Enlarge (credit: Getty Images)

In a joint advisory published Wednesday, the US FBI and CISA (Cybersecurity and Infrastructure Security Agency), the Australian Cyber Security Center, and the UK’s National Cyber Security Center listed the top 30 or so most exploited vulnerabilities. The vulnerabilities reside in a host of devices or software marketed by the likes of Citrix, Pulse Secure, Microsoft, and Fortinet.

“Cyber actors continue to exploit publicly known—and often dated—software vulnerabilities against broad target sets, including public and private sector organizations worldwide,” the advisory stated. “However, entities worldwide can mitigate the vulnerabilities listed in this report by applying the available patches to their systems and implementing a centralized patch management system.”

Enlarge / Eric Schmitt, Missouri Attorney General. (credit: Getty | Bloomberg)

Missouri has been one of the hardest-hit states so far in these early days of a delta-fueled COVID-19 surge. Cases increased nearly 500 percent since the start of July, while vaccinations stalled. Right now, with just 41 percent of the state fully vaccinated, 112 of the state’s 114 counties have high or substantial levels of coronavirus spread. Hospitalizations are up statewide, and some facilities have already run out of ventilators and seen intensive care units hit maximum capacity. Deaths are also increasing, with more than 300 people losing their lives this month since July 1. And the proportion of COVID-19 tests coming back positive is still rising, suggesting that things will likely only get worse in the weeks to come.

By nearly every metric, this entirely preventable surge is tragic. Yet, it hasn’t stopped the Show Me State’s Republican attorney general, Eric Schmitt, from waging war on local health restrictions aimed at trying to curb transmission. On Monday, Schmitt filed a lawsuit to stop St. Louis County and St. Louis City from enforcing mask mandates for fully vaccinated people and children, which took effect that day.

The timing of the lawsuit is awkward. It partly rests on now-outdated guidance from the Centers for Disease Control and Prevention that fully vaccinated people didn’t need to wear masks in most indoor settings. “The Mask Mandates are arbitrary and capricious because they require vaccinated individuals to wear masks, despite the CDC guidance that this is not necessary,” the lawsuit claims. The rest of the lawsuit didn’t argue that masks were ineffective at curbing transmission but rather claimed that they were unnecessary for children—despite that they are largely ineligible for vaccinations—and that requiring them is “unconstitutional.” Otherwise, the lawsuit nitpicked language of the mandates, such as alleging that they didn’t define the word “dwelling.”

Enlarge / President Joe Biden speaks at Mack Truck Lehigh Valley Operations on July 28, 2021, in Macungie, Pennsylvania. (credit: Getty Images | Michael M. Santiago)

President Joe Biden pledged early in his term to lower Internet prices, and this appears to be the first tangible result—although it will only affect ISPs that take the new funding, and the White House didn’t release key details about the affordable Internet plans. A White House fact sheet on the $550 billion infrastructure deal with senators included two paragraphs summarizing the broadband portions:

[M]ore than 30 million Americans live in areas where there is no broadband infrastructure that provides minimally acceptable speeds—a particular problem in rural communities throughout the country. The deal’s $65 billion investment ensures every American has access to reliable high-speed Internet with a historic investment in broadband infrastructure deployment, just as the federal government made a historic effort to provide electricity to every American nearly one hundred years ago.

The bill will also help lower prices for Internet service by requiring funding recipients to offer a low-cost affordable plan, by creating price transparency and helping families comparison shop, and by boosting competition in areas where existing providers aren’t providing adequate service. It will also help close the digital divide by passing the Digital Equity Act, ending digital redlining, and creating a permanent program to help more low-income households access the Internet.

“Low-cost” definition not released yet

The announcement didn’t say what speeds or prices will have to be offered by government-funded ISPs in the required low-cost plans. It also didn’t say whether those low-cost plans would be available to all customers or only those who meet certain income requirements.

Enlarge / Artist’s reconstruction of Thomas Cromwell’s mansion on Throgmorton Street in 1539, London, England. (credit: Peter Urmston)

Tudor England was a treacherous place for ambitious courtiers, as the steady rise and sudden tragic fall of Thomas Cromwell—one of the chief architects of the English Reformation under King Henry VIII—makes clear. Cromwell had just completed work on a magnificent private mansion in London when he fell out of the king’s favor and was summarily beheaded. Now, a British historian has produced the most detailed analysis yet of both that mansion and the townhouse in which Cromwell lived prior to its completion, presented in a new paper published in the Journal of the British Archaeological Association.

“These two houses were the homes of this great man; they were the places where he lived with his wife and two daughters, where his son grew up,” said Nick Holder, a historian and research fellow at English Heritage and the University of Exeter, who authored the new paper. “It was also the place he went back to at night after being with Henry VIII at court and just got on with the hard graft of running the country. No one else has looked at these two houses in quite as much detail, comparing all the available evidence. This is about as close as you are going to get to walking down these 16th-century corridors.”

There was a time when historians considered Thomas Cromwell to be a rather insignificant court figure during Henry VIII’s reign. That view began to shift in the 1950s as historians realized just how much Cromwell may have influenced the king and Parliament during a particularly chaotic period in British history. Much of that chaos, it must be said, stemmed from the monarch’s impetuous nature, particularly when it came to wives.

Enlarge / Sure, it’s cheaply produced clip art… but it’s also a disturbingly accurate picture of the current state of supply and demand in the semiconductor product market. (credit: tommy via Getty Images)

2021’s infamous chip shortages aren’t only affecting automakers. In a post-earnings conference call Tuesday, Apple CEO Tim Cook said, “We’ll do everything we can to mitigate whatever circumstances we’re dealt”—a statement that likely means the company will ration its chip supplies, prioritizing the most profitable and in-demand items such as iPhones and AirPods, at the expense of less profitable and lower-demand items.

CFRA analyst Angelo Zino told Reuters that Cook’s somewhat cryptic statement “largely reflects the timing of new product releases”—specifically, new iPhone releases in September. Counterpoint Research Director Jeff Fieldhack speculates from the flip side of the same coin, saying the company will likely direct supply chain “pain” to its least lucrative products. “Assuming Apple prioritizes the iPhone 12 family, it probably affects iPads, Macs, and older iPhones more,” Fieldhack said.

Processor manufacturer AMD has also been carefully managing its supply chain in response to pandemic-induced shortages. With flagship products that finally outperform rival Intel’s, AMD is focusing on the more profitable high end of the market while leaving the economy segment—until a few years ago, its strongest performer—to Intel. “We’re focusing on the most strategic segments of the PC market,” CEO Lisa Su told investors on a conference call.

Enlarge (credit: Getty Images | Charles O’Rear)

Philip Cooke, former senior manager of security operations for eBay’s Global Security Team, pleaded guilty in October 2020 to one count of conspiracy to commit cyberstalking and one count of conspiracy to commit witness tampering. He was sentenced to 18 months in federal prison on each charge, with the two sentences to be served concurrently, according to an order issued in US District Court for the District of Massachusetts. He was also fined $15,000 and sentenced to supervised release of three years after he gets out of prison.

The Department of Justice alleged that in 2019, Cooke helped plan and attempt to cover up the stalking of Ina and David Steiner of Natick, Massachusetts, who run the news website EcommerceBytes. Cooke was one of seven eBay employees accused of harassment involving sending threatening messages and deliveries of live cockroaches, a funeral wreath, and a bloody pig mask to the couple’s home. Several conspirators allegedly traveled from California to Massachusetts to conduct surveillance on the couple, but Cooke was not among them. Cooke wasn’t included in the initial charges filed in June 2020 but was charged a few weeks later.

Enlarge (credit: Google Drive)

Google is changing the way content sharing works on Drive. Drive files have two sharing options: a single-person allow list (where you share a Google Doc with specific Google accounts) and a “get link” option (where anyone with the link can access the file). The “get link” option works the same way as unlisted YouTube videos—it’s not really private but, theoretically, not quite public, either, since the link needs to be publicized somewhere. The secret sharing links are really just security through obscurity, and it turns out the links are actually guessable.

Along with Drive, Google is also changing the way unlisted YouTube links work, and the YouTube support page actually describes this change better than Drive does:

Enlarge / US President Joe Biden, NATO Secretary General Jens Stoltenberg and Belgian Prime Minister Alexander De Croo attend a plenary session of a NATO summit at the North Atlantic Treaty Organization (NATO) headquarters in Brussels, on June 14, 2021. (credit: Laurie Dieffembacq | Getty Images)

Biden said on Tuesday that cyber threats including ransomware attacks “increasingly are able to cause damage and disruption in the real world.”

“If we end up in a war, a real shooting war with a major power, it’s going to be as a consequence of a cyber breach,” the president said in a speech at the Office for the Director of National Intelligence, which oversees 18 US intelligence agencies.

Enlarge (credit: Howard Kingsnorth / Getty Images)

We’ve known for decades that tropical rainforests are special. They’re nearly unrivaled in biodiversity, and research has shown that they absorb more carbon dioxide than any other ecosystem. A recent study showed that the tropics sequester four times as much carbon dioxide as temperate and boreal ecosystems combined—and several studies have estimated that all terrestrial ecosystems combined sequester as much as 30 percent of the total carbon dioxide in the atmosphere each year.

We’ve also known for decades that these ecosystems are at risk of vanishing. As much as 20 percent of tropical rainforests have been cleared in the last 30 years, with an additional 10 percent lost to degradation. Beyond these direct threats, forests worldwide, and especially rainforests, are experiencing severe losses due to climate change—notably higher temperatures and drought.

Until now, there haven’t been means to systematically keep tabs on the health of these critical ecosystems. But a collaboration of nearly 50 institutions has recently developed a comprehensive index to measure the health and vulnerability of all tropical rainforests around the world. The result is a potential warning system that allows scientists and policymakers to monitor and prioritize which forests are at the highest risk of irreversible damage and loss.

Enlarge / Mark Zuckerberg demonstrates an Oculus Rift headset at a 2016 event. (credit: David Paul Morris/Bloomberg via Getty Images)

Over the past week, the social media company has blitzed media outlets with news about its “metaverse” initiative, a plan to create virtual worlds where people can interact to play games, have meetings, and so on. Last week, CEO Mark Zuckerberg shared his metaverse plans with the public in an interview with The Verge. Then, earlier this week, Facebook announced that it would be putting together a metaverse team staffed with a handful of longtime VPs.

It’s clear that Zuckerberg has been thinking about this metaverse idea for a while. But the timing of Facebook’s announcement is interesting, to say the least. Facebook has “a history of doing these kinds of technical projects that look like they might be revolutionary at times when they’re being criticized for their lack of social responsibility,” Jen Goldbeck, a computer scientist and professor at the University of Maryland, told Ars.

Enlarge / Activision Blizzard CEO Bobby Kotick. (credit: Flickr / bobby-kotick)

Ahead of Wednesday’s planned “Walkout for Equality” among Activision Blizzard employees, CEO Bobby Kotick has issued a new statement criticizing the company’s initial response as “tone deaf” and promising immediate and ongoing action on some issues raised by employees.

After acknowledging what he called a “difficult and upsetting week,” Kotick praised the “courage” of employees who have come together so far. “We will do a better job of listening now and in the future,” Kotick said. “It is imperative that we acknowledge all perspectives and experiences and respect the feelings of those who have been mistreated in any way. I am sorry that we did not provide the right empathy and understanding.”

As part of a commitment to “long-lasting change,” Kotick said the company will be taking the following actions immediately:

Enlarge / Peter Beck, founder of Rocket Lab, is seen as essential to Rocket Lab’s success. (credit: Rocket Lab)

These are the kinds of details we rarely see in the often financially opaque launch business, but as part of the process of converting into a publicly traded Special Purpose Acquisition Company, Rocket Lab had to make extensive financial disclosures. The full 712-page document can be downloaded here.

Enlarge (credit: Getty Images)

Both groups say they are aiming for big-game targets, meaning corporations or other large businesses with the pockets to pay ransoms in the millions of dollars. The additions come as recent ransomware intrusions of oil pipeline operator Colonial Pipeline, meat packer JBS SA, and managed network provider Kaseya have caused major disruptions and created pressure in Washington to curb the threats.

Haron: like Avaddon. Or maybe not

The first group is calling itself Haron. A sample of the Haron malware was first submitted to VirusTotal on July 19. Three days later, South Korean security firm S2W Lab discussed the group in a post.