DJI claims Insta360 copied its Osmo Pocket 3, while Insta360 claims DJI copied its gimbals.

Whether you rent or own, there are some chores you have to complete on a near-constant basis. The good news is, you can get some help from robots and apps in your Apple Home.

I’m a firm believer in optimizing when possible. If a robot, machine, or gadget exists to speed up or even remove the need for certain tasks, I’m going to implement it.

While we’re still waiting on a robot that can fold your laundry and put it away, there are plenty of robots available that can take on your chore list. Whether it’s mowing, mopping, or changing out the litter box, there’s something available.

I’m also going to discuss managing your Apple Home via apps, at least this time maintenance and stock-specific ones. While my approach leans into Apple apps, there are third-party options that offer interesting capabilities.

This is the fourth story I’ve written in the Owning an Apple Home series. The first covered moving, the second was about whole-home audio with HomePods, and the third was about smart home tech involving pets.

Let’s get into chores, robots, and maintenance in your Apple Home.

Let the robot do it

It may seem obvious, but having a robot step in and complete a chore for you is the ultimate luxury. Thankfully, you don’t have to be filthy rich for the privilege.

You do have to be careful which robots you purchase, though, because they may not meet your expectations if they’re too cheap. Sure, there are plenty of sub-$1,000 options, but they’re not always going to be up to the task.

The way I have approached choosing the right robots so far is to look for basic capabilities like LiDAR navigation, object recognition, and overall performance. You shouldn’t be buying a bare-minimum robot the same way you probably wouldn’t buy the bare-minimum refrigerator or dishwasher.

Robot vacuum and mops

Matter works with robot vacuums and mops. Apple has adopted the Matter version that allows this, but there are very few options available.

The Narwal robot can easily clean floors and carpets

The Narwal Freo X Ultra that I use in my home isn’t Matter-compatible and won’t ever be. However, the Narwal app is good enough for the manual controls I need to have it occasionally clean the common areas.

Unlike my previous home, this one has a ledge between the living room, kitchen, and den, so the robot is confined to one half of the home. It can’t scale the ledge, and I have no interest in installing a ramp.

However, that doesn’t make the robot any less useful. It can clean all of the bedrooms, hallway, and living room without interference.

I manually sweep and mop the stone-tiled kitchen, and the den is so small the effort to clean the floor is negligible. I share this to say that a robot helping with any amount of cleaning is worth it.

There are lots of options for indoor robots, and while I won’t be making any direct recommendations today, I will say the $800 to $1,200 range should be good enough for most needs. There are tiny robots that are great for single rooms or single-purpose cleaning, but I haven’t investigated those.

It’s easy to say that a robot vacuum and mop is as essential as any other appliance in your home in 2026. There’s lots of silly marketing speak around these machines, but one thing is definitely true — they’ll take care of cleaning the floors so you don’t have to.

Robot lawn mowers

I recently published a review of my first functional robot lawn mower. There was no telling how it would perform considering my first foray into the space ended disastrously.

Mova LiDAX Ultra Lawn Mower

Thankfully, my yard in the new home isn’t what you’d call challenging. It’s a flat backyard and a 90% flat front yard with a slope off of one edge.

The Mova mower I tested handled everything without issue other than the hill and one dip in the front yard. After those issues though, it learned and didn’t get stuck again.

I’m willing to bet that some of you reading this have never even considered a robot mower. Let me tell you that it is a lifesaver, especially if you don’t particularly care for mowing or have severe allergies.

Don’t pay a mowing company, just buy a little robot and set it loose weekly for perfectly trimmed grass each week. It can sometimes roll over a weed and leave it standing, and some corners are a challenge, but you’d want to weed-eat after the mower anyway.

The key here is that instead of mowing for an hour or two each week, you have to weed-eat for ten minutes every two weeks. That’s it, chore complete.

Just trust me when I say don’t get tempted by the cheaper options. You don’t want to have to lay a boundary wire no matter how much money it saves you.

Litter robots

Now, if you’ve been reading this series, you know I’ve already discussed the Litter Robot 5 in my pets edition. However, I have to mention it here because it is one of the best chore eliminators I’ve encountered.

The litter robot takes over yet another undesirable chore

Sure, mowing sucks, and mopping isn’t exactly a delight, but cleaning the litter box is a universally hated task. My Litter Robot 5 not only handles the task, it keeps things clean and fresh without any human intervention beyond taking out the trash.

I have three cats, which means topping off the litter box and changing the trash bag about once a week. That’s it.

It’s kind of a genius product when you sit and think about it. It’s just a giant wheel with a motor, a sifting tray, and a big hole to the actual litter waste.

Sometimes the more simple solutions are the best. Really, don’t scoop your cat’s business when you can have a robot do it for you.

Air purifiers

I know an air purifier isn’t a robot, but I wanted to throw this in here since we’re talking chores and cleanliness. A well-placed air purifier can make all the difference in terms of a space’s comfort, odor, and allergen levels.

Air purifiers can keep your home air feeling fresh and work quietly in the background

Since I have three cats and allergy medication can only go so far, an air purifier helps keep things under control. I’ve got the Smartmi E1 hanging right above the Litter Robot to keep the den nice and fresh.

It’s heavily discounted and requires proprietary filters, so I’m a little concerned that it may be discontinued soon, so keep that in mind.

I’ve got another air purifier in my bedroom, the AirVersa Purelle, to keep the dust and cat dander levels in the air down. Thankfully, for both units, it’s very much a set it and forget it technology.

Our house stays fairly clean thanks to the other robots doing their tasks, but the extra bit of help from the air purifiers keeps things feeling extra fresh.

Outside the tech

I wanted to have a small diversion from tech-related talk here to say that maintaining a clean and healthy home goes beyond your little robot helpers. I’ve worked hard to ensure our home is free from toxic chemicals and harsh cleaning agents too.

I don’t want to get too hippie-dippy here, but seriously, we should all stop using those expensive and toxic cleaners like Windex, Clorox, and others. They’re packed with forever chemicals, staining agents, and irritants that only replace the mess with what is basically a slow-moving chemical spill.

We’ve gone all-natural for our cleaning supplies. There are plenty of options out there, but we’ve tried solutions from Branch Basics and Pure and Gentle.

I can also highly recommend the non-toxic air and fabric freshening scents from Grow Fragrance.

Another aspect of maintaining a clean home is ensuring chores are easy to complete. I invested in a Simplehuman trash can that has the trash bag refills readily available via a slot in the back of the can.

There are a million ways to maintain a clean, healthy, and happy home. Robots can cut down on how much time you spend cleaning, the right supplies can keep your home free of toxins, and finally, apps can help you manage everything.

Managing things via apps

Now, I’m all in on first-party Apple apps, so I primarily rely on Apple Reminders and Notes. However, there is a ton of great smart home management apps in the App Store.

Managing your Apple Home in Apple apps like Home, reminders, and Notes

I’ll probably do a story on third-party apps in general later, so I won’t get too into that today. Instead, I’ll highlight a few obvious apps related to maintenance that go a bit further than a standard reminder.

For Apple Reminders, it is the perfect place for tracking things like when you last changed a filter, when the next order for trash bags is about to go through, or just managing a grocery list.

I know there are dedicated apps that are better at each of these functions, but I like having everything in one space. I’ve set up a Reminders list just for tracking subscriptions and recurring purchases, for example.

I’ve even created reminders for which rooms I should give a specific deep clean each day. Really, Reminders is a great catch-all for anything that needs to be done on a repeating basis.

Apple Notes has become a haven for home purchase wish lists and maintenance guides. I’ve got a shared list just for what cleaning supplies we use, where to order them from, and cleaning guides for each.

Of course, third-party apps go much further.

• HomeBatteries: see the battery level of devices like sensors, locks, and other reportable devices in one place
• HomeLog: view live network conditions to troubleshoot a product’s connection
• Homepass: manage your HomeKit and Matter codes in one place

I used to use an app called Directive for logging filter changes and such, but it hasn’t been updated in five years. Other apps exist for this, but I find that Reminders is just fine for this task.

If you’ve got a shared Reminders list with your spouse, kids, or roommate, you can take things further by assigning different tasks to individuals. Reminders is a great place to manage chore lists even though it isn’t a well-advertised feature.

Where Apple Home should pick up the slack

The Apple Home app is seriously lacking in design and functionality. I agree with my colleague Oliver here. Apple Home needs an overhaul.

Apple Home needs an upgrade

When the smart home was just entering the mainstream around 2014, Apple Home made sense. It was a utilitarian app that simply showed what you had and gave you a button to press.

Today, we’re so far beyond that functionality.

Apple Home is behind on adopting the latest Matter standards. It doesn’t have icons for many products you can add. There are no troubleshooting or maintenance tracking functions, and some things feel absolutely obtuse and arbitrary.

It’s time for a change.

Everything I’ve mentioned in this story today should be managed in the Home app. Chore reminders and assignments, robot schedules, filter replacements, and even weather alerts should all be in Apple Home.

The background for each room doesn’t even sync across devices or to other users.

Apple Home is a mess that needs to be cleaned up. I shouldn’t need a third-party app for viewing battery levels or managing HomeKit codes.

WWDC 2026 didn’t address these complaints, but that doesn’t mean Apple won’t upgrade the home experience at any time. There are rumors of new home-focused products that could be announced at any time, which could warrant a new Apple Home app launch.

Racing fans are well aware that the real-life Peugeot 9X8 made waves when it debuted on the World Endurance Championship grid. Its streamlined form, lack of a traditional rear wing, and hybrid powertrain represented a new direction for Le Mans prototypes. LEGO nailed that presence in bricks with the Technic Peugeot 9X8 24H Le Mans Hybrid Hypercar (set 42156), priced at $159.99 (was $200), and the finished vehicle feels like a true centerpiece rather than simply another small desktop model.

Most LEGO supercar sets are nice and compact, but this one defies the norm, measuring approximately 20 inches long and 9 inches wide when assembled. Because of the extra space, builders can develop levels of intricacy and complexity that would be impossible to achieve with smaller sets. With 1,775 pieces, this model is quite heavy, and it rewards close inspection from all angles.

LEGO Technic Peugeot 9X8 24H Le Mans Hybrid Hypercar 42156 Collectible Race Car Building Kit for Adults…

• A celebration for race car fans – Pay tribute to 100 years of racing at Le Mans in 2023 with this authentic LEGO Technic PEUGEOT 9X8 24H Le Mans…
• Start your engines – Build the hybrid system including the detailed V6 piston engine. This impressive replica includes doors that open, front…
• Recreate the iconic details – Add the finishing touches to this replica model with car decals and PEUGEOT sponsor logos to capture the iconic look…

The build takes place across 19 numbered numbered bags and 5 building stages, immersing you from the start. You begin with the back chassis and the V6 piston engine, which is snuggled beneath a removable cover. When the rear wheels turn, you can see the engine trembling, providing a clear view of what is going on through side vents. The front section is next, and here’s where things get really interesting: LEGO has released a new electric motor for their Technic vehicles, composed of two massive gray barrels and some flexible components. The hybrid pattern extends throughout the drivetrain, and the best part? There is no need for batteries or remotes.

The suspension operates separately at each corner, which is unusual for a Technic design, with each axle having its own horizontal shock absorber to ensure stability. The steering is controlled by both the inside of the wheel and a little top-mounted knob, allowing you to navigate from the driver’s seat or above. The doors swing open in a delightful butterfly motion, and the overall item is strong enough to be handled with caution once completed.

Color-wise, you’re looking at a lot of dark gray and black, with some sleek lime green accents to mirror the look of the real car’s paint job. Two massive sticker sheets offer a lot of adornment, from sponsor logos to fine details, and the headlights have glow-in-the-dark parts that pick up any available light and shine in the same cool tone as the original Peugeot LEDs. At night, it’s an entirely different beast, and it’s extremely dramatic.

In terms of how closely it resembles the real 9X8, the accuracy is rather impressive, especially once all of the body panels are secured into place. The curved Technic pieces accurately reproduce the original’s striking front end, low profile, and massive rear diffuser. There are a few minor concessions in terms of height and visible connection points, but the overall shape captures the car’s aggressive, distinct style better than many people expected from a Technic build. When it’s finished, it looks right at home among photos of the original car on the Mulsanne Straight.

Paramount Skydance is cleared to move forward with its acquisition of Warner Bros. Discovery, the US Department of Justice announced Friday. The deal marks a tectonic shift in the American media landscape, further dwindling the number of major players in the industry and drastically expanding the influence of the Ellison family.

In its press release announcing the approval, the DoJ shot down arguments against the merger. It denied that the acquisition of Fox by Disney some years ago could be used as a case study, citing the COVID-19 pandemic as an interfering factor which renders the comparison moot. It also dismissed labor concerns which have been widely voiced by industry workers. On June 9, it was reported that The United Kingdom is conducting its own investigation of the deal, a factor which may have advanced the DoJ’s timeline.

With the acquisition of Warner and its associated brands, Paramount Skydance CEO David Ellison will run the historic Warner Bros. Studios, as well as HBO and its streaming counterpart HBO Max. CNN Worldwide, a major broadcast rightsholder for The Olympics and the NHL, among others, is also included in the deal, as is Warner Bros. Games. The company already owned Paramount and its TV subsidiaries including CBS, MTV, BET, and Nickelodeon. David Ellison’s father, the billionaire Larry Ellison, is reported to be providing $45.7 billion worth of equity to float the deal. The elder Ellison owns Oracle, a major provider of server infrastructure. Oracle recently joined a consortium of investors for a 45% stake in the American operations of the popular short-form video platform TikTok. Together, the father-son duo now control a media portfolio to rival Disney’s. (Megan Ellison, the senior Ellison’s daughter, has her own media venture which is independent of the father-son duo’s portfolio.)

The DoJ approval for the deal comes on the heels of multiple scandals at CBS News, which have sparked fear regarding the future of CNN. Larry Ellison is a personal friend of president Donald Trump, who has suggested that CNN’s current leadership is “corrupt and incompetent.” Under the Ellisons’ control of Paramount, Bari Weiss was installed as the head of CBS News, and she wasted no time gutting the legacy news organization. Now, the fear is that a similar fate could befall CNN.

Most recently, Weiss fired 60 Minutes correspondent Scott Pelley, a decision which led Pelley and remaining 60 Minutes staffers to speak out, with Pelley claiming the venerated news show is being “murdered” by Weiss. A 60 Minutes report on conditions in ICE facilities was scuttled in December, and correspondent Cecelia Vega was fired in May while working on a report about Francesca Albanese, UN special rapporteur on the occupied Palestinian territories who was sanctioned by the US. Vega’s journalistic work was withheld from her during the firing, raising concerns that her sources might be exposed by CBS.

Under Ellisons’ control, CBS also moved to cancel The Late Show with Stephen Colbert, a decision Paramount Skydance claimed was purely motivated by financial realities but which came on the heels of a Colbert segment which pointedly criticized a $16 million settlement paid to president Trump by CBS.

In May, over 5,500 movie and television industry professionals signed an open letter warning that the acquisition of Warner by Paramount would “threaten the sustainability of the entire creative community.” Signees include Glenn Close, Jane Fonda, Joaquin Phoenix, Kevin Bacon and many other household Hollywood names.

While DoJ approval was the biggest hurdle for the landmark deal, state attorneys general in California and New York have indicated their intent to bring challenges against it, in addition to an investigation by European Officials and the aforementioned investigation by the UK. Paramount Skydance has until September 30 to officially close the deal before it will become subject to a daily ticking fee of $7 million for Warner Bros. Discovery shareholders.

Large language models continue to struggle with hallucinations, presenting a major roadblock for real-world enterprise applications. Reducing these errors is a messy business, forcing model developers to navigate a strict tradeoff where eliminating factual errors often suppresses valid answers.

In a new paper, Google researchers introduce the concept of “faithful uncertainty,” a metacognitive technique that aligns a model’s response with its internal confidence. This alignment allows the model to offer appropriately hedged hypotheses, such as “My best guess is,” instead of defaulting to an unhelpful “answer-or-abstain” binary.

In real-world agentic AI applications, this metacognitive awareness acts as an essential control layer. It empowers autonomous systems to accurately determine when their internal knowledge is sufficient and when they must dynamically trigger external tools or search APIs to resolve deficits.

The utility tax of current mitigation strategies

Understanding why LLMs hallucinate hinges on separating two capabilities: a model knowing facts versus knowing what is known. Historically, most factuality gains in AI have come from expanding the knowledge boundary, meaning developers simply pack more facts into the model’s parameters through larger scale and more training data.

However, expanding a model’s knowledge does not automatically improve its boundary awareness, which is its ability to distinguish the known from the unknown and recognize its own limitations.

“There are broadly two ways to improve LLM factuality,” Gal Yona, Research Scientist at Google and co-author of the paper, told VentureBeat. The first is continuing to teach the model more facts. But, Yona notes, “model capacity is finite, and the long tail of knowledge is effectively infinite.”

Once models hit this limit, the hope is they know what they don’t know and simply abstain from answering. However, this is inherently difficult for LLMs.

“This is why most practical attempts to reduce hallucinations through various interventions don’t actually make it to deployment,” Yona explains. “They do reduce hallucinations, but they also hurt utility, because the model ends up refusing to answer questions it actually does know.”

This inability to distinguish between knowns and unknowns creates what the paper’s authors call the “utility tax.” Enforcing a zero-hallucination standard requires the model to abstain whenever it is even slightly uncertain, discarding massive volumes of completely valid information. For example, the authors demonstrate that reducing an underlying 25% error rate down to a strict 5% target forces developers to discard 52% of the model’s correct answers.

Treating all errors as hallucinations forces enterprise systems to choose between trustworthiness and helpfulness. Application developers are generally unwilling to pay this massive utility tax and render their models unhelpful.

Consequently, they optimize systems to prioritize coverage, forcing models to operate in a state where they continue to generate confident hallucinations.

Reframing hallucinations as confident errors

To move past the utility tax, the researchers propose to stop treating any factual error as a hallucination. Instead, they reframe hallucinations as “confident errors”: incorrect information delivered authoritatively without appropriate qualification.

This subtle reframing dissolves the strict “answer-or-abstain” dichotomy and allows the model to express its uncertainty.

In this new framework, if a model makes a factual mistake but appropriately hedges its response (e.g., by stating, “I am not completely sure, but I think…”), it isn’t a hallucination. It is simply a hypothesis offered to the user for consideration. By expressing uncertainty, the AI preserves its utility—sharing whatever partial or likely knowledge it has—without violating the user’s trust.

However, if an AI assistant hedges all its responses with a disclaimer, the user is forced to double-check everything, defeating the purpose of the tool entirely.

The solution the researchers propose is “faithful uncertainty.” This approach requires aligning a model’s linguistic uncertainty, or the words it uses to express doubt, with its intrinsic uncertainty, which is its actual, internal statistical confidence in that specific answer. This ensures the model only hedges when its internal state genuinely reflects conflicting or low-probability information.

Faithful uncertainty forms a core component of “metacognition,” the AI’s ability to be aware of its own uncertainty and act on it. To understand this practically, consider the intuitive example of consulting a doctor. We do not trust doctors because they are all-knowing. We trust them because they reliably distinguish between a confident diagnosis (“You have a fracture”) and an educated hypothesis (“It might be a sprain, but let’s run some tests”).

Practical implications for enterprise AI

Under the new framing, errors where a model is genuinely confident but factually incorrect are categorized as “honest mistakes.” This casts knowledge expansion (training the model on more data) and faithful uncertainty as completely complementary efforts. Knowledge expansion pushes the absolute knowledge boundary outward to minimize honest mistakes, while faithful uncertainty honestly communicates wherever that boundary currently lies.

This new framing has important implications for agentic applications. The shift to agentic AI might make it seem like knowing what the model doesn’t know is redundant, since models can just search external databases. However, access to external tools actually amplifies the need for faithful uncertainty. In agentic systems, metacognition becomes the central control layer that governs the entire system.

External tools solve the storage problem because the model no longer needs to encode every fact into its parameters. However, this introduces a new control problem: managing when to retrieve information, verify facts, and orchestrate these external tools. Without faithful uncertainty, an agent is essentially flying blind and must rely on external, static heuristics or over-engineered scaffolds.

“The model might search for something it already knows confidently—wasting latency and cost for no gain. Or the opposite: it confidently answers from memory when it should have searched, producing a plausible but wrong output,” Yona said. Today’s agent harnesses try to solve this externally with query classifiers or always-search rules, but Yona notes that these are “static and brittle.” By using its intrinsic uncertainty to regulate its own behavior, the agent dynamically optimizes its tool use, choosing to invoke a search tool only when its internal confidence is genuinely low.

Beyond deciding when to search, faithful uncertainty is critical for evaluating the results of a search. If a tool returns low-quality or unexpected information, a metacognitive agent does not blindly accept whatever appears in its context window. Instead, it uses its uncertainty awareness to weigh the retrieved external signals against its own internal priors. This prevents sycophantic behavior where the system might otherwise trust external sources that conflict with its actual known knowledge.

The bootstrapping paradox: The catch to teaching uncertainty

For enterprise builders, achieving this faithful uncertainty is trickier than it sounds. It requires teaching models the syntax of uncertainty through supervised fine-tuning (SFT). Because pre-trained models are mostly fed authoritative text, they must be explicitly taught to say things like, “I’m not entirely sure, but I think VentureBeat was founded in…”

But SFT introduces a “bootstrapping paradox.” Unlike standard training datasets where the “right answer” is the same regardless of the model, the ground truth for uncertainty is the model’s own dynamic knowledge base.

“Here’s the catch: the ‘correct’ expression of uncertainty is inherently dynamic, because it depends on what this particular model knows or doesn’t know at this particular point in training,” Yona said. “If you train on a label that says ‘I don’t know X’ but the model actually does know X, you’ve taught it to hallucinate uncertainty… The training data is static, but the target is a moving one, and that’s the fundamental tension teams need to grapple with.”

The road to self-aware AI

For enterprises looking to implement these capabilities without expensive retraining, prompting serves as the most accessible entry point. “Prompt engineering is already something most engineers do today, this provides the lowest-friction path to improving metacognitive behavior today,” Yona said. Enterprise developers can explore frameworks like MetaFaith, an open-source project previously co-authored by Yona, to begin applying metacognitive prompting to off-the-shelf models.

However, Yona cautions that “there is still substantial headroom that prompting alone doesn’t solve,” meaning the industry will eventually need to rely on advanced reinforcement learning (RL) to bake metacognition deeply into model training.

Ultimately, as enterprises transition from isolated chat applications to complex, multi-agent workflows, self-awareness will become a defining prerequisite for reliable autonomy. But evaluating whether a model truly possesses this awareness remains a profound technical challenge.

“How do you actually evaluate whether a model can sense its internal states?” Yona asks. “Even in humans, it’s hard to define or separate ‘true’ self-monitoring abilities from a capable reliance on proxies. We face exactly the same challenges with LLMs: a model might learn to mimic the style of uncertainty without truly sensing its internal state. Developing evaluation frameworks that can tell the difference is one of the most important open problems in this space.”

The brokerage says it saw “record-breaking traffic.”

Software

GitHub caught off guard by customers actually using the AI being evangelized

GitHub has been struggling with service availability in recent months as traffic on the platform has surged, driven in large part by AI-assisted coding and agentic development workflows. The code-sharing site has been trying to address those issues by expanding capacity and migrating more workloads to Azure infrastructure, but reliability remains uneven.

In the May 2026 GitHub Availability Report, GitHub acknowledges nine incidents that degraded performance, one fewer than its April report.

That’s something. But Jakub Oleksy, SVP of software engineering at GitHub, says there’s more to be done.

“We are making structural changes that permanently remove failure modes,” he said in the report. “We acknowledge that we have work to do, but we’re committed to getting it done and making GitHub reliable when and where you need it.”

Microsoft’s code hosting site also briefly halted new Copilot subscriptions to reduce the cost impact of its AI services and to adjust its Copilot pricing to account for shifting model provider policies.

As noted in an April post, GitHub had planned to increase its capacity by 10x back in October 2025, but by February 2026 it had become evident that a 30x expansion would be needed to accommodate the surge of pull requests, commits, and new repos.

Last year, GitHub reportedly handled 1 billion commits for the entire year. Now it receives 1.4 billion commits every month.

“We’re now serving 40 percent of monolith traffic from Azure (up from 8 percent in February), with Git traffic at 30 percent and repository replication at 99 percent,” said Oleksy. “We’ve more than doubled our effective capacity in four months.”

Oleksy notes that efforts to isolate GitHub’s primary database cluster by moving users, authentication, and authorization into separate domains should prevent failures that cascade across the system.

That hasn’t quite solved GitHub’s ongoing availability challenges, in part because Azure has also confronted capacity problems recently. There were nine incidents in May compared to 10 incidents in April. And June is on pace for a similar number.

The Missing GitHub Status Page, an unofficial project to track GitHub service problems, counts 12 incidents in May and reports uptime over the past 90 days at 87.26 percent. By month, the project puts GitHub availability at 78.33 percent in April, 93.86 percent in May, and 88.39 percent for June so far.

GitHub’s Official Status Page presents a far more flattering view of availability, with uptime figures mostly around 99.9 percent for the listed services.

These figures depend upon what gets counted and the duration of the disruption. GitHub’s own incident history page cites 26 incidents in April, 23 in May, and 12 to date in June.  ®

“While several organizations successfully blocked the activity or remediated the vulnerabilities, others experienced compromise, resulting in stolen data being published on the ShinyHunters DLS,” Mandiant said. (DLS is short for data leak site.)

An analysis of a bash script left in the staging environment shows the attackers performed reconnaissance on compromised organizations, including mapping the PeopleSoft configurations, viewing process scheduler, and WebLogic server XML configurations. Eventually, the threat actors established an outbound SSH connection to 176.120.22.24, the IP address hosting ShinyHunters’ DLS. The stolen data was first compressed using the zstd tool. The DLS claimed to have recovered 48GB of data from a single victim.

A partially redacted section of the ShinyHunters’ DLS.

Credit:
Mandiant

Advertisement

Advertisement

ShinyHunters has been active since at least 2019. Over the past several years, it has executed scores of hacks against some of the world’s largest companies, affecting millions of people downstream. A small sample of victims includes Ticketmaster (through the breach of Snowflake, which hosted the data), Spain’s biggest bank, Santander, and Salesforce (and, through it, Google and, reportedly, many other companies). ShinyHunters uses various techniques to gain initial access, including exploiting cloud misconfigurations and software vulnerabilities, stealing OAuth tokens, supply chain attacks, voice phishing, and other forms of social engineering.

Mandiant and Rapid7 are providing detailed indicators of compromise. They are also advising PeopleSoft customers on the steps they should take immediately. Given ShinyHunters’ success rate, all PeopleSoft users would do well to heed the calls.