Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Tech
Europe built sovereign clouds to escape US control. Then forgot about the processors
FEATURE Can digital sovereignty exist on American silicon?
Europe is pouring more than €2 billion into sovereign cloud initiatives designed to reduce exposure to US legal reach. The EU’s IPCEI-CIS program funds infrastructure development. France qualifies operators under SecNumCloud, a framework with nearly 1,200 technical requirements promising “immunity from extraterritorial laws.”
But most datacenters and qualified cloud operators still rely heavily on Intel or AMD processors. And inside those processors sits a computer beneath the computer: management engines operating at Ring -3, below the operating system, outside the control of host security software, persistent even when the machine appears powered off. Under the US Reforming Intelligence and Securing America Act (RISAA) 2024, hardware manufacturers count as “electronic communications service providers” subject to secret government orders.
Europe’s frameworks certify the clouds. They don’t assess the silicon.
The computer your OS can’t see
That computer beneath the computer has a name. On Intel processors, it is the Management Engine (ME), or more precisely the Converged Security and Management Engine (CSME). On AMD, it is the Platform Security Processor (PSP). Both run at what security researchers call Ring -3, below the operating system, below the hypervisor, in a privilege level the host cannot see or log.
“It’s a computer inside your computer,” explains John Goodacre, Professor of Computer Architectures and former director of the UK’s £200 million Digital Security by Design program. He is clear about what that means in practice. The ME has its own memory, its own clock, and its own network stack, and because it can share the host’s MAC and IP addresses, any traffic it generates is indistinguishable from the host’s own traffic to the firewall.
The architecture is not theoretical. Embedded in the Platform Controller Hub, the CSME is a separate microcontroller that operates independently of the host, with direct memory, device access, and network connectivity the host operating system cannot monitor. AMD’s PSP works the same way.
Intel’s Active Management Technology (AMT), the remote management feature the ME enables, exposes at least TCP ports 16992, 16993, 16994, and 16995 on provisioned devices. Goodacre notes that an attack surface exists on unprovisioned hardware too. These ports deliver keyboard-video-mouse redirection, storage redirection, Serial-over-LAN, and power control to administrators managing fleets of devices remotely. The capability has legitimate uses. It also provides a channel that operates at a level below what European sovereignty frameworks can attest.
Microsoft documented in 2017 that the PLATINUM nation state actor used Intel’s Serial-over-LAN (SOL) as a covert exfiltration channel. SOL traffic transits the Management Engine and the NIC sideband path, delivered to the ME before the host TCP/IP stack runs. The host firewall and endpoint detection saw nothing, and any security tooling running on the compromised machine itself was equally blind. PLATINUM did not exploit a vulnerability. It exploited a feature, requiring only that AMT be enabled and credentials obtained. In documented cases, those credentials were the factory default: admin, with no password set.
Goodacre catalogues this and related scenarios in a 37-page risk assessment prepared for CISOs evaluating Intel vPro hardware connected to corporate networks. Its conclusion is blunt: connecting an untouched-ME device to corporate resources “exposes the organization to a class of compromise that defeats the host security stack in its entirety.”
The ME does not stop when the machine appears to. Users recognize the symptom: a laptop powered off and stored for weeks is found, on next boot, to have a depleted battery. On modern thin and light platforms, what Microsoft documents as Modern Standby means “off” does not correspond to “all subsystems unpowered.” The system-on-chip components the Management Engine runs on remain in low-power states, drawing enough to drain a 55 Wh battery over weeks, on the order of 100-200 mW continuous draw.
The implication is documented in Goodacre’s risk assessment: “Whether the radio is in a Wake-on-Wireless-LAN listening state is firmware policy. On a device whose firmware has been tampered with during transit through the supply chain, the answer cannot be inferred from the visible power state.” A laptop that appears off, in a bag, can associate with a hostile network the user has no knowledge of.
Professor Aurélien Francillon, a security researcher at French engineering school EURECOM, has spent years studying exactly this class of problem. Working with colleagues, he built a fully functional backdoor in hard disk drive firmware [PDF], a proof of concept demonstrating how storage devices could silently exfiltrate data through covert channels. Three months after presenting it at an academic conference, the Snowden disclosures revealed the NSA’s ANT catalogue, which documented an identical capability already deployed in the field.
“The NSA were already doing it,” Francillon says flatly. “Quite amazing.” That background informs his assessment of the ME. “Yes, it can probably be used as a backdoor, like many other things, including BMC [baseboard management controller] and many other firmwares,” he says. The question, he argues, is not whether the backdoor exists but whether operational controls make it unreachable in practice.
AMD faces the same architectural question. On April 14, 2026, researchers demonstrated the Fabricked attack against AMD’s SEV-SNP confidential computing technology, achieving a 100 percent success rate with a software-only exploit. The Platform Security Processor proved vulnerable to the same class of compromise.
On server hardware, the picture is the same. Intel ME runs on servers under a different name, Server Platform Services or SPS, and the BMC, the remote administration controller standard in datacenter hardware, relies on it. “More or less the same,” Francillon says of the server variant. For datacenter operators, he sharpens the focus further: “If I look at cloud systems, servers, I would be more concerned with the BMC,” pointing to published research demonstrating remote exploitation of BMC vulnerabilities that could allow an attacker to reinstall or fully compromise a server. The BMC is not a separate concern from the ME: on server hardware, it is the primary network entry point into the SPS, making it both the most exposed interface and the most consequential.
Both Intel and AMD processors contain management engines that operate below the operating system. The silicon is designed by American companies and subject to American legal process.
The backdoor the CLOUD Act doesn’t use
That legal process has teeth that most European policymakers underestimate. The CLOUD Act, passed in 2018, gave US authorities extraterritorial reach to data held by American companies. FISA Section 702 allows intelligence agencies to compel US persons and companies to provide access to communications. Both are well known in European sovereignty discussions. They operate through the front door: a legal order served on a company that controls data. Less well known is RISAA 2024, a law that opens a different entrance entirely.
RISAA amended FISA’s definition of “electronic communications service provider” in ways that go beyond cloud operators and platform companies, and beyond the bilateral agreements that European policymakers have built their legal defenses around. Hardware manufacturers now fall within scope. Intel and AMD can be compelled, via secret orders with gag clauses, to cooperate with US intelligence access.
The mechanism through which that access could be exercised is the management engine: a persistent, privileged, network-connected runtime that operates below anything the host operating system can see or block. A SecNumCloud-certified operator can be legally isolated from American data demands. The processor inside its servers cannot. “You’ve actually got a policy mechanism by which any such machine anywhere can deliver any of its information,” Goodacre says.
RISAA’s two-year term expired on April 20, 2026, but Congress extended it by 45 days while debating reforms. Whether it is renewed, amended or allowed to lapse, the architecture it targets does not change.
SecNumCloud’s blind spot
France’s SecNumCloud is Europe’s most rigorous attempt to build a cloud certification that is legally immune to American law. It did not emerge from nowhere. ANSSI, France’s national cybersecurity agency, was established in 2009 as part of a broader effort to build institutional muscle on digital sovereignty long before the term became fashionable. When Edward Snowden revealed the scale of NSA surveillance in 2013, France’s response was technical rather than rhetorical: ANSSI published the first SecNumCloud framework in July 2014. A decade later, that framework has grown to nearly 1,200 technical requirements.
At the time, SecNumCloud was a cybersecurity qualification, not a sovereignty instrument: it set requirements for architecture, encryption standards, access controls, and incident response, but said nothing about who controlled the underlying infrastructure or whose laws applied to it. The CLOUD Act changed that. Passed in 2018, it gave American authorities extraterritorial reach to data held by US companies, and suddenly a French cybersecurity framework had a geopolitical dimension it was not designed for. Version 3.2, introduced in 2022, added Chapter 19: a set of explicit requirements targeting extraterritorial law, mandating that only EU operators could run the service, that no non-EU party could access customer data, and that the provider could operate autonomously without external intervention. It promised “immunity from extraterritorial laws.”
In December 2025, S3NS, a joint venture between French defense and technology group Thales and Google Cloud, operating Google Cloud Platform technology under French control, became the first “hybrid” cloud to receive SecNumCloud qualification. The certification triggered heated debate: was this real sovereignty, or American technology with a European flag?
But the debate missed a more fundamental question. Does SecNumCloud’s certification reach as far as the silicon it runs on? Francillon is positioned to see both sides of that question. He sits on the French Technology Academy’s working group on cloud security, a body that advises on the technical foundations of frameworks like SecNumCloud. And he has spent years studying firmware backdoors in academic literature and demonstrated them in practice.
He knows what the hardware can do, and he knows what the certification requires. His starting point is that SecNumCloud provides genuinely valuable protection, and that the silicon gap does not negate that. When asked whether SecNumCloud explicitly addresses Intel Management Engine or AMD Platform Security Processor vulnerabilities, his answer is unambiguous: “There is no direct requirement for firmware backdoor prevention.”
The framework is not designed to be a technical specification for hardware-layer security. “The document aims to be generic and not dive into technical details,” Francillon says. “Most of it is organizational security.” What SecNumCloud does require is that providers build a proper threat model, consider mitigation mechanisms, and monitor administration gateways where external tech support could be exploited. The hardware layer was not addressed by oversight. It was left out by design.
Francillon’s assessment is not a fringe view. Vincent Strubel, the director of ANSSI, the very agency that designed and administers SecNumCloud, is equally explicit about what the framework does and does not cover. In a January 2026 LinkedIn post addressing SecNumCloud’s scope, he writes that all cloud offerings, hybrid or not, depend on electronic components whose design and updates are not 100 percent controlled in Europe. If Europe were ever cut off from American or Chinese technology, he argues, the result would be a global problem of security degradation, not just in hybrid clouds, but everywhere.
Strubel frames SecNumCloud carefully: it is “a cybersecurity tool, not an industrial policy tool.” It protects against extraterritorial law enforcement and kill-switch scenarios. It was never designed to eliminate technology dependencies at the hardware layer, and no actor, state, or enterprise fully controls the entire cloud technology stack anyway.
One technology frequently cited in sovereignty discussions is OpenTitan, Google’s open source secure element deployed on its server hardware and used within the S3NS infrastructure. Francillon is clear about what it is and, critically, what it is not. “OpenTitan is a secure element, a small chip on the side that can be used for protecting sensitive keys, providing signatures, making attestations,” he explains. “It’s a bit like a TPM.” What it is not is a replacement for the main processor. “The Linux and all your applications will not run on it.” OpenTitan sits alongside x86 infrastructure as an external root of trust, independent of the ME. That matters because the default embedded TPM lives inside the ME, making it subject to the ME attack surface. OpenTitan sits outside that boundary. The two address different problems entirely, and conflating them, as sovereignty advocates sometimes do, obscures where the residual exposure actually lies.
ANSSI’s own technical position paper [PDF] on confidential computing, published in October 2025, concludes that Intel SGX, TDX, and AMD SEV-SNP are “not sufficient on their own to secure an entire system, or to meet the sovereignty requirements of SecNumCloud 3.2.” Physical attackers are “explicitly out-of-scope” of vendor security targets. Supply chain attackers are “explicitly out-of-scope.” The ME attack surface discussed in this article falls into neither category: it is a remote network threat, not a physical one. The paper’s conclusion for users concerned about hostile cloud providers is stark: “Switch to a cloud provider they trust, or use their own hardware with physical security protection measures.”
The castle with a structural flaw
Francillon does not dispute that SecNumCloud leaves the ME unassessed. His argument is that this does not matter in practice. “What I mean is that if there is a backdoor to access a room, it cannot be directly used if the room is in a castle. You have to pass the castle walls first.” Network isolation, monitoring, and threat modeling are the walls. SecNumCloud’s operational requirements mandate that administration gateways be isolated, that external tech support be monitored, that network segmentation prevents lateral movement. The Management Engine backdoor may exist, but the framework makes it unreachable except in what Francillon calls “very high-end attacks.”
That qualifier matters. Francillon is not claiming perfect security. He is claiming that proper operational controls reduce the threat to a level where only nation state actors with significant resources could exploit it. For most threat models, he argues, that is sufficient. “Saying it is useless to do SecNumCloud because there is ME, or whatever backdoor in some hardware we don’t control, is a mistake,” he says. SecNumCloud improves security over deployments without such controls, he argues, provided that hardware is carefully evaluated and firmware securely configured.
The castle walls have a structural flaw that Goodacre’s risk assessment documents in detail. Corporate perimeter firewalls see the device’s traffic, but because the ME shares the host’s MAC and IP addresses, they cannot tell ME-originated flows apart from legitimate host traffic. “The perimeter cannot attribute a flow to host-versus-CSME origin without out-of-band knowledge,” Goodacre writes. A TLS-encrypted tunnel from the ME to an attacker server on port 443 looks, to the perimeter, like any other HTTPS connection the laptop makes. Network filtering reduces attack surface. It does not eliminate the exposure.
Goodacre’s position is that a “Tier-3 supply-chain residual remains in both cases and is the irreducible cost of buying any silicon that ships with a Ring -3 manageability engine.” He defines Tier 3 as nation state cyber services operating at the level of compromising firmware in transit, mis-issuing CA certificates via in-country authorities, and modifying hardware at customs or courier hubs. The NSA’s Tailored Access Operations division treated supply chain interdiction as routine business, with explicit doctrinal preference for BIOS and firmware implants over disk-level malware.
His risk assessment’s data on fleet vulnerability is concrete. Industry telemetry from Eclypsium, analyzing production enterprise environments, found that approximately 72 percent of devices observed remained vulnerable to INTEL-SA-00391 years after public disclosure, and 61 percent remained vulnerable to INTEL-SA-00295. The same reporting documented that the Conti ransomware group developed proof-of-concept Intel ME exploit code with the intent of installing highly persistent firmware-resident implants.
“Connecting an untouched-ME vPro laptop to corporate resources exposes the organization to a class of compromise that defeats the host security stack in its entirety,” Goodacre concludes. “The exposed controls include BitLocker full-disk encryption, FIDO2-protected sign-in, endpoint detection and response, the host firewall and the corporate VPN.”
The disagreement between Francillon and Goodacre is not about whether the vulnerability exists. Both confirm it does. Both confirm AMD faces the same issue. Both confirm software alone cannot fix it. The disagreement is about whether operational controls, Francillon’s castle walls, make an architectural backdoor irrelevant in practice, or merely reduce its exploitability while leaving nation state actors with a path through.
For SecNumCloud operators processing sensitive government or commercial data, the distinction is not academic. It is worth noting that SecNumCloud is designed for a higher level of security than standard cloud certifications, but is not intended for classified or restricted government data. The threat that can still slip through Francillon’s castle walls is precisely the threat SecNumCloud was designed to keep out.
The gap nobody names
Goodacre told The Register he tested awareness of the Management Engine with various attendees at the CyberUK conference in April 2026. “Almost no one” knew about it, he reports. The gap between the sovereignty rhetoric and the silicon reality is not being surfaced in policy discussions, procurement decisions, or public debate over what digital sovereignty means.
The debate that does happen, hybrid versus non-hybrid, Google/Thales versus pure European providers, focuses on operational control and legal structure. It does not address the shared silicon foundation. Strubel’s LinkedIn post pushes back against the framing: “Imagining this problem is limited to hybrid cloud offerings is pure fantasy that doesn’t survive confrontation with facts.” Every cloud provider, hybrid or not, depends on components they don’t fully control. The distinction isn’t hybrid versus sovereign. It is what you’re protecting against, and whether the controls you’re implementing address that threat.
There is no immediate solution. RISC-V, the open source processor architecture European sovereignty advocates point to as a long-term alternative, remains years from competitive performance in datacenter workloads. “It will take decades,” Francillon says flatly. Arm is a cautionary precedent: it took nearly 20 years from the first server attempts before Arm achieved any meaningful datacenter presence.
Can sovereignty exist on compromised silicon?
For Goodacre, the bottom line is simple: the Tier-3 supply chain residual is “the irreducible cost of buying silicon with a Ring -3 manageability engine.” Francillon argues that operational controls, including network isolation, monitoring, and threat modeling make the backdoor unreachable except in very high-end attacks. Strubel acknowledges hardware dependencies are real but maintains that SecNumCloud provides valuable protection for what it does cover: legal control, kill-switch resistance, defense against cyberattacks and insider threats.
The disagreement is not about technical facts. It is about risk tolerance and threat model calibration. For European CIOs choosing SecNumCloud-certified providers, the question to ask vendors is: how do you address Intel Management Engine and AMD Platform Security Processor in your threat model? The answer will clarify whether the vendor treats the hardware layer as out of scope, or has implemented controls that reduce but do not eliminate the exposure.
For European policymakers, the question is broader. Can digital sovereignty exist on non-sovereign silicon? The current frameworks do not answer that question. They certify operational controls, legal structure, and autonomous execution capability. They do not certify silicon-layer immunity, because the hardware is American or Chinese, subject to American or Chinese law, designed with management engines that European authorities did not specify, cannot legally compel on their own terms, and cannot replace.
Whether that is a gap worth addressing, or a risk worth accepting as the unavoidable cost of participating in global technology supply chains, is a question Europe will need to answer for itself. ®
Continue Reading
Tech
Microsoft’s June Patch Tuesday fixes a record 200 vulnerabilities, including five being actively exploited
In a nutshell: On the second Tuesday of every month, Microsoft addresses the overall security of its many software products. The Patch Tuesday tradition has continued for more than 20 years, but the number of vulnerabilities addressed in monthly updates is now truly skyrocketing.
Microsoft recently released its latest batch of monthly security fixes for vulnerabilities found in Windows, Office, and other products sold by the company. This month’s Patch Tuesday stands out for a record number of CVE-tracked flaws, with 200 individual bugs and 33 “critical” vulnerabilities that could have serious consequences for Microsoft customers.
The June updates address a wide range of security issues. The most common categories include elevation of privilege vulnerabilities (65), remote code execution bugs (55), and information disclosure issues (30), among others. The Patch Tuesday release does not include flaws discovered in the Chromium-based Edge browser, which saw 360 issues fixed this month alone.
The updates also addressed five zero-day vulnerabilities, which are publicly disclosed bugs that are already being actively exploited by cybercriminals. The zero-day flaws include CVE-2026-45586, an elevation of privilege vulnerability; CVE-2026-49160, a denial-of-service vulnerability in Http.sys; and CVE-2026-42897, a server spoofing vulnerability in Microsoft Exchange.
The CVE-2026-45586 patch targets a vulnerability previously known as GreenPlasma. The flaw was discovered by a security researcher known as Nightmare-Eclipse, who has been in a dispute with Microsoft over alleged attempts to damage his reputation.
This month’s Patch Tuesday also addresses a security flaw discovered by Nightmare-Eclipse. Known as “YellowKey,” the bug was described as a potential attempt to introduce a stealth backdoor in Microsoft’s BitLocker full-volume encryption feature. Tracked as CVE-2026-45585, the issue should now be fully patched. However, Microsoft has not publicly acknowledged Nightmare-Eclipse’s contribution.
Speaking of, the researcher also released another exploit dubbed “RoguePlanet.” The proof-of-concept code could potentially be abused to open a command prompt with full “SYSTEM” privileges. It remains to be seen whether Microsoft will quietly address the issue without crediting its original discoverer.
Security experts warn that the number of software bugs addressed through Patch Tuesday and other periodic patching programs is likely to continue increasing. Microsoft noted that both security professionals and threat actors are now using advanced AI models to discover new vulnerabilities. The result is a rapidly expanding attack surface, with software vendors expected to spend increasing time fixing issues uncovered through automated discovery methods.
Tech
ChatGPT becomes the fastest app to reach 1 billion monthly active users, just as AI sentiment worsens
Editor’s take: Much like the Call of Duty series and pornography, generative AI is one of those things that’s incredibly popular despite a lot of people claiming to dislike it. ChatGPT, for example, has just reached one billion monthly app users, just 3.5 years after it launched in November 2022.
Market intelligence firm Sensor Tower reports that ChatGPT has become the fastest app ever to reach one billion monthly app users (MAUs), beating the previous record holder, Google Maps, which took around five years after launch to hit the same number.
ChatGPT isn’t the only AI app experiencing immense popularity right now. The monthly number of Claude and Meta AI users increased by 640% and 973% year-on-year. ChatGPT was up by a mere 62%, though it remains the clear leader.
Abe Yousef, Sensor Tower’s senior insights analyst, told CNBC that model improvements and more positive market sentiment have pushed the growth of ChatGPT’s rivals.
Earlier this year, OpenAI was one of several companies to sign deals with the Pentagon. It led to a huge consumer backlash, prompting CEO Sam Altman to promise additional safeguards to prevent government use of the technology for surveillance of US citizens – while leaving several obvious loopholes in place, of course.
Sensor Tower found that ChatGPT uninstalls surged around 295% day-over-day on February 28, the day after OpenAI announced the Pentagon agreement. It also led to Anthropic’s Claude becoming the top free app on the iPhone.
Anthropic has refused to let the government use its models for mass domestic surveillance and fully autonomous weapons, leading to a bitter dispute and the company’s blacklisting over claims that it posed a national security risk. But it was recently reported that the NSA is using Claude Mythos for offensive cyber operations.
Paradoxically, the use of generative AI tools is growing as public opinion toward the technology worsens. In addition to the tens of thousands of job losses being caused, which some now say never really happened, the anger toward new data center builds is growing.
On that note, an OpenAI report this week claimed that Chinese ChatGPT users were trying to encourage anti-data center feelings in the US. The company admitted that their efforts had little effect – it’s not like people don’t hate the facilities already – but the report might encourage some people to soften their opposition simply because they don’t want to be thought of as “influenced” by China.
Humanoids aren’t quite ready to replace factory workers, but the industry can’t wait. Faced with labor shortages, manufacturers have shown growing interest in startups that promise faster automation without the usual tradeoffs.
That’s the bet behind Theker, an AI robotics startup that aims to go beyond robots trained for a single task. “If you always have to put the same cookie in the same box, that works perfectly, but most processes aren’t like that,” co-founder Carla Gómez Cano told TechCrunch.
Theker is designed for that messier reality. Unlike humanoid robots designed around a fixed form — think Boston Dynamics — Theker’s machines are built to be reconfigured. Their hands, arms, and overall form can be swapped out or resized depending on the task, whether that’s sorting packages, packing clothing, or handling bottles and cans in a warehouse.
That Inditex, Zara’s parent company, signed on as an early backer is a signal of where Theker’s ambitions start, not where they end. The company’s broader goal is to move beyond retail into heavier industrial settings like manufacturing, where the complexity and scale of manual tasks is even greater.
This generalist ambition has helped cement Theker’s status as one of Europe’s hot startups to watch — and raise capital accordingly. The Barcelona-based startup has just raised $85 million in what it’s calling “Europe’s largest ever robotics Series A.” (We haven’t found a larger one in our records, either.)
Less than a year after a record seed round, this Series A was led by American VC firm CRV and backed by a mix of traditional and strategic investors, including Samsung and Aglaé Ventures, the investment vehicle tied to LVMH chairman Bernard Arnault.
Gómez Cano said Samsung is not a client yet but that the two are in advanced discussions. Theker would welcome having the Korean company as a customer, supplier, and investor simultaneously — a trifecta that would give the startup both revenue and credibility in manufacturing at scale.
She also noted that she and co-founder Jiaqiang Ye Zhu “didn’t build Theker to run pilots,” so the team skips innovation departments entirely and goes straight to logistics or operations, where deals are real and timelines are shorter.
To demonstrate that the company can actually deliver on that, Theker has a showroom in central Barcelona, and plans to open others as it expands across Europe, the U.S. and Asia. It will also grow its headcount across tech, deployment, and sales.
“We already received 15,000 job applications and have to filter like crazy,” Gómez Cano said. She estimated that the team could grow from dozens to up to 120 people by the end of the year, then caught herself: “I am saying that, but I also said that we’d raise $30 or $40 million!”
That Theker managed to raise twice its target also reinforces the startup’s conviction in keeping its HQ in Barcelona, a growing robotics hub, and in Europe’s tech ecosystem more broadly. “It has never been a barrier to acceleration for us, so we are making the most of it,” Gómez Cano said.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Danish pharmaceutical giant Novo Nordisk, the world’s largest producer of insulin, disclosed a data breach affecting patient information from some clinical trials.
Founded in 1923, Novo Nordisk now employs around 67,900 people across 80 offices worldwide and is the maker of viral GLP-1 receptor agonist drugs Wegovy and Ozempic.
The company revealed on Thursday that attackers gained access to its internal IT systems and data related to patients participating in some clinical trials, including their patient IDs (random alphanumeric strings) and information on trial participation, sex, year of birth, biomarkers, health/immunogenicity data, and lifestyle factors (e.g., smoking, alcohol use, BMI).
However, Novo Nordisk said that this data was pseudonymized and that the attackers can’t use it to identify any affected patients by name.
“While our investigation and response are ongoing, we have discovered that certain non-public data, including personal data, was copied externally without authorisation. We are informing the impacted parties as appropriate,” the company said.
“This information is not directly linked to any patients by name or other direct identifiers. Information about identity would therefore require access to underlying information, identifying patients by name etc. This information was not exposed. We therefore do not consider the incident to enable any third party to identify participants in our clinical trials.”
The data breach also affects an undisclosed number of healthcare professionals (HCPs), whose names, registration numbers, e-mail addresses, phone numbers, WhatsApp details, and office locations have been exposed.
Novo Nordisk warned affected HCPs to be wary of unexpected messages or calls, as they may be targeted in phishing attacks via e-mail, phone, WhatsApp, or fraudulent messages impersonating their colleagues.
The company has taken the compromised internal IT systems offline but noted that its core business operations were not impacted. Novo Nordisk is now investigating the incident with the help of external cybersecurity experts to assess the full impact and scope of the breach.
“We are working to bring the affected systems back online in a controlled and safe manner; however, we acknowledge this process takes time. Our core business operations are not impacted and remain up and running,” Novo Nordisk added.
Novo Nordisk has yet to disclose when the breach was detected and how many individuals had their personal and patient data exposed.
A Novo Nordisk spokesperson was not immediately available for comment when BleepingComputer reached out for more details on the attack.
Our recently concluded event in Europe saw the return of the Hackaday Communicator badge — a stylish handheld gadget with a QWERTY keyboard, a LoRa radio, and an ESP32. It came complete with a simple messaging app built into it’s MicroPython firmware, and by all accounts it was a great success.
But there was certainly room for improvement, which is where [Giovi321]’s new firmware for the badge comes in. It brings support for Meshtastic proper, as well as longer battery life support for GPS module. To install this firmware you will need to have the ESP-IDF but fortunately there are very comprehensive instructions provided to help you. Under the hood it’s running FreeRTOS.
It’s something which is so often missing with an event badge, any sense of how it might have a life after the event rather than becoming a piece of e-waste. The Communicator badge is such a nice physical design that it obviously has potential, so this firmware unlocks it and gives the badge a use out in the real world. We really like it for this, and we’ll be flashing a few of our badges over to give it a shot shorlty.
If you’re looking to upgrade the hardware on your Communicator, check out the custom RGB keyboard we covered last week.
Samsung is finally adding one of Android’s most basic quality-of-life features to Galaxy phones.
With One UI 9, Galaxy users can now display their internet speed directly in the status bar. This makes it easier to keep an eye on network performance without opening a separate app or digging through settings.
It’s a feature that has long been available on many Android devices from brands such as Xiaomi, OnePlus and Realme, making its absence on Samsung phones all the more surprising. Now, it looks like Samsung is finally closing that gap.
The feature arrives through an updated version of Samsung’s QuickStar module within the Good Lock customisation suite. Once enabled, a small indicator appears in the status bar showing real-time network speeds while you browse, stream or download content.
While it may seem like a minor addition, it’s one that power users have been requesting for years. A live network speed indicator can be particularly useful when troubleshooting slow connections. It is also useful when checking download activity or simply confirming that your mobile data is actually doing what it should.
The update appears to include another notable change, too. Samsung has added a new toggle that lets users disable the Now Bar. The Now Bar is the company’s live activity-style feature that surfaces information such as timers, voice recordings and ongoing calls on the lock screen.
These additions form part of the wider One UI 9 update, which is currently being tested on Galaxy S26 devices. Samsung is also preparing to bring the software to older Galaxy flagships, but a broader rollout timeline has yet to be confirmed.
Beyond the new status bar indicator, One UI 9 is expected to introduce several other upgrades. These include a redesigned call log, more customisation options for the Quick Panel and further improvements to Samsung DeX.
The network speed indicator might not be the flashiest feature in One UI 9. However, for many Galaxy owners, it could end up being one of the most useful.
For Open Call 2026, IMR will be joined by a new delivery partner, the South Eastern Applied Materials Research Centre at South East Technological University.
Irish Manufacturing Research (IMR) has today (12 June) announced the next European Space Agency Phi-Lab Ireland Open Call, which invites Irish companies to better position themselves in the global space economy and as Europe’s hub for the development and manufacturing of next-generation space-bound hardware.
ESA Phi-Lab Ireland funds research in advanced materials and manufacturing, across the entire life-cycle of space-optimised hardware and for Open Call 2026, will be joined by a new delivery partner, the South Eastern Applied Materials (SEAM) Research Centre at South East Technological University.
Last year, Open Call 2025 drew involvement from a range of organisations across the Irish industrial base, with companies such as Mbryonics and Ubotica successfully incubated within the Irish Phi-Lab building.
Open Call 2026 will offer ESA innovation seed funding of up to €400,000 for projects less than two-years, alongside expert mentorship, training, access to state-of-the-art research infrastructure and comprehensive networking opportunities. Key research areas supported by Open Call 2026 will include advanced materials research, additive manufacturing, structural analysis and simulation and integration of smart materials.
Commenting on the launch of Open Call 2026, Dr Ken Horan, the director of technology innovation and entrepreneurship at IMR and head of ESA Phi-Lab Ireland, said: “Ireland already has world-class manufacturing and materials capabilities, what has been missing is a dedicated front door into the space sector.
“That is exactly what ESA Phi-Lab Ireland provides and as the national platform for space technology development, it sits at the very centre of our national effort to support companies seeking a role in the global space economy. Open Call 2026 is an open invitation to ambitious Irish companies, whether or not they have ever worked in space before, to build the products and the expertise that will define the next decade of this industry in Europe”.
Evelyn Kerschbaumer, the commercial officer at the European Space Agency, said: “The space economy is one of the fastest-growing markets in the world, and Europe’s future competitiveness depends on a strong base of innovative companies in every Member State.
“Through ESA Phi-LabNET we are building that base region by region and Ireland’s focus on space-optimised hardware brings a distinctive strength to the network. We look forward to seeing Irish companies turn Open Call 2026 into real technologies with genuine global reach”.
In February of 2026, Ireland launched the first European Space Agency Phi-Lab at IMR in Mullingar, Co Westmeath. The Irish Government has committed to investing €170m into the ESA over the next five years and the six-year-long ESA Phi-Lab programme is a flagship element of that wider national commitment. The consortium is co-funded by the ESA and Enterprise Ireland.
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
Tech
Windows NT on the GameCube is Basically a Homebrew Project That Brings the Classic OS to Nintendo Hardware
GameCube hardware already delivers strong value for fans of its original game library. Loaders such as Swiss open the door to region-free play, disc backups from SD cards or USB drives, and emulators that reach back to earlier Nintendo systems and beyond. Homebrew keeps the console active long after its commercial peak. A separate project now layers something unexpected onto that foundation by bringing a full PowerPC build of Windows NT to the same machine.
The architecture similarities between the console and early PowerPC-based PCs make this port much easier than you think. The GameCube is powered by a Gekko CPU, which was mostly derived from the PowerPC 750 series and obtained official support in the first versions of Windows NT. That shared basis is a huge advantage for developers since it allows them to avoid full emulation and instead write specialized drivers and a hardware abstraction layer that interfaces directly with the Flipper chipset.
Nintendo Switch 2: Choose Your Game Bundle
- Kick off the fun with a Nintendo Switch 2 system, your choice of a select digital game, and a savings* of up to $29.99!
- Includes choice of either the Mario Kart World, Donkey Kong Bananza, or Pokémon Pokopia digital game download
- One system, three play modes: TV, Tabletop, and Handheld
Wack0 runs the entii-for-workcubes project, which is a GitHub repository containing all of the components required to run Windows NT 3.51 or 4.0 on a GameCube, Wii, or even some vWii systems. They’ve created a unique ARC firmware bootloader (which loads homebrew software), a custom HAL (hardware abstraction layer), and a few drivers for video, input, and storage via the external interface bus.
The ARC firmware is the important first stage, running from a homebrew application, displaying a simple menu on screen, and allowing the user to carve up a disk image stored on an SD card or an EXI-IDE device. The Windows NT installation is then run immediately from an ISO file that is saved in the same location as the original disk image. During setup, the user can choose a custom GameCube or Wii hardware profile and install the necessary drivers for video, controller ports, and mass storage.
To get started, the user must prep an SD card with the release files, a Windows NT 3.51 or 4.0 ISO, and a blank raw disk image of the appropriate size. For a GameCube, this means purchasing a serial-port converter or an SD Gecko for more reliable access. They’ll also need a homebrew loader, such as Swiss, to get started. Once that’s done, the ARC menu will guide you through partitioning and installing NT, even letting you choose your keyboard layout and pointing device. The entire scenario takes place on real hardware, with no emulation layers between the operating system and console components.
Once the OS is installed, you can expect some basic work tools to be available. Notepad, Solitaire, ancient backgrounds, and even an early version of Internet Explorer should all operate smoothly. Input is supported via mapped GameCube controllers or an ASCII keyboard controller plugged into a port, which is useful for typing.
The original hardware limits keep everything in check. The GameCube only has 24MB of accessible RAM, which limits the number of programs you can run at once and forces you to carefully select your drivers. You’re also out of luck if you want fast storage, because accessing it through the GameCube’s external interface is significantly slower than using an internal drive, so expect to spend some time waiting for installation to finish, especially when compared to what you could do on a PC at the time. The graphics driver merely copies and pastes bitmaps rather than utilizing advanced optimized pathways, which is inefficient for a smooth desktop experience. To make matters worse, neither the GameCube nor the Wii versions include working sound. Your GameCube may occasionally stall during a reboot, requiring you to manually turn it off and back on.
SYSTEMS
Half the trouble of building an Nvidia NVL or AMD Helios competitor is just getting the networking out of the box
COMPUTEX 2026 It’s hard enough for startups to compete with AMD and Nvidia on chip design. The rise of rack-scale architectures has only made things harder.
Companies not only have to invest in chip design but also the mechanical, thermal, and power engineering necessary to pack six dozen or more AI accelerators into a single rack that functions as one enormous GPU.
At Computex last week, Delos Data, a startup funded by former Intel and Barefoot Networks execs, showed off a modular server platform aimed at giving chip startups a shortcut to rack scale.
One of the challenges with the move to rack scale is actually the sheer amount of networking that needs to be enabled at the box. A typical eight GPU HGX node only needs one or two ports per GPU. By comparison, a GB300 NVL72 needs 18 400 Gbps ports per GPU.
Nvidia and AMD have developed custom racks with integrated backplanes, power delivery, and cooling. Delos by comparison is keeping things relatively simple by designing a chassis that, at least from the front, looks more like a switch than a GPU server.
It features 36 OSFP ports, nine for each of the four OAM sockets at the heart of the system. OAM, if you’re not familiar, is an open socket commonly used by high-performance accelerators requiring more interconnect bandwidth and power delivery than standard PCIe cards can manage. Assuming 200 Gbps SerDes, that works out to 3.6 TB/s per chip of interconnect, the same as Nvidia’s new Rubin GPUs.
OSFP means that customers can use standard DACs or pluggable transceivers, and switches depending on how large they want their scale-up domain to be.
And while OSFP is usually associated with Ethernet, you can run just about anything you want through them, whether it be UALink, Ultra Ethernet, PCIe, or something else. From a deployment standpoint, these systems would be wired up like any other hyperscale system, just a whole lot denser.
Delos isn’t the only option out there for chip startups looking for scale up reference design. AWS for example appears to be repurposing Nvidia’s MGX form factor for its Trainium 3 rack systems, while AMD’s Helios rack is now an OCP standard. Both designs would, in theory, be easier to service, but Delos argues that its modular design offers greater flexibility.
“It makes it a little bit more flexible in terms of, maybe you want a scale up domain of 100 or maybe you want it a scale up domain of one,” CTO Dan Daly told El Reg. “It just depends on how many cables you want to plug in. This also allows you to go plug into different types of switches… it could be simpler switches, maybe even optical circuit switches (OCS).”
Using existing packet switches from Broadcom or Marvell, such a design could support 512-1,024 accelerators in a single layer fabric depending on whether you’re using 200 Gbps or 100 Gbps SerDes. Using multi-layer fabrics, OCS, and/or 2D/3D toruses, the compute domain could scale even further, all while using off-the-shelf components.
While OSFP keeps things simple and easy, it also means power consumption could become problematic for larger compute domains requiring pluggable optics.
In fact, this is why Nvidia has taken so long to embrace optical scale-up. Copper may not have the reach, but it uses a fraction of the power.
Delos CEO Ed Doe tells us the company is already exploring versions of the system that will use near package or co-packaged optics out to MPO-style connectors rather than the OSFP.
The startup isn’t just doing hardware. As anyone who’s done large scale networking knows, the physical and logical topologies — that is, the way devices communicate with one another on the network — can look very different depending on the workload.
Delos has developed a software orchestration platform designed to facilitate the configuration and monitoring of these switched fabrics or meshes in order to enable dynamic rerouting of traffic in the event of a link failure.
At Computex, this software platform, which Delos has dubbed its Nonstop AI network, was on display, allowing attendees to pull links at random and see the network react and correct itself automatically.
The company’s ambitions don’t stop at network orchestration and systems. We’re told Delos has additional products in the works, and we don’t know for sure what they are, but a high radix switch design built atop merchant silicon would certainly complement its Nonstop AI systems. ®
offbeat
It’s just not cricket
BORK!BORK!BORK! Windows swings for a six but smacks the stumps instead as the baleful glow of a Blue Screen of Death (BSOD) adorns Worcestershire County Cricket Club.
We were worried that, with recent editions of Windows, the traditional white monospaced text on a blue background of a BSOD was becoming a thing of the past. Thankfully, Worcestershire County Cricket Club, founded in 1865, is keeping the old ways alive with a BSOD to bring a tear to many a system administrator’s eye.
Spotted by Register reader Rhodri Howell, Windows has been felled by a DRIVER_POWER_STATE_FAILURE, probably due to a bit of hardware not waking up when Windows asked it to, or the driver experiencing an unexpected teatime.
The screens on top of the club’s sign are usually there to beam messages at attendees, but in this case, it looks like at least one is a bit poorly, which might have contributed to Windows throwing in the towel or, to use cricket terminology, conceding.
For the uninitiated, cricket is a team sport in which a ball is thrown at an individual called a “batter’” who defends several sticks in the ground called a “wicket.” The sport is notable for a variant called a “test,” which can last for several days, involve multiple games, and still end up in a draw.
Windows, on the other hand, is an operating system more than capable of knocking an administrator for six and lobbing the odd googly or two at the unwary.
The word “test” is also something that doesn’t seem to trouble Microsoft so much these days, at least if what the company has delivered in recent months is anything to go by. No amount of shin pads or even the toughest of boxes is sufficient to ward off an eyewatering Windows update.
Microsoft’s current CEO, Satya Nadella, is a fan of the sport, and so the sight of Windows disgracing itself above Worcestershire County Cricket Club’s signage (and the three black pears of the county’s emblem) is doubly distressing.
As the saying goes: “It’s just not cricket.” ®
Politics33 seconds ago
Ben-Gvir wants to ban Mosque loudspeakers, citing precious “sleep”
Sports2 minutes ago
Trump’s World Cup: More matches, higher prices, fewer foreigners – The Debate
Tech3 minutes ago
Microsoft’s June Patch Tuesday fixes a record 200 vulnerabilities, including five being actively exploited
-
Fashion7 days agoWeekend Open Thread: Evereve – Corporette.com
-
Entertainment5 days agoThe Best Mystery Series of All Time Is Surging on Streaming 30 Years After It Ended
-
NewsBeat4 days agoAlexander Zverev wins the French Open to finally earn a 1st Grand Slam title
-
Crypto World7 days agoJensen Huang Approves Samsung, SK Hynix, and Micron for NVIDIA (NVDA) HBM4 Memory Supply
-
Crypto World4 days agoAnatomy of the June crypto crash: Fed, Iran, Saylor
-
Tech6 days agoSuspicious Polyfill login prompts pop up on Toshiba, Muji websites
-
Crypto World6 days agoSenator Cynthia Lummis Calls CLARITY Act the Most Consequential Financial Legislation of This Generation
-
Tech5 days agoMicrosoft unveils seven homegrown AI models in new bid for ‘long term self-sufficiency’
-
NewsBeat5 days agoAlexander Zverev conquers demons and outlasts Flavio Cobolli to win French Open for first major title
-
Tech6 days agoVon der Leyen’s AI envoy pick draws conflict-of-interest fire
-
Business4 days agoHigh Stakes for Wembanyama as New York Pushes for 3-0 Lead
-
Tech6 days agoHackers now exploit SolarWinds Serv-U flaw to crash servers
-
Business5 days agoThe Pain Points Taking a Fragile Tech Rally Down a Notch
-
Tech7 days agoMeta steals a tactic from Tesla and builds data centers in tents
-
Crypto World4 days agoEli Lilly (LLY) Stock Surges 4% Following Breakthrough Sleep Apnea Trial Results
-
Tech4 days agoNotion restores access to Anthropic after service disruption
-
Crypto World5 days agoTrump’s AI Ownership Plan Could Benefit Anthropic at OpenAI’s Expense
-
Business5 days agoThe investment to transform historic St Helen’s ground in Swansea
-
Sports3 days agoBangladesh beat Australia after 20 years in ODIs, register only their second win over six-time world champions | Cricket News
-
Tech7 days agoRCS Messages Between iPhone and Android Get End-to-End Encryption With iOS 26.5
You must be logged in to post a comment Login