❌

Reading view

Ocean Monitoring Cuts Threaten Weather Forecasting While Helicopters Deliver 100 Tonnes for Mountain Trail Repairs — Today’s Environmental Briefing for Sat, Jun 6 2026

Ocean monitoring buoy floating in blue water with scientific equipment visible above surface

Across the stories today, a common thread emerges around the growing tension between humanity’s expanding footprint and the natural world’s capacity to sustain it — and the innovative ways communities are responding to that pressure.

From Nepal’s sleepless farmers standing guard against crop-raiding elephants to New York’s groundbreaking moratorium on data centers, the day’s coverage points to growing momentum around a fundamental question: How do we balance human needs with environmental limits? In Nepal’s fertile plains, farmer Dhruba Prasai embodies this struggle in the most personal terms, spending nights protecting his livelihood from wildlife that has nowhere else to go as habitats shrink. His story reflects a global pattern where conservation success — healthy animal populations — creates new challenges for the communities living alongside recovering ecosystems.

Meanwhile, the United States is grappling with its own version of this tension through energy infrastructure. New York’s proposed data center freeze represents the first state-level recognition that the digital economy’s physical infrastructure carries real environmental costs. As artificial intelligence development accelerates — highlighted by upcoming presidential meetings with tech leaders — states are being forced to confront whether unlimited growth in energy-hungry facilities aligns with climate commitments.

The policy landscape reveals a surprising role reversal that challenges conventional wisdom about climate action. While traditionally blue states like California retreat from aggressive environmental policies, red states are surging ahead in renewable energy development. This shift suggests that economic opportunity, not political ideology, may increasingly drive clean energy adoption. Virtual power plants are gaining traction in states like Massachusetts and Minnesota, signaling that grid modernization is becoming a bipartisan priority as electricity demand soars.

But perhaps the most encouraging thread running through today’s stories is the remarkable capacity for recovery when protection efforts succeed. Tanzania’s turquoise dwarf gecko has rebounded from near-extinction after trade bans halted the illegal capture of 40,000 individuals. Mangrove forests worldwide are staging unexpected comebacks after decades of destruction. Even in crisis, there are signs of resilience: curlew chicks successfully hatched from eggs rescued during wildfires, and New Mexico’s “reforestation pipeline” is training climate-resilient seedlings to heal wildfire-devastated landscapes.

It’s a reminder that progress and pressure often arrive together. The same technological advances driving data center construction are also enabling virtual power plants to balance renewable energy. Conservation successes that allow wildlife populations to recover create new management challenges for rural communities.

Behind the numbers are real communities adapting in real time. From Nepalese farmers developing night watch systems to Native American tribes seeing their bison restoration efforts threatened by new federal grazing rules, the human dimension of environmental change continues to play out in deeply personal ways.

The contrast between immediate local impacts and longer-term recovery stories suggests we’re in a pivotal moment where short-term adaptation strategies must align with longer-term restoration goals. As the week unfolds, all eyes will be on how policymakers balance competing demands — from Alaska’s Arctic refuge lease sale to Albania’s luxury resort controversy — while communities continue innovating at the intersection of human needs and environmental health.

The post Ocean Monitoring Cuts Threaten Weather Forecasting While Helicopters Deliver 100 Tonnes for Mountain Trail Repairs — Today’s Environmental Briefing for Sat, Jun 6 2026 first appeared on EnviroLink Network.

  •  

Hole in GitHub’s browser-based VSCode editor could lead to stolen token

A vulnerability in GitHub’s browser-based VSCode editor could lead to the theft of a developer’s token under certain circumstances, says a researcher.

The issue, revealed this week in a blog by Ammar Askar, has apparently been already addressed by GitHub owner Microsoft. But it raises a questions about both DevOps security, and about the researcher’s allegation that, because Microsoft doesn’t treat bug discoveries seriously, he can justify giving it short notice before openly publishing vulnerabilities he finds.

First, the bug: Users of github.com may not realize it, but when they are on any repository, they can shift to github.dev and its browser-based version of VSCode just by changing the URL.

Why do this? Because the browser instance of VSCode is pretty powerful, Askar says in his blog. “You can view all the files in the repo (even if it’s a private one), you can send out pull requests, and even make commits.”

Rob Enderle, a IT consultant who heads the Enderle Group, agrees that jumping into VSCode this way is “an incredibly useful tactical tool for quick tasks. By just hitting the ‘.’ key in any GitHub repo, you instantly get a browser-based VS Code interface without having to clone gigabytes of data locally. It’s perfect for rapid PR reviews, quick documentation edits, or navigating code on the fly without breaking your workflow. Just keep in mind that it runs entirely in the browser sandbox; there’s no compute backend, no terminal, and no code execution.”

For any heavy lifting or actual compiling, he added, the developer will still need the raw compute of a local workstation, or a full cloud environment like Codespaces.

The problem, Askar says, is that this functionality is achieved by github.com POSTing over an OAuth token to github.dev that allows it to interact with GitHub on your behalf. “The token is not scoped to the particular repo you interacted with, meaning it has full access to every other repo that you have access to,” he wrote in the blog.

“The presence of this token, and the fact that this web app is running almost the entire brunt of VSCode’s million line Typescript codebase, makes it a great target for anyone looking into VSCode bugs,” he wrote.

The exploit

Askar said that a threat actor could install an extension in a repository using a Jupyter notebook, a web application for creating and sharing computational documents that has the ability to install a malicious local workspace extension while skipping the publisher trust check. In his proof of concept, Askar said that once his payload runs, the newly installed extension will grab the GitHub API token, run a query to get the private repos the developer has access to, and then print out the replies and the token.

This vulnerability also exists in the desktop version of VSCode, Askar said, though it’s harder to exploit, since a threat actor would need to convince the victim to clone their repo and open the notebook containing the webview script payload. “Of course,” he added, “if you [the hacker] had some other XSS [cross-site scripting attack] in a webview that you can get a victim to open, you get effectively full RCE [remote code execution] on their computer.”

In an email, he said this vulnerability was “about as serious as it gets. Any website on the internet could have redirected you to a github.dev link that could have provided an attacker a token to read and modify your code repos. If one could convince the maintainer of a popular software project to click a link, they could have made whatever modifications they wanted to their project.”

This means, said Enderle, “we have to start treating developer endpoints with strict, isolated, zero-trust parameters, because we clearly cannot rely on vendor complacency to protect us.”

This issue reinforces the point that you should never follow any links unless you know exactly where they will take you, added Dwayne McDaniel, principal developer advocate at GitGuardian.

Short notice

Here’s where things get complicated. Because of an unhappy experience when disclosing a previous VSCode vulnerability to Microsoft — the bug was fixed, but Askar wasn’t given credit — this time he only gave GitHub one hour notice that this new discovery was going to be published. Microsoft applied what Askar calls a “stopgap” fix by adding a confirmation when a developer opens notebooks in web VSCode, and by not allowing the trusted publisher requirement to be skipped by commands.

[Related content: When responsible disclosure becomes unpaid labor]

An ethical question

Askar’s short notice raises an ethical question: How far in advance should a responsible researcher give notice to a vendor about a vulnerability before publicly revealing it?

These days, most infosec pros agree that notice must be given, or else a threat actor can quickly exploit a hole. Not only that, but the researcher risks damage to their reputation if reasonable notice isn’t given. Experienced researchers often give vendors at least 30 days to create and distribute a patch.

For their part, vendors often create bug bounty programs, or partner with bug bounty programs, to reward researchers for their work. Unfortunately, some vendors don’t always credit researchers, or downplay the damage a vulnerability can cause. In fact, last month Microsoft and a prominent cybersecurity researcher got into a public spat about one such alleged incident.

An imbalance of power

Asked for comment about Askar’s most recent discovery, a Microsoft spokesperson said, “we value the critical role that the security research community plays in strengthening the security of our products, services, and the broader technology ecosystem. While independent researchers determine when and how to publish their findings, we remain committed to rapidly assessing reported issues, mobilizing the appropriate engineering and security response resources, and delivering mitigations, guidance, and protections as quickly as possible to help safeguard our customers.”

The spokesperson added that the issue Askar reported “has been mitigated for our services and no customer action is required.”

[Related content: Is the vulnerability disclosure process glitched?]

There is a balance between coordinating disclosure with a software vendor (CVD) and full disclosure, Askar told us. But, he added, there’s an imbalance of power. “A security researcher can pour countless hours into an issue, ensuring they develop a good proof of concept and provide all the steps to recreate the issue. With this, they hope to at least get an acknowledgement for their efforts, which they can use to further their security track record or, in the best case, a monetary bounty reward.”

However, he added, “If security vendors don’t adhere to their side of the bargain, public disclosure is one of the few options security researchers have (if they don’t want to sit on their vulnerabilities or sell them on the black market). It forces the vendor to acknowledge the security issue publicly and usually leads to a much faster resolution than any private communication would.”

This, said Enderle, creates problems for enterprises: “When vendor bureaucracy penalizes responsible disclosure, it alienates the security community and forces public zero-day drops, ultimately leaving enterprise customers holding the bag.”

  •  
❌