5 PM Technology News Recap: Divine Revival, Flock Privacy Pressure, Thunderbird and OpenJDK Patches (August 23, 2026)

1. Divine is bringing back six-second video—with a very different social contract

CNN reports that Divine officially launched last week after nine months of development and beta testing. The app pairs new six-second looping videos with an archive of more than two million original Vine posts. It is inspired by Vine but is not formally affiliated with the former Twitter-owned service.

The more interesting story is not nostalgia. Divine says it will reject AI-generated uploads, explain how its “For You” feed works, and let people choose among feeds driven by different algorithms. Its official FAQ says the service is built on the open Nostr protocol and describes portable identity, open-source code, creator-controlled feeds, and six-second video as core design choices.

Founder Rabble told CNN that Divine had around 100,000 users. CNN also reported the app’s first brand partnership with Taco Bell. Those are useful signs of traction, but the user figure is a founder-provided number, not an independently audited active-user count. There is also a material archive-count discrepancy: CNN describes access to more than two million original Vine posts, while Divine’s current FAQ says it has recovered about 170,000 archived videos from roughly 62,000 creator accounts. The opened sources do not reconcile whether those figures measure different libraries, import stages, or update times, so neither should be treated as a single settled total. The FAQ still refers to mobile beta testing, suggesting at least some official documentation may lag the reported launch state.

Why it matters: mainstream social platforms usually ask users to accept one opaque recommendation system. Divine is testing whether people value visible feed choices, portable identity, and an explicit preference for human-created media. The project could become a useful experiment even if it never approaches TikTok-scale reach.

Evidence: CNN — “A new app is bringing Vine back, with a very 2026 twist” (published August 23 at 10:30:29 UTC) and Divine’s official FAQ.

2. Flock’s privacy changes are under pressure from both parties—and the exceptions matter

TechCrunch reports growing public and political opposition to Flock Safety’s camera, drone, and automated license-plate-recognition network. The article cites a Washington Post investigation that identified 46 alleged unauthorized police uses of Flock technology, including cases involving officers accused of tracking wives, girlfriends, or former partners.

Flock says it is reducing default data retention from 30 days to seven days and requiring a case code before users access data. The company’s chief executive, Garrett Langley, has also called for criminal penalties for illegal use. Three House Republicans introduced a bill that would bar federal purchases of automated surveillance systems using facial recognition, biometric identification, or license-plate recognition, explicitly naming Flock cameras. A proposal is not an enacted restriction, but the issue is no longer confined to one political camp.

The safeguard details are the key. The ACLU notes that agencies may use “Evidence Mode” to preserve information beyond seven days and may select longer retention periods where local policy permits. The group also says Flock’s audit-assistance tooling has not received an independent effectiveness evaluation and argues that earlier search-reason controls were easy to circumvent. Flock presents its auditing as a way to expose abuse; the ACLU argues that without a reliable denominator, isolated detections cannot establish how much abuse the tooling actually catches.

Practical context: organizations evaluating surveillance or analytics systems should ask about defaults, overrides, audit independence, access reviews, retention deletion, misuse notification, and procurement restrictions—not merely whether an audit log exists. A control that can be overridden without narrow approval and review is a different control than a hard technical limit.

Evidence: TechCrunch — “Flock CEO calls for ‘compromise’ as surveillance company faces growing backlash” (published August 23 at 15:30 UTC) and the ACLU’s August 13 analysis. The ACLU is an advocacy organization; its interpretation is presented as such.

3. Debian’s Thunderbird update is a reminder that email clients are high-value software

Debian’s security tracker lists DSA-6461-1, “thunderbird – security update,” with 31 CVE references. For Debian 13 “trixie,” the tracker marks 1:140.12.0esr-1~deb13u1 vulnerable and 1:140.14.0esr-1~deb13u1 fixed in the trixie-security repository.

Thirty-one references do not mean 31 equally severe or equally reachable attacks. The tracker page does not provide CVSS scores, active-exploitation claims, or a single universal attack path. The operational takeaway is simpler: Thunderbird parses mail, links, images, and other attacker-influenced content while holding sensitive communications. Administrators should not leave an internet-facing mail workflow on the listed vulnerable build merely because it is a desktop application.

What to do: Debian users should refresh package metadata, confirm that the security repository is enabled, update Thunderbird through the normal package manager, and restart the application so the running process loads the new code. Managed fleets should verify the installed version rather than counting only a successful update job.

Evidence: Debian Security Tracker — DSA-6461-1 and the official advisory archive link. The archive returned an automated challenge during our final check; package versions and the 31-reference count were verified on the tracker.

4. Debian’s OpenJDK 25 update belongs on server and build-system maintenance lists

Debian’s DSA-6460-1 tracker entry lists four vulnerabilities: CVE-2026-60589, CVE-2026-61308, CVE-2026-70906, and CVE-2026-70907. For Debian 13 “trixie,” the tracker marks 25.0.3+9-2~deb13u1 vulnerable and 25.0.4.1+1-1~deb13u1 fixed in trixie-security.

Java updates can be deceptively quiet. Updating the package on disk does not replace a JVM already loaded inside a long-running application server, integration service, or build agent. Operators should identify which services use OpenJDK 25, test the update against business applications, schedule controlled restarts, and confirm the running Java version after maintenance.

The official tracker does not report active exploitation, CVSS scores, or universal attack prerequisites on this summary page. That uncertainty should shape the language, not become an excuse to defer normal patching. A fixed security build is available; the exact operational urgency depends on exposure, workload, and application compatibility.

Evidence: Debian Security Tracker — DSA-6460-1 and the official advisory archive link. The archive returned an automated challenge during our final check; the tracker supplied the CVE and package-version record.