As the clock ticked down, schools were simply unprepared to be graded on their assignment.

Federal disability law has required local governments to make their websites accessible for decades.

Two years ago, during the Biden administration, the U.S. Department of Justice published a “final rule” spelling out how schools could measure whether their websites and mobile apps were accessible for students with disabilities, relying on widely accepted guidelines. The agency also set enforcement dates based on population size. For states and local governments with a population over 50,000, the first date would have taken effect later this week.

Experts told EdSurge at the time that it was an important milestone that shifted the burden of responsibility from families of students with disabilities — who often have to labor to even access class materials — and onto schools and the vendors that work with them. In the years after the pandemic’s forced switch to remote learning, it seemed even more vital.

But Monday, the DOJ published an “interim final rule” that postpones the compliance date to next year.

Disability advocates and policy experts had expected an extension. The federal government had been holding meetings about the rule, as EdSurge recently reported. Testimony revealed that governments were not going to be able to meet well-advertised deadlines, as EdSurge noted.

The extension will “ensure that covered entities better understand the rule’s substance to achieve compliance to the benefit of persons with disabilities,” according to a notice from the Justice Department.

To disability experts, that’s crucial.

The extra time is “not an invitation to pause” attempts to make sure websites and mobile applications are accessible to all, but rather a chance to get accessibility right, argues Glenda Sims, chief information accessibility officer at Deque Systems, a digital accessibility company.

Digital accessibility is in a different cultural moment than when the original enforcement deadlines were issued.

Schools are facing widespread fatigue and skepticism over their reliance on tech.

Plus, under the Trump administration, shredded grants, mass firings and shifting priorities mean that students with disabilities cannot rely on federal support. For instance, a nonpartisan government watchdog group noted federal actions have led to the dismissal of 90 percent of student civil rights complaints, including from students with disabilities.

Lately, accessibility lawsuits have surged, with more than 3,000 filed last year.

For schools and vendors, there’s still pressure to be proactive, experts argue.

Taking the next year to invest in accessibility will set institutions up to avoid an endless cycle of accessibility audits and remediation, according to Sambhavi Chandrashekar, global accessibility lead at D2L, which operates a learning management system. That means putting money into procurement systems, training for those who create course content, and tools that produce accessible content by default, she explained in a note to EdSurge. But that could prove useful. For example, a U.S. district court recently dismissed an accessibility lawsuit against a website for an eyeglasses vendor, which Chandrashekar attributes to the company’s ability to show it had a documented and ongoing accessibility program.

Right now, most schools are not accessible because they started too late, argued Sims of Deque, in a note to EdSurge. If schools interpret the DOJ’s extension as permission to delay accessibility efforts, they will fall farther behind, she added.

Schools that use this time to build resilient systems and treat accessibility like other responsibilities, such as security and privacy, will fare the best, Sims said.

When it comes to robots, few are as iconic as Robby. [Ogrinz Labs] has wanted to build one and even examined a real one up for auction to get high-res photos of it. He also combined his designs with some other open-source designs, and it looks good. He’s released his design as a Creative Commons-licensed set of STL files that you, in theory, could print. There are more details and instructions in the video below.

If you are looking for something quick to print for the weekend, this isn’t it. As you might expect, this is a lot to print. The creator admits, too, that it isn’t totally accurate. It has bigger feet, for example, so his feet can fit inside. There are a few other modifications made for different reasons, but only a hard-core Robby enthusiast would notice any of them.

In theory, you can wear the robot as a costume, but at the current height, it doesn’t look like that will work for the creator. Also, the joints that would make things rotate are still forward work, but he’s promised to provide updates.

Robby started out on Forbidden Planet and went on to appear in many other movies and TV shows. Much of the original body was vacuum-formed plastic (an early form of ABS known as Royalite).

Thanks to modern slicers, you can easily print the parts on your printer for later assembly, and the video shows you how. You can select what connectors are used, and while we like the dovetail mode for most of what we do, Robby’s clean surfaces need dowel connectors. We would be really excited to see someone take these files and make a working robot based on the design.

We’ve been watching this project for a while. If you are sorry you missed the auction of the original, you aren’t alone. But we couldn’t have afforded the $5,375,000 price tag anyway.

Apple is finally giving AirPods users something they’ve been demanding for years: proper control over sound.

With iOS 27, Apple is adding a custom equaliser to its AirPods lineup. For the first time, users can manually tweak how their headphones sound.

The new EQ option allows listeners to adjust key parts of the audio profile, including boosting bass, lifting treble, or shaping the overall sound signature to taste. It’s a straightforward addition. However, it is meaningful for anyone who has ever felt locked into Apple’s default tuning.

Until now, AirPods have largely relied on automated audio features rather than manual control. Tools like Adaptive Audio and Conversational Awareness already adjust sound in real time depending on what you’re doing or where you are. However, they don’t let users directly fine-tune the listening experience.

This article is crossposted from IEEE Spectrum’s careers newsletter. Sign up now to get insider tips, expert advice, and practical strategies, written in partnership with tech career development company Parsity and delivered to your inbox for free!

Early in my career, I walked into a shared office space on my first day as a full stack software developer and sat down between the CTO and the CEO to get onboarded. There were four of us in total. Before the day was over, I received my first assignment.

This was one of the most formative—and most stressful—experiences of my professional life. In the decade since, I have worked at half a dozen companies including Fortune 100 firms, mid-size startups, and companies you’ve probably never heard of. I have also spoken with roughly a thousand developers at various stages of their careers.

Most engineers entering the field are obsessed with landing at Google, Meta, or Amazon. But those roles represent approximately 0.6 percent of software engineering positions. For most of us, the real choice is between a small startup, a mid-size company, and a large enterprise. Each comes with tradeoffs, and your experience will differ from mine. What follows is an honest account of what you might reasonably expect.

The Small Startup

Pros

Your work actually matters. A feature you build might determine whether the company closes its next funding round. You gain exposure to the full spectrum of the business, from deployment pipelines to sales and operations and everything in between. You wear many hats out of necessity. For engineers who want to grow quickly and understand how a product is built end to end, few environments move faster.

Cons

Everything is on fire, always. Work-life balance is difficult to maintain when every release feels critical. Priorities shift without warning and culture tends to reflect the personality of whoever has the most influence in a small room. Startups optimize for speed over craft which means engineers learn to move fast but don’t always learn to build well, and that gap can follow you into your next role.

The Mid-Size Company

Pros

“So this is how a real business works.” There is process, documentation, a quality assurance function, and some form of career structure. The team is large enough to offer a diversity of experience and perspective. Stability is a myth, especially nowadays, but it is considerably more predictable than an early-stage startup.

Cons

“So this is how a real business works?” Processes that enable quality also produce friction. Access controls, approval workflows, and cross-team dependencies slow things down. The career ladder exists but it might stop at senior engineer. Without significant organizational growth, your salary and title can plateau early.

The Large Enterprise

Pros

That badge on your LinkedIn profile just bought you credibility for the next five years. Compensation at this level can be meaningfully higher, particularly when equity is included. The career ladder is long and clearly defined. Engineering practices at mature organizations tend to be more rigorous, and a well-known employer carries market value in future job searches.

Cons

It’s slow. Technology stacks often lag industry trends by several years. Political dynamics shape advancement as much as technical ability does. Skill atrophy is a risk when you spend years on a narrow slice of a legacy system. You are now a small fish in a big pond and it will be harder to get noticed.

The Roadmap I Would Take If I Could Start Over

According to a recent Stack Overflow survey, 47 percent of professional developers work at companies with fewer than 100 employees. This may surprise you because social media is dominated by engineers who work at the most well known companies on the planet.

The path most engineers imagine for themselves and the path most engineers actually walk are two very different things.

If I could do it again, here’s the path I’d take: Start at a small company to build breadth and learn how a business works across functions. This also provides some room to experiment within different roles. Next, move to a mid-size organization with a clear goal of reaching a senior or leadership role. Making a lateral move is easier than trying to get up-leveled at the next company. Finally, target a more mature company where a leadership position opens the door to meaningful equity and long-term growth (aka stocks and bonuses).

Each stop builds something the others cannot. The startup gives you range. The mid-size company gives you a taste of how larger orgs operate. The enterprise gives you leverage, credibility and maybe even some stability.

Your path will not look like mine. At a five person startup, I had no idea what I was in for. Looking back, I would not trade it. Just know what you are signing up for before you sign.

—Brian

“Social engineering” is a concept that has become associated with phishing, in which scammers manipulate people into disclosing personal information. But shaping human behavior in this way doesn’t have to have such negative effects. Systems engineer Guru Madhavan argues that we need to reclaim the term and govern the practice to defend ourselves from bad actors and benefit from social engineering’s good side.

Read more here.

Smartphone apps are increasingly used to help manage medical conditions, but many of these have not been verified by any regulatory agencies. To help ensure these apps are credible, the IEEE Standards Association recently launched a directory listing apps that have been vetted by experts for technical soundness, ethical design, data security and privacy, and clinical efficacy. The registry will be publically available at no cost, and developers can now apply for approval.

Read more here.

A veteran chip designer reflects on what he learned when moving from academia to industry, where the goal changes from proof of concept to ensuring a design works reliably at scale. Differences in risk tolerance, he discovered, lead to varying approaches in the rapidly growing semiconductor industry.

Read more here.

from the abusive-spying-is-abusive dept

President Trump’s highly politicized appointment of an entirely unqualified acting Director of National Intelligence (DNI) underscores why the government’s warrantless mass spying power must be reformed. 

Congress now faces a deadline of Friday, June 12 to reauthorize Section 702 of the Foreign Intelligence Surveillance Act, an unconstitutional program rife with problems, loopholes, and compliance issues. Section 702 allows the National Security Agency to collect communications from targets overseas – including communications with Americans in the U.S. – and stores them in massive databases. The NSA then allows other agencies, including the Federal Bureau of Investigation, to access untold amounts of that information.  

Under current practice, the FBI can query and even read the U.S. side of that communication without a warrant. What’s more, victims won’t even know and have very few ways of finding out that their communications have been surveilled. EFF and other civil liberties advocates have been trying for years to know how data collected through Section 702 is used in domestic investigations and prosecutions.  

Our advocacy to reform Section 702 has been consistent across administrations, including when the federal Intelligence Community was run by people with experience in the relevant agencies. In fact, the 2004 law creating the position of DNI – which coordinates America’s 18 spy agencies – requires those who hold it to have “extensive national security expertise.” 

Enter Bill Pulte. 

Trump on Tuesday named Pulte – currently director of the Federal Housing Finance Agency (FHFA) and chairman of Fannie Mae and Freddie Mac – to replace current DNI Tulsi Gabbard, who announced her resignation last month. Pulte lacks any intelligence, military, or congressional experience.  

“William has deep experience managing the most sensitive matters in America, the safety and soundness of the Markets, and over 10 Trillion Dollars at Fannie Mae/Freddie Mac, a substantial increase from where it was just 12 months ago,” Trump wrote on his Truth Social platform.

Because Trump named him acting DNI, Pulte isn’t subject to Senate confirmation. And under the Vacancies Act, Pulte could remain in the role for about seven months. 

This is particularly concerning because of Pulte’s history of using private information held by the government as a political weapon. In his FHFA role, he has accused several of the President’s political foes and targets – including New York State Attorney General Letitia James, U.S. Sen. Adam Schiff, D-Calif., and Federal Reserve governor Lisa Cook – of mortgage fraud based on private data held by his agency.  

All these targets and others have denied wrongdoing. A federal criminal complaint filed against James in Virginia imploded after a judge found prosecutor Lindsey Halligan had been unlawfully appointed, and prosecutors twice failed to convince a grand jury to indict James. Pulte’s accusations against Schiff, Cook, and others have not led to criminal charges. 

Pulte also used his FHFA pulpit to attack then-Federal Reserve Chair Jerome Powell and dismantle internal oversight. 

Pulte isn’t a qualified intelligence administrator. He does, however, seem to be unquestioningly loyal to President Trump and willing to use his position to attack and smear the President’s political foes. As acting DNI, Pulte would have access to every scrap of classified information the Intelligence Community holds, and under Section 702, that includes massive amounts of information about Americans. 

Even lawmakers who are typically friendly to the intelligence community acknowledge that this is a disaster in the making. U.S. Sen. Mark Warner, D-Va., who is the Senate Intelligence Committee’s ranking Democrat, told NPR that Pulte has “no experience in the military, no experience in Congress, no experience in the intel community or law enforcement” and was chosen because he is “100% loyal to doing anything and everything President Trump demands.” 

And Senate Majority Leader John Thune, R-S.D., told reporters “we don’t need a weaponized” national intelligence director. Asked about fears that Pulte might pursue Trump’s political opponents, Thune said: “We need professionals there.” 

Congress already has had trouble reauthorizing Section 702 as Freedom Caucus Republicans and many Democrats joined forces to demand reforms including the common-sense requirement that federal agencies get a probable cause warrant from a judge before searching any data involving Americans. Pulte’s appointment exemplifies why no administration should have the power granted by Section 702 without the independent judicial review required in seeking a warrant. 

Republished from EFF’s Deeplinks blog.

Filed Under: 702 reform, bill pulte, fisa, odni, section 702, surveillance

• Ukraine wants to flood future battlefields with millions of combat drones annually
• Kyiv says its drone factories could dwarf Russian and Chinese military production
• Ukrainian drones are now reaching military and energy targets deep inside Russia

Ukraine’s defense ministry has laid out a startling industrial vision which could reshape global military manufacturing.

Deputy Defense Minister Mstislav Banik recently told NATO lawmakers that his country could produce 20 million military drones each year if allied nations commit sufficient resources to Ukrainian production lines.

A security researcher has released a new Microsoft Defender zero-day exploit named “RoguePlanet” just hours after Microsoft fixed two previously disclosed flaws during June 2026 Patch Tuesday.

The researcher, known as Nightmare Eclipse, says the new vulnerability affects fully patched Windows 10 and Windows 11 devices, allowing attackers to spawn a command prompt with SYSTEM privileges via a Microsoft Defender race condition vulnerability.

The researcher shared a proof-of-concept exploit on Tuesday afternoon in a self-hosted Git repository after saying that GitHub and GitLab repositories hosting their exploits had previously been removed by Microsoft.

“The exploit is a race condition, so it’s a hit or miss. I have managed to get a 100% success rate on some machines while it struggled to work on others,” Nightmare Eclipse wrote in the repository.

The flaw was reportedly tested against Windows 11 Official and Canary builds, as well as Windows 10 systems with the June 2026 security updates installed.

When successful, a Windows command prompt will be spawned with SYSTEM privileges.

Cybersecurity firm ThreatLocker told BleepingComputer that they successfully reproduced the flaw in their testing and confirmed the exploit worked against fully patched Windows 11 systems with KB5094126 installed, and shared a video demonstrating it.

“Our initial analysis confirms that the RoguePlanet exploit is viable and performs as described. Organizations using application allowlisting can prevent the exploit from executing, providing an effective layer of protection against this attack,” Danny Jenkins, CEO of ThreatLocker, told BleepingComputer.

According to Nightmare Eclipse, RoguePlanet was originally developed as a remote code execution vulnerability that exploited Microsoft Defender’s handling of files hosted on remote SMB shares.

“In initial development, it was confirmed that this vulnerability was a remote code execution,” the researcher explained in a blog post.

“It required an attacker to coerce a victim to open a .vhd(x) in a remote SMB server, succesful exploitation resulted in defender overwriting its own files and obviously the end outcome was an RCE.”

The researcher says another attack scenario could lead to remote code execution simply by coercing a victim into opening an SMB share if symlink evaluation settings were enabled.

However, the researcher claims Microsoft silently hardened Defender in mid-May by patching “mpengine!SysIO*” API, which blocked junction attacks.

“Rewriting RoguePlanet to make it functional again drained my soul and I couldn’t complete the other scenarios and for now it remains unclear if RoguePlanet is limited to LPE or there is some sort of way to turn it into an RCE,” the researcher wrote.

The release is part of an ongoing dispute between Nightmare Eclipse and Microsoft over the company’s vulnerability disclosure and bug bounty practices.

Over the past several months, the researcher has publicly released multiple Windows zero-days, including the BlueHammer, RedSun, GreenPlasma, and YellowKey flaws. Some of the zero-days targeted Microsoft Defender, while others targeted BitLocker and Windows components. 

Microsoft fixed the GreenPlasma and YellowKey flaws today as part of the June 2026 Patch Tuesday updates.

Microsoft previously reacted to the disclosures with warnings that it would work with law enforcement when people engage in “malicious activity causing real harm to our customers,” leading many in the cybersecurity community to think Microsoft was threatening the researcher.

Nightmare Eclipse claims Microsoft repeatedly targeted and removed previous repositories hosted on GitHub and GitLab, prompting the creation of a self-hosted code platform at projectnightcrawler.dev.

BleepingComputer has contacted Microsoft about the new zero-day and will update the story if we receive a statement.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

In 2021, I was a demoralized educator: not burnt out, but demoralized. As I shared in my first article for EdSurge, demoralization occurs when teachers “encounter consistent and pervasive challenges to enacting the values that motivate their work.”

That year, the pervasive challenges seemed obvious and communal. We were all navigating online platforms, figuring out how to replicate student services virtually and struggling to make up for lost time in instruction, social-skill development and relationship-building for when students returned to in-person schooling.

When I think about what feels most pressing now, it seems those challenges persist but are perhaps less obvious to society at large. As the authors of “Going the Distance: The Teaching Profession in a Post-COVID World (2024)” wrote:

A crisis is not merely an event: it’s the context in which an event takes place and the response to that event.” The global pandemic has ended, but how much has the context changed and did the response meet the needs?

Right now, I believe teaching is the most important thing we can do. When the world is on fire, what feels most pressing is teaching students to claim their humanity and helping educators understand how much the communal learning experience matters. Five years later, I have come full circle.

This time, I return to that same claim with a broader and deeper understanding of what makes a school. We use that old adage, “It takes a village…” More and more, I see that we, as school communities, are the village and the villagers that we need right now. What really makes a school more human is not just the principals and teachers, but the child welfare staff, paraeducators, campus supervisors, guidance counselors, cafeteria workers, coaches, librarians, custodians and secretaries. The list is long, but it feels necessary to name the people on campus who make students feel like they belong, support them and have their backs when students need it. These are the colleagues who have shown me what it is like to truly model humanity to our students.

The truth is that the onus is on all of us to create an environment in which mutual respect and empathy are the baseline expectations. So, as an instructional coach, as a leader and as a voice of change in this context, what can I do? How do I communicate to teachers that, while they have been beaten down and blamed for society’s ills, they also have the herculean task of helping students learn how to be human together?

In 2021, I said that I was demoralized. In 2026, I am revitalized and committed to my role as an educator, instructional coach and teacher advocate.

Since participating in the inaugural cohort of the Voices of Change fellowship, I have contributed essays to The California Educator, Edutopia and EdSurge. I have joined podcast panels to talk about social-emotional learning, culturally responsive teaching and civil discourse in the classroom.

This fellowship showed me the power of personal writing for representation and advocacy. I have started to write children’s books about my own neurodivergent children. I have presented at local and state conferences and will continue to use my voice and my words to advocate for students, for educators, for quality professional development and schools that model the best of humanity. Writing for the Voices of Change fellowship has helped me claim my voice, my humanity and my power.

At long last, a corporate training you might actually enjoy.

ServiceNow is warning about a security incident after attackers exploited an unauthenticated access flaw through a vulnerable API endpoint, allowing them to query data from customer instances.

The company quietly warned impacted customers through a support bulletin and direct support cases after detecting “anomalous activity” related to the issue.

The bulletin, which is hidden behind ServiceNow’s customer support login portal, states that the company applied a security update to hosted customer instances on June 5, 2026.

“On June 5, 2026, ServiceNow applied a security update to hosted customer instances,” reads the support bulletin.

“The update concerned a security issue that could allow an unauthenticated user, in certain circumstances, to gain greater access to ServiceNow instances than intended.”

The company says this security update changes the API endpoint configuration to limit access to authenticated users only.

ServiceNow also confirmed that attackers exploited this flaw to successfully query the customer instance tables.

While ServiceNow did not disclose which data was accessed during the attacks, instances commonly store sensitive enterprise information, including IT support tickets, employee records, internal documentation, asset inventories, security incident reports, workflow data, and configuration details for corporate systems and services.

Support case information has become an increasingly popular target for threat actors, as tickets can contain credentials, API tokens, internal documentation, and authentication secrets shared during troubleshooting.

According to the advisory, ServiceNow has now opened support cases with affected customers. If a customer has not received one, they are not believed to be affected by the incident.

While ServiceNow has not publicly disclosed technical details about the flaw, administrators discussing the incident on Reddit say the issue appears to be tied to a REST endpoint at ‘/api/now/related_list_edit/create‘.

One commenter claimed the endpoint was configured with ‘requires_authentication=false‘, potentially allowing unauthenticated requests to access instance data. The security update released on Friday was allegedly used to set requires_authentication to true.

Numerous admins shared indicators of compromise, including API requests from the IP address ‘51.159.98.241,’ advising other administrators to review logs for requests to the vulnerable endpoint.

The bulletin states the issue primarily impacts customers running the Australia platform release or customers on older releases who made certain configuration changes.

“The security issue pertains to customers who are on the Australia platform release or made certain configuration changes to instances on releases prior to Australia,” ServiceNow warned.

BleepingComputer contacted ServiceNow earlier today after a reader alerted us to the incident, asking how long the activity had been ongoing, what caused the issue, and whether customer data had been stolen. We did not receive a response before publication.

ServiceNow says it is still evaluating whether it will publish a CVE for the issue.

Administrators are advised to review ServiceNow logs for requests to /api/now/related_list_edit, particularly from the IP address 51.159.98.241.

Impacted organizations should review exposed tickets and records for sensitive information, rotate credentials or tokens shared through support workflows, and ensure API logging is enabled.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper