DEV Community: Tahir Almas

NYC Wants Every Support Bot to Offer a Human in One Step, and to Log It

Tahir Almas — Sat, 24 Oct 2026 18:47:38 +0000

Originally published at ictdesk.net

On 20 October 2026, New York City proposed a rule that treats bot-only customer service as presumptively deceptive. You'd have to say up front that it's a bot, offer a one-step route to a person, and log every bot conversation for three years. For anyone running live support software, the logging is the part to plan for now.

What the city proposed

The Department of Consumer and Worker Protection (DCWP) published the proposal under its Consumer Protection Law powers. It adds a new section 5-02 and a new Subchapter U to Chapter 5 of Title 6 of the Rules of the City of New York. We read the rule text itself, not the press coverage. It's short, and it's more specific than most headlines suggest.

Its definition of an automated customer service system is broad. It covers any technology where "all or substantially all" of the communication comes from the technology rather than a person. That takes in an LLM chat agent, a rules-based chatbot and a phone IVR alike. Customer service is defined just as widely: help with a product, account, refund, bill, complaint, cancellation, fraud claim or dispute.

The four obligations

Don't promise a channel you don't staff (5-311)

If you label an email address, phone number or chat as "customer service" or "contact us", real customer service has to happen there. A bare address with no such label isn't treated as a promise. Audit your footer and contact page with that in mind.

Say it's a bot, at the start (5-312(a))

The disclosure must be clear and conspicuous, made at the beginning of the conversation, and in the language the conversation is happening in. A Spanish-language chat that opens with an English disclaimer wouldn't meet it. If you already handle the EU AI Act's disclosure duty, you're most of the way there, but check the language point.

Give people a way to a human (5-312(b) and (c))

This is the heart of it. It's a deceptive and unconscionable practice to promise customer service and then repeatedly and unreasonably send people to menus that don't address their question, or answer with "unresponsive, irrelevant, or erroneous information". That's the doom loop, written into a rule.

Then comes the presumption. If you run a bot and don't offer a human option, you're presumed to be breaking that rule. You can rebut the presumption, but you start out losing. There are two ways to stay clear of it:

A single-step transfer. One clearly named action at any point, such as "Say or type agent" or "Press 0", that starts a transfer to or queues for a person. No extra questions, no reason demanded, no further menus, except a menu that only routes the customer to the right team. If there's a queue, tell them the estimated wait.
An alternative, when nobody's free or the queue is unreasonably long. The rule lists seven options, and you need at least one: the hours when live transfer works, a phone number with hours, live chat with hours, a message with a promised reply timeframe, a contact form with a timeframe, a text number with a timeframe, or an email address with a timeframe.

Notice that every alternative comes with either hours or a timeframe. "Leave a message and we'll get back to you" doesn't qualify. "We'll reply within one business day" does.

Keep the records (5-313)

Most teams will spend their real effort here. For at least three years, in a machine-readable format, you'd keep:

the agreements, licences and setup documents for the bot, plus the dates each model was in use;
a log of every bot conversation showing its duration, whether a one-step transfer was offered, whether the customer used it, and whether they were transferred, queued or given an alternative;
yearly totals, covered below;
the exact wording and format of the disclosure you showed;
a record of the alternative routes to a person you offered.

The number that will sting

The yearly totals include total bot conversations, how many were resolved without a transfer, how many customers asked for a transfer, and the average length. One more item says a lot about what the city expects to find: how many bot conversations came from someone who'd already talked to the bot in the previous 72 hours.

That's the doom loop, counted. A bot can report a high resolution rate because people give up and close the window. Then they come back the next day with the same problem. The 72-hour repeat count catches exactly that. It's the same gap we wrote about in deflection versus resolution, and this would make it a figure you hand to a regulator.

"The AI did it" is no defense

The new section 5-02 applies across DCWP's whole jurisdiction, not just chatbots. It isn't a defense that you "directly or indirectly used or relied on a technology" that made the claim, left out the information, did the violating act or helped with it. It's the same principle a German court applied this year when it held a clinic liable for what its website chatbot invented, which we covered in a German court says your support bot speaks for you.

Penalties and dates

The proposed schedule is $525 for a first violation, $1,050 for a second and $3,500 for a third or later, for each of the four rules. Each subdivision charged counts as a separate violation. The certification from the Mayor's Office of Operations says there's no cure period.

The public hearing is at 11:00 a.m. on 19 November 2026, by phone and video. There's a discrepancy on comments. The printed notice says comments must arrive on or before 19 November, while the city's rules portal lists 18 December. If you plan to comment, aim for the earlier date.

It's a proposal, not law. Wording can change after comments, and nothing applies until DCWP adopts a final rule. It also covers merchants dealing with New York City consumers, not everyone, everywhere. But California's AB 1609, signed on 28 September 2026, already bars larger businesses from passing a chatbot off as a human. Rules like this tend to travel.

What to check in your own setup

In ICTDesk, a visitor who types "talk to a human", or reaches a point where the AI's confidence is low, is transferred to the next available live agent. The agent sees the full conversation history, so the visitor doesn't repeat themselves, and the full transcript is saved. When your team is offline, the AI keeps answering routine questions, and anything it can't handle lands in your inbox for an agent to pick up later. Chat Reports split AI and agent performance. Our support center covers the setup.

Measured against the proposal, the gaps to close are mostly wording and records, not technology:

Make the greeting say plainly that it's an AI assistant, in each language you serve.
Name the transfer phrase in the greeting itself, not only when the bot gets stuck. The rule wants it offered as a clear, named option.
When nobody's online, state a reply timeframe in the offline message and your live hours.
Decide where the four per-conversation fields will come from, and export transcripts on a schedule that gives you three years of history.
Start counting 72-hour repeat contacts now, so you see your own number before anyone else asks for it.

FAQ

Is the NYC chatbot rule in force?

No. DCWP proposed it on 20 October 2026. It holds a public hearing on 19 November, takes comments, and only then can adopt a final version, which may differ from the draft.

Does it apply to businesses outside New York City?

It applies to merchants under DCWP's Consumer Protection Law jurisdiction, which turns on dealings with New York City consumers. If you sell to people in the city, assume it reaches you, and check with counsel for your situation.

Does a phone IVR count, or only chatbots?

Both. The definition covers any technology that handles all or substantially all of the communication, and the rule's own examples of a single-step transfer include "Press 0".

We only offer chat during business hours. Is that allowed?

Yes, if the bot tells people the hours when a person is available, or gives another route with a stated timeframe, such as a contact form with a promised reply time. A bot with no human option at any hour is what triggers the presumption.

Can the bot ask a question before transferring?

Only to route the customer to the right team. The definition of a single-step transfer bars extra automated steps, extra questions or asking the customer to justify the request, except for a menu that "serves solely to route" them.

What happens if we can't produce the logs?

Failing to keep or produce the required records is a violation in its own right, on the same $525, $1,050 and $3,500 schedule as the other three rules.

Source: NYC Department of Consumer and Worker Protection, Notice of Public Hearing and Opportunity to Comment on Proposed Rules Regarding Automated Customer Service Systems, published 20 October 2026, and the NYC Rules portal listing for the same proposal.

Santa Barbara Lost Mobile 911 for the Third Time in a Year. Where Does Your PBX Send 911?

Tahir Almas — Sat, 24 Oct 2026 18:44:37 +0000

Originally published at ictpbx.com

On Thursday 22 October 2026, AT&T and T-Mobile customers in Santa Barbara couldn't reach 911 by voice from 8:15 a.m. to 4:35 p.m. It's the city's third wireless 911 outage in about a year. Your PBX software can't fix a carrier's cut fiber. It can decide whether your office has a second way out.

What happened on Thursday

The city of Santa Barbara put out the alert that morning: 911 voice calls were failing for AT&T and T-Mobile customers. Callers were told to ring the police department's 24/7 dispatch line on a 10-digit number instead, or to text 911, which kept working the whole time. Service came back at 4:35 p.m., according to the Santa Barbara Independent.

Santa Barbara wasn't alone. Riverside County lost 911 for the same two carriers the same day, and Riverside City College police put it down to a cut line. AT&T pointed at damage to another provider's fiber in the Los Angeles area, possibly linked to theft. Oakland had trouble too, but a different kind: its computer-aided dispatch system froze. That one sat inside the dispatch center, and no office phone system could have helped.

The pattern is what should bother you. In January the Independent described a 6 January AT&T outage, caused by physical damage to fiber owned by an outside provider, as the second such incident in months, after a late-October 2025 failure that took out wireless 911 for nearly a full day. Thursday makes three.

Every fallback said the same thing

Look at what officials told people each time. Use a landline. Use a phone on another carrier. Text instead. Call this 10-digit number. Every piece of advice comes down to one idea: take a different path to the dispatcher.

For an office, that different path is the phone system. Your desk phones don't care which mobile network is down. They care which trunk your PBX sends 911 down, which carrier sits behind that trunk, and whether that carrier's cable shares a trench with the one somebody just cut.

Most offices have never traced it. The 911 route was set up when the system went in, it worked on day one, and nobody has looked since.

Trace the call, one box at a time

A 911 call from a desk phone passes through five places. You configure two of them. You only choose who runs the other three.

1. The phone

Under Kari's Law, a multi-line telephone system has to let someone dial 911 directly, with no 9 or other prefix first. It also has to notify a central point on site, such as the front desk or security, when someone does, where that's feasible without new hardware. Dial plans get edited over the years. Check that no change has quietly put a prefix back in front of 911.

2. The route

Open your outbound routes and find the one that matches 911. Note which trunk it points at. In ICTPBX, each outbound route covers one service, matches the destination patterns you give it, and sends calls through the provider you pick, so the answer is one screen away. If your 911 pattern sits inside a catch-all route that also carries long distance, give 911 a route of its own. Then you can repoint emergency calls without touching anything else.

3. The trunks

One trunk is one failure. A second trunk on a different carrier helps only if it really is different: different upstream network, and ideally a different physical way out of your building. Ask both providers how their traffic leaves your area. In ICTPBX the trunks list shows each provider's registration status, so you can see straight away when one has dropped. Setting up a second provider is the same job as the first. Our SIP trunk setup guide walks through it.

4. The 911 service and the address on file

Section 506 of the RAY BAUM'S Act requires a dispatchable location to go with 911 calls from these systems. That means a street address plus the floor or suite a responder needs. The record usually lives with whoever provides your 911 service. It goes stale when people move desks, when a site opens, or when staff take softphones home. Ask your provider what address each extension or site is sending, and fix it before a dispatcher is relying on it.

5. The dispatch center

Both Santa Barbara and Riverside County published 10-digit numbers for people who couldn't get through. Find out what your local dispatch center would publish, and put it somewhere staff will actually look during an outage: the intranet, a card at reception, the on-call runbook. Don't wire it into the dial plan as an automatic 911 substitute. Those lines aren't built for emergency call volume or location data, and that decision belongs to your local public safety agency, not your IT team.

Test without tying up dispatchers

On Thursday, Santa Barbara asked people not to call 911 just to see whether it worked, because every test call takes time away from real emergencies. The same goes for your PBX. Many 911 service providers offer a test number that reads back the location on file, often 933. Ask yours which number it supports, and use it after any dial plan or trunk change.

What this won't fix

Be honest about the limits. If the dispatch center's own systems fail, as Oakland's did, nothing in your phone room helps. If both your carriers buy transport from the same backbone, a second trunk may share the very fiber that breaks. And if your 911 traffic and your provider's 911 routing depend on the same regional network, diversity on your side only goes so far.

What you can do is make sure your office isn't the weakest link in the chain. A single trunk, an old prefix in the dial plan and an address that still points at last year's floor plan are all things you can fix this week. If you're still running copper lines alongside the PBX, our piece on copper retirement covers what happens to those backup lines next. The ICTPBX feature list shows where routes, trunks and time conditions live.

FAQ

Did Thursday's outage affect desk phones on VoIP?

The public notices described AT&T and T-Mobile mobile customers. Whether any office system was affected depends on which carrier and path carried its 911 traffic. That's the point of tracing your own.

Is a second SIP trunk enough to protect 911?

It helps only if the second trunk takes a different network and physical route. Two providers reselling the same upstream carrier can fail together. Ask each provider how their traffic leaves your area before counting on it.

Can we automatically send 911 to the 10-digit dispatch number when the trunk is down?

Don't do it on your own. Those administrative lines usually don't carry caller location the way 911 does, and they aren't staffed for emergency volume. Publish the number to staff, and take any routing decision to your local public safety agency.

What does Kari's Law require from our phone system?

Direct dialing of 911 without a prefix, plus notification to a central location on site when a 911 call is placed, where that's possible without improving the hardware or software. It applies to systems made, sold or installed after 16 February 2020.

Who keeps our dispatchable location up to date?

Usually your 911 service provider holds the record, but you're the one who knows when people move. Treat it as a joint job, and check it whenever you open a site, change floors or send staff home with softphones.

How should we test 911 after a change?

Ask your 911 provider for its test number, often 933, which reads back the location on file without reaching a dispatcher. Never test by calling 911 itself.

Sources: City of Santa Barbara outage notices, 22 October 2026; Santa Barbara Independent, 22 October 2026 and 6 January 2026; NBC Palm Springs and Viewpoints (Riverside City College), 22 October 2026; Gizmodo, 23 October 2026.

The RealPage Renters' Settlement Is Final: How to Check and Claim Before 29 January

Tahir Almas — Thu, 22 Oct 2026 04:18:30 +0000

Originally published at roshni.online

If you rented an apartment in the US between October 2018 and November 2025, you may be owed part of a $359,925,000 settlement. A federal judge gave final approval on 15 October 2026 to settlements with landlords accused of using RealPage software to push rents up. You have until 29 January 2027 to file a claim.

Most people who qualify never got a letter, or threw it away thinking it was junk. That's fine. You don't need a notice to claim. You need to know whether your building is on the list and to file before the deadline. This guide walks through both, plus what you're giving up and what's still being fought over.

What the case is about

The case is called In re RealPage, Inc., Rental Software Antitrust Litigation (No. II). It's in the US District Court for the Middle District of Tennessee, case number 3:23-md-03071, before Judge Waverly D. Crenshaw Jr.

RealPage sells software that recommends rents to landlords. The renters who sued say landlords fed the software private data about their own rents and occupancy, and the software then used that pooled data to recommend higher rents across competing buildings. In plain terms, the claim is that algorithmic pricing let competitors coordinate on rent without ever talking to each other. The landlords deny doing anything wrong. They settled anyway, and as part of the deal they agreed to stop sharing private data with RealPage and to stop using pricing tools that depend on competitors' private data.

Do you qualify?

Three things have to be true.

You paid the rent. You were the tenant on the lease and the rent came from you.
It was during the class period, which runs from 18 October 2018 to 21 November 2025. You only need to have rented there for part of that time, and you don't need to live there now.
The property was owned or managed by a settling landlord that used RealPage pricing software. The settlement covers properties that used RealPage's Revenue Management Solutions, Lease Rent Options, YieldStar or AI Revenue Management. The settling landlords include big names such as Greystar, Equity Residential, Camden Property Trust and Lincoln Property Company, along with dozens of others.

You won't know the third point just from your lease, because tenants were rarely told which software set their rent. The official website, realpagerentalsettlement.com, has a property lookup tool. Search for every address you rented at during those seven years, not just your current one. People move a lot in that time, and each eligible tenancy counts.

How to file a claim

Go to the official settlement website and use the property lookup for each address.
File the claim form online, or print it and post it. A paper claim has to arrive by the deadline, so leave plenty of time for the mail.
Gather what you can: the addresses, the dates you lived there and roughly what you paid. Old lease agreements, bank statements or rent receipts help if you still have them. The form says supporting documents are needed only "if applicable", so don't let missing paperwork stop you from filing.
Keep a copy of what you submit and any confirmation you get.

The deadline is 11:59 p.m. Eastern time on 29 January 2027. The claims administrator is Angeion Group.

A warning that applies to every big settlement: you should never have to pay anything to file. Use the official website, type the address yourself rather than clicking links in texts or emails, and treat anyone asking for a fee or your bank login as a scam.

How much will you get?

Nobody knows yet, and anyone giving you a number is guessing. The money is split pro rata, which means by how much rent you paid during the class period. Someone who rented an expensive apartment for six years gets a bigger share than someone who rented a cheaper one for a few months. The final amount also depends on how many people claim and on fees and administration costs, which come out of the fund first. Fewer claims means bigger shares for those who file.

What you're agreeing to

The deadline to opt out or object was 22 September 2026, and it has passed. If you're in the class, you're bound by the settlement now. In a class settlement, that usually means you can't bring your own separate lawsuit against the settling landlords over the same claims. For most renters that's not a real loss, since a solo antitrust case would cost far more than it could recover. But if you were already planning your own case against one of these landlords, talk to a lawyer before filing a claim.

RealPage itself hasn't settled

This is the part that gets lost in the headlines. The settlements are with the landlords. RealPage is also a defendant, denies any wrongdoing and isn't part of these deals. The claims against RealPage and against landlords that didn't settle are still going. So this may not be the last word in the case, and it's worth keeping your rent records even after you file.

When to get advice

For most people, filing a claim is a 15-minute form, and you don't need a lawyer. It's worth getting advice if you had a business lease rather than a home, if you rented many units, if a roommate or employer paid part of the rent, or if you were already thinking about your own case against a landlord. If you want to talk it through, you can book a session with a verified professional through Roshni's online legal consultation.

If you're curious how courts are treating the tools people now use to research their own legal questions, we also looked at whether your AI chat about your case is private.

This article is general information, not legal advice for your situation.

Frequently asked questions

What is the deadline to file a RealPage settlement claim?

Claims must be submitted online, or received by mail, by 11:59 p.m. Eastern time on 29 January 2027.

Do I need a notice or claim ID to file?

No. If you rented at a covered property during the class period and paid the rent, you can file even if you never got a notice.

How do I know if my apartment used RealPage?

Use the property lookup tool on the official settlement website, realpagerentalsettlement.com. Check every address you rented at between 18 October 2018 and 21 November 2025.

How much money will each renter get?

It isn't known yet. Payments are split according to how much rent each claimant paid during the class period, after fees and costs, so the amount depends on your rent and on how many people file.

Can I still opt out of the settlement?

No. The opt-out and objection deadline was 22 September 2026. Class members are now bound by the settlement.

Did RealPage pay into this settlement?

No. The $359,925,000 comes from the settling landlords. RealPage denies wrongdoing and remains a defendant in the ongoing case.

"This Call May Be Recorded" May Not Cover Your AI Vendor: What Contact Centers Should Check

Tahir Almas — Thu, 22 Oct 2026 04:15:30 +0000

Originally published at ictcontact.com

If an AI tool listens to your customer calls, "this call may be recorded" may not be enough consent. In Ambriz v. Google, callers argue that Google's contact center AI was a third party on their calls, and Google is asking the court to dismiss the case. The answer turns on what your AI vendor is allowed to do with the call data.

The case has been running since 2023, and it's now at the stage where the question gets answered. Courthouse News reported on 13 October 2026 that Google had asked US District Judge Rita F. Lin, in San Francisco, to throw out the remaining claims. The judge took the motion under submission without ruling. Whatever she decides will be read closely by anyone who runs a contact center with AI in the loop.

What the case is about

The plaintiffs called customer service lines that used Google's Cloud Contact Center AI. According to the report, those lines belonged to companies including Verizon, The Home Depot, Discover, Uber, Hulu and GoDaddy. While the calls were happening, Google's software transcribed them and suggested replies to the human agent.

The callers sued under the California Invasion of Privacy Act, usually shortened to CIPA. Section 631 of that law bars anyone other than the parties to a conversation from reading or listening in without everyone's consent. Section 637.2 lets a person sue for $5,000 per violation, which is why these cases are filed as class actions. Multiply $5,000 by every call to a busy support line and the numbers get serious very fast.

Google's lawyer put its position plainly at the hearing: "The consent that is required is only consent that a third party may be present and listening in to the call." In other words, the callers heard a recording notice, so they agreed. The plaintiffs' reply was that "the caller does not have a choice here because they don't get to know what they are consenting to." Nobody told them a separate company was on the line.

The capability test

This isn't the first round. In February 2025 the same judge refused to dismiss the case, and the reasoning is the part every contact center should understand. CIPA treats a recording tool used by one of the parties, such as a tape recorder, very differently from an outside party listening in. The court said Google's product could count as an outside party because it had the capability to use call data for its own purposes, such as improving its models. It didn't matter whether Google actually did that with these calls.

That idea has spread. On 13 August 2026, Judge Eumi K. Lee, in the same court, let the core wiretap and privacy claims against Otter.ai go forward. Otter said it was just a tool used at the direction of the meeting host. The judge rejected that at the pleading stage, because the plaintiffs alleged Otter keeps and uses what it records for its own commercial purposes.

Put the two together and you get a simple test you can apply to your own setup. If your AI vendor can use your call audio or transcripts for anything beyond serving you, a court may treat it as a separate listener. Then the question becomes whether your callers consented to that listener, and a generic recording notice is exactly what's being argued over.

Why this matters outside California

CIPA is a California law, but the caller's location is what usually matters, not yours. If people in California call your support line, this applies to you. California is also one of about a dozen states that require consent from everyone on a call before recording, so the same arguments can show up elsewhere.

We're not lawyers and this isn't legal advice. But you don't need a ruling to tighten the parts you control, and none of them are expensive.

Five checks before a cloud AI touches a customer call

Read the vendor's data terms. Look for a clause that stops the provider using your call audio and transcripts to train or improve its own models. If the default allows it, find out how to switch it off and get that in writing. Under the capability test, the permission matters even if it's never used.
Say more than "this call may be recorded." Something like "this call may be recorded and transcribed by automated systems, including our service providers" costs you two seconds and answers the plaintiffs' main complaint. If an AI voice agent answers the call, it should also say it's automated. We covered that side in what your contact center must tell callers about AI voice agents.
Keep the recordings on your own servers. A vendor that only sees a short stream of audio while it does one job has far less to use for its own purposes than one that holds your entire recording archive.
Know which provider heard which call. A modern voice stack often uses three different companies: one for speech-to-text, one for the language model and one for the voice. Each of them is a potential listener, and each needs its own check.
Ask for deletion, then check it. Short or zero retention on the vendor side, written into the contract, with a way to confirm it actually happens.

Where ICTContact fits

ICTContact is self-hosted contact center software, so the call recordings sit on your own server. They show up in the Call Recording report, where supervisors can play or download them and filter by agent or campaign. No vendor holds your archive unless you send it there.

The AI Voice Agent, built into the Service Provider Edition, lets you choose the speech-to-text engine, the language model and the text-to-speech voice for each persona. That makes check four easy: you can list exactly which companies hear which persona's calls. Some parts can stay entirely on your own hardware, such as Piper for the voice. But be clear-eyed about it. If you connect a cloud speech or language provider, that provider's data terms decide which side of the capability test it falls on, not ours. Self-hosting gives you control over the choice. It doesn't make the choice for you.

Your greeting and recording announcements are yours to set, so the wording in check two is a change you can make this week. The features page lists the IVR and recording tools involved.

One practical test: pick your three busiest inbound queues and write down every company that touches the audio on those calls. Then find the clause in each contract that says what they may do with it. If you can't find one, that's the gap the next lawsuit will look for.

Frequently asked questions

Is "this call may be recorded" enough consent for AI transcription?

That's exactly what Ambriz v. Google is arguing about. Google says yes. The callers say no, because they weren't told a separate company was listening. Until the court rules, a more specific notice that mentions automated transcription by service providers is the safer choice.

What is the capability test under CIPA?

It's the idea that an AI vendor can be treated as a third-party eavesdropper if it has the ability to use call data for its own purposes, such as training its models, whether or not it actually does. The Ambriz court applied it in February 2025.

How much can a CIPA claim cost?

California Penal Code section 637.2 allows $5,000 per violation. Because every recorded call can count, these claims are usually brought as class actions.

Does this apply if my contact center is outside California?

It can. What usually matters is where the caller is. If you take calls from people in California, assume CIPA applies to those calls.

Does self-hosting remove the risk?

It removes one source of it: your recording archive stays with you. Any cloud provider you connect for speech or language processing still needs its own data terms checked, because that provider is the one a court would look at.

Korea Will Void an Exam Over AI Glasses in a Bag. What Your Smart Online Exam Needs

Tahir Almas — Tue, 20 Oct 2026 10:27:24 +0000

Originally published at ictlms.net

South Korea will void a candidate's college entrance exam if AI smart glasses are simply found in their bag, and ban them from next year's exam if they wear them. The rules arrived after two universities caught glasses-wearing candidates in October and punished them very differently. For any smart online exam, the lesson is to write device rules down before test day.

The Korea Institute for Curriculum and Evaluation (KICE) published its test-taker guidelines for the 2027 College Scholastic Ability Test, the CSAT, on 15 October 2026. The exam itself is on Thursday 19 November. Smart glasses now sit on the list of banned items alongside smartwatches, and invigilators get guidance on spotting them for the first time.

What happened at Yonsei and the University of Seoul

Two incidents, a week apart, pushed this up the agenda.

University of Seoul, 3 October. A candidate in a natural sciences essay exam was caught wearing smart glasses. They were removed from the room and barred from the university's admissions exams for three years.
Yonsei University, 10 October. Yonsei checked candidates' glasses before its essay exam. One candidate wore ordinary glasses for the check, then swapped to smart glasses once the test began. That candidate was ordered to leave the exam.

Same device, same kind of exam, same month. One candidate lost three years of applications to that university, and the other lost one sitting. Neither university was wrong to act, but the gap shows what happens when the penalty is decided after the incident instead of before it.

The devices themselves are simple to describe. As the Korea Herald put it, smart glasses "can use cameras embedded in their frames to photograph exam questions, process them with AI and display answers or step-by-step solutions on screens built into the lenses."

The three tiers in the CSAT rules

KICE's guidelines turn that mess into a ladder anyone can read in advance.

Possession. Bring smart glasses into the exam room and keep them in your bag without handing them in, and that exam is invalidated. You don't have to use them.
Wearing them. Fail to hand them in before the first session and wear them during the exam, and the exam is invalidated and you're barred from the CSAT the following year.
Refusing a check. Refuse an invigilator's request to inspect your glasses, and after review it can be treated as serious cheating, on the same footing as wearing them.

Notice what the ladder does. It separates having the device from using it, and it covers refusal so a candidate can't dodge the question by declining to be checked. It's published a month before the exam, so nobody can say they didn't know.

Why this matters more for online exams

An exam hall has invigilators who can ask to see your glasses. A remote exam usually doesn't. A webcam sees a student wearing glasses, and smart glasses are built to look like ordinary frames. There's no reliable way to tell from a video feed.

AI detectors don't help much here either. The candidate reads an answer in the lens and writes it themselves, by hand or in their own words, so there's no pasted text to flag. We've written before about why detector scores don't hold up as evidence on their own.

So the honest starting point is that no online exam setting makes a test glasses-proof. What you can do is make the device less useful, and make your rules clear enough that you can act fairly when you suspect it.

What exam design can and can't do

Every tactic below raises the cost of using a device that photographs the question. None of them blocks it outright.

A tight timer. Photographing a question, waiting for the AI and copying the answer all take time. A timer set to what a prepared student needs leaves little room for that loop.
Shuffled questions. When every student sees a different order, a helper can't share a single answer sequence.
Ask for the working. A final number is easy to copy from a lens. Several lines of handwritten working, uploaded as an image, are slower to copy and easier for a teacher to question.
A short availability window. An exam that's open for an hour gives fewer chances to rehearse a setup than one open all week.
Follow-up questions. A five-minute oral check on any script that looks off is still the strongest test of whether a student understands their own answer. We covered how to run those at scale in reviving oral exams online.

Write the device rule before the exam

The Korean ladder is a good template for any school, whatever platform it uses. Put a short device rule in your exam instructions, and make sure students see it before they start.

Name the devices. Smart glasses, smartwatches, earbuds and second phones. Vague wording like "unauthorised aids" invites argument later.
Split possession from use. Decide whether simply having a device nearby counts, and what the penalty is if it's used.
Cover refusal. If you ask a student to show their glasses to the camera or join a follow-up call, say what happens if they decline.
Say what evidence you'll rely on. A follow-up conversation, a comparison with earlier work, or the working the student uploaded. Not a hunch, and not a detector score alone.
Apply it the same way every time. The point of a written ladder is that two students in the same situation get the same outcome.

If your coursework allows AI but your exams don't, the rule matters even more, because students need to know exactly where the line moves. Our guide to running a no-AI exam tier covers how to set that up.

How ICT Exam fits

ICT Exam doesn't do webcam proctoring, and we don't claim it can catch smart glasses. What it gives you are the design controls above. You can set a timer and an open and close availability window, limit attempts, and shuffle questions so every student sees a different order. You can also choose what students see after they submit. Students can answer with an image or diagram, such as a photo of handwritten working. AI-assisted grading reviews it, and the teacher can always override the result. All of it is listed on the ICT Exam features page.

Pair those settings with a written device rule and a follow-up step for flagged scripts, and you've got something you can defend if a result is challenged.

Frequently asked questions

What happens if you bring AI glasses to the CSAT?

Under KICE's 2027 guidelines, keeping smart glasses in your bag without handing them in invalidates that exam. Wearing them during the exam invalidates it and bars you from the CSAT the following year.

When is the 2027 CSAT?

The 2027 College Scholastic Ability Test is on Thursday 19 November 2026.

Can a webcam detect smart glasses in an online exam?

Not reliably. Smart glasses are designed to look like ordinary frames, and a video feed rarely shows the camera or the display in the lens.

What is the best defense against AI glasses in online exams?

No single setting stops them. A tight timer, shuffled questions, requiring shown working and short oral follow-ups all reduce their usefulness, and a written device rule lets you act consistently.

Does ICT Exam include proctoring?

No. ICT Exam provides exam controls such as timers, availability windows, attempt limits and question shuffling, plus AI-assisted grading with teacher review. It doesn't monitor students by webcam.

$251 a Number: What Teleflora's Text Settlement Means for Your Call Center Software

Tahir Almas — Tue, 20 Oct 2026 10:24:16 +0000

Originally published at ictbroadcast.com

Teleflora has agreed to pay $6 million, about $251 per phone number, to settle claims that it sent promotional texts to people on the National Do Not Call Registry. If your call center software sends SMS campaigns, the settlement is a clear price tag on a check that takes minutes to run before every send.

The case is Carter v. Teleflora LLC, filed on 26 June 2026 in the Circuit Court for Miami-Dade County, Florida (case 2026-012979-CA-01). The court gave preliminary approval on 26 August, the notice went out this month, and the final approval hearing is set for 25 November 2026. Teleflora denies doing anything wrong. It settled anyway, and the reasons it did are worth reading if you run outbound messaging.

Who is in the class

The class definition is short, and every word in it is a test your own campaigns can fail. A phone number is in if all three of these are true:

The person never gave Teleflora their number. That phrase points at numbers that came from somewhere else, such as a bought list, a data append or a partner.
The number had been on the National Do Not Call Registry for at least 30 days when the texts arrived.
Teleflora sent more than one promotional text to it within 12 months. The class period runs from 9 May 2021 to 26 August 2026.

About 23,844 numbers qualify. Six million dollars across that many numbers is where the $251 estimate comes from, before fees and administration costs come out of it.

Why texts count as calls here

The TCPA's Do Not Call section, 47 U.S.C. 227(c), lets a person sue when they get more than one telemarketing call within 12 months while their number is on the registry. Damages are up to $500 per violation, and a court can triple that if the violation was willful or knowing.

The FCC said in December 2023, in order FCC 23-107, that it was codifying the registry's protections for text messages as well as calls. So the federal regulator's position is plain: a marketing text to a registered number is treated the way a marketing call would be.

Some courts have read the statute differently. Eric Troutman of TCPAWorld, writing about this settlement on 19 October, pointed to recent decisions holding that texts fall outside the DNC rules, that cell phones aren't covered, or that there's no private right of action under those rules at all. His view is that Teleflora paid more than it had to. That may be right, but it's a split, not a settled rule. Plenty of defendants decide that $251 a number is cheaper than finding out which side of the split their judge lands on.

For a business sending texts, the practical reading is simple. Don't build your campaign on the hope of winning that argument. Scrub as if texts are covered, because the FCC says they are.

The defense Teleflora could have used

The DNC rules carry a safe harbor. Under 47 CFR 64.1200(c)(2), a seller that shows it followed routine business practices can defend a call or text that slipped through by mistake. The rule lists what those practices are:

written procedures for complying with the national Do Not Call rules
training for staff on those procedures
a list of numbers the seller may not contact
a process that checks the registry using a version no more than 31 days old
records showing all of this happened

The safe harbor protects a business that made an error despite doing the work. It doesn't help a business that never scrubbed in the first place, and it only works if you can prove the process with records.

Four checks before a marketing text goes out

Here's the order we'd run them in on every SMS broadcast. Any "no" drops the number from that send, and the reason gets logged.

Is there consent or a relationship on file? Know where each number came from and when. "The person gave us this number" is a very different position from "a vendor sold us this number", and the class definition turns on that difference.
Is the number clear of the national registry? Check against a registry copy that's no older than 31 days. If a number joins the registry, you have up to 31 days to honor it, not forever.
Is it clear of your own DNC and STOP list? Every opt-out counts, whether it arrived as a STOP reply, a keypress on a voice call, an email or a word to an agent. It should block every channel, not just the one it came in on.
Is it inside your sending window? Federal rules allow telephone solicitations between 8am and 9pm in the recipient's local time. Many states set tighter hours and add days of the week.

Count texts per number, too. The statute's trigger is more than one message in 12 months, so a business that sends one promotional text a week to a registered number crosses it in the second week.

How ICTBroadcast handles DNC for SMS

ICTBroadcast runs voice, SMS, email and fax campaigns from one system, and it keeps two kinds of Do Not Call list. The Master DNC list holds country-wide registry data, such as numbers you download from the FTC's registry, and the User DNC list holds each user's own opt-outs. Any number on a DNC list is skipped automatically when a campaign runs. The DNC support page explains both lists.

On SMS campaigns, when someone replies STOP, the platform adds them to your do-not-contact list so they drop out of every future campaign. The SMS broadcasting guide covers throttling, delivery reports and opt-out handling in detail.

What the software can't do is decide where your numbers came from or keep your registry copy fresh for you. Downloading the registry, loading it on a schedule that keeps it inside 31 days, and keeping consent records are your jobs. As our DNC page says, it's up to each user to follow federal and state law. If you're unsure what consent your campaign needs in the first place, we covered the latest consent ruling in the robocall consent case everyone is quoting wrong.

A good test is to pick ten numbers from your last SMS campaign and try to answer two questions for each one. Where did this number come from, and when did we last check it against the registry? If you can't answer both from your records, that's the gap a class action would find.

Frequently asked questions

How much is the Teleflora settlement per person?

The fund is $6 million for about 23,844 phone numbers, so the estimate is up to $251 per number, before attorney fees and administration costs are taken out.

Do Do Not Call rules apply to text messages?

The FCC says yes. In December 2023 it codified that National Do Not Call Registry protections extend to texts. Some courts have recently disagreed, so the question isn't fully settled, but the safest course is to treat marketing texts like marketing calls.

How often do I need to scrub against the Do Not Call Registry?

The FCC's safe harbor requires a registry version obtained no more than 31 days before the call or text. In practice that means refreshing your copy at least monthly and scrubbing before each campaign.

Does a STOP reply count as a Do Not Call request?

Treat it as one. A STOP reply should go on your internal do-not-contact list straight away and block that number across every channel you use, not just SMS.

Does ICTBroadcast scrub against the national registry automatically?

ICTBroadcast skips any number on its Master DNC or User DNC lists. You load the registry data into the Master DNC list yourself and keep it current. STOP replies to SMS campaigns are added to the do-not-contact list automatically.

One Ignored Opt-Out Cost BBVA €5.5M. Check Your CRM Software for the Same Gap

Tahir Almas — Thu, 15 Oct 2026 18:09:11 +0000

Originally published at ictcrm.com

Italy's data protection authority has fined BBVA €5,508,000 because one customer's marketing opt-out never reached the system that sent the marketing. The choice was recorded, a sync between internal systems and the CRM unit failed, and promotions kept arriving for seven months. If your CRM software holds consent in one place and sends from another, this is the case to read.

The European Data Protection Board published the summary of the decision on 9 October 2026. The Garante, Italy's regulator, made the final decision on 3 July 2026. Three days after the BBVA summary, the EDPB published a second Italian decision, a €16.7 million fine against the telecoms operator Wind Tre, which turns on the same failure at a much larger scale.

What happened at BBVA

A customer of BBVA's Italian branch switched off marketing in the bank's mobile app settings. He then repeated the objection to Customer Service. The promotional notifications kept coming anyway, from October 2025 to May 2026, at least ten of them.

BBVA's explanation is the part every CRM owner should notice. The bank said the customer's choice had been recorded correctly, but "a technical failure prevented synchronisation between its internal systems and the Customer Relationship Management unit responsible for sending commercial communications". In other words, the opt-out existed. It just lived in a system the marketing didn't read.

Two more findings made it worse.

The channel argument failed. BBVA argued the customer should have used the dedicated email addresses listed in its privacy policy. The regulator rejected that. He'd objected through the app and through Customer Service, and controllers "cannot disregard a valid request merely because it was not submitted through a preferred channel".
Front-line staff gave the wrong answer. Customer Service told the customer the promotional pop-ups in the app couldn't be switched off. BBVA later showed that they could. The regulator counted that as a failure of the bank's technical and organisational measures.

The fine covered breaches of GDPR Articles 5(1)(a), 12, 21 and 24. BBVA was also ordered to put measures in place so rights requests are handled correctly and without undue delay, and to report back within 30 days. When setting the amount, the regulator noted that the case concerned one person, ran for seven months and involved contact data used for marketing. BBVA's fixes counted in its favour. A previous relevant infringement counted against it.

Wind Tre: the same failure, at scale

The Wind Tre decision, final on 5 June 2026 and published by the EDPB on 12 October, started from numerous complaints. People kept receiving promotional contacts after objecting, or without having given valid consent. Some found contracts and services activated without their knowledge. The regulator found weak controls over Wind Tre's sales network and said the company's systems couldn't reliably stop unlawful processing or act quickly on people's requests.

The list of breached articles is longer here, including Article 25, data protection by design and by default. Alongside the €16.7 million fine, Wind Tre is banned from further processing of personal data obtained without consent and must tighten how it controls its sales partners.

Put the two cases side by side and the pattern is plain. Neither regulator cared much that a choice had been written down somewhere. They cared whether it reached every system that contacts people, and how fast.

Why CRM setups lose opt-outs

The BBVA failure isn't exotic. It's what happens in most stacks where marketing grew up next to the CRM rather than inside it. A typical company has:

a CRM where sales and service log customers and their preferences
a separate email platform with its own unsubscribe list
a dialer or call center tool with its own DNC list
an SMS gateway that handles STOP replies on its own
an app or website with a preference centre

Each one has its own idea of who said no. They're kept in step by nightly imports, middleware or someone's spreadsheet. When the sync works, nobody notices. When it breaks, nothing errors out. Messages just keep sending, and the first alert is a complaint to a regulator.

Agents are the other weak point. A customer says "please stop calling me" on a sales call, and the agent sets a disposition or writes a note. Whether that note becomes an objection that the email and SMS tools respect depends entirely on how the systems are wired.

What a sound opt-out looks like in CRM software

The fix isn't a better sync job. It's having fewer places where an objection can live. Here's what we'd check.

One record per person, read at send time

An objection should sit on the contact record itself, with when it arrived, through which channel, who or what logged it, and when it took effect. Every outbound channel, whether that's dialer, SMS, email or app, should check that record at the moment it sends, not from a copy taken last night.

Every way in counts

The regulator was clear that the customer picks the channel. App settings, a reply to an email, a STOP text, a ticket, a keypress on an automated call or a sentence to an agent all count. Map each one and check that it ends up in the same record.

Measure the time to take effect

GDPR doesn't give a fixed number of hours for honouring a marketing objection, but "promptly" clearly doesn't mean seven months. Track the gap between when an objection arrives and when the last message to that person went out. If you can't measure it, you can't defend it.

Train the people who answer the phone

BBVA's Customer Service told a customer something false about the app. Front-line staff need a short script: how to record an objection, what it stops, and how long it takes. If they don't know, they'll guess, and a regulator will read the guess as your policy.

Hold partners to the same record

Wind Tre's problem ran through its sales network. If resellers, agencies or outsourced call centers contact people for you, they need to work from your suppression record, not their own lists, and you need logs that show it.

How ICTCRM handles it

ICTCRM is built on ICTContact, so the CRM and the contact center are one platform. Voice, SMS and email campaigns run from the same system that holds the contact records. That doesn't make compliance automatic, but it removes the sync step that failed at BBVA, because there's no separate marketing tool to feed.

A few specifics, all covered in the contacts guide:

Each contact has an activity timeline that shows calls, faxes, SMS and emails in one place, including delivery events such as Unsubscribed and Spam complaint. You can see what a person received after they objected.
Move Selected to DNC adds numbers to your DNC list and removes them from Contacts, so they drop out of the groups that campaigns dial.
The contact filter can flag numbers listed in DNC before a campaign starts.
Voice campaign types offer Action on DNC, which lets the person called press 9 to be taken off the list. The campaign types guide lists where it appears.

Because ICTCRM can be self-hosted, those logs sit on your own server, which helps when you need to show a regulator what happened and when. We covered the wider privacy picture in CRM data privacy and the 2026 state laws.

Whatever CRM you use, run the test in the diagram above. Opt a test contact out through each way in, then try to reach it through each way out. Any message that lands is a gap, and it's far cheaper to find it yourself.

Frequently asked questions

Why was BBVA fined €5.5 million for one customer?

The Italian regulator found that BBVA didn't honour a marketing objection correctly or in time, rejected its argument about the channel used, and found its staff gave wrong information. One customer and seven months were factors in the amount, as were BBVA's fixes and a previous infringement.

Does GDPR let a company require opt-outs through one specific channel?

Not according to this decision. The regulator said controllers must make rights easy to exercise and can't ignore a valid request because it didn't arrive through their preferred channel.

How fast must a marketing opt-out take effect?

GDPR doesn't set a fixed number of hours. The BBVA order requires requests to be handled correctly and without undue delay. Seven months of continued messages was clearly too long.

Does this apply to companies outside Italy?

The decision is Italian, but the rules it applies, GDPR Articles 12 and 21, apply across the EU and to any business marketing to people in the EU. US state privacy laws have their own opt-out rights too.

Is an integrated CRM enough to stay compliant?

No. It removes the sync gap between separate tools, which is the failure in the BBVA case, but you still need the right processes, staff training and regular testing.

Pennsylvania's New Telemarketing Rules Start 18 October. Reset Your Auto Dialer Software

Tahir Almas — Thu, 15 Oct 2026 18:05:35 +0000

Originally published at ictdialer.com

Pennsylvania's rewritten telemarketing law takes effect on Sunday, 18 October 2026. From then on, texts and ringless voicemail count as telephone solicitations, cold outreach is limited to 9:00 a.m. to 7:00 p.m. with no Sundays, and prerecorded or artificial voice calls need prior express written consent. If your auto dialer software reaches Pennsylvania numbers, change your schedules and consent records this week.

The law is Senate Bill 992, signed on 20 July 2026. It amends the state's Telemarketer Registration Act, which dates from 1996. The bill itself isn't new, but the date it starts biting is, and plenty of campaign calendars still run on the federal 8 a.m. to 9 p.m. window. Because 18 October falls on a Sunday, which the new law closes anyway, your first working day under the new rules is Monday, 19 October.

What changes on 18 October

Five changes matter for anyone running outbound campaigns.

Texts and ringless voicemail are now solicitations. The definition of "telephone solicitation" now names text messages and ringless voicemail explicitly. If your SMS or voicemail drops sit outside your calling rules today, they won't be outside the law next week.
Calling hours shrink. Solicitations are allowed only between 9:00 a.m. and 7:00 p.m. No solicitations at all on Sundays. Legal holidays were already off limits and still are.
Written consent replaces "express request". The old exception for calls the person had asked for is gone. In its place is prior express written consent (PEWC), defined in a way that largely follows the federal TCPA rules. The exception for people you've done business with in the last 12 months stays.
Robocalls get their own definition. A robocall is "a telephone solicitation that uses an automated dialing system to deliver prerecorded or artificial voice calls or messages". These need PEWC, whether the line is residential, business or wireless, unless an emergency or another statutory exemption applies.
Deception gets named. The law bans unfair or deceptive practices used to get consent, and bans using "any technology or any synthetic or computer-generated messaging to defraud, deceive or mislead" the person called.

Penalties don't move: up to $1,000 per violation, or up to $3,000 if the person called is 60 or older. One enforcement tool goes away. The provision that let the Attorney General revoke a telemarketer's registration after repeated violations has been deleted. And there's a new registration exemption for businesses whose calls don't meet the definition of telephone solicitation at all.

The calling window is the change you'll trip over first

Most dialer compliance setups are built around the federal TCPA window of 8 a.m. to 9 p.m. in the called party's local time. Pennsylvania now cuts an hour off the morning and two hours off the evening, and closes Sunday completely. If you run a single national campaign with one schedule, Pennsylvania contacts will be inside your window and outside the state's.

There's one piece of good news. All of Pennsylvania sits in the Eastern time zone, so you need one schedule for the whole state, not several.

The evening cut is the one that hurts most. For a lot of B2C campaigns, 5 p.m. to 8 p.m. is when people actually pick up. Losing 7 p.m. to 9 p.m. in Pennsylvania means your contact rate there will probably fall, and your predictive pacing will need time to settle on the new numbers. Plan for that rather than being surprised by it on the first Monday.

How to set up your auto dialer software for Pennsylvania

Here's the setup we'd suggest to anyone running ICTDialer, and most of it applies to any dialer.

1. Give Pennsylvania its own campaigns

Split Pennsylvania contacts into their own contact group and run them in their own campaigns. That lets you give them their own schedule without tightening every other state to match. Use the state from the customer's address where you have it, not just the area code. Mobile numbers move with people, so a 215 number may belong to someone in Florida, and a Pennsylvania resident may still carry a number from another state. If you only have the area code, err toward treating it as Pennsylvania.

2. Set the schedule to the new window

In ICTDialer, campaign scheduling lets you pick the weekdays and the start and stop times for each campaign, and the dialer starts and stops on its own. For a Pennsylvania campaign, that means Monday to Saturday, starting at 9:00 a.m. Eastern. Set the stop a few minutes before 7:00 p.m. so that retries and calls already ringing don't spill past the line. Leave Sunday unticked.

Holidays need a manual step. Put the year's legal holidays in your team calendar and pause Pennsylvania campaigns on those days. It's easy to forget, and "we forgot" isn't a defence.

3. Put texts and voicemail drops on the same rules

If you send SMS or ringless voicemail to Pennsylvania numbers, those campaigns need the same window and the same Sunday block as your voice campaigns. This is the gap most likely to catch teams out, because SMS is often scheduled by a different person or from a different tool. If it touches a Pennsylvania number, it follows the Pennsylvania clock.

4. Record written consent per number

If you rely on consent to call, you now need written consent that meets the PEWC standard. Store it against each number: when it was given, where (web form, paper, recorded call), the exact wording the person agreed to, and which campaigns it covers. If you can't produce that record for a number, treat the number as cold and keep it inside the strict window. For prerecorded or AI-voice campaigns, no PEWC means no call.

5. Keep opt-outs instant

ICTDialer keeps a master DNC list and a user DNC list per account, and contacts who opt out during a campaign are added to the user list automatically. Make sure the Pennsylvania campaigns use both lists, and that opt-outs from texts land in the same place as opt-outs from calls. A person who says stop by text and then gets a voice call from you the next morning is exactly the complaint you don't want.

6. Check how your AI voice calls introduce themselves

ICTDialer's AI Voice Agent is a live product, and the new Pennsylvania wording on synthetic messaging targets deception, not the technology itself. Even so, an AI agent that lets people assume they're talking to a human, or that makes claims a human rep wouldn't be allowed to make, is now riskier in Pennsylvania than it was. Pair this with the disclosure points in our post on AI voice disclosure state rules. And remember that an AI voice call is an artificial voice call, so the PEWC requirement for robocalls applies.

What about calls made with consent or to existing customers?

The law carves calls made with PEWC, and calls to people you've done business with in the last 12 months, out of its definition of a telephone solicitation. That suggests the strict hours bite hardest on cold outreach. But how far those carve-outs reach is a question for your lawyer, not for a blog post. Our advice is practical. Unless you've had that conversation and it's documented, run every Pennsylvania campaign inside the new window. Losing a couple of evening hours on warm leads costs far less than defending a claim at $3,000 a call.

Where this sits next to the federal rules

Nothing here replaces federal law. The TCPA, the national Do Not Call registry and the FCC's consent rules still apply on top. Pennsylvania is stricter on hours and on what counts as a solicitation, so you follow both and the stricter rule wins. The FCC's own changes to how consumers revoke consent are still working through the process too, so check the current state of play in our roundup of 2026 TCPA rules for auto dialers.

Pennsylvania is also part of a pattern. A growing number of states have written their own telemarketing statutes with tighter hours, text messages brought into scope and stricter consent. If your dialer setup assumes one national rulebook, this is a good week to rebuild it around per-state campaigns.

What we couldn't confirm

We based this post on the bill summary from Kelley Drye & Warren's Ad Law Access team and the coverage that followed it. A few points we haven't seen confirmed in the official legislative record, so we've left them out: the Act number assigned to the law, and some commentators' readings on private lawsuits and on liability for companies that hire outside telemarketers. If those matter to how you run campaigns, read the enrolled bill with counsel before Monday.

This post isn't legal advice. It's what we'd change in a dialer this week if we were calling into Pennsylvania.

Frequently asked questions

When does the new Pennsylvania telemarketing law take effect?

On 18 October 2026. That's a Sunday, and Sunday solicitations are banned under the new law, so the first day you can call under it is Monday, 19 October.

What are the new calling hours in Pennsylvania?

Telephone solicitations are allowed between 9:00 a.m. and 7:00 p.m. No solicitations on Sundays or legal holidays. All of Pennsylvania is in the Eastern time zone.

Do text messages count under the Pennsylvania law?

Yes. The new definition of telephone solicitation expressly includes text messages and ringless voicemail, so SMS campaigns need the same hours and consent handling as voice.

What are the penalties?

Up to $1,000 per violation, or up to $3,000 if the person called is 60 or older. Those amounts didn't change in the rewrite.

Can I still use prerecorded or AI voice messages in Pennsylvania?

Yes, with prior express written consent from the person you're calling, unless the call is for an emergency or falls under another statutory exemption. Without that consent, don't send it.

Does my auto dialer software handle this on its own?

Not on its own. A dialer runs the rules you give it. In ICTDialer you set the schedule, contact groups and DNC lists per campaign, so a separate Pennsylvania campaign with a Monday to Saturday, 9 to 7 schedule covers the hours. Consent records and holiday pauses are still yours to manage.

BT Is Rescuing TalkTalk. What It Means If You Sell White Label ICT Services

Tahir Almas — Wed, 07 Oct 2026 05:11:10 +0000

Originally published at ict.vision

BT agreed on 5 October 2026 to rescue TalkTalk and its wholesale arm PXC from collapse. Retail customers were told nothing changes. The million wholesale customers served through resellers got no specific promise. If you sell white label ICT services on rented lines, this is the week to check which parts of your business you actually own.

Most coverage has read this as a consumer broadband story. For anyone reselling connectivity or voice under their own brand, it's a supply chain story, and a fairly blunt one. Your upstream supplier can come close to failing, change hands and end up owned by its biggest rival, all inside a few weeks.

What happened to TalkTalk and PXC

TalkTalk was carrying around £1.5 billion of debt and losing customers, according to the PA report of the deal. It made a £100 million loss last year. BT's chief executive described the company as on track to collapse.

BT is buying the whole business: the TalkTalk retail ISP and PXC, the wholesale company TalkTalk had been trying to sell. Investment firm Octopus had been in exclusive talks for PXC over the summer, then walked away in September. A few weeks later, BT stepped in.

From a failed wholesale sale to a government-supervised rescue in about two months.

The numbers that were reported:

About 2.5 million customers in total: 1.5 million retail and 1 million wholesale.
Roughly 900 staff, based in Salford, moving to BT.
A total cost to BT of around £400 million, including the purchase price, fees, about £60 million of expected losses and £100 million that TalkTalk owed Openreach and BT wrote off.

The government used a Public Interest Intervention Notice under the Enterprise Act 2002, citing the risk to vulnerable customers, critical national infrastructure and emergency services if TalkTalk collapsed. The Competition and Markets Authority has been asked to report by 19 October. After that, the Culture Secretary decides. Until approval, TalkTalk and PXC are expected to operate separately.

The sentence resellers should read twice

The reports carry a clear continuity message for retail customers: services carry on as normal. They carry nothing equivalent for wholesale customers. BT did say it has "no plans" to move altnet-connected customers off their current infrastructure, which is reassuring as far as it goes. A plan can change. A contract is what binds.

There's a structural point too. PXC was described in the coverage as BT's main rival in the wholesale market. If the deal goes through, the company you bought wholesale from to avoid depending on BT becomes part of BT. The CMA review exists precisely because that matters. Whatever it concludes, prices and terms in that market will now be set with one fewer independent player at the table.

None of this means anyone's lines go dark next week. It means the assumptions under a lot of reseller businesses just got less safe, and the time to act is while nothing is on fire.

What white label ICT software providers rent, and what they should own

Every reseller rents something. That's the model. The question is whether the parts that keep your customers loyal are rented too.

If the top half changes hands, the bottom half is what keeps your customers yours.

The rented layer is the access you resell, the upstream voice you terminate calls on, and the prices and terms that come with them. You can switch these, with effort, if the owner changes.

The owned layer is different. Your customer and billing records say who pays you, for what and since when. Your number records tie every number to a customer and hold the data you'd need to port it. Your service platform, the PBX or contact center your customers log into, holds their configuration. Your call history lets you bill and settle disputes. If those live inside a supplier's portal, a change of supplier owner reaches straight into your customer relationships.

Here's my view, and it's the reason we build what we build: the platform layer is the one resellers most often rent without noticing. A hosted PBX from your wholesaler feels convenient right up until the wholesaler is for sale. If you run your own multi-tenant platform, the access underneath it can change and your customers never see it.

A 30-day checklist if you resell on PXC or TalkTalk

Read your contract for change of control and termination. Know what you can do, and what they can do, if ownership changes.
Export your data now, while it's easy. Customers, services, numbers, billing history and call records, in a format you can load somewhere else.
Check every number's porting path. Confirm you hold the details needed to port each number out without asking anyone's permission.
Line up a second upstream for voice. Even a small test trunk with another carrier turns a crisis into a migration.
Move the platform you depend on to one you control. Your own PBX or contact center, multi-tenant, on servers you choose.
Put 19 October in the diary. That's the CMA's deadline. Its findings will say a lot about what happens to wholesale terms next.

If point five is the gap, ICT Vision sells one-time licences for multi-tenant platforms that service providers install on their own servers, with the source code included. You can see the full range of service provider platforms, or start with ICTPBX if hosted voice is what you resell.

Questions to put to your wholesaler this week

You don't need to wait for the CMA to start asking. A good account manager will answer these in writing. A vague answer is useful information too.

Will my current contract be honoured on its current terms until it ends? Get the answer in writing, not on a call.
Who will I deal with after completion? A named contact and an escalation route, not a general support address.
How much notice will I get of any price or product change? Your contract probably sets a minimum. Check whether they intend to go beyond it.
Can I export my service and number data in bulk today? If the answer is "open a ticket", find that out now rather than in a hurry later.
What happens to products that overlap with BT's own? Overlapping products are the ones most likely to be rationalised once two wholesalers become one.

Write the answers down with the date and the name of whoever gave them. If the terms do shift later, a dated record of what you were told is the strongest position you can be in.

What we don't know yet

Quite a lot, and it's worth being honest about it. We don't know what the CMA will recommend, whether the Culture Secretary will attach conditions, or how and when BT plans to integrate PXC with its own wholesale business. We don't know whether existing wholesale contracts will be honoured on current terms for their full length. Treat anything you hear on those points as speculation until it's in writing.

Frequently asked questions

Is the BT and TalkTalk deal final?

Not yet. BT agreed the rescue on 5 October 2026, but the government issued a Public Interest Intervention Notice, so the CMA reports by 19 October and the Culture Secretary then decides whether to approve it.

What is PXC?

PXC (PlatformX Communications) is TalkTalk's wholesale business. It supplies connectivity to resellers and businesses and was described in coverage of the deal as BT's main rival in the UK wholesale market.

Will my wholesale service from PXC stop?

Nothing reported suggests an immediate change, and BT said it has no plans to move altnet-connected customers off their current infrastructure. But no specific continuity commitment for wholesale customers was reported, so check your contract and keep your data portable.

What does white label ICT software have to do with this?

White label ICT software lets you run the service platform, such as a PBX or contact center, yourself under your own brand. When the access or wholesale layer underneath changes owner, a platform you control keeps your customers' configuration, numbers and history with you.

What should a reseller do first?

Export your customer, number and billing data, and read the change of control clause in your wholesale contract. Both take a day, and both are much harder to do in a hurry later.

New FCC Copper Rules Start 15 October. Fax Server Software Keeps You Faxing

Tahir Almas — Tue, 06 Oct 2026 13:46:20 +0000

Originally published at ictfax.com

On 15 October 2026 the FCC's revised copper retirement and discontinuance rules take effect. Carriers can now retire copper with less public notice and faster approvals, and none of the five replacement services they can point to has to carry a fax. If your fax line still runs on copper, fax server software is how you keep it working.

That date isn't a guess. The rules were adopted in April as FCC 26-19, but seven sections were held back until the Office of Management and Budget finished its paperwork review. On 1 October the Wireline Competition Bureau published the notice that sets them live on 15 October (91 FR 62334). Those seven sections happen to be the ones that matter most for anyone still faxing over a phone company line.

What changes on 15 October

The held-back sections are the network change disclosure rules in part 51 and the discontinuance rules in part 63. Here's what each one does once it's live.

Four changes, all taking effect the same day. Sources: 91 FR 20913 and 91 FR 62334.

Copper retirement notices stop going through the FCC. The order eliminates "all filing requirements" in the network change disclosure rules. Incumbent carriers still have to post notice, but they can do it on their own publicly accessible website or in industry publications. They must still notify directly interconnected carriers and 911 providers.
Every discontinuance gets a 31-day automatic grant. The FCC applied the 31-day auto-grant period "to all discontinuance applications regardless of the applicant's status as dominant or non-dominant." Big incumbents used to wait longer.
One test replaces two. The Adequate Replacement Test and the Alternative Options Test are folded into a single technology transitions rule. More on that below, because it's where fax falls out.
Conflicting state rules are preempted. If a state's requirements clash with the federal discontinuance framework, the order says they're subject to preemption.

Put plainly: there's less public warning, a faster clock, and less room for a state regulator to slow things down. That's the stated goal. The order calls these reforms a way to speed "the transition from outdated legacy networks and services to next-generation, Internet Protocol (IP)-based infrastructure."

Five replacement services, and none has to carry a fax

To get fast approval for retiring a voice service, a carrier now certifies that at least one of five replacement services is available everywhere in the affected area. Here's the list, straight from the order.

Any one of these qualifies. Not one of them is required to pass fax or modem tones.

Notice what's missing. The 2016 rules kept a list of "key applications", alarms and medical monitors among them, that a replacement had to work with. The FCC says that compatibility requirement was always temporary, and it sunset in 2025. The new test doesn't bring it back.

The alarm industry asked for something narrower. It wanted the FCC to require that replacement services support "G.711 codec handshake with RFC 2833 disabled" on calls to alarm monitoring receivers, end to end through every carrier handoff. The FCC said no, in paragraph 21, partly because a discontinuing carrier "has no control over the configuration of the network" when the replacement comes from a third party. It encouraged carriers to configure their IP networks well, and left it there.

That matters to you because a fax machine and an alarm panel have the same problem. Both are modems. Both send audio tones that have to survive the trip intact. Squeeze those tones through a compressed codec, add jitter, or let a carrier handoff renegotiate the call, and pages fail halfway through. And if the replacement your carrier picks is option two, mobile wireless, there's no realistic way to plug a fax machine into it at all.

My honest read: the FCC didn't target fax here. It simply stopped asking. Fax was never named in the order, and that silence is the point.

How to tell whether your fax line is still on copper

Plenty of offices don't know, because nobody has looked at the line in years. A few quick checks will tell you.

Look at the bill. Copper lines usually show up as a basic business line, POTS or a measured line. If it says VoIP, digital voice or something similar, you're already on IP and the copper rules matter less than your provider's T.38 support.
Look at the wall. A fax cable that runs straight into a phone jack is likely copper. One that runs into a small box, an adapter or the back of a router is already being converted to IP somewhere.
Pull the power. Unplug the router or the adapter for a minute and try to get a dial tone on the fax line. Copper lines generally keep working without local power. IP lines generally don't.
Ask the carrier directly. Ask whether the line is copper and whether its wire center is on a retirement or discontinuance list. Write down the answer and the date.

If it turns out you're already on IP and faxes have been failing on and off, that's the same problem described above. It just arrived early.

What fax server software changes about this

The fix is to stop depending on a copper line behaving like a copper line. There are two parts to it.

First, get fax off the audio path. T.38 is the protocol built for sending fax over IP. Instead of pushing modem tones through a voice codec and hoping, it relays the fax as data, with redundancy for lost packets. A FreeSWITCH based fax server can terminate T.38 from a SIP trunk, so the copper line, and whatever replaces it, drops out of the picture.

Second, get the people off the machine. Once faxes land on a server, staff can send and receive through email-to-fax and web-to-fax, and every page lands in a log you control. That second part is what most offices actually feel. The machine in the corner stops being a single point of failure.

If you've been following the copper story, this is the next chapter of the one we covered in August, when AT&T's analog fax lines were on a 180-day clock. That piece was about one carrier's timetable. This one is about the federal rules every carrier now works under.

A fax server software checklist before your line moves

Find every fax number you have. Not just the main fax. Check the copier with a fax card, the line in the pharmacy, the old number printed on referral forms. You can't protect a number you've forgotten.
Watch the carrier's website, not the FCC. From 15 October, copper retirement notices don't have to go through the FCC's system. Bookmark your carrier's network change page, and read every letter your carrier sends about a discontinuance.
Test a real fax over the replacement before you agree to it. Send a ten-page document, both ways, at a busy time of day. One cover page proves nothing.
Ask your SIP provider one question: do you support T.38 end to end? If the answer is vague, plan around G.711 passthrough failing under load.
Port fax numbers to a SIP trunk that feeds your own fax server. Keep the numbers your partners already use, and move the line underneath them.
Keep a transmission log. If you handle patient data, a dated record of what was sent, to whom and whether it confirmed is what you'll want when someone asks.

If you'd rather run this yourself than rent it, the ICTFax fax server software page covers what a self-hosted setup includes, and the packages page has the editions.

What we don't know yet

Plenty. The rules set the process, not anyone's schedule. Each carrier decides which wire centers go next and when, so there's no national date to plan against. The preemption language will probably be tested by states that disagree with it. And because notices no longer pass through the FCC, it'll be harder for anyone, us included, to track where copper is going away. Assume your line is on the list until your carrier tells you otherwise.

Frequently asked questions

When do the new FCC copper rules take effect?

15 October 2026. The Report and Order (FCC 26-19) was published on 20 April 2026 at 91 FR 20913, and most of it took effect on 20 May. Seven sections covering network change notices and discontinuances waited for paperwork approval, and a notice published on 1 October set them live on 15 October.

Will my fax machine stop working on 15 October?

Not on that day. The rules change how carriers retire copper, not when your specific line goes. But they make it faster and quieter, so the day your line changes could come with less warning than before.

Do carriers have to make sure fax still works on the replacement service?

No. None of the five qualifying replacement services has to pass fax or modem tones, and the FCC declined a request to guarantee G.711 audio end to end even for alarm receivers.

What is T.38 and why does it matter for fax over IP?

T.38 is the standard for relaying fax over IP networks as data rather than as audio. It copes far better with packet loss and jitter than pushing modem tones through a voice codec, which is why a fax server that speaks T.38 is the reliable way to fax once copper is gone.

Can I keep my existing fax numbers?

Usually, yes. Fax numbers can normally be ported to a SIP trunk like any other number, and then routed to your fax server. Check with the receiving provider before your copper service is discontinued, not after.

Your Vendor Says the HIPAA Security Rule Overhaul Is Final. The Register Says Otherwise

Tahir Almas — Sat, 03 Oct 2026 19:13:16 +0000

Originally published at ictfax.org

Search for the HIPAA Security Rule overhaul this week and you will be told it is final, that it took effect in March 2026, that it finalises in May, and that you have 240 days to comply. I checked the Federal Register on 4 October 2026. It is still a proposed rule. There is no final action, no effective date and no clock running.

We covered the agenda slip back in July, when final action moved out to 2027 and the rule was reclassified into long-term actions. What is new is that two months on, the deadline claims have not gone away. They have multiplied.

What the record actually holds

There is exactly one document. It is titled HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information. Its type is Proposed Rule. It was published on 6 January 2025 at 90 FR 898, under RIN 0945-AA22, and the comment period closed on 7 March 2025.

Note the citation, because a surprising number of write-ups give it as 90 FR 800. That is the wrong page, and it is a useful tell. A citation that gets copied wrong across a dozen sites usually means nobody in that chain opened the document.

No final rule has been published. The proposal has now sat for more than eighteen months since comments closed.

The two-minute check

You do not have to take my word for any of this, and you should not have to take a vendor's either. The Federal Register has a free API and it answers this question directly.

Query the documents endpoint for the rule title, ask for the type and citation fields, and read what comes back. If the type says Proposed Rule, there is no deadline. If a final rule existed it would be there, with an effective date attached, because that is what publication means.

I would make this a habit rather than a one-off. Any time somebody sells you a compliance date, the primary record is one request away, and the gap between what circulates and what is filed is wider than most people expect.

Why I am not telling you to relax

Here is where I would push back on my own headline. The deadline is fiction. The controls are not.

Almost everything in that proposal is either already required under the Security Rule as it stands, or is the sort of thing OCR has been citing in settlements for years. Encryption, unique user identification, asset inventory, audit logging. None of that is waiting on a final rule, and a fax server that fails on those today fails on them whatever happens in 2027.

The one I would start with is storage. TLS and SRTP protect the hop, and teams tend to stop there because the transport is the part the product page talks about. The TIFF or PDF left sitting in a spool directory afterwards is the artefact that turns up in breach reports, and encryption at rest is addressable under 164.312(a)(2)(iv) today.

Unique user identification under 164.312(a)(2)(i) is required right now, not proposed. Shared logins on a fax queue remain the single most common thing OCR finds when it looks at a document system, and it is the cheapest finding to avoid.

Then the inventory, which is less glamorous and more useful than it sounds: every place a fax comes to rest. Spool directories, archive shares, the mail gateway, the multifunction printer nobody has logged into since 2019. The asset inventory the proposal would mandate is the same list a risk analysis has always needed, and most teams discover at least one copy they had forgotten.

The practical point about planning

If a 2026 date is in your remediation plan, take it out. Not because the work is wrong, but because a fake deadline makes the work fragile. When the date passes and nothing happens, the budget conversation gets harder, and the next real deadline gets less attention than it deserves.

Plan the controls on their own merit. They survive the rule being finalised, delayed again, or rewritten.

FAQ

Is the HIPAA Security Rule overhaul dead?

No. It is a live proposal that has not been finalised. Being moved to long-term actions signals that nobody expects it soon, not that it has been withdrawn.

So nothing changed since January 2025?

Not in the Federal Register. The proposal published, comments closed in March 2025, and the regulatory agenda later pushed final action back. No final rule has appeared.

Does the existing Security Rule already require encryption?

It is addressable rather than required, which means you implement it or document why an equivalent alternative is reasonable. In practice, for stored PHI on a fax server, I have never seen a convincing version of that documentation.

What is 90 FR 898?

Volume 90 of the Federal Register, page 898. It is the citation for the proposed rule published on 6 January 2025. If a source gives you 90 FR 800, that source did not check.

Should we wait for the final rule before changing anything?

No, and that is the one piece of advice I would give without hedging. Waiting means your risk analysis is out of date for another two years while the controls you need are already enforceable.

How do I check rulemaking status myself?

Use the Federal Register documents API, search the rule title, and read the type and citation fields. It is public, free and needs no account.

Verified against the Federal Register documents API on 4 October 2026. Document number 2024-30983, RIN 0945-AA22, published 6 January 2025 at 90 FR 898, type Proposed Rule, comments closed 7 March 2025.

Five of the Nine FreeSWITCH CVEs Are in One Module You Probably Do Not Use

Tahir Almas — Sat, 03 Oct 2026 19:10:25 +0000

Originally published at ictinnovations.com

Nine FreeSWITCH CVEs were published in June 2026. Two are critical, 9.8 and 9.1. If you read them as a list you get a patch-everything-now panic. If you group them by where they actually live, the job gets much smaller, and for a lot of installs the best move is not a patch at all.

Where they actually sit

I pulled all nine from the NVD API rather than a vendor bulletin, because scores and vectors get copied around with errors. Grouped by component, the distribution is lopsided.

Five of the nine are mod_verto or its WebSocket handling. That includes the worst one.

CVE-2026-49841, scored 9.8, is a heap overflow in the mod_verto HTTP request handler. It allocates a fixed 2 MiB buffer for a urlencoded POST body but accepts a Content-Length just under 10 MiB, and the read loop is bounded by the header value rather than the buffer. Unauthenticated, network reachable, no user interaction.

CVE-2026-49842 is more embarrassing than dangerous on paper but tells you something about the module. A hash-prefixed speed-test protocol, #SPU and friends, gets parsed before any authentication check, with the payload size read by atoi and only non-positive values rejected. CVE-2026-49847 is a single unauthenticated WebSocket frame with deeply nested JSON that drives the worker stack into the guard page and takes every call on the host with it.

The remaining two in that group, 49843 and 49848, are both auth-ordering bugs: state written from a client-supplied request before the credential check happens. Lower scores, same root cause.

The one that is not about the switch

CVE-2026-49840, scored 9.1, is in the Event Socket Library. Content-Length is parsed with atol and handed to malloc with no sign or magnitude check, so a negative length corrupts the heap.

The description is worth reading carefully. It affects any process linked against libesl, not just FreeSWITCH. That means the monitoring script somebody wrote four years ago, the little dashboard that tails events, the billing hook. Those are not usually on anyone's telephony patch list, and a man-in-the-middle on an ESL connection is a realistic position if ESL is not on loopback.

Two more sit in bundled XML parsing. CVE-2026-45771 is a billion-laughs expansion reached through the PIDF body of a SIP PUBLISH, before any digest check. CVE-2026-49472 is an expat clone inside the bundled xmlrpc-c that never received an upstream security patch. Vendored dependencies, aging quietly.

And CVE-2026-49475 is a STUN attribute whose declared length is shorter than the struct the parser casts to, giving an out-of-bounds access on the per-leg media buffer. Worth separating from the Verto group, because it lives in media handling. WebRTC traffic reaches it whether or not you run Verto.

So check the module list first

This is the actual recommendation, and it is not what a CVE list pushes you toward.

From fs_cli, run show modules and look for mod_verto. Plenty of installs carry it only because it sat in the default modules.conf.xml and nobody pruned it. If nothing on your network speaks Verto or connects a browser client to that box, unloading the module retires five of the nine, including the 9.8, with no maintenance window and no regression risk to your call path.

For the record, our own builds do not ship it. I checked the module list we stage for the ICTCore and ICTFax images: 53 modules, mod_event_socket present, mod_verto absent. That is not cleverness on our part, it is just that a fax and voice application server has no reason to serve browser clients.

Which leaves ESL as the one that does apply to us, and to most people reading this.

A caveat on version numbers, because this part is genuinely unclear

The advisories name the fixed versions as 1.11.0 and 1.11.1. Three issues are fixed in 1.11.0, the other six in 1.11.1, so landing on 1.11.0 and stopping leaves both criticals open.

Here is the part I cannot answer for you. The 1.11 line is FreeSWITCH master. Most production installs run the 1.10 stable line, and the advisories do not say whether the fixes were backported into a later 1.10 release. Our own Docker image pulls 1.10.12 from a Copr repository, and our older Ubuntu install script still pins 1.10.11, which is a mismatch we need to fix on our side regardless.

I am not going to tell you that 1.10.x is safe, and I am not going to tell you it is exploitable. Neither claim is supported by what the advisories actually say. Ask whoever packages your build whether these specific CVE IDs are addressed in the version you are running, and treat a shrug as a no.

What to do if you cannot upgrade this week

Unload modules you do not use. That is free and it is the biggest single reduction here.

Put ESL back where it belongs. Loopback, or an allowlist, or a tunnel. An event socket reachable from anywhere other than the host itself has been a bad idea for a decade and this batch adds a heap corruption bug to the argument.

Then check that your Verto and WebSocket ports are not answering from the open internet. We wrote a longer piece on the tooling and resources around both Asterisk and FreeSWITCH if you want the wider map, but the port question takes about a minute with nmap from outside and answers more than any list will.

FAQ

Is mod_verto safe to unload on a running system?

If no client connects over Verto, yes. Unloading it drops Verto and its WebSocket listener and touches nothing in the SIP path. Check show modules and your access logs before assuming nobody uses it.

Does this affect Asterisk too?

No. These are FreeSWITCH CVEs. Asterisk has its own advisory stream and its own release lines.

Why group by module rather than by score?

Because score tells you how bad something is if it applies, and the module tells you whether it applies at all. A 9.8 in code you do not load is not your problem. A 5.3 in code every one of your scripts links against might be.

Is CVE-2026-49840 really a problem if ESL is internal?

Lower risk, not zero. The bug is triggered by a malicious or man-in-the-middle peer, so it depends on who can reach the socket and what sits between. Internal is not the same as trusted on a flat network.

Were these actively exploited?

I have seen no evidence of exploitation in the wild and I am not going to imply any. Treat them on severity and reachability, not on rumour.

How do I check my version properly?

Run version in fs_cli for the build string, and check your package version separately, since a distribution package and the upstream tag do not always line up. The build date alone tells you very little.

Sources: NVD API records for CVE-2026-49841, 49840, 49847, 49842, 49475, 45771, 49843, 49472 and 49848, all published June 2026. Scores quoted are CVSS 3.1 base scores as recorded by NVD.