Scientists discover a new magnet that bends light

Researchers have uncovered the magnetic properties and underlying mechanisms of a novel magnet using advanced optical techniques. Their study focused on an organic crystal believed to be a promising candidate for an “altermagnet”- a recently proposed third class of magnetic materials. Unlike conventional ferromagnets and antiferromagnets, altermagnets exhibit unique magnetic behavior.

Details of their breakthrough were published recently in the journal Physical Review Research.

“Unlike typical magnets that attract each other, altermagnets do not exhibit net magnetization, yet they can still influence the polarization of reflected light,” points out Satoshi Iguchi, associate professor at Tohoku University’s Institute for Materials Research. “This makes them difficult to study using conventional optical techniques.”

To overcome this, Iguchi and his colleagues applied a newly derived general formula for light reflection to the organic crystal, successfully clarifying its magnetic properties and origin.

[…]

The team’s newly derived general formula for light reflection was based on Maxwell’s equations and is applicable to a wide range of materials, including those with low crystal symmetry, such as the organic compound studied here.

This new theoretical framework also allowed the team to develop a precise optical measurement method and apply it to the organic crystal κ-(BEDT-TTF)2Cu[N(CN)2]Cl. They successfully measured the magneto-optical Kerr effect (MOKE) and extracted the off-diagonal optical conductivity spectrum, which provides detailed information about the material’s magnetic and electronic properties.

The results revealed three key features in the spectrum: (1) edge peaks indicating spin band splitting, (2) a real component associated with crystal distortion and piezomagnetic effects, and (3) an imaginary component linked to rotational currents. These findings not only confirm the altermagnetic nature of the material but also demonstrate the power of the newly developed optical method.

“This research opens the door to exploring magnetism in a broader class of materials, including organic compounds, and lays the groundwork for future development of high-performance magnetic devices based on lightweight, flexible materials,” adds Iguchi.

Source: Scientists discover a strange new magnet that bends light like magic | ScienceDaily

State Dept. Guts Human Rights Reporting, Removing Anything The Administration Doesn’t Think Violates Human Rights

[…] go ahead and read a few of the reports generated by Marco Rubio/Donald Trump’s State Department and compare them to literally any of those published before Trump’s second term began.

[…]

But if you really want to see how this administration is rewriting its world view to serve its own ends, you need to click through and see the depressingly long list of human rights violations and international crimes the Trump administration no longer desires to treat as violations or criminal acts.

This is only part of it and it’s already more than enough:

Everything highlighted and struck-through is something the State Department will not be investigating or reporting on as long as the GOP is still in power.

Starting from the top, here’s only a partial list of what the Trump administration will be deliberately turning a blind eye to for at least the next three years:

  • Prison conditions
  • Due process rights
  • Property seizures and/or restitution
  • Libel and slander laws
  • “National security (used as a pretext for punishing critics)”
  • Freedom of peaceful assembly
  • Abuse of refugees and asylum seekers
  • Access to basic services for asylum seekers
  • Abuses or irregularities in recent elections
  • Participation of women or members of marginalized people in elections
  • “Section 4: Corruption in government”
  • Retribution against human rights defenders
  • Rape and domestic violence
  • Gender-based violence
  • Child abuse or neglect
  • Sexual exploitation of children
  • Institutionalization of people with disabilities
  • Everything under the heading: “Lesbian, bisexual, transgender, queer, and intersex persons”

That’s not even the entire list, but it’s indicative enough of what this administration thinks should be treated as acceptable behavior by the government, government officials, and anyone in the general population deserving enough of having their crimes against others (and humanity in general) ignored by the people in power.

This sort of thing would be considered breathtakingly horrendous anywhere in the world. That it’s happening in the nation that many considered to be the “Leader of the Free World” is absolutely sickening.

Source: State Dept. Guts Human Rights Reporting, Removing Anything The Administration Doesn’t Think Violates Human Rights | Techdirt

Google wants to verify all developers’ identities, including those not on the play store in massive data grab

  • Google will soon verify the identities of developers who distribute Android apps outside the Play Store.
  • Developers must submit their information to a new Android Developer Console, increasing their accountability for their apps.
  • Rolling out in phases from September 2026, these new verification requirements are aimed at protecting users from malware by making it harder for malicious developers to remain anonymous.

 

Most Android users acquire apps from the Google Play Store, but a small number of users download apps from outside of it, a process known as sideloading. There are some nifty tools that aren’t available on the Play Store because their developers don’t want to deal with Google’s approval or verification requirements. This is understandable for hobbyist developers who simply want to share something cool or useful without the burden of shedding their anonymity or committing to user support.

[…]

Today, Google announced it is introducing a new “developer verification requirement” for all apps installed on Android devices, regardless of source. The company wants to verify the identity of all developers who distribute apps on Android, even if those apps aren’t on the Play Store. According to Google, this adds a “crucial layer of accountability to the ecosystem” and is designed to “protect users from malware and financial fraud.” Only users with “certified” Android devices — meaning those that ship with the Play Store, Play Services, and other Google Mobile Services (GMS) apps — will block apps from unverified developers from being installed.

Google says it will only verify the identity of developers, not check the contents of their apps or their origin. However, it’s worth noting that Google Play Protect, the malware scanning service integrated into the Play Store, already scans all installed apps regardless of where they came from. Thus, the new requirement doesn’t prevent malicious apps from reaching users, but it does make it harder for their developers to remain anonymous. Google likens this new requirement to ID checks at the airport, which verify the identity of travelers but not whether they’re carrying anything dangerous.

[…]

Source: Google wants to make sideloading Android apps safer by verifying developers’ identities – Android Authority

So the new requirement doesn’t make things any safer, but gives Google a whole load of new personal data for no good reason other than that they want it. I guess it’s becoming more and more time to de-Google.

Farmers Insurance data breach impacts 1.1M people after Salesforce attack

U.S. insurance giant Farmers Insurance has disclosed a data breach impacting 1.1 million customers, with BleepingComputer learning that the data was stolen in the widespread Salesforce attacks.

Farmers Insurance is a U.S.-based insurer that provides auto, home, life, and business insurance products. It operates through a network of agents and subsidiaries, serving more than 10 million households nationwide.

The company disclosed the data breach in an advisory on its website, saying that its database at a third-party vendor was breached on May 29, 2025.

“On May 30, 2025, one of Farmers’ third-party vendors alerted Farmers to suspicious activity involving an unauthorized actor accessing one of the vendor’s databases containing Farmers customer information (the “Incident”),” reads the data breach notification on its website.

[…]

The company says that its investigation determined that customers’ names, addresses, dates of birth, driver’s license numbers, and/or last four digits of Social Security numbers were stolen during the breach.

Farmers began sending data breach notifications to impacted individuals on August 22, with a sample notification [1, 2] shared with the Maine Attorney General’s Office, stating that a combined total of 1,111,386 customers were impacted.

[…]

Source: Farmers Insurance data breach impacts 1.1M people after Salesforce attack

Trump admin strips ocean and air pollution monitoring from next-gen weather satellites

The National Oceanic and Atmospheric Administration is narrowing the capabilities and reducing the number of next-generation weather and climate satellites it plans to build and launch in the coming decades, two people familiar with the plans told CNN.

This move — which comes as hurricane season ramps up with Erin lashing the East Coast — fits a pattern in which the Trump administration is seeking to not only slash climate pollution rules, but also reduce the information collected about the pollution in the first place. Critics of the plan also say it’s a short-sighted attempt to save money at the expense of understanding the oceans and atmosphere better.

Two planned instruments, one that would measure air quality, including pollution and wildfire smoke, and another that would observe ocean conditions in unprecedented detail, are no longer part of the project, the sources said.

“This administration has taken a very narrow view of weather,” one NOAA official told CNN, noting the jettisoned satellite instruments could have led to better enforcement and regulations on air pollution by more precisely measuring it.

[…]

Having fewer satellites in the sky means less redundancy and raises the risk of critical data outages, the NOAA official stated. “It’s gambling with the continuity of an operational system that we’ve relied on since the early 70s,” they said.

The satellite series is meant to be the successor to the GOES satellites, which provide a wealth of data for weather forecasting, with the first launch set for 2032 and service lasting through 2055.

[…]

Source: Trump admin strips ocean and air pollution monitoring from next-gen weather satellites | CNN

4chan will refuse to pay daily UK fines, its lawyer tells BBC

A lawyer representing the online message board 4chan says it won’t pay a proposed fine by the UK’s media regulator as it enforces the Online Safety Act.

According to Preston Byrne, managing partner of law firm Byrne & Storm, Ofcom has provisionally decided to impose a £20,000 fine “with daily penalties thereafter” for as long as the site fails to comply with its request.

“Ofcom’s notices create no legal obligations in the United States,” he told the BBC, adding he believed the regulator’s investigation was part of an “illegal campaign of harassment” against US tech firms.

Ofcom has declined to comment while its investigation continues.

“4chan has broken no laws in the United States – my client will not pay any penalty,” Mr Byrne said.

[…]

In a statement posted on X, law firms Byrne & Storm and Coleman Law said 4chan was a US company incorporated in the US, and therefore protected against the UK law.

“American businesses do not surrender their First Amendment rights because a foreign bureaucrat sends them an email,” they wrote.

“Under settled principles of US law, American courts will not enforce foreign penal fines or censorship codes.

“If necessary, we will seek appropriate relief in US federal court to confirm these principles.”

[…]

Ofcom has previously said the Online Safety Act only requires services to take action to protect users based in the UK.

[…]

If 4chan does successfully fight the fine in the US courts, Ofcom may have other options.

“Enforcing against an offshore provider is tricky,” Emma Drake, partner of online safety and privacy at law firm Bird and Bird, told the BBC.

“Ofcom can instead ask a court to order other services to disrupt a provider’s UK business, such as requiring a service’s removal from search results or blocking of UK payments.

“If Ofcom doesn’t think this will be enough to prevent significant harm, it can even ask that ISPs be ordered to block UK access.”

Source: 4chan will refuse to pay daily UK fines, its lawyer tells BBC

Welcome to the world of censorship.

YouTube’s Sneaky AI ‘Experiment’ changing your videos without you knowing

Something strange has been happening on YouTube over the past few weeks. After being uploaded, some videos have been subtly augmented, their appearance changing without their creators doing anything. Viewers have noticed “extra punchy shadows,” “weirdly sharp edges,” and a smoothed-out look to footage that makes it look “like plastic.” Many people have come to the same conclusion: YouTube is using AI to tweak videos on its platform, without creators’ knowledge.

[…]

When I asked Google, YouTube’s parent company, about what’s happening to these videos, the spokesperson Allison Toh wrote, “We’re running an experiment on select YouTube Shorts that uses image enhancement technology to sharpen content. These enhancements are not done with generative AI.” But this is a tricky statement: “Generative AI” has no strict technical definition, and “image enhancement technology” could be anything. I asked for more detail about which technologies are being employed, and to what end. Toh said YouTube is “using traditional machine learning to unblur, denoise, and improve clarity in videos,” she told me. (It’s unknown whether the modified videos are being shown to all users or just some; tech companies will sometimes run limited tests of new features.)

[…]

Source: YouTube’s Sneaky AI ‘Experiment’

Study finds sea-level projections from the 1990s were spot on

Global sea-level change has now been measured by satellites for more than 30 years, and a comparison with climate projections from the mid-1990s shows that they were remarkably accurate, according to two Tulane University researchers whose findings appear in Earth’s Future, an open-access journal published by the American Geophysical Union.

“The ultimate test of climate projections is to compare them with what has played out since they were made, but this requires patience. It takes decades of observations,” said lead author Torbjörn Törnqvist, Vokes Geology Professor in the Department of Earth and Environmental Sciences.

“We were quite amazed how good those early projections were, especially when you think about how crude the models were back then, compared to what is available now,” Törnqvist said. “For anyone who questions the role of humans in changing our climate, here is some of the best proof that we have understood for decades what is really happening, and that we can make credible projections.”

[…]

“Sea level doesn’t rise uniformly – it varies widely,” he said. “Our recent study of this regional variability and the processes behind it relies heavily on data from NASA’s satellite missions and NOAA’s ocean monitoring programs. Continuing these efforts is more important than ever, and essential for informed decision-making to benefit the people living along the coast.”

A new era of monitoring global sea-level change took off when satellites were launched in the early 1990s to measure the height of the ocean surface. This showed that the rate of global sea-level rise since that time has averaged about one eighth of an inch per year. Only more recently, it became possible to detect that the rate of global sea-level rise is accelerating.

When NASA researchers demonstrated in October 2024 that the rate has doubled during this 30-year period, the time was right to compare this finding with projections that were made during the mid-1990s, independent of the satellite measurements.

In 1996, the Intergovernmental Panel on Climate Change published an assessment report soon after the satellite-based sea-level measurements had started. It projected that the most likely amount of global sea-level rise over the next 30 years would be almost 8 centimeters (3 inches), remarkably close to the 9 centimeters that has occurred. But it also underestimated the role of melting ice sheets by more than 2 centimeters (about 1 inch).

[…]

Source: Study finds sea-level projections from the 1990s were spot on | Tulane University News

Paper: Evaluating IPCC Projections of Global Sea-Level Change From the Pre-Satellite Era

A universal rhythm guides how we speak: Global analysis reveals 1.6-second ‘intonation units’

Have you ever noticed that a natural conversation flows like a dance—pauses, emphases, and turns arriving just in time? A new study has discovered that this isn’t just intuition; there is a biological rhythm embedded in our speech.

The work is published in the journal Proceedings of the National Academy of Sciences.

According to the study, led by Dr. Maya Inbar, alongside Professors Eitan Grossman and Ayelet N. Landau, human speech across the world pulses to the beat of what are called units, short prosodic phrases that occur at a consistent rate of one every 1.6 seconds.

The research analyzed over 650 recordings in 48 languages spanning every continent and 27 . Using a novel algorithm, the team was able to automatically identify intonation units in spontaneous speech, revealing that regardless of the language spoken, from English and Russian to in remote regions, people naturally break their speech into these rhythmic chunks.

“These findings suggest that the way we pace our speech isn’t just a cultural artifact, it’s deeply rooted in and biology,” says Dr. Inbar. “We also show that the rhythm of intonation units is unrelated to faster rhythms in speech, such as the rhythm of syllables, and thus likely serves a different cognitive role.”

Why does this matter? intonation units play a critical role in helping listeners follow conversations, take turns speaking, and absorb information. They also offer children crucial cues for learning language. Most intriguingly, the low-frequency rhythm they follow mirrors patterns in linked to memory, attention, and volitional action, illuminating the profound connection between how we speak and how we think.

“This study not only strengthens the idea that intonation units are a universal feature of language,” explains Prof. Grossman, from the Department of Linguistics at Hebrew University, “but also shows that the truly universal properties of languages are not independent of our physiology and cognition.”

[…]

Source: A universal rhythm guides how we speak: Global analysis reveals 1.6-second ‘intonation units’

Uni of Melbourne used Wi-Fi location data to ID protestors

Australia’s University of Melbourne last year used Wi-Fi location data to identify student protestors.

The University used Wi-Fi to identify students who participated in July 2024 sit-in protest. As described in a report [PDF] into the matter by the state of Victoria’s Office of the Information Commissioner, the University directed protestors to leave the building they occupied and warned those who remained could be suspended, disciplined, or reported to police.

The report says 22 chose to remain, and that the University used CCTV and WiFi location data to identify them.

The Information Commissioner found that use of CCTV to identify protestors did not breach privacy, but felt using Wi-Fi location data did because the University’s policies lacked detail.

“Given that individuals would not have been aware of why their Wi-Fi location data was collected and how it may be used, they could not exercise an informed choice as to whether to use the Wi-Fi network during the sit-in, and be aware of the possible consequences for doing so,” the report found.

As the investigation into use of location data unfolded, the University changed its policies regarding use of location data. The Office of the Information Commissioner therefore decided not to issue a formal compliance notice, and will monitor the University to ensure it complies with its undertakings.

Source: Australian uni used Wi-Fi location data to ID protestors • The Register

Privacy‑Preserving Age Verification Falls Apart On Contact With Reality

[…] Identity‑proofing creates a privacy bottleneck. Somewhere, an identity provider must verify you. Even if it later mints an unlinkable token, that provider is the weak link—and in regulated systems it will not be allowed to “just delete” your information. As Bellovin puts it:

Regulation implies the ability for governments to audit the regulated entities’ behavior. That in turn implies that logs must be kept. It is likely that such logs would include user names, addresses, ages, and forms of credentials presented.

Then there’s the issue of fraud and duplication of credentials. Accepting multiple credential types increases coverage and increases abuse; people can and do hold multiple valid IDs:

The fact that multiple forms of ID are acceptable… exacerbates the fraud issue…This makes it impossible to prevent a single person from obtaining multiple primary credentials, including ones for use by underage individuals.

Cost and access will absolutely chill speech. Identity providers are expensive. If users pay, you’ve built a wealth test for lawful speech. If sites pay, the costs roll downhill (fees, ads, data‑for‑access) and coverage narrows to the cheapest providers who may also be more susceptible to breaches:

Operating an IDP is likely to be expensive… If web sites shoulder the cost, they will have to recover it from their users. That would imply higher access charges, more ads (with their own privacy challenges), or both.

Sharing credentials drives mission creep, which will create dangers with the technology. If a token proves only “over 18,” people will share it (parents to kids, friends to friends). To deter that, providers tie tokens to identities/devices or bundle more attributes—making them more linkable and more revocable:

If the only use of the primary credential is obtaining age-verifying subcredentials, this isn’t much of a deterrent—many people simply won’t care…That, however, creates pressure for mission creep… , including opening bank accounts, employment verification, and vaccination certificates; however, this is also a major point of social control, since it is possible to revoke a primary credential and with it all derived subcredentials.

The end result, then is you’re not just attacking privacy again, but you’re creating a tool for authoritarian pressure:

Those who are disfavored by authoritarian governments may lose access not just to pornography, but to social media and all of these other services.

He also grounds it in lived reality, with a case study that shows who gets locked out first:

Consider a hypothetical person “Chris”, a non-driving senior citizen living with an adult child in a rural area of the U.S… Apart from the expense— quite possibly non-trivial for a poor family—Chris must persuade their child to then drive them 80 kilometers or more to a motor vehicles office…

There is also the social aspect. Imagine the embarrassment to all of an older parent having to explain to their child that they wish to view pornography.

None of this is an attack on the math. It’s a reminder that deployment reality ruins the cryptographic ideal. There’s more in the paper, but you get the idea

[…]

Source: Privacy‑Preserving Age Verification Falls Apart On Contact With Reality | Techdirt

Proton releases Lumo GPT 1.1:  faster, more advanced, European and actually private

Today we’re releasing a powerful update to Lumo that gives you a more capable privacy-first AI assistant offering faster, more thorough answers with improved awareness of recent events.

Guided by feedback from our community, we’ve been busy upgrading our models and adding GPUs, which we’ll continue to do thanks to the support of our Lumo Plus subscribers. Lumo 1.1 performs significantly better across the board than the first version of Lumo, so you can now use it more effectively for a variety of use cases:

  • Get help planning projects that require multiple steps — it will break down larger goals into smaller tasks
  • Ask complex questions and get more nuanced answers
  • Generate better code — Lumo is better at understanding your requests
  • Research current events or niche topics with better accuracy and fewer hallucinations thanks to improved web search

New cat, new tricks, same privacy

The latest upgrade brings more accurate responses with significantly less need for corrections or follow-up questions. Lumo now handles complex requests much more reliably and delivers the precise results you’re looking for.

In testing, Lumo’s performance has increased across several metrics:

  • Context: 170% improvement in context understanding so it can accurately answer questions based on your documents and data
  • Coding: 40% better ability to understand requests and generate correct code
  • Reasoning: Over 200% improvement in planning tasks, choosing the right tools such as web search, and working through complex multi-step problems

Most importantly, Lumo does all of this while respecting the confidentiality of your chats. Unlike every major AI platform, Lumo is open source and built to be private by design. It doesn’t keep any record of your chats, and your conversation history is secured with zero-access encryption so nobody else can see it and your data is never used to train the models. Lumo is the only AI where your conversations are actually private.

Learn about Lumo privacy

Lumo mobile apps are now open source

Unlike Big Tech AIs that spy on you, Lumo is an open source application that exclusively runs open source models. Open source is especially important in AI because it confirms that the applications and models are not being used nefariously to manipulate responses to fit a political narrative or secretly leak data. While the Lumo web client is already open source(new window), today we are also releasing the code for the mobile apps(new window). In line with Lumo being the most transparent and private AI, we have also published the Lumo security model so you can see how Lumo’s zero access encryption works and why nobody, not even Proton can access your conversation history.

Source: Introducing Lumo 1.1 for faster, advanced reasoning | Proton

Physicist simulates turning nuclear waste into fusion fuel

[…] The American Chemical Society on Monday shared preliminary findings from Los Alamos physicist Terence Tarnowsky, who has uncovered evidence – albeit from simulations – that the waste from traditional nuclear reactors could be further refined into tritium, turning more than 90,000 metric tons of useless and deadly garbage into a valuable resource.

And by valuable, we mean valuable.

“Right now, the value of commercial tritium is about $15 million per pound [$33 million per kilogram], and the US doesn’t have any domestic capability to create it,” Tarnowsky told the ACS for the announcement of his research, which has yet to be published. According to an abstract of his paper shared with the press release, a 1 GW(th) deuterium–tritium fusion plant would require more than 55 kg of tritium per year.

[…]

According to Tarnowsky’s simulations, all one would need is a particle accelerator to “jump-start atom-splitting reactions” in the waste that would “ultimately produce tritium after a series of other nuclear reactions.”

The idea isn’t new, Tarnowsky admitted, but modern tech finally makes it practical.

According to his research – all simulated thus far, mind you – an accelerator-driven system running at about a gigawatt of thermal power could produce around 2 kilograms of tritium per year, roughly matching the annual commercial output of Canada’s CANDU reactors.

That’s all well and good, but ACS fails to mention some things in the preliminary bit of information it shared ahead of Tarnowsky’s presentation at its Fall expo this week. It’s not clear what the ratio of nuclear waste input to tritium output is, for example. ACS also didn’t mention if there are other byproducts of the process that could be harmful. The org noted in its release that efficiency calculations are the next step Tarnowsky has planned for his ongoing project, and the group didn’t respond to questions before publication.

[…]

Source: Physicist simulates turning nuclear waste into fusion fuel • The Register

US spy chief Gabbard says UK agreed to drop ‘backdoor’ mandate for Apple

U.S. Director of National Intelligence Tulsi Gabbard said on Monday the UK had agreed to drop its mandate for iPhone maker Apple to provide a “backdoor” that would have enabled access to the protected encrypted data of American citizens.

Gabbard issued the statement on X

saying she had worked for months with Britain, along with President Donald Trump and Vice President JD Vance to arrive at a deal.

[…]

U.S. lawmakers said in May that the UK’s order to Apple to create a backdoor to its encrypted user data could be exploited by cybercriminals and authoritarian governments.
Apple, which has said it would never build such access into its encrypted services or devices, had challenged the order at the UK’s Investigatory Powers Tribunal (IPT).
The iPhone maker withdrew its Advanced Data Protection feature for UK users in February following the UK order. Users of Apple’s iPhones, Macs and other devices can enable the feature to ensure that only they — and not even Apple — can unlock data stored on its cloud.
U.S. officials said earlier this year they were examining whether the UK broke a bilateral agreement by demanding that Apple build a backdoor allowing the British government to access backups of data in the company’s encrypted cloud storage systems.
In a letter dated February 25 to U.S. lawmakers, Gabbard said the U.S. was examining whether the UK government had violated the CLOUD Act, which bars it from issuing demands for the data of U.S. citizens and vice versa.
Cybersecurity experts told Reuters that if Apple chose to build a backdoor for a government, that backdoor would eventually be found and exploited by hackers.
[…]

Source: US spy chief Gabbard says UK agreed to drop ‘backdoor’ mandate for Apple | Reuters

Forget LASIK: Safer, cheaper vision correction could be coming soon

[…] In the body, the shapes of many collagen-containing tissues, including corneas, are held in place by attractions of oppositely charged components. These tissues contain a lot of water, so applying an electric potential to them lowers the tissue’s pH, making it more acidic. By altering the pH, the rigid attractions within the tissue are loosened and make the shape malleable. When the original pH is restored, the tissue is locked into the new shape.

Previously, the researchers used EMR to reshape cartilage-rich rabbit ears, as well as alter scars and skin in pigs. But one collagen-rich tissue that they were eager to explore was the cornea.

In this work, the team constructed specialized, platinum “contact lenses” that provided a template for the corrected shape of the cornea, then placed each over a rabbit eyeball in a saline solution meant to mimic natural tears. The platinum lens acted as an electrode to generate a precise pH change when the researchers applied a small electric potential to the lens. After about a minute, the cornea’s curvature conformed to the shape of the lens — about the same amount of time LASIK takes, but with fewer steps, less expensive equipment and no incisions.

They repeated this setup on 12 separate rabbit eyeballs, 10 of which were treated as if they had myopia, or nearsightedness. In all the “myopic” eyeballs, the treatment dialed in the targeted focusing power of the eye, which would correspond to improved vision. The cells in the eyeball survived the treatment, because the researchers carefully controlled the pH gradient. Additionally, in other experiments, the team demonstrated that their technique might be able to reverse some chemical-caused cloudiness to the cornea — a condition that is currently only treatable through a complete corneal transplant.

Though this initial work is promising, the researchers emphasize that it is in its very early stages. Next up is what Wong describes as, “the long march through animal studies that are detailed and precise,” including tests on a living rabbit rather than just its eyeball. They also plan to determine the types of vision correction possible with EMR, such as near- and far-sightedness and astigmatism. Though the next steps are planned, uncertainties in the team’s scientific funding have put them on hold.

[…]

Source: Forget LASIK: Safer, cheaper vision correction could be coming soon | ScienceDaily

A new mRNA cancer vaccine just wiped out tumors in mice

An experimental mRNA vaccine boosted the tumor-fighting effects of immunotherapy in a mouse-model study, bringing researchers one step closer to their goal of developing a universal vaccine to “wake up” the immune system against cancer.

Published recently in Nature Biomedical Engineering, the University of Florida study showed that like a one-two punch, pairing the test vaccine with common anticancer drugs called immune checkpoint inhibitors triggered a strong antitumor response.

A surprising element, researchers said, was that they achieved the promising results not by attacking a specific target protein expressed in the tumor, but by simply revving up the immune system — spurring it to respond as if fighting a virus. They did this by stimulating the expression of a protein called PD-L1 inside of tumors, making them more receptive to treatment. The research was supported by multiple federal agencies and foundations, including the National Institutes of Health.

[…]

“This paper describes a very unexpected and exciting observation: that even a vaccine not specific to any particular tumor or virus — so long as it is an mRNA vaccine — could lead to tumor-specific effects,” said Sayour, principal investigator at the RNA Engineering Laboratory within UF’s Preston A. Wells Jr. Center for Brain Tumor Therapy.

“This finding is a proof of concept that these vaccines potentially could be commercialized as universal cancer vaccines to sensitize the immune system against a patient’s individual tumor,” said Sayour, a McKnight Brain Institute investigator and co-leader of a program in immuno-oncology and microbiome research.

Until now, there have been two main ideas in cancer-vaccine development: To find a specific target expressed in many people with cancer, or to tailor a vaccine that is specific to targets expressed within a patient’s own cancer.

“This study suggests a third emerging paradigm,” said Duane Mitchell, M.D., Ph.D., a co-author of the paper. “What we found is by using a vaccine designed not to target cancer specifically but rather to stimulate a strong immunologic response, we could elicit a very strong anticancer reaction. And so this has significant potential to be broadly used across cancer patients — even possibly leading us to an off-the-shelf cancer vaccine.”

[…]

Source: A new cancer vaccine just wiped out tumors in mice | ScienceDaily

Boffins release 5G traffic sniffing tool

“Sni5Gect [is] a framework that sniffs messages from pre-authentication 5G communication in real-time,” the researchers from the Singapore University of Technology and Design explained of their work, presented this week at the 34th USENIX security bash, “and injects targeted attack payload in downlink communication towards the UE [User Equipment, i.e. a phone].”

Designed to take advantage of the period just after a device connects to a 5G network and is still in the process of handshaking and authentication – which, the team points out, can occur when entering or leaving a lift, disembarking a plane and turning aeroplane mode off, or even passing through a tunnel or parking garage – Sni5Gect takes advantage of unencrypted messaging between the base station and a target handset.

“Since messages exchanged between the gNB [Next-Generation Node B, the base station] and the UE are not encrypted before the security context is established (pre-authentication state),” the researchers wrote, “an attacker does not require knowledge of the UE’s credentials to sniff uplink/downlink [traffic] nor to inject messages without integrity protection throughout the UE connection procedure.”

That’s a flaw, and one the framework is designed to exploit. The team’s testing showed it capable of sniffing both uplink and downlink traffic with more than 80 percent accuracy, at ranges of up to 20 meters between an off-the-shelf software-defined radio and the target mobile. For packet injection, the success rate varied between 70-90 percent – and delivered, among other things, proof of a novel downgrade attack by which a ne’er-do-well equipped with Sni5Gect could downgrade a connection from 5G to 4G to reduce its security and carry out further surveillance and attacks.

As Sni5Gect works in real-time, its creators have claimed, and can inject attack payloads, including multi-stage attacks, based on protocol state, it’s suited to fingerprinting, denial-of-service attacks, and downgrading.

“To the best of our knowledge,” they wrote in their paper’s introduction [PDF], “Sni5Gect is the first framework that empowers researchers with both over-the-air sniffing and stateful injection capabilities, without requiring a rogue gNB [base station].”

[…]

Not all of the capabilities claimed in the team’s paper have been fully disclosed, however. The team has kept private “other serious exploits leveraging the framework,” in order to “avoid abusing SNI5Gect to launch attacks against people’s smartphones[s].” These exploits, it is claimed, will be made available only to “trusted institutions like universities and research institutions” upon application and verification of their legitimate interest.

[…]

More information, including a link to the open-access paper, is available on the project website.

Source: Boffins release 5G traffic sniffing tool • The Register

Find the git repository here

Gamblers Now Bet on AI Models Like Racehorses

Now that AI developers are getting paid like pro athletes, it’s fitting that fans are placing big bets on how well they’re doing their jobs.

On Kalshi, Polymarket and other sites where people wager “predictions” on real-world events, gamblers lay down millions each month on their picks for AI’s top model.

The AI arms race is playing out in plain sight on social media, ranking sites and obscure corners of the internet where enthusiasts hunt for clues. The constant buzz makes the topic appealing for wagers, though not every scrap of information is meaningful.

[…]

Trading volume across AI prediction markets has surged to around $20 million this month. Kalshi, the only platform currently available in the U.S., is seeing 10 times the volume on AI trades compared with the start of the year, a spokesman says.

Each bet, or “contract,” is priced in cents to reflect the odds: McCoy bought thousands of Gemini contracts at around 40 cents, meaning it had a 40% chance of winning. If the bet had settled and Gemini won, McCoy’s 40 cents would become a dollar. If Gemini lost, McCoy would lose it all.

But much of the action happens before the final outcome. As more people piled into the Gemini bet, the contract price rose. McCoy sold when it had reached 87 cents. It’s like betting on a sports match, only with the option to cash out when the odds rise in favor of your bet.

[…]

Strategies vary. Some bet on the big industry players, others buy low on less-known or soon-to-be-updated models. Some compare odds on Kalshi and Polymarket to find arbitrage opportunities in the odds.

As volume for these AI trades continues to grow, the incentive for good information will only increase, and the squeeze on casual bettors will get tighter, says Robin Hanson, a professor of economics at George Mason University.

“When you have better information in these kinds of markets, you can make better decisions,” Hanson says. “If you know a little more, you make more money.”

[…]

Source: Gamblers Now Bet on AI Models Like Racehorses

The EU could be scanning your chats by October 2025 with Chat Control

Denmark kicked off its EU Presidency on July 1, 2025, and, among its first actions, lawmakers swiftly reintroduced the controversial child sexual abuse (CSAM) scanning bill to the top of the agenda.

Having been deemed by critics as Chat Control, the bill aims to introduce new obligations for all messaging services operating in Europe to scan users’ chats, even if they’re encrypted.

The proposal, however, has been failing to attract the needed majority since May 2022, with Poland’s Presidency being the last to give up on such a plan.

Denmark is a strong supporter of Chat Control. Now, the new rules could be adopted as early as October 14, 2025, if the Danish Presidency manages to find a middle ground among the countries’ members.

Crucially, according to the latest data leaked by the former MEP for the German Pirate Party, Patrick Breyer, many countries that said no to Chat Control in 2024 are now undecided, “even though the 2025 plan is even more extreme,” he added.

[…]

As per its first version, all messaging software providers would be required to perform indiscriminate scanning of private messages to look for CSAM – so-called ‘client-side scanning‘. The proposal was met with a strong backlash, and the European Court of Human Rights ended up banning all legal efforts to weaken encryption of secure communications in Europe.

In June 2024, Belgium then proposed a new text to target only shared photos, videos, and URLs, upon users’ permission. This version didn’t satisfy either the industry or voting EU members due to its coercive nature. As per the Belgian text, users must give consent to the shared material being scanned before being encrypted to keep using the functionality.

Source: The EU could be scanning your chats by October 2025 – here’s everything we know | TechRadar

Trojan horse bacteria sneak cancer-killing viruses into tumors

Researchers at Columbia Engineering have built a cancer therapy that makes bacteria and viruses work as a team. In a study published recently in Nature Biomedical Engineering, the Synthetic Biological Systems Lab shows how their system hides a virus inside a tumor-seeking bacterium, smuggles it past the immune system, and unleashes it inside cancerous tumors.

The new platform combines the bacteria’s tendency to find and attack tumors with the virus’s natural preference for infecting and killing cancerous cells. Tal Danino, an associate professor of biomedical engineering at Columbia Engineering, led the team’s effort to create the system, which is called CAPPSID (short for Coordinated Activity of Prokaryote and Picornavirus for Safe Intracellular Delivery). Charles M. Rice, an expert in virology at The Rockefeller University, collaborated with the Columbia team.

“We aimed to enhance bacterial cancer therapy by enabling the bacteria to deliver and activate a therapeutic virus directly inside tumor cells, while engineering safeguards to limit viral spread outside the tumor,” says co-lead author Jonathan Pabón, an MD/PhD candidate at Columbia.

The researchers believe that this technology — validated in mice — represents the first example of directly engineered cooperation between bacteria and cancer-targeting viruses.

The approach combines the bacteria’s instinct for homing in on tumors with a virus’s knack for infecting and killing cancer cells. “By bridging bacterial engineering with synthetic virology, our goal is to open a path toward multi-organism therapies that can accomplish far more than any single microbe could achieve alone,” says Zakary S. Singer, a co-lead author and former postdoctoral researcher in Tal Danino’s lab.

“This is probably our most technically advanced and novel platform to date,” says Danino, who is also affiliated with the Herbert Irving Comprehensive Cancer Center at Columbia University Irving Medical Center and Columbia’s Data Science Institute.

Sneaking past the immune system

One of the biggest hurdles in oncolytic virus therapy is the body’s own defense system. If a patient has antibodies against the virus — from a prior infection or vaccination — those antibodies can neutralize it before it reaches a tumor. The Columbia team sidestepped that problem by tucking the virus inside tumor-seeking bacteria.

“The bacteria act as an invisibility cloak, hiding the virus from circulating antibodies, and ferrying the virus to where it is needed,” Singer says.

Pabón says this strategy is especially important for viruses that people are already exposed to in daily life.

“Our system demonstrates that bacteria can potentially be used to launch an oncolytic virus to treat solid tumors in patients who have developed immunity to these viruses,” he says.

Targeting the tumor

The system’s bacterial half is Salmonella typhimurium, a species that naturally migrates to the low-oxygen, nutrient-rich environment inside tumors. Once there, the bacteria invade cancer cells and release the virus directly into the tumor’s interior.

“We programmed the bacteria to act as a Trojan horse by shuttling the viral RNA into tumors and then lyse themselves directly inside of cancer cells to release the viral genome, which could then spread between cancer cells,” Singer says.

By exploiting the bacteria’s tumor-homing instincts and the virus’s ability to replicate inside cancer cells, the researchers created a delivery system that can penetrate the tumor and spread throughout it — a challenge that has limited both bacteria- and virus-only approaches.

Safeguarding against runaway infections

A key concern with any live virus therapy is controlling its spread beyond the tumor. The team’s system solved that problem with a molecular trick: making sure the virus couldn’t spread without a molecule it can only get from the bacteria. Since the bacteria stay put in the tumor, this vital component (called a protease) isn’t available anywhere else in the body.

“Spreadable viral particles could only form in the vicinity of bacteria, which are needed to provide special machinery essential for viral maturation in the engineered virus, providing a synthetic dependence between microbes,” Singer says. That safeguard adds a second layer of control: even if the virus escapes the tumor, it won’t spread in healthy tissue.

“It is systems like these — specifically oriented towards enhancing the safety of these living therapies — that will be essential for translating these advances into the clinic,” Singer says.

Further research and clinical applications

This publication marks a significant step toward making this type of bacteria-virus system available for future clinical applications.

“As a physician-scientist, my goal is to bring living medicines into the clinic,” Pabón says. “Efforts toward clinical translation are currently underway to translate our technology out of the lab.”

Danino, Rice, Singer, and Pabón have filed a patent application (WO2024254419A2) with the U.S. Patent and Trademark Office related to this work.

Looking ahead, the team is testing the approach in a wider range of cancers, using different tumor types, mouse models, viruses, and payloads, with an eye to developing a “toolkit” of viral therapies that can sense and respond to specific conditions inside a cell. They are also evaluating how this system can be combined with strains of bacteria that have already demonstrated safety in clinical trials.


Story Source:

Materials provided by Columbia University School of Engineering and Applied Science. Note: Content may be edited for style and length.


Journal Reference:

  1. Zakary S. Singer, Jonathan Pabón, Hsinyen Huang, William Sun, Hongsheng Luo, Kailyn Rhyah Grant, Ijeoma Obi, Courtney Coker, Charles M. Rice, Tal Danino. Engineered bacteria launch and control an oncolytic virus. Nature Biomedical Engineering, 2025; DOI: 10.1038/s41551-025-01476-8

Source: Trojan horse bacteria sneak cancer-killing viruses into tumors | ScienceDaily

How Age Verification Laws Targeting Online Porn Could Be (And Should Be) Viewed As A Labor Rights Issue

[…]

While not a traditional “labor issue,” like union rights and equal pay, the government’s role in regulating and restricting forms of expression that can be produced, distributed, and monetized for entertainment media consumption is a dimension of the age-gating issue often overlooked and/or ignored.

Digital sex workers’ incomes and living conditions are dependent on platforms for content distribution. Sites like OnlyFans, Pornhub, xHamster, Chaturbate, and literally thousands more grant performers and content creators access to revenue generation opportunities that are remote, distributed, and confidential.

Due to these platforms forming the foundations of a trend-setting, technology-innovating, digitally native entertainment industry, age verification laws target digital sex workers’ means of distribution and, in a lot of cases, means of production. The overwhelming majority of adult content creators and adult performers are self-employed—classified as independent contractors and/or small business owners. Some performers have incorporated, with others adding trademarks and intellectual property protections on their branding.

Consider a few examples of adult content creators actively engaging in the activity of running a small business or self-employed enterprise. Platforms such as OnlyFans issue tax forms so that content creators can accurately report their income to the IRS and their state tax authorities. Or take the example of the performer-creator, going by the stage name Gigi Dior, duking it out with high-fashion house Christian Dior in front of the Trademark Trial and Appeal Board at the U.S. Patent and Trademark Office. Activities and actions like these aren’t seen by the vast majority of consumers—or, importantly, the critics of the entire online adult ecosystem.

We all hear the “think of the children” mantra from the Helen Lovejoys of the world daily. We are seeing it now with Collective Shout teaming up with Visa and Mastercard to clamp down on NSFW gaming. We are seeing it in the United Kingdom with calls from both the House of Commons and the House of Lords to ban certain types of pornography to comply with a broad interpretation of the Online Safety Act of 2023.

At least 40 percent of all United States residents live in jurisdictions with age verification laws. Millions of adult content creators are diverse and dynamic. Faced with all of these mounting regulatory pressures, adult entertainment performers and adult content creators—particularly those operating with marginalized identities—have developed a range of creative strategies to sustain their work, visibility, and autonomy in the national digital space. Inaccessibility is a legitimate issue that goes far beyond concerns of consumers.

While these laws are often framed as protecting children, the actual barrier they create is for adults — the lawful consumers who make up the legitimate market for adult entertainment. Under laws like Texas’s HB 1181, anyone wanting to access adult content must submit government-issued ID or sensitive personal data to a third-party vendor. Many adults are unwilling to do this, not because they wish to evade age restrictions, but because they don’t trust where that data will go, how it will be stored, or who might access it.

The result is that large numbers of adults — the only legal audience for these performers in the first place — stop visiting legitimate platforms altogether. That loss of audience directly translates into a loss of income for adult content creators. For an industry where the majority of workers are self-employed, often operating as small businesses, the shrinkage of the paying customer base is an existential threat.

This is why age verification mandates should also be seen as a labor rights issue. They are not simply regulating content; they are regulating the ability of consenting adults to transact with one another in a lawful marketplace.

[…]

Source: How Age Verification Laws Targeting Online Porn Could Be (And Should Be) Viewed As A Labor Rights Issue  | Techdirt

$81M ‘Trade Secrets’ Verdict Against Boeing Was Overturned – and Then Reinstated

14 months ago a jury ruled against Boeing, awarding $81 million in damages to failed electric airplane startup Zunum. “Zunum alleged that Boeing, while ostensibly investing seed money to get the startup off the ground, stole Zunum’s technology and actively undermined its attempts to build a business,” the Seattle Times reported at the time.

But two months later that verdict was overturned, Reuters reports, with U.S. District Judge James Robart deciding that Zunum “did not adequately identify its secrets or show that they derived their value from being kept secret.”

And then three days ago a U.S. appeals court reinstated the original $81 million award, reversing that district judge’s decision and “rejecting his finding that the information Boeing allegedly stole was not entitled to trade-secret protection.” [T]he district court erred in concluding that “Zunum failed to identify any of its alleged trade secrets with sufficient particularity”… Here, the court rejected Zunum’s repeated attempts to introduce comprehensive trade secret definitions into evidence and instead provided the jury with a court-created exhibit enumerating Zunum’s alleged trade secrets with a short description of each. Zunum’s witnesses identified the trade secrets by number, provided a basic explanation of each, and used exhibits and demonstratives to exemplify information comprising specific trade secrets.
“internal Boeing communications introduced at trial suggesting that Boeing intended to modify its own in-house designs, methods, and strategies to incorporate information from certain Zunum trade secrets…” according to the new ruling. “Under the parties’ agreement, Boeing was not permitted to use Zunum’s confidential information for any reason other than to manage its investment in Zunum.”

Reuters adds that “A spokesperson for Boeing declined to comment on the appeals court’s decision”

One final note: The appeals court also ordered the case to be assigned to a new judge after Robart revealed that his wife had acquired Boeing stock through a retirement savings account during the litigation.
Judge Robart had called that an “error”. (And judicial ethics experts interviewed by Business Insider in 2024 “characterized Robart’s trades and delayed disclosure to the parties as a minor issue,” they reported Thursday.)

But Thursday’s ruling notes that the delayed disclosure “taken together with the district court’s consistent rulings in Boeing’s favor during and after trial, could give an objective observer reason to question the district judge’s impartiality in further proceedings.”

Source: $81M ‘Trade Secrets’ Verdict Against Boeing Was Overturned – and Then Reinstated

Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere

[…] Zveare, who has found bugs in carmakers’ customer systems and vehicle management systems before, found the flaw earlier this year as part of a weekend project, he told TechCrunch.

He said while the security flaws in the portal’s login system was a challenge to find, once he found it, the bugs let him bypass the login mechanism altogether by permitting him to create a new “national admin” account.

The flaws were problematic because the buggy code loaded in the user’s browser when opening the portal’s login page, allowing the user — in this case, Zveare — to modify the code to bypass the login security checks. Zveare told TechCrunch that the carmaker found no evidence of past exploitation, suggesting he was the first to find it and report it to the carmaker.

When logged in, the account granted access to more than 1,000 of the carmakers’ dealers across the United States, he told TechCrunch.

“No one even knows that you’re just silently looking at all of these dealers’ data, all their financials, all their private stuff, all their leads,” said Zveare, in describing the access.

Zveare said one of the things he found inside the dealership portal was a national consumer lookup tool that allowed logged-in portal users to look up the vehicle and driver data of that carmaker.

In one real-world example, Zveare took a vehicle’s unique identification number from the windshield of a car in a public parking lot and used the number to identify the car’s owner. Zveare said the tool could be used to look up someone using only a customer’s first and last name.

With access to the portal, Zveare said it was also possible to pair any vehicle with a mobile account, which allows customers to remotely control some of their cars’ functions from an app, such as unlocking their cars.

Zveare said he tried this out in a real-world example using a friend’s account and with their consent. In transferring ownership to an account controlled by Zveare, he said the portal requires only an attestation — effectively a pinky promise — that the user performing the account transfer is legitimate.

“For my purposes, I just got a friend who consented to me taking over their car, and I ran with that,” Zveare told TechCrunch. “But [the portal] could basically do that to anyone just by knowing their name — which kind of freaks me out a bit — or I could just look up a car in the parking lots.”

[…]

Zveare said this was similar to a feature found in a Toyota dealer portal discovered in 2023.

“They’re just security nightmares waiting to happen,” said Zveare, speaking of the user-impersonation feature.

Once in the portal Zveare found personally identifiable customer data, some financial information, and telematics systems that allowed the real-time location tracking of rental or courtesy cars, as well as cars being shipped across the country, and the option to cancel them — though, Zveare didn’t try.

Zveare said the bugs took about a week to fix in February 2025 soon after his disclosure to the carmaker.

[…]

Source: Security flaws in a carmaker’s web portal let one hacker remotely unlock cars from anywhere | TechCrunch

However he won’t identify the car maker – which is a real problem with bad responsible disclosure rules.

Phishing training is pretty pointless, researchers find

In a scientific study involving thousands of test subjects, eight months and four different kinds of phishing training, the average improvement rate of falling for phishing scams was a whopping 1.7%.

“Is all of this focus on training worth the outcome?” asked researcher Ariana Mirian, a senior security researcher at Censys and recently a Ph.D. student at U.C. San Diego, where the study was conducted. “Training barely works.”

[…]

Dameff and Mirian wanted scientifically rigorous, real-world results. (You can read their academic paper here.) They enrolled more than 19,000 employees of the UCSD Health system and randomly split them into five groups, each member of which would see something different when they failed a phishing test randomly sent once a month to their workplace email accounts.

  • Control: Its members got a 404 error if they clicked on a phishing link in the body of the email.
  • Generic static: This group saw a static webpage containing general information about avoiding phishing scams.
  • Generic interactive: This group was walked through an interactive question-and-answer exercise.
  • Contextual static: A static webpage again, but this time showing the exact phishing lure the subject had received and pointing out the warning signs that were missed.
  • Contextual interactive: An interactive Q&A session that walked the subject on what they missed in the specific lure they’d received.

Over the eight months of testing, however, there was little difference in improvement among the four groups that received different kinds of training. Those groups did improve a bit over the control group’s performance — by the aforementioned 1.7%.

Not what was expected

However, there were some lessons learned — not all expected. The first was that it helped a lot to change up the phishing lures. Most subjects saw right through a phishing email that urged the recipients to change their Outlook account passwords, resulting in failure rates between 1% and 4%.

But about 30% of users clicked on a link promising information about a change in the organization’s vacation policy. Almost as many fell for one about a change in workplace dress code.

“Whoever controls the lures controls the failure rates,” said Mirian. “It’s important to have different lures in your phishing training.”

Another lesson was that given enough time, almost everyone falls for a phishing email. Over the eight months of the experiment, just over 50% failed at least once.

“Given enough time, most people get pwned,” said Mirian. “We need to stop punishing people who fail phishing tests. You’d end up punishing half the company.”

[…]

Source: Phishing training is pretty pointless, researchers find | SC Media

And for a more guerrilla approach, you may want to look at this:

Google Issues New Update Warning To 3.5 Billion Chrome Users

Google has issued a security update for its Chrome browser which you should apply right now. That’s because Google has fixed six issues in its widely-used browser, half of which are rated as having a high severity.

The Chrome Stable channel has been updated to 139.0.7258.127/.128 for Windows, Mac and 139.0.7258.127 for Linux, Google said in an advisory published on the Chrome blog. The Chrome update will roll out over the coming days and weeks, according to Google.

The latest Google Chrome security fixes come just one week after the browser maker issued an update for eight flaws and two weeks following an emergency patch for a high severity vulnerability. The Chrome update also comes after Apple released iOS 18.6, fixing a hefty list of 29 security flaws.

[…]

High Severity Issues Fixed In Google Chrome

CVE-2025-8879 is a heap buffer overflow flaw in libaom, which is rated as having a high impact. Meanwhile, CVE-2025-8880 is a race issue in V8 that Google has also rated as having a high severity.

The last high severity vulnerability is CVE-2025-8901, an out of bounds write issue in ANGLE, which allows a remote attacker to perform out of bounds memory access via a crafted HTML page.

Google details two of the medium severity flaws, CVE-2025-8881, an inappropriate implementation issue in File Picker and CVE-2025-8882, a use after free vulnerability in Aura.

None of the flaws fixed in Google Chrome have been used in real-life attacks, but some of the issues are pretty serious — especially those that can be exploited by remote attackers.

[…]

Source: Google Issues New Update Warning To 3.5 Billion Chrome Users