Join our Folding@Home team:
Main F@H site
Our team page
Support us: Subscribe Here
and buy SoylentNews Swag
We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.
A $5 billion bet on a failing technology?
In a move that defies the growing consumer rejection of electric vehicles, Hyundai has doubled down on its multi-billion dollar wager. The automaker has opened Georgia's first purpose-built EV training facility, a massive 89,000-square-foot center intended to churn out hundreds of workers for its adjacent Metaplant. This grand opening on November 5 in Ellabell comes at a moment of profound crisis for the electric vehicle industry, raising serious questions about the wisdom of investing in a technology the free market is already abandoning.
The Hyundai Mobility Training Centre, strategically located next to the Hyundai Motor Group Metaplant America in Bryan County, represents a colossal investment in the EV supply chain. The facility can train 824 workers simultaneously, preparing them for roles at the massive plant. Governor Brian Kemp celebrated the project, stating, "The Hyundai Mobility Training Center of Georgia will give thousands of people over the years the knowledge they need to benefit from this generational project."
[...] This massive push for EV workforce development stands in contrast to the reality unfolding across the automotive landscape. While Hyundai prepares to train thousands for EV assembly, Ford is reportedly on the verge of scrapping its flagship F-150 Lightning electric pickup truck. Hailed by CEO Jim Farley as a "modern Model T," the Lightning has become a symbol of EV failure, with demand described as horrendous and mounting EV losses totaling $13 billion since 2023.
Previously: Ford Will Lose $3 Billion on Electric Vehicles in 2023, It Says
Analysis of data from ESA's Solar Orbiter spacecraft from the solar south pole region reveals a surprise: The magnetic field is carried towards the pole faster than expected:
In March, ESA's spacecraft Solar Orbiter had its first clear view of the Sun's south pole. A first analysis has now been published.
The Sun is governed by a strict rhythm. The magnetic activity of the Sun displays a cyclic variation, reaching a maximum approximately every eleven years. Two enormous plasma circulations, each in one solar hemisphere, set the pace for this rhythm thus defining the Sun's eleven-year cycle: near the surface the plasma flows carry the magnetic field lines from the equator to the poles; in the solar interior, the plasma flows back to the equator in a huge cycle spanning the entire hemisphere.
Important details of this solar "magnetic field conveyor belt" are still poorly understood. The exact processes at the Sun's poles are likely to be crucial. From Earth, scientists have only a grazing view of this region making it impossible to determine the properties of the magnetic field. Most space probes have a similarly limited perspective.
Since February 2020, ESA's Solar Orbiter spacecraft has been travelling in elongated ellipses around the Sun. In March of this year, it left for the first time the plane in which the planets – and almost all other space probes – orbit the Sun. From a trajectory tilted by 17 degrees, Solar Orbiter now for the first time has a better view of the Sun's poles.
In the new publication, which appears today in the journal Astrophysical Journal Letters, researchers led by MPS analyze data from Solar Orbiter's Polarimetric and Helioseismic Imager (PHI) and Extreme-Ultraviolet Imager (EUI). The PHI data are from March 21 of this year; the EUI data cover the period from March 16 to 24. The measurements provide information about the direction of plasma flows and the magnetic field on the solar surface.
The data reveal a refined picture of the supergranulation and magnetic network of the Sun at the south pole for the first time. Supergranules are cells of hot plasma, about two to three times the size of Earth, which densely cover the surface of the Sun. Their horizontal surface flows wash magnetic field lines to their edges, creating the Sun's magnetic network: a web of strong magnetic fields.
To the surprise of the researchers, the magnetic field is seen to drift toward the poles at approximately 10 to 20 meters per second, on average, almost as fast as their counterparts at lower latitudes. Previous studies based on the ecliptic-plane observations have seen much slower drifts of the magnetic field near the high polar latitudes. Their motion offers important clues about the Sun's global plasma and magnetic field circulation.
It is still unclear whether the Sun's global "magnetic conveyor belt" does truly not slow down near the poles. The data now published only show a brief snapshot of the entire solar cycle. Further observational data, ideally covering longer time periods, are needed.
Journal Reference: L. P. Chitta et al [OPEN] 2025 ApJL 993 L45 DOI 10.3847/2041-8213/ae10a3
A bitter new drink swept through the holy cities of Mecca and Medina in the early 1500s – and ignited one of the fiercest religious debates of the late-medieval Islamic world:
A new study, published in Darah: Journal of Arabian Peninsula Studies, explores how the arrival of coffee transformed the sacred landscape of the Hijaz. Drawing on chronicles, fatwas, poetry, and eyewitness travel accounts, historian Reda Asaad Sharif reveals how what is now a daily ritual was once denounced as a dangerous novelty — banned from marketplaces and even burned in the streets of Mecca.
Sharif traces coffee's journey from Abyssinia to Yemen, where Sufi mystics used it to stay awake for night-time dhikr (remembrance of God), before it reached Mecca around the year 1500 (AH 905). Its rapid popularity with pilgrims and townspeople provoked suspicion from conservative jurists. The very word qahwa — traditionally a poetic synonym for wine — cast a shadow over the new beverage.
According to Sharif, tensions came to a head in 1509 when Meccan scholars convened at the Mujāhidiyya hall near Bāb al-ʿUmra to debate coffee's legality. The chief Shāfiʿī judge Shaykh Nūr al-Dīn ʿAlī ibn Nāṣir issued a fatwa permitting coffee, praising its ability to sharpen alertness for worship.
Opponents countered that it altered the mind; two witnesses even swore it was intoxicating. The Mamluk governor responded by ordering the arrest of coffee-sellers and the burning of their coffee husks.
In June 1511, the market inspector Khāʾir Beg enforced a sweeping ban, citing reports that people were gathering in coffeehouses "in a manner similar to taverns, where certain people gather over it, pawn their possessions, and partake in other activities that are forbidden."
Sharif notes that the dispute escalated to the top of the Mamluk state. Sultan Qānṣūh al-Ghūrī issued a decree declaring:
As for coffee, we have been informed that certain people drink it in a manner similar to wine, mixing intoxicants into it, singing to it with instruments, dancing, and swaying. It is well known that even the water of Zamzam, if consumed in such a manner, would be forbidden. Therefore, its consumption and its circulation in the markets must be prevented.
Violators were punished with "around ten lashes or more," and some were paraded through the market as a warning.
When the Ottomans replaced the Mamluks in 1517 they, too, tried to curb the spread of coffee. Several times during the 16th century orders were sent from Constantinople banning not only the drink but coffeehouses too, as they were accused of promoting immoral behaviour.
[...] Various scholars also criticized the Ottoman ban, noting that these authorities were more lenient to the use of wine and hashish. However, it was the sheer number of people who enjoyed coffee that would soon turn the tide in favour of the drink. By the end of the 16th century, the debate was practically over, not only in the Hijaz, but throughout the Middle East and Ottoman territories, with coffee and coffeehouses becoming very popular.
Journal Reference: Sharif, R. A. (2025). The Role of Hijaz Coffeehouses in Serving Pilgrims from Their Emergence until the Beginning of the 20th Century. [OPEN] Darah Journal of Arabian Peninsula Studies, 3(2), 214-255. https://doi.org/10.1163/29501768-20250203
NASA confirms Voyager spacecraft has encountered a "wall of fire" at the edge of the Solar System:
After nearly half a century of traveling through space, NASA's Voyager mission has made another astonishing discovery — one that could redefine where our Solar System truly ends.
Voyager 1, launched 47 years ago, continues to send back data from farther away than any other human-made object. The spacecraft's long journey has allowed scientists to glimpse regions of space no probe has ever reached before, offering new insight into the outermost layers of the Solar System.
According to NASA, Voyager 1 has now encountered what researchers describe as a "wall of fire," a zone where temperatures reach between 30,000 and 50,000 kelvin — roughly 30,000 degrees Celsius. The finding was made as part of ongoing efforts to understand the boundary separating our Solar System from interstellar space.
Scientists have long debated where the Solar System actually ends. Some define it by the limits of the planets' orbits; others, by the reach of the Sun's gravitational and magnetic influence. The most accepted boundary is the heliopause — the outer edge of the heliosphere, the vast bubble created by the Sun's constant stream of charged particles, known as the solar wind.
"The Sun emits a constant stream of charged particles called the solar wind, which eventually travels past all the planets to a distance three times greater than that of Pluto before being stopped by the interstellar medium," NASA explains. "This forms a giant bubble around the Sun and its planets, known as the heliosphere."
The heliopause, then, is the frontier where the solar wind's strength fades and the interstellar medium begins. Both Voyager 1 and Voyager 2 have now crossed this line, making them the only spacecraft ever to venture into true interstellar space.
One of the most striking findings from this mission concerns the alignment of magnetic fields beyond the Solar System's edge. NASA said that Voyager 2's measurements confirm what Voyager 1 had detected years earlier — that the magnetic field just outside the heliopause runs parallel to the field inside the heliosphere.
"An observation made by Voyager 2 confirms a surprising result from Voyager 1: the magnetic field in the region just beyond the heliopause is parallel to the magnetic field inside the heliosphere," NASA noted. With data from both spacecraft, scientists can now confirm that this alignment is not a coincidence but a defining characteristic of the boundary region.
[Editor's Comment: I am confused - how did Voyager 1 and Voyager 2 pass through this wall of 30,000 Celsius? Can anyone explain please?--JR]
https://www.404media.co/fbi-tries-to-unmask-owner-of-infamous-archive-is-site/
https://archive.ph/TFqAx
The FBI is attempting to unmask the owner behind archive.today, a popular archiving site that is also regularly used to bypass paywalls on the internet and to avoid sending traffic to the original publishers of web content, according to a subpoena posted by the website. The FBI subpoena says it is part of a criminal investigation, though it does not provide any details about what alleged crime is being investigated. Archive.today is also popularly known by several of its mirrors, including archive.is and archive.ph.
The subpoena, which was posted on X by archive.today on October 30, was sent by the FBI to Tucows, a popular Canadian domain registrar. It demands that Tucows give the FBI the "customer or subscriber name, address of service, and billing address" and other information about the "customer behind archive.today."
"THE INFORMATION SOUGHT THROUGH THIS SUBPOENA RELATES TO A FEDERAL CRIMINAL INVESTIGATION BEING CONDUCTED BY THE FBI," the subpoena says. "YOUR COMPANY IS REQUIRED TO FURNISH THIS INFORMATION. YOU ARE REQUESTED NOT TO DISCLOSE THE EXISTENCE OF THIS SUBPOENA INDEFINITELY AS ANY SUCH DISCLOSURE COULD INTERFERE WITH AN ONGOING INVESTIGATION AND ENFORCEMENT OF THE LAW."
The subpoena also requests "Local and long distance telephone connection records (examples include: incoming and outgoing calls, push-to-talk, and SMS/MMS connection records); Means and source of payment (including any credit card or bank account number); Records of session times and duration for Internet connectivity; Telephone or Instrument number (including IMEI, IMSI, UFMI, and ESN) and/or other customer/subscriber number(s) used to identify customer/subscriber, including any temporarily assigned network address (including Internet Protocol addresses); Types of service used (e.g. push-to-talk, text, three-way calling, email services, cloud computing, gaming services, etc.)"
The subpoena was issued on October 30 and was reported Wednesday by the German news outlet Heise. The FBI, Archive.today, and Tucows did not respond to a request for comment.
The site, which is known by both archive.today, archive.is, or any number of other mirrors, started in the early 2010s but rose to prominence during the GamerGate movement.
GamerGaters would take snapshots of articles using archive.is in order to avoid sending traffic directly to the websites that published them.
They also used the service to document changes to articles. The site has since become a widely used archiving tool and internet resource, with hundreds of millions of pages saved. It is often used to bypass website paywalls, but it is also used to save snapshots of articles or government websites that are likely to change or be deleted. It is still also widely used to avoid sending traffic to the original publisher of content.
A 2013 blog post on archive.today explains that once a page has been archived, it is very difficult to delete, and that the only way to get a page deleted from the site is to email the webmaster there: "It would be ridiculous if the site which goal is to fight the dead link problem has dead links itself."
Very little is known about the person or people who work on archive.today, though there have been numerous attempts to identify the webmasters. The most interesting is this article on a site called Gyrovague, whose crawling through various archive.today blogs and web presences suggests "it's a one-person labor of love, operated by a Russian of considerable talent and access to Europe."
A FAQ page, which has not been updated since 2013, states the site "is privately funded; there are no complex finances behind it." A post on the site's blog from 2021 says "it is doomed to die at any moment."
https://9to5linux.com/trinity-desktop-environment-r14-1-5-released-with-support-for-debian-trixie
This release also adds support for the openSUSE Leap 16, Ubuntu 25.10, Fedora Linux 43, and Red Hat Enterprise Linux 10 operating systems.
Trinity Desktop Environment (TDE) R14.1.5 desktop environment has been released for nostalgic KDE 3.5 users as the fifth maintenance release of the R14.1.x series with various new features and enhancements.
Coming almost six and a half months after Trinity Desktop Environment R14.1.4, the Trinity Desktop Environment R14.1.5 release introduces support for recent GNU/Linux distributions, including Debian 13 "Trixie", Ubuntu 25.10 (Questing Quokka), openSUSE Leap 16, Fedora Linux 43, and RHEL 10.
The nightly builds also support the upcoming Debian 14 "Forky" operating system (Debian Testing). Support for older distributions that are no longer supported has been dropped in this release, including Ubuntu 23.10 (Mantic Minotaur), openSUSE Leap 15.5, and Fedora Linux 41.
New features in Trinity Desktop Environment R14.1.5 include tiling support on multi-monitor setups, along with user-friendly tiling band settings, support for a paste command to the KRDC remote desktop client to let you send clipboard content as text, and FFmpeg 8.0 support to the K9Copy DVD backup and DVD authoring program.
This release also brings various aesthetic improvements and new blur options to the Kicker application menu, a mute toggle button to Codeine's volume slider, support for the unzip v6 date format to the Ark file archiver, and improvements to various TDE-branded artwork and a new Flying Konqi wallpaper.
Last but not least, Trinity Desktop Environment R14.1.5 adds a new option to center the pop-up menu when using the Baghira style, support for the libgpgme 2.0 library to the tdepim component, support for OpenLDAP 2.5, and smooth resize as the default selection at start to the KolourPaint paint program.
Of course, numerous bugs were fixed, so check out the full release notes for more details about the changes included in TDE R14.1.5, which you can download for Linux distros, as well as BSD and DilOS systems from the official website.
Has anybody here used it? Any comments?
- Previously:
Trinity Desktop Environment 14.1.4 Released
Life is full of negotiations. Techies focused on their career specialty may not be well prepared to negotiate, but at MIT there is a highly respected class - https://betterworld.mit.edu/spectrum/issues/spring-2025/unlocking-unique-negotiation-playbooks
Introduction to negotiation theory and practice. Applications in government, business, and nonprofit settings are examined. Combines a hands-on personal skill-building orientation with a look at pertinent tactical and strategic foundations.
Preparation insights, persuasion tools, ethical benchmarks, and institutional influences are examined as they shape our ability to analyze problems, negotiate agreements, and resolve disputes in social, organizational, and political circumstances characterized by interdependent interests.
[...]
Verdini [the Prof] received the Institute's first-ever interdisciplinary PhD in negotiation, communication, diplomacy, and leadership in 2015. "I had fallen in love with these four fields because they ask for a full presence," he says. "You can't negotiate or lead effectively if you don't know what you stand for, and you can only figure out what you stand for if you're committed in a lifelong process of self-discovery and curiosity about oneself and each other."
[...]
Maya Makarovsky '25 [...] immediately saw how the course had "altered brain chemistry" for the better. One example: in the midst of passionate, defensive arguments in a business meeting, she was able to steer the discussion back to a more productive place."Before speaking, I took a moment to think of how to create value through our different interpretations of reality, and how we could convert an adversarial critical stance to one of mutual respect to work towards progress," she says. "11.011 empowered me to step back in the heated situation and think about what I should prioritize for all stakeholders involved, which was the long-term success of the project rather than short-term ego defense."
MIT OpenCourseWare offers this class (free, online), but it appears to be taught by the previous prof, not the rockstar noted in the Spectrum link above https://ocw.mit.edu/courses/11-011-the-art-and-science-of-negotiation-spring-2006/
Are you able to negotiate effectively? How did you learn? Your AC submitter learned by working with a couple of family members who were very good at negotiating--but it wasn't efficient, it took many years for their negotiating skills to rub off.
https://9to5linux.com/mx-linux-25-infinity-is-now-available-for-download-based-on-debian-13-trixie
This release introduces new Conky configurations, along with a default Conky configuration to change between 12h (AM/PM) and 24h for the locale.
The MX Linux 25 (codename Infinity) distribution has been released today for download based on the latest Debian 13 "Trixie" operating system stable series.
MX Linux 25 features the long-term supported Linux 6.12 LTS kernel series for the standard editions and a Liquorix-flavored Linux 6.15 kernel for the KDE Plasma edition and the Xfce-based AHS (Advanced Hardware Support) edition, offering both systemd and SysVinit flavors for the Xfce and Fluxbox editions.
Highlights of MX Linux 25 include support for Debian's new deb822 format for managing sources, a Qt 6 port of the MX Tools app, a new mx-updater tool that replaces the apt-notifier package updater tool, and Wayland by default for the KDE Plasma edition.
This release also features an updated installer that now includes a function to help "replace" an existing Linux installation and support for 64-bit UEFI Secure Boot installations. Moreover, MX Linux 25 introduces systemd-cryptsetup on the systemd-based ISOs to improve support for encrypted /home partitions.
New Conky configurations have been added as well in this release, along with a default Conky configuration, allowing users to change between 12h (AM/PM) and 24h for the locale, depending on the 12h/24h time display. MX Linux 25 also updates to the mx-ease and mx-matcha themes.
The Xfce edition got an improved Whisker Menu that has been updated to the new settings format. On the other hand, the KDE Plasma edition received root actions and other service menus for the Dolphin file manager, while TLP has been removed in favor of the power-profiles-dameon to fix an issue with the power profile widget.
The Fluxbox edition received many new configuration options, a revised panel configuration, revised root-level menus, revamped "appfinder" configurations for the Rofi tool, adjustments to the default toolbar configurations and the default styles, and Audacious as the default audio player instead of DeaDBeeF.
Among other changes, the Nvidia-installer (ddm-mx) received a fallback mode for the NVIDIA developer repository function and enhanced compatibility with Wayland, while the mx-updater utility was improved to make "automatic" updates work as expected.
MX Linux 25 is available for download right now from the official website as Xfce, KDE Plasma, and Fluxbox editions featuring the Xfce 4.20, KDE Plasma 6.3.6, and Fluxbox 1.3.7 graphical environments.
On-chip TEEs withstand rooted OSes but fall instantly to cheap physical attacks:
Trusted execution environments, or TEEs, are everywhere—in blockchain architectures, virtually every cloud service, and computing involving AI, finance, and defense contractors. It's hard to overstate the reliance that entire industries have on three TEEs in particular: Confidential Compute from Nvidia, SEV-SNP from AMD, and SGX and TDX from Intel. All three come with assurances that confidential data and sensitive computing can't be viewed or altered, even if a server has suffered a complete compromise of the operating kernel.
A trio of novel physical attacks raises new questions about the true security offered by these TEES and the exaggerated promises and misconceptions coming from the big and small players using them.
The most recent attack, released Tuesday, is known as TEE.fail. It defeats the latest TEE protections from all three chipmakers. The low-cost, low-complexity attack works by placing a small piece of hardware between a single physical memory chip and the motherboard slot it plugs into. It also requires the attacker to compromise the operating system kernel. Once this three-minute attack is completed, Confidential Compute, SEV-SNP, and TDX/SDX can no longer be trusted. Unlike the Battering RAM and Wiretap attacks from last month—which worked only against CPUs using DDR4 memory—TEE.fail works against DDR5, allowing them to work against the latest TEEs.
All three chipmakers exclude physical attacks from threat models for their TEEs, also known as secure enclaves. Instead, assurances are limited to protecting data and execution from viewing or tampering, even when the kernel OS running the processor has been compromised. None of the chipmakers make these carveouts prominent, and they sometimes provide confusing statements about the TEE protections offered.
Many users of these TEEs make public assertions about the protections that are flat-out wrong, misleading, or unclear. All three chipmakers and many TEE users focus on the suitability of the enclaves for protecting servers on a network edge, which are often located in remote locations, where physical access is a top threat.
"These features keep getting broken, but that doesn't stop vendors from selling them for these use cases—and people keep believing them and spending time using them," said HD Moore, a security researcher and the founder and CEO of runZero.
He continued:
Overall, it's hard for a customer to know what they are getting when they buy confidential computing in the cloud. For on-premise deployments, it may not be obvious that physical attacks (including side channels) are specifically out of scope. This research shows that server-side TEEs are not effective against physical attacks, and even more surprising, Intel and AMD consider these out of scope. If you were expecting TEEs to provide private computing in untrusted data centers, these attacks should change your mind.
[...] Many TEE users run their infrastructure inside cloud providers such as AWS, Azure, or Google, where protections against supply-chain and physical attacks are extremely robust. That raises the bar for a TEE.fail-style attack significantly. (Whether the services could be compelled by governments with valid subpoenas to attack their own TEE is not clear.)
All these caveats notwithstanding, there's often (1) little discussion of the growing viability of cheap, physical attacks, (2) no evidence (yet) that implementations not vulnerable to the three attacks won't fall to follow-on research, or (3) no way for parties relying on TEEs to know where the servers are running and whether they're free from physical compromise.
"We don't know where the hardware is," Daniel Genkin, one of the researchers behind both TEE.fail and Wiretap, said in an interview. "From a user perspective, I don't even have a way to verify where the server is. Therefore, I have no way to verify if it's in a reputable facility or an attacker's basement."
[...] The root cause of all three physical attacks is the choice of deterministic encryption. This form of encryption produces the same ciphertext each time the same plaintext is encrypted with the same key. A TEE.fail attacker can copy ciphertext strings and use them in replay attacks. (Probabilistic encryption, by contrast, resists such attacks because the same plaintext can encrypt to a wide range of ciphertexts that are randomly chosen during the encryption process.)
[...] With possession of the key, the attacker can use the compromised server to peer into data or tamper with the code flowing through the enclave and send the relying party an assurance that the device is secure. With this key, even CPUs built by other chipmakers can send an attestation that the hardware is protected by the Intel TEEs.
[...] "Now that we have interpositioned DDR5 traffic, our work shows that even the most modern of TEEs across all vendors with available hardware is vulnerable to cheap physical attacks," Genkin said.
The equipment required by TEE.fail runs off-the-shelf gear that costs less than $1,000. One of the devices the researchers built fits into a 17-inch briefcase, so it can be smuggled into a facility housing a TEE-protected server. Once the physical attack is performed, the device does not need to be connected again. Attackers breaking TEEs on servers they operate have no need for stealth, allowing them to use a larger device, which the researchers also built.
[...] "It's a really hard problem," Moore said. "I'm not sure what the current state of the art is, but if you can't afford custom hardware, the best you can do is rely on the CPU provider's TEE, and this research shows how weak this is from the perspective of an attacker with physical access. The enclave is really a Band-Aid or hardening mechanism over a really difficult problem, and it's both imperfect and dangerous if compromised, for all sorts of reasons."
Both vulnerabilities are being exploited in wide-scale operations:
Two Windows vulnerabilities—one a zero-day that has been known to attackers since 2017 and the other a critical flaw that Microsoft initially tried and failed to patch recently—are under active exploitation in widespread attacks targeting a swath of the Internet, researchers say.
The zero-day went undiscovered until March, when security firm Trend Micro said it had been under active exploitation since 2017, by as many as 11 separate advanced persistent threats (APTs). These APT groups, often with ties to nation-states, relentlessly attack specific individuals or groups of interest. Trend Micro went on to say that the groups were exploiting the vulnerability, then tracked as ZDI-CAN-25373, to install various known post-exploitation payloads on infrastructure located in nearly 60 countries, with the US, Canada, Russia, and Korea being the most common.
Seven months later, Microsoft still hasn't patched the vulnerability, which stems from a bug in the Windows Shortcut binary format. The Windows component makes opening apps or accessing files easier and faster by allowing a single binary file to invoke them without having to navigate to their locations. In recent months, the ZDI-CAN-25373 tracking designation has been changed to CVE-2025-9491.
On Thursday, security firm Arctic Wolf reported that it observed a China-aligned threat group, tracked as UNC-6384, exploiting CVE-2025-9491 in attacks against various European nations. The final payload is a widely used remote access trojan known as PlugX. To better conceal the malware, the exploit keeps the binary file encrypted in the RC4 format until the final step in the attack.
"The breadth of targeting across multiple European nations within a condensed timeframe suggests either a large-scale coordinated intelligence collection operation or deployment of multiple parallel operational teams with shared tooling but independent targeting," Arctic Wolf said. "The consistency in tradecraft across disparate targets indicates centralized tool development and operational security standards even if execution is distributed across multiple teams."
With no patch available, Windows users are left with a limited number of options for fending off attacks. The most effective countermeasure is locking down .lnk functions by blocking or restricting the usage of .lnk files from untrusted origins. This can be done by setting the Windows Explorer to disable the automatic resolution of such files. The severity rating for CVE-2025-9491 is 7 out of 10.
The other Windows vulnerability was patched last week, when Microsoft issued an unscheduled update. CVE-2025-59287 carries a severity rating of 9.8. It resides in the Windows Server Update Services, which administrators use to install, patch, or delete apps on vast fleets of servers. Microsoft previously attempted to patch the potentially wormable remote code execution vulnerability, caused by a serialization flaw, a week earlier in its October Patch Tuesday release. Publicly released proof-of-concept code quickly proved that the attempted fix was incomplete
Around the same time that Microsoft released its second fix, security firm Huntress said it had observed the WSUS flaw being exploited starting on October 23. Security firm Eye reported the same finding shortly after.
Packages downloaded from NPM can fetch dependencies from untrusted sites:
Attackers are exploiting a major weakness that has allowed them access to the NPM code repository with more than 100 credential-stealing packages since August, mostly without detection.
The finding, laid out Wednesday by security firm Koi, brings attention to an NPM practice that allows installed packages to automatically pull down and run unvetted packages from untrusted domains. Koi said a campaign it tracks as PhantomRaven has exploited NPM's use of "Remote Dynamic Dependencies" to flood NPM with 126 malicious packages that have been downloaded more than 86,000 times. Some 80 of those packages remained available as of Wednesday morning, Koi said.
"PhantomRaven demonstrates how sophisticated attackers are getting [better] at exploiting blind spots in traditional security tooling," Koi's Oren Yomtov wrote. "Remote Dynamic Dependencies aren't visible to static analysis."
Remote Dynamic Dependencies provide greater flexibility in accessing dependencies—the code libraries that are mandatory for many other packages to work. Normally, dependencies are visible to the developer installing the package. They're usually downloaded from NPM's trusted infrastructure.
RDD works differently. It allows a package to download dependencies from untrusted websites, even those that connect over HTTP, which is unencrypted. The PhantomRaven attackers exploited this leniency by including code in the 126 packages uploaded to NPM. The code downloads malicious dependencies from URLs, including http://packages.storeartifact.com/npm/unused-imports. Koi said these dependencies are "invisible" to developers and many security scanners. Instead, they show the package contains "0 Dependencies." An NPM feature causes these invisible downloads to be automatically installed.
Compounding the weakness, the dependencies are downloaded "fresh" from the attacker server each time a package is installed, rather than being cached, versioned, or otherwise static, as Koi explained:
This opens the door to sophisticated targeting. In theory, they could check the IP address of every request and serve different payloads: benign code to security researchers on VPNs, malicious code to corporate networks, specialized payloads for cloud environments. Or play the long game—return clean code for weeks to build trust and pass security scans, then flip a switch and start serving the malicious version.
[...] Anyone who regularly downloads packages from NPM should check the Koi post for a list of indicators that their system has been compromised through PhantomRaven. These indicators can be used in system scans to determine whether they've been targeted.
Under a new partnership with the government aimed at combating fraud, Britain's largest mobile carriers have committed to upgrading their networks to eliminate scammers' ability to spoof phone numbers within a year.
This agreement is part of the new Telecoms Charter, which brings together law enforcement, government agencies, and Britain's top mobile networks, including BT EE, Virgin Media O2, Vodafone Three, Tesco Mobile, TalkTalk, and Sky.
It requires carriers to upgrade their networks to indicate when calls originate from abroad, preventing fraudsters from impersonating banks, government agencies, and other trusted organizations.
"Advanced call tracing technology will also be rolled out across mobile networks to give police the intelligence to track down scammers operating across the country and dismantle their operations," the UK Home Office said in a Wednesday press release.
"New commitments to boost data sharing with the police will shine a light on the mobile networks that let scam calls slip through the net, empowering customers and making it harder for scams to go undetected."
[...] According to data shared by the UK government today, 96% of mobile users check caller ID before answering, with three-quarters blocking calls from unknown international numbers, a trend exploited by scammers who spoof UK numbers to appear local and trustworthy.
"Spoofed calls allow scammers to deceive the public with fake identities and false promises. In a major upgrade of our mobile network, call spoofing will be eliminated within a year - stripping away the tools scammers use to cheat people out of their hard-earned cash," said Minister for Fraud Lord Hanson.
Breakingviews - AI sets up Kodak moment for global consultants:
Management consultants are getting closer to their Kodak moment. The likes of $155 billion Accenture made their mark by charging corporate clients way less than what they would have had to pay to provide IT, cyber protection and offshore call centres themselves. Artificial intelligence is making the industry's dynamics look problematically like that of the camera giant that famously filed for bankruptcy protection in 2012 - after having its lunch eaten by digital competition.
As the AI boom develops, consultants are in a tricky spot. The pandemic, inflation and economic uncertainty have encouraged many of their big clients to tighten expenditure. The U.S. government, one of the biggest spenders, has been cancelling multiple billion-dollar contracts in an effort to conserve cash. In March, 10 of the largest consultants including Deloitte, Accenture, Booz Allen Hamilton, IBM and Guidehouse were targeted by the Department of Government Efficiency to justify their fees. As a result, the largest listed players' shares have collapsed by up to 30% in the past two years, against the S&P 500's 50% jump.
AI is, in some respects, a boon. In September, Accenture said it had helped it cut 11,000 jobs, and CEO Julie Sweet is set to augment that with staff that cannot be retrained. Salesforce recently laid off 4000 customer support workers. Microsoft has halted hiring in its consulting business.
Unfortunately, big clients are cottoning on to the advantages too. One finance chief of a large UK company outlined the issue for Breakingviews via an illustrative example. Say an outsourced project costs the client $1 million to do themselves, and Accenture and the like have historically been able to do the same job for $200,000. With the advent of machine learning, companies can do the same work for just $10,000.
This gives clients considerable leverage. If consultants won't lower their prices to near the relevant level, the client can find one who will. Or just do the job itself.
[...] Either way, none of this will stop clients demanding knockdown prices. Kodak did emerge from bankruptcy protection in 2013 as a smaller company that is now worth around $500 million - a far cry from the $30 billion-plus it fetched in its 1990s heyday. The risk for the consultants is a similar valuation downer.
Are any of you Soylentil independent consultants feeling this pinch?
New South Wales has banned Australians from taking ebikes on trains
[...] Those who own converted e-bikes are now banned from using certain public transport services in New South Wales.
It comes as the state government seeks to crack down on battery-related fires linked to e-mobility devices.
The new rule came into effect on November 1.
Converted e-bikes, which have become increasingly popular in recent years, are regular pedal bicycles that have been retrofitted with an electric motor and battery.
[...] According to Transport for NSW, converted e-bikes have a “higher risk of electrical failure and fire risk to DIY installations, inadequate wiring and use of second-hand batteries and incompatible or poor-quality components.”
Commercially manufactured e-bikes and shared e-bikes will still be permitted.
Riders caught bringing a banned e-bike on board face a $400 on-the-spot fine, with a maximum penalty of $1,110.
NSW’s e-bike ban could spread nationwide after a spate of similar e-bike battery fire incidents in other states have affected public transport services in recent years.
The Australian Wine Industry has had enough of counterfeits which are weighing in at an estimated cost of $70 billion. Bottle caps with NFC and an application to read the value to verify that the bottle is authentic.
Australian wines have long been sought after on international shelves, renowned for their bold flavours and global appeal.
But recent reports of counterfeit Australian wines circulating overseas are sparking new fears that one of our nation’s most valuable exports is under threat – with a growing underground market of fake bottles waiting to cash in.
It’s estimated that counterfeit wine affects up to 20 per cent of the global $350 billion wine industry, ripping off up to $70 billion a year.
And the trade is becoming more sophisticated than just crude label forgery, replicating bottles and even serial numbers with extreme accuracy.
Now, the industry is turning to technology to fight back through the use of “smart” bottle tops.
Perth company Cellr has developed a product to combat the fake wine market, with technology built directly into bottles.
The caps include Near Field Communication (NFC) and Radio Frequency Identification (RFID) chips that can be scanned using an accompanying app.
This story, from Australia's national broadcaster, details how scientists were keen to use old lead from a ship that sunk in Roman times to shield modern instruments from stray radiation.
When a 2,000-year-old Roman shipwreck was found off the Sardinian coast in 1988, it didn't just thrill archaeologists — physicists were excited too.
The discovery grabbed the attention of one in particular: Ettore Fiorini, a particle physicist with Italy's Institute for Nuclear Physics (INFN).
He didn't care too much about the ship. He was more interested in its cargo — hundreds of lead bars, each weighing 33 kilogrammes.
[...] Ancient lead is useful for sensitive physics experiments because it has lost the radioactivity that can complicate observations.
When trying to observe elementary particles, which are the tiniest building blocks that make up reality, physicists need to silence any background noise.
[...] Lead is a suitable shield from this radioactivity — which can come from cosmic rays or bananas — because it's super dense.
But freshly mined lead has some radioactive "noise" of its own, because it naturally contains a trace amount of the unstable isotope lead-210, which releases energy as it decays.
[...] Which is why, according to metallurgist Kevin Laws of the University of New South Wales, physicists are on the lookout for lead mined during ancient Roman times.
It has had plenty of time to become stable.
"But there is debate that by utilising lead from sources such as shipwrecks we are destroying historical items and record," Dr Laws says.