Loading today’s stories
Long form
Deep Dives
The longer read: reporting that follows the evidence past the first turn of the story.
Science · Deep Dive
Provenance attestations inherit your source control's integrity, and nothing tests that
GitHub's own docs say attestations do not guarantee an artifact is secure, and SLSA's source claims only run forward from onboarding; a rewritten commit or a stolen cookie exploits the gap silently.
4 publishers
Security · Deep Dive
Assume Compromise on Windchill: Clop Built a Shell That Knows Your PLM Schema
The web shell dropped on PTC Windchill servers queries the database as the application itself. There is no encryption stage, so ransomware controls stay quiet and the first signal is an extortion email.
5 publishers
Leadership · Deep Dive
The Commissioned Angle Had No Sources. What the Material Did Have Was a Capacity Problem
The brief named two suppliers, a 60-day pricing window and an automated shutdown rule. The supplied sources are about a monk, dinosaur pictures and a sealed cave in northern Spain.
2 publishers
Invest · Deep Dive
Pennsylvania Puts a Price on Its Data Center Welcome: $517 Million a Year
Shapiro's GRID Standards gate state support, fast permits and a sales tax exemption behind one certification. Two of those three levers are already his; the expensive one needs the legislature.
4 publishers
Build · Deep Dive
Agents can hit send now, and the primitives that make that survivable come from payments
Google, Anthropic and Rillet have shipped agents that take irreversible actions. The engineering that keeps those actions safe is idempotency keys and event de-duplication, not better prompts.
4 publishers
Science · Deep Dive
A Config File Is Now an Executable, and Nobody Has the Inventory
Tenable and Adversa describe agent tooling that runs whatever a cloned repository hands it. An Anthropic-EPFL preprint shows the same precondition with no code execution at all.
3 publishers
Leadership · Deep Dive
The gate, not the fine: Pennsylvania makes $517 million in tax relief conditional, project by project
Shapiro's GRID Standards attach four conditions to Commonwealth support for data centers, and the strongest part of that lever still needs the General Assembly. The unit of exposure is the project.
2 publishers
Product · Deep Dive
Pennsylvania wrote its data centre objections as an eligibility gate, not a fine
The GRID Standards turn state support into a certification a developer can fail. The part with real money in it, a tax break projected to cost over $517m a year by FY 2030-31, needs the legislature.
5 publishers
Invest · Deep Dive
AI Can Reach 45% of Your Data. The Firm Measuring That Also Sells the Remedy
A Google Cloud-sponsored MIT Technology Review Insights study says 55% of executives cannot scale agents because of their own data systems. The diagnosis has an owner and a price list.
3 publishers
Build · Deep Dive
20,700 CVEs, A Fake Build Step And One Matching SHA-1: The Provenance Gate Nobody Built
Disclosure volume rose 36 percent last quarter while confirmed exploitation rose 10, and the human review gates began shedding load. The checks that held were the ones a machine could run.
22 publishers
Security · Deep Dive
The Extortion Desk That Never Needs a Vulnerability
GuidePoint says the "third party" emailing ransomware victims with an offer of help is the affiliate that took their data. Decide your verification policy and your ceiling before that email arrives.
24 publishers
Invest · Deep Dive
A $125bn Backstop, a Halved Guarantee, and the Number Nobody Has: What Old GPUs Are Worth
Nvidia says its compute has the longest life of any AI asset and lined up six firms to raise $500bn on that premise. Four days later, investors made it cut a guarantee in half.
5 publishers