from the ctrl-alt-speech dept

Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw.

Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed. To get extended episodes with additional coverage, support us on Patreon.

In this week’s roundup of the latest news in online speech, content moderation and internet regulation, Ben is joined by Cori Crider, executive director of the Future of Technology Institute, an independent non-profit focusing on technology that serves the public. She previously co-founded legal non-profit Foxglove and led national security litigation at human rights organisation, Reprieve. Together, Ben and Cori discuss:

And in the extended episode for Patreon supporters, they cover:

Our fun links this week are the rise of dopamine sites (Ben) and Polaroid’s billboard campaign (Cori).

If you’re already a Patreon supporter, you can get the extended episode on Patreon.

Filed Under: australia, child safety, content moderation, eu, germany, social media, trust and safety

Companies: eurosky, funk, meta, tiktok

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned on Wednesday that attackers have begun exploiting a high-severity Microsoft SharePoint remote code execution vulnerability.

Tracked as CVE-2026-45659, this security flaw stems from a deserialization of untrusted data weakness, and it allows attackers with low privileges to execute arbitrary code on unpatched SharePoint servers in low-complexity attacks that don’t require user interaction.

“Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges. In a network-based attack, an authenticated attacker, who has a minimum of Site Member permissions (PR:L), could execute code remotely on the SharePoint Server,” Microsoft explains.

“The attack vector is Network (AV:N) because this vulnerability is remotely exploitable and can be exploited from the internet. The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”

Microsoft released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition to address this vulnerability on May 21, saying that the CVE had been accidentally omitted from the May 2026 Security Updates.

Internet security watchdog group Shadowserver is currently tracking over 10,000 SharePoint servers exposed online. However, there is no information regarding how many of these devices have already been secured against ongoing CVE-2026-45659 attacks.

​With the April 2026 Patch Tuesday, Microsoft addressed another SharePoint vulnerability that was exploited in zero-day attacks.

On Wednesday, CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog (KEV), ordering Federal Civilian Executive Branch (FCEB) agencies to secure their servers by Saturday, as required by Binding Operational Directive (BOD) 26-04.

BOD 26-04 was issued last month and requires U.S. federal agencies to prioritize patching based on whether the security flaw is included in CISA’s KEV catalog, whether exploitation can be automated for large-scale attacks, whether the asset is publicly exposed online, and whether successful exploitation grants attackers partial or total control of the targeted device.

“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency warned yesterday. “Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.”

Since 2021, CISA has tagged 11 Microsoft SharePoint vulnerabilities that have been abused in the wild, with seven of them also exploited in ransomware attacks.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

PlayStation Underground captured the scene at Sony Disc Manufacturing in Springfield, Oregon, just after 7 a.m. The night shift had already run for hours, and stacks of fresh discs waited for the next steps. Everyone asked the same question back then. How did those distinctive black PlayStation CDs actually get made?

Security began at the mastering room door. To be safe, all workers donned safety gear, coveralls, and shower caps. Any of them leaving a stray hair or skin cell behind could be disastrous for the production line. However, that area had to remain sealed and locked down because the master discs within were gold, which was extremely precious.

PlayStation 5 Portal Remote Player – Midnight Black

• Play Your Game Collection with Remote Play – PlayStation Portal Remote Player can play compatible games you have installed on your PS5 console…
• Cloud Streaming from the Game Catalog and Classics Catalog – Discover an awesome library of PS5 games on the PlayStation Portal Remote Player with…
• Cloud Streaming for PS5 Games in Your Library – With PlayStation Plus Premium, stream select digital PS5 games in Your Library from PlayStation Store…

Previously, game makers would transmit their finished products on a special gold master CD. It was nothing more than a jumbled mess of zeroes and ones, yet a laser would cut through it all, flashing on and off as it imprinted the same sequence onto a glass master disk. The disc was coated with some ultra-sensitive film, and after being exposed to that laser, as it was washed down, all of the empty film was rinsed away, leaving a microscopic spiral of tiny pits and lands so precise that you could stack a strand of hair on top of 40 of the little guys.

That glass master held the game, but it would never withstand the high-volume pressing procedure that followed. So, initially, a technician would meticulously make a metal stamper out of it, and that stamper would be responsible for all of the hard work of pressing the game onto thousands of discs. Then followed a batch of plastic pellets, which were dumped in handfuls on the floor. Machines heated them until they were the viscosity of thick syrup, then pressed them into a mold with the stamper, resulting in a flawlessly shaped disc with the stamper’s design imprinted on its surface. This time, black colorant was also thrown in, and it was this colorant that gave every PlayStation disc its signature dark appearance while also adding a small extra barrier against duplicating.

The next task on the list was to apply a thin layer of metal. Without it, the laser inside the console would have nothing to bounce against. That was what transformed the very tiny pits and lands into usable data that the console could later use to generate pictures, sound, and gameplay, and before long, the all-important quality control test arrived. A series of automated equipment inspected each disk for flaws. Any CDs that did not pass the test were immediately recycled. And no disc left the line unless it satisfied the stringent specifications required for smooth play.

Up next was the all-important artwork, and this was where screens came into play, painting on one colour at a moment across the top surface. Then came the ultraviolet lamps to set the color in place. Then it was back to the painting station to repeat the same process. This was the component that gave each game its own cover image without smearing or fading. Special trucks were guided by a computer and just rolled along a predetermined path in the facility; no one had to push or pull a single disk. As a result, 375 people were able to move more than 6 million discs per month, primarily for games, music, and software items.

Robert Pollard and Guided By Voices (GBV) have again bestowed upon us another excellent new album: Crawlspace Of The Pantheon. A dandy rocker in grand GBV form, this is easily the band’s best since the last best one, which for me was 2025’s Thick Rich And Delicious. And I mean that with all the heart and soul of the deep fan that I am.

While no band likes to be pigeonholed, I sometimes think Guided By Voices deserves its own genre to describe what they do. Initially, I was thinking “Modern Classic Vintage British Rock,” but since GBV are from Dayton, Ohio, perhaps we should just call it “Modern Classic Vintage Rock.”

For me, GBV fills a musical void dating back to my childhood, when everyone anticipated a new Beatles album every six months or so. It was an event. In their own special way, a new GBV release is also an event, chock full of fresh earworms that feel familiar yet new.

Crawlspace Of The Pantheon is another solid sounding, well produced, full studio effort from the band, retaining just enough indie rock aesthetic to make clear that it is a GBV made, self-released, home brewed production. The current GBV is arguably the band’s most consistent lineup, achieving a super appealing balance between its glossier late 1990s and early 2000s first commercial peak, including Do The Collapse and Isolation Drills, and the early LoFi cassette multitrack basement wizardry that first put them on the map in the early 1990s, including Propeller and Bee Thousand.

 
“Lost In The Sun” kicks off Crawlspace Of The Pantheon echoing The Who and The Cars in the same breath, with Mellotron strings and tight harmonies. Saving its best hook for the very end, the song is one of those tunes I had to immediately play over and over.

“We Outlast Them All” could be a hit single for The Psychedelic Furs. Seriously, I cannot not hear Furs founder Richard Butler singing this song, even though it feels lyrically GBV autobiographical, a grand affirmation of the group’s staying power.

Another single candidate, “Advance Without Dropping,” packs a punch and is elevated by an incredible changeup in its ending bridge sequence: a mesmerizing, rising Doug Gillard guitar solo moment that sends quick chills down the spine.

If “Arthur Square” might be considered a lost cousin to 1969 pre Tommy Who, Mark Shue’s mad bass lines and Kevin March’s rolling drum fills appropriately channel the spirits of John Entwistle and Keith Moon, respectively. Gothic bells, more Mellotrons, and voiceover news reports turn this into a mad, brilliant psychedelic metal meltdown.

“(How Would You Like A) Chariot Ride” riffs on a chord sequence that cleverly echoes “The Punk And The Godfather” from The Who’s Quadrophenia. Try not humming Roger Daltrey’s stuttered “My Generation” melody over that moment.

“When You’re My Clown (Nothing Happens)” is an epic album closer, built around a tremendous chugging communal riff before launching into a beautiful acoustic driven coda. A classic GBV moment.

I think by now you get the idea Crawlspace Of The Pantheon is another shining crazy diamond in a long arc of winning musical gems from Guided By Voices. You can buy it at Amazon on vinyl for $26.39 or on CD for $17.98. Support independent music.

Our Ratings

★★★★★★★★★★ Album

★★★★★★★★★★ Sound Quality

★★★★★★★★★★ Pressing Quality

Where to buy

Mark Smotroff is a deep music enthusiast / collector who has also worked in entertainment oriented marketing communications for decades supporting the likes of DTS, Sega and many others. He reviews vinyl for Analog Planet and has written for Audiophile Review, Sound+Vision, Mix, EQ, etc.  You can learn more about him at LinkedIn.

Related Reading:

Plus, we dive into Sony dumping PlayStation discs.

Credits

Looking for the most recent Connections answers? Click here for today’s Connections hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle, Connections: Sports Edition and Strands puzzles.

Today’s NYT Connections puzzle has some fun words in the grid. You might recognize the blue category right away. Read on for clues and today’s Connections answers.

The Times has a Connections Bot, like the one for Wordle. Go there after you play to receive a numeric score and to have the program analyze your answers. Players who are registered with the Times Games section can now nerd out by following their progress, including the number of puzzles completed, win rate, number of times they nabbed a perfect score and their win streak.

Read more: Hints, Tips and Strategies to Help You Win at NYT Connections Every Time

Hints for today’s Connections groups

Here are four hints for the groupings in today’s Connections puzzle, ranked from the easiest yellow group to the tough (and sometimes bizarre) purple group.

Yellow group hint: Keep at it.

Green group hint: Limerick is another one.

Blue group hint: Cheers!

Purple group hint: Not sour.

Answers for today’s Connections groups

Yellow group: Persist.

Green group: Kinds of poems.

Blue group: Tropical drinks.

Purple group: Sweet ____.

Read more: Wordle Cheat Sheet: Here Are the Most Popular Letters Used in English Words

What are today’s Connections answers?

The yellow words in today’s Connections

The theme is persist. The four answers are continue, last, linger and stay.

The green words in today’s Connections

The theme is kinds of poems. The four answers are ballad, epic, ode and villanelle.

The blue words in today’s Connections

The theme is tropical drinks. The four answers are hurricane, painkiller, scorpion and zombie.

The purple words in today’s Connections

The theme is sweet ____. The four answers are dreams, nothings, pea and spot.

Alibaba has banned its employees from using Claude Code, Anthropic’s AI-powered coding agent, after security researchers discovered that the tool contained hidden code designed to identify Chinese users. The ban, effective 10 July, follows weeks of escalating conflict between the two companies over allegations that Alibaba stole Anthropic’s AI capabilities through industrial-scale distillation.

“As Claude Code was recently discovered to carry back-door risks, after comprehensive evaluation, Claude Code has now been added to a list of high-risk software with security vulnerabilities,” Alibaba said in an internal notice reported by the South China Morning Post. The company recommended employees use Qoder, its own coding agent platform, as a substitute.

How the tracking worked

A Reddit user identified as LegitMichel777 reverse-engineered Claude Code on 30 June and found obfuscated code that had been silently present since version 2.1.91, released on 2 April, with no mention in the release notes. The code checked whether a user’s system timezone was set to Asia/Shanghai or Asia/Urumqi and scanned proxy URLs against a hardcoded list of Chinese domains and AI lab addresses.

Rather than logging the results conventionally, the system used steganography to hide its signals in the system prompt sent back to Anthropic’s servers. If the timezone was Chinese, the date format changed from dashes to slashes, and the apostrophe in “Today’s date is” was swapped with one of three visually identical but technically distinct Unicode characters depending on which flags were triggered.

The alterations are invisible to human users and potentially even to the AI model itself, but they are machine-parseable by Anthropic’s servers. Portions of the detection code were XOR-obfuscated with the key 91, a technique used to prevent plain-text extraction during code analysis.

Anthropic’s response

Thariq Shihipar, an Anthropic engineer on the Claude Code team, said on X that the tracking was “an experiment we launched in March that was meant to prevent account abuse from unauthorised resellers and protect against distillation.” He said the team had been “meaning to take this down for a while” and that the pull request to remove it was merged on 1 July.

The rollback coincided with the restoration of Anthropic’s Fable 5 and Mythos 5 models, which the US Commerce Department had ordered the company to disable for all foreign nationals in mid-June after Amazon researchers found a jailbreak vulnerability. The export controls were lifted on 30 June, and Anthropic restored access on 2 July, saying it would “scale up government collaboration” on frontier AI security.

The distillation backdrop

Anthropic’s justification for the tracking code sits within a broader campaign against what it calls systematic theft of its models’ capabilities. In a letter to the US Senate Banking Committee on 10 June, the company accused operators affiliated with Alibaba’s Qwen AI lab of running the largest known distillation attack on Claude, using roughly 25,000 fraudulent accounts to generate 28.8 million exchanges between April and June.

Alibaba has denied the accusation. Anthropic had previously named DeepSeek, Moonshot AI, and MiniMax in February as perpetrators of similar campaigns, framing distillation as an existential threat to the business models of frontier AI companies.

Distillation, the practice of using a powerful model’s outputs to train a smaller one, occupies a grey area in AI development. Asian AI startups have launched alternatives to Anthropic’s models partly because the export ban on Fable 5 and Mythos 5 left a gap in the market, making the line between legitimate competition and illicit extraction increasingly difficult to draw.

The developer trust problem

Claude Code requires deep access to a developer’s local file system to read, modify, and execute code, meaning any hidden functionality in the tool effectively has access to everything on the machine. Huorong Security, a Chinese cybersecurity firm, said Anthropic’s tracking was not only a transparency issue but also raised cross-border data compliance concerns.

“Today it’s a timezone check, tomorrow it could be system sabotage or data exfiltration,” one Reddit user wrote. Anthropic’s privacy policy states that it collects the kind of data in question, but critics argue the steganographic method, designed to be invisible to users, crosses a line that a standard privacy disclosure does not.

The bigger picture

The episode accelerates China’s push to reduce reliance on American AI tools, which Chinese firms increasingly view as carrying legal, security, and operational risks. Alibaba has been building out its own AI stack aggressively, integrating its Qwen models across products from e-commerce to robotics, and the Claude Code ban gives it further justification to push employees toward domestic alternatives.

Lizzi Lee, a fellow at the Asia Society Policy Institute’s Centre for China Analysis, said the conflict showed how the US-China AI competition has moved beyond technology into access control and sovereignty. “If a US AI coding tool can detect Chinese usage or proxy access, then it’s not surprising for major Chinese tech companies to not want employees using it internally,” she said.

Anthropic’s models have long been officially inaccessible in China, but they remain popular among domestic developers who use workarounds to maintain access. Whether the tracking controversy pushes more of them toward Chinese alternatives or simply confirms what many already suspected about the risks of depending on American AI tools is a question that extends well beyond Alibaba.

The eufy Omni C20 is built for households that don’t want to bother with constant cleaning.

This vobo vac has dropped to £308.99 from its original price of £599, a saving of 48% that brings a fully automated cleaning station within much easier reach.