The data center boom will be judged not only by how much infrastructure we build, but by whether the people building it return home safely. Major opportunities bring a rush for capital, market share, and industry leadership. Schedules tighten, hiring accelerates, and safety can be treated as an obstacle. From what I have seen in high-risk work environments, that is a costly mistake. Cutting corners can hurt people, stop projects, and consume the capital everyone was racing to protect.

The scale of the current buildout makes that risk difficult to ignore. PwC forecasted that annual U.S. investment in data center infrastructure will rise 116%, from $53.2 billion in 2024 to $118.4 billion in 2027. This is not a gradual expansion. It is an enormous amount of complicated physical work being compressed into a short period.

The workforce is being stretched just as quickly. Deloitte found that data center job postings for core roles grew 64% between 2023 and 2025, compared with 4% across the broader economy. Postings for electrical technicians climbed more than 180%. In Deloitte’s survey, 63% of data center executives identified skilled-labor shortages as their leading talent obstacle. The opportunity for workers is real, but so is the pressure to deploy people before they are prepared.

I have watched workers move from restaurants, grocery stores, and other settings into construction and energy jobs. Their experience has value, but the hazards are different. A person using a hand drill may not understand how it will react if it seizes. Someone new to night shifts may arrive exhausted because the body has not adjusted. Outdoor work introduces heat, cold, hydration, and other factors that can affect judgment.

New workers are not the problem. Employers are responsible for preparing them. A certificate earned in a day or two is not the same as competence, and orientation is not supervised experience. When demand outpaces the supply of qualified people, employers may shorten training, accept questionable credentials, or assume a new hire will learn on the job. On a complex data center site, that assumption can endanger everyone nearby.

The answer begins with controlled onboarding. I favor a short-service employee program pairing each new worker with an experienced journeyman or senior employee, ideally one-to-one for high-risk work. The mentor tracks progress and helps the employee understand both the task and the site. A program might last 90 days, six months, or longer. The duration matters less than demonstrated competence.

Preparation must also happen before each task. Job safety analyses and pre-job risk assessments should be conversations, not compliance paperwork. Teams should review what will happen, how they will work, what could change, and when they should stop. Rehearsal lets people visualize the task before tools, vehicles, and changing conditions enter the picture.

Most importantly, workers must know that stopping a job for safety will be supported. Too many people hesitate because they fear retaliation or believe they will be blamed for missing a deadline. Leaders create culture through what they reward. Reporting a hazard, asking a question, or declining to complete an unsafe task should be treated as responsible performance. If employees hear “see something, say something” during orientation but watch supervisors punish delay in the field, the real policy is obvious.

The data center industry has an unusual advantage. Its workforce is arriving from different trades and backgrounds, and the industry is still establishing its norms. It can define safe work as professional work from the beginning. That takes more than a seminar. It requires qualified supervisors, manageable spans of control, recurring coaching, and consistent expectations when deadlines are under pressure.

Some executives may still see those measures as extra time and expense. The business case points in the other direction. EY notes that shortages of skilled workers and specialized contractors are already contributing to higher costs and longer timelines, while construction delays can bring substantial financial penalties. An incident adds its own chain of consequences: an investigation, damaged equipment, lost production, absent qualified workers, legal exposure, and potentially a shutdown. A rushed decision intended to save one shift can jeopardize an entire schedule.

That discipline matters even more as investors question the scale and timing of AI infrastructure returns. A credible safety system can instead become evidence that a project is being managed for reliable delivery rather than a single rushed milestone.

Safety should therefore be presented to customers and investors as an operating capability. Developers should explain how they verify competence, mentor new hires, assess risk, protect stop-work authority, and learn from reported hazards. These systems protect people first while also supporting continuity, quality, and trust.

The data center boom is a historic opportunity, but speed alone will not make it a success. We can build an industry in which people are rushed into unfamiliar work and learn its hazards through injury, failure, and loss. Or we can build the training, supervision, and speaking-up culture at the same time as the facilities themselves. The infrastructure will be judged by what it enables. The industry should also be judged by whether the people who built it returned home safely.

from the fix-your-own-shit dept

There’s still a massive effort afoot to implement statewide “right to repair” laws that try to make it cheaper, easier, and environmentally friendlier for you to repair the technology you own. All fifty states have at least flirted with the idea, though only Massachusetts, New York, Texas, Minnesota, Colorado, California, Oregon, and Washington have actually passed laws.

US PIRG tells the Guardian that this year alone, legislators have introduced more than 50 bills across 22 states, including a Florida bill that addresses wheelchairs, a motorcycle-oriented bill in Missouri, and a proposal in Ohio that would apply broad new consumer repair protections across everything from digital devices to aircraft and construction equipment.

In Iowa, state lawmakers passed a first draft of right-to-repair legislation in April that focuses heavily on agricultural equipment and tractors, a subject that has driven broad, bipartisan support:

“Farmers have been fixing their own equipment as long as they have been farming, and it’s essential to the sustainability of our farms that we be able to have that control over the equipment,” said Aaron Lehman, who is also president of the Iowa Farmers Union.”

And on the federal level, efforts remain slow but ongoing to pass the Repair Act, which states that “a motor vehicle manufacturer may not employ any technological barrier or specified legal barrier that impairs the ability of a motor vehicle owner” to “access vehicle-generated data.”

One strange trend I keep seeing however (and this is perpetuated in the Guardian piece): despite major progress on passing new legislative proposals, I’ve yet to see a single state enforce any aspect of a new right to repair law despite absolutely no shortage of corporate offenders. And in several of these states these laws are approaching four or five years of age.

So while the momentum the movement has built is impressive, it’s decidedly less impressive if the new laws passed are so full of loopholes as to be pointless (as we saw when New York’s right to repair law was watered down post-passage), or enforcement doesn’t result in any actual observable reform. At some point activism has to start hammering real-world enforcement of laws already on the books.

Filed Under: consumers, hardware, independent repair, right to repair, software, state law, tractors

Plaud has unveiled the Plaud One Explorer Edition, a new pair of AI-powered earbuds designed to capture conversations and turn them into actionable tasks.

The $249.99 wearable combines earbuds with a standalone case, built-in 4G connectivity and Plaud’s latest AI platform, with pre-orders now open in selected markets.

Unlike conventional earbuds, Plaud One is designed primarily around conversation rather than music. It can capture phone calls, online meetings, face-to-face conversations and ideas on the go, with the company positioning it as a new interface for interacting with AI.

One of the more interesting aspects is that the earbuds don’t need to stay connected to a phone to upload recordings. Plaud One has a built-in eSIM and 4G LTE connectivity, allowing conversations to be uploaded for transcription and summarisation as they happen. The standalone case can also be used to capture conversations.

PaperCut has released a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers discovered multiple ways to bypass the initial fixes.

As BleepingComputer reported yesterday, PaperCut warned that hackers were exploiting a vulnerability in zero-day attacks against customer servers and released an initial emergency patch for PaperCut NG/MF versions 25 and 26.

At the time, however, the company had not disclosed CVE identifiers or technical details about the vulnerabilities, saying it was withholding information while it investigated the attacks and gave customers time to apply emergency fixes.

PaperCut has now shared technical details and CVE identifiers for the two vulnerabilities, tracked as CVE-2026-82078 and CVE-2026-81578. These vulnerabilities can be chained to bypass authentication and execute code on vulnerable servers.

CVE-2026-81578 is a high-severity authentication bypass vulnerability rated 8.8 that impacts the PaperCut NG/MF web management interface.

“Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks,” explains PaperCut’s updated advisory.

The second vulnerability, tracked as CVE-2026-82078, is a critical unsafe dynamic class-loading flaw rated 9.4 that exists in PaperCut’s database connection utilities.

The application loads database driver classes based on configurable driver names without validating them against an approved allowlist. 

“If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process,” explains PaperCut.

Cybersecurity firm watchTowr, which has been working with PaperCut during the incident, said on LinkedIn that the vulnerabilities allow unauthenticated attackers to bypass authentication and gain remote code execution on affected PaperCut NG/MF instances.

Second emergency patch released

On Friday, PaperCut released Emergency Patch Release 2, an updated security fix that includes additional hardening developed after further analysis with its internal security team and researchers at Huntress and watchTowr.

“Following further work with our internal security team and external researchers, including Huntress and watchTowr, we have released an updated Emergency Patch (Release 2) that includes additional hardening beyond the original emergency patch,” PaperCut said.

The company is urging all customers to install Release 2 even if they already installed the first emergency patch.

This second release comes after watchTowr said its researchers fully reproduced the vulnerabilities, discovered multiple patch bypasses, and identified an additional authentication bypass vulnerability.

Huntress, which has been working with PaperCut during the incident, says it observed exploitation in two customer environments and reproduced the full pre-authentication RCE chain.

The company told BleepingComputer that PaperCut logs captured commands used by the attackers for system reconnaissance, while hex-encoded Java `.class` files found in the logs acted as an RCE bridge between PaperCut and the underlying operating system, allowing commands to be executed and files to be read or written.

The commands observed by Huntress appear to have been used for reconnaissance rather than to deploy malware or establish persistence.

Huntress also says it discovered multiple bypasses for the original emergency patches and an additional authentication bypass vulnerability, which it shared with PaperCut.

Emergency Patch Release 2 is available for PaperCut NG and MF versions 24, 25, and 26 on Windows, Linux, and macOS. Customers running version 23 or earlier are advised to upgrade to the latest version rather than wait for a patch for those releases.

PaperCut says Site Servers and secondary/print servers should also be upgraded to patched versions. Other components, like Print Deploy and Mobility Print, are not affected and do not require updates.

Even though patches are available, PaperCut to urge customers to restrict access to the web interfaces to trusted IP addresses using firewall rules, network access controls, or equivalent measures.

Administrators should also look for suspicious post-exploitation activity from the pc-app.exe process, missing or truncated server.log files, and the following errors in the server.log.

ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST

The company has not disclosed who is behind the attacks or what threat actors are doing after compromising vulnerable servers.

PaperCut told BleepingComputer that the attacks appear limited and targeted, and that it is withholding details about post-exploitation activity while it continues its investigation.

“Our investigation into what attackers are doing post-compromise is still active, and premature detail could complicate any affected customers’ own response,” PaperCut told BleepingComputer.

“What we can say: the bulletin advises customers to watch for intrusion-detection, endpoint, or network-monitoring alerts tied to the PaperCut Application Server, and we’ll publish indicators of compromise as they’re verified.”

PaperCut servers were previously targeted in 2023 after attackers began exploiting CVE-2023-27350, an authentication bypass and remote code execution vulnerability.

Those attacks were ultimately linked to numerous threat actors, including the Clop and LockBit ransomware operations, Iranian state-backed hacking groups, and the Bl00dy Ransomware Gang.

Update: Added information from Huntress.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

• Intel shows three agentic AI architectures at Hot Chips 2026: the 256-core Diamond Rapids Xeon, the Crescent Island inference GPU, and the already-shipping Wildcat Lake client SoC
• Diamond Rapids matches AMD’s EPYC Venice on cores and bandwidth but arrives in 2027 with half the threads, while Wildcat Lake’s 17 TOPS NPU falls short of Copilot+’s 40+ TOPS certification
• Intel’s Crescent Island will support up to 480 GB via third-party partner cards, but the Intel-branded variant will be limited to 160 GB, even as it currently does not publish the memory bandwidth that determines its token economics.

Intel used its slot at Hot Chips 2026 to lay out three architectures it says will carry agentic AI from the rack to the laptop.

The already-shipping Wildcat Lake Core Series 3 SoC is for mainstream client and edge machines, Crescent Island is an inference-optimized data center GPU, and Diamond Rapids is its next-generation enterprise-class data center CPU that can be configured with up to 256 cores.

Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.

McKesson is a major U.S. healthcare company and pharmaceutical distributor that provides medicines, medical supplies, technology, and services to healthcare providers and pharmacies.

CyberInsider first reported the breach earlier today, and McKesson later disclosed it in a Form 8-K filing with the U.S. Securities and Exchange Commission.

McKesson says it discovered the cybersecurity incident on August 25, 2026, and that its investigation remains in the early stages.

“Information about the incident, including any updates, is available on the company’s website at www.mckesson.com/cybersecurity,” McKesson said in its SEC filing.

“As of the date of this filing, the company has not determined that the incident is material or that the incident has had, or is reasonably likely to have, any material impact on the company, including its financial condition or results of operations.”

In a separate notice to customers, McKesson confirmed that the incident involved third-party applications and the unauthorized access and exfiltration of data.

“We take the security and privacy of our partners, customers and their patients very seriously. Upon discovery, we immediately activated our incident response protocols, launched an investigation, and engaged leading cybersecurity industry experts to assist in our response,” reads McKesson’s notice.

The company said its investigation is ongoing to determine the full scope of the incident.

McKesson also warned that customers may experience intermittent service degradation believed to be related to the attack, although the company said it was not proactively disconnecting systems within its environment.

At this time, McKesson has not publicly disclosed which third-party applications were compromised, how the attackers gained access, or what information was stolen.

McKesson says its investigation remains ongoing and that it will provide additional information as it develops a more complete understanding of the incident.

ShinyHunters claims responsibility

The ShinyHunters extortion group told BleepingComputer that it was behind the attack, claiming it gained access after conducting voice phishing, or vishing, social engineering attacks against multiple McKesson employees.

ShinyHunters declined to provide many technical details about the social engineering attacks, including the domain used during the campaign. However, BleepingComputer learned from another source that the threat actors used the mckesson[.]claims domain as part of the attack.

This domain matches a ShinyHunters campaign recently documented by ReliaQuest’s Threat Research team, which said the extortion group was registering .claims domains containing the names or abbreviations of targeted companies to impersonate their help desks and IT teams.

“ReliaQuest is tracking a widespread ShinyHunters campaign using domains that follow the company[.]claims pattern. These domains incorporate the targeted organization’s name or abbreviation under the .claims TLD,” ReliaQuest said in a now-deleted post on X.

ShinyHunters told BleepingComputer that the vishing attacks led to the compromise of multiple employees’ Okta single sign-on accounts, which they then used to access the company’s Salesforce and Snowflake environments.

The threat actor claims it fully compromised the Salesforce environment, including support cases. The threat actor also allegedly stole a much larger collection of patient-related data from Snowflake.

According to ShinyHunters, the threat actor exfiltrated about 1TB of data over four days, between August 21 and August 25.

The threat actor also claims the stolen Snowflake data contains approximately 284 million data records of patient-related information. However, this does not mean that the breach impacted 284 million patients.

Previous reporting stated that information belonging to 284 million patients had been exposed. ShinyHunters clarified to BleepingComputer that the figure is actually a raw count of approximately 284 million data records, or lines, rather than a count of unique individuals.

The threat actor told BleepingComputer that it has not fully analyzed the stolen data and does not know how many unique people are in those records.

ShinyHunters claims the stolen information includes names, addresses, dates of birth, Social Security numbers, patient IDs, phone numbers, email addresses, Medicaid numbers, medical record numbers, medication and allergy information, illnesses, disabilities, appointment information, and physician information.

The group also claims the data contains information related to deceased and terminally ill patients, prescriptions and medication shipments, invoices, employee information, Salesforce records, internal communications, and healthcare providers and clinics using McKesson’s services.

BleepingComputer has not independently verified these claims, and McKesson has not publicly disclosed what information was stolen.

The group says it contacted McKesson after completing the data theft on August 25 and demanded a $55,236,150 ransom, giving the company 72 hours to respond. According to ShinyHunters, McKesson did not respond to or negotiate over the ransom demand.

The attack comes amid an ongoing wave of data-theft attacks targeting healthcare and health technology organizations attributed to ShinyHunters.

Health-ISAC recently warned healthcare organizations about increasing ShinyHunters attacks involving social engineering designed to compromise corporate accounts and gain access to cloud and SaaS platforms.

Other healthcare technology companies targeted in recent ShinyHunters data-theft attacks include Medtronic, DentaQuest, iRhythm, OneMedical, and AdaptHealth.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

It’s a quick fix for that dead zone in your house.

What does an Android Wi-Fi extender actually do?

How to set up your Android phone as a Wi-Fi extender

MIRACLE PROJECT/Shutterstock

Android phone vs. commercial alternatives: Which is better?

New Africa/Shutterstock

You can now grab the Kindle Scribe Colorsoft at its lowest price since launch, saving £150 in the process.

Amazon has cut £150 off the Kindle Scribe Colorsoft, taking it from £629.99 down to £479.99, a 24% discount that makes this the cheapest way yet to own one of Amazon’s most advanced e-readers.