Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Tech
Von der Leyen’s AI envoy pick draws conflict-of-interest fire
The European Commission has appointed Jim Hagemann Snabe, chairman of Siemens’ supervisory board, as its special envoy for industrial artificial intelligence. He will advise Commission President Ursula von der Leyen and tech sovereignty chief Henna Virkkunen on how to accelerate AI adoption across European industry.
The backlash was immediate. Snabe’s appointment lands weeks after Siemens was among the companies that lobbied hardest for the rollback of the EU’s AI Act, the world’s most ambitious AI regulatory framework. Critics say the appointment amounts to handing advisory power over AI policy to the same industry that successfully weakened it.
Who is Jim Hagemann Snabe
Snabe, 60, is a Danish executive who co-led SAP as co-CEO from 2010 to 2014 before moving to the supervisory board. He became chairman of Siemens’ supervisory board in 2018. Beyond those roles, he has served on the advisory board of Google Cloud, on the board of US enterprise AI firm C3.ai, and as a board of trustees member at the World Economic Forum.
The Commission says it conducted a thorough conflict-of-interest assessment before the appointment. For the duration of his mandate, which runs until 31 March 2027, Snabe will suspend his Google Cloud and C3.ai memberships. The role is unpaid.
The AI Act rollback
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!
The timing is what makes the appointment politically charged. On 7 May, the Council of the EU and the European Parliament reached a deal to simplify the AI Act through the so-called Digital Omnibus. The headline change was a 16-month delay to high-risk AI obligations, pushing the deadline from August 2026 to December 2027.
More significantly for Siemens, the deal introduced an industrial AI exemption. AI systems used on factory floors and embedded in machinery will now be covered by separate machinery regulations rather than the AI Act, unless a failure could directly endanger health or safety. Germany, where Siemens is headquartered, led the push for that exemption. Chancellor Friedrich Merz called for freeing industrial AI from the EU’s “regulatory straightjacket” at the Hannover Messe trade fair in April, with Siemens executives alongside him.
Virkkunen, who drove the simplification through the College of Commissioners, framed the deal as proof that Europe can maintain a rules-based approach while making regulation workable for industry. Snabe’s appointment is the next step in that direction: an explicit signal that industrial competitiveness, not regulatory caution, is now the priority.
The criticism
“My first reaction was just: Wow,” said Kim van Sparrentak, the Dutch Green lawmaker who led the Parliament’s work on the AI Act. “They fought hard against AI rules for themselves, they lobby against technological sovereignty, and now they get to decide how we are going to integrate AI.”
The concern is not only about Siemens. Snabe’s board positions at Google Cloud and C3.ai place him at the intersection of the three constituencies most directly affected by EU AI policy: European industry, US Big Tech, and the enterprise AI software market. Suspending board seats is not the same as severing ties, and critics argue that an unpaid advisory role with no formal accountability is precisely the kind of arrangement that makes revolving-door governance difficult to scrutinise.
The Commission has not disclosed the specific terms of Snabe’s conflict-of-interest assessment. It says one was carried out but has not published the methodology or findings, which makes the assurance hard to evaluate independently.
What the role involves
Snabe’s mandate is to advise on how Europe can boost industrial AI adoption, a priority that the Commission has elevated since the AI Act’s passage exposed a tension at the heart of European tech policy: the desire to regulate AI and the fear of falling behind the US and China in deploying it.
The appointment was announced alongside the Commission’s broader technology sovereignty blueprint, which includes the Cloud and AI Development Act, Chips Act 2.0, and new restrictions on US cloud providers handling sensitive European government data. Snabe’s role sits within that framework, theoretically bridging the gap between Brussels’ regulatory ambitions and the corporate reality of getting AI into European factories.
Whether a Siemens chairman is the right person to bridge that gap or simply the most obvious symptom of the gap itself is the question Brussels will be debating for the duration of his mandate.
Continue Reading
Threat actors are creating OpenAI tenants that impersonate legitimate companies and inviting employees to join them, in what appears to be a ploy to trick targets into submitting sensitive company information in chats and projects.
Push Security discovered what they dub as the “Poisoned Tenant” campaign after multiple employees received invitations to join an OpenAI organization named “Push Security Inc.” While the invite was legitimate, coming directly from OpenAI, the ChatGPT tenant had been created by an attacker using Gmail addresses rather than by the company.
The invitation emails were sent from OpenAI’s legitimate notification address, noreply@tm.openai.com, passed email authentication checks, and were identical to a normal invitation to join an organization’s ChatGPT workspace.
Source: Push Security
Push Security told BleepingComputer that other customers have also received similar invitations and that all are in the cybersecurity or technology space.
Attacker-controlled OpenAI organizations
According to a new report by Push Security, the invitations targeted specific employees using their work email addresses, suggesting the attackers had researched the employees who work at the company before launching the campaign.
Although OpenAI includes a warning stating that the inviter’s email domain does not match the recipient’s company domain, the notice appears as a single line within the legitimate invitation email.
To better understand the attack’s goal, Luke Jennings, VP, Research & Development at Push Security, accepted one of the invitations.
After accepting, the researcher was immediately added to the fraudulent organization, which impersonated Push Security and contained a single attacker-controlled account with a Gmail address that posted as the company’s CEO, Adam Bateman.
The invited employees had all been assigned Owner privileges within the organization, giving them administrative permissions over the tenant.
As they had administrative access, they could view other pending invitations and confirm that none of the targeted employees had joined the fake ChatGPT organization. They also found that a Visa credit card had already been attached to the organization’s billing account, adding further legitimacy.
Source: Push Security
Push Security told BleepingComputer that the project was empty and contained no existing chats or projects, making it unclear what the goal of the attack was.
Push Security believes the attackers’ objective is to convince employees to use the ChatGPT workspace as if it were a legitimate corporate platform, which would then allow the attackers to collect any sensitive information that was submitted.
“An attacker who just wants to spray scam content through a trusted email channel doesn’t name the organization after their target, research individual employees, or attach a credit card,” wrote Push.
“That investment only pays off if employees actually join the organization and start using it. And on an AI platform, the data people put into prompts can be extraordinarily sensitive — source code, internal documents, customer data, security research, strategic plans.”
The company also believes that attaching a payment method removes another potential warning sign, allowing invited users to use premium features without questioning whether the organization is legitimate.
Push Security says the campaign reflects a broader trend of attackers abusing legitimate invitation and notification features built into SaaS platforms.
Unlike normal phishing campaigns, these invitations originate from the platform’s own infrastructure, and because they are legitimate, they are more likely to bypass email security controls.
To reduce the risk of these types of attacks, Push recommends training employees to verify unexpected organization invitations and monitoring SaaS organization memberships.
BleepingComputer contacted OpenAI to ask whether it has received additional reports of similar campaigns, what protections organizations can use against these attacks, and whether it plans to introduce additional safeguards to prevent attackers from creating organizations impersonating legitimate companies. We will update this article if we receive a response.
what-to-expect-at-the-next-samsung-galaxy-unpacked
Although it isn’t yet official, you can bet the farm that Samsung will hold a Galaxy Unpacked event this summer. The rumor mill even points to a specific time and venue: July 22 in London. But whether that’s the official date or not, you can expect a foldable-focused shindig sometime soon. Samsung will likely unveil new Galaxy Z Fold and Galaxy Z Flip phones, as well as new Galaxy Watches. And we just might get a closer look at Samsung and Google’s Android XR smart glasses.
A wider Galaxy Z Fold 8
At last year’s event, Samsung launched its most polished foldable yet, the Galaxy Z Fold 7. But now the company appears ready to shake things up. Leaks point to a wider Fold model alongside one with the more established design.
Curiously, the wider shape more closely aligns with what industry insiders expect from Apple’s upcoming foldable iPhone. Welcome to the world of Big Tech, where you have to question whether a new product was greenlit to compete with one that doesn’t yet exist.
This model would trade the narrow design of the current Fold line for something that, when opened, more closely resembles a small tablet. It may even resemble the first-generation Pixel Fold (pictured above). Leaks suggest this wider Z Fold 8 would have a 7.8-inch inner display and a 5.4-inch outer display. Its outer screen is also expected to be wider, which could make it feel more like a standard phone when closed. It’s rumored to have two rear cameras, compared to the three on the current Fold line.
When leaks about this wider Fold first surfaced, they hinted that it would be sold as an offshoot from the main series. (Think something along the lines of the Z Fold Special Edition.) However, the latest ones suggest Samsung may position this model as the standard Galaxy Z Fold 8.
Galaxy Z Fold 8 Ultra
Meanwhile, a foldable whose aspect ratio and feature set resemble last year’s standard model could be called the Galaxy Z Fold 8 Ultra. (Confused yet?) As its alleged name suggests, this phone would be the top-tier model.
The Z Fold 8 Ultra is rumored to include a less visible display crease than its predecessor. It could also carry a new Snapdragon chip, a 200-megapixel main camera and 45W charging.
We can speculate as to why Samsung might rebrand the previously standard model as “Ultra.” First, one heavily rumored name for Apple’s foldable is the iPhone Ultra. More cynically, Samsung’s (unconfirmed) naming could also be designed to make a more expensive Fold feel more justifiable. With AI data-center-fueled shortages driving up memory prices, it wouldn’t be surprising to see a price hike for the lineup. (The 2025 model was already $2,000, so… yikes.) But if the new phone’s upgrades are more incremental than revolutionary, that could be a hard sell — “Ultra” naming or not.
Galaxy Z Flip 8
Then there’s the cheaper Galaxy Z Flip 8. It’s rumored to include a new hinge design that reduces the display crease. This could also make the phone a bit lighter at 180g. (The Flip 7 weighs 188g.)
Leaks point to a return to a Snapdragon processor, after last year’s model used a Samsung Exynos chip. (Specifically, the Snapdragon 8 Elite Gen 5.) Elsewhere, expect the same 6.9-inch inner display and a 4.1-inch cover display.
If those are the only upgrades — and we see a RAMageddon-fueled price increase — it’s hard to imagine the Galaxy Z Flip 8 as a compelling buy. Such a ho-hum launch likely wouldn’t put to rest rumors that Samsung might axe the Flip line after this generation.
Galaxy Watch 9 and Watch Ultra 2
Updated Galaxy Watch models typically arrive in the summer Unpacked event, too. Leaks point to a Galaxy Watch 9 with mostly incremental design changes, including a new case color and new bands. You can also expect the Snapdragon Wear Elite processor, and on the software side, it’s rumored to receive new health-tracking features.
Meanwhile, the Galaxy Watch Ultra 2 could be a similar story. Leaks suggest it will also have subtle design changes: a boxier look, thinner bezels with number markings and more muted accent colors on the side buttons.
As for the Galaxy Watch Classic — you know, the one with a rotating bezel and a more traditional watch design? Well, at least one leak suggests Samsung will skip it this year.
Android XR glasses
One of the event’s more interesting updates could be a product we’ve already caught a glimpse of. Samsung and Google teased their first Android XR-powered smart glasses at Google I/O 2026. If the companies’ stated timeline holds, this event could be the perfect stage to reveal more details.
The first model is a pair of audio-focused glasses developed with Gentle Monster and Warby Parker. They have an ever-present Gemini voice assistant — including (arguably creepy) cameras for contextual AI. In other words, it’s their answer to Meta’s Ray-Ban specs. A second Google-Samsung pair with a built-in display is in the pipeline for 2027.
Google previously said the audio glasses would arrive this fall, so don’t expect an imminent release after Samsung’s Unpacked event. But it seems likely the company would use the spotlight to tell us more about the device, which could possibly include pricing and a release date.
Polymarket says it will fully reimburse customers who lost an estimated $3 million after hackers injected a malicious script into the platform’s frontend following a breach at a third-party vendor.
The company states in a brief announcement that the hack was the result of a supply-chain attack that impacted a dependency on its website.
.png)
Polymarket is one of the world’s largest cryptocurrency-based prediction markets that allows users to trade contracts with prices that reflect the market’s collective estimate of an event’s outcome.
It offers predictions for sports, economic indicators, weather patterns, awards, political and legislative outcomes, and even military conflicts.
Founded in 2020, the platform is currently valued at $9 billion, handles billions of dollars in trading volume, and serves as an influential source of information on market expectations.
During the attack, unsuspecting users were tricked into approving fraudulent transactions on the official Polymarket website after malicious JavaScript was injected through a frontend vendor.
Polymarket’s own servers and backend infrastructure were not impacted by the incident.
The company did not share many details about the event, but independent blockchain intelligence firms estimate the losses at roughly $3 million, stolen from a small number of accounts.
According to blockchain security firm PeckShield, the incident was a phishing campaign that stole approximately $3 million worth of ParyonUSD from users. The stolen funds were later swapped for 1,893 Ether.
“The attacker bridged the stolen funds from #Polygon to #Ethereum and swapped them into ~1,893 $ETH,” PeckShield says.
Source: PeckShield
Based on visual analytics company Bubblemaps, the incident has impacted less than 15 accounts. The company published a list of some of the affected accounts as well as the wallets holding the stolen funds.
BleepingComputer has contacted Polymarket to request more details about the incident, but we have not received a response by publication time.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
security
Researchers warn many AI coding assistants now execute commands from project configurations
A high-severity flaw in Amazon’s AI coding assistant for Visual Studio Code meant that opening the wrong Git repository could allow an attacker to execute code on a developer’s machine and potentially hand them the keys to the dev’s cloud environment.
The bug, tracked as CVE-2026-12957 and assigned a CVSS 4.0 score of 8.5, centers on how Amazon Q handled Model Context Protocol (MCP) server configurations. Wiz found the extension would automatically load a repository’s .amazonq/mcp.json file and execute the commands it contained when a developer opened the project and activated Amazon Q.
“The security model assumes the user explicitly configures these servers. After all, you’re granting an AI assistant permission to run arbitrary commands on your machine. This should require informed consent,” the researchers write. “The vulnerability arose when this assumption was violated: Amazon Q automatically loaded MCP configurations from .amazonq/mcp.json within the workspace – no prompt, no consent, no workspace trust check.”
MCP lets AI assistants launch local processes to carry out tasks. In Amazon Q’s case, those processes inherited the developer’s environment, giving them access to AWS credentials, API keys, authentication tokens, SSH agent sockets, and other secrets already loaded into the session.
“The combination meant that a single malicious config file could execute arbitrary commands with full access to the developer’s credentials – no user interaction required beyond opening the folder and activating Amazon Q,” Wiz said.
To prove the attack worked, Wiz built a repository with a malicious MCP configuration. Opening the project and activating Amazon Q caused the extension to execute a command against AWS using the developer’s existing credentials.
Amazon fixed the bug in version 1.65.0 of its language server, which powers Amazon Q’s IDE integrations. Existing installations should receive the patched component automatically unless you’ve blocked automatic updates.
“We would like to thank Wiz for collaborating with us on this issue. We have remediated this issue in language server version 1.65.0,” Amazon said in an advisory, though it didn’t respond to The Register’s questions.
Wiz argues the bug is less an Amazon problem than an industry one. More and more AI coding assistants are adopting MCP to connect models to local tools and services, allowing them to execute commands on developers’ machines.
According to the researchers, similar workspace configuration flaws have recently surfaced in other AI coding tools. It suggests attackers have found a new place to lurk: the hidden files that developers rarely think twice about trusting. ®
Tech
Why everyone from OpenAI to SpaceX is building their own chips (and turning up the heat on Nvidia)
Nvidia has dominated the AI chip market for years, but the era of total dependence might be ending.
OpenAI just shared its plans to spice things up with Jalapeño, its custom inference chip built with Broadcom, joining Google, Apple, and SpaceX in a growing list of companies building their way out of single-supplier risk. The goal is less of a clean break and more of a hedge. Custom silicon means more control, hardware tuned to specific needs, and the kind of performance gains Apple unlocked when it ditched Intel.
On this episode of TechCrunch’s Equity podcast, hosts Kirsten Korosec, Anthony Ha, and Sean O’Kane dig into what the custom chip trend means for the industry and a few deals of the week worth watching.
Subscribe to Equity on YouTube, Apple Podcasts, Overcast, Spotify and all the casts. You also can follow Equity on X and Threads, at @EquityPod.
In this episode, Hackaday editors Elliot Williams and Tom Nardi start off by taking a trip down the Raspberry Pi memory lane and then tackle a fresh pile of listener mail. The discussion moves on to hacking bike counter, homebrew upgrades to the Nintendo Entertainment System, and building RAM from whats in the parts bin. You’ll hear about the latest drop-in upgrade for a classic Casio watch, hosting light bulbs that host subversive literature, and loading Wii U games from a weird disk drive from the 1980s. They’ll wrap things up with a dive into the evolving portrayals of brilliant rebels in media, and all the things you can do with a cheap router.
Check out the links if you want to follow along, and as always, tell us what you think about this episode in the comments!
Direct download in DRM-free MP3.
Episode 375 Show Notes:
Mailbag:
What’s that Sound:
Interesting Hacks of the Week:
Quick Hacks:
- Elliot’s Picks:
- Tom’s Picks:
Can’t-Miss Articles:
This will impact Home Assistant users and those who rely on similar third-party tools.
Samsung just announced it’s going to start charging for SmartThings API access, which is the company’s smart home automation platform. Most of these changes impact software developers and other commercial partners, but there is a way this could hit regular users in their wallets.
Starting in October, there’s going to be a $5 monthly plan for “non-commercial individual developers.” This won’t impact people using the traditional SmartThings app to control any of the thousands of gadgets that automatically work with the platform. It does, however, apply to those who use third-party tools like Home Assistant to control their Samsung-connected devices.
It’ll also likely impact those with custom smart home controls, adding yet another monthly subscription fee to the pile. This seems like a real kick in the pants to the smart home open-source community.
“We’re all for choice, but feel very disappointed that users will have to decide whether to shell out for access in the shadow of yet another cloud paywall,” Home Assistant founder Paulus Schoutsen wrote in a blog post.
What are users getting as part of all this? We aren’t exactly sure. Samsung says the added funds will allow it to “invest heavily in the enterprise-grade features our partners and users have been asking for.” The company hasn’t released any concrete details, other than saying that it’s working on new integrations and expanded capabilities of some kind. There is a new Developer Center hub coming down the pike, which will provide “current usage and data points to optimize” code.
Again, this starts in October. Access to the SmartThings API remains free for the time being.
The announcement comes amid a race between organisations to build semiconductors that can handle increasingly demanding AI workloads.
Multinational technology giant IBM has announced the creation of what it claims is the world’s first technology capable of producing chips smaller than one nanometre.
According to IBM, the chip has a transistor architecture of 0.7 nanometres and can hold nearly 100bn transistors on a “fingernail”-sized surface, achieving roughly double the density of its 2-nanometre chip unveiled in 2021.
In order to create the chip, IBM reportedly developed a new transistor design called a nanostack, which lays transistors on top of each other in three dimensions, rather than the standard method of laying them flat, effectively fitting more into the same amount of available space.
Commenting on the achievement, Jay Gambetta, a director of IBM Research, said, “With our new nanostack architecture, we’re not just making smaller transistors, we’re reinventing how chips are built to deliver dramatically more power and energy efficiency.”
According to IBM, the new nanostack technology will also be capable of shrinking a type of memory circuit called SRAM by 40pc when compared to its previous chip technology. Production is expected to begin within the next five years and the organisation has yet to name a manufacturing partner for this technology, if there is one.
IBM’s announcement comes at a time when many organisations all over the globe are racing to become the most prominent name in the manufacturing of advanced chip technology and artificial intelligence.
In late May, leading chipmakers Micron and SK Hynix both surpassed $1trn in market value. Global semiconductor company Infineon Technologies announced earlier in June that it is set to open a new €5bn chip factory in Dresden, Germany, representing Infineon’s single largest investment. Last month, Analog Devices announced it was acquiring AI power delivery provider Empower Semiconductor in a deal valued at $1.5bn.
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
These days, a lot of embedded projects feature some sort of screen, and a screen often creates a desire for a nice user interface. [Geoffrey Wells] has created a tool for developing web interfaces for the ESP32, named ESP-GenUI.
The aim was to make UI development as easy as possible for this platform. ESP-GenUI allows the creation of a website by dragging various nodes on to a canvas and linking them up to create the desired web interface. There are nodes for GPIO control, camera feeds, gauges, and all sorts of other common elements for quickly putting together dashboards and control panels. All this is done from within the browser, and the code generated by the tool can even be flashed without having to open any external tools. Alternatively, it can spit out Arduino code that you can open and flash from within the IDE. You can try the tool out yourself right here.
We’ve featured some other great resources for developing embedded user interfaces, like this highly-flexible display library for the ESP32. Feel free to espouse on your own favorite tools and techniques in the comments.
from the good-deals-on-cool-stuff dept
flowkey is a fun, interactive piano learning platform that helps anyone go from absolute beginner to confident player — at their own pace. It combines step-by-step courses with thousands of songs you know and love, tailored for every skill level, from first-time learners to advanced pianists. The app listens as you play and gives instant feedback so you can improve faster, practice technique, and master sheet music with confidence. Whether you’re learning scales or your first full song, flowkey makes piano practice easy, fun, and rewarding. A one year subscription is on sale for $40, two years for $60, or five years for $80.
Note: The Techdirt Deals Store is powered and curated by StackSocial. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.
Filed Under: daily deal
Sports2 minutes ago
2026 MLB Mock Draft: Rays take college catcher at No. 2, three shortstops go in top four
Tech3 minutes ago
Cybersecurity firms targeted by fraudulent OpenAI organization invites
NewsBeat5 minutes ago
Manchester Airport brother sentencing RECAP as Mohammed Fahir Amaaz JAILED for three-and-a-half years after ‘cowardly’ attack
-
Entertainment6 days agoRenter of Home in Anne Heche Crash Denies Settlement With Son
-
Sports3 days agoTwo goals and an assist by sheer aura: Cristiano Ronaldo just entered the World Cup chat
-
Tech4 days agoMicrosoft accidentally kills epic Outlook email threads
-
Business6 days agoSoccer-U.S. defends Iran World Cup travel restrictions, says discussions ongoing
-
Politics12 hours agoThe House | Manchesterism won’t survive the painful trade-offs unless it gets citizens on board
-
Politics6 days agoAndy Burnham and the meaning of Makerfield
-
Politics16 hours agoPotential 2028er World Cup attendee leaderboard
-
Tech23 hours agoA Look At A Gaggle Of Transputer Boards
-
Crypto World3 days ago
Bitcoin (BTC) Dips Below $62K, Ethereum (ETH) Plunges 6% Daily: Market Watch
-
Crypto World2 days agoSecuritize Wraps Roubini's SEC-Registered ETF as Dubai VARA Digital Security
-
Crypto World1 day agoDell (DELL) Shares Tumble Over 5% Following Analyst Downgrade to Hold
-
Business3 days ago
Entergy settles forward sale agreements, raises $672 million in cash proceeds
-
Business11 hours agoAsia stock markets slide as tech shares slump
-
Business7 days agoWall Street Week Ahead: Investors see Micron earnings as pulse check of AI rally momentum
-
Crypto World6 days agoCan Charles Hoskinson Really Rescue Cardano?
-
Entertainment7 days agoJose Alvarado Wants Taylor Swift at More Knicks Games
-
Crypto World7 days agoHIVE shares jump as $220M AI deal speeds Bitcoin mining pivot
-
Crypto World4 hours agoHyperliquid Named on Singapore MAS Investor Alert Register
-
Crypto World6 days agoJake Chervinsky accuses CME of protecting derivatives monopoly
-
Tech5 days agoSignal’s Meredith Whittaker says AI chatbots ‘are not your friends’ and calls Copilot agents a backdoor
You must be logged in to post a comment Login