raelynne

https://www.theregister.com/personal-tech/2026/09/28/amazon-evaluating-drone-deliveries-in-australia-asia/5299343

E-commerce giant Amazon.com is preparing to launch drone deliveries in Australia and other nations. “As Prime Air evaluates Australia and other countries, we are hiring a Head of Regulatory Approvals, Australia – the person responsible for navigating Australia's aviation regulatory system and securing every approval required to deliver to Australian customers by drone,” reads a recently published job ad. Whoever gets the gig in Australia will report to someone who holds the title “Leader, Prime Air Expansion – Asia Pacific.” The Register asked Amazon to comment on the ad, and which other Asian countries it plans to enter. The company had not responded at the time of writing. Whoever gets the job “will be measured by the approvals you obtain, the timelines you hit, and – ultimately – Australian customers receiving drone deliveries.” That wording suggests Amazon intends to operate Prime Air in Australia and is doing rather more than market evaluations. In August, Amazon said it plans to operate Prime Air drones in “nearly” 500 cities and towns across the USA this year. Meta and Singapore sling scammers Meta last week announced that information-sharing with Singapore Police helped the social media giant to identify a new variety of attack and led it to take action against more than 113,000 entities and pages connected to fraud and scams on Facebook and Instagram. Meta calls the new scams calls “shell pages” and says they “look empty and harmless” because they don’t include ads or content that violates Zuck’s T&Cs. “But scammers had pre-built infrastructure, ready to be activated for scam campaigns at a moment’s notice,” Meta says. “Working from SPF’s signals, in July 2026, we took action against over 3.6 million shell pages before they could be used – and we’re now pursuing further disruptions against this type of scam.” “Rather than responding to individual reports, this collaboration focuses on proactive network disruption – where SPF information helps Meta’s investigators identify and dismantle entire ecosystems of bad actors,” the company asserted. Meta didn’t say how scammers could sign up for 3.6 million pages without it noticing. Nothing has a plan to conquer India’s consumer tech market Consumer electronics outfit Nothing, which has carved out a small niche with well-priced Android devices, has decided to spin out its Indian subsidiary CMF. CEO Carl Pei explained the move as a bet on India’s growing electronics manufacturing industry spurring demand for local consumer tech brands. “Every country that has manufactured consumer electronics at scale has eventually produced its own global champions. Japan did. Korea did. China did, and I watched it happen over the better part of a decade living there,” he wrote. “India is next. It's already the world's second largest smartphone manufacturer, with the largest youth population on earth and one of its deepest software talent pools. What it doesn't have yet is a global consumer electronics brand of its own. That will change. The only questions are when, and how.” Pei thinks the how is spinning out CMF, a Nothing sub-brand that makes budget-priced phones, audio kit, and smartwatches. Bangkok floods – brace for supply chain impact When heavy rains and subsequent floods struck Thailand’s capital city Bangkok in 2011, facilities operated by hard disk manufacturers Western Digital and Seagate experienced damage that disrupted production for months. Bangkok was again hit by rain and severe floods last weekend, but to date The Register can find no evidence of problems at major tech companies. Western Digital and Seagate have not announced any issues, while hyperscalers Google, Microsoft, and AWS also report their local infrastructure is operating normally. Thailand’s government announced a two-day holiday to help residents clean up after the flood, which saw much of Bangkok under 30 centimeters or more of water. India’s top unis ban 22 vendors – maybe including Oracle – from recruiting their grads India’s 23 Institutes of Technology (IITs) are famed for producing exceptional technology talent that tech companies often strive to hire. However 22 companies – reportedly including Oracle – won’t be considered for graduate recruitment programs due to not following through on hiring promises. India’s Economic Times reports that the companies offered over 150 jobs to IIT students, but didn’t make the appointments. Another source claims Oracle is one of the 22 companies that the All IITs Placement Committee, the body which runs graduate placements, has decided not to deal with for two years. ®

https://www.theregister.com/personal-tech/2026/09/28/amazon-evaluating-drone-deliveries-in-australia-asia/5299343

https://www.theregister.com/columnists/2026/09/27/big-ais-content-problem-take-the-work-keep-the-money/5299007

Big AI has a problem. Its companies must ingest other people’s work. You know, books, news stories, photographs, code, websites, that one original meme you came up with, and practically everything else on the internet to train its large language models (LLMs). We all know that. We also know that AI companies hate paying for any of it, obeying the licenses attached to it, or, God forbid, sharing their revenue with the companies and people who created the work in the first place. Recently, Big AI's default way of doing business: "Take it now, argue about legality later," has become more in your face than ever. Look, for example, at the copyright fight between The New York Times and OpenAI and Microsoft. According to 404 Media’s reporting on recently unsealed court documents - arguments from the plaintiffs that the court has not yet ruled on - Microsoft allegedly knew what it was doing when it was importing the internet willy-nilly. Microsoft's Director of Applied Science, Dr. Brent Hecht, was quoted in the news plaintiffs' 92-page combined brief as saying: the case was about “an astonishing theft of unprecedented proportions." Indeed, it was possibly the “largest theft of labor in human history,” he was quoted as saying in the summary judgment brief from the journalists' lawyers [PDF].This, mind you, wasn't a comment by a member of the press; it was from a senior Microsoft staffer. Hecht wasn't the only one at Microsoft who commented. In an internal Microsoft policy document also quoted in the court papers, the authors admitted generative AI could “significantly disrupt the employment of the very people who generated the data on which the foundation model was trained [because] LLMs are a product that destroys its supply chain.” That, in turn, leads to model collapse. Ironically, AI is killing the content-creator goose that lays the gold eggs of worthwhile content. Judge Sidney H. Stein of the US District Court for the Southern District of New York has not yet issued a decision on the case. OpenAI and Microsoft are actively disputing the plaintiffs' allegations under a "fair use" defense. They contend that using public articles and books to train large language models helps push forward public knowledge, and isn't acting as a "unlawful economic market substitute". But the statements the documents cites are real. Big AI knows it needs the content. Some of the companies concerned don't give a damn; money now, worry later is their motto. Those who can look past the revenue numbers are well aware they're engaged in what Microsoft itself called a “doom loop” of AI content strategy in those unsealed court documents. Will that stop them? Nah. According to the filing [PDF], which refers to sworn deposition testimony of OpenAI’s own corporate representative, it also testified that its LLMs were happy to vacuum up other people's work even when a paywall nominally protected it. Its rep was quoted as saying they were unaware of “any effort to detect paywall content in its training datasets” or “to remove paywall content from its training datasets.” When OpenAI cofounder Greg Brockman was told OpenAI could hack its way through the firewall, he responded, “ah, nice.” Whether or not these statements are found to be reflective of a wider attitude, similar attitudes prevail amongst Big AI. Such policies could eventually come back and bite the LLM makers; it's already affecting the market for journalism, fiction writing, graphics creation, anything that demands humans actually get paid for producing original work. But Big AI just doesn't want to pay for it. That's not a side effect. It's the business model. Joe User couldn't care less. They just want a quick answer that sounds right. Some of them couldn't care less about getting the right answers. As for looking deeper to see if the information they're regurgitating is accurate, forget about it! As an OpenAI software engineer put it: “No matter how prominently we show the links, users won’t click.” Well, I click. That's a big reason why Perplexity is my AI of choice. It's not that it gives a more reliable answer. No, it's that, unlike most LLMs, Perplexity provides sources and links, and I check them before accepting what it tells me. But then I'm a journalist whose degrees are in history, where my professors drummed into me that you always - always - look at the primary sources. Big AI takes the same approach with its code generators. The US Ninth Circuit recently handed GitHub, Microsoft, and OpenAI a narrow win in the Doe v. GitHub lawsuit. The court ruled that the plaintiffs hadn't established a claim under one particular provision of the Digital Millennium Copyright Act (DMCA), which concerns the removal or alteration of copyright-management information (CMI). In short, the court said that generating new code without including CMI is not necessarily the same thing as removing or altering copyright information from an existing work. Judge Eric Miller wrote: “One who creates a new work and fails to include CMI cannot be said to have ‘removed’ or ‘altered’ anything.” This ruling didn't establish that GitHub Copilot or any other coding model may train on every open source project without restriction. It didn't determine that copying source code into a training set is always fair use. It did not decide that generated code cannot infringe copyright. And it certainly did not repeal the GPL, Apache, BSD, MIT, or any other open-source license. After all, open source isn't a synonym for “do whatever you want with it.” It just seems that way when AI gets its hands on open source code. That's the problem with AI-generated code. A programmer who receives a Copilot suggestion is very unlikely to check whether the GPL covers the code, or whether Apache covers the snippet from a library. The developer certainly can't tell which license terms may apply to the code that just popped up from Opus 5.5 or GPT 6. As the guy from OpenAI said, people don't click the links, and in AI-enabled programming pipelines, they don't even have the links anyway. An open source-savvy attorney friend of mine has a bigger worry than this narrow decision. He told me that what gives him "pause is a broader trend. There are multiple cases where parties are litigating open source licenses as contracts rather than as the IP / copyright licenses they were written to be. Contract theories let a plaintiff sidestep the questions copyright forces you to answer. 'Do you own the work? Is it protectable expression? Was it actually copied?'" He added: "Those questions are the foundation on which licenses are built. Open source licenses are grants of permission to use someone's intellectual property. If a case can't show that any intellectual property was owned or infringed, it's fair to ask whether enforcing the license as a bare contract supports open source licensing or quietly turns it into something else." With AI in the mix, this issue will eventually become one of those nasty IP matters developers hate, businesses want to avoid, but that courts must settle with expensive lawyers whose hourly rates worry even AI millionaires. After all, IP uncertainty isn't a minor paperwork issue. It is a supply-chain security and compliance problem. If you use AI-generated code, you may be importing unknown legal obligations into your software. If you are an open-source developer, your work may be used to improve a proprietary service that returns code without provenance, attribution, or meaningful reciprocity. And if you are a customer, you may be relying on software whose origins no one can fully explain. The Ninth Circuit ruling didn't solve any of that. We're in for a lot more open source litigation that will make SCO vs. the known Linux universe look like a kerfuffle over a parking ticket. Then there is the latest wrinkle: A federal antitrust lawsuit against Anthropic, OpenAI, SpaceXAI, and Google. The plaintiffs allege the companies coordinated to slow the development of advanced AI systems. The lawsuit points to public statements from AI leaders all calling for coordination to “pace” frontier AI development over a single weekend. Anthropic CEO Dario Amodei has argued for industry-wide coordination to slow frontier development. OpenAI CEO Sam Altman, Google DeepMind co-founder Demis Hassabis, and Elon Musk have also publicly expressed versions of the view that powerful AI systems need controls and careful deployment. On its face, that sounds sensible. AI safety is a real issue. Anyone who says otherwise has not been paying attention. But there's a huge difference between all big AI players agreeing among themselves on how quickly a market should develop. This looks like an awful lot like competitors deciding who gets to compete, what they get to build, and when they may build it. The Big AI companies all look like good guys while simultaneously strangling their smaller competitors. To mere mortals, this may sound like an open-and-shut case. It's not. Antitrust law requires evidence of an agreement and actual harm to competition; executives making similar public comments is not enough. The plaintiffs will need considerably more than quotes about AI safety or responsible development to win. Besides, if they do win, so what? What recently looked like huge antitrust wins has had its teeth pulled when it came to actually punishing the likes of Google and its ad business, or its earlier "lose the case, win the settlement" with Google Search. Do you see the pattern here? Big AI has effectively argued that copyright law, open source licenses, and competition rules shouldn't slow them down. When creators object, they are told that training is fair use. When developers object, they are told that generated code is new code. When competitors object, they are told security requires the largest companies to coordinate. Funny how the answer always seems to leave Big AI with the data, the market, and the money, isn't it? The central issue isn't whether AI should be allowed to develop. It will develop. The issue is whether the companies building it should be allowed to treat everyone else’s work as a free raw-material supply, then use the resulting products to take away the creators’ traffic, revenue, and bargaining power. Unless we stop Big AI now from this land grab with GPUs, only a handful of trillionaires will really benefit from AI, with the rest of us becoming serfs in a 21st-century post-technology feudal system. ®

https://www.theregister.com/columnists/2026/09/27/big-ais-content-problem-take-the-work-keep-the-money/5299007

https://www.theregister.com/offbeat/2026/09/26/space-jam-uk-debuts-space-squadron-to-protect-satellites/5299119

Britain’s Royal Air Force has gained some space cadets, in the form of No. III Space Effects Squadron, tasked with protecting critical satellites that the UK relies on for communications and navigation. Air Chief Marshal Sir Harvey Smyth announced the new unit at an inaugural UK Space Power Conference in London, saying it will safeguard the vital benefits that space gives to our armed forces, and be capable of denying those benefits to our adversaries. Smyth added that the RAF’s headquarters at High Wycombe transitioned to become Air and Space Command just a few weeks ago. According to the MoD, the existing No. I Space Operations Squadron and No. II Space Warning Squadron give the RAF the ability to watch and warn of threats in space, but the latest unit will have the ability to act against those threats. How, you might ask, given the UK has limited launch facilities and no anti-satellite missile systems, as far as we are aware? This will be accomplished using “advanced technology,” we are told, including electronic warfare, to “disrupt, degrade and deny hostile actions.” In fact, the government says the UK has formally ruled out destructive anti-satellite missile testing, and instead continues to work through the UN Committee on the Peaceful Uses of Outer Space. That implies the use of ground-based jamming systems to disrupt or neutralize any nefarious foreign satellites. We asked the MoD for further details on what the space force’s capabilities consist of, exactly, but a spokesperson told us there is not much more that can be said as the information is classified. However, the MoD does say the squadron will support both offensive and defensive space operations and will expand over time as new capabilities enter service. The MoD states that satellites are critical for both national security and daily life, enabling intelligence gathering and missile warnings, while also providing telecoms and weather forecasts. The emergency services rely on satellite navigation systems for emergency responses, and energy networks use the same systems to organise power grids, making use of the precise time coding in such signals to synchronise operations. Last year, The Register reported that the MoD was working with the UK’s Space Agency on finding ways to protect orbiting satellites with technology that can spot when lasers are being used to try and dazzle them and disrupt communications. Four countries are known to have tested anti-satellite missiles; the US, Russia, China and India. The most recent incident was when Russia destroyed one of its own defunct orbiters in 2021, endangering the International Space Station. The ISS also had to conduct manoeuvres the same year to avoid space debris created by China blowing up one of its own satellites years earlier. In 2022, the United Nations passed a US-led resolution calling on countries to commit not to conduct any similar anti-satellite missile tests. That hasn’t stopped China, for one, looking at other ways of taking out orbital assets if it considers it necessary, looking at employing lasers and high-power microwaves to disable them. The US Space Force also claimed to have observed Chinese satellites practicing “dogfight” manoeuvres in orbit. ®

https://www.theregister.com/offbeat/2026/09/26/space-jam-uk-debuts-space-squadron-to-protect-satellites/5299119

https://www.theregister.com/applications/2026/09/25/microsoft-cells-out-crams-multiple-values-into-excel-boxes/5299294

Microsoft has ended 40 years of single-occupancy for Excel cells and is now allowing multiple values to inhabit the same home. "One of the oldest rules of spreadsheets: one cell, one value," said Jake Armstrong, senior product manager for Excel, in a LinkedIn post. "No longer!" "I’m excited to announce a set of new features: Lists, Arrays in Cells and Nested Arrays in Excel." For the time being, this capability is only available in Microsoft Excel for Windows and Mac Beta Channels. And it is opt-in. To make the case for lists in cells, Armstrong in a blog post explained that each Excel project can have multiple owners. "Traditionally, you'd need separate columns, helper tables, or text like 'Carlos, Henrietta, Jacob' packed into a single cell," he explained. "With lists, you can keep those values together in one cell while still working with each item individually. Project owners stay connected to the project they belong to, while remaining available for filtering, calculations, and analysis." And he goes on to cite the potential utility of arrays in cells and nested arrays for expanding the kinds of information that Excel spreadsheets can represent. Armstrong's enthusiasm for multi-value cells comes with a caveat that this is a preview feature and shouldn't be used in important workbooks until general availability. Among those commenting on Armstrong's LinkedIn post, several people suggested the change has the potential to break things and hinder auditability by making business logic less visible. External software libraries that expect cell.value to return only a string, number, boolean, or date may need to be updated to handle a new data type – though Microsoft hasn't yet published how lists, arrays in cells, and nested arrays will be represented in .xlsx XML. This includes libraries like openpyxl, pandas, and calamine. The same goes for applications that import Excel data and don't yet have any concept of multi-value cells, like CSV export, Google Sheets, LibreOffice, and older Excel builds. And users of Excel may need to flatten lists and arrays to make multi-value cells work with existing features like PivotTables, at least until those features have been adjusted to accommodate the new cell structure. ®

https://www.theregister.com/applications/2026/09/25/microsoft-cells-out-crams-multiple-values-into-excel-boxes/5299294

https://www.theregister.com/security/2026/09/25/fake-google-security-team-ad-says-no-script-reading-in-voice-phishing-then-prints-the-script/5299264

Yes, criminals have job listings too. A Telegram user recruiting callers to work in an apparent Google Security Team voice-phishing scam told applicants that they weren’t allowed to read from scripts – in the same ad that also included the exact script they had to read during these scam calls. This and other true-crime tales of criminals making fools of themselves appear in the latest installment of the Trellix Advanced Research Center’s Dark Web Roast, which uses memes and mockery to troll criminals on the dark web. It also acknowledges: “While these incidents are genuinely amusing, they represent real criminal activities causing significant harm.” One of these incidents from August involves a Telegram user identified by Trellix as Derian (@crɑick) who posted an ad in the UK Fraudsters Telegram channel. “Hiring - Female/Male Mail Callers,” the advertisement said, seeking “USA/CA (white sounding)” applicants and, in bold, “NO SCRIPT READING.” The ad then proceeded to print the exact script the callers would read: “Good afternoon, this is [name] reaching you on behalf of the Google Account Security Team on a recorded line. Am I speaking with Larry Boyles?” The Trellix threat-intel analysts note that the “‘recorded line’ flourish is a nice touch, because nothing says legitimacy like a fraudster cosplaying compliance theatre. The pretexting playbook is depressingly effective, but the recruiter’s QA process is roughly as robust as the fake Google team it impersonates.” Burn, baby, burn. The Register previously spoke with Trellix VP of threat intelligence strategy John Fokker about the Dark Web Roast, and he said the idea came from a desire to take an "almost psyops" approach to covering the criminal underground. "We don't want to glorify them, what's the opposite we can do? We're going to roast them," Fokker told us during a conversation at RSAC. "I'm trying to spark a debate, or a healthy conversation, about what we can do as an industry," he said. "Everybody's glorifying threat actors, and that's not helping our customers or organizations. These are just individuals, they just use computers, and they just want to steal your data and make money. They're not mythical. They don't have superpowers." The FBI’s Internet Crime Complaint Center (IC3) recently reported its most damaging year for internet scams, with 2025’s data pegging reported losses at $20.87 billion, and English-language social engineering is among the most in-demand skill sets on underground forums. One report by threat detection and response firm ReliaQuest found the number of job advertisements posted on criminal marketplaces mentioning this particular talent more than doubled between 2024 and 2025. Plus, according to Google, voice phishing surged last year to become the second most common method used by cybercriminals to gain initial access to their victims' IT estate – and the No. 1 tactic used when breaking into cloud environments. So when these criminals do dumb things, we’re happy to see Fokker’s team call them out.®

https://www.theregister.com/security/2026/09/25/fake-google-security-team-ad-says-no-script-reading-in-voice-phishing-then-prints-the-script/5299264

https://www.theregister.com/cyber-crime/2026/09/25/shinyhunters-tells-the-reg-we-hacked-the-fbi-to-protect-our-business/5299250

ShinyHunters, the data theft and extortion crew that has stolen sensitive information belonging to millions of cancer patients, university and K-12 students, and Carnival cruisers, wanted to preserve their reputation and keep their “business” afloat. So it hacked the FBI to make a statement, the group told The Register. “It’s a game and it’s the world we live in,” a ShinyHunters spokesperson told us. “We are just protecting our business as any other business would do. It’s about who does their job better.” On Friday, the FBI confirmed the breach to The Register, after earlier in the week saying the bureau was investigating ShinyHunters’ claims. "The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” an FBI spokesperson told The Register. "While the point of breach is still undetermined - whether a third-party or the FBI’s enterprise - we are actively and aggressively investigating this matter and working closely with those third-party providers that support FBIJobs.gov to mitigate any and all risk." On Tuesday, the criminals told us that they broke into the bureau via yet another Oracle PeopleSoft zero-day flaw in the FBIJobs.gov portal, which remains down as of Friday. Then, they breached the FBI’s managed servers on AWS GovCloud and swiped thousands of personnel files belonging to current, former, and prospective FBI employees. “We hold very sensitive data on almost ALL FBI Agents and individuals who filed an application with the FBI for a job,” the group claimed in a message posted online and addressed to FBI Director Kash Patel and Brett Leatherman, assistant director of the FBI’s Cyber Division. Sample files reviewed by journalists and security researchers appear to contain agents’ home addresses, phone numbers, email addresses, Social Security numbers, job titles, assigned field office, and emergency contact information. 'We refuted the misinformation disseminated by the FBI' According to a spokesperson for ShinyHunters, the FBI hack isn’t about the money, and the crew did not demand a multimillion-dollar extortion payment to not leak the agents’ personal details. “Our breach of the FBI was executed specifically to contest the allegations made against ShinyHunters in their May 2026 FLASH report,” a spokesperson told The Register. The FBI bulletin, published soon after the group breached ed-tech giant Instructure's Canvas platform and claimed to have stolen data tied to hundreds of millions of students, teachers, and staff, said ShinyHunters uses “harassment strategies, sending threatening text messages and phone calls to victims and their family members, and in some cases, swatting.” The criminals, it continued, “may falsely claim to have sensitive or compromising information, including embarrassing photographs or videos of victims, which frequently do not exist.” ShinyHunters contends this is all false. By hacking the FBI and releasing its statement about the hack, “we demonstrated our technical capabilities and directly refuted the misinformation disseminated by the FBI, journalists, and industry researchers,” the spokesperson told us in an interview. “This was fundamentally a public relations and marketing initiative for our business,” they said. 'Results-driven professionals' or criminals? ShinyHunters said it believes that “future corporate partners we engage with for payment will review this documentation, reinforcing our reputation as serious, results-driven professionals focused solely on transaction and resolution.” Most people call these "future corporate partners" victim organizations, breached by the digital thieves, and threatened with data leaks unless they pay an extortion demand. The FBI intrusion “establishes our credibility, technical superiority and excellence, and capability with future corporate stakeholders, positioning us as a professional and predictable entity focused on concluding negotiations efficiently,” the spokesperson said. It also puts a huge target on the crew, and we’d bet that the FBI, already gunning to arrest ShinyHunters members, is now doubling down on those efforts. The spokesperson said they and others in the crew started off as GnosticPlayers before rebranding as ShinyHunters in 2020, and that they have since seen the “majority” of GnosticPlayers members arrested. This business, however, is a criminal operation. We asked them why they believe people will trust the words of criminals over those of law enforcement. They said it’s due to ShinyHunters’ “unique and exceptional reputation along with over five years of history in the space…We are in a unique position and due to our vast capabilities and resources, victims are more likely to resolve the situation quickly and cheaper with us instead of going down the full disclosure route.” Think of the children We also questioned how they justify doing what they do in this “business” - breaking into IT systems, stealing data, extorting victims - considering the personal toll it takes on people, especially when the stolen files contain sensitive information about children as they did in the Canvas intrusion. ShinyHunters claims that they “don't attack human beings. We attack the corporate structure. The Business. Not human beings. The money comes out of insurance pocket. Not people’s or businesses' own. Full coverage by insurance. No personal harm is being done, only business harm that they recover from within a quarter considering the type of attack.” Ransomware and other disruptive attacks are “substantially worse and costly,” they said. “There are times in the work we do sometimes we have to push the corporate to the absolute limit to get them on the table,” they continued, noting that there was an “initial issue” with the Canvas intrusion “that we cannot comment on, but it highly relates to the misinformation we are combating. It takes a lot of convincing to bring a corporate to the table to negotiate if they think you are not trustworthy and bluffing/exaggerating what you have.” While we don’t know for sure what this issue was, ShinyHunters switched to school-by-school extortion after compromising Instructure, the company that owns the Canvas online learning platform, in late April and after the initial pay-or-leak deadline passed on May 6. They injected a ransom message into about 330 Canvas school login portals, causing Instructure to take the platform offline for a day - during final exams and Advanced Placement testing for many. Meanwhile, that PeopleSoft 0day The ed-tech company ultimately “reached an agreement” with ShinyHunters, which is corporate-speak for they paid the extortion demand. Alliance Risk CEO David Vainer previously told The Register he estimates the figure sits somewhere between $5 million and $30 million. According to ShinyHunters, the PeopleSoft preauth vulnerability that they exploited in the FBI attack still doesn’t have a patch. Oracle hasn’t responded to The Register’s questions about the zero-day, or any plans for a patch. Shiny had “no comment” about whether the gang has abused the PeopleSoft bug to compromise other organizations. But they added: “the zero-day would allow us to access similar HR/Employee personal information for other corporations who are vulnerable.” They wouldn’t put a dollar amount on how much they earn from extorting businesses, but boasted: “our revenue performance significantly outperforms both our counterparts and legitimate real life businesses. We have reason to believe in a few months or soon an upcoming financial analysis or reports tracking our earnings will reflect substantial revenue growth.” And they would not comment when asked if they worried about getting arrested and criminally charged for their digital intrusions and extortion attacks. ®

https://www.theregister.com/cyber-crime/2026/09/25/shinyhunters-tells-the-reg-we-hacked-the-fbi-to-protect-our-business/5299250

https://www.theregister.com/security/2026/09/25/crooks-use-fake-desktop-apps-to-fool-hr-staff-into-giving-them-remote-access/5299226

You work in your company's human resources department and use HR software to check employee information, benefits, and payroll. So, when you see a downloadable Windows version promising a faster alternative to the usual web interface, you grab it. Unfortunately, the app isn't what it claims to be. Instead, it silently installs ConnectWise's legitimate ScreenConnect software, giving the operator persistent remote access to your PC. Cybersecurity outfit Allure Security reported the discovery of the campaign Thursday, describing it as the latest evolution in a trend of abusing ScreenConnect and other remote monitoring and management software. This time, the main giveaway is knowing what the vendors actually sell: None offers the Windows app being advertised. According to Allure, the campaign impersonates three unnamed US-based HR and payroll platforms by offering fake desktop clients for those providers’ software. In all three cases, those companies don’t offer a desktop client, meaning all it takes is an unaware HR or payroll clerk tricked by promises of superior performance to potentially expose some incredibly sensitive company data. Allure said that it’s not sure how potential victims are being targeted by the campaign either, but those who have been targeted may not pick up on anything being wrong. Clicking through to the website offering the fake app brings up a legitimate-looking site built using AI app builder Lovable and hosted on Vercel. The site is hidden behind the cloud host’s bot challenge page, meaning scrapers haven’t been able to index it and expose the scam. Further obscuring the malicious nature of the campaign, the downloads are hosted on a GitHub Releases page, meaning they point to a trusted domain. Once downloaded and executed, the installer presents the victim with an actual Microsoft installer to make it appear like a legitimate piece of software. It actually installs the Microsoft .NET Desktop Runtime 8.0.26, so it goes through the entire process and shows that an installation completes, but nothing ever pops up, leaving the victim unclear as to where their desktop app went. That’s not all the installer is doing, of course: It’s also running a quiet, no-interface installer to drop the ScreenConnect client on the victim’s machine. “The [ScreenConnect] access mode is set to unattended,” Allure notes. “The victim-facing indicators are turned off: no ‘your machine is being controlled’ banner, no system-tray icon, no connection balloon.” The silent install is also configured to launch on boot, and stay connected across various user sessions, giving the attacker “a quiet, persistent, interactive foothold,” says Allure. “Nothing in this chain is malware in the usual sense,” the infosec outfit said. “The page was generated by a legitimate AI builder and served by a legitimate host. The download came from a legitimate code platform. The one window the victim saw belonged to Microsoft. The thing that was installed is a legitimate RMM product, doing what it was designed to do, for someone who was never supposed to have it.” In other words, security teams have some work to do before they even check the indicators of compromise that Allure included in its report: Check with HR and payroll vendors to see if they offer a desktop app, and if not alert all members of those teams to this campaign. For those hoping they haven’t fallen victim, the actual number of victims remains unknown. Allure said the GitHub download counts across the three fake downloads totaled 291 as of its report. Some of those came from Allure’s researchers, and possibly other researchers and sandboxes too, so the download count can’t be used to determine how many victims there are. ®

https://www.theregister.com/security/2026/09/25/crooks-use-fake-desktop-apps-to-fool-hr-staff-into-giving-them-remote-access/5299226

https://www.theregister.com/storage/2026/09/25/sponsored/5299080

EVENT: The Register is hosting a private dinner in New York on Tuesday 27 October for senior technology, infrastructure and data leaders, with LucidLink. Joe Fay takes the chair, it runs under the Chatham House Rule, and nothing said leaves the table. Distributed teams are producing more unstructured file data than ever, and most of them reach it through infrastructure designed for an office: legacy NAS, a VPN, and a sync-and-download habit nobody actually chose. It rarely fails outright. It charges rent somewhere else instead, in duplicated storage, in waiting, in governance gaps, and in the hour somebody loses working out which version of a file is current. The conversation worth having about that is not the architecture diagram. It is what a team did when it stopped being in one building. Which workaround somebody has quietly been paying for ever since. What broke when they tried to retire the NAS, and what they would do differently now. People say that over dinner. They do not say it on a recorded webinar. So this is dinner. Drinks, a handful of questions across the table, then more drinks. Everyone there as a peer, and a chair whose job includes stopping anyone who starts to pitch. The premise is deliberately not rip and replace. The evening is about modernizing around the storage and governance investments an organization already has, rather than pretending they are not there, which is usually the point at which these conversations stop being useful to the people who have to pay for them. On the table: handling the growth in unstructured data, supporting distributed teams without paying for the same file three times, sync and version control, and whether any of it holds up against a security incident. Holly Bossert, Commercial Sales US at LucidLink, joins the conversation. Joe Fay of The Register moderates. The table is for senior technology, infrastructure and data leaders carrying this now, not planning for it later. Dinner runs from 6.00pm to 8.30pm at The Capital Grille, 120 W 51st Street. Places are limited and go by invitation. Request one here.

https://www.theregister.com/storage/2026/09/25/sponsored/5299080

https://www.theregister.com/os-platforms/2026/09/25/windows-update-leaves-some-virtual-desktops-staring-into-the-void/5299106

Microsoft has admitted that some Windows 11 virtual desktops may fail to load after sign-in, leaving users staring at a black screen until they launch Explorer manually. The glitch affects devices running the August 2026 non-security preview update or later releases and, according to Microsoft, "has been primarily observed on Azure Virtual Desktop (AVD) hosts, using FSLogix." Windows Explorer crashes may appear in the affected device's Application event log. Users can temporarily recover the desktop by opening Task Manager and running explorer.exe as a new task. Microsoft has also issued a Known Issue Rollback (KIR) that administrators can deploy through Group Policy. This disables the offending change until a permanent fix arrives. "We are working on a resolution for this issue, and it will be released in a future Windows update," the company said. This is distinct from another problem introduced by the same August preview update, which replaced some customized desktop backgrounds with solid black. Microsoft fixed that in September, but has not explained precisely what causes this latest failure. It said only that the problem "appears to occur more frequently with some existing user profiles." That will be of limited comfort to users glumly firing up Task Manager to launch their desktops manually. Windows 11 versions 26H1, 25H2, and 24H2 are affected. Microsoft does not list Windows 10 or Windows Server among the affected platforms. The stream of problems introduced by Microsoft's August and September updates is becoming relentless, undermining the company's claims that Windows is getting better. Quality improvement promises made earlier this year by Windows chief Pavan Davuluri are ringing increasingly hollow. If this is how Microsoft plans to "win back" its fans, as Satya Nadella said it must, the response may well be: thanks, but no thanks. ®

https://www.theregister.com/os-platforms/2026/09/25/windows-update-leaves-some-virtual-desktops-staring-into-the-void/5299106