❌

Reading view

UK Electric Vehicle Loopholes Add 17 Million Tonnes CO2 While Coastal Erosion Threatens 200-Year-Old Sailors’ Grave — Today’s Environmental Briefing for Sun, Jun 7 2026

Electric vehicles charging at station with emissions visualization showing carbon dioxide impact

Across the stories today, a common thread emerges: the growing tension between ambitious climate goals and the messy realities of making change happen on the ground. From Colorado’s largest-ever oil lease sale to federal subsidies flowing toward aging coal plants, the gap between environmental necessity and economic momentum has rarely felt more stark.

The day’s coverage points to growing momentum around innovation, but also the persistent pull of established systems. While virtual power plants gain traction in Massachusetts and Minnesota as states seek clean energy solutions, the federal government simultaneously allocated $700 million to support the struggling coal industry through the Defense Production Act. It’s a reminder that progress and pressure often arrive together, creating policy landscapes that can feel contradictory but reflect the complex economics of energy transition.

Perhaps most telling are the stories of communities caught between these larger forces. In Colorado’s northwestern wilderness, the Bureau of Land Management is opening 156,000 acres of critical wildlife habitat — including migration corridors for the nation’s largest elk herd — to oil and gas drilling. Meanwhile, in the Dominican Republic, 450 families near the Pueblo Viejo gold mine are demanding relocation from what they describe as dangerous pollution, while Canada’s corporate watchdog office remains unstaffed and unable to respond.

These human-scale impacts reveal how environmental challenges increasingly operate across borders and timescales. The Middle East conflict now threatens global food security through fertilizer trade disruptions, while mangrove forests — nature’s carbon guardians for tens of millions of years — face existential pressure from rising seas happening faster than these resilient ecosystems can adapt.

Behind the numbers are real communities adapting in real time. In Nepal’s fertile southern plains, farmer Dhruba Prasai stands guard over his crops every night as wildlife emerges from nearby forests, highlighting the complex relationship between conservation success and agricultural livelihoods. In Norfolk, authorities must consider exhuming a 200-year-old mass grave of sailors as coastal erosion — accelerated by climate change — threatens this historic site.

Yet today’s stories also showcase remarkable resilience and ingenuity. A Kent village transformed itself into a living solar system model to inspire environmental awareness. The stunning turquoise dwarf gecko has rebounded from near-extinction thanks to trade bans and conservation efforts. Amazon communities are pioneering new models for sustainable resource management while protecting some of the world’s last intact forests.

The juxtaposition feels particularly acute in water policy, where federal officials prepare to impose Colorado River management plans if seven states can’t reach agreement, while a Labour politician calls for public ownership of Thames Water amid ongoing environmental concerns. These parallel struggles — one over scarcity, another over stewardship — underscore how water governance has become a defining issue for both climate adaptation and democratic accountability.

As the week unfolds, all eyes will be on whether the Biden administration’s mixed signals on energy policy — supporting both clean innovation and fossil fuel infrastructure — represent a pragmatic transition strategy or a failure to fully commit to climate goals. The stories emerging from frontline communities, from Nepal’s fields to Colorado’s wilderness, suggest that the window for managed, equitable change continues to narrow, making each policy choice increasingly consequential for both people and planet.

The post UK Electric Vehicle Loopholes Add 17 Million Tonnes CO2 While Coastal Erosion Threatens 200-Year-Old Sailors’ Grave — Today’s Environmental Briefing for Sun, Jun 7 2026 first appeared on EnviroLink Network.

  •  

Breaking Barriers: First Female Chair of Grayling Society Champions River Conservation and Women in Angling

Breaking Barriers: First Female Chair of Grayling Society Champions River Conservation and Women in Angling

Marnie Lovejoy has made history by becoming the first woman to chair the Grayling Society, marking a significant milestone in the traditionally male-dominated world of fly-fishing and freshwater conservation. Her appointment comes at a crucial time for England’s rivers and the protection of one of its most elegant native fish species.

Known to anglers as the “lady of the stream” for its iridescent pink scales and graceful dorsal fin, the grayling faces mounting pressures from habitat degradation, pollution, and climate change. These beautiful fish require pristine water conditions to thrive, making them important indicators of river health across England’s waterways.

Lovejoy’s leadership represents more than just breaking glass ceilings in angling circles. She aims to inspire a new generation of women to take up fishing while simultaneously advancing conservation efforts for England’s struggling river ecosystems. Her dual mission addresses both the sport’s diversity challenges and the urgent need for river protection.

The timing of her appointment underscores broader changes in the angling community. Until 2024, some prestigious fishing clubs excluded women entirely, even as guests. Now, with Lovejoy at the helm of grayling conservation efforts, the sport is slowly evolving to embrace both gender equality and environmental stewardship. Her work could prove vital for protecting these sensitive fish and the pristine river habitats they depend on for survival.

The post Breaking Barriers: First Female Chair of Grayling Society Champions River Conservation and Women in Angling first appeared on EnviroLink Network.

  •  

Ocean Monitoring Cuts Threaten Weather Forecasting While Helicopters Deliver 100 Tonnes for Mountain Trail Repairs — Today’s Environmental Briefing for Sat, Jun 6 2026

Ocean monitoring buoy floating in blue water with scientific equipment visible above surface

Across the stories today, a common thread emerges around the growing tension between humanity’s expanding footprint and the natural world’s capacity to sustain it — and the innovative ways communities are responding to that pressure.

From Nepal’s sleepless farmers standing guard against crop-raiding elephants to New York’s groundbreaking moratorium on data centers, the day’s coverage points to growing momentum around a fundamental question: How do we balance human needs with environmental limits? In Nepal’s fertile plains, farmer Dhruba Prasai embodies this struggle in the most personal terms, spending nights protecting his livelihood from wildlife that has nowhere else to go as habitats shrink. His story reflects a global pattern where conservation success — healthy animal populations — creates new challenges for the communities living alongside recovering ecosystems.

Meanwhile, the United States is grappling with its own version of this tension through energy infrastructure. New York’s proposed data center freeze represents the first state-level recognition that the digital economy’s physical infrastructure carries real environmental costs. As artificial intelligence development accelerates — highlighted by upcoming presidential meetings with tech leaders — states are being forced to confront whether unlimited growth in energy-hungry facilities aligns with climate commitments.

The policy landscape reveals a surprising role reversal that challenges conventional wisdom about climate action. While traditionally blue states like California retreat from aggressive environmental policies, red states are surging ahead in renewable energy development. This shift suggests that economic opportunity, not political ideology, may increasingly drive clean energy adoption. Virtual power plants are gaining traction in states like Massachusetts and Minnesota, signaling that grid modernization is becoming a bipartisan priority as electricity demand soars.

But perhaps the most encouraging thread running through today’s stories is the remarkable capacity for recovery when protection efforts succeed. Tanzania’s turquoise dwarf gecko has rebounded from near-extinction after trade bans halted the illegal capture of 40,000 individuals. Mangrove forests worldwide are staging unexpected comebacks after decades of destruction. Even in crisis, there are signs of resilience: curlew chicks successfully hatched from eggs rescued during wildfires, and New Mexico’s “reforestation pipeline” is training climate-resilient seedlings to heal wildfire-devastated landscapes.

It’s a reminder that progress and pressure often arrive together. The same technological advances driving data center construction are also enabling virtual power plants to balance renewable energy. Conservation successes that allow wildlife populations to recover create new management challenges for rural communities.

Behind the numbers are real communities adapting in real time. From Nepalese farmers developing night watch systems to Native American tribes seeing their bison restoration efforts threatened by new federal grazing rules, the human dimension of environmental change continues to play out in deeply personal ways.

The contrast between immediate local impacts and longer-term recovery stories suggests we’re in a pivotal moment where short-term adaptation strategies must align with longer-term restoration goals. As the week unfolds, all eyes will be on how policymakers balance competing demands — from Alaska’s Arctic refuge lease sale to Albania’s luxury resort controversy — while communities continue innovating at the intersection of human needs and environmental health.

The post Ocean Monitoring Cuts Threaten Weather Forecasting While Helicopters Deliver 100 Tonnes for Mountain Trail Repairs — Today’s Environmental Briefing for Sat, Jun 6 2026 first appeared on EnviroLink Network.

  •  

Hole in GitHub’s browser-based VSCode editor could lead to stolen token

A vulnerability in GitHub’s browser-based VSCode editor could lead to the theft of a developer’s token under certain circumstances, says a researcher.

The issue, revealed this week in a blog by Ammar Askar, has apparently been already addressed by GitHub owner Microsoft. But it raises a questions about both DevOps security, and about the researcher’s allegation that, because Microsoft doesn’t treat bug discoveries seriously, he can justify giving it short notice before openly publishing vulnerabilities he finds.

First, the bug: Users of github.com may not realize it, but when they are on any repository, they can shift to github.dev and its browser-based version of VSCode just by changing the URL.

Why do this? Because the browser instance of VSCode is pretty powerful, Askar says in his blog. “You can view all the files in the repo (even if it’s a private one), you can send out pull requests, and even make commits.”

Rob Enderle, a IT consultant who heads the Enderle Group, agrees that jumping into VSCode this way is “an incredibly useful tactical tool for quick tasks. By just hitting the ‘.’ key in any GitHub repo, you instantly get a browser-based VS Code interface without having to clone gigabytes of data locally. It’s perfect for rapid PR reviews, quick documentation edits, or navigating code on the fly without breaking your workflow. Just keep in mind that it runs entirely in the browser sandbox; there’s no compute backend, no terminal, and no code execution.”

For any heavy lifting or actual compiling, he added, the developer will still need the raw compute of a local workstation, or a full cloud environment like Codespaces.

The problem, Askar says, is that this functionality is achieved by github.com POSTing over an OAuth token to github.dev that allows it to interact with GitHub on your behalf. “The token is not scoped to the particular repo you interacted with, meaning it has full access to every other repo that you have access to,” he wrote in the blog.

“The presence of this token, and the fact that this web app is running almost the entire brunt of VSCode’s million line Typescript codebase, makes it a great target for anyone looking into VSCode bugs,” he wrote.

The exploit

Askar said that a threat actor could install an extension in a repository using a Jupyter notebook, a web application for creating and sharing computational documents that has the ability to install a malicious local workspace extension while skipping the publisher trust check. In his proof of concept, Askar said that once his payload runs, the newly installed extension will grab the GitHub API token, run a query to get the private repos the developer has access to, and then print out the replies and the token.

This vulnerability also exists in the desktop version of VSCode, Askar said, though it’s harder to exploit, since a threat actor would need to convince the victim to clone their repo and open the notebook containing the webview script payload. “Of course,” he added, “if you [the hacker] had some other XSS [cross-site scripting attack] in a webview that you can get a victim to open, you get effectively full RCE [remote code execution] on their computer.”

In an email, he said this vulnerability was “about as serious as it gets. Any website on the internet could have redirected you to a github.dev link that could have provided an attacker a token to read and modify your code repos. If one could convince the maintainer of a popular software project to click a link, they could have made whatever modifications they wanted to their project.”

This means, said Enderle, “we have to start treating developer endpoints with strict, isolated, zero-trust parameters, because we clearly cannot rely on vendor complacency to protect us.”

This issue reinforces the point that you should never follow any links unless you know exactly where they will take you, added Dwayne McDaniel, principal developer advocate at GitGuardian.

Short notice

Here’s where things get complicated. Because of an unhappy experience when disclosing a previous VSCode vulnerability to Microsoft — the bug was fixed, but Askar wasn’t given credit — this time he only gave GitHub one hour notice that this new discovery was going to be published. Microsoft applied what Askar calls a “stopgap” fix by adding a confirmation when a developer opens notebooks in web VSCode, and by not allowing the trusted publisher requirement to be skipped by commands.

[Related content: When responsible disclosure becomes unpaid labor]

An ethical question

Askar’s short notice raises an ethical question: How far in advance should a responsible researcher give notice to a vendor about a vulnerability before publicly revealing it?

These days, most infosec pros agree that notice must be given, or else a threat actor can quickly exploit a hole. Not only that, but the researcher risks damage to their reputation if reasonable notice isn’t given. Experienced researchers often give vendors at least 30 days to create and distribute a patch.

For their part, vendors often create bug bounty programs, or partner with bug bounty programs, to reward researchers for their work. Unfortunately, some vendors don’t always credit researchers, or downplay the damage a vulnerability can cause. In fact, last month Microsoft and a prominent cybersecurity researcher got into a public spat about one such alleged incident.

An imbalance of power

Asked for comment about Askar’s most recent discovery, a Microsoft spokesperson said, “we value the critical role that the security research community plays in strengthening the security of our products, services, and the broader technology ecosystem. While independent researchers determine when and how to publish their findings, we remain committed to rapidly assessing reported issues, mobilizing the appropriate engineering and security response resources, and delivering mitigations, guidance, and protections as quickly as possible to help safeguard our customers.”

The spokesperson added that the issue Askar reported “has been mitigated for our services and no customer action is required.”

[Related content: Is the vulnerability disclosure process glitched?]

There is a balance between coordinating disclosure with a software vendor (CVD) and full disclosure, Askar told us. But, he added, there’s an imbalance of power. “A security researcher can pour countless hours into an issue, ensuring they develop a good proof of concept and provide all the steps to recreate the issue. With this, they hope to at least get an acknowledgement for their efforts, which they can use to further their security track record or, in the best case, a monetary bounty reward.”

However, he added, “If security vendors don’t adhere to their side of the bargain, public disclosure is one of the few options security researchers have (if they don’t want to sit on their vulnerabilities or sell them on the black market). It forces the vendor to acknowledge the security issue publicly and usually leads to a much faster resolution than any private communication would.”

This, said Enderle, creates problems for enterprises: “When vendor bureaucracy penalizes responsible disclosure, it alienates the security community and forces public zero-day drops, ultimately leaving enterprise customers holding the bag.”

  •  

Meta Expands Safety Features for Teenagers

The changes, after Meta’s legal losses in two child safety cases, are aimed at limiting harmful content shown to teenagers on Instagram, Facebook and Messenger.
  •  
❌