❌

Normal view

High-severity vulnerability in Linux caused by a single faulty character

9 June 2026 at 16:12

Researchers have analyzed a high-severity vulnerability in Linux that’s able to escalate untrusted users to root by exploiting a bug you don't often see: a single errant character inside the kernel.

The vulnerability, tracked as CVE-2026-23111, is located in nf_tables, a subsystem of the Linux kernel that provides packet filtering capabilities. It’s used to manage firewall rules and replaces older subsystems such as iptables, ip6tables, arptables, and ebtables.

!!!WTF!!!

The presence of a single mis-issued exclamation point in code implementing nf_tables introduced a use-after-free, a class of vulnerability that corrupts memory by placing malicious code at memory addresses that haven’t been properly freed of their previous contents. CVE-2026-23111 can be exploited by an unprivileged user or process to elevate system rights to root.

Read full article

Comments

© Getty Images

Trump’s new AI order — hallucinations aren’t just for LLMs

9 June 2026 at 08:00

Years ago, right-wingers coined the phrase “Trump Derangement Syndrome” (TDS) to describe people who hate US President Donald J. Trump. (I think it better describes the president’s outlandish, truth-challenged statements and the followers who think he can do no wrong.) What’s really deranged is his recent AI executive order.

First, a little history. As you may recall, Trump often (and loudly) trashed his predecessor’s Executive Order 14110, which had demanded “safe, secure, and trustworthy” AI. That Biden Administration order was replaced last year by Trump’s own “Removing Barriers to American Leadership in Artificial Intelligence” directive; it basically let US AI companies do whatever they wanted in the name of innovation.

Then, a little thing called Anthropic Mythos came along — and scared the pants off even AI’s biggest fans. Seemingly in response, someone in the federal government decided that letting AI companies do whatever they want might not be the brightest policy. 

Or, did they?

True, the new order creates a process under which AI companies can give US  government access to “covered frontier models” for up to 30 days before public release so experts can probe for vulnerabilities and test how the systems could be abused. It also directs agencies to set evaluation standards, establish an “AI cybersecurity clearinghouse,” and harden federal networks against rapidly advancing AI‑enabled attacks. 

Some people, like Graham Brookie, vice president for technology programs and strategy at the Atlantic Council, think the order is great. “The administration’s executive order on Advanced AI Innovation and Security is a serious policy with support from necessary stakeholders across party lines and industry to ensure the government is evaluating the cybersecurity risks posed by frontier AI models. It’s a policy that can be built on.”

Really? I’m not sure Brookie read the same document I did — if, indeed, he read it at all.

I quote:

“Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance, or permitting requirement for the development, publication, release, or distribution of new AI models, including frontier models.

“In addition, ‘This order is not intended to, and does not, create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.’”

In other words, AI companies won’t be required to do much of anything. And if they do  submit a project for review, get the government’s blessing for it, and something goes badly wrong, it’s not the government’s fault. 

So, exactly why would AI companies even mess with this performative AI security theater?

Beyond those concerns, who exactly will be judging AI projects in 30 days? In theory, it would be a cybersecurity clearinghouse made up of people from the National Security Agency, the US Treasury Department, and the Cybersecurity and Infrastructure Security Agency (CISA). Most likely, CISA would do the bulk of the heavy-lifting — it’s their job, after all. But there’s this wee problem; Trump’s so-called Department of Government Efficiency (DOGE) last year gutted CISA. There’s virtually no one left to do the work, and certainly not in 30 days.

There’s also the question of funding for the new initiative.  According to the order, “The Director of OMB, in coordination with the National Cyber Director and the Director of CISA, shall determine whether any Federal grant programs have available and relevant funding that can be directed toward applicants developing advanced AI vulnerability detection.”

Spoiler: There’s no money set aside for this purpose.

Leaving aside whether the Executive Order has any teeth at all — the Brennan Center for Justice argued that under the Constitution, it doesn’t; the closer you look at the document, the less substance you’ll find.

Besides, in an industry where success is all about releasing the latest Large Language Model (LLM) as fast as possible to garner attention and investor dollars, who exactly would want to put their AI models on ice for even 30 days? (Short answer: No one.) These companies are always going to be focused first on getting the word out about their latest model as fast as humanly — Uh, AI-ly — possible. 

Still, some people seem to think this executive order really will make a difference. For example, Paul Benda, the American Bankers Association executive vice president for risk, fraud, and cybersecurity, sees it “as a constructive step toward strengthening the nation’s approach to managing the cybersecurity risks and opportunities associated with advanced artificial intelligence [because it ] can help better protect critical infrastructure, including the financial sector.”

Oh, please. I’m so tired of people who skim the titles of Trump’s executive orders and then assume there’s anything real about them. 

This AI order is meaningless garbage, and anyone telling you otherwise is either lying or wants to be on the Trump regime’s good (?) side. Or, both — it could always be both. 

For the 2nd time in weeks, Microsoft packages laced with credential stealer

8 June 2026 at 19:34

Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI coding agents.

In all, multiple researchers said, 73 packages were flagged as malicious when automated systems on GitHub blocked them on the platform. Rather than noting they are malicious—and that developers who used AI agents to work with them should assume their systems are compromised—the Microsoft-owned GitHub said it disabled the packages “due to a violation of GitHub's terms of service.” The text went on to encourage the package owner to contact GitHub.

Devs: Assume compromise and proceed accordingly

It wasn’t until Monday that Microsoft even raised the possibility the packages were infected. In an email, the company stated: “We have temporarily removed some repositories as we investigate potential malicious content.”

Read full article

Comments

© Getty Images

Axiom and Prada advance design of spacesuit

8 June 2026 at 12:23
Axiom spacesuits

Axiom Space unveiled the design of another element of the lunar spacesuit it is developing for NASA in partnership with luxury designer Prada.

The post Axiom and Prada advance design of spacesuit appeared first on SpaceNews.

Les grillades n'attendent pas : ce barbecue à charbon passe sous les 80 €

8 June 2026 at 11:00
L'été approche et les repas en plein air reviennent sur le devant de la scène. Si vous envisagez d'investir dans un barbecue à charbon, Cdiscount met actuellement en avant le Weber Compact Kettle à prix réduit. Avec sa cuve en acier émaillé et son format adapté aux repas conviviaux, ce modèle...

Cette gêne très courante en milieu bruyant cacherait un lien étonnant avec le risque de démence

7 June 2026 at 08:00
Une découverte surprenante relie les difficultés auditives en milieu bruyant à un risque accru de démence. Cette étude britannique, menée sur plus de 80 000 adultes, ouvre de nouvelles perspectives dans la prévention de cette maladie neurodégénérative. Quelles sont les implications de ces...

How a USB-connected speaker can infect a PC without ever being touched

5 June 2026 at 22:00

Operating system makers take many steps to prevent their wares from accepting commands from remote devices. The safeguards, designed to thwart malicious attacks, typically require hackers to jump through all kinds of hoops to bypass the measures. But what if remote code execution were as simple as being within Bluetooth range of a speaker connected to the targeted device?

It turns out it can, at least when the speaker is a Sound Blaster Katana V2X sold by Singapore-based Creative Technologies. The speaker, which sells for $283, is widely acclaimed with numerous reviews showering praise on the sound and performance of it and its predecessor, the Sound Blaster V2.

A PC-pwning proxy

Researcher Rasmus Moorats stumbled on the hack by accident, after he purchased a Katana V2X, a soundbar that connects to PCs, Macs, and Linux devices over USB or Bluetooth. Moorats was curious if he could create a Linux tool that communicated with his speaker. He discovered he could do so through CTP, a proprietary mechanism he guesses is short for Creative Transport Protocol.

Read full article

Comments

© Creative Technologies

Leaf Space partners with D-Orbit and EnduroSat to test connectivity service

5 June 2026 at 19:12
Attendees gather around the Leaf Space booth at the 2026 SmallSat Europe conference. Credit: Leaf Space

MILAN – Italian ground segment operator Leaf Space unveiled a new space connectivity service May 27. The technology, named TreeNet, aims to make space communications more seamless by treating individual […]

The post Leaf Space partners with D-Orbit and EnduroSat to test connectivity service appeared first on SpaceNews.

“A Game Changing Warfighting Capability”: DIU-Funded Hermeus Says Autonomous, High-Mach Payload Release Test Flights to Begin

5 June 2026 at 16:36


Days after successfully flying its Quarterhorse unmanned aircraft at supersonic speeds, an industry-first defense aviation company, Hermeus, has received the largest-ever contract awarded by the Defense Innovation Unit (DIU) to demonstrate high-Mach flight combined with high-Mach payload release.

The new $ 159 million award, which increases the original contract to a total of $219 million, will allow Hermeus’ engineers to expand on previous high-Mach test flight milestones in direct partnership with the U.S. Air Force and the U.S. Navy, with the goal of providing the American warfighter with the most advanced arsenal capable of delivering munitions and payloads around the world at record-setting speeds.

“By delivering flight-ready aircraft and demonstrating payload release at speed, we will prove this technology can create a decisive military advantage on a timeline that matters,” explained Hermeus CEO and co-founder, AJ Piplica. “Our focus is on providing the Air Force and Navy with the validated data they need to transition these platforms into the future force.”

High Mach Payload Release: “A Game Changing Warfighting Capability”

When announcing the new DIU award, Hermeus executives noted that the program will include a series of “intensive flight tests.” The first is expected later this year, while the final flights are expected sometime in 2027.

Although few specifics were provided, the company said the flights will “prove the aircraft can maintain high speeds and expand its performance limits” while also demonstrating the successful carry and release of payloads at high velocity. The company also noted that all flight data gathered during the development and testing phases “will directly inform service experimentation and future acquisition decisions.”

high-Mach flight
In May, Hermeus’ Quarterhorse Mk 2.1 unmanned aircraft successfully completed its first supersonic flight, reaching a top speed of Mach 1.21. Image Credit: Hermeus.

Although the U.S. Military has several aircraft capable of exceeding the speed of sound, and several more hypersonic (exceeding five times the speed of sound) aircraft and missile prototypes, delivering payloads from high-Mach aircraft has remained a challenge. However, some military experts argue that the U.S. would benefit greatly from the capability.

When discussing the need for high-speed payload release, DIU Military Deputy Major General Joe “Solo” Kunkel said that the largest problems the military is facing in the future are “generally around time and distance,” and the associated challenges with getting to distant locations “in a timeframe that matters.”

“I care about the warfighting capability, providing advantage to our partners and us in the fight, and making sure that we can walk into every fight with swagger,” General Kunkel said, adding that mass producing the technology developed by Hermeus could move it from a test platform to a “game-changing warfighting capability.”

“I think we found a significant number of use cases where it can be used as a weapon,” the General added. 

Moving High-Mach Capability Out of the Lab

When discussing the company’s approach that convinced the DIU to offer its largest award in the organization’s history, including what they describe as “reclaiming the lost art of rapid iterative prototyping to build the fastest aircraft in the world today,” Hermeus noted that directly partnering with the USAF and USN allows their engineers to align tests with future mission needs and shorten the path from testing to deployment.

“By prioritizing relentless hardware iteration, we deliver high-speed systems at the pace of the modern battlefield,” the company’s statement explained. “We work with the Department of War to provide the high-speed capabilities our nation and its allies need to maintain a durable, asymmetric advantage.”

High-Mach flight
Image Credit: Hermeus.

When discussing the significance of the upcoming tests and the overall need for high-Mach flight payload deployment, including the benefit of the performance data, the company CEO heralded the DIU’s award, noting that the financing will help them move their successful demonstrations into real-world high-Mach platforms.

“This program is about moving high-Mach capability out of the lab and into an operationally relevant environment,” Piplica said. 

Christopher Plain is a Science Fiction and Fantasy novelist and Head Science Writer at The Debrief. Follow and connect with him on X, learn about his books at plainfiction.com, or email him directly at christopher@thedebrief.org.

Des chercheurs du MIT ont créé un pacemaker autocollant : sans implant, ni chirurgie

5 June 2026 at 11:18
Une équipe de chercheurs américains présente une nouvelle approche du pacemaker sans intervention invasive. Leur technologie, encore expérimentale, pourrait ouvrir la voie à une nouvelle génération de dispositifs médicaux portables.

Dashlane explains how attackers managed to download encrypted password vaults

4 June 2026 at 21:02

Dashlane said that attackers mounted a coordinated hacking campaign against a large base of its users in an attempt to recover as many encrypted password vaults as possible. The password manager provider said fewer than 20 personal user vaults were downloaded before it shut down the operation.

In a campaign that started Sunday, the unknown threat actor abused the mechanism that allows Dashlane users to add new devices, such as computers or phones, to their accounts. By abusing Dashlane's programming interfaces for device enrollment, the attackers sent requests to large numbers of existing users’ registered email addresses. In an update published Thursday, Dashlane wrote:

The threat actor targeted the API endpoints for device registration and used a brute force attack to send a large volume of automated requests to those endpoints.

In response, Dashlane’s automated security systems operated as intended, triggering an automatic lockout of the targeted accounts to protect those users. Before the attack was fully mitigated, the threat actor was able to brute force and generate valid tokens for fewer than 20 personal plan customers, allowing them to register a new device on those accounts and download copies of users’ encrypted vaults.

The flow and strategy of the attack

When a user installs the Dashlane app on a new device and attempts to enroll it in their existing account, Dashlane first verifies the account holder's identity. This verification is completed by sending a one-time six-digit token to the user’s registered email address (or, for users who have enabled two-factor authentication, by validating a six-digit code generated by their authentication app).

Read full article

Comments

© Getty Images

Can't make sense of Dashlane's vault theft notification? You're not alone.

3 June 2026 at 20:53

There’s a lot that doesn’t add up in a security advisory password manager Dashlane published Monday, warning that attackers managed to obtain 20 encrypted user vaults.

“Starting on Sunday, May 31, 2026, an external party launched a brute force attack against certain Dashlane user accounts,” the company said. “The goal of the attack was to brute-force two-factor authentication (2FA) protections to allow the attacker to register new devices on existing user accounts.”

Hello, Dashlane, anybody home?

A Dashlane user who received such a 2FA request provided this screenshot of the notification, which arrived on Sunday.

Read full article

Comments

© Dashlane

MIT Engineers Solve a Major Lidar Problem That Has Stumped Researchers for Years

Array of Integrated Antennas Minimizing Unwanted CrosstalkA new MIT-designed lidar chip uses specially engineered antennas to reduce interference and widen the sensor’s field of view. From self-driving cars navigating busy streets to drones surveying disaster zones, lidar has become one of the most important technologies for helping machines perceive the world in three dimensions. By sending out rapid pulses of infrared [...]

NFC Summit 2026: Fábrica de Unicórnios de Lisboa recebe três dias dedicados à arte digital, IA e blockchain

3 June 2026 at 16:09

Entre os dias 4 e 6 de junho, a Unicorn Factory Lisboa, no Beato, vai receber o NFC Summit 2026. Nesta edição o evento reúne mais de 350 oradores internacionais, mais de 200 artistas, mais de 36 expositores principais, distribuídos por oito programas e 50 mil metros quadrados. 

The post NFC Summit 2026: Fábrica de Unicórnios de Lisboa recebe três dias dedicados à arte digital, IA e blockchain appeared first on Tek Notícias.

❌