Nintendo and Sony spent the early nineties arguing over a Super NES compact disc attachment that never reached store shelves. Throaty Mumbo read that history and aimed lower, at the original front-loading NES, a console with no disc hardware and an expansion port that sat unused on the bottom of millions of gray boxes. His project page calls the result NESCD-001, an unofficial homemade compact disc add-on built for fun and documented in a build video plus a public GitHub repo.

His finished unit is a gray 3D printed slab that fits under the console in the same way as the old Famicom Disk System did. A white disk tray with glossy red lettering faces forward, accompanied by an eject button and volume knob. Inside, there’s a conventional 40-pin IDE compact disk drive (the Pacific Digital Mach 52, as seen in the movie), a custom circuit board, a PCM5102 converter, and an RP2350B microcontroller that communicates with both the drive and an Everdrive N8 Pro flash cartridge. The printable shell files and sticker art for that board layout are available in the same source as the board layout itself.

Games do not run directly from the disc in the same way as later CD consoles do. What happens is that the RP2350B reads the ROM from the disk, transfers it to the Everdrive over USB, and runs it. After things are up and running, the microcontroller monitors a CHR mailbox at memory address 0x21FF8 for any requests from the running game, which could be for additional audio or a chunk of full motion video. Frames of video are delivered over the same USB link and written into NES video memory using proprietary bitstream code from the Cyclone IV FPGA already installed on the Everdrive N8 Pro.

Then there’s the audio side, which has gone its own way on purpose. Compact disk sound exits the PCM5102 and enters the NES via the expansion port mixer pin, an input pin that Nintendo slipped onto American hardware but never seemed to use. That method prevents any additional sound from clogging the already congested USB link, while simultaneously allowing the front knob to do something. One Molex cable from a wall adapter supplies 5 and 12 volts to the drive and board. A buck converter then reduces the 12V to around 9.5V, allowing you to utilize a spare NES power plug to power the console from the top of the box, using only one outlet to power the entire stack. Of course, you can still use the original brick to power the NES.

Proof of concept can be found on a homemade disc labeled “Super Mario Bros. CD edition”. Yes, it’s still the 1985 platformer, but now the music comes from compact disc recordings and small cutscenes pop in. Mario and Luigi are talking about a picnic, while Bowser is checking into a local hotel. When you take the disk out, the extra layer stops working. Early tests also ran standard cartridge games through the Everdrive while the drive and board were being wired, including a sanity check to ensure Contra was still operational when some flash carts decided to cause problems.

The full motion video functionality is still very much in beta. Something Nerdy Studios already showed that an Everdrive N8 Pro can push Bad Apple across the full NES screen from an SD card by stuffing tiles into CHR RAM as fast as the machine will take them. Throaty Mumbo leaned on that work for a disc-fed version, then held the firmware back because parts of it were reverse engineered from that demo.

Author: Gene Moody, Field CTO at Action1

AI can help us find vulnerabilities faster than ever. But what happens when the rest of the vulnerability management ecosystem can’t keep up?

When Vulnerability Volume Outpaces the System

In April, NIST released a statement regarding updates to NVD operations that reflects a necessary response to scale. CVE volume has grown beyond what the current enrichment model was designed to handle. As part of the change, roughly 30,000 vulnerabilities published before March 1, 2026, were reclassified as “Not Scheduled.”

Prioritization, automation, and selective processing are reasonable adjustments in principle. In practice, however, the shift introduces a set of risks that may not be fully understood, particularly for those responsible for defending enterprise environments.

The pressure is not theoretical. Action1’s 2026 Software Vulnerability Ratings Report found that disclosed vulnerabilities across the enterprise software categories analyzed increased 92% in 2025 compared with 2024. Critical and high-severity vulnerabilities increased 103% each, while vulnerabilities enabling remote code execution increased 128%. 

Today, the volume of disclosures that must be validated, enriched, prioritized, and ultimately remediated is likely to place even greater pressure on systems designed for a slower era of vulnerability discovery.

The core issue is therefore not simply the existence of a backlog. Backlogs are an expected outcome in any system operating under rapid growth. The concern is how that backlog is managed and, more importantly, what signals are created by the decision to prioritize newer vulnerabilities over older, unprocessed ones.

What Happens When Enrichment Falls Behind

By focusing enrichment efforts only on recent CVEs, the system implicitly deprioritizes vulnerabilities that may already be known, confirmed, and, in some cases, actively discussed by vendors or researchers but lack full NVD context. 

This creates an information asymmetry of a particularly difficult kind: partial intelligence without the second half that makes it readily actionable. Security teams that rely heavily on NVD as a normalized source of vulnerability information may see incomplete or delayed data.

Attackers, meanwhile, do not need to wait for standardized enrichment before correlating vendor advisories, security research, patch releases, exploit information, and public disclosures.

That gap matters because enrichment is not cosmetic. Structured metadata, affected-platform information, severity scoring, configuration details, and other contextual information allow defenders to determine whether a vulnerability actually applies to their environment and how urgently it should be addressed.

When that information is missing or delayed, organizations are often forced to either wait for additional context or make decisions using fragmented information. Neither outcome is ideal in a threat landscape where exploitation can move faster than internal validation and remediation processes.

But That’s Not All

There is also a second-order effect that is harder to quantify but equally important. A rolling backlog that is continuously fed while being selectively drained creates uncertainty about coverage. Without a clear commitment to processing older entries within a defined timeframe, the backlog becomes a semi-permanent condition.

Some vulnerabilities will be enriched quickly, others will remain in limbo, and there will be limited visibility into which category any given CVE falls into at a given moment.

For practitioners, this overly complicates prioritization. If affected-product information such as CPE data is incomplete or overly broad, organizations face a greater risk of false positives. Teams may spend time investigating vulnerabilities that do not apply to their environment while potentially overlooking risks that do.

Over time, this will certainly erode confidence in the dataset and push organizations to build alternative intelligence pipelines. That will lead to additional cost, tooling, and operational complexity. As well, as one may predict, increasing failure rates.

Vulnerability Management Is Changing

None of this suggests that NIST is acting irresponsibly. The scale problem is real, and the existing model was not designed for the volume of vulnerability information now entering the ecosystem.But the introduced trade-off pushes more responsibility downstream.

Organizations will need to rely less on a single authoritative source and more on correlation across multiple sources, including NVD, vendor advisories, independent vulnerability-intelligence providers, threat intelligence platforms, and internal asset inventories.

Zoom out, and the view is that vulnerability management is becoming less about consuming a curated list and more about synthesizing accurate intel from incomplete data in near real time. That requires maturity, tooling, and process discipline that not all organizations currently possess. 

If this direction continues, the NVD will remain a critical component of the vulnerability-management ecosystem, but it will no longer function as a comprehensive baseline on its own. Instead, it becomes one input among many, and one that may lag significantly behind the realities of exploitation in the field.

The more important question then becomes not simply, “What vulnerabilities exist?” but “Which of them affect us, which represent the greatest risk, and how quickly can we act?”

How Defenders Should Adapt

The first lesson is that vulnerability management can no longer depend on any single source of enrichment. NVD remains enormously valuable, but security teams increasingly need to subscribe to cumulative works of vendors and organizations that aggregate the available data into usable intelligence

More importantly, collecting additional feeds is only part of the answer. More information can simply create another prioritization problem. The real objective is to turn fragmented vulnerability intelligence into a decision: Does this vulnerability affect us, how urgent is it, and what can we do about it now?

This is the model Action1 has adopted for vulnerability management. Rather than relying exclusively on NVD enrichment, Action1 combines intelligence from sources including VulnCheckNVD++, NIST NVD, CISA’s KEV Catalog, Microsoft’s own MSRC data, and vendor release notes, then scores each vulnerability based on CVE data, CVSS severity, CISA KEV status, and known usage in ransomware campaigns, providing initial prioritization in minutes.

That intelligence is correlated with real-time endpoint data so teams can determine which vulnerabilities actually affect software deployed in their environment and prioritize remediation accordingly.

Once an affected endpoint has been identified, remediation should not require another export, manual correlation exercise, or lengthy handoff before patching begins. 

Action1 brings vulnerability assessment and remediation into the same workflow, allowingorganizations to move from learning that a vulnerability exists to reducing actual exposure much faster, all from a single console.

The AI vulnerability era will not be defined by how fast IT and security teams can find flaws, but by how quickly they can understand, prioritize, and patch them. Discovery is accelerating, soremediation must accelerate with it.

See how Action1 connects real-time OS and third-party vulnerability intelligence with automated remediation to help your team reduce exposure faster. 

Start free and scale when you’re ready.

Sponsored and written by Action1.

The Tottenham vs Newcastle live stream involves two teams looking for their first wins of the new season. Tottenham were humbled by Brentford on matchday one, while Newcastle were denied all three points by a last-gasp Liverpool equaliser.

There were few positives for Roberto De Zerbi to take from this side’s display against Brentford. Spurs finished 17th last season, and their performance at the Gtech Community Stadium was worse than most of their showings in 2025/26. The only saving grace is that Tottenham’s starting XI will be significantly different going forward, starting with the visit of Newcastle.

Apple’s next big iPhone event is almost here, with the iPhone 18 Pro, iPhone 18 Pro Max and the company’s first foldable, the iPhone Ultra, all expected to make their debut.

The event will also mark the first major Apple product launch since John Ternus takes over as CEO on September 1. As with recent launches, Apple will combine an in-person gathering at Apple Park with a prerecorded presentation.

When is the iPhone 18 Pro/Ultra event?

The event will take place on Wednesday, September 9, starting at 10am PDT (1pm EDT). For other regions, the event starts at 6pm BST in the UK, 7pm CEST in Central Europe and 10:30pm IST in India. Viewers in China can tune in at 1am CST on September 10, followed by 2am JST in Japan and 3am AEST in Sydney.

Apple’s official event page also includes an Add to Calendar option, which automatically adjusts the event time for your location. It’s worth opening the stream a few minutes early, particularly if you want to catch the opening announcements.

What just happened? A federal judge has ordered the Trump administration to rescind its designation of Anthropic as a supply-chain risk, ruling that the government violated the AI company’s First Amendment rights. The decision found the designation was not supported by evidence of a genuine national-security threat and instead stemmed from Anthropic’s objections to Pentagon plans for using its AI models.

US District Judge Rita F. Lin ruled late Thursday that the government failed to show Anthropic posed a national-security threat. Instead, she found that officials acted against the company after it publicly challenged the Pentagon’s plans for using AI.

“Defendants’ contemporaneous words and deeds confirm that the challenged actions were based on a desire to make a public example out of Anthropic for its ‘arrogance’ in criticizing the government,” Lin wrote.

The ruling requires the government to withdraw guidance, directives, and other communications that blacklisted Anthropic or labeled it a supply-chain risk.

Anthropic sued the administration in March after talks with the Pentagon over military use of its AI models broke down. The company had asked for limits on the use of its technology in fully autonomous weapons and domestic surveillance. The Pentagon wanted an agreement allowing the military to use Anthropic’s models for any legal purpose.

The dispute centered on whether Anthropic could place limits on how the government used its models after making them available to federal agencies. The Pentagon viewed Anthropic’s proposed restrictions as too narrow for military operations. Anthropic said the limits were needed for high-risk uses of AI.

Government lawyers argued that the Pentagon was allowed to choose vendors it considered reliable. They said Anthropic could make undisclosed changes to its models that might affect military operations.

“The Department of War needs to trust that its AI vendors are going to be forthright and honest with the department,” government attorney James Harlow said during court arguments.

Lin questioned that position during the case. At a July hearing, she called the government’s argument that it could retaliate against a contractor for criticizing the administration “really troubling” and “quite extreme.”

The designation had immediate business consequences for Anthropic. The company said the government action led to hundreds of millions of dollars in canceled, shortened, or delayed contracts. Documents filed in the case showed rivals, including OpenAI, were preparing to replace Anthropic in parts of the federal government.

The decision also comes as Anthropic’s technology remains in use across the US government. Claude has been used by the military, including in the January raid in Venezuela and the war with Iran. Other federal agencies continue to use Anthropic products, including Fable and Mythos.

Lin said that continued government use undercut the Pentagon’s claim that Anthropic was a national-security risk. She had previously issued a preliminary injunction in March that blocked parts of the designation while the case moved forward.

Anthropic and the administration reached a separate agreement in June that allowed the company to release Fable and Mythos following a shutdown tied to security concerns. That agreement did not resolve the lawsuit over the blacklist.

The Defense Department did not immediately respond to a request for comment. The administration could appeal Lin’s decision. A separate case involving Anthropic remains before a federal appeals court in Washington, which denied the company’s request in April to block other parts of the designation.