Apple’s iCloud Private Relay is back to private status, after an apparent fix in iOS 26.6.1 patched the vulnerability that would expose a person’s IP address even when the feature was enabled.

iCloud Private Relay is a paid feature available only to those with an iCloud Plus subscription. When it’s active, it routes web traffic through proxy servers to mask your physical location and web traffic. It’s specific to Apple’s Safari web browser and apps that use Apple’s WebKit framework, and is not the same as a VPN, which hides all internet traffic.

Earlier in August, developers Talal Haj Bakry and Tommy Mysk noticed that Apple devices with iCloud Private Relay enabled could still leak their IP addresses in three circumstances. The developers set up a web page at leaks.psylo.app where you could check whether you’re vulnerable.

On Tuesday, Mysk posted on X that Apple’s iOS 26.2.1 release (and the 26.2.1 releases of Apple’s other operating systems) is where the fix appeared, even though it’s not noted in Apple’s security release notes. Now, if you go to that leaks page, it reports the masked IP address, not the actual address, of the device you’re running. You need to have iCloud Private Relay on in Settings > iCloud.

Mysk also noted in a reply on X that, “It’s near to impossible Apple would have addressed this issue so quickly had we reported it to Apple first. As expected, they only fixed it for Safari.”

An Apple representative didn’t immediately respond to a request for comment.

Soon after its existence was revealed, the iCloud Private Relay vulnerability prompted a lawsuit by Clarkson Law Firm, the same outfit that negotiated a $250 million settlement with Apple over how the company advertised its Apple Intelligence features at launch. The firm has also recently sued smart ring maker Oura.

A Clarkson Law Firm representative didn’t immediately respond to a request for comment.

Jeff Carlson

Senior Writer

Advertisement

Jeff Carlson writes about mobile technology at CNET, from cellular phone plans to devices and emerging technology.

See full bio

Current owners of the popular RPG will get the upgrade for free.

from the good-deals-on-cool-stuff dept

Unlock a world of knowledge with a Headway Premium subscription. This exclusive deal gives you unlimited access to Headway’s massive library of 1500+ book summaries, with 30-50 new ones added monthly. Cover any topic you can imagine, from personal development and business strategies to health and wellness. It’s usually on sale for $60 for new users only, but for a very limited time you can get it for $50.

Note: The Techdirt Deals Store is powered and curated by StackSocial. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

Filed Under: daily deal

from the only-white-people-deemed-to-do-it-the-right-way dept

Many Trump supporters keep insisting that his immigration purges are justified because the people swept up in them came here “illegally,” so who cares if they get kicked out (or shipped off to some random war-torn country). When asked what people seeking asylum should do, the answer is often “do it the legal way.” That the US government has spent years making “the legal way” harder and harder — and, as we’re about to see, has now started punishing the people who actually took it — never seems to enter the conversation. But here we have a really clear example of people doing it “the legal way, as instructed by Trump himself” who are about to get kicked out of the US.

The AP is reporting that the administration is about to pull out on the order of 200,000 visas from those who came to the US legally under B1 or B2 visas, and then sought asylum, just as Trump said they should. This would be the largest mass revocation of visas in US history.

The Trump administration is preparing to revoke the business and tourism visas of up to 200,000 foreigners who have applied for or are currently seeking asylum status in the United States. If it happens, the move would be the largest single mass revocation of visas in U.S. history and would likely face legal challenges.

Unless challenged or revised, the State Department is expected to announce in the coming weeks the revocation of so-called B1 and B2 visas issued between 2016 and 2026 whose holders have sought asylum or are now seeking asylum, according to State Department documents obtained by The Associated Press and two U.S. officials. The action will be taken in coordination with the Department of Homeland Security.

“We are coordinating with DHS to identify and revoke the nonimmigrant visas of foreigners who have come to the United States claiming to be short-term visitors, but then file for asylum to stay here permanently,” said State Department spokesman Tommy Pigott.

Advertisement

Go back to 2018, when the first Trump administration proclaimed that anyone crossing the southern border anywhere other than an official port of entry would be ineligible for asylum. The whole framing was that there was a legal way to seek asylum and an illegal way, and only the legal way was going to count. In remarks about this executive order, Trump said that those who wished to seek asylum would have to “lawfully present themselves at a port of entry,” at which point they could seek asylum.

Under this plan, the illegal aliens will no longer get a free pass into our country by lodging meritless claims in seeking asylum. Instead, migrants seeking asylum will have to present themselves lawfully at a port of entry. So they’re going to have to lawfully present themselves at a port of entry.

A few months later, in his State of the Union, he claimed he wanted immigrants to enter the country legally (in large numbers!):

“I want people to come into our country in the largest numbers ever, but they have to come in legally,” he declared…

Note that these are two separate demands: show up at a port of entry rather than sneaking across, and get into the country through legal channels in the first place. The people about to lose their visas satisfied both, and then some. They applied for a visa, got vetted and approved by the State Department, walked in through the front door, and filed an asylum claim through the official process. If there’s a more “legal way” available, nobody has described it.

That demand, that people come “legally” and then make their asylum claims at a port of entry (though the courts later deemed this “asylum only counts at port of entry” to be wildly against the law) still resulted in a ton of people getting legal visas to the US, and then seeking asylum when they entered.

It now appears that (unsurprisingly) the Trump administration was full of shit when they claimed they wanted asylum seekers to “come the legal way.”

There was nothing in what Trump said initially that said they had to get other types of visas to seek asylum. It just said “get here legally and then make your case.” Which is exactly what all of these people did, and Trump and Marco Rubio are about to pull their visas, even though they literally did things “the legal way” that Trump himself had encouraged.

While this won’t necessarily mean immediate deportations, it will likely mean that people with live, pending asylum claims lose their lawful status while those claims are still being adjudicated — which is precisely how you end up removable. And with bands of roving ICE thugs looking for anyone without legal status to deport, you know these people are likely to be added to the target list.

So once again, doing things “the legal way” turns out to protect you from exactly nothing. Follow the instructions the president himself gave you and on the visa the State Department itself issued you, file the paperwork the process demands, and the reward is having that visa pulled while your claim is still pending. What good is doing things “the legal way” when, with the stroke of a pen, Trump and Rubio will make that “legal way” illegal?

The New Colossus poem on the Statue of Liberty reads:

Give me your tired, your poor, Your huddled masses yearning to breathe free…

To which the Trump administration responds: “get the fuck out of here.”

Filed Under: asylum, deportation, donald trump, immigration, marco rubio, trump administratin, visa revocation, visas

Metro Exodus spent much of its time proving this series could survive outside the Moscow Metro. Artyom was always a dreamer and hoped for a better world for the people of the Metro. And despite everything, hope seemed to prevail if you made the right choices in Exodus.

So why is Metro 2039 drawing me back in? It’s not just the name and the setting that’s worth its weight in gold, no. It’s the fact that it takes the bleak world of Dmitry Glukhovsky’s Metro series and takes us deeper into darkness. 4A Games dropped a new Renegade gameplay trailer during Gamescom Opening Night Live, this time putting the new protagonist, The Stranger, in the spotlight once again.

We see him moving through the independent Sevastopolskaya station, where he explored the irradiated Moscow and fought mutants and humans alike. But the latest travel shows us brutality firsthand, reminding us that Artyom is gone. Thinking about the DNA the original Metro 2033 game shared with GSC Game World’s Stalker, this is exactly how I want my Metro.

The tunnels have learned a few tricks from Exodus

The big new location, Sevastopolskaya, was seen again in the new Renegade trailer. 4A describes it as an independent station being slowly destabilized from inside by propaganda and alcohol while Novoreich-backed Raiders put pressure on it from outside. The Stranger visits while chasing information connected to his mysterious target.

Aside from just looking pretty, the entire game feels more interactive, and by that extension, more immersive. Something small like the breaching tool that was used by the Stranger adds to new gameplay mechanics. Similarly, a new UV light can expose hidden mutants, repel flying Insectalis, and uncover codes used in environmental puzzles.

While I loved wandering through sprawling large environments in Exodus, Metro 2039 appears to be bringing that curiosity back into tighter spaces. The new Shatun pneumatic rifle looks appropriately Metro too. Its power depends on keeping the weapon pumped, giving you another mechanical thing to worry about while something horrible is trying to eat you.

Something strange is still lurking down there

Everything about the trailer that caught my eye was related to The Stranger. He wears Spartan armor, yet 4A describes him as a traumatized man focused almost entirely on his own mission rather than saving everyone suffering under Hunter’s Novoreich regime. One line summarizes him rather efficiently:

The Spartans were wolves in helmets. But I’m something worse.

Then comes the part that really has me curious. As Hunter’s propaganda repeats its call that the enemy must be destroyed, the voices of the Dark Ones join him. The trailer stops short of explaining what that means, leaving another supernatural thread hanging over The Stranger’s violent waking nightmares. Unlike before, the Dark Ones don’t look like they are just mysterious; they seem outright hostile.

I was already impressed by how much stranger and more eldritch its post-apocalyptic setting had become. This trailer makes the gameplay side equally promising. Metro 2039 launches in February 2027 for PS5, Xbox Series X/S, Steam, Epic Games Store, and Xbox on PC. An exact date hasn’t been announced.

At the height of the Cold War, one very specialized computer was so secret that the world didn’t know it existed. It ran its jobs up to 200 times as fast as any other computer of its time. It was the U.S. National Security Agency’s main cryptographic processor in operation from the time of the Cuban Missile Crisis in 1962 through the Vietnam War and on past the 1975 Helsinki Accords. The machine stopped running only when its moving parts finally gave out.

The Harvest computer mattered because of what it was as well as when it ran. For 14 years, it was the engine processing the NSA’s most sensitive intercepts at a time when signals intelligence was as close to a strategic weapon as anything short of a warhead.

Designed and built by IBM for the NSA, Harvest was one of the first machines designed to apply operations to enormous datasets rushing past, a precursor to the computers today that manage continuous video streams and security systems in real time. It was also one of the first machines built as an add-on—a specialized helper intended to do one job exceptionally well, bolted onto a general computer. Harvest’s modular design is like a 1960s version of today’s graphics chips that CPUs use to run intensive video-game and AI processing loads.

All that raw processing power meant that Harvest also needed nonstop rivers of data to run on. And that led to another pioneering achievement: the world’s first automated tape library that could robotically fetch any one of hundreds of large cassettes of magnetic tape from the machine’s racks.

Given Harvest’s unprecedented processing and storage capacity, the machine’s designers naturally needed to rethink how their system handled information. So IBM wrote a customized programming language called Alpha to let code breakers rigorously describe cryptographic problems, just as scientists at the time were using the emerging language Fortran to describe equations and data-processing algorithms.

In Fort Meade, Md., an NSA data center hosted one of the world’s fastest computers of its time—although not often discussed, because of its sensitive, high-security code breaking and cipher hunting work. National Cryptologic Museum

The story of Harvest, pieced together from declassified documents and contemporary manuals and technical overviews, provides a new and unexpected vista on the history of computing. It also offers a case study in how national security needs, especially during the Cold War, pushed computer technology beyond the far reaches of what unclassified, civilian computing could achieve. Harvest’s distinctive history reveals a visionary algorithmic, coding, memory, and hardware architecture occasionally decades ahead of its time. But this machine was also built only once, for one singular purpose, and then ultimately quietly retired.

The Heart of NSA’s Secret Machine

IBM’s landmark 1960 transistorized mainframe, the IBM 7030, better known as Stretch, provided the front end for Harvest (which was officially known as the IBM 7950). IBM delivered Stretch to eight or nine customers, mostly scientific research labs, from 1961 through ’63. Designed and prototyped throughout the second half of the 1950s, Stretch introduced the now standard notion of an 8-bit byte. For its first three years of operation, Stretch was the non-classified world’s fastest computer, although it failed to meet IBM’s aggressive goal of running 100 times as fast as Stretch’s predecessor, the IBM 704. While IBM engineers in Poughkeepsie, N.Y., were designing and building Stretch, the company was also quietly discussing a new system that would be built for NSA.

At the time, NSA’s existing cryptanalytic computers—large, batch-processing machines that required human operators to manually stage each tape run—were struggling to keep pace with the sheer volume of intercepted message traffic coming in from around the globe. What the agency needed was a machine that could process an unbroken river of incoming data, automatically, around the clock. That requirement alone profoundly shaped Harvest’s design.

IBM’s Harvest system, custom-built for the NSA for code breaking, paired the IBM 7030 Stretch mainframe with a bespoke data-stream processor. Stretch handled ordinary computing and input/output, including the Tractor automated tape library. Both units shared two kinds of memory: a large main bank and a smaller, faster bank. When Stretch switched to streaming mode, Harvest drew two streams of data, P and Q, from memory, processed them in parallel, and returned the results as a third stream, called R. Chris Philpot

After two failed proposals to NSA, in 1958 IBM finally landed the contract: a Stretch-based machine, augmented by a custom coprocessor, with a revolutionary tape-based storage system, called Tractor.

Stretch’s forte was floating-point math for scientific computations. IBM had designed it primarily for labs working on frontier research like nuclear weapons design and weather prediction. By contrast, the custom coprocessor to be built atop Stretch would help NSA analysts sift through alphanumeric characters—that is, essentially integer data.

Harvest’s coprocessor was the opposite of a general-purpose system. It was, rather, a streaming computer. Instead of executing long series of instructions, it followed one fixed sequence of steps and applied that same sequence to every pair of characters as they streamed past. Harvest shared memory with the main Stretch processor and ran in bursts. Either Stretch was operating, or else it suspended itself while Harvest’s coprocessor shot through data in memory at extreme speeds.

Stretch and Harvest were among the first large computers built entirely from transistors packaged in circuit cards and housed in large, refrigerator-size frames. A 1962 technical manual about Stretch describes the machine’s CPU as divided into functional sections—the instruction unit, the look-ahead unit, the (parallel and serial) arithmetic unit, and the memory bus unit. Harvest inherited Stretch’s basic circuit design but then added something unconventional: Its streaming units processed data in overlapping stages called a pipeline. So while one pair of data bytes was being compared, the next pair was being fetched from memory.

Harvest’s coprocessor operated by fetching two streams of data, called P and Q, from the system’s memory, performing operations on them, then writing the results to memory as a third stream, R. Each stream could be anywhere from 1 to 8 bits wide. Harvest’s memory was bit-addressable, meaning word boundaries could be ignored entirely. For instance, it could fetch just 5 bits rather than filling out a whole byte. Streams P, Q, and R included flexible provisions for looping and addressing data in complex patterns—allowing, for example, repeated fetching of short strings from memory.

Data from P and Q fed into two functional units. The simpler was the logic unit, which performed basic, bitwise operations—the same operations any programmer would recognize today—and wrote its results back to memory. The more complex was a table-lookup unit. It combined incoming data from P and Q to form an address in memory, which could then be used to advance a counter by one, set a specific bit, or retrieve a stored value. The latter unit functioned, in effect, like the rotor wheel inside a cipher-encoding/decoding machine of the era, the kind that electronically substituted one value for another according to the cipher machine’s wiring.

Harvest’s complexity baffled some at the NSA. During employee tours, according to James Bamford’s 2001 NSA history, Body of Secrets (Doubleday), officials would point to the machine and scoff, “It’s beautiful, but it doesn’t work.”

Not everyone at the agency was put off by the monumental device, however. One of the few documented examples of Harvest at work, recounted by Bamford, describes the machine searching 3.5 billion characters of text for any of 7,000 target terms, in just under 4 hours.

In unclassified remarks from 1972, NSA analyst Robert Looney mentions one job Harvest had tackled—though he didn’t specify the end goal or the code-breaking effort behind it. Codenamed “Moretown,” the job involved sifting through 11 million messages spanning 16 years of intercepted traffic against a list of some 8,000 search terms—all in about ten hours.

IBM’s Frances Allen helped design Alpha, Harvest’s custom-built programming language.IBM

IBM’s James H. Pomerene was chief engineer of Harvest, supervising its custom-designed circuits that’d been optimized for algorithms used in many cryptographic jobs.IEEE

IBM’s Fred Brooks Jr. was a key co-architect of Harvest’s hardware system. Computer History Museum

As a unified system, Harvest—that is, Stretch plus IBM’s custom-built streaming processor add-on—streamed 1 byte every 0.3 microseconds, and it boasted about 800 kilobytes of addressable memory.

“Here you see one bank pulled out of its oil bath,” Looney said in his 1972 remarks celebrating Harvest’s tenth anniversary of operations. He held up a photo of Harvest’s magnetic core memory banks—six of them, submerged in oil for cooling.

Factor in the time demands of various data fetches from Tractor’s tape archives, and a single Harvest “instruction” sometimes carried on, without needing any human intervention, for hours.

“It was quite an amazing computer,” recalled IBM Fellow Emerita Frances Allen in a 2001 oral history. “One instruction, for example, could do sorts, and do statistical analysis of the data that was streaming by it.… Everything we were doing at that time was on the cutting edge. There was no question about it.”

Allen, who received the A.M. Turing Award in 2006, was one of the developers who worked on both Stretch and Harvest. At the time she started working on Harvest, Allen noted, the Fort Meade, Md.–based NSA was largely unknown outside of classified intelligence circles. So she at first assumed she was working on an unspecified naval project. “We thought of ourselves as working for the Bureau of Ships, because that was the code name for NSA in the budget!” recalled Allen, who died in 2020.

Other key Harvest designers and early developers wound up becoming influential figures over the course of computing history. Frederick Brooks Jr., recipient of the 1999 Turing Award and a major contributor to the hardware and software for IBM’s System/360, also helped develop Harvest. And James Pomerene, prior to his involvement with Harvest as its chief engineer, had previously helped build the pioneering IAS computer alongside John von Neumann.

How Tractor Stored a World of Data

IBM built the Tractor tape system (IBM 7955) to attach to the same Stretch machine that hosted Harvest, because no existing data storage technologies could keep up with the computer’s staggering throughput. Stretch handled the business of staging tapes from the library to the drives—using Tractor’s automated cassette handler. Stretch also coordinated reading data in from Tractor and writing results back out from Harvest. Harvest, in turn, did all its actual computing on the system’s shared main memory.

In the early 1960s, and even after Tractor and Harvest were installed, hard-drive data storage was in its infancy. For code-breaking jobs of the size Harvest was taking on, disk storage would have been impractical in terms of both cost and sheer floor space. So Tractor had to be based around tape storage.

Each tape was sealed inside a case built like a boombox—twin encased reels under a window, carried by a handle—and, at 6 to 7 kilograms, about as heavy as a bowling ball. Think of a Tractor cassette as an outsize predecessor of the audiocassette, which would come along a decade later, and holding some 120 megabytes of data on a reel of tape 550 meters long. Each storage unit housed up to 160 of these cassettes.

An IBM technician holds one of the data cassettes used with Harvest’s automated Tractor tape drives. IBM

When Harvest launched in 1962, it had three automatic cartridge units, each serving two drives. So the available online storage across the three Tractor units totaled a stunning 44 gigabytes. That’s more than 190 times as much capacity as the IBM 2314 disk storage system, announced in 1965, which held 233 megabytes across its full complement of eight drives.

Tractor had to run continuously, swapping cassettes in and out, 24 hours a day, seven days a week. The system’s tape-handling speed was tuned to keep pace with Harvest’s own appetite for data. The custom-built robotic mechanism for retrieving the cassettes was a servo-driven arm that traversed the system’s storage racks. It fetched a cassette from its slot and delivered it to a handler or received a cassette from one of the handlers and returned it to storage.

Running at 6 meters per second, Tractor’s tapes zipped past the read/write heads faster than the eye could track. Software running on Stretch handled the cassette shuttling as well as reading and writing. For one of Tractor’s drives to move from the completion of processing one tape to reading the next took about 18 seconds, assuming it had already been fetched and was ready to mount. Robotically fetching a cassette from the storage unit and preparing it for reading required no human handling or input whatsoever.

In addition to Tractor, the system had standard reel-to-reel tape drives attached to Stretch. Harvest’s technicians often used the conventional drives for importing and exporting data to and from other systems; there was no other practical way to get large datasets into or out of Harvest. Tractor could also store permanent files and retrieve them directly from its tape libraries when a job required them. In other words, Tractor’s substantial cassette libraries acted both as permanent data storage and as a place to hold transient data for processing by Harvest.

No system in the commercial computing world of 1962 came close to Tractor’s gigabytes of simultaneously accessible data. At most computer centers at the time, “available” data meant physical racks of tape standing somewhere near its drives—accessible only as rapidly as an operator could manually pull a reel and thread it onto a machine, one at a time, over the course of a shift.

Alpha Was Harvest’s Custom-Built Programming Language

Created jointly by IBM and NSA, the Alpha language existed solely to program Harvest’s streaming dataflow engine for code-breaking work. According to a declassified Pentagon history of NSA computers, Alpha stood for Advanced Language for Programming Harvest.

Alpha allowed the programmer to define the alphabet in which code-breaking data would be processed. The language also included two unusual characters with no equivalent in conventional computing until years later, when Multics and Unix introduced wildcard characters. A “scab” (which was represented on Harvest’s input keyboard, a repurposed early IBM Selectric typewriter, by a “?”) stood for a character that was real but unknown. And a “pad” (represented by a blank space) was a null or spacer. These characters provided flexibility of representation for code breaking jobs, in which unknown or uncertain characters were commonplace.

A Harvest operator types on one of the main system consoles, a repurposed IBM Selectric typewriter.IBM

The rules governing Alpha’s operations on strings anticipated other modern rubrics, like “not a number”—a designation describing an unknown value in a dataset that can propagate through calculations, rather than silently corrupting them. Strings in Alpha could also be aggregated into cords, and cords into ropes, giving cryptanalysts a hierarchical vocabulary for describing complex intercepts.

Allen wrote a final technical report on her section of the Harvest software when her part of the project concluded—and just as promptly lost access to it. “I spent the good part of a summer on that,” she recalled in 2001. “And it just disappeared into Fort Meade somewhere.”

Replacing an Irreplaceable Machine

By 1971, according to NSA analyst Looney, the machine was running at its highest utilization ever—115 hours of production a week, or more than two-thirds of the time. Yet the number of jobs it processed had been dropping since 1967. Ordinary data-processing work, Looney noted, was by 1972 migrating to newer, general-purpose machines, leaving Harvest to concentrate on the very large, specialized jobs no other system could handle.

At its tenth anniversary of operations, Looney concluded, Harvest was a machine “conceived in the fifties, born in the sixties, and irreplaceable in the seventies.”

He got the last part wrong.

On 27 February 1976, operators shut down Harvest for the last time. A custom mechanical component in the Tractor tape library had worn out, and the manufacturer of the part was no longer in business. By then Harvest had run continuously for nearly a decade and a half—through the roughest close call in the history of mutually assured destruction and into the age of détente—processing intercepts at a rate no civilian machine could touch. By the time it retired, Harvest had outlived several generations of commercial computing.

A placard commemorates the 1976 decommissioning of IBM’s Harvest computer at the NSA’s headquarters in Fort Meade, Md. National Cryptologic Museum

Somebody at the NSA decided to commemorate the machine with a mock telegram, written under Harvest’s name on the machine’s last day (and now preserved in the agency’s archives). “I first began operations at NSA. Although not widely known, I was probably the largest, fastest, and most technically advanced computer system in the world,” the telegram said. “And now, fourteen years later, the time to retire has come. The cost of my upkeep and operation has been overtaken by more modern equipments and the newer technologies.”

The NSA ultimately replaced Harvest with the landmark Cray-1 supercomputer. The Cray-1 was built from faster, more tightly integrated circuits that could outperform Harvest’s aging transistors at nearly any task, including text processing. Although the Cray was designed primarily for numeric and scientific computing, it sold across many fields—which ultimately made the supercomputer win out once Harvest’s custom-built text-processing hardware was no longer worth the upkeep for just one customer.

The secrecy that shrouded Harvest meant it could claim no lineage of immediate successors. But the ideas it pioneered didn’t disappear—they resurfaced, again and again, in the years that followed.

Tractor’s automated tape library was the forerunner of the robotic storage silos that would become standard in enterprise data centers about 20 years later. Harvest’s pipeline architecture prefigured the dataflow computing movement of the 1980s. The continuous pattern-detecting logic of its match units finds direct echoes in modern hardware packet-inspection intrusion detectors and programmable network switches that today route traffic through the internet at wire speed.

Harvest didn’t found a dynasty. But, in its time, it steadfastly pointed toward the future—in several directions at once.

This article appears in the September 2026 print issue as “The Lost History of IBM’s Cold–War Code Breaker.”

SECURITY

Attackers now ready to exploit how things work, rather than just break them, says Oracle support expert

In late July, Oracle released a mammoth security patch dump with 1,449 patches, in a perhaps unprecedented bad day for database admins.

None of them, it turns out, would have prevented the credential theft on an Oracle database server described by security platform Huntress.

“Even if it had been fully patched, everything working, it still would have happened,” said Craig Savage, cybersecurity lead at Oracle third-party support vendor Spinnaker Support, referring to the attack.

In July, Huntress was alerted to credential theft activity, according to a post from the security company. The attack involved a “simple” SQL injection exploiting an unnamed organization’s public-facing web app.

Although SQL injections have a long history and are easy to avoid with good info-sec housekeeping, what happened next was more unusual.

“After gaining initial access, the threat actor dropped a post-exploitation toolkit (called khunt) via a Java Source within an Oracle database, which is a novel aspect of this attack,” Huntress said.

Because a code-object can be loaded directly in Oracle’s database engine, the malicious actors were able to upload their toolkit directly into the database.

“This is a technique that’s previously been discussed and described over the years, including via a technique described as oraexec – however, the use of the technique in the wild has rarely been documented,” Huntress said.

Oracle’s database has an embedded Java Virtual Machine (JVM), and users can take Java source code and store it as a database object. “This is what attackers did during this incident: they fed CREATE JAVA SOURCE commands to the Oracle database from [Java implementation] Tomcat, through the [database] connection, and the Java source code contained within was then compiled directly inside the database as a stored schema object,” the vendor said.

Speaking to The Register, Savage said: “Oracle has its own JDK. You are able to build and run Oracle Java programs within the database. It should never be something a web server can do. In fact, in a production Oracle environment, it should be locked down. It should only be re-enabled during a development or maintenance window, for example. It was poorly configured, poorly secured, but it wasn’t an Oracle breach.”

The ability to run Java in the database should be limited to only the DBA user, Savage argued, and users should disable the ability to compile code on a production server. “If they’d done that, it would have downloaded that Java code, and JDK would not have been configured to compile it,” he said.

Savage said cybercriminals were seeking to exploit this kind of functionality more commonly, rather than simply looking to find and use vulnerabilities.

“We’re starting to see more and more of this: these cybercrime gangs now know about these products. They don’t just know how to break them. They also know what legitimate functionality they could potentially use if it’s been turned on, and that’s what we saw here. That’s the wake-up call. Oracle published something like 1450-ish patches. Organizations are totally focused on patch, patch, patch, but you still need to do the basics,” he said. ®

The premium car audio arms race has become wonderfully ridiculous.

Genesis just unveiled a 25-speaker Bang & Olufsen system with a discrete 7.1.4 Dolby Atmos layout for its flagship GV90. Cadillac has stuffed 38 AKG speakers into the Escalade IQ. BMW offers 36 Bowers & Wilkins speakers in the 7 Series, while Volvo continues expanding Dolby Atmos and Apple Music Spatial Audio across its latest Bowers & Wilkins-equipped EVs.

Porsche, apparently deciding that another dozen loudspeakers would be too obvious, has gone after the semiconductors instead.

The German automaker has developed what it describes as the world’s first production-ready high-end automotive audio system to incorporate gallium nitride (GaN) semiconductor technology, with the first application scheduled to reach a future Porsche vehicle in 2027. The technology is being integrated into Porsche’s Burmester 3D High-End Surround Sound System and was developed with the University of Stuttgart.

There is an important technical distinction here. Porsche has not announced that every amplifier stage in the Burmester system is becoming a GaN design.

A GaN-based high-performance chip is being used for the voltage conversion required to power the system’s 400-watt subwoofer amplifier. That may sound less dramatic than proclaiming that Porsche has invented a giant GaN-powered stereo on wheels, but it is also considerably more accurate.

Why Is Porsche Using GaN?

Gallium nitride is already familiar to anyone following modern Class D amplification and compact power supplies. Compared with conventional silicon semiconductors, GaN devices can switch at higher frequencies with lower losses, helping engineers reduce heat and shrink some of the supporting circuitry.

Those advantages are particularly useful inside a car, where packaging space and weight matter far more than they do in a listening room.

Porsche says the improved efficiency allows the Burmester amplifier’s heat sink to be approximately 20 percent lighter, while passive components including capacitors and inductors can also be made smaller.

That 20 percent figure applies specifically to the heat sink, not the complete amplifier or audio system.

From Stuttgart University to a Production Porsche

The project began in mid-2023, when Porsche engineers started investigating whether GaN could meet the thermal, durability and packaging demands of an automotive environment.

Beginning in spring 2024, Porsche audio, semiconductor and sustainability specialists worked with the Institute for Robust Power Semiconductor Systems at the University of Stuttgart to develop a prototype GaN-based subwoofer amplifier.

Porsche subsequently worked with an unnamed international semiconductor manufacturer and an audio development partner to turn the concept into a production-ready design. The company says several patent applications have resulted from the project.

The first production application is scheduled for 2027, although Porsche has not disclosed which model will receive it first.

We also don’t know the complete speaker configuration, total amplifier output, option price or whether the first GaN-equipped system will otherwise mirror one of Porsche’s existing Burmester installations.

What Does Burmester Already Offer in Porsche Vehicles?

The current electric Porsche Macan provides useful context.

Its $6,010 optional Burmester 3D High-End Surround Sound System uses 21 speakers, 21 amplifier channels and 1,470 watts of total system output, including a 400-watt active subwoofer.

Porsche has also been expanding its immersive audio capabilities. For model year 2026, compatible vehicles equipped with premium Bose or Burmester systems gained support for Dolby Atmos through the latest Porsche Communication Management platform.

The GaN project therefore isn’t replacing Porsche’s broader push toward immersive audio and advanced DSP. It is addressing the electrical hardware underneath those systems.

Automotive Audio Is Getting Serious

We have been watching this transformation accelerate throughout 2026.

The Genesis GV90 arrives with a 25-speaker Bang & Olufsen Premier 3D system configured as a 7.1.4 Dolby Atmos layout, including four overhead speakers. Acoustic Lens Technology, cabin isolation and B&O’s Virtual Venue processing make it one of the more ambitious factory systems announced this year.

The Cadillac Escalade IQ’s 38-speaker AKG Dolby Atmos system was also one of the best automotive immersive audio demonstrations we heard at NAMM 2026. Its success wasn’t simply about the speaker count; the system worked because the drivers, processing, bass reproduction and cabin were engineered together.

BMW’s current 7 Series offers a 36-speaker Bowers & Wilkins Diamond Surround Sound System with Dolby Atmos, while Volvo continues pursuing the same immersive direction with Bowers & Wilkins systems in vehicles including the EX60, EX90 and ES90.

Premium automotive audio is no longer defined by attaching a famous hi-fi badge to a door grille and hoping somebody notices before signing the lease. Cabin acoustics, streaming platforms, DSP, amplification and immersive formats are increasingly being developed as parts of the same system.

Porsche’s GaN project adds semiconductor efficiency to that equation.

What Makes Porsche’s GaN System Unique?

What separates Porsche’s announcement from most recent high-end car audio launches is its focus.

Genesis, Cadillac, BMW and Volvo are primarily pushing immersive playback, additional channels and more sophisticated cabin processing. Porsche is working deeper inside the electronics, attempting to reduce the size, weight and thermal demands of the hardware supplying that performance.

In a sports car or EV, those gains matter.

Nobody should expect this single audio component to produce a meaningful increase in driving range, and Porsche has made no such claim. The significance is more about what could follow.

The company says it is already examining additional GaN applications elsewhere in the vehicle, including power conversion in high-voltage systems used by electric sports cars, while also evaluating broader uses within automotive audio.

The subwoofer amplifier may therefore be the first production application rather than the final objective.

Price & Availability

Porsche says the first production implementation of its GaN technology will appear in a future Porsche vehicle in 2027.

The company has not announced the vehicle, U.S. availability, pricing, complete Burmester system specifications or whether the technology will initially be standard equipment or part of an optional audio package.

The Bottom Line

The Porsche and Burmester GaN project matters because it approaches premium automotive audio from a different direction. While much of the industry is concentrating on Dolby Atmos, DSP and ever-more-elaborate speaker arrays, Porsche is trying to make the electronics behind those systems smaller, lighter and easier to cool.

For now, the application is relatively focused: GaN-based voltage conversion for a 400-watt Burmester subwoofer amplifier arriving in an unnamed Porsche model in 2027.

But if Porsche can expand the technology across more of the audio system and eventually into other areas of the vehicle, this could prove considerably more important than adding another row of speakers to the headliner.

For more information: newsroom.porsche.com

Related Reading:

It’s a shame the Fold is only available in two colors: Obsidian, the color of my review unit, looks more like a dark matte gray than black, while Olive Green has a shinier gold frame.

I’m not a fan of Google’s asymmetrical design. With the Pixel 11 Pro Fold closed, there’s a curved corner cutout, and when you open the phone, the two halves have slightly different thicknesses. All folding phones still have a detectable fold line in the middle of the screen when you open them, but Google’s is among the most noticeable. Some folks won’t notice or care, but I’m the kind of guy who goes upstairs to turn the light on so the downstairs switches aren’t misaligned.

The fingerprint sensor in the power button always bugs me when I switch to a folding phone, because I have to pick it up to touch it and unlock the screen, rather than pressing on the screen like most phones. You do have face unlock with the Pixel 11 Pro Fold, and it works well provided there’s ample light, but it still doesn’t work in a dark room, which is still annoying.

You get two lovely, sharp OLED displays in the Pixel 11 Pro Fold: an 8-inch main screen and a 6.5-inch cover screen. Both push peak brightness to 3,600 nits, remaining legible in direct sunlight, and boast a variable refresh rate up to 120 Hz. They’re smooth, with rich colors, and I have nothing to complain about beyond that crease.

Pro Pretender

I’m not convinced the 11 Pro Fold earns the “Pro” in its title. It does have the new HiLight feature, a group of color LEDs in the camera module’s flash that light up different colors based on who is calling, or swirl through the rainbow while you chat to Gemini. It’s neat, if a little underbaked. It’s handy if you put your phone face down when you’re working or trying to relax, but it’s a very minor feature.

All the Pixels get the new Tensor G6 processor, and the Fold has 16 GB of RAM paired with 256 GB, 512 GB, or 1 TB of storage. Switching from the Pixel 10 Pro XL, it was mostly smooth sailing. But it froze a couple of times in split-screen view in Gmail and after launching an app on the outer display, then unfolding the inner display.

The 11 Pro Fold actually has more in common with the regular Pixel 11, because it misses out on the high-end camera in its Pro siblings. Folding phones struggle to match flagships on camera specs because of form-factor limitations, and they must include two front-facing cameras (one for open and one for closed).

Photograph: Simon Hill

ON-PREM

State and local regulators would decide whether the public gets a say on minor-source permits

Soon, you may not even be able to find out what that new neighborhood bit barn could do to your air quality. A proposed change by the US Environmental Protection Agency (EPA) would eliminate federal minimum requirements for public participation in minor-source air permits, a move critics warn could affect some datacenter projects.

The Environmental Protection Network, which is made up of former employees of the EPA itself, says the proposed rule change would eliminate mandatory public notice and comment requirements for so-called minor New Source Review (NSR) industrial air pollution permits in state plans under the Clean Air Act (CAA).

Instead, state and local air quality regulatory authorities would be able to determine whether and to what extent public participation in minor NSR programs is necessary, effectively allowing them to decide whether the public is notified about new sources of pollution or modifications to existing sources.

The EPN, which has submitted formal public comments on the proposed changes, warns that it would leave communities in the dark regarding industrial developments. These could include large-scale, fossil-fueled power generators for AI datacenters that may be permitted as minor or synthetic-minor sources, and therefore avoid more stringent major-source review, it claims.

“By eliminating the long-standing federal requirement for public notice, this proposal continues efforts by the current administration to turn its back on the fundamental EPA principle of transparency,” said Mike Koerber, a former deputy director of EPA’s Office of Air Quality Planning and Standards.

We asked the EPA for comment.

The agency’s current administrator, Lee Zeldin, stated earlier this year that the Trump administration was not going to set national-level environmental rules for the growing datacenter industry. He argued that state and local governments were best equipped to make such decisions, as local conditions like water availability, air quality, and electricity needs differ between regions.

But the EPN says that the current proposal directly contradicts Zeldin’s earlier transparency memorandum, which pledged that “the public must be able to trust our work” and called for “the fullest possible public participation in our decision making.”

Without public review, facilities such as datacenters may be able to avoid major-source controls on pollution altogether, it warns.

The build boom in new server farms to profit from the AI gold rush has often run into difficulties when it comes to getting a connection to the grid. Rather than wait years, many developers or operators opt for on-site power generation, typically supplied by gas-burning turbines. But this can have an effect on local communities, thanks to emissions of smog-generating nitrogen oxides (NOx) and other pollutants.

This comes against a background of rising public opposition to bit barns, with a recent Gallup survey finding that more than 70 percent of Americans would be against the construction of a facility in their neighborhood.

But President Trump has become more vocal in his backing for datacenters. Speaking out about the Texas governor’s decision to pause new grid-connection approvals for datacenter projects, he claimed it would be a mistake to push back on datacenters, saying “taxes are going to go way down because this is a tremendous source of income.”  ®