Google Translate expands live translation to all earbuds on Android

[…]

The latest version of Google’s live translation is built on Gemini and initially rolled out earlier this year. It supports smooth back-and-forth translations as both on-screen text and audio. Beginning a live translate session in Google Translate used to require Pixel Buds, but that won’t be the case going forward.

Google says a beta test of expanded headphone support is launching today in the US, Mexico, and India. The audio translation attempts to preserve the tone and cadence of the original speaker, but it’s not as capable as the full AI-reproduced voice translations you can do on the latest Pixel phones. Google says this feature should work on any earbuds or headphones, but it’s only for Android right now. The feature will expand to iOS in the coming months. Apple does have a similar live translation feature on the iPhone, but it requires AirPods.

[…]

Google also debuted language-learning features earlier this year, borrowing a page from educational apps like Duolingo. You can tell the app your skill level with a language, as well as whether you need help with travel-oriented conversations or more everyday interactions. The app uses this to create tailored listening and speaking exercises.

[…]

Source: Google Translate expands live translation to all earbuds on Android – Ars Technica

Russian hackers debut ransomware service on Telegram. Hardcode the keys in plaintext in tempdir.

CyberVolk, a pro-Russian hacktivist crew, is back after months of silence with a new ransomware service. There’s some bad news and some good news here.

First, the bad news: the CyberVolk 2.x (aka VolkLocker) ransomware-as-a-service operation that launched in late summer. It’s run entirely through Telegram, which makes it very easy for affiliates that aren’t that tech savvy to lock files and demand a ransom payment.

CyberVolk’s soldiers can use the platform’s built-in automation to generate payloads, coordinate ransomware attacks, and manage their illicit business operations, conducting everything through Telegram.

But here’s the good news: the ransomware slingers got sloppy when it came time to debug their code and hardcoded the master keys – this same key encrypts all files on a victim’s system – into the executable files. This could allow victims to recover encrypted data without paying the extortion fee, according to SentinelOne senior threat researcher Jim Walter, who detailed the gang’s resurgence and flawed code in a Thursday report.

[…]

“Our analysis reveals an operation struggling with the challenges of expansion: taking one step forward with sophisticated Telegram automation, and one step backward with payloads that retain test artifacts enabling victim self-recovery,” Walter wrote.

[…]

In November, the ransomware operators began advertising standalone RAT and keylogger tools and advertised these pricing models:

  • RaaS (single OS): $800-$1,100 USD
  • RaaS (Linux + Windows): $1,600-$2,200 USD
  • Standalone RAT or Keylogger: $500 USD each

Once the ransomware has been deployed on victims’ systems, it escalates privileges, bypassing Windows User Account Control (UAC) to execute malware with admin-level privileges. It determines which files to encrypt based on exclusion lists for specific paths and extensions that have been configured in the malware’s code, and the ransomware uses AES-256 in GCM mode (Galois/Counter Mode) for file encryption.

But, here’s where the malware developers screwed up: VolkLocker doesn’t dynamically generate encryption keys, but rather hardcodes them as hex strings, and writes a plaintext file with the complete master encryption key in the %TEMP% folder.

The plaintext master key “likely represents a test artifact inadvertently shipped in production builds,” Walter wrote. “CyberVolk operators may be unaware that affiliates are deploying builds with the backupMasterKey() function still embedded.”

This “suggests that the operation is struggling to maintain quality control while aggressively recruiting lesser-skilled affiliates,” he added.

[…]

Source: Russian hackers debut simple ransomware service • The Register

US State Dept to Stop Using Calibri Font, go back to Times New Roman in Anti-DEI Push

Secretary of State Marco Rubio sent a memo on Tuesday ordering everyone at the U.S. State Department to use Times New Roman for all official government documents, according to the New York Times. What’s behind Rubio’s sudden obsession with fonts? The Secretary thinks the current typeface being used, Calibri, is too woke.

Rubio’s memo was titled “Return to Tradition: Times New Roman 14-Point Font Required for All Department Paper,” according to the Times and Reuters, which obtained a copy of the memo.

“To restore decorum and professionalism to the Department’s written work products and abolish yet another wasteful DEIA program, the Department is returning to Times New Roman as its standard typeface,” the cable said.

[…]

You can’t make this up

Source: Marco Rubio Orders State Dept to Stop Using Calibri Font in Anti-DEI Push

Over 10,000 Docker Hub images found leaking credentials, auth keys

More than 10,000 Docker Hub container images expose data that should be protected, including live credentials to production systems, CI/CD databases, or LLM model keys.

The secrets impact a little over 100 organizations, among them are a Fortune 500 company and a major national bank.

[…]

After scanning container images uploaded to Docker Hub in November, security researchers at threat intelligence company Flare found that 10,456 of them exposed one or more keys.

The most frequent secrets were access tokens for various AI models (OpenAI, HuggingFace, Anthropic, Gemini, Groq). In total, the researchers found 4,000 such keys.

When examining the scanned images, the researchers discovered that 42% of them exposed at least five sensitive values.

“These multi-secret exposures represent critical risks, as they often provide full access to cloud environments, Git repositories, CI/CD systems, payment integrations, and other core infrastructure components,” Flare notes in a report today.

[…]

According to the researchers, one of the most frequent errors observed was the use of .ENV files that developers use to store database credentials, cloud access keys, tokens, and various authentication data for a project.

Additionally, they found hardcoded API tokens for AI services being hardcoded in Python application files, config.json files, YAML configs, GitHub tokens, and credentials for multiple internal environments.

Some of the sensitive data was present in the manifest of Docker images, a file that provides details about the image.

Many of the leaks appear to originate from the so-called ‘shadow IT’ accounts, which are Docker Hub accounts that fall outside of the stricter corporate monitoring mechanisms, such as those for personal use or belonging to contractors.

Flare notes that roughly 25% of developers who accidentally exposed secrets on Docker Hub realized the mistake and removed the leaked secret from the container or manifest file within 48 hours.

However, in 75% of these cases, the leaked key was not revoked, meaning that anyone who stole it during the exposure period could still use it later to mount attacks.

Organizations should implement active scanning across the entire software development life cycle and revoke exposed secrets and invalidate old sessions immediately.

Source: Over 10,000 Docker Hub images found leaking credentials, auth keys

Half of exposed React servers remain unpatched amid attacks

Half of the internet-facing systems vulnerable to a fast-moving React remote code execution flaw remain unpatched, even as exploitation has exploded into more than a dozen active attack clusters ranging from bargain-basement cryptominers to state-linked intrusion tooling.

That’s the assessment from Alon Schindel, VP of AI and Threat Research at Wiz, who says CVE-2025-55182 – the React server-side vulnerability dubbed “React2Shell” – is now being actively exploited at scale, with researchers tracking at least 15 distinct intrusion clusters in the wild over the past 24 hours alone.

According to Wiz’s latest telemetry, roughly 50 percent of publicly exposed resources known to be vulnerable are still running unpatched code, giving attackers a comfortable head start.

The critical-severity flaw, first disclosed earlier this month, affects React Server Components and dependent frameworks such as Next.js and stems from unsafe deserialization in React’s server-side packages, allowing an unauthenticated attacker to send a crafted request to achieve remote code execution. As The Register previously reported, the bug quickly proved attractive to attackers because of React’s ubiquity in modern web stacks, particularly in cloud-hosted environments where a single exposed endpoint can provide a foothold into far larger estates.

What began as opportunistic scanning and cryptomining has now broadened into something messier. Wiz says it is seeing a clear split between “commodity” exploitation – dominated by familiar cryptomining operations using tools like Kinsing, C3Pool, and custom loaders – and more deliberate intrusion sets deploying post-exploitation frameworks and bespoke malware.

Among the clusters observed are Python-based campaigns masquerading as miner droppers while quietly exfiltrating secrets, Sliver command-and-control infrastructure used for hands-on-keyboard operations, and a JavaScript file injector that systematically infects every server-side *.js file it can reach. Wiz also reports the re-emergence of EtherRat backdoor variants, a family of malware that had previously fallen out of favor but appears to have been dusted off for this wave of exploitation.

The technical sophistication is also creeping upward. Multiple miscreants are actively attempting to frustrate incident response by manipulating timestamps, minimizing logs, and otherwise scrubbing evidence of compromise. Those anti-forensics techniques, Wiz warned, suggest operators who expect to be hunted and intend to linger.

[…]

Source: Half of exposed React servers remain unpatched amid attacks • The Register

Dark chocolate ingredient associated with lower apparent age

A natural chemical in dark chocolate may play a role in slowing certain signs of biological aging. Researchers at King’s College London have identified theobromine, a plant compound found in cocoa, as a possible contributor to this effect.

The study, published on December 10 in Aging, analyzed how much theobromine was present in participants’ blood and compared those levels with biological aging markers measured in blood samples.

What Biological Age Reveals

Biological age reflects how well a person’s body is functioning, rather than the number of years they have lived. This measure is based on DNA methylation, a collection of tiny chemical tags on DNA that shift as we grow older.

The research team examined data from two European groups, including 509 people from TwinsUK and 1,160 from KORA. Individuals with higher amounts of theobromine in their bloodstream tended to have a biological age that appeared younger than their chronological age.

[…]

Dr. Ricardo Costeira, a Postdoctoral Research Associate at King’s College London, said: “This study identifies another molecular mechanism through which naturally occurring compounds in cocoa may support health. While more research is needed, the findings from this study highlight the value of population-level analyses in aging and genetics.”

Although the findings are encouraging, the researchers caution that increasing dark chocolate consumption is not automatically beneficial. Chocolate also contains sugar, fat and other ingredients, and more work is needed to fully understand how theobromine interacts with the body and how it may influence aging.

Source: Scientists find dark chocolate ingredient that slows aging | ScienceDaily

Apple appeal loses vs Epic again. Google decides to settle with Epic.

Shortly after appeals court judges ruled against Apple’s contempt appeal in a years-long antitrust dispute against the makers of Fortnite, I got to talk to Epic Games CEO Tim Sweeney in an interview. According to Sweeney, today’s ruling “completely shuts down” Apple’s App Store rules that allow it to collect “junk fees.”

The three-judge Ninth Circuit Court of Appeals panel largely affirmed an April ruling that Apple failed to comply with Judge Yvonne Gonzalez Rogers’s 2021 order allowing app developers to link to external payment options, which Sweeney said “… is really awesome for all developers.”

Perhaps the most notable part of the appeals court ruling is that the panel is asking Gonzalez Rogers to look at ways Apple could charge developers reasonable fees for purchases made in apps using outside payment links. In her April ruling, Gonzalez Rogers blocked Apple from taking any fees from external payments because of decisions like slapping external payments with a 27 percent fee and forcing developers to make their payments links in plain text.

But the appeals court says Apple “should” be able to charge a fee based on “the costs that are genuinely and reasonably necessary for its coordination of external links for linked-out purchases, but no more” and that Apple is “entitled to some compensation for the use of its intellectual property that is directly used in permitting Epic and others to consummate linked-out purchases.”

“If you want to have an app go through review with custom linkouts, maybe there’s several hundred dollars of fees associated with that every time you submit an app, which is perfectly reasonable because there are real people at Apple doing those things and Apple pays them, and we should be contributing to that,” Sweeney says. But he says that the ruling, “completely shuts down, I think, for all time, Apple’s theory that they should be able to charge arbitrary junk fees for access.”

With these two areas that Apple would be allowed to charge for, Sweeney says that “I can’t imagine any justification for a percentage of developer revenue being assessed here.”

[…]

The ruling wasn’t the only big news for Epic and Fortnite on mobile today: the game also returned to Google Play in the US after similarly being booted by Google when Epic added the in-app payments system to Fortnite. Epic and Google announced last month that they have agreed to settle their lawsuit, and while the two sides are still seeking court approval for their settlement, it resolves their disputes worldwide.

[…]

Source: Tim Sweeney on the future of Fortnite after another win over Apple | The Verge

How Cops Are Using Flock’s license plate camera Network To Surveil Protesters And Activists

It’s no secret that 2025 has given Americans plenty to protest about. But as news cameras showed protesters filling streets of cities across the country, law enforcement officers—including U.S. Border Patrol agents—were quietly watching those same streets through different lenses: Flock Safety automated license plate readers (ALPRs) that tracked every passing car.

Through an analysis of 10 months of nationwide searches on Flock Safety’s servers, we discovered that more than 50 federal, state, and local agencies ran hundreds of searches through Flock’s national network of surveillance data in connection with protest activity. In some cases, law enforcement specifically targeted known activist groups, demonstrating how mass surveillance technology increasingly threatens our freedom to demonstrate.

Flock Safety provides ALPR technology to thousands of law enforcement agencies. The company installs cameras throughout their jurisdictions, and these cameras photograph every car that passes, documenting the license plate, color, make, model and other distinguishing characteristics. This data is paired with time and location, and uploaded to a massive searchable database. Flock Safety encourages agencies to share the data they collect broadly with other agencies across the country. It is common for an agency to search thousands of networks nationwide even when they don’t have reason to believe a targeted vehicle left the region.

Via public records requests, EFF obtained datasets representing more than 12 million searches logged by more than 3,900 agencies between December 2024 and October 2025. The data shows that agencies logged hundreds of searches related to the 50501 protests in February, the Hands Off protests in April, the No Kings protests in June and October, and other protests in between.

[…]

While EFF and other civil liberties groups argue the law should require a search warrant for such searches, police are simply prompted to enter text into a “reason” field in the Flock Safety system. Usually this is only a few words–or even just one.

In these cases, that word was often just “protest.”

Crime does sometimes occur at protests, whether that’s property damage, pick-pocketing, or clashes between groups on opposite sides of a protest. Some of these searches may have been tied to an actual crime that occurred, even though in most cases officers did not articulate a criminal offense when running the search. But the truth is, the only reason an officer is able to even search for a suspect at a protest is because ALPRs collected data on every single person who attended the protest.

[…]

In a few cases, police were using Flock’s ALPR network to investigate threats made against attendees or incidents where motorists opposed to the protests drove their vehicle into crowds. For example, throughout June 2025, an Arizona Department of Public Safety officer logged three searches for “no kings rock threat,” and a Wichita (Kan.) Police Department officer logged 22 searches for various license plates under the reason “Crime Stoppers Tip of causing harm during protests.”

Even when law enforcement is specifically looking for vehicles engaged in potentially criminal behavior such as threatening protesters, it cannot be ignored that mass surveillance systems work by collecting data on everyone driving to or near a protest—not just those under suspicion.

Border Patrol’s Expanding Reach

As U.S. Border Patrol (USBP), ICE, and other federal agencies tasked with immigration enforcement have massively expanded operations into major cities, advocates for immigrants have responded through organized rallies, rapid-response confrontations, and extended presences at federal facilities.

USBP has made extensive use of Flock Safety’s system for immigration enforcement, but also to target those who object to its tactics. In June, a few days after the No Kings Protest, USBP ran three searches for a vehicle using the descriptor “Portland Riots.”

[…]

Fighting Back Against ALPR

ALPR systems are designed to capture information on every vehicle that passes within view. That means they don’t just capture data on “criminals” but on everyone, all the time—and that includes people engaged in their First Amendment right to publicly dissent. Police are sitting on massive troves of data that can reveal who attended a protest, and this data shows they are not afraid to use it.

Our analysis only includes data where agencies explicitly mentioned protests or related terms in the “reason” field when documenting their search. It’s likely that scores more were conducted under less obvious pretexts and search reasons. According to our analysis, approximately 20 percent of all searches we reviewed listed vague language like “investigation,” “suspect,” and “query” in the reason field. Those terms could well be cover for spying on a protest, an abortion prosecution, or an officer stalking a spouse, and no one would be the wiser–including the agencies whose data was searched. Flock has said it will now require officers to select a specific crime under investigation, but that can and will also be used to obfuscate dubious searches.

For protestors, this data should serve as confirmation that ALPR surveillance has been and will be used to target activities protected by the First Amendment. Depending on your threat model, this means you should think carefully about how you arrive at protests, and explore options such as by biking, walking, carpooling, taking public transportation, or simply parking a little further away from the action. Our Surveillance Self-Defense project has more information on steps you could take to protect your privacy when traveling to and attending a protest.

[…]

Everyone should have the right to speak up against injustice without ending up in a database.

Source: How Cops Are Using Flock Safety’s ALPR Network To Surveil Protesters And Activists | Techdirt