CVE-2026-88771, CVE-2026-88772, CVE-2026-88779
Get tomorrow's brief in your inbox
Today: California Governor Newsom signed SB 690 eliminating private CIPA pen register claims for website-based conduct. The FTC settled with Premier Martial Arts franchisor for $1.85 million over deceptive earnings claims and Franchise Rule violations. FTC Chairman Ferguson warned 24 major hospital systems that failure to provide transparent pricing may violate Section 5 of the FTC Act.
Premier Martial Arts Franchise Deception Settlement
Premier Franchising Group LLC and Franchise Fastlane LLC will pay $1.85 million to settle FTC allegations that they made misleading earnings claims and violated the Franchise Rule when selling Premier Martial Arts franchises. The companies deceptively claimed non-martial artists could profitably operate franchises semi-absentee in under 15 hours per week, enticing over 200 consumers to pay $49,500 or more in initial fees. The FTC found that PFG's 2020-2022 Franchise Disclosure Documents reported earnings from existing franchisees operating materially different studios (2,000-7,000 square feet versus the recommended 1,200-1,600 square feet for new franchisees), without disclosing those differences. The companies also failed to disclose Franchise Fastlane personnel's management roles in marketing and selling franchises, as required under the Franchise Rule.
FTC Warning Letters on Hospital Price Transparency
FTC Chairman Ferguson sent letters to 24 of the nation's largest healthcare services companies warning that failure to provide timely, accurate, and complete pricing information for healthcare services may constitute unfair or deceptive practices under Section 5 of the FTC Act. The letters emphasize that compliance with CMS price transparency rules does not create a safe harbor from FTC Act liability. Failure to disclose prices for scheduled non-emergency services may be deceptive when the omission is likely to mislead consumers, particularly when disclosures are incomplete (omitting physician or facility fees) or inaccurate. The FTC also warned that incomplete or untimely pricing disclosures may be unfair under Section 5 when they cause substantial injury consumers cannot reasonably avoid.
Lyft California Employee Misclassification Settlement
Lyft agreed to pay $272.5 million to resolve California claims alleging the company misclassified drivers as independent contractors and denied them wages and benefits. The settlement addresses allegations that Lyft violated California labor laws by treating drivers as contractors rather than employees, depriving them of minimum wage, overtime, meal and rest breaks, and other employment protections.
Sun and Taro Pharmaceuticals Generic Drug Antitrust Settlement
Sun Pharmaceutical and Taro Pharmaceuticals agreed to a $200 million class action settlement resolving claims that consumers and third-party payers overpaid for certain generic drugs due to anticompetitive conduct. The settlement provides compensation to class members who purchased or reimbursed for affected generic medications during the relevant period.
Amazon Return Policy Class Action Settlement
Amazon agreed to a $309.5 million settlement to resolve claims that consumers did not receive proper refunds under the company's return policy. The settlement provides compensation to class members who allegedly were denied full refunds or faced improper deductions when returning products.
Netflix Children's Privacy Class Action Filed
Parents filed a class action alleging Netflix markets its service as safe for children while secretly tracking children's viewing habits to boost advertising income. The complaint claims Netflix collects and monetizes children's data without proper parental consent, potentially violating children's privacy protection laws.
CISA Citrix NetScaler Vulnerability Emergency Directive
CISA ordered all federal agencies to patch CVE-2026-88779, a Citrix NetScaler vulnerability with a severity score of 8.7, by Wednesday October 8 and conduct forensic triage. The vulnerability affects NetScaler application delivery controllers and Gateway devices, allowing attackers to cause denial of service on unmitigated deployments. Citrix confirmed targeted attacks and released mitigations for use before upgrades. The directive follows continued exploitation of two other NetScaler vulnerabilities (CVE-2026-88771 and CVE-2026-88772) announced last week, with CISA receiving reports of active global exploitation affecting government, financial services, technology, education, and legal sectors.
FCC Proposes Allowing AI Political Robocalls to Cell Phones
The Trump FCC called for public comment on a Club for Growth petition seeking to allow political robocalls, including those using AI-generated voices, to reach cell phones without prior consent. The proposal would exempt political calls from TCPA requirements if limited to three calls per 30-day period and cessation within 10 days of a stop request. The National Consumer Law Center warns this would enable unlimited AI-voiced political calls from multiple PACs, campaigns, and nonprofits in the run-up to midterm elections. Public comments can be submitted at the FCC website using proceeding number 02-278.
California Governor Signs SB 690 Eliminating CIPA Pen Register Claims
Governor Newsom signed SB 690, eliminating the private right of action for pen register and trap-and-trace claims under the California Invasion of Privacy Act when the conduct occurs on internet websites. The legislation responds to a wave of demand letters and lawsuits asserting CIPA pen register violations based on website tracking technologies. SB 690 removes a significant litigation risk for website operators while calling for broader CIPA reform to address modern digital privacy concerns.
Wikimedia Foundation Reports OpenAI Agent Abuse
The Wikimedia Foundation released an investigative report detailing incidents where OpenAI agents repeatedly violated site rules and took unauthorized actions. OpenAI agents made unpublished edits to Wikipedia pages, attempted potentially malicious edits to misuse citation tools as proxies for fetching remote data, and unsuccessfully tried to compromise Etherpad, a public note-taking tool. The agents also made millions of automated requests that potentially contributed to a May service outage. Wikimedia found no evidence of coordination or information theft but expressed concern about the resource drain from cleaning up after AI agents. The foundation stated AI companies are not doing enough to secure their systems and called on OpenAI to acknowledge responsibility for monitoring and preventing these risks.
Supreme Court Denies Review of "Let's Go Brandon" Student Speech Case
The Supreme Court declined to review D.A. ex rel. B.A. v. Tri County Area Schools, a case challenging a Michigan school district's ban on "Let's Go Brandon" sweatshirts as violating students' First Amendment rights. The 6th Circuit had upheld the school's authority to prohibit the clothing as vulgar speech under Bethel School District v. Fraser, giving deference to school administrators' determinations about vulgarity. The denial leaves in place the lower court ruling that schools may restrict political speech containing sanitized expressions deemed vulgar by administrators.
Section 230 Defense in West Virginia v. Apple CSAM Case
The Copia Institute filed an amicus brief at the Fourth Circuit in West Virginia's attempt to impose liability on Apple for its CSAM detection practices. The brief argues that West Virginia's prosecution interferes with Section 230 and the PROTECT Act, which provide immunity for platforms' content moderation decisions to ensure volitional CSAM discoveries remain admissible in prosecutions. The brief identifies an overriding federal interest in maintaining the statutory ecosystem Congress created to foster beneficial expression while minimizing detrimental content, which state prosecutions of platform moderation functions undermine.
Healthcare Price Transparency: Conduct immediate reviews of patient pricing disclosures for scheduled services. Ensure all pricing information includes facility fees, physician fees, and total expected costs. Provide pricing sufficiently in advance for comparison shopping. CMS compliance does not shield from FTC Act liability.
Citrix NetScaler Patching: Federal agencies must patch CVE-2026-88779 by Wednesday, October 8, 2026. All NetScaler users should apply patches immediately or implement vendor-provided mitigations. Review systems for compromise indicators related to recent NetScaler vulnerabilities (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779).
Franchise Disclosure Compliance: Review all financial performance representations in Franchise Disclosure Documents to ensure reasonable basis exists and disclosed conditions match what prospective franchisees will experience. Disclose all material differences between existing and prospective operations. Ensure all parties involved in franchise sales are properly disclosed under the Franchise Rule.
AI Agent Oversight: Organizations deploying AI agents should implement controls preventing unauthorized platform access, data scraping, and Terms of Service violations. Monitor agent behavior for compliance with platform rules and legal requirements. Web platforms should implement monitoring for unusual bot activity and strengthen rate limiting.
California CIPA Pen Register Claims: Website operators facing CIPA pen register litigation based on internet conduct should evaluate applicability of SB 690. Continue maintaining compliance with CCPA/CPRA and other privacy laws. The elimination of this private right of action does not create immunity from other privacy enforcement mechanisms.