Hackers have compromised virtually all versions of Aqua Security’s widely used Trivy vulnerability scanner in an ongoing supply chain attack that could have wide-ranging consequences for developers and the organizations that use them.

Trivy maintainer Itay Shakury confirmed the compromise on Friday, following rumors and a thread, since deleted by the attackers, discussing the incident. The attack began in the early hours of Thursday. When it was done, the threat actor had used stolen credentials to force-push all but one of the trivy-action tags and seven setup-trivy tags to use malicious dependencies.

Assume your pipelines are compromised

A forced push is a git command that overrides a default safety mechanism that protects against overwriting existing commits. Trivy is a vulnerability scanner that developers use to detect vulnerabilities and inadvertently hardcoded authentication secrets in pipelines for developing and deploying software updates. The scanner has 33,200 stars on GitHub, a high rating that indicates it’s used widely.

“If you suspect you were running a compromised version, treat all pipeline secrets as compromised and rotate immediately,” Shakury wrote.

Security firms Socket and Wiz said that the malware, triggered in 75 compromised trivy-action tags, causes custom malware to thoroughly scour development pipelines, including developer machines, for GitHub tokens, cloud credentials, SSH keys, Kubernetes tokens, and whatever other secrets may live there. Once found, the malware encrypts the data and sends it to an attacker-controlled server.

The end result, Socket said, is that any CI/CD pipeline using software that references compromised version tags executes code as soon as the Trivy scan is run. Spoofed version tags include the widely used @0.34.2, @0.33, and @0.18.0. Version @0.35.0 appears to be the only one unaffected.

The FBI has issued a public service announcement warning that Russian intelligence-linked threat actors are actively targeting users of encrypted messaging apps such as Signal and WhatsApp in phishing campaigns that have already compromised thousands of accounts.

The FBI’s PSA is the first public attribution linking these campaigns directly to Russian intelligence services, rather than a broader description of just state hackers.

According to the FBI, the campaigns are designed to bypass the protections of end-to-end encryption in commercial messaging apps (CMAs), not by breaking encryption, but through account hijacks.

The FBI says the techniques used in these attacks can be applied to multiple CMAs but predominantly target Signal users.

Depending on the access they obtain, attackers can read private messages and contact lists, impersonate victims, and launch additional phishing campaigns as trusted people.

The FBI says the attacks have affected “thousands” of accounts worldwide and primarily target those with access to sensitive information.

“The activity targets individuals of high intelligence value, such as current and former U.S. government officials, military personnel, political figures, and journalists,” reads the FBI’s PSA.

The FBI’s attribution comes after earlier advisories from Dutch and French cybersecurity authorities that described similar account-hijacking operations.

Earlier this month, Dutch intelligence agencies warned that state-backed attackers were targeting Signal and WhatsApp users in phishing campaigns aimed at gaining access to secure communications.

The advisory highlighted that the attacks relied on tricking users into allowing attackers to add the account to their devices or link attacker-controlled devices to the account.

Today, France’s Cyber Crisis Coordination Center (C4) also published an alert about the same tactics targeting instant messaging platforms, stating the activity is widespread and ongoing across multiple countries.

Signal phishing attacks

All three advisories state that the phishing attacks follow the same tactic of bypassing the platform’s encryption by hijacking accounts or linking devices to an existing account.

The FBI says that most phishing messages impersonate support accounts, which request that the target perform an action that secretly grants threat actors access to the account.

Victims are typically tricked into sharing verification codes or scanning malicious QR codes that link their accounts (Signal and WhatsApp) to attacker-controlled devices.

Once the threat actors gain access to accounts, they can silently monitor communications, join group chats, and send messages as the compromised user, making detection more difficult and enabling further phishing campaigns.

The PSA emphasizes that encryption in Signal, WhatsApp, and similar platforms is not broken and no vulnerabilities are being exploited.

The FBI says the campaign has already led to unauthorized access to thousands of messaging accounts, which were then used to target additional victims.

Users are advised to remain suspicious of unexpected messages, be wary of requests to scan QR codes or link devices to their accounts, and never share verification codes with anyone, including accounts claiming to be a platform’s support personnel.

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Download The Report

FiiO isn’t just busy in 2026, it is borderline relentless. The company has already rolled out close to 20 new products this year, with a roadmap that stretches for pages. DACs, amps, streamers, dongles you name it. But buried in that flood of new gear is something far less flashy and arguably more important: the DARKSIDE PRO.

Because here is the reality most brands do not like to talk about. A lot of entry level and mid tier gear from FiiO, Topping, SMSL, Schiit, WiiM, Eversolo ships with pretty mediocre power supplies. Cheap switching adapters. Lightweight wall warts that get the job done, technically, but do not exactly help performance. Noise creeps in, dynamics flatten out, and the gear never quite sounds like it should.

The FiiO DARKSIDE PRO goes straight at that problem. It is a linear power supply designed to clean up the foundation of your system, not dress it up. And it does not just work with a handful of FiiO products, it is compatible with a wide range of DACs, headphone amps, and streamers from multiple brands, provided the voltage and current match.

At $159, it is also not a major financial leap. Which is why it makes a lot of sense as a first upgrade, often more impactful than swapping cables, and sometimes enough to hold off on replacing the component entirely. I have already got one on order for the K11 R2R and a few other pieces on my desk. That probably tells you everything you need to know.

The DARKSIDE PRO is built to address something most desktop systems overlook until it becomes a problem: power quality. Instead of relying on a standard switching adapter, FiiO uses a linear power supply design, which is inherently better at reducing high-frequency noise and electrical interference that can bleed into sensitive audio circuits. That matters because DACs and headphone amplifiers don’t just amplify music—they amplify whatever noise is riding along with the power.

At the heart of the DARKSIDE PRO is a 75W toroidal transformer paired with a fully discrete voltage regulation stage. Toroidal transformers are preferred in audio applications because they generate less electromagnetic interference and deliver more stable current under load. The discrete regulation stage further refines that output, reducing ripple and ensuring that voltage remains consistent even when the connected device demands more current during dynamic passages.

The unit provides selectable 12V or 15V output with up to 3A of current, which makes it compatible with a wide range of desktop gear. That includes FiiO’s own DACs and amplifiers like the K11, K13 R2R, K7, and other low-voltage components, as well as third-party DACs, streamers, and headphone amps that rely on external DC power. The ability to switch voltage is not just about compatibility—it allows users to match the exact requirements of their gear, avoiding underpowering or unnecessary stress on the circuit.

Performance-wise, the benefit comes down to lowering the noise floor and improving system stability. With less ripple and cleaner DC output, connected devices can operate closer to their intended design limits. That can translate into tighter bass control, cleaner transients, and improved low-level detail—not because the power supply “adds” anything, but because it removes interference that shouldn’t be there in the first place.

There’s also a practical advantage in current reserve. With up to 3A on tap, the FiiO DARKSIDE PRO avoids the bottlenecks that cheaper switching supplies can introduce when a system demands more instantaneous power. That helps prevent compression or softening of dynamic peaks, especially with more demanding headphones or complex music.

What makes the DARKSIDE PRO useful is its role as a system-level upgrade. It doesn’t change your gear—it lets your gear perform the way it was designed to. For users building around FiiO’s growing desktop ecosystem, it’s a logical companion piece. And for anyone running sensitive DACs or headphone amps on generic wall adapters, it’s one of the few upgrades that can improve everything downstream without touching the signal path itself.

FiiO K13 R2R: Architecture, Power, and Real Control

The K13 R2R has been a long time coming. First announced last September, it took a few extra months to actually land, but now that it’s here, the value proposition is a lot clearer.

At its core is something you still almost never see at this price: a true, fully differential 24-bit resistor ladder DAC. FiiO’s four-channel design uses 192 precision thin-film resistors with tight tolerances, which isn’t just engineering flex—it directly improves linearity, channel balance, and low-level detail. The result is a presentation that feels more continuous and less clinical than the usual delta-sigma approach.

FiiO also gives you both NOS and OS modes, so you can choose between a smoother, more analog-leaning sound or something tighter and more technically precise. The DAC feeds a fully balanced amplifier capable of up to 2400mW per channel into 32 ohms, with low output impedance and multiple gain settings that make it flexible enough for everything from IEMs to planars.

On the digital side, it’s fully loaded: USB with up to 384kHz/32-bit PCM and DSD256 via XMOS, plus optical, coaxial, and I²S inputs, and Bluetooth 5.4 with LDAC for wireless. In other words, it covers just about every use case you’re likely to throw at a desktop unit in this range.

What makes the K13 R2R unique is obvious—the R2R DAC at $319. What matters just as much, though, is everything around it. Because here’s the part most people ignore: no DAC or headphone amp at this level reaches its potential on a cheap switching power supply. A better power source often delivers more meaningful gains than swapping cables—and in some cases, enough of an improvement that you don’t feel the need to upgrade the device at all.

Which is exactly why something like the FiiO DARKSIDE PRO exists in the first place.

The Bottom Line

The FiiO DARKSIDE PRO is for anyone running a DAC, streamer, or headphone amp on a basic wall adapter and wondering why it sounds a little flat. It makes sense because cleaner, more stable power can unlock performance you already paid for. At $159, it is a low risk upgrade that can deliver real gains without replacing your gear.

Where to buy:

For more information: fiio.com

Related Reading:

Anthropic cannot manipulate its generative AI model Claude once the US military has it running, an executive wrote in a court filing on Friday. The statement was made in response to accusations from the Trump administration about the company potentially tampering with its AI tools during war.

“Anthropic has never had the ability to cause Claude to stop working, alter its functionality, shut off access, or otherwise influence or imperil military operations,” Thiyagu Ramasamy, Anthropic’s head of public sector, wrote. “Anthropic does not have the access required to disable the technology or alter the model’s behavior before or during ongoing operations.”

The Pentagon has been sparring with the leading AI lab for months over how its technology can be used for national security—and what the limits on that usage should be. This month, defense secretary Pete Hegseth labeled Anthropic a supply-chain risk, a designation that will prevent the Department of Defense from using the company’s software, including through contractors, over the coming months. Other federal agencies are also abandoning Claude.

Anthropic filed two lawsuits challenging the constitutionality of the ban and is seeking an emergency order to reverse it. However, customers have already begun canceling deals. A hearing in one of the cases is scheduled for March 24 in federal district court in San Francisco. The judge could decide on a temporary reversal soon after.

In a filing earlier this week, government attorneys wrote that the Department of Defense “is not required to tolerate the risk that critical military systems will be jeopardized at pivotal moments for national defense and active military operations.”

The Pentagon has been using Claude to analyze data, write memos, and help generate battle plans, WIRED reported. The government’s argument is that Anthropic could disrupt active military operations by turning off access to Claude or pushing harmful updates if the company disapproves of certain uses.

Ramasamy rejected that possibility. “Anthropic does not maintain any back door or remote ‘kill switch,’” he wrote. “Anthropic personnel cannot, for example, log into a DoW system to modify or disable the models during an operation; the technology simply does not function that way.”

He went on to say that Anthropic would be able to provide updates only with the approval of the government and its cloud provider, in this case Amazon Web Services, though he didn’t specify it by name. Ramasamy added that Anthropic cannot access the prompts or other data military users enter into Claude.

Anthropic executives maintain in court filings that the company does not want veto power over military tactical decisions. Sarah Heck, head of policy, wrote in a court filing on Friday that Anthropic was willing to guarantee as much in a contract proposed March 4. “For the avoidance of doubt, [Anthropic] understands that this license does not grant or confer any right to control or veto lawful Department of War operational decision‑making,” the proposal stated, according to the filing, which referred to an alternative name for the Pentagon.

The company was also ready to accept language that would address its concerns about Claude being used to help carry out deadly strikes without human supervision, Heck claimed. But negotiations ultimately broke down.

For the time being, the Defense Department has said in court filings that it “is taking additional measures to mitigate the supply chain risk” posed by the company by “working with third-party cloud service providers to ensure Anthropic leadership cannot make unilateral changes” to the Claude systems currently in place.

Pinterest’s CEO has thrown his support behind an Australia measure banning social media for younger teens and is calling for governments around the world to implement similar bans. “Social media, as it’s configured today, is not safe for young people under 16,” Ready writes in a piece published by Time. “We need a clear standard: no social media for teens under 16, backed by real enforcement, and accountability for mobile phone operating systems and the apps that run on them.”

Ready is one of the highest-profile tech CEOs to come out in favor of a broad ban on social media for teens. That may also seem like a bold stance for someone who runs a platform with a user base that’s more than 50 percent Gen Z, but Ready doesn’t think that ban should apply to Pinterest. Pinterest, as he notes, already bars teens under 16 from accessing messaging features and other social features. It also makes teen accounts private by default.

A spokesperson for Pinterest confirmed the company has no plans to change its own policies regarding users under 16, and said Pinterest considers itself a “visual search platform” not social media. Pinterest, like most social media and social media-adjacent companies, doesn’t allow users under 13 to sign up.

Social media or not, Pinterest has encountered child safety-related issues in the past. In 2023, NBC News reported that Pinterest’s recommendation algorithm was surfacing photos and videos of young girls to adults who were “seeking” such content. Some of those users had created Pinterest boards featuring images of young girls with titles like “sexy little girls,” their investigation found. The company made profiles for teens under 16 private and “not discoverable” six months later.

According to Ready, Pinterest’s popularity with younger users is proof its policies are also good for the company’s business. “Our experience shows that prioritizing safety and well-being doesn’t push young people away; it builds trust,” he writes.

A civil jury in California on Friday ruled that Elon Musk intentionally misled Twitter investors when he tried to back out of his $44 billion acquisition of the platform in 2022.

At the time, Musk had tweeted that Twitter had too many bots, which is why he later tried to renege on the acquisition. (Twitter ended up suing Musk to force him to seal the deal.)

“Twitter deal temporarily on hold pending details supporting calculation that spam/fake accounts do indeed represent less than 5% of users,” Musk wrote on the platform that he has since renamed X.

In the days after Musk posted this, Twitter shares declined 8%. Investor Giuseppe Pampena filed suit against Musk on behalf of other former Twitter investors who had sold Twitter shares between May 13 (the day of the tweet) and October 4, the day the deal was finalized.

Pampena’s lawsuit argued that Musk intentionally posted about his concerns with Twitter to create uncertainty about the platform’s stability to artificially drive down its stock price, causing those who sold shares during that window to suffer losses. Musk’s attorneys argued that he was expressing legitimate concerns about the number of bots on the app. But the jury was more convinced by the plaintiff’s argument.

It is not yet clear how much money Musk will have to pay to those former Twitter shareholders, but Pampena’s attorney said that damages could reach up to $2.6 billion, according to CNBC. It’s not a huge blow for Musk, as Bloomberg estimates his net worth at over $660 billion.

This isn’t Musk’s first experience going to court over tweets. In 2018, he tweeted that he had secured funding to take Tesla private at $420 per share, meaning he planned to buy out public shareholders and delist the company from stock exchanges. The SEC alleged that these posts were misleading, charging Musk with securities fraud. Musk later had to testify in court that he was not making a marijuana joke (420 being a widely recognized reference to cannabis) and maintained that he earnestly believed that he would take Tesla private at $420 per share, which was a substantial premium on Tesla’s stock price at that time.

Musk emerged victorious in a similar lawsuit that shareholders filed about the “funding secured” tweet, but this time, he’ll have to pay up.

After acquiring Twitter, Musk rebranded the company as X, then merged it with his newer AI company, xAI. The combined company was valued at $113 billion, according to Musk. Then, last month, SpaceX merged with xAI. Musk has said that the merger was motivated by his desire to build data centers in space.