• Boeing receives $12.68 million investment to update the MQ-25's RF blanker, encrypted storage, and mission computer security, running through November 2029
• The change is a recent one: the Navy's April 2026 acquisition report lists refueling as the MQ-25's primary mission and intelligence, surveillance, and reconnaissance (ISR) as secondary, with no electronic warfare requirement and only two key performance parameters
• An RF blanker is electromagnetic compatibility hardware that stops an aircraft's own transmitters from deafening its receivers, allowing it to conduct EW more effectively

A single line buried in a recent US Department of War contract announcement is being read across multiple channels as the Navy's first carrier-based drone acquiring multiple electronic warfare upgrades.

The details, however, seem to focus on the defensive side of the spectrum and include a Radio Frequency Blanker Unit and an updated Encrypted Mass Storage System carrying an embedded Data Transfer System.

The modification also provides an option for deficiency analysis and corrections, supporting security assessments of the aircraft's Mission Management System Computer.

Why do these upgrades matter?

The most important upgrade for the MQ-25 Stingray, arguably, is its RF Blanker. An RF blanker is electromagnetic compatibility equipment. When an aircraft carries several transmitters and sensitive receivers within a few meters of each other, a transmitter firing at full power can deafen or damage a nearby receiver operating in an overlapping band.

A blanker fixes that by taking a blanking request from each transmitter and issuing a suppression pulse to the affected receivers for the duration of the transmission, as GE Aerospace describes. For a drone that could also house sophisticated EW capabilities in the future, this is essentially a prerequisite.

The Navy's Modernized Selected Acquisition Report dated April 21, 2026, offers a relatively narrow scope for the drone for now; however, it states that the MQ-25 conducts aerial refueling as its primary mission and provides Intelligence, Surveillance, and Reconnaissance capability as a secondary mission.

It is fairly possible that the upgrades are purely defensive, to prevent rogue players from accessing the drone or knocking it offline with relative ease. In its current capacity, the MQ-25 serves as an unmanned aerial refueling drone for the US Navy, offering capabilities including the ability to carry roughly 14,000 to 16,000 pounds of fuel at a combat radius of 500 nautical miles.

This could change even as the US continues hardening its EW offerings and prepares for potential hostile actors to have the same capabilities it currently harbors. For now, the $12 million invested in what is a $19 billion program is essentially a rounding error at the end of the day.

This sudden investment may signal more to come: Boeing has already pitched a land-based MQ-25 variant with external pylons and marketing language about ISR, electronic warfare, and airborne early warning roles, though the aircraft has no customer yet.

• A GAO report requested by Bernie Sanders lists Amazon among the top employers of Medicaid and SNAP recipients in every state that supplied employer data
• Amazon's capital expenditure guidance for 2026 has risen from $200 billion to $220 billion citing AI demand as a primary driver
• Amazon contests the findings, stating the rankings used do not account for the employer's workforce numbers

The Government Accountability Office (GAO) recently published a report claiming Amazon is among the largest employers of Americans who rely on food stamps and Medicaid.

The report, requested by US Senator Bernie Sanders, who is the ranking member of the Senate Health, Education, Labor and Pensions Committee, was released publicly on July 22 2026, a month after it was sent to the senator.

The study is not the first of its kind: the GAO published the same in October 2020 at the request of the same committee, though Amazon was far less dominant on the list at a cursory glance.

A report that paints a worrying trend, but fails to provide a complete picture

GAO collected employment records from 15 agencies across 11 states, all of them the same agencies that supplied the 2020 data, and asked for a snapshot of September 2025.

The office then estimated the 25 employers in each state with the most enrollees. The resulting document showed Amazon near the top of every list: It ranked second in five states for Medicaid enrollees, and second or third for SNAP recipients in six different states. Adding the state figures links the e-commerce giant's employee list to 11,338 Medicaid enrollees and 12,346 SNAP recipients.

The report does not, however, directly or indirectly address AI, data centers, or Amazon's Capex ambitions, or point to a particular trend as a snapshot of a single month of data, and it fails to draw a direct comparison with its 2020-based iteration.

It has drawn a sharp rebuke from Amazon, which saw its spokesperson, Rachael Lighty, tell The Washington Post that the company dealt in raw numbers rather than percentages, which was misleading, and CNN that eligibility "is based on total household income and family size, not individual wages or benefits," so an employer offering part-time work will naturally show more eligible staff.

This is something the GAO tends to accept, even in its own footnotes: a larger employer simply has more employees in play and is therefore more likely to be on that list, which is skewed against part-time individuals who are more likely recipients of those food assistance programs.

It does make for an interesting approach to the entire model, which Senator Sanders has pointed out shows "triple" the number on SNAP and Medicaid simply because Amazon's employment statistics have swung so wildly of late.

The e-commerce giant's global workforce went from about 798,000 at the end of 2019 to a peak of 1.61 million in 2021, and stood at 1,576,000 at the end of 2025, effectively doubling from when the report was originally published in 2020, potentially skewing results against itself due to a larger employee base.

The findings and the defense presented by Amazon, however, have not gone down well with certain quarters; Senator Sanders has called the trends "beyond unacceptable", stating that "American taxpayers should not be forced to subsidize the starvation wages of large corporations".

Much of Amazon's recent focus, including a significant increase in Capex spending, has been towards AI and AI-related infrastructure under its AWS arm. Amazon guided to about $200 billion of 2026 capital expenditure on its Q4 2025 call in February, up from $131.8 billion in 2025. On July 30, Andy Jassy raised that to $220 billion, blaming higher memory prices, and said Amazon would still not have enough capacity for the demand it is seeing.

AI data centers are increasingly a point of contention among AI juggernauts, hyperscalers, and less-eager locals bearing the brunt of higher water and power costs, even as availability becomes equally challenging.

For a company spending $220 billion on AI infrastructure this year and rolling out an $1 billion commitment in late 2025 to raise base pay for its US fulfillment and transportation workers, being at the top of multiple lists of states with workers being eligible for (and using) Medicaid and food assistance programs might not be great timing when there is increasing scrutiny of trillion-dollar corporations and their massive profit margins by consumers and jobseekers alike.

• TSMC reportedly holding roughly $1 billion of finished A20 Pro wafers that cannot be packaged because the DRAM they must be integrated with has not yet arrived
• The bottleneck exists because Apple moved the A20 Pro to TSMC's WMCM packaging, which bonds processor and memory at the wafer level, removing the option of stockpiling finished dies and adding memory later
• The launch is not expected to slip but could mean that post-launch inventory could be dicey, with thin stock and extended delivery estimates the likely outcome for Apple's upcoming devices

Around a billion dollars of finished Apple silicon is reportedly sitting at TSMC with nowhere to go, reports have claimed.

The wafers are processed, the yields are fine, and the chips cannot move to the next stage of production because the memory they need to be packaged with has not arrived.

The reason they cant be stockpiled for later use is a design choice Apple made with TSMC to use its Wafer-Level Multi-Chip Module (WMCM) process instead, an extension of the CoWoS packaging family adapted for mobile parts.

Trouble in smartphone chip paradise?

The reported delay was revealed by Tim Culpan, a Taipei-based semiconductor analyst, who says production of the A20 Pro on TSMC's N2 node is progressing well, with good volume and yields, but wafers are piling up waiting for DRAM before they can be packaged and sent onwards.

These chips will almost certainly power the next generation of Apple devices (probably the iPhone 18 Pro) but there might be a slight twist in the making due to design decisions made by Apple.

Memory shortages delay products all the time, but this one is worth attention because of what Apple changed about how it builds its processors.

For roughly a decade, TSMC packaged Apple's iPhone processors using Integrated Fan-Out, or InFO. Under that approach, the logic die containing the CPU, GPU, and Neural Engine is first fabricated and diced from the wafer, and memory is attached afterward, stacked on top of the finished die in a later assembly step.

The sequencing matters: a memory shortage under InFO delays final assembly but does not stop anything upstream. You keep fabricating logic dies, stockpile them, and attach DRAM when supply arrives.

The A20 Pro, as mentioned previously, uses TSMC's WMCM process instead, an extension of the CoWoS packaging family adapted for mobile parts. WMCM integrates the processor and DRAM at the wafer level, side by side, before either can proceed.

That reverses the sequence. TSMC needs the memory in hand to complete the package, and it cannot be added at a later step, which means Apple cannot bank finished dies against a memory delivery that has not happened yet.

There is a certain amount of irony here: Apple reportedly moved to WMCM specifically to fit more DRAM at lower latency for on-device AI features, since placing memory on the wafer improves both, but an AI-related memory shortage has stalled its progress.

The memory in question is LPDDR5X, and it is scarce because AI infrastructure buildout has absorbed the manufacturing capacity that would otherwise serve smartphones. Apple's on-device AI ambitions are being throttled by the datacenter version of the same ambition.

Culpan reports that Apple and its assemblers remain confident they can meet initial demand and that launch-day orders will be fulfilled without delaying the launch, though we might see thinner supply as a result of the delay.

Apple's exposure runs deeper on the other side of launch day: main logic board assembly and final assembly are largely handled by Foxconn and BYD Electronics, and late deliveries of packaged processors compress their schedules, even if Apple ultimately secures the memory.

The likely outcome is thin retail inventory, a fast preorder sellout, and delivery estimates that stretch out for weeks rather than a phone that does not exist. Apple reportedly plans to ship around 200 million units of the upcoming iPhone across the lineup over its lifespan, against an iPhone 17 range that surpassed 245 million shipments in 2025, so there isn't much room for error here.

Apple's usual LPDDR5X route runs through Micron, with SK Hynix and Samsung alongside, and an attempt to widen it fell over: a reported approach to Chinese memory maker CXMT, apparently aimed at cheaper pricing, did not produce a deal. Renegotiations with existing suppliers reportedly have not landed either, which leaves Apple paying whatever the current market asks. Whether it secures enough supply to avoid the thin-inventory scenario remains to be seen.

• Nvidia open sources its cuFile APIs and storage stack into a new GitHub organization with Google, Intel, and Meta as founding maintainers, and formally launched Storage-Next with 40-plus flash and storage vendors
• Nvidia's key unveiling is its SCADA framework, which moves the storage control path onto the GPU, allowing parallel GPUs to pull data directly from storage
• The driver is KV cache economics: inference fetches data in a few hundred bytes at a time, while SSD controllers tuned for 4KB spend the same effort on either size

Following the recent Future of Memory and Storage conference, Nvidia has argued that the next leap in AI rests as much on the storage feeding accelerated computing as on the silicon doing the computing.

The company open sourced its cuFile APIs and the storage stack beneath them, and formally launched an industry initiative called Storage-Next with more than 40 flash and storage vendors.

It also put a name to SCADA, the framework that lets GPUs pull data from drives without the CPU brokering every request.

A 512-byte problem that comes into focus as storage becomes key

Nvidia's approach here is not new. cuFile was introduced in 2019 as the interface component of GPUDirect Storage and has shipped since 2021; its role is to take the CPU out of the data path. Bytes move by Direct Memory Access (DMA) straight between the drive and GPU memory, with no bounce buffer in host RAM. What stayed on the CPU was the control path: host software still decided what to fetch and issued every request, with the GPU as the DMA target rather than the initiator.

That split is invisible at large transfer sizes. A one-megabyte read essentially amortizes the per-request cost. At 512 bytes, the ratio inverts, the fixed cost dominates, and the CPU saturates long before the drives do. SCADA is the piece that moves the control path onto the GPU, letting it construct and complete its own storage requests and absorb per-operation latency, just as it already absorbs memory latency by keeping hundreds of thousands of operations in flight. The two are complementary rather than successive: cuFile for bulk transfers, SCADA for high volumes of small random reads.

The problem it solves is one that enterprise SSDs exhibit, having been tuned around 4KB random reads for nearly a decade to match virtualization and databases. As a result, most controllers do the same amount of work to serve 512 bytes of data as they would a 4KB read request.

AI inference access patterns are considerably smaller than that: embeddings run a few hundred bytes, and the KV cache blocks sit well under a kilobyte. Serving them from 4K-tuned drives imposes something like eightfold read amplification, and at tens of terabytes of small objects, that amplification decides whether flash works as a memory tier at all.

The KV cache, essentially the attention state for every token already processed, grows with context length, and agentic deployments run thousands of concurrent conversations. It quickly outgrows GPU memory, and recomputing evicted entries costs more GPU time than reading them back, so the standard design spills from GPU memory to system memory and flash, and refills through high volumes of small random reads.

Serving that from flash rather than DRAM increases the context length and the concurrent user count each GPU can support, which in turn affects the per-user cost of serving a model. This also explains why Nvidia is focusing on 512-byte IOPS rather than raw bandwidth, since inference performance depends heavily on the former.

Opening up cuFile is a departure; this layer has historically lived inside CUDA, and the logic is not charity. A GPU-initiated storage interface only pays off if drive, controller and array vendors build to it, and vendors do not build to a proprietary interface owned by the company whose GPUs they are feeding.

Publishing the interface, open-sourcing the implementation, and convening 40-plus vendors to standardize the underlying hardware behavior is how Nvidia aims to make GPU-initiated storage the industry default. It also stands to benefit the most from that outcome, since it sells most of the GPUs in question.

StorageReview notes Intel's participation as a significant development; a leading supplier of the x86 silicon currently sitting in storage controllers has signed on to maintain software designed to remove that silicon from the I/O path. Google and Meta co-maintaining a layer that standardizes how accelerators reach storage, while building their own accelerators, points in the same direction.

Nvidia's take is a coherent, well-argued push at a real bottleneck, with unusually credible partners attached. Partner systems from DDN, Dell, HPE, IBM, VAST Data and WEKA are due in the second half of 2026. Kioxia's XL-Flash drives built for 512-byte access are in development under Storage-Next.

Nvidia's roadmap calls for Gen7 SSDs sustaining 100 million IOPS each, which is a target controller vendors are designing toward rather than a product anyone can buy. Storage-Next itself has been discussed publicly since GTC 2025; this week, it acquired both a membership number and a framework to build against.

• Cyberattack hits operational technology at more than 30 Minnesota community water systems, briefly taking treatment plant offline and forcing several towns onto manual operations
• A leaked WaterISAC memo obtained by WIRED relays a state fusion center assessment tying the intrusions to Iranian-affiliated hackers, but no US agency has formally attributed the attack yet
• The CISA had warned four days earlier that Iranian-affiliated actors were compromising internet-facing PLCs, repeating guidance that has mostly fallen on deaf ears

More than 30 community water systems across Minnesota were hit by a coordinated cyberattack, targeting the operational technology running pumps, wells, water towers, and wastewater lift stations rather than the office networks behind them.

Minnesota IT Services disclosed the attack on July 28 2026 and activated a statewide incident response, stating that it wasn't aware of any Minnesota city asking residents to change their drinking water use just yet.

A memo obtained by Wired, circulated by the water sector information-sharing group WaterISAC and carrying a restricted TLP: AMBER handling marking, relays a Minnesota state fusion center assessment that ties the intrusions to Iranian-affiliated hackers.

A warning that was more or less ignored

Four days before the attacks, CISA updated an advisory, AA26-097A, warning that Iranian-affiliated actors were compromising internet-facing programmable logic controllers made by Rockwell Automation, Schneider Electric, Siemens, and possibly others across the US water, energy, and government sectors. It documented confirmed disruptions and financial losses.

This drew no immediate response from state functionaries, and it is easy to see why: the US has tens of thousands of community water systems that serve small populations and lack budgets for dedicated cybersecurity staff.

This is despite there being a precedent: Iranian-linked actors hit the Municipal Water Authority of Aliquippa in Pennsylvania in November 2023, defacing a Unitronics controller with an anti-Israel message. CISA said at the time those devices were exposed to the internet with default passwords still in place. The advice issued then is the same advice being issued this week, which is telling about how little has changed since.

The WaterISAC memo, dated the day the attacks concluded, passes on a state fusion center report linking the activity to Iranian-affiliated actors. That memo was not meant to be public, but it has been corroborated by The New York Times and The Washington Post, which reported that they spoke to federal officials and US intelligence agencies, respectively, lending credence to the claims.

CISA later warned that attackers are changing PLC passwords to lock operators out of their own equipment, and repeated the advice that has been unchanged for years: get PLCs off the public internet and put remote access behind a VPN or gateway.

Who was affected?

The worst of the cyberattack hit Braham, a town of roughly 1,700 people, where the city said attackers shut down the operating controls, taking the water treatment plant and the well offline. Crews restored it manually within a couple of hours, and residents were told to minimize water use in the meantime.

Plymouth, a Minneapolis suburb of about 80,000, found the problem confined to equipment connected over cellular links at two water towers and several wastewater lift stations. Its IT division disconnected the affected kit from the network entirely to stop the attack and prevent retargeting during reconfiguration.

Maple Plain declared a local state of emergency to manage its response, and South St. Paul reported that some automated controls were compromised. In most cases, contingency procedures held and water and wastewater operations continued.

None of this is happening in a vacuum, however. The June memorandum that paused fighting between the US and Iran has broken down, and both are trading strikes, including recent US attacks near the Strait of Hormuz that destroyed a water facility and cut supply to more than 20,000 people. Whoever carried out the Minnesota attacks, the symbolism of targeting municipal water is unlikely to be accidental.

The damage that these intrusions caused was limited; they produced brief outages that trained staff fixed by hand. That is an outcome with a silver lining, and it depended on utilities having people who knew how to run a treatment plant without its automation, even if its digital defenses collapsed outright.

• Instructions hidden as white text in a Word document can make Microsoft 365 Copilot silently alter the file it is drafting and copy the instructions into the output
• Each poisoned document becomes a carrier, so the attack spreads through ordinary internal workflows without the original malicious file and needs no macros, malware, or code execution
• Microsoft has shipped two mitigations across a 144-day disclosure, including a model upgrade, and the attack was still reproducible by the researcher

A security researcher has published a proof of concept showing that instructions hidden inside a Word document can cause Microsoft 365 Copilot to silently alter the file it is drafting, then copy those same instructions into the finished document, so the next person to use it becomes a carrier too.

Håkon Måløy, a data scientist with a doctorate in applied machine learning, disclosed the technique as the third installment of his Context Collapse series, after a 144-day coordinated disclosure with the Microsoft Security Response Center.

The reason this is being reported ahead of a fix is that it still works despite multiple attempts by Microsoft, as he notes that no robust mitigation for the broader vulnerability class is currently available.

A clever attack designed around Copilot's approach to text

The underlying attack belongs to a family known as cross-domain prompt injection, or XPIA. An attacker writes instructions in a natural-language document, formats them as white text on a white background at a small point size, and shares the file.

Because Copilot for Word strips formatting before passing text to the underlying language model, the model reads text the human never sees. This is true even for documents that are not opened by the user on purpose: The attack can trigger either when a user manually attaches a document to Copilot or when Copilot, working in Work IQ mode, searches the user's OneDrive for relevant files and finds the malicious one on its own.

It is also more dangerous than other exploits because of one key element: propagation. The hidden prompt in Måløy's proof of concept had two parts. One instructed Copilot to alter the document being drafted, in his demonstration halving every financial figure in a quarterly report.

The other instructed Copilot to copy the prompt into the new document and conceal it, framed innocuously as source tracking and readability formatting. Copilot did both, appending the instructions in white text and mentioning neither action to the user.

The disclosure timeline is the most uncomfortable part of the report. Måløy reported to MSRC on March 6 2026. Microsoft confirmed the behavior on March 31 and shipped a first mitigation in early April via a reworked Edit with Copilot experience, which successfully blocked his original prompt wording. He reproduced the attack with different wording the same week, and a second case was opened.

The second fix, on July 14, consisted of upgrading the underlying model to GPT-5.5. Måløy broke it the following day using GPT-5.6, then voluntarily offered Microsoft a further two-week delay to attempt another mitigation. The class still reproduced on the disclosure date, indicating that although a fix is in the works, the exploit is still possible to run.

A complicated issue that lacks a proper resolution

The issue goes far beyond Microsoft Word: an AI assistant must ingest untrusted content to determine whether it is relevant or hostile. But the content enters the same context window as the system prompt and the user's actual request, so by the time the model evaluates whether the text is an attack, the attacker's tokens have already shaped that evaluation.

As Måløy puts it, "the content being inspected participates in the act of inspection."

Microsoft confirmed it had reviewed the findings in a statement to The Register but stopped short of indicating a timeline for a complete fix:

“We have addressed the findings reported by the researcher and thank them for working with us through coordinated vulnerability disclosure," the company said.

"To address this class of risk, we use a defense-in-depth strategy with safeguards that block malicious instructions at multiple points and help keep tasks aligned with users’ requests. We are continuously strengthening these safeguards as the technology and threat landscape evolve. We encourage customers to install the latest updates, use multiple layers of security protection, treat content from unknown sources with caution, and review AI-generated content before using or sharing it.”

Måløy's recommendations are to treat externally sourced documents as untrusted when using them with Copilot, review attachments before starting an AI-assisted draft, and review Copilot's output carefully before sharing or reusing it.

He also suggested that generated documents should carry provenance metadata that records source material and model edits, which would not prevent injection but would make an infection traceable after the fact.

With Copilot extending further into agentic products that create and manipulate documents with less human oversight, the scope of how exploits like this could affect workflows (and users) will widen rather than narrow, and a complete solution is not yet in sight.

• Kaspersky says empty web pages are watching you, and the research backs up the warning
• Over 90% of parked domains now send visitors somewhere malicious, and clearing your cookies will not help
• Blank pages are also a problem: many 'Coming Soon' placeholders are quietly fingerprinting your device

Kaspersky has unveiled a rather underreported attack vector which is increasingly being used by threat actors to harvest private data from unsuspecting victims: registered websites that are yet to be developed.

Its warning focuses on parked domains, the registered web addresses that have no real website behind them yet, arguing that the blank screens and "Coming Soon" placeholders users dismiss as harmless are frequently doing work in the background.

The company says simply loading one of these pages can trigger silent collection of a visitor's IP address, approximate location, User-Agent string and cookie identifiers, and that operators go further by building browser fingerprints through other techniques, then feeding the result into advertising networks to assemble targeted profiles without consent from users.

Browser fingerprinting sans the permissions

The mechanics Kaspersky describes are worth understanding, because fingerprinting is the part most readers will not have encountered, and the part that conventional privacy habits do not touch.

For context, a cookie is a file placed on your machine that you can delete, thereby limiting tracking. A fingerprint is not stored on your machine at all. It is derived from how your specific hardware and software combination renders a test image, draws 3D graphics, or processes an audio signal, producing a value distinctive enough to identify the same device across unrelated sites.

Browser fingerprinting, the method used to capture such data within a browser session, is attractive to trackers because it is considerably harder to shake off. A private browsing window prevents your machine from keeping a local record of the visit, but it does not change how your hardware renders the test image, so the fingerprint it produces remains largely the same.

Such domains can also cause more direct damage than selling one's information to advertisers. Kaspersky says threat actors embed scripts that bounce visitors onward to fraudulent platforms, adult content, or online casinos. It flags typosquatting as a particularly acute risk, in which a domain differing from a well-known brand by a letter or two can capture mistyped traffic, landing the user on a phishing page or triggering a drive-by download.

This isn't the first time the problem has been reported, either, as recent research from Infoblox finding that in large-scale experiments, over 90% of the time, a visitor to a parked domain was routed to illegal content, scams, scareware, antivirus subscription traps, or malware.

Kaspersky recommends several ways to mitigate the risk, including avoiding suspicious links, clearing cache and cookies after an unintended visit, and using software that blocks web tracking.

Clearing cookies is worth noting, though: it addresses the cookie identifiers Kaspersky mentions, but by the company's own explanation it does nothing about fingerprinting, because there is nothing stored locally to clear.

Parked domains, including blank pages that appear inert, are now a routine part of criminal infrastructure rather than digital litter and should be treated with caution. At best, you give away more information than you meant to. At worst, you become the victim of an attack you never saw coming.

• Cloudflare summary logs a typhoon, two earthquakes, power failures, and thirteen government exam shutdowns
• It also identified a fiber cut, drone damage to an AWS region, and a botched DNSSEC key rollover
• The report's sharpest finding is that Tanzania's accidental power blackout looked almost identical in the data to its deliberate election-day shutdown in 2025

Cloudflare has published its latest account of what recently knocked chunks of the Internet offline, and the list reads like a catalogue of everything that can go wrong at once: a typhoon, two earthquakes a minute apart, a national power failure, ten government shutdowns timed to school exams, a fiber cut, drone damage to a cloud region, and a routine cryptographic key update that briefly made every .de website in the world unreachable.

Drawn from traffic telemetry on Cloudflare Radar, it is a useful reminder that the systems most people treat as a utility are held together by a surprisingly small number of things.

With geopolitics in the Middle East shaping traffic in Iran, the UAE, Iraq and Sudan, Cloudflare found that not only did the former's traffic drop even after a shutdown ended two months ago, but the UAE seems to be one of the most affected by the on-again, off-again US-Iran conflict thanks to two AWS facilities being struck by Iranian drones.

An accidental blackout and a government shutdown look similar from the outside

Cloudflare's insights tend to make for an interesting read on how the connected world functions, often defying expectations about traffic, online activity, and user behavior, with the recent FIFA 2026 World Cup being an excellent place to start.

When it comes to the most severe disruptions, one would turn to Iran's approach, which cut off internet access during its conflict with the US, an engagement that also had ramifications for most of its Gulf neighbors.

Interestingly, Radar began picking up signs of restoration on May 26 2026, ending an 88-day shutdown that had left the country almost entirely offline since February 28, but it never reached peak pre-conflict levels.

By May 27, traffic had returned to 40% of pre-outage levels, consistent with reports that access was being reintroduced selectively. It has since climbed as high as 90% before settling at roughly 59% of pre-shutdown levels, suggesting that more stringent restrictions may be in effect even as the country grapples with a war that threatens to reignite at a moment's notice.

The most consequential item on the list, as a result of the conflict, is ironically the one that does not look like an Internet outage at all. HTTP traffic to AWS me-central-1, the cloud region in the United Arab Emirates, has remained low, matching AWS status reports at the end of April 2026 stating that the region had been damaged by the conflict in the Middle East and could not reliably support customer applications.

This followed earlier reports in March of physical damage to facilities in both the UAE and Bahrain caused by drone strikes, with two UAE facilities directly hit. It also highlights an interesting insight: A cloud region has become the sort of concentrated dependency that a submarine cable used to be, with the added complication of being a physical target that is much easier to locate than an undersea cable.

The longest single disruption came from Super Typhoon Sinlaku, the strongest storm of the 2026 Pacific typhoon season so far, which tracked through the Mariana Islands in mid-April and passed just north of Guam. The island avoided a direct hit, but tropical-storm-force winds knocked out power, disrupted water systems, and took connectivity with them. Traffic from the territory fell as much as 80% below expected levels on April 13 and 14.

Venezuela lost connectivity on June 24 when two major earthquakes struck northern Venezuela within roughly a minute of each other, at Yumare and San Felipe, followed by an aftershock near the coast outside Caracas, coinciding with a fall in traffic visible across Fibex Telecom, which serves an estimated 1.6 million users.

Three days later, a power outage in Tanzania produced a sharp drop in HTTP traffic lasting at least five hours, with Cloudflare drawing parallels to the country's election-related blackout in 2025.

Saint Lucia lost most of its connectivity on June 21 when traffic on Karib Cable's network fell to essentially zero by 21:00 UTC and remained flat for the better part of a day, reportedly due to a fiber cut near the island. Karib Cable is one of the largest providers there, so the loss was registered nationally, with the country's overall traffic falling by around 60% compared with the previous week.

In terms of a self-inflicted wound, Germany takes the cake: On 5 May, DENIC, the registry for the .de domain, performed a DNSSEC key rollover, the routine periodic replacement of the cryptographic keys used to sign a zone's DNS records, and the process began producing invalid signatures.

Because DNSSEC-validating resolvers only trust answers whose signatures match the current published keys, a mismatch is read as evidence of tampering, so resolvers worldwide rejected every .de lookup and returned errors until normal service resumed at 23:15 UTC. To users, it did not appear to be a cryptographic failure. It presented as German websites not loading, email bouncing, and apps timing out. It resulted in global .de query volume going up during the outage rather than down, indicating that users were, as a result, looking for ways to access said sites, amplifying the failure, at least statistically.

Taken together, Cloudflare's insights about the quarter are less a parade of exotic failures than a fairly consistent argument about concentration.

One registry's keys gate an entire national domain for the whole world. One provider carries enough of Saint Lucia's traffic to take the country with it. One cloud region hosts applications that have no idea they are under attack by a drone strike, causing unintended blackouts. The causes are both ordinary and extraordinary. It is the dependencies, however, that are extreme, making the case for redundancies worldwide.

• Nvidia's Olympus core architecture prioritizes single-thread IPC over frequency, using a 10-wide decode front end, deep out-of-order mid-core, and a graph prefetcher tuned for agentic AI's branch-heavy, pointer-heavy workloads
• Vera trades chiplet-style core density for a monolithic 88-core die and single-NUMA-per-socket design, a deliberate bet on agentic AI workloads that Nvidia's own engineers admit comes at the expense of legacy workload performance
• Self-reported SPEC CPU 2026 results by Nvidia paint a per-core advantage figure of anywhere between 70% and 80% versus AMD's EPYC 9755 server CPU

Nvidia's Vera CPU has a lot to prove, representing the company's first real attempt at the AI server CPU market, where traditional vendors Intel and AMD, along with third-party Arm-based providers, are all gunning for a piece of an increasingly lucrative data center pie.

To that end, Nvidia has published its most detailed technical account yet of the chip, promising substantial performance gains over the competition. Vera is the company's first server processor built around a fully in-house core design, a departure from the stock Arm cores that powered its Grace predecessor.

As Vera heads toward general availability in the second half of 2026, Nvidia is making its case on a specific front: not raw core count, but sustained per-core performance under load, the metric it argues matters most for agentic AI.

What's actually under the hood of Nvidia's Vera CPU?

At the core of every Vera CPU is Olympus, Nvidia's first custom server core, built to the Armv9.2 instruction set but designed in-house rather than derived from Arm's stock Neoverse designs, as its predecessor, Grace, was.

Nvidia's second-generation data center CPU is a completely reworked design built around a single goal: to lead in agentic workload performance.

Rather than following Intel and AMD down the chiplet route, Nvidia packs all 88 cores (176 threads) onto a single monolithic die, with a dual-socket configuration delivering 176 cores and 352 threads in one system.

Nvidia has detailed the core design extensively, and several publications have since dug into the microarchitecture. The front end runs a 10-wide decode engine paired with a neural branch predictor that can resolve up to two taken branches per cycle, designed to handle the large instruction footprints and irregular control flow of interpreters, compilers, and agent runtimes.

The mid core combines a wide rename-and-allocation engine with a large reorder buffer and dependency-breaking techniques including memory renaming and value prediction.

The execution engine schedules dynamically across integer, vector, floating-point, cryptographic, load, and store resources, while the cache subsystem adds a graph prefetcher targeting the pointer-chasing access patterns that defeat conventional streaming prefetchers.

That design has not gone unanswered. AMD has countered with estimated figures for its 256-core Zen 6 "Venice" part, claiming a 3.3x rack-level advantage over Vera, though those numbers are extrapolated rather than measured.

AMD responding first isn't surprising. Within x86, it continues taking ground from Intel, reaching 33.2% of x86 server CPU shipments in Q1 2026 per Mercury Research, up from 27.2% a year prior.

With Arm reporting that its architecture now accounts for roughly 50% of CPU compute among top hyperscalers, competition is building from several directions at once. Vera may well set a new bar for agentic AI.

• Copenhagen-based Triton Depth, founded in 2025 by three DTU engineering students, has raised €1 million in pre-seed funding
• It aims to address one of the EU's most underserved security concerns: the seabed, as Baltic cable sabotage, shadow-fleet activity, and underwater drone warfare are increasingly growing concerns
• Triton Depth intends to build a scalable network of passive acoustic sensors it calls 'Triton Nodes' to address the issue, leveraging AI to identify vessels and objects in real time

A three-man Danish company founded by students is venturing into a somewhat interesting industry for an EU-based startup: underwater defense.

Triton Depth has received €1 million in pre-seed funding from investors including London-based The Creator Fund and Denmark's state-owned Export and Investment Fund (EIFO), with aims to focus on acoustics to answer what is arguably Europe's biggest security threat in the days to come: drone-based naval warfare and sabotage.

With growing concerns about the vulnerability of the European Union, and by extension, Denmark, to a variety of sea-borne threats, EIFO's investment in Triton Depth might be more than just a value play, but a hallmark of a realization that it needs to tend to its own defense needs even as NATO continues to meander, with the US proving to be a volatile partner of late, to say the least.

Using affordable dual-use acoustic technology as the first line of defense

Triton Depth's approach is appealing for a domestic defense industry that does not share the budgets that larger naval players such as the US, Russia, or China possess: it is simple, yet elegant in its premise, and even partial wins when it comes to its claims would go a long way to safeguard Denmark and the EU's regional interests.

Triton Depth's approach centers around the use and deployment of its 'Triton Nodes', a scalable cluster of low-maintenance passive acoustic sensors that measure sound underwater before feeding information back to an AI model that assesses and classifies signatures it detects in real time.

The company intends to market its product line as a dual-use technology play, with CEO and Co-Founder Carl Borg stating that they aim to build "the intelligence layer for the ocean" for both civilian and defense use cases.

The focus on defense stems from Denmark's own vulnerabilities in the Baltic Sea, which has previously suffered significant economic damage from sabotage, including the destruction of Nord Stream 1 and 2.

With an increasing share of its critical infrastructure, including power interconnectors, data cables, and offshore wind, lying underwater, it could be argued that EIFO's investment is the Danish state safeguarding its own maritime security and intelligence interests by investing in an intelligent tripwire for the future.

Other European governments are also actively seeking scalable, affordable ways to monitor coastal and subsea infrastructure, even as Nordic defense budgets continue to rise, with Triton Depth among many defense infrastructure companies poised to benefit from a renewed focus on maritime security in the region, even as acoustics are seen as a reliable metric to monitor for a variety of infrastructure plays.

• An internal DHS readout shows analysts twice dismissed intrusion alerts on the HSIN information-sharing network as false positives
• This effectively gave hackers roughly three weeks of undetected access before a breach was declared on June 4 2026
• The as-yet anonymous attackers altered server files, ran malicious code through a legitimate web-server program, deleted logs, installed backdoors, and stole credential files

Hackers managed to find their way into the US Department of Homeland Security's primary information sharing platform, gaining unfettered access to the HSIN network that hosts unclassified information that multiple US agencies and international rely on.

The hack allowed the attackers to modify server files, run malicious code and steal credential files while installing backdoors and deleting logs to remove their digital footprint.

Their movements were flagged twice by automated systems and analysts in May 2026, before being dismissed as a false positive each time before an active breach was declared a month later.

Bad timing meets bad security practices?

The timing and specifics of this intrusion are, in particular, details which could prove to be embarrassing for the US government.

Not only does the HSIN network serve as a key intelligence-sharing tool for both domestic and international partners during the FIFA World Cup, but it also hosts information on other major events, such as America250.

The fact that the hack was picked up not once, but twice by flags before being dismissed as a false positive raises competency concerns for an instance that has already sparked interest, with the House Homeland Security Committee staff having already requested a briefing on the intrusion.

The DHS, for its part, is downplaying the incident, with a spokesperson confirming it but characterizing it narrowly: the department is "aware of a recent cyber incident involving a specific, unclassified legacy information sharing environment" and states there is no indication that classified networks were affected.

This viewpoint is countered by Senate Intelligence Committee Vice Chairman Mark Warner, who argued the platform's sensitivity outstrips its classification level, saying that the information in HSIN, "while not classified, is highly sensitive, and its exposure risks national security."

Investigators have yet to identify or assign blame to a particular hacking group or organization, adding to the chaos in determining motive. The hackers have deleted logs on servers, which only adds to the confusion here.

Major implications

The important question, perhaps, is not how the breach happened, but why confusion and mischaracterization of the security lapse allowed it to become a much bigger issue than it would have been if it had been contained from the start. Despite security flags and analysts highlighting the breach as early as the 15th of May, the hackers essentially had free rein to operate until at least the 3rd of June thanks to initial reports being dismissed as false positives.

HSIN as a platform handles event security planning, interagency coordination, threat information, and details on persons of interest. Whether any of that material was actually copied remains unknown. Investigators have not determined what, if anything, was exfiltrated, though the theft of credential files is itself telling: attackers who steal credentials are, almost by definition, trying to reach systems and accounts beyond their initial foothold.

This is not the first time HSIN has been compromised, with two documented previous incidents, including a compromised account in 2009 and misconfigured access in 2023, that have resulted in intentional and unintentional breaches of the network.

The issue is only exacerbated by the fact that the DHS, along with its cybersecurity agency, CISA, has absorbed significant workforce cuts over the past year, potentially weakening its defenses against sophisticated hacks that require manual human intervention or oversight to detect, even when the correct flags (which triggered as intended) are already in place.

Such manpower shortages have also been politically polarizing in the US Congress and may be highlighted when the department provides more detailed information about the hack in the coming days, even as the Pentagon deals with its own OPSEC issues that are also being aired in the same forum.

Via DefenseOne

• ETH Zurich quantum chip sees superconducting qubit act as CPU and the vibrational modes of a fingernail-width acoustic resonator serve as quantum RAM
• The approach borrows from classical computer architecture as it completely flips the script on how modern quantum computing might store short-term data
• The team demonstrated a universal gate set and ran small instances of the quantum Fourier transform and period finding

A guitar string essentially stores a note based on how it vibrates, and if one plucks it differently, an entirely different note plays.

A team of researchers at ETH Zurich has leveraged the same principle to build a quantum chip that stores information by replacing the string with microscopic acoustic resonators.

This allows the chip to increase its working memory significantly, essentially increasing the storage capacity, a prohibitively expensive commodity in quantum computing, significantly.

A vibrations-based quantum storage play

ETH Zurich's research is led by quantum physicist Yiwen Chu, who used tiny mechanical vibrations to both store and process information. The vibrations, however, go far beyond the range of human hearing, happening inside a quantum chip where they essentially replace or complement the working memory of a quantum computer.

The study, published by the Hybrid Quantum Systems group, lists Professor Yiwen Chu, along with doctoral students Yu Yang and Igor Kladarić, as lead authors and focuses on replicating the division of labor seen in a classical computer.

A superconducting transmon qubit serves as the CPU, while the working memory (the quantum equivalent of RAM) is a high-overtone bulk acoustic wave resonator, or HBAR, whose many vibrational modes each serve as a memory slot.

The Qubit essentially swaps a quantum state from a vibrational mode (reads it, in classical computer terms), manipulates it (modifies it), and swaps it back (writes it). This makes for a unique configuration that most modern quantum computers do not follow, in which processing and storage are two distinct segments; most designs treat both memory and compute similarly.

The approach has advantages, however: acoustic waves have wavelengths roughly a hundred thousand times shorter than electromagnetic ones, allowing an entire quantum chip to be extremely small, as the research team states, even if the actual computer will be many orders of magnitude larger.

The chip has passed stress tests, including a proof of feasibility, which also included testing using two of the most commonly used methods to benchmark a quantum computer: the quantum Fourier transform and a period-finding algorithm.

The endgame here, as noted by the research team, is quantum random-access memory (QRAM), which would allow modern quantum computers to access a much larger store of quantum memory than current specifications allow. Whether this pans out depends on both the scalability of the approach and the computational power in play.

• Vyriy 15 FPV with The Fourth Law's TFL-1 AI guidance reportedly struck Russian logistics 68 miles (110 KM) away
• Ever-innovating Ukrainian drone industry continues to achieve economies of scale even as it becomes a growing threat to Russian advances
• With a payload capacity of 8kg and the ability to be equipped with a thermal imaging module as well as electronic warfare deterrence, it offers an interesting alternative to comparable fixed-wing drones that cost thousands of dollars

Basic FPV drones are hardly a new thing in a market flooded with hundreds, if not thousands of options that can cost as little as $100 to 200, but the Russia-Ukraine conflict might have upped the ante on affordability for a different kind of UAV that leverages the same tech: attack drones.

The Vyriy 15 is a self-styled "kamikaze drone" by the company that offers a stated strike range of 40-70km with up to a 8kg payload in tow which can be retrofitted with a thermal imaging module as well as an extended band VTX module to make jamming it harder.

With a control range of up to 30KM and a flight duration of 20 minutes (with a payload) and a cruising speed of 60-100 km/h, its not the most technologically advanced drone out there, but at its purported price tag of $500, it doesn't need to be.

An FPV strike record backed by AI

On the 10th of July, Yaroslav Azhnyuk, the CEO of Ukrainian autonomy developer The Fourth Law, announced on X what he called "a new FPV strike record": a Vyriy 15 quadcopter, flown by Ukraine's 5th Border Guard Detachment and fitted with his company's AI terminal-guidance module, had flown 110 km (68 miles) to strike a Russian logistics target.

This is both a significant achievement for Ukraine's domestic drone industry and a key indicator of how fast the Russia-Ukraine war has turned into one of attrition, with supply lines becoming increasingly targeted to prevent significant advances in either direction.

It also showcases how AI on the battlefield is shaping the conflict: the Vyriy 15 is, by default, a manually controlled drone that would otherwise need an operator or a relay to be closer to the theater of war.

The competition is American-made Hornets, fixed-wing drones that can cost upwards of $5,000, a 10-fold increase in cost for an already cash-strapped Ukrainian military that is increasingly looking towards localized solutions.

The optional AI module used to set the record is The Fourth Law's TFL-1, a machine-vision terminal-guidance module that operates on a fire-and-forget principle: once the operator visually designates a target, an onboard computer takes over the final approach, essentially countering Russian jammers that would otherwise disrupt a video link.

If Ukraine manages to mainstream such warfare in the future while cutting costs down to a tenth of what they do right now, reliably striking as deep as 100km into enemy territory while proving difficult to jam or costly to intercept, drones like the Vyriy 15 could signal an evolution in the modern battlefield even as aggression with low-cost drone swarms is already being rewarded in other conflicts such as the US-Iran war.