Connect with us
DAPA Banner
DAPA Coin
DAPA
COIN PAYMENT ASSET
PRIVACY · BLOCKDAG · HOMOMORPHIC ENCRYPTION · RUST
ElGamal Encrypted MINE DAPA
🚫 GENESIS SOLD OUT
DAPAPAY COMING

Tech

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

Published

on

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and authorship platform.

The threat group TeamPCP, formally tracked by Google Threat Intelligence Group as UNC6780, claimed responsibility and is advertising the stolen repositories for sale starting at $50,000. GitHub’s assessment: the attacker’s claim is “directionally consistent” with the investigation so far. Trend Micro, StepSecurity, and Snyk have formally tracked TeamPCP across at least seven waves of the Mini Shai-Hulud supply chain worm since March.

The GitHub breach did not land in isolation. It arrived the same day a new Mini Shai-Hulud wave forged valid cryptographic provenance on 639 malicious npm package versions, one day after attackers compromised a VS Code extension with 2.2 million installs, the same day Wiz discovered TeamPCP had compromised Microsoft’s durabletask Python SDK on PyPI, and the same morning Verizon’s 2026 DBIR revealed that 67% of employees access AI tools through non-corporate accounts. Five supply chain surfaces failed in 48 hours. Two more AI-agent attack classes were disclosed the same month that completed the grid. One group connects at least three of them.

GitHub confirms the breach, names the attack vector, and the attribution trail is long

“Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately,” GitHub posted in a five-post thread on X on May 20. “Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. [Emphasis added by VentureBeat] The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.” GitHub added that critical secrets were rotated overnight with the highest-impact credentials prioritized first.

Advertisement

GitHub’s confirmation narrows the attack vector to a single employee device but leaves the blast radius expanding. The company has not named the specific extension. Internal repositories contain infrastructure configurations, deployment scripts, staging credentials, and internal API schemas. Source code access at that level is not a data breach. It is an infrastructure intelligence leak.

Dark Web Informer reported that TeamPCP’s listing appeared on a hacking forum hours before GitHub’s initial disclosure, advertising around 4,000 private repositories. Hackmanac independently confirmed the listing. An X account linked to TeamPCP, xploitrsturtle2, posted after GitHub’s confirmation: “GitHub knew for hours, they delayed telling you and they won’t be honest in the future. What an amazing run, it’s been an honor to play around with the cats over the past few months.”

Google Threat Intelligence Group formally tracks TeamPCP as UNC6780, a financially motivated threat actor specializing in supply chain attacks targeting open-source security utilities and AI middleware. Trend Micro tracked “at least seven confirmed waves” spanning Trivy (March 2026), Checkmarx KICS, LiteLLM, elementary-data, Bitwarden CLI, TanStack (May 11), and Mistral AI (May 12). StepSecurity, Snyk, and Trend Micro assess high confidence on the Trivy, Bitwarden CLI, and TanStack waves based on toolchain overlap. GitHub’s May 20 confirmation that the breach came through a poisoned VS Code extension aligns with the exact attack surface TeamPCP weaponized throughout 2026.

Binance co-founder CZ posted immediately: “If you have ANY private repos with plain text secrets or sensitive documents/architectures, immediately rotate your secrets.” Mike Riemer, CTO of Ivanti, told VentureBeat in an exclusive interview that Azure’s honeypot network now shows known vulnerabilities exploited in under 90 seconds. Stolen credentials shorten the recon phase that precedes exploitation. Every GitHub-side secret that reaches a buyer accelerates whichever attack path that buyer was already running.

Advertisement

The worm that forges its own provenance badge

Hours before GitHub’s disclosure, Endor Labs detected 42 malicious npm packages published between 01:39 and 02:06 UTC on May 19. Socket’s broader tracking put the full wave at 639 malicious versions across 323 packages inside Alibaba’s @antv data visualization ecosystem, roughly 16 million weekly downloads.

This wave introduced provenance forgery. The worm now calls Fulcio and Rekor at runtime to generate valid Sigstore signing certificates for every package it propagates to. Provenance tooling shows a green badge. The build chain belongs to the attacker. “The attestation proves where the package was built. It does not prove the build was authorized,” Endor Labs stated.

Peyton Kennedy, senior security researcher at Endor Labs, told VentureBeat that “TanStack had the right setup on paper: OIDC trusted publishing, signed provenance, 2FA on every maintainer account. The attack worked anyway. Each wave has picked a higher-download target and introduced a more technically interesting access vector.”

Late on May 12, vx-underground reported that TeamPCP open-sourced the fully weaponized Shai-Hulud worm code. Copycat variants have already appeared, complicating attribution. Kennedy provided VentureBeat a first-pass detection check: run find . -name ‘router_init.js’ -size +1M across project directories and grep for the hash 79ac49eedf774dd4b0cfa308722bc463cfe5885c in package-lock.json. If either returns a hit, isolate and image the machine before revoking any tokens. The worm’s destructive daemon triggers on revocation.

Advertisement

GitHub Actions tags redirected to imposter commits the same day

Also on May 19, threat actors compromised the popular GitHub Actions workflow actions-cool/issues-helper by redirecting every existing tag in the repository to an imposter commit that does not appear in the action’s normal commit history. “That commit contains malicious code that exfiltrates credentials from CI/CD pipelines that run the action,” StepSecurity researcher Varun Sharma said. GitHub has since disabled access to the repository.

The exfiltration domain (t.m-kosche[.]com) matches the @antv Mini Shai-Hulud wave, tying the two clusters together. Only workflows pinned to a known-good full commit SHA were unaffected.

The worm jumped to Microsoft’s own Python SDK the same day

Hours after the @antv wave, Wiz detected that TeamPCP had compromised durabletask, the official Microsoft Python client for the Durable Task workflow execution framework. Three malicious versions (1.4.1, 1.4.2, and 1.4.3) were published to PyPI within a 35-minute window on May 19. The attack chain was direct: a GitHub account compromised in a previous TeamPCP operation still had access to the microsoft/durabletask-python repository. The attacker dumped GitHub Secrets, extracted a PyPI publishing token, and pushed the infected releases directly. PyPI quarantined all three versions.

StepSecurity’s analysis found the payload downloads a 28 KB dropper (rope.pyz) that steals credentials from AWS, Azure, GCP, Kubernetes, and over 90 developer tool configurations, then spreads laterally through cloud infrastructure. The payload skips systems with a Russian locale. The durabletask package averages over 400,000 monthly downloads.

Advertisement

VS Code extensions breached GitHub itself, and that is not even the first compromise this week

On May 18, attackers published a compromised version of the Nx Console VS Code extension, installed more than 2.2 million times. The malicious version harvested tokens from GitHub, npm, AWS, HashiCorp Vault, Kubernetes, and 1Password, and specifically targeted Claude Code configuration files under ~/.claude/settings.json. The Nx team removed it within 11 minutes. Any developer who opened a workspace between 12:36 and 12:47 UTC ran the credential stealer. One day later, GitHub confirmed that a different poisoned VS Code extension was the entry point for the 3,800-repo breach of its own internal infrastructure.

As one X user framed it: “Microsoft’s GitHub was compromised when a Microsoft developer using Microsoft VSCode installed a rogue extension from Microsoft’s VSCode extension library, which is moderated and hosted by Microsoft.” The entire attack chain stayed inside one vendor’s ecosystem. Developers have been reporting malicious VS Code extensions to Microsoft for years. A publicly documented complaint from December 2024 asked Microsoft to fix the marketplace. Eighteen months later, the marketplace was the entry point for a breach of GitHub itself.

AI coding agents treat trust dialogs as features, not security events

Adversa AI’s TrustFall research, published May 7, tested Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI. “A repository can ship a configuration that auto-approves and immediately launches an MCP server, no tool call from the agent is required,” researcher Rony Utevsky told Dark Reading. All four default to “Yes/Trust.” The Managed scope configuration that could lock this down is “rarely used.” When Claude Code runs headless through GitHub Actions, the trust dialog never renders.

PR comments became agent instructions

Aonan Guan, alongside Johns Hopkins colleagues Zhengyu Liu and Gavin Zhong, typed a malicious instruction into a PR title and watched Anthropic’s Claude Code Security Review action post its own API key as a comment. The same prompt injection worked against Gemini CLI Action and GitHub’s Copilot Agent. Anthropic classified it CVSS 9.4 Critical.

Advertisement

Prompt injection reaches eval() through legitimate API calls

Microsoft disclosed CVE-2026-26030 and CVE-2026-25592 on May 7, both critical in Semantic Kernel. The Python SDK flaw let a crafted prompt achieve host-level remote code execution. The .NET SDK flaw turned an accidentally exposed file-transfer helper into a tool the AI model could invoke, enabling sandbox escape from Azure Container Apps.

Social channels deliver the payload where EDR has no signal

CrowdStrike’s 2026 Financial Services Threat Landscape Report, released May 14, quantified identity theft scaling outside developer toolchains. DPRK-nexus actors stole $2.02 billion in digital assets in 2025, a 51% year-over-year increase. PRESSURE CHOLLIMA conducted the largest single financial theft ever reported: $1.46 billion through trojanized software distributed via supply chain compromise. FAMOUS CHOLLIMA doubled its operations using AI-generated identities. STARDUST CHOLLIMA tripled its tempo. The primary delivery channels: WhatsApp and LinkedIn, where EDR has no signal.

“Financial services organizations face threats from every direction, and AI is making each of them harder to stop,” Adam Meyers, senior vice president, counter adversary operations at CrowdStrike, said in the report. “Adversaries are using AI to compress the time from initial access to impact, moving through trusted paths faster than legacy defenses can respond.” His 2026 Global Threat Report found 82% of detections in 2025 were malware-free. The average eCrime breakout time fell to 29 minutes, with the fastest observed at 27 seconds.

Riemer told VentureBeat the same dynamic applies to developer toolchains. “Bad guys are pivoting to what’s the next weakest link. Let me get somebody’s house key, and I can make it through the back door.” Stolen developer identities are the house key.

Advertisement

Shadow AI usage tripled in one year

The Verizon 2026 DBIR found that 45% of employees are regular AI users, up from 15% last year, with 67% accessing AI through non-corporate accounts. Third-party involvement in breaches jumped to 48%.

The Developer Tool Stolen-Identity Audit Grid

No single surface in this grid qualifies as a zero day. Chained together, they function like one. “I can take a whole bunch of little things and chain them together and get the same level of access,” Riemer told VentureBeat. “That’s what AI does very, very well.”

Surface

Incident / Vector

Advertisement

Visibility Gap

Recommended Action

GitHub internal repositories

TeamPCP (UNC6780) stole ~3,800 internal repos via poisoned VS Code extension on employee device. GitHub confirmed May 20. Critical secrets rotated overnight. Listing includes security infra and AI tooling repos

Advertisement

Customers cannot audit internal repo contents. Leaked secrets affect every downstream tenant

Rotate GitHub-issued tokens, OAuth app secrets, and Actions OIDC trust relationships

npm provenance verification

Mini Shai-Hulud wave (May 19). 639 malicious versions per Socket. Stolen maintainer identity generated legitimate Sigstore certs at runtime

Advertisement

Provenance check passes. Signing identity is stolen. 16M weekly downloads affected

Stop treating provenance badges as sufficient. Add install-time behavioral analysis. Set minimumReleaseAge

VS Code extension auto-update

Nx Console v18.95.0 (May 18). Stolen contributor token, orphan commit, three exfil channels. Claude Code configs targeted. 2.2M installs

Advertisement

Auto-update executes credential stealer silently. No detection category exists

Pin extension versions. Audit auto-update policy. Review publisher token governance

AI coding agent CLI trust dialog

TrustFall (Adversa AI). All four CLIs auto-execute untrusted MCP servers with one keypress

Advertisement

Trust dialog is a feature, not a security event. Headless CI skips dialog entirely

Disable enableAllProjectMcpServers. Require explicit per-server approval

CI/CD pipeline agent execution

Comment and Control (Johns Hopkins, CVSS 9.4). PR comments processed as agent instructions

Advertisement

Malicious .mcp.json runs with runner’s full credentials. Zero human interaction

Gate agent runs to post-merge branches. Review pull_request_target workflows

AI agent framework eval() path

Semantic Kernel CVE-2026-26030 (9.9) and CVE-2026-25592 (10.0). Prompt injection reaches eval()

Advertisement

EDR sees approved call. Flat auth plane fails to respect user permissions

Upgrade to Python 1.39.4+ / .NET 1.71.0+. Disable auto-invocation

Out-of-band delivery

CrowdStrike FinServ (May 14). WhatsApp and LinkedIn as primary vectors. CHOLLIMA doubled and tripled tempo

Advertisement

EDR has no signal on social-channel delivery. AI-generated identities at scale

Add WhatsApp and LinkedIn to insider-threat playbooks

Seven surfaces. One group confirmed across at least three of them, with open-sourced tooling enabling copycats across the rest. Kayne McGladrey, IEEE Senior Member, told VentureBeat that organizations are “defaulting to cloning human user profiles for agents, and permission sprawl starts on day one.” The compliance frameworks enterprises rely on were written for humans. Agent identities do not appear in any control catalog McGladrey has encountered.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

The First Production Car To Break 1,000 HP Wasn’t The Dodge Demon 170

Published

on





The 3,300 buyers who managed to snag themselves a Dodge SRT Demon 170 got an awful lot for their money. Despite the car’s sub-$100,000 price tag, the Demon produces the kind of power that’s been reserved for ultra-exclusive hypercars until relatively recently. With the right fuel in the tank, it churns out 1,025 horsepower; even on regular pump gas, it’s good for 900 horsepower. At its launch in 2023, Dodge called it the most powerful muscle car in the world, and in the years since then, nothing else has come along to take its crown.

As impressive as it may be, it’s far from the first production car to boast a horsepower output in four-figure territory. For starters, by the time the Demon 170 was announced, Tesla’s Model X Plaid and Model S Plaid had already been on sale for 2 years, with both cars making 1,020 horsepower. To return to the time when the 1,000 horsepower barrier was first crossed in a production car, you’ll have to go back a decade and a half further.

Advertisement

However, the answer to which production car was indeed the first to feature over 1,000 horsepower isn’t as straightforward to answer as you might think. The initial candidate is the Bugatti Veyron, which launched in 2005 after years of anticipation and quickly established itself as a new benchmark in the hypercar world. Originally, it produced 1,001 PS (metric horsepower), which is roughly 987 hp (mechanical horsepower). The second candidate is a much less well-remembered car, the SSC Ultimate Aero TT.

Advertisement

The SSC Ultimate Aero TT is America’s forgotten hypercar

If you’re measuring by mechanical horsepower rather than metric horsepower, the Bugatti Veyron officially falls slightly short of the 1,000 hp mark. However, there are no such caveats with its rival, the SSC Ultimate Aero TT.

SSC is a small American manufacturer founded by Jerod Shelby, who, despite their shared surname and interest in extremely fast cars, is not a relative of the legendary Carroll Shelby. The Ultimate Aero TT entered production in late 2006 and initially made 1,180 horsepower, according to the brand’s archived website. By the time SSC set a world speed record with the car in September 2007, that figure had been tweaked slightly to 1,183 horsepower.

The Veyron might have been designed and developed with the backing of VW Group, but its record as world’s fastest production car was nonetheless eclipsed by the upstart Ultimate Aero TT. During a two-way run, the SSC managed an average speed of 256 mph, just ahead of the Bugatti’s 253 mph average.

Both cars were designed to be the fastest in the world, but they were very different in most other aspects. The Bugatti had a W16 engine with four turbochargers, while the SSC was powered by a twin-turbo V8. The interiors of both cars were also worlds apart, with the Bugatti being luxurious and the SSC being bare-bones at best. In a 2007 feature for Classic Driver, one reviewer claimed that the SSC’s interior “falls way short, not just of other hypercars, but of almost all other cars currently on sale.”

Advertisement

Collectors don’t value the SSC like the Bugatti

As well as their engines and cabins, pricing was also a key differentiator between the two cars. The Bugatti retailed for around $1.2 million at the time of its launch, while SSC charged $550,000 for the Ultimate Aero TT. Today, the difference in value between the two is even more extreme. While the average Veyron sells for around $2 million, interested buyers can pick up an Ultimate Aero TT for under $500,000.

Advertisement

Unfortunately, anyone who’s interested in buying the example that actually beat the Bugatti’s speed record is out of luck. According to The Drive, the record-setting Ultimate Aero TT was crushed at a monster truck event in Washington in 2025, allegedly as a result of its owner being angry with SSC. Speaking to the outlet, Jerod Shelby said that the car had been non-functional for years and was previously in a museum, and added “I can’t imagine why anyone would want to destroy a vehicle of that stature.”

As both a former world speed record holder and the first production car to produce more than 1,000 mechanical horsepower, the Ultimate Aero TT is one of many American cars that arguably deserves a lot more recognition than it gets. Meanwhile, the Veyron remains in high demand with collectors, even if its oil changes alone cost as much as some used cars.

Advertisement



Source link

Continue Reading

Tech

Accenture makes three-pronged OT security acquisition for $4.17bn

Published

on

The consultancy giant will take a majority stake in Dragos, and full ownership of RunZero and NetRise.

Accenture is to partially or fully acquire three companies in the area of operational technology (OT) security for critical infrastructure and industrial operations for what it called a “combined enterprise value” of approximately $4.17bn.

The consultancy giant will take a majority stake in Dragos – which Accenture said offers “industry-leading OT threat detection” alongside a “trusted vendor-neutral platform and proprietary dataset” – and full ownership of RunZero and NetRise.

Under the deal, Dragos will continue to function as an independent business while overseeing RunZero, a cybersecurity platform that offers “comprehensive exposure assessment and attack-surface intelligence”, and NetRise, which analyses software supply chains for vulnerabilities.

Advertisement

According to Accenture, combining the three companies, which are based in two different US states, will allow it to advance a platform “to cover the extended environment that controls physical processes” – or ‘xOT’ – at greater scale for the protection of power grids, pipelines, manufacturing operations, distribution facilities and data centres.

“Combining Dragos with RunZero and NetRise will deliver a unified solution that enhances visibility, accelerates threat detection and response, and strengthens Dragos’s ability to scale adoption of its broadened platform,” Accenture said.

Accenture said it expects the three companies to generate, in total, approximately $208m in annual recurring revenue as of June 2026, and noted that its overall cybersecurity business has current revenues of around $10bn, having made a number of OT-focused acquisitions over the past decade.

“Our clients across industries and regions are asking us how to be more proactive and integrated in their approach to cybersecurity,” said Accenture’s CEO and chair Julie Sweet.

Advertisement

Taking on the three companies at a time when “AI-driven cyber threats and geopolitical risk are evolving at a rapid pace … fills this important need”, she added.

Under the deal, which is expected to close in August or September, three executives from the two fully acquired companies will become executives for Dragos, which will continue to be led by its co-founder and CEO Robert M Lee.

“Our energy and water systems, manufacturing plants, data centres and other operational environments need cybersecurity built from the ground up for xOT and designed to keep pace as threats evolve. The consequences of getting it wrong become societal threats,” said Lee.

“Organisations need solutions, not a patchwork of software and services. The addition of RunZero and NetRise will allow the Dragos platform to be a unique, end-to-end platform for global defence, and Accenture will bring its decades of trusted relationships and deep expertise to help us scale and secure more critical infrastructure and physical operations globally.”

Advertisement

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Source link

Advertisement
Continue Reading

Tech

Four-Month Build Turns $100 Pepsi Vending Machine Into a Rolling Go-Kart Attraction

Published

on

Pepsi Vending Machine Go-Kart
Most people have sat in a go-kart at some point. The seat sits low, the steering feels direct, and the whole thing skitters around with a kind of playful urgency. Very few have ever climbed into one that still carries the shape and branding of a soda machine. A maker known as Mixed Bag set out to close that gap. He bought a used Pepsi vending machine for a hundred dollars on Facebook Marketplace, then spent four months turning it into something that could actually drive.



Initially, the goal was rather straightforward. He saw an advertisement for a local car show in the Dallas area and decided he’d want to enter something, even though a typical project was far out of his price range. The vending machine stood out as a potential contender, and it eventually became his project of choice. Removing all the extra weight the previous machine was lugging around was the first step, as it had a reinforced cabinet and all sorts of internal components that made it way too heavy for battery power and basic mobility. So he removed as much of that as he could, making the endeavor more attainable.

Pepsi Vending Machine Go-Kart
Then came the question of transforming the machine into something that could move. He created a go-kart-style frame that fit inside the cabinet and served as the structural backbone of the item. Battery-powered motors handled propulsion, with two of them driving the rear wheels and providing differential steering, allowing the machine to turn by adjusting speed or direction on either side. Some reused elements from a pair of Razor scooters were utilized for front steering; with the handlebars removed, the steering was joined together for good synchronized movement. Brakes were a must-have, so he installed them. It actually rolled on its own power, though its greatest speed was just about 5 mph. That suited us perfectly, considering the weight and our need to keep it under control during testing and public appearances.

Pepsi Vending Machine Go-Kart
Inside the machine, he installed a real seat, a small AC unit to keep things cool during long runs, and a full set of live cameras on either side. A computer was responsible for monitoring the feeds. He also installed a PA system with an external speaker on the roof, allowing the driver to communicate with anyone close. All of the power came from a set of batteries, one large pack under the item and a few others elsewhere. Fresh Pepsi decals restored its luster, a “mystery flavor” slot at the bottom looked terrific, a rear access hole was cleaned up, and a fresh paint job completed the look.

Pepsi Vending Machine Go-Kart
Testing took place in stages, beginning with night trips and casual cruises about the neighborhood to ensure reliability. It completed a couple of laps on a half-mile track with four bars remaining on the battery, which is equivalent to at least a mile of range on a single charge. Neighbors were more astonished and amused by the gadget than anything else, which was a positive thing because it meant the design seemed friendly rather than frightening. Of course, steering was more difficult on the sidewalk than on the roadway, but it held together relatively well with only a few small failures.

Pepsi Vending Machine Go-Kart
So the real test came at the Rowlett car show, when the organizers allowed it into the custom-built category (with the caveat that it was not street legal, of course). It was parked amid the historic vehicles, lifted trucks, supercars, and insane custom machines, in the ideal location. No trophy was brought home, since Best of Show went to a 1961 Porsche. Mixed Bag stated that the original trophy goal changed once the machine began making strangers laugh, making that outcome more fulfilling than hardware on a shelf.

Source link

Advertisement
Continue Reading

Tech

Apple’s iPhone Air 2 is getting a second camera and better battery life, coming next year

Published

on

The big picture: Apple is working on a new version of the iPhone Air due out early next year. Sources familiar with the matter say the new phone will address two complaints that consumers had with the first model: a single rear-facing camera and lackluster battery life.

The next Air will reportedly ship with an ultrawide rear camera alongside the primary unit, boosting its appeal to photo bugs that may have skipped the first-gen device due to its single-camera configuration. In an era where multiple cameras are the norm on most mainstream and premium models, the single-camera Air no doubt felt like a major compromise to some.

Sources tell Bloomberg that Apple is also going to improve the Air’s battery life, although it’s unclear exactly how that will be achieved. The obvious answer would be to simply stuff a higher-capacity pack into the phone but doing so would be counterintuitive to the Air’s thin nature.

Gains could also be made through software tweaks and the use of more efficient hardware like the processor. Speaking of, the second-gen Air will be powered by a version of Apple’s A20 Pro SoC, which will debut in new iPhones due out this fall.

Advertisement

The first-gen iPhone Air launched in the latter half of 2025 with a 6.5-inch display and a slim 5.6mm profile. Initial reports suggested a lackluster response from consumers although later analysis refuted those claims. Moving forward with a new model indicates, at the very least, that Apple isn’t ready to give up on the idea just yet.

Apple is expected to launch the second-gen Air in the spring of 2027 alongside the standard iPhone 18. The latter would normally arrive with Pro-grade handsets in the fall but Apple is expected to shake things up this year with the arrival of its first foldable iPhone in addition to the iPhone 18 Pro and Pro Max. A special edition iPhone is being planned for the fall of 2027 to celebrate the iPhone’s 20th anniversary, we’re told.

Source link

Advertisement
Continue Reading

Tech

Sandisk’s new PS5 SSDs cost up to $2,960, that’s five PlayStation 5 consoles

Published

on

Facepalm: Sandisk has unveiled a new line of SSDs designed to expand the PlayStation 5’s storage capacity. To no one’s surprise, the new drives are priced more like luxury hardware than an affordable storage upgrade for a mass-market home console.

The US memory manufacturer has launched the Optimus GX PRO 850P SSD lineup, which includes storage drives specifically designed for the PlayStation 5 and PlayStation 5 Pro. While high-capacity SSDs are already expensive, Sandisk’s PS5-branded drives push pricing to an entirely different level.

The Optimus GX PRO 850P lineup includes four NVMe SSDs with capacities ranging from 1TB to 8TB. The 1TB, 2TB, 4TB, and 8TB models are priced at $380, $760, $1,500, and $2,960, respectively. Sandisk is also offering introductory discounts on the drives, suggesting their regular retail prices will be even higher once the promotion ends.

Sandisk said the Optimus GX PRO 850P SSDs are officially licensed by Sony and feature an exclusive heatsink design with a PS5 logo on top. The PCIe 4.0 drives have reportedly been optimized for the console’s internal M.2 expansion slot, although they are also compatible with any PC motherboard that supports the M.2 2280 form factor.

Advertisement

Additional specifications include support for the NVMe 1.4 protocol, sequential read speeds of up to 7,300 MB/s, and sequential write speeds ranging from 6,300 MB/s on the 1TB model to 6,600 MB/s on the 8TB version. Endurance ranges from 600 TBW for the 1TB drive to 4,800 TBW for the 8TB model, while every SSD is backed by a five-year limited warranty.

Sandisk describes the Optimus GX PRO 850P lineup as a “no-compromise” storage solution that can significantly expand the number of games stored on a PS5 at once. However, the company neglected to mention that the 8TB model now costs about as much as five PS5 consoles. Only the 1TB version is currently “cheaper” than the console itself, and even that comparison is based on the higher PS5 prices Sony introduced earlier this year.

Unlike the Xbox Series X and Series S, the PS5 uses a standard M.2 NVMe SSD for expandable storage. If Sandisk’s pricing is too steep, plenty of third-party alternatives can expand the console’s storage at a much lower cost.

Advertisement

The Optimus GX PRO 850P drives are the latest example of hardware affected by ongoing supply chain pressures in the memory industry. The retail SSD market is shrinking, while consumer electronics prices continue to climb because of rising memory costs. AI companies are buying up virtually every memory chip they can secure, even though many planned US data center projects for 2026 have yet to materialize.

Source link

Advertisement
Continue Reading

Tech

BMPS Grand Finals Day 1 Schedule & Format

Published

on

After some fierce competition over the past few weeks, 16 teams have qualified for the BMPS Grand Finals happening in Jaipur. And this time, the event is more important than ever. Not only has the prize pool been doubled to ₹4 crore, but the champion of the BMPS Grand Finals gets a direct entry to the esports World Cup happening in Paris later this year. Here’s what the schedule will look like on day one.

BMPS 2026 Grand Finals Day 1 Schedule & Timing

The live broadcast will begin at 2:45 PM IST. Fans can catch the games like on Krafton’s YouTube channel in Hindi, English, and a few other regional languages. Or, if you want to support your team live, head over to the Jaipur Convention Center. Tickets are available on the District app. Maps for today will include:

  • Match 1 — Rondo
  • Match 2 — Erangel
  • Match 3 — Erangel
  • Match 4 — Erangel
  • Match 5 — Miramar
  • Match 6 — Miramar

A total of 18 matches will be played over the course of this weekend. And the format is pretty simple. Points are awarded for each finish, and also for how long a team survives. In the end, the team with the most total points (position + finish) will be the winners.

BMPS Grand Finals Qualified Teams

  • Nebula Esports
  • Myth Official
  • iQOO Revenant XSpark
  • iQOO Reckoning Esports
  • Genesis Esports
  • Gods Reign
  • GodLike Esports
  • iQOO 8Bit
  • iQOO SouL
  • Vasista Esports
  • Divine Gaming
  • iQOO Orangutan
  • Victores Sumus
  • Gods Esports
  • Team Apex Gaming
  • iQOO Team Tamilas

Source link

Continue Reading

Tech

‘We’ve seen an increase in Blu-ray orders of 10,000%’: I spoke to a Blu-ray and vinyl manufacturer about their Blu-ray sales and it’s given me even more hope for physical media’s survival

Published

on

Physical home media has gone through a turbulent time the last few years. With the rise of streaming services, demand for physical media over the past few years has steadily declined, with people choosing the convenience of streaming over physical discs.

There’s still a dedicated fanbase of physical media collectors, though, and more recently streaming price rises and splintering means people have more interest just owning the stuff they want to watch. I’ve been writing about my hope for the resurgence of 4K Blu-ray, and physical media in general, since 2023. Now in 2026, I’m actually more hopeful than ever. It couldn’t come at a better time either, with the 20th anniversary of Blu-ray’s debut on June 20th, 2026.

Source link

Continue Reading

Tech

Congress Just Rushed Through A Disastrous Copyright Office Overhaul

Published

on

from the bad-copyright-ideas dept

In a voice vote last week, the House of Representatives passed H.R. 6028, the “Legislative Branch Agencies Clarification Act.” The legislation is presented as a technical reorganization of some government agencies, but it’s much more than that. 

H.R. 6028 would fundamentally change the U.S. Copyright Office, and not in a good way. The bill removes the Library of Congress’ current supervisory role over the Copyright Office, transfers several powers directly to the Register of Copyrights, and makes the Register a presidential appointee, confirmed by the Senate. 

These changes would make an office that’s already hugely influential in copyright and tech policy much more political. EFF first explained why that’s a terrible idea when it came up nearly a decade ago. This bill, like the older one, weakens the few public-interest checks and balances that do exist.  We hope the Senate promptly rejects this bill. 

The Copyright Office Doesn’t Need More Politics—Or More Power

The Copyright Office’s main responsibilities are administrative and advisory. It registers copyrights, maintains records, grows the Library of Congress’s collections, and provides expertise to Congress on copyright law. But over the past two decades, the Office has also become increasingly influential in copyright policy debates that affect free expression, libraries, educators, competition—and everyday internet users. Unfortunately, it has not been a neutral advocate. The office’s recent report on the role of AI severely bungled the issue of fair use, prioritizing private licensing market “solutions” over user rights. 

Advertisement

Going further back, the Copyright Office supported one of the most infamous anti-internet proposals of all time—the Stop Online Piracy Act (SOPA), a disastrous internet censorship proposal that sparked one of the largest online protests in history. The Office has repeatedly advanced positions that favored large entertainment-industry interests over the public interest.

The Office also plays a major role in the Digital Millennium Copyright Act (DMCA) Section 1201 rulemaking process, which determines when the public may lawfully bypass digital locks for activities such as security research, repair, preservation, or accessibility. EFF has used this process repeatedly to mitigate some of the worst harms of the DMCA. H.R. 6028 would move rulemaking authority over 1201 from the Librarian of Congress to the Register of Copyrights, further consolidating power within the Copyright Office itself.

The bill also makes the Register of Copyrights a presidential appointee confirmed by the Senate. Each administration will be pressured to pick nominees aligned with their own policy preferences, and the powerful copyright owning industries will invest even more heavily in lobbying to get their way, and influence the selection. This position should be focused on administrative ability and actual expertise, not lobbying and politics. 

The Copyright Office Should Stay Connected To The Library of Congress

H.R. 6028 would do more than change who appoints the Register of Copyrights. It would sever the Copyright Office from Library of Congress supervision and transfer many Librarian powers directly to the Register. 

Advertisement

The supervisory relationship exists for good reason, as the nation’s libraries have pointed out for years. The Library, while far from perfect, at least has the mission of preserving and providing access to knowledge. That should be an important public-interest counterweight in copyright debates. Congress has not explained how weakening the ties between the Library and the Copyright Office would serve the public better, or even seriously inquired about it. 

This Bill Was Rushed Through

Back in March, EFF joined Public Knowledge, the Center for Democracy and Technology, library organizations and tech groups, urging Congress not to fast-track this legislation. We told them changes to the Copyright Office will have major consequences for the “speech rights, educational opportunities, and creative freedoms of all Americans.” 

Yet Congress moved forward without any hearings on the bill, and without meaningful examination. H.R. 6028 creates a years-long separation of the Copyright Office from the Library of Congress, transfers significant legal authority, and restructures the appointment process for the nation’s top copyright official. Changes like that deserve hearings, debate, and public scrutiny. H.R. 6028 got none of that. 

The Senate Should Stop This Bill

Copyright law exists to serve the public and “promote the progress” of science and learning. The institutions that administer copyright law should do the same. 

Advertisement

H.R. 6028 would move the Copyright Office further away from that goal. Congress should be strengthening public-interest oversight of copyright policymaking, not looking for ways to concentrate more authority in a single presidentially appointed official. 

The Senate should reject H.R. 6028. The Copyright Office should serve the public—not presidential administrations, and not industry lobbyists. 

Republished from the EFF’s Deeplinks blog.

Filed Under: copyright, copyright office, copyright policy, library of congress

Advertisement

Source link

Continue Reading

Tech

Cybercriminals have been distributing malware via Steam for a year, tens of thousands affected

Published

on

WTF?! According to Kaspersky, cybercriminals have been targeting Steam users with a sustained malware campaign since 2025, distributing malicious software disguised as desktop wallpapers. The attack hijacked the accounts of gamers using Steam’s live wallpaper application Wallpaper Engine, which ranks among the platform’s most popular non-game downloads.

The attack reportedly abused Wallpaper Engine’s “Application Wallpaper” executable, which runs as a standalone Windows program and can include community-developed games, planners, calendars, system monitors, and other widgets. However, because the app allows unverified third-party code to run on users’ systems, it can be abused by threat actors to target unsuspecting users.

The researchers found that the attackers used two primary methods to distribute malware. The first involved archives containing the executable wallpaper alongside a malicious payload, typically including compromised .exe files, DLLs, or scripts. The malware was also frequently concealed within password-protected archives and executed automatically when the wallpaper was applied.

Once applied, the infected executables stole users’ account credentials, hijacked live sessions, and transmitted the stolen data to servers controlled by the attackers. The researchers discovered dozens of malicious application wallpapers on Steam Workshop, some of which were downloaded tens of thousands of times.

Advertisement

To test the attackers’ modus operandi, the researchers launched a wallpaper containing a malicious game called NTRaholic, which ran “flawlessly.” The gameplay and controls worked as advertised, raising no suspicion at first glance. However, unbeknownst to the user, the wallpaper dropped a backdoor called Synaptics.exe, part of the notorious DarkKomet malware family.

The executable that launched the game was named ._cache_GAME1.exe, but it also installed a system library called AggregatorHost.dll, which contained a malicious payload designed to steal user data and transmit it to the attackers’ command-and-control server. Once the attackers gained control of the active session, they used the compromised account to upload additional malicious wallpapers to Steam Workshop.

The campaign primarily targeted gamers in China, who accounted for 89% of the compromised downloads. Users in Germany, Canada, Russia, Singapore, Hong Kong, Vietnam, and India were also affected, though in much smaller numbers. Steam has since removed all of the malicious wallpapers, but Kaspersky is still urging users to run antivirus scans before applying wallpapers that include built-in executables.

Advertisement

Source link

Continue Reading

Tech

Your 8K Living Room On Wheels Has Arrived

Published

on

Benz’s electric “Grand Limousine” might just make minivans cool.

The concept of a living room on wheels is something of a modern cliché in the automotive world, a vision for a car so comfortable, well-appointed and ultimately luxurious that you’d be just as happy to spend hours there as you would lounging at home.

The problem is that most of those concepts, like the Cadillac InnerSpace or Mini Urbanaut, have depended on the availability of self-driving technology, something that still only exists in the limited circles of Waymo, Zoox and their ilk. We’re still years away from you or I being able to buy a car that can drive itself unsupervised, but that isn’t stopping Mercedes from releasing what could be the most compelling of the rolling living spaces.

Advertisement

It’s called the VLE, and while it requires a human behind the wheel, passengers in the second row will be treated to reclining, massaging seats, a 22-speaker Dolby Atmos sound system and a 31.3-inch ultrawide 8K display. It’s an amazing package, but is it enough to shrug off those minivan preconceptions?

Don’t call it a Caravan

Visually, the VLE fits the silhouette of countless family-friendly minivans that have been handling kid-hauling duties in the United States since the Dodge Caravan planted the seed way back in the early ’80s. Ask Mercedes, though, and they’ll tell you this is a different beast.

Advertisement

The VLE is what the company calls a Grand Limousine, and while that sounds pretentious, it’s actually perfectly appropriate. At 216 inches, the VLE is 10 inches longer than a GLS SUV. It also has an internal ceiling height of 49 inches, making it easy for me, at six feet tall, to move around.

And it is certainly at least as luxurious as your average limousine, with seating to match. The VLE can be configured with room for up to eight across three rows, but it’s best with fewer, specifically configured with the two-seat captain’s chair arrangement you see here.

Two powertrains will be available. The VLE 300 offers front-wheel drive and 272 horsepower, while the VLE 400 4MATIC steps up to a dual-motor, all-wheel drive configuration with 416 hp. Both rely on the same, sizable, 115-kilowatt-hour usable battery pack that spans the floor of the van. Mercedes says it will provide enough range to cover 435 miles on the European WLTP test cycle. On our more challenging EPA test, expect a rating somewhere around 350 miles.It’s an 800-volt system that charges at a maximum rate of 300 kilowatts. That means adding about 200 miles in 15 minutes.

Advertisement

The media experience

As much as I love to drive, the best seats in the VLE are in the second row. From there, you can recline and gaze up through the glass ceiling, or deploy the 31.3-inch ultra-wide screen and whittle away at your YouTube queue.

You can also stream Disney+ directly on the display, but sadly those are the only two video streaming partners of note. Neither Chromecast nor AirPlay streaming are supported. There is an HDMI port if you want to BYO content, but running wires across the cabin doesn’t feel particularly luxurious to me.

You can also pick from a few basic games to play on the system, and if you have two kids who can never agree on anything, you can split the TV into dual, 15-inch 4K displays. The 32:9 ratio means that after splitting, you’re effectively getting a pair of 16:9 displays, which is honestly better for viewing most content anyway. A pair of Bluetooth headsets means a pair of passengers can also get their own dedicated audio.

Advertisement

Sitting up front? There’s plenty of pixels there, too. Specifically, three dashboard-spanning units that make up Benz’s MBUX Superscreen setup. There’s a 10.25-inch gauge cluster on the left, a 14-inch main infotainment screen in the middle and a 14-inch passenger display on the right that can also stream videos and other media.

For the broader aural part of the media experience, you have 22 speakers from a Burmester 3D sound system. It handles Dolby Atmos, so you can be fully immersed in both music and more theatrical content. Interestingly, the system can also dynamically reconfigure itself based on who is sitting in the van and where.

Driving solo? The speakers automatically prioritize you. Have a full van? It’ll fill it all with sound. And it’s very capable of doing that. I cruised through a playlist of Atmos-optimized music, everything from Tay Tay to Axl Rose, and everything sounded fantastic.

Advertisement

Creature comforts

Those two chairs in the middle are heated and ventilated and can sit you upright or slide you to a reasonable degree of recline. No, they don’t go fully flat, but you probably wouldn’t like what would happen to you in an accident if they did. They’re honestly a bit narrow and awkward to get in and out of, but I could see myself spending hours back here without complaint.

I could stay productive, too, thanks to integrated USB-C power in all three rows, and a fold-out laptop tray that looks flimsy but was sturdy enough to handle my Lenovo X1 Carbon. A temperature-controlled compartment in the armrest can keep hot drinks hot and cold drinks cool, and there’s a separate chiller towards the back for more.

RGB LEDs run throughout the entire cabin, so you can give your ride whatever hue you like, and there’s even an integrated nebulizer, making for a bespoke scent, too.

Advertisement

Even the third row is comfortable. The middle seats swing themselves forward and out of the way, so entry is easy, and I had ample headroom back there.And then there’s the driver’s seat, which is also comfortable and accommodating should you have to drive this machine yourself.

Behind the wheel

With up to 416 horsepower delivered through all four wheels, the VLE can be properly quick when punched up to sport mode. It also rides on adaptive air suspension, which can firm up and make the VLE feel that much more responsive in the corners.

Advertisement

But in my time behind the wheel, it never felt comfortable when driven aggressively. I enjoyed piloting the VLE much more when I dialed it down to Comfort, took a deep breath and just cruised along my route.

In this mode, the air suspension is supple, and the throttle relaxed enough that you can ease your way forward without disturbing anyone in the rear seats. The steering has a slow ratio as well, but don’t let that make you think this isn’t a nimble van. With seven degrees of steering from the rear wheels, the VLE can turn its impressive bulk in a far tighter circle than you might expect.

Drivers get to take advantage of a suite of active safety systems as well, including active lane-keep assistance on the highway and a comprehensive automatic parking system that swings this big beast into tiny parking spots. It’ll even automatically back itself out of a tight situation should you make a wrong turn down a narrow alley.

Advertisement

Wrap-up

About the only thing the VLE is missing is full autonomy. It’d be awfully nice to get a machine like this and let it take you to work while you got in a few rounds of Fortnite on that 8K display. Alas, we’re not there yet, but I have a feeling most people who experience the VLE will do so from the second row. This would be an epic airport and event shuttle, but it’s going to be a little while before it enters service.

The VLE isn’t due to hit the American market until late 2027, and while the price isn’t set, Andreas Zygan, Head of Development at Mercedes-Benz Vans, told me this: “It will not be a cheap one, for sure.”

Advertisement

Source link

Continue Reading

Trending

Copyright © 2025