In a letter to the residents of Tumbler Ridge, Canada, OpenAI CEO Sam Altman said he is “deeply sorry” that his company failed to alert law enforcement about the suspect in a recent mass shooting.

After police identified 18-year-old Jesse Van Rootselaar as a suspected shooter who allegedly killed eight people, the Wall Street Journal reported that OpenAI had flagged and banned Van Rootselaar’s ChatGPT account in June 2025 for after she described scenarios involving gun violence. The company’s staff debated alerting police but ultimately decided against it, eventually reaching out to Canadian authorities after the shooting.

OpenAI has since said that it is improving safety protocols, for example by putting more flexible criteria in place to determine when accounts get referred to authorities, and by establishing direct points of contact with Canadian law enforcement.

In Altman’s letter, which was first published in the local newspaper Tumbler RidgeLines, the CEO said he’d discussed the shooting with Tumbler Ridge Mayor Darryl Krakowka and British Columbia Premier David Eby, and they’d all agreed “a public apology was necessary,” but “time was also needed to respect the community as you grieved.”

“I am deeply sorry that we did not alert law enforcement to the account that was banned in June,” Altman said. “While I know words can never be enough, I believe an apology is necessary to recognize the harm and irreversible loss your community has suffered.”

Altman also said that OpenAI’s focus will “continue to be on working with all levels of government to help ensure nothing happens like this again.”

In a post on X, Eby said Altman’s apology is “necessary, and yet grossly insufficient for the devastation done to the families of Tumbler Ridge.”

Canadian officials have said they are considering new regulations on artificial intelligence but have not made any final decisions.

If you are in a crisis or having thoughts of suicide, call or text 988 to reach the 988 Suicide and Crisis Lifeline.

Is truth determined by the size of the audience it reaches?

If so, Michael—a new film about the pop singer Michael Jackson that is on track to have the biggest-ever opening for a music biopic, with projected earnings of $70 million at the US box office, despite critics saying it sanitizes the reality of who Jackson actually was—intends to supplant the King of Pop as the apotheosis of artistic virtue.

The film’s release has sparked a civil war online, between those eager to reclaim the music and myth of Jackson, and those who see any celebration of him as a failure of accountability.

Musically, Jackson was in a class all his own. In the pre-social media days, before AI artists charted on Billboard and he became a recurring meme online, Jackson was the epitome of monoculture: 13 number one singles, countless awards, twice inducted into the Rock & Roll Hall of Fame. He remains, even in death, one of the best-selling music artists of all time. But his legacy was also defined by multiple allegations of sexual abuse, an occasionally eccentric personal life, and Jackson’s on-record admission of sharing his bed with underage boys. “This guy was worse than Jeffrey Epstein,” Dan Reed, the director of Leaving Neverland, the 2019 Emmy-winning HBO documentary about Jackson’s alleged sexual misconduct, recently told the Hollywood Reporter.

Director Antoine Fuqua, who maintains Jackson’s innocence, never intended to fully avoid the allegations that circled Jackson later in life. According to him, the original cut of Michael included a reenactment of the 1993 police raid on Neverland Ranch, where Jackson was strip-searched to verify the physical description of his first accuser, Jordan Chandler. But the scene was ultimately scrapped along with the film’s entire third act—totaling $15 million in reshoots—because of a legal clause in a settlement with Chandler that prohibited the depiction of his experience on screen.

The result is a film that stops abruptly in 1988 and erases the most controversial two decades of Jackson’s life. Instead, the film emphasizes Jackson’s musical legacy—the story arc is structured around career-defining music moments, like the making of the “Thriller” video—over the more contentious aspects of his personal behavior.

Scrubbing the Neverland Ranch scene, but also choosing to completely write around any of Jackson’s alleged misconduct, is not surprising given that the Jackson estate had approval over the use of his music, essentially granting it veto power over the film’s final cut. One argument that keeps surfacing on social media is that critics should judge Michael on its own terms rather than on what they think it should have been. “It seems like people wanted a movie [that] was never going to exist,” noted one X user. “So it was never going to be salacious or introspective”

Jackson’s fans argue the allegations shouldn’t eclipse his musical and artistic legacy, separating the artist from the work, while critics insist that a biopic should present a complete picture of Jackson, regardless of how unflattering that picture may be. As film critic Sean Burns characterized it on X, ending “with the release of Bad is like ending an OJ biopic with him winning the Heisman.” A good Michael Jackson movie, wrote the artist Harmony Holiday, “would be part tragedy, part farce,” calling attention to how the film lacks the real kind of interiority that made Jackson so polarizing.

“Watching it feels more like being frog-marched through a wax museum than watching a movie, each milestone restaged with an off-putting, uncanny-valley resemblance and no interiority,” critic Alison Willmore noted in Vulture.

A 31-year-old engineer and computer scientist was identified in media reports and President Donald Trump as the suspected shooter at the White House Correspondents Dinner on Saturday night.

Cole Tomas Allen, of Torrance, California, was apprehended following the firing of shots at the Washington Hilton, where Trump was scheduled to deliver remarks to a ballroom full of journalists, cabinet officials, and Hilton staff. Allen’s name surfaced in media reports shortly before Trump posted two photos of a suspect following his apprehension. The person in the photos Trump posted matches photos of Allen.

In dramatic scenes, several shots were heard outside the ballroom, after which Trump and Vice President JD Vance were immediately rushed off the stage by the United States Secret Service. In the immediate aftermath of the shooting incident, it briefly appeared as if the event would proceed—Trump posted “LET THE SHOW GO ON” on Truth Social—but the event was eventually shut down.

According to the Metropolitan Police Department, the suspect “charged” a Secret Service checkpoint at the Hilton hotel, and was intercepted by agents. MPD interim chief Jeffery Carroll said the suspect was carrying a “shotgun, handgun, and multiple knives.”

At a White House press conference following the shooting, Trump said one United States Secret Service agent was shot but saved from serious injury by his bulletproof vest. Trump said the agent, who was not named, is “doing great” and in “great shape.” No other injuries were immediately reported.

The suspect was later transported to a local hospital “to be evaluated,” according to Carroll, who said he appears to be a “lone actor.”

Around the time Trump’s press conference began on Saturday night, he posted a picture on his Truth Social account appearing to show the suspected shooter on the ground, with his hands restrained behind his back, and a foil warming blanket covering the lower half of his body.

A WIRED review of public databases shows a seemingly minimal online presence associated with Allen’s name. According to his LinkedIn profile, he graduated from Caltech in 2017 with a bachelor’s in mechanical engineering from California State University Dominguez Hills in 2025 with a master’s in computer science. A photo that appears to be of Allen appears on the Caltech site identifying him as a member of the school’s Mechanical Engineering 72 class, described by the school as a “two-term engineering design lab” for building robots and autonomous vehicles. His name is also listed in a 2025 Dominguez Hills graduation program. A search in a public facial recognition database returns only two images, both apparently of him as an undergraduate.

According to the shooter’s LinkedIn profile, he has been employed part-time since March 2020 at C2 Education, a private company that helps students prepare for the SAT and ACT exams. In December 2024, C2 Education said in posts on LinkedIn and Facebook that he was the company’s “December Teacher of the Month.”

Since 2018, the suspected shooter self-identified on his LinkedIn profile as a “self-employed” indie game developer. He appears to have released an “atomic fighting game” called Bohrdom on Steam in 2018. He advertised the game using accounts on YouTube and X that appeared to have little to no following. The caption for a trailer of the game describes it as a “non-violent, skill-based, asymmetrical fighting game loosely based on a chemistry model that is itself loosely based on reality.”

Relatives of Allen’s did not immediately respond to requests for comment. C2 Education and the Metropolitan Police Department also did not immediately respond to requests for comment.

In a recent experiment, Anthropic created a classified marketplace where AI agents represented both buyers and sellers, striking real deals for real goods and real money.

The company admitted this test — which it called Project Deal — was only “a pilot experiment with a self-selected participant pool” of 69 Anthropic employees who were given a budget of $100 (paid out via gift cards) to buy stuff from their coworkers.

Nonetheless, Anthropic said it was “struck by how well Project Deal worked,” with 186 deals made, totaling more than $4,000 in value.

The company said it actually ran four separate marketplaces with different models — one that was “real” (where everyone was represented by the company’s most-advanced model, and with deals actually honored after the experiment) and another three for study. 

Apparently, when users are represented by more advanced models, they get “objectively better outcomes,” Anthropic said. But users didn’t seem to notice the disparity, raising the possibility of “‘agent quality’ gaps” where “people on the losing end might not realize they’re worse off.”

Also, the initial instructions given to the agents didn’t appear to affect sale likelihood or the negotiated prices.

Microsoft is rolling out a major overhaul of its Windows Insider Program, aiming to simplify how early Windows features are tested while addressing long-standing user complaints around complexity and control. The update marks one of the biggest structural changes to the program in years, signaling a shift in how Microsoft wants to collaborate with its testing community.

A Simpler Insider Program Built Around Feedback And Control

The revamped program introduces a streamlined structure, reducing multiple Insider channels into two primary ones: Beta and Experimental. This replaces the earlier, more fragmented system that included Dev, Canary, and Release Preview channels, which often confused users about where they belonged.

Microsoft is also making it easier for users to move between channels or exit the program without needing a full system reset, thanks to in-place upgrade options.

Alongside structural changes, the company is rolling out new preview builds and features that focus heavily on usability. Early updates include improvements to Windows Update, such as the ability to pause updates, avoid forced restarts, and gain more control over when updates are installed.

This shift reflects direct feedback from users who have long complained about disruptive updates and lack of control.

Why This Overhaul Matters For Windows As A Platform

The Windows Insider Program is more than just a testing environment. It plays a critical role in shaping the future of Windows by allowing millions of users to test features before they reach the general public.

By simplifying the program, Microsoft is attempting to make feedback more meaningful and participation more accessible. The previous multi-channel system often led to fragmentation, with users unsure about stability levels or feature timelines.

The new approach suggests Microsoft is prioritizing clarity and efficiency over experimentation chaos. It also indicates a broader shift toward improving Windows 11’s overall quality, rather than rushing out features without sufficient refinement.

Why This Should Matter To You As A User

Even if you’re not a Windows Insider, these changes will likely affect your everyday experience. The Insider Program acts as a testing ground for features that eventually roll out to all users. Improvements in update control, system stability, and feature clarity will directly influence future Windows releases.

For enthusiasts and developers, the changes make it easier to participate in testing without dealing with confusing channel choices or risky upgrades. For regular users, it means the features you eventually receive are more likely to be polished and less disruptive.

In simple terms, a better Insider Program leads to a better Windows experience overall.

What Comes Next For Microsoft’s Insider Strategy

The rollout of the revamped program is happening in phases, with users gradually being moved into the new channel structure. Microsoft is expected to continue refining the experience, focusing on transparency, clearer communication, and stronger integration of user feedback into development decisions. There are also indications that future updates will place greater emphasis on performance, reliability, and user control rather than just adding new features.

This overhaul doesn’t introduce a new version of Windows, but it may be just as important. It reflects a recognition from Microsoft that building a better operating system starts with listening more effectively to the people who use it.

Author: Eirik Salmi, System Analyst at Passwork

When a threat actor walks into your network using a legitimate username and password, which control stops them?

For most financial institutions, the honest answer is: nothing catches it immediately. The attacker looks like an authorised user. They move laterally, escalate privileges, and map critical systems for an average of 186 days before the breach is even identified — and a further 55 days to contain it — according to IBM’s Cost of a Data Breach Report (2025).

By then, the operational damage is done, and the regulatory clock has already started.

On January 17, 2025, the Digital Operational Resilience Act (DORA) entered into application across the EU. Article 9 of the regulation makes credential security a binding financial risk control, with supervisory consequences for institutions that fall short.

The question is no longer whether your authentication posture meets best practice. It is whether it meets the law — and whether you can prove it.

This article traces the specific Article 9 requirements that govern credential management, explains why a compromised password is an operational resilience failure under DORA’s framework, and outlines the practical controls that close the gap.

The threat that DORA was built to counter

Stolen credentials are the single largest initial access vector in 2025, accounting for 22% of all data breaches, per Verizon’s Data Breach Investigations Report. For financial institutions, the sector-specific cost of that exposure averages $5.56 million per incident, according to IBM’s Cost of a Data Breach Report — down from $6.08 million in 2024, yet still the second-highest of any industry globally.

The supply side of credential theft has been fully industrialised. Initial Access Brokers sell verified corporate network access for an average of $2,700, with 71% of listings including privileged credentials — pre-packaged access that requires no technical skill to exploit, according to Rapid7 research.

Infostealers such as Lumma, RisePro, StealC, Vidar, and RedLine automate credential harvesting at scale. IBM X-Force data shows their delivery via phishing increased 84% year-on-year in 2024, with 2025 data pointing to an even steeper trajectory.

DORA’s Article 9 exists precisely to interrupt this chain. The regulation reflects a documented, ongoing threat to the operational continuity of European financial markets.

What DORA Article 9 actually requires

Article 9 of DORA — titled “Protection and Prevention” — sits within the ICT risk management framework mandated by Article 6. It sets out specific technical and procedural obligations that financial entities must implement.

Two provisions are directly relevant to credential management.

• Article 9(4)(c) requires financial entities to “implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only.” This is the least-privilege principle, stated as a legal obligation.

Advertisement

• Article 9(4)(d) goes further, requiring entities to “implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes.”

Unpacking that language in operational terms: MFA is mandatory. The reference to “relevant standards” points directly to FIDO2/WebAuthn — the most widely deployed authentication standard currently resistant to Adversary-in-the-Middle (AiTM) phishing kits, which can bypass SMS and TOTP-based MFA in real time. Cryptographic key management is a regulatory requirement.

Privileged access management (PAM) tools are not named explicitly in the regulation — but the controls they deliver map directly onto Article 9’s requirements. Session recording, just-in-time (JIT) access provisioning, and privileged credential vaulting are precisely the “dedicated control systems” the regulation describes.

Institutions that have not deployed these controls face a compliance gap that supervisors can act on.

The European Banking Authority (EBA) and ESMA’s Regulatory Technical Standards under DORA provide additional specificity on ICT risk management requirements, reinforcing the Article 9 baseline with sector-specific implementation guidance.

Credential compromise as an operational resilience failure

DORA’s stated purpose is to ensure financial entities can withstand, respond to, and recover from ICT disruptions. A credential compromise looks entirely different through that lens than it does through a security incident lens.

With an average dwell time of 186 days, a compromised credential does not produce a discrete security event. It produces a sustained, invisible threat to operational continuity — an attacker moving laterally, escalating privileges, and mapping critical systems while appearing as a legitimate user. It is a direct threat to the operational continuity DORA is designed to protect.

The breach of France’s national bank registry in January 2026 made the mechanics concrete. A threat actor obtained the credentials of a single civil servant with access to Ficoba — the interministerial database holding records on every bank account opened in France.

Using only that one account, the attacker accessed and extracted data on 1.2 million bank accounts, including IBANs, account holder names and addresses, and tax identification numbers.

The affected system was taken offline, operations at the registry were disrupted, and the incident was reported to France’s data protection authority, CNIL. The attack required no technical sophistication.

Under DORA, an incident of that scale at a financial entity would trigger mandatory reporting obligations under Article 19 — an initial notification within 4 hours of classification (and no later than 24 hours after detection), an intermediate report within 72 hours, and a final report within one month.

The third-party dimension: Vendor credentials are your credentials

DORA’s Chapter V places explicit obligations on financial entities regarding ICT third-party risk. The compliance perimeter does not stop at the institution’s own systems.

The Santander breach in May 2024 is the European reference point. Attackers used credentials stolen from employees of Snowflake to access a database containing customer and employee data across Spain, Chile, and Uruguay.

The credentials had been harvested months earlier by infostealer malware infecting contractor workstations. None of the compromised Snowflake accounts had multi-factor authentication enabled.

The entry point was not inside Santander. It was a vendor’s weak authentication posture — and it exposed data belonging to one of Europe’s largest banks without a single exploit being written.

Under DORA, a financial institution whose critical ICT provider suffers a credential-based breach faces direct regulatory exposure. Institutions must contractually require equivalent authentication standards from their vendors and audit compliance against those requirements.

A vendor’s password policy gap is not the vendor’s problem alone — it is the financial entity’s regulatory liability.

Building a DORA-compliant credential management

Meeting Article 9’s requirements demands a structured programme across four areas.

• Deploy phishing-resistant MFA first. FIDO2/WebAuthn-based authentication — hardware security keys, passkeys, platform authenticators. SMS and TOTP-based one-time passwords are not adequate against current attack techniques. Enforce phishing-resistant MFA for all users, with particular rigour on privileged accounts and remote access paths.

• Enforce least-privilege access. JIT provisioning — granting elevated access only for the duration of a specific task — eliminates the standing privileges that make credential theft so damaging. Deactivate accounts immediately on offboarding. Dormant accounts are among the most common and most avoidable attack vectors.

• Vault all credentials. Service account passwords, API keys, and privileged credentials must be stored in an encrypted, access-controlled credential vault. Manual credential management at scale is operationally unworkable and produces no audit trail. A business password manager Passwork — deployed on-premise within the institution’s own infrastructure — provides the encrypted vaulting, granular access controls, and complete activity history that Article 9 demands.

Advertisement

• Monitor continuously. Anomalous login behaviour — unusual geolocations, off-hours access, lateral movement patterns — must trigger automated alerts. Reducing that 186-day average dwell time is the single most effective lever for cutting both financial exposure and DORA incident reporting obligations.

All four controls depend on the same foundation: how credentials are stored, shared, accessed, and monitored. Without structure at that layer, even well-designed policies fail at execution.

How Passwork supports DORA compliance in practice

Passwork is a corporate password manager certified to ISO/IEC 27001 and available as a self-hosted deployment — meaning your credential data never leaves your own infrastructure.

For financial entities navigating DORA’s Chapter V supply chain obligations, that distinction matters: a third-party SaaS credential store introduces exactly the kind of ICT dependency the regulation requires you to govern.

For institutions working through the four controls above, Passwork addresses the credential management dimension of each.

• MFA enforcement across the credential layer. Passwork supports biometric, passkey, and security key MFA natively, with SAML SSO and LDAP integration for enterprise environments.

• Role-based access control and least privilege. Permissions are assigned at vault and folder level, inherited from AD or LDAP groups, and updated automatically on directory changes. Offboarding revokes access to shared credentials in a single operation — logged and timestamped, producing the evidence an investigator will request under Article 9(4)(c).

• Privileged account inventory and secure sharing. Passwork provides a structured, searchable repository of all organisational credentials, including shared administrative accounts. Encrypted vault sharing replaces informal channels that leave no audit trail and cannot be revoked.

• Audit logs for compliance documentation. Every credential access, permission change, password reset, and sharing event is recorded in a tamper-evident log, exportable for compliance reporting and integrable with SIEM systems. A structured activity history is a substantively stronger response to a regulator than a policy document alone.

DORA compliance is as much an evidence problem as a technical one. The institutions that navigate enforcement most effectively are those that can produce documentation on demand.

Act before the audit

DORA has converted credential management from a security best practice into a binding financial risk control. Articles 9(4)(c) and 9(4)(d) are explicit: least-privilege access, strong authentication, and cryptographic key protection are legal obligations for every financial entity operating in the EU.

Operational resilience begins with identity — and identity begins with controlling who holds the keys.

Audit your credential controls against Article 9, document the findings, and have the evidence ready before a regulator asks. Under DORA, the absence of documentation is itself a finding.

Passwork is designed for exactly this situation: a self-hosted password manager that keeps credential data inside your own infrastructure, enforces MFA across every access point, and generates the tamper-evident audit logs that turn a compliance conversation from a liability into a demonstration. ISO/IEC 27001 certified, with LDAP and SAML SSO integration for enterprise environments.

Start your free Passwork trial — full functionality, no limitations.

Sponsored and written by Passwork.

A new vulnerability dubbed Pack2TheRoot could be exploited in the PackageKit daemon to allow local Linux users to install or remove system packages and gain root permissions.

The flaw is identified as CVE-2026-41651 and received a high-severity rating of 8.8 out of 10. It has persisted for almost 12 years in the PackageKit daemon, a background service that manages software installation, updates, and removal across Linux systems.

Earlier this week, some information about the vulnerability has been published, along with PackageKit version 1.3.5 that addresses the issue. However, technical details and a demo exploit have been not been disclosed to allow the patches to propagate.

An investigation from the Deutsche Telekom Red Team uncovered that the cause of the bug is the mechanism PackageKit uses to handle package management requests.

Specifically, the researchers found that commands like ‘pkcon install’ could execute without requiring authentication under certain conditions on a Fedora system, allowing them to install a system package.

Using the Claude Opus AI tool, they further explored the potential for exploiting this behavior and discovered CVE-2026-41651.

Impact and fixes

Deutsche Telekom’s Red Team reported their findings to Red Hat and PackageKit maintainers on April 8. They state that it’s safe to assume that all distributions that come with PackageKit pre-installed and enabled out-of-the-box are vulnerable to CVE-2026-41651.

The vulnerability has been present in PackageKit version 1.0.2, released in November 2014, and affects all versions through 1.3.4, according to the project’s security advisory.

Researchers’ testing have confirmed that an attacker could exploit the the CVE-2026-41651 vulnerability in the following Linux distributions:

• Ubuntu Desktop 18.04 (EOL), 24.04.4 (LTS), 26.04 (LTS beta)
• Ubuntu Server 22.04 – 24.04 (LTS)
• Debian Desktop Trixie 13.4
• RockyLinux Desktop 10.1
• Fedora 43 Desktop
• Fedora 43 Server

The list is not exhaustive, though, and any Linux distribution using PackageKit should be treated as potentially vulnerable to attacks.

Users should upgrade to PackageKit version 1.3.5 as soon as possible, and ensure that any other software using the package as a dependency has been moved to a safe release.

Users can use the commands below to check if they have a vulnerable version of the PackageKit installed and if the daemon is running:

dpkg -l | grep -i packagekit

rpm -qa | grep -i packagekit

Users can run systemctl status packagekit or pkmon to check if the PackageKit daemon is available and running, which indicates that the system may be at risk if left unpatched.

Although no details about the state of exploitation have been shared, the researchers noted that there are strong signs showing compromise because exploitation leads to the PackageKit daemon hitting an assertion failure and crashing.

Even if systemd recovers the daemon, the crash is observable in the system logs.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

Although there are plenty of premium soundbars available to buy, and the very concept was,at one point, an expensive accessory that only a few home theatre enthusiasts could enjoy, it’s now possible to pick up a soundbar with a budget price tag attached. Even if you only have around £100 / $100 to spend, you can still find a soundbar to elevate your TV’s audio, and thanks to the hard work of our tech experts, we know which ones are best to buy.

Even though soundbars have been around for quite some time, and we’ve honestly tested more than we care to count, there’s a good chance that you might be someone who’s looking to buy their very first soundbar, and in which case it’s worth covering the basics before we move on to the options that our team recommend.

As TVs have only gotten slimmer over the years, this has usually come at the expense of built-in speakers as there’s only so much sound quality you can derive when there isn’t a lot of space available. Soundbars offer a return to form, acting as dedicated speakers that can focus on delivering amazing audio, whilst your TV works solely on the visual side of things.

If you care about good audio quality even a little bit then we can’t recommend soundbars enough. They’re fantastic for everything from elevating vocals so that you can actually hear what characters are saying, to delivering powerful bass that makes action scenes even more intense. Regardless of how much a soundbar costs, we put them all through a series of rigorous tests to see how they perform across multiple use cases.

You can read about our testing process in greater detail below, or skip ahead to get straight to our current recommendations for soundbars that don’t break the bank. If you decide that you’d rather save up and go with a brand that costs a little more then you can find more premium options in our round-up for the best soundbars overall. Similarly, anyone wanting to do a full visual/audio upgrade in one go can also check out the best TVs.

Best cheap soundbar at a glance

SQUIRREL_ANCHOR_LIST