The Xiaomi 17T series is officially set to launch globally on May 28. Through a post on X, the company hinted at an upcoming launch with the tagline “The T is coming.” While Xiaomi has not shared any official details yet, reports suggest the teaser belongs to the Xiaomi 17T smartphone.

According to recent leaks, Xiaomi may not launch the Xiaomi 17T Pro in India. Instead, the company is expected to introduce only the standard Xiaomi 17T in the country. This launch is notable because Xiaomi skipped the Indian release of the 12T, 13T, and 14T series smartphones. As a result, the return of the T-series could give Indian users access to Xiaomi’s premium features once again.

Expected Design and Display Features

Leaks suggest that the Xiaomi 17T and Xiaomi 17T Pro could look nearly identical from the outside. The phones may feature flat rear panels paired with square camera islands, giving them a clean and premium appearance. Xiaomi is also expected to place the power and volume controls on the right side of the devices. The Xiaomi 17T Pro could feature a 6.83-inch display with up to 144Hz refresh rate support, whereas the standard model may offer a 6.59-inch 1.5K AMOLED panel.

Furthermore, Xiaomi may feature the Xiaomi 17T with the MediaTek Dimensity 8500-Ultra chipset, or the Dimensity 9500 processor. Xiaomi may also include large batteries in both smartphones. The standard model could pack a 6,500mAh battery. Meanwhile, the Pro variant may feature a 7,000mAh battery.

Leica-Tuned Triple Camera Setup

The Xiaomi 17T series will focus heavily on its camera capabilities. The company has announced Leica cameras for the upcoming series, while teaser images have shown a square-shaped rear camera module design. According to reports, this series may include a triple-rear camera system consisting of a 50MP main camera, a telephoto lens, and a 12MP ultrawide lens.

Xiaomi 17T Expected Price in India

Recent leaks suggest that Xiaomi may introduce the Xiaomi 17T as a premium smartphone in India. The starting variant of the phone with 12GB RAM and 256GB storage is expected to cost Rs 74,999, while the variant with 512GB storage might launch at Rs 84,999. Such a pricing scheme would allow the smartphone to compete with other high-end flagships from OnePlus, Vivo X series, and iQOO.

Financial crime investigators in the Netherlands (FIOD) arrested two men and seized 800 servers linked to a web hosting company that enabled cyberattacks, interference operations, and disinformation campaigns.

FIOD arrested a 57-year-old suspect, who was the company director, and a 39-year-old who headed a separate firm that provided internet connectivity.

According to the authorities, the suspects indirectly provided economic resources to Russian and Belarusian entities sanctioned by the European Union (EU).

The investigation focuses on the activities of web hosting firm Stark Industries, founded on February 10, 2022, shortly before Russia’s invasion of Ukraine.

“The [Dutch] web hosting company, according to the research team, provided support to actions by the Russian Federation that undermine democracy and security, including through information manipulation and disruption of public and economic systems,” FIOD says.

The EU added Stark Industries to the list of sanctioned entities last year on May 20. Following this restriction, the web hosting infrastructure was transferred to a newly created Dutch company that investigators believe acted as a front for the sanctioned entities.

In the recent action, FIOD conducted multiple raids in data centers in Dronten and Schiphol-Rijk, as well as searches in Enschede and Almere, where they seized 800 servers, laptops, phones, and administrative records.

According to a report from the De Volkskrant publication, the name of this Dutch entity is WorkTitans B.V. and provides hosting services under the brand THE.Hosting.

The same outlet alleges that Danish authorities and infrastructure providers linked WorkTitans to attacks by the pro-Russian hacktivist group NoName057(16), which has previously targeted key organizations with distributed denial-of-service (DDoS) attacks.

Mirhosting, based in Almere, operated physical servers, provided colocation, and supplied high-capacity connectivity to major internet exchanges in Amsterdam and Frankfurt, acting as the transport layer through which Stark’s traffic entered Europe to reach the WorkTitans infrastructure.

It’s worth noting that WorkTitans did not respond to de Volkskrant’s requests for a statement, while Mirhosting denied knowingly supporting illegal operations, claiming they quickly intervened upon receipt of abuse complaints.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.

This guide covers the 6 surfaces you actually need to validate.

Download Now

Almost a year since its announcement, and nine months after its planned launch, the Trump phone has finally arrived — albeit looking different to the one originally unveiled.

The Trump phone, officially known as the Trump Mobile T1, arrived with us this week. CNET placed a preorder back with a $100 deposit back in June 2025, and it’s worth noting that Trump Mobile expedited our shipment so that we could review the T1. (It’s typical for a phone company to set aside review units for journalists, but Trump Mobile did not do this.)

Trump Mobile launched in June 2025 with a $47.45-a-month mobile phone plan, and it announced that the T1 would be made in the US and launch in August 2025. But when it became obvious that domestic large-scale smartphone manufacturing would not be possible, Trump Mobile dropped the “made in the US” claim and delayed the launch. 

Last month, a redesigned Trump Mobile website finally showcased a new-looking T1 phone, its third redesign. It followed Trump Mobile executives showing off a handset they said was a near-production version of the T1 phone to The Verge in early February. 

The Android phone was delayed due to production issues, the company said last week, when it confirmed the handset would begin shipping to customers.

“The technology business is more difficult than some may realize, as parts must be tested for quality assurances,” Trump Mobile CEO Pat O’Brien said in a statement to CNET last week. “We have experienced delays during a variety of steps in getting the T1 to completion, but those delays were worth it in our minds as we are delivering an amazing product.”

This long weekend, I’ll be testing the phone in a real-world environment, using it as my main phone during the Memorial Day long weekend. I’ll live blog my experiences as I go, updating with any anecdotes or tests I run.

Compact action cameras keep getting better at fitting into everyday life without slowing anyone down. This GO Ultra Creator Bundle from Insta360 delivers a complete setup built around a camera so small it feels like an afterthought until the footage starts rolling in. At the current price of about $425 (was $500), the package bundles the core camera with enough mounts and extras to handle vlogging, sports, or simple point-of-view recording straight out of the box.

When you open the box, you’ll discover the Action Pod, a Magnet Pendant, a Quick Release Safety Cord, a Magnetic Easy Clip, a Quick Release Mount, the Mini 2-in-1 Tripod 2.0, and the Pivot Stand, all ready to use. Save the microSD cards for now, as the rest of the gear is ready to use right out of the box. Clip the camera to your hat brim or shirt collar with the magnetic gubbins and you’ll nearly forget it’s there while it shoots great smooth footage.

Sale

Insta360 GO Ultra Creator Bundle – Small 4K Vlogging Camera, Hands-Free, POV Cam, 1/1.28″ Sensor, 53g…

• In The Box: 1x Standalone Camera, 1x Action Pod, 1x Magnet Pendant, 1x Quick Release Safety Cord, 1x Magnetic Easy Clip, 1x Mini 2-in-1 Tripod 2.0, 1x…
• Hands-Free POV & Wearable – Magnetic mounting lets you clip the camera to a cap or wear it with the Magnet Pendant, freeing up your hands for a…
• Lightweight & Portable – 53g and the size of a watch, built for conveniently getting 4K footage from any angle. Great for cycling, running, diving…

The camera is approximately the size of a small watch, but it has a 1/1.28-inch sensor capable of recording 4K video at 60 frames per second and sharp 50 megapixel still images. Then there’s the 156-degree field of view, which is a good angle without needing to step back to see everything. Plus, there’s some clever stabilization technology called FlowState that keeps the horizon from wobbling and movements from appearing jerky even when you’re running or riding a bike. Low-light situations are also much easier to manage, thanks to the PureVideo mode, which captures more information than previous models.

Battery life is actually much better than expected for a little camera of this size. The camera alone lasts about 70 minutes, and the Action Pod extends it to about 200. Recharge is very speedy; going from zero to 80 percent in 12 minutes should be plenty to get you through a great workout. Of course, the pod includes a flip screen, allowing you to frame shots while sitting on a tripod or mount.

The possibilities for mounting this camera are near infinite. You can hang the Magnet Pendant around your neck for some good chest-level POV footage, clip the Easy Clip and Quick Release Mount to helmets, bags, or automobiles, or use the Mini Tripod and Pivot Stand to make it into a decent desk or vlogging platform. Everything fits together remarkably simply and stays there even while you’re active.

Whatever you choose, the audio will sound clear, and the program can even perform some basic edits for you, such as removing highlights, adding simple transitions, and selecting music to fit. FreeFrame mode allows you to crop and reframe images as you see fit, or into whatever form you need for social media. The camera is waterproof up to 33 feet and can go deeper with one of the available cases, allowing you to film in the rain or shallow water whenever you want.

On May 19, 633 malicious npm package versions passed Sigstore provenance verification. They were cleared by the system because the attacker had generated valid signing certificates from a compromised maintainer account.

Sigstore worked exactly as designed: it verified the package was built in a CI environment, confirmed a valid certificate was issued, and recorded everything in the transparency log. What it cannot do is determine whether the person holding the credentials authorized the publish — and that gap turned the last automated trust signal in npm into camouflage.

One day earlier, StepSecurity documented an attack on the Nx Console VS Code extension, a widely used developer tool with more than 2.2 million lifetime installs. Version 18.95.0 was published using stolen credentials on May 18 and stayed live for under 40 minutes — but Nx internal telemetry showed approximately 6,000 activations during that window, most through auto-update, compared to just 28 official downloads. The payload harvested Claude Code configuration files, AWS keys, GitHub tokens, npm tokens, 1Password vault contents, and Kubernetes service account tokens.

The Mini Shai-Hulud campaign, attributed by multiple researchers to a financially motivated threat actor identified as TeamPCP, hit the npm registry at 01:39 UTC on May 19. Endor Labs detected the initial wave when two dormant packages, jest-canvas-mock and size-sensor, published new versions containing an obfuscated 498KB Bun script — neither had been updated in over three years, making a sudden version with raw GitHub commit hash dependencies a detection signal, but only if the tooling is watching.

By 02:06 UTC, the worm had propagated across the @antv data visualization ecosystem and dozens of unscoped packages, including echarts-for-react (~1.1 million weekly downloads). Socket raised the total to 639 compromised versions across 323 unique packages in this wave. Across the full campaign lifecycle, Socket has tracked 1,055 malicious versions across 502 packages spanning npm, PyPI, and Composer.

StepSecurity confirmed the payload contained full Sigstore integration. The attacker didn’t just steal credentials; they could sign and publish downstream npm packages that carried valid provenance attestations.

These two incidents aren’t isolated. Research teams at Endor Labs, Socket, StepSecurity, Adversa AI, Johns Hopkins, Microsoft MSRC, and LayerX independently proved that the developer tool verification model is broken, and no vendor framework audits all of the attack surfaces that failed.

Seven attack surfaces failed in the 48 hours between May 18 and May 19 — npm provenance forgery, VS Code extension credential theft, MCP server auto-execution, CI/CD agent prompt injection, agent framework code execution, IDE credential storage exposure, and shadow AI data exposure — and the audit grid below maps each.

The verification model is broken across all four major AI coding CLIs

Adversa AI disclosed TrustFall on May 7, demonstrating that Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI all auto-execute project-defined MCP servers the moment a developer accepts a folder trust prompt. All four default to “Yes” or “Trust.” One keypress spawns an unsandboxed process with the developer’s full privileges.

The MCP server runs with enough privilege to read stored secrets and source code from other projects. On CI runners using Claude Code’s GitHub Action in headless mode, the trust dialog never renders. The attack executes with zero human interaction.

Johns Hopkins researchers Aonan Guan, Zhengyu Liu, and Gavin Zhong published “Comment and Control,” proving that a malicious instruction in a GitHub pull request title caused Claude Code Security Review to post its own API key as a comment. The same attack worked on Google’s Gemini CLI Action and GitHub’s Copilot Agent. Anthropic rated the vulnerability CVSS 9.4 Critical through its HackerOne program.

Microsoft MSRC disclosed two critical Semantic Kernel vulnerabilities on May 7. One routes attacker-controlled vector store fields into a Python eval() call; the other exposes a host-side file download method as a callable kernel function — meaning one poisoned document in a vector store launches a process on the host.

LayerX security researchers separately demonstrated that Cursor stores API keys and session tokens in unprotected storage, meaning any browser extension can access developer credentials without elevated permissions.

The threat actors hunting these credentials doubled their operational tempo

The Verizon 2026 Data Breach Investigations Report, released May 19, found that 67% of employees access AI services from non-corporate accounts on corporate devices. Shadow AI is now the third most common non-malicious insider action in DLP datasets. Source code leads all data types submitted to unauthorized AI platforms — the same asset class the npm worm campaign targeted.

The CrowdStrike 2026 Financial Services Threat Landscape Report, released May 14, documents the adversaries actively hunting the credential types these attacks harvest.

STARDUST CHOLLIMA tripled its operational tempo against financial entities in Q4 2025. CrowdStrike documented the group using AI-generated recruiter personas on LinkedIn and Telegram, sending malicious coding challenges that looked like technical assessments, and running fake video calls with synthetic environments. The targets are GitHub PATs, npm tokens, AWS keys, and CI/CD secrets. The shadow AI exposure in grid row 7 is the door they walk through.

Developer Tool Stolen-Identity Audit Grid

No vendor framework currently scopes all seven surfaces. This grid maps each one to the research that exposed it, what your stack cannot see, and the audit action to take before the next vendor renewal.

Security director action plan

Security directors may want to run this grid against current vendor contracts before Q2 renewals close — asking each vendor which of the seven surfaces their product covers, and treating the non-answers as the gap map.

Any credential accessible from a developer machine or CI runner that installed affected npm packages between 01:39 and 02:18 UTC on May 19 should be considered compromised. That includes GitHub PATs, npm tokens, AWS access keys, Kubernetes service account tokens, HashiCorp Vault tokens, SSH keys, and 1Password vault contents.

AI coding agent integrations running in CI/CD pipelines with pull_request_target workflows deserve a close look. Each one is a prompt injection surface that processes PR comments as agent instructions.

Procurement teams evaluating AI coding tools should consider adding a stolen-identity resistance dimension to vendor assessments. The question worth asking: can the vendor demonstrate how their tool distinguishes a legitimate maintainer publish from an attacker using compromised credentials? If they cannot, the tool is not a verification layer.

The developer tool supply chain has the same problem IAM had a decade ago: credentials prove who you claim to be, not who you are. IAM got a 10-year head start on compensating controls before nation-state groups turned credential theft into an industrial operation. The AI coding tool ecosystem is starting that clock now.

MOON by Simaudio has expanded its Compass Collection with the new MOON 491 Network Player/Preamplifier and MOON 461 Power Amplifier, a Canadian-made streaming and amplification pairing built for listeners who want one serious high-end system without turning the rack into a wiring nightmare.

Designed and handcrafted just outside Montréal, the 491 combines a network player, preamplifier, DAC, MM/MC phono stage, and headphone amplifier in one chassis, while the 461 delivers 150 watts per channel and borrows MOON’s distortion-cancelling amplifier architecture from the flagship North Collection.

The timing feels right. MOON has built a reputation for delivering strong performance for the money in the high-end category, and this new pairing arrives with the same kind of momentum currently rattling Bell Centre glass during the Canadiens’ unexpected 2026 Stanley Cup Playoffs run.

“As a pairing, the 491 and 461 represent a complete expression of the Compass Collection,” said Etienne Gautier, CCO of Simaudio. “Together they deliver outstanding musical performance and system flexibility, while also forming a visually striking statement that will look exceptional in any environment, from contemporary interiors to traditional spaces. The MOON 491 and MOON 461 are the True Direction.”

That “complete expression” part matters. The 491 is not just another streamer with a nice faceplate. With MiND 2 streaming, Roon Ready support, AirPlay, Bluetooth, Qobuz Connect, TIDAL Connect, Spotify Connect, analog and digital inputs, adjustable MM/MC phono support, headphone output, and MOON’s Hybrid Power supply, it is clearly designed to be the hub for $6,500 USD.

Add the 461 power amplifier, with MOON Hybrid Power and MDCA technology, and the Compass Collection starts to look less like a lifestyle stack and more like a proper no-nonsense two-box high-end system with Canadian muscle. No poutine theatrics required. This is more like a smoked meat sandwich from Lester’s with fries and a hearty karnatzel on the side: straightforward, satisfying, and built to do the job without asking for applause.

MOON 491 Network Player/Preamplifier: One Box to Run Streaming, Vinyl, Digital and Headphones

The MOON 491 Network Player/Preamplifier is designed to be the control center of a serious two-channel system. It combines a network player, preamplifier, DAC, MM/MC phono stage, and headphone amplifier in one chassis, which means it can manage streaming, digital sources, analog components, turntables, headphones, and system volume without requiring five separate boxes and a weekend with cable labels. 

At the center of the 491 is MOON’s proprietary MiND 2 streaming platform. It works as a UPnP renderer, a Roon Ready endpoint, and supports AirPlay and Bluetooth. The MOON MiND Controller app for iOS and Android provides access to Qobuz, TIDAL, Deezer, and Spotify, while direct platform support includes Qobuz Connect, TIDAL Connect, and Spotify Connect. That gives users multiple ways to stream without being forced into one control path. Having used MiND 2 at AXPONA 2026, I can attest to its relatively easy learning curve.

The 491 also takes vinyl seriously. Its built-in phono stage supports both MM and MC cartridges, with adjustments for loading, capacitance, gain, and equalization through the on-screen menu.

Analog connectivity includes one RCA line-level input, one balanced XLR input, and one phono input. Outputs include fixed and variable RCA, variable balanced XLR, and a 1/4 inch headphone jack. The large color display shows volume, album art, and track information, while control is handled through the app, front-panel buttons, and the aluminum CRM-4 remote. 

MOON’s Hybrid Power supply is also part of the package, blending linear and switch-mode power supply technologies to provide stable, low-noise DC power. According to MOON, the design operates beyond the audio band to avoid contaminating sensitive audio circuits, helping lower the noise floor and improve dynamic range. 

MOON 491 Network Player/Preamplifier Specifications:

• Product type: Network player, preamplifier, DAC, phono stage, headphone amplifier
• Streaming platform: MOON MiND 2
• Network playback: UPnP renderer
• Roon support: Roon Ready
• Wireless support: AirPlay, Bluetooth
• App control: MOON MiND Controller app for iOS and Android
• Streaming services via app: Qobuz, TIDAL, Deezer, Spotify
• Connect support: Qobuz Connect, TIDAL Connect, Spotify Connect
• Phono stage: MM and MC cartridge support
• Phono adjustments: Loading, capacitance, gain, equalization
• Analog inputs: 1 RCA line-level input, 1 balanced XLR input, 1 phono input
• Outputs: Fixed RCA, variable RCA, variable balanced XLR, 1/4 inch headphone output
• Digital inputs: HDMI ARC, S/PDIF, Toslink, AES-EBU
• Ethernet: 2 inputs
• Input sensitivity: 0.3 V to 5 V
• Input impedance: 22 kΩ
• Gain: 10 dB
• Frequency response: 10 Hz to 200 kHz, +0.5/-3.0 dB
• Total harmonic distortion + noise: 0.0004%
• Intermodulation distortion: 0.0004%
• Dimensions: 16.9 x 3.5 x 14.1 inches / 42.9 x 8.7 x 35.7 cm
• Shipping weight: 20 lbs / 9 kg
• Finish: Black chassis with bead-blasted aluminum cheeks in black or silver
• Remote: CRM-4 aluminum remote control
• Display: Large color display with volume, album art, and playback information

MOON 461 Power Amplifier: Serious Power for the Compass Collection

The MOON 461 Power Amplifier is the dedicated power amplifier in Simaudio’s Compass Collection. It is designed to take the signal from a preamplifier and drive loudspeakers with high output, low distortion, and stable performance across different speaker loads. It is the most powerful model in the Compass Collection, rated at 150 watts per channel into 8 ohms, 300 watts per channel into 4 ohms, and 450 watts in mono into 8 ohms. 

At the center of the 461 is MOON’s proprietary MDCA, or MOON Distortion-Cancelling Amplifier architecture, which was first developed for the flagship North Collection. The design is intended to reduce distortion and improve linearity, helping the amplifier preserve clarity, accuracy, and control as output demands increase. 

The 461 also uses two MOON Hybrid Power supply modules, with one dedicated to each channel. That dual-mono layout is designed to improve channel separation, reduce crosstalk, and deliver stronger current into lower-impedance loudspeakers. A Stereo / Bridged Mono / Bi-Amping Mono mode switch adds useful system flexibility for listeners who may want to run a single amplifier now and expand later. 

Visually, the 461 follows the Compass Collection design with a black chassis, bead-blasted aluminum cheeks in black or silver, and a clean front panel. It is not flashy, which is probably the point. This is a power amplifier, not a Cirque du Soleil audition. Think more Montreal Metro in February: not glamorous, but it moves a lot of current and usually gets you where you need to go.

MOON 461 Power Amplifier Specifications:

• Product type: Analog stereo power amplifier
• Collection: MOON Compass Collection
• Amplifier architecture: MOON Distortion-Cancelling Amplifier architecture, or MDCA
• Power supply: Two proprietary MOON Hybrid Power supply modules
• Power supply layout: Dual-mono implementation, with one MHP module dedicated to each channel
• Operating modes: Stereo, Bridged Mono, Bi-Amping Mono
• Output power, stereo 8 ohms: 150 W
• Output power, stereo 4 ohms: 300 W
• Output power, mono 8 ohms: 450 W
• Input sensitivity: 1 V
• Input impedance: 22 kΩ
• Gain: 31 dB
• Frequency response: 5 Hz to 100 kHz, +0/-3 dB
• Total harmonic distortion + noise at 1 W: 0.005%
• Total harmonic distortion + noise at 150 W: 0.003%
• Damping factor: 425
• Power consumption, idle: 35 W
• Power consumption, full power standby: 34 W
• Power consumption, low power standby: 1 W
• Dimensions: 16.9 x 3.5 x 14.5 inches / 42.9 x 8.7 x 36.8 cm
• Shipping weight: 24 lbs / 11 kg
• Finish: Black chassis with bead-blasted aluminum cheeks in black or silver

The Bottom Line

The MOON 491 Network Player/Preamplifier and MOON 461 Power Amplifier make the most sense as a clean, high-performance two-box system for listeners who want modern streaming, vinyl playback, DAC functionality, headphone listening, and serious loudspeaker control without building a rack that looks like Bell Centre after triple overtime.

The 461 is the matching muscle. With 150 watts per channel into 8 ohms, 300 watts into 4 ohms, and 450 watts in mono, it gives the Compass Collection real amplifier authority. MOON’s MDCA amplifier architecture, borrowed from the flagship North Collection, and dual MOON Hybrid Power modules add some meaningful trickle-down engineering. The stereo, bridged mono, and bi-amping modes also make it more flexible as a long-term system anchor.

What is missing? The 491 is not a full integrated amplifier, so passive loudspeakers still require a power amplifier like the 461. Otherwise, the feature set is quite complete: HDMI ARC, four digital inputs, two Ethernet jacks, MiND 2 streaming, Roon Ready support, Qobuz Connect, TIDAL Connect, Spotify Connect, MM/MC phono, DAC, headphone output, and preamplifier functionality.

The only obvious omission from the supplied information is any confirmation of higher-resolution Bluetooth codec support such as LDAC, aptX HD, or aptX Lossless.

Pricing & Availability

This pairing is not entry-level, but it is very MOON: designed and handcrafted in Canada, backed by a 10-year warranty, and built for listeners who want long-term performance rather than feature churn.

• MOON 491 – $6,500 USD / C$8,800 CAD / €6,800 EUR
• MOON 461 – $5,000 USD / C$6,800 CAD / €5,200 EUR

For more information: simaudio.com

Related Reading: