Nvidia is working with Wall Street heavyweights on a potential $500 billion financing package for AI infrastructure (source paywalled; alternative source). The consortium includes BlackRock's Global Infrastructure Partners, Brookfield Asset Management, Goldman Sachs and KKR. The Financial Times reports: The partnership underscores Nvidia's growing efforts to raise capital for itself and its clients to continue assembling the chips, power production and data centres at the heart of the AI boom. The $5.25 trillion company has positioned itself at the centre of the AI boom, providing chips, infrastructure and software to a wide array of partners developing the technology. Nvidia's graphics processing units, or GPUs, underpin most of the leading US AI models available today. [...] The biggest cloud-computing companies, including Meta, Oracle, Microsoft, Alphabet and Amazon, have dramatically increased their spending on AI infrastructure as they look to win the race to dominate the emerging technology. Morgan Stanley projects so-called hyperscalers will spend $3.5 trillion between 2026 and 2028. That need for capital has forced technology groups to tap every source of cash they can find, including public equity, investment-grade and high-yield bonds, securitized debt, private credit and project finance markets. "[The] sheer size of the AI infrastructure build-out is unprecedented," Jim Zelter, president of Apollo, said on an earnings call earlier this month. "More than $8 trillion of capital is expected to be invested, a staggering sum. We see an enormous opportunity for private capital to finance a portion of this along with public capital."

Read more of this story at Slashdot.

The previous GPG signing subkey was inadvertently added to a GitHub repository and Mozilla decided to revoke it.

The post Mozilla Issues New Firefox GPG Key Following Exposure appeared first on SecurityWeek.

An anonymous reader quotes a report from NPR: Billions of dollars are traded every week on the lightly regulated prediction market sites, where users bet on everything from movie reviews to elections to conflicts in the Middle East. Clinical trials are just the latest area where the industry's rapid growth is raising ethical questions. Kalshi claims such bets will provide a new source of information about which drugs will get approved, and what clinical trials will show promising results, which the company says can help investors decide what new drugs to fund. "If you want to ban profiting from the failure of clinical trials, you would start with the stock market, where the financial incentive for this type of profit is orders of magnitude larger," said Kalshi spokesman Jack Such, pointing to stock market short sellers who have profited from clinical trial failures. "While Kalshi and the stock market are the same in this regard, they do differ in one important way: the stock market doesn't give any valuable information to researchers," Such said. Drug trial researchers, though, are far from convinced. David Tsai, who runs clinical trials at a biotech company in the San Francisco Bay Area, started an online petition pushing for such betting to be banned, making the case that betting on drug trials "threatens the very foundation of trust and integrity in biotechnology." Tsai is concerned that the prospect of betting provides those involved with a clinical trial a reason to tamper with the results for a prediction market payout. "If we were running a trial for an oncology drug that requires an infusion, a pharmacist who had placed a bet saying that it's gonna work well, or doesn't work well, could obviously adjust the infusion rate, could adjust the source temperature of the drug," he said. "They could change any number of variables that could obviously have a direct impact [on] how the trial and the data and the patient safety would come out." Another skeptic is Nicholas Zaorsky, a professor of radiation oncology at the Mayo Clinic in Jacksonville, Fla., who has helped run clinical trials and agrees that prediction markets can interfere with the advancement of life-saving drugs. "Prediction markets can be valuable in some settings because they aggregate information, but clinical trials are fundamentally different: investigators, coordinators, and sometimes even participants can directly influence aspects of the outcomes being wagered on," Zaorsky said. "That creates financial incentives that risk undermining trial integrity." Bettors should not be rooting for an experimental medicine to fail just to earn a buck, says Joshua Pederson, the father of a 12-year-old cancer patient enrolled in a clinical trial. "It's a dark idea," he said. "It's quite ghastly." Kalshi, for its part, argues that its prediction markets could help patients track promising medical breakthroughs and clinical trials, enlisting experts including 23andMe founder Anne Wojcicki to make the case. "Most patients don't know about the choices available in clinical trials or which programs are most promising. The opportunity to have an open, transparent dataset about trial probabilities is extremely promising and empowering for people," a white paper sponsored by Kalshi stated.

Read more of this story at Slashdot.

Palo Alto Networks researchers have demonstrated attacks against Google’s synced passkey implementation.

The post New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts appeared first on SecurityWeek.

Trump Media has officially launched its $100,000-per-month data feed giving trading firms machine-readable access to Truth Social posts milliseconds before the public. According to Fortune, five Wall Street firms have already signed up for the service, which "would generate about $500,000 in monthly revenue, or $6 million annually." Critics argue the service could let President Trump, who owns about 41% of the company, profit from early access to market-moving presidential communications. "I'll be blunt," Gian Luca Clementi, an economics professor at NYU Stern School of Business, told Fortune. "This is insider trading by definition." "He's going to monetize the role of the office of the president of the United States," he said. "The undisputable fact is that somebody is going to earn some more money than before, and that's the president of the United States." From the report: Trump's media venture has struggled to build a profitable social media business despite its lofty valuation. Truth Social has reported significant operating losses since going public. According to the company's earnings report for Q1 2026, Trump Media & Technology Group netted a roughly $405 million loss and raised less than $900,000 in sales. Not everyone agrees the arrangement meets the legal bar for insider trading. Shannon Devine, a spokeswoman for Trump Media & Technology Group, has pushed back on the characterization, telling Quartz that Truth API "offers customers the fastest way to ingest publicly available Truth Social data" and that critics "must have invented a new theory of 'insider trading' based on publicly available information." Classic insider trading law hinges on trading on secret, material information in breach of a fiduciary duty, and Truth Social posts are, by design, meant to become public within moments -- raising real doctrinal uncertainty about whether faster access alone qualifies. But other legal experts argue the greater risk lies ahead. Richard Painter, former White House chief ethics counsel, has argued that the arrangement could violate federal law once Trump posts genuinely market-moving news -- on tariffs, military action, or other policy decisions -- before it's public, with Truth Social effectively acting as a paid "tipper" on the president's behalf. Sen. Alex Padilla (D-Calif.) said he plans to introduced legislation Tuesday to ban the president from selling expedited access to his statements.

Read more of this story at Slashdot.

eBay and several former executives have agreed to pay $56 million to Ina and David Steiner, the newsletter writers targeted in a 2019 corporate harassment campaign that involved threats, surveillance attempts, and deliveries of live insects and other disturbing items. The settlement closes the couple's civil case after seven former employees pleaded guilty to criminal charges related to the scheme. TechCrunch reports: Ina and David Steiner, a married couple and the co-authors of EcommerceBytes, inspired the ire of high-level eBay executives after occasionally criticizing the company in their newsletter. In 2019, a plot was concocted to intimidate the couple into halting their negative coverage. Executives used sock puppet social media accounts to harass the couple, while also sending them anonymous threatening letters and bizarre items in the mail -- including live spiders and cockroaches, pornographic magazines, a bloody pig mask, a funereal wreath, and a book about surviving the death of a spouse. According to previously released court documents, a plan that was attempted but never successfully carried out involved affixing a GPS tracking device to the couple's car. Yet another internally broached plan involved sending a "Samoan gang" to the Steiners' home. The settlement this week resolves a 2021 civil case brought by the couple against eBay. The law office representing the Steiners writes that the settlement includes $46.15 million paid to the couple by eBay itself, as well as $2 million from former eBay executive CEO Devin Wenig. Additionally, $500,000 will be paid out to the couple from former eBay executive Wendy Jones, as well as $50,000 from former eBay executive Steve Wymer. Additional funds are being paid to various non-profits. In 2022, seven former eBay employees were criminally charged and pled guilty in relation to the plot, including the company's former security chief, James Baugh -- who was sentenced to nearly five years in prison. Others indicted by the U.S. Department of Justice include David Harville, Brian Gilbert, Stephanie Popp, Stephanie Stockwell, Philip Cooke, and former eBay contractor Veronica Zea.

Read more of this story at Slashdot.

Ernst & Young previously confirmed that personal and financial information was stolen from a third-party management platform.

The post ShinyHunters Claims Ernst & Young Hack appeared first on SecurityWeek.

An anonymous reader quotes a report from Reuters: Nvidia is in talks to provide roughly $250 billion in financing guarantees for OpenAI as part of a massive data center project, the Wall Street Journal reported on Sunday. The backstop from Nvidia would help the ChatGPT maker lease a 10-gigawatt project that SoftBank's energy subsidiary is developing in southern Ohio, the newspaper said, citing people familiar with the matter. For OpenAI, a deal would be the first step toward controlling its own infrastructure instead of renting it from Microsoft, Amazon, and Oracle, while for Nvidia, it would guarantee demand for its chips for years to come. The project is expected to cost more than $500 billion in total, including the chips inside the data center, according to the WSJ. The $250 billion guarantee covers the data center lease and debt financing, but would not cover the Nvidia chips inside the center, the WSJ said, adding that the chipmaker was also discussing financing OpenAI's chip purchases worth up to $350 billion. Nvidia's backing would support financing vehicles aimed at reassuring lenders about the project's funding, the report added. The first phase of the project is expected to be finished in 2028, with around 800 megawatts of power, the Journal said. The report notes that the U.S. government will control access to the power, while Japan will fund it separately under a trade agreement tied to Tokyo's $33 billion investment in a natural gas plant. Commerce Secretary Howard Lutnick will reportedly help determine who receives access.

Read more of this story at Slashdot.

Roku has raised prices on several streaming devices, blaming memory and component shortages tied to the AI data-center boom. The Roku Ultra jumped from $100 to $150 and the basic Streaming Stick rose from $30 to $40. The Desk reports: In a phone call with The Desk on Friday, a Roku executive said the company made the tough decision to raise prices on its streaming hardware to address shortages in computer memory and other components caused by the artificial intelligence rush. [...] Still, the executive who spoke with The Desk on Friday said the company believes its hardware is still competitive against other streaming TV hardware because Roku devices are still priced aggressively compared to the Apple TV and other expensive streaming hardware, and the company remains focused on looking at ways to add value to its Roku platform before and after it enters a customer's home. "We are doing our best to have great deals like what we have going on right now," the executive said. "Roku is even upping the price for a bundle that includes a Streaming Stick Plus and a one-month subscription to Fox One," notes Ars Technica in a separate report. "As recently as July 20, Roku listed the bundle at $60 with a sale price of $25, according to the Internet Archive's Wayback Machine. Now, the bundle carries an $80 MSRP and $45 sale price."

Read more of this story at Slashdot.

Apple is reportedly launching a Klarna financing deal that will let U.S. customers spread the cost of devices over up to three years, pushing the company closer to a hardware-as-a-service model. "The only thing you don't get under the new arrangement is AppleCare, for which you'll allegedly need to pay extra," notes Computerworld. From the report: The introduction of the scheme gives consumers a way to purchase the company's popular high-end devices when they are introduced -- no doubt,at higher cost -- this fall. [...] A combination of changed customer habits and external threat means the stars are now aligned for hardware-as-a-service models. "Reframing a device as a low monthly payment protects that [upgrade] cadence and allows Apple to start marketing their products as device-as-a-service to consumers, which no other vendor was ever able to do," [IDC analyst Francisco Jeronimo] wrote to me. There is a one-more-thing aspect to this: the products are effectively being leased, a new approach that will give Apple a stronger grip on EOL devices, helping it grab more of them for refurbishment, resale, and recycling. Over time, this will give the company a much stronger grip on the lucrative second-user market that exists around Apple equipment, even while for almost every consumer product we find the life we want is something we can rent, but probably can't afford to own. The other solid reason to take a partnership approach is risk management. Apple had intended to develop its own buy-now, pay-later scheme via Apple Pay Later, but abandoned that plan as it became riskier with rising bank rates. "Also, by backing the program with Klarna rather than reviving the in-house subscription plan it shelved in 2024, Apple captures the demand upside without taking the credit risk onto its own balance sheet," Jeronimo said. "Apple Upgrade lands at precisely the moment Apple needs it," Jeronimo wrote in a note seen by Computerworld. "Having just pushed Mac and iPad prices up on the back of the memory shortage, with iPhone increases widely expected in September -- as well as the new iPhone foldable expected at $2,500 -- Apple's real risk is that rising prices even further can impact the upgrade cycle."

Read more of this story at Slashdot.

An anonymous reader quotes a report from Wired: Nearly seven years after Apple debuted the Apple Card, Samsung is following the iPhone maker's footsteps with the Galaxy Card, aiming for its own slice of the credit card market. The announcement comes two days before Samsung's second Galaxy Unpacked event of the year, where it's expected to showcase new smartwatches and folding smartphones. The Galaxy Card is issued by Barclays on the Visa network; the Apple Card, originally issued by Goldman Sachs but now transitioning to Chase, is on the MasterCard network. There is a physical card -- it's not made of titanium but recycled steel. The virtual card will be provisioned to a user's Samsung Wallet account. With no annual fee, Samsung says cardmembers can earn 5 percent cash rewards on all in-store or online purchases made directly from Samsung in the US, 3 percent cash rewards on purchases made with the Galaxy Card using Samsung Wallet, 2 percent cash rewards on streaming service subscriptions, and 1 percent cash rewards on everything else with the physical card. The cash rewards can be redeemed as a statement credit or transferred to a checking or savings account. The annual percentage rate (APR) varies by cardmember, but the card has no foreign transaction fees. Other perks include a 20 percent discount on Samsung's VIP Advantage membership, which offers extended device protection, specialized support, and exclusive deals, and $200 in cash rewards after spending $2,000 in the first 90 days. Applications open up on July 22. The Samsung Wallet app is only available on Samsung smartphones and watches, so what happens if a consumer switches to a different smartphone brand? The company says Galaxy Card is not limited to Samsung device owners and that anyone can use the physical card, but you lose the key perks; the card can be managed through a BarclaysUS.com online portal. (Similarly, if an iPhone owner switches to Android, their physical Apple Card will still work, but they lose access to the Apple Wallet app and the 3 percent daily cash perk on Apple purchases; there's a web portal to manage the account.)

Read more of this story at Slashdot.

The European Commission has fined AliExpress more than $625 million, the largest penalty yet under the Digital Services Act, after finding that the marketplace failed to "diligently assess and mitigate risks relating to the sale of illegal, unsafe, or counterfeit products on its e-commerce platform." EU officials said flagged products repeatedly reappeared, sellers could evade safeguards, and AliExpress's recommendation and ad systems helped amplify dangerous goods. Ars Technica reports: For shady sellers, the risks of detection appeared low. The e-commerce site's mandatory brand authorization system was also ineffective and understaffed, the EC found, and AliExpress did not penalize traders for selling illegal products as its policy claims it would. Making things worse, AliExpress "inadequately assessed how its recommender and advertising systems exacerbate the spread of illegal products," the EC said. So rather than remove illegal products, AliExpress was recommending them to consumers and helping to maximize exposure. Talking to the press, the European Union's tech chief, Henna Virkkunen, noted that one in five Europeans shop monthly at retail sites like AliExpress, Temu, and Shein. AliExpress also relied on a single quantitative metric to gauge how effectively its systems were working to weed out illegal products. And that metric did not properly measure the extent of the harm. EC testing found that "a high volume of illegal products" -- including unsafe toys and dangerous cosmetics -- "continued to circulate despite AliExpress' moderation efforts." In June 2025, AliExpress was ordered to bring its platform into compliance with the DSA but failed to make the necessary changes, the EC said. The fine was calculated to be proportionate to the nature of the violations, which the EC considered "particularly serious infringements," and to penalize AliExpress's delayed interventions to mitigate flagged risks. [...] AliExpress told Ars it was "surprised" by the "disproportionate" fine. AliExpress said it plans to appeal the decision, claiming the EC ignored its "sound risk management framework and the significant, proactive enhancements we have made." The massive online retailer noted that its EU market is substantially smaller than its China market and said that it invests "substantial resources in risk assessment and mitigation, product safety and consumer protection" and "has been and continues to be committed to meeting our obligations to consumers."

Read more of this story at Slashdot.

Hackers stole names, addresses, Social Security numbers, credit/debit card numbers, and other information from a third-party management platform.

The post Ernst & Young Data Breach Affects Personal, Financial Information appeared first on SecurityWeek.

ABC News reports that White House teleprompter operator Gabriel Perez allegedly made more than $100,000 betting on Kalshi markets tied to what President Trump would say in speeches, using his access to prepared remarks and last-minute edits. ABC News reports: According to the sources, Kalshi alerted its regulator, the Commodity Futures Trading Commission (CFTC), to the suspicious activity on its "Mentions" market, where users can bet on whether specific words, phrases or topics are uttered during a public speech. "Our surveillance team promptly flagged and referred these trades to the CFTC, and we are cooperating and assisting regulators," Kalshi's head of enforcement, Bobby DeNault, said in a statement provided to ABC News. White House Press Secretary Karoline Leavitt told reporters Thursday afternoon, following ABC News' report, that Perez has been put on unpaid administrative leave. Leavitt said she spoke with President Trump about it, and he thought it was a "disgrace" and made the decision himself to put Perez on unpaid leave. Leavitt said she was unaware of any other White House staffers who have made such trades. "The White House has strict ethics guidelines that we expect all staffers and officials to follow," said White House spokesperson Davis Ingle when contacted by ABC News. In addition to February's State of the Union address, sources said CFTC investigators discovered that Perez placed bets on more than a dozen Trump speeches over a three-month period, including a December primetime address, a January speech at the World Economic Forum in Davos, Switzerland, and Trump's remarks in March during a Medal of Honor ceremony.

Read more of this story at Slashdot.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a recent data leak in which a contractor published dozens of internal CISA credentials — including AWS Govcloud keys — in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency’s initial response provide important lessons that all security teams should absorb.

On May 15, 2026, the security firm GitGuardian asked for help in notifying CISA about the existence of a public GitHub repository called “Private CISA” that included 844 MB of sensitive CISA-related data. One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers. Another file — “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems.

CISA quickly acknowledged our initial alert, but took more than 48 hours to invalidate the AWS keys and many other important secrets leaked in the GitHub repo. In its report on the data leak, CISA said the complexities of the agency’s systems and interconnections with federal and industry partners caused its key rotation to take longer than anticipated.

“Drawing on this experience, CISA encourages others to maintain mature and well-tested key management capabilities,” the report notes.

CISA also admitted it can do better when it comes to responding to security incident notifications from external parties. The postmortem stresses that clear and distinct reporting channels are essential to ensure that incidents affecting the organization itself are handled differently from those involving its products or customers.

“In CISA’s case, these channels were not well defined, leading the security researcher to try multiple avenues – including emailing the contractor, submitting through CISA’s vulnerability disclosure platform (which is intended for vulnerabilities impacting the broader cybersecurity community), and ultimately involving a reporter,” reads the analysis written by Preston Werntz and Brad Libbey, the acting chief information officer and acting chief information security officer at CISA, respectively.

CISA said it is refining its reporting channels to make them easier and faster for researchers. “Additionally, while many researchers rely on the security.txt file, organizations can ensure clarity by publishing reporting instructions in multiple prominent locations,” the CISA authors wrote.

Guillaume Valadon, the GitGuardian researcher who first contacted KrebsOnSecurity about the exposed CISA credentials, said CISA ignored nine automated alerts about the exposed credentials prior to our notification on May 15. Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures.

“Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure,” Valadon wrote in an analysis of CISA’s report. “Make it trivial to report a leak about you, not just about your products. The person reporting a leak to you is not the threat. Publish a security.txt, but do not stop there. Put reporting instructions in several prominent places, and make sure a report about your own infrastructure does not land in a product-bug queue.”

The report’s authors also emphasized the importance of continuously scanning public code repositories like GitHub for exposed secrets, and said CISA has since rotated all secrets and created an action plan to improve management of developer secrets and to better monitor for them going forward.

The report notes that while CISA had developed a playbook for responding to cybersecurity incidents, that playbook somehow didn’t include what to do in situations involving GitHub or other cloud services. Valadon said the report validates the need to scan continuously — not just quarterly — for exposed secrets.

“The Private-CISA repository sat public for six months,” Valadon wrote. “Continuous monitoring of public GitHub surfaced it. Comprehensive internal scanning could have caught the plaintext passwords and committed backups long before they left the building.”

CISA gave itself passing grades on several areas of security preparedness that it said helped the agency gauge the scope and impact of the exposed secrets, including enhanced logging capabilities, and the adoption of zero-trust principles in both its production and development systems. CISA said those detailed logs allowed it to show that no customer or mission data was exposed, and that the leaked credentials were not used outside of CISA’s environments. The agency said the contractor who exposed the secrets had their system access revoked.

Valadon reckons the biggest takeaway is the CISA postmortem itself, and praised the agency for being transparent about what worked and what didn’t.

“To my knowledge, it is also the first time a national cybersecurity agency has publicly advocated for secrets scanning and for simplifying relations with security researchers,” Valadon wrote. “That is exactly the incident communication we should expect from every organization.”

An anonymous reader quotes a report from The Guardian: The [San Francisco international airport] is hoping to build a brand-new terminal exclusively for passengers who pay a premium, gaining access to a luxurious airport experience complete with private security lines and valet service from terminal to tarmac. It will service commercial flights, not business or corporate jets, and the terminal will have its own Transportation Security Administration (TSA) lines as well as Customs and Border Protection (CBP) lines for international travel. SFO is seeking bidders to take on the development, construction and operation of the private terminal, which is planned for a 75,000-sq-ft site located across the runway from all current public terminals. The airport will accept proposals between late September and early October, and is looking to award a contract by early December with hopes of opening the terminal in late 2028. [...] If SFO is successful, it would become the next major American airport to open a luxury terminal. Los Angeles, Dallas Fort Worth, Miami and Hartsfield-Jackson Atlanta international airports all offer a private terminal through PS (formerly known as the Private Suite), a company owned by security firm Gavin de Becker and Associates. Multiple representatives from PS and Gavin de Becker and Associates attended a June conference hosted by SFO about the private terminal, and PS has said it hopes to open a private terminal at every major US airport by 2030. The report notes that access to existing PS private terminals "can cost passengers $1,295 for a one-time experience, or up to $4,850 for a yearly membership."

Read more of this story at Slashdot.

JPMorgan, Bank of America, Wells Fargo, PNC, and other major banks have reportedly explored acquiring Fiserv's debit-card networks, STAR and Accel, in a move that could help them bypass federal caps on debit-card transaction fees. A law limits the fees big banks can charge merchants, but only if the transactions are routed through an outside network. There are no caps on these interchange fees over a bank-owned network, however. The Wall Street Journal reports: When Capital One Financial bought Discover Financial in a $50.6 billion deal, it got a network that cut out the need for a middleman in card transactions and allowed it to deal more directly with merchants. Now, big banks are looking on with envy because owning a network can mean exemption from a federal law that caps debit-card fees. Those fees collectively amount to billions of dollars each year across the industry, but banks have long complained the government-defined cap limits their ability to offer customers debit-card rewards and other services. Some have been exploring a small deal that could upend the rules, though they are worried about political backlash if they try. Big banks including JPMorgan Chase, Bank of America, Wells Fargo and PNC Financial Services Group have in recent months held preliminary and tentative discussions about a deal to acquire a network owned by the financial-technology company Fiserv, according to people familiar with the matter. There is no certainty a deal will happen. Several of the banks that looked at the Fiserv network have already decided it would be unlikely for them to move forward, some of the people said. Some have privately expressed concern that such a deal could prompt backlash from lawmakers, regulators and merchants, the people added.

Read more of this story at Slashdot.

Meta is introducing a subscription for expanded access to advanced smart-glasses features. According to Wired, "[U]sers will need the Meta One Premium Plan to unlock expanded access to some features for their smart glasses, whether it's the Ray-Ban, Oakley, or Meta-branded version." They'll still be usable with a subscription, but "certain features will be limited," the report says. From the report: Specifically, a feature called Conversation Focus, which boosts the audio of the person you're speaking with so you can hear them better in loud environments. You'll get three hours per month without a subscription, but if you want to use it more often, then you'll need to pay up. Though even then, you're still capped at 15 hours. Subscribing also nets you "Premium Device Support," where you'll get faster access to what Meta says are "human experts" trained on the smart glasses' features, should any problems arise. Guess humans are better at some things after all. A Meta spokesperson tells WIRED that this is "not an AI rate limit." Rate limits are common on other AI platforms -- users get free access to a feature until they hit a certain cap, then they'll need to subscribe to use it more until the limit resets at the end of the month. However, the Conversation Focus feature runs on-device, meaning it doesn't need to head to Meta's servers for AI processing. There's no real-time way to monitor how many hours you've used Conversation Focus, but you'll receive a notification when you get near the limit. "The subscription supports that ongoing work and gives power users expanded access along with premium device support," the spokesperson says. "We're going to start testing new optional subscription plans that offer more premium features and advanced capabilities for those who want to unlock more from our apps and AI glasses."

Read more of this story at Slashdot.

Trump administration budget chief Russell Vought told lawmakers Tuesday that he’s willing to work with Department of Homeland Security Secretary Markwayne Mullin on re-staffing up the Cybersecurity and Infrastructure Security Agency, following deep personnel cuts and further proposed reductions in the fiscal 2027 budget blueprint.

Mullin said last week at a House Appropriations Subcommittee on Homeland Security hearing that he would like to hire 600 more people at CISA, similar to remarks he made earlier this month at another House hearing. President Donald Trump has cut or lost more than 1,000 from an agency that stood around 3,400-strong at the end of the Biden administration — cuts criticized by lawmakers in both parties.

At a House Appropriations Subcommittee on Financial Services and General Government   hearing Tuesday, Rep. Mark Amodei, R-Nev., asked Vought about Mullin’s CISA remarks.

“You don’t just flip a light switch on, and you got 600 folks over in CISA now. What’s the plan for getting CISA fully operational?” Amodei, who chairs the panel’s Subcommittee on Homeland Security, asked. “How do we make sure we have a robust, effective, cost-effective CISA force? Because I don’t think anybody thinks we have it now.”

Vought, director of the Office of Management and Budget, said he hasn’t received a formal request from Mullin to increase CISA’s number of full-time employees, but knows that hiring isn’t instantaneous.

“He was not here when we developed this budget, so if he feels the need to have additional resources, we will work through that internally, and at the appropriate time, come up and brief you,” he answered Amodei. “I do think he’s in the process still of getting his arms wrapped around the department,” he said. Mullen became DHS secretary in late March.

“This is probably one of those things, particularly in the cyber world, you now have a year and a half of a new administration,” Vought continued, and referred to conservative complaints about how CISA handled election security and disinformation under Biden. “We saw this agency had major concerns with it in our four years outside of government and with new management, I think it’s now an agency, or could be an agency, that plays a very valuable part for DHS’s portfolio.”

Bringing hundreds of new CISA personnel on board could prove challenging for reasons beyond the usual bureaucratic hurdles and security clearance processes that slow any federal hires in the national security space. Past CISA employees and agency observers have said the way the Trump administration has purged personnel and treated those who have stayed could prove a further disincentive to future hires.

Acting CISA director Nick Andersen recently said that the agency has begun the process of hiring new CISA staffers, and expected to have nearly 200 job offers out by the end of this month.

The post Trump budget boss Russell Vought open to re-staffing CISA appeared first on CyberScoop.

The New York Times tells the story of a 63-year-old retiree who wrote a check for several thousand dollaras to pay her taxes. But she discovered much later that her taxes were never paid because that check had been intercepted and then altered to be payable to someone else: In some cases, thieves may pilfer one or more checks from local mailboxes. Adam Rust, director of financial services for the Consumer Federation of America, said thieves sometimes "fish" for checks at free-standing drop boxes, using long tools with sticky pads on the ends to grab letters. In other cases, more sophisticated criminals may steal large batches of checks, copy them and then sell them on the internet. Often, the purloined checks are chemically altered in what's known as "check washing" to remove the name of the recipient. The thief replaces it with a fraudulent name, and often increases the amount of the check, before cashing or depositing it. The 63-year-old retiree's bank told her she'd waited too long to recover the funds: Schwab's "security guarantee," outlined on its website , says that "Schwab will cover losses in any of your Schwab accounts due to unauthorized activity." But fine print at the bottom of the page notes that reimbursement "requires your timely reporting of unauthorized activity to Schwab," and that Schwab "will not be liable for additional or increased losses resulting from a failure to report unauthorized activity in a timely manner." It notes that more details are available in account agreements... Notify your bank as soon as possible, said Scott Anchin, senior vice president of strategic initiatives and policy at the independent bankers association. Banks generally allow at least 30 days and sometimes up to 90 days from the time your statement is made available to you to report suspected check fraud, he said. So how can you avoid check fraud? Adam Rust, director of financial services for the Consumer Federation of America, just suggests that "No one should ever mail a check." If you must write a check, he said, try to deliver it in person or take it inside a post office to mail rather than relying on your own mailbox or public drop boxes. The American Bankers Association recommends using permanent "gel" ink pens when you do write checks to reduce the risk of tampering... And if you don't already, consider using your bank's online bill payment service. The article notes that even the U.S. federal government "has been moving away from paper checks for things like benefit payments and income tax refunds, saying digital payment methods are more secure."

Read more of this story at Slashdot.