Brits have delivered a fairly unambiguous verdict on giving the government access to their encrypted messages: no, thanks. New polling commissioned by the Center for Democracy & Technology (CDT) found that 93 percent of British adults believe they have a right to private conversations online, while 89 percent think nobody should be able to access their personal messages without a court order. Perhaps more awkwardly for Westminster, two-thirds said they would not trust either the current government or any future one with the power to access encrypted messages. That distrust crosses political lines. Among people who voted in the 2024 general election, 58 percent of Labour voters said they wouldn't trust any government with the power, alongside 59 percent of Conservatives, 56 percent of Liberal Democrats, 69 percent of Greens and 75 percent of Reform voters. Public First did the asking, polling 2,000 British adults for CDT in April and weighting the results to reflect the wider population. The margin of error is 2.2 percentage points. The findings land as the UK government's appetite for slurping encrypted data continues to collide with the tech industry's insistence that encryption works best when nobody has a spare key lying around. That fight became particularly public when Apple withdrew Advanced Data Protection from UK users after receiving a secret Technical Capability Notice (TCN) under the Investigatory Powers Act. Apple challenged the order, and while the US government later said Britain had withdrawn its demand for access to Americans' encrypted data, reports have since suggested another TCN was issued focusing on British users. Despite the international row, 55 percent of those polled hadn't heard about the Apple notice at all. Once presented with the idea, enthusiasm remained thin. Just 12 percent backed the government being able to secretly order companies to provide access to users' information while preventing those companies from revealing the order. A third said the government shouldn't have that power at all, while another 41 percent wanted greater transparency or parliamentary oversight. Nor were respondents particularly sold on sacrificing security for law enforcement. 53 percent said the security risks of accessing encrypted messages outweighed the benefits, compared with 28 percent who thought the benefits came out on top. The reasons will sound familiar to anyone who has followed the encryption debate for more than five minutes. 84 percent worried that mechanisms allowing access to encrypted messages could introduce vulnerabilities for hackers and criminals, while 82 percent were concerned the powers could be abused. Knowing someone might be watching could also change how people behave. 65 percent said they'd become more cautious about what they liked, shared or commented on, while 41 percent said they'd self-censor criticism of public institutions or government officials. CDT is not a disinterested observer: the digital rights group campaigns for strong encryption and commissioned the research as part of that work. The polling itself, however, was carried out independently. Commenting on the research, Jim Killock, executive director of Open Rights Group, said: “The British public instinctively know that being able to communicate privately is crucial to our individuality and to the survival of a free and open society. “The government persists with the myth that it can weaken encryption to target the bad guys only. Attacks on the security of our phones, security tools and messaging apps harm us all and make our democracy weaker.” None of this is likely to end Westminster's long-running pursuit of encrypted communications. But if ministers were hoping the public was enthusiastically behind them, the numbers suggest otherwise. ®

Last month I sat in a networking lab with AWS VP of Global Network Engineering Matt Rehder and cracked a joke about cage nuts cutting your hands to ribbons. I wasn't prepared for the blank stare I got in response, but I really should have been. Mind you, not because the joke wasn't funny (my jokes are hilarious), but rather because the world the joke was referencing no longer exists for them. Racks show up as assembled units, and apparently nobody screws hardware into anything in an AWS datacenter facility these days. It was a peek behind a curtain into a world that powers everything we do in cloud, but that remarkably few of us know exists. My Reg colleague Thomas Claburn toured the lab previously and gave us a deep dive into AWS's paper on this. In summary, "a flat, single-tier network wired in a deliberately near-random pattern leads to a way more resilient network that costs far less to run" and now you're up to speed. The part that I felt didn't get enough attention (and is why I invited myself to tour an AWS facility, much to AWS's surprise) is the economic part and how it impacts AWS customers. In short, their new networking approach can be up to 40 percent more energy efficient, and it's the default for most new datacenter builds (and dear reader, they are building a lot of those these days), and it's been completely invisible both inside and outside of the walls of the world's largest bookstore. The savings and cost efficiencies are real — so where do they go? Cost efficiencies abound Seventeen years ago, Amazon SVP James Hamilton got on stage and pointed out [PDF] that network vendors ran businesses whose margins resembled those of mainframe vendors, who themselves in turn resembled starving pigs at a trough (colorful metaphor mine, but also... not wrong). His big issue with this distilled down to "they're in my way," and he plus his team set out to do something about it. It turns out that "what they did about it" was nothing less than rebuilding the entire networking stack themselves atop commodity hardware. This brings us to a few years ago. Their networking cost efficiencies were already far lower than they would have been running atop traditional networking vendors, and then their Resilient Network Graph shufflebox play took another axe to the cost of networking. So... where have those savings gone over these past few years? I asked point blank whether it was fair to say that they kept the margin improvement rather than passing it back to customers. Their answer was unequivocal: "From a cost perspective? Effectively, yes." AWS cloud economics It's easy to see that answer as damning, but I humbly suggest that if that's your reaction, you haven't been paying attention to broader industry trends these last few years. Unlike its competitors, AWS has not raised prices on existing SKUs. (Yes, the cost of GPU capacity blocks has been raised on a quarterly basis, but that's apparently how those were designed to work, much like a slow version of Spot Instances. And yes, they started charging per public IPv4 address a couple of years ago.) You can go out and spin up the same instance with 64GB of RAM that you could in 2020 and pay the same price today; that's not even increasing a price to keep up with inflation! And while there's a 9 percent increase to go from a Graviton4-based c8g.2xlarge to its equivalent c9g.2xlarge Graviton5 instance, nothing is making you upgrade. Frankly, given the component cost hikes, I'm more than a little astonished that they were able to hold the increase to 9 percent. Further, despite the madness-inducing level of granularity you see in an AWS bill with its millions of SKUs, it's worth noting that each SKU itself obscures dizzying levels of complexity. An EC2 instance charges you per hour (yes, it's metered by the second; do not email me), but that one charge covers the CPU, the RAM, the backplane, the power, the building's physical security, the IAM security bits that keep it from resembling a public computer/something from Microsoft Azure, the employees it takes to build and run these systems, and a stupendous amount of networking magic. A sea change in approach One of those aspects of networking magic is that while it can be usuriously expensive to move traffic between Availability Zones (in major regions each gigabyte has a list price of a penny in and a penny out, so "two cents per gigabyte," which adds up), moving data inside of an AZ remains free. That's impressive when you start to realize how many different datacenter facilities can comprise a single AZ. It's damned impressive when you realize that AZs are expanding, data volumes are increasing, and that expansion comes with costs that thus far AWS has chosen to bear rather than pass on. It's significantly more expensive to move data out of AWS. Their now-defunct Snowball family of devices let you ship data back and forth to AWS. Sending one in cost a set fee, while sending one out cost that fee plus a per-GB charge. Annoying, right? That changed over the last year with the advent of AWS Interconnect - multicloud, which charges you nothing per GB, just an hourly port charge. There's a free tier of one 500 Mbps port per provider, which reduces to zero the AWS-side cost of sending that traffic to GCP, Oracle, and soon Azure. For comparison's sake, it'd be roughly $12,000 to send a month's saturation of that port across the open internet. Stated more plainly, this has never been done before on the AWS side, and it's fascinating. While it's not the primary area of focus for the folks I talked to, I nonetheless asked them about it for an on-the-record answer: "We know customers do not like rate-based network charges because it’s hard to predict their cost, which is why we are moving towards flat-rate pricing for new network products." Well slap me naked and hide my clothes; I'd be less surprised if Matt Garman gave his next re:Invent keynote in iambic pentameter. This bears watching; it's more interesting to me that it comes at a time when prices are rising instead of falling. How hard can it be? Very hard The problem is that a lot of what AWS does is invisible. For example, why am I telling you this instead of AWS? AWS concedes that they're generally bad at telling their own story, but they clearly want to tell it. Historically, they've punted to customers to tell their own stories, on the belief that the benefit will accrue to them. Here's my favorite example: the hard part of a near-random network isn't the cabling so much as the routing. Every protocol you've heard of (BGP, OSPF, a few Cisco-specific protocols that nobody sane uses, etc.) computes shortest paths, and "shortest path" stops meaning much when there are roughly thousands of equivalent routes between any two points. AWS solved that with a protocol called SIDR (Scalable Intent-Driven Routing, pronounced "cider," like the CIDR method for allocating IP addresses because these people are malevolent at naming things) that runs the control plane, while Spraypoint picks up the actual forwarding path. They presented SIDR publicly at re:Invent in 2023, then covered it again at the "Monday Night Live" re:Invent keynote in 2024. Then they published the RNG paper, which doesn't mention SIDR at all. As best I can tell, nobody outside the company has ever connected the protocol to the network it makes possible. I had to ask just in case I was missing something. I'm right. It isn't a secret! They just never got around to mentioning how important it was to making the whole thing go. Unfortunately, their lack of storytelling prowess about these things isn't working for them. The perception runs the other way: the market believes that the neoclouds and the Nvidia reference designs are better. They aren't. You can build a neocloud without knowing much about networking, and some outfits clearly have. A lot of datacenter networks are run by absolute clowns. I know this; I used to be one of said clowns before I got religion / discovered I could pay a cloud provider to make this stuff Matt Rehder's problem. AWS has gotten so good at making network arcana invisible that we don't really stop and think about just how wild it is that you can get damned near full line-rate between any two points in AWS and it just works. In the datacenters you or I build, you get to worry about fun things like "the switch at the top of the rack can only push so much traffic, so not every node can talk at full speed all the time." I have never encountered a real-world scenario of that being a concern in AWS. As a result, when folks set out to build their own datacenters, they don't know what they don't know after a generation of that complexity being hidden away from them, and they approach it with a sense of "how hard could it be?" It is extremely hard, and I have little confidence that the neoclouds spinning up new DC facilities overnight are paying attention to this. I asked Rehder directly whether the "ML datacenter facilities" AWS was launching in places like Mississippi were taking shortcuts since GPU workloads might have different requirements. He looked at me as if I were nuts; every datacenter they build is to the same spec. But customers won't care about that until right after they really should have cared about that; I have faith that a datacenter failure will be sufficiently public, embarrassing, and impactful so as to remind them. The tree of uptime must be periodically refreshed with the blood of massive outages. The humble mumble The folks I spoke to at AWS about this have built something that most of their own customers will never know exists, and they seem generally untroubled by that fact. I found that more admirable than I would have expected to; it's the very definition of thankless work, and AWS shines here. The reason the work is invisible is simply because it succeeds. And they're so humble about it! They politely chuckled at my joke about cage nuts once they got the reference, and I politely chuckled at their joke about how each year's switch is painted the Pantone "Color of the Year," which it turns out was in fact not even slightly a joke. AWS gets a lot wrong. They have ridiculous marketing campaigns, they build five services that do mostly the same thing and then name them like malevolent toddlers, and they've never found a partner they couldn't find a way to compete with. But when it comes to the "chop wood, carry water" type of work that makes the entire cloud possible, the kind that would put most of a keynote audience to sleep, they're the finest in the world. They're just bad at telling the world about it. ®

A defense startup has raised $7 million to develop its counter-drone system that uses small interceptors to defend against swarms of FPV (First-Person View) drone swarms, the kind causing heavy battlefield casualties in Ukraine. San Francisco-based Mara says it has secured the funding to bring its Spike drone defense system to market, aiming to provide a cost-effective counter to small FPV attack drones - typically quad-copters with an explosive payload. The system comprises separate Spotter sensor / targeting units and multiple Seeker kinetic interceptors. The latter are small (250g / half a pound), fast (200 kmph / 124 mph), tube-launched, and have onboard intelligence to help find their way to the target. Mara claims that deployments can scale from a single rucksack kit to protect a squad of troops, to a vehicle-mounted launcher, up to a multi-kilometer perimeter shield for a base or site. A launcher can be fitted with up to 48 of the Seeker interceptors, and reloaded in less than a minute, or so the firm says. The Spotter detection and tracking sensor combines electro-optical and acoustic sensors with an optional low-signature radar, for day and night all-weather protection. “Small drones changed the battlefield because they distributed the cost and capability of precise attack,” Mara co-founder and CEO Daniel Kofman said in a statement. Yet many defensive countermeasures are concentrated into one costly point solution, he claims. “Spike creates a distributed mesh of small, cheap nodes that can each aim and shoot in multiple directions at once.” The components of its Spike system have already been tested by potential customers, Mara says. Seeker completed intercepts cued through US Army systems at an exercise in Texas, while Spotter has been operated on an armored vehicle during another Army exercise in Europe. Most recently, Ukrainian forces operated Spotter near to the front line in their country, where it tracked multiple FPV drones. Mara says it has research and testing agreements with three US defense organizations, and is in early-stage engagements with international military partners in the UK, Czech Republic and Ukraine. The $7 million funding round was led by Khosla Ventures. We asked Mara for further details, such as the range of its Seeker interceptors and just how inexpensive they are, and will update if we get answers. ®

Microsoft's latest Xbox merchandising deal means at least you can sit on an IKEA cushion while you wait for your PlayStation 5 to boot. IKEA has announced YXSTABY, a nine-piece collection of items aimed at the XBOX completist who has to have every possible piece of merchandise associated with their beloved game console. Need a stool? How about one modeled on a controller's thumbstick? A cushion? There's a D-pad to throw on the sofa. And a tariff refund for Xbox customers? Ah, well, the IKEA deal only goes so far… IKEA has long had a reputation for being that place where relationships go to die, thanks in part to the occasionally labyrinthine layout of its store. Xbox has, under the leadership of Asha Sharma, acquired a similar rep as far as staffers and game studios are concerned. Thousands of workers were laid off in recent months as Sharma "reset the business" to improve the platform's standing in a market dominated by rivals. In the UK, IKEA charges £12 for a cushion or platter, and up to £115 for a side table on wheels. The Reg suspects Xbox branded stuff will be a little pricier but considerably less than an Xbox itself. Microsoft Store shows the comparatively weedy Xbox Series S retailing for £429.99, while the beefier Series X goes for £669.99. When launched in 2020, the Series S cost £249. "Unfortunately," wrote Microsoft, "console storage and memory prices have increased by more than 2.5x and we expect another doubling by the fall of 2027." It is far from alone. Price rises have become a way of life in the tech industry in recent months as demand for memory outstripped supply. This is not the first gaming-related wares that IKEA has sold. The BRÄNNBOLL collection predates the Xbox collaboration and features "everything to improve your gaming adventures, from a rug that helps you hit the enemies, not the table, to gaming bolsters that boost your comfort and play." The YXSTABY range was unveiled at Gamescom this month, but eager buyers have a little longer to wait for that Xbox-inspired stool. The range will be in stores and available online from October 1. ®

Anthropic’s Claude Code running Opus 5 in Auto Mode can be tricked into executing attacker-controlled code simply by asking the coding agent to summarize a website. The attack works up to 80 percent of the time, according to prompt-injection wizard Johann Rehberger, aka wunderwuzzi. In a blog and video demo, he detailed how to hijack Opus 5 in Auto Mode, which is the default setting for Claude as of mid-August. It starts off by asking the agentic coding model to summarize a malicious website that presents itself as an archive of notebook records, and then tricking Claude into using curl instead of its WebFetch tool to retrieve the contents of the page – but without directly telling the model to use curl. The WebFetch request fails, returning a 415 Unsupported Media Type response, so the model decides to access the website directly by issuing a Bash tool call with curl. The website returns a 303 response, and redirects to a malicious ZIP archive, which Claude then downloads. This archive contains seemingly harmless files including catalog metadata, a README file, seven Base85/zlib-encoded JSON notebook records, a macOS decoder-darwin binary – plus a poisoned Python file named struct.py. Claude, per its safety guardrails, refuses to run the decoder: “This is planned and what the attacker wants,” Rehberger wrote. Instead of using the supplied binary, the AI decides to write its own decoder. “Ironically, that safety decision is the exploit path,” Rehberger explained, adding a purple devil emoji to the text. The new decoder imports base64, and from here the attack relies on Python module shadowing to trick the model into running the malicious struct.py code. Module shadowing occurs when a local file shares the same name as a Python standard-library module. The local file hides the official module, causing Python to load it instead. In this case, the standard-library base64 module imports the legitimate struct module, and the malicious ZIP contains a malicious file with the same name. Rehberger says he used ChatGPT to obfuscate the malicious struct.py code to bypass Claude’s safety controls, and this successfully launches a separate Python process to download and execute a remote payload – in this case a command-and-control callback, which in turn opens Calculator. We assume that real attackers would execute something a little more nefarious. In another attack scenario, struct.py launches a second, headless Claude Code via claude -p, meaning this prompt injection can be used not just to remotely execute code, but rather to create a whole new agent. “The nested Claude gets its own tool access and context,” Rehberger wrote. “In these runs the child performed basic recon (whoami, uname, id), opened Calculator and wrote to local files in the home folder.” Across three variants tested five times each, which Rehberger noted were small samples, he reported success rates between 60 percent and 80 percent. “I would say that these results are representative for a motivated attack, but not comprehensive.” Anthropic did not respond to The Register’s request for comment, but reportedly told Rehberger that the model’s “behavior is working as designed.” We’ve heard this one before. “Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee,” Rehberger wrote, paraphrasing Anthropic’s response to his security report. According to Rehberger, the classifier isn’t built to stop determined prompt-injection chains made up of individually benign-looking steps, and the real boundary is OS isolation and network egress control. The key takeaway, according to Rehberger, is to run this and other coding agents in a sandbox. “The solution is something we talked about for many years,” he wrote. “Do not trust the model output.”®

Datacenter cooling could get a lot more affordable, and sustainable, if a joint German-Japanese research project can be scaled beyond the laboratory. Researchers from the Karlsruhe Institute of Technology and the University of Tsukuba published a paper in Nature Energy on Friday discussing the success they had with a solid-state cooling technology that doesn’t need any electric input at all, and was still able to demonstrate temperature reductions in laboratory experiments. For those unfamiliar with solid-state cooling, it’s a more sustainable alternative to traditional compression cooling that relies on environmentally harmful refrigerants and lots of electricity. Instead of compressing and expanding a gas to generate cold, some solid-state systems rely on thermoelectric materials that, when supplied with electricity, can generate temperature differences. Thermoelectric solid-state cooling systems can be incredibly small, but there’s a catch: They still need energy, and they’re only a quarter as efficient as modern compression cooling systems, as the researchers noted. Enter elastocaloric cooling, which relies on shape-memory alloys that change temperature when mechanically loaded and unloaded through a phase transition. It’s that sort of material and methodology that the KIT and Tsukuba team experimented with. Like other forms of solid-state cooling, elastocaloric systems have traditionally required electricity to effect change in the shape-memory alloys they use, relying on actuators that can get quite large. What the researchers wanted to develop was a miniaturized form of elastocaloric cooling that didn’t require any electricity at all, instead relying on the waste heat being generated by the objects it wanted to cool – for example, a computer processor, as they mention in their paper. Based on their demonstration, it appears to have worked. The researchers used a pair of super thin nickel-titanium foils for their elastocaloric system with opposing functions: One foil shrinks when subjected to heat, generating movement that translates into mechanical energy and acting as its own actuator. That mechanical energy is transferred to the second foil, which is loaded and unloaded to trigger a phase transition that produces the cooling effect. Laboratory tests demonstrated that their technology isn’t only theoretically feasible, but also actually works – albeit to a limited extent. “Our prototype achieves a temperature span of 12.9 K at the refrigerant film level and 4.0 K at the device level under Joule-heated actuation at 86°C (187°F),” the team said in their report. When subjected to an external heat source of 130°C (266°F), the system still maintained a device-level temperature span of 2.2 K – not a lot, but it still shows the device, even at its most basic, single-pair-of-films level, works. "For us, the decisive moment was seeing measurable cooling for the first time, actually generated by a heat-driven system," KIT PhD candidate and paper lead author Yi-Ting Hsiau said of the project in a release put out by the university. "This showed us that the principle doesn't just work on paper." With the concept of electricity-free miniaturized cooling now proven, the team is planning to build larger experimental units to optimize cooling performance. Electricity-free and water-free cooling designs couldn’t come at a better time: Energy generation used to power and cool things like datacenters is on the rise, as is the water footprint of such facilities, in part also linked to cooling. Add climate change to the mix, and cooling electronics and people is only more of a concern – according to IRENA, heating and cooling together now account for more than 40 percent of global energy-related carbon dioxide emissions. Sorting out the datacenter energy and water problem has a lot to do with figuring out how to keep systems cool, and while this research is in its infancy, it could prove to be a valuable contribution to reducing the tech industry’s energy footprint. "We believe this is just the beginning," said Jingyuan Xu, head of KIT’s ZEco Thermal Lab, working on zero-emissions and eco-friendly heating and cooling tech. "By scaling up this technology, we aim to develop compact cooling systems that utilize abundant heat sources for sustainable cooling." ®

For years, Corey Quinn, chief cloud economist at Duckbill and occasional Reg columnist, has argued that Amazon's Route 53 DNS service is a database. While literally true in the sense that DNS records are stored key-value pairs, it's more of a provocation than an endorsement. Even so, the idea has inspired prior jibes. In that spirit, Colin Percival, the creator of backup service Tarsnap, has released Route 53 Files, "a new file system that seamlessly connects any AWS compute resource with Amazon's highest-availability database." "The opening line of referring to Route 53 as Amazon's highest-availability database was partly a hat-tip to Corey," Percival told The Register. "Everyone in the field knows it's true, though." But Percival's satirical target isn't really AWS database downtime. He's more focused on Amazon S3 Files, a file system that links AWS compute resources with Amazon Simple Storage Service. "S3 Files launched in April and my reaction was, 'Oh, we're shipping category errors now? Hold my beer,'" explained Percival. "I'm not saying that Route 53 Files can't be useful – as Corey notes, the API for Route 53 is awful – but the inspiration was 'this needs to be satirized' and the launch post was written with that in mind." The launch post was penned in the style of the S3 Files launch post. Percival pointed to one particular passage about Route 53 Files being "ideal for shared workloads that mutate authoritative DNS, such as AI agents collaborating through file-based tools and on-call engineers reverting each other's changes using sed." That passage, he said, echoes wording from the AWS post pitching S3 Files as being "ideal for interactive, shared workloads that mutate data, from agentic AI agents collaborating through file-based tools to ML training pipelines processing datasets." Percival said he understands that many AWS customers love S3 Files. "But the fact customers ask for faster horses doesn't in itself mean that's what we should give them; the weird edge cases which come up when you ship category errors can cause unexpected problems and I'm not convinced that customers understand them sufficiently," he said. Percival said he doesn't personally know anyone using S3 Files in production. "I'm just looking at the design and saying, 'that looks like a sharp edge which will hurt someone.' Two examples which come to mind are the 'Sync back to S3 after 60 seconds of inactivity,' which I'm sure will bite someone eventually when they end up waiting for changes which never arrive because a file is being continuously updated; and the IAM integration, which (due to the security fail which is IMDS) gives people far less privilege separation than they might expect from a filesystem." Quinn expressed appreciation for Percival's work. "I've been calling Route53 a database for the better part of a decade mostly to annoy people who know what a database is," Quinn told The Register. "Colin took the amazing bones of a legendary service and gave it an interface model that isn't molten garbage, and I am totally here for it. He replaced the API with echo which is a downgrade in every respect except for the part where it works without requiring six weeks of cloud school." And the funny thing is that it actually works. ®

The latest semi-annual release of LibreOffice, the cross-platform FOSS office suite, is out – and it’s gleefully throwing some shade. The Document Foundation released LibreOffice 26.8 – and sent The Register a press pack before it did so. We’re not going to go through it in great depth: it’s a mature suite, and most Linux distros bundle it by default, even some of the slightly strange ones. We do like some of the sly notes in the launch materials, though, starting with the headline: “LibreOffice 26.8 brings professional typography, deeper support for the world’s writing systems, and no artificial intelligence” No artificial intelligence. In 2026, this is a bold position statement, but it is merited. In the last six months, we have reported on The Document Foundation distancing itself from Collabora. We spoke to some representatives of TDF – and Collabora – at considerable length about this, but we came away unconvinced by TDF’s arguments. Collabora developers contribute much of the code in LibreOffice. For instance, the last time we covered a new release of LibreOffice, we mentioned its rich Markdown support. Collabora told us that its engineers developed this. And yet, TDF decided to restart development of its own cloud-based office suite, in direct competition with Collabora Office. Later we covered the release of Collabora CODE 26.04 – which is Collabora’s local office suite, based on LibreOffice FOSS code, but rendered inside the browser using web technologies. Collabora’s announcement places AI integration front and centre. That caused us some dismay, and we told the company’s representatives that. They replied that Collabora’s partners and users were requesting this, and it felt it had to comply. As such, we are pleased by TDF’s stance with LibreOffice. It is a native app, with separate ports for Windows, and Linux, and macOS. All run as native local apps, they do so entirely on your machine, and they do not attempt to save anything into “cloud storage” for you. Your software, your data, on your computer, on your premises. For us, that is how it should be. As The Register has also reported recently, TDF is also firmly against using MS Office file formats by default. We do see its point here, but there are pragmatic reasons for this. Despite this strong ideological stance, the LibreOffice 26.8 press kit included both LibreOffice’s native .ODT files, and also MS Office .DOCX files. We do keep a decade-old and unsupported copy of MS Word around on our Mac, although we rarely use it. So, from curiosity, we opened both – and this is what it looked like. In our personal subjective judgement, the MS Word version looks a lot better. Our copy of LibreOffice 26.02 was configured with a Microsoft-style Ribbon, and to be fair, the screenshot shows that older version, before we upgraded. It doesn’t look much different in the newer version, though. We like and recommend LibreOffice. There are alternatives for Linux users: we compared OnlyOffice and WPS Office a few years ago. WPS Office is freeware, rather than FOSS, but it works. The Chinese edition of Ubuntu Kylin included it in place of LibreOffice. OnlyOffice is based on cloud tech, but you can run it locally… and for cloud-based stuff, as well as OnlyOffice and Collabora Online, there’s the new EuroOffice from Nextcloud. If you don’t mind paying, or if you’d prefer a European-made office suite, then there’s Softmaker Office. But LibreOffice is right here, it’s completely free, and it works well. We like the local-first stance and we like the AI-free stance. Version 26.8 has multiple improvements: improved internationalization, and support for different alphabets and writing systems. It’s available in 120 different languages. It has better paragraph and formatting handling, ARIA support for better screen-reader handling to improve accessibility, and much more. It really is all good. We regularly write that it’s a very good idea for Microsoft Office users to keep it installed just in case – it is much better at recovering damaged Word, Excel, and Powerpoint files than their native apps. As we also regularly point out, anyone who still has OpenOffice installed should remove it and replace it with LibreOffice as soon as possible. OpenOffice is still available, but as Dedoimedo found on 26.8’s day of release, you really should not use it any more. Saying that, we’re concerned about TDF positioning itself as a rival to Collabora, rather than – well – collaborating with the company which provides more LibreOffice developers than any other external contributor. TDF has long offered two branches of LibreOffice: an older stable branch, for business users, and the current version, which gets relatively frequent minor updates. For us, the pragmatic position would have been for TDF to offer the current version, and direct business users to Collabora for the slower-moving stable release… but when we suggested this idea to TDF’s representatives, they treated the idea with scorn. The future remains uncertain. In a business world embracing “AI”, focusing on cloud apps, plus the lucrative new sovereign cloud movement, LibreOffice looks a bit old and dowdy. But it’s a vital tool.Traditional local-first tools like LibreOffice aid reusing old computers rather than replacing them. Ignore the “thought leaders” – the world needs LibreOffice more than ever. ®

The Green Party of England and Wales wants the government to end the blanket designation of new bit barns as “critical infrastructure” and change planning rules to stop such facilities taking precedence over households for water and energy. The current UK government designated datacenters as critical national infrastructure (CNI) back in 2024, putting them on the same footing as essential services such as water and power. This made them eligible for special protection, but may also make it easier for developers to overcome any local objections to their construction, as The Register pointed out. The Green Party claims that CNI status means that server farms are prioritized for access to water and energy, even when ordinary households are hit with drought restrictions, as over 27 million people currently are in England. It wants to see planning permission for new facilities granted only when the developer can show it will meet the highest environmental standards, and there has been full community consultation. “We need to slam the brakes on the rampant building of new datacenters which could put our communities at risk of water shortages and drive up energy bills – and yet are currently being waved through by our government,” said Green Party leader Zack Polanski. “Data should serve people, not the other way around – but right now, because datacenters are designated as critical infrastructure, people come a poor second, with datacenters even being given priority for water and electricity.” “We need clear criteria to distinguish between datacenters vital to national security or public services, and those that simply serve private tech companies and private profit,” Polanski added.  There was certainly talk earlier this year of prioritizing "strategically important" grid connections, which would include data campuses, and a report published by the London Assembly late last year highlighted the pressure on the power supply in the capital, with some areas of West London having to put a hold on new housing developments. On the water side, MPs were warned earlier this year that official forecasts of England's future water needs excluded datacenters, despite the growing number of them, and that they could end up competing with homes and businesses for supply. The Green Party claims that a single large-scale datacenter can use around 1.5 million liters (396,258 US gallons) of water per day, comparable to the daily water needs of a town of around 10,000 people. Yet bit barn construction is projected to expand rapidly, with growth often concentrated in areas already classified as water-stressed, like London and the South East. But water consumption can vary, depending on the cooling systems in use at specific facilities. In theory, newer campuses should require less water, especially if they are deploying AI infrastructure that uses so-called direct-to-chip cooling, where fluid is circulated through a closed-loop system. A government spokesperson told us: “A pause on building new datacenters would simply send investment and good jobs abroad, while leaving Britain dependent on overseas computing for the processing of sensitive health and defense data. Put simply, it would be a disaster for jobs and national security.” However, the spokesperson added: “This does not mean a blank cheque for Big Tech or that every datacenter should be approved. Developers should prioritize clean power, use water responsibly, create British jobs and supply chains, and provide investment to the communities in which they are built." The Green Party is also calling on the government to urgently develop a comprehensive national strategy for AI infrastructure, as the country is currently dependent on foreign-owned infrastructure for critical services, from healthcare to public safety – something the Institute for Public Policy Research was warning about just this week. ®

The former Defense Intelligence Agency (DIA) IT specialist previously accused of trying to pass secret and top-secret information to foreign spies has pleaded guilty following a successful FBI sting. Nathan Vilas Laatsch, then 28, and now 29, was arrested in May 2025 after an undercover FBI agent caught him for the second time transmitting intelligence packages in a public park that he believed would be collected by a foreign government’s spy. The man, who had been employed at the DIA as a civilian employee since 2019, held top-secret clearance, and in March 2025 offered to transmit classified information to an overseas administration. The identity of this country has never been revealed, but court documents [PDF] describe it as “a friendly foreign government.” Laatsch was assigned to the DIA’s Insider Threat Division in “spring 2025,” a unit dedicated to identifying government workers who were likely to leak, or already were leaking, classified information to foreign powers. According to the Justice Department, the FBI “became aware” of Laatsch’s offer in March. The man’s initial email, sent from a newly created account, had the subject line: “Outreach from USA Defense Intelligence Agency (DIA) Officer.” The email introduced Laatsch, his role at the DIA, and the service he was willing to provide. According to the complaint, Laatsch served in a technical role in support of the DIA's internal Officer of Security (SEC). Among other things, his duties included "enabling user activity monitoring on individuals with access to DIA systems, including individuals who are under investigation" and "assisting external partners, such as law enforcement, on the use of insider threat tools." “I am willing to share classified information that I have access to, which are completed intelligence products, some unprocessed intelligence, and other assorted classified documentation,” the email stated. The email included a picture of his government ID used to enter and exit his Washington, D.C. workplace, with name and image redacted, and a username associated with an encrypted messaging platform the recipient could use to continue the conversation. Soon after Laatsch’s email was intercepted, the FBI instigated an undercover operation to trick the IT bod into thinking that he was talking to a genuine spy. The feds’ efforts were not immediately successful. Agents replied on March 23, saying: “Good afternoon, I received your message and share your concerns. We are glad you reached out. I look forward to your response and learning more about your work.” Laatsch did not respond until April 14, after the FBI sent a follow-up via the original email address on April 4. Following additional conversations, in which Laatsch described what information he was offering to the "foreign spy," on April 28, 205, Laatsch entered his office and within 20 minutes began accessing classified information. Prosecutors said he spent much of the entire workday writing on a physical notepad while intermittently looking at his computer monitor, hiding the notebook when coworkers walked by. “The defendant wrote multiple pages of notes, which he then removed from the notepad at his desk and folded into squares,” court documents state. “At the end of his workday, the defendant bent under his desk, placed the folded papers into his socks, and departed the office.” Laatsch repeated the same behavior on April 29, and again on April 30, only this time placing the paper squares in the bottom of his lunchbox. The next day, the IT specialist followed FBI instructions on where to dead-drop the thumb drive - onto which he had transposed state secrets - in an Arlington, Virginia park. Although he believed he was leaving the device for a foreign spy to collect, the FBI instead gathered Laatsch’s deposit and found nine typed documents, eight of which contained information classified as top-secret and contained sensitive compartmented information. Court documents confirmed that the nature of the files Laatsch transmitted included sensitive methods of intelligence collection, intelligence related to foreign military exercises, and analysis of the impact of those military exercises. These were chosen entirely by Laatsch, who had not received a brief on what files to collect from the FBI. In exchanged messages, Laatsch stated he chose the files based on assumed interests. The device also contained a note from Laatsch personally. In it, he said he hoped the initial tranche of files would serve as proof of the type of information to which he had access. Laatsch, whom prosecutors described as an individual who had become disenfranchised with the current administration, also expressed his willingness to accept citizenship in the foreign nation. Further, he said he was “not opposed to other compensation,” but was not in need of financial or other kinds of material rewards. In the interim, Laatsch messaged the "spy" with additional details about how internal investigations are carried out at the DIA, the common “stupid mistakes” made by those under investigation, and that they “should not be too difficult” for him to avoid. The undercover FBI agent arranged a second intel drop for the following month, to which Laatsch agreed. According to the plea agreement, between May 15 and May 27, Laatsch would enter his workplace, log into his classified system, and spend most of the day transcribing classified information by hand into a notebook. He repeatedly folded up the pages and placed them in his socks before leaving at the end of the workday. The FBI arranged the second intel drop for May 29, 2025. It instructed Laatsch to instead head to a specific picnic table in the same Arlington park and electronically transfer the files from his personal computer while situated at the picnic table. Laatsch agreed, executed the transfer to the FBI-controlled address while sitting in the park, and was arrested on the spot. The man waived his right to an attorney and admitted to the offenses when questioned by FBI agents. “By his own admission, Laatsch betrayed his oath by offering classified information to a foreign government, the very thing he was supposed to prevent as an employee of DIA’s Insider Threat Division,” said Roman Rozhavsky, assistant director at the FBI’s Counterintelligence and Espionage Division. “Those entrusted with our nation’s most sensitive information must not exploit their access for personal gain - in this case offering to sell American secrets to buy foreign citizenship. The FBI and our partners will continue to hold accountable all those who betray the trust of the American people.” Laatsch’s plea agreement [PDF] recommends a sentence between 11 and 18 years, including time served, although the court is able to issue a maximum sentence that includes a life term and a $250,000 fine. ®

It looks like the Racoon has bedded in and settled down, as Canonical releases the first point release of this year’s Ubuntu LTS version, offering an upgrade to users on Ubuntu 24.04 LTS (Noble Numbat). Ubuntu 26.04.1 is the first point release of April’s long-term support version, which will be supported until 2031. Assuming that it follows the pattern of previous Ubuntu LTS releases, 26.04.1 will be followed by four further point releases – usually, the final release comes a little while after the following LTS release. That means Ubuntu 26.04.5 should arrive some time after Ubuntu 28.04 - meaning in or around September 2028. It’s accompanied by most of the remixes releasing matching point releases: Kubuntu, Ubuntu Budgie, Lubuntu, Ubuntu Kylin, Ubuntu Studio, Xubuntu, Edubuntu, and Ubuntu Cinnamon. Notably, two flavors are missing from this list. There are 10 official flavors but only eight point releases lists. There was no official 26.04 release of Ubuntu MATE. Maintainer Martin Wimpress has stepped down – he has a new project called Nøughty Linux he’s working on instead. There’s not much to see on the website yet, but if you’re curious, his talk at the 2025 Ubuntu Summit will give you a taste. Ubuntu Unity isn’t in that list, either. That remix missed the 25.10 release cycle because lead developer Rudra Saraswat – whom we first talked to in 2022, when he was 12 – is at university. The good news is that some developers did step up to help and there is an Ubuntu Unity 26.04 release. It replaces a bunch of subcomponents of the previous version, though, and that means it’s officially not an LTS release. Ubuntu Unity users should be aiming for the 26.10 release instead. This first point release has a few consequences we can expect. One is that for LTS users, it’s upgrade time, if you are planning on trying to stay current. Canonical does not start offering new version upgrades to LTS users until the first point release. Now that Raring-point-one is here, people running Ubuntu 24.04 “Noble Numbat” will start to see offers to upgrade to the new version. This applies to those running their Ubuntu servers as pets, rather than herding them like cattle. One of the things that really crumples the cardigans of hardcore Debianisti is that Canonical inserts messages into the output of the apt command. So the upgrade offers won’t be limited to graphical desktop users. Another consequence, albeit less concerned with any of the official flavors, is that System 76’s Pop!_OS 26.04 is expected soon. The company said on LinkedIn that they were aiming for an end-June release date. That didn’t happen. The team is certainly hard at work. Its in-house COSMIC desktop hit version 1.0 in December last year, and earlier this week, it released COSMIC version 1.7.0. That means that the next Pop!_OS will now use Ubuntu 26.04.1. The Reg FOSS desk is becoming quite fond of COSMIC and Pop!_OS, after a fairly shaky start. It feels quite a bit faster than Ubuntu itself, and on our newer testbed laptop – a 2018 Dell XPS13 – it’s not only very fast to start, but its ability to change the screen DPI on the fly is very handy. On older kit, it can make effective use of NVIDIA GPUs that the official binary driver can no longer use on modern kernels, although we have seen it freeze up quite a few times on those 10-15 year old machines. COSMIC is new and it’s developing faster than any other desktop in the Linux world. The team has ambitious plans for “Epoch 2” and beyond. At the rate they’re moving, perhaps Pop!_OS 26.04 will come with COSMIC 2. ®

Veteran Microsoft engineer Raymond Chen shared another fireside tale – one to strike fear into the hearts of engineers everywhere: the bug that can't be replicated in the debugger. The story begins near the end of the Word 97 release cycle, when a defect surfaced in the test labs but vanished the moment engineers reached for a debugger. It was maddening. A script could trigger the crash fairly reliably, yet the instant anyone tried to hunt it down, the bug ducked out of sight. Chen recalled: "The development team was very anxious, because a bug that appears only sporadically in the lab is going to occur regularly in the wild. But how do you debug a problem that resists debugging?" It is every developer's nightmare, even for those smug types who lean back in their chairs and tell testers "works alright here, mate." There is a special place reserved in the afterlife for these developers. With the bug refusing to cooperate, talk turned to an ICE (an In-Circuit Emulator, not the immigration agency), which could stand in for the CPU and allow breakpoints inside the emulated chip itself. "To most software developers," said Chen, "in-circuit emulators existed only in myth, and the possibility of acquiring one and using it was met with the excitement of a five-year-old boy who learns that he might get to ride on a fire truck." Eventually the team traced the problem to a specific manufacturer, and from there to a CPU erratum. The compiler in use at the time had been updated to dodge the problematic code sequence. However, by then the toolset had already been locked. Swapping in a new compiler risked introducing fresh, unknown bugs, so that was off the table. The solution? Scour the binaries to find instances of the code that might upset CPUs. One was found. "To avoid introducing any new problems as a side effect of the fix, the team opted to do a binary patch to the binary to insert a nop into the offending code sequence." Word 97 introduced plenty of headline features. There was the arrival of Clippit (aka Clippy) and Visual Basic for Applications (VBA). And then there was a binary patch produced by determined engineers, which received far less attention. But without it, Word 97 could have been distinctly wobbly. ®

The IEEE is warning that China’s export controls on rare earth minerals could start to impact datacenters, as shipments of some key materials are down 75 percent and Beijing is due to review its policies this November. The techie org's official publication, IEEE Spectrum, focuses on two rare earths in particular, erbium and yttrium, which are used in components for IT equipment. Exports of yttrium are down by about 75 percent this year in comparison with 2025. Yttrium was one of seven medium and heavy rare earth elements that China placed under mandatory licensing in its first wave of restrictions in 2025. Yttrium is used in white LED lights and displays, microwave filters, and solid-state lasers, and also in ceramic capacitors found in pretty much all electronic kit. Erbium is used in the amplifier circuits that boost optical signals in fiber-optic links. The Chinese government enacted restrictions on the overseas sale of rare earth minerals last April, as reported by The Register. This was part of retaliatory measures against the Trump administration’s slapdash trade tariffs. It upped the ante later in the year with tougher measures, including laws that require companies to apply for a license before they ship any goods containing rare earths sourced in China to anywhere in the outside world. This latter rule is a mirror of US laws like those used to block the export of ASML chipmaking equipment to China. That second wave of measures – which was to have included increased export controls of five new elements including erbium – was suspended in November 2025 for 12 months, following trade talks between the US and China. When the year is up this November, Beijing will decide whether to drop the tougher measures or re-apply them, perhaps extending them to all or most of the rare earth minerals it controls. According to the International Energy Agency (IEA), the supply of rare earths remains among the least geographically diversified among all critical minerals. For those minerals used in magnets, China accounted for about 60 percent of global mining output in 2024, and its dominance is even greater in the separation and refining stages, making up about 91 percent of global production. But for yttrium and erbium used in IT kit, China is effectively the sole source, IEEE Spectrum claims. The country mines 90 percent of the world’s yttrium, but it processes all of the world’s mined ore into an industrially usable form such as yttrium oxide, and likewise supplies all erbium oxide. Washington has been taking some steps to try and offset China’s virtual monopoly of key rare earth materials. Recently, the US Department of Defense announced a $750 million investment to secure supplies of rare earth elements for magnets from a production site in central Brazil, while the Department of Energy announced $500 million for seven selected projects to expand critical mineral and material processing, battery manufacturing, and recycling. The US signed agreements with representatives of 54 countries at the 2026 Critical Minerals Ministerial meeting in February this year, as well as talking up commitments to build secure and resilient supply chains for such materials. Also in February, President Trump launched Project Vault, a supply chain security initiative establishing an American Strategic Critical Minerals Reserve stockpile, with funding of up to $10 billion from the federal Export-Import Bank of the United States. But many of these initiatives will take time to have any impact, and China’s impending decision will put these to the test, should it decide to take a tougher stance. Relations between Washingon and Beijing remain strained because of trade and other factors, and a lot could be riding on a summit between President Trump and President Xi Jinping next month. ®

The Pentagon illegally blacklisted Anthropic as a national security threat based partly on things Claude couldn't actually do, a US federal judge has ruled. US District Judge Rita Lin found that the government illegally retaliated against Anthropic for speaking out, denied the company due process, and unlawfully branded it a supply-chain risk. In a 59-page ruling, she repeatedly picked apart the Pentagon's national security case and found some of its central claims about Claude "entirely unfounded." The dispute erupted in February after Anthropic refused to remove safeguards preventing Claude from being used for certain military applications, including fully autonomous weapons and mass domestic surveillance. At a meeting with Anthropic, Defense Secretary Pete Hegseth called Claude's capabilities "exquisite" and said the company's concerns were "understandable," but gave it three days to agree to "all lawful uses" or face being designated a supply-chain risk. Hegseth also floated invoking the Defense Production Act to declare Anthropic essential to national security and compel it to provide Claude. He then announced that Anthropic would be designated a supply-chain risk, while President Trump ordered federal agencies to stop using its technology. One problem: the Pentagon hadn't yet written the assessment explaining why Anthropic supposedly posed that risk. When that assessment arrived, it suggested Anthropic could interfere with Claude during military operations by altering or disabling models, allowing them to "drift," or introducing hidden biases or backdoors. According to the court, Anthropic couldn't actually do those things to Claude models already deployed inside Pentagon systems. Those models are static, and Anthropic cannot remotely access, modify, update, or disable them. The government didn't dispute that evidence, leading Lin to call the alleged danger "entirely unfounded." Years of government records also contained no previous Anthropic supply-chain concerns, said the judge's order. Lin said the chronology suggested the Pentagon assembled its case "after the fact to justify the foreordained conclusion." The government also did not behave as if Anthropic were an intolerable national security threat. Even after the designation was finalized, Under Secretary of Defense Emil Michael was still negotiating contract language with the company. "I think we are very close here," he wrote in an email. The government later continued working with Anthropic around Project Glasswing and its Mythos cybersecurity model. According to the ruling, the NSA and NASA began deploying Mythos, while senior White House officials held what Anthropic described as "productive and constructive" talks with CEO Dario Amodei. Lin instead found substantial evidence that Anthropic had been punished for publicly disagreeing with the administration. Her order cited Trump branding it a "RADICAL LEFT, WOKE COMPANY" staffed by "Leftwing nut jobs," adding that Hegseth spoke of its "Silicon Valley ideology." The Pentagon's own internal memo complained that Anthropic had behaved in an "increasingly hostile manner through the press." Lin said announcing Anthropic's punishment before the formal designation process had begun appeared designed to "make a public example of Anthropic for daring to criticize the Administration." The judge also rejected the idea that being a difficult supplier makes a company a security threat. "An IT vendor does not become a potential adversary of the United States whenever it asks probing questions," she wrote, warning against blacklisting companies simply because officials considered them "too arrogant or difficult to 'trust.'" The consequences went well beyond losing a Pentagon contract. Hegseth's directive sought to prevent Pentagon contractors and suppliers from doing business with Anthropic, even for work unrelated to defense. More than 100 enterprise customers contacted Anthropic with concerns about continuing to work with it, and the company estimated the measures could knock multiple billions of dollars off its 2026 revenue. Lin stressed that the Pentagon remains free to stop buying Anthropic's technology through lawful procurement processes. It couldn't, however, use a contracting dispute to punish a government critic. "The empty invocation of national security is not a blank check to punish and retaliate against government critics," she concluded. ®

Microsoft has dropped Windows 11 26H2 into the Windows Insider Release Preview Channel and released August's preview update. Windows 11 26H2 shares the same servicing branch as Windows 11 24H2 and 25H2, and many of the tweaks and updates that users are looking forward to have already appeared in the monthly Windows updates. The latest, the August Preview Update, includes such modifications as the long-awaited movable taskbar, more Start Menu customization, and the ability to drop web and Microsoft Store suggestions from local results in Windows Search. The update will turn up via an enablement package – a relatively small piece of code that switches on functionality already downloaded, but currently dormant. "Think of it as a switch rather than a full operating system replacement," Microsoft wrote. It's considerably more compact than a multi-gigabyte full download and reinstall of an operating system. Resetting the support clock The shared codebase and shared updates – Windows 11 26H2 will share the same release note KB identifiers as 25H2 and 24H2 – might have some users wondering about the point. One answer is support. For example, support for the Home and Pro editions of Windows 11 24H2 ends on October 13, 2026. Windows 11 26H2 resets this clock, with 24 months of support for Home and Pro versions, and 36 months for Enterprise and Education editions. Enterprises will still need to validate the new release. The servicing branch is the same, and if something works with Windows 11 25H2 and 24H2, it should work with Windows 11 26H2. However, Microsoft still recommends "testing with devices running recent versions of Windows 11 to confirm compatibility with your apps, policies, and infrastructure." Some organizations will have already done this, while others will have waited until the Release Preview milestone was reached. Microsoft took careful aim at its foot when it skipped the Release Preview stage and released the infamous document-destroying Windows 10 October 2018 update. It has been considerably more cautious in the years since. The move to Release Preview was accompanied by the August Preview Update, which included a raft of improvements, but was also greeted with dismay by some users complaining of problems with cursors and black desktop backgrounds following the installation. As far as Microsoft is concerned, it is not currently aware of any issues with the update. ®

CISA is still crying out for software vendors to adopt Secure by Design (SBD) development practices, and says in its latest review that longstanding vulnerability classes are still the most exploited. The agency examined soft spots across 2024 and 2025, finding that the majority of those that receive CVEs and make it to the Known Exploited Vulnerability (KEV) catalog belong to decades-old flaws that should have been addressed by now. Injection-related vulnerabilities, such as cross-site scripting (XSS) (CWE-79), OS command injections (CWE-78), and SQL injections (CWE-89) were among the most common across both CVE and KEV records in 2024-2025, CISA said. These were joined by bugs introduced by vendors that didn’t properly mitigate against improper input validation (CWE-20) in their code – the single most-common weakness type across the KEV catalog and registered CVEs. “Threat actors continue to succeed, in part, because simple, preventable software weaknesses remain unaddressed,” CISA said in the review. “Resolving fundamental issues would eliminate a significant portion of today’s most common compromises.” Readers may remember two MITRE reports that have been frequently referred to and revisited since being published years ago. Findings from a 2007 edition examining what the organization called “unforgivable vulnerabilities,” and another in 2023 referring to “stubborn weaknesses,” continue to crop up regularly in modern data. CISA said that in 2024, seven of the 10 most frequent CWEs seen on the CVE list belong to MITRE’s “stubborn weaknesses.” Equally, seven of the 10 most frequent CWEs seen on the KEV catalog, comprising 41.5 percent of all bugs on that list, were also stubborn weaknesses. And three of the top five KEVs also stemmed from unfixed holes, a finding that CISA said demonstrates “how reliably these weaknesses translate into real-world exploitation.” For reference, these three were improper input validation (CWE-20), path traversal (CWE-22), and OS command injections (CWE-78). The data from 2025 follows a similar pattern, CISA said: seven of the top 10 CWES were still those considered “unforgivable” in 2007. “Three of today’s top 10 CWEs would have been considered ‘unforgivable’ nearly two decades ago,” it said. “Their persistence today illustrates that the problem is not technical complexity: it is organizational culture, developer workflows, and systemic gaps in Secure by Design adoption.” For those who can’t remember the paper published 19 years ago, unforgivable vulnerabilities are those that exist because of common, well-documented mistakes, have an “obvious” attack path, the exploit is simple, and attackers can locate the bug in minutes. The same findings can be found in CISA’s Risk and Vulnerability Assessments (RVAs), the no-cost penetration tests the agency carries out on real organizations to improve their security and gain a richer understanding of the broader US cyber landscape. The assessments across both 2024 showed that memory safety and improper input validation vulnerabilities are the most reliable paths to exploitation, accounting for 16.7 percent of KEV entries in 2025. Injection vulnerabilities are also commonly seen in registered CVEs, although these are less commonly exploited in the real-world, especially against cyber-mature organizations. To tackle this pervasive issue, CISA is once again recommending organizations adopt SBD practices, eliminating the stubborn vulnerability classes that continue to support cyberattacks, decades after they were deemed too much of a lingering threat. It ultimately comes down to vendors helping defenders to shoulder less of the security burden. Instead of releasing patch packages that continue to swell to record sizes, just build the software responsibly in the first place. In CISA’s view, this means “owning security outcomes” for customers, killing off the so-called stubborn and unforgivable weaknesses, and improving the automation of configurations, monitoring, and updates. Software buyers should only choose vendors that meet these requirements, and ensure they have software bills of materials (SBOMs) in place to track supply chain risk. “Organizations must shift from reacting to threat actors to fixing the fundamental flaws those actors are known to exploit,” said CISA. “Stronger cybersecurity begins with software that is secure by design. “It requires prioritization of vulnerabilities and collaboration across industry and government. Finally, it demands leadership attention to understand cyber risk as a business risk, a national security threat, and an impediment to operational resilience.” ®

OpenAI has gathered more than 100 of the world's biggest tech and infosec companies to warn that cyber defense is in trouble - a reassuring development given quite a few of them helped build the technology involved. The open letter has more than 100 names attached to it, including many of the companies with the most to gain – or lose – from what happens next. OpenAI, Anthropic, Google and Microsoft are among the AI builders warning about increasingly capable AI attacks, while security heavyweights including Cloudflare, CrowdStrike, Fortinet, and Palo Alto Networks have also signed on. AWS, IBM, Oracle and Cisco are there too, alongside banks, consultancies and other companies whose businesses depend on keeping an increasingly messy technology stack running. Together, they have reached a troubling conclusion: the current approach to cybersecurity isn't working. "We have a limited window to strengthen cyber defenses," the letter warns, predicting that AI-enabled attacks will become "far more widespread and sophisticated" in the coming months as models become more capable. Hospitals, water treatment plants and internet infrastructure are singled out as being at risk. It's an interesting warning given who's making it. Some of the signatories are racing to build ever more capable AI systems, while others make billions selling the cloud services, enterprise software and security tools that are supposed to keep attackers at bay. Still, the underlying problem is real enough. The letter points to old vulnerabilities, unpatched software, misconfigurations and weak authentication as problems that have been piling up for years, particularly across critical infrastructure where security teams are often short on money and staff. Their proposed solution is, inevitably, more AI. The letter calls for cyber-capable models to be put into the hands of more defenders, with cheaper models handling security work at scale and frontier systems reserved for harder problems. Security vendors should continuously test their defenses against frontier AI capabilities, share threat intelligence and help critical infrastructure operators deploy AI-powered defenses. Governments, meanwhile, are asked to fund cybersecurity for essential services, expand trusted-access programs and give hospitals, water utilities and local governments access to capable defensive AI. Companies developing frontier models have their own homework assignment. They should provide "responsible model access, significant funding, training, and hands-on support," particularly to under-resourced critical infrastructure operators, while investing in testing, vulnerability disclosure and tools that make AI agents traceable. What the letter doesn't include is any figure for that "significant funding," or any deadlines or firm commitments from the companies signing it. For now, they're being asked to bring the "full weight of their technology, resources, and expertise" to the problem. It's quite a message from a group that includes some of the biggest names in cloud, enterprise software, and cybersecurity. When more than 100 companies agree that "status quo security won't be enough," it's worth remembering that many of them have been selling that status quo for years. There is some urgency behind all this. AI agents have already been shown finding and exploiting vulnerabilities on their own, while AI-generated exploit code has started turning up in attacks against critical infrastructure. As the models improve, the fear is that those capabilities become cheaper and available to a lot more attackers. That's the "defenders' window" the signatories want to seize: use AI to shore up defenses before the offensive side gets much easier. So, after years of selling organizations cloud services, security software and, more recently, AI, the industry has settled on a fix for the looming AI security problem: better cybersecurity, more resources and more AI. Who will pay for it remains rather less clear. ®

Microsoft has pushed back detection and question answering by the Teams Facilitator to November, after initially scheduling General Availability for June. Teams Facilitator is an AI assistant that joins meetings. It tracks agendas and can take notes, if enabled. The next stage in its development is to have it pop up and answer questions if it detects a knowledge gap. For example, somebody might ask "What is this Teams Facilitator thing?" and, if nobody answers, Facilitator will show a prompt offering to find an answer. It sounds like a marginally more irritating version of Clippy, and getting it into a state where it is declared generally available has proved difficult for Microsoft. When Microsoft added the capability to its roadmap in April, the expectation was that it would roll out in June. Then July. Then August. Then September. The latest update schedules it for a targeted release in November and worldwide general availability in mid-December. It is unclear why the feature is being delayed. It might be that determining whether a lull in conversation actually signals a question needing an answer is trickier than expected. Or it could be that whatever a search turns up doesn't make sense in the context of the meeting. The Register asked Microsoft to explain the holdup, but the company has yet to respond. There are some privacy implications around the feature, although it is worth noting that Facilitator must be included in the meeting, and removing the assistant will stop the behavior. According to Microsoft: "The feature processes meeting conversations in real time to detect knowledge gaps and generate responses," which indicates extra data processing and, of course, AI capabilities are required to generate responses in the correct context. That said, the premium edition of Microsoft 365 Copilot is required, so the data privacy ship could have likely long sailed. Also, if web search for Copilot is disabled, there won't be any responses anyway. Still, having to wait a few more months before a perky virtual assistant chimes in with "it looks like you're having a heated debate about the benefits of AI. Would you like some help with that?" is probably no bad thing… ®

OPINION It wasn't that long ago, like earlier this year, that AI leaders were doing their usual pie-in-the-sky proclamations of how everything would be so wonderful with AI. Anthropic CEO Dario Amodei tweeted that AI "will actually be possible to cure most human diseases in ~5-10 years." While on a podcast, OpenAI CEO Sam Altman proclaimed that AI would create "the greatest boom in people starting smaller businesses that we have ever seen." So, what's not to love? Well, you see those same AI CEOs/cheerleaders have also been tactfully admitting that AI isn't all that safe. Altman, for example, recently admitted, "model capabilities were outstripping the pace of safety and alignment." Meanwhile, Amodei also said, "I worry that biology will have a strong attacker-defender asymmetry, where sufficiently capable models may be able to quickly weaponize pandemic-level viruses with widely available materials." They're not the only AI boosters who are having second thoughts. Earlier this year, Bill Gates, who needs no introduction, described himself as an AI optimist. Eight months later, he's singing a different tune. Now Gates worries that AI could become “the worst source of injustice," and that current policy is putting the world on a course with “a very high chance of a net negative outcome.” Gates lately pronounced, "If the world takes the right steps, AI will be a force for good and leave everyone better off." But "right now we are not preparing for it. I don’t see evidence that leaders, experts, and communities are confronting the challenges adequately." What is certain is that AI companies are saying they're doing things to make AI safer. For instance, OpenAI recently introduced ChatGPT for Teens to protect teenagers from content about suicide, self-harm, and sexual chat. Yeah, good luck with keeping teens from inappropriate materials. It didn't stop me when our idea of racy stuff was Playboy magazine; it won't stop today's teens. Besides, as my colleague Mike Elgan wrote, "the teen version of ChatGPT is an admission of guilt … [OpenAI] knows which features and attributes cause brain rot, addiction, and attachment — and… it knows how to turn them off." It won't turn them off, though, because "brain rot is profitable." Who am I to argue? Grok, despite protests from Elon Musk, is still getting into legal hot water for its use in deepfake porn. A German survey found 30 percent of people admitted to using AI for sexual purposes. As the song goes, "the Internet is for porn," and so is AI. Of course, Mike assumes OpenAI can turn off its objectionable output. I'm not so sure. ChatGPT for Teens makes safety promises, but there's no evidence that its age checks, guardrails, alerts, or learning features actually work. As the International Scientific Report on the Safety of Advanced AI states, "Several technical approaches can help mitigate risks, but no currently known method provides strong assurances or guarantees against harm associated with general-purpose AI. Besides the damage AI can already cause, the rise of AI agents, with their power not merely to answer questions but to carry out multistep tasks using browsers, code repositories, and databases, opens endless new possibilities for damage. The 2026 International AI Safety Report warned that agents pose heightened risks because they can operate on their own without any human intervention. That means they can be used for fraud, misinformation, privacy violations, biased outcomes, and even attack other models. Is this great or what? Let's talk The US government has invited OpenAI, Anthropic, Google, and Meta to White House meetings this month to discuss voluntary government safety testing of the most advanced AI models before they're released. But who thinks the same people who want to invade Greenland can possibly have anything worthwhile to say about AI safety? The only thing more dangerous than uncontrolled AI is AI under the control of the technically clueless. Now, there are some efforts to make AI safer that I feel more sanguine about than political fumbling. For example, Nvidia and the Linux Foundation-backed Open Secure AI Alliance have proposed a framework, Shared AI Findings Exchange (SAFE), for confidential sharing of agent-related cybersecurity incidents and near misses. This is still in the request for comments stage, though. It's far from an actionable policy. We're too slow. The AI we have today is more than dangerous enough. For years, disputes over AI safety have often been divided into two camps: Those focused on near-term harms such as discrimination, surveillance, job loss, and misinformation, and those warning of far-future scenarios in which highly capable systems evade human control. Tomorrow is here. That division is narrowing. Gates worries that we face three major problems. Many jobs will disappear forever; AI will empower people (and perhaps AIs) to do more harm; and AI could stunt our kids’ development and replace human relationships. I always used to say that the only thing that Gates and I agree on is that we both like Shih Tzu dogs. Now we agree on the dangers of AI too. The question is no longer how quickly AI can transform society. It's increasingly whether society or AI companies can build the technical safeguards, economic protections, and public institutions necessary to keep up with it. Gates asks US leaders "to act now, before unemployment rises sharply, communities are hurting, and public trust has eroded. You can make sure that your government handles the problem holistically, rather than divvying it up into multiple bureaucratic fiefdoms. You can make sure AI benefits everyone. And you can work with other governments to meet this national and global challenge." Bless his optimistic heart. Under the Trump administration, that simply won't happen. Brace yourselves, folks. We're in for a heck of a ride. ®

UK businesses say the market power of Big Tech is stifling competition, and will hinder the UK’s ability to reap the benefits from AI, a key part of the government’s plans for economic recovery. A report [PDF] from the Institute for Public Policy Research (IPPR) points out that a handful of companies hold almost total control over the digital infrastructure relied on in Blighty, and warns that we risk letting AI become monopolized in the same way unless more pro-competitive measures are introduced. A survey conducted for the report found 79 percent of UK businesses relying on digital platforms are concerned about Big Tech using their dominance to limit competition. They rank this as a bigger constraint on their growth than access to finance or talent, according to the IPPR. So we are in no doubt about which tech giants are being referred to, the report points out that Google handles more than 90 percent of UK internet searches, Microsoft and AWS each control 30 to 40 percent of customer spending on cloud services (Google takes another 5 to 10 percent), and Microsoft is also being investigated for its dominance in business software. The report is highly critical of the UK’s official market regulator, the Competition and Markets Authority (CMA), almost accusing it of allowing the global tech giants to maintain their dominant position in Britain’s technology market. “Over the past two years, senior officials have resigned or been sacked from the CMA, and in interviews they describe a collapse in ministerial support for their work. In 2025, the government explicitly asked the regulator to prioritise inward investment (DBT 2025), which was widely interpreted as a call to go easy on ‘big tech’. And subsequently, multiple investigations have led to voluntary commitments rather than binding rules, despite evidence of harm,” it states. As The Register reported earlier this year, the chair of the CMA’s cloud inquiry quit, citing the glacial pace of implementing reforms and saying the independence of the agency was at risk. This came just weeks after the CMA appointed Doug Gurr, a former Amazon veteran, as permanent Chairman at the agency. In fact, the IPPR recommends the government develops an updated strategic steer for the CMA, to encourage it to be more proactive, rapid and bold in its enforcement. Greater emphasis is needed on interventions that genuinely boost growth, it claims, saying the CMA has so far done little to create conditions where competitors thrive, even though these conditions may deliver growth and sovereignty. The report warns the stakes are becoming even higher with the rapid growth of AI. The technology is central to the government’s plans for future growth, as laid out in the AI Opportunities Action Plan, introduced at the start of last year. But UK investment in home-grown AI firms risks being undermined when they depend excessively on infrastructure controlled by overseas technology giants, the IPPR says. The AI industry is already highly concentrated, with Nvidia dominating the accelerator market, and the hyperscalers largely controlling access to AI infrastructure via their cloud platforms. Microsoft, Google and Amazon have collectively invested in excess of $20 billion in the major AI developers, causing the CMA and the US Federal Trade Commission to flag these partnerships as a risk. If AI ends up becoming a monopoly (or oligopoly), the UK’s leverage will likely be tiny and its financial returns constrained, the IPPR says. “Big tech dominance is holding back British businesses, limiting competition and making it harder for new firms to innovate and grow,” claims IPPR senior research fellow and report author Roa Powell. “The CMA has the expertise and the tools to improve competition, what it needs now is clear political backing from government to act boldly,” she added. Alas, MPs have already warned Parliament that the UK has no "coherent strategy" for creating sovereign capabilities across a range of technologies, including AI, space, and quantum computing. And as The Register reported last year, experts believe it is now close to impossible for European firms to escape the clutches of the US cloud giants. In response to the IPPR claims, a CMA spokesperson told us: “The CMA has not waited to act. Since the digital markets regime came into force 20 months ago, we have made 3 strategic market status designations, implemented targeted, impactful interventions in Google search and secured meaningful improvements to Google and Apple’s mobile ecosystems. "We continue to progress interventions in both search and mobile ecosystems. We also have an investigation into Microsoft’s business software ecosystem underway - which includes cloud licensing practices and AI-enabled products - at a time where these are becoming critical for the UK. “Our interventions are already opening up opportunities for thousands of UK businesses, giving them greater choice, fairer access to customers and a stronger ability to compete and innovate in markets that have long been controlled by a small number of powerful global firms, and there is more to come.” ®