from the today-in-what-the-everloving-fuck dept

Compliant Technologies probably would have preferred to keep flying under the radar. But a gaudy new no-bid contract with ICE (worth up to $20 million!) made it impossible.

Prior to ICE’s big purchase, it may as well have never existed. It only had a few clients, and those few clients purchased a few pairs for prison guards and jail staffers. That’s the sort of thing that kind of makes sense. Controlling inmates in enclosed spaces requires a bit more finesse than just beating them with batons.

Given the increased chance of losing control of a “compliance” option, turning gloves into quasi-stun guns made it easier to deploy force while simultaneously reducing the probability of losing a baton/Taser/OC canister to an inmate who’s stronger and faster than the average prison guard (i.e., most of them).

But ICE decided it wanted even more force to deploy, even though deploying force (a lot of it “excessive”) is basically all ICE does. Under-trained officers tend to underperform in the field, especially when they’re asked to do something more than seize the occasional website or find illegal substances hidden in cargo containers.

Here comes the shocker. Not only did a cop shop give officers some stun G.L.O.V.E.s (Generated Low Output Voltage Emitters), but it allowed them to deploy them in Omaha, Nebraska schools. With the G.L.O.V.E. backlash now fully engaged due to ICE’s interest in inflicting further unnecessary pain, an Omaha school district is “asking” cops not to use these gloves.

And the best thing we can say about this development is that the cops have actually agreed to stop glove-stunning students, without engaging in too much extracurricular bitching:

Omaha police agreed this week to stop carrying gloves that can deliver electric shocks to students in the halls of Nebraska’s largest public school district.

The Omaha mayor and police chief said in a joint statement Monday that the gloves were used twice in the last school year, including in a program for students with learning deficits.

Reread that last sentence a few more times. That’s extremely disturbing. While officers claim to have only used them “twice,” it did deploy them at least once to stun “students with learning deficits.”

And I only said there was a minimum of bitching by the cops. There was still some bitching, which arrived in the form of belated justification for stun-tech I can almost guarantee no parent was aware school resource officers (a fancy phrase for “school cop”) had access to, much less using on students.

“We believe it is the safest use-of-force option in the rare times when it is used,” the statement said.

“Safest?” As compared to what?!?! At what point do you decide a school discipline issue necessitates an ambush with literal shock tactics? Is this safer than NOT FUCKING DOING THIS AT ALL? I’m not an expert in “low voltage emissions” but I would like to believe any option that is less violent than stunning a student into submission is actually safer than any option that involves incapacitating someone with an electric shock.

What’s wild is that the school district actually had to make this request and then hope the cops would comply. And they had to hold onto this hope despite there being significant pushback from the community these cops are supposed to be serving. That it took the cops an entire day to simply agree to use the multiple violent force options they already have available to them doesn’t inspire a lot of confidence.

Destroying this minimal amount of confidence is the fact that this “agreement” (which hasn’t been made official) only extends to the Omaha PD. For some fucking reason, a bunch of Omaha-area cops “serving” Omaha schools apparently also have these gloves and aren’t promising to change a damn thing about how they handle policing schools.

However, the suburban Bellevue police department that patrols two Omaha schools and the large Bellevue district said its officers will continue carrying the gloves. Three other large school districts in the metro area that have Omaha school resource officers assigned to their buildings have not taken action to stop police from using the devices.

This agency saw the backlash and the semi-capitulation of the city’s largest law enforcement agency and then… did absolutely nothing. As far as the Bellevue PD is concerned, it’s still open season on students when it comes to SROs (school resource officers) and their stun gloves.

The schools in that district appear to be led by people who will never take issue with anything cops might do. Nothing to see here, says the district spokesperson, whose statement sounds like something delivered by someone who developed Stockholm Syndrome while undergoing a lobotomy:

Bellevue schools spokeswoman Amanda Oliver said the district has a great relationship with Bellevue police and doesn’t see a need to alter anything.

Oh, I’m sure the district has a “great relationship” with the cops. But we’re not worried about the administrators. We’re worried about the kids, who are the ones who will be subjected to violent force, including these novel stun gloves the kids at ICE keep talking about. And the Bellevue PD has used them just as often on students as the Omaha PD. And even though it was only “two” instances, the Omaha PD was at least willing to swear off using this tech in schools.

Meanwhile, in Bellevue, it’s apparently business as usual, even though no one (other than the PD and this weirdly cheery PR person) wants cops to have this option when patrolling schools.

At last week’s school board meeting, about 30 people spoke out against police using the gloves. Residents and board members alike said they were appalled at the practice. No one spoke in favor of it.

No one except the people who will never be subjected to the stun gloves, which the company helpfully points out won’t leave evidence “burn or contact marks” on the minors subjected to them. Bellevue schools — via its PR flack — said everything is fine. The chief of the Bellevue PD, Ken Clary, similarly claims to have a healthy relationship with the G.L.O.V.E.

“I am not comfortable having our officers give up a tool that has repeatedly proven to be safe, effective, and less harmful than the alternatives,” Clary said in a statement.

Again: as compared to what? You can’t just say this option is better than others without providing any evidence to support this statement. I mean, you can, but you shouldn’t expect anyone to believe you. This just sounds like a top cop claiming each new force option is more “effective” and “safer” than whatever the department is already using. Adding yet another option is never viewed as adding to the excess. It’s just folded in with everything else and glossed over in public statements until the public’s attention is focused elsewhere.

There’s no reason for ICE to have these gloves. Officers already have tons of force options, as well as the full permission/judicial immunity to use whatever option they feel will inflict the most pain at any given point. The G.L.O.V.E. may have started out as a prison option, but now it’s clear cops want this option whenever they’re dealing with… shall we say… captive audiences. And the defenders of this tech are making it clear they think inmates and students are interchangeable, at least when it comes to deploying force.

Filed Under: ice, nebraska, police misconduct, police violence, school resource officer, stun gloves, wtaf

Companies: compliant technologies

Nintendo and Sony spent the early nineties arguing over a Super NES compact disc attachment that never reached store shelves. Throaty Mumbo read that history and aimed lower, at the original front-loading NES, a console with no disc hardware and an expansion port that sat unused on the bottom of millions of gray boxes. His project page calls the result NESCD-001, an unofficial homemade compact disc add-on built for fun and documented in a build video plus a public GitHub repo.

His finished unit is a gray 3D printed slab that fits under the console in the same way as the old Famicom Disk System did. A white disk tray with glossy red lettering faces forward, accompanied by an eject button and volume knob. Inside, there’s a conventional 40-pin IDE compact disk drive (the Pacific Digital Mach 52, as seen in the movie), a custom circuit board, a PCM5102 converter, and an RP2350B microcontroller that communicates with both the drive and an Everdrive N8 Pro flash cartridge. The printable shell files and sticker art for that board layout are available in the same source as the board layout itself.

Games do not run directly from the disc in the same way as later CD consoles do. What happens is that the RP2350B reads the ROM from the disk, transfers it to the Everdrive over USB, and runs it. After things are up and running, the microcontroller monitors a CHR mailbox at memory address 0x21FF8 for any requests from the running game, which could be for additional audio or a chunk of full motion video. Frames of video are delivered over the same USB link and written into NES video memory using proprietary bitstream code from the Cyclone IV FPGA already installed on the Everdrive N8 Pro.

Then there’s the audio side, which has gone its own way on purpose. Compact disk sound exits the PCM5102 and enters the NES via the expansion port mixer pin, an input pin that Nintendo slipped onto American hardware but never seemed to use. That method prevents any additional sound from clogging the already congested USB link, while simultaneously allowing the front knob to do something. One Molex cable from a wall adapter supplies 5 and 12 volts to the drive and board. A buck converter then reduces the 12V to around 9.5V, allowing you to utilize a spare NES power plug to power the console from the top of the box, using only one outlet to power the entire stack. Of course, you can still use the original brick to power the NES.

Proof of concept can be found on a homemade disc labeled “Super Mario Bros. CD edition”. Yes, it’s still the 1985 platformer, but now the music comes from compact disc recordings and small cutscenes pop in. Mario and Luigi are talking about a picnic, while Bowser is checking into a local hotel. When you take the disk out, the extra layer stops working. Early tests also ran standard cartridge games through the Everdrive while the drive and board were being wired, including a sanity check to ensure Contra was still operational when some flash carts decided to cause problems.

The full motion video functionality is still very much in beta. Something Nerdy Studios already showed that an Everdrive N8 Pro can push Bad Apple across the full NES screen from an SD card by stuffing tiles into CHR RAM as fast as the machine will take them. Throaty Mumbo leaned on that work for a disc-fed version, then held the firmware back because parts of it were reverse engineered from that demo.

Author: Gene Moody, Field CTO at Action1

AI can help us find vulnerabilities faster than ever. But what happens when the rest of the vulnerability management ecosystem can’t keep up?

When Vulnerability Volume Outpaces the System

In April, NIST released a statement regarding updates to NVD operations that reflects a necessary response to scale. CVE volume has grown beyond what the current enrichment model was designed to handle. As part of the change, roughly 30,000 vulnerabilities published before March 1, 2026, were reclassified as “Not Scheduled.”

Prioritization, automation, and selective processing are reasonable adjustments in principle. In practice, however, the shift introduces a set of risks that may not be fully understood, particularly for those responsible for defending enterprise environments.

The pressure is not theoretical. Action1’s 2026 Software Vulnerability Ratings Report found that disclosed vulnerabilities across the enterprise software categories analyzed increased 92% in 2025 compared with 2024. Critical and high-severity vulnerabilities increased 103% each, while vulnerabilities enabling remote code execution increased 128%. 

Today, the volume of disclosures that must be validated, enriched, prioritized, and ultimately remediated is likely to place even greater pressure on systems designed for a slower era of vulnerability discovery.

The core issue is therefore not simply the existence of a backlog. Backlogs are an expected outcome in any system operating under rapid growth. The concern is how that backlog is managed and, more importantly, what signals are created by the decision to prioritize newer vulnerabilities over older, unprocessed ones.

What Happens When Enrichment Falls Behind

By focusing enrichment efforts only on recent CVEs, the system implicitly deprioritizes vulnerabilities that may already be known, confirmed, and, in some cases, actively discussed by vendors or researchers but lack full NVD context. 

This creates an information asymmetry of a particularly difficult kind: partial intelligence without the second half that makes it readily actionable. Security teams that rely heavily on NVD as a normalized source of vulnerability information may see incomplete or delayed data.

Attackers, meanwhile, do not need to wait for standardized enrichment before correlating vendor advisories, security research, patch releases, exploit information, and public disclosures.

That gap matters because enrichment is not cosmetic. Structured metadata, affected-platform information, severity scoring, configuration details, and other contextual information allow defenders to determine whether a vulnerability actually applies to their environment and how urgently it should be addressed.

When that information is missing or delayed, organizations are often forced to either wait for additional context or make decisions using fragmented information. Neither outcome is ideal in a threat landscape where exploitation can move faster than internal validation and remediation processes.

But That’s Not All

There is also a second-order effect that is harder to quantify but equally important. A rolling backlog that is continuously fed while being selectively drained creates uncertainty about coverage. Without a clear commitment to processing older entries within a defined timeframe, the backlog becomes a semi-permanent condition.

Some vulnerabilities will be enriched quickly, others will remain in limbo, and there will be limited visibility into which category any given CVE falls into at a given moment.

For practitioners, this overly complicates prioritization. If affected-product information such as CPE data is incomplete or overly broad, organizations face a greater risk of false positives. Teams may spend time investigating vulnerabilities that do not apply to their environment while potentially overlooking risks that do.

Over time, this will certainly erode confidence in the dataset and push organizations to build alternative intelligence pipelines. That will lead to additional cost, tooling, and operational complexity. As well, as one may predict, increasing failure rates.

Vulnerability Management Is Changing

None of this suggests that NIST is acting irresponsibly. The scale problem is real, and the existing model was not designed for the volume of vulnerability information now entering the ecosystem.But the introduced trade-off pushes more responsibility downstream.

Organizations will need to rely less on a single authoritative source and more on correlation across multiple sources, including NVD, vendor advisories, independent vulnerability-intelligence providers, threat intelligence platforms, and internal asset inventories.

Zoom out, and the view is that vulnerability management is becoming less about consuming a curated list and more about synthesizing accurate intel from incomplete data in near real time. That requires maturity, tooling, and process discipline that not all organizations currently possess. 

If this direction continues, the NVD will remain a critical component of the vulnerability-management ecosystem, but it will no longer function as a comprehensive baseline on its own. Instead, it becomes one input among many, and one that may lag significantly behind the realities of exploitation in the field.

The more important question then becomes not simply, “What vulnerabilities exist?” but “Which of them affect us, which represent the greatest risk, and how quickly can we act?”

How Defenders Should Adapt

The first lesson is that vulnerability management can no longer depend on any single source of enrichment. NVD remains enormously valuable, but security teams increasingly need to subscribe to cumulative works of vendors and organizations that aggregate the available data into usable intelligence

More importantly, collecting additional feeds is only part of the answer. More information can simply create another prioritization problem. The real objective is to turn fragmented vulnerability intelligence into a decision: Does this vulnerability affect us, how urgent is it, and what can we do about it now?

This is the model Action1 has adopted for vulnerability management. Rather than relying exclusively on NVD enrichment, Action1 combines intelligence from sources including VulnCheckNVD++, NIST NVD, CISA’s KEV Catalog, Microsoft’s own MSRC data, and vendor release notes, then scores each vulnerability based on CVE data, CVSS severity, CISA KEV status, and known usage in ransomware campaigns, providing initial prioritization in minutes.

That intelligence is correlated with real-time endpoint data so teams can determine which vulnerabilities actually affect software deployed in their environment and prioritize remediation accordingly.

Once an affected endpoint has been identified, remediation should not require another export, manual correlation exercise, or lengthy handoff before patching begins. 

Action1 brings vulnerability assessment and remediation into the same workflow, allowingorganizations to move from learning that a vulnerability exists to reducing actual exposure much faster, all from a single console.

The AI vulnerability era will not be defined by how fast IT and security teams can find flaws, but by how quickly they can understand, prioritize, and patch them. Discovery is accelerating, soremediation must accelerate with it.

See how Action1 connects real-time OS and third-party vulnerability intelligence with automated remediation to help your team reduce exposure faster. 

Start free and scale when you’re ready.

Sponsored and written by Action1.

The Tottenham vs Newcastle live stream involves two teams looking for their first wins of the new season. Tottenham were humbled by Brentford on matchday one, while Newcastle were denied all three points by a last-gasp Liverpool equaliser.

There were few positives for Roberto De Zerbi to take from this side’s display against Brentford. Spurs finished 17th last season, and their performance at the Gtech Community Stadium was worse than most of their showings in 2025/26. The only saving grace is that Tottenham’s starting XI will be significantly different going forward, starting with the visit of Newcastle.

Apple’s next big iPhone event is almost here, with the iPhone 18 Pro, iPhone 18 Pro Max and the company’s first foldable, the iPhone Ultra, all expected to make their debut.

The event will also mark the first major Apple product launch since John Ternus takes over as CEO on September 1. As with recent launches, Apple will combine an in-person gathering at Apple Park with a prerecorded presentation.

When is the iPhone 18 Pro/Ultra event?

The event will take place on Wednesday, September 9, starting at 10am PDT (1pm EDT). For other regions, the event starts at 6pm BST in the UK, 7pm CEST in Central Europe and 10:30pm IST in India. Viewers in China can tune in at 1am CST on September 10, followed by 2am JST in Japan and 3am AEST in Sydney.

Apple’s official event page also includes an Add to Calendar option, which automatically adjusts the event time for your location. It’s worth opening the stream a few minutes early, particularly if you want to catch the opening announcements.