The EU could be scanning your chats by October 2025 with Chat Control

Denmark kicked off its EU Presidency on July 1, 2025, and, among its first actions, lawmakers swiftly reintroduced the controversial child sexual abuse (CSAM) scanning bill to the top of the agenda.

Having been deemed by critics as Chat Control, the bill aims to introduce new obligations for all messaging services operating in Europe to scan users’ chats, even if they’re encrypted.

The proposal, however, has been failing to attract the needed majority since May 2022, with Poland’s Presidency being the last to give up on such a plan.

Denmark is a strong supporter of Chat Control. Now, the new rules could be adopted as early as October 14, 2025, if the Danish Presidency manages to find a middle ground among the countries’ members.

Crucially, according to the latest data leaked by the former MEP for the German Pirate Party, Patrick Breyer, many countries that said no to Chat Control in 2024 are now undecided, “even though the 2025 plan is even more extreme,” he added.

[…]

As per its first version, all messaging software providers would be required to perform indiscriminate scanning of private messages to look for CSAM – so-called ‘client-side scanning‘. The proposal was met with a strong backlash, and the European Court of Human Rights ended up banning all legal efforts to weaken encryption of secure communications in Europe.

In June 2024, Belgium then proposed a new text to target only shared photos, videos, and URLs, upon users’ permission. This version didn’t satisfy either the industry or voting EU members due to its coercive nature. As per the Belgian text, users must give consent to the shared material being scanned before being encrypted to keep using the functionality.

Source: The EU could be scanning your chats by October 2025 – here’s everything we know | TechRadar

Trojan horse bacteria sneak cancer-killing viruses into tumors

Researchers at Columbia Engineering have built a cancer therapy that makes bacteria and viruses work as a team. In a study published recently in Nature Biomedical Engineering, the Synthetic Biological Systems Lab shows how their system hides a virus inside a tumor-seeking bacterium, smuggles it past the immune system, and unleashes it inside cancerous tumors.

The new platform combines the bacteria’s tendency to find and attack tumors with the virus’s natural preference for infecting and killing cancerous cells. Tal Danino, an associate professor of biomedical engineering at Columbia Engineering, led the team’s effort to create the system, which is called CAPPSID (short for Coordinated Activity of Prokaryote and Picornavirus for Safe Intracellular Delivery). Charles M. Rice, an expert in virology at The Rockefeller University, collaborated with the Columbia team.

“We aimed to enhance bacterial cancer therapy by enabling the bacteria to deliver and activate a therapeutic virus directly inside tumor cells, while engineering safeguards to limit viral spread outside the tumor,” says co-lead author Jonathan PabĂłn, an MD/PhD candidate at Columbia.

The researchers believe that this technology — validated in mice — represents the first example of directly engineered cooperation between bacteria and cancer-targeting viruses.

The approach combines the bacteria’s instinct for homing in on tumors with a virus’s knack for infecting and killing cancer cells. “By bridging bacterial engineering with synthetic virology, our goal is to open a path toward multi-organism therapies that can accomplish far more than any single microbe could achieve alone,” says Zakary S. Singer, a co-lead author and former postdoctoral researcher in Tal Danino’s lab.

“This is probably our most technically advanced and novel platform to date,” says Danino, who is also affiliated with the Herbert Irving Comprehensive Cancer Center at Columbia University Irving Medical Center and Columbia’s Data Science Institute.

Sneaking past the immune system

One of the biggest hurdles in oncolytic virus therapy is the body’s own defense system. If a patient has antibodies against the virus — from a prior infection or vaccination — those antibodies can neutralize it before it reaches a tumor. The Columbia team sidestepped that problem by tucking the virus inside tumor-seeking bacteria.

“The bacteria act as an invisibility cloak, hiding the virus from circulating antibodies, and ferrying the virus to where it is needed,” Singer says.

PabĂłn says this strategy is especially important for viruses that people are already exposed to in daily life.

“Our system demonstrates that bacteria can potentially be used to launch an oncolytic virus to treat solid tumors in patients who have developed immunity to these viruses,” he says.

Targeting the tumor

The system’s bacterial half is Salmonella typhimurium, a species that naturally migrates to the low-oxygen, nutrient-rich environment inside tumors. Once there, the bacteria invade cancer cells and release the virus directly into the tumor’s interior.

“We programmed the bacteria to act as a Trojan horse by shuttling the viral RNA into tumors and then lyse themselves directly inside of cancer cells to release the viral genome, which could then spread between cancer cells,” Singer says.

By exploiting the bacteria’s tumor-homing instincts and the virus’s ability to replicate inside cancer cells, the researchers created a delivery system that can penetrate the tumor and spread throughout it — a challenge that has limited both bacteria- and virus-only approaches.

Safeguarding against runaway infections

A key concern with any live virus therapy is controlling its spread beyond the tumor. The team’s system solved that problem with a molecular trick: making sure the virus couldn’t spread without a molecule it can only get from the bacteria. Since the bacteria stay put in the tumor, this vital component (called a protease) isn’t available anywhere else in the body.

“Spreadable viral particles could only form in the vicinity of bacteria, which are needed to provide special machinery essential for viral maturation in the engineered virus, providing a synthetic dependence between microbes,” Singer says. That safeguard adds a second layer of control: even if the virus escapes the tumor, it won’t spread in healthy tissue.

“It is systems like these — specifically oriented towards enhancing the safety of these living therapies — that will be essential for translating these advances into the clinic,” Singer says.

Further research and clinical applications

This publication marks a significant step toward making this type of bacteria-virus system available for future clinical applications.

“As a physician-scientist, my goal is to bring living medicines into the clinic,” PabĂłn says. “Efforts toward clinical translation are currently underway to translate our technology out of the lab.”

Danino, Rice, Singer, and PabĂłn have filed a patent application (WO2024254419A2) with the U.S. Patent and Trademark Office related to this work.

Looking ahead, the team is testing the approach in a wider range of cancers, using different tumor types, mouse models, viruses, and payloads, with an eye to developing a “toolkit” of viral therapies that can sense and respond to specific conditions inside a cell. They are also evaluating how this system can be combined with strains of bacteria that have already demonstrated safety in clinical trials.


Story Source:

Materials provided by Columbia University School of Engineering and Applied Science. Note: Content may be edited for style and length.


Journal Reference:

  1. Zakary S. Singer, Jonathan PabĂłn, Hsinyen Huang, William Sun, Hongsheng Luo, Kailyn Rhyah Grant, Ijeoma Obi, Courtney Coker, Charles M. Rice, Tal Danino. Engineered bacteria launch and control an oncolytic virus. Nature Biomedical Engineering, 2025; DOI: 10.1038/s41551-025-01476-8

Source: Trojan horse bacteria sneak cancer-killing viruses into tumors | ScienceDaily

How Age Verification Laws Targeting Online Porn Could Be (And Should Be) Viewed As A Labor Rights Issue

[…]

While not a traditional “labor issue,” like union rights and equal pay, the government’s role in regulating and restricting forms of expression that can be produced, distributed, and monetized for entertainment media consumption is a dimension of the age-gating issue often overlooked and/or ignored.

Digital sex workers’ incomes and living conditions are dependent on platforms for content distribution. Sites like OnlyFans, Pornhub, xHamster, Chaturbate, and literally thousands more grant performers and content creators access to revenue generation opportunities that are remote, distributed, and confidential.

Due to these platforms forming the foundations of a trend-setting, technology-innovating, digitally native entertainment industry, age verification laws target digital sex workers’ means of distribution and, in a lot of cases, means of production. The overwhelming majority of adult content creators and adult performers are self-employed—classified as independent contractors and/or small business owners. Some performers have incorporated, with others adding trademarks and intellectual property protections on their branding.

Consider a few examples of adult content creators actively engaging in the activity of running a small business or self-employed enterprise. Platforms such as OnlyFans issue tax forms so that content creators can accurately report their income to the IRS and their state tax authorities. Or take the example of the performer-creator, going by the stage name Gigi Dior, duking it out with high-fashion house Christian Dior in front of the Trademark Trial and Appeal Board at the U.S. Patent and Trademark Office. Activities and actions like these aren’t seen by the vast majority of consumers—or, importantly, the critics of the entire online adult ecosystem.

We all hear the “think of the children” mantra from the Helen Lovejoys of the world daily. We are seeing it now with Collective Shout teaming up with Visa and Mastercard to clamp down on NSFW gaming. We are seeing it in the United Kingdom with calls from both the House of Commons and the House of Lords to ban certain types of pornography to comply with a broad interpretation of the Online Safety Act of 2023.

At least 40 percent of all United States residents live in jurisdictions with age verification laws. Millions of adult content creators are diverse and dynamic. Faced with all of these mounting regulatory pressures, adult entertainment performers and adult content creators—particularly those operating with marginalized identities—have developed a range of creative strategies to sustain their work, visibility, and autonomy in the national digital space. Inaccessibility is a legitimate issue that goes far beyond concerns of consumers.

While these laws are often framed as protecting children, the actual barrier they create is for adults — the lawful consumers who make up the legitimate market for adult entertainment. Under laws like Texas’s HB 1181, anyone wanting to access adult content must submit government-issued ID or sensitive personal data to a third-party vendor. Many adults are unwilling to do this, not because they wish to evade age restrictions, but because they don’t trust where that data will go, how it will be stored, or who might access it.

The result is that large numbers of adults — the only legal audience for these performers in the first place — stop visiting legitimate platforms altogether. That loss of audience directly translates into a loss of income for adult content creators. For an industry where the majority of workers are self-employed, often operating as small businesses, the shrinkage of the paying customer base is an existential threat.

This is why age verification mandates should also be seen as a labor rights issue. They are not simply regulating content; they are regulating the ability of consenting adults to transact with one another in a lawful marketplace.

[…]

Source: How Age Verification Laws Targeting Online Porn Could Be (And Should Be) Viewed As A Labor Rights Issue  | Techdirt

$81M ‘Trade Secrets’ Verdict Against Boeing Was Overturned – and Then Reinstated

14 months ago a jury ruled against Boeing, awarding $81 million in damages to failed electric airplane startup Zunum. “Zunum alleged that Boeing, while ostensibly investing seed money to get the startup off the ground, stole Zunum’s technology and actively undermined its attempts to build a business,” the Seattle Times reported at the time.

But two months later that verdict was overturned, Reuters reports, with U.S. District Judge James Robart deciding that Zunum “did not adequately identify its secrets or show that they derived their value from being kept secret.”

And then three days ago a U.S. appeals court reinstated the original $81 million award, reversing that district judge’s decision and “rejecting his finding that the information Boeing allegedly stole was not entitled to trade-secret protection.” [T]he district court erred in concluding that “Zunum failed to identify any of its alleged trade secrets with sufficient particularity”… Here, the court rejected Zunum’s repeated attempts to introduce comprehensive trade secret definitions into evidence and instead provided the jury with a court-created exhibit enumerating Zunum’s alleged trade secrets with a short description of each. Zunum’s witnesses identified the trade secrets by number, provided a basic explanation of each, and used exhibits and demonstratives to exemplify information comprising specific trade secrets.
“internal Boeing communications introduced at trial suggesting that Boeing intended to modify its own in-house designs, methods, and strategies to incorporate information from certain Zunum trade secrets…” according to the new ruling. “Under the parties’ agreement, Boeing was not permitted to use Zunum’s confidential information for any reason other than to manage its investment in Zunum.”

Reuters adds that “A spokesperson for Boeing declined to comment on the appeals court’s decision”

One final note: The appeals court also ordered the case to be assigned to a new judge after Robart revealed that his wife had acquired Boeing stock through a retirement savings account during the litigation.
Judge Robart had called that an “error”. (And judicial ethics experts interviewed by Business Insider in 2024 “characterized Robart’s trades and delayed disclosure to the parties as a minor issue,” they reported Thursday.)

But Thursday’s ruling notes that the delayed disclosure “taken together with the district court’s consistent rulings in Boeing’s favor during and after trial, could give an objective observer reason to question the district judge’s impartiality in further proceedings.”

Source: $81M ‘Trade Secrets’ Verdict Against Boeing Was Overturned – and Then Reinstated

Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere

[…] Zveare, who has found bugs in carmakers’ customer systems and vehicle management systems before, found the flaw earlier this year as part of a weekend project, he told TechCrunch.

He said while the security flaws in the portal’s login system was a challenge to find, once he found it, the bugs let him bypass the login mechanism altogether by permitting him to create a new “national admin” account.

The flaws were problematic because the buggy code loaded in the user’s browser when opening the portal’s login page, allowing the user — in this case, Zveare — to modify the code to bypass the login security checks. Zveare told TechCrunch that the carmaker found no evidence of past exploitation, suggesting he was the first to find it and report it to the carmaker.

When logged in, the account granted access to more than 1,000 of the carmakers’ dealers across the United States, he told TechCrunch.

“No one even knows that you’re just silently looking at all of these dealers’ data, all their financials, all their private stuff, all their leads,” said Zveare, in describing the access.

Zveare said one of the things he found inside the dealership portal was a national consumer lookup tool that allowed logged-in portal users to look up the vehicle and driver data of that carmaker.

In one real-world example, Zveare took a vehicle’s unique identification number from the windshield of a car in a public parking lot and used the number to identify the car’s owner. Zveare said the tool could be used to look up someone using only a customer’s first and last name.

With access to the portal, Zveare said it was also possible to pair any vehicle with a mobile account, which allows customers to remotely control some of their cars’ functions from an app, such as unlocking their cars.

Zveare said he tried this out in a real-world example using a friend’s account and with their consent. In transferring ownership to an account controlled by Zveare, he said the portal requires only an attestation — effectively a pinky promise — that the user performing the account transfer is legitimate.

“For my purposes, I just got a friend who consented to me taking over their car, and I ran with that,” Zveare told TechCrunch. “But [the portal] could basically do that to anyone just by knowing their name — which kind of freaks me out a bit — or I could just look up a car in the parking lots.”

[…]

Zveare said this was similar to a feature found in a Toyota dealer portal discovered in 2023.

“They’re just security nightmares waiting to happen,” said Zveare, speaking of the user-impersonation feature.

Once in the portal Zveare found personally identifiable customer data, some financial information, and telematics systems that allowed the real-time location tracking of rental or courtesy cars, as well as cars being shipped across the country, and the option to cancel them — though, Zveare didn’t try.

Zveare said the bugs took about a week to fix in February 2025 soon after his disclosure to the carmaker.

[…]

Source: Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere | TechCrunch

However he won’t identify the car maker – which is a real problem with bad responsible disclosure rules.

Phishing training is pretty pointless, researchers find

In a scientific study involving thousands of test subjects, eight months and four different kinds of phishing training, the average improvement rate of falling for phishing scams was a whopping 1.7%.

“Is all of this focus on training worth the outcome?” asked researcher Ariana Mirian, a senior security researcher at Censys and recently a Ph.D. student at U.C. San Diego, where the study was conducted. “Training barely works.”

[…]

Dameff and Mirian wanted scientifically rigorous, real-world results. (You can read their academic paper here.) They enrolled more than 19,000 employees of the UCSD Health system and randomly split them into five groups, each member of which would see something different when they failed a phishing test randomly sent once a month to their workplace email accounts.

  • Control: Its members got a 404 error if they clicked on a phishing link in the body of the email.
  • Generic static: This group saw a static webpage containing general information about avoiding phishing scams.
  • Generic interactive: This group was walked through an interactive question-and-answer exercise.
  • Contextual static: A static webpage again, but this time showing the exact phishing lure the subject had received and pointing out the warning signs that were missed.
  • Contextual interactive: An interactive Q&A session that walked the subject on what they missed in the specific lure they’d received.

Over the eight months of testing, however, there was little difference in improvement among the four groups that received different kinds of training. Those groups did improve a bit over the control group’s performance — by the aforementioned 1.7%.

Not what was expected

However, there were some lessons learned — not all expected. The first was that it helped a lot to change up the phishing lures. Most subjects saw right through a phishing email that urged the recipients to change their Outlook account passwords, resulting in failure rates between 1% and 4%.

But about 30% of users clicked on a link promising information about a change in the organization’s vacation policy. Almost as many fell for one about a change in workplace dress code.

“Whoever controls the lures controls the failure rates,” said Mirian. “It’s important to have different lures in your phishing training.”

Another lesson was that given enough time, almost everyone falls for a phishing email. Over the eight months of the experiment, just over 50% failed at least once.

“Given enough time, most people get pwned,” said Mirian. “We need to stop punishing people who fail phishing tests. You’d end up punishing half the company.”

[…]

Source: Phishing training is pretty pointless, researchers find | SC Media

And for a more guerrilla approach, you may want to look at this:

Google Issues New Update Warning To 3.5 Billion Chrome Users

Google has issued a security update for its Chrome browser which you should apply right now. That’s because Google has fixed six issues in its widely-used browser, half of which are rated as having a high severity.

The Chrome Stable channel has been updated to 139.0.7258.127/.128 for Windows, Mac and 139.0.7258.127 for Linux, Google said in an advisory published on the Chrome blog. The Chrome update will roll out over the coming days and weeks, according to Google.

The latest Google Chrome security fixes come just one week after the browser maker issued an update for eight flaws and two weeks following an emergency patch for a high severity vulnerability. The Chrome update also comes after Apple released iOS 18.6, fixing a hefty list of 29 security flaws.

[…]

High Severity Issues Fixed In Google Chrome

CVE-2025-8879 is a heap buffer overflow flaw in libaom, which is rated as having a high impact. Meanwhile, CVE-2025-8880 is a race issue in V8 that Google has also rated as having a high severity.

The last high severity vulnerability is CVE-2025-8901, an out of bounds write issue in ANGLE, which allows a remote attacker to perform out of bounds memory access via a crafted HTML page.

Google details two of the medium severity flaws, CVE-2025-8881, an inappropriate implementation issue in File Picker and CVE-2025-8882, a use after free vulnerability in Aura.

None of the flaws fixed in Google Chrome have been used in real-life attacks, but some of the issues are pretty serious — especially those that can be exploited by remote attackers.

[…]

Source: Google Issues New Update Warning To 3.5 Billion Chrome Users