System Admin Stuff

Friday, 14 August 2026

Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks

You're not alone if you just received an "Apple Threat Notification" saying it detected a "mercenary spyware attack targeted at your iPhone." [...]

source https://www.bleepingcomputer.com/news/apple/apple-sends-new-threat-notification-alerts-over-mercenary-spyware-attacks/

Ukraine shuts down 94 fraudulent call centers, seize millions in cash

Authorities in Ukraine shut down 94 fraudulent call centers across the country that lured people into investment scams or tried to obtain access to bank accounts. [...]

source https://www.bleepingcomputer.com/news/security/ukraine-shuts-down-94-fraudulent-call-centers-seize-millions-in-cash/

Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt

An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. [...]

source https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/

Hackers breach govt webmail while running parallel crypto fraud

The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. [...]

source https://www.bleepingcomputer.com/news/security/hackers-breach-govt-webmail-while-running-parallel-crypto-fraud/

Hundreds of fake Chrome VPN extensions route traffic through a proxy

More than 737 browser extensions published on the Chrome Web Store impersonated well-known VPN and proxy services while routing users' traffic through SOCKS5 proxies operated by a single provider. [...]

source https://www.bleepingcomputer.com/news/security/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy/

Delphi 13 Community Edition released

Delphi is still very much a thing, and still very much in active development. The current stewards of Delphi, Embarcadero, released the Delphi 13 Community Edition today.

Delphi Community Edition is a full-featured, free edition of Delphi for building native applications with the Delphi language. It includes a professional IDE, visual designers, integrated compilers and debuggers, the VCL framework for Windows development, and the FireMonkey framework for creating native applications from a shared codebase across Windows, macOS, iOS, and Android.

It is designed for students, hobbyists, freelancers, and small teams that meet the Community Edition license requirements.
↫ Marco Cantu at the Embarcadero blog

Delphi has been around since 1995, first released for Windows 3.1. It’s both a programming language, a variant of Object Pascal, and the accompanying IDE and related tooling and frameworks, originally developed by legendary company Borland. This latest version of course adds a number of new features to the programming language, and further improves the IDE as well, this time with a brand new 64bit version. The two frameworks for visual application development, VCL and FireMonkey, have also been updated and improved.

Sadly, it’s not open source, and the Community Edition is intended for mostly non-commercial, hobbyist use. If you want to actually earn any money using Delphi, you’re going to have to step up to Delphi 13 Florence, which isn’t free.

source https://www.osnews.com/story/145742/delphi-13-community-edition-released/

Cisco warns of ASA and FTD VPN flaw exploited to crash devices

Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being actively exploited in attacks to remotely crash affected devices. [...]

source https://www.bleepingcomputer.com/news/security/cisco-warns-of-asa-and-ftd-vpn-flaw-exploited-to-crash-devices/

Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days

Today is Microsoft's August 2026 Patch Tuesday, and with it comes security updates for a massive 400 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]

source https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/

Zuck rekindles open weights Llama drama with Muse Glimmer

After seemingly abandoning its open source AI roots this spring, Meta offered enterprises a glimmer of hope on Monday with the launch of its first open weights model in more than a year. Unveiled on Monday, Muse Glimmer is a 30 billion-parameter LLM distilled from the Social network's larger, and for now proprietary, Muse Spark model. Glimmer arrives as American tech companies grapple with a crisis over the proliferation of Chinese open weights models and a call for domestically-created alternatives. Meta built its reputation on the back of open weights model development beginning with the Llama herd back in 2023. But after Llama 4 flopped and the company restructured its AI group, critics questioned CEO Mark Zuckerberg's commitment to open source AI. With Muse Glimmer, Meta has returned to the open weights arena. The company describes the model as being ideally suited to local AI inference workloads, including local agents, code assistants, and applications requiring robust multi-modal tool use and function calling. Released under a highly permissive Apache 2.0 license, enterprises are also free to deploy, use, and modify the model however they see fit. We imagine it won't be long before Nous Research — one of the original Llama fine-tuners — emits another Hermes model based on Glimmer. Early support has begun to hit popular local AI inference platforms like Llama.cpp, Ollama, and Unsloth, with optimized implementations expected to hit over the next few weeks. But at 30 billion parameters, Muse Glimmer doesn't exactly move the needle much on reclaiming American open weights superiority. It's too small to compete with Moonshot AI's Kimi K3, Alibaba's Qwen 3.8-Max, DeepSeek V4 Flash, or any of the other Chinese models which have dominated the AI news cycle over the past few months. Instead, Muse Glimmer is positioned as a model for small-to-medium sized enterprises or enthusiasts, competing with similarly-sized LLMs from Alibaba and Google. This is reflected in Meta's benchmark figures, which pit the model against Alibaba's Qwen 3.6-27B and Google Gemma 4 31B. As usual, take these claims with a grain of salt, but Glimmer does appear to best Google's Gemma in most scenarios, and trades blows with Alibaba's equivalently sized model. Unfortunately for Meta, the comparison probably won't age well, with Qwen 3.8-27B due to be released any day now. Open and local Glimmer's relatively small parameter count means that its hardware requirements are rather modest compared to larger frontier-class models, like DeepSeek V4. At its native BF16 precision, the model should fit comfortably into a single Nvidia RTX Pro 6000 or AMD MI350P. Quantized to 4-bit precision and model's weights shrink from around 60 GB to just under 16 GB — small enough to fit in a 20 to 24 GB consumer graphics card, like an RTX 30/4090 or RX 7900 XT/XTX. Unfortunately for those with 16 GB cards, a lack of adequate working memory means dropping down to a smaller, less accurate 3-bit quant. Even if you can get the model to fit, it won't be as fast as some other recent models, like Qwen 3.6-35B-A3B or Gemma 4 26B-A4B, as Glimmer uses all 30 billion parameters to generate each token where the others use just 3 to 4 billion. Glimmer benefits heavily from memory bandwidth. On cards like the RTX 5090, which has 1.8 TB/s of it, Meta says users can expect between 75 and 233 tok/s. The higher end of that relies on a technique called speculative decoding. As a quick refresher, speculative decoding uses a small draft model, in this case one modeled after DeepSeek's DSpark drafter, to speed up inference by predicting the outputs of a larger model. If you're interested, we explore the concept in greater depth in this hands-on here. While 233 tok/s is plenty fast for most agentic workloads, most users won't see performance nearly that high. On an M5 Max MacBook Pro, Meta estimates that the systems' up to 614 GB/s of bandwidth will deliver a still-meaningful 26.2 to 57.8 tok/s, but it's also worth pointing out the M5 Max delivers 4x the memory bandwidth of the typical Windows notebook today. In other words, unless you've got a dedicated graphics card with enough memory to run the model, the best you can expect is around 6 to 14 tok/s. Testing on a DGX Spark in Unsloth Studio, we were getting around 12.2 tok/s, though DSpark support doesn't appear to have been implemented just yet. If you'd like to try the model out for yourself, its weights are currently available for download on Hugging Face as well as through local inference platforms like Ollama and LM Studio. Sparking joy Meta's return to the open weights arena doesn't stop with Glimmer. In an X post Monday, Meta's Superintelligence chief Alexandr Wang committed to releasing an open weights version of Muse Spark 1.2 "soon." Muse Spark 1.2 is Meta's most capable model, its first to compete in a meaningful way with rivals OpenAI, Anthropic, and Google. However, even this release won't close the gap with Chinese models. Both Kimi K3 and Qwen 3.8-Max outperform Spark, according to Artificial Analysis' intelligence index. Having said that, we still don't know how big Spark actually is. If Meta's next open weights model ends up delivering similar performance using fewer weights, this may end up being more competitive from a cost per token standpoint. ®

source https://www.theregister.com/ai-and-ml/2026/08/10/zuck-rekindles-open-weights-llama-drama-with-muse-glimmer/5285666

OpenAI releases ChatGPT 5.6 Cyber, but it's only for approved users

OpenAI has developed a new model called "GPT 5.6 Cyber," designed for vulnerability research, penetration testing, incident response, and remediation. [...]

source https://www.bleepingcomputer.com/news/security/openai-releases-chatgpt-56-cyber-but-its-only-for-approved-users/

North Korean spies are running local LLMs to cause AI mischief

North Korean government snoops are operating LLMs locally and collecting technology to weave AI into their attack operations, according to South Korean security firm Genians. The researchers said they observed Kimsuky setting up and operating local LLM environments using Ollama, GPT4All, and Msty, experimenting with other AI tools such as Cursor, and using retrieval-augmented generation (RAG) for local document searches. This prevents the data from getting sucked into the cloud where enemies might see it and try to stop it. Kimsuky, a cyber-espionage crew that operates under North Korea's Reconnaissance General Bureau, has for years used phishing and decoy documents in attacks targeting government agencies, think tanks, academia and security research organizations. Genians’ findings “provide concrete evidence that the Kimsuky-affiliated threat actor is moving beyond one-off experimentation with AI and is continuously preparing to integrate the technology into actual attack capabilities, including malware development, data analysis, and the advancement of attack techniques,” the researchers said in a Monday report. The North Korean group’s recent phishing emails use ZIP archives containing malicious LNK files - Kimsuky typically disguises these as materials related to international events, research reports, or meeting requests. When the recipient opens the archive and executes the LNK file contained within it, the shortcut runs an embedded PowerShell loader. In some cases, the goon squad used AI to create lures related to virtual assets and finance, we’re told. These decoy documents “use natural language, a highly polished structure, and formats similar to actual business materials to increase user trust and induce the execution of malicious files,” the security analysts noted. Additionally, the Pyongyang spies use various obfuscation techniques, including Base64 encoding, string splitting, and custom decoding routines, to hide the files’ malicious behavior. The PowerShell script collects a ton of system information, including operating system version and architecture, system configuration, PC type, operating system installation and boot history, and a list of running processes. The attackers use this information to assess the infected environment and support follow-on attacks. As with earlier Kimsuky campaigns, these intrusions use Git repositories for command-and-control (C2) infrastructure. “During the analysis, Genians Security Center identified multiple public GitHub repositories operated by the threat actor,” the researchers wrote. “One repository contained not only configuration files and PowerShell scripts, but also various payloads used in subsequent attacks.” Additionally, the months-long investigation uncovered the spies also using the Git-based C2 infrastructure for malware development and testing, stolen data management, and AI technology research. This included setting up multiple local LLM environments using Ollama, GPT4All, and Msty on infrastructure it controlled. “Because the local approach prevents conversation data from being transmitted to external AI services, it reduces the risk of external exposure, making it a particularly attractive option for a state-sponsored threat actor,” Genians said. The miscreants also collected a “large number” of libraries, such as LLaMaSharp and Microsoft.Extensions.AI, plus packages including OpenAI and Azure.AI.OpenAI, which call and integrate commercial AI services into their own custom applications. “The fact that development components spanning 'local AI execution → document retrieval (RAG) → automated agents → external AI integration' were collected together strongly suggests that they were not gathered out of simple curiosity, but for the direct development of an AI-based tool designed for a specific purpose,” according to the threat hunters. Genians uncovered logs containing speech-to-text tools, such as OpenAI’s Whisper speech recognition models, and evidence that the spies used Cursor AI to edit code and tested RAG for document-based question answering. Using RAG on stolen files can help attackers more quickly and automatically identify valuable information within large volumes of data. While the researchers noted that they did not identify any evidence that the Norks have begun training their own models - but rather remain focused on applying AI to malware development and attack operations - the findings make a strong case for defenders needing to shift away from content-based assessment to behavior-based detection. Assessing threats based on the quality of fake documents, such as unnatural translated language, poor formatting, and spelling errors, is no longer effective because AI is really good at producing convincing decoys. In addition to using indicators of compromise (IoC) to detect attackers in their environments, organizations should look for anomalous behaviors following LNK execution - such as PowerShell execution, persistence establishment, and external communications - to hunt for threats.®

source https://www.theregister.com/security/2026/08/10/north-korean-spies-are-running-local-llms-to-cause-ai-mischief/5285632

NEC tests parking tech that only starts charging once you exit your car

ASIA IN BRIEF Japan’s NEC has started tests of parking technology that will start charging once a driver leaves their car. Most car parks record the time a driver enters the facility and start charging, or depleting a free parking period, at that moment. That means drivers pay for time spent driving around looking for a spot and for the time it takes to exit a car park. NEC, in concert with another Japanese company called UrbanChain, will next month test a system that detects when a driver pulls up in a parking spot and exits their car – and starts charging for parking at that moment. That’s only possible using cameras and AI analysis of real-time video, and the tests NEC will conduct in September will investigate how many cameras are needed to make its plans feasible. NEC’s announcement also mentions “data utilization services targeting commercial facilities that can be used for monitoring vehicle occupant exit counts, analyzing facility visitor trends, and more” plus “new possibilities for data utilization.” Which sounds like a new form of surveillance capitalism, brought to car parks. The two companies also think there’s a safety benefit to their proposal, as it can spot drivers who haven’t left their cars for an extended period – a potential sign of illness. They also hypothesize that if drivers know they won’t be charged while searching for a spot or exiting a center, they may drive more safely. Fujifilm may join Japan’s printer exodus Fujifilm last week informed investors [PDF] that it is investigating a partial spin-off of its printer business. The company wants to float the business and retain up to 20 percent of its shares; an idea it thinks will mean Fujifilm can focus on its other businesses. If the plan goes ahead, Fujifilm will join fellow Japanese printer-makers Epson. Toshiba, and Ricoh in reducing its exposure to the biz. It’s not hard to see why Fujifilm is eyeing the exit: Analyst firm IDC recently said “a confluence of structural transformation and cyclical pressure” has brought uncertainty and sharply falling sales to the printer market. 2GW-plus datacenter opens in western China Chinese company Envision last week announced the commissioning of a two-gigawatt-plus datacenter in Ulana, Inner Mongolia. The company said the 120,000-square-meter facility can house up to one million GPUs and deliver one million PFLOPS of AI computing power. Renewable energy powers the facility, which is located in China’s west – making it an expression of Beijing’s Data East, Compute West plan that calls for construction of large datacenters closer to sources of clean energy and away from large population centers. Cable operator calls for police probe after faults follow “suspicious” activity Australian submarine cable operator and entrepreneur Bevan Slattery on Sunday claimed “some suspicious/coincidental activity” took place at the time two of his cables experienced a fault. “This is a concerning development. Partially because submarine cables are the digital lifeblood of our nation, but also because this could very well turn out to be the second such incidence in a Federally declared cable protection zone,” Slattery wrote. His post includes a marine chart that shows a vessel called the GEM Sapphire, which ship-tracking site VesselFinder lists as a 183-meter long tanker, repeatedly crossing the path of two cables. Infosys to wear Crocs for ten years Indian tech services giant will spend the next decade making sure the world’s ugliest shoes can be produced efficiently, after scoring a deal to help Crocs modernize its systems. Infosys says it will “unify data across the organization and aim to empower Crocs, Inc. with real-time, insight-driven decision-making – accelerating innovation while enhancing efficiency, responsiveness and customer experience.” Apparently, the deal “help Crocs, Inc. address key industry challenges, including rising costs, inconsistent processes and the need for increased agility. The transformation will standardize operations and aim to enable the business to better respond to evolving consumer and market demands.” There’s no mention if the deal will mean anyone looks cool wearing Crocs. Maybe even a decade of help from Infosys can’t make that possible. Australia urges smart glasses privacy probe Australian discount department store Kmart last week started selling low-end smart glasses for just AU$89 ($62/£46). The Guardian reported they sold out swiftly, sparking a privacy debate that quickly saw Australia’s Attorney-General write to the nation’s Privacy Commissioner to ask “that this issue be given priority consideration.” “Privacy is an essential part of all our lives,” said Attorney-General Michelle Rowland, before citing “widespread community concerns about the potential impacts of ‘smart glasses’, particularly for women and children.” ®

source https://www.theregister.com/software/2026/08/10/nec-tests-parking-tech-that-only-starts-charging-once-you-exit-your-car/5285245

I've gone from writing about SD-WAN to depending on it

This spring, my wife and I moved from the Denver suburbs into the Colorado Rockies. The high-altitude retreat presented a welcome reprieve from our otherwise tech-dominated lives. As remote workers, however, we faced certain challenges, and technology was the only reason our move was possible in the first place. Prior to my time at El Reg, I, among other things, breathlessly covered a subset of the networking industry, which as it happens had become big business following the COVID-19 outbreak and the pandemic that followed. I’m speaking, of course, about software defined wide-area-networking (SD-WAN). Little did I know, a mere six years later, this technology would become essential to my wife and me. Had it not been for 5G and Starlink, the move might as well have been time travel. To put it into perspective just how far into the foothills we’d ventured, the fastest wired connection at our disposal was DSL. CenturyLink promised, but notably did not guarantee, up to 20 Mbps down and a staggering 1.5 Mbps up. Compared to the symmetrical gigabit fiber line we’d enjoyed in the Denver suburbs for the past six years, relying on DSL alone felt positively medieval. To those, including many of my neighbors, living this reality, you have my sympathies. Thankfully, DSL wasn’t our only option. For better or worse, 5G and Starlink are helping to close the digital divide in a meaningful way — but individually they’re still far from perfect. Where we live, T-Mobile’s 5G internet service delivers near-gigabit download speeds and uplink speeds ranging from 30–40 Mbps. Meanwhile, Starlink promised between 100 and 400 Mbps downlink depending on the plan, with uplinks that, at least for us, capped out at around 30 Mbps. Either would be fast enough for our needs, but reliable? Turns out there’s still some room for improvement. In the past two months we’ve experienced no fewer than a dozen dropped connections lasting anywhere from a minute all the way to five. Making matters worse, the majority of these drops took place during working hours. With a relatively clear view of the sky, we’ve found Starlink to be more reliable, but even SpaceX isn’t immune to the occasional outage. That’s not to mention the threat of space junk kicking off a Kessler syndrome-like event. SD-WAN to the rescue The easy way to approach multi-WAN would have been to set up two networks, each with its own SSID. In the event one went down, we’d switch to the other. While simple, it’s far from perfect, and does nothing to mitigate disruptions to the voice and video calls on which my wife and I spend a considerable amount of our week. With two WiFi access points, we’d also have to contend with interference from overlapping channels. Wrangling multiple LANs, wireless SSIDs, and firewall rules isn’t exactly ideal. Thankfully, there’s a better way, and we just so happened to have all the equipment we needed. SD-WAN was developed in the early 2010s to solve a very specific problem: as SaaS apps like Office 365, Salesforce, and Google Apps took off, more and more enterprise traffic was going out to the internet. This was a problem for a lot of enterprise WANs, which often relied on expensive MPLS links designed to connect satellite offices to servers running back at headquarters or regional datacenters. In many cases, these WANs were built to prioritize reliability over bandwidth, and due to their topology required backhauling traffic tens or hundreds of miles just to access the internet. SD-WAN gateways offered an alternative. These devices could route internal traffic over the private WAN while SaaS and other internet-bound traffic could be piped over whatever local ISP served businesses in that area. SD-WAN is an entire can of worms in itself, but for my purposes two key capabilities stood out: multi-WAN and policy-based routing support. Our router, a Ubiquiti UniFi Dream Machine SE (UDM-SE), already supported both. The hardware The UDM-SE is not Ubiquiti’s newest nor even its most capable gateway. Introduced in 2022, the all-in-one appliance combines a 3.5 Gbps router (with IPS/IDS enabled) with an 8-port gigabit PoE switch, an integrated network video recorder, and critically two WAN ports, one good for 2.5 Gbps and another capable of 10 Gbps. Ubiquiti’s SD-WAN implementation is somewhat basic compared to gateways from HPE, Cisco, or Extreme. However, of the bevy of networking and security features SD-WAN encompasses, we only really needed a handful – multi-WAN and policy-based routing were the main ones – and Ubiquiti is kind enough not to gate this functionality behind an enterprise license. The setup itself was about as simple as it gets: plug each ISP-provided gateway into one of UDM-SE’s WAN ports and tell it whether you want to load-balance traffic across the two, or failover in the event of an outage or dropped connection. In practice there were a few extra steps, including disabling the 5G and Starlink gateways' onboard routing and WiFi functionality. Starlink supports a bypass mode, but the T-Mobile modem+router combo didn’t. We were able to disable the onboard WiFi, but only using an onboard utility. Putting it to the test With everything connected, we opted to configure the UDM-SE for WAN failover with T-Mobile as the primary and Starlink as the backup, rather than load-balancing traffic across the two, in part because the 5G link was so much faster. The first few days after setting everything up, my wife and I were questioning whether we even needed Starlink. But then we saw the notification: “Internet connection WAN1 (T-Mobile USA) on port 9 is down and WAN2 (Starlink) is now active,” and then a few minutes later, “Internet connection WAN1 (T-Mobile USA) on port 9 is restored after failing over to WAN2 (Starlink).” Both notifications were dated two hours earlier. We just hadn’t noticed. In fact, despite at least a dozen dropped connections over the past two months, the UDM-SE failed over fast enough that it was never an issue. No dropped calls, no buffering video, no timed-out web pages. Perhaps the most surprising discovery was that while Starlink didn’t offer the fastest or lowest-latency connectivity, it was remarkably reliable. Despite less than perfect alignment and view of the sky, the logs show just two dropped connections in the past month, one of which happened in the middle of the night when no one was awake to notice. While WAN failover kept us online, it didn’t do anything to guard against network congestion. The UDM-SE offers a preconfigured quality-of-service (QoS) policy that in theory should detect Zoom or MS Teams traffic and prioritize it over something like Windows Update or YouTube. But since we had two WANs, we could go one better and take advantage of another SD-WAN favorite: policy-based routing. This allowed us to force certain devices or services to prioritize one ISP over the other. For example, because Starlink had proven to be the more reliable of the two links, I wrote a policy to route traffic from my wife’s work laptop over the satellite link first and fail over to T-Mobile in the event of an outage. This also had the benefit of ensuring that if I happened to kick off a large game or AI model download while she was in the middle of a meeting, I wouldn’t get myself in trouble for turning her Zoom call into a pixelated mess. The digital divide is narrowing, not closed In the more rural parts of the US where wired connectivity isn’t a given, cellular home internet and low-Earth orbit (LEO) satellite communications, like Starlink, have gone a long way toward closing the digital divide — particularly for those working from home. However, individually they’re still far from perfect. Dropped connections weren’t a daily occurrence, but they still occurred more frequently and for longer than we would have liked. Five minutes is a long time to wait wondering whether the person on the other end of the Zoom call will be there when you eventually get back online. Technologies like SD-WAN can help to mitigate the problem by allowing multi-WAN failover, load balancing, and policy based routing, but to take advantage of them also requires paying for two ISPs and hundreds of dollars of equipment, which may or may not require monthly subscriptions or annual licenses. We were fortunate that the hardware we already owned supported these features and didn’t lock them behind a pricy enterprise license. Even still, we’re paying more for internet than we’d like. Between T-Mobile and Starlink, we’re spending around $125 a month to get online. Along with the higher price, network latency is also a lot higher than we’d like. Compared to our old fiber line, which routinely achieved latencies under 5 ms, T-Mobile and Starlink ranged from 15 ms at best to as much as 80 ms at worst. The only online game I play regularly is a real-time strategy that’s old enough to drink. I’m not playing CS:GO or whatever twitch shooter is popular these days, so the higher latency wasn’t that big of a deal, but if you're a competitive gamer, a wired connection is still a must. The good news is T-Mobile and Starlink may not be our only options for high-speed internet for much longer. There are numerous ongoing efforts across the US and other nations to improve access to fiber connectivity, including one slowly working its way down the highway in our general direction. On a personal note, while it’s neat to experience a technology firsthand that I dedicated years of my life to writing about, the moment fiber-to-the-home comes, both our Starlink and 5G home internet subscriptions are getting the boot. ®

source https://www.theregister.com/networks/2026/08/09/ive-gone-from-writing-about-sd-wan-to-depending-on-it/5285130

Ransomware gangs skip the CEO, head straight for the 40-something IT manager

Turns out the fastest way to get a company to consider paying a ransom isn't calling the CEO – it's targeting the 46-year-old IT manager. That's according to Zscaler, whose ThreatLabz researchers tracked 351 victims across 334 organizations caught up in a single ransomware campaign over the course of a month. The data suggests today's ransomware crews have become oddly specific about their preferred victim profile: nearly two-thirds of victims held manager-level titles or above, the average victim was a 46-year-old Gen Xer, and three-quarters worked in accounting and finance, sales, operations, HR, or marketing. Half worked in the industrial or IT sectors. Rather than blasting the same extortion email across an organization, attackers are doing their homework first. Zscaler says they combine information from compromised systems with publicly available data to map reporting lines and identify the employees most likely to influence a company's response. "The ransomware landscape has shifted from indiscriminate attacks to highly targeted extortion campaigns," the security outfit wrote. "Rather than targeting executives directly, attackers are increasingly focusing on managers and other key personnel with the authority or influence to accelerate payment decisions." That shift reflects what Zscaler calls "business privilege" rather than technical privilege. Security teams have traditionally focused on privileged users with administrator rights. Attackers, meanwhile, are after employees whose day jobs give them access to invoices, payment approvals, budgets, supplier contracts, customer accounts, HR records, or other sensitive business processes. "The value of a compromised managerial account lies in the breadth of business access associated with the position," the researchers wrote. "Managers may approve payments, oversee budgets and vendors, review contracts, access sensitive records, or coordinate work across business units." The Gen X skew is probably no coincidence either. Zscaler says many workers in their forties and fifties have reached established management positions, giving attackers access to valuable systems, sensitive information, and people with decision-making authority without needing to compromise the executive suite. It also found more than a dozen organizations said multiple employees were compromised during the campaign, suggesting attackers weren't content with a single foothold once inside a network. Instead, they appeared to work their way through different business functions to increase the chances of reaching valuable data and the people capable of influencing a ransom payment. The wider report points to a ransomware ecosystem that is becoming increasingly focused on extortion rather than encryption alone. Zscaler said ransomware attempts blocked across its cloud platform increased 146 percent over the past year, while public extortion cases rose 70 percent and the volume of data stolen from victims climbed 92 percent. By the time the ransom note lands, the crooks may already know who approves invoices, who signs contracts, who runs HR, and who reports to whom. The encryption is just the bit that victims notice. ®

source https://www.theregister.com/security/2026/08/09/ransomware-gangs-skip-the-ceo-head-straight-for-the-40-something-it-manager/5284499

IceWM 4.1.0 released

IceWM, the venerable X11 window manager, has put up a new maintenance release, version 4.1.0. It’s got a small number of fixes, two very minor new features, as well a few updated translations. That’s it.

source https://www.osnews.com/story/145703/icewm-4-1-0-released/

Brit boffins boast of beating barriers to building fusion power

Scientists at the UK Atomic Energy Authority (UKAEA) say that they have overcome plasma instability issues standing in the way of commercial fusion power plants. The boffins overseeing the MAST (Mega Amp Spherical Tokamak) Upgrade installation at UKAEA's Culham Campus in Oxfordshire conducted a fifth series of experiments on it during 2025 and 2026 and produced more than 1,100 fusion plasmas. During these experiments, the team demonstrated the highest pressure ever achieved with the MAST Upgrade machine, without the super-hot plasma destabilizing, they say. One of the challenges they set out to address is to figure out how to suppress instabilities known as Edge Localised Modes or ELMs. These are described as “sudden bursts at the plasma’s outer edge” that can cause a loss of plasma pressure and also lose up to a tenth of its stored energy in a single event. Over time, these occurrences will damage the tokamak’s inner wall and exhaust components, and were therefore seen as a serious obstacle to commercial viability. To cure this, the team adopted two techniques already previously tested to avoid these damaging heat bursts; Quasi-Continuous Exhaust mode (QCE-mode) and Resonant Magnetic Perturbations (RMP). With QCE, the plasma edge experiences high-frequency, low-amplitude filaments that act to bleed off pressure before it can build to a destructive level. Likewise, RMPs use a magnetic field to induce small perturbations at the edge of the plasma that bleed off the pressure leading to ELMs. The team also accessed two additional stable operating regimes known as Quiescent H-mode (QH-mode) and I-mode (Intermediate-mode), improved plasma confinement techniques that deliver better energy confinement while mitigating issues associated with large ELMs. QH-mode is understood to tackle ELM using an edge electromagnetic instability called the Edge Harmonic Oscillation (EHO) to steadily remove excess heat, while I-mode is a confinement technique that features a steep thermal barrier at the edge that allows particles to escape, again preventing the buildup of pressure. The Culham scientists also claim to have developed a technique for controlling the plasma’s position. This involves measuring visible light created by deuterium emitted from the machine’s upper and lower outer divertors (the exhaust system), allowing minute positional imbalances to be detected in real-time. Detecting changes in position is a step towards automated, real-time control systems that future commercial power plants will need to operate without constant manual intervention, according to the team. The series of experiments also explored “negative triangularity” plasma shapes that allow high-power operations without ELMs. This is said to be an approach being closely watched by the international fusion community. This MAST Upgrade installation is set to get further enhancements this year. These will include two new neutral beam injectors, doubling the machine’s heating capacity, and the installation of an Electron Bernstein Wave (EBW) system that will provide an additional 1.6 MW of heating power. Following this further upgrade, a sixth series of experiments is planned for 2028. EBW systems use high-frequency, electrostatic plasma waves to heat and drive currents in dense fusion plasmas, and the technology is planned for use in STEP, (Spherical Tokamak for Energy Production), the UK’s pilot fusion power plant to be built at the site of a former coal power station in Nottinghamshire. “These findings take us another step closer to practical fusion energy,” claimed James Harrison, head of MAST Upgrade science at UKAEA. “The results genuinely shape the design of future fusion power plants. Accessing four stable high-performance plasma regimes demonstrates that MAST Upgrade is producing science at the leading edge of what is possible.” Earlier this year, the UKAEA published a roadmap of targets it wants scientists to hit before the end of the decade, in order to drive forward development of working commercial fusion reactors. Reg readers will no doubt be aware of the old chestnut that working fusion power is perpetually 30 years away, but there have been developments in recent years, such as “ignition” being achieved at the National Ignition Facility (NIF) at Lawrence Livermore National Laboratory (LLNL) in California, while UK fusion firm Tokamak Energy said it expected to deliver commercial fusion energy in the next decade. ®

source https://www.theregister.com/science/2026/08/07/brit-boffins-boast-of-beating-barriers-to-building-fusion-power/5284882

Metabase SQLi zero-day exploited in customer data-theft attacks

A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally. [...]

source https://www.bleepingcomputer.com/news/security/framework-tally-disclose-metabase-data-theft-attacks/

Unlimited Technology Systems breach impacts 3.8 million people

Healthcare software company Unlimited Technology Systems reported that more than 3.8 million people were impacted by a data breach incident that occurred in October 2025. [...]

source https://www.bleepingcomputer.com/news/security/unlimited-technology-systems-breach-impacts-38-million-people/

Uncle Sam aims to help nuclear energy find its sea legs

Not content with nuclear reactors on land, the US is backing an international push to put atomic power plants aboard civilian ships and floating platforms. The US will host the launch of the International Atomic Energy Agency's (IAEA) Atomic Technologies Licensed for Applications at Sea (ATLAS) initiative in Washington, DC, on August 26 and 27. ATLAS aims to tackle the legal, regulatory, safety, security, and liability problems that stand between maritime reactors and commercial deployment. Ahead of the launch, the US will hold an "Industry Day" on August 25 to showcase technology from American nuclear and maritime companies hoping to take a share of any future market. US Secretary of Energy Chris Wright linked the event to the Department of Energy's broader drive to deliver oodles of extra atomic power for AI datacenters and other industries. "DoE remains focused on unleashing American energy dominance, accelerating innovation, and advancing sources of energy that are affordable, reliable, and secure for the American people," he said. "Hosting the launch of ATLAS supports this critical mission, positioning the US nuclear and maritime sectors at the forefront of advanced energy innovation, while promoting safety and security for the United States and the world." The initiative covers civilian nuclear-powered ships and floating power plants, with the latter potentially supplying coastal communities or energy-hungry industrial processes such as desalination. The DoE is pinning its hopes on small modular reactors (SMRs), whose high energy density and long operating cycles could suit ships and offshore power installations. America is no stranger to reactors afloat. Every active US Navy aircraft carrier is nuclear-powered, giving it almost unlimited range without frequent refueling. The US Navy also used to operate nuclear-powered cruisers, such as the Virginia class, but these were retired after the end of the Cold War because they were costly to run. Civilian nuclear ships are also not entirely new. NS Savannah was the first nuclear-powered merchant ship when it was launched back in 1959, but again proved costly to run. Perhaps the IAEA hopes that SMRs will make atom-driven civilian ships more economical. Russia operates the world's only floating nuclear power plant. The Akademik Lomonosov is a barge-like vessel whose two KLT-40S reactors can generate a combined 70 MW of electricity. Putting a reactor on water changes the risks rather than making them disappear. The surrounding sea provides a vast heat sink for cooling, but a plant moored in a remote location may have limited access to emergency backup power, according to one assessment. However, any accident might also see radioactive contamination of the marine environment near the damaged reactor, which could seriously affect the coastal community the nuke was meant to be serving. "The global maritime sector is at a critical turning point, facing urgent pressure to sustain long-distance, high-speed operations while ensuring reliability and energy security," said IAEA Director General Rafael Mariano Grossi. "Small modular reactors offer a safe and viable option for maritime transport and offshore energy systems – delivering high energy density and long operating cycles that eliminate the need for frequent refueling." ®

source https://www.theregister.com/science/2026/08/06/uncle-sam-aims-to-help-nuclear-energy-find-its-sea-legs/5284179

New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes

Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines. [...]

source https://www.bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes/

Prompt injection isn't the bug, AI agent frameworks are

Nearly a dozen flaws, some critical, in major AI agent frameworks that enterprises use to build apps reveal a security failure that extends beyond prompt injection - or any single model - according to Check Point researchers. “Our research shows a deeper failure: in many agentic frameworks, prompt-controlled content can cross the boundary into trusted framework logic itself,” Yarden Porat and Shahar Tal note in a write-up about a Wednesday Black Hat talk on post-injection exploitation across AI agent frameworks, which they also discussed with The Register. “A bug in an agent framework isn't a bug in one product - it's a bug in the layer a whole category of AI apps runs on,” Tal told us. “And the agent needs no dangerous tools to be turned against you: reading the wrong document is enough. We’re building this layer faster than we know how to defend it.”  The researchers spent a year trying to break various frameworks that enterprises use including LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK. And across these frameworks, the team found and disclosed 11 vulnerabilities. “Almost none of it was a completely new bug class,” Tal said. “That's insecure deserialization, server-side request forgeries, path traversals, use-after-free. These are bugs that we learned to fix 20 years ago, and they're sitting underneath agents that now read your inbox, or update your database.” These are old types of threats, and the model isn’t the weak link, he added. The failure exists in the “plumbing around the model, and we think this has been overlooked,” Tal told us. “There’s a lot of research going into prompt injection and defenses, which are important, but that’s just the beginning.” Defenders should assume prompt injection, according to the researchers. The bug is what the framework does with the injection - and in these cases, the threat hunters found that the frameworks often fail to keep attacker-controlled content in the data plane. This allows it to influence trusted orchestration, memory, state, routing, and system instructions. For example, the duo found a critical checkpoint deserialization bug in Microsoft Agent Framework that led to remote code execution. “Agents have checkpoints, which are a way for them to save their state or rewind to an earlier point,” Tal explained. These checkpoints are saved snapshots of an agent's state, or task progress at a specific moment, and they serialize data - such as conversation history - into persistent storage, so if an error occurs, the system reloads this saved state instead of starting from scratch. In this case, Check Point’s team found an insecure deserialization issue where, via prompt injection, the agent loaded untrusted checkpoint data, and this could allow attackers to execute malicious code on the system. “One person's message plants the payload, and then a different person rewinds their own session, which triggers the payload, and now the attacker has a shell on that server,” Tal said. Microsoft recognized the researchers’ findings, paid a $10,000 bug bounty and fixed the issue. But because the framework wasn’t a generally available product when Check Point found the flaw, Microsoft did not issue a CVE. Microsoft told us that it appreciated the researchers reporting the vulnerability. “We have released protections to harden the Agent Framework and prevent the concrete exploitation path demonstrated in the proof of concept,” a spokesperson told The Register. “In addition, we updated the specific checkpoint file with additional language to define the security boundary.” The duo also found flaws in Google ADK (agent development kit). However, Google responded differently, the researchers told us, and did not completely fix the vulnerability or issue a CVE. “ADK ships a built-in development assistant that can write files, and it stays reachable over the HTTP API even though it is hidden from the app listing,” Porat told us. To break this trust boundary, an attacker opens a session, asks ADK to write an agent whose Python code runs at import time, and then asks the server to run the agent, he explained. The server then imports the file and executes the attacker’s code. “There is no authentication on that API by default, and adk deploy cloud_run publishes the same API, so on a default Cloud Run deployment it is reachable without credentials,” Porat said. “From there it reaches the environment's API keys and the container's Google Cloud service account." Google did not respond to The Register’s inquiries. But according to Check Point, Google initially deemed the issue not a bug. “We argued the consequence rather than the mechanism: code execution on that container reaches the environment's API keys and the container's Google Cloud service account, which is secret theft, not a developer inconvenience,” Porat said. Google ultimately paid a $3,133.70 bounty and issued a partial fix, we’re told. In total, the bug hunters received $17,133.70 in rewards for their efforts. And this isn’t a story about one vendor or framework doing a “particularly bad job,” Tal said. “If one was an outlier, this would be a story about that one vendor,” he added. “Our finding is that the same bug classes turn up in all of them.” ®

source https://www.theregister.com/security/2026/08/05/prompt-injection-isnt-the-bug-ai-agent-frameworks-are/5283585

Time Magazine has a separate version of its website with ads only AI can see

AI webpage crawlers are now being served their very own ads that ordinary visitors never see, with one firm's boss openly describing a strategy to influence what chatbots say about brands. The next time you ask Claude about where to bank, its answer may have been influenced by this bot-targeted content. We only have one documented example so far, and that's Time serving AI-only ads to selected AI crawlers, as spotted by Germany-based freelance software developer Vincent Schmalbach. In a Wednesday blog post, Schmalbach detailed how he found sponsored content embedded in markdown versions of some Time pages that are served to AI crawlers but not ordinary browsers. Those pages also contained advertising tags from adtech vendor Mobian ahead of extensive FAQs for online-only bank Ally. The FAQs include brand "facts," such as the number of fee-free ATMs associated with the branchless bank, alongside claims that Ally is "the only bank built for life today," putting it in "a category of one." Key “brand fact” statements that make for great regurgitable facts are also included in the AI-only advertisement, as are answers to questions like “is Ally good for everyday banking,” “can you deposit cash at Ally Bank,” and the like. The FAQ is flagged as sponsored content on the markdown page, but it doesn’t change the fact that the entire thing is written like it was designed to be spit back out by a chatbot in response to specific questions. Not all web crawlers are getting these markdown ads either. Per Schmalbach, Google’s standard search indexing bot doesn't see the ads, as it just gets the same HTML that a human gets. “Only the [chatbot] assistant crawlers get the forked version,” he wrote. That means user-agents including ClaudeBot, OAI-SearchBot, and PerplexityBot receive the sponsored markdown, while Google's standard search crawler gets the same HTML served to ordinary browsers. GPTBot and ChatGPT-User, which OpenAI uses for model training and user-initiated retrieval respectively, return HTTP 406 errors in Schmalbach's tests, while OAI-SearchBot receives the markdown version used to support ChatGPT Search. These AI ad-infused markdown versions of stories should be viewable by humans who change the User-Agent header sent as part of HTTP requests, which is how Schmalbach said he spotted them. The Register tested several articles from Time to see for ourselves, and we were able to replicate the results using the crawler simulator provided by search engine optimization firm Encited. When viewed as ClaudeBot, Time’s Best Inventions of 2025 list includes the Ally Bank ad, as do stories about Time’s top content creators of 2026, as does a gallery of photos from a creators' party held in New York recently to honor the list. The markdown ads don’t appear on newsier stories that we checked, suggesting the ads may be part of more evergreen content rather than articles with a shorter shelf life. As Schmalbach points out in his writeup, this could be “the first clear look at what the web starts to become when the main audience is AI models,” which is a threshold we’ve already crossed. Why advertise to humans when you can make AI do it for you? It’s not clear whether Time’s strategy of advertising to AI crawlers has been adopted by other publishers, but it’d be a shock if others weren’t at least considering it. As noted above, AI crawler traffic has already begun to surpass human visits to webpages, making it potentially more lucrative for advertisers to target those crawlers than the humans who made them. With half of the US consumers surveyed saying they use AI to search the web, the potential to reach consumers by influencing AI responses is incredibly powerful, and that is what Time and its advertising partner Mobian appear to be banking on. When we asked the publication to verify Schmalbach’s report and the results we found, they didn’t answer questions, instead pointing us to a story in media and marketing outlet Digiday from last week that verified not only what we saw but our fears about the scheme, too. Per Digiday, Time started converting its web pages to markdown in order to make them more appealing to AI crawlers in June, and a partnership with Mobian was included in that rework. Time COO Mark Howard told Digiday that the publication’s sales team is pitching agent ads to brands that have also converted their websites to markdown, as it suggests those brands are thinking about reaching AI bots. It’s a quote from Mobian CEO and co-founder Jonah Goodhart that makes the objective clear, however: The company's aim is to shape what AI assistants say about the brands paying for the service. “When you influence ChatGPT, you’re influencing potentially all of ChatGPT. If ChatGPT changes what it says about [a brand], it’s massive and it’s more than any one campaign could ever do,” Goodhart told Digiday. “With a human you influence one person.” So far, the pair confirmed to Digiday that Ally Bank and the Project Management Institute were the first brands trying to influence AI search results, matching the ads Schmalbach and The Register found in AI crawler versions of Time's pages. Time and Mobian told Digiday that the partnership marks the first time a publisher has served ads directly targeting AI crawlers, but that “more are already being lined up.” In other words, you soon may not be able to tell which results in an AI powered search are legitimately being surfaced because of being good products, and which are just gaming the system. It’s the early days of the SEO race all over again, only this time fooling the indexers is as easy as handing any old idiot the same pamphlet over and over again until its content becomes truth. ®

source https://www.theregister.com/ai-and-ml/2026/08/05/time-magazine-has-a-separate-version-of-its-website-with-ads-only-ai-can-see/5283640

Elon pledges to give Nvidia a virtual monopoly over the stars

Nvidia commands about 85 percent of the datacenter GPU market today, and if Elon Musk has his way, the AI infrastructure giant will have a virtual monopoly over the stars. On Tuesday, Musk wrote on the social media network he owns that “SpaceX has committed to using Nvidia GPUs exclusively because they are the best.” The collab should surprise absolutely no one. It’s not like AMD or anyone else out there is making hardened versions of their GPUs for orbital datacenters. Why, you might ask? Well, to quote one Gartner analyst, the idea that space-based datacenters will ever be economically viable is “peak insanity.” Nvidia just happens to have $13.2 billion in cash to burn on pipe dreams like these. Specifically, SpaceX says that it will be deploying Nvidia’s Space-1, a specialized version of its upcoming Vera Rubin compute platform designed to operate high above the Earth’s atmosphere where no one can hear you scream because the LLM is hallucinating again. In a separate X post Tuesday, SpaceX announced it was “partnering with Nvidia to design the Starmind AI1 satellite compute payload,” and that “Each of the Starmind satellites will include Nvidia Rubin GPUs and Vera CPUs for datacenter class space compute.” According to SpaceX’s website, when fully deployed, the Starmind AI1 will measure 30 meters tall, have a wingspan of 75 meters from solar array to solar array, and support a compute payload of 250 kW. That might sound like a lot of power, but to put that in perspective, that’s only enough power for roughly a single Vera Rubin NVL72 rack. So, if you thought Nvidia’s rack systems were expensive, just wait till you have to loft them into orbit. Speaking of orbit, before any of this can happen, SpaceX needs to get its super heavy rocket, Starship, into orbit, which still hasn’t happened. An even bigger challenge is making it cost-effective to lob the 3.33 ton satellites into orbit. It currently costs about $7,000 to put a kilogram into orbit aboard a Falcon 9 rocket. That puts the current price of launching the AI1 at north of $23 million, assuming you manage to pack the thing into a Falcon 9 in the first place. For orbital datacenters to be cost-effective, Starship is going to need to get the cost per kilogram down to Elon’s stated goal of $10, Ortibal CEO told El Reg earlier this year. That would bring the cost to orbit to about $33,300, assuming the target is anything more than aspirational. Now is probably about the time we remind folks that Elon doesn’t exactly have the greatest track record of following through on his “commitments.” Remember how SpaceX was going to put humans on Mars by 2022 or how Tesla would field a million robo-taxis by 2020? But even if they don't go to space, Musk still might get something valuable out of Starmind AI1’s development. In yet another X post, Elon opined that the satellite's architecture was so efficient that SpaceX properties would be deploying them, sans solar and thermal management systems, in their terrestrial datacenters. “It’s a major improvement in data center efficiency,” he wrote. The notes came on the heels of SpaceX's first earnings report as a public company, during which it said that capital expenditures grew by a factor of 6x versus a year ago to $18.4 billion as the company goes into overdrive building out xAI, the company's artificial intelligence offering. The company posted a quarterly net loss of $541 million on revenues of $7.81 billion. The stock was down more than 10% in mid-day trading on Wednesday, and is down 17% from its listing price of $135 in June. ®

source https://www.theregister.com/systems/2026/08/05/elon-pledges-to-give-nvidia-a-virtual-monopoly-over-the-stars/5283605

Hackers run khunt post-exploitation toolkit from Oracle database

Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network. [...]

source https://www.bleepingcomputer.com/news/security/hackers-run-khunt-post-exploitation-toolkit-from-oracle-database/

IBM i (OS/400): the database operating system

Today, I wanted to show you one of the most fascinating and surprising operating systems ever created. It’s not another Unix, Linux, or Windows. It is an architecture that went its own way and proved that systems engineering design can look completely different.

I’m talking about IBM’s child, which for many might be synonymous with “boring banking systems,” but in reality, is one of the most uncompromising projects in IT history. While we get excited about abstraction and virtualization today, thinking we are discovering new lands, this system was doing it decades ago. Imagine a system that doesn’t know the concept of a “file” in the way we understand it. A system where everything is an object, and all disk and operational memory form one vast, flat space. If you are looking for proof that true engineering doesn’t need buzzwords to blow you away, I invite you to read on.
↫ Kamil Pytliński

Ever since watching Clabretro’s detailed video about getting IBM i to work on his own IBM POWER hardware and then remoting into them, I’ve been obsessed with running IBM i at home. It feels like the final boss of operating systems to dive into and explore, hidden in the deepest, darkest trenches of the ocean of technology. Everything about IBM i feels alien, complex, convoluted, opaque, and overwhelming, and you can probably dedicate your entire career to working with this platform and somehow still learn new things about it every day.

There’s something brutalist about IBM i, and I so desperately want to bang my head on its concrete walls.

source https://www.osnews.com/story/145681/ibm-i-os-400-the-database-operating-system/

77 Open VSX extensions found harvesting developer info

77 extensions on the Open VSX marketplace impersonated legitimate developer tools while transmitting information about the systems and development environments where they were installed. [...]

source https://www.bleepingcomputer.com/news/security/77-open-vsx-extensions-found-harvesting-developer-info/

Google dev kit spurs first-ever agent-on-agent violence

In what they call the first-ever real-world agent-to-agent exploitation method, Pillar Security researchers say they discovered an exploit in the repository behind Google's Agent Development Kit for Python that could allow attackers to compromise supply chains. In other words, now we know that one AI agent can be used to control and compromise another one that has more privileges. The security snafu existed in google/adk-python, an open source Python toolkit with more than 90 million downloads used to build and deploy AI agents. Google has since fixed the underlying issue in the repository but deemed the exploit non-rewardable because it involved social engineering. Even so, it illustrates the risks of using AI agents in CI/CD workflows for triage, pull request (PR) reviews, and discussions. It also shows how one AI agent could attack another in a production environment, according to Pillar’s Dan Lisichkin, who found and reported the vulnerability. “Our world is changing quickly, and new attack surfaces are not yet reflected in threat models because these attacks never could exist in the first place in the ‘pre-agent’ world,” Lisichkin said in a technical write-up published on Monday. He will also discuss the findings during a poster talk at DEF CON's AI Village on Friday, August 7 at 1600 PDT. “CISOs and security practitioners should start considering these scenarios, threat-modeling them, and calculating worst-case implications and blast radius,” Lisichkin wrote. The issue stems from the way that the repo ran two classes of automated AI agents with different privilege levels that unintentionally share a trust boundary. One is a low-privilege, public-facing AI agent activated whenever a user opens a pull request (PR) or issue, and a second is a high-privilege, maintainer-only agent. Pillar’s team found that the low-privilege, public-facing agent could be manipulated via prompt injection into triggering a maintainer-only agent that can execute malicious actions. “Because workflows that explain how these agents work behind the scenes are also public, any person could have connected the dots that one agent should be able - at least theoretically - to 'call' the other,” Lisichkin told The Register. "When it comes to building the attack, you just need to know English to build the prompt injection (or just ask an AI to do it for you)." There is one caveat: an attacker would first likely need to make legitimate contributions to the repository to build trust among the maintainers before moving on to prompt injection. But assuming someone was willing to put in the time, here’s how the attack would play out. First, an external user - this would be the attacker - creates a new PR. Lisichkin calls this PR A, and it combines a real fix with malicious code, such as a modified package.json or malicious dependency. Then, a public-facing agent tied to a high-privilege collaborator personal access token (PAT) reads the attacker’s PR text and marks the PR for review. This level of trust - the collaborator PAT - allows the attacker-generated text to trigger a gated workflow. Once the PR A triage happens, the attacker opens a second PR - PR B - with the prompt injection, and the triage agent emits the trusted @gemini-cli handoff. This triggers the privileged-agent workflow and executes the malicious action. “Strung together, they manufacture a complete, believable ‘a human asked for a review, gemini ran it, gemini approved’ trail on the poisoned PR, none of which ever happened,” Lisichkin wrote. Google did not respond to The Register’s inquiries, but Lisichkin confirmed that the underlying issue was fixed. Still, his findings, Google said, “did not meet the bar” for a bug-bounty payout. “This report demonstrates exfiltration of a GitHub token with a 'pull-requests: write' permission, which enables tampering with a PR but still requires a maintainer to take an action to merge the malicious PR as PRs are not automatically merged after a bot review,” Google explained. “We don't reward vulnerability reports that require social engineering to enable a supply chain security compromise,” the rationale continued. “Nonetheless, we have taken an action to harden the repository so we will be recognizing this report with credit.” Lisichkin told us the research shows agent isolation is not enough. "Agents should have their own identity, which mandates what resources they are allowed to access and in what they are allowed to interact with these resources," he said. "In this case, if Google had just given a bot identity to the initial triaging agent, most of the attack could have been prevented. Security teams need to start modeling agent identity and agent resource access within their threat models."®

source https://www.theregister.com/security/2026/08/03/google-dev-kit-spurs-first-ever-agent-on-agent-violence/5282496

Fake Roblox Xeno script launcher pushes infostealer, RAT malware

Fake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals sensitive information. [...]

source https://www.bleepingcomputer.com/news/security/fake-roblox-xeno-script-launcher-pushes-infostealer-rat-malware/

Microsoft says 8GB of RAM should be enough for anyone running Windows 11

Microsoft has added four new items to the to-do list it set itself to improve the quality of Windows 11. Redmond’s list landed in March 2026 in response to users’ anger at Windows 11 becoming increasingly flaky and needy. Pavan Davuluri, Microsoft’s executive VP for Windows and Devices, promised “Improved memory efficiency, lowering the baseline memory footprint for Windows, freeing up more capacity for the apps you run.” Last Friday, Davuluri reviewed Microsoft’s efforts in a new post that is unsurprisingly enthusiastic about Redmond’s repair job – even though much of the work is yet to appear in production versions of Windows. Among the work Davuluri lauded was removing some AI features, improving driver quality, and trying to make the Windows Insider program less convoluted. But he also acknowledges there’s more to be done and that memory efficiency is yet to manifest. “We’ve steadily been introducing several improvements to the memory efficiency of Windows, from taking advantage of a more efficient memory allocator to reduce overhead across apps and components, continued tuning of WinUI 3 so that apps built on it use less memory by design, as well as driving efficiencies across Chromium and Webview2 components when they appear in the operating system,” he wrote. Davuluri’s post also reveals that Microsoft has decided to work on four new areas it hopes will make Windows less craptastic. The third of those is “Memory optimization for 8GB and above,” which Davuluri describes as “Reducing Windows memory footprint to deliver a fast and responsive Windows experience across the PCs customers use every day.” Microsoft’s system requirements for Windows 11 state that the OS needs a PC equipped with at least 4GB of memory, or 16GB of pricey DDR5/LPDDR5 to qualify as a Copilot+ PC capable of handling AI workloads. The software giant seemingly assumes Windows users are all clamoring to run Copilot and other AI, so working to ensure that Windows 11 can run on 8GB of memory feels like a tacit admission that Copilot+ PCs aren’t exciting buyers, perhaps due to the current high price of memory. Or perhaps because people just don’t see much value in paying extra for an AI-capable PC. Another reason for the change may be the declining PC market, which analyst firm IDC recently forecast will experience a 11.3 percent shipment slump in 2026, and 20 percent drop in calendar Q4 alone. “The culprit is a persistent memory shortage with no meaningful relief expected before the end of 2027,” the firm stated. “The knock-on effects are significant: prices are rising and PC manufacturers are struggling to maintain full product portfolios.” Microsoft’s three other new Windows improvement priorities are: Delivering a faster and more efficient out-of-box experience. Providing a faster set up and making it easier for families to access useful parental controls. Making voice more natural and fluid to interact across the apps you use every day. Davuluri didn’t say when Microsoft will deliver these changes. But he did say the company has heard Windows users’ frustrations and will act to assuage them. “The signal from you is clear: keep going. We intend to,” he wrote. ®

source https://www.theregister.com/os-platforms/2026/08/03/microsoft-says-8gb-of-ram-should-be-enough-for-anyone-running-windows-11/5282153

Meta straps on a ‘Kick Me’ sign by mistakenly taking down video by India’s prime minister

ASIA IN BRIEF Meta last week briefly took down an unremarkable video posted by India’s prime minister Narendra Modi, earning itself days of criticism and regulatory trouble. The video featured Modi announcing a new task force that will reform the exams required to secure places in many Indian universities. Those exams have become a major factor in the sudden development of a major youth protest movement in India, after the cancellation of one test amid claims that questions had leaked. As part of his attempts to quell protests, Modi posted his first-ever selfie-style Instagram reel last week and followed it up with others –including the one Meta took down and replaced with a placeholder saying the vid was the subject of a legal complaint. The social networking giant said that was a mistake, apologized, and restored the video. That error gave India’s government the chance to beat up Meta in public. S. Krishnan, the secretary of India’s Ministry of Electronics and Information Technology (MeitY), said he asked Meta “to come in at the highest level and explain what is happening and why.” “They have agreed to come – well, they have to – and explain what the situation is,” Krishnan said. “We want to have both a policy level understanding and a technical understanding of the issues, and also adaptation to the kind of concerns India has.” Krishnan said Meta has written to India’s government to express regret over the incident and established new protocols governing moderation of accounts run by prominent people to avoid future messes of this sort. India has a complex relationship with Big Tech companies, sometimes celebrating their role in assisting the nation’s development, but often also lamenting their monopolistic tendencies and role in spreading content the Modi government would rather netizens don’t see. DeepSeek teases ‘peak/valley’ pricing for new models which hit beta last week Chinese AI upstart DeepSeek last week released a beta API for its next model, deepseek-v4-flash, and revealed a new pricing policy for its APIs. The company says the new policy will apply “soon” and will see the cost of its services double between 09:00 and 12:00, then again from 14:00 to 18:00 – in China’s single official timezone UTC+8. DeepSeek startled the AI market last year by releasing models that it claimed to have trained without vast fleets of Nvidia accelerators. Those claims didn’t stand up to close scrutiny, but the company is considered a significant challenger to western AI outfits such as OpenAI and Anthropic. deepseek-v4-flash is likely to reach general availability within weeks. DeepSeek already claims it outperforms its last model, V4-Pro. Australia proposes new tax on Big Tech – and a new out Australia’s government has tweaked its plans to tax Big Tech companies unless they pay local media for the right to share links to their work. The Land Down Under previously threatened tech companies with a 2.25 percent tax if they don’t fund local media. On Monday, that plan changed to a 2.5 percent levy on advertising revenue only and expanded incentives to fund small and regional publications. Meta has previously slammed the idea as “A discriminatory tax built on a false premise.” Also in Australia, regulators last week decided to sue Telegram after it failed to take down violent and terrorism-related content. Kioxia profits jump by billions, as you’d expect from a memory-maker Japanese memory-maker Kioxia last week announced [PDF] its quarterly revenue grew 451 percent year over year to reach $11.1 billion, plus profit of $5.3 billion – a massive turnaround from the $287,000 loss for the same quarter last year. According to Japanese outlet Nikkei, CFO Yoshihiko Kawamura said the company expects even better days ahead because he believes demand for NAND storage is “still in the early stages.” Japan’s next moonshot to ride local rocket Japanese space startup iSpace last week announced its next mission will ride a Japanese rocket to the moon. iSpace has launched two moon lander missions, but both failed. The company’s plan for its third mission involves new lander design called ULTRA that is capable of carrying payloads weighing several hundred kilograms to Luna. This time around, iSpace plans to use the H3 rocket built by Mitsubishi Heavy Industries, instead of the SpaceX Falcon 9 that carried its first two missions. ®

source https://www.theregister.com/public-sector/2026/08/03/meta-straps-on-a-kick-me-sign-by-mistakenly-taking-down-video-by-indias-prime-minister/5282130

OpenAI teases Astra, its next major AI model, after it solves 10 long-standing math problems

OpenAI has revealed Astra, an unreleased model designed to tackle complex, long-running tasks, after an internal version produced ten significant advances in mathematics and theoretical computer science. [...]

source https://www.bleepingcomputer.com/news/artificial-intelligence/openai-teases-astra-its-next-major-ai-model-after-it-solves-10-long-standing-math-problems/

COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft

A vulnerability in COLDCARD hardware wallet firmware allowed attackers to steal an estimated $88.6 million in Bitcoin from thousands of wallets whose seeds were generated using a flawed random number generator. [...]

source https://www.bleepingcomputer.com/news/security/coldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft/

Google Chrome may soon block New Tab hijacker extensions by default

Google is preparing a new Chrome security feature that would block policy-installed extensions from hijacking the New Tab page or changing the default search engine. [...]

source https://www.bleepingcomputer.com/news/google/google-chrome-may-soon-block-new-tab-hijacker-extensions-by-default/

Meet the 'internet radical' who helped Microsoft get email and AT&T get online

Tom Evslin drove the WorldNet project at AT&T and helped develop what became Microsoft Exchange and Outlook. He was at Microsoft when the company was still working out what to do about this newfangled internet thing. Evslin describes himself as one of Microsoft's "internet radicals" in the early 1990s, when the company was developing Exchange Server to fend off the threat from Lotus Notes. "Bill Gates was willing to put lots of effort and money into Exchange because he was very afraid of Lotus Notes," Evslin says. "He felt that Lotus Notes could become a platform the way that Windows was, which would be an enormous threat to Microsoft. And so he saw Exchange as a Notes killer." Evslin saw Exchange differently "because I was an email guy." He and Microsoft's other "internet radicals" wanted the upcoming products delayed until they had been made relevant to the internet. Gates disagreed. "Bill said, with some truth, that we were probably behind schedule anyway, always looking for an excuse to be late. So we go ahead with the next launch of products, including Office, Exchange, and NT, then worry about the internet afterward, which I thought was a mistake." Evslin was fascinated by the internet's potential and disappointed by Gates' stance. He was responsible for gateways in Exchange, services that connect one mail system to another. Some did things like connecting to CompuServe. Others linked to MCI Mail, one of the first commercial email services in the US, "which I had done a client for," Evslin says. "We had one little gateway that we hadn't put much work into, which was called an SMTP gateway, which connected SMTP mail, which was used on the internet. Which itself wasn't widely used." So, was Gates right? Only briefly. While Microsoft's corporate clients insisted communication over the internet was "not safe" and "not secure," Evslin says: "All of a sudden we got a huge number of requests for this SMTP gateway. And when I looked into it, I found that more and more email was going over the internet." The official corporate stance might have been one of "nope," but employees had other ideas. "Their engineers were communicating on the internet, and they never understood that, or didn't understand that at the time," Evslin says. And then there was what would become Outlook. "From the beginning, we wanted the client for Exchange to be able to support graphics, to be able to support fonts, so that you could format an email in the same way that you could format a Word document. "Where we didn't go far enough is we still had two separate formatting engines, so the Word and Outlook client never merged as I thought they should have." Soon after Gates chose to launch the products before adding deeper internet integration, AT&T invited Evslin "to come and develop their internet strategy." Back then, Evslin says, AT&T didn't really have a clear plan for the internet. The company had tinkered with proprietary networks, but Evslin reckoned AT&T should become an ISP. "AT&T always had illusions about being a content provider," he says. Evslin also favored all-you-can-eat pricing, which smaller providers had attempted but AT&T had yet to try. "There was a lot of debate internally, people saying 'you can't launch a new service in less than seven years.'" Considering how quickly things were moving – and still are – seven years was a lifetime. "I said, 'the solution to that is launch it fast and then adapt.'" WorldNet offered straightforward internet access to customers accustomed to portals, proprietary networks, and some heart-stopping telephone bills. Demand grew so quickly that AT&T had to control sign-ups lest the service earn the "America On Hold" nickname occasionally and unkindly applied to America Online. With the internet in the ascendant, Evslin became interested in another technology: voice over IP. This, he acknowledges, "was an impossible sale inside AT&T." And so, in 1997, Evslin moved on again to found ITXC, a wholesale VoIP carrier. ®

source https://www.theregister.com/offbeat/2026/08/02/meet-the-internet-radical-who-helped-microsoft-get-email-and-att-get-online/5281281

CallMeMaybe: runtime reflection library built on C++26 static reflection

I have a policy to effectively never link to YouTube videos. I’ll gladly make an exception for this one.

Reflection is one of the most powerful concepts in Computer Science. Unfortunately, not every programming language is blessed enough to have it.

In the 1980s, one company, Symbolics took the concept to the logical extreme. By representing EVERYTHING as objects; they created the most powerful (and inadvertently) least private operating system ever created!

The company collapsed, but the ideas live on. Some modern languages got a full dose of reflection. Some…weren’t so lucky. I ranked them all, and in the end I’ll show you how I dragged C++ up a tier with my brand new runtime reflection library, CallMeMaybe!
↫ Laurie Wired

The GitHub description of CallMeMaybe:

CallMeMaybe (CMM) is a C++ runtime reflection library built on top of P2996 static reflection introduced in C++26. CMM purposefully mirrors many of the std::meta functions to provide a uniform interface, but allows runtime introspection, dynamic invocation, and instantiation by building a runtime reflection registry. Class members can be automatically traversed and reflected by simply adding [[=cmm::reflectable]] as an annotation. CMM implements a custom type system to completely avoid RTTI requirements.
↫ CallMeMaybe GitHub page

My YouTube linking policy will remain in place.

source https://www.osnews.com/story/145661/callmemaybe-runtime-reflection-library-built-on-c26-static-reflection/

Amgen says cloud data breach exposed patient health, proprietary info

Pharmaceutical company Amgen says it suffered a data breach after threat actors stole corporate data and patient information stored in multiple cloud systems operated by third-party service providers. [...]

source https://www.bleepingcomputer.com/news/security/amgen-says-cloud-data-breach-exposed-patient-health-proprietary-info/

Online ad firm Adform’s script compromised to steal cryptocurrency

Online advertising firm Adform suffered a supply-chain attack that delivered cryptocurrency-stealing scripts to websites using its ad platform, replacing wallet addresses copied to visitors' clipboards with ones controlled by an attacker. [...]

source https://www.bleepingcomputer.com/news/security/online-ad-firm-adforms-script-compromised-to-steal-cryptocurrency/

OpenAI says its new GPT 5.6 models are becoming more cost-efficient

OpenAI says it has reduced the price of two GPT-5.6 models, cutting Luna's API price by 80% and Terra's by 20% as it works to make its models more efficient. [...]

source https://www.bleepingcomputer.com/news/artificial-intelligence/openai-says-its-new-gpt-56-models-are-becoming-more-cost-efficient/

GPUs could explode to multiple TB with new storage-inspired memory tech

Virtually every high-end GPU and AI accelerator relies on high bandwidth memory (HBM), which can shuffle data around at multiple terabytes a second but can only reach into the gigabytes, with models often needing to be shared across multiple processors. However, an emerging storage technology could change that, boosting accelerator memory capacity from hundreds of gigabytes to terabytes. The technology, called high-bandwidth flash (HBF), is being developed by Sandisk and SK Hynix and aims to provide SSD-like capacities at HBM-like speeds. Peeling back HBF’s layers Conceptually, high-bandwidth flash looks and sounds a lot like HBM. It’s assembled by stacking multiple layers (16 in the case of Sandisk’s first-gen modules) of memory together, which boosts capacity and bandwidth. But where HBM uses DRAM, HBF aims to use NAND flash. Sandisk claims its first generation of high-bandwidth flash will supposedly achieve read bandwidths up to 1.6 TB/s [PDF], making it a bit faster than HBM3e but significantly slower than HBM4, which is already hitting 2.5 TB/s per 12-high stack. Future HBF generations are expected to push bandwidth to over 2 TB/s and eventually 3.2 TB/s. While bandwidth makes HBF interesting as an alternative to HBM, its real party trick is capacity. Because it’s built using NAND, Sandisk says it can achieve capacities up to 256 Gb per die, which translates to 512 GB per 16-high module. That’s more than 14 times the capacity of the HBM4 used in AMD and Nvidia’s latest accelerators. Continuing with the similarities, HBF modules share similar packaging requirements to HBM, which means you can expect them to be fused to the GPU die using advanced packaging techniques like TSMC’s CoWoS, or Intel’s EMIB and Foveros tech. Nothing particularly exotic as AI accelerators go. What’s more, the storage vendor doesn’t expect the modules to come at a power or price premium over HBM. And from a bits per dollar standpoint, HBF looks like a stellar option. If all this sounds a bit too good to be true, that’s because for all of HBF’s benefits, it comes with some rather significant compromises. NAND still isn’t DRAM The main trade off, as we understand it, is write endurance and access latency. HBF may perform like HBM on paper, but it’s still using NAND, which has a finite write endurance before it wears out and has access latencies measured in microseconds as opposed to tens of nanoseconds for DRAM. If you were to swap HBM for HBF, it (probably) wouldn’t perform very well and it’d wear out pretty quickly, rendering that $50,000-plus GPU of yours a paperweight — not ideal for a product that’s being asked to serve longer to suit hyperscalers' depreciation schedules. Instead, Sandisk and SK Hynix propose using HBF to supplement HBM to make inference more cost effective. HBM handles all the write intensive stuff while HBF takes care of the read heavy parts of the pipeline. While we talk about inference as one job, it's really a collection of many that can broadly be broken into two categories, one that’s compute intensive and another that’s bandwidth bound. The first of these phases, called prefill, involves tokenizing and embedding prompts, feeding them through the model in one big forward pass, generating the key value caches used to track state, and outputting the first token. The second, called decode, reads the entirety of the model's weights, or in the case of a mixture of experts (MoE) models, their active parameters, from memory over and over again for each token generated. Because of this, how quickly an AI system can churn out tokens is directly proportional to how fast its memory is. Prefill is comparatively write heavy, so it makes sense to do as much of that in HBM as possible. But the decode phase is almost entirely read, which makes HBF an ideal medium for storing model weights as write endurance really isn’t a factor. It becomes a sort of write-once, read-many scenario, which is perfect for NAND flash since reads are essentially free. You could almost think about HBF a bit like a rewritable ROM cartridge for models. And because HBF is non-volatile, it becomes a bit like Intel’s Optane persistent memory. There is no need to wait for weights to reload from storage into GPU memory; they’re already there and ready to go. Sandisk’s slides propose a couple of different options including one that would feature 3.12 TB of memory across two stacks of HBM and six stacks of HBF. Oh the things you can do with all that memory That much memory has implications for model and inference architectures. Most frontier models at this point employ a mixture-of-experts (MoE) architecture, which means the model is really a collection of routed sub-models called experts, a small selection of which are used to generate each token. This has allowed model devs to build models larger than would otherwise be practical to serve due to memory bandwidth constraints. Because HBM’s capacity is so limited, these experts usually have to be spread across multiple GPUs connected by extremely high-speed interconnects. But with high-bandwidth flash, even multi-trillion-parameter models, like Kimi K3, could be packed into a single accelerator, mitigating any of the performance bottlenecks induced by the chip-to-chip interconnects. On the flip side, HBF could allow a 72-GPU rack to run some truly massive models measuring hundreds of trillions of parameters. Training such a model presents its own unique set of challenges, and the number of active experts/parameters would be limited by HBF’s bandwidth, but it could work. So when? So when can we expect to see HBF deployed in datacenters? If Sandisk is to be believed, the first samples should go out later this year with the first AI inference devices based on HBF available early next year. But for a variety of reasons previously highlighted by our sibling site Blocks and Files, we’re not holding our breath. One of the biggest factors is standardization. Memory is a commodity business and blazing your own trail with a proprietary technology rarely pans out — just look at Optane if you need evidence of that. Sandisk and SK Hynix officially kicked off this process earlier this year under the auspices of the Open Compute Project. “The key to AI infrastructure is to go beyond the performance competition of individual technologies and to optimize the entire ecosystem,” Ahn Hyun, president and chief development officer at SK Hynix, said at the time. There are also manufacturing considerations to be made. HBF is going to require a lot more dies per module than your typical flash storage device. What’s more, from what we understand, the specific kind of NAND used to make these modules is different from the kind used to make SSDs and other flash storage. Those modules will need to be copackaged with accelerators, which means SK Hynix and Sandisk will need to get buy-in from GPU and ASIC makers, which is going to take time. In fact, it wouldn’t be surprising for these modules to be ready years before the first chips designed to take advantage of them enter production.®

source https://www.theregister.com/storage/2026/07/30/gpus-could-explode-to-multiple-tb-with-new-storage-inspired-memory-tech/5281363

Open source project fools AI scrapers with poisoned font

If you don't want AI scrapers training themselves on your website, there's a new way to stop them that doesn't involve server-side blocking or praying they respect your instructions in robots.txt. A team of creatives have teamed up with a typography company to create a new type of font that’ll trick LLM scrapers into ingesting poisoned gibberish. Dubbed ShieldFont, the open-source project almost seems like magic if you're not familiar with the ins and outs of computer fonts. Look at a web page written using a ShieldFont font and it’ll appear exactly as one would expect: All the content words (the nouns, verbs, adjectives and adverbs that give a sentence meaning) are the same as the writer originally wrote. Inspect the raw HTML that a scraper reads from a ShieldFonted page, however, and you’ll see a sentence that’s essentially gibberish. Typing “good luck reading this, you useless robot” in the online demo version, for example, turns it into “good comfort reading this, you yellow barrier.” The goal, as outlined in the ShieldFont white paper, is not to get a scraping bot to reject the text as garbage, but to convince it that the text on the page is unusual but sensible. A noun will never be swapped for a verb, for example, and a verb will never be swapped for an adjective: Swaps only come from the same grammatical pool. It goes even more distinct than that, The ShieldFont creators noted. “Not just noun for noun: plural abstract noun about communication for plural abstract noun about communication,” the white paper explains. “There are about 250 such pools, built by crossing part of speech with sense category, concreteness, singular or plural, verb transitivity, verb inflection and adjective degree.” Around a quarter of words in a chunk of text end up replaced, the creators noted, with the hope the copy still gets ingested. Even if it doesn't, and the group notes scrapers do sometimes reject it, that still means your writing doesn’t get sucked up to train an AI – a win either way. How does this black magic work? This all seems a bit mystical unless you’re versed in the functions of fonts – specifically fonts in the OpenFont family, which ShieldFont is designed to work with. First off, you may be familiar with typographic ligatures, which combine two letters into a single character for the sake of making text look a bit neater, or conveying meaning in some languages but not others. Æ is one classic example in Latin script used in some languages but not others; there's also ﬁ, which combines a lower case F and I in a way that prevents the top curve of the F from bumping into the I’s dot. OpenType fonts all come with ligature tables that define how single glyphs or glyph sequences get substituted automatically by a word processor in a process known as glyph substitution, or GSUB. Even Google Docs supports user-configurable GSUB to an extent - you can fairly easily configure a substitution to automatically fill in for frequently used special words or characters. ShieldFont works on largely the same premise, but extends GSUB to entire words instead of letters or character pairs. So for example, a word like "daughter" in raw HTML might be rendered as "journalist" when it actually shows up to human viewers on the page. Here's what a paragraph written in the ShieldFont looks like as viewed on a web page (above), as opposed to what the raw HTML actually says (below): Even with that extended GSUB format, the font files are still quite small. We spoke with Amsterdam design studio Seneda & Abrucio, founded by Isaque Seneda and Gabriel Abrucio, the team behind ShieldFont, and they told us that the document/desktop fonts that are ShieldFonted are only around 5 MB, while compressed web fonts that include the entire GSUB dictionary still only come in at around 800 KB - large for your average font, S&A explained, but still considerably smaller than the desktop version. There’s more than one GSUB dictionary too - ShieldFont is shipping with three of them, and the GitHub repository explains how users can create their own to prevent reverse-engineering. But why poison a few words instead of just scrambling text altogether? S&A told us that they want a deterrent to scraping by introducing uncertainty and chaos into training data, not just a way to get scrapers to ignore some pages. “Pure scrambling fonts already existed,” the pair explained. “We wanted a mechanism with actual consequences: scrape without asking, and you can't tell if what you took was real. Concealment alone just gets you dropped and forgotten.” The default font that ships with ShieldFont is a modified version of Optik from Copenhagen typography shop Playtype, who partnered with S&A on the project. Like other scraping deterrents, it's not perfect Speaking of reverse-engineering, ShieldFont isn’t perfect by a long shot. As the team notes in their white paper, it can be defeated with relative ease. A screenshot of a page that’s run through OCR avoids the poisoned HTML, as does any other method that a scraper might use to scrape user-viewed pages instead of raw code. Targeted AI that downloads its own copy of ShieldFont and runs through all three GSUB dictionaries can also decode a page. SheildFont could also impose an SEO penalty on people who use it, as search engines, like AI scrapers, read the raw HTML to look for content, as do translation apps and the copy/paste function built into computer operating systems. Screen readers used for those with visual impairment also have trouble with it too, though there is a feature built in to ensure screen readers can get the user-displayed text, albeit slowly. “[ShieldFont’s] purpose is not to stop a determined actor, but to slow unauthorized mass scraping by adding cost, friction and uncertainty,” S&A said in a press release. “Scrapers cannot know in advance whether a site uses ShieldFont or which mapping it uses.” As for whether ShieldFont is just an experiment or something S&A hope gets widely adopted, the pair told us it’s a bit of both. “ShieldFont is real and working today, but it's v0/alpha, so still improving,” S&A explained. “Longer term, it's a bet on collective pressure,” the ShieldFont designers added. “Nothing currently makes bypassing a publisher's requests costly. If enough sites make scraping expensive, scrapers have to change how they operate. That's the point where negotiation becomes possible.” ShieldFont is now available to try. The online demo encoder can be used to generate protected HTML for embedding in a website, and it’s also available as a React component and for CSS and CDN integration, all of which is explained on the project’s GitHub page and the ShieldFont website. ®

source https://www.theregister.com/ai-and-ml/2026/07/30/open-source-project-fools-ai-scrapers-with-poisoned-font/5281303

Friday, 14 August 2026

Thursday, 13 August 2026

Wednesday, 12 August 2026

Tuesday, 11 August 2026

Monday, 10 August 2026

Sunday, 9 August 2026

Saturday, 8 August 2026

Friday, 7 August 2026

Thursday, 6 August 2026

Wednesday, 5 August 2026

Tuesday, 4 August 2026

Monday, 3 August 2026

Sunday, 2 August 2026

Saturday, 1 August 2026

Friday, 31 July 2026

About

Privacy Policy

ShortNewsWeb

Blog Archive

Categories

Recent Comments

Popular Posts

Translate

My Blog List

Popular

System Admin Share

Total Pageviews