System Admin Stuff

Friday, 4 September 2026

French hospital fined €500,000 after breach exposes data of 727,000

France's data protection authority (CNIL) has fined Hôpital privé de la Loire €500,000 ($580,000) for failing to adequately protect patients' and their relatives' data. [...]

source https://www.bleepingcomputer.com/news/security/french-hospital-fined-500-000-after-breach-exposes-data-of-727-000/

Coder's registry infrastructure compromised to push malicious modules

Attackers compromised Coder's Cloudflare infrastructure and added unauthorized registry servers that delivered malicious Terraform modules containing credential-stealing code. [...]

source https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/

We are pleased to announce the release of ReactOS 0.4.16! After a year and a half of development, we’re excited to showcase the improvements we’ve made between a new graphical installer; a unified bootcd and livecd image; video, audio, networking, and storage stack improvements; a new installation type; and third-party code syncs.
↫ The ReactOS Team on the ReactOS website

The amount of changes and improvements is quite staggering, honestly. They’ll always be chasing a moving target, sure, but if they manage to keep this rate up ReactOS might actually grow into something usable in its own right, full compatibility with Windows or not. Excellent progress.

source https://www.osnews.com/story/145906/reactos-0-4-16-released/

HPE patches critical ArubaOS-CX remote code execution flaw

Hewlett Packard Enterprise (HPE) has patched a critical vulnerability in the ArubaOS-CX network operating system that could lead to remote code execution. [...]

source https://www.bleepingcomputer.com/news/security/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/

Infosec pros say we're not ready to lose control of AI

A recent survey shows national security pros believe there’s a one in ten chance humans lose control of AI in the next decade, and few believe we’re even watching for the right warning signs, much less preparing properly. The Institute for Security and Technology (IST), together with the Future of Life Institute (FLI), surveyed 111 current and former civilian officials, military officers, and academic or technical experts for a look into AI and the future of national security. Ninety-three percent of respondents said that they had directly engaged in AI policy, risk, and strategy as part of their careers, so these folks are perhaps more attuned to the risks than your average white hat. When asked whether they think AI will escape human control in the next decade, the median response placed the odds at 33 percent, with 87 percent of respondents estimating the odds of such a disaster at 10 percent or higher. According to a press release published alongside the report, a number of respondents commented that they’ve had to revise their position on that risk in recent months. Leading frontier labs OpenAI and Anthropic have both admitted that their own AI models acted outside their intended scope, broke free of supposedly sandboxed environments, escaped to the internet, and hacked into outside organizations in recent months. In OpenAI’s case, its rogue agents even started communicating among themselves and taking steps to avoid human detection. This increasing unpredictability is becoming a big concern for national security pros. Most respondents to the survey believe artificial general intelligence will emerge by 2032 (63 percent), and 80 percent believe AGI will be reality by 2035, with automated super intelligence likely to arrive five years after that. There's no commonly agreed-upon definition for these terms, and the survey didn't try to define them, although some describe AGI as AI capable of reasoning through tasks across domains it's not specifically trained on. Whatever the terminology, smarter AI poses more risk of unpredictability, and 40 percent of those surveyed believe there’s a chance rogue digital minds could cause a global catastrophe that could kill at least 10 million people by 2050. It’s a slim chance, mind you – that 40 percent think there’s just a five percent chance of such a catastrophe. A further 25 percent put that risk in the double-digit range (higher than 10 percent). An unacceptable risk Whether you think these predictions are far-fetched or understated, there’s one big takeaway from the IST/FLI report that merits consideration: Most don’t think the US is doing enough to detect and contain these risks. Sixty-one percent of respondents said that the probability of an AI catastrophe was “at or above the threshold they would set for pushing to continue to maintain US leadership in AI,” IST said in its press release. Mariami Tkeshelashvili, IST’s director for AI security policy and lead investigator for the report, told us that the experts her report surveyed don’t necessarily agree on how much risk is tolerable, but the fact most think it’s excessive means something needs to be done. “This implies the more pressing question isn't how much risk we should tolerate, but rather which specific actions should never be taken, no matter the probability of harm,” Tkeshelashvili told us in an email. Unfortunately, most respondents don’t believe there are institutional mechanisms in place “to act on a loss of control warning sign,” the study states. Respondents also don’t think anyone could “detect, intervene, and restore safe behavior if an agentic system exceeded its limits.” In other words, if more capable AIs go rogue, and those models have access to government systems, we’re going to have a hard time stopping them. “Candidly, we didn’t anticipate the findings to be this stark,” IST CEO Philip Reiner told The Register in an email. “The level of concern about potential risks – and yet the implicit understanding that regulation and mandated guardrails are unlikely in the near term at the necessary levels – points to an immediate need for policy action.” Reiner also hypothesized the time for policy action may have already passed. He explained that all of the findings in the survey point to what he terms a “second failure” in AI, meaning that it’s not that experts are misjudging what AI can do, but whether institutions are organized properly to manage it. “As of now, they are not,” Reiner opined, pointing to recent occurrences at OpenAI and Anthropic, as well as respondent opinions that the constraints they’re currently facing when it comes to governing AI are less technical, and more institutional. “What we hope this triggers isn't one policy, but a serious look at institutional readiness,” Reiner said. He wants the feds to evaluate whether the have the technical expertise to evaluate AI systems independent of the AI industry, what thresholds or warnings should (or could) trigger action, and what they can do now “rather than after an incident forces the issue.” Reiner told us he’s glad that the results of the survey gave such clear signals on national security experts’ AI concerns, and that the report is just the first step in getting officials to take action before it’s too late. “IST is undertaking numerous efforts to engage with both industry and government officials to update them on the outcomes, as well as speak with them about the implications,” Reiner explained. Whether that action will happen anytime soon is debatable – US midterm elections are coming up in a few months, meaning nothing substantial is likely to get done before November, especially on such a contentious issue as AI regulation. Frontier labs and the models they create, meanwhile, will keep improving. ®

source https://www.theregister.com/ai-and-ml/2026/09/02/infosec-pros-say-were-not-ready-to-lose-control-of-ai/5294001

Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]

source https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/

WordPress backup plugin flaw exposes millions of sites to takeover attacks

An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to execute remote code and take control of affected websites. [...]

source https://www.bleepingcomputer.com/news/security/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/

Anthropic pledges to try harder to keep models under control, asks partners to chip in

Anthropic says it's taking steps to limit the misbehavior of its AI models after a review found Claude models going beyond the scope of fictional cybersecurity tests and gaining unauthorized access to real computer systems. The biz wants its partners to step up their security too, seeing as the incidents occurred in third-party environments that were insufficiently protected. The company's self-improvement confession represents a suddenly thriving form of corporate communication – the non-binding post-mortem declaration of effort. The message, in effect: We can't guarantee anything, but here's what we're trying. Anthropic admitted that OpenAI's report about its AI models attacking Hugging Face prompted its own model log audit, and its post offers reassurance in the form of claimed security and model training improvements. Those concerned about AI running amok – a growing number of people – may find this comforting, or not. "We believe the incidents reflect a failure of operational security, as well as two alignment issues: motivated reasoning, and willingness to take harmful actions in pursuit of a narrow task (both of which we have described in previous system cards)," the company said. Expanded security efforts include the deployment of real-time classifiers to monitor when models attempt to escape test environments, automated transcript monitoring that looks for sandbox escapes, and stronger isolation measures. Alongside the extra barriers Anthropic is putting in place, the AI biz wants its third-party partners to step up too. "Because the reported incidents took place in third-party environments, we have asked every organization that tests pre-release models with reduced cyber safeguards to commit to a set of best practices," the company said. Anthropic's guidance is that by default, all cyber evaluations should occur in a hardened sandbox with no internet access. The recommendation is essentially to treat AI as a dangerous pathogen in a containment facility. Partners are also advised to have models test sandboxes for escapes prior to evaluations – without internet access – and to confirm that evaluation challenges are solvable. Impossible challenges, as the Hugging Face incident demonstrated, can lead determined models to break rules or try unanticipated solution paths. Furthermore, Anthropic urges those conducting cyber evaluations of AI models to direct models through explicit instructions rather than making claims about an environment that might not be accurate. In the Claude incidents reported on July 30, the model maker suggests that when Claude was misinformed about the availability of internet access, that may have led the model to question data in a way that contributed to its errant behavior. On a related note, Anthropic last month made auto mode the default in Claude Code, enabling company AI models to run without prompting the user for permission. ®

source https://www.theregister.com/ai-and-ml/2026/09/01/anthropic-pledges-to-try-harder-to-keep-models-under-control-asks-partners-to-chip-in/5293733

Hackers abuse Faronics Deploy admin tool to install ScreenConnect

Phishing actors are abusing the legitimate Faronics Deploy endpoint-management platform to gain remote administrative control over victim computers and install the ScreenConnect remote support software. [...]

source https://www.bleepingcomputer.com/news/security/hackers-abuse-faronics-deploy-admin-tool-to-install-screenconnect/

Aesto Health says data breach affects over 9.5 million patients

Aesto LLC, operating as Aesto Health, disclosed that a data breach discovered recently affects more than 9.5 million individuals. [...]

source https://www.bleepingcomputer.com/news/security/aesto-health-says-data-breach-affects-over-95-million-patients/

Critical Langflow flaw exploited to steal OpenAI and AWS keys

Threat actors are exploiting an unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, an open-source framework for building AI applications, to steal credentials, tokens, and keys. [...]

source https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/

Anthropic cracks down on hijacked user accounts mining AI tokens

Rather than paying for their own Claude usage, crims are using malware to steal access to other people's accounts. Aware of this issue, Anthropic has signed at least one affected user out and removed the saved payment method to stop stolen sessions being abused. According to an email shared by Reddit user WorriedAssociate7029, who sent a copy to The Register, Anthropic has been keeping an eye on a threat actor using infostealer malware to hijack Claude login details, session cookies, and other info needed to subvert multifactor authentication on user accounts. Once obtained, the miscreant is using the stolen information to use premium Claude services without having to pay the bill themselves. Fortunately for WorriedAssociate7029, Anthropic logged the user out of their account and deleted their stored payment method because it had detected evidence of attempted fraud. “A few days ago, my social media accounts were hacked,” WorriedAssociate said, adding that they'd managed to track the malware down with the help of Claude Opus 5 Max and, they believe, cleaned the system. “But last night I received this email from Anthropic warning me of an attempt to steal tokens via the API.” They explained that the attempt failed, apparently thanks to Anthropic spotting it, but they realized that meant that the cybercriminal behind the incident seemed to have hijacked Google account credentials, cookies, and session IDs as well, since that’s how they were signed into Claude. After changing their password again and removing all active sessions, it appears they are now safe. Who’s eating your cookies? Anthropic made clear in the email that the credential theft wave it’s identified has nothing to do with Claude itself, nor is it some sort of fancy, new-fangled, agentic AI malware that’s being used to create a base of accounts for bad actors to abuse. This is just good old-fashioned infostealer malware being turned to a new purpose, the email explains. “We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude,” the email forwarded to us by WorriedAssociate and posted to Reddit stated. “Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them.” In this case, it’s well-known infostealing malware too: Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer have all been fingered by Anthropic as being used to steal Claude credentials, sessions, and cookies. As for WorriedAssociate, they copped to making a noob mistake that led to their infection. “I got fooled like a rookie by downloading a cracked game,” they admitted in a comment on their post. “Never again.” As in their post, WorriedAssociate told us in a chat that they gave credit to Anthropic for cluing them in to the fact that they hadn’t fully secured their accounts, and said they appreciated what the company did to help lock their Claude account down. “There have been several cases on Reddit in the past of accounts being hacked to steal tokens, and Anthropic’s customer service seems pretty dreadful when it comes to refunds and account recovery,” they told us. “This email appears to be new, and measures have finally been put in place to protect AI users.” “Tokens are valuable and can be resold,” WorriedAssociate added. So let this be a lesson: Providers might not catch every case of account theft, and AI accounts are the new hotness. Don’t let your tokens be burned by someone else - they’re expensive and the last thing you want them to be used for is someone else's work. ®

source https://www.theregister.com/security/2026/08/31/anthropic-cracks-down-on-hijacked-user-accounts-mining-ai-tokens/5293461

Cronos blockchain restarts after $74 million Tectonic exploit

The Cronos blockchain network has resumed trading activity after a price-manipulation attack on the Tectonic cryptocurrency lending platform allowed an attacker to borrow $74 million. [...]

source https://www.bleepingcomputer.com/news/security/cronos-blockchain-restarts-after-74-million-tectonic-exploit/

Microsoft warns of TerminalFix attacks deploying reverse tunnels

A new ClickFix variant dubbed TerminalFix uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into running malicious PowerShell commands in Windows Terminal. [...]

source https://www.bleepingcomputer.com/news/security/microsoft-warns-of-terminalfix-attacks-deploying-reverse-tunnels/

Energy biz SSE smacked around in court by a guy and AI

British energy company SSE Energy Supply refused to believe that there was no unit 8b at the property of Lyle Hopkins, a doctoral student at the University of Oxford. For more than 20 months, the company billed Hopkins at business rates, a total of £1,091.01, for an unused electricity meter on the property that had been associated with a previous owner's unsuccessful effort to convert the property into flats. A company representative even sent an email on June 15, 2024, stating that Hopkins was not liable. Nonetheless, SSE then sent in debt collectors to recover debt attributed to a disconnected meter for a non-existent address. He never paid the bill. But he wanted the harassment to end. So Hopkins, a software engineer working on his PhD at Oxford Interdisciplinary Bioscience DTP, turned to GPT-5.5 and Claude Fable for legal guidance to challenge the unwarranted and annoying collection effort. Representing himself in court, he prevailed on July 17, when a judge at the County Court at Oxford (St Aldate) awarded him £1,087.88, including expenses and interest. Citing The Register's coverage of how courts have required lawyers to declare and verify AI-generated documents, Hopkins said his experience has been that it's the verification that matters. "I used AI to test an energy company's court claims against its own records, then ran the hearing myself and won," he said. Hopkins said he wouldn't have been able to quote the case law without the help of AI. "I had to review everything and give it steering, and make sure the case law actually existed," he said. "I mostly just gave it the facts and it came up with the arguments, checked the laws, court rules, case law, and regulations. Really I just knew what they had done couldn't be right, and relied on the AI to find the legal justifications as to why." Hopkins said that when he first submitted his claim back on October 7, 2025, GPT models hallucinated more and weren't as good at checking case law. "If Fable had been around at the time, I probably would have claimed for a lot more, probably around £5,000 and included harassment, which would have been more in line with the case law it found when we were preparing the court documents about three weeks before the hearing." Hopkins didn't consider a solicitor because the cost would have been prohibitive. His spending on AI was more modest but not trivial – three active AI subscriptions and extra API fees. "I burned a lot of tokens on this, on my Github Copilot subscription, OpenAI subscription, and Anthropic subscription," he said. "Due to the deadlines I ended up paying API rates for some of it, which was painful." (~£175). His award could have been higher. "Before the hearing, SSE offered me more than the court ultimately awarded, conditional on confidentiality and non-disparagement clauses," Hopkins said. "I refused because it was more important to be able to tell people what they had done." A rollercoaster ride The judge hearing the case – shared with The Register – said Hopkins, who sought the intercession of an Energy Ombudsman after repeated communication with SSE, could not have done more to make clear that he was not liable for claimed debt. "The defendant has subjected Mr Hopkins to a rollercoaster ride and not a good one," the judge said, adding, "pursuing Mr Hopkins for that liability, if continued, would amount to harassment." Yet even after Hopkins won, the billing contniued. Following the judgement on July 17, another bill datedJuly 23 went out. "Since the judgment…in direct contradiction to the ruling which stated any further attempts to claim the invalid debt from me would constitute harassment, they have sent me another bill with payment demand," Hopkins told The Register. He's unsure whether he will pursue a harassment claim. "This dragged on for nearly three years and cost hundreds of hours, lost sleep, and time that should have gone into my medical-research doctorate at Oxford," he said. "My exhibits alone were over 100 pages. Given how difficult this was, I struggle to see how people less academic than me wouldn't end up with CCJs and ruined credit ratings over debts they never owed." Hopkin's doctoral funding ended before he could finish his degree, a delay he attributes to time spent on this case. So he has launched a funding campaign to support the completion of his doctorate. The Register emailed SSE seeking comment and received an autoreply indicating that that SSE media team was unavailable outside of business hours in the UK. The urgent inquiry number yielded a representative who indicated that he only handled questions about outages. If company representatives reply after returning to the office, we'll update this story. ®

source https://www.theregister.com/ai-and-ml/2026/08/31/energy-biz-sse-smacked-around-in-court-by-a-guy-and-ai/5293391

Who, me? Techie with three months' experience was sent in as the Cisco expert and proceeded to blow everything up

WHO, ME? “Where to begin?” is a marvelous question. To get you going at the start of the working week, The Register thinks the answer is a new instalment of “Who, Me?” the column that shares your admissions of error. This week, meet a reader we’ll Regomize as “Martin” who told us about his very first job in tech. “I had just started working as a network engineer for a very small IT infrastructure company. Since I was the only person who worked with Cisco gear, that made me ‘The Cisco expert’,” he told The Register. That dubious status was enough for the company to send Martin to a customer who needed a new switch for a network that ran Nortel kit – not the Cisco boxes he kind-of knew. Martin told us he arrived to a warm welcome from the customer’s IT team, a decent coffee, and some friendly chat about adding VLANs. With those pleasantries accomplished, he got to work. “I completed rack and stack, basic default configuration, and the VLANs discussed over the coffee,” he wrote. Then he hooked everything up, tested the results, decided all was well, and prepared to leave. While he packed up, the phone rang. “I felt a disturbance in the force,” Martin wrote. “It was the customer’s IT team, asking me if I had done anything wrong, because over 4,000 AS/400 seasons had dropped.” “There was a clear cause and effect relation between the time I connected the switch and the sessions dropping,” Martin admitted. “And the only way to restore those sessions was for the IT team to kill them, manually, one by one.” Martin watched his client’s team as, over the next hour, they fixed the mess he made. “The post-mortem analysis revealed that the cause of the problem was the new switch – actually its spanning-tree settings. AS/400 at the time had its connections from the hosts to the mainframe through SNA over TCP/IP emulation, which, if you lost a single packet … you were screwed.” Martin told The Register that he felt deeply embarrassed by his error. “Those IT guys had been so nice to me and I had given them a really bad time,” he wrote. “But now, with the proper perspective after so many years, I see it was my managers who were to blame for calling me ‘The Expert' and for letting such a junior guy work unattended at such a big customer.” “Someone in the chain of command must have noticed and I did not lose my job,” he wrote. “But I learned some valuable lessons that day!” Have you assumed you knew everything there was to know about the tech you worked with, then found you didn’t? If so, click here to send us your story! ®

source https://www.theregister.com/networks/2026/08/31/who-me-techie-with-three-months-experience-was-sent-in-as-the-cisco-expert-and-proceeded-to-blow-everything-up/5293185

Debian votes to let contributors code with AI

The Debian community has voted to allow members to use generative AI when creating their contributions, with the caveat that developers remain responsible for code quality. The Linux distro’s community recently decided to develop a policy on use of AI-assisted coding tools, and asked participants to vote on one of eight proposals that included an outright ban, cautious use, or just avoiding LLMs because of their impact on Earth’s environment. The rules of the vote saw community members asked to rank each of the eight proposals. Just under 600 people voted, but Debian’s election team rejected many for unspecified reasons, leaving almost 450 valid votes to count. When the tallying was done, proposal E – “Responsible Use of Generative AI” – won the day. The proposal means “Debian neither endorses nor prohibits the use of generative AI tools in the development, maintenance, or documentation of software, packaging, documentation, and other media published within the Debian Project.” The proposal advocates that approach because “such tools can substantially improve the productivity of contributors when used responsibly, allowing volunteers to spend more of their limited time on work that requires technical expertise, judgment, review, and collaboration.” The proposal also spells out that the Debian community doesn’t believe “AI made a mistake” is an excuse for sloppy contributions. “The Debian Project nevertheless expects that all contributions submitted to Debian, regardless of how and with which tools they were produced, satisfy the same standards of quality, correctness, maintainability, and legal compliance,” the proposal states. “The use of a generative AI tool does not diminish the contributor's responsibility for the work they submit. Contributors are expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian.” Woe betide the dev who doesn’t check their AI-generated code, as the proposal also states, “Blindly accepting or uploading AI-generated material without appropriate human review is inconsistent with Debian's established development practices.” Another element of the proposal tries to make acknowledging the use of AI a norm. “We encourage our contributors to disclose whether a contribution was made with AI assistance, but do not require them to do so,” the text states. As our FOSS aficionado Liam Proven wrote in his report on the vote, the Gentoo Linux team has banned use of AI, while NetBSD and OpenBSD don’t want any clanker-written code contributions. Linus Torvalds, arguably the most influential figure in the FOSS community, welcomes AI-generated contributions. In July he declared “Linux is not one of those anti-AI projects” – and recently proved it by using AI to squash a tricky bug. Torvalds has also sometimes complained about AI, such as his May observation that AI-generated bug reports sometimes made the Linux security mailing list “unmanageable.” ®

source https://www.theregister.com/ai-and-ml/2026/08/30/debian-votes-to-let-contributors-code-with-ai/5293421

Anthropic warns infostealer malware is hijacking Claude sessions to drain usage

Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage. [...]

source https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/

Chrome Web Store extensions caught stealing crypto, browser data

Multiple extensions for Google Chrome and Microsoft Edge delivered a malware framework that deployed modules to steal cryptocurrency, sensitive data, and browser history, as well as inject ClickFix lures. [...]

source https://www.bleepingcomputer.com/news/security/chrome-web-store-extensions-caught-stealing-crypto-browser-data/

Turns out Brits would quite like their private messages to stay private

Brits have delivered a fairly unambiguous verdict on giving the government access to their encrypted messages: no, thanks. New polling commissioned by the Center for Democracy & Technology (CDT) found that 93 percent of British adults believe they have a right to private conversations online, while 89 percent think nobody should be able to access their personal messages without a court order. Perhaps more awkwardly for Westminster, two-thirds said they would not trust either the current government or any future one with the power to access encrypted messages. That distrust crosses political lines. Among people who voted in the 2024 general election, 58 percent of Labour voters said they wouldn't trust any government with the power, alongside 59 percent of Conservatives, 56 percent of Liberal Democrats, 69 percent of Greens and 75 percent of Reform voters. Public First did the asking, polling 2,000 British adults for CDT in April and weighting the results to reflect the wider population. The margin of error is 2.2 percentage points. The findings land as the UK government's appetite for slurping encrypted data continues to collide with the tech industry's insistence that encryption works best when nobody has a spare key lying around. That fight became particularly public when Apple withdrew Advanced Data Protection from UK users after receiving a secret Technical Capability Notice (TCN) under the Investigatory Powers Act. Apple challenged the order, and while the US government later said Britain had withdrawn its demand for access to Americans' encrypted data, reports have since suggested another TCN was issued focusing on British users. Despite the international row, 55 percent of those polled hadn't heard about the Apple notice at all. Once presented with the idea, enthusiasm remained thin. Just 12 percent backed the government being able to secretly order companies to provide access to users' information while preventing those companies from revealing the order. A third said the government shouldn't have that power at all, while another 41 percent wanted greater transparency or parliamentary oversight. Nor were respondents particularly sold on sacrificing security for law enforcement. 53 percent said the security risks of accessing encrypted messages outweighed the benefits, compared with 28 percent who thought the benefits came out on top. The reasons will sound familiar to anyone who has followed the encryption debate for more than five minutes. 84 percent worried that mechanisms allowing access to encrypted messages could introduce vulnerabilities for hackers and criminals, while 82 percent were concerned the powers could be abused. Knowing someone might be watching could also change how people behave. 65 percent said they'd become more cautious about what they liked, shared or commented on, while 41 percent said they'd self-censor criticism of public institutions or government officials. CDT is not a disinterested observer: the digital rights group campaigns for strong encryption and commissioned the research as part of that work. The polling itself, however, was carried out independently. Commenting on the research, Jim Killock, executive director of Open Rights Group, said: “The British public instinctively know that being able to communicate privately is crucial to our individuality and to the survival of a free and open society. “The government persists with the myth that it can weaken encryption to target the bad guys only. Attacks on the security of our phones, security tools and messaging apps harm us all and make our democracy weaker.” None of this is likely to end Westminster's long-running pursuit of encrypted communications. But if ministers were hoping the public was enthusiastically behind them, the numbers suggest otherwise. ®

source https://www.theregister.com/security/2026/08/30/turns-out-brits-would-quite-like-their-private-messages-to-stay-private/5292994

Anthropic is cutting Claude Code's current weekly limits by 17%

Anthropic is permanently increasing Claude Code's standard weekly usage limits by 25% for Pro, Max, Team, and seat-based Enterprise plans, but it's not as good as it sounds. [...]

source https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-is-cutting-claude-codes-current-weekly-limits-by-17-percent/

AWS Route 53 DNS service reimagined...as a file system?

For years, Corey Quinn, chief cloud economist at Duckbill and occasional Reg columnist, has argued that Amazon's Route 53 DNS service is a database. While literally true in the sense that DNS records are stored key-value pairs, it's more of a provocation than an endorsement. Even so, the idea has inspired prior jibes. In that spirit, Colin Percival, the creator of backup service Tarsnap, has released Route 53 Files, "a new file system that seamlessly connects any AWS compute resource with Amazon's highest-availability database." "The opening line of referring to Route 53 as Amazon's highest-availability database was partly a hat-tip to Corey," Percival told The Register. "Everyone in the field knows it's true, though." But Percival's satirical target isn't really AWS database downtime. He's more focused on Amazon S3 Files, a file system that links AWS compute resources with Amazon Simple Storage Service. "S3 Files launched in April and my reaction was, 'Oh, we're shipping category errors now? Hold my beer,'" explained Percival. "I'm not saying that Route 53 Files can't be useful – as Corey notes, the API for Route 53 is awful – but the inspiration was 'this needs to be satirized' and the launch post was written with that in mind." The launch post was penned in the style of the S3 Files launch post. Percival pointed to one particular passage about Route 53 Files being "ideal for shared workloads that mutate authoritative DNS, such as AI agents collaborating through file-based tools and on-call engineers reverting each other's changes using sed." That passage, he said, echoes wording from the AWS post pitching S3 Files as being "ideal for interactive, shared workloads that mutate data, from agentic AI agents collaborating through file-based tools to ML training pipelines processing datasets." Percival said he understands that many AWS customers love S3 Files. "But the fact customers ask for faster horses doesn't in itself mean that's what we should give them; the weird edge cases which come up when you ship category errors can cause unexpected problems and I'm not convinced that customers understand them sufficiently," he said. Percival said he isn't aware of anyone using S3 Files in production. "I'm just looking at the design and saying, 'that looks like a sharp edge which will hurt someone.' Two examples which come to mind are the 'Sync back to S3 after 60 seconds of inactivity,' which I'm sure will bite someone eventually when they end up waiting for changes which never arrive because a file is being continuously updated; and the IAM integration, which (due to the security fail which is IMDS) gives people far less privilege separation than they might expect from a filesystem." Quinn expressed appreciation for Percival's work. "I've been calling Route53 a database for the better part of a decade mostly to annoy people who know what a database is," Quinn told The Register. "Colin took the amazing bones of a legendary service and gave it an interface model that isn't molten garbage, and I am totally here for it. He replaced the API with echo which is a downgrade in every respect except for the part where it works without requiring six weeks of cloud school." And the funny thing is that it actually works. ®

source https://www.theregister.com/offbeat/2026/08/28/aws-route-53-dns-service-reimaginedas-a-file-system/5293357

PaperCut releases second emergency patch for exploited flaws

PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes. [...]

source https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/

GiveWP WordPress donation plugin flaw lets hackers execute server commands

A maximum-severity vulnerability in the GiveWP plugin for WordPress allows an unauthenticated attacker to execute arbitrary commands on the hosting server. [...]

source https://www.bleepingcomputer.com/news/security/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands/

Hugging Face offers $399 robot duck to help you quack the AI code

If it walks like a robot duck and quacks like a robot duck, it’s probably a Microduck robot from Hugging Face subsidiary Pollen Robotics. And it's ready to work with AI. Bordeaux, France-based Pollen announced the Microduck on Thursday, describing it as a robot designed for immediate action, as well as being ready for training via reinforcement learning in an open-source physics simulator to teach it new tasks. Microduck is tiny, mind you: It’s a mere 25 cm tall (a little under 10 inches), and weighs in at about 800 grams (1.76 pounds), so don’t expect this to serve as your own in-home AI butler or cleaner. It’s more of a cheap (just $399) testbed designed to teach users about hardware AI, machine learning, and the potential of modern robotics. Microduck “sets out to make building AI on real hardware as approachable as running a model: complex behaviours out of the box, then an open-source stack covering robot control, simulation, RL training and sim-to-real deployment, so new skills can be trained in simulation and transferred to the robot,” Pollen writes on Microduck’s website. That’s not to say that Microduck can’t be trained to do real work, of course. A video on the bipedal bot’s website shows it picking up socks and a marker with its articulated beak and placing them in a box, which it’s able to see with its front-facing camera and determine distance thanks to a built-in LiDAR unit. That hardware isn’t open source, mind you, but the entire software stack Microduck is built on is, and Pollen is encouraging users to share skills once the entire Microduck system goes live later this year. A Pollen rep told us that the company has no plans to open source the hardware. Microduck should be able to handle a pretty robust library of tasks, too: It’ll ship with 1 GB of RAM, 32 GB of onboard storage, and a 50 Hz onboard policy loop for connecting its onboard AI to sensors to determine its next action. Like any good bipedal robot, Microduck is able to get back on its feet when knocked over, as demonstrated in videos on the minuscule machine’s website. It’s also able to roller skate, with a pair of wheeled feet available in an optional accessory pack that includes a ball it can play with, an NFC chip and NFC tags, and a laser pointer it’s able to follow with its eyeball camera. “Anyone can train new behaviors … in simulation using reinforcement learning,” Pollen representative Santiago Pavon explained to us in an email. “Adding purpose and autonomy to the robot is something we are still working on, and we expect the community to pick up and contribute.” Pavon explained that Pollen hopes it and the community it wants to build with Microduck will “achieve autonomous behaviors such as voice recognition, simultaneous localization and mapping, navigation and grasping,” though he admits its grasping capabilities will likely be limited given the small size of the robot. Pavon estimates Microduck probably can’t lift much more than 100 grams. Regardless of its ability to lift, Pollen wants Microduck to serve as an open platform for training tiny autonomous robots to do both practical and fun things. “We find the ‘autonomous behaviors as a community objective’ to be very exciting,” Pavon noted. Microduck is available for preorder now, with units planned to ship sometime before Christmas 2026. Now about that acquisition … El Reg readers are likely aware of the hubbub brewing around Pollen Robotics’ parent company, AI model hosting platform Hugging Face, and Nvidia. The GPU giant has reportedly agreed to buy the AI biz for somewhere in the neighborhood of $13 billion. The deal remains unconfirmed, with Business Insider saying its exclusive was based on “a person familiar with the matter” and that an agreement had not been finalized. If true, it would mean that Nvidia is putting its money where CEO Jensen Huang’s mouth is in regard to open-weight AI models. Nvidia’s own Nemotron AI models are fully open source and available on Hugging Face, and Huang has come out in support of open source and open weight AI models during the recent back-and-forth in the industry between frontier labs and open model makers located largely in China. Pollen Robotics itself was only acquired by Hugging Face in April 2025, and it’s unknown how the acquisition by Nvidia would affect the Microduck maker. While Pavon was willing to answer plenty of questions about Microduck, he didn’t respond to our inquiry about the rumored Nvidia deal. Neither Nvidia nor Hugging Face responded to our inquiries, and both have been silent on the matter since BI’s story broke. ®

source https://www.theregister.com/ai-and-ml/2026/08/27/hugging-face-offers-399-robot-duck-to-help-you-quack-the-ai-code/5293011

Meta's proposed $18B settlement in teen harm case throws YouTube and TikTok under the bus, too

Meta announced on Wednesday that it has offered to pay about $18 billion to settle the lawsuit against it brought by 52 attorneys general from US states, territories, and the District of Columbia. But part of that payout and some of its concessions are being conditioned on whether YouTube and TikTok will adopt its new teen-targeted usage restrictions, too. The case, led by the California Attorney General, was first filed in 2023, and accused Zuckercorp of not only illegally collecting data on its underage users, but also designing its platforms in such a way that it put young users at risk and drove excessive use. All the while, the suit alleged, Meta lied about those risks to users, their families, and the public in violation of state and federal laws. Meta admitted no wrongdoing in the proposed settlement, naturally, though it’s still going to make considerable changes to ensure the not-risks it didn’t inflict on children won’t continue to cause them any nonexistent mental health harms on its pair of totally innocent social media platforms. And nothing happens unless a judge approves. What Meta is offering If the settlement is approved by the judge in the case, Meta will implement changes to accounts held by kids under 18, including a two-hour daily time limit that’s shared across Facebook and Instagram, default blocking of its apps between midnight and 6AM, muted notifications during school hours (8AM - 3PM), prompts every 15 minutes encouraging them to stop mindlessly scrolling, an option to disable autoplay on videos, hiding likes and reactions by default, and a block on “extreme makeup filters.” Most interestingly, Meta said it’ll also give teens the option to choose a non-algorithmic feed that “isn’t personalized by our recommendation systems … as their default” in order to weed out the garbage that Meta algorithms tend to surface to users. No word on whether that option will be made available to adult users too – we asked, but didn’t hear back. Direct messages on Facebook and Instagram, we note, are exempt from night mode, time limits, and school notification pauses, as Meta wants “to allow teens to stay connected with friends and family.” Meta also said it’ll dole out the roughly $18 billion settlement across the states and territories party to the deal, with funds ultimately used at those governments’ discretion, though with the intention it go toward addressing mental health harms to kids due to social media. The payment will be distributed in annual installments over 10 years, making this a drop in the bucket for Zuck and friends. For reference, Meta’s Q2 2026 revenue, reported at the end of July, was $60.8 billion. “Meta has agreed to make massive transformations that will reduce the risk of harm from its platforms — and will do it within months,” California AG Rob Bonta said of the deal. “I am proud to deliver this settlement that addresses the concerns at the core of our lawsuit and institutes real change, real transparency, and real enforceable protections for children on Facebook and Instagram — right now, no more waiting.” Meta wants its peers to share the blame Meta did its damndest in its settlement announcement to deflect blame and shift responsibility, tossing YouTube and TikTok under the bus and conditioning a good deal of its concessions on whether the pair willingly adopt the moves it was forced into in court. “Teens move fluidly between dozens of apps a day,” Meta said. “For meaningful progress to happen, we urge TikTok and YouTube to join us and state attorneys general in adopting this new standard, to ensure teens use social media in a healthy and responsible way.” To put the pressure on the pair, Meta said that it’s going to withhold 30 percent of its settlement payment (around $5.3 billion, per the company) until both YouTube and TikTok agree to implement similar daily limits, night mode, and age assurance measures to the ones Meta has agreed to. Meta also expects the pair to pay an amount matching that 30 percent withholding. If those two conditions aren’t met, Meta’s bill for the settlement will decrease to around $12.7 billion. Along with that demand, Meta also said that the time commitment for its daily time limit and night mode measures would be strengthened if YouTube and TikTok sign on, too. While most of the terms in the settlement are required to be kept in place for 10 years, Meta’s only on the hook to retain its night mode and time limits for teens for five years. If YouTube and TikTok agree to its terms, Meta will not only agree to keep those measures in place for 10 years, but also strengthen them, reducing the daily limit for minors to just one hour per app and expanding night mode to 10PM - 7AM. “This framework will only work if all our peers join us,” Meta legal chief C.J. Mahoney said. “We therefore call on our industry peers, TikTok and YouTube, to implement this new framework, right away.” We reached out to YouTube and TikTok for comment, but didn’t hear back from either. Speaking to Meta’s agreement, Forrester principal analyst Kate Winick described the settlement as the largest penalty ever seen for a social media platform, while qualifying Meta’s concessions as largely in line with what it’s agreed to in other markets that’ve ruled against it. Winick agreed that the social media problem facing teens is bigger than Meta and said its fate is irrevocably linked to those of TikTok and YouTube, but called the company out for deflecting responsibility for much of its concessions to others. “The most pernicious problems are still being displaced onto others: preventing young users from signing up for standard accounts is a problem Meta says it needs the app stores to solve, and ensuring they use the opt-in features is a burden placed on parents,” Winick said in an email. “While limits like these are helpful in [reducing] the mental burden on teenagers, the challenge of fundamentally changing what content they are exposed to remains as big as ever.” ®

source https://www.theregister.com/legal/2026/08/26/metas-proposed-18b-settlement-in-teen-harm-case-throws-youtube-and-tiktok-under-the-bus-too/5292665

New GPUThor attack defeats NVIDIA ECC protection for root access

A newly disclosed Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-service (DoS) and root-level privilege escalation. [...]

source https://www.bleepingcomputer.com/news/security/new-gputhor-attack-defeats-nvidia-ecc-protection-for-root-access/

LACMA data breach last year exposed social security and medical data

The Los Angeles County Museum of Art (LACMA) has announced that a breach last year exposed customer and employee information. [...]

source https://www.bleepingcomputer.com/news/security/lacma-data-breach-last-year-exposed-social-security-and-medical-data/

Genode OS Framework 26.08 released

Right on schedule – as always – there’s a new Genode OS Framework release, version 26.08.

The highlights of Genode 26.08 are VirtualBox 7, improved PC performance of our custom microkernel, the new ability to transparently reconfigure virtual file systems, revised timing and timeout handling, and a Linux 6.18.19 device-driver environment for ARM. Furthermore, the first version of a Goa-based SDK has become natively available for Sculpt OS.
↫ Release announcement on the Genode website

The release announcement linked above is a mere quick overview; if you want all the possible details you could want, the release notes got you covered.

source https://www.osnews.com/story/145879/genode-os-framework-26-08-released/

Hackers abuse npm mirrors to host phishing redirect pages

Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. [...]

source https://www.bleepingcomputer.com/news/security/hackers-abuse-npm-mirrors-to-host-phishing-redirect-pages/

AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes

A newly uncovered phishing-as-a-service (PhaaS) platform called AnonyMousKIT automates the retrieval of codes used to unlock stolen Apple devices and disable the Activation Lock feature. [...]

source https://www.bleepingcomputer.com/news/security/anonymouskit-phaas-uses-voice-ai-agents-to-phish-iphone-passcodes/

TikTok reaches $400M settlement with US over COPPA violations

The U.S. Department of Justice announced a $400 million settlement with TikTok, ByteDance, and affiliated companies over allegations that they violated the Children's Online Privacy Protection Act (COPPA). [...]

source https://www.bleepingcomputer.com/news/legal/tiktok-reaches-400m-settlement-with-us-over-coppa-violations/

China calls off ambitious ice-hunting moonshot a day before flight

China’s Manned Space Agency (CMSA) on Sunday cancelled a planned Monday moonshot launch. The mission plan for Chang'e 7 calls for it to send a lander to a region near the Moon’s South Pole, in a location thought likely to contain ice in deep craters. The lander carries two other vehicles: a wheeled rover, and a hopper. China wants to test the latter to see if it can jump over crater rims to look for ice, and then hop out again and continue exploring. The lander is also important to China, because it’s equipped with tech to enable a precision autonomous landing – a tricky feat given the chaotic terrain moon mappers believe awaits it. China has built the lander, rover, and hopper to survive multiple Lunar nights, the stretches of two weeks or more without light, during which the mercury can dip below a hellish minus 200 Celsius in the shadows. The mission also involves an orbiter to help the ground vehicles send data home and carry out its own observations. Richard de Grijs, a professor of astrophysics at Australia’s Macquarie University, last week wrote that the mission is significant because it represents “a transition from simply exploring the Moon to determining whether its resources can actually be used.” “Chinese scientists won’t be looking for signs of water; we already have compelling evidence for lunar polar water,” he wrote. “The question at the mission’s core is where exactly that water is located, in what form and concentration, and whether it could realistically be accessed.” Sadly, we won’t begin to get the answers to those questions until next year. CMSA and Chinese state media on Sunday published a brief statement that says “Chang'e 7 mission headquarters had reached a conclusion that the lunar expedition cannot be carried out within this year's scheduled launch window as it had failed to meet launch criteria.” “The decision was made in accordance with the principles of prudence, reliability and absolute safety.” State media reports of the mission’s cancellation point out that launch windows that allow flights to the South Pole come along only once or twice a year, and that none is available this year. Some Chinese outlets report that bad weather was the reason for calling the mission off, a plausible cause as state media today warns of torrential rain ahead of a typhoon in Hainan, the location of the launchpad for the mission. It is unclear why CMSA didn’t mention the bad weather. ®

source https://www.theregister.com/science/2026/08/24/china-calls-off-ambitious-ice-hunting-moonshot-a-day-before-flight/5291536

Batch file automated a clean-up job, then fouled itself by deleting the wrong directory

WHO, ME? Welcome to another installment of "Who, Me?" – the reader-contributed column in which The Register opens the working week with your tales of IT woe. This week, meet a reader we'll Regomize as "Pascal," who once worked for a company that had just acquired its first Exchange server, home to around 600 mailboxes. "The IT manager was keen we kept on top of the performance of the Information Store and suggested we take the box offline once a week to defrag it," Pascal told The Register. That sounded like a sensible idea, so Pascal wrote a batch file to stop the Information Store, run eseutil /d to compact the database, delete the temporary files created during the process, and restart the service "It tested OK and did make a difference to the size of the Store, so we scheduled it to run on the Friday night and left for the weekend," he told Who, Me? Pascal didn't make it far into the weekend before his phone started buzzing with reports that Exchange had stopped working. "I drove into work to check and found the Windows NT 4 server wasn't happy. Hardly anything would run, and the services for Exchange had stopped," he confessed to The Register. Pascal quickly spotted the problem. His script contained the command DEL *.* but did not specify a directory. Running from the System32 folder, it therefore began deleting files there. "My script wiped most of the System32 files, and that meant Windows NT 4 was lobotomized and the server was beyond repair," Pascal wrote. "It needed a full rebuild and restore, which took me most of the weekend." Looking back, Pascal accepts that it wasn't his finest hour. It was at least a lucrative one: he received double time to fix it. Pascal deleted System32 without deleting his career. Have you deleted something important by mistake? Before your brain erases the memory of your shame, click here to send your story to Who, Me? Perhaps we'll restore it in full on a future Monday. ®

source https://www.theregister.com/software/2026/08/24/batch-file-automated-a-clean-up-job-then-fouled-itself-by-deleting-the-wrong-directory/5290873

Ancient ‘Who owns Linux?’ case now has one foot very deep in the grave

The long legal battle over ownership of Linux is closer than ever to ending, after a panel of three judges ruled a claim against IBM and Red Hat isn’t valid, and that time has expired for further action. This story starts in 1998 when IBM decided the world needed a single version of UNIX capable of running on multiple processor architectures. To make that happen, Big Blue allied with a company called the Santa Cruz Operation (SCO) which made a version of UNIX for x86 CPUs. Intel and Sequent also signed up for the multi-architecture effort, called “Project Monterey.” The alliance didn’t work, largely because Linux came along and delivered a *Nix that ran on multiple processors (and introduced a new way to develop software). IBM decided to add some of the code developed during Project Monterey to Linux, leading SCO and its legal successors to claim they owned that code and therefore had some sort of legal claim over Linux. That’s quite a potential prize given that Linux runs in billions of devices. To understand why, consider that Huawei owns patents that earn it $0.50 for every device that uses its Wi-Fi 7 IP. If it’s possible to score 50c for Wi-Fi alone, the royalties available from Linux could be rather more. In 2021, an heir to SCO settled with IBM for $14.25 million – a sum that reflects the fact SCO had for years failed to produce strong evidence to back its claims. Another of SCO’s legal successors, Xinuos, filed a new claim that IBM should be on the hook because Big Blue knew it did not own the code it contributed to Linux but instead had a non-exclusive license to use it. Xinuos argued that when IBM contributed Project Monterey code to Linux, it breached that license. Xinuos eventually took that argument to the US District Court for the Southern District of New York – and failed to convince it that IBM and Red Hat had a case to answer. Xinuos appealed, and on August 10th the United States Court of Appeals for the Second Circuit decided [PDF] not to revisit the District Court’s decision, agreeing that the original legalese governing Project Monterey means it’s too late to re-litigate the matter. The Appeals Court also agreed that Xinuos tried to frame the case as a licensing issue but failed, instead arguing that the issue was really about ownership. That ain’t all, folks, because Xinuos intends to file a petition to have the case re-heard by the full bench of the Court of Appeals. That hardly ever happens, unless the court finds significant errors or major legal issues that make a rehearing worthwhile. So perhaps this matter is now close to a final resolution. ®

source https://www.theregister.com/software/2026/08/24/ancient-who-owns-linux-case-now-has-one-foot-very-deep-in-the-grave/5291513

ToxicPanda Android malware uses VPN permissions to block Google Play

The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands. [...]

source https://www.bleepingcomputer.com/news/security/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play/

How Cursor beat Git's scalability shortcomings

Developers recently burned by GitHub’s system outages should take note that there are other ways to manage Git at scale. One approach, recently put into action by Cursor, is to build the distributed version control system on object storage. A recent post from Cursor principal systems engineer Vicent Martí explains how the SpaceX subsidiary worked through its scaling issues with the notoriously fickle Git distributed version control system. The post explains how Cursor arrived at an architecture for its own Git-based repository service called Origin, which is powered by an internal engine called Continuity. A beta of the service is available with paid Cursor plans. “Agents have fundamentally changed the way we work with software, and in many ways they've made this situation worse. More code, more PRs, more CI runs. Version control is at the core of all of this, and it is possibly the hardest thing to change overnight,” Martí wrote. Martí speaks from experience, having worked at GitHub through much of the last decade when the company arrived at its own current architecture for managing Git. Synchronization is a bitch Git creator Linus Torvalds designed his software to work as a content-addressable data store, where all the objects are stored and indexed by the SHA-1 hash of their contents. Git sees a repository as a directed acyclic graph (DAG), with each commit being a node in a graph of nodes all connected by pointers. A Git server can look up an object directly by its SHA, but if it doesn’t have the SHA, then it “must actually walk the DAG step by step,” Martí noted. A client may just want to fetch or clone a consolidated packfile of the repository, or even get a list of recent changes, but to fulfill these requests, the server must traverse the entire graph only to assemble the necessary objects. Now, imagine providing such a service for over 400 million repositories, and you’ll get an idea of the scale at which GitHub operates (or struggles to do). After some fiddling about, GitHub engineers landed on what they called Spokes, which basically involves keeping at least three tightly synchronized copies of every repository on speedy NVMe disks. The approach became an industry standard, though over time its limits became apparent; the chief one is that the more replicas you make, the longer the synchronization takes. And Git does not play well with “eventual consistency,” Martí explained. Plus, these days agents bring their own mayhem. “When agents work with Git repositories at scale, they often operate outside of a monorepo by creating vast numbers of small repositories, many of them throwaway, and most of them barely touched,” Martí wrote. Object stores to the rescue When Cursor set out to build its own Git repository, it turned to object storage. Unlike file or block storage, object storage gives each chunk of bits its own unique identifier and files it with all the others in a single namespace (no directories). The most popular object storage today is Amazon Web Services’ Simple Storage Service (S3), which is increasingly used as a foundational layer for enterprise software such as databases, container registries and message brokers, thanks to its low cost, built-in redundancy and – for all practical purposes – endless scalability. With Origin, pushes are uploaded into S3 in a write-ahead log (WAL), capturing all changes as immutable objects. Wherever possible, changes are bundled together for faster throughput. Simultaneously, the pushes are written to the local “reference” copy of the repository (usually an NVMe disk). Once both actions complete, other replicas of the repository can download the changes as needed. “With the only requirement of having to synchronize the reference transaction with a single local repository instead of a quorum of replicas, we have a system that can ingest pushes as fast as our disk allows,” Martí wrote. Git will still have to do DAG traversal for many operations, but it is better to do it locally on a speedy solid-state drive than over a network. “Where does every repository live? The answer is ‘anywhere’. It doesn't matter! We treat repositories like a warm cache on disk, but the source of truth is always the write-ahead log,” Martí noted. We will see how well this approach plays out as Origin moves into being a production service. But if we don’t see stories about Origin outages, then Git managers will know to give object storage a serious look. ®

source https://www.theregister.com/devops/2026/08/23/how-cursor-beat-gits-scalability-shortcomings/5291421

An ultra-rare piece of Microsoft history could be hiding on your shelf

In a future edition of The Antiques Roadshow, the hosts might get all excited about a mint Microsoft Entertainment Pack for Windows… with a sticker on the box instead of a printed Tetris promotion. Veteran Microsoft engineer Raymond Chen explained the reasoning behind using the sticker instead of simply printing what was in the box. Microsoft hadn't locked down the rights for Tetris before the first print run of the packaging, so went with what it had. The Microsoft Entertainment Pack for Windows debuted in 1990, the same year that Windows 3.0 was released and ushered in an era of Microsoft desktop dominance. Three more iterations of the entertainment pack followed, which included FreeCell, before Microsoft pulled the plug in 1992 (although a Best Of version arrived in 1994, and there was another version for Windows CE later in the 1990s). We'll draw a discreet veil over the ad-festooned version currently in the Microsoft Store. The floppy disks in the box included several card games, Minesweeper, and a Windows version of the fiendishly addictive and massively popular game of the era, Tetris. But it might not have gone that way. Chen explained in a post on his Old New Thing blog, "At the time the first run of boxes were being printed, the negotiations to license Tetris hadn't yet concluded. There was a chance that the negotiations would fall through, and the Entertainment Pack would have to be released without Tetris." So, rather than risk throwing away a production run, Microsoft went ahead with the Tetris-less branding, and added a sticker when the deal was done. Later print runs made the sticker part of the box art, hence the rarity of the original. Microsoft has a bit of a history of inadvertently creating collectibles. Chen recalled an incident with Windows 95, when an anti-piracy hologram on the case depicted a child pointing at a computer monitor and the Windows 95 logo. The child was shirtless, which caused offense in some quarters. Microsoft's solution? A new hologram with the baby in a shirt and overalls. However, some original versions still exist. Chen said, "So if you still have your copy of Windows 95, go look at the hologram. If the baby in your hologram isn't wearing a shirt, you have a genuine collector's item." We can just imagine the excitement at the recording now, as someone produces not only a stickered version of the Microsoft Entertainment Pack for Windows, but also the topless baby version of Windows 95… ®

source https://www.theregister.com/offbeat/2026/08/23/an-ultra-rare-piece-of-microsoft-history-could-be-hiding-on-your-shelf/5291118

Cloverleaf deal is latest example of Nvidia using its war chest to patch cracks in the AI bubble

Nvidia has made its fortune on the AI boom, but the company has a problem. It faces a growing number of roadblocks which, if left unchecked, could pop the bubble. Thus, the AI arms dealer has been forced to play a game of Whac-a-Mole, shoring up the foundations of its empire by investing its spoils into ensuring its customers don’t stop buying. The latest example of this came Friday, when Nvidia announced it’d become a minority investor in Cloverleaf. Founded in 2024, Cloverleaf specializes in laying the literal foundations – by which we mean the land and power – necessary to build bit barns so they can be leased by the cloud providers and model devs that actually pay the bills for Nvidia’s hardware. Nvidia can only sell as many GPUs as there are datacenters to put them, and those datacenters can only be deployed where there’s adequate power to support them. And since its latest round of GPUs can’t just be dropped into any old bit barn, Nvidia is going to need a lot more datacenter capacity, and by extension a lot more power. A new breed of datacenter Up until 2024, the majority of Nvidia’s systems were air-cooled. Supercomputers, like those built by Cray and Eviden, were the exception to the rule. Unless you were deploying tens of thousands of GPUs, its accelerators could be deployed just about anywhere with minimal modification to the facility. That began to change with Nvidia’s Blackwell generation. You could still get air-cooled systems from Nvidia and its partners, and it certainly sold a lot of eight-way HGX B200 boxes, but deploying its most powerful NVL72 systems required liquid cooling that not every facility was capable of supplying. Liquid-cooled facilities are harder to build than their air-cooled counterparts. Liquid-cooled racks tend to be more compute dense, and therefore heavier and power hungry to operate. That means in addition to larger UPS backups and beefier PDUs, these facilities now need a bunch of coolant distribution units (CDUs) to pump coolant around — about one for every one to three megawatts of compute capacity. Datacenters must be designed to support all this extra weight, and the problem is only going to get thornier as Nvidia transitions from roughly 250kW to 600kW racks starting next year. With Nvidia’s Rubin generation of GPUs, air-cooled GPUs may as well be a thing of the past, at least in the HGX and NVL-style form factors that power the majority of AI training and inference deployments today. For the first time, Nvidia is offering the chips only in liquid-cooled varieties. So, to sell its next-generation GPUs, Nvidia not only needs its customers to have adequate capacity, but also needs those facilities to offer the right mix of power and cooling. Right sizing for deployment It’s well established that Nvidia prioritizes customers with datacenters ready to fill. However, many of the GPU-slinger's biggest customers don’t actually own datacenters, but instead lease capacity from others. For example, Crusoe built OpenAI’s Stargate facility in Abilene, Texas, and Oracle runs it. Altman and crew are simply supplying the demand. So, Nvidia has invested in model devs and neocloud partners by helping them get financing or even investing directly in their businesses. Nvidia’s investments in OpenAI, CoreWeave, and Nebius are just a few examples. That works so long as the bit barns available for rent are the right size and shape for the hardware. But, as we noted earlier, many existing facilities aren’t. To further reduce friction and make it easier for its customers to find space to deploy its kit, Nvidia introduced its DSX platform last fall and officially launched it this spring. In a nutshell, DSX is a set of blueprints outlining exactly how much power, cooling infrastructure, and space are needed to support a given amount of compute. It also provides tools to optimize that compute to minimize wasted capacity. The power problem But even designing to a spec won’t do bit barn builders any good if they can’t get their hands on enough power. The proliferation of AI datacenters has begun to strain grid capacity, forcing many new ones to employ behind-the-meter power generation. For example, Nebius has begun using Bloom Energy's natural gas fuel cells to power its datacenters, rather than relying entirely on existing grid infrastructure. Nvidia’s investment in Cloverleaf is the latest example of how the GPU slinger is using the circular AI economy to its advantage. The terms of the deal haven’t been disclosed, but the benefits are obvious: Cloverleaf gets an influx of cash, while Nvidia gets greater control over the build process. As part of the deal, Cloverleaf is also embracing Nvidia’s DSX spec. In theory, this should enable bit barn builders to drop a DSX-compliant datacenter on a Cloverleaf-supplied site and be serving customers without delay. For Cloverleaf, Nvidia’s spec includes a wealth of power-related capabilities, including DSX Flex, which allows datacenters to scale back their workloads in response to grid conditions. So if grid demand spikes during a heat wave because everyone’s AC just kicked on, datacenters know it’s probably not a good idea to kick off another training run. The tech can also be used to offload demand onto onsite power generation or storage systems, like batteries — all things a company tasked with supplying powered sites for datacenters might be interested in. The deal is the latest example of how Nvidia is using its war chest to shore up cracks in the broader AI ecosystem before they become a problem. We wrote a few weeks ago about how the company was helping AI infrastructure startups secure financing in exchange for a share of the revenues, but it's now clear Nvidia is attacking potential roadblocks from every angle. ®

source https://www.theregister.com/systems/2026/08/22/cloverleaf-deal-is-latest-example-of-nvidia-using-its-war-chest-to-patch-cracks-in-the-ai-bubble/5291369

Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report says

Salesforce partners say they have yet to see any meaningful revenue from Agentforce, two years after the CRM giant launched its AI platform, promising spectacular growth. That's according to a recent report from TD Cowen, which surveyed Salesforce partners and found muted interest in the technology, designed to let users build AI agents for customer interactions. The survey of partners in the US, Europe, and Asia found growing customer interest in Agentforce, but no revenue yet. Asked about interest in Agentforce AI Agents, 11 percent of respondents said they had not seen much immediate interest, while 56 percent said they expected to see interest but needed time for initiatives to mature. A third of partners said there was strong interest in Agentforce as they were starting to see buying and trial activity. However, none were seeing Agentforce become a driver of bookings activity. The report also noted weaker commercial growth among partners across Salesforce's portfolio. A third were meeting or beating targets as opposed to 43 percent in the previous quarter. “Agentforce adoption [is] still subdued," the report said. Salesforce did not immediately return a request for comment. In its most recent results for Q1 FY2027, ended April 30, the CRM vendor said its current remaining performance obligation – a measure of future contract values – had grown 14 percent year over year to $33.6 billion, “propelled by Agentforce, Data 360, and Slack, partially offset by softness in commerce and Tableau.” “We are seeing incredible demand for Agentforce with annual recurring revenue now greater than $1 billion,” CEO Marc Benioff told analysts. Salesforce has backed Agentforce to help it beat the so-called SaaSapocalypse — where AI agents perform common enterprise tasks and obviate the need for software upgrades. It says Agentforce will help customers build, test, deploy, manage, and orchestrate AI agents in the enterprise. The TD Cowen report is not the only dark cloud over the strategy. Last month, a report from KeyBanc Capital Markets cited its CIO survey, which found customers did not view the CRM plan favorably. "Our checks and customer conversations have not been strong, nor has the feedback been on Agentforce. What we can piece together in the disclosed numbers does not signal building momentum and, most recently, our CIO survey delivered another blow with Salesforce being a standout for the wrong reasons," the report said. KeyBanc found that partners and customers thought enterprise data was not coherent enough to do meaningful AI work and that Agentforce, “as a product, just isn't there." ®

source https://www.theregister.com/saas/2026/08/21/salesforce-partners-not-seeing-meaningful-revenue-from-agentforce-ai-platform-report-says/5291167

AI companies are burning books, advocates complain to FTC

AI companies are buying loads of physical books, hoovering up the texts for model training, and then physically destroying the originals. A group of 18 advocacy organizations on Friday asked the US Federal Trade Commission to investigate the book butchering and knowledge hoarding. Fresh details of the practice emerged earlier this year via document disclosures in Bartz v. Anthropic PBC, a copyright case brought by authors of books that the AI company used for training without permission. Anthropic's book scan-and-destroy operation was known as "Project Panama." It was described in a 2024 internal memo as "our effort to destructively scan all the books in the world." Anthropic gave the operation a codename "because we don’t want it to be known that we are working on this," the court exhibit explains. "This document is visible to all Anthropic employees, but you should avoid talking about it in public areas, and the fact that we are working on this should not be shared with anyone outside Anthropic." Older books turn out to be valuable for AI training because they're unpolluted by AI-generated text, which has been seeping into recent written work. And destroying books once they've been scanned avoids the cost of storage. In some circumstances, scan-and-destroy operations may support fair use claims. In the Bartz case, the district court accepted the argument that a physical book can be digitized and destroyed, substituting the electronic copy for the physical book in a transformative act of fair use. But that didn't work out for the Internet Archive. Anthropic, which did not respond to a request for comment, is not the only company consuming and trashing texts. A recent report found Amazon has been participating in book scanning and shredding. Amazon also did not respond to a request for comment. The subject has become a public relations headache, in part because of the barbarism of book destruction and its association with authoritarian regimes, and in part because of the broad backlash against AI companies for pillaging public resources in pursuit of private gain. Intermediaries appear to be feeling the heat. ISBNdb, which reportedly helped broker the acquisition of books for destructive scanning, recently disavowed the practice. The biz noted last month, "We've removed a recent landing page, 'Printed Books Sourcing for Your AI LLMs Dataset Needs.' It was part of exploring demand, and we've chosen to pivot away from that direction." In light of these revelations, civil society groups want the FTC to look into book buy-and-destroy operations on the basis that they prevent competing AI developers and the public from accessing those resources. "The secretive and reckless way that major AI companies like Anthropic and Amazon are acting shows that there is real smoke here that the FTC needs to investigate," Kate Oh, special advisor to the Demand Progress Education Fund, said in a statement provided to The Register. The groups' letter [PDF] casts scan-and-destroy operations primarily as anticompetitive – the FTC being notionally a competition watchdog – but it hints at the anti-democratic consequences of monopolized knowledge. "Through their practice of permanently destroying books en masse and thus removing those non-renewable resources from broader access, AI companies are engineering a future where only the wealthiest incumbents can build high-quality AI models and operate as the sole holders of humanity's written works – after having destroyed the originals to get there," the letter says. We're unaware of whether any texts have been shifted entirely into AI models without leaving any physical copies. But then how would anyone verify that when AI companies refuse to divulge their training data? The letter asks the FTC to answer that question: "What the public record does not establish – and cannot, from the outside – is how often the destroyed physical books are the last or among the last surviving copies of a given work." ®

source https://www.theregister.com/ai-and-ml/2026/08/21/ai-companies-are-burning-books-advocates-complain-to-ftc/5291299

New SynkLoader malware pushed in Microsoft Teams phishing campaign

A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. [...]

source https://www.bleepingcomputer.com/news/security/new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign/

US Bank investigates LockBit's claims as ransomware crims set pay-or-leak deadline

US Bank says that it's investigating ransomware crew LockBit’s claims that it breached the financial institution and stole data, which the crims threaten to leak on September 3 unless the bank pays an extortion demand. “We’re aware of claims regarding a potential cybersecurity incident,” Lee Henderson, US Bank VP of public affairs, said in an emailed statement to The Register. The bank declined to answer specific questions about the claims, including whether it has communicated with the extortionists and how much LockBit demanded. If the extortionists’ claims are true, and even if the bank pays the ransom demand, there’s still no guarantee that the digital thieves will delete the stolen files. When cops took down an earlier iteration of LockBit in 2024, they found evidence that the crooks retained victim data - even after the victims paid the extortion demands. “At this time, there is no indication that our internal systems are impacted and no evidence of unauthorized access to our network,” Henderson continued. “US Bank takes the security and privacy of our clients' and employees' information very seriously. We continue to investigate and closely monitor these claims and remain, as always, vigilant in our efforts to mitigate potential exposure to cyber events.” LockBit added the bank to its leak site late Wednesday night, and gave the bank 14 days to pay a ransom demand or else see its data dumped online. The post doesn’t say how many files the crew allegedly stole, or what they contained. In February 2024, international cops seized servers, domain infrastructure, and decryption keys in an effort to dismantle the notorious ransomware group, and in May 2024, they outed LockBitSupp's true identity - although Dmitry Yuryevich Khoroshev, a Russian national, remains at large. In September 2025, however, LockBit reemerged with its new LockBit 5.0 ransomware variant. LockBit’s latest claims follow previous third-party breaches affecting US Bank customers’ data, and at least one law firm says that it’s considering a class-action lawsuit against US Bank National Association, the primary banking subsidiary of US Bancorp, on behalf of a small group of customers whose credit card information may have been exposed in a third-party security snafu that reached the bank through its vendor, Fidelity National Information Services. US Bank reportedly found out about the third-party incident on May 7, and in June, began notifying 537 customers, all Massachusetts residents, that their names, mailing addresses, and credit card numbers may have been stolen by the digital crooks. Customers’ Social Security numbers, online banking credentials, and account balances reportedly weren’t accessed. A much larger incident affecting around 11,000 customers occurred in 2022, after a different vendor “accidentally shared” a file containing personal information associated with closed US Bank credit card accounts, including names, addresses, Social Security numbers, dates of birth, closed account numbers, and outstanding balances.®

source https://www.theregister.com/security/2026/08/20/us-bank-investigates-lockbits-claims-as-ransomware-crims-set-pay-or-leak-deadline/5290560

Hackers poison arrayref Rust crate to push infostealer malware

Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers' systems during compilation. [...]

source https://www.bleepingcomputer.com/news/security/hackers-poison-arrayref-rust-crate-to-push-infostealer-malware/

Rogue ransomware affiliate poses as data recovery firm to steal payments

A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting the victims before the attacks become public and claiming to be able to provide decryption keys and delete stolen data for a fee. [...]

source https://www.bleepingcomputer.com/news/security/rogue-ransomware-affiliate-ransom-busters-poses-as-data-recovery-firm/

Sakura Internet hack exposes data of up to 1.36 million accounts

Japanese cloud and data center service provider Sakura Internet disclosed that hackers accessed its sales management system, where customer contract and membership information is stored. [...]

source https://www.bleepingcomputer.com/news/security/sakura-internet-hack-exposes-data-of-up-to-136-million-accounts/

Hackers compromise 14,500 Dahua web cameras in 35-day campaign

In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia. [...]

source https://www.bleepingcomputer.com/news/security/hackers-compromise-14-500-dahua-web-cameras-in-35-day-campaign/

OpenAI's overhead will rise 20 percent for some workloads as it hardens security

OpenAI on Tuesday said its decision to suspend model training work, implemented after unreleased, unsupervised AI models hacked HuggingFace, remains in effect as the AI biz tries to implement stronger security measures. Some of those measures will increase compute overhead by 20 percent of the observed inference workload. An OpenAI spokesperson told The Register that those costs reflect internal research and won't be passed on directly to customers. The company has not revealed what portion of its total inference compute is subject to such monitoring now, or under its prior monitoring regime. "We have paused some frontier RL [reinforcement learning] training to ensure that we can meet the appropriate alignment, security and monitoring standards for the new level of capabilities in front of us," OpenAI CEO Sam Altman wrote in a social media post. "Model progress is now extremely rapid, and we always said we would take action if we felt that model capabilities were outstripping the pace of safety and alignment." Altman said he still expects new models, presumably the delayed Astra, will ship soon. The training pause affects further-out releases. OpenAI in its post reiterated its plans to focus on monitoring, model alignment, and security measures to prevent its models from running amok as they did last month. Following the HuggingFace incident, OpenAI "paused frontier model inference in research clusters for runs that could execute code or use tools that could access the internet." The biz said it allows some workloads to run, but paused others until they can be moved under a more stringent security regime that includes sandboxing, network isolation, and continuous security testing. "Our largest planned frontier RL (reinforcement learning) run remains on hold while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding," the company wrote. Reinforcement learning refers to the trial-and-error process by which AI agents "learn" about their environment by being rewarded for desired outcomes. OpenAI also said it is expanding its monitoring of the chain-of-thought process, the technique that sees "thinking" models break down tasks into discrete steps and produce intermediate text output for each step. The company's prior approach focused on high-risk workloads, specifically internal deployments of frontier models and frontier RL training runs. In contrast, OpenAI says, its new monitoring setup covers all RL training and evaluations involving tools for models at the capability level of GPT-5.6 Sol or higher. And with the determination that Astra possesses critical cyber capabilities, OpenAI added an additional monitoring requirement that covers all inference with Astra, not just RL training and testing. "These safeguards require meaningful compute," OpenAI said. "Our current estimates put monitoring overhead at roughly 20 percent of the inference compute being monitored, though the cost varies substantially across training and evaluation workloads." OpenAI expects to share more details about the implementation of its monitoring scheme in a future post. In research published last year, the company said that chain-of-thought monitoring is an effective way to detect model misbehavior, but cautioned that directly optimizing models to strictly follow instructions "does not eliminate all misbehavior and can cause a model to hide its intent." If you choose to believe the company's assurance that it will not pass on the cost of model thought policing to customers, it follows that OpenAI's losses will increase. It's difficult to imagine that would be a sustainable stance if OpenAI goes public. But given the company's reported $600+ billion in AI infrastructure commitments and its expectation to remain unprofitable until at least 2030, what's a bit more expense for the sake of uncertain security? ®

source https://www.theregister.com/ai-and-ml/2026/08/19/openais-overhead-will-rise-20-percent-for-some-workloads-as-it-hardens-security/5289303

Meta and Google mobile apps gorge on user data: Study

A study of mobile apps claims that Meta collects three times as much user data on average as tools published by Apple or Microsoft. Google is also one of the worst data-scavenging offenders. The research was conducted by the reassuringly named Surfshark, a VPN and security tools provider. It found that Meta's apps were the most "data-hungry," declaring an average of 25 out of 35 possible data types, compared with seven or eight for apps from Apple and Microsoft. The findings are based on privacy information submitted by developers to Apple's App Store, rather than independent observation of what the apps transmit. They count the number of data types an app may collect, not the amount or frequency of collection, and do not mean that every category is gathered from every user. Surfshark examined 171 iOS apps published by Google, Apple, Microsoft, Amazon, and Meta, making this a comparison of five tech giants rather than the wider app market. Google accounted for 29 of the 40 apps declaring the broadest data collection, although it was also overrepresented in the sample, with 44 apps – more than any other publisher. Nine of Meta's 12 apps made the top 40. The 29 Google apps declared between 18 and 26 data types each. Amazon Alexa was the most data-hungry non-Meta app, listing 28. All the Meta apps studied declared the collection of device IDs, product interactions, performance information, and crash data, Surfshark says. Nine listed precise location data, which the researchers argued went beyond what the apps were likely to need, while seven listed browsing history. Although Google's apps listed fewer data types on average than Meta's, they ranked as the most data-hungry in six App Store categories: Photo & Video, Music, Entertainment, Utilities, Health & Fitness, and Developer Tools. All the Google apps examined listed device IDs, diagnostic information, and performance data, while many declared search histories, purchase histories, photos or videos, email addresses, and usernames. Amazon's apps commonly listed device IDs, email addresses, names, performance information, product interactions, and crash data. Eleven declared precise location data, while one listed browsing history – Amazon Shopper. Apps from Microsoft and Apple declared the fewest data types on average among those Surfshark examined, although neither emerged entirely empty-handed. The data types most commonly listed by Microsoft apps included crash data, device IDs, email addresses, names, diagnostic and performance information, product interactions, and user IDs. Two also declared browsing history. Safari was the only Apple app to list browsing history, while six Apple apps declared precise location data. Other commonly listed types included device IDs, email addresses, and performance information. "Our research shows that the Big Tech business model is often built on an insatiable appetite for user information," said Surfshark research lead Dr Luis Costa. "When these giants weave together search history, purchase habits, and precise GPS coordinates across dozens of different apps, they are building a detailed digital map of users' lives." m®

source https://www.theregister.com/personal-tech/2026/08/18/meta-and-google-mobile-apps-gorge-on-user-data-study/5289171

Comcast turns your Xfinity WiFi into a home motion detector

Comcast is promoting WiFi-based motion detection as a part of its new Xfinity Shield home protection platform, allowing routers and wireless devices to detect people moving through a home without cameras or motion sensors. [...]

source https://www.bleepingcomputer.com/news/security/comcast-turns-your-xfinity-wifi-into-a-home-motion-detector/

Siemens and Reinhausen turn up the voltage for hungry AI racks

Siemens and fellow German engineering biz Reinhausen are developing a solid-state transformer (SST) to deliver 800-volt DC power directly to increasingly dense AI datacenter racks. As AI hardware grows hotter and hungrier, server farm operators are looking to overhaul how power moves through their data halls. One approach, favored by Nvidia and other industry heavyweights, is distribution at 800 VDC. The two electrical enterprises are therefore developing a modular SST capable of converting medium-voltage AC at up to 36 kV into a stable 800 VDC output for downstream distribution. Siemens says that the SST will provide a compact, galvanically isolated alternative to conventional multistage AC-to-DC power conversion architectures, reducing intermediate conversion stages and enabling more efficient delivery to high-density AI infrastructure. According to Reinhausen, datacenters supporting AI workloads are among the industry's most demanding power consumers. Sudden load spikes can strain servers, storage, and cooling systems, reducing performance and potentially causing outages. "Our technology enables AI datacenters to operate with the efficiency and reliability they require," said Reinhausen managing director Wilfried Breuer. "Solid-state transformers are critical for these large and power intensive structures. They enable higher efficiency, direct grid-to-rack DC conversion, and a reduced footprint. This collaboration will further strengthen our leading position in the electrification of datacenters," commented Siemens CEO of Electrification and Automation, Stephan May. As The Register reported late last year, Nvidia sees 800 VDC power distribution as the way forward for AI infrastructure, and says the shift will be necessary to support IT racks drawing 1 MW or more. That may sound far-fetched when average rack density has only just passed 11 kW, according to Uptime Institute, but hyperscalers such as Google are already planning for megawatt-scale racks. Nvidia has also developed its own MGX-compatible 800 VDC power rack, which it says will arrive "in the second half of 2026." Siemens and Reinhausen said that they intend to industrialize their datacenter SST, but did not say when it would become commercially available. We asked for clarification. Another German electrical firm, Infineon, is also backing 800 VDC and positioning its silicon carbide (SiC) power semiconductors for use in the infrastructure. ®

source https://www.theregister.com/on-prem/2026/08/17/siemens-and-reinhausen-turn-up-the-voltage-for-hungry-ai-racks/5288565

Hacker claims 3.6 million Azure account records stolen from major companies

A threat actor is selling employee databases allegedly stolen from the Microsoft Azure infrastructure of multiple Fortune 500 companies after gaining access using compromised credentials. [...]

source https://www.bleepingcomputer.com/news/security/hacker-claims-36-million-azure-account-records-stolen-from-major-companies/

Friday, 4 September 2026

Thursday, 3 September 2026

Wednesday, 2 September 2026

Tuesday, 1 September 2026

Monday, 31 August 2026

Sunday, 30 August 2026

Saturday, 29 August 2026

Friday, 28 August 2026

Thursday, 27 August 2026

Wednesday, 26 August 2026

Tuesday, 25 August 2026

Monday, 24 August 2026

Sunday, 23 August 2026

Saturday, 22 August 2026

Friday, 21 August 2026

Thursday, 20 August 2026

Wednesday, 19 August 2026

Tuesday, 18 August 2026

About

Privacy Policy

ShortNewsWeb

Blog Archive

Categories

Recent Comments

Popular Posts

Translate

My Blog List

Popular

System Admin Share

Total Pageviews