Join our Folding@Home team:
Main F@H site
Our team page
Support us: Subscribe Here
and buy SoylentNews Swag
We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.
On February 1, Robert Tinney, the illustrator whose airbrushed cover paintings defined the look and feel of pioneering computer magazine Byte for over a decade, died at age 78 in Baker, Louisiana, according to a memorial posted on his official website.
As the primary cover artist for Byte from 1975 to the late 1980s, Tinney became one of the first illustrators to give the abstract world of personal computing a coherent visual language, translating topics like artificial intelligence, networking, and programming into vivid, surrealist-influenced paintings that a generation of computer enthusiasts grew up with.
Incident is at least the third time the exchange has been targeted by thieves:
Open source packages published on the npm and PyPI repositories were laced with code that stole wallet credentials from dYdX developers and backend systems and, in some cases, backdoored devices, researchers said.
"Every application using the compromised npm versions is at risk ...." the researchers, from security firm Socket, said Friday. "Direct impact includes complete wallet compromise and irreversible cryptocurrency theft. The attack scope includes all applications depending on the compromised versions and both developers testing with real credentials and production end-users."
Packages that were infected were:
dYdX is a decentralized derivatives exchange that supports hundreds of markets for "perpetual trading," or the use of cryptocurrency to bet that the value of a derivative future will rise or fall. Socket said dYdX has processed over $1.5 trillion in trading volume over its lifetime, with an average trading volume of $200 million to $540 million and roughly $175 million in open interest. The exchange provides code libraries that allow third-party apps for trading bots, automated strategies, or backend services, all of which handle mnemonics or private keys for signing.
[...] The malicious code available on PyPI contained the same credential theft function, although it also implemented a remote access Trojan (RAT) that allowed the execution of new malware on infected systems. The backdoor received commands from dydx[.]priceoracle[.]site. The domain was registered on January 9, 17 days before the malicious package was uploaded to PyPI.
The RAT, Socket said:
- Runs as a background daemon thread
- Beacons to the C2 server every 10 seconds
- Receives Python code from the server
- Executes it in an isolated subprocess with no visible output
- Uses a hardcoded authorization token: 490CD9DAD3FAE1F59521C27A96B32F5D677DD41BF1F706A0BF85E69CA6EBFE75
Once installed, the threat actors could:
- Execute arbitrary Python code with user privileges
- Steal SSH keys, API credentials, and source code
- Install persistent backdoors
- Exfiltrate sensitive files
- Monitor user activity
- Modify critical files
- Pivot to other systems on the network
Socket said the packages were published to npm and PyPI by official dYdX accounts, an indication that they were compromised and used by the attackers. dYdX officials didn't respond to an email seeking confirmation and additional details.
The incident is at least the third time dYdX has been targeted in attacks. Previous events include a September 2022 uploading of malicious code to the npm repository and the commandeering in 2024 of the dYdX v3 website through DNS hijacking. Users were redirected to a malicious site that prompted them to sign transactions designed to drain their wallets.
"Viewed alongside the 2022 npm supply chain compromise and the 2024 DNS hijacking incident, this [latest] attack highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels," Socket said. "The threat actor simultaneously compromised packages in both npm and PyPI ecosystems, expanding the attack surface to reach JavaScript and Python developers working with dYdX."
Anyone using the platform should carefully examine all apps for dependencies on the malicious packages listed above.
The study, from academics at Cardiff University, Loughborough University and the University of Oxford, used computer software to analyse the range of nouns and adjectives used in 33 of his best-selling Discworld novels.
The results show a significant decrease in the diversity of nouns and adjectives in his later works. This shift was particularly marked in the diversity of adjectives, which decreased below a defined threshold approximately ten years before Pratchett's formal diagnosis.
Sir Terry Pratchett died in 2015 at the age of 66. He had posterior cortical atrophy, a rare form of early-onset Alzheimer's disease that primarily affects visual processing.
Study co-author Dr Melody Pattison, based at Cardiff University's School of English, Communication and Philosophy, said: "Our analysis of Sir Terry Pratchett's novels suggests that subtle changes in linguistic patterns, such as decreased lexical diversity, may precede clinical diagnosis of dementia by a considerable margin. In particular we found the richness of descriptive language in his books gradually narrowed."
We would normally expect less lexical diversity as texts get longer, but even after controlling for text length our findings were still significant. This was not something a reader would necessarily notice, but rather a subtle, progressive change. --Dr Melody Pattison
[...] "Research indicates that memory problems may not be the first symptom of dementia. We wanted to explore whether language could be an early warning sign, and to do this, we used Sir Terry Pratchett's books, who himself suffered dementia.
"Our analysis found that Sir Terry's use of language did indeed change during his career. These results suggest that language may be one of the first signs of dementia, and Sir Terry's books reveal a potential new approach for early diagnosis."
Journal Reference: Brain Sci. 2026, 16(1), 94; https://doi.org/10.3390/brainsci16010094
A team of physicists at MIT has managed to do something long thought impossible: peer into the ultrafast, quantum-scale motion of superconducting electrons. Using a microscope built around pulses of terahertz light – radiation oscillating trillions of times per second – they've captured a kind of atomic dance that has remained hidden until now.
The implications of the breakthrough could ripple through multiple industries. A better understanding of how superconductivity behaves at quantum scales could accelerate the development of room-temperature superconductors, radically improving electrical grids, quantum computers, and magnetic levitation systems.
The underlying terahertz technology itself – capable of transmitting and detecting signals at unprecedented speeds – could shape the future of wireless communications, sensing devices, and ultrafast data transfer for next-generation electronics.
The development, described in Nature, centers on bismuth strontium calcium copper oxide (BSCCO), a copper-based superconductor known for carrying electricity without resistance at relatively high temperatures.
When hit with precisely tuned terahertz bursts, the electrons inside the material began to move collectively, vibrating in unison at the same frequencies as the light itself. MIT physicist Nuh Gedik calls this previously unseen motion "a new mode of superconducting electrons."
The feat was accomplished using a terahertz microscope capable of compressing radiation that typically stretches hundreds of microns long down to the tiny scale of a quantum material. Terahertz radiation sits between microwaves and infrared on the electromagnetic spectrum, an energy range considered a sweet spot for imaging because it's non-ionizing, penetrates deeply, and matches the natural oscillation rate of atoms and electrons.
Yet until now, it's been all but useless for imaging small structures because of a fundamental barrier called the diffraction limit – light can't be focused to a spot smaller than its own wavelength.
MIT postdoctoral researcher Alexander von Hoegen and colleagues found a way to beat that limitation. They used a spintronic emitter, a layered metallic structure that generates sharp terahertz pulses when hit by a laser.
By placing microscopic samples extremely close to this source, the researchers trapped the light before it could spread out, focusing the energy into a region much smaller than its wavelength. That confinement allowed the microscope to resolve features that had been invisible under conventional terahertz illumination.
The design integrates the emitter with a Bragg mirror – a stack of ultrathin reflective layers that filter unwanted light while allowing the desired terahertz frequencies through. This setup protects the fragile sample from the optical laser but preserves the high-frequency terahertz signals scientists want to study.
In their first experiment, the researchers cooled a BSCCO sample to near absolute zero, where it enters its superconducting phase. As terahertz pulses moved through the chilled material, detectors picked up faint oscillations in the returning field – a telltale sign that electrons inside were moving collectively like a frictionless fluid.
The team compared the signals to theoretical predictions and confirmed that they had, for the first time, imaged the quantum superfluid motion itself. "It's this superconducting gel that we're sort of seeing jiggle," von Hoegen explained.
The visualization offers a new window into the quantum dynamics of superconductors and could help uncover factors that might one day enable superconductivity at room temperature – a long-sought goal in physics and energy technology.
Von Hoegen sees broad implications beyond basic physics. Future terahertz microscopes, he said, could study signal propagation in nanoscale antennas or sensors designed for terahertz-frequency telecommunications – the next frontier beyond today's Wi-Fi and millimeter-wave systems.
"There's a huge push to take Wi-Fi or telecommunications to the next level, to terahertz frequencies," he said. "If you have a terahertz microscope, you could study how terahertz light interacts with microscopically small devices that could serve as future antennas or receivers."
With the new microscope now operational, the team plans to explore other two-dimensional materials known for exotic electronic behaviors, hoping to capture their internal vibrations in the terahertz domain. Each experiment, they say, brings them closer to understanding how electrons cooperate when friction disappears – and what that could mean for the future of electronic materials.
Reference:
"Imaging a terahertz superfluid plasmon in a two-dimensional superconductor" - A. von Hoegen, T. Tai, C. J. Allington, M. Yeung, J. Pettine, M. H. Michael, E. Viñas Boström, X. Cui, K. Torres, A. E. Kossak, B. Lee, G. S. D. Beach, G. D. Gu, A. Rubio, P. Kim & N. Gedik: DOI https://www.nature.com/articles/s41586-025-10082-2
... have you no sense of decency, sir?
(Attorney Joseph Welch, 1954 Army‑McCarthy hearings)
"The European Commission, in a comprehensive decade-long effort, has successfully pressured social media platforms to change their global content moderation rules, thereby directly infringing on Americans' online speech in the United States. Though often framed as combating so-called "hate speech" or "disinformation," the European Commission worked to censor true information and political speech about some of the most important policy debates in recent history—including the COVID-19 pandemic, mass migration, and transgender issues. After ten years, the European Commission has established sufficient control of global online speech to comprehensively suppress narratives that threaten the European Commission's power."
Thus opens a February 3 report [PDF] of the Committee on the Judiciary of the US House of Representatives.
The report is a long, long through-the-looking-glass argument against the European Union's Digital Services Act (DSA), specifically its Code of Practice on Disinformation.
That DSA, goes the argument -- with a long list of screenshots of heavily redacted e-mails, and the occasional Fox News article as source -- has been used to gang-pressure a whole bunch of election campaigns in European countries: France (2024), the Netherlands (2023 & 2025), Slovakia (2023), Moldova (2024), Germany, Ireland (2024 & 2025), and Romania. Romania's 2024 presidential election is a particularly nasty example, with the EU and France pressuring Telegram and TikTok to block content associated with conservative candidate Călin Georgescu, despite the absence of evidence supporting allegations of Russian interference used to justify those actions (says the report). [Paywalled]
What the report also -- inadvertently -- highlights is how the European Union (and Australia, Japan, South-Korea and Canada) and the United States are diverging on the treatment of social media.
Out of the EU's 27 member states, 15 of them have a partial or complete ban on smartphone usage in schools in place. Nine EU countries -- Spain, Greece, France, Italy, Finland, Germany, Denmark, Austria and Portugal -- are currently discussing a ban on social media usage under a certain age (mostly around 15, 16): a debate driven by concerns about addiction, mental health impact, and the spread of harmful content.
South Korea has implemented a school‑wide phone‑ban since 2024 and is actively discussing, but has not yet legislated, a social‑media age limit for minors. Japan is considering age‑restriction policies and has a government‑led working group, but there is currently no legal ban on smartphones in schools nor a statutory social‑media age limit. In Canada, most provinces have mandatory school-wide bans, but there is no age limit being discussed (yet), while Australia has no ban on smartphone usage, but is the first to have a federal law barring under-16s of having accounts on major social media platforms.
Get 'em while they're young, I guess.
Stellantis says it overestimated the EV transition and is shifting back to hybrids, V8s, and what customers actually want:
Stellantis took a €22.2 billion ($26.25 billion) write-down last year, tied largely to scaling back electric vehicle programs. But buried inside the numbers is a much bigger message: the company openly acknowledged it moved faster than customers were ready to follow. According to Stellantis and Reuters, the automaker is now rebuilding its strategy around real-world demand rather than aggressive electrification targets.
CEO Antonio Filosa was unusually direct in Stellantis's announcement, saying the company "over-estimated the pace of the energy transition" and allowed their pre-planned strategy to overpower what buyers actually want. The result was billions written off in canceled EV products, impaired electric platforms, and downsized battery operations. Keep in mind, Stellantis had once aimed for electric vehicles to make up 50% of U.S. sales and all European sales by 2030, despite EV adoption in America sitting at 7%.
That disconnect is now being corrected, with Stellantis shifting capital back toward hybrids and internal combustion models that align more closely with consumer wants. And it seems other automakers have the same idea in mind, with even Porsche rumored to abandon the all-electric 718. To add fuel to the fire, there are countless players in the EV segment nowadays, with Chinese automakers seeming to lead the pack. Pursuing a profitable full-electric approach has become more difficult than ever before.
Previously:
Beginning in March, all accounts will have a 'teen-appropriate experience by default'
Discord announced on Monday that it's rolling out age verification on its platform globally starting next month, when it will automatically set all users' accounts to a "teen-appropriate" experience unless they demonstrate that they're adults.
"For most adults, age verification won't be required, as Discord's age inference model uses account information such as account tenure, device and activity data, and aggregated, high-level patterns across Discord communities. Discord does not use private messages or any message content in this process," Savannah Badalich, Discord's global head of product policy, tells The Verge.
Users who aren't verified as adults will not be able to access age-restricted servers and channels, won't be able to speak in Discord's livestream-like "stage" channels, and will see content filters for any content Discord detects as graphic or sensitive. They will also get warning prompts for friend requests from potentially unfamiliar users, and DMs from unfamiliar users will be automatically filtered into a separate inbox.
RelatedDirect messages and servers that are not age-restricted will continue to function normally, but users won't be able to send messages or view content in an age-restricted server until they complete the age check process, even if it's a server they were part of before age verification rolled out. Badalich says those servers will be "obfuscated" with a black screen until the user verifies they're an adult. Users also won't be able to join any new age-restricted servers without verifying their age.
[...] If Discord's age inference model can't determine a user's age, a government ID might still be required for age verification in its global rollout. According to Discord, to remove the new "teen-by-default" changes and limitations, "users can choose to use facial age estimation or submit a form of identification to [Discord's] vendor partners, with more options coming in the future."
The first option uses AI to analyze a user's video selfie, which Discord says never leaves the user's device. If the age group estimate (teen or adult) from the selfie is incorrect, users can appeal it or verify with a photo of an identity document instead. That document will be verified by a third party vendor, but Discord says the images of those documents "are deleted quickly — in most cases, immediately after age confirmation."
Badalich also says after the October data breach, Discord "immediately stopped doing any sort of age verification flows with that vendor" and is now using a different third-party vendor. She adds, "We're not doing biometric scanning [or] facial recognition. We're doing facial estimation. The ID is immediately deleted. We do not keep any information around like your name, the city that you live in, if you used a birth certificate or something else, any of that information."
[...] Even so, there's still a risk that some users will leave Discord as a result of the age verification rollout. "We do expect that there will be some sort of hit there, and we are incorporating that into what our planning looks like," Badalich says. "We'll find other ways to bring users back."
Or it might just be destroyed by the Sun. It's a tough call:
It's been a while since we've had a Great Comet in the sky, something bright and visible for many. Currently, no object appears to fit the bill for 2026, but a couple of comets have a chance to become bright enough to be visible to the naked eye this April. In fact, a newly discovered Kreutz sungrazer has a very good chance of doing that.
The object is known as C/2026 A1 (MAPS), discovered extremely recently on January 20 by a group of French amateur astronomers using the AMACS1 Observatory in the Atacama Desert, Chile. It has been traced back to the Kreutz comet group, a group that has some of the brightest comets ever seen, like the Great Comet of 1843.
Like other members of this group, it comes from below the plane of the Solar System. It will have its perihelion, its closest approach to the Sun, on April 4. At perihelion, the comet will be just 810,000 kilometers (about 500,000 miles) from our star. In comparison, interstellar comet 3I/ATLAS's perihelion in October 2025 saw it fly around 200 million kilometers (124 million miles) from the Sun.
Sungrazing comets can become very bright for quite a while, or very bright for a very short time, or just get ripped apart. We'll have to wait and see. It is already a record-breaker, however. No inbound Kreutz comet has ever been spotted so far from the Sun with such a long lead-in time (11.5 weeks) before reaching perihelion.
"It's moving on an orbit typical of Kreutz sungrazing comets, and already holds one record. At the time of its discovery, comet MAPS was farther from the Sun than any previous newly discovered sungrazer," Jonti Horner wrote in The Conversation. "That suggests it might be a larger-than-usual fragment—perhaps."
The previous record holder was Comet Ikeya–Seki, another Kreutz sungrazer, which passed almost half as close and was so bright it was even visible during the day. It was discovered one month before its perihelion in 1965. It is one of the brightest in a millennium and definitely the brightest of the 20th century. Comet Ikeya-Seki was also very large and still broke apart into three pieces following the encounter with the Sun. This new comet is unlikely to be this large.
Comet MAPS is currently expected to become almost as bright as Venus as it passes by the Sun. That is obviously a very bright comet, but it doesn't mean it will be a more classical bright comet. Millennials and older folks may remember that in 1996 and 1997, the sky blessed us with two brightly visible comets: Hyakutake and Hale-Bopp. It's unlikely to look like either of them.
In the aftermath of its close encounter, the comet will be visible more favorably in the Southern Hemisphere. It will definitely be visible for solar observatories like SOHO, so we should get some good images.
You might remember we said there were two comets of interest. If Comet MAPS doesn't pan out, there's always the chance that Comet C/2025 R3 (PanSTARRS) will be very bright after it reaches perihelion on April 19.
After years of bolting AI onto everything, Redmond remembers admins exist:
There is good news for administrators: Microsoft has delivered on its promise to build Sysmon functionality into Windows.
The functionality arrived in the Dev and Beta Windows Insider channels this week in builds 26300.7733 and 26220.7752, respectively. It allows administrators to capture system events via custom configuration files, filter for specific events, and write them to the standard Windows event log for pickup by third-party applications, including security tools.
Sysmon, part of the Sysinternals toolset, has long been useful for monitoring Windows' internals. Mark Russinovich, Microsoft technical fellow and co-founder of Winternals, from whence Sysinternals (and Sysmon) sprang, said: "It helps in detecting credential theft, uncovering stealthy lateral movement, and powering forensic investigations.
"Its granular diagnostic data feeds security information and event management (SIEM) pipelines and enables defenders to spot advanced attacks."
But deployment has been painful for administrators, managing potentially thousands of endpoints across an enterprise that need to be kept. Russinovich noted "a lack of official customer support for Sysmon in production environments."
Having it built in (though disabled by default) is therefore welcome, a respite from Microsoft's relentless AI integrations across its portfolio.
Enabling it requires some work with PowerShell, which shouldn't trouble Sysmon-savvy users. Microsoft notes that any existing Sysmon installation must be uninstalled first before the built-in version can be enabled.
After a month of patches that Microsoft would rather forget, Sysmon's arrival is a genuinely positive update.
When reading my local newspaper online this morning, I noticed for the first time a small message, lower-left of the window, "Opt-Out Signal Honored". A little quick searching turned up GPC, Global Privacy Control https://globalprivacycontrol.org/
The GPC signal is intended to communicate a Do Not Sell or Share request under the California Consumer Privacy Act, and similar state privacy laws that allow users to opt out of data sales or the use of their data for cross-context targeted advertising. Under the GDPR, the intent of the GPC signal is to convey a general request that data controllers limit the sale or sharing of the user's personal data to other data controllers (GDPR Articles 7 & 21). The GPC may also invoke other compatible rights in other jurisdictions.
A little more digging shows that SN covered this in late 2020 (five+ years ago), https://soylentnews.org/article.pl?sid=20/10/08/0119236 but at that time it was in the FSF Privacy Badger--which I was already using back then.
So my first thought is that all of a sudden my state (not California) has turned on a similar rule. But then, my partner's Win11 PC (no Privacy Badger) gave the same message on a consumer company catalog page (from yet a third state)--so maybe the message is coming from somewhere else? We do both use Firefox, but I'm on ESR (for Win7) and they are on the main track.
Why did the message start to appear today? Does GPC actually work? Any relation to the European GDPR?
The campaign allegedly cost $15 million for the ads, $70 million for the domain name.
AI.com bought its way onto the biggest advertising stage in the world on Sunday night, running a fourth-quarter Super Bowl ad spot that told tens of millions of sports fans worldwide to head to the site and create a handle. Hyped-up viewers arrived in droves, and then the site crashed.
Within minutes of the ad airing, users across social platforms reported that AI.com was either unreachable or stuck in failed sign-up loops, turning what was meant to be the site's big launch moment into an unexpected stress test that failed right before the eyes of millions. The company soon restored its service, but first impressions count.
In a post on X.com, co-founder and CEO Kris Marszalek, best known as the CEO of Crypto.com, said that the company had "prepared for scale, but not for THIS," later attributing the disruption to external factors outside the company's control. Marszalek later wrote that the website was "hitting Google rate limits (which are at their absolute global maximum)."
Linus Torvalds Confirms The Next Kernel Is Linux 7.0:
Following Linus Torvalds releasing Linux 6.19 stable, Linus Torvalds is now out with his customary release announcement. Notably he officially confirmed that the next kernel version is Linux 7.0 as the successor to Linux 6.19.
Linus Torvalds wrote in the Linux 6.19 release announcement:
"I have more than three dozen pull requests for when the merge window opens tomorrow - thank you to all the early maintainers. And as people have mostly figured out, I'm getting to the point where I'm being confused by large numbers (almost running out of fingers and toes again), so the next kernel is going to be called 7.0."
So it's on to the Linux 7.0 kernel cycle kicking off tomorrow. The Linux 7.0 merge window will run the next two weeks. Linux 7.0 stable will be out in mid-April as the kernel version also squeezing into Ubuntu 26.04 LTS.
There are a lot of exciting changes on the table for Linux 7.0.
Which also means, as Michael Larabel mentions in the above:
Linux 6.19 Released With Better Support For Older AMD GPUs, DRM Color Pipeline API:
As anticipated due to the extra week for the cycle given end of year holidays, Linus Torvalds today released the Linux 6.19 stable kernel as the first major release of 2026. There is a lot in store with this early 2026 kernel release.
Linux 6.19 as usual is especially heavy on Intel and AMD changes including AMD GCN 1.0 / GCN 1.1 dGPUs now defaulting to the AMDGPU driver rather than Radeon legacy driver for better performance, RADV compatibility out-of-the-box, etc. On the Intel side there is more enablement work for Wildcat Lake and Nova Lake platforms. Plus Intel Linear Address Space Separation (LASS) and Content Adaptive Sharpness Filter (CASF) are among the new features enabled. Linux 6.19 also mainlines the DRM Color Pipeline API backed by Valve, various file-system improvements, the ASUS Armoury and Uniwill platform drivers, and much more.
See the Linux 6.19 feature overview for a more extensive look at the changes of this new kernel.
If you're looking to protect your privacy while using any of the best iPhones, one of the most effective things you can do is limit how your location data is used. And with iOS 26.3 just around the corner, you'll soon have another way to keep your private data under lock and key.
That's because Apple is about to introduce a new feature in iOS 26.3 called Limit Precise Location. As the name implies, this is designed to reduce the information that can be gleaned from your location, and instead provides much more vague data to cellular providers.
In a new support document on Apple's website, the company outlines how Limit Precise Location works. After explaining that your location can be pinpointed based on the cell towers your phone connects to, Apple says its new setting restricts the information that's available to carriers in this way. That might mean they can only determine the rough neighborhood where you are located, for example, rather than a precise street address.
Apple also notes that this new feature does not limit "signal quality or user experience," and it also doesn't hinder first responders, as they can still see your exact location during an emergency.
In order to use it, you'll need to open the Settings app and tap Mobile Service Mobile Data Options, then enable the toggle next to Limit Precise Location. Your device needs to be restarted whenever you enable or disable this feature.
It's worth noting that this new feature comes with some conditions. For one thing, Apple says you need to have an iPhone Air, iPhone 16e, or iPad Pro with M5 chip and Wi-Fi plus cellular connectivity in order for the feature to work.
Your phone must also be running on a compatible network, as detailed below:
- Germany: Telekom
- United Kingdom: EE, BT
- United States: Boost Mobile
- Thailand: AIS, True
[...] All of this means the new feature is having a somewhat limited rollout for the time being. But as more Apple devices start to use the company's C1 and C1X modems – the ones outfitted in the compatible phones listed earlier – this kind of privacy-preserving tool should become the norm for Apple fans. And that's great news for anyone who wants to guard their privacy just a little more securely.
The window to patch vulnerabilities is shrinking rapidly:
Russian-state hackers wasted no time exploiting a critical Microsoft Office vulnerability that allowed them to compromise the devices inside diplomatic, maritime, and transport organizations in more than half a dozen countries, researchers said Wednesday.
The threat group, tracked under names including APT28, Fancy Bear, Sednit, Forest Blizzard, and Sofacy, pounced on the vulnerability, tracked as CVE-2026-21509, less than 48 hours after Microsoft released an urgent, unscheduled security update late last month, the researchers said. After reverse-engineering the patch, group members wrote an advanced exploit that installed one of two never-before-seen backdoor implants.
The entire campaign was designed to make the compromise undetectable to endpoint protection. Besides being novel, the exploits and payloads were encrypted and ran in memory, making their malice hard to spot. The initial infection vector came from previously compromised government accounts from multiple countries and were likely familiar to the targeted email holders. Command and control channels were hosted in legitimate cloud services that are typically allow-listed inside sensitive networks.
"The use of CVE-2026-21509 demonstrates how quickly state-aligned actors can weaponize new vulnerabilities, shrinking the window for defenders to patch critical systems," the researchers, with security firm Trellix, wrote. "The campaign's modular infection chain—from initial phish to in-memory backdoor to secondary implants was carefully designed to leverage trusted channels (HTTPS to cloud services, legitimate email flows) and fileless techniques to hide in plain sight."
The 72-hour spear phishing campaign began January 28 and delivered at least 29 distinct email lures to organizations in nine countries, primarily in Eastern Europe. Trellix named eight of them: Poland, Slovenia, Turkey, Greece, the UAE, Ukraine, Romania, and Bolivia. Organizations targeted were defense ministries (40 percent), transportation/logistics operators (35 percent), and diplomatic entities (25 percent).
[...] Trellix attributed the campaign to APT28 with "high confidence" based on technical indicators and the targets selected. Ukraine's CERT-UA has also attributed the attacks to UAC-0001, a tracking name that corresponds to APT28.
"APT28 has a long history of cyber espionage and influence operations," Trellix wrote. "The tradecraft in this campaign—multi-stage malware, extensive obfuscation, abuse of cloud services, and targeting of email systems for persistence—reflects a well-resourced, advanced adversary consistent with APT28's profile. The toolset and techniques also align with APT28's fingerprint."
Trellix has provided a comprehensive list of indicators organizations can use to determine if they have been targeted.
https://www.rs-online.com/designspark/a-fresh-look-at-ibm-3270-information-display-system
The IBM mainframe computer has evolved over a period spanning almost six decades and in part, this has been in response to wider industry trends, with notably the advent of "midrange" and personal computers, and the sweeping success of TCP/IP. However, the mainframe has also been responsible for delivering features and functionality which would only come much later to smaller systems, not to mention enduring and enviable reliability which is hard to beat today.
This post takes a look at the IBM 3270 Information Display System, which played a key role in enabling a single mainframe computer to scale and serve thousands of users. It should also be noted that, while discussing the system mostly in the past tense, the mainframe itself very much lives on and actually so does 3270, albeit nowadays as a protocol that is run on top of TCP/IP.