Chinese Hackers Breached Foreign Ministers’ Exchange Email Servers

Chinese hackers breached email servers of foreign ministers as part of a years-long effort targeting the communications of diplomats around the world, according to researchers at the cybersecurity firm Palo Alto Networks Inc.

Attackers accessed Microsoft Exchange email servers, gaining the ability to search for information at some foreign ministries, said the team at Unit 42, the threat intelligence division of Palo Alto Networks, which has been tracking the group for nearly three years.

Hackers specifically searched in the email servers for key terms related to a China-Arab summit in Riyadh, Saudi Arabia, in 2022, said Lior Rochberger, senior researcher at the company. They also searched for names such as including Chinese President Xi Jinping and his wife, Peng Liyuan, in the context of that summit, the researchers said.

The researchers declined to specifically identify which countries had their systems breached in the hacking campaign, but wrote in the report that the group’s targeting patterns “align consistently with the People’s Republic of China (PRC) economic and geopolitical interests.”

[…]

“When I found them searching for specific diplomatic keywords and then exfiltrating emails from embassies and military operations, I realized this was a serious intelligence collection effort,” Rochberger said.

[…]

Source: Chinese Hackers Breached Foreign Ministers’ Email Servers

So that sounds like it was the Cloud version of Exchange was targeted. You would think that countries would have some respect for their own security and not have their data in the US on a US company servers. But no, their procurement departments are led by idiots who are now complaining that there are no alternatives – probably because they didn’t fund the alternatives that do exist.

YouTube coughs up $24.5 million to make Trump case (with no legal leg to stand on) go away. Oh, is that a bribe then?

YouTube has agreed to pay $24.5 million to end the case brought by US president Donald Trump, who alleged the vid-streamer had infringed his freedom of speech.

The case stems from the events of January 6th, 2020, when supporters of the president stormed the US Capitol building and attempted to disrupt certification of the presidential election that Trump lost. YouTube, Meta, and Twitter all suspended Trump’s accounts after January 6th, because they felt the president might use their platforms to incite violence.

Once out of office, Trump sued all three. His case [PDF] against YouTube claimed the video outfit deprived him of the constitutional right to freedom of speech. Lawyers at the time pointed out Trump didn’t have a legal leg to stand on, because corporations are not required to guarantee or preserve free speech.

Meta and Twitter nonetheless settled their cases, and on Monday YouTube did likewise.

A court filing [PDF] states that the settlement is not “an admission of liability or fault on the part of the Defendants or their agents, servants, or employees, and is entered into by all Parties for the sole purpose of compromising disputed claims and avoiding the expenses and risks of further litigation.”

President Trump is a paper billionaire. Alphabet, YouTube’s parent company, reported annual revenue of $350 billion for its last full financial year, and net income of $100 billion. YouTube alone generates revenue close to $10 billion each quarter.

The vid-streamer can therefore afford to litigate.

The risks of litigation are another matter, as the second Trump administration has seemingly looked favorably on companies engaged in activities that might require the federal government’s approval, and which resolve matters close to the president’s heart.

Google could certainly benefit from good relations with the administration, as it faces possible appeals against a recent antitrust judgment that left its monopolies intact, and seeks approval to build new datacenters to run AI workloads.

This settlement might help because Trump has directed one $22 million payment YouTube will make to the body overseeing his pet project – construction of a ballroom at the White House. Another $2.5 million payment will go to plaintiffs who joined the case and also felt YouTube infringed their rights.

YouTube has not commented on the matter at the time of writing. ®

Source: YouTube coughs up $24.5 million to make Trump case go away • The Register

Innovative aviation projects cleared for take off – UK invests paltry $4.4m in 14 projects.

An investment of £4.4 million across 14 innovative aviation projects will support areas such as the NHS, emergency services and nature restoration in the UK.

Innovate UK, in partnership with the Department for Transport, has announced the latest group of projects to receive funding from the Future Flight Programme.

The programme encourages the innovative use of aviation technologies to support a variety of challenges in the UK, including:

  • medical supply chains
  • protecting national infrastructure
  • agricultural restoration

Project ambitions

Eight of the projects are for strategic growth, to demonstrate progress towards commercialisation.

These focus on real-world operations proving use cases in a variety of sectors, from agriculture to healthcare and provide tangible insights to support regulatory development in key areas.

Six of the projects are regional demonstrators, which have been funded to enable local areas across the UK to plan for the adoption and integration of drones.

This includes passenger carrying eVTOL (Electric Vertical Take-off and Landing) and zero emission conventional aircraft.

[…]

Full list of funded projects

Strategic Growth projects

Advanced Logistics BVLOS UAV Mission (ALBUM)

Partners include:

  • ARC Aerosystems
  • Highlands and Islands Transport Partnership
  • Acroflight
  • Scubatx

This project will test a large, uncrewed aerial vehicle (UAV) in Beyond Visual Line of Sight (BVLOS) operations.

This was a key step towards commercialisation of ARC’s heavy cargo for mid-mile logistics with up to 100kg payload and flying long distances of up to 400km.

It aims to revolutionise logistics and medical transport in remote areas, such as the Scottish Highlands and Islands.

ALIAS II: Regulatory Policy Concepts Enabling Integrated Traffic Management (ITM)

Partners include:

  • Volant Autonomy
  • Snowdonia Aerospace Centre
  • Planefinder
  • Draken Europe
  • DroneCloud

This project aims to demonstrate an ITM system that will allow drones, air taxis, and traditional crewed aircraft to safely operate together in the same airspace.

It will use a combination of simulations and real-world flight trials of an advanced Detect and Avoid capability at the Snowdonia Aerospace Centre.

Beyond Restoration

Partners include:

  • Autospray Systems
  • National Trust
  • Woodland Trust
  • North Pennines National Landscape
  • Skypointe

This project aims to deploy a fleet of drones to apply lime, native seed mixes, fertiliser and tree seeds across ecologically significant sites in England, Wales and Scotland.

It offers an innovative, scalable alternative to manual spreading, using heavy-lift drones operating BVLOS to deliver restoration materials over remote and degraded land.

Containment with Confidence

Partners include:

  • Flare Bright
  • RPAS Heroes
  • National Gas Transmission
  • Satellite Applications Catapult

This project aims to help National Gas improve how it monitors the safety of its pipelines by replacing periodic helicopter inspections with a more efficient and environmentally friendly drone-based system.

By moving from helicopters to BVLOS drones, this project will enable National Gas to reduce its carbon emissions and demonstrate that drone-based systems can be harnessed to improve UK energy security and infrastructure monitoring.

“Dragon’s Heart”: A Welsh Medical Drone Delivery Network (MDDN)

Partners include:

  • Snowdonia Aerospace
  • Volant Autonomy
  • Skyports Deliveries
  • SLiNK-TECH

This project is building a Welsh MDDN to increase NHS operational flexibility and improve connectivity for all health and social care providers across Wales.

Drone as a First Responder

Partners include:

  • Idroneinnovations
  • SLiNK-TECH
  • Leading Edge Power
  • Thames Valley Police
  • Hampshire and Isle of Wight Constabulary

This project is developing advanced automated drone systems to improve the safety, speed and cost efficiency of infrastructure inspections, emergency response and public safety operations.

Its modular, adaptable platform will help organisations such as emergency services and infrastructure operators integrate drones into routine workflows more easily.

London Health Bridge Growth

Partners include:

  • Apian
  • Matternet UK

This project is an expansion of an existing medical drone delivery service trial, aiming to significantly increase the number of medical samples delivered by drone and create a multi-site logistics network for the NHS.

Scaling BVLOS Operations for Critical National Infrastructure (Project SOCNI)

Partners include:

  • DroneCloud
  • NATS
  • Network Rail
  • Transport for Wales
  • Railscape
  • British Transport Police

This project will create a structured approach to designing, deploying and testing safety mitigations across national infrastructures, to improve incident management and asset inspection in a real-world rail environment.

Regional Demonstrator projects

Future Air: Southwest

Partners include:

  • Daedal Research
  • Somerset Council
  • Isles of Scilly Skybus

This project aims to overcome the significant obstacles to using eVTOLs and Zero Emission Conventional Take-off and Landing for commercial purposes.

It will look at all the challenges at once, including those related to regulations, how the aircraft are operated, the money needed, and social acceptance.

By simultaneously evaluating the full range of challenges, it will develop solutions that enable scalable BVLOS drone capabilities.

OXCAM AAM Corridor

Partners include:

  • Skyports Infrastructure
  • Bristow Helicopters
  • NATS
  • Vertical Aerospace Group
  • Oxfordshire County Council

This project aims to demonstrate the commercial and operational viability of Advanced Air Mobility (AAM), like passenger and cargo services using eVTOLs, between Oxford and Cambridge.

This will test and identify real-world, commercially viable uses for this new technology, addressing the social and economic needs of the area.

The project will culminate in live demo flights of Vertical Aerospace’s VX4 aircraft from Skyports’ Bicester Vertiport.

Regional Offshore Cargo Drone Demonstrator

Partners include:

  • Flowcopter
  • AYR Logistics
  • Angus Council

This project aims to demonstrate how a new heavy-lift drone can be used for logistics and maintenance at offshore wind farms.

The project tackles a major problem for the wind energy industry which is the cost and difficulty of transporting equipment in bad weather.

By using a heavy-lift drone, the project will provide a safer, faster, and cheaper alternative, which is crucial for the efficient operation and maintenance of the UK’s offshore wind farms.

Project RESCUE

Partners include:

  • Somerset Council
  • Limosaero
  • Land and Minerals Consulting

This project is a collaboration between Somerset Council, emergency services and specialised drone companies.

Its main goal is to develop a minimum viable product for a sustainable drone-based service.

The project will focus on environmental monitoring to allow for rapid response to critical weather events.

Testing in real-world scenarios, including monitoring floods and assisting with search and rescue operations.

SATE: Highlands and Islands Regional Pathway to Sustainable Aviation

Partners include:

  • Highlands and Islands Transport Partnership
  • University of the Highlands and Islands
  • Urban Foresight
  • European Marine Energy Centre
  • Windracers
  • Skyports Deliveries
  • Hybrid Air Vehicles
  • Streamline Shipping Agencies
  • Cormorant SEAplanes
  • Cranfield Aerospace Solutions
  • Loganair
  • Regional and Business Airports Group
  • Shetland Islands Council

This project will develop a Regional Sustainable Aviation Strategy that outlines a clear roadmap for how new technologies can be put into service in the area.

It will not just focus on the technology itself but will also calculate the financial and social benefits that better air connectivity will bring to the region.

Project URBAN ASCENT

Partners include:

  • Coventry City Council
  • Skyfarer
  • Coventry University
  • SLiNK-TECH
  • Manufacturing Technology Centre
  • Altitude Angel
  • Odys Aviation

This project, based in Coventry and the West Midlands, aims to create a scalable plan for integrating drones and eVTOLs into UK cities.

By addressing the challenges of integrating drones and air taxis into a complex urban environment, it will lay the foundation for new services that can provide significant economic and social benefits.

This includes faster and more efficient transport of goods and people within cities.

Source: Innovative aviation projects cleared for take off – UKRI

4.4m in 14 projects ensures that they won’t really have enough money to make it. Hopefully this is the start of iterative funding though.

Ladybird Browser Gains Cloudflare Support to Challenge the Status Quo

In a somewhat unexpected move, Cloudflare has announced its sponsorship of the Ladybird browser, an independent (still-in-development) open-source initiative aimed at developing a modern, standalone web browser engine. It’s a project launched by GitHub’s co-founder and former CEO, Chris Wanstrath, and tech visionary Andreas Kling.

It’s written in C++, and designed to be fast, standards-compliant, and free of external dependencies. Its main selling point? Unlike most alternative browsers today, Ladybird doesn’t sit on top of Chromium or WebKit.

Instead, it’s building a completely new rendering engine from scratch, which is a rare thing in today’s web landscape. For reference, the vast majority of web traffic currently runs through engines developed by either Google (Blink/Chromium), Apple (WebKit), or Mozilla (Gecko).

The sponsorship means the Ladybird team will have more resources to accelerate development. This includes paying developers to work on crucial features, such as JavaScript support, rendering improvements, and compatibility with modern web applications. Just to remind you, last year the project was already funded with $1 million from Wanstrath and his family.

Cloudflare stated that its support is part of a broader initiative to keep the web open, where competition and multiple implementations can drive enhanced security, performance, and innovation.

[…]

Source: Ladybird Browser Gains Cloudflare Support to Challenge the Status Quo

The browser wars in the 2000s were not lite for no reason – the browser is the viewing portal to the world and who controls the underlying technology is also the harvester of information. Something that most Chrome users don’t really understand.

UK offers JLR landmark £1.5B loan to safeguard suppliers after cyberattack – which we still don’t know what happened. 

The UK government is stepping in with financial support for Jaguar Land Rover, providing it with a hefty loan as it continues to battle the fallout from a cyberattack.

A government-backed loan to the tune of £1.5 billion ($2 billion) will be made available to the carmaker to support its recovery and the companies in its extensive supply chain struggling as JLR brings its invoicing systems back online.

Business secretary Peter Kyle said: “This cyberattack was not only an assault on an iconic British brand, but on our world-leading automotive sector and the men and women whose livelihoods depend on it.

“Following our decisive action, this loan guarantee will help support the supply chain and protect skilled jobs in the West Midlands, Merseyside, and throughout the UK.

“We’re backing our automotive sector for the long term through our modern Industrial Strategy and the landmark trade deals we’ve signed to boost exports, as part of our Plan for Change.”

[…]

JLR’s production plants have remained closed since August 31, and the impact on its suppliers – and local communities – is said to be severe.

Workers and their families fear for their jobs after seeing suppliers, many of which rely on their big JLR contracts, already initiate redundancy proceedings.

Then there are the smaller businesses that serve local communities. With JLR’s main production plants being based in Solihull and Halewood – employing roughly 9,000 and 3,000 workers respectively – businesses such as sandwich shops and cafes have seen a significant loss in revenue.

When these businesses lose out, so do their suppliers, such as bakers and butchers, meaning the impact of JLR’s attack extends far beyond what is typical for such cases.

[…]

It is estimated that the impact of the cyberattack threatens around 120,000 jobs at JLR and companies across its supply chain.

David Bailey, professor of business economics at the University of Birmingham, said JLR could be hemorrhaging between £5-10 million ($6-13 million) for every day that production remains halted.

He estimated that JLR could ultimately lose out on £2.2 billion ($2.9 billion) in revenue and £150 million ($202 million) in profit.

[…]

Source: UK offers JLR landmark £1.5B loan to safeguard suppliers • The Register

The Internet Reacts To Electronic Arts’ $55 Billion Acquisition

After reports sprouted up last week that Electronic Arts, the publisher behind The Sims, BioWare’s catalog, and most of your favorite sports games, was being acquired for over $50 billion in a joint venture between Saudi Arabia’s Private Investor Fund, Silver Lake, and the Jared Kushner-owned Affinity Partners, the company has officially confirmed the deal. If approved, the acquisition would be one of the most expensive in the history of the video game industry and would make Electronic Arts a privately held company. Given the questionable ownership, the internet is not taking the news well.

The Saudi Arabian government’s attempts at sportswashing away the stink of its dire human rights laws, as evidenced by its investments in various facets of the video game industry, are well-documented at this point.

[…]

Given Saudi Arabia’s treatment of queer people, a fair bit of concern has been extended specifically to The Sims and to BioWare, the developer of Mass Effect and Dragon Age, all of which have been trailblazers for queer representation in video games. EA CEO Andrew Wilson has stated in an email statement to staff that the company’s “values and [its] commitment to players and fans around the world remain unchanged,” but considering that both the Saudi Arabian government and Jared Kushner, the owner of Affinity Partners and Donald Trump’s son-in-law, now own the publisher, that’s not exactly convincing.

[…]

The Saudi government’s influence on the games it has money in has thus far resulted in some bizarre shit, such as soccer player Cristiano Ronaldo showing up in the latest Fatal Fury, though developer SNK has insisted the company’s sale to PIF would not affect its games. Beyond that, the Saudi Arabian government has been hosting events with industry figureheads like Hideo Kojima. The nation’s monetary investment in video games has been extensive, but buying one of the biggest companies in the space, whose games are played by millions every year, is almost certainly the farthest-reaching move it’s made thus far. We don’t know what impact this will have on EA, its studios, and its IP in the future, but in this moment, things look bleak.

Source: The Internet Reacts To Electronic Arts’ $55 Billion Acquisition

So yes, maybe EA will have more money to make more games, but they will be right wing nutcase / religious games, heavily censored. Considering that the gaming industry is larger than Hollywood and the shared experiences from gaming shape our culture, this is a pretty iron grip on what it is that we see, experience and how we experience it. Gaming tells us who are the goodies and the baddies and now this is under control of some very dubious people.

Israeli military company now owns many popular VPN products

Social media users are calling for the mass cancellation of ExpressVPN subscriptions after it was revealed that a cybersecurity firm with Israeli ties owns the popular privacy service.

In 2021, The Times of Israel reported that Kape Technologies, a British-Israeli digital security company, acquired ExpressVPN, one of the world’s largest virtual private network (VPN) providers, for nearly $1bn.

[…]

Kape Technologies, based in London and founded in 2010, has previously acquired VPN services, including CyberGhost, ZenMate, and Private Internet Access.

People across social media have urged users to delete the app, citing concerns over surveillance, military ties, and ethical complicity.

[…]

Source: Outcry over ExpressVPN ownership: What the Israeli connection means for user privacy | Middle East Eye

Seemingly safe to use at the time of writing: NordVPN, Surfshark, Mullvad (please do your own research!)

New digital ID will be mandatory to work in the UK. Ausweiss bitte!

Digital ID will be mandatory in order to work in the UK, as part of plans to tackle illegal migration.

Sir Keir Starmer said the new digital ID scheme would make it tougher to work in the UK illegally and offer “countless benefits” to citizens, while his senior minister Darren Jones said it could be “the bedrock of the modern state”.

However, opposition parties argued the proposals would not stop people crossing the Channel in small boats.

The prime minister set out his plans in a broader speech to a gathering of world leaders, in which he said it had been “too easy” for people to work illegally in the UK because the centre-left had been “squeamish” about saying things that were “clearly true”.

[…]

Another Labour prime minister, Sir Tony Blair, tried to introduce compulsory ID cards but the idea was scrapped by the Conservative-Lib Dem coalition in 2010.

However, Sir Keir has recently said he believes the debate has “moved on in the last 20 years” as “we all carry a lot more digital ID now than we did”.

Labour believes its new proposal has public support, although more than a million people have signed a petition against the idea.

Conservative leader Kemi Badenoch said the plan would “do nothing to stop the boats” but would “end up being used against law-abiding citizens while crooks walk free”.

She also expressed concern about the security of the data saying it would be a risk to put the information “in one database”.

Liberal Democrat leader Sir Ed Davey said his party would “fight tooth and nail” against the scheme which would “add to our tax bills and bureaucracy, whilst doing next to nothing to tackle channel crossings”.

Some campaign groups have also objected to the plan, with Liberty arguing it raised “huge concerns” about mass surveillance, while Big Brother Watch said it would make the country “less free”.

[…]

The new digital ID will be held on people’s phones, in a similar way to contactless payment cards or the NHS app.

It is expected to include a person’s name, date of birth, nationality or residency status and a photo.

The consultation will also consider whether additional information such as an address should be included.

[…]

The government said the roll-out would eventually make it simpler to apply for services like driving licences, childcare and welfare – as well as streamlining access to tax records.

[…]

Emlyn Jenkins, 23, is against digital IDs, describing the plan as “fascistic and horrible”.

“How will people who are homeless be affected if they don’t have access to a smartphone or they don’t have access to consistent internet?” she asked.

Arianwen Fox-James, 20, says she can see some practical benefits but is uncomfortable with the idea of a “centralised hub of all the data”.

[…]

data safety. “Every time these things get launched they get hacked,” she says. “Everyone hacks everything.”

Source: New digital ID will be mandatory to work in the UK

Another point: to fight migrants “taking jobs”  (hint: they are not) they are going to make it more difficult for those who don’t have jobs by making them incur costs and difficulties to get a government issued ID somehow and for temporary employers to check the validity of these IDs. So that will probably actually raise the amount of illegal work being done.

Chinese hackers breach US software and law firms amid trade fight

A team of suspected Chinese hackers has infiltrated US software developers and law firms in a sophisticated campaign to collect intelligence that could help Beijing in its ongoing trade fight with Washington, cybersecurity firm Mandiant said Wednesday.

The hackers have been rampant in recent weeks, hitting the cloud-computing firms that numerous American companies rely on to store key data, Mandiant, which is owned by Google, said. In a sign of how important China’s hacking army is in the race for tech supremacy, the hackers have also stolen US tech firms’ proprietary software and used it to find new vulnerabilities to burrow deeper into networks, according to Mandiant.

The FBI is investigating the intrusions and US officials are still trying to understand the full scope of the hacks, sources told CNN.

It’s a fresh five-alarm fire for the FBI’s cyber experts, who at any given time are investigating multiple sophisticated Chinese cyber-espionage campaigns aimed at US government and corporate secrets.

In some cases, the hackers have lurked undetected in the US corporate networks for over a year, quietly collecting intelligence, Mandiant said.

The disclosure comes after the Trump administration escalated America’s trade war with China this spring by slapping unprecedented tariffs on Chinese exports to the United States. The tit-for-tat tariffs set off a scramble in both governments to understand each other’s positions.

[…]

Source: Chinese hackers breach US software and law firms amid trade fight, experts say | CNN Politics

Scientists develop ‘glue gun’ that 3D prints bone grafts directly onto fractures

Researchers have modified a standard glue gun to 3D print a bone-like material directly onto fractures, paving the way for its use in operating rooms.

The device, which has so far been tested in rabbits, would be particularly useful for fixing irregularly shaped fractures during surgery, the researchers say.

[…]

Typically, large fractures or other defects in bones require bone grafting and the use of a metal fastener, such as a pin or plate, to support the broken bone as it heals. But because the shape of these implants is not specific to a given patient’s fracture, this can result in poor alignment and compromised stability of the bone.

Previous studies have shown that 3D printing bespoke bone grafts for individual patients can be done, but these required considerable time and effort to make, preventing them from being used on the fly during surgery.

Now, in a study published Friday (Sept. 5) in the journal Device, Lee and colleagues detailed their new method of 3D printing a bone substitute directly onto a fracture using a glue gun.

Source: Scientists develop ‘glue gun’ that 3D prints bone grafts directly onto fractures | Live Science

When Fisker EV collapsed, its customers became the car company to keep it running

In June 2024, seven months after Fleming’s purchase, Fisker collapsed into bankruptcy, having only delivered 11,000 vehicles.

Early adopters were left with cars plagued by battery failures, glitchy software, inconsistent key fobs, and door handles that did not always open. With the company gone, there was no way to fix any issues. Regulators logged dozens of complaints as replacement parts vanished. Passionate owners who spent top dollar on high-end trims saw their cars reduced to expensive driveway ornaments.

Rather than accept defeat, thousands of Ocean owners have organized into their own makeshift car company. The Fisker Owners Association (FOA) is a nonprofit that’s launched third-party apps, built a global parts supply chain, and came together around a future for their orphaned vehicles. It’s part car club, part tech startup, part survival mission. Fleming now serves as the organization’s president.

[…]

So far, 4,055 Ocean owners have signed up, paying $550 a year in dues that the group estimates will raise around $3 million annually, about 0.1 percent of Fisker’s peak valuation. Only verified Ocean owners can become full members, but anyone can donate.

The grassroots effort has precedent — DeLorean diehards and Saab enthusiasts have kept their favorite brands alive after factory closures. But those efforts focused on preserving aging vehicles. FOA is attempting something different: real-time software updates and hardware improvements for a connected, two-year-old EV fleet.

[…]

The organization has spawned three separate companies. Tsunami Automotive handles parts in North America while Tidal Wave covers Europe, scavenging insurance auctions and contracting with tooling manufacturers to reproduce components. UnderCurrent Automotive, run by former Google and Apple engineers, focuses on software solutions.

UnderCurrent’s first product is OceanLink Pro, a third-party mobile app now used by over 1,200 members that restores basic EV features, such as remote battery monitoring and climate control. A companion device called OceanLink Pulse adds wireless CarPlay and Android Auto, with plans for future upgrades including keyless entry.

“Those are things you would have expected to be in a $70,000 luxury car,” Bagley says. “But, you know, we’re happy to provide what the billion-dollar automaker apparently couldn’t.”

[…]

Source: When this EV maker collapsed, its customers became the car company | The Verge

For this kind of stuff to work, you need right to repair laws. You need the IP of the company to release so that software engineers can interface with the existing software.

Mesh-Mapper – Drone Remote ID mapping and mesh alerts

Project Overview

The FAA’s Remote ID requirement, which became mandatory for most drones in September 2023, means every compliant drone now broadcasts its location, pilot position, and identification data via WiFi or Bluetooth. While this regulation was designed for safety and accountability (or to violate pilot privacy 😊), it also creates an unprecedented opportunity for personal airspace awareness.

This project harnesses that data stream to create a comprehensive detection and tracking system that puts you in control of knowing what’s flying overhead. Built around the powerful dual-core Xiao ESP32 S3 microcontroller, the system captures Remote ID transmissions on both WiFi and Bluetooth simultaneously, feeding the data into a sophisticated Python Flask web application that provides real-time visualization and logging.

But here’s where it gets really interesting: the system also integrates with Meshtastic networks, allowing multiple detection nodes to share information across a mesh network. This means you can deploy several ESP32 nodes across your property or neighborhood and have them all contribute to a unified picture of drone activity in your area.

Why This Project Matters

Remote ID represents a fundamental shift in airspace transparency. For the first time, civilian drones are required to broadcast their identity and location continuously. This creates opportunities for:

  • Privacy Protection: Know when drones are operating near your property and who is operating them
  • Personal Security: Monitor activity around sensitive locations like your home or business
  • Community Awareness: Share drone activity information with neighbors through mesh networks
  • Research: Understand drone traffic patterns and airspace usage in your area
  • Education: Learn about wireless protocols and modern airspace management
The key difference between this system and commercial drone detection 
solutions is that it puts the power of airspace awareness directly in your 
hands, using affordable hardware and open-source software.

While you can build this project using off-the-shelf ESP32 development boards, I’ve designed custom PCBs specifically optimized for Remote ID detection integration with Meshtastic that are that are available on my Tindie store. Thank you PCBway for the awesome boards! The combination of their top tier quality, competitive pricing, fast turnaround times, and stellar customer service makes PCBWay the go-to choice for professional PCB fabrication, whether you’re prototyping innovative mesh detection systems or scaling up for full production runs.

https://www.pcbway.com/

Step 1: Hardware Preparation

If using custom MeshDetect boards from Tindie:

  • Boards come pre-assembled, flashed, and tested
  • Includes Stock 915mhz and 2.4ghz antennas
  • USB-C programming interface ready to use

If building with standard ESP32 S3:

  • Xiao ESP32 S3 development board recommended
  • USB-C cable for connection and power
  • Optional upgraded3 2.4GHz antenna for better range
  • Optional Heltec Lora V3 for Mesthastic Integration

Step 2: Firmware Installation

To install the firmware onto your device, follow these steps:

1. Clone the repository:

git clone https://github.com/colonelpanichacks/drone-mesh-mapper

Open the project in PlatformIO: You can use the PlatformIO IDE (in VS Code) or the PlatformIO CLI.

2.Select the correct environment:

This project uses the remotied_mesh_dualcore sketch, which enables both BLE and Wi-Fi functionality.Make sure the platformio.ini environment is set to remoteid_mesh_dualcore.

3. Connect you device via usb and flash

Upload the firmware:

  • In the IDE, select the remoteid_mesh_dualcore environment and click the “Upload” button.

3. Sofware Installation

Install Python dependencies:

  • flask>=2.0.0
  • flask-socketio>=5.0.0
  • requests>=2.25.0
  • urllib3>=1.26.0
  • pyserial>=3.5

Run the detection system:

python mapper.py

The web interface automatically opens at http://localhost:5000

Step 4: Device Configuration

1. Connect ESP32 via USB-C

2. Select the correct serial port in the web interface

3. Click “Connect” to start receiving data

4. Configure device aliases and settings as needed

How It Works

  • Core 0 handles WiFi monitoring in promiscuous mode, capturing Remote ID data embedded in beacon frames and processing Neighbor Awareness Networking transmissions on channel 6 by default.
  • Core 1 continuously scans for Bluetooth LE advertisements containing Remote ID data, supporting both BT 4.0 and 5.0 protocols with optimized low-power scanning.
  • Both cores feed detected Remote ID data into a unified JSON output stream via USB serial at 115200 baud. The firmware is based on Cemaxacuter’s excellent Remote ID detection work, enhanced with dual-core operation.
  • The Python Flask web application receives this data and provides real-time visualization on an interactive map, automatic logging to CSV and KML files, FAA database integration for aircraft registration lookups, support for up to 3 ESP32 devices simultaneously, live data streaming via WebSocket, and comprehensive export functions.

One of the most exciting features is Meshtastic integration. The ESP32 firmware can send compact detection messages over UART to a connected Meshtastic device. This enables:

  • Distributed Monitoring: Multiple detection nodes sharing data across your property or neighborhood
  • Extended Range: Mesh networking extends effective coverage area beyond single-device limitations
  • Redundancy: Multiple nodes provide backup coverage if one device fails
  • Low-Power Operation: Meshtastic’s LoRa radios enable remote deployment without constant power
  • Community Networks: Integration with existing Meshtastic mesh networks for broader awareness
  • Messages sent over the mesh network use a compact format optimized for LoRa bandwidth constraints:

Features in Action

Real-Time Detection and Mapping

The web interface provides a Google Maps-style view with drone markers showing current aircraft positions, pilot markers indicating operator locations, color-coded flight paths derived from device MAC addresses, signal strength indicators showing detection quality, and automatic cleanup removing stale data after 5 minutes.

Data Export and Analysis

The system continuously generates multiple data formats including timestamped CSV logs perfect for spreadsheet analysis, Google Earth compatible KML files with flight path visualization featuring individual drone paths color-coded by device and timestamped waypoints, and JSON API providing real-time data access for custom integrations with RESTful endpoints and WebSocket streams.

FAA Database Integration

One of the most powerful features is automatic FAA registration lookup that queries the FAA database using detected Remote ID information, caches results to minimize API calls and improve performance, enriches detection data with aircraft registration details, and includes configurable rate limiting to respect API guidelines.

Multi-Device Coordination

The system supports up to three ESP32 devices simultaneously with automatic device discovery and connection, individual device health monitoring, load balancing across multiple receivers, and unified data view combining all devices.

Performance and Optimization

Reception Range

Testing has shown effective detection ranges of 5 Km in urban environments, 10-15 kilometers in open areas with good antennas, overlapping coverage that eliminates dead zones when using multiple devices, and significant improvement with external antennas compared to built-in antennas.

System Resources

The Python application is optimized for continuous operation with efficient memory management for large datasets, automatic log rotation to prevent disk space issues, WebSocket connection pooling for multiple clients, and configurable data retention policies.

For remote deployments, Meshtastic integration enables off-grid operation, webhook retry logic ensures reliable alert delivery, local data storage prevents data loss during network outages, and bandwidth optimization handles limited connections.

Privacy and Security Considerations

This system puts powerful airspace monitoring capabilities in individual hands, but it’s important to use it responsibly. The detection data contains location information about both drones and their operators, so implement appropriate data retention policies and be aware of local privacy regulations.

For network security, remember that the Flask development server is not production-ready, so consider a reverse proxy for production use and implement authentication for sensitive deployments. Use HTTPS for webhook communications and monitor for unauthorized access attempts.

The system enables you to know what’s flying over your property while respecting the legitimate privacy expectations of drone operators. It’s about transparency and awareness, not surveillance.

Conclusion

This Remote ID detection system represents a significant step forward in personal airspace awareness. The combination of dual-core ESP32 processing, comprehensive web-based interface, Meshtastic mesh integration, and professional data export features creates a platform that’s both accessible to makers and powerful enough for serious privacy protection applications.

The availability of custom-designed PCBs on Tindie removes the barrier of hardware design, while the open-source firmware and software ensure complete customizability. Whether you’re building a single-node setup for personal property monitoring or deploying a mesh network for neighborhood-wide awareness, this system provides the foundation for comprehensive drone detection and tracking.

As more drones come online with Remote ID compliance, having your own detection system becomes increasingly valuable for maintaining privacy and situational awareness of your local airspace

Mesh Mapper Github : https://github.com/colonelpanichacks/drone-mesh-mapper

Mesh Detect Github (all firmware for Mesh Detect boards: https://github.com/colonelpanichacks/mesh-detect

Mesh Detect SMA mount clip SMA mount clip for the Mesh Destect board by OrdoOuroboros https://www.printables.com/model/1294183-mesh-detect-board-sma-mount

Build Your Own

Ready to start monitoring your local airspace? The combination of affordable hardware, open-source software, and comprehensive documentation makes this project accessible to makers of all skill levels. Start with a single ESP32 device to learn the system, then expand to multiple nodes and Meshtastic integration as your privacy protection needs grow.

The future of airspace monitoring is distributed, affordable, and puts control back in the hands of individuals and communities. Join the movement building these next-generation detection systems!

Source: Mesh-Mapper – Drone Remote ID mapping and mesh alerts – Hackster.io

Detecting Surveillance Cameras With The ESP32 from Colonel.Panic

These days, surveillance cameras are all around us, and they’re smarter than ever. In particular, many of them are running advanced algorithms to recognize faces and scan license plates, compiling ever-greater databases on the movements and lives of individuals. Flock You is a project that aims to, at the very least, catalogue this part of the surveillance state, by detecting these cameras out in the wild.

The system is most specifically set up to detect surveillance cameras from Flock Safety, though it’s worth noting a wide range of companies produce plate-reading cameras and associated surveillance systems these days. The device uses an ESP32 microcontroller to detect these devices, relying on the in-built wireless hardware to do the job. The project can be built on a Oui-Spy device from Colonel Panic, or just by using a standard Xiao ESP32 S3 if so desired. By looking at Wi-Fi probe requests and beacon frames, as well as Bluetooth advertisements, it’s possible for the device to pick up telltale transmissions from a range of these cameras, with various pattern-matching techniques and MAC addresses used to filter results in this regard. When the device finds a camera, it sounds a buzzer notifying the user of this fact.

Meanwhile, if you’re interested in just how prevalent plate-reading cameras really are, you might also find deflock.me interesting. It’s a map of ALPR camera locations all over the world,  and you can submit your own findings if so desired. The techniques used by in the Flock You project are based on learnings from the DeFlock project. Meanwhile, if you want to join the surveillance state on your own terms, you can always build your own license plate reader instead!

Source: Detecting Surveillance Cameras With The ESP32 | Hackaday

VITURE Launches ‘Luma Ultra’ AR Glasses with Sony Micro-OLED Panels

VITURE has now launched Luma Ultra AR glasses, which pack in Sony’s latest micro-OLED to go along with spatial gesture tracking thanks to onboard sensor array.

Priced at $600, and now shipping worldwide, Viture Luma Ultra is targeting prosumers, enterprise and business professionals looking for a personal, on-the-go workspace.

Notably, these aren’t standalone devices, instead relying on PC, console and mobile tethering for compute, which means they integrate as external (albeit very personal) monitors.

Image courtesy VITURE

Luma Ultra is said to include a 52-degree field of view (FOV), Sony’s latest micro-OLED panels with a resolution up to 1200p and 1,250 nits peak brightness. Two depth sensing cameras are onboard in addition to a single RGB camera for spatial 6DOF tracking and hand gesture input.

Unlike some AR glasses, which rely on slimming waveguide optics, Luma Ultra uses what’s called a ‘birdbath’ optic system, which uses a curved, semi-transparent mirror to project the digital image into the user’s eyes. It’s typically cheaper and easier to manufacture, and can also reach higher brightness at the expense of more bulk and weight.

Image courtesy VITURE

The device also includes an electrochromic film for tint control, myopia adjustments up to -4.0 diopters, and support for 64 ± 6mm interpupillary distance (IPD).

SEE ALSO
Hands-on: ‘Marvel’s Deadpool VR’ Nails the Vibe, But Needs Work on Feel

In reality, the company also launched a slate of AR glasses alongside it, which are targeted at consuming traditional media, positioning Viture Luma Ultra the company’s flagship device.

Check out the full lineup and spec below:

Image courtesy VITURE

Viture Luma ($400), Luma Pro ($500) and Luma Ultra ($600) are all estimated to ship within two weeks of ordering, with the next device, Luma Beast ($550) slated to ship sometime in November.

None of the devices above (besides Luma Ultra) include spatial tracking due to the lack of depth sensors, however Luma Beast is said to come with the same micro-OLED displays as Luma Ultra at a slightly larger 58-degree FOV and an auto-adjusting electrochromic film for tint control.

This follows the news of Viture’s latest funding round, which brought the San Francisco-based XR glasses company $100 million in Series B financing. which the company says will aid in global expansion of its consumer XR glasses. Viture says the funding will aid in global expansion of its consumer XR glasses.

Source: VITURE Launches ‘Luma Ultra’ AR Glasses with Sony Micro-OLED Panels

Windows MR Headsets Revived By Free ‘Oasis’ SteamVR Driver

A lone Microsoft employee released an unofficial SteamVR driver for Windows MR headsets, called Oasis, re-enabling their use on Windows 11.

The Oasis driver arrives just under one year after Microsoft started rolling out Windows 11 24H2, which completely removed support for Windows MR. This meant Acer, Asus, Dell, HP, Lenovo, and Samsung PC VR headset owners could no longer use their headset at all, not even on Steam, since Windows MR had its own runtime and only supported SteamVR through a shim.

Matthieu Bucchianeri’s Oasis solves this problem, for free. Oasis is a native SteamVR driver for Windows MR headsets, adding direct SteamVR support. No other software is required, except for SteamVR itself.

[…]

The Oasis driver includes full support for headset tracking, controller tracking, haptics, buttons, triggers, sticks, and battery state, as well as basic monoscopic camera passthrough. It also relays the IPD value from Reverb and Samsung Odyssey headsets, and even the eye tracking from HP Reverb G2 Omnicept Edition.

The only headset feature that isn’t supported is Bluetooth. Instead, you’ll need to use your PC’s Bluetooth, such as a USB or PCI-E Bluetooth adapter.

UploadVR’s Don Hopper has tested and confirmed that Oasis works with his HP Reverb G2, turning what had become a paperweight into a fully functional PC VR headset again.

Oasis Driver for Windows Mixed Reality is available for free on Steam. Make sure to read the full installation and setup instructions on GitHub, as you’ll need to pair your controllers via Bluetooth and “unlock” both the headset and controllers before use.

[…]

Source: Windows MR Headsets Revived By Free ‘Oasis’ SteamVR Driver

Austrian armed forces ditch Microsoft for open-source LibreOffice to safeguard data sovereignty. Someone woke up 10 years too late.

Austria’s military has completed a major IT overhaul, replacing Microsoft Office with the open-source LibreOffice suite across all its desktop systems. The change, finalized this month, affects approximately 16,000 workstations in the Austrian Armed Forces.

This move will substantially reduce Austria’s software bill. At $33.75 per user per month, a Microsoft 365 E3 subscription for 16,000 workstations costs approximately $6,480,000 per year, compared to LibreOffice’s zero cost.

Also: 4 reasons why LibreOffice downloads are way up (hint: you’ll relate)

But this move isn’t about saving money. The real motivation is to gain digital sovereignty and control over critical data. As Michael Hillebrand of Directorate 6 information and communications technology (ICT) and Cyber Defense, explained: “It was very important for us to show that we are doing this primarily to strengthen our digital sovereignty, to maintain our independence in terms of ICT infrastructure and to ensure that data is only processed in-house.”

Austria has plenty of company

This concern is not unique to Austria. Many EU governments are dumping Microsoft to protect their data. The German state of Schleswig-Holstein is replacing all Microsoft software with Linux and LibreOffice in government offices.

Austria’s move comes shortly after Danish officials said they’d be leaving Microsoft behind for the same reasons. The French city of Lyon is also moving to Linux and LibreOffice from Windows and Office to protect its citizens’ data.

Recently, digital sovereignty has become a contentious issue for countries outside the US that have been relying on American companies. Many European governments no longer trust their data or software to US-based companies under President Donald Trump.

They fear their data could be read or that Microsoft could kill their services on Trump’s behalf. While Microsoft chairman and general counsel Brad Smith dismissed such concerns and promised that the company would stand behind its EU customers against political pressure, others don’t trust Microsoft.

Their concerns will only be inflamed now that The Guardian reports that Microsoft has cut off Israel’s access to Azure, which the nation had been using to store data for a Palestinian surveillance system. While some people may support this decision, it also serves as a sharp warning that US companies can and will cut IT resources from their customers for political reasons.

In Austria’s case, the government started to worry that such moves were forthcoming when, in 2020, the military identified the risks of dependency on external cloud services, particularly those from the US. Austria wasn’t the only one. The German Interior Ministry warned in 2019 that Germany had become overly dependent on Microsoft software.

[…]

Source: This European military just ditched Microsoft for open-source LibreOffice – here’s why | ZDNET

It’s incredible that only some EU countries are waking up now, with Trump at the helm. The problem has always been there, despite GDPR arrangements. The US government has always had backdoor access to data stored in US cloud companies servers. None of these companies can guarantee that the data will be kept in EU clusters and even if they could, the US government installs secret backdoors in systems without the companies managements knowledge.

So by paying the US companies, not only are EU governments and militaries funding a dependancy on US software but also giving them all the knowledge and secrets they have on a platter. And for some reason, EU governments have been too stupid too see this.

Quantum random number generator combines small size and high speed

Researchers have developed a chip-based quantum random number generator that provides high-speed, high-quality operation on a miniaturized platform. This advance could help move quantum random number generators closer to being built directly into everyday devices, where they could strengthen security without sacrificing speed.

True randomness is essential for secure online banking, private messaging, and protecting from hackers, and the rising need for stronger digital protection is driving fast-growing demand for high-quality random numbers generated at high speeds.

“The quantum properties of light make it possible to produce numbers that are truly random, unlike the numbers generated by computer algorithms, which only imitate randomness,” said research team leader Raymond Smith from Toshiba’s Cambridge Research Laboratory in the United Kingdom. “However, making this technology practical for real-world use requires the that create these to be as small as possible so they can fit inside other systems.”

In the journal Optica Quantum, the researchers describe a new quantum design that can recover the quantum signal even when it’s buried in noise, which has been challenging to accomplish with chip-integrated devices. The new device can generate unpredictable random numbers at a rate of 3 gigabits per second, fast enough to support the security needs of large-scale data centers.

“A major application of random number generators is in protecting sensitive data and communications using encryption keys,” said Smith. “Our technology can generate those keys at high speed and with strong security guarantees. High-speed random numbers are also critical for scientific simulations and and for ensuring fairness in applications like online gaming or digital lotteries.”

[…]

Source: Quantum random number generator combines small size and high speed

Viral pay to record calls for AI app Neon takes itself down after exposing users’ phone numbers, call recordings, and transcripts to world + dog

A viral app called Neon, which offers to record your phone calls and pay you for the audio so it can sell that data to AI companies, has rapidly risen to the ranks of the top-five free iPhone apps since its launch last week.

The app already has thousands of users and was downloaded 75,000 times yesterday alone, according to app intelligence provider Appfigures. Neon pitches itself as a way for users to make money by providing call recordings that help train, improve, and test AI models.

But Neon has gone offline, at least for now, after a security flaw allowed anyone to access the phone numbers, call recordings, and transcripts of any other user, TechCrunch can now report.

TechCrunch discovered the security flaw during a short test of the app on Thursday. We alerted the app’s founder, Alex Kiam (who previously did not respond to a request for comment about the app), to the flaw soon after our discovery.

Kiam told TechCrunch later Thursday that he took down the app’s servers and began notifying users about pausing the app, but fell short of informing his users about the security lapse.

 The Neon app stopped functioning soon after we contacted Kiam.

[…]

Source: Viral call-recording app Neon goes dark after exposing users’ phone numbers, call recordings, and transcripts | TechCrunch

Shark bite resistant wetsuits actually work

Shark bites on humans are rare but can have substantial consequences for local coastal communities and businesses, often prompting pressure to implement effective mitigation measures. Wetsuits that incorporate bite-resistant materials have emerged as a new mitigation strategy that aims to reduce fatalities from shark bites, by reducing the severity of injuries inflicted from bites (e.g. lacerations, punctures, tissue and blood loss)

[…]

Key results

All bite-resistant materials reduced the proportional area of bites in substantial and critical damage categories, the categories associated with haemorrhaging and major vascular injury. However, there were limited to no differences in substantial and critical damage categories across the bite-resistant materials. Shark length also influenced the proportion of damage from tiger shark bites, but not from white shark bites.

Conclusions

Although internal and crushing injuries might still occur, bite-resistant materials offer an improved level of protection that can reduce severe wounds and blood loss, and should be considered as part of the toolbox and measures available to reduce shark-bite risk and resulting injuries.

Source: CSIRO PUBLISHING | Wildlife Research

EU becomes a little more fascist and starts collecting fingerprints at the border

The new Entry/Exit System (EES) will start operations on 12 October 2025. European countries using the EES will introduce the system gradually at their external borders. This means that data collection will be gradually introduced at border crossing points with full implementation by 10 April 2026.

Source: What is the EES?

You need to provide your personal data each time you reach the external borders of the European countries using the EES. For more information – see What does progressive start of the EES mean? 
The EES collects, records and stores: 

  • data listed in your travel document(s) (e.g. full name, date of birth, etc.)
  • date and place of each entry and exit 
  • facial image and fingerprints (called ‘biometric data’)
  • whether you were refused entry.

On the basis of the collected biometric data, biometric templates will be created and stored in the shared Biometric Matching Service (see footnote).

If you hold a short-stay visa to enter the Schengen area, your fingerprints will already be stored in the Visa Information System (VIS) and will not be stored again in the EES.

Depending on your particular situation, the system also collects your personal information from:

[…]

If you refuse to provide your biometric data, you will be denied entry into the territory of the European countries using the EES.

Who can access your personal data?

  • Border, visa and immigration authorities in the European countries using the EES for the purpose of verifying your identity and understanding whether you should be allowed to enter or stay on the territory.
  • Law enforcement authorities of the countries using the EES and Europol for law enforcement purposes. 
  • Under strict conditions, your data may be transferred to another country (inside or outside the EU) or international organisation (listed in Annex I of Regulation (EU) 2017/2226 – a UN organisation, the International Organisation for Migration, or the International Committee of the Red Cross) for return (Article 41(1) and (2), and Article 42) and/or law enforcement purposes (Article 41(6)).
  • Transport carriers will only be able to verify whether short-stay visa holders have already used the number of entries authorised by their visa and will not be able to access any further personal data.

[…]

Your data cannot be transferred to third parties – whether public or private entities – except in certain cases. See Who can access your personal data

[…]

So lots of data collected, and loads of people who can access this data – exceptions are absolutely everywhere. And for what? To satisfy far right fantasies about migration running rampant.

EU Data Act – get hold of your own data, but govt gets it too?

[…] The Regulation on harmonised rules on fair access to and use of data — also known as the Data Actentered into force on 11 January 2024 and into application on 12 September 2025. The Act is a key pillar of the European data strategy and it will make a significant contribution to the Digital Decade‘s objective of advancing digital transformation. The Data Act explained provides more in depth explanations.

The Data Act is designed to empower users — both consumers and businesses — by giving them greater control over the data generated by their connected devices, such as cars, smart TVs, and industrial machinery.

[…]

he new rules aim to facilitate the seamless transfer of valuable data between data holders and data users while upholding its confidentiality. This will encourage more actors, regardless of their size, to participate in the data economy. The Commission will also develop model contract clauses in order to help market participants draft and negotiate fair data-sharing contracts.

[…]

Public sector access and use of data

Rules enabling public sector bodies to access and use data held by the private sector for specific public interest purposes. For instance, public sector bodies will be able to request data necessary to help them respond quickly and securely to a public emergency, with minimal burden on businesses.

[…]

New rules setting the framework for customers to effectively switch between different providers of data-processing services to unlock the EU cloud market. This will also contribute to an overall framework for efficient data interoperability.

[…]

Users of connected products may choose to share this data with third parties. This will enable aftermarket (e.g. repair) service providers to enhance and innovate their services, fostering fair competition with similar services provided by manufacturers.

[…]

Source: Data Act | Shaping Europe’s digital future

Following the general provisions (Chapter I) which set out the scope of the regulation and define key terms, the Data Act is structured into six main chapters:

Chapter II on business-to-business and business-to-consumer data sharing in the context of IoT: users of IoT objects can access, use and port data that they co-generate through their use of a connected product.

Chapter III on business-to-business data sharing: this clarifies the data-sharing conditions wherever a business is obliged by law, including through the Data Act, to share data with another business.

Chapter IV on unfair contractual terms: these provisions protect all businesses, in particular SMEs, against unfair contractual terms imposed on them.

Chapter V on business-to-government data sharing: public sector bodies will be able to make more evidence-based decisions in certain situations of exceptional need through measures to access certain data held by the private sector.

Chapter VI on switching between data processing services: providers of cloud and edge computing services must meet minimum requirements to facilitate interoperability and enable switching.

Chapter VII on unlawful third country government access to data: non-personal data stored in the EU is protected against unlawful foreign government access requests.

Chapter VIII on interoperability: participants in data spaces must fulfil criteria to allow data to flow within and between data spaces. An EU repository will lay down relevant standards and specifications for cloud interoperability.

Chapter IX on enforcement: Member States must designate one or more competent authority(ies) to monitor and enforce the Data Act. Where more than one authority is designated, a ‘data coordinator’ must be appointed to act as the single point of contact at the national level.

[…]

Chapter V of the Data Act on business-to-government data sharing differentiates between two scenarios:

  • In order to respond to a public emergency, a public sector body should request non-personal data. However, if this is insufficient to respond to the situation, personal data may be requested. Where possible, this data should be anonymised by the data holder.    

  • In non-emergency situations, public sector bodies may only request non-personal data.

[…]

The Data Act will also entirely remove switching charges, including charges for data egress (i.e. charges for data transit), from 12 January 2027. This means that providers won’t be able to charge their customers for the operations that are necessary to facilitate switching or for data egress. However, as a transitional measure during the first 3 years after the Data Act’s entry into force (from 11 January 2024 to 12 January 2027), providers may still charge their customers for the costs incurred in relation to switching and data egress.

Source: Data Act explained

This is all great stuff, but the wording where public sector bodies can request personal data for unexplained emergencies (so… does a peaceful protest constitute an emergency, for example?) is pretty scary. Especially within the context of Chat Control Blanket Surveillance that the Danish presidency is keen to push through.

LaLiga’s Anti-Piracy Tactics Disrupt Major Sites in Spain. Again. Allowing company dragnets with no recourse, warning or anything is insanely stupid.

LaLiga, Spain’s top football league, is facing a firestorm of criticism after boasting about a staggering 142% increase in anti-piracy takedown notices in early 2025 while simultaneously causing extensive collateral damage across the internet.

As the 2025/2026 season began on August 15, LaLiga ramped up its enforcement strategy, triggering widespread outages for entirely lawful websites, services, and platforms.

These disruptions are tied to a controversial anti-piracy scheme operated in partnership with telecom giant Telefónica.

The initiative, which enjoys judicial backing in Spain, allows LaLiga to instruct major internet service providers, including Movistar, Vodafone, Orange, and DIGI, to block IP addresses suspected of hosting unauthorized streams.

The fallout is that entire chunks of the internet go dark for Spanish users, often during match broadcasts.

LaLiga doesn’t target specific infringing content. Instead, it flags entire IP ranges, many of which are shared by thousands of unrelated domains.

When one site is accused of hosting pirated material, everyone else sharing that IP address gets swept up in the block.

The result is a digital dragnet that has ensnared companies as diverse as Amazon, Cloudflare, GitHub, Twitch, and even Google Fonts.

TorrentFreak has documented repeated weekly blocks of platforms like Vercel since early 2025, while Catalonia’s own .cat domain registry has also reported service disruptions.

The issue became so disruptive that iXsystems, the team behind TrueNAS, a widely used open-source NAS operating system, was forced to shift its distribution model entirely. After its CDN IPs were repeatedly blocked in Spain, making critical security updates inaccessible to users, the developers resorted to distributing their software via BitTorrent.

[…]

LaLiga, meanwhile, continues to tout its enforcement record. A self-published report revealed that over 26 million takedown notices were sent in the first half of 2025 alone, more than doubling the total from all of 2024.

Source: LaLiga’s Anti-Piracy Tactics Disrupt Major Sites in Spain

Related: Massive expansion of Italy’s Piracy Shield underway despite growing criticism of its flaws and EU illegality

As site blocks pile up, European Commission issues subtle slapdown to Italy’s Piracy Shield

Why Italy’s Piracy Shield destroys huge internet companies and small businesses with no recourse (unless you are rich) and can lay out the entire internet in Italy to… protect against football streaming?!

Italy is losing its mind because of copyright: it just made its awful Piracy Shield even worse

Italy’s Piracy Shield Blocks Innocent Web Sites, Makes It Hard For Them To Appeal so ISPs are ignoring the law because it’s stupid

EU prepares to give new rights to live streaming sites, to the detriment of the Internet and its users

LaLiga Piracy Blocks Randomly Take Down huge innocent segments of internet with no recourse or warning, slammed as “Unaccountable Internet Censorship”

Now the copyright industry wants to apply deep, automated blocking to the Internet’s core routers

OpenAI plugs ShadowLeak bug in ChatGPT which allowed anybody access to everybodys gmail emails and any other integrations

ChatGPT’s research assistant sprung a leak – since patched – that let attackers steal Gmail secrets with just a single carefully crafted email.

Deep Research, a tool unveiled by OpenAI in February, enables users to ask ChatGPT to browse the internet or their personal email inbox and generate a detailed report on its findings. The tool can be integrated with apps like Gmail and GitHub, allowing people to do deep dives into their own documents and messages without ever leaving the chat window.

Cybersecurity outfit Radware this week disclosed a critical flaw in the feature, dubbed “ShadowLeak,” warning that it could allow attackers to siphon data from inboxes with no user interaction whatsoever. Researchers showed that simply sending a maliciously crafted email to a Deep Research user was enough to get the agent to exfiltrate sensitive data when it later summarized that inbox.

The attack relies on hiding instructions inside the HTML of an email using white-on-white text, CSS tricks, or metadata, which a human recipient would never notice. When Deep Research later crawls the mailbox, it dutifully follows the attacker’s hidden orders and sends the contents of messages, or other requested data, to a server controlled by the attacker.

Radware stressed that this isn’t just a prompt injection on the user’s machine. The malicious request is executed from OpenAI’s own infrastructure, making it effectively invisible to corporate security tooling.

That server-side element is what makes ShadowLeak particularly nasty. There’s no dodgy link for a user to click, and no suspicious outbound connection from the victim’s laptop. The entire operation happens in the cloud, and the only trace is a benign-looking query from the user to ChatGPT asking it to “summarize today’s emails”. […] The researchers argue that the risk isn’t limited to Gmail either. Any integration that lets ChatGPT hoover up private documents could be vulnerable to the same trick if input sanitization isn’t watertight.

[…]

Radware said it reported the ShadowLeak bug to OpenAI on June 18 and the company released a fix on September 3. The Register asked OpenAI what specific changes were made to mitigate this vulnerability and whether it had seen any evidence that the vulnerability had been exploited in the wild before disclosure, but did not receive a response.

Radware is urging organizations to treat AI agents as privileged users and to lock down what they can access. HTML sanitization, stricter control over which tools agents can use, and better logging of every action taken in the cloud are all on its list of recommendations. ®

Source: OpenAI plugs ShadowLeak bug in ChatGPT • The Register

Entra ID bug granted easy access to every tenant

A security researcher claims to have found a flaw that could have handed him the keys to almost every Entra ID tenant worldwide.

Dirk-jan Mollema reported the finding to the Microsoft Security Research Center (MSRC) in July. The issue was fixed and confirmed as mitigated, and a CVE was raised on September 4.

It is, however, an alarming vulnerability involving flawed token validation that can result in cross-tenant access. “If you are an Entra ID admin,” wrote Mollema, “that means complete access to your tenant.”

There are two main elements in the vulnerability. The first, according to Mollema, is undocumented impersonation tokens called “Actor tokens” that Microsoft uses for service-to-service communication. There was a flaw in the legacy Azure Active Directory Graph API that did not properly validate the originating tenant, allowing the tokens to be used for cross-tenant access.

“Effectively,” wrote Mollema, “this means that with a token I requested in my lab tenant I could authenticate as any user, including Global Admins, in any other tenant.”

The tokens allowed full access to the Azure AD Graph API in any tenant. Any hope that a log might save the day was also dashed – “requesting Actor tokens does not generate logs.”

“Even if it did, they would be generated in my tenant instead of in the victim tenant, which means there is no record of the existence of these tokens.”

The upshot of the flaw was a possible compromise for any service that uses Entra ID for authentication, such as SharePoint Online or Exchange Online. Mollema noted that access to resources hosted in Azure was also possible.

[…]

Source: Entra ID bug could have granted access to every tenant • The Register

Samsung confirms its $1,800+ fridges will start showing you ads

Samsung started rolling out an update to its refrigerators that brought ads to the display, whether you like it or not. The whole situation is rather surreal but not entirely unsurprising. There were some doubts that the changelog wasn’t real or that it belonged to a different product. Now, Samsung has confirmed to us that ads are indeed coming to its refrigerators.

We had reached out to Samsung for a statement, and this is what a Samsung spokesperson said:

Samsung is committed to innovation and enhancing every day value for our home appliance customers. As part of our ongoing efforts to strengthen that value, we are conducting a pilot program to offer promotions and curated advertisements on certain Samsung Family Hub refrigerator models in the U.S. market.
As a part of this pilot program, Family Hub refrigerators in the U.S. will receive an over-the-network (OTN) software update with Terms of Service (T&C) and Privacy Notice (PN). Advertising will appear on certain Family Hub refrigerator Cover Screens. The Cover Screen appears when a Family Hub screen is idle. Ad design format may change depending on Family Hub personalization options for the Cover Screen, and advertising will not appear when Cover Screen displays Art Mode or picture albums.
Advertisements can be dismissed on the Cover Screens where ads are shown, meaning that specific ads will not appear again during the campaign period.

As the statement notes, this is a pilot program for certain Samsung Family Hub refrigerator models sold in the US. As part of the program, these refrigerators will display “promotions and curated advertisements” on certain Cover Screens when the Family Hub screen (i.e., the door display) is idle.

The company notes that ads can be dismissed, and dismissed ads will not appear again. The ad design format will also change depending on the Cover Screen’s personalization options. Ads will not appear when the Cover Screen displays photos or art.

From the changelog, we know that ads will be displayed on the Cover Screen for the Weather, Color, and Daily Board themes, whereas the Cover Screen for the Art and Gallery themes will not display advertisements, in line with the company’s statement.

It’s still unclear which exact refrigerators are getting the ad infestation, but Samsung’s current Family Hub-equipped lineup in the US starts at $1,800 and goes all the way up to $3,500. It doesn’t seem like users can entirely turn off ads

Source: Samsung confirms its $1,800+ fridges will start showing you ads

Yay the good old US where this is legal. I am not sure this would go in the EU but then again, I am not sure what EU law would stop this either. Apparently you don’t own what you bought and you can’t stop “new features” if you don’t want them.