Tech

📈📉📊☕
Twitter

[Hedgeye @Hedgeye]

Chinese AI models are now being used more than U.S.-made ones

[It's FOSS @Itsfoss]

I find it surprising that most people do not know that UNIX was never open source.

[Qiusheng Wu @giswqs]

Google Earth Pro will be ending support and will be unavailalbe for new downloads after June 25, 2027!

If you are looking for an alternative, try out GeoLibre. It is a free and open-source, lightweight, cloud-native GIS platform for visualizing, exploring, and analyzing geospatial data. It runs everywhere you do, in the web browser, on the desktop, on mobile, and inside Jupyter notebooks, all while keeping your data local and private.

GeoLibre works across platforms:
- Windows: Microsoft Store / winget
- macOS: Homebrew
- Linux: AUR, COPR, Flatpak (FlatPark), .deb / .rpm / AppImage

Try it out:

- Launch GeoLibre Web: https://t.co/8gMtkVtfnm
- GitHub: https://t.co/VXq8c1o2Nd
- Documentation: https://t.co/7VA2AQoCUc
- Video tutorial: https://t.co/nmlHL8HAbq

#GIS #Geospatial #OpenSource #RemoteSensing #DataVisualization #MapLibre #GeoLibre

[StartMail @MyStartMail]

DuckDuckGo's AI feature has been telling users that U.S. President Donald Trump has died from a rabies infection. Do you trust the AI summaries from your search engine, or have they proven unreliable for you?

[Ben Norton @BenjaminNorton]

The US loves to boast about how wealthy it is, but its wealth is concentrated in the hands of a few oligarchs.

US oligarchs are so insanely rich that they make average wealth seem very high.

But *median* wealth in the US is lower than in Slovenia & Portugal, and half of Italy's

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: Anthropic has embedded hidden spyware-like code in Claude Code that covertly targets Chinese users. It then sends information regarding every user by injecting it into their prompt message.

Claude Code is sending info like timezone, proxy and possible AI Lab connections into the system prompt in ways Chinese users can't notice.

A coding agent with repo and command permissions should not silently hide routing metadata inside prompts. This is a serious breach of user trust.

[Luiza Jarovsky, PhD @LuizaJarovsky]

Who is suing whom in AI, by @mccandelish

[Science Simplified @Scivf4]

Wind electricity genrator

[Tech @Science_Py]

@AnaliseGeopol IPC first! 😆

[Tech @Science_Py]

🙄

[VECERT Analyzer @VECERTRadar]

🚨 CYBER INTELLIGENCE ALERT: 🇧🇷 [UNCONFIRMED / CRITICAL] MASSIVE LEAK OF TAX AND PII DATA — RECEITA FEDERAL (BRAZIL)

[STATUS: UNCONFIRMED]

A post has been detected on underground forums by the threat actor calling itself "BuddhaGroup," who claims to have breached and extracted the complete database of the Receita Federal (Brazil's tax authority). The actor has put up for sale a massive data package containing structured information on Brazilian citizens and companies.

Threat Actor: BuddhaGroup

Declared Scope: 248 million citizens (Natural Persons) and more than 41 million legal entities (Legal Entities). The total volume amounts to approximately 1.07 billion records.

Breach Format: 24 SQLite database files (.db), with a total uncompressed size of 78.7 GB.

📂 Details of Compromised Information (Exposed Schema)

According to the samples and table structure (schema) provided by the attacker, the records are highly granular and include:

Individuals (Citizens): Tax identification numbers (CPF), full names, dates of birth, gender, mothers' names, occupations, and email addresses.

Legal Entities (Companies): Corporate tax registration numbers (CNPJ), trade names, share capital, legal status, cadastral status, and economic activity codes (CNAE).

Contact and Location Data: Complete postal addresses (street, number, neighborhood, postal code, municipality) and more than 133 million phone numbers linked to profiles.

Corporate Structure: Detailed information on partners and shareholders by company, equity stake, and corporate succession history.

⚠️ Security and Risk Considerations

Financial Fraud and Identity Theft: The combination of CPF (Brazilian tax identification number), mothers' names, and dates of birth provides the exact set of data required to bypass basic security controls (KYC) at most financial institutions and credit platforms in Brazil, facilitating identity theft on a nationwide scale.

Actor Reliability: The group claims to have the capacity to infiltrate government and corporate entities, operating under a "cash on delivery" model (without upfront payments), which suggests a high degree of confidence in the authenticity of the material they sell.

🛡️ Recommended Actions (Strategic Level)

Sample Verification: Proceed with downloading and analyzing the sample file (obfuscated in the original report for security) in an isolated environment (sandbox) to cross-reference the exposed data (e.g., CPFs and CNPJs) with public records and verify the legitimacy and currency of the database.

VECERT TOOLS

Strategic Monitoring Tools & Intelligence Platform:

🌐 https://t.co/wk9bZJ2Nli

Security Verification & Monitoring:

🛡️ https://t.co/5LuqwzYuS6

#CyberSecurity 🔐 #Brazil 🇧🇷 #DataBreach 📁 #ReceitaFederal #PII 📋 #FinancialCrime 💸 #ThreatIntelligence 📊 #VECERT 🏢 #UnderInvestigation ⚠️

[Tech @Science_Py]

@grok @Samuelsworld Pode? ou vai?

[Peter Dedene @dedene]

POV: you're still using GitHub Copilot after June 1st, 2026

[Canonical @Canonical]

Ubuntu Core 26 has arrived.

Ubuntu Core 26 is now generally available, bringing precise Linux builds, optimized OTA updates, live kernel patching, and enhanced hardware-backed protection for mission-critical deployments.

"Ten years ago, Ubuntu Core pioneered a new OS security model, where every component is strictly confined, transactionally updated, and independently verifiable. Today, that approach is reflected in emerging industry standards. With Ubuntu Core 26, we continue to deliver the foundation that critical infrastructure operators need to meet the Cyber Resilience Act, run attested, immutable edge AI workloads, and manage devices securely at scale," said Jon Seager, VP of Ubuntu Engineering at Canonical.

Read the press release to learn more:
https://t.co/CC4Vmr8BoW

#OpenSource #Canonical #UbuntuCore26

[Sharing Travel @TripInChina]

Anti-drug publicity video by Guangzhou police in China.😆😆
There are behind-the-scenes stories inside, which are very interesting. The female police officer is always amused by the male supporting role.

[Roy🇨🇦 @GrandpaRoy2]

A kit available on the internet turns an ordinary paper airplane made from a sheet of A4 paper into a real mini-drone.
I can’t help looking at this whimsical little thing and picturing how it could be scaled up and weaponized for use in Ukraine.

[Tech @Science_Py]

https://t.co/Rtx1GouzEY

[Li Jingjing 李菁菁 @Jingjing_Li]

So, the story is Fox News parked illegally in Beijing and got a ticket, instead of reflecting their own mistakes, they complained it’s because of all the cameras and Communism …

Getting punishment when someone does illegal things is what everyone in the society expect. But looks like they got used to impunity.

[Tech @Science_Py]

@femisapien_z @SamsungBrasil @Samsung "Eu juro que não sei" 😄

[Hedgie @HedgieMarkets]

🦔 Researchers at Aikido Security found 151 malicious packages uploaded to GitHub between March 3 and March 9. The packages use Unicode characters that are invisible to humans but execute as code when run. Manual code reviews and static analysis tools see only whitespace or blank lines. The surrounding code looks legitimate, with realistic documentation tweaks, version bumps, and bug fixes. Researchers suspect the attackers are using LLMs to generate convincing packages at scale. Similar packages have been found on NPM and the VS Code marketplace.

My Take
Supply chain attacks on code repositories aren't new, but this technique is nasty. The malicious payload is encoded in Unicode characters that don't render in any editor, terminal, or review interface. You can stare at the code all day and see nothing. A small decoder extracts the hidden bytes at runtime and passes them to eval(). Unless you're specifically looking for invisible Unicode ranges, you won't catch it.

The researchers think AI is writing these packages because 151 bespoke code changes across different projects in a week isn't something a human team could do manually. If that's right, we're watching AI-generated attacks hit AI-assisted development workflows. The vibe coders pulling packages without reading them are the target, and there are a lot of them. The best defense is still carefully inspecting dependencies before adding them, but that's exactly the step people skip when they're moving fast. I don't really know how any of this gets better. The attackers are scaling faster than the defenses.

Hedgie🤗
https://t.co/XQ8Eqs1QOA

[The Tor Project @torproject]

The web’s security model has long relied on trusting the server. WEBCAT is an attempt to change that. Please help test it if you can. Your feedback at this early stage of development is extremely valuable. Excited to collaborate with @FreedomofPress & @SecureDrop