Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI coding agents.
In all, multiple researchers said, 73 packages were flagged as malicious when automated systems on GitHub blocked them on the platform. Rather than noting they are malicious—and that developers who used AI agents to work with them should assume their systems are compromised—the Microsoft-owned GitHub said it disabled the packages “due to a violation of GitHub's terms of service.” The text went on to encourage the package owner to contact GitHub.
Devs: Assume compromise and proceed accordingly
It wasn’t until Monday that Microsoft even raised the possibility the packages were infected. In an email, the company stated: “We have temporarily removed some repositories as we investigate potential malicious content.”
L'été approche et les repas en plein air reviennent sur le devant de la scène. Si vous envisagez d'investir dans un barbecue à charbon, Cdiscount met actuellement en avant le Weber Compact Kettle à prix réduit. Avec sa cuve en acier émaillé et son format adapté aux repas conviviaux, ce modèle...
Selecionadas pela Startup Portugal e pela Unicorn Factory Lisboa, as 27 empresas vêm de sectores como IA, Machine Learning ou Tecnologia da Saúde, empregando mais de 200 pessoas e com investimentos captados superiores a 20 milhões de euros.
Une découverte surprenante relie les difficultés auditives en milieu bruyant à un risque accru de démence. Cette étude britannique, menée sur plus de 80 000 adultes, ouvre de nouvelles perspectives dans la prévention de cette maladie neurodégénérative. Quelles sont les implications de ces...
Criado em 2022 como Non Fungible Conference, numa altura em que os NFTs estavam no auge da popularidade, o NFC Summit tem vindo a evoluir e, este ano, a arte digital, a IA e a cultura contemporânea estão no centro da programação, numa edição que, pela primeira vez, teve como palco a Unicorn Factory Lisboa.
Operating system makers take many steps to prevent their wares from accepting commands from remote devices. The safeguards, designed to thwart malicious attacks, typically require hackers to jump through all kinds of hoops to bypass the measures. But what if remote code execution were as simple as being within Bluetooth range of a speaker connected to the targeted device?
It turns out it can, at least when the speaker is a Sound Blaster Katana V2X sold by Singapore-based Creative Technologies. The speaker, which sells for $283, is widely acclaimed with numerous reviews showering praise on the sound and performance of it and its predecessor, the Sound Blaster V2.
A PC-pwning proxy
Researcher Rasmus Moorats stumbled on the hack by accident, after he purchased a Katana V2X, a soundbar that connects to PCs, Macs, and Linux devices over USB or Bluetooth. Moorats was curious if he could create a Linux tool that communicated with his speaker. He discovered he could do so through CTP, a proprietary mechanism he guesses is short for Creative Transport Protocol.
The giant planet’s bow shock isn’t just deflecting the solar wind, it’s acting as a powerful particle accelerator, firing electrons to relativistic energies of at least 1 MeV, according to a new analysis of data from NASA’s Juno spacecraft.
MILAN – Italian ground segment operator Leaf Space unveiled a new space connectivity service May 27. The technology, named TreeNet, aims to make space communications more seamless by treating individual […]
Days after successfully flying its Quarterhorse unmanned aircraft at supersonic speeds, an industry-first defense aviation company, Hermeus, has received the largest-ever contract awarded by the Defense Innovation Unit (DIU) to demonstrate high-Mach flight combined with high-Mach payload release.
The new $ 159 million award, which increases the original contract to a total of $219 million, will allow Hermeus’ engineers to expand on previous high-Mach test flight milestones in direct partnership with the U.S. Air Force and the U.S. Navy, with the goal of providing the American warfighter with the most advanced arsenal capable of delivering munitions and payloads around the world at record-setting speeds.
“By delivering flight-ready aircraft and demonstrating payload release at speed, we will prove this technology can create a decisive military advantage on a timeline that matters,” explained Hermeus CEO and co-founder, AJ Piplica. “Our focus is on providing the Air Force and Navy with the validated data they need to transition these platforms into the future force.”
High Mach Payload Release: “A Game Changing Warfighting Capability”
When announcing the new DIU award, Hermeus executives noted that the program will include a series of “intensive flight tests.” The first is expected later this year, while the final flights are expected sometime in 2027.
Although few specifics were provided, the company said the flights will “prove the aircraft can maintain high speeds and expand its performance limits” while also demonstrating the successful carry and release of payloads at high velocity. The company also noted that all flight data gathered during the development and testing phases “will directly inform service experimentation and future acquisition decisions.”
In May, Hermeus’ Quarterhorse Mk 2.1 unmanned aircraft successfully completed its first supersonic flight, reaching a top speed of Mach 1.21. Image Credit: Hermeus.
Although the U.S. Military has several aircraft capable of exceeding the speed of sound, and several more hypersonic (exceeding five times the speed of sound) aircraft and missile prototypes, delivering payloads from high-Mach aircraft has remained a challenge. However, some military experts argue that the U.S. would benefit greatly from the capability.
When discussing the need for high-speed payload release, DIU Military Deputy Major General Joe “Solo” Kunkel said that the largest problems the military is facing in the future are “generally around time and distance,” and the associated challenges with getting to distant locations “in a timeframe that matters.”
“I care about the warfighting capability, providing advantage to our partners and us in the fight, and making sure that we can walk into every fight with swagger,” General Kunkel said, adding that mass producing the technology developed by Hermeus could move it from a test platform to a “game-changing warfighting capability.”
“I think we found a significant number of use cases where it can be used as a weapon,” the General added.
Moving High-Mach Capability Out of the Lab
When discussing the company’s approach that convinced the DIU to offer its largest award in the organization’s history, including what they describe as “reclaiming the lost art of rapid iterative prototyping to build the fastest aircraft in the world today,” Hermeus noted that directly partnering with the USAF and USN allows their engineers to align tests with future mission needs and shorten the path from testing to deployment.
“By prioritizing relentless hardware iteration, we deliver high-speed systems at the pace of the modern battlefield,” the company’s statement explained. “We work with the Department of War to provide the high-speed capabilities our nation and its allies need to maintain a durable, asymmetric advantage.”
Image Credit: Hermeus.
When discussing the significance of the upcoming tests and the overall need for high-Mach flight payload deployment, including the benefit of the performance data, the company CEO heralded the DIU’s award, noting that the financing will help them move their successful demonstrations into real-world high-Mach platforms.
“This program is about moving high-Mach capability out of the lab and into an operationally relevant environment,” Piplica said.
Christopher Plain is a Science Fiction and Fantasy novelist and Head Science Writer at The Debrief. Follow and connect with him on X, learn about his books at plainfiction.com, or email him directly at christopher@thedebrief.org.
Une équipe de chercheurs américains présente une nouvelle approche du pacemaker sans intervention invasive. Leur technologie, encore expérimentale, pourrait ouvrir la voie à une nouvelle génération de dispositifs médicaux portables.
Et si la géographie du Seigneur des anneaux était un miroir nous renvoyant l'image de nos défis environnementaux contemporains ? L'univers de Tolkien, de la Comté au mont Destin, résonne avec les tensions écologiques actuelles et offre une réflexion sur nos façons d'habiter ou de transformer le...
Dashlane said that attackers mounted a coordinated hacking campaign against a large base of its users in an attempt to recover as many encrypted password vaults as possible. The password manager provider said fewer than 20 personal user vaults were downloaded before it shut down the operation.
In a campaign that started Sunday, the unknown threat actor abused the mechanism that allows Dashlane users to add new devices, such as computers or phones, to their accounts. By abusing Dashlane's programming interfaces for device enrollment, the attackers sent requests to large numbers of existing users’ registered email addresses. In an update published Thursday, Dashlane wrote:
The threat actor targeted the API endpoints for device registration and used a brute force attack to send a large volume of automated requests to those endpoints.
In response, Dashlane’s automated security systems operated as intended, triggering an automatic lockout of the targeted accounts to protect those users. Before the attack was fully mitigated, the threat actor was able to brute force and generate valid tokens for fewer than 20 personal plan customers, allowing them to register a new device on those accounts and download copies of users’ encrypted vaults.
The flow and strategy of the attack
When a user installs the Dashlane app on a new device and attempts to enroll it in their existing account, Dashlane first verifies the account holder's identity. This verification is completed by sending a one-time six-digit token to the user’s registered email address (or, for users who have enabled two-factor authentication, by validating a six-digit code generated by their authentication app).
There’s a lot that doesn’t add up in a security advisory password manager Dashlane published Monday, warning that attackers managed to obtain 20 encrypted user vaults.
“Starting on Sunday, May 31, 2026, an external party launched a brute force attack against certain Dashlane user accounts,” the company said. “The goal of the attack was to brute-force two-factor authentication (2FA) protections to allow the attacker to register new devices on existing user accounts.”
Hello, Dashlane, anybody home?
A Dashlane user who received such a 2FA request provided this screenshot of the notification, which arrived on Sunday.
A new MIT-designed lidar chip uses specially engineered antennas to reduce interference and widen the sensor’s field of view. From self-driving cars navigating busy streets to drones surveying disaster zones, lidar has become one of the most important technologies for helping machines perceive the world in three dimensions. By sending out rapid pulses of infrared [...]
Entre os dias 4 e 6 de junho, a Unicorn Factory Lisboa, no Beato, vai receber o NFC Summit 2026. Nesta edição o evento reúne mais de 350 oradores internacionais, mais de 200 artistas, mais de 36 expositores principais, distribuídos por oito programas e 50 mil metros quadrados.
Interdimensional beings are extradimensional beings, as distinct from extraterrestrials are perceived as entities in realms beyond our physical universe, governed by different principles. These beings may exist as energy or abstract forms and are common in science fiction and spiritual demonic contexts. Modern scientific language is used to make them acceptable.
Satanism is on the rise and is illustrated by a German football club invoking Lucifer to gain victory. The fans engaged in this worship are under strong delusion. They summon demons which will invariably lead to their possession.
Login
