Connect with us
DAPA Banner

Tech

What is a DAC? Digital-to-analogue converters explained

Published

on

If you listen to music a lot, chances are that it’ll be a digital music file you’re listening to.

However, what you might not realise is that in order to hear that file, you’ll need a DAC. Digital-to-analogue converters are built into every bit of kit capable of digital sound.

You’ll find a DAC in your phone or laptop, but also your TV or games console, in CD players, as well as wireless headphones, portable music players and more, taking analogue signals and turning them into the digital signal that you hear.

But what exactly are DACs, and why do they matter? Read on to understand why they hold such importance in the audio scene.

Advertisement

What is a DAC?

Before we get into exactly what a DAC is and does, let’s go through a quick re-cap. Human ears aren’t capable of hearing the 0s and 1s that make up digital music; unless you’re secretly an Android (or AI), us humans can only hear analogue signals.

Advertisement

Not just that, but the kit through which we hear music – whatever that may be – can’t play a digital signal either; it can only receive it. In order to transmit it, that signal must be converted into an analogue soundwave first, and that is where a DAC comes into the equation.

A DAC is the middleman within the whole process, unpacking the binary information stored in the digital file so the resulting sound most accurately represents the original analogue recording.

Advertisement
iFi iDSD Phantom DACiFi iDSD Phantom DAC
Image Credit (iFi Audio)

Of course, digital files can be stored in varying levels of quality/sample rates – from 256kbps MP3 streams to 24-bit/192kHz FLAC digital downloads – and this affects the amount of information they contain.

A DAC can only work with what it’s given though, its raison d’être is to make sense of what’s provided and translate it accurately from its binary format and return it as closely as possible to the original analogue recording.

Just be aware that feeding a good-quality DAC a poor-signal quality signal can make shortcomings in that recording clearer. Our review of the Eversolo DAC-Z10 is a good example of that.

Advertisement

Eversolo DAC-Z10 streamerEversolo DAC-Z10 streamer
Image Credit (Trusted Reviews)

Do I need an external DAC?

Not all DACs are created equal. Although every source of digital music contains a DAC, how well it does its job can vary widely.

For example, cheaper DACs might not support more unusual file data rates and are more likely (but not always) to have lesser quality circuitry that results in timing errors, distortion and noise in the sound that’s reproduced.

Advertisement

Timing errors are one of the biggest issues with lesser quality DACs, which is the reason devices such as mobile phones and laptops often aren’t the best source for digital music playback. The DAC included is not always the priority, especially in cheaper handsets.

iFi Go Blu Air portable DACiFi Go Blu Air portable DAC
Image Credit (iFi Audio)

Thankfully, you can improve what you already have and bypass a poor-quality internal DAC with a better quality external one with better internal circuitry that’s focused on making audio sound as good as it can be.

Advertisement

In particular, dedicated hi-fi DACs can tackle timing issues thanks to better, more advanced digital clock circuitry. This means the file conversion to analogue will be tighter, cleaner and more faithful to the original recording.

What type of DAC is right for you?

While any external DAC is likely to offer improvement on the sound pushed through something more basic, this isn’t a given – and its effectiveness will vary. As ever, it’s worth doing your research before you buy.

Advertisement

Device compatibility is an area to take note of, especially as pretty much all mobile devices have now ditched the 3.5mm jack that were common when this article was first published many moons ago.

You can spend thousands on a DAC if you’re rocking a system worthy of that kind of cash – Chord’s top-of-the-range DAVE comes can be had for £10,500.

Equally, if your wallet isn’t quite as flush with money, there are less expensive portable DACs such as the iFi Go Link 2 (£59) which could make all the difference to your audio setup.

Advertisement

Advertisement
iFi Audio Go Link 2iFi Audio Go Link 2
Image Credit (iFi Audio)

This is the reason it’s important to think about how you most listen to digital music. What devices do you use and what functionality do you need?

External DACs can come with a USB-C on-the-go cable, helpful for connecting to Android devices or iOS devices. For added convenience, there are DACs that can connect wirelessly to devices over Bluetooth.

Portable DACs such as the Go Link 2 don’t require any external power as they take it from your device. They keep things simple, with just a USB input and headphone jack for playback.

Spend a bit more on something like the Chord Mojo 2, and you’ll keep the portability but add in coaxial and optical inputs for extra functionality.

A unit such as the Burson Playmate 3 on the other hand, is bigger and requires external power. That makes it one for either your desktop or the hi-fi rack rather. It does offer more connectivity options such as digital or analogue audio inputs, for those with more involved setups.

Advertisement

Advertisement

Make sure these types of DACs come with a built-in headphone amp if you intend to do some private listening through a pair of headphones as not all do.

Make sure you’ve got the best possible quality

Regardless of the DAC you end up choosing, you need to start out with good source material. A low-res Spotify stream just won’t cut it.

You’ll hear optimum results with CD-quality content and above, which is best stored in FLAC, WAV or ALAC (for Apple Macs) lossless PCM formats, or alternatively DSD if you prefer that format.

Advertisement

Again, it’s worth noting that the likes of FLAC and PCM and relatively accessible unless we’re talking about high bit-rates and sample rates. Something more exotic, such as DSD, is not as common, but in the right set-up, it can offer excellent audio quality.

If you’re unaware of what DSD is, it’s an audio format that stands for Direct Stream Digital, and is an alternative to PCM (Pulse Code Modulation).

It differs by offering a bit depth of just one, but much higher sampling rates – DSD64 at 2.8 MHz and DSD128 at 5.6 MHz. If you’re in the DSD camp, it’s worth checking if a DAC supports it as again not all of them do. The ones that are compatible with DSD, tend to be on the expensive side.

Advertisement

Advertisement

In any case, if you enjoy listening to music in the best quality possible, you’ll be well served by adding a DAC to whatever system you have.

Do some research, read reviews, and you’ll be on your way to audio nirvana.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

Porsche is adding an all-electric Cayenne coupe to its lineup

Published

on

Porsche will start selling an all-electric Cayenne coupe in late summer, the latest signal from the German automaker that it still sees market demand for EVs.

The Cayenne coupe EV — which has four doors, unlike a traditional coupe — will join several other all-electric variants of the SUV when it comes to market later this year, including the base Cayenne Electric, Cayenne S Electric, and Cayenne Turbo Electric. Porsche does, after all, love its variants.

And it could be its most successful. When Porsche introduced a coupe version of its gas-powered Cayenne in 2019, it took just a year for the sportier version of the crossover SUV to capture 20% of sales within the Cayenne lineup. Five years later, the coupe variant accounts for 40% of Cayenne sales, according to Porsche. In some markets, the coupe accounts for as much as 90%.

In other words, the numbers suggest that the all-electric Cayenne coupe is a worthy bet even with its six-figure price tag.

Advertisement

The Cayenne Coupe Electric (as it is officially branded) won’t replace its gas-powered or hybrid brethren, unlike the Porsche Macan compact SUV, which will only be sold as an EV after this year.

The company says the Cayenne coupe EV will be sold alongside the other fuel variants well beyond 2030, according to a Porsche spokesperson. That could produce some valuable data for Porsche on what flavor of Cayenne coupe consumers actually want to buy — and whether this electric variant proves to be its most popular. (The extra front trunk space alone could influence some buyers, not to mention gas prices.)

None of those questions can be answered, however, until the Cayenne Electric, Cayenne S Electric, Cayenne Turbo Electric, and Cayenne Coupe Electric go on sale globally later this year — about nine months after the EV version was first unveiled.

Techcrunch event

Advertisement

San Francisco, CA
|
October 13-15, 2026

Image Credits:Porsche /

When the Cayenne coupe EV does go on sale, it will be offered in three variants: the base version, an S coupe, and a turbo coupe. (If you think that’s a lot, go check out how many versions of its flagship Porsche Taycan EV exist.)

The Cayenne Coupe Electric starts at $113,800, not including the $2,350 delivery fee. Prices rise from there with the Cayenne S Coupe Electric at $131,200, and the Cayenne Turbo Coupe Electric at $168,000. Consumers can, of course, spend even more by adding on options like the lightweight sport package, which includes a carbon roof, performance tires, and motorsports-inspired interior features.

Advertisement

For that kind of money, consumers will get a lot of horsepower and torque tucked inside a crossover body with a sloping roofline that is reminiscent of the iconic 911. All variants of the coupe EV come with an 800-volt powertrain, air suspension, and a shared roof design that features a new windshield and an adaptive rear spoiler. The Cayenne coupe EV is also equipped with the North American Charging Standard port, or NACS, that Tesla popularized, as as well as an additional AC charging port.

From here, some specs change depending on the version a consumer buys. The base coupe EV generates up to 435 horsepower and 615 pound-feet of torque, with a top speed of 143 miles per hour and a zero-to-60 time of 4.5 seconds.

For those who aren’t satisfied, there are two more powerful options that push those performance specs much higher. At the top end, the turbo version generates up to 1,139 horsepower and 1,106 pound-feet of torque — putting it up there with the Tesla Model S Plaid, Lucid Air Sapphire, and Porsche Taycan Turbo GT. The turbo version has a top speed of 162 mph and can travel from 0 to 60 mph in an eye-watering 2.4 seconds.

Porsche hasn’t released EPA estimates for the range these coupe EVs will deliver on a single charge. But early real-world testing is in line with other Cayenne electric variants, which is about 360 miles. Of course, if coupe EV buyers opt for those larger tires — which create more rolling resistance, requiring the battery to work harder — the range could drop about 10%.

Advertisement

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Source link

Continue Reading

Tech

Lowest price ever: Apple's 2026 14-inch MacBook Pro M5 Pro plunges to $1,949

Published

on

A bonus in-cart coupon brings the M5 Pro 14-inch MacBook Pro down to a record low $1,949, but supply is limited at the reduced price.

Open MacBook Pro 14-inch laptop with abstract dark wavy pattern on its screen against a blue gradient background, featuring large white text reading M5 PRO $1,949 across the display
Save $250 on Apple’s new 14-inch MacBook Pro with M5 Pro – Image credit: Apple

Apple Authorized Reseller B&H Photo is beating Amazon’s price this Friday on the new 14-inch MacBook Pro that was released in March 2026.
The standard model, which is on sale for $1,949 in Space Black after a $200 cash discount stacked with a $50 in-cart coupon, features Apple’s M5 chip with a 15-core CPU and 16-core GPU. The laptop is also equipped with 24GB of unified memory and 1TB of storage (up from the standard 512GB found in the M4 Pro line).
Continue Reading on AppleInsider | Discuss on our Forums

Source link

Continue Reading

Tech

Fewer than half of Singaporeans feel better off than a year ago

Published

on

Disclaimer: Unless otherwise stated, any opinions expressed below belong solely to the author. Data sourced from the Sensing SG survey by Blackbox Research.

The impact of the war in Iran is being felt by Singaporeans, according to the latest update to the long-running domestic sentiment survey carried out by Blackbox Research on approximately 1500 residents in Apr. The disruption caused by the closure of the Strait of Hormuz, which has led to oil and gas shortages across Asia, is also reflected in higher energy and petrol prices in Singapore.

This, in turn, not only influences the day-to-day transportation costs or electricity tariffs, but the costs of most goods as well, since the country imports almost everything, and all those goods have to arrive by air, road, or, mostly, sea.

It’s hardly a surprise, then, that the cost of living has rebounded as a top national concern, rising from 34% of responses in Q4 2025 to 46% in Q1 2026.

Advertisement
Image Credit: Blackbox Research

What’s more, according to Blackbox, just 46% of Singaporeans feel better off today than a year ago, which is the lowest reading recorded yet and sharp drop from 54% in Q4 of 2025.

And optimism about the future is melting equally quickly.

43% of respondents believe that the country will be doing better a year from now (down from 53%), while the share of those who think it’s going to be worse has doubled from just 19% to 38%.

Image Credit: Blackbox Research

There’s a warning for the government hidden in these statistics, too, as public confidence in the management of cost pressures is sliding already.

While the Government continues to receive high marks for Defence and National Security, which rose by six percentage points to 90%, its performance on Cost of Living has slipped 6 points to 46%.

Other key measures, such as housing affordability, the wealth gap, and GST, have all declined by at least three percentage points.

Advertisement

While a vast majority of the population may be happy with how the country is managed, they do expect the authorities to proactively address crises such as the current one caused by a distant, foreign war. Since the measures announced by PM Wong are only scheduled to be deployed in the coming months, most people haven’t yet felt them in their wallets.

Singaporeans still believe in themselves

Interestingly, the pessimism about the next 12 months in Singapore doesn’t translate into self-doubt, as still more than half of the local residents (52%) expect to be better off. Even though it’s a drop from 59% in Dec, it is relatively much smaller.

Similarly, just 19% see themselves falling behind over the next year—half as many as those who predict that to be the case for the entire country.

Image Credit: Blackbox Research

What’s more, in spite of the headwinds caused by the war, 86.3% are satisfied with the current situation in Singapore, 81.4% rate the economic situation positively, and 76.5% are happy with their personal finances.

In other words, while more people are anxious about what the turbulent future might bring, the vast majority are still very comfortable with where they are. And feel about the same about Singapore as a whole, too.

  • Read other articles we’ve written on Singapore’s current affairs here.

Featured Image Credit: Guo Xin Goh via Unsplash

Advertisement

Source link

Continue Reading

Tech

Ctrl-Alt-Speech: Celebrating 100 Episodes & Launching Our Patreon

Published

on

from the ctrl-alt-speech dept

Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw.

Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed.

In this special episode, Mike and Ben reflect on 100 episodes of the podcast, followed by an important announcement: we’re launching a Patreon and making some changes to Ctrl-Alt-Speech!

Advertisement

Starting on May 28th, Patreon members will get early access to extended weekly episodes with in-depth coverage of an extra major story. The free episodes will continue here on this feed, just slightly shorter and released one day later. 

You can become a member now at one of two levels: Supporters get early access to the extended episodes, and for a limited time Founders get that plus the opportunity to send us news stories that you think we should cover each week. After the new episodes begin at the end of May, the Founder tier will become the Insider tier with all the same benefits at a slightly higher price, so act now if you don’t want to miss out (you’ll also get bragging rights as a founding member!)

We’re immensely grateful to the incredible audience we’ve found over these past 100 episodes, and this is our way of helping make the podcast sustainable for the next 100!

Filed Under: content moderation, trust and safety

Companies: patreon

Advertisement

Source link

Continue Reading

Tech

Meta cuts 8,000 jobs and cancels 6,000 open roles as $135B AI spending reshapes the company from the inside

Published

on

Summary: Meta is cutting approximately 8,000 employees (10% of its workforce) beginning 20 May, cancelling 6,000 open roles, and planning additional cuts for H2 2026. The layoffs, announced via an internal memo from HR head Janelle Gale, are structural rather than performance-based, reorganising teams into AI-focused “pods” while Meta spends $115-135 billion on AI infrastructure this year. The cuts arrive alongside executive stock options worth up to $921 million each and a workplace surveillance programme capturing employee keystrokes to train AI agents.

Meta told employees on Wednesday that it will cut approximately 8,000 jobs, roughly 10% of its global workforce, beginning on 20 May. The company is also cancelling 6,000 open requisitions it had planned to fill, bringing the effective headcount reduction to 14,000 positions. Additional cuts are planned for the second half of the year, though their timing and scope have not been finalised. If the second wave matches the first, Meta will have eliminated roughly 20% of its pre-2026 workforce. The memo announcing the cuts was written by Janelle Gale, Meta’s head of human resources, who said the announcement came early because details had already leaked. “We’re doing this as part of our continued effort to run the company more efficiently and to allow us to offset the other investments we’re making,” Gale wrote. “This is not an easy tradeoff and it will mean letting go of people who have made meaningful contributions to Meta during their time here.

The investments she is referring to cost between $115 billion and $135 billion this year alone. That is Meta’s guided capital expenditure for 2026, a 73% increase over the $72.2 billion it spent in 2025, nearly all of it directed at AI infrastructure. The company is building Prometheus, a one-gigawatt AI supercluster in Ohio coming online this year, and Hyperion, a 2,250-acre, $10 billion facility in Louisiana capable of five gigawatts. It hired Alexandr Wang, the former Scale AI chief executive, as its first chief AI officer in June 2025 through a deal that included a $14.3 billion investment in Scale AI. It is poaching elite AI talent with packages worth up to $1.5 billion for a single engineer. The people being hired are not the same people being fired. That is the point.

The rolling layoffs

The May cuts are the third wave of 2026 layoffs at Meta. In January, the company eliminated more than 1,000 positions in Reality Labs, shutting down several VR game studios and cutting roughly 10% of the division. In March, it cut another 700 employees across at least five divisions, including Reality Labs, Facebook social, recruiting, sales, and global operations. The May round is company-wide and structural rather than performance-based, a distinction Gale’s memo made explicitly. Meta is reorganising teams into AI-focused “pods” and transferring engineers from across the company into the Applied AI organisation. New role categories are being created: “AI builder,” “AI pod lead,” and “AI org lead.” The company’s internal language describes the goal as driving “a step change in engineering productivity and product quality” through “fundamentally rewiring how we operate.

Advertisement

The cumulative toll since 2022 now exceeds 33,000 jobs. Meta cut 11,000 in November 2022, 10,000 in March 2023, 3,600 in January 2025 (framed as performance-based, though employees with positive reviews were caught in the sweep), and approximately 9,700 across the three 2026 waves. The company ended 2025 with 78,865 employees, up 6% year over year, having rehired aggressively through 2024 and 2025 after the original “year of efficiency” reductions. It is now cutting deeper than it rehired. US workers affected by the May round will receive 16 weeks of base pay plus two additional weeks per year of service, and 18 months of health coverage.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

The compensation contrast

Days before the March layoffs, Meta filed SEC disclosures revealing a new stock option programme tied to reaching a $9 trillion market capitalisation by 2031, roughly six times its current valuation. The potential payout: up to $921 million each for chief technology officer Andrew Bosworth, chief product officer Chris Cox, and chief operating officer Javier Olivan, and $787 million for chief financial officer Susan Li. Mark Zuckerberg is not included in the plan. The programme is modelled after Tesla’s Elon Musk compensation structure and is Meta’s first such award since going public in 2012.

Advertisement

The optics are difficult to defend. Stock-based compensation consumed approximately 96% of Meta’s $43.6 billion in free cash flow in 2025. Rank-and-file employees have seen reduced stock compensation in recent years while absorbing successive layoff rounds. The message, whether intended or not, is that the people who survive the cuts will work for less while the people who direct the cuts stand to make nearly a billion dollars each. The $9 trillion target requires Meta’s market capitalisation to grow at roughly 35% annually for five years. If the target is met, the stock appreciation that generates the executive payouts will have been funded in part by the labour cost reductions that the layoffs produce.

The surveillance question

The layoff announcement arrived days after a separate disclosure that sharpened employee anxiety. Meta is installing software on US employees’ work computers under a programme called the “Model Capability Initiative,” which captures keystrokes, mouse movements, and screenshots to train AI agents. Bosworth told employees that “there is no option to opt out of this on your work provided laptop.” The Register reported that employees protested the programme on internal forums. Cornell researchers raised consent and compensation questions about using employee behaviour as AI training data.

The juxtaposition is stark. Meta is asking its remaining employees to generate the training data that will teach AI systems to replicate computer-use patterns, while simultaneously laying off the employees whose patterns the AI will eventually replace. Zuckerberg is building a personal AI agent to handle executive information retrieval and coordination, the same kind of work that middle-management and operational roles traditionally perform. Internal tools called MyClaw and Second Brain are already reshaping how Meta employees interact with the company’s systems. The trajectory is clear: more AI, fewer people, and the people who remain will train the AI that makes the next round of people unnecessary.

The industry pattern

Meta’s cuts landed on the same day Microsoft announced its first voluntary retirement programme in 51 years, offering buyouts to roughly 7% of its US workforce. Oracle eliminated 20,000 to 30,000 employees in March. Atlassian cut 1,600 and replaced its CTO with two AI-focused executives. The tech sector has recorded more than 73,000 job cuts across 95 companies in the first four months of 2026, with projections that the full-year total will exceed the 124,201 eliminated in all of 2025. Every major company cites AI restructuring as the primary driver. The methods differ, Oracle’s was abrupt, Microsoft’s is voluntary, Meta’s is phased, but the direction is the same: traditional roles out, AI roles in, and the spending saved on the former redirected to the latter.

Advertisement

Meta’s Q4 2025 results, the most recent available, showed $59.89 billion in revenue (up 24%), $22.77 billion in net income, and earnings per share of $8.88, beating estimates by 8.4%. Full-year revenue crossed $200 billion for the first time. Q1 2026 results are due on 29 April, with revenue guidance of $53.5 billion to $56.5 billion. The company is not cutting because it is struggling. It is cutting because it has decided that the fastest path to a $9 trillion valuation runs through AI infrastructure, not through the 8,000 people it no longer needs. The question that Gale’s memo does not answer, and that no memo from any tech company this year has answered, is what those people are supposed to do next.

Source link

Advertisement
Continue Reading

Tech

Bitwarden CLI npm package compromised to steal developer credentials

Published

on

Bitwarden

Updated with further information from Bitwarden.

The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing payload capable of spreading to other projects.

According to reports by Socket, JFrog, and OX Security, the malicious package was distributed as version 2026.4.0 and remained available between 5:57 PM and 7:30 PM ET on April 22, 2026, before being removed.

image

Bitwarden confirmed the incident, stating that the breach affected only its npm distribution channel for the CLI npm package and only those who downloaded the malicious version. 

“The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised. Once the issue was detected, compromised access was revoked, the malicious npm release was deprecated, and remediation steps were initiated immediately,” Bitwarden shared in a statement.

Advertisement

“The issue affected the npm distribution mechanism for the CLI during that limited window, not the integrity of the legitimate Bitwarden CLI codebase or stored vault data.”

Bitwarden says it revoked the compromised access and deprecated the affected CLI npm release.

The Bitwarden supply chain attack

According to Socket, threat actors appear to have used a compromised GitHub Action in Bitwarden’s CI/CD pipeline to inject malicious code into the CLI npm package.

According to JFrog, the package was modified so that the preinstall script and the CLI entry point use a custom loader named bw_setup.js, which checks for the Bun runtime and, if it does not exist, downloads it.

Advertisement

The loader then uses the Bun runtime to launch an obfuscated JavaScript file named bw1.js, which acts as credential-stealing malware.

Loader executing the malicious bw1.js file
Loader executing the malicious bw1.js file
Source: Jfrog

Once executed, the malware collects a wide range of secrets from infected systems, including npm tokens, GitHub authentication tokens, SSH keys, and cloud credentials for AWS, Azure, and Google Cloud.

The malware encrypts the collected data using AES-256-GCM and exfiltrates it by creating public GitHub repositories under the victim’s account, where the encrypted data is stored.

OX Security says that these created repositories contain the string “Shai-Hulud: The Third Coming,” a reference to previous npm supply chain attacks that used a similar method and text string when exfiltrating stolen data.

Data exfiltration repository with a
Data exfiltration repository with a “Shai-Hulud: The Third Coming” string
Source: OX Security

The malware also features self-propagation capabilities, with OX Security reporting that it can use stolen npm credentials to identify packages the victim can modify and inject them with malicious code.

Socket also observed that the payload targets CI/CD environments and attempts to harvest secrets that can be reused to expand the attack.

Advertisement

The attack comes after Checkmarx disclosed a separate supply chain incident yesterday that impacts its KICS Docker images, GitHub Actions, and developer extensions.

While it is not known exactly how attackers gained access, Bitwarden told BleepingComputer the incident was linked to the Checkmarx supply chain attack, with a compromised Checkmarx-related development tool enabling abuse of the npm delivery path for the CLI during a limited time window.

Socket told BleepingComputer that there are overlapping indicators between the Checkmarx breach and this attack.

“The connection is at the malware and infrastructure level. In the Bitwarden case, the malicious payload uses the same audit.checkmarx[.]cx/v1/telemetry endpoint that appeared in the Checkmarx incident. It also uses the same __decodeScrambled obfuscation routine with the seed 0x3039, and shows the same general pattern of credential theft, GitHub-based exfiltration, and supply chain propagation behavior,” Socket told BleepingComputer.

Advertisement

“That overlap goes beyond a superficial resemblance. The Bitwarden payload contains the same kind of embedded gzip+base64 components we saw in the earlier malware, including tooling for credential collection and downstream abuse.”

Both campaigns have been linked to a threat actor known as TeamPCP, who previously targeted developer packages in the massive Trivy and LiteLLM supply chain attacks.

Developers who installed the affected version should treat their systems and credentials as compromised and rotate all exposed credentials, especially those used for CI/CD pipelines, cloud storage, and developer environments.

Update 4/23/26: Updated the story with information from Bitwarden confirming the incident was linked to the Checkmarx supply chain attack.

Advertisement

article image

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

Source link

Continue Reading

Tech

Hackers exploit file upload bug in Breeze Cache WordPress plugin

Published

on

Hackers exploit file upload bug in Breeze Cache WordPress plugin

Hackers are actively exploiting a critical vulnerability in the Breeze Cache plugin for WordPress that allows uploading arbitrary files on the server without authentication.

The security issue is tracked as CVE-2026-3844 and has been leveraged in more than 170 exploitation attempts by the Wordfence security solution for the WordPress ecosystem.

The Breeze Cache WordPress caching plugin from Cloudways has more than 400,000 active installations and is designed to improve performance and loading speed by reducing page load frequency through caching, file optimization, and database cleanup.

image

The vulnerability received a critical severity score of 9.8 out of 10 and was discovered and reported by security researcher Hung Nguyen (bashu).

Researchers at WordPress security company Defiant, the developer of Wordfence, say that the problem stems from missing file-type validation in the ‘fetch_gravatar_from_remote’ function.

Advertisement

This allows an unauthenticated attacker to upload arbitrary files to the server, which can lead to remote code execution (RCE) and complete website takeover.

However, successful exploitation is possible only if the “Host Files Locally – Gravatars” add-on is turned on, which is not the default state, the researchers say.

CVE-2026-3844 affects all Breeze Cache versions up to and including 2.4.4. Cloudways fixed the flaw in version 2.4.5, released earlier this week.

According to statistics from WordPress.org, the plugin has had roughly 138,000 downloads since the release of the latest version. It is unclear how many websites are vulnerable, though, because there is no data on the number that have the Host Files Locally – Gravatars enabled.

Advertisement

Given the active exploitation status, website owners/admins who rely on Breeze Cache to boost performance are recommended to upgrade to the latest version of the plugin as soon as possible or temporarily disable it.

If upgrading is currently not possible, admins should at least disable the “Host Files Locally – Gravatars.”


article image

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

Source link

Advertisement
Continue Reading

Tech

This AI bot does the mindless internet scrolling for you so you can skip the brainrot

Published

on

Spending too much time on social media and doomscrolling is bad for your brain. We all know it instinctively, and research has proven it time and again. But the fear of missing out keeps us glued to our feeds anyway.

Noscroll, a new AI-powered service, aims to solve that by reading the internet for you and texting you only what matters. The pitch is simple: no feeds, no brainrot, just signal.

How does it work?

To get started, you text Noscroll’s AI agent at (415) 718-4828. It sends you a link to connect your X account, which gives it access to your likes, bookmarks, and the accounts you follow.

From there, you tell the bot in plain language the topics you want to follow and the ones you don’t care about. It then pulls information from across the web, including news sites, blogs, Reddit, Hacker News, Substack, research papers, and more. You can even point it to specific sources you want it to monitor.

Advertisement

X has the best information on the internet and the worst incentives & culture.

meet noscroll — the AI that doomscrolls it for you and texts you just the things that matter.

no feed. no brainrot. no ragebait. just signal.

try it for free → https://t.co/XqdExWR13j 🙅🏼‍♂️ pic.twitter.com/EaHt2zfb7k

— noscroll (@noscroll) April 21, 2026

Advertisement

The bot then texts you news digests at whatever frequency works for you. If you are a casual reader, you might want a weekly roundup, while a news aficionado might prefer multiple updates a day. 

Each digest includes links and a short summary, but you can always tap through to read the full article. You can also reply to the bot to discuss what you’re reading and tweak your digest. 

Who built it and why?

Noscroll was built by Nadav Hollander, former CTO at NFT marketplace OpenSea. He told TechCrunch that his relationship with X inspired the idea. “It’s phenomenally entertaining and really informative in ways you just don’t get from normal media,” he said, but added that the platform is “so toxic culturally.”

He wanted the news without the misery. So he built the tool himself, alongside a friend from the open source world. Noscroll costs $9.99 per month, but you can try it free for seven days. You can find it at Noscroll.com.

Advertisement

Source link

Continue Reading

Tech

US soldier arrested for allegedly making over $400,000 on Polymarket with classified Maduro information

Published

on

United States soldier Gannon Ken Van Dyke has been arrested and charged for placing bets on prediction marketplace Polymarket using classified information he had access to related to the capture of former Venezuelan president Nicolás Maduro. The US Army Special Forces master sergeant, who was directly involved with the planning and execution of the operation, allegedly made $409,881 in profits.

According to the Department of Justice, Van Dyke created a Polymarket account around December 26, 2025 and made 13 bets related to Maduro from December 27 to January 2. He took the “Yes” position on several Polymarket wagers, including “US Forces in Venezuela… by January 31, 2026,” “Maduro out by… January 31, 2026, “Will the US invade Venezuela by January 31” and “Trump invokes War Powers against Venezuela by… January 31.” The US military captured Maduro and his wife on January 3.

Van Dyke allegedly bet a total of $33,034 and made over ten times that amount from his winnings. He withdrew his money from Polymarket on the day Maduro was captured and then sent it to a foreign crypto vault before depositing it to a new online brokerage account.

Shortly after Maduro’s capture, reports came out about how an anonymous gambler made almost half a million dollars before it was announced, raising concerns that someone had profited off insider military knowledge. The Justice Department says Van Dyke tried to cover his tracks. After reports about the potential insider bets were published, he allegedly asked Polymarket to delete his account, falsely claiming that he lost access to the email he used. He also changed the email address linked to his crypto account to another one not associated with his name.

Advertisement

Van Dyke has been charged with three counts of violation against the Commodity Exchange Act, with each one carrying a max sentence of 10 years in prison. He has also been charged with one count of wire fraud with a max penalty of 20 years in prison, as well as one count of unlawful monetary transaction with a max sentence of 10 years.

Prediction marketplaces have been struggling with insider trading problems, and this is far from the first incident. Recently, Kalshi took action against three political candidates, accusing them of insider trading related to their campaigns. Matt Klein of Minnesota and Ezekiel Enriquez of Texas face a fine of less than $1,000 and suspensions of up to five years. Meanwhile Mark Moran of Virginia faces disciplinary action, a five year suspension and a fine of more than $6,000.

Source link

Advertisement
Continue Reading

Tech

RFK Jr. Wipes His Hands Of This Whole Measles Outbreak Thing

Published

on

from the CYA-jr. dept

In the year 2,000 (cue the Conan O’Brien music), America had so successfully defeated measles as a disease that we were awarded elimination status for the disease. Then Trump was elected to a second term, for reasons I still can’t fully explain, after which RFK Jr. somehow was confirmed as the Secretary of HHS. Almost simultaneously, a massive measles outbreak began in Texas, spreading to most of the other states in the union, with particularly bad outbreaks in Arizona, Utah, and North Carolina. The reason for the outbreak is clear in the CDC statistics: falling vaccination rates for the MMR vaccine allowed the disease to gain a foothold and spread. Meanwhile, Kennedy offered up confused and confusing messaging to the public as to what do about it, oscillating between muted calls for vaccinations, musing that everyone should just get measles for natural immunity, and declaring out loud that measles victims were at fault for not being healthy enough.

Because of his inept leadership on the matter, measles in 2026 is going to be even worse than 2025. We’re on pace to blow past last year’s numbers and, again, it’s because not enough people are getting vaccinated.

Kennedy is, of course, the living avatar of the anti-vaxxer movement. He didn’t create it, but he has worked very hard to propel it into popularity and, now, into government policy. He has everything to do with the current outbreak. But he recently faced Congress and said with a straight face that it has nothing to do with him. Instead, it was those dirty immigrants that are to blame.

But despite Kennedy being the most vocal source of vaccine misinformation, the secretary tried to blame the outbreaks entirely on immigrants who come to the U.S. from countries where measles is not eliminated — framing the issue as a global epidemic rather than a national public health crisis.

“It has nothing to do with me,” he told lawmakers. “If you’re worried about polio and tuberculosis, you should look at the immigration policies in this country. ’Cause the place where it’s occurring are the place[s] where the immigrants are going, because they’re not vaccinated.”

So, a couple of things to say here, both equally important. The scapegoating of immigrants over disease outbreaks is an American tradition going back centuries. It’s stupid, it’s wrong, and it’s plainly racist. I have no doubt that diseases can be spread through foreign visitors, as they can be by domestic travelers as well. But the desire to blame immigrants for whatever the outbreak du jour happens to be is so reliable and predictable that it’s silly. And if you don’t believe that this happens as a result of bigotry, well, you’re just plain wrong.

Advertisement

The other item on which to take note is the complete failure of leadership exhibited by Kennedy. In his remarks, Kennedy went into full CYA mode. He said he’s not anti-vaxx, but he absolutely is. He said the measles outbreak isn’t his responsibility, but he’s the fucking Secretary of Health and Human Services, and it absolutely is. He said dropping vaccination rates are due solely to how the American government responded to COVID-19, but that isn’t remotely the full story, given that vaccination rates experienced declines long before 2020, after which they fell sharply.

And the question that remains for Kennedy is a simple one: what are you doing about all of this? What do you even plan to do about all of this? The job doesn’t end by saying it’s immigrants at fault and then we move on. The disease still has to be combated and, right now, nobody is fighting the fight at the federal level. Instead, we’re talking about curtailing vaccine schedule guidance even further, or eliminating childhood vaccines altogether. Even if Kennedy sincerely wants to help in all of this, his messaging is so muddled and misguided that it isn’t getting through to the public.

Rep. Debbie Dingell (D-Mich.) expressed concern to Kennedy, a longtime anti-vaxxer, over the rising number of infectious disease cases such as measles and polio.

“Every patient, every child with measles should be treated with compassion. But I had seven cases just in the last couple of weeks in my county. The contagious spots have been grocery stores and colleges, you can’t stop it,” Dingell said of measles, the highly contagious disease that U.S. officials announced they eliminated in 2000.

“I’ve met with the family of one of them, and I said, ‘Why didn’t you get immunized?’” she continued. “And they said, ‘We’re listening to our government. Our government tells us not to.’”

Even if you wanted to argue that those people are wrong, they’re not making up lies when they say this. The message they’re getting from HHS is to not vaccinate. This is why public health policy needs to be very clear and in a language the average person can understand. These are life and death situations we’re talking about.

Kennedy’s comments read like an abdication of his responsibility. I can’t think of another way to describe his hand-washing of our current measles fiasco. And that’s one of many reasons he has to go.

Advertisement

Filed Under: anti-vaxxers, blame game, health & human services, measles, rfk jr.

Source link

Advertisement
Continue Reading

Trending

Copyright © 2025