The Crystal Palace vs Man City live stream kicks off the Premier League weekend on Friday night. Man City are targeting a second victory of the season under their new boss Enzo Maresca, while Crystal Palace are looking to get off the mark in 2026/27 following defeat on the opening weekend.

Man City did not have everything their own way last time out. They fell behind to Bournemouth and were still trailing until the latter stages, before former Crystal Palace captain Marc Guehi notched an equaliser. Josko Gvardiol then completed the comeback in stoppage time.

On GitHub, [AyaanB] details buying a cheap Android TV streaming device, looking for, and finding, baked-in malware.

Multiple warnings have been issued by the FBI and CISA regarding malware on media box Android devices. Many devices have been caught participating in botnets providing residential proxies, ad-click fraud, and DDOS services. [AyaanB] sets out to discover if a $30 set-top streaming box is pre-infected with malware, and extracting it – without ever letting the device talk to the Internet or access other devices on the local network.

Picking a device named in the advisories, [AyaanB] discovered that it was, indeed, preloaded with multiple app stores and applications that wouldn’t typically make sense on a set-top TV box. After identifying the serial port test pads and obtaining a low-voltage serial adapter, they were able to gain access to the bootloader and from there dump the contents of the MMC over TFTP.

With the entire filesystem accessible out-of-body, proving it was infected with malware at the factory becomes simple: the malware is signed as a system application, baked onto the system partition of the MMC, granted SELinux exceptions to mark it as a system binary with shell privileges, and has multiple launch scripts to make sure it is executed even if partially removed. With the malware identified, [AyaanB] continues to dig through to uncover the capabilities.

By installing hooks into the low-level Android process spawning system, the malware installs hooks into every application as it is launched: even if an application isn’t trojaned already, by the time it finishes executing, it’s definitely been subverted. The functions patched and the methods used match the Vo1d botnet, which is used for account takeovers, residential proxies, free “VPN” services, and other unfriendly behavior.

Further digging into the system showed hooks for ad-click fraud, where hidden browser windows are allowed to run unthrottled and display overlays are configured to obscure ads below where the user may click. Other included tools bid in real-time ad auctions, claiming to directly publish ads to the user which may or may not be visible. To cap it all off, a root level backdoor allows botnet operators to access the systems directly and install additional tools.

Be sure to check out [AyaanB]’s writeup for more details on exfiltration methods and other malware found on the devices.

Hijacking Calls to Military Bases with DNS

In the early 2000s, a domain name scheme was developed to directly map telephone numbers to DNS records for SIP and VOIP calling. (Who knew? I didn’t!) But [Lina] did, with an excellent writeup on accidentally positioning themselves to intercept phone calls by registering an expired domain.

The e164-arpa number to name scheme was never widely adopted, and quickly forgotten about. As is the way with all forgotten standards, the infrastructure slowly fell apart. [Lina] noticed that several country records were delegated to name servers hosted in expired domains, and by simply registering them, they were able to begin resolving queries. For a five Euro registration fee, [Lina] gained control over an abandoned DNS resolution protocol for Saint Helena, Diego Garcia, and Ascension Island. After watching the logs for some time and not getting any traffic, and running into the bureaucratic tangle of standards committees and the actual United Nations, the project was shelved.

Six months later, [Lina] examined the logs of the other domains, and found hundreds of thousands of records of attempted calls, and since you read the section header, you already know where the calls were headed. Clearly some phone systems still attempt to use the ill-fated e164-arpa calling scheme even in 2026, and because the DNS records control the destination of the call, it would have been possible to hijack all the calls transparently and mine them for information, and all for five Euros. With military bases involved, and with one of the bases targeted by missiles during recent conflicts, suddenly agencies cared significantly more, and the story has the happy ending of the domains being transferred to the National Cyber Security Center in the UK.

AliExpress Fingerprinting Browsers

AliExpress has been caught using a hidden fingerprinting technique to try to identify users.

The fingerprinting plays a waveform in the background of the page with the volume set to zero, and measures variances in the computed values. Variances in the computed waveform are introduced by the browser type, CPU, audio hardware, and even the driver versions. While most of the headlines have focused on the audio fingerprinting, AliExpress also used other fingerprinting techniques to build profiles of each browser, including WebGL, WebRTC, screen resolution, and other web integrations.

The purpose of the advanced device fingerprinting is unknown: AliExpress could use it for fraud prevention, but could also be using it to identify and track customers when they have disabled traditional tracking cookies. The audio fingerprinting was discovered when a user experienced trouble with Bluetooth headphones being attached to the silent audio stream.

Unfortunately with fingerprinting techniques which leverage standard features in the browser it can be difficult to block them. Sometimes, ad blockers may be able to identify and block some of the fingerprinting resources, as can disabling some features in the browser, but many features like audio and WebGL can’t usually be turned off.

[Tom Ritter], who works for Firefox, mentions that they head this fingerprinting method off at the pass three years ago as part of their anti-fingerprinting campaign. This is clearly not the case for all browsers.

Attacking Signal’s Contact Discovery

Most chat apps allow you to discover users from your contacts list who also use that app – but then you’ve given your contact list to the app, helping them build their marketing and social graphs. Signal of course handles it differently, allowing you to discover users from your contacts list while preventing the Signal corporation from being able to access your list of contacts. Well, mostly.

Signal runs the contact discovery process inside an Intel SGX Enclave. A SGX Enclave is an Intel extension similar to a Trusted Execution Environment (TEE) on Arm, where memory and execution can be partitioned for a restricted process. In theory, code and memory inside an enclave can not be read by other processes, root processes, or even a hypervisor or virtualization system. Signal uses enclaves so that the users encrypted contacts list and the encryption key itself are fully insulated. The Signal client is then able to validate the integrity of the enclave using known measurement values baked into the client releases.

Researchers using the V12 AI agent discovered this wasn’t always the case. Because a SGX Enclave shares resources with the rest of the system, a malicious host could create exploitable race conditions in the algorithm by generating page faults and pausing execution of the enclave. The malicious server running the enclave is still unable to directly read the contents, but it could extract the secret values needed to then create false servers which could fully expose the user contact list.

A second attack would allow a malicious host to manipulate the list of clients connected to the enclave, gaining full code execution inside the enclave with the predictable result of exporting contact data.

Both of the issues were reported to Signal and fixed before the public writeup, and there is no evidence they were ever abused: to attack either flaw, a compromised host would have to be running the Signal enclave code and be part of the Signal infrastructure that clients would connect to.

Boston Scientific Hit by Cyberattack

Boston Scientific reported in a SEC filing that it has been hit with an unspecified cyber attack impacting operations, causing the stock to drop by almost 5% in a day.

The company has been unwilling to release any details of the attack, but expects to be able to resume shipping of medical products in “less than three weeks,” which sounds like a pretty major disruption. Boston Scientific manufactures defibrillators, pacemakers, and surgical equipment. It’s unclear if any patient data has been compromised, though presumably regulations will require disclosure if that’s determined to be the case.

With no additional information about the attack, it’s also unclear if any source code or other data which could aid attacking medical devices was impacted, either.

Carhartt Hit by Ransomware

The Carhartt clothing company has also been hit by ransomware, with 13 million accounts leaked.

The ShinyHunters group claims responsibility; previous victims of the group include casinos, car manufacturers, medical companies, and government agencies. The leak claims to include over 50 gigabytes of customer and employee data, with customer data including email, phone numbers, and physical shipping addresses. The group demanded $3.3 million in ransom for the data, and published it when Carhartt didn’t pay.

Have I Been Pwned linked the data to a compromise of the Databricks instance used by Carhartt, which is a platform for linking business data and AI.

AI Agents Installing Unknown Code

Multiple AI agents (Codex, Hermes, and Claude) have been observed executing arbitrary instructions and code contained in the llms.txt files on websites.

Normally, llms.txt and llms-full.txt are used to instruct AI agents on how to summarize and index the sites content, but researchers in Israel indexed the files of Fortune 500 companies, defense contractors, and tech companies and found that over a hundred of them included directions to install packages which didn’t exist or referenced domain names that were not registered. The researchers were able to create packages with matching names and record agents inside multiple high-profile companies installing and executing them.

While documenting the reach of the exposed packages, researchers found at least one had already been replaced by attackers with live malware which would execute inside whatever context the agent was executing in, potentially exposing authentication tokens or company data. The attacks which have been rampant in the NPM and PyPI package repositories can make even legitimate packages dangerous to install, but agents blindly following instructions from arbitrary websites inflates the danger even higher.

Alleged Members of TeamPCP Arrested

Finally, security reporter extraordinaire Brain Krebs brings news that suspected key operators of the TeamPCP group have been arrested in Australia.

TeamPCP has been behind some of the worst of the supply chain attacks plaguing PyPI, NPM, and VSCode plugin repositories, and have released the source code to some of the worms used in the supply chain attacks to muddy the waters and recruit new members. TeamPCP has also been involved in compromising thousands of GitHub repositories, and is affiliated with multiple other crime and malware groups.

While the identities of the arrested individuals have not been officially released, in typical Brian Krebs fashion, dozens of connections are correlated showing their likely identities and links to TeamPCP and other groups. If nothing else, this should serve as a reminder that the best time to pay attention to operational security was ten years ago.

As TeamPCP doesn’t appear to be a state-sponsored group, or even strongly organized, the arrests of a few members are unlikely to drastically slow down the compromises. Krebs details conversations held with one of the arrested men, in which they discuss struggles with sobriety and plans to leave the malware scene, stating that others have already taken over leadership roles in the group.

There’s no need to keep oversleeping (unless you want to).

How to keep your alarm at full volume when your Android phone is on mute

Henryk_Guziak/Shutterstock

Still no alarm sound? Other things worth checking

Fadfebrian/Getty Images

from the too-bad,-so-sad dept

Back in June, the Supreme Court ruled 6–3 in National Republican Senatorial Committee v. Federal Election Commission that federal limits on coordinated expenditures by political parties violate the First Amendment. Which is every bit as stupid and corrupt as it sounds.

Previously, under the Federal Election Campaign Act (FECA), political parties were subjected to strict statutory caps on how much money they could spend in direct coordination with their candidates’ campaigns. The Supreme Court’s June ruling eliminated candidate contribution caps, made it much easier for rich people to flood Joint Fundraising Committees (JFCs) with cash, and basically gave a giant green light for more quid-pro quo corruption to be exploited by dark money groups.

Given the broad disparity in how much money the two U.S. parties have ($125 million for the GOP versus a bunch of debt for the mismanaged DNC) Republicans were keen to use the Supreme Court ruling to their advantage in the coming midterms, hoping to flood the airwaves with more dark money-funded agitprop than ever before in a bid to try and offset Donald Trump’s nose-diving popularity.

Hoping to embolden their plan and provide discounts, the Brendan Carr FCC’s media bureau quietly issued an announcement late last March saying they were making some changes to the FCC’s lowest unit charge (LUC) requirements governing broadcast TV political ads. The changes expanded which political entities qualified for discounted broadcast advertising rates.

Historically, a subset of political candidates were given a discounted rate on ads starting 60 days before the midterms (generally the lowest rate any advertiser has to pay during that block of time). The Supreme Court and FCC collaborated to extend that discount to effectively all dark money political groups and JFCs, giving the GOP a massive advantage in midterm messaging and spending.

But things have since gotten slightly more complicated for Republicans.

Anna Gomez, the FCC’s lone Democratic Commissioner (because Republicans refuse to fill the other empty Democrat seat), issued a statement this week belatedly blasting the Carr FCC for expediting America’s steady decline at the hand of billionaire donors and political corruption:

“In the final stretch of a national election, this FCC is unleashing a flood of coordinated
campaign money into broadcast advertising, just as the Supreme Court has cleared the way
for unlimited coordinated spending between parties and candidates. This unprecedented,
last-minute decision gives the biggest political spenders an even bigger advantage over
everyone else by expanding the candidate-only discount established by law to joint
fundraising and party committees, an advantage that will make it hard for anyone else to
catch up before Election Day.

According to Gomez, Carr’s FCC also made the changes with all the transparency you might expect:

This decision was made behind closed doors by agency staff, not by the full Commission, and it contradicts what this administration itself told the Supreme Court less than a year ago about who qualifies for this discount. In direct conflict with the administration’s position, the FCC relies on alleged staff-level guidance that was never provided in writing and that nobody could find, and adopted it with no opportunity for the public to weigh in. The American people should not have sweeping election-year rule changes forced on them in the dark, on the eve of an election, without a single opportunity for public input.

But there’s some new bad news for Brendan Carr and the Republican midterm agitprop machine: Sen. Jon Ossoff, Rep. Kristen McDonald Rivet and Senate candidates Roy Cooper and Sherrod Brown filed a lawsuit last June attempting to stop the FCC. And this week, The Richmond, Virginia-based 4th Circuit Court of Appeals sided 2-1 with the four Democrats, temporarily suspending the FCC effort:

“The [lowest unit charge] requirement and campaign finance statutes are clear that neither political parties nor joint fundraising committees with non-candidate members can be entitled to the LUC.”

The court found that the Carr FCC also basically ignored numerous complaints by broadcasters and politicians about the unfairness of the discounted ad rate plan:

“Despite the time-sensitive nature of these proceedings, the Commission intentionally took no action and offered no response to the Application for more than three months. The Commission did not, for example, seek responses from impacted parties, or engage in fact finding, or secure supplemental briefing, or solicit public comment, or schedule or conduct an oral argument.”

Funny, that.

Republicans will inevitably appeal. Though the Republican effort to get highly discounted rates for their midterm agitprop campaigns has stalled out at an inopportune time (for them). But overall, the general direction of U.S. lobbying and corruption safeguards generally has only been headed one direction, with fairly ugly and obvious results everywhere you look.

Filed Under: advertising, airtime, anna gomez, brendan carr, broadcasters, corruption, dark money, fcc, jon ossoff, kristen mcdonald rivet, lowest unit charge, midterms, political advertising, politics, proaganda, roy cooper, sherrod brown, tv

This has been another year in which we’ve seen a significant number of streaming price hikes, and Apple has become the latest company to bump up costs for subscribers in the US. On Friday, the tech giant announced it’s raising the price of Apple TV’s monthly and annual subscriptions, as well as the Apple One Individual plan.

As of today, Apple TV will increase by $2 to $15 per month, and the annual price will increase by $20 to $119. The change goes into effect for new and current subscribers today, but existing customers will receive notification roughly one month before the new price hits their bill.

The streaming service, which also raised its subscription price in August last year, is home to popular titles such as Ted Lasso, Severance, Widow’s Bay and Dark Matter.

If you have the Apple One Individual plan, the new rate is $22 a month, up from $20. This plan bundles access to Apple TV, iCloud Plus, Apple Music and Apple Arcade. For now, pricing for the Family and Premier tiers remains the same.

It’s not the only streamer to hike prices, as Netflix, Spotify, Peacock, Prime Video and others have also implemented price jumps in 2026. This announcement comes ahead of Apple’s big iPhone event on Sept. 9, when it’s rumored to launch a foldable phone among its new lineup.

Kourtnee Jackson

Senior Editor

Kourtnee covers streaming services and entertainment. She previously worked as an entertainment reporter at Endgame 360, where she wrote about film, television, music, celebrities and streaming platforms.

See full bio

Advertisement

OS PLATFORMS

GRUB’s up for furry new update

It looks like the Racoon has bedded in and settled down, as Canonical releases the first point release of this year’s Ubuntu LTS version, offering an upgrade to users on Ubuntu 24.04 LTS (Noble Numbat).

Ubuntu 26.04.1 is the first point release of April’s long-term support version, which will be supported until 2031. Assuming that it follows the pattern of previous Ubuntu LTS releases, 26.04.1 will be followed by four further point releases – usually, the final release comes a little while after the following LTS release. That means Ubuntu 26.04.5 should arrive some time after Ubuntu 28.04 – meaning in or around September 2028.

It’s accompanied by most of the remixes releasing matching point releases: Kubuntu, Ubuntu Budgie, Lubuntu, Ubuntu Kylin, Ubuntu Studio, Xubuntu, Edubuntu, and Ubuntu Cinnamon. Notably, two flavors are missing from this list. There are 10 official flavors but only eight point releases lists.

There was no official 26.04 release of Ubuntu MATE. Maintainer Martin Wimpress has stepped down – he has a new project called Nøughty Linux he’s working on instead. There’s not much to see on the website yet, but if you’re curious, his talk at the 2025 Ubuntu Summit will give you a taste.

Ubuntu Unity isn’t in that list, either. That remix missed the 25.10 release cycle because lead developer Rudra Saraswat – whom we first talked to in 2022, when he was 12 – is at university. The good news is that some developers did step up to help and there is an Ubuntu Unity 26.04 release. It replaces a bunch of subcomponents of the previous version, though, and that means it’s officially not an LTS release. Ubuntu Unity users should be aiming for the 26.10 release instead.

This first point release has a few consequences we can expect.

One is that for LTS users, it’s upgrade time, if you are planning on trying to stay current. Canonical does not start offering new version upgrades to LTS users until the first point release. Now that Raring-point-one is here, people running Ubuntu 24.04 “Noble Numbat” will start to see offers to upgrade to the new version.

This applies to those running their Ubuntu servers as pets, rather than herding them like cattle. One of the things that really crumples the cardigans of hardcore Debianisti is that Canonical inserts messages into the output of the apt command. So the upgrade offers won’t be limited to graphical desktop users.

Another consequence, albeit less concerned with any of the official flavors, is that System 76’s Pop!_OS 26.04 is expected soon. The company said on LinkedIn that they were aiming for an end-June release date. That didn’t happen.

The team is certainly hard at work. Its in-house COSMIC desktop hit version 1.0 in December last year, and earlier this week, it released COSMIC version 1.7.0. That means that the next Pop!_OS will now use Ubuntu 26.04.1.

The Reg FOSS desk is becoming quite fond of COSMIC and Pop!_OS, after a fairly shaky start. It feels quite a bit faster than Ubuntu itself, and on our newer testbed laptop – a 2018 Dell XPS13 – it’s not only very fast to start, but its ability to change the screen DPI on the fly is very handy. On older kit, it can make effective use of NVIDIA GPUs that the official binary driver can no longer use on modern kernels, although we have seen it freeze up quite a few times on those 10-15 year old machines. 

COSMIC is new and it’s developing faster than any other desktop in the Linux world. The team has ambitious plans for “Epoch 2” and beyond. At the rate they’re moving, perhaps Pop!_OS 26.04 will come with COSMIC 2. ®

You might have to pay a bit more to catch the end of the latest Ted Lasso season.