Connect with us
DAPA Banner
DAPA Coin
DAPA
COIN PAYMENT ASSET
PRIVACY · BLOCKDAG · HOMOMORPHIC ENCRYPTION · RUST
ElGamal Encrypted MINE DAPA
🚫 GENESIS SOLD OUT
DAPAPAY COMING

Tech

Valid certificates, stolen accounts: how attackers broke npm’s last trust signal

Published

on

On May 19, 633 malicious npm package versions passed Sigstore provenance verification. They were cleared by the system because the attacker had generated valid signing certificates from a compromised maintainer account.

Sigstore worked exactly as designed: it verified the package was built in a CI environment, confirmed a valid certificate was issued, and recorded everything in the transparency log. What it cannot do is determine whether the person holding the credentials authorized the publish — and that gap turned the last automated trust signal in npm into camouflage.

One day earlier, StepSecurity documented an attack on the Nx Console VS Code extension, a widely used developer tool with more than 2.2 million lifetime installs. Version 18.95.0 was published using stolen credentials on May 18 and stayed live for under 40 minutes — but Nx internal telemetry showed approximately 6,000 activations during that window, most through auto-update, compared to just 28 official downloads. The payload harvested Claude Code configuration files, AWS keys, GitHub tokens, npm tokens, 1Password vault contents, and Kubernetes service account tokens.

The Mini Shai-Hulud campaign, attributed by multiple researchers to a financially motivated threat actor identified as TeamPCP, hit the npm registry at 01:39 UTC on May 19. Endor Labs detected the initial wave when two dormant packages, jest-canvas-mock and size-sensor, published new versions containing an obfuscated 498KB Bun script — neither had been updated in over three years, making a sudden version with raw GitHub commit hash dependencies a detection signal, but only if the tooling is watching.

Advertisement

By 02:06 UTC, the worm had propagated across the @antv data visualization ecosystem and dozens of unscoped packages, including echarts-for-react (~1.1 million weekly downloads). Socket raised the total to 639 compromised versions across 323 unique packages in this wave. Across the full campaign lifecycle, Socket has tracked 1,055 malicious versions across 502 packages spanning npm, PyPI, and Composer.

StepSecurity confirmed the payload contained full Sigstore integration. The attacker didn’t just steal credentials; they could sign and publish downstream npm packages that carried valid provenance attestations.

These two incidents aren’t isolated. Research teams at Endor Labs, Socket, StepSecurity, Adversa AI, Johns Hopkins, Microsoft MSRC, and LayerX independently proved that the developer tool verification model is broken, and no vendor framework audits all of the attack surfaces that failed.

Seven attack surfaces failed in the 48 hours between May 18 and May 19 — npm provenance forgery, VS Code extension credential theft, MCP server auto-execution, CI/CD agent prompt injection, agent framework code execution, IDE credential storage exposure, and shadow AI data exposure — and the audit grid below maps each.

Advertisement

The verification model is broken across all four major AI coding CLIs

Adversa AI disclosed TrustFall on May 7, demonstrating that Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI all auto-execute project-defined MCP servers the moment a developer accepts a folder trust prompt. All four default to “Yes” or “Trust.” One keypress spawns an unsandboxed process with the developer’s full privileges.

The MCP server runs with enough privilege to read stored secrets and source code from other projects. On CI runners using Claude Code’s GitHub Action in headless mode, the trust dialog never renders. The attack executes with zero human interaction.

Johns Hopkins researchers Aonan Guan, Zhengyu Liu, and Gavin Zhong published “Comment and Control,” proving that a malicious instruction in a GitHub pull request title caused Claude Code Security Review to post its own API key as a comment. The same attack worked on Google’s Gemini CLI Action and GitHub’s Copilot Agent. Anthropic rated the vulnerability CVSS 9.4 Critical through its HackerOne program.

Microsoft MSRC disclosed two critical Semantic Kernel vulnerabilities on May 7. One routes attacker-controlled vector store fields into a Python eval() call; the other exposes a host-side file download method as a callable kernel function — meaning one poisoned document in a vector store launches a process on the host.

Advertisement

LayerX security researchers separately demonstrated that Cursor stores API keys and session tokens in unprotected storage, meaning any browser extension can access developer credentials without elevated permissions.

The threat actors hunting these credentials doubled their operational tempo

The Verizon 2026 Data Breach Investigations Report, released May 19, found that 67% of employees access AI services from non-corporate accounts on corporate devices. Shadow AI is now the third most common non-malicious insider action in DLP datasets. Source code leads all data types submitted to unauthorized AI platforms — the same asset class the npm worm campaign targeted.

The CrowdStrike 2026 Financial Services Threat Landscape Report, released May 14, documents the adversaries actively hunting the credential types these attacks harvest.

STARDUST CHOLLIMA tripled its operational tempo against financial entities in Q4 2025. CrowdStrike documented the group using AI-generated recruiter personas on LinkedIn and Telegram, sending malicious coding challenges that looked like technical assessments, and running fake video calls with synthetic environments. The targets are GitHub PATs, npm tokens, AWS keys, and CI/CD secrets. The shadow AI exposure in grid row 7 is the door they walk through.

Advertisement

Developer Tool Stolen-Identity Audit Grid

No vendor framework currently scopes all seven surfaces. This grid maps each one to the research that exposed it, what your stack cannot see, and the audit action to take before the next vendor renewal.

Attack Surface

Disclosed By

What Verification Failed

Advertisement

What Your Stack Cannot See

Audit Action

1. npm provenance forgery

Endor Labs, Socket (May 19)

Advertisement

Sigstore certificates generated from stolen OIDC tokens pass automated verification

EDR and SAST do not validate whether the CI identity that signed a package authorized the publish

Require publish-time two-party approval for packages with more than 10,000 weekly downloads. Do not treat a green Sigstore badge as proof of legitimacy

2. VS Code extension credential theft

Advertisement

StepSecurity (May 18)

VS Code Marketplace accepted a malicious extension version published with a stolen contributor token

Extension auto-updates bypass endpoint detection. Marketplace window 12:30 to 12:48 UTC; overall exposure (including Open VSX) 12:30 to 13:09 UTC

Enforce minimum-age policies for extension updates. Pin critical extension versions. Audit all extensions with access to terminal or file system APIs

Advertisement

3. MCP server auto-execution

Adversa AI, TrustFall (May 7)

All four CLI trust dialogs default to “Yes/Trust” without enumerating which executables will spawn

EDR monitors process behavior, not what an LLM instructs an MCP server to do. WAF inspects HTTP payloads, not tool-call intent

Advertisement

Disable project-scoped MCP server auto-approval in Claude Code, Gemini CLI, Cursor CLI, and Copilot CLI. Block .mcp.json in CI pipelines unless explicitly allowlisted

4. CI/CD agent prompt injection

Johns Hopkins, Comment and Control (April 2026)

GitHub Actions workflows using pull_request_target inject secrets into runner environments that AI agents process as instructions

Advertisement

SIEM logs show an API call from a legitimate GitHub Action. The call itself is the attack. No anomalous network signature exists

Migrate AI code review workflows to pull_request trigger. Audit all workflows using pull_request_target with secret access for AI agent integrations

5. Agent framework code execution

Microsoft MSRC (May 7)

Advertisement

Semantic Kernel Python SDK routed vector store filter fields into eval(). .NET SDK exposed host file-write as a callable kernel function

Application firewalls inspect input payloads. They do not inspect how an orchestration framework parses those payloads internally

Update Semantic Kernel Python SDK to 1.39.4 and .NET SDK to 1.71.0. Audit all agent frameworks for functions tagged as model-callable that access host file system or shell

6. IDE credential storage exposure

Advertisement

LayerX (April 2026)

Cursor stores API keys and session tokens in unprotected storage accessible to any installed browser extension

DLP monitors data in transit. Cursor credentials at rest are invisible to DLP because no egress event occurs until the extension exfiltrates

Audit developer tools for credential storage practices. Require protected storage (OS keychain, encrypted credential stores) for all AI coding tool configurations

Advertisement

7. Shadow AI data exposure

Verizon 2026 DBIR (May 19)

67% of employees access AI services from non-corporate accounts on corporate devices. Source code is the leading data type submitted

CASB policies cover sanctioned SaaS. Non-corporate AI accounts on corporate devices operate outside CASB scope entirely

Advertisement

Deploy browser-layer AI governance that monitors non-corporate AI usage on corporate devices. Inventory AI browser extensions across the organization

Security director action plan

Security directors may want to run this grid against current vendor contracts before Q2 renewals close — asking each vendor which of the seven surfaces their product covers, and treating the non-answers as the gap map.

Any credential accessible from a developer machine or CI runner that installed affected npm packages between 01:39 and 02:18 UTC on May 19 should be considered compromised. That includes GitHub PATs, npm tokens, AWS access keys, Kubernetes service account tokens, HashiCorp Vault tokens, SSH keys, and 1Password vault contents.

AI coding agent integrations running in CI/CD pipelines with pull_request_target workflows deserve a close look. Each one is a prompt injection surface that processes PR comments as agent instructions.

Advertisement

Procurement teams evaluating AI coding tools should consider adding a stolen-identity resistance dimension to vendor assessments. The question worth asking: can the vendor demonstrate how their tool distinguishes a legitimate maintainer publish from an attacker using compromised credentials? If they cannot, the tool is not a verification layer.

The developer tool supply chain has the same problem IAM had a decade ago: credentials prove who you claim to be, not who you are. IAM got a 10-year head start on compensating controls before nation-state groups turned credential theft into an industrial operation. The AI coding tool ecosystem is starting that clock now.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

Which programming languages can aid a medtech career?

Published

on

Programming and coding skills are crucial to a range of STEM careers, including those dealing with future health challenges.

For professionals working in the medtech space, useful soft skills include the ability to communicate complex information, a strong style of leadership, problem-solving and an adaptable mindset, among others. On the technical side, experts should have an understanding of regulatory processes, be able to generate and analyse data, have knowledge of lab procedures and have awareness of topics related to AI and automation.

The list of skills that medtech professionals in 2026 should prioritise could go on and on, as it is a complex, rapidly changing and highly innovative space that demands consistent upskilling and learning. 

However, there are several skills, such as the ones previously listed, that are evergreen, in a sense, as they likely will always be in high demand. Among them is the ability to code, so in this day and age, which programming languages are best suited to one of many possible careers in medtech?

Advertisement

Imaging and analytics

If you envision a career as the brain behind the latest advancements in medical imaging technology, then a knowledge of programming language Python is absolutely critical. Popular and widely used across the STEM space, medtech professionals skilled in Python can use it to gain insight from data and build the machine learning (ML) models that drive innovation in medtech. ML applications can be used to perform medical diagnostics, advance drug discovery and generate predictive analytics, among other capabilities.  

Research suggests that one of the more promising applications of Python as a programming language in the medtech space is in how it enables ML models to analyse images, such as MRIs, CTs and diffusion tensor imaging scans. Python can also be used to automate the detection of cardiac abnormalities in imaging, enable the detection of certain cancers, and identify fractures and other injuries, thus improving decision making and reducing the risk of diagnostic errors.

Secure device delivery 

The medtech space, like many industries globally, is incredibly vulnerable to attacks from hackers and other malicious actors, as the information and technologies held within are often of a sensitive and critical nature. With that in mind, there are a growing number of professionals whose role it is to protect and bolster these systems, in an often hostile ecosystem. If your goal is to enable greater security in the development of medical devices, then consider learning Python, or if you want something a little more modern, Swift

This general purpose programming language, which was created by tech giant Apple, is a multi-paradigm, compiled programming language that is known for its easy-to-read syntax and grammar, and the scalability of its applications. It is also recognised for its speed, performance and safety. The language is emboldened by multiple security layers, improved data encryption and simplified coding, making it an ideal platform when developing security-conscious medical devices. 

Advertisement

Data visualisation

If your role in the medtech space requires you to deal with significant amounts of data, then R is definitely the language for you. As clinical laboratories become more and more dependent on data and analytics, R, as a comprehensive, open source, platform-independent, freely available programming language, can enable users to transform data, analyse it and properly communicate often critical results. 

Widely used and supported within statistical communities and data-driven industries, R skills can give those looking to move into the medtech space the upper hand. Typically, it is used for tasks and activities within hospitals, research labs, pharmaceutical companies and public health, by those who work with patient data, clinical trials and large biomedical datasets.

Notably, like in other career routes mentioned, Python is a handy language to know for a career driven by data visualisation. Just take it as a given that your skillset should always include Python, alongside whichever other language or languages you feel might aid you. 

How to get started

There are so many programming languages that are well-suited to medtech professionals. C++ is noted for its high-performance and reliability, Java integrates well and C# offers a mature ecosystem and community support. The list goes on and on, so where should you start?

Advertisement

Well, once you have identified the area of the medtech space that most appeals to you, make sure to do some research and learn the language pros and cons so you can make an informed decision. After that, consider online courses, third-level opportunities and networking events. The internet and indeed the real-world are full to the brim with opportunities to expand your knowledge, so engage and get going. 

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Source link

Advertisement
Continue Reading

Tech

Pretty in Pink 40th Anniversary Soundtrack Gets Expanded Color Vinyl Reissue Mastered by Bernie Grundman: Review

Published

on

The immensely successful 1986 film Pretty in Pink gave birth to an equally popular hit soundtrack album back in the day. In honor of its 40th anniversary, Universal Music and A&M Records have issued a special limited pink vinyl remastered edition of the soundtrack including two additional songs from the film not on the original release.

pretty-in-pink-40th-vinyl

A timecapsule, the music on Pretty in Pink clearly resonated with fans, catapulting the soundtrack to Gold Record status within two months of release. It reached the #5 spot in the Billboard Top 200 charts at the time and #3 for the year-end top soundtracks list that year.  

pretty-in-pink-40th-sticker

Official press materials frame the reissue’s significance this way: “As essential as the film itself, the music captures the story’s emotional truth—freezing moments in time with the vivid clarity of memories that linger for decades. Film soundtracks hold a rare power to shape identity, influencing who we are, where we belong, and the social experiences that define youth. Few filmmakers understood the coming-of-age experience quite like John Hughes, and Pretty in Pink stands as one of his most enduring cultural touchstones.”

pretty-in-pink-40th-hype-sticker

The Pretty in Pink soundtrack plays like a who’s who of the Billboard charts and vintage MTV from the mid-’80s, when hair was high, synths were higher, and every hallway needed emotional damage with a backbeat. Included is Suzanne Vega’s hooky single “Left of Center,” featuring Joe Jackson on piano, along with The Psychedelic Furs’ updated re-recording of the 1981 track that inspired the film’s title, “Pretty in Pink.” OMD’s “If You Leave” became a No. 4 charting hit, while tracks from The Smiths, Echo & The Bunnymen, and INXS round out the pure ’80s vibe.

pretty-in-pink-40th-gatefold-b

For this 40th Anniversary pink vinyl special edition, two songs from the film that were not included on the original soundtrack have been added: Otis Redding’s classic “Try a Little Tenderness” and Talk Back’s “Rudy.”

In general the sound quality on the Pretty in Pink soundtrack is very good as far as ’80s music productions go. The mastering by Bernie Grundman at Bernie Grundman Mastering in Hollywood no doubt helps bring out the best across all these different productions. The standard weight pressing is happily well centered and the opaque pink vinyl is actually quiet (which isn’t always the case with color vinyl variants). Original album graphics are in place and there is a new gatefold spread of photos from the film.   

pretty-in-pink-40th-gatefold-a

While the pink vinyl seems to be sold out at the time of this writing, you can order the standard black reissue of the Pretty In Pink soundtrack for $27.98 at Amazon. Fans of the pink vinyl edition should check in at Interscope‘s website where they have a special portal to inquire about represses. Most sites I’ve seen are currently sold out but if there is enough demand maybe they’ll repress. The pink vinyl is already commanding crazy collector’s pricing on Discogs, so be forewarned! 

Whether you’re revisiting the ’80s or replacing a well-worn original LP or cast-off CD, Pretty in Pink remains a legitimate pop music cultural touchstone and a fun spin to boot.

Where to buy: $27.98 at Amazon

Advertisement

Mark Smotroff is a deep music enthusiast / collector who has also worked in entertainment oriented marketing communications for decades supporting the likes of DTS, Sega and many others. He reviews vinyl for Analog Planet and has written for Audiophile Review, Sound+Vision, Mix, EQ, etc.  You can learn more about him at LinkedIn.

Advertisement. Scroll to continue reading.

Source link

Advertisement
Continue Reading

Tech

Minor edits to AI skills can make agents go rogue

Published

on

AI + ML

Text is the new attack

The adoption of AI agents has expanded the potential attack surface beyond code to natural language text.

AI agents – models wrapped in software that can use tools and perform multi-step tasks – often take direction from text-based skills. And researchers have demonstrated that skills can be weaponized.

Advertisement

“Many agent frameworks allow users to install skills from online registries so the agent can discover and use new capabilities on demand,” said Soheil Feizi, computer science professor at the University of Maryland (UMD) and founder/CEO of RELAI.ai, in a social media post. “This is powerful, but it also creates a new attack surface.”

Skills, Feizi explains, are not just code or dependencies. They’re also text instructions that tell agents what to do.

Skills, written out in a SKILL.md file, consist of text prompts with other data and resource references (e.g. URLs). They may get added to a user’s initiating prompt and pre-existing system prompts, all of which get fed to a model for a response. Typically, this happens when the user wants the model to perform a specific task that has been spelled out in a skill file, like conducting a code quality review.

When a model’s prompt – the combination of user input, instructions within skills, and system prompts – gets modified inadvertently or adversarially, that’s prompt injection. That can happen directly, if for example, a user submits a prompt that directs the model to ignore prior instructions. It can also happen indirectly, if for example, an AI agent visits a website and processes text on a page that the underlying model interprets as an instruction. 

Advertisement

A skill can effectively act as user-authorized prompt injection. And agents may also automatically retrieve and load third-party skills if their descriptions appear relevant to the task being pursued. And therein lies the problem.

The risk posed by skills has already been documented. In February, security biz Snyk found that 13.4 percent of skills on ClawHub and skills.sh (about 534 out of 3,984) “contain at least one critical-level security issue, including malware distribution, prompt injection attacks, and exposed secrets.”

In a preprint paper titled “Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry,” Feizi and UMD co-authors Shoumik Saha and Kazem Faghih examine the role that skill registries play in the distribution of malicious skills. Specifically, they look at how adversarial skills get discovered, selected, and vetted before execution.

“An attacker may not need to hide malware in executable code,” Feizi said. “Small semantic changes to a skill description can affect how the skill is discovered in a registry, whether an agent selects it over alternatives, and whether it passes governance or safety checks.”

Advertisement

Those details matter, he argues, because the selection process may be automated – software agents like OpenClaw have the ability to fetch and use third-party skills.

The text that influences tool discovery and usage thus has security implications, which may not be addressed by traditional security scanning mechanisms that focus on code.

The three co-authors show that short 20-token triggers can be added to a SKILL.md file to influence the chance an agent will discover it in a registry, to influence the chance an agent will select that skill, and to avoid detection through semantic evasion strategies.

In terms of discovery, the researchers demonstrated they could induce an agent to discover their skill over an unaltered source skill 86 percent of the time. They also succeeded in making an agent select their skill over variants 77.6 percent of the time. And they were able to evade registry scanning defenses between 36.5 percent and 100 percent of the time.

Advertisement

The most successful strategy for evading detection was to overflow the context window of the scanner – making the skill too long for the scanner to handle. “In ClawHub-style review, only the first 10K characters of long SKILL.md files are passed to the LLM reviewer, so we place the malicious instruction beyond this boundary while keeping it in the submitted skill,” the authors explain.

“Our work shows that protecting agents requires treating natural-language specifications as security-sensitive objects,” said Feizi. “We hope this encourages more careful design of skill registries, ranking mechanisms, governance pipelines, and agent-side defenses.”

Source code and supporting documentation have been published on GitHub. ®

Source link

Advertisement
Continue Reading

Tech

You can now stream Audible’s best podcasts straight from Apple Podcasts

Published

on

If you are an Audible member who also lives inside Apple Podcasts, this one is for you. Audible has officially launched a connected subscription that lets you stream nearly 700 premium titles directly in Apple Podcasts, across 135 countries, with more on the way.

What you get with Audible on Apple Podcasts?

The catalog is genuinely stacked. You get ad-free access to Audible Originals spanning true crime, investigative journalism, celebrity-led audio dramas, and personal growth series. That includes award-winning shows like Dr. Death and Hysterical, as well as star-powered productions like Kerry Washington’s The Prophecy and The Big Lie, starring Jon Hamm.

Marshall Lewy, Head of Audible Content for North America, says the goal is to meet listeners where they already are. He also said, “by making select shows and episodes available widely, we have the opportunity to introduce new listeners to the extraordinary audio storytelling Audible offers right inside the Apple Podcasts app.”

How to connect your Audible account to Apple Podcasts

If you are already an Audible member, open Apple Podcasts, and your subscription should link automatically. You can also search for any Audible premium show and connect from there at no extra cost.

New subscribers can sign up directly through Apple Podcasts by searching for a show like Dr. Death or OnlyFantasy and subscribing via the Audible app. Your membership then works across both platforms.

Advertisement

The connected subscription is currently live for US and UK members, with Australia, Japan, and Canada joining in June 2026.

Apple Podcasts has been on a serious upgrade spree lately, with its iOS 26.4 update bringing native video streaming, Picture-in-Picture, and offline downloads. That overhaul also introduced dynamic ad insertion for creators.

Audible, meanwhile, launched a new Standard membership plan at $8.99 per month for first-time listeners. Between the two platforms, there is a lot to look forward to as a listener.

Source link

Advertisement
Continue Reading

Tech

Humanoid Links with Bosch to Scale Production of Its Industrial Robots

Published

on

Humanoid Bosch HMND 01 Robot
London-based Humanoid announced a manufacturing agreement with Bosch that moves its HMND-01 robots closer to larger deployments across European factories and warehouses. The deal follows a successful proof-of-concept test completed in March at one of Bosch’s logistics sites in Bühl, Germany. During that trial, the robots handled box transfers from conveyors to trolleys, managing five different box sizes with varying weights and shapes without missing a step.



Humanoid develops robots for real-world applications, such as in factories and industrial environments. Their HMND-01 platform is available in two configurations: a 175 centimeter tall bipedal robot and a wheeled version. The bipedal one weighs roughly 70 kilograms and can move at a reasonable rate of 1.5 meters per second, which is quite quick for a robot. It can also carry a 15 kilogram payload with ease and run for approximately 4 hours on a single charge. There is also a wheeled variant, which is heavier, higher, and geared to handle demanding duties. Both versions run on Humanoid’s own KinetIQ system, which manages everything from perception to movement and actual task completion, and because they’re modular, they can be tailored to customers’ specific manufacturing or logistics needs.


Unitree G1 Humanoid Robot(No Secondary Development)
  • Sleek & Durable Design: Standing at 132cm tall and weighing only approx. 35kg, the G1 is constructed with aerospace-grade aluminum alloy and carbon…
  • High Flexibility & Safe Movement: Boasting 23 joint degrees of freedom (6 per leg, 5 per arm), it offers an extensive range of motion. For safety, it…
  • Smart Interaction & Connectivity: Powered by an 8-core high-performance CPU and equipped with a depth camera and 3D LiDAR. It supports Wi-Fi 6 and…

Bosch has agreed to help Humanoid deliver these robots to Europe. With its extensive manufacturing facilities and experience creating extremely complicated systems, the German corporation brings significant expertise to the table. Bosch’s contract manufacturing agreement include assisting Humanoid with all of the technical aspects of constructing the robots. That begins with the design stage and continues all the way through to delivery, which includes supply chain coordination and, of course, cost control. Meanwhile, Humanoid is working on improving the design, with the goal of making it easier to make, more dependable for customers to use, simpler to fix if something goes wrong, and more economical in general.


The combined testing at Bühl produced some hopeful results, as the robots performed rather well in a real-world logistics scenario. They were scanning boxes, responding to changing conveyor belt inputs, and transferring products smoothly. That was enough to persuade both sides to take the project a step further and begin producing robots in larger quantities, rather than simply focusing on the prototype phase.

Advertisement


What the two companies want to accomplish next isn’t just to keep producing the same old robots. They also want to look into how Bosch-made components like as actuators, motors, and sensors may be employed in future versions of the HMND-01. The goal is to make the thing faster, stronger, and more tightly integrated with the equipment and systems it works with.
[Source]

Source link

Advertisement
Continue Reading

Tech

SpaceX launches Starship V3 for the first time, but loses booster on return

Published

on

SpaceX has launched the upgraded third version of its Starship rocket for the first time, though the test launch did not go perfectly for Elon Musk’s spaceflight company.

The 407-foot rocket — the most powerful ever built — lifted off from SpaceX’s company town Starbase, Texas, at 5:30 p.m. local time. Just a few minutes later, the upper stage ship separated from the Super Heavy booster and continued on into space.

The booster pitched away from the Starship vehicle and headed back to Earth, where it was supposed to perform a simulated landing in the Gulf of Mexico. But the booster’s engines did not properly re-ignite for the sustained burn that is meant to deliver it back to the launch site. The booster then tumbled down to the water, where it likely exploded.

Starship, meanwhile, lost one of its six Raptor engines as it ascended into space. But it successfully deployed all 20 of the Starlink satellite simulators along with two modified Starlink satellites meant to record footage of Starship’s exterior. Roughly one hour after liftoff, Starship simulated a landing in the Indian Ocean, before tipping over and exploding as expected.

Advertisement

While it didn’t go exactly according to plan, this was an important test launch for SpaceX. It was the first real shakedown of the upgraded Starship V3 hardware, which has been in development for months. The company was also testing out an all-new launchpad at Starbase that it’s been developing and building for years.

The test launch also comes at a historical inflection point for SpaceX as a company. Its IPO filing was made public this week, and SpaceX is expected to list on the Nasdaq in mid-June. The IPO is reportedly supposed to raise around $75 billion for SpaceX, which the company plans to use to fuel further development, massive AI ambitions, and to pay off some of the debt associated with xAI and Musk’s social media company X. (That means this could also be the last Starship test launch to happen without a stock market reaction.)

SpaceX has spent years and billions of dollars developing Starship, which it sees as crucial to its mission of making life multi-planetary. The company plans to use Starship for NASA missions to the moon, and eventually Mars. But the big job it needs to perform in the near-term is delivering more advanced Starlink satellites to Earth orbit, as Starlink is the only profitable part of SpaceX’s business.

This was the first Starship flight since October 2025. SpaceX had planned to attempt launching Starship V3 earlier, but one of the first upgraded boosters suffered an explosion during testing in November. SpaceX first attempted the launch on Thursday but ultimately had to delay it as a hydraulic pin on the launch tower arm refused to retract, according to Musk.

Advertisement

This new version of Starship features SpaceX’s third-generation Raptor engines, which have more thrust and a far simpler design. The new booster is designed for faster takeoffs and easier catches by the launch tower.

This story has been updated to include information about Starship’s simulated landing.

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Source link

Advertisement
Continue Reading

Tech

Shein Buying Everlane Actually Makes Perfect Sense

Published

on

On Friday, the ultrafast-fashion giant Shein finalized its acquisition of Everlane, a US clothing retailer that made its name by promising “radical transparency” into how its clothes were made. Neither company disclosed the price of the deal, but Puck reported last weekend that it clocked in at $100 million.

Founded in 2010, Everlane became synonymous with a certain strain of millennial consumerism that was supposed to be the exact opposite of Shein. It mainly sold elevated basics, and told a generation of anxious and high-minded shoppers that they could feel morally good about buying yet another pair of plain ballet flats or black high-waisted skinny jeans. Shein, by contrast, became notorious by flooding the internet with astonishingly cheap, trendy clothing produced at enormous scale. It has been criticized for years for alleged poor labor practices.

Given how differently Shein and Everlane positioned themselves, many people online felt the acquisition fell somewhere between darkly ironic and outright dystopian. The fashion writer Derek Guy, better known online as the “menswear guy,” articulated the vibe in a post on X: “Under Shein,” he wrote, “Everlane’s ‘radical transparency’ means you get to read about the small child making your boring gray crewneck sweater.”

Really, though, the deal makes perfect sense. In the long run, it may end up looking like a preview of where Chinese consumer companies are heading next.

Advertisement

Chinese ecommerce giants conquered the global market largely by selling cheap stuff at eye-watering scale. Companies like Shein and Temu thrived in part because of the “de minimis” loophole, a US trade rule that allowed packages worth under $800 to enter the country tariff-free and with relatively little customs scrutiny. That system became the backbone of a new era of cross-border ecommerce, enabling Chinese companies to ship cheap stuff directly to American consumers faster and more efficiently than many traditional retailers could manage.

But after US president Donald Trump imposed sweeping new tariffs on Chinese imports and ended the de minimis exemption, the economics underpinning that model began to falter. Chinese companies quickly realized they could no longer rely solely on flooding Western markets with bargain-priced products. If they wanted to keep growing internationally, they needed something more durable: a good old-fashioned brand.

Shein buying Everlane, however culturally cursed it may appear, is part of a broader trend already unfolding across Chinese commerce and manufacturing. Increasingly, Chinese companies are trying to move beyond anonymous low-cost production and toward owning recognizable global brands associated with quality, lifestyle, and status.

One of the clearest examples comes from Temu’s parent company, Pinduoduo. In March, the company announced a major new initiative called New PinMu, a multibillion-dollar effort designed to help Chinese manufacturers build premium international brands. The project is part of a larger strategic vision outlined by Pinduoduo co-CEO Jiazhen Zhao, who has been hyping up the company’s ambitions to elevate manufacturing standards and create pathways for Chinese factories to move up the value chain.

Advertisement

Meanwhile, Luckin Coffee, a Chinese coffee chain that has become one of Starbucks’ biggest rivals, recently acquired Blue Bottle, the cultish specialty coffee brand that helped define American third-wave coffee culture. Anta Sports, a Chinese sportswear giant that began largely as a domestic sneaker company, has spent years buying into premium global sportswear brands, including controlling stakes in Arc’teryx and Salomon.

The trend also reflects broader political pressures inside China. The government has become increasingly critical of the brutal price wars and hypercompetition that dominate industries like ecommerce and electric cars, a phenomenon often referred to as “involution.” Beijing now wants companies to focus more on sustainable growth, higher-end manufacturing, and global competitiveness rather than an endless race to the bottom.

Source link

Advertisement
Continue Reading

Tech

Wingtech sues Nexperia in Chinese court over Dutch government’s semiconductor seizure

Published

on

Wingtech Technology has filed a lawsuit against its own subsidiary, Nexperia, in a Chinese court. The case, lodged at the Dongguan Intermediate People’s Court, seeks at least 8 billion yuan, roughly $1.1 billion, in damages. It is the first major legal challenge to a European government’s forced seizure of a Chinese-owned chipmaker. The dispute centres […]

This story continues at The Next Web

Source link

Advertisement
Continue Reading

Tech

Memorial Day Tech Deals: Sony, Apple, Beats (2026)

Published

on

When you think of Memorial Day sales, you probably think of mattresses and other home goods. And while those items are definitely discounted, now is also a good time to purchase tech. Personally, I’m not buying anything right now unless it’s discounted—and fortunately many of our top picks are. Whether you’re shopping for a power bank, a new pair of headphones, or some other gadget, I’ve rounded up the best Memorial Day deals for your perusal. We’ll update this article again over the weekend.

Check out our buying guides for more recommendations, including the best headphones, the best laptops, and the best cheap phones.

Updated May 22: We’ve checked prices, removed expired deals, added ten new deals, and ensured accuracy throughout.

WIRED Featured Deals:

Advertisement

Sony WH-1000XM5 for $248 ($152 off)

Sony WH-1000MX5 headphones

The Sony WH-1000XM5 have a very frustrating name, but they’re the predecessor to our favorite wireless headphones, and they’re still an excellent pick if you don’t want to shell out for the new WH-1000XM6. They go on sale frequently, but rarely drop this low in price, which comes within $5 of their all-time low. If you’re in the market for over-ear headphones, they’re hard to beat. They’re comfortable, portable, lightweight, and stylish, and they’ll make your music sound great no matter what you like to listen to.

Source link

Continue Reading

Tech

AI is being used to resurrect the voices of dead pilots

Published

on

In the latest sign of these AI-heavy times, the National Transportation Safety Board temporarily removed access to its docket system after discovering that voices of pilots who were killed in a UPS plane crash last year had been re-created using AI and were circulating on the internet.

The NTSB is prohibited by federal law from including cockpit audio recordings in its docket system, which otherwise contains troves of data on investigations and has historically been open to the public. But the accident docket for this flight included a spectrogram file of the voice recorder. A spectrogram uses a mathematical process to turn sound signals, including low and high frequencies, into an image.

Scott Manley, a popular YouTuber whose channel combines physics, astronomy, and video games, noted on X that it could be possible to reconstruct audio from the megabytes of data encoded in that image.

And that’s what happened. People took the spectrogram, along with the publicly available transcript, to create approximations of the cockpit voice recorder audio from UPS Flight 2976 in Louisville, Kentucky, according to the NTSB. They used AI tools like Codex, according to posts on social media.

Advertisement

The agency restored public access to the docket system on Friday but kept 42 investigations closed pending review — including the one related to Flight 2976.

Source link

Continue Reading

Trending

Copyright © 2025