Hackers have compromised virtually all versions of Aqua Security’s widely used Trivy vulnerability scanner in an ongoing supply chain attack that could have wide-ranging consequences for developers and the organizations that use them.
Trivy maintainer Itay Shakury confirmed the compromise on Friday, following rumors and a thread, since deleted by the attackers, discussing the incident. The attack began in the early hours of Thursday. When it was done, the threat actor had used stolen credentials to force-push all but one of the trivy-action tags and seven setup-trivy tags to use malicious dependencies.
Assume your pipelines are compromised
A forcedpush is a git command that overrides a default safety mechanism that protects against overwriting existing commits. Trivy is a vulnerability scanner that developers use to detect vulnerabilities and inadvertently hardcoded authentication secrets in pipelines for developing and deploying software updates. The scanner has 33,200 stars on GitHub, a high rating that indicates it’s used widely.
“If you suspect you were running a compromised version, treat all pipeline secrets as compromised and rotate immediately,” Shakury wrote.
Advertisement
Security firms Socket and Wiz said that the malware, triggered in 75 compromised trivy-action tags, causes custom malware to thoroughly scour development pipelines, including developer machines, for GitHub tokens, cloud credentials, SSH keys, Kubernetes tokens, and whatever other secrets may live there. Once found, the malware encrypts the data and sends it to an attacker-controlled server.
The end result, Socket said, is that any CI/CD pipeline using software that references compromised version tags executes code as soon as the Trivy scan is run. Spoofed version tags include the widely used @0.34.2, @0.33, and @0.18.0. Version @0.35.0 appears to be the only one unaffected.
Looking for the most recent Connections answers? Click here for today’s Connections hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle, Connections: Sports Edition and Strands puzzles.
English majors, today’s NYT Connections puzzle has a purple category with our names on it. Read on for clues and today’s Connections answers.
The Times has a Connections Bot, like the one for Wordle. Go there after you play to receive a numeric score and to have the program analyze your answers. Players who are registered with the Times Games section can now nerd out by following their progress, including the number of puzzles completed, win rate, number of times they nabbed a perfect score and their win streak.
Here are four hints for the groupings in today’s Connections puzzle, ranked from the easiest yellow group to the tough (and sometimes bizarre) purple group.
Apple unexpectedly launched yet another device, the very long-awaited AirPods Max, plus the MacBook Neo gets more real-world testing, and Family Sharing gets a great update, all on the AppleInsider Podcast.
Nobody saw it coming but the new AirPods Max is here — image credit: Apple
Just when you thought Apple was done with product launches in March — and just when you thought it would never update the AirPods Max — it went and did it. The new AirPods Max brings everything users have been asking for over the last several years. There’s reason to suspect the new AirPods Max is going to feel outdated in even just a few months, though. And also plenty of reasons to assume Apple won’t release a new version for a long time. Continue Reading on AppleInsider | Discuss on our Forums
schwit1 shares a report from the BBC: A French officer has reportedly revealed the location of an aircraft carrier deployed towards the Middle East after publicly registering a run on sports app Strava. French news outlet Le Monde first reported the officer, referred to as Arthur, logged a 35-minute run on the app while exercising on the deck of aircraft carrier Charles de Gaulle on 13 March. He used a smartwatch to record his run and upload the activity to the app, the paper said, creating a map that showed his location. […] The location of the vessel was said by Le Monde to have been northwest of Cyprus, around 100km (62 miles) from the Turkish coast, with satellite images capturing the carrier and its escort. A representative from the French Armed Forces said the officer’s behavior “does not comply with current guidelines,” which “sailors are regularly made aware of.”
Update: Added that Oracle declined to comment on whether the vulnerability has been exploited.
Oracle has released an out-of-band security update to fix a critical unauthenticated remote code execution vulnerability in Identity Manager and Web Services Manager tracked as CVE-2026-21992.
Oracle Identity Manager is used for managing identities and access across an enterprise, while Oracle Web Services Manager provides security and management controls for web services.
In an advisory released yesterday, Oracle is “strongly” recommending that customers apply the patches as soon as possible.
Advertisement
“This Security Alert addresses vulnerability CVE-2026-21992 in Oracle Identity Manager and Oracle Web Services Manager. This vulnerability is remotely exploitable without authentication. If successfully exploited, this vulnerability may result in remote code execution,” reads the security advisory.
“Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible. Oracle always recommends that customers remain on actively-supported versions and apply all Security Alerts and Critical Patch Update security patches without delay.”
The CVE-2026-21992 vulnerability has a CVSS v3.1 severity score of 9.8 and impacts Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, as well as Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.1.0.
Oracle says the flaw is of low complexity, remotely exploitable over HTTP, and does not require authentication or user interaction, increasing the risk of exploitation on exposed servers.
Advertisement
The fix was released through its Security Alert program, which delivers out-of-schedule fixes or mitigations for critical or actively exploited vulnerabilities. However, Oracle says that patches released through these programs are only offered for versions under Premier or Extended Support, and older unsupported versions may be vulnerable.
Oracle has not disclosed whether the vulnerability has been exploited and declined to comment when BleepingComputer asked about its exploitation status.
In a separate blog post published today, Oracle once again noted the severity of CVE-2026-21992 and warned customers to review the security alert for full details and patch information.
Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.
Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.
The famous cuckoo clock, with its moving, chirping mechanical bird indicating various divisions of time, has been around since at least the 1600s. The most famous of them come from the Black Forest area of Germany, and are still being made worldwide even today. Other clocks with different themes take their inspiration from the standard bird-based clocks from history, and thanks to modern 3D printing and other technologies we can make clocks with almost any type of hour indicator we’d like with relative ease like [Jason]’s golf clock.
While the timekeeping mechanism is a fairly standard analog clock, the hour indicator mechanism in this build is a small figure which putts a golf ball into a hole once every hour. It uses an ESP32-C3 at its core, which controls a pair of servos. One controls the miniature golfer, and the other lifts the ball up into position on the green at the appointed time. Once the ball is in place, the figure rotates, striking the ball towards the hole. Although it looks almost like the ball is guided by a magnet of some sort at first glance, the ball naturally finds its way into the hole by the topography of the green alone.
Almost all of the parts in this build are 3D printed, including the green, the golfer, the frame, and a number of the servo components. There’s also a small sensor that detects if the ball has actually made it into the hole and back to the lifting mechanism, and to that end there’s also a number of configurations that can be made in the software to ensure that the servos controlling everything all work together to putt the ball properly.
The White House has announced a new AI policy framework that calls for Congress to craft federal regulation that overrules state AI laws. The Trump administration has made multiple attempts to overrule more restrictive state-level AI regulation, but has failed so far, most notably in the passing of the “One Big Beautiful Bill.”
The framework focuses on a variety of topics, covering everything from child privacy to the use of AI in the workforce. “Importantly, this framework can succeed only if it is applied uniformly across the United States,” The White House writes. “A patchwork of conflicting state laws would undermine American innovation and our ability to lead in the global AI race.”
In terms of child privacy protections, the framework ask for Congress to require companies to provide tools like “screen time, content exposure and account controls” while also affirming that “existing child privacy protections apply to AI systems,” including limits on how data is collected and used for AI training. The framework also says carveout states should be allowed to enforce “their own generally applicable laws protecting children, such as prohibitions on child sexual abuse material, even where such material is generated by AI.”
The energy-use and environmental impact of AI infrastructure is a going concern, but the White House’s policy proposals are primarily worried about the cost of data centers. The framework suggests federal AI regulation should make sure that higher electricity costs aren’t passed on to people living near data centers, while streamlining the process for permitting AI infrastructure construction, so companies can pursue “on-site and behind-the-meter power generation.” The framework also calls for fewer restrictions on the software-side of AI development, proposing “regulatory sandboxes for AI applications” and asking Congress to “provide resources to make federal datasets accessible to industry and academia in AI-ready formats.”
Advertisement
While a recently AI bill from Senator Marsha Blackburn (R-Ten.) attempts to eliminate Section 230, a piece of a larger law that says platforms can’t be held responsible for the speech they host, the framework appears to propose the opposite. “Congress should prevent the United States government from coercing technology providers, including AI providers, to ban, compel or alter content based on partisan or ideological agendas,” the White House writes. The framework is similarly hands-off when it comes to copyright and the use of intellectual property to train AI. “Although the Administration believes that training of AI models on copyrighted material does not violate copyright laws,” the White House writes, it supports the issue being settled in court rather than by legislation. Though, the White House does think Congress should “consider enabling licensing frameworks” so IP holders can bargain for compensations from AI providers.
The clincher in the White House’s proposal is the idea that federal regulation should preempt state law, specifically so that states don’t “regulate AI development,” don’t “unduly burden American’s use of AI for activity that would be lawful if performed without AI” and don’t punish AI companies “for a third party’s unlawful conduct involving their models.” The idea that AI companies aren’t liable for the illegal or harmful uses of their products is particularly problematic because it lies at the heart of multiple intersecting issues with AI right now, including it being used to generate sexually explicit images of children and allegedly playing a role in the suicide of users.
Ultimately, though, the framework might be too contradictory to be useful, Samir Jain, the Vice President of Policy for the Center for Democracy and Technology, writes in a statement to Engadget:
The White House’s high-level AI framework contains some sound statements of principles, but its usefulness to lawmakers is limited by its internal contradictions and failure to grapple with key tensions between various approaches to important topics like kids’ online safety. It rightly says that the government should not coerce AI companies to ban or alter content based on ‘partisan or ideological agendas,’ yet the Administration’s ‘woke AI’ Executive Order this summer does exactly that. On preemption, the framework asserts that states should not be permitted to regulate AI development, but at the same time rightly notes that federal law should not undermine states’ traditional powers to enforce their own laws against AI developers. States are currently leading the fight to protect Americans from harms that AI systems can create, and Congress has twice correctly decided not to pursue broad preemption.
President Donald Trump has attempted to have an active role in how AI is developed and regulated in the US with mixed results, primarily because, as Jain notes, Congress has been unwilling to give up states’ right to regulate the technology on their own terms. Without that, its hard to say how much of the framework will actually make it into federal law.
Somehow, the whole thing got even faster. Earlier this month, Chinese automaker BYD announced that its Flash Chargers, first rolled out a year ago, can now charge some electric vehicle batteries from around 10 to 70 percent in five minutes, and from 10 to full in about nine. That’s more than 600 miles of range in the time it takes to order a cappuccino and leave a nice tip.
The new BYD chargers can add miles super quickly because they deliver up to 1,500 kilowatts (kW) per charge. Compare that to the 350 kW “hyper-fast” chargers seen more typically in the US, which can top up 80 percent of a battery in 15 to 25 minutes, and the full thing in closer to 40.
BYD’s move brings the charging experience closer to the auto industry’s holy grail: comparable to what drivers expect when they fill up their gas tanks. Survey after surveyfinds that potential EV buyers are worried about range and charging; speeding things up might go some way toward alleviating fears and getting more drivers seriously thinking about the plug. BYD, which doesn’t sell in the US because of high tariffs and national security concerns, has built more than 4,000 of the chargers in China so far, with plans to construct some 16,000 more by the end of the year, plus 2,000 in Europe.
There is, naturally, a catch—plus a few reasons to believe that a super fast charger won’t solve all of the world’s charging issues.
Advertisement
Right now, only one car will be able to take advantage of the Flash Chargers’ hyperspeed in Europe: BYD’s Denza Z9GT, due to make its Paris debut next month. That’s because the EV comes with the newest generation of BYD’s Blade battery. Making its own cars, its own chargers, and its own batteries gives BYD a significant leg-up in charging speeds over most global competitors, as the tech works together. (Tesla has also vertically integrated the charging experience.) To charge at such high speeds, the vehicles’ software and wiring need to be built to handle that much electric current.
BYD didn’t respond to WIRED’s questions, but according to Chinese language media, the newest Blade battery uses a lithium manganese iron phosphate (LMFP) chemistry to increase energy density. (The last version used lithium-iron phosphate, or LFP, which trades some energy density for durability and fast-charging capability). BYD says it has redesigned all of its battery elements, including the electrodes that store and release energy, the electrolytes that allow for ion transfer between electrodes during charging and discharging cycles, and the separators that disconnect and then conduct ion flow.
This all ups the battery’s energy density by 5 percent compared to what it touted as the latest and greatest last year. BYD says the Denza Z9GT can hit more than 620 miles per charge. (Real-life ranges tend to be a bit lower than claims by auto companies.)
The charger itself, a slick, teal T-shaped system that evokes—you guessed it—a gas station pump, belies its complexity. Dishing out more than a megawatt from the electric grid is no small feat, both in hardware and construction involved. BYD says it will make the rollout of the new charger a little easier by incorporating them into existing BYD charging banks, so that the infrastructure isn’t starting from scratch. Beyond that, BYD says it will use storage batteries at the charging sites to supplement the electrical grid, so the grid isn’t overloaded.
Advertisement
The Limits
Despite these impressive speeds, don’t expect BYD’s new system to change the game for EVs. “It’s a good, marginal improvement in technology,” says Gil Tal, who directs the EV Research Center at UC Davis’ Institute of Transportation Studies. “It’s not something that changes most people’s daily life.”
The first reason is practical. Today, most US EV owners have access to at-home charging and only use public fast-chargers on the occasional trip that stretches their 250-mile range. For those people, the difference between charging in 20 minutes and in 5 minutes might be close to negligible.
Looking for the most recent Wordle answer? Click here for today’s Wordle hints, as well as our daily answers and hints for The New York Times Mini Crossword, Connections, Connections: Sports Edition and Strands puzzles.
Some movies age gracefully. Others age into prophecy. Network did the latter and then some. When Sidney Lumet released this ferocious satire in 1976 from a venomously brilliant script by Paddy Chayefsky, audiences didn’t laugh it off as some cute exaggeration about television news. They squirmed. The film landed like a brick through the newsroom window; biting, unnerving, and uncomfortably close to the truth even then. Nearly fifty years later it feels less like satire and more like a documentary with better lighting. Cable news shouting matches. Personality driven commentary replacing journalism. A nonstop outrage cycle designed to keep viewers emotionally hooked. Chayefsky didn’t just understand television. He understood America’s appetite for spectacle long before the algorithms figured it out.
The story kicks off when aging news anchor Howard Beale, played with electrifying intensity by Peter Finch, learns he’s about to be fired because the ratings stink. Instead of fading quietly into retirement, Beale cracks on live television and promises to kill himself on the air during the next broadcast. Not exactly the sort of programming decision that wins industry awards. But something strange happens. Viewers tune in. Ratings spike. Suddenly the breakdown is good television. Enter Diana Christensen, played with ice-cold ambition by Faye Dunaway, a programming executive who sees Beale not as a problem but as a product. Soon he isn’t a journalist anymore. He’s a spectacle. A televised rage prophet urging viewers to open their windows and shout, “I’m mad as hell and I’m not going to take this anymore!” America listens. The ratings explode. The network cashes in. If this all feels familiar, it should, we’ve been living inside that feedback loop for decades.
The emotional backbone of the film belongs to William Holden as Max Schumacher, a veteran newsman clinging to the dying belief that journalism should still mean something. Poor Max. He’s the last adult in a room full of ratings addicts. One of the film’s most devastating scenes arrives when Max confesses his affair with Christensen to his wife, played by Beatrice Straight. Straight detonates with decades of frustration and heartbreak in a performance so raw it feels almost invasive to watch. The scene lasts only a few minutes but it anchors the film’s wild satire in something painfully real. Straight won an Academy Award for it, and rightly so.
Advertisement
For a moment the movie stops being about television and becomes about the collateral damage people leave behind while chasing ambition; the spouses ignored, the families sacrificed, the human wreckage left behind while the ratings climb. We’ve seen the modern version enough times: star anchors imploding, cable personalities flaming out on air, influencers chasing the next outrage clip while the cameras keep rolling. Careers burn, reputations collapse, and the audience moves on before the next commercial break. Lumet and Chayefsky knew the truth the media machine still pretends not to see or care about: behind every viral moment there’s usually someone paying the bill while the network or platform counts the clicks.
Then comes the speech that still rattles around in your skull long after the credits roll. Corporate executive Arthur Jensen, played with thunderous authority by Ned Beatty, summons Beale to a dimly lit boardroom and calmly explains how the world actually works. Nations are illusions. Democracy is window dressing. The real power belongs to multinational corporations. In 1976 Jensen name-checked IBM, Exxon, and AT&T. Today you could easily swap those out for Apple, Amazon, Google, Microsoft, and Meta and the speech would land even harder. Chayefsky understood that television news wasn’t simply reporting events anymore, it was becoming part of the corporate machine that shaped them.
And that’s where Network starts feeling downright uncomfortable in 2026. The film predicted the outrage economy decades before anyone put a label on it. Turn on the television today and it’s emotional theater twenty four hours a day. Panels yelling. Personalities performing. Headlines engineered to keep viewers angry enough to stay glued to the screen. The business model is simple: outrage drives engagement and engagement drives revenue. Diana Christensen figured that out in about thirty seconds. Calm reporting doesn’t trend. Anger does. Journalism slowly mutated into entertainment, and entertainment eventually became politics.
Watching Network today is like opening a time capsule that contains tomorrow’s headlines. It remains wickedly funny, brutally intelligent, and powered by one of the sharpest scripts ever written about American media culture. But what really hits is how little of it feels exaggerated anymore. Chayefsky saw the trajectory clearly: once outrage becomes profitable, it becomes irresistible. The cameras keep rolling. The ratings still rule everything. And somewhere in the digital noise of modern media, Howard Beale is still shouting into the void, mad as hell, begging the rest of us to wake up before the show consumes everything.
Advertisement
Criterion gives Network the kind of restoration treatment the film has long deserved. The new 4K digital restoration presents the movie in Dolby Vision HDR on a dedicated 4K UHD disc, with the film’s original uncompressed monaural soundtrack preserved intact. Lumet never intended this to be a sonic spectacle. This is a film powered by dialogue, and the restored mono track keeps Paddy Chayefsky’s machine gun script front and center where it belongs.
The restoration comes from a new 4K scan of the original 35mm camera negative and is presented in the film’s original 1.85:1 aspect ratio. Dolby Vision improves contrast and shadow detail, but the image still looks like film from the mid 1970s should look. Grain is intact. The newsroom lighting remains harsh and clinical. The endless televisions scattered around the sets finally reveal more texture and depth than older transfers ever managed.
Audio stays faithful to the original theatrical presentation. The uncompressed mono track is clean and focused, which matters because this movie lives and dies by the rhythm of Chayefsky’s dialogue. From Howard Beale’s televised sermons to Arthur Jensen’s thunderous boardroom lecture, every word lands with the bite Lumet intended. Criterion did not try to reinvent Network. They cleaned it up, respected the source, and delivered the sharpest home video presentation this film has ever had.
Criterion also includes a strong slate of supplemental material. Director Sidney Lumet provides a feature length audio commentary that offers insight into the film’s production, the performances, and the controlled chaos of Chayefsky’s dialogue heavy script. The set also includes Paddy Chayefsky Collector of Words (2025), a feature length documentary by Matthew Miele that explores the legendary screenwriter’s life and influence. For those who want deeper historical context, The Making of Network (2006), a six part documentary by Laurent Bouzereau, takes viewers inside the writing, casting, and cultural impact of the film.
Advertisement. Scroll to continue reading.
Advertisement
Movie Details
STUDIO: United Artists
FORMAT: Ultra HD 4K Blu-ray (February 24, 2026)
THEATRICAL RELEASE YEAR: 1976
ASPECT RATIO: 1.85:1
HDR FORMATS: Dolby Vision HDR
AUDIO FORMAT: LPCM Mono (48kHz, 24-bit)
LENGTH: 121 mins.
MPAA RATING: R
DIRECTOR: Sidney Lumet
STARRING: William Holden, Faye Dunaway, Peter Finch, Robert Duvall, Wesley Addy, Ned Beatty, Beatrice Straight
Gamers who remember sliding cartridges into their old Game Boy Color will feel right at home when they pick up the PicoPal. Its clear plastic shell displays all of the internal components while maintaining the classic shape and button layout of old. The small LEDs illuminate the directional pad and action buttons with customizable brightness, making them ideal for late-night gaming sessions when all you want to do is keep playing. And a 2.6-inch screen front and center displays lovely crisp colors on games that used to seem tiny on vintage Game Boys.
Hold the PicoPal and you’ll be surprised at how light and easy it is to slip into your pocket; it doesn’t feel like it’s going to bulge anytime soon. The buttons seem exactly right, with the firm tactile reaction that many players used to enjoy back then. The speakers are angled forward for good sound, but you can also use headphones if you prefer to be alone. A simple USB-C port on the side allows you to easily update and charge your device.
At the center of it all is a Raspberry Pi Pico 2 microcontroller. Some creative developers have managed to overclock it to 300 megahertz, allowing it to run through Game Boy and Game Boy Colour titles without lag. There’s a spare ESP32 chip ready for future wireless connections to be resolved. Games load directly from a microSD card, which can hold up to two terabytes if properly formatted, and the emulation software is based on some of the open-source projects available and appears to run everything just fine with a few tweaks to ensure it all works together smoothly across a wide range of titles.
It’s simple to navigate the menu and select a game, or to load up the last one right away, and you can even store your progress at any time and resume where you left off even if you turn the device off and on again. The deep sleep option preserves the last position you were in ready to go with little to no battery consumption. If you click one button when you turn it on, it can even function as a full-fledged MP3 player, streaming tunes directly from the same card with nice audio.
Battery life varies, however it can last anywhere from two to seventeen hours depending on screen brightness, volume, and whether the button lights are turned on or off. Most users appear to get approximately nine hours with the settings adjusted down slightly. There’s a decent solid DAC and amplifier combo that produces clean sound with no hiss or shaky bass. There’s even an IMU kicking around that can measure motion, possibly for future games or simply to show your G-forces during a vehicle journey.
Other nice touches include preserving screenshots as little files on the card and a fast-forward tool for sections that become repetitious. You may also choose from thirteen various color palettes or go with a lovely plain greyscale. With a rapid button combination, you can access the on-screen menu and change the brightness and other settings on the fly. The cartridge slot is now dormant, but there is plenty of area for future additions; you never know what they may come up with next.
For the truly dedicated makers, there are even more freebies, like a full open-source schematics firmware and a comprehensive bill of materials, allowing you to study the design, tweak the code, or even construct your own version. With future updates, you may expect the ESP32 to come to life for wireless connectivity and the like. Real-time clock support ensures that the time is kept accurate even after long interruptions.
You must be logged in to post a comment Login