GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact.

Specifically, Dependabot comes with a default three-day cooldown setting, while PyPI will reject new files uploaded to releases older than 14 days.

The measure comes after the two development ecosystems experienced multiple high-profile attacks over the past year. Some notable examples include the ‘chalk’ and ‘debug’ attacks, the “s1ngularity” operation, the Shai-Hulud campaign, and the GhostAction supply-chain attack.

GitHub announced last month changes to tackle supply chain threats, and the hardening process progresses with the new measures.

GitHub adds Dependabot cooldown

Dependabot is GitHub’s dependency-update service that reads files containing information about new package versions and opens update pull requests to notify software maintainers.

The tool now delays the package update process for 72 hours to reduce the risk of automatically adopting newly published malicious packages.

In many recent cases, malicious npm packages were detected and flagged by security tools within minutes of being published.

However, quick detection alone does not remove the threat, as repository maintainers and vendors must still take action to remove the packages, leaving a window during which developers and projects may download and incorporate the malicious code.

While GitHub explained that the period of three days was chosen as a balanced point between avoiding risky releases while keeping up with the latest upgrades, it noted that users still have the option to configure a shorter or longer delay through Dependabot’s ‘cooldown’ configuration option.

GitHub highlighted Dependabot’s cooldown limitations against longer-term compromise, recommending the use of lockfiles for dependency pinning, restricted-scope tokens, and disabling unnecessary installation scripts in CI.

PyPI blocks release poisoning with 14-day cutoff

PyPI announced that it now blocks maintainers from adding new files to a package release after 14 days have passed since its publication.

The measure is intended to prevent attackers who compromise publishing tokens or workflows from poisoning old, trusted releases.

The platform found that only a very small percentage of projects legitimately uploaded more than two weeks after publishing a release.

It should be noted that no known past attacks on PyPI have been confirmed to use the said release poisoning technique that this new measure blocks, but the platform is acting preventatively in this case to block a dangerous possibility.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Emma Woodhouse discusses her role in manufacturing and supply chain systems, the skills that keep it all moving and how pets have no regard for work deadlines.

Accenture’s Emma Woodhouse, a manufacturing and supply chain systems manager for manufacturing execution systems (MES), specialises in designing and implementing electronic batch records that help improve efficiency, quality and compliance for global pharmaceutical clients, bringing their production processes into the digital age. 

“No two days are the same in my role as a manufacturing execution systems designer, which is one of the things I enjoy most about the job,” she told SiliconRepublic.com. 

“One thing I’ve learned is that no matter how carefully you plan your day, there is always potential for a new challenge to appear when you least expect it. That’s part of what keeps the role interesting.

“Managing workload requires balancing multiple tasks and deadlines across different projects. Technical documentation, testing activities and troubleshooting are also important parts of the role, helping to ensure that solutions are delivered to a high standard and also perform as expected.”

What types of projects do you work on? 

The nature of MES projects can vary based on the specific requirements of the client. Some projects may be on a large global scale where a client is looking to roll out MES implementation across multiple or all of their manufacturing sites around the world. This presents an opportunity to pursue a standardised approach in terms of the design of the electronic batch records.

These projects challenge me to think creatively about how processes can be simplified, standardised and made more efficient while still meeting the needs of different manufacturing sites. I enjoy working through complex requirements and finding solutions that can be reused and scaled across a wider program.

Alternatively, a project may be on a smaller scale working with one manufacturing site to implement or improve master batch records, often due to a new product introduction, new equipment introduction or some other driving force for process improvement. These types of projects often allow project teams to form a tight-knit group which aids collaboration.

Some of the most rewarding projects have been those where I have been involved from the initial design stages right through to testing and deployment. Seeing a solution go from a concept on paper to a system that is actively supporting manufacturing operations is incredibly satisfying. 

What skills do you use on a daily basis? 

My role draws on a combination of technical, analytical and interpersonal skills every day.

Problem-solving and attention to detail are particularly important, as I am often translating complex manufacturing processes into electronic workflows while ensuring compliance with strict quality and regulatory requirements. I also use project management and organisational skills to balance multiple priorities, meet deadlines and co-ordinate activities across different workstreams.

While the technical aspects of MES are important, a significant part of the job involves working with people from different backgrounds and areas of expertise. I regularly collaborate with manufacturing operators, engineers, quality specialists, validation teams and project managers, all of whom may have different perspectives and priorities. Being able to listen, ask the right questions, and clearly explain technical concepts has become just as important as the technical knowledge itself.

Manufacturing environments are constantly evolving and projects can change direction as new requirements emerge. Being able to learn quickly, think creatively and adjust to new challenges has been invaluable.

What are the hardest parts of your working day and how do you navigate them? 

One of the most challenging aspects of my role is balancing the need for focused, uninterrupted work with the demands of collaboration.

Designing and configuring MES solutions often requires significant concentration, yet projects also involve regular meetings and stakeholder interactions across multiple functions, all of which are essential to delivering the right solution.

To navigate this, I prioritise my workload carefully and try to structure my day around key objectives. I set aside dedicated time for tasks that require focus, while also ensuring I remain available for collaboration and support when needed. Having a clear understanding of priorities helps me stay productive and prevents smaller tasks from distracting me from the most important deliverables.

Maintaining a healthy work-life balance is also important.

Working in a fast-paced industry means there can always be another task to tackle, but I’ve learned the value of stepping away from work and recharging. For me, spending time on my own hobbies such as DIY, coding and music production is a great way to switch off after a busy day.

My three dogs are also very effective at enforcing work-life balance. They have little interest in project deadlines, but they’re extremely committed to their walk and fetch schedules.

Taking that time to disconnect helps me return to work with a fresh perspective and ultimately helps me be more effective in my role.

How has this role changed as the sector has grown and evolved?

When I explain my job to friends and family, many are surprised by how digital modern pharmaceutical manufacturing has become. The reality is that technology now plays a central role in ensuring medicines are produced safely, efficiently and consistently.

Historically, many manufacturing processes relied heavily on paper-based documentation and manual data entry. Today, there is a much greater focus on digital systems, automation, data integrity and real-time access to information, which has expanded both the scope and impact of the role.

As technology has advanced, MES designers have become more involved in designing connected, data-driven solutions that support efficiency, quality, and compliance across the manufacturing life cycle. There is also a growing emphasis on standardisation, scalability and leveraging data to drive continuous improvement. This means the role now requires not only technical expertise but also a strong understanding of business processes, regulatory expectations and how different digital systems interact within a manufacturing environment.

One of the most exciting developments has been the increasing use of digital technologies to simplify complex processes and reduce the administrative burden on manufacturing teams.

As the sector continues to evolve, we’re seeing growing interest in areas such as AI-assisted workflows, advanced analytics and greater systems integration across manufacturing operations. These developments have the potential to further improve efficiency, support faster decision-making and help teams extract more value from manufacturing data.

What do you enjoy most about the job?

What I enjoy most about my role is the opportunity to solve complex problems and see the real-world impact of the solutions I help create.

I enjoy solving puzzles, and that’s often what the role feels like, except the puzzles involve manufacturing processes, technology, regulations, and occasionally several competing opinions in the same meeting. I enjoy the variety that comes with the role and the fact that there is always something new to learn.

Equally important are the people I work with. MES projects bring together experts from many different disciplines, and I enjoy the collaborative nature of the role. Working with colleagues to overcome challenges, share ideas and deliver successful outcomes makes the job both enjoyable and fulfilling. 

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Phone screens are better than they’ve ever been—bigger, sharper, and brighter—but they don’t always offer the best displays for extended reading sessions. If you’ve got a lot of text to get through, you might find yourself turning to a Kindle instead, or even a good old-fashioned physical book.

There are ways to tweak the screen configuration on your iPhone or Android phone, however, to make it more suitable for reading. These changes will reduce the chance of causing you eye strain while minimizing clutter to create a more pleasant reading experience. You won’t transform your phone into something that rivals an e-reader or the printed page, but you can certainly get closer to it.

Tweak the Display Settings

You’ve actually got more control over the font sizes, styles, and colors used by your phone than you might have realized—you can make text easier to read and create a more Kindle-like experience with just a few taps via the main Settings panel.

If you’re on Android, the menu labels will vary from model to model, but on Pixel phones head to Display size and text. The next screen lets you adjust the size of the default font and other on-screen elements to make text bolder, and there’s also a Dark theme option that you might find reduces eye strain.

Adjusting the font size on Android.Courtesy of David Nield

Over on iOS, open up Display & Brightness from Settings: Here you’ll find a Text Size slider you can adjust, as well as a Bold Text toggle switch. As on Android, there’s a dark mode option here via the theme selector at the top of the screen—select Dark to dim the colors all across the iOS interface.

Both Android and iOS also have a night reading mode that reduces the blue light emitted from your phone and makes the whole display warmer—which should make for a more pleasant reading experience. On Android Pixel phones, choose Display and touch > Night Light from Settings, and on iOS pick Display & Brightness > Night Shift. In both cases you can enable the feature manually or via a schedule.

Use Your Browser’s Reading Mode

Much of the reading you’re going to be doing on your phone will be through its web browser, and most modern mobile browsers come with a dedicated reading mode you can use. These modes will reduce onscreen clutter, simplify the color scheme, and bring the main article text to the fore.

If you’re using Google Chrome as your default browser on Android, tap the three dots (top right), then Show Reading mode to switch views for the article you’re currently reading. Swipe up on the panel at the bottom of the screen to change the font and color options. Tap the reading mode icon (just to the right of the address bar) to return to the normal browser view.

After OpenAI recently admitted that one of its models had breached the systems of AI platform Hugging Face, Hugging Face’s CEO Clem Delangue posted on X that he was flying to San Francisco to have “a little chat with that ‘rogue agent.’”

Then, in a follow-up post on Saturday, Delangue outlined what he’d asked for from OpenAI. He said he called for “radical transparency,” asking OpenAI to “release the traces from the ‘rogue’ agents so the entire research community can study what happened.”

And he also wants “more capabilities for defenders,” calling for OpenAI to commit $100 million worth of computing power “to help the Hugging Face community build powerful cyber defenses with the best open and closed models.”

Delangue added, “The first autonomous agent cyberattack is an unprecedented event. It deserves an unprecedented response!”

Despite the autonomous nature of the attack, cybersecurity experts suggested that it could also be blamed on human error — namely, OpenAI’s apparent failure to properly configure what should have been a fully isolated testing environment.

Security

(Security) hole-ier than thou

Click To Pray, a prayer app endorsed by the Pope with hundreds of thousands of users worldwide, has leaked people’s names and email addresses for months – or longer – according to an ethical hacker who said she found and reported the security vulnerability six months ago to no avail. This app needs to take a vow of silence when it comes to your personal information.

The app, available in seven languages and on iOS, Android, and clicktopray.org, is the official app of the Pope’s Worldwide Prayer Network. It connects users across the globe to pray for the Holy Father’s intentions, and as of July 2026, it has 719,517 registered accounts.

It’s also very leaky, according to security sleuth BobDaHacker, who says she spotted and disclosed the vulnerability to the Pope’s Worldwide Prayer Network on January 3.

“The vulnerability is still live,” the hacker said in a Friday blog. “Nobody has ever responded. I guess my email wasn’t in their prayers.”

The Reg readers likely remember BobDaHacker for her previous research exposing a free-food flaw in McDonald’s ordering system and open controls on Chinese robot manufacturer Pudu Robotics.

This latest security hole stems from an Insecure Direct Object Reference (IDOR) bug in the prayer app. This is a very common and easy-to-exploit type of flaw that occurs when a website or an app blindly accepts user-provided input to view or modify resources without checking to see if the user is actually authorized to retrieve the data.

“You ask for your own data, the server gives it to you,” BobDaHacker explains. “You ask for someone else’s data, the server gives you that too. Thou shalt not authorize, apparently.”

When you sign up for a Click To Pray account, the app assigns you a sequential numeric user ID. As BobDaHacker uncovered, the API endpoint GET https://api[.]clicktopray.org/user/users/{id} will return user data for any account – not just your own account – so long as you supply a valid, five-digit user ID. 

It doesn’t perform any authorization check or ownership validation. “Just increment the number and get someone else’s data,” she wrote.

This data includes users’ email addresses, first and last names, country, dates of birth, and whether the account has been deleted, and the API exposes all 719,517 accounts on the prayer site. “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform,” the hacker explained. “One GET request per user. for i in range(1, 719518): scrape(). That’s it. That’s the exploit.”

As BobDaHacker points out, many of these users are likely older individuals, not all that tech savvy, and very trusting of anything Vatican related, making these exposed accounts a “phishing goldmine.”

“Imagine getting an email that says ‘The Holy Father requests your urgent attention’ with a Vatican-looking link,” she wrote. “Grandma is clicking that. Every time.”

And then it gets even worse.

The signup endpoint, POST https://api.clicktopray.org/user/users/sign-up, returns the account’s validation_hash directly in the response body, and that value is the same UUID used in the email verification link. This means someone could sign up using any email address and verify the account before the confirmation message reached the inbox.

Plus, BobDaHacker’s email client flagged the real verification email with a warning that it had failed the domain’s authentication requirements and might have been spoofed or improperly forwarded.

“So not only is the API leaking 700,000 email addresses that could be used for phishing, but the real emails from Click To Pray already look like phishing,” the hacker noted. “An attacker wouldn’t even need to try hard. They could send a pixel-perfect phishing email and it would have the same level of email authentication as the real thing: none. God works in mysterious ways.”

The Register reached out to the Pope’s Worldwide Prayer Network and did not receive any response. BobDaHacker says she’s still praying for one, too.®

Your battery is continually losing charge.

Why the battery depletes

Rawpixel/Getty Images

Keep it half charged

Nature/Getty Images

Tips for keeping the battery healthy

Korosi Francois-Zoltan/Shutterstock