<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:media="http://search.yahoo.com/mrss/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:lab="https://labradorcms.com/ns/rss">
<channel>
    <title>www.theregister.com - Articles</title>
    <link>https://www.theregister.com</link>
    <description>Articles from www.theregister.com</description>

    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258429</guid>
        <link>https://www.theregister.com/ai-and-ml/2026/06/18/midjourney-pivots-from-ai-image-generation-to-body-scanning-medical-spa-where-patients-bathe-in-golden-light/5258429</link>
        <pubDate>Thu, 18 Jun 2026 20:18:25 +0200</pubDate>
        <title>Midjourney pivots from AI image generation to body scanning medical spa where patients bathe in 'golden light'</title>
        <description><![CDATA[ The underlying technology is real...and borrowed from a partner the company failed to mention ]]></description>
        <category>ai and ml</category>
                <lab:kicker><![CDATA[ ai + ml ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 19:04:21 +0000</dc:modified>
                <content:encoded><![CDATA[ A San Francisco startup best known for its AI-generation software is making a bizarre leap into medical imaging, and trying to says it hopes draw curiosity-seekers into its new spa to get scanned. On Wednesday, Midjourney announced the establishment of Midjourney Medical, which it admitted was a bit out of left field. To promote the tech, it claims to be opening a spa in San Francisco where guests will be able to step “into a shallow pool of golden light,” before being lowered into a tank where ultrasound sensors bombard their bodies in order to take a scan that AI pieces together into MRI-like images. This sounds like the plot of a cheap sci-fi movie, but there is some real science behind it. “As you descend into the water, hundreds of thousands of tiny elements take turns, sending out waves, listening together, compressing and then streaming data to a massive cluster where thousands of computers split the task,” Midjourney explained in the announcement. “By looking at how the shapes of all the waves change, we reconstruct a detailed map or ‘image’ which basically lets us figure out what’s in there.” That “basically” isn’t exactly reassuring when Midjourney says it wants to have 50,000 or more of the things deployed around the world by 2031 “with a total scanning capacity of a billion scans a month” for use as a preventative health tool. It’s not clear how fast the process is with the prototype unit, but Midjourney said its goal is for the whole thing to take around a minute. “We think it's completely possible that with enough early imaging in the future, the world could avoid 30% of all deaths and 50% of all healthcare costs,” the company added. According to a “technical” video included in the announcement, there’s a ring of 40 scanners included in the prototype unit the company has built. That ring of 40 elements contains 358,000 ultrasonic elements made up of tiny transducers that create ultrasound waves in water while listening for how they change when they slap the body of whoever is in Midjourney’s dunk tank up to a thousand times a second. The Midjourney Scanner, as the company has named it, can capture tissue details up to half a millimeter, which is on par with standard clinical MRIs, but pales in comparison to the resolution of more advanced designs.  Oh, did we not mention our partner? Midjourney said its scanner is the first of its kind ever constructed, but the technical video says it relies on Fullbody Ultrasound Computational Tomography (FUCT, or USCT, as the industry has taken to calling it to avoid the more questionable acronym). That's not new. Fast, full-body ultrasound scanning that requires patients to be submerged in a water tank has been an active project at Caltech based on a research paper from earlier this year. Same goes for the sensors Midjourney is including in its scanner. You wouldn’t know that from reading the announcement, which makes it seem like this was a project entirely of Midjourney’s own AI fever dreams, but ultrasound tech firm Butterfly Network was compelled to issue its own press release “following Midjourney’s public announcement” in order to “provide commentary” on the AI outfit’s new venture. Butterfly confirmed in its release that it provided the 40 ultrasound imaging modules for the Midjourney Scanner. The hardware was “licensed under a co-development agreement between the two companies,” according to Butterfly. According to a 2025 SEC filing, Butterfly expects to rake in $74 million over five years for providing the hardware. There's some irony in Midjourney's failure to mention its partner: The company has faced lawsuits claiming it used copyrighted works without permission to train its AI image generation model. We reached out to both companies to learn more. Midjourney didn’t respond, and Butterfly declined to add anything beyond what was in its press release. Midjourney said that it’s planning to open its first ultrasound scanner spa at the end of 2027, but it has another hurdle to jump: FDA approval. Beyond improving its tech so that the second-generation scanner is ready for its 2027 spa date, “regulation is the next limit,” the company said. “Normally, for every diagnostic medical capability you need FDA approval,” Midjourney explained. “We’re starting by just giving you detailed body composition maps — and we’ll be submitting regular test results to the FDA for increased capabilities.” Midjourney also fails to mention how it will store and secure those scans, whether it will use said scans to train its body composition-detection algorithms, and how it’s ensuring those algorithms get things right that it usually take a human a few years of education and training to learn. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5258466&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5258466&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258414</guid>
        <link>https://www.theregister.com/ai-and-ml/2026/06/18/committed-skeptic-finds-himself-warming-to-new-amazon-ai-products-that-actually-dont-suck/5258414</link>
        <pubDate>Thu, 18 Jun 2026 19:30:00 +0200</pubDate>
        <title>Committed skeptic finds himself warming to new Amazon AI products that actually don't suck</title>
        <description><![CDATA[ Ed's note to Corey: Blink once if you're safe, twice if you're in danger ]]></description>
        <category>ai and ml</category>
                <lab:kicker><![CDATA[ AI AND ML ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 18:52:06 +0000</dc:modified>
                <content:encoded><![CDATA[ If you live long enough, you'll wake up one day and find that you're living in a world you no longer understand. Lately there are things happening with AI in a couple of disparate parts of Amazon that brought that lesson home in a big way. The first is that, late last year, they acquired Bee, an AI wearable that is distressingly, upsettingly good. The second, which I want to talk about today as I fly back from AWS's NYC Summit, is Quick Desktop. The best way to describe this is "Enterprise OpenClaw in a polished app." Yes, I know this sounds like I'm being blackmailed. Read on. You work at Amazon, right? Amazon has spent the last three years breathlessly telling us that they're a leader in AI, then shipping products which make it clear that they're unsure what leadership looks like. They've spent far longer building user interfaces that carry a design aesthetic of "complete crap." Even Amazon's website, where you buy everything from underpants to chainsaws to dog food to more underpants, is not a well-designed interface; we've all just learned to live with it. The single good interface to come from Bezos and Coo was the Kindle e-reader: push a button, the page turns. And then they removed the buttons. So yes; "We're launching a desktop AI assistant" is the exact opposite of encouraging coming from these folks. It started like you'd expect. You pop over to the download page and grab the download. On a Mac it's half a gigabyte because of course it is; this is totally normal and fine in 2026. Install it, fire it up, and ... wait a bit. It has to think, and gather its wherewithal before it can get to work. And then the hits start coming. I had talked to people who have used this and raved about it. The problem here is that all of these people work at Amazon, and the current state of the product reflects that. They have a single identity provider they use internally; external users see a confusing array of offerings, each with its own byzantine flows. The feeling is not dissimilar to waking up in the middle of a hedge maze, with no idea how you got there, and discovering that someone just set it on fire. At one point during my time using Quick Desktop, I was logged out and had to log back in. After guessing seven different identity providers, I gave up and emailed the service team for help with this. After some back and forth, I was able to get back in. (GitHub! Future Corey, if you find yourself in this situation, you authenticated via GitHub!) It's clear that the people building this service aren't living the external user experience. It's why I maintain that Amazon's internal AWS account management tool is the service that I hate the most; it separates the people building AWS from the customers using it. At the moment, other similar challenges show up. You'd never have more than one email account from the same provider, right? (Google Workspace in my case, provided it hasn't been deprecated by the time this article goes to print.) You'd never have business conversations via iMessage, or Signal, or LinkedIn DMs, or any number of other services, right? The point isn't the snark; it's that Quick Desktop only knows about the channels its connectors deign to support. Every deal I've ever closed in a LinkedIn DM, every favor traded over Signal, every "hey, quick question" that arrived via iMessage is simply invisible to it — but it makes its confident little suggestions anyway, blissfully unaware that a good chunk of my professional life happens in places it can't see. Here's a free hint to the product team: do you think I mentioned the Bee in the opening of this article because I'm making a fashion statement? And then it starts to work… Once you prove yourself worthy by getting Quick Desktop set up, it ... sits there without doing much. It has a chatbot interface, which surely you've never seen before in an app, backed by a personality I'll call "Uninspiring Accountant." What was the point? And then things start to happen. Your activity feed starts surfacing things from your email. From Slack. From your calendar. I don't know about the rest of you, but my email inbox is where tasks and hope go to die. Slowly but surely, Quick Desktop starts making suggestions, surfacing things that you should handle, proposing email drafts (ugh, in such a bland corporate voice; I hope this email finds you before I do), and giving you quick links to the various apps where these things live so you can see the context it's surfacing. I went in skeptical, partly because I'd already cobbled together a janky version of this for myself by pointing Claude Code at a pile of APIs, so I had a decent sense of what these things miss. And that's when I became a Quick Desktop convert: it flagged an email buried forty messages deep in my inbox that I'd mentally filed under "dealt with" - but very much was not. My own inbox had given up on me like everyone who's ever tried to love me, but Quick Desktop hadn't. This is an Amazon product, and it's pretty clear that they expect you to work with Quick Desktop the way they reportedly work with their own employees: by beating them into compliance. Their own custom connectors and (lack of) extensibility system make it pretty clear that there's a corporate IT department somewhere that's configuring and getting this set up for folks. I freely admit that's not my use case; I'm testing this by myself, not sharing it with my colleagues. But the product is improving. Today, it doesn't really sync data or state between multiple machines; we're still waiting for Amazon to discover this whole "cloud" thing. That's almost certainly going to change in the near future. Along with the just-announced AWS Context approach, once you have a team of people using it, the shared knowledge graph it can build about your entire organization promises to be a significant boon. The part where I trust Amazon  That same knowledge graph is also a massive security treasure trove: every deal, every org-chart grudge, every "please don't forward this," every "how do I do the basic functions of my job" chat sessions, lives in one queryable place. Handing that to a vendor terrifies me. It should terrify you. And yet Amazon is one of a vanishingly small number of companies I'd trust with it. I want to acknowledge how strange it is that I just wrote that. I have spent a decade as a professional thorn in this company's side. I have a financial incentive, a personal brand, and frankly a temperament that all point toward not trusting AWS with so much as my lunch order. But credit where it's due: whatever else they get wrong, Amazon takes security and data privacy deadly seriously, and they have the scars and the org structure to prove it. I have lived through this multiple times, and I've seen what AWS does when security competes with other pressures. The list of companies I'd let build a map this detailed of my business is damn short, and most of the names on it are not the ones building these products. They have the security chops, but they have a completely different massive marketing problem. How do you get customers to try this out when you've incinerated your credibility in this space like it's your engineering team's token budget? "For once we have a product that is not shite," while honest, is probably going to be tricky to get through AWS corporate comms. Would I use it myself? I am Reader, I pay cash money for this. Everything I've said above about its sharp edges are true, and I've barely gotten started. I have three pages, ten slides, and one interpretive dance full of "here's why the product sucks" feedback I'll be giving to their product team, who are going to be astounded when I bust into their office uninvited. But I'm not throwing stones from the sidelines on this: "I am a paying customer, and I want this thing I pay you for to be better than it is, so you will listen to every goddamned word I have to say" is a powerful message, and one that's particularly resonant to Amazonians. I can see a world in which I roll this out to the rest of the company. My Claude Code contraption is interesting and in some ways more capable, but it scales precisely as far as "grumpy former sysadmin with a penchant for the CLI" and not one inch further. Our team would justifiably revolt if I tried to inflict it upon them. The hell of it is, the only thing that Amazon has to do to get Quick Desktop to beat my Frankenstein setup is "let Quick configure itself." Yes, there are problems with that approach; I leave them to Amazon to sort through. And so... I don't entirely know what to do with myself in a world where suddenly Amazon is shipping desirable AI products that I'm happy to pay for. First the Bee wearable and now this. That's two data points, and for a company whose AI track record reads like a list of things to apologize for, two data points is alarmingly close to a trend. Their biggest problem is going to lie in outrunning their own shadow, and changing their own nature. I used to be confident they couldn't. I'm less confident now, and I'm not sure how I feel about that. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5258559&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5258559&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258476</guid>
        <link>https://www.theregister.com/virtualization/2026/06/18/citrixs-daas-flex-aims-to-delay-pricey-pc-upgrades/5258476</link>
        <pubDate>Thu, 18 Jun 2026 18:59:51 +0200</pubDate>
        <title>Citrix now lets you run virtual desktops like a cost-conscious private equityeer</title>
        <description><![CDATA[ Soaring PC prices make alternatives to hardware refreshes interesting ]]></description>
        <category>virtualization</category>
                <lab:kicker><![CDATA[ VIRTUALIZATION ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 20:41:56 +0000</dc:modified>
                <content:encoded><![CDATA[ Your next work PC could live in the cloud. A couple of years ago, the Cloud Software Group – the private-equity-owned vendor that mashed up Citrix with Tibco – built a tool to analyze the ideal desktop environment for its users, a cost-control exercise aimed at ensuring it wasn’t spending big on under-utilized endpoints. Last month, the company productized the result and put it on sale under the name “Citrix DaaS Flex.” The product is effectively a front for Citrix’s existing portfolio of desktop-as-a-service (DaaS) and application publishing tools. Deploying Flex starts with an assessment of an organization’s endpoint fleet, which general manager for the company’s DaaS portfolio Shawn Bass told The Register often includes many inappropriate machines. Bass believes that few organizations have the data to understand which cloudy PC instance types are appropriate for their users, or experience running fleets of hosted PCs, so they end up paying too much for virtual machines that have far more performance than some users require. Others, he said, end up with bill shock if they sign up for consumption-based pricing. Some use virtual PCs when they can easily get by with a hosted managed browser locked into certain SaaS sites and published apps. Once Citrix figures out what your users need, it suggests “personas” – a collection of templates that suit different users. Bass said that organizations often need three personas – one each for task workers, knowledge workers, and power users. A persona could involve a full cloud PC, a managed browser, or just access to published apps. Whatever the recommendation, Citrix goes and makes it all happen. Users don’t see the company’s products; they just get to consume endpoints. Citrix runs the virtual PCs in Azure. Citrix charges for Flex using a system of credits. It might price a virtual PC for a power user at 60 credits a month, for example. After assessing users’ endpoint needs, Citrix will propose a credit budget, and a deal spanning three or more years and billed monthly. Users can hold back some credits to take into account seasonal usage spikes – Bass suggested retailers who add staff for Christmas shopping might plan to use more credits for a couple of months a year, without exceeding the total credits available over the life of a contract. Citrix budgets for virtual PCs to run between 10 and 14 hours a day. If users burn the midnight oil and incur extra Azure costs, that’s Citrix’s problem. Bass told us that Citrix plans to bring Flex into other hyperscale clouds and is also looking to make it work with on-prem platforms. The Reg suspects that will mean long-time partners like Nutanix get a look-in. A version for the channel is also in the works. When we cover virtual desktops, readers often note that accessing a cloudy PC requires an actual PC, or another device, and suggest that’s wasteful. Bass thinks the times may now suit DaaS, because the high price of memory means PC fleet refreshes are more expensive. Cloudy desktops, he thinks, therefore represent an upgrade path. Of course, he would say that because Citrix offers its own lightweight OS – eLux from Unicon – tailored to remote access and which comfortably runs on old PCs. Bass said customer interest in that offering is rising. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=252868&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=252868&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258376</guid>
        <link>https://www.theregister.com/os-platforms/2026/06/18/canonical-unveils-myna-speech-to-text-app-for-ubuntu-2610/5258376</link>
        <pubDate>Thu, 18 Jun 2026 18:04:09 +0200</pubDate>
        <title>Canonical reveals Myna, its local speech-to-text app</title>
        <description><![CDATA[ Bird-branded AI will ride on Stonking Stingray ]]></description>
        <category>os platforms</category>
                <lab:kicker><![CDATA[ OS platforms ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 16:06:13 +0000</dc:modified>
                <content:encoded><![CDATA[ Canonical has published more details about the local speech-to-text engine that will take dictation in the forthcoming Ubuntu version 26.10, aka "Stonking Stingray." In a post on the company’s Discourse forums on Wednesday, the outfit named one of the most significant new elements that’s coming in the next version: Myna: Speech to Text for Ubuntu Desktop. Earlier this month, we reported from the Ubuntu Summit that Canonical was going big on AI and that one of the first signs would be speech-to-text input via locally run speech-recognition models. After the Summit, the company then published the Ubuntu Desktop 26.10 “Stonking Stingray” Roadmap, as we mentioned towards the end of our review of MX Linux 25.2. The announcement explains – and illustrates – what the plan is, how it will work, and the user interface that the team is aiming for in the initial release: For Ubuntu 26.10, we’re deliberately focusing on the basics: a reliable desktop dictation. The initial experience will be simple: Press a keyboard shortcut, speak naturally, and see the resulting text appear in the application you’re using. Myna is designed to provide speech recognition with clear visual feedback while dictation is active. This is good stuff. Although it won’t be an accessibility revolution on its own, it’s an important step and will help desktop Linux catch up with the commercial competition. Speech recognition is built into Apple’s macOS in a tool called Voice Control. On modern Macs with Apple Silicon processors, the recognition engine is on-device and works offline. For a few months in 2023, The Reg's FOSS desk was unable to use his right arm, and when he returned to work, he dictated his articles into an M1 MacBook Air using this feature. Register columnist Colin Hughes knows much more about such matters than we do. He wrote about how Voice Control needed more work later that same year, and he returned to the subject on Global Accessibility Awareness Day – May 21. Microsoft’s current offering is called Voice Access, which is replacing the Windows Speech Recognition tool that Microsoft introduced with Windows Vista in 2006. The Myna project will be open source, and there’s already a GitHub repository for it, but there’s not very much there yet beyond some planning notes. There’s time: although the October release of 26.10 is only about four months away, this is not a major new pioneering technology. Various tools can already do similar things. One of the first was Mycroft, although it is no longer around: some three years ago, The Register described how the creator of the Linux virtual assistant blamed a "patent troll" for the project’s death. There is also Michal Kosciesza’s Speech Note tool, which you can install from Flathub. Last August, we reported on the release of FFmpeg 8, which can use the local whisper.cpp version of OpenAI’s Whisper model to do on-device speech-to-text, enabling it to automatically add subtitles to video files. Although this writer is unconcerned about being labelled an AI hater, we do feel allowing voice control of a PC is an acceptable and beneficial role for the technology. Or as the author of jqwik and noted AI skeptic Johannes Link put it, an Ethical Use of Generative AI. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5211372&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5211372&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258341</guid>
        <link>https://www.theregister.com/science/2026/06/18/nasa-payload-to-ride-commercial-mars-orbiter-from-rocket-biz-yet-to-reach-orbit/5258341</link>
        <pubDate>Thu, 18 Jun 2026 17:25:15 +0200</pubDate>
        <title>NASA payload to ride commercial Mars orbiter from rocket biz yet to reach orbit</title>
        <description><![CDATA[ Aeolus mission promises better Martian weather models, assuming Relativity Space can get its Terran R off the ground ]]></description>
        <category>science</category>
                <lab:kicker><![CDATA[ SCIENCE ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 15:38:10 +0000</dc:modified>
                <content:encoded><![CDATA[ It might not yet have reached Earth orbit, but Relativity Space has announced plans for a mission to Mars carrying a NASA payload. The mission, dubbed Aeolus and scheduled for 2028, will launch a Mars orbiter carrying four NASA-built instruments. Relativity Space will supply the rocket, spacecraft, and cruise operations, while NASA will deal with the payload. The four instruments comprise a Doppler wind and temperature-sounder, a thermal limb sounder, a surface radiometric sensor package, and a wide-field context camera. NASA will support instrument operations for at least one Martian year, while Relativity Space will maintain the spacecraft. NASA's Ames Research Center will be responsible for designing, building, and integrating the payload. Data collected by Aeolus will be used to improve models of dust, winds, temperature, and seasonal atmospheric behavior. It will also, according to NASA, "generate the detailed environmental knowledge required to reduce risk for future crewed and uncrewed landings. These measurements will directly inform entry, descent, and landing systems and support safer, more predictable mission planning for astronauts." NASA's Mars Odyssey and Mars Reconnaissance Orbiter already have spent decades orbiting Mars. Its MAVEN spacecraft was declared unrecoverable after controllers lost touch with the vehicle at the end of 2025. The Mars Sample Return mission, slated to recover samples deposited by NASA's Perseverance rover, is unlikely to reach the red planet any time soon. NASA boss Jared Isaacman said: "Public-private partnerships like this are a force multiplier for science," extolling the virtues of "pairing NASA's world‑class instruments with commercial innovation and investment," but the mission is a risky endeavor. Relativity Space has yet to get into Earth orbit, let alone beyond. Its first rocket, the mostly 3D-printed Terran 1, experienced a problem during its second stage burn, although it did manage to pass the 100 km Kármán line and reach space. The company has been working on Terran R since 2023, a medium-to-heavy-lift reusable rocket. The first launch of the vehicle might take place this year. NASA has increased commercial involvement in its missions in recent years. The agency's lunar ambitions lean heavily on vendors such as SpaceX and Blue Origin, and the upcoming Swift rescue mission, a high-risk, high-reward attempt to boost the orbit of an observatory, is being undertaken by Katalyst Space. The approach has, however, attracted criticism from some NASA veterans, one of whom expressed concern to The Register that the thoroughness that defined the missions of the 1970s might not be such a priority in the future. That said, the agency's budget is also not what it was. Increasing risk by doing more with less evokes the ghosts of the '90s and the "faster, better, cheaper" management philosophy at NASA that did not work so well. Although NASA did not say so in its post, the Aeolus mission requires unproven rocket and spacecraft technology, and a commercial vendor who hasn't even reached orbit yet. The potential rewards are considerable, but a failure could prove unpalatable. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=228006&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=228006&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258361</guid>
        <link>https://www.theregister.com/networks/2026/06/18/zte-and-china-telecom-guangdong-advance-crossvendor-ip-network-simulation-pilots-paving-the-way-for-intelligent-network-operations/5258361</link>
        <pubDate>Thu, 18 Jun 2026 17:21:55 +0200</pubDate>
        <title>ZTE and China Telecom Guangdong advance cross‑vendor IP network simulation pilots, paving the way for intelligent network operations</title>
        <description><![CDATA[ PARTNER CONTENT: Leveraging >95% digital twin fidelity and multi-vendor collaboration to eliminate network change risks and achieve zero-error O&M ]]></description>
        <category>networks</category>
                <dc:modified>Thu, 18 Jun 2026 15:22:53 +0000</dc:modified>
                <content:encoded><![CDATA[ ZTE announced that China Telecom Guangdong has officially released the E‑Surfing Simulation 2.0 – Cross‑Vendor IP Network Simulation Standard at the Talent & Expertise Development Forum (Peizhi Talent Empowerment Initiative) hosted by the company. Built on the joint simulation system co-developed by ZTE and China Telecom Guangdong, the standard applies digital twin technology to form a closed‑loop workflow from change submission through simulation verification to implementation authorization. This marks a pivotal shift of network O&M from experience‑reliant manual work to systematic pre‑verification. The solution has become a replicable benchmark for multi‑vendor collaborative simulation in the telecommunications industry, serving as a milestone to accelerate the rollout of intelligent network operations across the sector. Achieving High‑Precision Network Simulation to Strengthen Predictive O&M Capabilities The system adopts advanced network mirroring technology and proprietary protocol simulation algorithms, overcoming the traditional bottleneck of resource‑intensive dynamic modeling. It achieves over 95% digital twin fidelity for device status and routing protocols. O&M staff can accurately evaluate the impact of network adjustments in advance, enhancing the safety and precision of network operations. Breaking Multi‑Vendor Simulation Barriers to Build an Efficient O&M Model As communication networks keep expanding and evolving into more complex architectures, cross‑vendor O&M faces prominent challenges including low modeling efficiency, difficult collaboration and excessive resource consumption. ZTE and China Telecom Guangdong have innovated a distributed cross‑vendor simulation architecture following the principle of vendor‑specific simulation, unified collaboration. A global coordinator works seamlessly with dedicated simulation systems from different vendors to eliminate device simulation barriers, effectively reduce development and maintenance costs and enhance system scalability. Remarkable Pilot Results Enable Zero‑Error Network Changes Prior to the standard release, China Telecom Guangdong and ZTE completed phased pilot deployments from single-vendor to multi-vendor scenarios in Foshan and Yangjiang. The pilots covered all devices on the new metropolitan area networks of the two cities, targeting four core scenarios: protocol parameter modification, new home broadband service cutover, new device commissioning and network transformation. The solution covers more than 90% of mainstream network change scenarios. Field tests prove that pre‑simulation verification can substantially lower network change risks and realize zero‑error operations, laying a solid foundation for large‑scale nationwide promotion. Looking ahead, ZTE and China Telecom Guangdong will further upgrade system functions, expand application scenarios and iterate the standard to solidify the ecosystem of cross‑vendor intelligent O&M. Leveraging technological collaboration, ZTE will build the HI‑IPNet high-performance and high-intelligence IP network core platform, driving the IP network to evolve from manual O&M to intelligent scheduling and global cross‑network coordination. Committed to openness and continuous innovation, ZTE will partner with global industry players to advance the automation and intelligence of telecommunication networks, empowering the high‑quality development of the digital economy. Contributed by ZTE. ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5258440&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5258440&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258147</guid>
        <link>https://www.theregister.com/ai-and-ml/2026/06/18/the-ai-tipping-point-where-enterprise-ai-runs-at-scale/5258147</link>
        <pubDate>Thu, 18 Jun 2026 17:00:00 +0200</pubDate>
        <title>The AI tipping point: where enterprise AI runs at scale</title>
        <description><![CDATA[ PARTNER CONTENT: AI's cloud journey homeward bound: enterprises prefer private clouds for scaling AI workloads. ]]></description>
        <category>ai and ml</category>
                <dc:modified>Thu, 18 Jun 2026 08:26:07 +0000</dc:modified>
                <content:encoded><![CDATA[ When enterprises first began building AI strategies, the default assumption was straightforward: AI would run in the hyperscaler cloud. The APIs were ready, GPU capacity was building out, and the inertia of a decade of public cloud investment pointed in one direction. Broadcom’s Private Cloud Outlook 2026 report finds that, as enterprises move to scale, the direction has changed. The Private Cloud Outlook 2026: The AI Tipping Point draws on a blind, global survey of 1,800 senior IT leaders across eight countries. Now in its second year, the report tracks a shift in cloud strategy that is no longer something on the horizon, but one already showing up in production workloads, capital budgets, and board-level priorities. Enterprise AI has found its infrastructure home in private cloud. Production AI is moving to private cloud Last year, 56 percent of enterprises used public cloud as the primary environment for production AI inference. This year, that figure has fallen 15 percentage points to 41 percent, while 56 percent of enterprises are now running or planning to run production inferencing in a private cloud. The shift goes deeper than the top-line numbers. Forty-three percent of enterprises actively repatriating workloads are moving AI training, large language models, and inference out of the public cloud, a category that did not exist in last year's study. The broader repatriation trend has accelerated sharply as well: 83 percent of enterprises are now considering repatriation , up from 69 percent in 2025, and half have already moved at least some workloads, a 15-point jump in a single year. The forces driving enterprise AI to private cloud are the same ones that pulled storage, security-sensitive applications, and regulated data there before it. Security, control, cost, and governance did not become more important because of AI, but the consequences of getting them wrong became much harder to absorb at production scale. When IT leaders place workloads, those classified as high-security, latency sensitive, business critical, or data-intensive consistently land in private cloud. The bill for AI infrastructure has arrived For the first time in this study, cost has overtaken security as the top concern about public cloud. That reflects a familiar reality for enterprise IT leaders: public cloud costs were already difficult to forecast and manage, and AI workloads have made that problem substantially worse. Nearly all IT leaders surveyed (97 percent) believe some portion of their public cloud spend is wasted, and more than half (52 percent) say that waste exceeds 25 percent of their total spending. Generative AI and agentic workloads are compounding the pressure, with 62 percent of IT leaders reporting that they are very or extremely concerned about AI infrastructure costs. Enterprises are revising their investment strategies accordingly. Net intent to increase private cloud investment over three years has risen from 51 percent to 72 percent, and private cloud investment is now growing at more than twice the rate of public cloud. Cost predictability has become the second biggest driver of that shift, cited by 39 percent of organizations. Enterprises that built AI ambitions on variable, consumption-based public cloud pricing are recalculating. Private cloud, with its predictable economics and direct IT control over infrastructure, is increasingly where the budget decisions are landing. Sovereignty has become a board-level priority Geopolitics has moved squarely into the infrastructure conversation. Eighty-six percent of IT leaders say geopolitical and regulatory factors are now directly affecting their IT strategy and operations. Data sovereignty and residency requirements are the top concern, cited by 54 percent of respondents, followed by jurisdiction-specific compliance requirements at 51 percent. For enterprises operating across borders, decisions about where data lives carry direct implications for where workloads can run. AI workloads that process sensitive, regulated, or proprietary data require infrastructure that provides governance and control from the ground up. Security and compliance remain the single most important factor in workload placement decisions, cited by 32 percent of respondents. AI is adding new obligations on top of existing ones: data protection and privacy (37 percent) and security and control (36 percent) are now the leading infrastructure requirements that AI imposes. Private cloud provides the governance architecture to meet those requirements by design, built in from the start rather than bolted on after deployment. Complexity is a platform problem Running production AI at enterprise scale is an operations challenge as much as an infrastructure one. The top skills gap cited by IT leaders is AI infrastructure and operations, named by 40 percent of respondents, followed by cloud security operations at 38 percent and Kubernetes operations at 37 percent. To close that gap, 81 percent of enterprises now fully outsource or use professional services for their cloud-related needs. Operational simplification matters as much as picking the right technology partners. Enterprises that standardize on a unified, well-governed private cloud platform address the AI skills challenge with fewer specialists, less operational fragmentation, and clearer organizational accountability. A platform-centric approach reduces the surface area that teams have to manage, and that is where the real operational gains lie. The tipping point is here The Private Cloud Outlook 2026 confirms what the data has been building toward for two years. Enterprise IT has reached the AI tipping point, and private cloud is the preferred platform for production AI because it addresses what AI at scale demands: security, cost predictability, data sovereignty, and governance that enterprises cannot treat as optional. VMware Cloud Foundation 9.1 is built for this environment. It provides a unified platform for running AI and traditional workloads together, with the performance, cost controls, and security capabilities that production AI at enterprise scale requires. The research shows where enterprise AI is heading, and VMware Cloud Foundation is the platform built to get organizations there. Read the full Private Cloud Outlook 2026 report: https://www.vmware.com/docs/private-cloud-outlook-2026 Contributed by Broadcom. ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=1684467&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=1684467&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258076</guid>
        <link>https://www.theregister.com/security/2026/06/18/google-told-researcher-nice-catch-then-denied-bug-bounty-for-flaw-it-still-hasnt-fixed/5258076</link>
        <pubDate>Thu, 18 Jun 2026 17:00:00 +0200</pubDate>
        <title>Google told researcher 'Nice catch!' Then denied bug bounty for flaw it still hasn't fixed</title>
        <description><![CDATA[ EXCLUSIVE 'Working as intended' for the win … again ]]></description>
        <category>security</category>
                <lab:kicker><![CDATA[ Security ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 15:40:46 +0000</dc:modified>
                <content:encoded><![CDATA[ EXCLUSIVE Google has a security hole in a Kubernetes operator that could allow attackers to bypass Google Cloud Platform (GCP) identity and access protections and gain full control over any organization's cloud environment. Or it has a serious communication and transparency problem when it comes to its bug bounty programs.  Maybe both. Researcher and frequent cloud bug hunter Justin O'Leary told us that he found and reported to Google a major flaw that allows any Kubernetes namespace user to bypass GCP's Identity and Access Management (IAM) controls and therefore gain root access to managing an organization's cloud resources. Google initially rated the bug high priority and high severity, with a rep telling O'Leary "Nice Catch!" Then, the cloud giant changed course and told O'Leary and The Register that there's no vulnerability, so no fix and no reward payout. The bug report, however, is still marked high-priority and accepted. O'Leary spoke exclusively with The Register about the vulnerability, which he named ConfigConfusion, and what has happened since he reported it to Google on March 8. He is also releasing a blog post with more details. It stems from an issue in Config Connector, an open source Kubernetes add-on that lets users manage Google Cloud resources through Kubernetes. According to O'Leary, Config Connector doesn't perform an authorization check, and this allows any Config Connector service account with org-level permissions to bypass Identity and Access Management (IAM)  authorization and gain the highest level of control (roles/owner) to an entire GCP Organization – the root node of all of a company's resources within Google Cloud. On March 27, a Google security engineer accepted O'Leary's report and told him: "Nice catch!" The employee said that they filed a bug based on O'Leary's report with the relevant product team and assured him the Chocolate Factory's security squad would work with relevant Google Cloud people to fix the flaw. "We'll work with the product team to ensure this issue is address. We'll let you know when the issue was fixed," the engineer said. "In the meantime, review the payment option selected in your bughunters.google.com profile." Google assigned the bug P1 priority and S1 severity, signifying a flaw worthy of urgent repair because it affects a large percentage of users and can disrupt core organizational functions. "I figured that was the end of that," O'Leary said in a phone interview with The Register. Eleven days later, on April 7, he received a new message from a Google Security Bot reversing the earlier decision. The Reg viewed the email, and O'Leary included a screenshot in his Thursday writeup. The message said that the Cloud Vulnerability Reward Program panel decided that the "security impact of this issue does not meet the criteria to qualify for a reward." After reviewing the bug report, Google determined the software "is working as intended," the message continued. It also noted that the program's decision not to pay a bounty "does not mean that the product team won't fix the issue." Nearly three months later, the case remains P1/S1 with the status "in progress (accepted)." Google hasn't assigned a CVE or issued a fix. O'Leary didn't receive any reward for his research. This isn't the first time this has happened to O'Leary – or other security researchers submitting bug bounty reports. O'Leary had a similar experience with Microsoft earlier this year. In a story that has become all too familiar among bug hunters, O'Leary disclosed a privilege escalation vulnerability in Azure Backup for AKS. Microsoft rejected his report – and then silently patched the flaw without assigning a CVE or publishing a security advisory. "This is a pattern," O'Leary told us. "This is just how these trillion-dollar companies deal with people like me. In my day job, we use GKE, and it's incredibly frustrating on my end, when I find a critical vulnerability in the system that's being widely used, and I can't even get the vendor to patch their own stuff." Google's response When The Reg asked Google about O'Leary's situation, the company told us that it didn't issue a bug bounty reward because there's no vulnerability. “The issue reported does not qualify for a reward because the GCP IAM authorization bypass is only exploitable if an attacker has access to a Config Connector Service Account that’s been granted the Organization Admin role by the organization (i.e., it is privileged)," a Google spokesperson said in an email to The Register. "Additionally, an attacker would first need to gain entry to an organization's environment (e.g., an exposed container) in order to leverage the privileged Config Connector instance and execute commands with administrative authority, such as the IAM bypass," the spokesperson continued. "Granting this level of access to the Config Connector Service Account goes against Google Cloud’s publicly shared best practices and the principle of least privilege." Google did not answer The Register's questions about why the bug report case remains marked in progress – and not closed – on its end of things. O'Leary told us this is the same explanation he received. And he doesn't buy it. Yes, the Config Connector service account does need org-level permissions to manage resources across multiple GKE clusters. But Google's own documentation instructs users how to do this, he noted. We confirmed this as well. Moreover, "having those permissions doesn't mean any namespace user should be able to abuse them," O'Leary posited. "A developer with kubectl access to one namespace – and zero GCP IAM permissions – should not be able to become Organization Owner. They also shouldn't be able to impersonate any service account in the project with no audit trail." According to O'Leary: "The vulnerability is the missing authorization check. Config Connector executes privileged operations on behalf of users without verifying those users are authorized." Three lines, five seconds, full admin control In a video demonstrating ConfigConfusion, O'Leary shows how an attacker can write three lines of YAML to achieve full administrative control of a GCP Organization in about five seconds. "Config Connector has these missing validation checks," he said. "Config Connector is basically a Google-managed Kubernetes operator, and I found that having these missing validation checks creates these confused deputies, which means there's no validation of who's asking for what." Confused deputies pose a major security challenge because they allow an entity that doesn't have permission to perform an action to force a more-privileged entity to perform the action. To exploit this issue, a user with kubectl access to one namespace – and no GCP permissions – submits a malicious IAMPolicyMember, which escalates the attacker's privileges. Config Connector passes the user-controlled organization ID directly to the GCP IAM API without performing an authorization check, making the user a GCP Organization owner. This gives the attacker full admin control over everything in the environment – projects, secrets, billing, and Gmail accounts. "And there's no record of it," O'Leary said. This is because "the attacker's Kubernetes identity never touches GCP IAM," he wrote in the disclosure. "Config Connector executes the request using its own elevated credentials." 'Jenga' vulnerabilities According to O'Leary, Google has fixed this confused-deputy issue twice before in different services that access GCP. Tenable Research documented those issues and reported them to Google. One, called ImageRunner, abused permissions in Google Cloud Run to pull private Google Artifact Registry and Google Container Registry images in the same account. The second, ConfusedComposer, allowed an identity with edit permissions inside a Cloud Composer environment to escalate privileges to the default Cloud Build service account. "This privilege-escalation vulnerability in GCP builds upon a broader attack class of vulnerabilities in cloud services that we call 'Jenga,'" Tenable security researcher Liv Matan said at the time. ConfusedComposer "exploits the somewhat-hidden cloud provider misconfigurations related to cloud services permissions to escalate privileges beyond intended access levels," Matan explained. "This variant highlights how attackers can abuse interconnected services the cloud provider automatically deploys behind the scenes, as part of a service-orchestration process." Google ultimately added authorization checks to both Cloud Run and Cloud Composer. O'Leary says he doesn't understand why Google can't also add that check to Config Connector. Or perhaps he does. "It's just me versus Google," he said. "They can't do that same level of gaslighting to Tenable because they have PR teams and legal teams to fight them. I'm just a guy saying I don't understand how this is true" – that is, how something can be both a high-severity, high-priority bug and also working as intended. "And they just say: 'Well, it is true.'" ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5258119&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5258119&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258316</guid>
        <link>https://www.theregister.com/science/2026/06/18/neuromorphic-computing-may-one-day-offer-ai-a-power-saving-brainwave/5258316</link>
        <pubDate>Thu, 18 Jun 2026 16:01:33 +0200</pubDate>
        <title>Neuromorphic computing may one day offer AI a power-saving brainwave</title>
        <description><![CDATA[ Hybrid systems could bring efficiency gains at the edge, but conventional infrastructure isn't going anywhere fast ]]></description>
        <category>science</category>
                <lab:kicker><![CDATA[ SCIENCE ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 14:16:49 +0000</dc:modified>
                <content:encoded><![CDATA[ Brain-inspired computing may one day help curb AI's ballooning energy demands, but don't expect it to replace today's datacenter hardware any time soon, UK politicans have been told. Speaking to MPs this week, University of York professor Martin Trefzer said neuromorphic and other bio-inspired systems could improve efficiency by borrowing ideas from biological brains, where memory and processing are integrated rather than split across separate components. Analysis from last year shows AI is the biggest driver pushing global datacenter electricity use to more than double by 2030 to around 945 terawatt-hours (TWh), slightly more than the entire electricity consumption of Japan. "Data movement is probably one of the fundamental things we can learn from the brain. We don't have a memory bank on one computer and a [processor] on the other; it's all one system, and that is underpinning the efficiency," Trefzer told the House of Commons Science, Innovation and Technology Committee. At the same time, the brain "is not a rigid computer that is kind of clocked in a digital system." "This is motivating us to really build computing systems that are adaptable, to make them more robust, and to potentially adapt them to be more efficient in certain circumstances," Trefzer said. However, given the complexity of the as-yet-experimental computing model, it could be a long time before it proves its worth as a replacement for mature computing systems. "It is always pitched against a very mature technology like LLMs running in datacenters, but suffering from all the energy and sustainability problems," he said. The only way experimental technologies like neuromorphic computing – which takes inspiration from the brain – could have a practical impact in the short term is through specific applications alongside conventional computing to make it more efficient. "A wearable device, let's say a hearing aid, for example: you currently have these devices that are built on a digital substrate. We train models offline, but you could imagine a neuromorphic substrate that is susceptible to sound, that has modalities that allow it to function in a more brain-inspired computational manner. Then you could push functionality out of the digital system into, in this case, a sensor. This is where there is significant potential to be much more energy efficient, by orders of magnitude," Trefzer said. The short-term impact will be in identifying use cases for hybrid integration that work with current technology to optimize it. Also speaking to the committee, University of Manchester physics professor Caterina Doglioni said these advantages need to be offset against the energy and carbon cost of putting more devices on the edge, but there could be a threshold over which a new model is more efficient. "I hate to be the person that breaks it, but you have to think about how much it costs you and the environment to build these devices, but one can reach a break-even point where ultimately it is doing a better job on environmental sustainability, but that needs the studies," she said. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=256794&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=256794&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258247</guid>
        <link>https://www.theregister.com/os-platforms/2026/06/18/kde-plasma-67-brings-the-x11-era-to-a-close/5258247</link>
        <pubDate>Thu, 18 Jun 2026 14:57:26 +0200</pubDate>
        <title>KDE Plasma 6.7 brings the X11 era to a close</title>
        <description><![CDATA[ Plenty of new shiny in the service of improved usability ]]></description>
        <category>os platforms</category>
                <lab:kicker><![CDATA[ OS Platforms ]]></lab:kicker>
                <content:encoded><![CDATA[ The latest version of the KDE desktop - Plasma 6.7.0 - has arrived, bringing several shiny new functions – some of which have been a long time coming – and features the return of the popular Oxygen theme from KDE 4. Since the KDE 6 “megarelease” two and a half years ago, the project's developers have been very busy. Fresh Plasma releases have come thick and fast. It's fewer than six months since the release of KDE Plasma 6.6.0 back in February. This rate of change matters, as a massive implementation change is coming: as the team announced in November last year, the plan is that KDE Plasma 6.8 will be Wayland-only. That means that this new release is the last to support X11. From some time early next year, KDE Plasma will be “Wayland or no way.” There are already functional differences between Plasma on X11 and Plasma on Wayland, as the Dedoimedo blog described when reviewing Kubuntu 26.04 last month. (Dedoimedo is written by Igor Ljubuncic, who we interviewed at the 2023 Ubuntu Summit.) X11 holdouts need not feel entirely abandoned as there’s a new fork of the X11-capable version of the desktop, called SonicDE. The project’s self-description says: "We aim to preserve and improve the X11-specific aspects of KDE since they announced they are going Wayland-only in KDE Plasma 6.8. SonicDE currently consists of the customized KWin/X11 sonic-win window manager and compositor, Plasma Workspace components, the Silver theme, an SDDM theme, and some support libraries." SonicDE joins at least two existing forks of older versions of KDE: the Trinity desktop environment, based on the last version of KDE 3, and MiDesktop, which we mentioned recently, based on the last version of KDE 1. (If there are any others out there that we’ve missed, do please let us know.) Matching Macs For now, Plasma 6.7 isn’t radically different from the existing Plasma 6.6, but this version has some significant new features. Two of them may be familiar to macOS users. Firstly, while KDE has always supported virtual desktops, in this release, on computers with more than one physical display, each screen can have its own set of virtual desktops. Apple’s macOS does this, and it’s the only way to get a separate global menu bar on each screen. Aside from that, for this vulture, it’s more trouble than it’s worth – but from what we read, many people like it a lot and we think this will be a popular change. Secondly, to type letters with accents (technically, “diacritics”), such as ä or ç or Š, you can now press and hold a key, and a list of alternatives appears. This is how Macs have done it for decades. If you only very occasionally need these characters, it does have the advantage that you avoid having to memorize special shortcuts or combinations. Personally, this Vulture finds it faster to configure and use a Compose key, which KDE supports just fine, but this is a handy change if you only rarely need such things. These aren’t the only changes, of course. Alongside Plasma’s existing System Tray applets, the tray now shows GNOME-style “Background Apps” – commonly found in Flatpak apps. The Overview screen is easier to navigate, and you can now switch virtual desktops by scrolling with your pointing device, or using the PgUp and PgDn keys. The Discover software store makes the Install button more prominent, and sorts installed apps into categories. It’s now easier to switch light and dark mode globally with one click, and there’s better support for hardware detection of lighting brightness. Theme handling is in the middle of a major revamp, in an initiative called Union, which brings management of multiple different types of theme together in one place. Developers carefully modernized the “Oxygen” theme, the default dark look for KDE 4, and did likewise for its lighter equivalent “Air”. If you fancy a change from the now-ubiquitous flat look, it’s available to install, along with matching Horos wallpapers. There are a lot of smaller changes. There’s an option to test your microphone right from the taskbar. When the clock shows multiple timezones, it shows the offset in hours. Windows can be selectively hidden when recording or streaming the desktop. Type-ahead search optionally now works on the desktop itself. The printer status icon shows how many jobs are outstanding. Notifications now glide onscreen rather than fading into view, making them more obvious. There’s better color management, and ICC profiles and HDR are no longer mutually exclusive. GPU handling refinement should now mean both better performance and lower GPU utilization, even on Intel integrated GPUs. The Plasma wiki offers a more complete list, and there’s a complete changelog of everything since 6.6.5. Although the release notes still point to it, it looks to us like the KDE Neon download page is blank and empty. We’ve previously reported on the project’s technologically-innovative demo distro KDE Linux, and that now works well in VirtualBox – complete with documentation on how to do it. It’s already up to Plasma 6.7.80, a pre-release of what will become 6.8. The project dedicated this release to the late Eric Laffoon, a long-time KDE supporter. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5258299&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5258299&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258190</guid>
        <link>https://www.theregister.com/ai-and-ml/2026/06/18/ai-nose-uses-smell-language-model-to-sniff-out-signs-of-disease/5258190</link>
        <pubDate>Thu, 18 Jun 2026 14:45:00 +0200</pubDate>
        <title>AI nose uses 'Smell Language Model' to sniff out signs of disease</title>
        <description><![CDATA[ Sampling patients' breath may save lives and emergency room resources ]]></description>
        <category>ai and ml</category>
                <lab:kicker><![CDATA[ AI AND ML ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 12:51:04 +0000</dc:modified>
                <content:encoded><![CDATA[ Many people worry about what AI knows, but what about an AI Nose that can smell what disease you might have? Ainos, an AI and biotech company that is developing smell technology, is working with National Taiwan University (NTU) to explore whether its platform can help diagnose patients by analyzing volatile organic compounds (VOCs) in exhaled breath. The year-long research effort, which starts in July, will examine individuals who present with dyspnea, or shortness of breath, said to be one of the most common symptoms seen in emergency departments. Dyspnea can be a symptom of many conditions, including acute exacerbation of chronic obstructive pulmonary disease (AECOPD) and acute decompensated heart failure (ADHF), each of which requires different treatments. Ainos and NTU hope to develop and evaluate a system to analyze VOC-based breathprints to detect AECOPD and/or ADHF in patients. Ainos's Smell AI platform relies on an AI Nose module that features multiple micro-electro-mechanical system (MEMS) sensors and an integrated digital processor. Sensor resistance increases in the presence of detectable gases, and this is converted to a digital signal that is interpreted in much the way the human nose interprets scents, according to Ainos. That interpretation is handled by by a proprietary Smell Language Model that has been developed to learn, classify, and contextualize complex scent patterns. "AI Nose was originally developed with medical diagnostic applications in mind, where non-invasive sensing, accuracy, and real-world validation are essential," said Ainos CEO Eddy Tsai. "This research program brings that experience back into a high-value clinical setting and extends our Smell AI platform into digital breath intelligence." Not content with "digital breath intelligence," a term we must confess to not being too familiar with, the the company frames the research as part of its broader vision of "building Smell ID data and Smell Language Model capabilities across healthcare, industrial, and physical AI environments." If successful, the research could help create a breathprint database for dyspnea and support future studies for emergency, outpatient, and even home-monitoring settings. The research follows a separate program testing the AI Nose in an active emergency department at National Taiwan University Hospital. The system has been deployed to monitor respiratory infections and overcrowding in waiting areas, treatment areas, and observation zones. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=252861&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=252861&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258261</guid>
        <link>https://www.theregister.com/offbeat/2026/06/18/microsoft-once-used-its-own-brand-of-lego-to-optimize-windows/5258261</link>
        <pubDate>Thu, 18 Jun 2026 14:00:00 +0200</pubDate>
        <title>Microsoft once used its own brand of 'Lego' to optimize Windows</title>
        <description><![CDATA[ Making software feel snappier when you only have 12 MB RAM ]]></description>
        <category>offbeat</category>
                <lab:kicker><![CDATA[ OFFBEAT ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 12:50:12 +0000</dc:modified>
                <content:encoded><![CDATA[ People of a certain age sometimes like to reminisce about how software in the old days was somehow more responsive and more efficient on far less powerful hardware. Microsoft's approach was to take its software binaries and optimize the heck out of them. Former Microsoft engineer Dave Plummer spilled the beans on the practice, confirming that the company used an internal application called Basic Block Tool (BBT) – known internally as Microsoft Lego – to shuffle the internals of binaries to speed execution. Plummer's recollections go back to the '90s, when his first NT development system ran on a paltry 12 MB of RAM, but software was relentlessly growing in size. A binary might have 10 MB of code, but the startup path only needed 300 KB of it. "But if those 300 KB are sprinkled like Parmesan across 10 MB of binary, then the loader and the memory manager have to touch far more pages than the actual executed code would suggest," Plummer said. And if a trip to disk was needed to page the code in and out, the performance impact could be disastrous. Hence BBT, through which Microsoft ran a binary and came up with something that was functionally the same, but a good deal more performant. The binary was effectively defragmented as related code was lumped together. Similar techniques have, of course, persisted even as computational power has increased. BOLT, for example, can speed up large applications by optimizing the layout of binaries. Then there was HP's Dynamo [PDF], which could optimize code at runtime. This approach is not without risk. Tinkering with a binary is not for the faint of heart, but Microsoft had an incentive to wring every last bit of performance from systems. "Windows and Office were large native code products running on constrained machines, and the wins were user-visible," Plummer explained. "If you could reduce the number of pages touched during boot or shell startup, users felt it. If you could make common application paths fit into fewer memory pages, multitasking got better. "If you could keep hot code out of the swap file, the whole system felt less like it was dragging a refrigerator through wet cement." As with Raymond Chen's recent war story regarding binary translation and code rerolling at Microsoft, Redmond's engineers were laser-focused on performance. Whether that same focus survives in some of today's software is another matter. Plummer thinks his past efforts remain applicable. "Modern software has the same problem at a different scale," he said. "The binaries are much larger. The services are distributed. The frameworks are deeper. The machines are faster, but the dependency graphs are absurd. "And we still discover over and over again that locality matters as it always does. So put the hot data together. Put the hot code together. Keep the common path small. Push rare paths away. "Don't make the CPU fetch a haystack when it only needs the needle." ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=262631&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=262631&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258218</guid>
        <link>https://www.theregister.com/public-sector/2026/06/18/india-blocks-telegram-ahead-of-scandal-hit-medical-school-entrance-exam/5258218</link>
        <pubDate>Thu, 18 Jun 2026 13:24:36 +0200</pubDate>
        <title>India blocks Telegram ahead of scandal-hit medical school entrance exam</title>
        <description><![CDATA[ 2.3 million people sit test chasing 100,000 places, and country already canceled it once this year ]]></description>
        <category>public sector</category>
                <lab:kicker><![CDATA[ PUBLIC SECTOR ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 11:25:50 +0000</dc:modified>
                <content:encoded><![CDATA[ India has decided to block messaging service Telegram for a few days to reduce the chance of scams targeting over two million people taking a single exam that has already provoked a national scandal. The exam is called the National Eligibility cum Entrance Test (NEET) and is the only way to earn a place to study medicine in India. In most years, over two million people take the test – but only around 100,000 people earn a place in a medical school. Competition for those places is fierce, and student stress levels can be stratospheric. India's National Testing Agency (NTA), which oversees entrance exams across India, conducted the 2026 NEET on May 3. A few days later, however, Indian netizens noticed Telegram posts dated May 1 that included footage of the NEET questions – suggesting the exam paper leaked. NTA insisted the exam paper had not leaked before the test but also admitted the exam paper in the videos was legitimate. The agency was able to do so because the videos included a unique identifier on the paper that NTA used to identify the candidate associated with the paper shown in the video and the test center where it was used. NTA used its ability to trace the paper as evidence that it conducted the exam securely. Officials have pointed out that Telegram allows users to edit posts without changing the date. A post dated May 1, then updated on May 4, could therefore include exam questions and appear to be a pre-exam leak – but would actually be an edited post. In a separate incident, in the days after the May 3 test, netizens found a "guess paper" – an unofficial NEET exam created to help students revise for the test – that contained significant overlap with the actual questions asked in this year's test. NTA deemed the document sufficiently concerning that it annulled the test and rescheduled it for June 21. NTA requested the Telegram ban ahead of the new test by asking the Ministry of Electronics and Information Technology (MeitY) to use its powers under the Information Technology Act. The testing authority wants the ban to prevent a repeat of the May mess, and also to stop scammers offering paid access to exam papers. MeitY issued directions restricting access to Telegram from June 16 until June 22. The ministry also directed Telegram to disable message editing in India until June 30 to avoid the panic that followed the original exam. India has in the past shut down internet access across entire cities during major exams, earning criticism due to the impact such outages have on the wider community. NTA acknowledged the blast radius of its request, saying it "affects lakhs [hundreds of thousands] of citizens who use the Telegram platform for legitimate personal, educational, professional and informational purposes." The agency said it "sincerely regrets the inconvenience caused to them." Lobby group the Internet Freedom Foundation has criticized the Telegram ban, saying it is unconstitutional and represents overreach. "If the exam is secure and no leak exists, what is being suppressed is rumor, and rumor cannot justify closing a platform when specific blocking and criminal prosecution remain available." India is not the only country to shut off internet access during exams. We've seen it happen in Syria and Sudan too. The Internet Society has condemned the practice. "Internet shutdowns are never a proportionate response to anything, no matter how long they last," the nonprofit wrote in 2023. "Even if a shutdown were to prevent exam cheaters from communicating, it also prevents everyone else from using online services. It is not an effective anti-cheating mechanism, and it comes at a cost to all of society." ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=4094241&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=4094241&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257681</guid>
        <link>https://www.theregister.com/os-platforms/2026/06/18/freebsd-151-lands-but-desktop-dabblers-still-have-to-draw-their-own-gui/5257681</link>
        <pubDate>Thu, 18 Jun 2026 12:45:00 +0200</pubDate>
        <title>FreeBSD 15.1 lands, but desktop dabblers still have to draw their own GUI</title>
        <description><![CDATA[ Better laptop sleep and Wi-Fi support make the beastie more portable-friendly, but getting beyond the shell remains a DIY job ]]></description>
        <category>os platforms</category>
                <lab:kicker><![CDATA[ OS PLATFORMS ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 10:57:03 +0000</dc:modified>
                <content:encoded><![CDATA[ After a delay when a microcode-related boot problem surfaced, FreeBSD 15.1 is now available. Laptop support is getting there, but a GUI from the installer isn't – yet. You'll have to put in some extra work if you want to have more than a command prompt. As you might expect from its version number, it's much like a point release of other, more widely used OSes: it contains lots of bug fixes, and hardware support in multiple areas is improved. For the lowdown on what has changed, the Release Notes contain a list of fixes and new features, and the one known issue – in the NFS client – is detailed in the Errata. Desktop use is something of an edge case for FreeBSD, but the Laptop Support and Usability Project is working on it. We gave a brief update when KDE Plasma 6.6.0 appeared back in February, but work has continued. The May status update is encouraging. Now laptop suspend and resume work, and if you wish, FreeBSD 15.1 can put laptops to sleep when their lids are closed, and wake them when the lids are opened. The team is still working on hibernation, as well as the more modern "S0ix" sleep modes. Wireless networking support is also making significant strides. Version 15.1 has improved versions of the Intel iwlwifi and Realtek rtw88 and rtw89 drivers, which are based on Linux version 7.0. This means that FreeBSD 15.1 now supports Wi-Fi 4 and Wi-Fi 5. If, like this vulture, you're more familiar with ratified standards than marketing names, the former means 802.11n (2.4 GHz and 5 GHz, up to 600 Mbps) and the latter denotes 802.11ac (5 GHz, up to 3.5 Gbps). And if you're not sure which chipset your wireless controller uses, the FreeBSD 15.1 Hardware Notes page has full details of the names of all the supported devices. The release was delayed a couple of weeks due to what the RC3 announcement called "a critical bug fix to the x86 boot loader," which also noted the importance of manually updating the EFI boot loader. This step is also specified in the Upgrade instructions. The instructions are quite complex, and we recommend you study them closely. For one thing, you need to know if you installed your system using the traditional distribution sets or the more modern, and still somewhat experimental, base system packages. We upgraded the FreeBSD 15.0 VM we installed seven months ago, and we couldn't remember which method we used. Fortunately, the freebsd-update command told us, so we followed the commands given in the guide for package-based installations. By Linux standards, they're very wordy and we did miss at least one vital punctuation mark, but it worked in the end. A year ago, the project said that it hoped to offer the KDE desktop right from the installer. That didn't make it into FreeBSD 15.0 last December, and it's not in 15.1 either. We installed a clean copy on a test machine, a Core i5-based ThinkPad X220. The installation program is much the same as in FreeBSD 13 or 14: it still installs a resolutely text-only OS, and if you want a graphical environment or desktop, you must install and configure it yourself. The handy optional desktop-installer script is still available, but as far as we can tell, it hasn't been updated for version 15.1 yet. In our testing, it couldn't correctly install a working desktop, and whatever desktop we tried, it failed without giving any visible error. We worked out that we needed to install the GPU drivers separately. We manually installed the drm-kmod drivers, and enabled them by editing the main init script by hand. After this, even before loading X11, the boot process picked up the native resolution of the machine's LCD and automatically changed the screen mode to fit. Once this was working, the desktop-installer ran to completion – but by that point, most of its work was done. As well as the very basic TWM, we also tried the FreeBSD-native Lumina desktop, Xfce, and GNOME (albeit on X11 only). FreeBSD 15.1 also offers several others, including the rather dated GNOME 47 and the much more recent KDE Plasma 6.6.5. FreeBSD is making good strides in supporting modern portable hardware. We feel that this matters for two reasons. First, any FOSS project can only thrive if it continually wins new users, and if curious newbies graduate from VMs to bare metal, most are likely to try it on laptops. Second, power management matters everywhere, although it's unfairly neglected on servers. Even there, power management is useful: the world could save substantial amounts of power if workloads were migrated off underused machines and they were allowed to go to sleep, only waking when accessed. For tired Linux users looking for an escape from ever-more-bloated corporate-influenced distros, FreeBSD is getting more viable all the time. It doesn't have systemd, Flatpak, Snap, UKIs, or built-in AI features. It does support Wayland, if that's something you want. The main problem you will face is getting it as far as a GUI. Both NetBSD 11 and OpenBSD 7.8 are ahead in this department, but they are also smaller, simpler OSes. FreeBSD can do far more, even including running Linux binaries and Linux OCI containers. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5257793&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5257793&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257770</guid>
        <link>https://www.theregister.com/public-sector/2026/06/18/transport-for-london-keeps-capita-behind-wheel-of-road-charging-ops-in-912m-extension/5257770</link>
        <pubDate>Thu, 18 Jun 2026 12:00:00 +0200</pubDate>
        <title>Transport for London keeps Capita behind wheel of road charging ops in £912M extension</title>
        <description><![CDATA[ Replacement deal now expected in mid-2029 as body says safe transition will take at least five years ]]></description>
        <category>public sector</category>
                <lab:kicker><![CDATA[ PUBLIC SECTOR ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 15:56:57 +0000</dc:modified>
                <content:encoded><![CDATA[ Transport for London (TfL) has extended supplier Capita's two road user charging contracts at a potential cost of £912 million including VAT after delaying the start of a combined replacement by two years. TfL announced it was directly awarding the contract extensions to Capita on June 11, saying this was required given the time it will take to buy and implement a replacement support service for its road user charging schemes. These comprise the congestion charge, Low and Ultra Low Emission Zones (LEZ/ULEZ), tolls for the Blackwall and Silvertown tunnels, HGV safety permits, and traffic fines, with the work including processing data from thousands of automatic number plate recognition (ANPR) cameras along with customer account management, payment, and billing. In May 2025, TfL said that it wanted to replace Capita's current contracts for Business Operations (BOps) and Enforcement Operations (EOps) for Road User Charging with a single deal. It planned to publish a full tender notice for this around March 31, 2026, and start the new contract on September 30, 2027. In a revision of this notice in February this year, it pushed back the tender notice to April 15, 2027, and the contract start to October 2, 2028. Last week, TfL said it plans to award the new combined contract in mid-2029, in procurement notices extending the BOps contract at a cost of up to £510 million and the EOps one by up to £402 million. Both extensions are for five years with the option to extend them to a total of seven. "Due to the scale and complexity of the existing services and the need to design, build, integrate and safely deploy a replacement solution, the full procurement, mobilisation and transition is expected to require a minimum of five years based on current programme assumptions," TfL said in the notices. It added that it will have rights to end the extended contracts early, "enabling TfL to transition to a replacement supplier at the earliest point at which it is technically feasible and operationally safe to do so." TfL expects the new combined contract to be worth more than £2 billion over 20 years. Last month, TfL disclosed that its Revenue Collection Services contract, which it awarded to Spanish defense and tech group Indra Sistemas in January covering almost all public transport ticketing in London, could be worth up to £1.964 billion if all extensions and variations are exercised. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5257828&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5257828&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257698</guid>
        <link>https://www.theregister.com/software/2026/06/18/oracle-support-timelines-for-fusion-middleware-tighter-than-expected/5257698</link>
        <pubDate>Thu, 18 Jun 2026 11:15:00 +0200</pubDate>
        <title>Oracle support timelines for Fusion Middleware tighter than expected</title>
        <description><![CDATA[ Big Red drops ominous mention of 'Market Driven Support' beyond 2027 - but there's good news for AIX users ]]></description>
        <category>software</category>
                <dc:modified>Wed, 17 Jun 2026 15:30:23 +0000</dc:modified>
                <content:encoded><![CDATA[ Oracle has shocked its customers by releasing new end-of-life conditions for its middleware products that thousands of large organizations rely on in their enterprise application deployments. In a missive published online earlier this month, Big Red warned that support for the widely used Oracle Fusion Middleware 12c Release 2 was approaching a “critical milestone.” Top-level Premier Support is set to end in December 2026, while Extended Support will stop by the end of December 2027. “After these dates, Oracle will no longer provide updates or security fixes for this product version. Technical assistance will be provided as defined in the Oracle Lifetime Support Policy. All customers and partners are strongly encouraged to begin planning and executing upgrades or migration strategies to currently supported Oracle Fusion Middleware releases as soon as possible,” the note said. Martin Biggs, vice president and general manager of third-party support specialist Spinnaker, said users would be concerned about the lack of time to plan for the migration or strategic change to a new platform and to recruit scarce skills. “That version of Fusion Middleware has been around for quite a while now, and the announcement of Extended Support being only a year is quite unusual — normally it's two to three years. In part, that's because they kept the Premier Support going for so long, and then telling everyone it's going to be managed, ‘Market Driven Support’ after Extended Support is not what the market was expecting,” Biggs said. In its note, Oracle said that “to help reduce the time sensitivity of these upgrade programs”, it planned to offer a Market Driven Support program for Oracle Fusion Middleware 12.2.1.4/12.2.1.19 on a yearly basis beyond 2027. “Details of this program, including scope, terms, and availability, will be communicated at a later date,” the vendor said. Biggs described Market Driven Support — a fee-based service which offers a lower level of support than Premier or Extended Support — as an “extraordinarily limited product” which does not provide full patching. “The situation right now is you've got so many security vulnerabilities being announced all the time, who knows what Market-Driven Support is going to include? They're basically saying, when it comes to January 2028, it's unclear what they’re going to do. By the way, Market Driven Support is far more expensive for a far weaker support product. That's the big surprise to the marketplace,” Biggs said. The Register has offered Oracle the opportunity to comment. The good news is that Oracle is broadening platform support by confirming future versions of Oracle WebLogic Server and Oracle Fusion Middleware will be available on IBM's AIX Unix operating system for its mid-range POWER processor architecture. The move would offer “a more deliberate approach to modernization, allowing upgrades to be aligned with infrastructure lifecycle planning, application dependencies and business-driven transformation timelines,” IBM said in a statement. Oracle has also promised more details — at some point in the future — about its plans for Fusion Middleware. It plans to deliver the next Oracle Fusion Middleware suite release on a Jakarta EE 11-based container [for Java-based applications]. "This release is intended to extend support for the next generation of Java and WebLogic Server capabilities across the broader Fusion Middleware portfolio,” it said. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=1684268&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=1684268&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257817</guid>
        <link>https://www.theregister.com/public-sector/2026/06/18/uk-cabinet-office-hiring-ai-and-innovation-influencer-to-build-ai-first-culture-in-civil-service/5257817</link>
        <pubDate>Thu, 18 Jun 2026 10:30:00 +0200</pubDate>
        <title>UK Cabinet Office hiring AI and innovation 'influencer' to build 'AI-first culture' in civil service</title>
        <description><![CDATA[ Every buzzword deployed in quest to transform into 'country that is equipped for an AI world' ]]></description>
        <category>public sector</category>
                <lab:kicker><![CDATA[ Public sector ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 11:45:57 +0000</dc:modified>
                <content:encoded><![CDATA[ The UK Cabinet Office is looking for an AI and Innovation Director who can develop civil servants' use of artificial intelligence and change the way the civil service works. The task of persuading public sector workers to love AI involves "re-imagining the future workforce and business model" for the UK's civil service, promoting adoption of AI tools, "championing, coordinating, and tracking AI adoption" across government departments, and instilling an "AI-first culture," according to the job advert. As that list implies, the individual will need to be "a natural influencer" with a "deep understanding of the AI landscape," both traditional and generative, ideally with experience of building AI services. "My ambition is for the civil service to be a global leader in AI government transformation, to enable a more productive civil service that achieves world-class outcomes for citizens and a country that is equipped for an AI world," writes Cabinet Secretary Antonia Romeo in an information pack published with the job ad. "We are seeking an exceptional individual who is an experienced strategic leader, can deliver under pressure, and will help shape the direction of the civil service at a pivotal time." The exceptional individual in question will need to be content to serve King and country for a relatively modest £100,000 to £163,000 a year, albeit with generous pension contributions, compared with some private sector equivalents. They will have to agree to an expected assignment period of at least three years, although this is not contractual, and be British, a national of most European countries, or any Commonwealth country. The right to work in the UK is another requirement. Reg readers who fit the bill can apply by submitting a CV and a 1,000-word statement about why they are suitable by five minutes to midnight on Monday, July 13. While candidates can use AI in applying, "all examples and statements provided must be truthful, factually accurate, and taken directly from your own experience," so perhaps championing AI adoption should wait until after getting the job given the technology's propensity to make things up. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5227770&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5227770&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258128</guid>
        <link>https://www.theregister.com/databases/2026/06/18/roachfest-london-2026-the-database-as-competitive-asset/5258128</link>
        <pubDate>Thu, 18 Jun 2026 10:00:00 +0200</pubDate>
        <title>RoachFest London 2026: The database as competitive asset</title>
        <description><![CDATA[ SPONSORED POST: Operate without fear. Build with confidence. Adapt to the AI era ]]></description>
        <category>databases</category>
                <dc:modified>Thu, 18 Jun 2026 03:56:36 +0000</dc:modified>
                <content:encoded><![CDATA[ The database a business depends on shouldn’t be a potential point of failure; it should be a competitive asset. That’s the proposition Cockroach Labs will put to enterprise architects and database administrators at Convene's Bishopsgate venue in London on Thursday, June 25, 2026. The one-day RoachFest London 2026 event will examine how a database makes that transition from costly liability to competitive advantage. Modern infrastructure grows more complex and harder to manage by the year: Today's challenge might be a traffic spike or a cloud provider outage; tomorrow's could be an AI agent that needs durable context across long-running sessions. At RoachFest London, Cockroach Labs will show why the database should not sit as a passive store, but act as the resilient layer that a modern enterprise depends on: one that lets teams operate without fear, build with confidence, and adapt to what's next. What to expect Tracks at RoachFest London 2026 cover:  AI and agentic workloads  Resiliency  Migrations  Operational efficiency  Hands-on workshops range from foundational distributed SQL through multi-region architecture to vector storage, indexing, and retrieval-augmented generation (RAG) built on ACID guarantees. Databases in the age of AI In the keynote, Spencer Kimball, co-founder and CEO of Cockroach Labs, will walk through why the database industry is at an inflection point, facing a complexity tax and the sprawl of hundreds of alternatives that enterprises are struggling to operate and modernize. He'll connect those pain points to the wave of agentic AI that's creating data pressure the industry has never seen before, and make the case that distributed databases are no longer a luxury but an emerging requirement. He will also discuss how CockroachDB is evolving to meet this moment by collapsing cost and scaling elastically. He’ll close with the vision that the database of the next decade will operate itself, with humans elevated to policy and judgment, not log files and escalations. A separate panel session, led by Memori Labs co-founder Adam B. Struck, focuses on where long-term agent state should live and how to keep it consistent as conditions change. Cloud-busting on purpose Form3's vice president of engineering Kevin Holditch will walk attendees through a payments architecture that runs active/active/active across AWS, GCP, and Azure. Form3 takes disaster-recovery testing seriously enough to pull down a cloud provider for 24 hours in production, not staging. What's next for CockroachDB Cockroach Labs' vice president of product Igor Stanko will lay out the CockroachDB roadmap, including bring your own cloud, AI-powered migration tooling, and improvements to the database's price-performance ratio. Operating without fear The afternoon's featured guest knows high-stakes environments. In his session "Operating Without Fear", Major Tim Peake CMG, the first British astronaut to reach the International Space Station (ISS), draws a parallel between astronaut training and the discipline of building systems that thrive under adversity. RoachFest London 2026 takes place at Convene Bishopsgate on June 25. Workshops open at 9am, main stage sessions begin at 1:05, capped off by an evening reception from 4:30 to 6:00. Registration is free with promo code SP100 – register now as space is limited. See the full agenda and register at cockroachlabs.com/roachfest/location/london. Sponsored by Cockroach Labs. ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=1682525&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=1682525&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257932</guid>
        <link>https://www.theregister.com/security/2026/06/18/major-us-carrier-stored-credit-card-info-in-the-clear-employee-learned-on-first-day/5257932</link>
        <pubDate>Thu, 18 Jun 2026 09:00:00 +0200</pubDate>
        <title>Major US carrier stored credit card info in the clear, employee learned on first day</title>
        <description><![CDATA[ It happened at a major US telco in the early 2000s ]]></description>
        <category>security</category>
                <lab:kicker><![CDATA[ SECURITY ]]></lab:kicker>
                <dc:modified>Thu, 18 Jun 2026 19:50:00 +0000</dc:modified>
                <content:encoded><![CDATA[ PWNED Welcome back to PWNED, the weekly column where we register some of the worst tech security mistakes our readers have ever seen. Our goal: to help you not do the same. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. This week's tale of code carelessness comes courtesy of a database administrator we'll Regomize as Joker. Back in the first decade of the 21st century, she went for a job interview at one of the USA's leading national cellular carriers. What she saw would make you want to swap your SIM. After a successful meeting with a hiring manager, Joker was hired on the spot. Within hours the company granted her sudo-level access to a database server, then instructed her to "take a look" at some of the databases. Joker soon realized the carrier's security was no laughing matter as she found herself accessing the main production server for the company's data services division, overseeing all services for the mobile web. This story took place in a time before the iPhone, so she was looking at nasty little versions of websites comressed for viewing on their BlackBerries or flip phones. After peeking around some more, Joker discovered that she had access to the master customer table. It contained nightmarish quantities of personally identifiable information: names, addresses, Social Security numbers, billing info, and even full 16-digit credit card numbers. All of this info was stored in the clear, with no encryption or obfuscation. The CVVs were missing from some credit card info, but many were present. "There was a central billing system upstream on Amdocs servers, but this database also had billing details so they didn't have to reach back upstream to Amdocs if users asked to provision new services," Joker said. After Joker informed management about the mess, they deleted the offending info and forced the developers to go upstream again for billing information, just like they should have been doing in the first place. Joker, like any reasonable DBA, assumed access to this information would be tightly controlled - not made available to new staff with full access rights on their first day. She also assumed her new employer would tokenize key pieces of data because that technique means certain info – say credit card and Social Security numbers – would not be visible in the same table as a customer's name and address. Instead, there would be tokens linking back to the actual numbers stored in a secure token vault. This is common in payment systems. If Joker were less ethical or someone else had gained admin access, they could have exfiltrated large amounts of sensitive data. Permissions should start from a zero-trust assumption and provide only what someone needs to do their job. Joker said that when she later moved on to work for a major online retailer, security was front and center, proving that some people did get it, even back in the George W. Bush era. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5257971&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5257971&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257716</guid>
        <link>https://www.theregister.com/cyber-crime/2026/06/18/cyber-offenses-now-account-for-around-a-third-of-all-crime-across-asia-and-south-pacific/5257716</link>
        <pubDate>Thu, 18 Jun 2026 04:00:00 +0200</pubDate>
        <title>Cyber offenses now account for around a third of all crime across Asia and South Pacific</title>
        <description><![CDATA[ Latest Interpol review shows how scams continue to dominate, and AI-enabled attackers prove too hot to handle for cash-strapped regions ]]></description>
        <category>cyber-crime</category>
                <lab:kicker><![CDATA[ cyber-crime ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 14:57:45 +0000</dc:modified>
                <content:encoded><![CDATA[ Cybercrime now accounts for more than 30 percent of all offenses across the Asia and South Pacific (ASP) region, according to the latest figures from Interpol. The international cop shop said on Wednesday that the region has seen “a dramatic increase” in the number of recorded cybercrimes, driven largely by an uptake of digital infrastructure, new technologies, and the increasingly organized nature of criminal networks. Interpol’s latest ASP Cyberthreat Assessment Report states that online scams and phishing attacks dominate cybercrime in the region. Data taken from 2024-2025 shows that phishing campaigns have matured beyond the spray-and-pray mass emails of yesteryear and now resemble the more sophisticated techniques deployed elsewhere in the world. Targeted spear phishing is more common nowadays, and the growing use of AI helps even low-skilled script kiddies to apply a layer of authenticity to their attacks. The region’s problem with organized scamming gangs that run camps where hundreds of people are compelled to commit crimes is especially pronounced and well-documented. A United Nations report published last year described scam call centers across Southeast Asia as an epidemic that is metastasizing across the region “like a cancer.” These compounds can be found across countries such as Cambodia, Laos, Myanmar, and the Philippines, and often see vulnerable individuals trafficked into the scam centers to work under poor conditions – or even as slaves. Interpol cited Singaporean research, which estimated the regional scam industry generates close to $40 billion each year. AI tools, especially those capable of generating convincing deepfake imagery, have also proven popular with cybercriminals across ASP, just as they have beyond the region. In 2024, the same scam compounds were found using deepfake imagery to support romance scams. In February 2024, an employee at a multinational business in Hong Kong was duped into authorizing a $25 million payment because the faces of company execs were convincingly deepfaked on a video call. A similar case was also reported in Singapore in March 2025, when a finance director at a different multinational was tricked into transferring more than $499 million following a Zoom call in which fraudsters assumed the identities of company chiefs, including the CEO and CFO. Interpol’s report highlights how cyber threats are evolving into large-scale challenges for multiple jurisdictions, and no longer represent relatively uncommon, isolated incidents. While digitization across the region is growing, opening new economic opportunities for these countries, law enforcement agencies are struggling to keep pace with the increase in cybercrime. Many lack the skills and tools needed to investigate these crimes. The issue is especially pronounced in developing countries and small island states in the Pacific, which face “significant resource and capacity constraints,” and are thus more vulnerable to direct targeting in attacks by criminals who have a greater chance of evading consequences. Neal Jetton, cybercrime director at Interpol, said: “The findings in this report highlight a rapidly evolving cyber threat landscape across Asia and the South Pacific, where cybercriminals are leveraging artificial intelligence, ransomware-as-a-service models, and sophisticated social engineering techniques on an industrial scale. “As digital adoption accelerates across the region, strengthening operational cooperation, information sharing, and cyber resilience remains essential to protecting communities and critical infrastructure.” Some improvement Interpol lauded many jurisdictions and governments within the ASP region for their proactive approaches to countering cybercrime growth. Hong Kong and the Republic of Korea are two areas that have made strides by introducing new cybersecurity legislation, while others have established national task forces, codified national action plans, and launched awareness campaigns. But even in more developed countries globally, and those with more mature cybersecurity regulatory and legislative landscapes, the issue of increasing rates of cybercrime persists. While Interpol does not collect cybercrime figures for other regions, such as Europe and North America, in the same way that it does for ASP, it’s easy to see that problems persist everywhere. The UK’s Office for National Statistics (ONS) publishes crime rates by type across England and Wales each year, and while computer misuse offenses in 2025 decreased by 58 percent compared to 2017’s figures, there were still an estimated 735,000 cases across the year. Expanding the data to look beyond pure cyber offenses to cyber-supported crimes, such as banking and credit fraud, these offenses account for more than 2.7 million of the circa 9.6 million total crimes committed. The FBI in the US produces its annual IC3 report examining the rates of cybercrime across the country. Although it doesn’t compare it to total offenses or other crime types, the latest report reflecting 2025’s figures showed cybercrime reports topped one million for the first time, and total losses reached a record $20.87 billion. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5241871&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5241871&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5258087</guid>
        <link>https://www.theregister.com/ai-and-ml/2026/06/18/estonia-intends-to-recognize-ai-agents-with-digital-ids/5258087</link>
        <pubDate>Thu, 18 Jun 2026 01:12:47 +0200</pubDate>
        <title>Estonia intends to recognize AI agents with digital IDs</title>
        <description><![CDATA[ I am not a number! I am a free agent (that just happens to have a number) ]]></description>
        <category>ai and ml</category>
                <lab:kicker><![CDATA[ AI + ML ]]></lab:kicker>
                <content:encoded><![CDATA[ Estonia plans to allow AI agents to have their own digital identities so they can act on behalf of people in a way that can be verified and audited. The initiative, backed by the country's Eesti.ai advisory board, calls for the development of ID codes that AI agents can use to take actions, subject to some unspecified authorization and task delegation process. Academics and corporate technical folk have already made related proposals in recognition of the absence of agentic technical infrastructure. Last month, researchers under the flag of OWASP proposed the Agent Name Service for agent discovery and interoperability. DNS for AI Discovery is another such project. But these have more to do with platform plumbing while Estonia, known for its embrace of technology, is more focused on permission and punishment. Establishing digital identities for AI agents and authorizing limited powers will help avoid scenarios where individuals are required to delegate broad authority to an agent at the expense of their rights, the government says. "In the future, AI will increasingly carry out digital tasks on our behalf, compiling reports, preparing declarations or interacting with information systems," said Prime Minister Kristen Michal in a statement. "To that end, it must be clear who is acting on whose behalf with what rights, and who is ultimately responsible." By taking this step, Estonia casts itself as "first country to create digital identities for AI agents." Two weeks ago, Argentina's President Javier Milei endorsed a similar idea, legislation to allow "non-human corporations," managed by software, with limited liability. "Limited liability is not a luxury for such entities; it is a precondition for their existence," Milei wrote in a Financial Times op-ed. Several decades ago, IBM took a similar line on liability but reached the opposite conclusion about automated decision making: "A computer can never be held accountable, therefore a computer must never make a management decision." Despite the citation of that passage from IBM's 1979 Training Manual in a 2025 blog post, Big Blue's designated author Doug Bonderud sounds less certain about the impermissibility of AI action these days. "Should AI be used for management decisions?" he mused. "Maybe. Will it be used to make some of these decisions? Almost certainly." While governments work on legal changes that will allow AI agents to operate, private sector companies are already taking a stance, at least with respect to external AI agent usage by customers. Target Corporation earlier this year revised its Terms & Conditions with a section titled Agentic Commerce and Delegated Access. It states, "Purchases and other actions taken by an Agentic Commerce Agent that you have authorized are considered transactions authorized by you." American Express meanwhile has taken the opposite tack by assuming liability for errant agentic commerce. "In the future, if a Card Member authorizes an AI agent to make a purchase and that agent sends American Express the customer’s authenticated purchase intent, American Express will protect eligible customers from charges related to AI agent error," the company said in April when it introduced its agentic commerce developer kit. In a pre-print paper last year titled "AI Agents and the Law," Georgia Institute of Technology professors Mark Riedl and Deven Desai observe that once AI agents have the ability to act in a way that changes the state of the world – e-commerce transactions as opposed to output that requires human interaction for effect – concerns about harm become more pressing. They note that while the law is well equipped to deal with conflicts arising from human agents, it's not well-suited to the possibilities of software agents. "Put simply, although computer science and law have similar notions of agents, a software agent is not the same as a human agent," they write "For example, agency law disciplines agents by imposing legal liabilities on agents when they misbehave. Human agents can face financial and even criminal penalties; that is not so for software agents." To date, AI companies have done their best to limit liability for AI harms. But they've not been entirely successful: A Canadian court held Air Canada liable for bad chatbot advice, and a German court held Google liable for inaccurate AI Overview content. It may be a while before the rules for AI agents get hammered out and harmonized to whatever extent is possible. But in the interim we'll at least have digital identifiers to call out bad agents by name. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=4094163&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=4094163&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257978</guid>
        <link>https://www.theregister.com/devops/2026/06/17/git-good-with-epic-games-new-open-source-vcs-lore/5257978</link>
        <pubDate>Wed, 17 Jun 2026 22:49:00 +0200</pubDate>
        <title>Git good with Epic Games' new open source VCS, Lore</title>
        <description><![CDATA[ Got big binaries? Tired of other version control systems that treat them like inferior files? Lore might be worth a look ]]></description>
        <category>devops</category>
                <lab:kicker><![CDATA[ devops ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 21:15:52 +0000</dc:modified>
                <content:encoded><![CDATA[ Fortnite maker and Apple nemesis Epic Games has decided to git good all on its own with the open-source release of its homemade version control system, dubbed Lore. The project began life as Unreal Revision Control, and was used by internal teams and as the version control system (VCS) built into Unreal Editor for Fortnite. Now, Epic is ready to share its handiwork with the world. Lore is a centralized, content-addressed VCS that’s meant to be more flexible for developers, as it's licensed under the less restrictive MIT License instead of the copyleft requirements inherent in the GNU standard. MIT is generally considered more permissive because, unlike GNU, it doesn't require derivatives to be licensed in the same way (e.g., a fork of Lore could be proprietary). Lore can be installed on macOS, Windows, and Linux and its server side is designed to be transportable into different cloud services as well. The biggest difference between Lore and other VCS is its equal treatment of text files – e.g., code – and binaries. “All content is treated as opaque byte streams on the hot path,” Epic explains in its system design explanation document. “Text-aware features are layered on top, never assumed by the storage or transport paths. Binary content gets the same first-class treatment as text.” With that in mind, it’s obvious who Epic is targeting with the release: Game developers. Lore is purpose-built for projects that use large binary files such as games, Epic said, but that doesn’t preclude other use cases with heavy binary loads, like AI model builders, systems developers, and others who work with large amounts of machine-readable data alongside their own code. We have lots of VCS data, so why do we need Lore? There are plenty of VCS options out there: Git, Perforce, Mercurial (and its descendent Sapling) are all mentioned by Epic as alternatives that resemble Lore in its design and use. So, why a new VCS? That’s easy, says the Fortnite studio: None of ‘em do it all. Git, says Epic, has great revision graphing, but treats binaries as “second class citizens” and lacks multi-tenant isolation that ensures users on the same infrastructure can't access each others work. Perforce requires multiple server round trips to conduct standard operations, making it too slow. Mercurial and Sapling elegantly solve “the scale of source repositories” via their distributed architecture, but again treat text as king and everything else as second-class data. “The motivation is not that prior systems are bad,” Epic explained. “What Lore offers that the prior art does not is the union” of all those features, and some others too. Key design goals Epic had in mind when designing Lore included the aforementioned binary-first design, a sparse-by-construction architecture that only downloads necessary fragments from the server to clients to ensure fewer round trips, the elimination of partially-applied revisions, in-between states are invisible to readers, and a full-surface API that allows Lore to work with a variety of programming languages. If you want to give Lore a spin Epic has published a thorough quickstart guide, and pre-built binaries are available, ironically enough, on GitHub. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5258032&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5258032&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257951</guid>
        <link>https://www.theregister.com/ai-and-ml/2026/06/17/smelly-config-files-will-make-your-agents-waste-tokens-researchers-warn/5257951</link>
        <pubDate>Wed, 17 Jun 2026 21:32:16 +0200</pubDate>
        <title>Smelly config files will make your agents waste tokens, researchers warn</title>
        <description><![CDATA[ Researchers urge developers to see that less is more when it comes to instructions ]]></description>
        <category>ai and ml</category>
                <lab:kicker><![CDATA[ AI AND ML ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 23:29:22 +0000</dc:modified>
                <content:encoded><![CDATA[ If you're exposing your agent to a strong odor, it's time to clean up your instructions. Risky or poorly structured code patterns are known as "code smells," and it turns out coding agent directives can be similarly redolent, leading to wasted tokens and worse output. Coding agents rely on configuration files that summarize expected agent behavior. These context-enhancing files are commonly written in Markdown and named either CLAUDE.md for those using Anthropic models or AGENTS.md for pretty much everyone else. They include various text instructions that advise the coding agent about desired behavior and tool use. And they can get rather wordy. Anthropic advises no more than 200 lines of text because longer files consume model context and may hinder model coherence. Researchers affiliated with the computer science department of the Federal Institute of Minas Gerais in Brazil recently scoured some 532,000 files to build and analyze a dataset of 100 popular open-source projects containing either an AGENTS.md or a CLAUDE.md file. "Our results show that configuration smells are widespread," the authors state. "Lint Leakage was the most common smell, affecting 62 percent of the files, followed by Context Bloat (42 percent) and Skill Leakage (35 percent)." Linting is the process of running automated tools to check code for programming and style errors. Lint Leakage refers to agent instructions that repeat rules already enforced by linters, format checkers, and static analysis tools. Duplicative rules waste tokens by burdening the underlying model with guidance for a task already handled reliably by programmatic tools. Context Bloat, as its name suggests, describes the tendency of developers to overspecify code agent behavior. "Bloated configuration files increase token consumption, raise costs, and reduce the visibility of important instructions," the authors observe, pointing to Anthropic's recommendation of no more than 200 lines of text. Skill Leakage, another common configuration smell, occurs when rarely used tools or practices get added to the AGENTS.md file, which gets loaded in every agent session. The agent instructions would be better in a separate skills file (e.g. SKILLs.md) that gets loaded only when needed. Skill leakage also expands the agent's context unnecessarily and potentially distracts agents from other things. Other agentic odors include: Blind References, which happens when configuration files reference external documents (e.g. via URLs) without explaining when that resource becomes relevant; Init Fossilization, configuration details set up upon a project's initialization that are no longer relevant; and Conflicting Instructions, which occur when agent directives contradict each other. The study authors say that they found at least one of these six smells in 91 of the 100 AGENTS.md files tested. "These results suggest that developers could benefit from catalogs and tools designed to spot configuration issues in agent configuration files," they conclude in the preprint paper, entitled "Configuration Smells in AGENTS.md Files: Common Mistakes in Configuring Coding Agents." The authors are Helio Victor F. dos Santos, Vitor Costa, Joao Eduardo Montandon, Luciana Lourdes Silva, and Marco Tulio Valente. The message here is that less is more when it comes to code agent configuration files, perhaps even to the point that anything is worse than nothing. Similarly, when ETH Zurich boffins examined the impact of context files for agents a few months ago, they found [PDF] that developer-generated instructions raised costs and only improved code performance about 4 percent, while LLM-generated instructions had a small (3 percent) negative impact on agent-generated code. They concluded "unnecessary requirements from context files make tasks harder, and human-written context files should describe only minimal requirements." ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=227318&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=227318&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257909</guid>
        <link>https://www.theregister.com/networks/2026/06/17/nvidia-backed-optics-vendor-to-boost-wafer-output-by-4x-to-meet-ai-interconnect-demand/5257909</link>
        <pubDate>Wed, 17 Jun 2026 20:12:38 +0200</pubDate>
        <title>Nvidia-backed optics vendor to boost wafer output by 4x to meet AI interconnect demand</title>
        <description><![CDATA[ Jensen can't risk semiconductor supply chains derailing the AI hype train ]]></description>
        <category>networks</category>
                <lab:kicker><![CDATA[ NetworkS ]]></lab:kicker>
                <content:encoded><![CDATA[ As AI systems grow larger, optics are playing a larger part in their design – so much so that at Computex earlier this month, Nvidia CEO Jensen Huang proclaimed the technology would make Marvell the next trillion dollar company. Now, Nvidia-backed photonics vendor Coherent plans to boost indium phosphide (InP) wafer production at its Sherman, Texas, fab by 4x in anticipation AI proliferation will trigger an explosion in optical interconnect demand. Supply chains must be ready to meet that demand when (or if) it materializes, and Coherent is one such supplier. The company operates eight wafer fabs across the US that produce semiconductors used in laser light sources and optical modules. These supply chains are so important to Nvidia’s future growth that, in March, the GPU slinger invested $2 billion in the optics vendor to bolster its production capacity. Coherent is wasting little time putting those funds to use. Along with $20 million in funding from the Texas Semiconductor Innovation Fund and the Sherman Economic Development Corporation, and up to $50 million in CHIPS and Science Act funding, Coherent plans to plow $650 million into its Sherman plant, effectively doubling the factory’s footprint and quadrupling InP wafer output. InP semis are commonly employed in lasers, photodetectors, and modulators found in optical interconnects. As rack scale AI systems grow from a few dozen accelerators to hundreds or thousands, copper is no longer sufficient and optics are now required to achieve this scale. We expect this trend to dramatically increase the number of optical components employed by these systems over the next couple of years. Coherent claims that the Sherman expansion will create about 1,000 new jobs, roughly 550 of which are directly related to advanced manufacturing, engineering, and technical roles. The company hasn't shared a timeline for when the expansion will be completed. We've reached out for comment and will let you know if we hear anything back. Coherent is not the only optics vendor Nvidia is bankrolling. This spring, GPUzilla also invested $2 billion in Lumentum, which produces a variety of optical products used in datacenters including pluggable transceivers, optical circuit switches, and laser modules. Less than a month later, Nvidia plowed another $2 billion into Marvell in part to accelerate its silicon photonics roadmap. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=226090&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=226090&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257877</guid>
        <link>https://www.theregister.com/cyber-crime/2026/06/17/massive-password-stealing-attack-hits-75k-fortinet-firewalls/5257877</link>
        <pubDate>Wed, 17 Jun 2026 19:27:40 +0200</pubDate>
        <title>Massive password-stealing attack hits 75k Fortinet firewalls</title>
        <description><![CDATA[ Why are you even reading this?! Rotate your passwords!! ]]></description>
        <category>cyber-crime</category>
                <lab:kicker><![CDATA[ CYBER-CRIME ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 20:19:41 +0000</dc:modified>
                <content:encoded><![CDATA[ UPDATED If you have a Fortinet firewall, it's time to stop and change your passwords. Intruders somehow gained access to around 75,000 Fortinet firewall devices and stole credentials belonging to major corporations across 194 countries, in some cases leading to full network compromise. Security researchers say that they have verified the data, and the cracked FortiGate passwords belong to accounts spanning multinational corporations including FoxConn, Samsung, Comcast, Siemens, Lenovo, FedEx, PxW, Accenture, Oracle and many others. Check to see if your organization made the list of affected domains – and immediately rotate all passwords associated with Fortinet VPN and administrative interfaces. Make sure multi-factor authentication is turned on, too, as this type of massive credential leak can lead to very serious consequences, giving attackers full, remote access to not only the firewall but the entire corporate network. Hudson Rock, which analyzed the data, said the leak affects 21,632 unique domains. “The scale of this breach touches nearly every sector of the global economy, sparing no industry. The threat actors have built a verified database of working credentials for some of the largest enterprises on the planet,” the security shop said on its Infostealer blog. Researcher Volodymyr “Bob” Diachenko first spotted the intrusions and attributed them to a Russian-speaking group. “They intercept SSL VPN authentication, crack hashes on a 45-GPU cluster managed via Hashtopolis, and pivot into internal Active Directory environments,” he wrote on LinkedIn. “The operation processed 1.16 billion credential attempts against 320,777 FortiGate targets and 2.1 billion attempts against 163,650 MSSQL servers.” Plus, according to Diachenko, the criminals fully pwned at least four organizations, including a Turkish NATO defense contractor, and, in that case, stole classified defense documents. Security sleuth Kevin Beaumont, who also verified the stolen credentials, said “the data is legit.” “I have worked with several orgs listed, and can confirm the logins and passwords are real,” Beaumont wrote. “Many of the devices sampled are on fairly recent patches.” According to device search engine Shodan, the massive heist comprises about half of all internet-facing Fortinet firewalls. Plus, Beaumont noted, most of the compromised Fortinet devices remain online. So if you’re still reading this story: stop now, and go reset your Fortinet firewall passwords stat. After we first published this story, Fortinet responded to us, denying that the attacks are fresh and claiming that the data showing up on the dark web comes from prior breaches. "Based on our analysis, the data involved is a resharing of data from previous incidents, as well as bruteforcing of credentials, and is not related to any recent incident or advisory," a Fortinet spokesperson told El Reg. Organizations that follow routine best practices, including regularly refreshing security credentials, as per guidance in this March blog, face minimal risk from credential compromise detail referenced in the reporting.” The Register reached out to the companies affected by the so-called FortiBleed campaign for comment, Lenovo said it was looking into it; we didn't receive responses from the others. ® Updated at 2118 with a statement from Fortinet. ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=257713&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=257713&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257854</guid>
        <link>https://www.theregister.com/systems/2026/06/17/uncle-sam-bets-500m-that-alphabet-spinoffs-ai-can-dig-up-new-semiconductor-materials/5257854</link>
        <pubDate>Wed, 17 Jun 2026 19:05:19 +0200</pubDate>
        <title>Uncle Sam bets $500M that Alphabet spinoff's AI can dig up new semiconductor materials</title>
        <description><![CDATA[ AI drug discovery is so last year, even though it hasn't accomplished much yet ]]></description>
        <category>systems</category>
                <lab:kicker><![CDATA[ systems ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 17:05:34 +0000</dc:modified>
                <content:encoded><![CDATA[ In order to move more semiconductor manufacturing onshore, the US needs to depend less on foreign-sourced materials. Now, the government is giving an Alphabet spinoff $500 million in CHIPS Act funds to find domestic minerals, molecules, and chemicals needed for this process. SandboxAQ (that’s AI and Quantum, for those wondering), which spun off from Alphabet in 2022 under the chairmanship of former Google CEO Eric Schmidt, announced the award Wednesday. The company won’t be doing any manufacturing – this is just an R&D grant to turn the startup's AI simulation software toward discoveries necessary to build a domestic chip industry. According to SandboxAQ, the $500 million awarded to it by the Department of Commerce will go toward developing “novel molecules and formulations for semiconductor manufacturing," including chip production materials that are free of PFAS ("forever chemicals"), new semiconductor fabrication catalysts, magnets that don’t rely on foreign-sourced neodymium and other rare earths, and fab-powering batteries that don’t rely on majority foreign-sourced materials like lithium. The CHIPS and Science Act, signed into law by President Biden in 2022, was designed in part to dole out $52 billion to US firms to reignite domestic semiconductor manufacturing, which has mostly fled the country for more favorable production environments overseas. Four years on, the government’s many investments have seen some payoff, like the acquisition of a 10 percent stake in Intel to help keep the company afloat, but there’s still a lot of work to be done to reduce dependence on foreign supply chains and manufacturers. SandboxAQ relies its own large quantitative models (LQMs), which it describes as “AI systems trained on the laws of physics, chemistry, and biology, not human language.” That, the company asserts, means they’re well-suited to discover new materials needed to eliminate harmful PFAS and foreign-sourced materials from the semiconductor supply chain. The hope is that the LQMs will be able to generate their own material predictions that researchers then test in the lab – essentially the same process that’s undergirded the years-long effort to use AI to help synthesize new drugs. Despite AI industry leaders prognosticating we’d be popping AI-designed drugs in 2025, AI has yet to design a functional medicine, according to the US National Institutes of Health. Why, then, should we presume an AI will succeed at replacing critical battery and chip manufacturing components where drug research has failed? In fact, according to SandboxAQ’s announcement, its LQMs aren’t even necessarily grounded in real-world data. They rely in part on synthetic data, which is then fed into the company’s LQMs and used to train their design-make-test workflows. A company spokesperson told The Register in an email that it still uses real-world data where possible. “Where experimental data exists, we incorporate it,” SandboxAQ told us. “Where it doesn't, we can still move forward and solve the problem.” When asked whether an error in the reasoning process could compound, leading to considerable lost time for researchers and a lack of results, the company admitted that such a potential is exactly what “any rigorous AI-driven materials program has to answer.” “Our models are trained on the laws of physics and chemistry, so they are anchored to physical reality, rather than free to drift,” the spokesperson told us, adding that lab testing is the final check on AI accuracy. “A material either performs in the lab, or it doesn’t, and that validation gate is precisely what prevents a chain of reasoning from running away with itself.” SandboxAQ added that it is not starting from zero in any of the four target areas, having done previous work on catalysts, battery materials, alloy discovery, and PFAS breakdown that will be incorporated into its CHIPS Act-funded work. “In commercial deployment, we’ve already cut development timelines from months to weeks” at the candidate screening stage, the SandboxAQ spokesperson explained. SandboxAQ said that some of the work it's doing, like PFAS mitigation, could be rolled out to existing fabs, as could new batteries and the like, but it admitted that the various verticals will operate on different timelines. “Qualification in the semiconductor industry is genuinely rigorous and does take time – we wouldn’t minimize that – but the path runs through validation and industrial qualification with existing manufacturers, not through standing up new fabrication capacity from scratch,” SandboxAQ told us. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=242692&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=242692&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257781</guid>
        <link>https://www.theregister.com/on-prem/2026/06/17/only-half-of-us-datacenter-capacity-planned-for-2026-is-actually-under-construction/5257781</link>
        <pubDate>Wed, 17 Jun 2026 17:55:16 +0200</pubDate>
        <title>Only half of US datacenter capacity planned for 2026 is actually  under construction</title>
        <description><![CDATA[ Another fun example of AI hype and reality colliding ]]></description>
        <category>on-prem</category>
                <lab:kicker><![CDATA[ ON-PREM ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 15:58:51 +0000</dc:modified>
                <content:encoded><![CDATA[ Don't count your bit barns before they've at least started to hatch. Developers continue to announce new datacenter construction projects, but construction work for many due to come online this year or next appear not to have commenced, while planned capacity may have been overestimated. According to financial analyst Jefferies, known promises to build new stateside datacenters suggest 160 GW worth of infrastructure will be operational in the country by 2032 In a research note shared with The Register, the firm reports pervasive delays and claims that only 12 GW out of 24 GW of datacenter capacity scheduled for 2026 is currently under construction. The situation is even worse for the 2027/2028 timeframe, as substantial construction of as much as 80 percent of the planned capacity does not appear to have started yet. The reasons for the delays are familiar: zoning and/or permitting challenges, interconnection setbacks, problems accessing energy supply, labor shortages, and the signing of commercial contracts with end users. Power availability is a well-known issue, as are grid connection setbacks. The latter have grown so bad – reports of seven-year delays - that the US Energy Secretary directed the Federal Energy Regulatory Commission (FERC) to implement new rules to speed the process for customers such as datacenters. Jefferies highlights another factor, that of duplicative counting inflating the planned total capacity due to hyperscalers making multiple requests to various energy utilities. For this reason, it does not expect the majority of the extra load forecast for 2026 and 2027/2028 to materialize. Some investor expectations do not reflect real-world constraints, primarily labor, the report says, suggesting that 15-20 GW of capacity coming online per year is more realistic than the 40+ GW forecast by some for 2027-28. Announced capacity should not be considered a reliable way of evaluating data campus load growth, Jefferies says, citing offtake agreements, permitting progress, financing, and a realistic construction timeline as better indicators. The report points to strategies that operators are taking to circumvent the issues outlined above. Behind-the-meter and hybrid models are solutions to the power problem, with “hybrid” referring to datacenters tending to take all they can get from the grid first, before later turning to behind-the-meter sources - typically on-site power generation. Jefferies says that the build pipeline is shifting increasingly toward regions with more attractive interconnection and permitting options, pointing out that Texas had 14 GW of new capacity announced in the second quarter of this year alone. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=1684059&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=1684059&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257652</guid>
        <link>https://www.theregister.com/personal-tech/2026/06/17/smartphone-market-to-shrink-15-percent-this-year-due-to-memory-crisis/5257652</link>
        <pubDate>Wed, 17 Jun 2026 17:00:00 +0200</pubDate>
        <title>Smartphone market to shrink 15 percent this year due to memory crisis</title>
        <description><![CDATA[ Buyers put off by rising prices expected to turn to second-hand phones instead  ]]></description>
        <category>personal tech</category>
                <lab:kicker><![CDATA[ Personal Tech ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 14:32:28 +0000</dc:modified>
                <content:encoded><![CDATA[ Unless your personal tech budget has bloated, prepare to stick with your current smartphone for a while thanks to AI-driven demand that has driven up memory prices and made new handsets so expensive that sales are falling dramatically. So says research firm CCS Insight, which expects smartphone shipments to fall by 15 percent this year as some entry-level devices have already seen their sticker prices go up by more than 50 percent since last year. The firm found that the primary smartphone market (meaning new devices) contracted 4.4 percent in the first quarter of this year, despite sales channels front-loading (meaning stockpiling) product inventory, as device prices begin to rise sharply. As CCS notes, this casts an ominous shadow on the outlook for the rest of the year, and it seems things have worsened since The Register first started reporting on the smartphone memory woes. Back in January, the forecast was for handset price rises of 6-8 percent, while the most pessimistic outlook was that the global market might contract as much as 5.2 percent. By February, analysts were expecting to see a decline in shipments of around 8 percent across the global market, and for prices to increase by about 14 percent. The root cause of all this is the AI craze, which has seen huge demand for high-performance GPU-filled servers to process it all. Chipmakers have moved to capitalize on this by prioritizing production of high-margin memory components for those servers, rather than making the plain old DRAM and NAND needed for PCs and phones. This is different from the usual boom-bust cycle of the memory market, where prices rise because of production issues constraining supply. Instead, it is demand-side pressure from hyperscalers that has tipped the balance, leading to a memory supercycle that may last until 2028. "The memory chip crisis shows no sign of slowing down in the near future, ramping up the pressure on manufacturers and consumers. Memory components now account for more than 30 percent of a manufacturer's bill of materials in some smartphones.,” said CCS research analyst Ben Hatton. “The full impact has yet to be felt in many regions, but it's clear that device prices will accelerate over the rest of the year.” As expected, budget devices are the worst hit, as memory and storage costs make up a higher proportion of their bill of materials, hence some entry-level devices seeing a 50 percent jump in price. In contrast the organized secondary market (meaning traders in pre-owned devices) grew by four percent during the first quarter, as consumers in search of low-cost phones increasingly see used devices as a suitable alternative. CCS therefore believes the second-hand smartphone market will grow by 15 percent this year. But there’s a snag. With fewer people buying new phones, the supply of pre-owned models will tail off as well, as it relies on people trading up. This was highlighted by a report in May, which found that replacement cycles are getting longer as consumers often hold on to their devices for more than four years, rather than the couple of years that used to be typical. There are also fewer smartphone vendors these days, meaning fewer launches every year. “The secondary market has an opportunity to serve some of the demand that will be unfulfilled by the primary market,” commented Hatton. “The major challenge in the near term is to grow supply during a fallow period of flagship launches.” Countries with mature trade-in programs will be in a stronger position to capitalize on this opportunity and see higher growth rates in the pre-owned market. As The Register reported last year, this probably doesn’t mean Europe, as less than a third of consumers there trade in or sell their old phones, limiting the supply of second-hand devices. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=259160&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=259160&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5256365</guid>
        <link>https://www.theregister.com/devops/2026/06/17/aws-hypes-continuous-agentic-devops-puts-kiro-in-your-pocket/5256365</link>
        <pubDate>Wed, 17 Jun 2026 17:00:00 +0200</pubDate>
        <title>AWS hypes continuous agentic DevOps, puts Kiro in your pocket</title>
        <description><![CDATA[ Trust is the biggest barrier to AI adoption, says AI chief, claiming that new features in Bedrock AgentCore will prevent bad outcomes ]]></description>
        <category>devops</category>
                <lab:kicker><![CDATA[ DEVOPS ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 09:34:45 +0000</dc:modified>
                <content:encoded><![CDATA[ AWS today introduced new and enhanced agents aimed at DevOps and code security at its New York Summit, including previews of Continuum for identifying and fixing application vulnerabilities, and an iOS mobile app for its Kiro coding tool. Matt Wood, chief AI and technology officer, said in a press briefing that the company sees AI tools operating continuously in the background, rather than being used on demand. AWS Continuum, now in closed preview, is a set of agents that "continually provide security continuity using artificial intelligence, building on penetration testing and code review," he said. Sounds expensive? According to Wood, the cost of using AI tools is falling despite the rising price of tokens. "While the cost of a token at the frontier continues to go up, if you normalize for a particular point of intelligence, the cost continues to decrease year by year," he claimed. AWS Continuum currently includes two products. Continuum for code vulnerabilities performs vulnerability scans of an AWS environment and is claimed to prioritize findings that are actually reachable in a production path, with exploits demonstrated in a sandbox. The tool will also generate suggested fixes such as network changes or patches for the code. The existing AWS Security Agent will be renamed "Continuum pen testing" and "Continuum code scanning". The AWS DevOps agent, first previewed at the company's re:Invent conference in late 2025, is billed as an AI tool that can resolve and prevent application outages and optimize application reliability and performance. It was made generally available in March. DevOps Agent is gaining release management capabilities, now in preview, which assess code readiness and run software in an AWS-managed isolated environment to verify the builds. The new feature follows other enhancements to DevOps Agent introduced earlier this month. DevOps Agent has always had support for calling tools via Model Context Protocol (MCP) but now exposes its own MCP endpoint, enabling other tools to call the Agent API. There is also support for the Agent2Agent (A2A) protocol, introduced by Google last year to assist agent collaboration. These new endpoints are in addition to the standard AWS REST API. DevOps Agent is designed to use other observability tools as input, including AWS CloudWatch, Datadog, Dynatrace, New Relic, and Splunk, as well as code from repositories such as GitHub and GitLab. It can also connect to Microsoft Azure and Azure DevOps. AWS Transform, an AI service for migrating and modernizing workloads and application code, gets a new preview feature called continuous modernization. AWS suggests it as a tool to cover both the day-to-day work of upgrading and patching libraries, and larger projects such as moving to a more recent framework or runtime for Java or .NET applications. Kiro is an IDE and service for specification-driven AI coding. Kiro can be extended with "powers," wrappers for one or more MCP servers available from GitHub. Powers exist for AWS services such as DevOps Agent and Lambda, as well as for third-party services such as Datadog and Dynatrace. Now in closed preview, the Kiro mobile app for iOS can launch and manage remote sessions. There are three modes of interaction: chat, spec for continuing a specification workflow, and autonomy for delegating tasks. The app shows the live state from cloud sessions, and renders code diffs as cards that the company says are legible on a small screen. According to AWS, it is a true native app, not a wrapper for a web application. In addition to DevOps tools, the company also previewed AWS Context, a service for mapping company data into a knowledge graph for agentic search. It is similar to search in the existing Amazon Quick service, except that Context is designed to be organizational rather than personal. Context publishes its metadata into Amazon S3 tables in Apache Iceberg format. According to AWS, all queries are identity-aware to prevent users from accessing data they are not authorized to see. Amazon Quick will use the same underlying technology as Context. Quick is also getting the ability to create autonomous agents via voice prompts, or to choose from a library of pre-configured agents. Hundreds of connectors add integration with third-party services such as Gmail, Slack, and Microsoft Teams and SharePoint. Finally, Amazon Bedrock AgentCore, a platform for custom agents, adds a managed knowledge base, web search, and the ability for agents to spend money on paid content such as financial market feeds. Companies going all-in on agentic AI will find it costly. Services like Quick are subscription-based, and others like DevOps Agent are based on per-second usage, currently the same for incident response, evaluations (incident prevention), and on-demand tasks such as chat. Pricing is somewhat opaque because the time an agent will take for a task is unknown. There are also additional charges for AWS services an agent consumes, such as CloudWatch queries. Another issue is reliability. In its post on AgentCore, AWS acknowledges that "the most dangerous agent failures aren't the ones that throw errors. They're the ones that look fine on dashboards: an agent that confirms an order modification it never executed, one that fabricates product availability when an API times out, another that skips an approval step while dashboards show a 99 percent success rate." AWS claims new AgentCore features address this with "failure, intent, and trajectory insights across hundreds of sessions." AgentCore also has policy capabilities that define what an agent can and cannot do, and Bedrock Guardrails, which run at a gateway layer outside the agent and evaluate actions for prompt injection, harmful content, and data exposure. "Trust is the single biggest barrier to adoption for artificial intelligence systems inside most organizations," said Wood. He said that AWS is trying to build agents that "exhibit and communicate trusted outcomes to their users," using Bedrock AgentCore policy and guardrails to make AI agents safer and more reliable. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5230510&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5230510&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5254631</guid>
        <link>https://www.theregister.com/security/2026/06/17/digital-sovereignty-needs-an-operating-model/5254631</link>
        <pubDate>Wed, 17 Jun 2026 17:00:00 +0200</pubDate>
        <title>Digital sovereignty needs an operating model</title>
        <description><![CDATA[ PARTNER CONTENT Europe wants control over its own technology, but what does that look like? ]]></description>
        <category>security</category>
                <dc:modified>Fri, 12 Jun 2026 03:06:34 +0000</dc:modified>
                <content:encoded><![CDATA[ Europe, like much of the world, is living through a period of heightened geopolitical uncertainty in which sanctions risk, legal divergence, and cyber disruption have moved from abstract concerns to board-level variables. Digital sovereignty is shifting from aspiration to operational requirement, driven by resilience expectations, critical service dependency, and rising geopolitical and cyber risk. Definitions of sovereignty vary, ranging from blanket data localization edicts to industrial policy to national security, but the absence of an agreed definition should not be mistaken for an absence of intent. Sovereignty is already shaping procurement, regulatory compliance, and technology strategy. From my years working at the intersection of government and the technology industry, I have seen how quickly digital policy can harden into operational constraints. I have also seen how easily "sovereignty" becomes a stand-in for broader concerns: dependency, geopolitics, and the fear that critical services may not remain available during a crisis Two issues are at play. First, policymakers are right that over-dependency on foreign technology can become a national resilience problem. Cloud market concentration is a case in point: last year across Europe, the three leading cloud providers accounted for around 70 percent of the market, while European providers' collective share remained around 15 percent. Concentration is not, by itself, a security failure, but it is a strategic dependency that can become acute when legal regimes diverge, access is contested, or a geopolitical shock tightens the room to maneuver. It also amplifies the "ripple effect": disruption at a small number of providers can cascade across thousands of organizations and supply chains. Second, business leaders are right to worry that blunt sovereignty initiatives raise costs and regulatory complexity. A hard localization mandate or a "sovereign-only stack" duplicates infrastructure, slows modernization, and in practice keeps organizations tied to legacy systems longer than planned while limiting access to leading technologies. The same tension is shaping Europe's competitiveness debate. Former Italian prime minister Mario Draghi has argued that security is a precondition for sustainable growth and that deep dependencies can leave Europe vulnerable to coercion as geopolitical volatility increases. The question is not whether sovereignty matters but how to pursue it without turning it into a counterproductive procurement ideology. From policy to platform choice A recent decision by the French government to restrict certain foreign-made video conferencing tools in favor of a homegrown alternative illustrates the direction of travel across the EU. Whether one agrees with the decision or not, it signals something larger: sovereignty is becoming a set of practical constraints that can reshape technology choices quickly. Many organizations are responding with a third, damaging outcome: delay. In a recent Zscaler-commissioned survey, 73 percent of respondents said digital sovereignty concerns had caused them to delay or cancel transformation initiatives. That "pause dynamic" is dangerous because it prolongs exposure to legacy risk, weakens cyber readiness, and leaves organizations less able to absorb disruption from ransomware, supply chain compromise, systemic outages, or sudden changes in cross-border rules at a time when the threat landscape is shifting faster than ever. If Europe wants sovereignty that strengthens resilience rather than undermines it, political and business leaders need a framework that is practical, measurable, compatible with open markets, and informed by the technology sector's expertise. Here is one: control, choice, and continuity. An outcome-based framework Sovereignty begins with what an organization can control in practice: who can access data, who can administer systems, whether a vendor can see customer content, where logs are stored, how keys are managed, what subcontractors can see, and how policies can be enforced. Control is not about isolation; it is about enforceable governance and reducing hidden dependency. Sovereignty also requires choice: credible options when assumptions break. Too many organizations discover too late that their "vendor strategy" is really a dependency strategy, with few realistic alternatives. Choice is not achieved by buying two of everything. It is achieved through architecture and contracts that keep an organization mobile and avoid vendor lock-in: portability for data and configurations; full transparency on who they rely on, where access sits, and which jurisdictions and subcontractors are in the chain; and pre-agreed exit paths that can be executed under time pressure. It also requires leaders to prevent the sovereignty debate from becoming an excuse to stop transformation. Every program facing sovereignty constraints should be forced through a decision path: redesign, mitigation, or exit on a timeline. The third C is continuity: keeping critical services running during any kind of disruption. If sovereignty is meant to reduce strategic vulnerability, continuity is where it either becomes real or becomes theater. Continuity is measurable through recovery time objectives, tested failover, supplier-failure drills, and exercises for jurisdiction-change scenarios. Across Europe, the urgency is reinforced by the threat environment. Zscaler ThreatLabz data shows rising numbers of damaging ransomware attacks year over year across the region: Spain (+116 percent), Germany (+74 percent), Belgium (+73 percent), Italy (+53 percent), and France (+34 percent) among others. Separate research on resilience found that 52 percent of IT executives believe their current security measures are insufficient to defend against existing or emerging threats such as agent-based AI and quantum computing. The UK's National Cyber Security Centre, meanwhile, reported a 130 percent rise in "nationally significant" incidents over the past year. AI is accelerating these risks. It already gives "bad actors" new capabilities to increase the speed, scale, and sophistication of their attacks. The question is not whether disruption happens, but whether systems can withstand it. Mandate outcomes, not vendors Business leaders argue that sovereignty will raise costs, increase compliance friction, and shrink access to leading technology. That is often true. Policymakers' concerns are also legitimate: strategic dependency can undermine national security and resilience. The mistake is writing sovereignty rules that dictate which vendors to buy rather than what controls buyers must have to keep services running during shocks. The most useful sovereignty requirements are outcome-based: enforceable control over access and data, credible choice through portability and exit, proven continuity through testing and recovery. They create room for organizations to use global platforms safely while meeting local requirements, without freezing modernization. If sovereignty is now an operating requirement, every stakeholder has a role. Boards should define what "sovereign enough" means for their organization, then require regular reporting and testing, with incentives tied to resilience outcomes. CEOs and COOs should treat sovereignty as continuity, fund the modernization that reduces brittle legacy dependency, and force decisions on blocked programs. CIOs and CISOs should map and minimize third-party access, implement localization and multi-region resilience where required, and build plans for supplier failure and jurisdiction-change scenarios. Regulators should clarify definitions, harmonize requirements where possible, and create compliance pathways with transition periods that reward modernization rather than incentivize delay. The approach must be risk-based and agreed in consultation with industry. Scaling control, choice and continuity To make control, choice and continuity achievable at scale, two additional disciplines are required: collaboration and compliance. Collaboration keeps sovereignty compatible with openness through interoperability, shared incident readiness, transparent subcontracting, and trusted vendor partnerships that reduce concentration risk instead of merely relocating it. Solutions must be tailored for local demands and drive investment in local ecosystems. Compliance makes sovereignty measurable through clear definitions, auditable evidence, and regulatory approaches that focus on operational controls so that organizations are pushed to modernize rather than to delay. Sovereignty on European terms should be judged by outcomes rather than rhetoric: whether organizations can govern access, keep options open, recover quickly when incidents happen, and continue delivering critical services when dependencies fail. Done well, digital sovereignty becomes a catalyst for resilience, innovation, growth and competitiveness; done bluntly, it becomes a brake on the very transformation it is meant to protect. Contributed by Zscaler. ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5237766&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5237766&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257598</guid>
        <link>https://www.theregister.com/personal-tech/2026/06/17/surface-tension-rises-as-microsofts-latest-kit-starts-at-a-pricey-1499/5257598</link>
        <pubDate>Wed, 17 Jun 2026 16:25:25 +0200</pubDate>
        <title>Surface tension rises as Microsoft's latest kit starts at a pricey $1,499</title>
        <description><![CDATA[ Snapdragon X2 silicon and recycled aluminum are nice, the sticker shock less so ]]></description>
        <category>personal tech</category>
                <lab:kicker><![CDATA[ PERSONAL TECH ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 14:45:46 +0000</dc:modified>
                <content:encoded><![CDATA[ Microsoft has unveiled new Surface hardware at prices that could keep customers away until the hardware supply chain sorts itself out. Two devices were announced – a new Surface Pro and Surface Laptop with Snapdragon X2 silicon. The 13-inch Pro has, according to Microsoft, 53 percent faster graphics performance than the previous generation, and the 13.8 and 15-inch Laptop deliver 58 percent better graphics performance. The batteries should last all day, and the touchpad on the Laptop features haptic technology. Of course, there is dedicated NPU silicon for those on-device AI tasks that have yet to become a killer application. Still, nice to have. Less nice is the price. The Pro starts at $1,499, and the Laptop $1,599. The base Pro comes with 16 GB RAM and a 256 GB SSD, as does the base Laptop. The base 15-inch Laptop ups the storage to 512 GB, although the price starts at $1,699. The devices look great and appear well built. Microsoft has claimed they are "designed with sustainability and repair in mind," with 100 percent recycled aluminum enclosures and a new Surface Repair Tool to guide users through repair workflows for components such as the battery or display. But there is no getting around the prices, which are a hike on top of the increases Microsoft rolled out in April. Remember the Surface Laptop 7? It came in at $999 when it launched in 2024 and included a 256 GB SSD and 16 GB RAM. The new Surface Laptop is a whopping $600 more. Microsoft is not the only company affected by rising component costs, and has attempted to soften the blow a little. There's a free keyboard on offer for Surface Pro 13-inch buyers, and a free Surface Arc Mouse for Laptop purchasers. There's also up to $900 on offer for trade-ins. It is, however, difficult to recommend the devices or indeed any premium device in the current hardware climate. The problem Microsoft faces is the rise of portables like Apple's $599 MacBook Neo. While it is a vastly underpowered device when compared to the latest Surface Laptop, it is more than adequate for most purposes and an attractive proposition for customers reluctant to drop another thousand dollars on Microsoft's (or any other premium vendor's) latest and greatest. The latest Surface devices represent a missed opportunity for Microsoft. Although a price hike for a premium device is difficult to avoid, considering component shortages, other vendors appear capable of releasing more basic hardware at a price point that is not so heart-stopping. Dell, for example, has launched a new XPS 13 laptop for $699. In Microsoft's last earnings report, revenue from Windows OEM and Devices was down 2 percent. It is difficult to see how the newly announced Surfaces will change this trend as customers consider whether a premium device is worth quite such a premium price. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5257742&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5257742&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257621</guid>
        <link>https://www.theregister.com/security/2026/06/17/cisco-adds-another-sd-wan-box-to-max-severity-bug-advisory/5257621</link>
        <pubDate>Wed, 17 Jun 2026 15:45:00 +0200</pubDate>
        <title>Cisco adds another SD-WAN box to max-severity bug advisory</title>
        <description><![CDATA[ Updated at the time? No sweat. Check those logs, though ]]></description>
        <category>security</category>
                <lab:kicker><![CDATA[ Security ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 13:20:59 +0000</dc:modified>
                <content:encoded><![CDATA[ Cisco has updated a February security advisory, adding another product to the list of those affected by the maximum-severity CVE-2026-20127. Switchzilla made a small amendment to the original advisory on Tuesday evening, noting that Cisco Catalyst SD-WAN Validator, formerly vBond, was also among the boxes attackers could pop open. Readers may remember the fuss over CVE-2026-20127 (10.0) a few months ago. The make-me-admin improper authentication flaw prompted a Five Eyes alert since attackers could essentially gain persistent root access to all vulnerable instances. In other words, it's a far-from-ideal situation that could could create espionage opportunities, given the prevalence of Cisco's SD-WAN offerings in Western networks. Cisco said at the time that attackers could exploit CVE-2026-20127 to gain admin rights, access NETCONF, and reconfigure the SD-WAN fabric, before exploiting CVE-2022-20775 (7.8), a path traversal flaw discovered in September 2022, to gain root access. Cisco Talos, the company's threat intel arm, posited that the bug could have been exploited for as long as three years by the time it was discovered. Talos attributed the exploitation activity to a group it tracks as UAT-8616, whose activity dates back to at least 2023, according to its researchers' estimates. No one has formally attributed UAT-8616 to a specific country or group of individuals, but experts say that it is a highly sophisticated outfit that has a history of targeting critical infrastructure sectors. Ollie Whitehouse, NCSC-UK's CTO, said at the time: "Our new alert makes clear that organizations using Cisco Catalyst SD-WAN products should urgently investigate their exposure to network compromise and hunt for malicious activity, making use of the new threat hunting advice produced with our international partners to identify evidence of compromise. "UK organizations are strongly advised to report compromises to the NCSC, and to apply vendor updates and hardening guidance as soon as practicable to reduce the risk of exploitation." The Register asked Cisco for more information, but it did not immediately respond. Customers should not have to make any new changes, provided that they upgraded their software to a fixed version across all systems when the advisory was first published in February, not just SD-WAN Controller and SD-WAN Manager. The update comes weeks after Cisco disclosed another zero-day affecting Catalyst SD-WAN, suggesting that it had been exploited for at least a week at the time. Tracked as CVE-2026-20245, it marked the sixth SD-WAN flaw disclosed this year, and the second to be exploited as a zero-day in as many months. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=4094206&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=4094206&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257570</guid>
        <link>https://www.theregister.com/devops/2026/06/17/homebrew-60-released-with-new-security-mechanism-linux-sandbox-and-more/5257570</link>
        <pubDate>Wed, 17 Jun 2026 15:31:00 +0200</pubDate>
        <title>Homebrew 6.0 released with new security mechanism, Linux sandbox and more</title>
        <description><![CDATA[ Homebrew was "less vulnerable 10 years ago than npm is today," project lead tells us ]]></description>
        <category>devops</category>
                <lab:kicker><![CDATA[ DEVOPS ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 13:06:26 +0000</dc:modified>
                <content:encoded><![CDATA[ The Homebrew team has released version 6.0 of this popular open-source package manager for macOS and Linux, with a new mechanism for trusting packages and support for sandboxing on Linux, to align with existing sandboxing on macOS. Homebrew 6.0 introduces tap trust, a "tap" being a collection of formulae, casks (a package of pre-compiled binaries) and commands which usually reside in a Git repository. The tool trusts official Homebrew taps by default, but requires an explicit agreement before it will trust third-party taps (which can include arbitrary Ruby code) before they install or run any code. Tap trust is part of Homebrew’s approach to supply chain security, which has a number of distinctive features. Package maintainers are Homebrew maintainers, not the authors of the package. Names are maintainer-curated, so typosquats (giving a package a misleading name designed to be similar to one that is popular) can be rejected. Each download is pinned to a sha256 checksum. Package binaries are built from source, which protected Homebrew from incidents like the Trivy compromise earlier this year when official Trivy binaries were replaced with malicious versions. These and other features of Homebrew security are described in the documentation. Project leader Mike McQuaid told us that "Homebrew was less vulnerable 10-15 years ago than npm is today. The trust model is radically different and, even today, we are much quicker to break backwards compatibility in the interest of security." A new security feature is sandboxing on Linux when Homebrew compiles software. This was already implemented on macOS (and has been for a decade). Version 6.0 adds a Linux implementation based on the Bubblewrap project, and this will be on by default for developers. A new Homebrew sub-command, brew vulns, will check installed packages for known vulnerabilities, by checking against the OSV (vulnerability database for open source). The commands brew install and brew upgrade will now show a dependency summary and require a conformation prompt before running, called ask mode, following a developer survey earlier this year where this was highly requested. Another new command, brew exec, will run a Homebrew-provided executable, similar to the way npx works for npm packages. Homebrew startup performance in 6.0 is said to be faster, thanks to parallelised bottle fetching (a bottle is a pre-built package) and other optimizations. Apple is phasing out support for Intel macOS both for future versions of macOS and for Rosetta, the Intel compatibility layer. Homebrew is following: in September this year no new bottles will be built for macOS Intel and from September 2027 macOS Intel will be "unsupported entirely and all related code deleted," according to the post introducing Homebrew 6.0. Homebrew is well-liked by developers, and becoming more popular on Linux as well as macOS. There is some frustration though regarding the dropping of Intel support. "The deprecation of Intel support is agressive! Every Mac enthusiast I know who uses a Mac as a server uses their old machines, which are pretty much all Intel. We'll lose support from you guys a year before Apple!," said one. McQuaid replied noting that Homebrew will still work for a year after support is dropped to "Tier 3”, meaning almost unsupported, and added that "there’s nothing stopping you for doing the work to setup ‘Intelbrew’ and support it for the community." Another issue he mentioned is that GitHub is dropping macOS Intel runners for continuous integration towards the end of 2027. It is notable that Homebrew 6.0 made extensive use of AI coding. A document on responsible AI usage takes the line that AI contributions must be disclosed and human-reviewed, and that AI is not responsible for any code, rather the human contributor is responsible. "AI is great if used responsibly which means a human reviewing all changes both before PRs submitted and a maintainer reviewing before PRs are merged. I have found despite using it responsibly it has been a huge personal accelerator," McQuaid told us. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5255295&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5255295&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257384</guid>
        <link>https://www.theregister.com/software/2026/06/17/apples-webkit-performance-tax-leaves-ios-browsers-stuck-in-the-slow-lane-says-microsoft/5257384</link>
        <pubDate>Wed, 17 Jun 2026 15:02:56 +0200</pubDate>
        <title>Apple's WebKit performance tax leaves iOS browsers stuck in the slow lane, says Microsoft</title>
        <description><![CDATA[ Rival rendering engines could make pages load almost 30% faster on iPhones, Redmond claims ]]></description>
        <category>software</category>
                <lab:kicker><![CDATA[ Software ]]></lab:kicker>
                <content:encoded><![CDATA[ Critics and competitors have long complained about the "Apple Tax" – the sales commission developers are obliged to pay on App Store sales and in-app purchases. Now Microsoft engineers have documented a performance tax – the performance hit that iOS users today endure because Apple requires iOS browsers, with theoretical exceptions, to use the WebKit browser engine that powers Safari. The performance tax comes to 28.6 percent, almost as much as Apple's 30 percent commission rate. Browser rendering engines handle the heavy lifting for web browsers. "They determine how web standards are implemented, how security and privacy protections are enforced, and which actors ultimately shape the evolution of the web," as Mozilla recently explained. Just three major engines dominate commercial deployments: Blink, the foundation of Chrome and its Chromium-based siblings Edge, Vivaldi, Brave, and Opera, among others; WebKit, the foundation of Safari; and Gecko, the foundation of Firefox. Firefox holds about 2 percent of the global browser market share, according to StatCounter. That helps explain Mozilla's concern that the lack of browser engine diversity, a consequence of the market power of Google and Apple, threatens the open web. According to DigitalApplied, Safari owns 23.4 percent of mobile browsing on iOS globally and 51.2 percent of mobile browsing in North America. But due to Apple's platform rules, every browser that runs on iOS is WebKit-based, so there are few opportunities for competitive differentiation outside of interface elements. Browser rivals, advocacy groups, and web developers have argued that Apple should relax its platform rules and improve its web technology for years. Europe's Digital Markets Act (DMA), plus regulatory action in Japan and elsewhere, have amplified hope that Apple will allow more competition on its mobile OS. The latest such investigation comes from the Italian Competition Authority. Microsoft has now highlighted the cost of the iOS browser engine monoculture – time lost to Safari's slowness. On Monday, Kyle Pflug, group product manager for the Microsoft Edge Web Platform, published benchmark test results using Apple's Speedometer 3.1 and other test tools that show how a Chromium-based iOS browser using the open source Blink rendering engine compares to Apple's Safari browser, which relies on the open source WebKit rendering engine. Edge is a Chromium-based browser, and if it were implemented for iOS using BrowserEngineKit, a framework Apple introduced in March 2024 to comply with Europe's Digital Markets Act (DMA), it would score 28.6 percent better (49.27 vs 38.3 on Speedometer 3.1) than Apple's Safari browser under iOS 26.5.1. It would also outperform Safari on the JetStream 3 benchmark (JavaScript and Wasm performance) by 13.1 percent (306.35 vs 270.9) and on the MotionMark 1.3.1 benchmark (graphics rendering) by 2.1 percent (4,773.52 vs 4,673.68). "To be clear, this is a research prototype, not a product announcement; and these are preliminary numbers from my own device, not lab results," said Pflug. "But it does prove out the opportunity to close real capability gaps and deliver new competition on performance." Rick Byers, principal Chrome engineer at Google, took note of the results. "Given how Chromium and WebKit are always vying for the top spot in Speedometer on macOS, it's really striking how big the gap is on iOS!" he said in response to Pflug's post. "And we haven't even really tried to optimize performance for that platform yet! IMHO this is what you should expect to see when there's a lack of competition!" Apple did not immediately respond to a request for comment. The EU has enforced competition through browser selection screens, with some success. In theory, the bloc's rules should promote browser engine competition on iOS. The DMA allows EU-based developers to build browsers with rendering engines other than WebKit. Since March 2024, Apple has provided tools to do so. Yet more than two years later, no browser maker has launched an alternative browser. As Microsoft has done with Edge, Google and Mozilla have prototyped Blink and Gecko-based versions of their respective browsers for iOS. But no such browser has been released. That may be because building a new browser means scaling considerable technical hurdles that Apple hasn't rushed to lower, such as BrowserEngineKit bugs. Browser makers therefore consider the Apple rule compliance process too onerous. For example, if Microsoft were to release a Blink-based version of Edge on iOS, it would have to be a separate app from the WebKit-based version of Edge – leaving Redmond to reacquire its entire iOS user base. Alex Moore, executive director of Open Web Advocacy, a group that has lobbied on behalf of web developers against Google and Apple's platform rules, pointed to citations [PDF] in US court filings (the US 2024 antitrust case against Apple is ongoing) and UK regulatory documents that highlight the problem posed by Apple's platform power. In February 2020, these documents say, Apple's vice president of iPhone marketing proposed that the company should "set a stake in the ground for what features we think are 'good enough' for the consumer" rather than investing and innovating. "This is a clear example of the costs Apple imposes on consumers and businesses worldwide, costs created by its 17-year ban on competing browser engines," Moore told The Register. "Even in the EU and Japan, where Apple is now required to allow browser vendors to use their own engines, the barriers it has put in place ensure browser vendors are prevented from porting their own engines to iOS. Given that Apple has now had more than two years to produce a compliant solution, the European Commission needs to open a specification proceeding to instruct Apple, in precise terms, how these barriers must be removed." "If Apple can restrict browser engines on iOS, it can limit what the mobile web is capable of, and keep businesses dependent on native apps and app store rules. This is, in our view, the most critical intervention the EU could possibly make, and the one most likely to reshape the entire mobile ecosystem. No other intervention comes close." ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=248852&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=248852&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257487</guid>
        <link>https://www.theregister.com/systems/2026/06/17/intel-starts-cooking-up-enhanced-18a-p-silicon-for-would-be-foundry-customers/5257487</link>
        <pubDate>Wed, 17 Jun 2026 14:14:00 +0200</pubDate>
        <title>Intel starts cooking up enhanced 18A-P silicon for would-be foundry customers</title>
        <description><![CDATA[ Chipzilla claims 9% speed bump without extra power draw but is compatible with designs for 18A ]]></description>
        <category>systems</category>
                <lab:kicker><![CDATA[ SYSTEMS ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 11:59:59 +0000</dc:modified>
                <content:encoded><![CDATA[ While Intel ramps up production of its 18A process node, the chipmaker has started limited output of its enhanced variant, 18A-P, promising 9 percent higher performance at the same power. At the IEEE's 2026 VLSI Symposium in Hawaii, Intel disclosed that it has started risk production using 18A-P, the first of its planned enhancements for the 18A process, and potentially the first to be used for commercial customers of Intel's foundry biz. Risk production refers to initial low-volume output to qualify a new manufacturing node. Chipzilla says reaching this stage means it is meeting timelines it has shared with customers and partners. The x86 giant launched its first chips made with the base 18A process back in January, in the form of the "Panther Lake" Core Ultra Series 3 processors. But it had already detailed plans for updated versions of the manufacturing tech last year, as reported by The Register at the time. Intel claims 18A-P delivers 9 percent better performance than 18A while consuming the same power as 18A silicon, or, alternatively, 18 percent lower power consumption for the same performance. It achieves these performance and power benefits through a mix of transistor, interconnect, and design technology co-optimizations, the firm says. But a key factor is that 18A-P is said to be fully design rule compatible with 18A, meaning that any chips designed for 18A should be easily transferable for production with Intel's newer process. Industry talk is that Intel's first foundry customers may therefore skip straight to 18A-P. Previously, the chipmaker planned to offer the upcoming and more advanced 14A node as its first mainstream commercial offering but it is understood that chief exec Lip-Bu Tan changed that plan. Intel is also reportedly in talks with Apple to manufacture some of its silicon on 18A or 18A-P. "Our updates and presentations at VLSI signal to Intel Foundry customers and partners that we are fully committed to leading edge process innovation over the long term," said Intel Foundry EVP Naga Chandrasekaran. The other process node variant Intel is working on is called 18A-PT, which is optimized for designs requiring through-silicon vias (TSVs). This is to allow a final product to be assembled by stacking multiple chips or chiplets on top of one another. Industry watchers believe Intel expects AI accelerator designers will favor 18A-PT, as it allows memory tiles to be manufactured separately and integrated during packaging. Also at the VLSI event, Intel disclosed several technologies still under development. These include CFET (Complementary FET) using vertically stacked NMOS and PMOS devices for increased transistor density, and integration of gallium nitride power devices with silicon logic, enabling digital control circuitry alongside high-power transistors in a single process. Speaking at a conference earlier this month, Intel chief financial officer David Zinsner admitted that the firm had bitten off more than it could chew with 18A, referring to the delays in getting it into production last year. "I would say it this way, I don't know, early last year, I think the challenge around 18A was two things. One, we tried to do too much at once. And it took a while to get that settled. And I think second is, we were trying to play performance and yield and trying to improve both at the same time. It was like trying to fly the plane and fix the wing at the same time, basically," he said. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5248955&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5248955&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5256343</guid>
        <link>https://www.theregister.com/os-platforms/2026/06/17/windows-devs-rerolled-old-code-to-save-precious-bytes/5256343</link>
        <pubDate>Wed, 17 Jun 2026 14:01:00 +0200</pubDate>
        <title>Windows devs rerolled old code to save precious bytes</title>
        <description><![CDATA[ There really was a time when Microsoft cared about every KB ]]></description>
        <category>os platforms</category>
                <lab:kicker><![CDATA[ OS PLaTFORMS ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 12:44:03 +0000</dc:modified>
                <content:encoded><![CDATA[ Microsoft's latest Windows update might or might not have improved performance for the company's flagship operating system, but there was a time when its engineers cared about performance. A lot. Veteran Microsoft engineer Raymond Chen on Monday hearked back to that time by telling another war story from the glory days of Windows, when a team was working on an x86-32 emulator for an unnamed processor (though it isn't particularly difficult to identify potential candidates). The emulator used binary translation – native code was generated for the original x86-32 code. Chen explained, "This offered a significant performance improvement over emulation via interpreter. You can imagine that x86-32 is just a bytecode, and the emulator is a JIT compiler." The team came across a function that needed to allocate 64 KB of memory. Simple enough stuff – check that there is enough memory available, subtract 65536 from the stack pointer, and then initialize the memory in a loop. Use the comments to correct me, but this sounds like loop rolling, where repetitive code gets condensed into a loop. However, it appeared that a compiler had … optimized … the code "by unrolling the loop into 65,536 individual 'write byte to memory' instructions, each 4 bytes long." Perhaps a bit quicker, but goodness – quite the memory hog. "All in all," wrote Chen, "it took this program 256 kilobytes of code to initialize 64 kilobytes of data." Almost like a glimpse into a future where operating systems don't appear to give two hoots about efficient use of storage. What would that look like? As for the engineers working on the CPU emulator, Chen said, "This offended the team so much that they added special code to the translator to detect this horrible function and replace it with the equivalent tight loop." It would be interesting to know what that same team would make of the internals of some Windows binaries today, but it is heartening to know that, at one point, engineers cared about memory efficiency enough to reroll something. Sure, there might, just might, have been a performance hit, but spitting out 256 KB of code just to initialize 64 KB of data? Naughty. Very naughty. The much younger version of this hack, optimizing the heck out of code to fit within the confines of computers from yesteryear, would have been horrified. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5256377&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5256377&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257545</guid>
        <link>https://www.theregister.com/public-sector/2026/06/17/ukgov-links-up-with-linkedin-for-jobs-market-intel-from-40m-accounts/5257545</link>
        <pubDate>Wed, 17 Jun 2026 13:30:57 +0200</pubDate>
        <title>UK.gov links up with LinkedIn for jobs market intel from 40M accounts</title>
        <description><![CDATA[ What anonymized data taught me about B2B sales... and reliance on the private sector for statistical info ]]></description>
        <category>public sector</category>
                <lab:kicker><![CDATA[ Public sector ]]></lab:kicker>
                <content:encoded><![CDATA[ The UK's Department for Work and Pensions (DWP) will draw on 40 million UK LinkedIn accounts to get a better understanding of local job markets. DWP said it plans to use anonymized data to help it find trends such as mismatches between local job ads and the skills possessed by local people. The department won't scrape the Microsoft-owned social network, instead relying on Redmond to analyze data and pass its findings to Skills England, a DWP agency whose officials are already working on the project. "This partnership with LinkedIn will give us a clearer understanding of the jobs market – what employers need, where opportunities are, and how people are building their careers, in order to boost economic growth," DWP minister Pat McFadden said in a canned statement. He added that more detailed insights into local workforces could particularly help young people. Skills England intends to use LinkedIn data to investigate how people move between jobs to help them develop new career options and support businesses in widening their recruitment nets. LinkedIn has nearly four million more UK-registered accounts than the 36.2 million adults who were working or looking for work in the first quarter of this year, according to figures from the Office for National Statistics (ONS). However, the service is open to students and retirees, so perhaps that accounts for the discrepancy. The Reg knows some users have more than one account on the site as well. The UK government increasingly draws on commercial data to supplement its official statistics. For example, the ONS publishes "real-time indicators" that include monthly data on new online job adverts, based on Textkernel scraping information from 90,000 job board and recruitment pages. The ONS has suffered from falling response rates for official data-gathering exercises such as its Labour Force Survey, making commercial sources more attractive. A recent report from Germany-based digital policy group Interface suggests that other arms of government are also taking advantage of commercial data, with Hungary's intelligence services using location data gathered for mobile advertising and equivalent organizations in other countries likely to be doing similar. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=258088&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=258088&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257506</guid>
        <link>https://www.theregister.com/personal-tech/2026/06/17/brit-competition-cops-order-google-to-make-search-rankings-less-mysterious/5257506</link>
        <pubDate>Wed, 17 Jun 2026 13:01:07 +0200</pubDate>
        <title>Brit competition cops order Google to make search rankings less mysterious</title>
        <description><![CDATA[ New rules cover organic rankings, AI Overviews, and user-approved search data sharing ]]></description>
        <category>personal tech</category>
                <lab:kicker><![CDATA[ PERSONAL TECH ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 11:05:14 +0000</dc:modified>
                <content:encoded><![CDATA[ The UK's Competition and Markets Authority (CMA) has imposed two new conduct requirements for Google's search services, to improve transparency and fairness in result rankings and allowing users to port their search data to third parties. The requirements follow the CMA's actions in early June that let publishers opt out of having their work appear in AI Overviews, while requiring attribution and clear links to sources. "More activity is expected over the summer," the regulator warned. The fair ranking requirement arises from complaints from UK businesses that Google's current approach is "neither fair nor transparent," as the web giant makes changes without sufficient notice and does not offer an easy way to complain. Google sees it differently. A spokesperson told The Register: "Our ranking systems are fair, transparent and show the most relevant, highest quality results. "We are committed to protecting the integrity of our systems, and will work constructively with the CMA to ensure that we can uphold the high quality of Search for our users." Be that as it may, the CMA's conduct requirements call for Google to provide businesses with more transparency into how its rankings work and to introduce "clear processes" for raising concerns about the Big G's practices. Furthermore, "organic" search results must be ranked using "objective and non-discriminatory criteria." The requirement also encompasses Google's AI Overviews, but not sponsored results. Google has six months to implement the ranking requirements. It has three months to implement a data portability requirement, but this is more about putting the voluntary processes already in place via Google's UK Data Portability API on a legal footing. According to the CMA, "the rights of UK users will now be on a par with those in the EU (under the EU's Digital Markets Act)." Businesses, unsurprisingly, are keen to get hold of that data. The CMA wrote: "Using this data would allow third parties to offer people more personalized features – like tailored travel suggestions, more relevant shopping deals, and rewards (including cashback and discounts)." Will Hayter, Executive Director for Digital Markets at the CMA, said: "These new measures will ensure search results are ranked fairly and objectively, with clearer information about changes and effective routes to raise concerns. "At the same time, innovative businesses will have the confidence that they can access search data in practice, unlocking investment and innovation in new products and services for users." The CMA slapped Google with Strategic Market Status (SMS) in general search and search advertising in October 2025. This designation was a recognition of Google's market power, although it does not, by itself, indicate the company has acted anti-competitively. It does, however, give the CMA more power to introduce interventions such as the conduct requirements above. Google is not the only company facing scrutiny. The CMA recently launched a fourth SMS investigation into Microsoft's business software ecosystem. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=258252&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=258252&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257454</guid>
        <link>https://www.theregister.com/cyber-crime/2026/06/17/helpdesk-scammers-are-making-house-calls-to-make-their-lies-feel-more-real/5257454</link>
        <pubDate>Wed, 17 Jun 2026 12:38:35 +0200</pubDate>
        <title>Helpdesk scammers are making house calls to make their lies feel more real</title>
        <description><![CDATA[ 15-year-old among six arrested after Dutch cops target suspected bank fraud call center ]]></description>
        <category>cyber-crime</category>
                <lab:kicker><![CDATA[ Cyber-crime ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 10:59:11 +0000</dc:modified>
                <content:encoded><![CDATA[ Six people suspected of bank helpdesk fraud are in custody after Dutch cops stormed an Amsterdam residence and caught them in conversation with a potential victim. Police say the individuals were aged between 15 and 30 and operated out of a makeshift call center they had established in an Amsterdam home. Authorities believe the accused committed bank helpdesk fraud, which has become increasingly popular across the Netherlands. Offenders were recently targeted as part of Game Over?!, a novel law enforcement scheme that successfully shamed criminals into submitting themselves to authorities. Helpdesk scammers typically operate call victims on the phone, using methods similar to voice phishing, or "vishing." They present themselves as bank employees contacting victims under various guises, all designed to steal their money. In this case, police say the alleged criminals tried to convince victims to "increase their limits," and in "several" cases, succeeded in stealing funds from their accounts. The precise cover story is largely irrelevant, however. The aim of the game is the same each time: Convince a prospective victim to surrender enough details to access their bank accounts and steal their money. While these scams mostly take place remotely, Dutch police said in their announcement on Tuesday that the crew sent members to visit victims in person, purportedly offering hands-on assistance to secure their accounts. The same tactic can often be observed with fake police officer shakedowns, which have also become popular in the country. Police say tens of thousands of elderly people, who make up the majority of targets for such scams, have fallen victim to the confidence scams. In these cases, fraudsters visit elderly individuals' houses and pretend to represent law enforcement, offering a service to safeguard their valuables. The crooks then steal those valuables, and police say previous cases have turned violent. Some have also ended in fatalities. Multiple victims of the helpdesk frauds reported their respective cases, according to the cops. The National Intervention Team for Digital Crime was called in to investigate, and during a raid on June 10, officers found the suspects mid-call with a potential victim. Officers seized multiple laptops and phones after apprehending the six suspects, and found several bank cards at the property. Further arrests have not been ruled out. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=227005&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=227005&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257425</guid>
        <link>https://www.theregister.com/personal-tech/2026/06/17/windows-update-leaves-third-party-office-document-launches-in-limbo/5257425</link>
        <pubDate>Wed, 17 Jun 2026 11:56:54 +0200</pubDate>
        <title>Windows update leaves third-party Office document launches in limbo</title>
        <description><![CDATA[ Microsoft won the OLE vs OpenDoc wars. Now it's saying OLE dependencies don't matter ]]></description>
        <category>personal tech</category>
                <lab:kicker><![CDATA[ PERSONAL TECH ]]></lab:kicker>
                <content:encoded><![CDATA[ Microsoft's June Windows update has upset some third-party applications that use Object Linking and Embedding (OLE) automation to open or control Office apps, leaving users with failed document launches and, in some cases, no error message to explain what went wrong. According to Microsoft, "reports indicate that this issue may affect applications such as CCH Engagement, Workpaper Manager, dental software (such as Dentrix and Softdent), and Zotero; other similar applications might also be impacted." The workaround is to "open the application or document directly instead of launching it from the affected third-party application." Microsoft was quick to point out that this wasn't its problem. The third parties concerned are "independent of Microsoft." "We make no warranty, implied or otherwise, about the performance or reliability of these products." That would be fair enough were it not for the fact that these third parties are relying on Windows plumbing that has been around since the 1990s, and abruptly breaking or changing something in a Windows release doesn't give those vendors much time to deal with the problem. OLE allows one application to control another – for example, firing up a Word document or Excel spreadsheet from an accounting application. When it works properly, users don't need to switch between applications. The process should be seamless. If opening the file directly, which somewhat defeats the point of OLE, doesn't help, ordinary users will have to wait for a fix in "a future Windows update." There is a mitigation for affected devices within organizations, though obtaining it requires contacting Microsoft support for business customers. Veteran techies may find this mess ironic, given that in the 1990s Microsoft went all-in on OLE and ultimately saw off the rival OpenDoc tech backed by Apple and IBM. The issue is the first that Microsoft has acknowledged in the patch, although the company's forums are full of users complaining about other difficulties, including OneDrive and BitLocker problems. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=260003&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=260003&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5255258</guid>
        <link>https://www.theregister.com/personal-tech/2026/06/17/system76-boss-reckons-he-can-liberate-the-entire-pc-stack-just-give-him-another-15-years/5255258</link>
        <pubDate>Wed, 17 Jun 2026 11:15:00 +0200</pubDate>
        <title>System76 boss reckons he can liberate the entire PC stack... just give him another 15 years</title>
        <description><![CDATA[ Bootstrapped Linux box-botherer flogs new Thelio kit, talks up COSMIC, and politely declines to bolt AI onto everything ]]></description>
        <category>personal tech</category>
                <lab:kicker><![CDATA[ personal tech ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 10:01:39 +0000</dc:modified>
                <content:encoded><![CDATA[ INTERVIEW There are only a handful of dedicated Linux PC vendors. One of the best-known is the 20-year-old American company System76. It's not just a business that installs Linux on PCs. System76 is building something rare in 2026: a vertically integrated Linux‑first computing stack that treats open source as an engineering north star, not just marketing copy.  We spoke to founder and CEO Carl Richell about where System76 began and where it's going. When Richell started System76 20 years ago, he had "$1,500 in my basement" and no venture capital. He only had a bet that there were enough serious Linux users to sustain an honest, Linux‑only PC company. It has since grown organically into a factory operation in Denver, where raw aluminum sheets and billets come in one end and finished Thelio desktops roll out the other, complete with in‑house firmware and Linux preloads. It wasn't an immediate success. The growth curve was incremental. The company started in a basement, moved to a tiny office, then a slightly larger office, a still bigger one in downtown Denver, and, more recently, System76 operates out of its own factory. There, the company says, its servers, desktops, and laptops are "designed by nerds. Engineered by experts. Handcrafted by humans." All this was funded, Richell said, by reinvested profits and conventional machinery loans rather than venture capitalists. This was by design. That choice means there's no VC partner demanding an "exit" or pushing for a pivot away from Linux and open source; Richell says they "work for our customers and we work for each other," and have "never had to really roll the dice on the company," just take calculated risks. That deliberate pacing also shaped the culture. Many of the engineers who could "go work at Google" stay, he argues, because their "true beliefs align" with System76's open source‑first mission, not a retrofit of openness onto an ad business. For a niche OEM in a hostile, margin‑thin PC market, that ideological stickiness might be as important an asset as any product spec sheet. System76 likes to talk about its community roots, but the company's survival story is written in purchase orders. More than half of its sales are business‑to‑business, and Richell says there are "very few Fortune 500 companies that we don't ship products to," even if those deals are typically developer and engineering rigs rather than sprawling, company‑wide rollouts. Those systems often land in engineering departments and university labs as developer desktops, AI workstations, or high‑end Linux boxes for research workloads rather than accounting PCs. The pitch is a fully integrated Linux platform: hardware designed and manufactured for Linux in Denver, Pop!_OS and COSMIC developed in‑house, and open firmware that can be audited, modified, and redeployed. In a year when AI datacenters have driven up the cost of memory and storage, System76 entered 2026 expecting "much harsher headwinds" from component prices. Instead, demand stayed strong, and the business continues to grow year‑over‑year, suggesting that for a certain class of customer – developers, researchers, and Linux‑centric organizations – the premium for a well‑supported Linux workstation is easier to swallow than the friction of fighting Windows or bespoke dual‑boot setups. System76 keeps that business by pairing the product with the kind of operational plumbing most open hardware upstarts never quite build. That includes tightly coupled support, sales, and engineering teams (support is "ten feet from the sales team") and the ability to trace customer pain directly into product changes. It's a Linux company built like a small enterprise vendor, not a boutique enthusiast shop. On the hardware side, 2026 is the beginning of a new design era, centered on the freshly redesigned Thelio desktop family. Mira is the high‑performance mid‑tower, aimed at users who need serious CPU and GPU throughput in a comparatively compact box. Thelio Major stretches into high‑end desktop territory with support for Threadripper‑class CPUs, ECC memory, and dual power supplies to feed multiple top‑end GPUs. Richell describes Mira as the "beginning of that new desktop design refresh," a platform that lets System76 relearn thermal dynamics, structural design, and manufacturability at scale. They put the chassis through adhesive and mechanical torture tests – robots repeatedly pulling the side and front panels off thousands of times – to ensure the new modular construction would withstand years of use and field servicing. Next up is the Prime, a mini‑ITX desktop that shrinks the new design language into an "adorable, tiny desktop" now going through thermal testing. Further out is "Paleo Mega," an AI workstation designed to carry the thermal and power lessons from Mira and Major into multi‑GPU, AI‑first configurations, where cooling and power delivery are often the limiting factors. The product cadence shows a company that now thinks in platform terms: reuse chassis and thermal designs across a family, and then specialize for AI, compact workstations, and other niches. COSMIC and Pop!_OS as a buildable desktop If hardware is where System76 proves it can build real machines, software is where it tries to shape the broader Linux ecosystem. COSMIC, its Rust‑based desktop for Pop!_OS and other distros, is explicitly designed to be "modular and composable," with components you can replace, extend, or use as building blocks for entirely new UI experiences. Richell argues that before COSMIC, there "wasn't really a Linux desktop… designed to build things" in the way the kernel or the LAMP stack are foundations for other work. COSMIC's components have strict, well‑defined dependencies and are built to be reassembled – by OEMs, distro maintainers, or specialized platforms – into custom desktops for different devices and use cases. In System76's ideal world, COSMIC becomes the UI layer you reach for when you're building your own Linux‑based system, not just the default skin on Pop!_OS. On the user‑facing side, COSMIC is already shipping as a rolling‑release desktop, with new features and fixes flowing into users' machines as soon as they clear QA rather than on slow, monolithic schedules. Since its December 11 release, the project has seen roughly 1,200 merges from 172 contributors, a pace more reminiscent of a popular upstream project than a vendor‑specific shell. That rolling strategy matters right now in gaming, where System76 is devoting fresh attention. The team has recently added support for Wayland's pointer capture protocol, so first‑person shooters and "infinite scroll" scenarios behave correctly, fixed full‑screen window handling for workflows like Steam Big Picture, and tightened a long list of "around the edges" behaviors that used to require user workarounds. In Richell's telling, the aim is to make gaming "just work" on Pop!_OS + COSMIC without hidden incantations, a necessity if Linux gaming is going to be credible outside the hobbyist circle. Pop!_OS itself runs atop Ubuntu LTS, with System76 adopting what Richell – over some internal grumbling – still calls a "hardware enablement stack": newer kernels, Mesa, and related bits to keep up with GPUs and emerging hardware, while COSMIC continues to roll on top. The current release tracks Ubuntu 24.04 LTS; Pop!_OS 26.04 is expected to follow roughly a month after its upstream release, with some delay thanks to Canonical's recent DDoS‑related infrastructure issues. Critically, Pop!_OS has gone "entirely over to Wayland." That move, Richell says, freed the team from trying to build a cutting‑edge desktop on top of legacy X11 stacks and let them align COSMIC with the latest graphics and input pipelines from the start. Ask any Linux vendor about AI in 2026, and you'll likely get a flurry of product names; System76 is more circumspect. While Canonical, for example, is busy wiring "agentic AI tools" into Ubuntu so they're easy to add, Richell says System76 is still "thinking about it" and sees "more questions than answers" for now. The areas where he does see clear value for AI are pragmatic, Linux-user-focused ones, including accessibility features that can leverage AI, and smarter launchers that go beyond fuzzy string matching to actually understand user intent when they hit Super and start typing. In that world, the launcher might answer questions, locate files, or trigger workflows that shrink the distance between "I want this" and "it's done." But AI features will have to be optional, he insists, and designed with "the community's concerns around AI" in mind. For now, the company's to-do list prioritizes HDR, gaming polish, and foundational desktop work over embedding language models everywhere. That restraint might frustrate some early adopters, but it aligns with System76's tendency to ship infrastructure first and pretty features later. On the hardware side, AI shows up more directly in plans for the Paleo Mega workstation and in the market forces buffeting System76's bill of materials. GPU and memory prices are being driven upward by datacenter AI demand, which in turn raises the costs of high‑end desktops and workstations. The surprise for Richell is that demand for System76's boxes has held steady despite those increases, suggesting a base of customers who see local, Linux‑native AI workstations as a necessary capital expense rather than a nice‑to‑have. If there's a single idea that animates Richell when he talks about System76's next decade, it's the dream of "liberating the entire stack." Open source has already transformed the operating system and much of the software above it; he'd like to see hardware follow, turning the motherboard, firmware, and even some silicon into something you can read, fork, and improve. To that end, he said, "anything that we design inside of System76 is open hardware." System76 wants to go further with open hardware by creating reusable components that others can build into their own designs. Think of chassis elements, power distribution boards, or controller modules that can be dropped into third‑party projects – hardware analogs to open libraries and frameworks. The obstacles are obvious: CPUs, memory, and most major silicon are still dominated by opaque supply chains, NDAs, and closed firmware. RISC‑V offers a path toward open instruction set architectures, and System76 is watching that space as a way to eventually reduce its dependence on closed processor platforms. In the meantime, it has chipped away where it can, shipping its own open EC (embedded controller) firmware and adopting coreboot‑based system firmware on many laptops, closing a gap Richell once thought might never be solved. "It took us 15 years, but we got there," he says about open firmware. That timeline is probably the right yardstick for the rest of the hardware vision. Over the next decade, he wants System76 to take on more design and manufacturing in‑house, build more of its own components, and gradually expand the platform's surface area that can be studied, modified, and reused by others. The company will never be able to satisfy the most uncompromising free‑software purists – Richell readily admits they can't "work in a totally purist fashion" and stay in business – but its trajectory is pointed toward more openness, not less. For many developers and organizations who want control without giving up modern hardware, that may be enough. In 2026, most stories about PCs involve consolidation, commoditization, or retreat from the desktop toward cloud services and locked‑down devices. System76 is betting on a different future: one where there's enduring demand for machines you can understand, repair, and reimagine, running an OS that treats you as the operator rather than the product. It's a risky path. The company operates in a small, noisy niche where many rivals have tried and failed; Linux‑only hardware vendors have come and gone, often leaving behind little more than a blog post and some unfulfilled orders. System76's answer is to behave less like a startup and more like a craft manufacturer crossed with a small enterprise vendor: design your own hardware, invest in a factory, write your own desktop, and grow slowly enough that you never lose sight of the people actually using the machines. If the next ten years look anything like what Richell hopes, System76 could end up not just as "the company that still makes Linux desktops," but as the reference implementation for an open, full‑stack computing platform. In a world increasingly defined by black‑box AI and sealed hardware, that might be its most radical feature. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5255300&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5255300&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5256133</guid>
        <link>https://www.theregister.com/virtualization/2026/06/17/tesco-is-sprinting-to-quit-vmware-and-broadcom-despite-rapid-migration-risks/5256133</link>
        <pubDate>Wed, 17 Jun 2026 09:30:00 +0200</pubDate>
        <title>Tesco is sprinting to quit VMware and Broadcom despite rapid migration risks </title>
        <description><![CDATA[ Supermarket giant has turned to third-party support as court sets date to hear licensing dispute ]]></description>
        <category>virtualization</category>
                <lab:kicker><![CDATA[ virtualization ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 08:59:05 +0000</dc:modified>
                <content:encoded><![CDATA[ UK retail giant Tesco is replacing VMware with an alternative product and pressing ahead with its licensing lawsuit against the virtualization pioneer's parent company, Broadcom, which will be considered by the UK's High Court no sooner than November 2027. The roots of the dispute are a January 2021 contract that saw Tesco acquire perpetual licenses for VMware's vSphere Foundation and Cloud Foundation products, plus subscriptions to Virtzilla's Tanzu products. The supermarket giant also signed up for support services and software upgrades until 2026, with an option to extend that deal for four years. Computacenter signed up as a reseller and relied on Dell as the distributor of VMware's products. Tesco also uses some of Broadcom's mainframe software, and wanted to extend licences and support for that too. Tesco and VMware struck that deal before Broadcom acquired VMware. After the acquisition, Broadcom stopped selling standalone services for customers who did not adopt subscriptions for its software bundles. Broadcom was therefore unwilling to extend support for Tesco's VMware estate. The supermarket chain sued Broadcom in mid-2025, alleging breach of contract and anti-competitive behavior. The case picked up again in late May with a flurry of filings that The Register has just digested. The new documents reveal that Tesco has decided to quit VMware and Broadcom's mainframe products, is rushing to migrate to alternatives, has turned to third-party support providers for its VMware estate, and alleges Broadcom is abusing its market power. "Faced with Broadcom's abusive conduct, and given the criticality of virtualization and mainframe software and services to its business, Tesco has been forced to incur material costs to procure alternative solutions with reduced functionality, and to migrate to that software in a manner, and on a timeframe, that creates very significant risks to its business," the filing states. Those costs include payments for third-party VMware support because Broadcom stopped supporting the virtualization software in January 2026. The supermarket hopes to be off VMware by the end of 2027 but says that target is its earliest possible date and will require it to work "at exceptional pace." Elsewhere in the filing, Tesco says "the timeframe in which that migration must be undertaken has created and continues to create operational and commercial risk, and at material ongoing cost and disruption to the business." The risks aren't abstract: Tesco says it uses Broadcom mainframe software to order products for its stores and process its payroll. The retailer is also worried about data security and protection because the virtualization product it has chosen as a VMware replacement isn't compatible with the Veeam and Zerto tools it uses. Rejecting offers Broadcom appears to have made Tesco at least four offers, including a "Strategic proposal" in July 2024 that covered virtualization and mainframe products. Another offer delivered on January 9, 2026, offered separate terms for VMware products and mainframe software – the first time Broadcom dangled discrete deals. Tesco struggled to process it because Broadcom offered the deal just 19 days before the end of its existing agreements. Two offers arrived in April. Tesco says one proposed charges of $23.5 million (around £17.4 million) for a year of VMware Cloud Foundation 9.0 and Mainframe Software and Support Services. The retailer says that offer represented an increase of "around 175 percent" compared to the prices Tesco believes it was entitled to under its 2021 contract for VMware software and services, and a 350 percent increase for the mainframe products and services. The retailer described those price hikes as "manifestly unfair and excessive." Broadcom's amended defence rejects that characterisation, and also Tesco's claim that it deserves damages as it could not find an alternative supplier before its deals expire. Now that Tesco has found alternatives, Broadcom thinks the retailer can't easily point to losses that deserve damages payments. Other recent filings reveal that the matter is due to be heard in the UK's High Court during a window that opens on November 1, 2027, and closes on February 25, 2028. That doesn't mean the trial will consume all that time – it's an indication of when the court thinks it will have time to consider the matter. Broadcom has fought other high-profile cases over its licensing changes, most notably with AT&T and Siemens. The telco giant reached a confidential settlement, but the Siemens case is ongoing. On The Reg's reading of Tesco's filings, the retailer appears comfortable with litigating its claims with an argument that Broadcom refused to honor past agreements and that its main defense – it can't support products that don't exist since it reorganized VMware – is weak. Broadcom execs have told The Register they have an enormous dislike for providing extended support for old products and a huge preference to shift customers to subscriptions for the company's flagship Cloud Foundation (VCF). They argue that that continuing to use old VMware software sold under perpetual licenses is an act of corporate self-harm because VCF is so powerful it quickly pays for itself by improving IT department operations and improving business efficiency. But those messages aren't landing with some customers. We've reported organizations including Western Union, GEICO, and Computershare moving away from VMware, and even some VMware partners like Rackspace reducing their use of the virtualization giant's wares. We've also just learned that Belgian technical secondary school Scheppers Instituut Wetteren shifted to local contender Whitesky.Cloud to avoid a 400 percent price hike, and made the move without needing any new hardware. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=260306&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=260306&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5255316</guid>
        <link>https://www.theregister.com/ai-and-ml/2026/06/17/developers-build-the-best-tools-for-developers-and-are-now-defanging-the-ai-menace/5255316</link>
        <pubDate>Wed, 17 Jun 2026 08:31:00 +0200</pubDate>
        <title>Developers build the best tools for developers – and are now defanging the AI menace</title>
        <description><![CDATA[ Fear and even grief are natural reactions to machines that do your job. The next reactions – acceptance and innovation – are more useful ]]></description>
        <category>ai and ml</category>
                <lab:kicker><![CDATA[ AI and ML ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 11:01:57 +0000</dc:modified>
                <content:encoded><![CDATA[ Forty years ago, while working for a tiny subsidiary of a gigantic telco, I stumbled through pre-Git source code management and tried to avoid explosively devolving into a mess of conflicts after every merge. Thankfully, modern practices make it possible to work in massive, distributed teams, swarming around a codebase, working independently toward a collective goal. That sounds a lot like what we're heading toward with agents, and here it touches a nerve: nearly everyone in software engineering feels a deep terror as an invasion of agentic systems sweep all before them. Now that Stack Overflow has gone agent-first, what's left for us meatsacks? Shoulder-to-shoulder with the flesh-based cohort most immediately under the pump at a conference called AI Engineer Melbourne, I heard conversations about the future of software engineering working their way through denial, anger, bargaining, and depression, to ... coupon clipping? Now that organisations have been weaned off earlier 'all you can eat' subscription plans and onto 'pay-as-you-go' metered token consumption, they're all in various stages of sticker shock. Several talks at the conference discussed managing token costs, such as AJ Fisher's exploration of 'diffusion' models. Analogous to the diffusers used to generate images, they generate text at lighting speed, making them cheaper to operate while also being less accurate than the pricey and slower “autoregressive” frontier models. Fisher's solution? Use a low-quality model and make it iterate on a problem (that new classic, the Ralph Wiggum loop) until it gets a satisfactory solution. This approach delivers the same result as a full-fat model, for anywhere from one half to one tenth the spend. Google released its DiffusionGemma model, which produces text at prodigious speed, just days after Fisher's talk, giving everyone the ability to try this approach. But some engineers reject AI in 'all the things'. Annie Vella, author of the seminal essay "The Software Engineering Identity Crisis" shared what she's learned about the feelings of grief experienced by a cohort of software engineers, provoked by AI tooling. We've seen the field divide into 'all in' and 'never ever' camps (even in the pages of El Reg), with a broad middle cautiously getting their feet wet. That divide has roots in two styles of work: those who look for outcomes, and those who look for learning, for whom the journey into understanding is the whole point of the exercise. Short circuiting that journey with AI tools makes folks for whom the journey is the reward feel cheated. How do we breach the divide? Annie suggests sensitivity, listening, and openness to change on both sides - highlighting human qualities in the machine age. Kaggle and fast.ai alum Jeremy Howard took a different tack, reminding the audience of the importance of critical thinking - really, a plea to just keep thinking, a refrain we'll be hearing a lot as we struggle to avoid nodding off in the warm bath of machine thoughts. He followed up with a demo of SolveIT, his still-in-beta tool combining some of the best aspects of Python notebooks, Mathematica, Wikipedia, and a chatbot, offering up a counterexample of an environment designed for swimming in the sea of knowledge, rather than floating off into mindless oblivion. Finally, Daniel Rodgers-Pryor's "Fully Automated Luxury Gay Space Engineering" blew my mind with a practical, working vision for AI in the engineering department. Rodgers-Pryor's entire CI/CD pipeline feeds all of its metrics, messages, logs and user feedback into a set of AI agents that quickly identify issues, find the underlying problems, fix them, integrate solutions into the codebase, test them, and push them out to users. What sounds like a recipe for disaster turns out to be a formula for a self-healing, 'anti-fragile' system that improves as the pressure on it increases. More users? Good. More metrics? Great! More messages and logs? Even better. Agents eat all of that data and use it to improve the performance of the overall system. Rodgers-Pryor's "closed feedback loop" reminds me of a 20th century production line worker dipping into the stream of bonbons (or widgets) eyeing a few for quality, then tossing them back into the stream. "This is your job now," he concludes. "How can you can make those feedback loops shorter and tighter?" Software engineers have been forced to absorb more change in the last three years than in the previous thirty, and have every right to be a aggrieved about that. Yet as AJ Fisher, Annie Vella, Jeremy Howard and Daniel Rodgers-Pryor all portrayed in their own ways, adopting AI looks less like rolling over before the dictates of the machine, and more like exploring a whole new world. Like any journey into a new realm, perils and hardships await. Who's to say that's not the price of admission for a once-in-a-lifetime opportunity? ® The author attended AI Engineer Melbourne as a guest of the conference. ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=261387&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=261387&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5256321</guid>
        <link>https://www.theregister.com/cyber-crime/2026/06/17/cyberattack-sees-crops-kept-in-the-ground/5256321</link>
        <pubDate>Wed, 17 Jun 2026 04:16:00 +0200</pubDate>
        <title>Cyberattack sees crops kept in the ground</title>
        <description><![CDATA[ Bitter harvest for Australia's Mackay Sugar, attacked in peak cane crushing season  ]]></description>
        <category>cyber-crime</category>
                <lab:kicker><![CDATA[ CYBER-CRIME ]]></lab:kicker>
                <dc:modified>Tue, 16 Jun 2026 15:16:36 +0000</dc:modified>
                <content:encoded><![CDATA[ A cyberattack on Australia’s second-largest sugar producer has forced farmers to keep crops in the ground, and looks like denting their incomes. Mackay Sugar, based in the Australian state of Queensland, processes sugar cane farmed in nearby districts. The company disclosed a cyberattack on June 10 and limited operations while it dealt with the fallout. Some operations remain restricted, but the company said on Monday that it managed to perform some manual crushing at its Farleigh Mill site, working with sugar cane that was harvested before the attack. “Significant progress has been made over the weekend in restoring the systems that support cane supply, harvesting, and mill operations,” Mackay Sugar said in a statement. “Steam trials are now underway, and subject to final validation activities, some harvesting is expected to recommence this week in preparation for the staged restart of crushing operations later this week.” While the company is optimistic it can resume crushing, it's advised growers not to harvest their crops for the time being. That edict works for Mackay Sugar because sugar producers need to process crops within 48 hours of harvest. Doing so preserves high sugar content and overall yield. Delaying the processing for any longer after harvesting could result in sucrose converting to simple sugars, unwanted fermentation, and lower yields. But late harvesting can reduce the quality of cane, reducing the price they earn for their crops. Interrupted harvesting also impacts the railways used to move cane from farms to mills. Mackay Sugar acknowledged the impact its downtime could have on growers and other partners, and committed to restoring systems safely. “We are communicating directly and regularly with our employees, growers, and key partners,” it said. “We recognise the impact this incident is having on our growers, and we are doing everything we can to support them and to safely resume full operations as soon as possible. “We take our responsibility to protect our systems, operations, and information very seriously. We apologise for any disruption this incident has caused and will continue to provide updates as we continue our investigation.” The company operates three mills across Queensland, two of which were operating at a limited capacity due to the attack. Its Racecourse Mill, described as the heart of the business and home to its corporate offices, was among those affected. Racecourse Mill typically generates 213,000 tons of raw sugar and 58,000 tons of molasses a year, and the site’s cogeneration plant generates 156,000 MWhs of renewable electricity a year, around 71 percent of which is sent back into the national electricity grid. Mackay’s mill in Farleigh, the company’s oldest, was also affected. It typically produces around 196,000 tons of raw sugar and 49,000 tons of molasses per year. The company’s largest and most productive factory, Marian Mill, was unscathed. Ungentlemanly conduct Cybercrime group The Gentlemen claimed responsibility for the attack on Mackay Sugar, posting the company to its data leak site without offering any details about the attack or whether it stole data to use as leverage for extortion demands. Cyber threat intelligence professionals have known of the group for almost a year, after spotting it in July 2025 and classifying it as a ransomware-as-a-service provider. However, there is no evidence that ransomware was used in the attack on Makay Sugar. The company has never mentioned ransomware in its statements, referring to the attack only as a “cyber security incident.” However, The Gentlemen is known for using file-encrypting malware in its double extortion attacks. The group caught the attention of Microsoft’s researchers, who last month published a deep dive into how it carries out attacks. Microsoft’s report noted that not only do The Gentlemen affiliates have access to a powerful file encryptor, but also one that self-propagates, which “increases the likelihood of widespread impact once initial access is achieved.” It has also recently established a partnership with BreachForums, which allows the group to recruit prospective new affiliates with different skillsets, such as penetration testers and initial access brokers. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5227626&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5227626&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5257352</guid>
        <link>https://www.theregister.com/systems/2026/06/16/amds-mext-buy-shows-how-ai-could-solve-the-ram-shortage-it-created/5257352</link>
        <pubDate>Wed, 17 Jun 2026 00:09:32 +0200</pubDate>
        <title>AMD's Mext buy shows how AI could solve the RAM shortage it created</title>
        <description><![CDATA[ Running low on memory, can't afford more? The House of Zen's latest acquisition puts an AI spin on flash-based memory expansion ]]></description>
        <category>systems</category>
                <lab:kicker><![CDATA[ SYSTEMS ]]></lab:kicker>
                <content:encoded><![CDATA[ With no end in sight to the memory crunch, AMD thinks that AI, the main cause of the shortage, could be part of the solution. This week, the House of Zen acquired predictive memory startup Mext for an undisclosed sum, setting the stage for a world where bots decide which data to put into RAM and which to store in less-expensive flash. Founded in 2023, the Mext proactive memory platform uses machine learning algorithms and learned heuristics to proactively offload "cold" memory to flash storage, and, based on data access patterns, restore it before its needed again. Modern flash arrays are already approaching main memory in terms of aggregate bandwidth, but swapping to disk still imposes a stiff latency penalty. Mext claims it can expand the effective memory of a system by 2 to 4x using flash, which gig for gig is still vastly less expensive than DRAM. This flash memory is exposed to the operating system like regular memory simply by running the Mextd daemon. Memory tiering is nothing new and has seen various reincarnations over the years with some being software based and others, like Intel Optane persistent memory, using special 3D XPoint memory tech co-developed by Micron. Mext stands out for its use of machine learning to migrate data from hot memory to cold storage almost like a branch predictor — something AMD has an awful lot of experience with. Mext isn't using one model to decide when to shuffle your data. Instead it uses a series of heuristics, long short term memory, and modern transformer architectures depending on which combination renders the best results. “This approach has the potential to reduce infrastructure costs, improve resource utilization, and help customers more effectively scale general-purpose and AI workloads,” Dan McNamara SVP of AMD’s compute and enterprise AI biz wrote in a blog post this week. Beyond enterprise applications, the technology could have implications for AI serving. Modern mixture of experts (MoE) models are, as their name suggests, comprised of multiple sub-models. For each token predicted, a different selection of experts may be used. In practice an LLM may use some experts more frequently and others rarely. We wouldn't be surprised to see AMD use Mext's prediction algorithms to offload infrequently utilized experts from HBM to slower system memory, enabling enterprises to take advantage of larger more capable models with fewer resources. That’s just speculation of course, but we've reached out to AMD for comment; we'll let you know if we hear anything back. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5257373&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5257373&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5256591</guid>
        <link>https://www.theregister.com/ai-and-ml/2026/06/16/the-new-siri-makes-one-of-apples-most-convenient-os-features-a-cumbersome-mess/5256591</link>
        <pubDate>Tue, 16 Jun 2026 22:47:37 +0200</pubDate>
        <title>The new Siri makes one of Apple's most convenient OS features a cumbersome mess</title>
        <description><![CDATA[ Goodbye, useful Spotlight; hello force-fed Apple intelligence bloatware that feels distressingly like Google AI Overviews ]]></description>
        <category>ai and ml</category>
                <lab:kicker><![CDATA[ ai + ml ]]></lab:kicker>
                <content:encoded><![CDATA[ HANDS ON That new AI-juiced Siri that Apple rolled out last week at WWDC was supposed to set a new paradigm for on-device AI. But don't believe the hype coming out of Tim Cook's final big event. After a week-long test drive, it seems like Apple just crammed Google AI Overviews on top of the most useful parts of its various operating systems and made the whole ecosystem more cumbersome to use. But hey, it has more AIs! I’ve been running the iOS and macOS 27 developer betas since they were made available on June 8, and I was blessed by the waitlist gods with access to the new version of Siri a few days after that. There are definitely some useful new features: Siri now carries on actual conversations, which makes it far more useful than the ask, get a response, we’re-done-here flow of the old Siri that left no room for clarifying questions or follow ups. Siri is now able to find things on my device more easily too – at least on my M1 MacBook. My iPhone 15 Pro has been telling me it’s still re-indexing my device after the update for more than a week, but I was still able to use it to conduct web searches and find some things on my phone – it's possible this message itself was an error. The dedicated Siri app is also nice in its own way, as it shows a record of every conversation I’ve had with the new Apple Intelligence front end for later review, but that comes with a caveat, too. Even the most brief questions – the overnight weather forecast, for example – is now stored in perpetuity, cluttering up the list of chats we’ve had until I manually delete it. The only apparent alternative is setting an expiration window for past chats and losing records of the more useful conversations we’ve had. Who turned out my Spotlight? Those are small inconveniences, however, compared to my biggest gripe with Siri AI: It’s completely ruined Spotlight. I’ve come to rely on Apple’s embedded search/launcher feature almost exclusively for digging up apps that I don’t keep a shortcut for, and on my iPhone, it’s the main method I use to kick off a web search because it's so simple. Swipe down from the center of the screen, type what I want to search for, and tap on the item that points to my query as a Google search in Safari. Swipe, type, and a tap and I’m perusing a search result page. Not anymore. The new Siri-first interface that presumes that if you’re searching for anything but an app or file, you must want Siri to feed you a few links of Apple Intelligence’s choosing. Getting to a web search from a Spotlight query now requires multiple taps: Type your query, tap “Show Results” (careful: hitting enter will trigger Siri to craft a response, eliminating the possibility of seeing any actual Spotlight content), tap on “Show More” next to the list of Siri-surfaced web results, scroll down until you see Search Google (or whatever engine you have set as your default), then tap that. Maybe I’m being a grumpy old journalist who likes things the way they used to be, the transformation of Spotlight into a Siri interface seems like intentional degradation of a basic feature in order to front-load an AI that in my experience so far is largely an inconvenience. Overall, the experience reminds me of Google’s much-maligned and often wrong AI Overviews, which push actual search results down the page in favor of force-fed info from Google Gemini. There's a logical reason for the similarity. At the end of 2025, Apple replaced its former AI chief John Giannandrea, formerly Google's SVP of search and AI, in a bid to right the Siri ship. Taking his place was another Google alum with even closer ties to The Chocolate Factory’s AI strategy, Amar Subramanya, who spent 16 years there, including a turn as the head of Gemini engineering. Subramanya, now Apple’s VP of AI, now reports directly to Apple's SVP of software engineering, Craig Federighi, who himself has assumed responsibility for Apple’s machine learning initiatives, including the construction of Apple foundation models. As we learned at WWDC last week, Apple has leaned heavily on a partnership with Google to build its foundation models, and it appears Subramanya has brought some of that Google AI ethos with him as well. So, what’s the alternative to the new AI bloat in iOS 27? Siri can still be turned off entirely in the Settings app, so there’s that, but I’ve decided to take another tack and use one of Apple’s other AI features to get what I want. As the iMaker mentioned at WWDC, you can now create shortcuts (tiny scripts that automate basic tasks) by making a natural language request to Siri. In my case, I asked it to build a shortcut I could drop on my home screen to do a Google search with whatever text I input. It works perfectly, and is available to duplicate on your own iDevice should you see fit. Again, this is a developer beta, so it’s entirely possible that Apple will wise up and stop burying basic Spotlight search functionality before its 27 series of OSes release to the public this fall. We asked Apple if the change was intentional, but didn’t hear back. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=4093949&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=4093949&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5256632</guid>
        <link>https://www.theregister.com/ai-and-ml/2026/06/16/python-dev-saved-from-disaster-by-intuition-and-ai/5256632</link>
        <pubDate>Tue, 16 Jun 2026 22:15:06 +0200</pubDate>
        <title>Python dev saved from disaster by intuition... and AI</title>
        <description><![CDATA[ I'm sorry, Dave. I can't install that repo that will totally hose your system ]]></description>
        <category>ai and ml</category>
                <lab:kicker><![CDATA[ AI AND ML ]]></lab:kicker>
                <dc:modified>Wed, 17 Jun 2026 08:05:02 +0000</dc:modified>
                <content:encoded><![CDATA[ Python developer Roman Imankulov nearly took the bait. The fact that he didn't can be chalked up to human intuition and AI code vetting. A person claiming to be a recruiter from a small crypto startup got in touch through LinkedIn, looking for help with what she described as proof-of-concept code that didn't work. The company, she explained, needed a lead engineer. As Imankulov described the exchange in a blog post, the recruiter asked him to look into an issue with a deprecated Node module. Something about the request seemed off. "I'd heard, as probably all of us have, about those types of attacks," Imankulov explained in a phone interview. "And I was like, 'what if this could be I could be the target?' It was just based on the past experience that I had." So he took the unusual step of spinning up a VPS on Hetzner where he cloned the repo. He then used his Pi coding agent (running Codex) to conduct a read-only analysis of the code. "I ran an agent to test how it worked, and I was almost certain that it would return to me 'everything is clear, the code is ugly but in general it's safe to run and just go ahead and perform your review,'" he explained. "To my surprise, almost immediately the agent returned a response like, 'Don't run this code, just walk away because there's a trap.'" The AI model had flagged one of the files, app/test/index.js. The file contained a backdoor. It took the form of a server URL, fragmented to look like a test suite configuration, and a network request that will run anything the server sends in response to the request. Imankulov credited his AI agent with catching details that he had missed. "I opened this code myself and I skimmed through this code and it looked to me like just, you know, a regular sloppy file written by a sloppy developer," he said. "So I just scroll down, [thinking] 'Yeah, yeah, it's awful, but you know if they can pay me to fix this code, I don't mind.' But the agent in the very same file found the exact vulnerability that I overlooked." Just installing the repo using npm would have been sufficient to trigger the backdoor. The repo's package.json file contained a "prepare" post-installation hook designed to run the script following the installation process. The referenced malicious repo is no longer accessible – presumably GitHub removed it in response to Imankulov's complaint – but a clone can still be found. "What makes this attack insidious is how it hijacks standard developer workflows," explained Devashri Datta, independent open source and security architect, in an email to The Register. "The adversary didn't rely on the target executing a suspicious binary; they relied on the target running a routine command: npm install. "By burying the execution logic inside the prepare lifecycle hook within package.json, the malicious payload triggers automatically during dependency resolution. This isn't a novel technique, but it remains highly effective precisely because developers run npm install on autopilot. The string fragmentation used to assemble the malicious URL, piecing together a domain from small constants, was deliberate obfuscation designed to defeat static analysis tools that scan for hardcoded indicators of compromise." Imankulov said that the commits in the malicious repo appeared to be the work of a developer with an established web presence and body of work. But when he contacted the supposed author, the dev said he had been impersonated on GitHub more than once and didn't write that code. The recruiter's LinkedIn profile referenced a real arts journalist, though Imankulov believes the associated profile was faked. His online interactions with the recruiter suggested a level of technical knowledge not evident in her work history. LinkedIn likes to talk about the tens of millions of fake accounts it catches and removes before they interact with anyone. But hundreds of thousands of accounts still get created and interact with people before being detected and flagged. And that number keeps growing. In the period from January through June 2025, LinkedIn restricted 386,000 accounts after user reports. That figure was 266,000 in the prior six month period. And it was a mere 86,000 in the January through June 2021 period. These sorts of software supply chain social engineering attacks have become commonplace. Earlier this month, we noted how North Korean-linked scammers have been running various campaigns to compromise developer accounts using fake interviews and job offers. Other developers have reported nearly falling for these scams (and also being saved by their AI agent) and have posted code analyses. Datta said Imankulov's response highlights a shift in how security-conscious developers are approaching code review hygiene. "Historically, the guidance was to sandbox untrusted code or review it manually," she said. "Here, Roman deployed a local AI agent in a constrained, read-only environment to analyze the codebase before executing anything. This is a useful counterpoint to the dominant narrative around AI as an offensive threat vector. Used defensively at the developer endpoint, an AI agent isn't susceptible to fatigue or social pressure; it simply surfaces anomalous behavior, such as a test suite initiating an outbound network connection to retrieve unverified code, in seconds." npm 12 could change the game If it's any consolation, the relevant attack vector should be addressed next month. GitHub, which maintains npm, is preparing to release npm 12 which changes the behavior of the npm install command. The allowScripts setting will be defaulted to off. "npm install will no longer execute preinstall, install, or postinstall scripts from dependencies unless they are explicitly allowed in your project," GitHub explains. "Install-time lifecycle scripts are the single largest code-execution surface in the npm ecosystem," explained GitHub product manager Leo Balter in a community discussion post last week. "Every npm install runs scripts from every transitive dependency, so a single compromised package anywhere in your tree can execute arbitrary code on a developer machine or CI runner. Making script execution opt-in closes that path while keeping it one command away for the packages you trust." Imankulov said he doesn't have a strong opinion about that. "From my perspective, just for the sake of personal safety, I switched to pnpm just to make sure that I don't execute those scripts by default," he said. Datta said the incident underscores why enterprise software supply chain security had to extend beyond the perimeter of the corporate network. "Attackers are now shifting left all the way to individual engineering endpoints before a single line of code enters the corporate supply chain," she said. "When a developer's local workstation is compromised during what appears to be a routine job interview, that machine frequently holds active SSH keys, cloud provider tokens, and live access to internal repositories." Proper defense, Datta contends, requires enforcing technical guardrails such as isolated developer containers or secure cloud workstations for evaluating third-party or untrusted code. "Emerging frameworks are beginning to extend exploitability context down to the workstation layer itself, recognizing that VEX-style signal needs to travel further left than the enterprise SBOM inventory if it is to intercept threats at the point of introduction," she said. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=1683298&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=1683298&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5256535</guid>
        <link>https://www.theregister.com/hpc/2026/06/16/intel-born-networking-tech-resurfaces-as-infiniband-alternative-for-doe-supers/5256535</link>
        <pubDate>Tue, 16 Jun 2026 22:03:59 +0200</pubDate>
        <title>Intel-born networking tech resurfaces as InfiniBand alternative for DoE supers</title>
        <description><![CDATA[ Omni-Path lights up Lawrence Livermore system at 400 Gbps ]]></description>
        <category>hpc</category>
                <lab:kicker><![CDATA[ HPC ]]></lab:kicker>
                <dc:modified>Tue, 16 Jun 2026 20:16:36 +0000</dc:modified>
                <content:encoded><![CDATA[ When it comes to networking supercomputers, Nvidia's InfiniBand rules the roost, but a new competitor is sneaking into the space with its own solution. This week the Department of Energy powered on a new cluster at Lawrence Livermore National Laboratory, and gluing it all together is Intel spinoff Cornelis Network’s Omni-Path interconnect tech. Lynx is a relatively modest bit of iron, at least as DoE supers go, packing 952 Dell Technologies PowerEdge nodes powered by Intel’s aging 4th-gen Xeon Scalable processors, codenamed Sapphire Rapids. The system, commissioned by the National Nuclear Security Administration (NNSA) will provide additional compute capacity for some of America’s most secretive workloads. But what sets the machine apart isn’t the compute, but rather its choice of interconnect. Most DoE systems today either use HPE Cray’s proprietary Slingshot 11 or Nvidia’s InfiniBand networking. Lynx uses neither, instead opting for Cornelis Network’s CN5000-series Omni-Path switches and NICs. “The collaboration between the NNSA ASC program and Cornelis has been rooted in a shared commitment to advance high-performance computing. Lynx reflects the results of that public-private R&D investment and will support the modeling, simulation, and analysis capabilities that underpin the modern NNSA complex,” Matt Leininger, a senior principal HPC strategist at LLNL, said in a statement. If Omni-Path sounds familiar, that’s because it’s been around in one shape or form for the better part of a decade. Originally developed by Intel in 2015 for HPC applications, the lossless interconnect is similar in many respects to InfiniBand. Several DoE Labs were early adopters, including Los Alamos National Lab’s Trinity super and the Cori machine, before Intel pulled the plug in 2019. The division was eventually spun off in 2020. For many, this is where the story ended, but in 2025, the company unveiled its CN5000 family of NICs and switches to the world, promising 400 Gbps connectivity with near linear performance scaling. The tech quickly attracted the attention of the DoE which tapped the niche networking startup’s tech for its Lynx system last summer. Omni-Path not only offers the agency an alternative to InfiniBand for non-Cray systems, but is now one of the fastest interconnects at their disposal. The majority of the Cray systems deployed by the DoE labs operate at 200 Gbps. InfiniBand technically can accommodate higher port speeds, but is in extremely high demand for AI compute clusters. For Cornelis, the deployment represents a significant proof point for the company’s next-generation Omni-Path protocol and networking systems. “It's laying that foundational proof point for the industry to see that the most demanding customers out there have run it through its paces and are seeing really good results,” Cornelis CEO Lisa Spelman told El Reg. In particular, Spelman says the deployment allowed Cornelis to demonstrate the scaling efficiency of its CN5000 portfolio. As compute clusters grow larger, network interconnects can quickly become a bottleneck. “We were able to show a 91% network scaling efficiency, which is great for this size of cluster,” she said. This scaling is so good, in fact, that Spelman expects to see Lynx outperform similarly sized clusters using more modern processors simply because the interconnects are more efficient. Lynx won’t be the last supercomputer Omni-Path finds its way into. The company is working on additional systems, including some, we’re told, that will make use of some non-traditional accelerators. “We're looking forward to the next chance to prove it at 2,000, 5,000, 10,000 and just keep going up from there,” Spelman said. Cornelis is also working to bring faster 800 Gbps equipment to market later this year, timed with the release of PCIe Gen 6.0-compatible CPUs from Intel, AMD, and others. PCIe 5.0 connectivity effectively caps conventional NICs at 400 Gbps. Nvidia and some others have side stepped this problem by integrating large PCIe switches into their NICs which offers additional bandwidth, but adds cost and complexity that Spelman says Cornelis would prefer to avoid. CN6000 is expected to launch in the second half of this year, and is expected to bring with it support for Ethernet connectivity allowing for greater cross compatibility with existing networks.® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=145706&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=145706&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5256492</guid>
        <link>https://www.theregister.com/science/2026/06/16/ai-and-brain-computer-interface-allow-speechless-als-patient-to-work-a-full-time-job/5256492</link>
        <pubDate>Tue, 16 Jun 2026 20:44:12 +0200</pubDate>
        <title>AI and brain-computer interface allow speechless ALS patient to work a full-time job</title>
        <description><![CDATA[ The hardware isn't new, but a UC Davis research team's machine learning-powered method of translating brain activity in an ALS patient into sentences with 92% accuracy is ]]></description>
        <category>science</category>
                <lab:kicker><![CDATA[ science ]]></lab:kicker>
                <content:encoded><![CDATA[ Imagine being paralyzed so badly that not only can't you move your hands or feet, but you can't speak either. For years, brain computer interfaces have presented the tantalizing promise of reading brainwaves well enough to allow a person to communicate and access a PC. Now, a new breakthrough shows how someone can talk and even work a job while afflicted with a motion-robbing disease. A team of scientists from the University of California, Davis, published a paper Monday detailing a years-long study of a brain computer interface (BCI) system implanted in a patient with amyotrophic lateral sclerosis (ALS, also known as Lou Gehrig’s disease), which destroys motor neurons and causes loss of motor control and eventual paralysis. According to the team, their patient, Casey Harrell, has been living with BCI implants since 2023 that are still working today, giving him the ability not only to control a computer cursor with his thoughts, but also to speak. The Davis team is part of a broader coalition of universities with the US Department of Veterans Affairs known as BrainGate. They're working on a variety of neuroscience projects to do things like restore speech, use computers, and, in some cases, restore movement. In Harrell’s case, the Davis team was trying to figure out how to turn experimental tech into something long lasting and practical for use outside of a laboratory. Davis neurosurgeon David Brandman, co-principal investigator and co-senior author of the paper published Monday, as well as the surgeon who placed Harrell’s implant, described the results his team published as the crossing of a threshold in BCI technology: Not only has Harrell’s implant been working well with daily use since 2023, but it’s also incredibly accurate. In controlled tests, the system managed to synthesize sentences from Harrell’s brain activity with 99 percent accuracy; outside of the lab in daily use, Harrell still assessed it as being accurate 92 percent of the time. “The key thing to me is that it’s enabling everyday communication for a guy who wants to talk but can’t,” Brandman told The Register in an interview. “Despite being paralyzed [Harrell] has gone back to work full time and has meaningful conversations with his daughter who’s never heard the sound of his voice.” Prior work in the BCI space, Brandman told us, has either required researchers to be in a patient’s home whenever they’re using the tech, or for the patient to come to the researchers. That’s not the case here, with the system allowing Harrell’s home care team to hook him up to the system themselves, enabling him to use the device for more than 3,800 hours in the past few years. Based on the time the study was filed (It published Monday but went into peer review in July 2025) that would mean Harrell was using the device for more than five hours a day, on average. “It is a life that is more full of dynamic action and with friends and family, with colleagues, and it is something that allows me to communicate more in my natural way of communicating than any other technology that I have experienced,” Harrell told UC Davis via his BCI system. An actual practical use of AI Brandman is no stranger to BCI technology: Along with being a key figure in the BrainGate consortium, he’s also worked as study principal in investigating the safety of commercial BCI tech from Paradromics, one of the leading companies in the space alongside Synchron and Neuralink. As Brandman explained it, the Davis study didn’t involve any purpose-built hardware, instead making use of an existing BCI design produced by Blackrock Neurotech. The big advancement, says the Davis neurosurgeon, is with his team’s use of machine learning technology. The lab has built its own software platform for operating BCI devices known as Brain-computer interface for Rapidly Adaptive Neural Decoding (BRAND, which Brandman told us was coincidentally named), which UCD postdoctoral fellow Nick Card built machine learning algorithms for. BRAND is now used across the BrainGate consortium, and is where the secret sauce of the project’s success lies. According to the paper, BRAND’s AI algorithms are able to translate activity in Harrell’s ventral precentral gyrus, the part of the brain that controls motor function in the face, mouth, and jaw, into English-language phonemes. Additional algorithms in the software map those phonemes to words, and words to sentences. The end result is some very precise speech synthesis that allows Harrell to work full time as an environmental advocate. As for when the technology being developed by the UCD team might hit the commercial market, Brandman tells us that other technologies in the BCI space, such as those from Neuralink and others, are all working on tech with the same sorts of goals. His team’s objective is just to prove that BCI systems are more than just dead-end laboratory experiments. “My job is to derisk it,” Brandman told us. He likened the current state of BCI technology to early pacemakers, which started off in the 1950s having to be wired to hardware outside the body that was often connected to large batteries or directly tethered to the wall. Fast forward seventy years, and pacemakers are so simple to implant they’re often done in an outpatient procedure. “We’re at the early stages of this kind of technology,” Brandman said. “Casey has demonstrated that this kind of tech is practical.” Harrell may be wired up to a bunch of bulky external computers now, but combine the Davis UCD team’s AI advancements with the hardware work being done by other firms, and the future looks brighter for a lot of people whose lives are limited by paralysis and other impairments. “I want desperately to not be unique or special, because that will mean I no longer have the disease or that everyone that has the disease like me can get [BCI] prescribed to them,” Harrell said. BrainGate is currently accepting applications for future study participants. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5256515&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5256515&amp;width=800" />
            </item>
    <item>
        <guid isPermaLink="true">https://www.theregister.com/a/5256461</guid>
        <link>https://www.theregister.com/security/2026/06/16/three-critical-fortinet-sandbox-bugs-splattered-by-unknown-attackers/5256461</link>
        <pubDate>Tue, 16 Jun 2026 20:27:12 +0200</pubDate>
        <title>Three critical Fortinet sandbox bugs splattered by unknown attackers</title>
        <description><![CDATA[ All have patches, so make sure you upgrade to a fixed version ]]></description>
        <category>security</category>
                <lab:kicker><![CDATA[ Security ]]></lab:kicker>
                <content:encoded><![CDATA[ Three critical flaws in Fortinet’s sandbox that allow remote attackers to bypass authentication, escalate privileges, and execute malicious code are under active exploitation, according to threat intelligence firm Defused. Fortinet patched two of the three flaws, CVE-2026-39813 and CVE-2026-39808, in April and the third, CVE-2026-25089 last week. All three bugs received 9.1 CVSS ratings, and, at the time, the vendor said that there were no reports of active exploitation. CVE-2026-39813 is a path traversal bug in the FortiSandbox JRPC API that allows an authentication bypass using specially crafted HTTP requests. It affects FortiSandbox 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5. Patch to 4.4.9+ or 5.0.6+, depending on the branch, to fix the flaw. Fortinet security analyst Loic Pantano found this one. CVE-2026-39808 is an OS command injection flaw in FortiSandbox that allows unauthenticated attackers to execute unauthorized code or commands via HTTP requests. It affects versions 4.4.0 through 4.4.8, and upgrading to FortiSandbox 4.4.9 or above patches the hole. Fortinet credited KPMG Spain researcher Samuel de Lucas Maroto with finding and reporting this bug. Finally, CVE-2026-25089 is another OS command vulnerability in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI that allows unauthenticated attackers to execute unauthorized commands using specifically crafted HTTP requests. FortiSandbox 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5, FortiSandbox Cloud 5.0.4 through 5.0.5, and FortiSandbox PaaS 5.0.4 through 5.0.5 are vulnerable. Upgrading to a fixed version patches the hole. Fortinet did not respond to The Register’s inquiries about these three CVEs and if the vendor had also observed any attacks against them. According to Defused, the exploitation began over the weekend. “We are observing exploitation of multiple Fortinet FortiSandbox vulnerabilities during the past 24 hours,” the threat-intel firm said in a LinkedIn post on Monday. “Per our research a working exploit for CVE-2026-25089 has not yet been publicly disclosed,” the company added, noting that the exploit for this flaw appeared to be vibe coded and may be faulty. We do know that all manner of miscreants love to abuse Fortinet flaws, so if you haven’t already, patch now. Earlier this month, Check Point VP of research Lotem Finkelstein warned that ransomware crims had exploited a critical authentication bypass vulnerability affecting Fortinet's Remote Access VPN and Mobile Access deployments, and said that the same crew was also likely abusing other VPN-related vulnerabilities in Fortinet products. ® ]]></content:encoded>
                <enclosure url="https://image.theregister.com/?imageId=5256503&amp;width=800" type="image/jpeg" />
                <media:thumbnail url="https://image.theregister.com/?imageId=5256503&amp;width=800" />
            </item>
</channel>
</rss>