Connect with us
DAPA Banner
DAPA Coin
DAPA
COIN PAYMENT ASSET
PRIVACY · BLOCKDAG · HOMOMORPHIC ENCRYPTION · RUST
ElGamal Encrypted MINE DAPA
🚫 GENESIS SOLD OUT
DAPAPAY COMING

Tech

This Week In Security: Microsoft On Microsoft, Register Your Domains, Linux On ARM, And FreeBSD Joins The File Cache Club

Published

on

Supply chain attacks continue, with Microsoft’s own open source Azure repositories being automatically disabled by GitHub following a compromise of the packages by the Miasma worm.

OpenSourceMalware reports that the infection resulted in 73 Microsoft-related package repositories being flagged and taken offline in a little over a minute by the GitHub automated security system, with over 40 repositories being related to Azure and the rest distributed across the Microsoft organization.

The center of the infection appears to be the Microsoft Durabletask package, which was previously compromised in May and used to push infected packages to PyPi. Considering that all of the supply chain worms also steal credentials for every service they can find in the build or developer environment they infect, it seems likely that credentials stolen in the original attack were never properly disabled.

Disabling the repositories can help stem the infected packages and GitHub actions from spreading and infecting more organizations, but of course any build processes depending on those packages will not function. In May, the Durabletask package showed over 400,000 downloads per month.

Advertisement

The OpenSourceMalware report includes a full list of the impacted repositories.

Microsoft Fixes GitHub Token Exploit

Microsoft has finally fixed a bug in GitHub which could steal a GitHub authentication token with access to all of an accounts repositories via the embedded web-based VSCode editor which is part of GitHub itself.

Ammar Askar discovered the bug and discusses it on their blog; by manipulating the sandboxed VS Code into treating an embedded web view as user keyboard strokes, it is possible to to cause it to install a VS Code extension which is then used to exfiltrate the GitHub authentication tokens of the user using the embedded VS Code instance.

TP-Link Taeover via Unregistered Domain

Julian B demonstrates capturing traffic from TP-Link routers and access points thanks to an unregistered domain name in the firmware.

Advertisement

After finding an archive of the firmware releases for every TP-Link product, Julian simplified the list to the latest versions, and ran a custom scraper tool to extract domain names referenced in the firmware and search for matching domain names.

After registering an available domain, Julian began receiving requests from TP-Link devices checking in to a server which had lapsed, likely years ago. Fortunately, Julian reported the issue to TP-Link and was able to transfer the domain.

It’s unclear what the risks of the unregistered domain name were in the context of the TP-Link devices, however unregistered domain names can lead to all sorts of issues in the wrong situations.

A Pile of OpenSSL Vulns

The OpenSSL library has a new collection of vulnerabilities which range from low-severity flaws in message verification in functions which aren’t used in any of the OpenSSL implemented protocols to a high-severity use-after-free bug in PKCS7 handling which could be used to run arbitrary code.

Advertisement

Use-after-free bugs occur when a chunk of memory is dynamically allocated, then freed and returned to the memory pool, but a later piece of code re-uses the memory that is no longer claimed. In the meantime, this memory could have been assigned to another variable or otherwise restructured, leading to memory corruption. In the case of OpenSSL, the memory associated with a PKCS7 container (a certificate storage method) or a S/MIME message (usually used in secure email) can be manipulated into using freed memory.

The advisory warns that applications processing PKCS7 or S/MIME are affected; fortunately most uses of OpenSSL are unlikely to be directly impacted (neither of those functions are common in web servers or similar), but as always, update as soon as possible!

NightmareEclipse is Back

The researcher previously identified as NightmareEclipse, known for releasing advanced Windows vulnerabilities with working proof of concept code, has returned as MSNightmare releasing several new exploits after previously being removed from GitHub. Despite a strongly worded (and poorly received) public statement by Microsoft threatening criminal investigations, the researcher returns with the RoguePlanet vulnerability.

RoguePlanet exploits race conditions in Windows Defender under Windows 10 and Windows 11 to gain a system-level shell, a fairly common trend in the vulnerabilities found by this researcher.

Advertisement

Additionally, another BitLocker bypass has been released, called GreatXML, which unlocks BitLocker protected drives if a Windows Defender offline scan has ever been run.

Of course, these releases coincide with Patch Tuesday, so they’re unlikely to be addressed before the July patch day.

It appears Microsoft has backed down from their initial press release which appeared to claim that vulnerability research and development outside of the guidelines Microsoft decided would be treated as criminal behavior; this was not well received by much of the security industry. At the start of the modern security industry in the late 1990s, public release of vulnerabilities was common. Companies had no way to reach a security contact to get it fixed, simply did not care to fix it, or were actively hostile to researchers. Through years and decades of community programs, it is now normal to reach out to a company with security flaws and have an expectation they will be fixed, and often rewarded either monetarily through structured bounty programs like HackerOne or through public credit to the researchers who found the flaws (nobody wants to be paid in exposure, but security is now an industry, and having a well-known name and track record can be valuable.)

Unfortunately, recently, it seems Microsoft may have forgotten that while disclosure to the vendor has become the norm, it is simply a social contract. Having already publicly alienated one skilled researcher (NightmareEclipse), the company seems to be doing the best it can to alienate others by burning community good will. Expect more publicly released vulnerabilities in the wake.

Advertisement

Linux Arm Fixes

Phoronix reports that the Linux kernel has patched a critical-severity flaw on Arm CPUs in the memory allocation logic. The list of processors affected continues to grow, including some NVIDIA embedded platforms.

The flaw lies in specific ordering requirements for accessing memory via the TLB, or “Translation Lookaside Buffer”, a critical part of the virtual memory and memory protection system. The TLB is a cache of recently resolved lookups of physical memory locations, so any corruption of the TLB can cause invalid memory reads, leading to almost the same results as recent kernel vulnerabilities in the Linux page cache system which allowed binaries to be replaced in RAM.

The bug was found thanks to advisories from Arm themselves clarifying that additional protections were needed around modifications to the TLB cache on these chips. The real-world impact remains to be seen, but now that the bug and patches are public, I’d expect proof of concept code to follow soon after. It’s also safe to assume that this flaw affects other operating systems on Arm platforms, as well, but there is no public information yet.

FreeBSD Gets a Page-Cache Bug

FreeBSD racks up another kernel bug this week, the amusingly named Bumsrakete (“Bum Rocket” or “Bang Rocket”), complete with a well-crafted troll of an announcement, right down to the use of Comic Sans for the announcement site.

Advertisement

Beneath the crap-posting exterior lies a legitimate CVE (CVE-2026-45257) where any user with access to the PMAP_HAS_DMAP system (the standard configuration) can overwrite the disk page cache in memory. This is the FreeBSD flavor of the kernel cache flaws in Linux used by CopyFail, DirtyPipe, and friends, and even involves decryption primitives in the kernel similar to the original CopyFail process.

It’s not surprising that following the multiple disk cache corruption bugs in Linux disclosed this spring, other operating systems with similar functionality are being examined and new flaws showing up.

NPM to Block Auto Install Scripts

NPM is introducing major changes in NPM 12 to attempt to stem the flood of supply-chain vulnerabilities by removing the automatic execution of commands from the install phase of packages and disabling the use of remote URLs as dependencies.

Most of the NPM-based worms infecting packages at record rates use the install script process, hooking either pre-install, install, or post-install scripts to run commands automatically as a package dependency is included. Since the install script runs as the user (or build service) pulling the dependencies, it has direct access to any credentials or files that user and service has. Under the new model an infected package could still perform malicious actions inside a compiled application or site, but a major mechanism for automatic spreading of malicious packages will be addressed.

Advertisement

It’s good to see progress made towards addressing the underlying weaknesses in the package ecosystem which aid in spreading malicious packages.

Libinput Security Fix

The libinput library sees a pair of security fixes this week, centered around the handling of device names for uinput and uhid devices. Maliciously named devices could execute commands as root.

To be able to exploit this, a user needs to already be on the system and have the ability to create new uinput devices. This is normally restricted to root, however if steam-devices, antimicrox, or kdeconnectd packages are installed, the permissions to create a device are modified and any user logged into the system can create a uinput device.

Go forth, and update!

Advertisement

Mini Shai-Hulud Hides in Censorship

The Shai-Hulud, Mini Shai-Hulud, and Miasma worms have been prolifically infecting packages on NPM and PyPi as well as VS Code extensions and GitHub actions. Using a combination of captured worm code and publicly released versions of the worms, researchers have been reverse engineering the behavior of the worm using the decrypted payloads.

Amusingly, they have discovered that the Mini Shai-Hulud worm attempts to hide from automatic analysis and detection via AI prompt injection. The payload file executed during a NPM package install contains a block of comment text referencing biological and nuclear weapons, topics many AI models refuse to allow.

Interpreting the comment as a banned request, the AI models may immediately stop processing the rest of the file, either blocking further analysis by researchers or disabling AI-based malware detection tools scanning for malicious payloads.

Another Record Patch Tuesday

For the second time this year, Microsoft has a record-breaking number of fixes included in Patch Tuesday with more than 200 security fixes, including fixes for two vulnerabilities released by NightmareEcllipse in recent weeks, however none of the fixes specifically reference the conflict between Microsoft and the researcher.

Advertisement

Outside of the Patch Tuesday fixes, Microsoft also fixed 360 browser vulnerabilities.

With the increasing automatic bug finding via AI tools, this may become the new normal for Patch Tuesday fix counts.

Python Linter Blocks Shai-Hulud

Sometimes pedantry pays off. StepSecurity brings the tale of a supply chain infection of the popular Pythagoria-io GPT Pilot package, an AI coding assistant tool. After one of the developers was infected by the Miasma supply chain worm, the worm performed the typical trick of attempting to reversion and push compromised versions of all accessible packages.

This time, the commits containing the trojaned were rejected by the Python linter, Ruff, for not matching the style guidelines of the project. Linters analyze code for style, comments, and syntax (think the pretty printing in a code editor that highlights incorrect tabs and spaces or deprecated functions.)

Advertisement

The developer will still need to clean up their system and make sure to revoke all tokens the worm has access to, but the project itself was spared infection by a humble syntax styler.

Deep Dive into Miasma

Finally, we have a dive into the Miasma worm thanks to SafeDep.

The payload source for Miasma has been open sourced, apparently by some of the developers of the malware. Previously the payload was heavily encrypted, however progress was made in decoding it during the initial wave of attacks. By open sourcing the worm, the developers likely hope to muddy the waters by creating copy-cat worms using modified techniques and signatures.

SafeDep takes a deep look into the capabilities of the payload, noting several unusual abilities including disabling GitHub environment protections, a full list of the credential harvesting capabilities, and more. Be sure to check out the full write up for an extremely detailed breakdown of each major component of the worm and the actions it takes, if that sort of thing is interesting to you!

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

Week in Review: Most popular stories on GeekWire for the week of June 7, 2026

Published

on

Get caught up on the latest technology and startup news from the past week. Here are the most popular stories on GeekWire for the week of June 7, 2026.

Sign up to receive these updates every Sunday in your inbox by subscribing to our GeekWire Weekly email newsletter.

Most popular stories on GeekWire

Source link

Continue Reading

Tech

A $200 ChatGPT subscription could cost OpenAI $14,000 if you actually used it to its full potential

Published

on

Bottom line: The math behind AI subscriptions is starting to look uncomfortable. Flat monthly pricing helped fuel the rapid adoption of tools like ChatGPT and Claude, but new analysis suggests those fees may not come close to covering the actual cost of heavy use. As users push these systems harder and more demanding AI workflows take hold, the gap between revenue and compute costs is becoming difficult to ignore.

SemiAnalysis has calculated how big that gap really is. After testing subscription tiers from both OpenAI and Anthropic – running long-horizon coding and agentic tasks until weekly limits were exhausted – the firm found that the cost of theoretical maximum usage of these plans if priced at standard API rates far exceeds what users actually pay.

A $200 ChatGPT Pro 20x subscription could cost as much as $14,000 in API pricing if fully utilized. Anthropic’s Claude Max 20x plan, also priced at $200 per month, has a comparable ceiling, with potential usage totaling roughly $8,000 in token costs.

Those figures help explain why utilization rates matter so much to the AI companies offering them. According to SemiAnalysis, Anthropic breaks even on Claude Pro and Claude Max 5x at around 20% utilization. OpenAI’s margin is thinner. It begins losing money on ChatGPT Plus and ChatGPT Pro 5x once usage climbs above 11.4%.

Advertisement

The economics get tighter at the high end. Anthropic reaches zero gross margin at roughly 10% utilization on its top-tier plans, while OpenAI crosses into negative territory at just 5.7%. It doesn’t take extreme use for these subscriptions to turn unprofitable.

Adjusting pricing or restricting access is not a straightforward fix. Subscription models have been central to user growth, and pulling back risks slowing momentum in a market where capabilities remain a key competitive differentiator.

Part of the pressure comes from how AI is actually being used. Token consumption is rising quickly, especially with agentic systems that can require up to 1,000 times more tokens than a standard prompt. That kind of demand is already forcing large organizations to rethink how freely these tools should be deployed.

Microsoft, Meta, and Amazon have reportedly pulled back from internal efforts that encouraged heavy usage after costs escalated. In one widely cited example, a company burned through $500 million in a single month using Anthropic’s Claude, largely because it failed to put limits on employee access.

Advertisement

That kind of overspending is pushing companies toward more controlled approaches. One strategy gaining traction is to shift workloads between models depending on the task. More complex queries go to expensive frontier models, while routine work is handled by cheaper alternatives.

The savings can be substantial. A Wall Street Journal report found that routing tasks this way can cut costs by up to 95%. “You don’t need a model that knows quantum gravity,” Columbia University vice dean Vishal Misra told the publication. “These open-source models are very capable, and the ability to charge a big premium for AI is going to diminish.”

Some companies have already made the shift. Flo Crivello, founder and CEO of AI assistant startup Lindy, announced that the company moved 100% of its traffic to DeepSeek V4, switching entirely away from Anthropic’s models. DeepSeek V4 proved comparable to Claude Sonnet at a fraction of the cost, and the move has “saved the company millions of dollars,” Crivello said.

Others are going further by building their own AI systems on top of open-source models trained on internal data. While that requires more upfront investment, it offers tighter cost control and reduces dependence on third-party providers. In some cases, these tailored systems may even outperform general-purpose frontier models for specific use cases.

Advertisement

There is some expectation that costs will ease over time. As infrastructure expands and newer models replace older ones, the cost of running mid-tier systems should decline. SemiAnalysis suggests that models at the Opus 4.8 level could eventually be delivered profitably for around $20 per month.

That does not apply to the most advanced systems, though. Frontier models, including those still in development, remain expensive to run. Their highest-end capabilities may increasingly be priced via APIs rather than bundled into consumer subscriptions.

For now, AI providers are juggling two forces: users want powerful tools at low, predictable monthly prices, but the infrastructure to run them remains costly and highly sensitive to usage. OpenAI CEO Sam Altman has acknowledged the tension, noting that rising token costs are becoming a serious issue and that the company is working to help users “get more value for less spend” when using ChatGPT.

Advertisement

Source link

Continue Reading

Tech

How to watch Ivory Coast vs Ecuador: Free Streams & TV Channels

Published

on

Watch Ivory Coast vs Ecuador free live streams from anywhere in the world as two dark horse go head-to-head in Philadelphia.

If you want to make a statement ahead of FIFA World Cup 2026, beating one of the tournament favourites in their own backyard isn’t a bad way to go about it.

Source link

Advertisement
Continue Reading

Tech

MCP solved tool calling. A2A solved coordination. What solves transport?

Published

on

The history of distributed computing is one of protocol proliferation followed by consolidation.

Common Object Request Broker Architecture (CORBA), Distributed Component Object Model (DCOM), Java remote method invocation (RMI), and early simple object access protocol (SOAP) competed for the enterprise integration market in the late 1990s before representational state transfer (REST) quietly won by being simpler and HTTP-native.

Extensible Messaging and Presence Protocol (XMPP), Internet Relay Chat (IRC), and a dozen proprietary protocols fragmented real-time messaging before MG telemetry transport (MQTT) and WebSockets carved out their respective niches. Every new computing paradigm generates a burst of competing standards, then slowly converges as implementations accumulate and interoperability becomes economically necessary.

The AI agent ecosystem is currently in the proliferation phase. Four significant protocols have been published in the past eighteen months: Model context protocol (MCP) from Anthropic in late 2024, agent communication protocol (ACP) from IBM Research in March 2025, Agent2Agent (A2A) from Google in April 2025, and agent network protocol (ANP) from an independent working group.

Advertisement

The W3C AI Agent Protocol Community Group has opened a standards track. The Internet Engineering Task Force (IETF) is receiving Internet-Drafts on agent transport. Conferences are running workshops on interoperability. Every week brings a new GitHub repository claiming to solve the agent communication problem.

Understanding where and how quickly this converges has real consequences for architecture decisions being made right now.

What the protocols actually solve

The proliferation looks more chaotic than it is, because most of these protocols address different layers of a stack rather than competing for the same slot. The confusion comes from marketing, which describes each as "the standard for AI agent communication" without specifying which aspect of communication.

MCP is a tool-calling interface. It defines how a model discovers what functions a server exposes, how to invoke them, and how to interpret the response. It is a typed remote procedure call (RPC) contract between a model client and a tool server, running over HTTP. The Linux Foundation confirmed more than 10,000 active public MCP servers and 164 million monthly Python SDK downloads by April 2026. MCP has already won the tool-calling layer. The standardization work is effectively done.

Advertisement

A2A is a task coordination interface. Where MCP defines how an agent calls a tool, A2A defines how two agents delegate a task. It introduces Agent Cards (capability advertisements), task lifecycle states, and three interaction modes: Synchronous, streaming, and asynchronous. Google donated it to the Linux Foundation in June 2025, and enterprise AI teams have adopted it broadly because it fills a real gap that MCP leaves open.

ACP is a message envelope format. Lightweight, stateless, designed for agent-to-agent message exchange without A2A's full coordination semantics. It is useful in systems where simple message passing suffices and A2A's task lifecycle overhead is unnecessary.

ANP is a discovery and identity protocol. It uses Decentralized Identifiers (DIDs) for agent identity and JSON-LD graphs for capability descriptions, providing a foundation for decentralized agent marketplaces where no central registry is required.

The stack that is emerging: Capability discovery via ANP or simpler registries, task coordination via A2A, tool calls via MCP, and lightweight messaging via ACP for cases that do not require full task lifecycle management. These layers complement rather than compete.

Advertisement

The transport problem that remains

Every protocol in this list runs over HTTP. This reflects where the protocols came from: Research teams, API providers, and enterprise software companies building systems where HTTP is an unquestioned assumption. HTTP is the protocol they know, the one their servers already speak, and the one that makes demos easy.

The production problem is that HTTP assumes a reachable server. Behind network address translation (NAT) — and 88% of networked devices sit behind NAT — there is no reachable server without a relay. For agent fleets that need to route tasks directly between peers across cloud boundaries, home networks, and edge deployments, this centralization forces every message through relay infrastructure. Relay infrastructure adds latency, cost, and a failure mode.

The application-layer protocols solve the semantics of what agents say to each other. They do not solve how agents find each other and establish direct connections. That is a session-layer problem, Layer 5 in the open systems interconnection (OSI) model and none of MCP, A2A, ACP, or ANP address it.

The technologies for solving it exist. UDP hole-punching with session traversal utilities for NAT (STUN) provides NAT traversal for roughly 70% of network topologies. X25519 Diffie-Hellman and AES-256-GCM provide authenticated encryption at the tunnel level without a certificate authority. Quick UDP internet connections (QUIC) (RFC 9000) or custom sliding-window protocols over user datagram protocol (UDP) provide reliable delivery without TCP's head-of-line blocking. These are the same primitives that WireGuard uses for VPN tunnels and that WebRTC uses for browser-to-browser media streams.

Advertisement

What differs in the agent context is capability-based routing. Agents need to find peers not by hostname but by what those peers can do. A research agent should be able to query "which peers have real-time foreign exchange data?" and receive a list of currently active specialist agents. This is closer to a service registry than to DNS, and it is a natural extension of ANP's design philosophy applied to the transport layer.

A handful of projects are assembling these pieces. Pilot Protocol has the most complete published specification, with an IETF Internet-Draft covering addressing, tunnel establishment, and NAT traversal for agent networks. libp2p provides a battle-tested foundation with similar primitives. The IETF's QUIC working group is developing NAT traversal extensions that will be relevant here.

What convergence will look like

The HTTP-based protocols (MCP, A2A) are already converging on stable versions. The next 12 months will see production hardening, security improvements, stateless MCP servers for horizontal scaling, better A2A federation — rather than new fundamental designs. The tool-calling and task-coordination layers are largely solved.

The transport layer is 18 to 24 months behind. Expect a period of implementation diversity as teams experiment with different approaches to peer-to-peer (P2P) agent networking, followed by consolidation around a small number of implementations once empirical data on performance and reliability accumulates. The IETF and W3C standardization tracks will likely produce something in the 2027-2028 window, by which time one or two open-source implementations will have accrued enough production deployments to establish de facto standards ahead of the formal specification.

Advertisement

For engineering leaders making architecture decisions today, the practical implication is layered adoption. The application-layer protocols are stable enough to build on. MCP adoption now is low-risk. A2A adoption for multi-agent coordination is reasonable with the expectation that the protocol will evolve. The transport layer is where you either build something custom and plan to replace it, or you evaluate early implementations knowing the space is still moving.

The teams that will have the most leverage when the transport layer stabilizes are the ones that designed their agent systems with a clean separation between application semantics (MCP, A2A) and transport (whatever sits below). Clean separation is cheap to implement now and expensive to retrofit later, a lesson the microservices era taught anyone who tried to add observability or circuit breaking to systems that had none.

Philip Stayetski is a co-founder of Vulture Labs.

Source link

Advertisement
Continue Reading

Tech

What Was The 2-Minute Rule On Netflix?

Published

on





There was a time when Netflix had a lot of confidence in the “2-minute rule.” This controversial method was the way the streaming giant determined whether a household had watched a movie or television show. Under this old policy, users only needed to watch 2 minutes of a show for it to count as a view. It didn’t even matter whether you watched it to the end or stopped after 2 minutes and 1 second: A view was a view so long as it passed that two-minute threshold.

The rule was first introduced in 2020 and represented a major shift from Netflix’s previous standard. In years prior, a title was considered “viewed” after a user watched 70% of the movie or episode. For a 90-minute movie, that works out to a little over an hour. While it’s not how you might traditionally define having watched something, 70% is definitely much closer to the definition than 2 minutes is. At the time, the company claimed that switching to the 2-minute rule was actually more truthful than any percentage would be. In a letter to shareholders (via GameSpot), the service believed that a flat two-minute threshold treated short and long content more equally.

Advertisement

Netflix has since ditched the 2-minute rule for a new metric

For context, at the time, the soon-to-be-shuttered Hulu was considering 10% watched as a view. Meanwhile, YouTube was counting 30 seconds as a view. That actually helps put this 2-minute rule in a new light: Most of the top streaming services were seemingly measuring viewer choice over 100% completion, and Netflix was merely following suit. 

Luckily for fans of accurate reporting, Netflix eventually backed down from the nonsensical time-based rule. After all, two minutes might not even get you to the opening credits of some movies or TV shows. The metric was providing numbers 35% higher than before, and that hardly seems fair to those involved. So, Netflix pivoted to a new way of evaluating user engagement.

Today, Netflix measures a title’s performance by dividing the total hours viewed by its runtime. That gives the streaming service a much more accurate estimate of total views, but one that still leaves room for all those people who only watch a couple of minutes of something. Now, for a 90-minute movie, two people watching half of it (or 45 people all watching the first two minutes) would count as one collective view. It’s still not perfect, but it’s at least considerably fairer.

Advertisement



Source link

Advertisement
Continue Reading

Tech

Canada’s Carney compares Anthropic shutdown to 2008 financial crisis, warns of AI “model risk”

Published

on

TL;DR

PM Carney says the Anthropic model ban shows the risk of AI over-reliance, comparing it to 2008’s systemic bank linkages ahead of the G7.

Canadian Prime Minister Mark Carney said Sunday that the US export ban that forced Anthropic to shut down Fable 5 and Mythos 5 demonstrates the danger of depending on a small number of powerful AI models. Speaking to reporters during a visit to Ireland, Carney framed the suspension as a warning about systemic vulnerability rather than a failure by any single company.

The situation we’re in collectively right now with Mythos and Fable is something that can happen with over-reliance on certain models,” Carney said. “Nobody’s done anything wrong in this situation, but we will have done something wrong if we just accept this, don’t take the lesson, don’t build out and diversify.

The former central banker then drew a direct parallel to the 2008 financial crisis. Carney, who led both the Bank of Canada and the Bank of England before entering politics, said “we have similar things in terms of model risk” and called for redundancy and diversity in AI infrastructure, the same principles regulators imposed on the banking system after the collapse of Lehman Brothers.

Advertisement

The analogy carries weight because of who is making it. Carney was governor of the Bank of Canada during the 2008 crisis and subsequently became the first non-British governor of the Bank of England, where he spent six years strengthening financial system resilience. When he warns that concentrated AI dependence mirrors the systemic linkages that nearly destroyed the global banking system, the comparison draws on direct experience rather than rhetorical convenience.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

Carney said there is a “good flow of information” between the Canadian and US governments on AI and acknowledged that Washington has identified “some risks” with Anthropic’s latest models. But his emphasis was on the structural lesson, not the specific dispute between Anthropic and the US Commerce Department.

Advertisement

The comments arrive days before the G7 summit in Évian-les-Bains, France, which runs from 15 to 17 June and has AI governance prominently on its agenda. Anthropic’s Dario Amodei, OpenAI’s Sam Altman, and Google DeepMind’s Demis Hassabis are all slated to attend a working lunch with G7 leaders on Wednesday. Carney said he has already discussed AI with French President Emmanuel Macron.

We need to make progress” on AI, Carney said, but cautioned that “there will not be a mission accomplished banner that comes out of the G7.” The remark suggests Canada will push for substantive commitments on AI diversification at Évian rather than symbolic declarations.

Canada has been positioning itself on this front. On 4 June, Carney launched “AI for All,” a $2.3 billion national AI strategy that includes sovereign computing infrastructure, a national supercomputer, and plans to raise business AI adoption from 12% to 60% by 2034. The strategy explicitly frames dependence on foreign cloud providers as a vulnerability.

The Anthropic suspension has now given Carney a concrete, real-time example to cite at the G7. A US government decision to invoke export controls against a single AI company cut off access to its most capable models for every user outside the United States, including allies. For G7 nations building their economies around AI capabilities they do not control, the implications are difficult to ignore.

Advertisement

Carney’s Ireland visit also produced a bilateral agreement between Canada and Ireland on AI cooperation, tech collaboration, and food security. Ireland currently holds the presidency of the Council of the European Union, making it a strategic partner for Canada as it seeks to deepen ties with Europe on AI, defence, and critical minerals.

The broader pattern is accelerating. The EU published a tech sovereignty package earlier this month curbing US cloud dependence. India has proposed a $5 billion sovereign AI fund in the wake of the Anthropic suspension.

Britain’s Cosine is rallying BT, HSBC, and BAE to build a sovereign frontier model. Carney’s 2008 analogy suggests he sees these as early moves in a structural realignment, not isolated reactions.

Advertisement

Source link

Continue Reading

Tech

I tried ASUS’ ROG Xbox Ally X20, and the 171-inch screen changes everything

Published

on

Gaming handhelds are great because they are portable (basically small). But that is also one of its biggest weaknesses. I was reminded of that while trying Asus’ new ROG Xbox Ally X20 bundle at Computex 2026. On its own, the Ally X20 is already a more polished version of the ROG Xbox Ally X. It arrives with nice updates that sound minor on paper but make a device feel more complete in your hands. The real surprise, though, was the bundled ROG XREAL R1 Edition 20 Gaming AR Glasses.

I walked in to try the 20th anniversary edition of ASUS’ handheld console, but the massive 171-inch screen trick surprisingly stole the show.

The handheld gets the right upgrades

The ROG Xbox Ally X20 is not a total reinvention of Asus’ Xbox-branded handheld. It still sits in that familiar Windows handheld space, with PC gaming power, Xbox integration, and the usual promise of taking your library anywhere. Everything ASUS changed here is to smooth out the experience, and you can feel it as soon as you actually hold it.

The biggest upgrade is the display. The X20 moves to a 7.4-inch OLED Nebula HDR panel, which is slightly larger than the standard Ally X screen and far more exciting visually. It supports a 120Hz refresh rate, FreeSync Premium Pro, Dolby Vision, and up to 1,400 nits of peak brightness.

The controls have also been cleaned up. ASUS added TMR joysticks, a Transforming D-pad that can switch between four-way and eight-way control, improved face buttons that sit more flush with the chassis, and rubberized grips on the back that definitely offer improved handfeel, which is important for gamers. A few extra fps, thanks to a faster chip, is great, though bad grips, mushy controls, or a weaker display are something you’ll notice every time you start playing on the gaming handheld.

Advertisement

Then ASUS straps a giant screen to the idea

The bundled ROG XREAL R1 Edition 20 glasses are what make ASUS’ portable console a little more interesting than the new Intel G3 Extreme-powered handhelds. Even at their largest, handheld screens are still handheld screens. Admittedly, that is part of the appeal. If you wanted a bigger screen, you’d likely go for a gaming laptop. For many, this is exactly what they want: a smaller window into big games.

Except that the glasses still change that equation. They can project a virtual display up to 171 inches at 4 meters, which sounds absurd until you actually put them on. Now, you’re not relying on the handheld screen anymore, and the Ally X20 becomes an oversized controller, which is powering a much larger screen.

During my hands-on with this ROG Xbox Ally X20 with the XREAL R1 Edition 20, I understood why the bundle exists. ASUS pairing these two gadgets together makes it all the more immersive. This isn’t the first time a pair of gaming AR glasses has been built for handhelds, but the Ally X20 bundle is the exception as it comes with the ROG XREAL R1 Edition 20, which is also optimized for this system in particular.

How AR glasses just work here

Gaming AR glasses have been pretty niche in the overall PC and console gaming segment. However, you are already holding a portable console in your hands, which comes with its own set of cables, chargers, and a case. So adding another peripheral doesn’t sound too inconvenient. The fact that you can stay portable, while the glasses let the display feel massive when you want it to, sounds incredibly fun.

Not everyone would want this bundle, but the ROG XREAL R1 Edition 20 glasses complete it. They turn the Ally X20 from a nicer handheld into a more flexible gaming setup. You get the benefit of both a convenient form factor console with a 171-inch virtual screen when you want a more immersive experience.

Source link

Advertisement
Continue Reading

Tech

Moderns TVs are getting lost in the weeds of measurements and specs

Published

on

When you buy a TV, what motivates the purchase: Picture quality? Value? Screen size? Brand loyalty?

Is brightness in nits, dimming zones and Delta E colour accuracy among those ‘needs’. I’d hazard a guess and say ‘probably not’.

Which is not to say that these areas are not important, but I’d make an assumption that most of the TV buying audience is not au fait with these areas – some won’t know their nits from their candelas, and others just won’t care.

And that’s fine.

Advertisement

But the TV market seems to have developed a fixation with measurements and numbers, and it’s become a question of to what end?

Advertisement

Playing the numbers game

For the most part, you’re unlikely to come across these technical terms during your TV buying experience. Browsing the likes of Currys, Amazon and Richer Sounds, you’ll be exposed to the marketing ramble, most of it words that look like they could be equations or formulas (NQ4 AI Gen3, a9 AI processor).

On our side, the reviewers’ side, we get this as well as insight on the technical side. Of course, we need to know how they work, but I won’t lie in saying that some of this stuff goes over my head and requires educating myself and asking questions.

Advertisement

The more advanced TVs get, the more complex they become to understand. The use of AI has, in a way, accelerated this complexity faster. AI is often used as a blanket term for tech. For some TV manufacturers, as part of their brand story, it’s easier to say AI to get people interested and fit as part of the overall story in tech.

TCL SQD-MiniLEDTCL SQD-MiniLED
Image Credit (Trusted Reviews)

AI has helped TVs achieve a higher level of performance. But it’s also turned TVs into a numbers game – my number is bigger than yours.

But what does it really mean? If I have a TV from Samsung, LG, Sony, Hisense and TCL and they all hit 3000 nits of brightness, which is better? The one with more dimming zones? The one that covers the widest colour spectrum? The one with the best Delta E number?

Advertisement

Focusing on these areas turns it into a specs battle, and for most people, none of these measurements will have much context in their living room. If the picture looks good, then it looks good. Things like Delta E, tone mapping, and colour gamut – they’ll end up just confusing the buyer or making decisions more complicated, not easier.

Advertisement

Welcome to the real world

The TV that prompted this discussion was the Hisense UR9.

On paper, this TV has stonking specs. It’s an RGB Mini LED, brand new technology to the TV market that allows for purer colours, displaying a wider range of colours than more conventional LCD TVs and doing so with more accuracy. The number of dimming zones is nearly 1000, it claims to hit peak brightness levels of 4000 nits. All these specs suggest a Bona fide contender.

So why was I left underwhelmed by the UR9’s picture?

Colours weren’t that punchy or bright. The levels of sharpness and detail were less than those of an LG OLED65G6 sat next to it. The Dynamic mode, which should be the brightest, looked dull. Filmmaker mode, Cinema mode and IMAX Enhanced mode all looked identical to the point where I thought something must be wrong with the TV.

Advertisement

Advertisement

Having reviewed the U8Q in 2025 and hailed that as the best Hisense TV I’d tested, the UR9 felt as if the balloon had popped, leaving me deflated.

Hisense UR9 Alien RomulusHisense UR9 Alien Romulus
Image Credit (Trusted Reviews)

Reasons? I don’t think the anti-reflection/anti-glare screen worked in Hisense’s favour, as it seemed to shave off levels of detail, sharpness, and reduce contrast, which I also noted on Hisense’s Canvas TV. Highlights and overall brightness weren’t as high as measurements suggested, black levels not as strong or as deep as I hoped.

Viewing angles weren’t great either, like down to the type of panel used, and colours were a bit off despite many reviews noting the accuracy the UR9 out of the box.

But something just wasn’t quite right with the TV’s picture performance.

Advertisement

Personally, I wonder if this is down to Hisense’s PQ philosophy, or how it views colour. Every brand has a PQ philosophy; Sony wants to reflect the creator’s intent, as do LG and Panasonic, while Samsung wants to do that and offer the brightest, most colourful picture experience with any technology it gets its hands on.

Advertisement

But I can’t quite discern what Hisense’s philosophy is. In the past I’ve found its TVs have relied heavily on Dolby Vision, which is not their PQ philosophy but Dolby’s.

Earlier this year, I witnessed a shootout between several TVs: OLED, Mini LED, RGB Mini LED, and SQD Mini LED. The model that fared the worst was the Hisense, with all the test patterns and demos causing some sort of issue.

Advertisement

One pattern in particular showed Hisense’s lack of precision. The pattern was a white rectangle surrounded by green. The rest of the TVs showed the white rectangle as white – the Hisense showed the white rectangle to be a shade of green…

The gist of all this? What the specs say on paper doesn’t always translate to the real world.

Don’t be swayed by the specs, the charts, the stats. Not everything is always what it appears to be.

Advertisement

Advertisement

Source link

Continue Reading

Tech

UFC White House live stream: how to watch Topuria vs Gaethje online

Published

on

UFC White House live streams will be an MMA event like no other, as the Octagon takes up residence on the South Lawn of the White House in Washington, DC, to mark the upcoming 250th anniversary of the United States on July 4 — and, more specifically, President Donald Trump’s 80th birthday on Sunday. With headliners from the US, Georgia, Brazil and France, the event also known as UFC Freedom 250 is a surprisingly multinational affair.

While there will doubtlessly be no end of pomp and pageantry taking place over the weekend, there’s the serious matter of two UFC titles up for grabs in a co-main event. At the very top of the bill is Ilia Topuria vs Justin Gaethje, with the former defending his Lightweight title. The unbeaten champion is one of the most dominant fighters in the organization and is sure to be a mainstay for years to come, while for ‘The Highlight’ it’s surely the last opportunity to win the belt outright as Gaethje approaches his 38th birthday.

Source link

Advertisement
Continue Reading

Tech

IQM adds Vanguard director to its board as Europe’s first quantum Nasdaq listing nears

Published

on

TL;DR

IQM added Vanguard director Barbara Venneman to its board as it nears a $1.8bn Nasdaq listing, Europe’s first for a quantum computing company.

IQM Quantum Computers, the Finnish maker of superconducting quantum systems, has appointed Barbara Venneman to its board of directors as the company approaches what would be the first Nasdaq listing by a European quantum computing company. Venneman currently serves on the board of Vanguard, one of the world’s largest investment management firms, and previously led Deloitte Digital globally. The appointment signals that IQM is stacking its governance with public-markets experience ahead of a shareholder vote scheduled for June 25.

That vote will determine whether IQM completes its merger with Real Asset Acquisition Corp (Nasdaq: RAAQ), a special purpose acquisition company based in Princeton, New Jersey. The deal, announced in February at a pre-money valuation of $1.8 billion, would give IQM a primary listing on Nasdaq with a potential dual listing on the Helsinki Stock Exchange. The SEC declared the registration statement on Form F-4 effective on June 5.

The transaction has gained momentum since February. IQM and RAAQ announced an upsized PIPE of $146 million in early June, up from an initial $134 million commitment, after Finnish pension insurer Ilmarinen joined existing institutional investors. Combined with cash from RAAQ’s trust account, an earlier €50 million financing from BlackRock, and IQM’s existing balance sheet of $172 million, the company expects to hold more than $450 million in cash at closing.

Advertisement

IQM’s commercial profile sets it apart from the cloud-only quantum providers that have dominated the US public market so far. The company builds full-stack superconducting quantum computers for on-premises deployment, giving customers direct ownership of the hardware rather than API access to shared systems. It has sold 21 quantum systems to 13 customers, including four of the ten largest supercomputing centres in the world, and ships what it describes as 15% of all publicly disclosed quantum systems globally.

The company reported verified 2025 revenue of approximately €31 million ($36 million) and more than $100 million in cumulative bookings and order visibility. Founded in 2018 as a spinout from Aalto University and VTT Technical Research Centre of Finland, IQM now employs more than 400 people across Europe, Asia, and North America. Its technology partners include Nvidia, Hewlett Packard Enterprise, and AWS, which made IQM’s Garnet processor the first quantum system available via AWS cloud in the European Union.

Venneman brings more than 30 years of experience in digital transformation and enterprise technology commercialisation. She also serves on the board of advisors at Decagon.AI, an enterprise AI software company, and holds an MBA from McGill University and a computer science degree from the Université de Montréal. IQM’s board chair Sierk Poetting said her background in “enterprise technology commercialization, AI, and governance” would be valuable as IQM scales its commercial presence in the US.

The board also reshuffled its founder representation. CEO and co-founder Jan Goetz will replace co-founder Juha Vartiainen as the founder representative on IQM’s board, consolidating the company’s executive and governance leadership under the same person as it transitions to public-company reporting requirements.

IQM is not the only quantum company taking the SPAC route to public markets. Infleqtion listed on the NYSE earlier this month, and Horizon Quantum Computing has pursued a similar path. The SPAC structure carries well-documented risks, with the 2021 wave of blank-cheque listings producing widespread underperformance. IQM’s deal will test whether a European hardware company with real revenue, institutional backing from BlackRock and Finnish pension capital, and a $1.8 billion valuation can break that pattern.

Advertisement

Source link

Continue Reading

Trending

Copyright © 2025