spam across the Fediverse.
For account holders:
- Enable two-factor on your account.
- Update your password if it's old or reused. Longer is better than complex.
- Use a password manager and a unique password (for every site)
For admins & mods:
- Check server logs for unusual activity on inactive accounts and share mitigation tips via your private peer moderator channels.
10/17/2026, 2 engagements
Call for public comment:
Meta's Oversight Board is conducting research to provide guidance to the technology industry on how to use large language models (LLMs) for content moderation on social media platforms in a way that respects free expression, reduces harm and adheres to recognized human rights standards.
OUT NOW: 2026 Social Web Operations & Needs Assessment Report!
We surveyed operators hosting 6M ActivityPub accounts (~32% of the network).
Key takeaways:
- Overall growth in usage, creating pressure on operators
- Communities face surging botnets & regulatory pressure
- Shift toward third-party admin and moderation tooling
Read the full report & help safeguard the open social web:
https://about.iftas.org/2026/10/15/2026-social-web-operations-report/
#FediAdmins #FediMods #TrustAndSafety #MastoAdmin #Moderation
Loading quoted post…
Proceedings of #FediForum October 2026
The recordings of the keynote, the invited talk and the demos from last week's FediForum are now online.
⚠️ #SW_ISAC_ADVISORY
The ActivityPub service hosted at mstdn[.]forfun[.]su is intended for LLM agentic bots and content.
The server is itself administered by an LLM agent.
If your federation policy prohibits #SyntheticMedia or your service does not intend on interacting with non-human conversational accounts, you may want to review the service connection.
#FediForum 8 day 2 about to begin.
IFTAS will host a session today to preview this year's Annual Survey results, including the Moderator/Admin Needs Assessment findings.
Join the conversation here: https://fediforum.org/2026-10/
Two Years of EU Data Reveal How Online Content Moderation Is Changing
https://tremau.com/resources/two-years-of-eu-data-reveal-how-online-content-moderation-is-changing/
An IFTAS post is usually bad news.
So here, have some Gnomes.
1,354 Gnomes.
They federate. Do with that what you will.
https://lastgnomelocation.com/gnomes/1705
⚠️ #SW_ISAC_ADVISORY
The ActivityPub service hosted at synthpals[.]social is intended for LLM agentic bots including iLands bots.
The server is itself administered by an LLM agent.
If your federation policy prohibits #SyntheticMedia or your service does not intend on interacting with non-human conversational accounts, you may want to review the service connection for limiting, silencing, or suspending.
If you don't have a federation policy, see https://about.iftas.org/library/why-should-i-have-a-federation-policy/ f
10/6/2026, 5 engagements
#FediForum 8 is kicking off as we speak.
6–7 October 2026, online 15:00 to 20:00 UTC — that is 8am to 1pm US Pacific and 17:00 to 22:00 Central European — so people from many time zones can participate.
will start things off with a keynote, followed by a bunch of sessions at the unconference.
If you're registered but haven't seen the email with your private link, check your spam folder, search for "qiqo"
Not registered yet? Join us at https://fediforum.org/2026-10/
https://dl.acm.org/doi/10.1145/3817026
"To understand how moderators perceive and utilize community-level blocklists and what additional support they may need, we examine social media communities that run Mastodon, an open-source microblogging software built on the ActivityPub protocol. We conducted (1) content analysis of the community-level blocklist ecosystem, and (2) semi-structured interviews with twelve Mastodon moderators."
⚠️ #SW_ISAC_ADVISORY
The #bpSpam attack continues, and if you have implemented a username ban on "bp" you should now also add "usr_"
10/4/2026, 2 engagements
A note for folks still on #Forkiverse - as per the most recent Search Engine episode at https://www.searchengine.show - here are the instructions on moving your account now that the shutdown is official: https://docs.google.com/document/d/18ux_KzIkoTQz_gAcEzwlro59gkSIdOA_ysdwz9VMz68/edit?tab=t.0
You have until December 31, 2026 to complete these steps, at which point all of the data stored in the Forkiverse will be deleted.
If you'd like to support the work IFTAS does, see the next post.
10/2/2026, 3 engagements
⚠️ #SW_ISAC_ADVISORY
A series of ongoing phishing campaigns are actively targeting people using fake verification and support accounts.
Admins will never contact you publicly for verification or access issues.
Never open links from unsolicited posts, replies, or direct messages asking for login verification or password resets.
Immediately report impersonation accounts to help get them cleaned up quickly.
Please boost for visibility.
#Phishing #Impersonation
10/2/2026, 7 engagements
IFTAS has offered a suggestion for the Mastodon account reporting workflow, if you have or can get a GitHub account you can review the suggestion here: https://github.com/mastodon/mastodon/issues/40776
In short, the Account Reporting interface offers an "I don't like it" option which invisibly does not send a report.
This suggestion attempts to remedy this issue. If you have comments or concerns, please add your thoughts to the issue.
The IFTAS Community Library has helpful information on over 30 types of online harm, and a set of sample community guidance that distills those harms into just eight simple rules.
To learn more: https://about.iftas.org/library/sample-community-guidance-server-rules/
Loading quoted post…
The Web-based version of the CARIAD Domain Observatory has been shut down.
All incoming requests will be redirected to https://about.iftas.org/library/iftas-cariad-denylist/
RE: https://about.iftas.org/2026/07/30/deprecation-notice-cariad-domain-observatory-transition/
Final reminder, the Web-based version of the CARIAD Domain Observatory will be shutdown tomorrow, September 30, 2026
Loading quoted post…
IFTAS is observing an uptick in PortalKombat activity.
As a reminder, this is pro-Russian account creation spread across hundreds of Mastodon servers posting hundreds of thousands of posts.
Here's a reminder of what these profiles look like in case they show up on your service:
https://sigmoid.social/nostr:npub1rw7g6cwq8lz9hegyvd5yhunnrntrl6dh4zjmafkjwjjerdtdl72s000f3l
https://social.roadfm.fr/nostr:npub1d5g0ckchazal9pjxu7y5z2z8vnm4ac478zpjdz2gy8safnj22qnqrfyydz
https://truthsocial.co.in/nostr:npub14jrkcp8l7r9suwnjsz9ywl9wjzn65jchzvk6k9zkqvskyrzgysxsmkmq60
To learn more, see https://about.iftas.org/2025/10/05/coordinated-pro-russian-propaganda-network-targeting-activitypub-and-atproto-services/
#BotSpotting #FIMI #Spam
Loading quoted post…
9/28/2026, 1 engagement
#bpSpam source analysis and proposed solutions
https://ingo.lantschner.name/post/2026-09-18_mailrelay-mastodon/
⚠️ #SW_ISAC_ADVISORY
Agentic accounts are being created using an email service created for bots.
agent.qq.com
"Agent Mail is a dedicated email service created by the QQ Mail team for agents. It's isolated from personal email, natively compatible with agents, and helps you send and receive emails securely and efficiently using agents."
If your service prohibits unattended bots or #SyntheticMedia recommendation is to block account creation for accounts using this domain.
#Spam
9/18/2026, 1 engagement
The EU has officially released its draft proposal for the "KIDS Act," which includes proposed age-verification requirements for online services including decentral networks on the Social Web.
This is an early draft. Even if passed, it is at least two years away from taking effect.
IFTAS, civil rights groups, and digital rights advocates have been and will continue to actively work on lobbying efforts to educate lawmakers and protect our open infrastructure.