Critical Gitea Vulnerability (CVE-2026-60004) Actively Exploited for Crypto Mining – Upgrade to 1.27.1 Now

A serious vulnerability in the popular self-hosted Git service Gitea has drawn urgent attention from security teams worldwide after federal authorities confirmed active exploitation in real-world attacks. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw, tracked as CVE-2026-60004 and carrying a CVSS score of 9.8, to its Known Exploited Vulnerabilities catalog. This move signals that threat actors have already developed reliable methods to compromise exposed instances, making immediate patching a priority for any organization running the platform.

The vulnerability centers on the diffpatch endpoint, a component designed to handle repository patch operations. Researchers discovered that users with write access to a repository can manipulate this endpoint to create and install Git hooks that execute arbitrary commands on the underlying server. Because Gitea runs these hooks under the same service account that powers the application itself, successful exploitation grants attackers full control over the host system. In observed incidents, adversaries have used this access to deploy payloads that behave similarly to cryptocurrency miners, quietly consuming server resources while blending into normal system processes.

Gitea’s default configuration contributes significantly to the risk. The platform enables open user registration by default, allowing anyone to create an account and potentially gain write access to public repositories. Once an account is established, an attacker can create or fork a repository, push malicious changes that trigger the vulnerable diffpatch logic, and plant a post-receive or update hook containing shell commands. These hooks then execute automatically when the repository receives new commits, giving the attacker a persistent foothold without needing additional authentication.

SecurityWeek first reported on the active exploitation campaign, noting that multiple organizations had already detected suspicious activity tied to the vulnerability. In several cases, forensic analysis revealed mining software installed alongside modified configuration files intended to maintain persistence across restarts. The payloads observed so far appear focused on resource theft rather than data exfiltration or ransomware deployment, though experts warn that the same access could easily support more destructive objectives.

The vulnerability affects all versions of Gitea prior to 1.21.5, 1.22.4, and 1.23.0, with the most recent fix appearing in version 1.27.1 and later releases. Administrators running older branches should prioritize upgrades or implement temporary mitigations while planning their migration path. The Gitea project maintainers released patches that strengthen input validation on the diffpatch endpoint and restrict the locations where Git hooks can be written. They also added runtime checks to prevent execution of hooks originating from untrusted repository content.

Organizations that cannot upgrade immediately face limited defensive options. Disabling repository hooks entirely through configuration settings can reduce risk, though this approach breaks legitimate automation workflows that many development teams rely upon. Restricting user registration to approved domains or requiring administrator approval for new accounts can shrink the pool of potential attackers, yet these changes require careful planning to avoid disrupting collaborative environments. Network-level controls that limit access to Gitea instances to trusted IP ranges provide another layer of protection, particularly for servers exposed to the public internet.

The discovery of this flaw highlights ongoing challenges with Git hook mechanisms across multiple platforms. Similar issues have appeared in other version control systems over the years, often stemming from the inherent tension between powerful automation features and the need to contain untrusted code. Git itself allows hooks to run arbitrary executables, and when a web application like Gitea exposes control over hook content to external users, the attack surface expands dramatically.

Forensic evidence gathered from compromised systems shows that attackers typically follow a predictable sequence. After gaining initial code execution through the hook, they download additional payloads from command-and-control servers hosted on bulletproof hosting providers. These secondary stages often include process hollowing techniques to hide mining activity within legitimate system binaries. Some campaigns also install rootkits or modify scheduled tasks to ensure the miner survives reboots and software updates.

The The Hacker News coverage of the incident emphasized that the vulnerability’s high severity stems not only from its technical impact but also from the ease with which attackers can obtain the necessary repository access. In many observed cases, threat actors simply signed up for accounts on public Gitea instances, created throwaway repositories, and triggered the exploit within minutes. This low barrier to entry explains why exploitation appeared so quickly after the vulnerability’s public disclosure.

Security researchers have published proof-of-concept code demonstrating the attack, though they deliberately omitted certain details to slow widespread adoption by less sophisticated threat actors. Even so, multiple independent groups have reverse-engineered the missing pieces, leading to several exploit repositories appearing on public code-sharing platforms. This rapid dissemination underscores the need for organizations to treat the vulnerability as an immediate threat rather than a theoretical concern.

Beyond the technical mechanics, the incident raises questions about supply chain risks associated with self-hosted development tools. Many organizations deploy Gitea as part of larger continuous integration and continuous deployment pipelines. A compromised Gitea server can therefore serve as a pivot point to attack build servers, artifact repositories, or even production infrastructure. Attackers who gain control of a Gitea instance might modify source code undetected, inject backdoors into compiled binaries, or steal credentials stored in repository secrets.

Administrators should conduct thorough audits of their Gitea deployments. Key steps include reviewing all installed hooks across every repository, scanning for unexpected processes consuming high CPU resources, and examining network logs for outbound connections to unfamiliar domains. Tools that monitor file integrity on the Gitea host can help detect unauthorized changes to hook directories or configuration files. Because the service account often possesses broad permissions, investigators should also check for new user accounts, modified sudoers files, or unexpected SSH keys.

The addition of CVE-2026-60004 to the CISA KEV catalog carries regulatory implications for federal agencies and contractors. Organizations subject to binding operational directives must apply the available patches or implement approved mitigations within a specified timeframe. Even private sector entities without formal compliance obligations benefit from following CISA’s guidance, as the catalog serves as a reliable indicator of threats currently targeting production environments.

Gitea’s popularity has grown steadily as teams seek alternatives to larger commercial platforms. Its lightweight design, open-source licensing, and straightforward installation process make it attractive for both small projects and enterprise deployments. Unfortunately, this widespread adoption also increases the number of potential targets. Attackers have demonstrated they can scan the internet for exposed Gitea instances using simple fingerprinting techniques based on default login pages or API response headers.

Looking forward, the Gitea project has signaled plans to implement more granular permission models around hook management. Future releases may separate the privileges required to edit repository content from those needed to modify executable hooks. Such architectural changes could prevent entire classes of attacks while preserving the platform’s automation capabilities. In the meantime, administrators are encouraged to subscribe to the project’s security mailing list and monitor official release notes for additional hardening measures.

The observed mining payloads, while not particularly sophisticated, reveal a clear economic motive. Cryptocurrency mining allows attackers to monetize compromised infrastructure with minimal interaction after the initial breach. Because many Gitea servers run on powerful hardware optimized for compilation tasks, they provide ideal targets for CPU-intensive mining operations. Some victims have reported monthly electricity costs increasing by thousands of dollars before the compromise was discovered.

Security teams recommend treating all self-hosted Git services with the same caution applied to other internet-facing applications. Regular vulnerability scanning, automated patch management, and network segmentation can reduce exposure. Where possible, organizations should consider containerizing Gitea deployments to limit the blast radius of a successful compromise. Running the service under a dedicated low-privilege user and applying strict file system permissions further constrains what an attacker can achieve.

As exploitation continues, security vendors have begun releasing updated detection signatures for common mining tools and anomalous hook execution patterns. Endpoint detection and response platforms can alert on processes spawned from within the Gitea data directory, especially when those processes exhibit network activity associated with mining pools. Web application firewalls may also block malicious requests to the diffpatch endpoint if properly tuned to recognize exploit patterns.

The speed with which this vulnerability moved from disclosure to active exploitation serves as a reminder that modern threat actors monitor security research closely. Proof-of-concept code that appears in academic papers or conference presentations often becomes weaponized within days. Organizations cannot afford to delay remediation while waiting for more detailed technical analysis or vendor guidance.

Administrators running Gitea in air-gapped environments should still apply patches as soon as possible, since insider threats or compromised developer workstations could introduce the exploit through internal repositories. The requirement for repository write access does not necessarily mean the attacker must come from outside the organization. A compromised developer account or stolen credentials could provide the same level of access.

The broader lesson from this incident involves maintaining visibility into all development infrastructure. Many security programs focus heavily on production applications while treating internal tools as lower risk. Yet these internal systems frequently hold privileged credentials, access to source code, and direct pathways into build pipelines. A single vulnerable component like an outdated Gitea instance can undermine otherwise strong perimeter defenses.

Teams should also evaluate whether their current Git platform still meets security requirements. Some organizations have begun migrating to solutions with stronger default configurations and more sophisticated access controls. Others have implemented additional monitoring layers specifically tailored to version control systems, watching for unusual repository creation patterns or sudden spikes in hook execution.

Despite the urgency surrounding this particular vulnerability, experts stress that Gitea remains a capable and widely used platform when properly maintained. The project has demonstrated a commitment to rapid remediation once issues surface, and the latest versions incorporate multiple improvements beyond the immediate CVE-2026-60004 fix. Organizations that upgrade promptly and adopt recommended security practices can continue using the software with reduced risk.

The active exploitation of this remote code execution flaw in Gitea illustrates how quickly a seemingly specialized vulnerability can impact a diverse range of organizations. From individual developers running personal instances to large enterprises managing thousands of repositories, anyone exposing Gitea to untrusted users must act decisively. The combination of easy account creation, powerful hook functionality, and a critical flaw in patch handling has created conditions that attackers have already begun to exploit at scale. Prompt upgrades to version 1.27.1 or newer, combined with thoughtful configuration changes, represent the most effective path toward restoring secure operations.

from WebProNews https://ift.tt/bSv79hf

Medusa Ransomware Hits Over 500 Organizations Worldwide, CISA Warns

The Medusa ransomware operation has compromised more than 500 organizations worldwide, prompting fresh warnings from federal authorities about its expanding reach and aggressive tactics. An updated joint advisory issued by the Cybersecurity and Infrastructure Security Agency, the Federal Bureau of Investigation, and the Department of Health and Human Services outlines how the group and its affiliates continue to target entities across critical infrastructure sectors. Healthcare providers, manufacturers, government agencies, information technology firms, and financial institutions have all appeared on the growing victim list. As of April 2026, the scale of these attacks underscores the persistent threat posed by ransomware-as-a-service models that allow even less skilled actors to launch sophisticated campaigns.

Medusa functions primarily as a ransomware-as-a-service platform, enabling affiliates to deploy the malware after purchasing access or licensing the tool from its core operators. This business structure has accelerated the group’s growth by distributing responsibility and broadening the pool of potential attackers. According to the advisory available at CISA’s official page, the operation relies heavily on initial access brokers who sell pre-compromised network credentials on underground forums. These brokers often obtain entry through phishing emails that trick users into revealing credentials or executing malicious attachments. Once inside a target network, affiliates move quickly to escalate privileges and deploy the ransomware payload.

The speed with which Medusa actors exploit newly disclosed vulnerabilities stands out as a defining characteristic. Rather than waiting for widespread patching, the group scans for and attacks systems running unpatched software within days of a vulnerability becoming public. This approach has allowed them to bypass traditional defense timelines and compromise organizations before many realize they face heightened risk. The advisory from Help Net Security notes that Medusa frequently combines these exploits with credential dumping tools and lateral movement techniques to spread across an environment. Such methods reduce the window available for detection and response teams to contain an intrusion.

Double extortion remains central to the group’s strategy. After encrypting files with strong RSA and AES algorithms, attackers exfiltrate sensitive data before triggering the ransomware. They then threaten to publish stolen information on dedicated leak sites if victims refuse to pay. This tactic increases pressure on organizations that might otherwise accept data loss but cannot afford reputational damage or regulatory penalties from exposed customer records. Healthcare entities in particular face acute challenges because leaked patient information can trigger HIPAA violations and long-term trust erosion. Manufacturing firms risk exposure of proprietary designs, while government agencies contend with potential national security implications.

The updated technical details in the joint advisory provide defenders with a clearer picture of Medusa’s current behaviors. Operators favor specific living-off-the-land binaries to avoid introducing easily detectable malware. They commonly use tools such as PowerShell, Windows Management Instrumentation, and legitimate remote access software to maintain persistence and move laterally. Command and control infrastructure often routes through proxy servers and compromised legitimate domains to mask traffic. The advisory lists refreshed indicators of compromise, including file hashes, IP addresses, and domain names associated with recent campaigns. Security teams are encouraged to review these indicators against their network logs and endpoint telemetry to identify potential footholds.

One notable evolution involves the group’s targeting priorities. While earlier versions of Medusa showed preference for Windows servers, recent activity demonstrates increased focus on hybrid cloud environments and virtualized infrastructure. Affiliates have adapted scripts to enumerate cloud storage buckets, virtual machine snapshots, and backup repositories. By destroying or encrypting backup systems early in the attack chain, they aim to eliminate recovery options and force payment. This shift reflects a broader trend among ransomware operators who recognize that reliable backups represent the most effective defense against their operations.

Mitigation guidance from CISA, FBI, and HHS emphasizes a defense-in-depth approach. Organizations should implement multifactor authentication across all remote access points and administrative interfaces. Regular vulnerability scanning combined with prompt patching of internet-facing systems can reduce exposure to the rapid exploitation tactics Medusa favors. Network segmentation limits lateral movement once an initial breach occurs, while robust backup strategies that include offline or immutable copies provide recovery pathways that do not depend on attacker goodwill. Employee training programs that simulate phishing scenarios help reduce the success rate of initial access attempts.

The advisory also recommends deployment of endpoint detection and response solutions capable of identifying suspicious PowerShell activity and anomalous file access patterns. Behavioral analytics can flag unusual data exfiltration attempts before large volumes of information leave the network. Incident response plans should incorporate tabletop exercises that specifically address ransomware scenarios involving data theft and encryption. Organizations in regulated sectors such as healthcare must ensure their plans align with federal notification requirements that can trigger within hours of discovery.

Financial consequences of Medusa attacks vary but frequently reach millions of dollars when factoring in ransom demands, downtime, recovery costs, and potential regulatory fines. Some victims have chosen to pay, though authorities strongly discourage this practice because it funds future operations and provides no guarantee that attackers will honor their promises to delete stolen data. Others have restored from backups after weeks of system outages that disrupted patient care, halted production lines, or delayed government services. The cumulative economic impact across more than 500 known victims illustrates how ransomware continues to function as a tax on digital infrastructure.

Law enforcement efforts have disrupted some Medusa infrastructure, but the ransomware-as-a-service model allows operators to reconstitute quickly under new branding or through affiliate networks. The group’s leak sites remain active, periodically publishing samples of stolen data to demonstrate credibility and pressure victims. Security researchers continue to monitor these portals for patterns that might reveal additional targets or emerging tactics. Collaboration between public and private sectors has produced the detailed advisory, which serves as both a warning and a practical resource for organizations seeking to strengthen their defenses.

Smaller and mid-sized organizations often assume they fall below the radar of sophisticated ransomware groups, yet Medusa has shown willingness to pursue any entity with valuable data or adequate financial resources. The advisory highlights several cases where initial access was gained through third-party vendors with weaker security postures. Supply chain compromise represents another vector that organizations must address through contractual requirements and regular assessment of vendor controls. Managed service providers in particular face heightened scrutiny because a single breach in their environment can expose numerous downstream customers.

Technical analysis of Medusa samples reveals continuous development of the core ransomware binary. Newer versions include enhanced anti-analysis features designed to evade sandbox environments and security tools. The encryption routine has been optimized for speed, allowing attackers to lock files across large networks in shorter timeframes. These improvements demonstrate that operators invest in product development much like legitimate software companies, albeit with criminal objectives. Understanding these technical refinements helps security vendors update detection signatures and behavioral models.

Beyond immediate technical mitigations, the advisory encourages organizations to adopt a proactive threat hunting mindset. Rather than waiting for alerts, teams should periodically search for signs of initial access broker activity such as unusual remote desktop protocol connections or anomalous authentication attempts. Establishing baselines for normal network behavior makes deviations easier to spot. Integration of threat intelligence feeds that include the latest indicators from the CISA advisory can automate parts of this process and reduce manual effort.

The healthcare sector has borne a disproportionate share of Medusa attacks, reflecting both the value of patient data and the operational necessity of maintaining continuous system availability. Hospitals and clinics cannot easily take systems offline for extended periods without affecting critical care delivery. This pressure creates an environment where attackers can demand higher ransoms with greater confidence that payment will be considered. The joint advisory stresses the need for healthcare organizations to prioritize segmentation between clinical and administrative networks so that a breach in one area does not automatically compromise patient monitoring or life-support systems.

Manufacturing victims have reported production line stoppages lasting days or weeks while forensic teams worked to restore operations from clean backups. The loss of just-in-time inventory systems can cascade through supply chains, affecting companies far removed from the initial target. Government agencies compromised by Medusa have faced both operational disruptions and public scrutiny over their ability to protect citizen data. These varied impacts demonstrate that ransomware represents more than a technical problem; it carries significant consequences for public safety, economic stability, and national security.

As Medusa continues to adapt, security professionals must maintain vigilance and regularly update their defensive strategies. The joint advisory from CISA, FBI, and HHS provides a comprehensive reference that organizations across all sectors should review and incorporate into their security programs. By understanding the group’s preferred tactics, techniques, and procedures, defenders can implement targeted controls that address specific threats rather than relying on generic best practices. The more than 500 documented victims serve as a sobering reminder that no organization is immune, but informed preparation can substantially reduce both likelihood and impact of an attack.

Regular review of backup integrity, combined with tested recovery procedures, remains one of the most effective countermeasures against ransomware regardless of the specific variant involved. When paired with strong access controls, timely patching, and continuous monitoring, these measures create multiple layers of protection that can thwart even determined adversaries. The updated advisory equips organizations with the latest information needed to strengthen those layers against the evolving Medusa threat.

from WebProNews https://ift.tt/ih7Nl6u

New Malware Impersonates IT Helpdesk in Microsoft Teams Attacks

Microsoft Teams has become a primary communication platform for organizations worldwide, making it an attractive target for cybercriminals seeking to exploit user trust. A newly discovered malware campaign specifically targets Teams users by impersonating internal IT helpdesk personnel, tricking victims into downloading malicious files that compromise their systems and potentially their entire corporate networks.

Security researchers at TechRadar reported on this emerging threat, which takes advantage of the familiar interface and collaborative features within Teams. The attackers create convincing profiles that mimic legitimate company IT staff, complete with company logos, official-sounding names, and realistic job titles. These fake accounts then initiate contact with employees, often claiming to assist with common technical issues such as software updates, security patches, or account verification procedures.

The campaign follows a well-structured social engineering approach. Attackers first gather information about target organizations through public sources like company websites, LinkedIn profiles, and recent news announcements. They identify employees who might be more susceptible to technical support requests, such as new hires or those in non-technical departments. Once they have sufficient background details, the malicious actors create Teams accounts using slightly modified email addresses or domains that closely resemble the legitimate corporate ones.

When the fake IT helper reaches out, the messages appear entirely legitimate at first glance. They might reference recent company-wide updates, mention specific software versions used by the organization, or reference ongoing projects that demonstrate insider knowledge. The attackers often create a sense of urgency, suggesting that immediate action is required to prevent account suspension or security breaches. This psychological pressure reduces the likelihood that victims will pause to verify the request through official channels.

The malware delivery mechanism typically involves directing users to download what appears to be a legitimate troubleshooting tool, software update, or diagnostic application. These files are often hosted on compromised legitimate websites or use cloud storage services that don't immediately trigger security warnings. Once downloaded and executed, the malware establishes persistence on the victim's device while attempting to harvest credentials, monitor keystrokes, and exfiltrate sensitive corporate data.

Analysis of the malicious payloads reveals sophisticated capabilities designed to evade traditional antivirus detection. The malware employs obfuscation techniques, encrypts its communications with command-and-control servers, and can adapt its behavior based on the detected environment. Some variants specifically look for virtual machines or sandbox environments used by security researchers, altering their actions accordingly to avoid analysis.

Organizations that rely heavily on Teams for daily operations face particular risks from this attack vector. The platform's integration with other Microsoft 365 services means that a compromised Teams account can provide attackers with broader access to email, SharePoint repositories, and OneDrive storage. This interconnected nature amplifies the potential damage from a single successful social engineering attempt.

The attackers behind this campaign demonstrate increasing sophistication in their understanding of corporate IT support procedures. They craft messages that align with how actual helpdesk teams communicate, using appropriate technical terminology and referencing standard troubleshooting steps. This attention to detail makes the fraudulent requests difficult to distinguish from genuine support interactions, especially for employees who regularly engage with IT staff through digital channels.

Security experts recommend several defensive measures to counter this specific threat. Organizations should establish clear verification protocols for any unexpected technical support requests received through messaging platforms. This might include requiring helpdesk personnel to provide unique verification codes or directing users to contact support through official ticketing systems rather than responding directly to unsolicited messages.

Employee training programs need regular updates to address these evolving social engineering tactics. Rather than generic security awareness sessions, training should include specific examples of how attackers impersonate trusted internal roles. Simulated phishing exercises that replicate Teams-based attacks can help employees recognize suspicious patterns in real-world scenarios.

Technical controls also play a vital role in limiting the impact of successful compromises. Implementing application whitelisting prevents unauthorized executables from running, while network segmentation restricts lateral movement if malware gains initial access. Multi-factor authentication provides an additional barrier, though attackers have developed methods to bypass or intercept these protections in some cases.

The malware's ability to target Teams users highlights broader trends in cybercrime strategies. Rather than relying solely on email-based phishing, attackers now exploit the full range of collaboration tools that employees use daily. This shift reflects how workplace communication has evolved, with instant messaging and video conferencing replacing many traditional email interactions.

Microsoft has acknowledged the growing threats targeting its collaboration platform and continues to release security updates designed to detect and block malicious activity. The company encourages administrators to enable advanced threat protection features within Microsoft 365, which can identify suspicious account behavior and potentially malicious file downloads before they reach end users.

Despite these platform-level protections, the human element remains the weakest link in most security chains. The success of this campaign demonstrates how effectively social engineering can bypass technical controls when attackers invest time in research and message customization. Organizations must balance convenience with security, ensuring that productivity tools like Teams don't inadvertently create new attack surfaces.

Incident response teams should prepare specifically for compromises originating through collaboration platforms. Traditional indicators of compromise might not immediately surface in these scenarios, requiring updated playbooks that account for messaging-based initial access. Forensic analysis should examine Teams conversation histories, downloaded file metadata, and unusual account activity patterns.

The financial implications of such attacks extend beyond immediate remediation costs. Data breaches resulting from compromised credentials can lead to regulatory penalties, reputational damage, and lost business opportunities. Companies in regulated industries face additional compliance requirements that demand prompt reporting and comprehensive breach investigations when customer data becomes exposed.

Looking at the technical details shared by TechRadar, the malware exhibits several notable characteristics that distinguish it from more generic threats. The campaign appears to focus on mid-sized enterprises rather than exclusively targeting large corporations, possibly because these organizations often have less mature security operations while maintaining valuable intellectual property and customer information.

Attackers have refined their approach to avoid common detection methods. Instead of using obviously malicious domain names, they register domains that incorporate legitimate-sounding terms related to IT support or technical services. The malware itself uses legitimate code signing certificates when possible, or employs sophisticated packing techniques that make static analysis more challenging for security tools.

One particularly concerning aspect involves the malware's capacity to capture screenshots, record audio from connected microphones, and monitor clipboard contents. These capabilities allow attackers to gather information that extends far beyond simple credential theft. In environments where employees discuss sensitive projects through Teams calls or share confidential information via chat, the potential for industrial espionage increases significantly.

Companies should consider implementing stricter policies regarding file downloads within Teams conversations. While convenient for legitimate collaboration, the feature can be abused by attackers posing as colleagues or support staff. Automated scanning of all downloaded files, combined with user education about verifying sender identities, creates multiple layers of protection.

The emergence of this threat coincides with increased remote and hybrid work arrangements that rely heavily on digital communication tools. With fewer opportunities for in-person verification of technical support requests, employees must develop stronger instincts for questioning unexpected assistance offers. Building these instincts requires ongoing reinforcement rather than one-time training sessions.

Security operations centers increasingly monitor collaboration platforms for anomalous behavior, such as new accounts joining multiple team channels or unusual messaging patterns from internal-looking addresses. Advanced analytics can flag accounts that exhibit characteristics common to fake profiles, including recent creation dates, limited connection histories, or inconsistent activity patterns.

As attackers continue refining their techniques, organizations must adapt their defense strategies accordingly. This includes regular audits of Teams configurations, permission reviews, and external tenant access settings. Many companies inadvertently expose themselves by allowing overly permissive guest access or failing to monitor third-party application integrations that could serve as additional entry points.

The human resources department can contribute to defense efforts by ensuring new employee onboarding includes specific guidance about recognizing legitimate IT communications. Similarly, when employees leave the organization, prompt removal of their access across all platforms prevents former accounts from being repurposed by attackers.

This latest campaign serves as a reminder that security awareness must evolve alongside the tools employees use daily. What worked for email-based threats may prove insufficient for sophisticated attacks targeting enterprise messaging platforms. Organizations that treat security as an integral part of their digital transformation initiatives rather than an afterthought position themselves better against these targeted social engineering efforts.

The malware's focus on impersonating IT helpdesk functions exploits the natural trust employees place in technical support personnel. Most workers want to maintain productivity and willingly follow guidance from those perceived as technology experts. Attackers capitalize on this dynamic by positioning themselves as helpful allies rather than obvious adversaries.

Detection challenges persist because many organizations lack comprehensive visibility into Teams activity. Without centralized logging and analysis of messaging patterns, suspicious interactions can go unnoticed until after damage occurs. Investing in security information and event management systems that incorporate collaboration platform data helps bridge this visibility gap.

As this threat continues developing, security teams should share intelligence about observed tactics across industry groups and information sharing organizations. Collective defense approaches often prove more effective than isolated efforts, particularly when facing determined adversaries who target multiple organizations with similar techniques.

The campaign underscores the need for authentication mechanisms that extend beyond simple username and password combinations. Passwordless authentication methods, context-aware access controls, and behavioral biometrics offer promising ways to verify user and account legitimacy before granting access to sensitive resources.

Ultimately, protecting against these Teams-targeted attacks requires a combination of technical solutions, procedural controls, and continuous employee education. No single measure provides complete protection, but layered defenses significantly reduce the likelihood of successful compromise. Organizations that proactively address these risks through comprehensive security programs stand the best chance of maintaining their operational security in an environment where collaboration tools have become prime targets for sophisticated threat actors.

from WebProNews https://ift.tt/6Xh0i8y

Canada Fires Back at Trump’s 50% Tariffs: A High-Stakes Test of Sovereignty and Economic Resolve

President Donald Trump’s new 50% tariffs on roughly $20 billion of Canadian goods took effect at midnight. Hours earlier, trade talks between the two neighbors collapsed. Canadian Prime Minister Mark Carney called the breakdown a direct result of American demands that went too far.

“We’re going to hit back,” Carney said, per Fortune. Canada will match those duties dollar for dollar. The retaliatory measures start September 8. They target U.S. steel, dairy, appliances, agricultural equipment, pulp and paper, and electronics.

Short, sharp consequences. Longer-term questions about power, dependence and endurance now hang over both economies. Nearly three-quarters of Canadian merchandise exports flow south. The U.S. economy is roughly 10 times larger. Replacing decades of integrated supply chains won’t happen overnight. Yet Carney has drawn a line.

He described the final U.S. proposals as unacceptable. They would have restricted Canada’s freedom to strike trade deals with other countries. Carney called this a question of sovereignty. British Columbia Premier David Eby warned that accepting such terms would reduce Canada to the economic equivalent of the 51st state. Trump has mused publicly about exactly that outcome.

Resistance carries real costs. Both sides know it.

Carney had warned months earlier that middle powers must withstand economic pressure from larger nations. In January at the World Economic Forum in Davos, he described the international order as undergoing a rupture rather than a transition. Sovereignty, he argued, would hinge on a country’s capacity to absorb pain. Seven months later, Canada finds itself as the test case.

Trump responded quickly after those Davos remarks. “Canada lives because of the United States,” he said. “Remember that, Mark, the next time you make your statements.” On Sunday, following Canada’s retaliation pledge, Trump posted on Truth Social: “Canada wants the benefits of being a State, without being one!!!” He accused Canada of charging U.S. farmers massive tariffs for years. “No more!!!”

The numbers tell a stark story. The U.S. tariffs hit sectors including wine, furniture, dairy, cement, clothing, fishing rods and hockey equipment. That volume represents about 5.5% of Canadian exports to the United States. Retaliation will raise costs and reduce choices for Canadian consumers. American businesses and farmers will feel the pinch too.

Carney suspended negotiations late Friday. He directed Canada’s team to return to Ottawa. In a statement, he blamed the Trump administration’s “uneconomic” and “unfair” demands. The U.S. Trade Representative Jamieson Greer pushed back. He said Ottawa introduced new demands at the last minute and walked away from earlier commitments. Washington had offered tariff relief on steel, autos, lumber and other goods.

But Carney stood firm. “Last spring, I warned that America is trying to break us so that they can own us,” he said Saturday. “And I promised: ‘That will never, ever happen.’ We are keeping that promise.” The words echo across Canadian media and political circles. Anger toward the Trump administration runs high north of the border. Polls and provincial leaders suggest the hard line enjoys broad support for now.

And the premiers are lining up behind Carney. Manitoba Premier Wab Kinew urged Canadians to prepare for a prolonged fight. “He’s got two more years left in office. We should be prepared to duke it out for two years, and then hopefully, sanity will return,” Kinew said, as reported by CBC News.

Other U.S. allies have taken a different path. The European Union prepared retaliatory tariffs last year but suspended them repeatedly to keep negotiations alive. Canada chose confrontation. That decision sets a precedent. It tests whether one middle power’s resistance can shift the calculations of others. Ian Bremmer, president of the Eurasia Group, noted that Americans often underestimate Canadian anger. “Taking a hard line in response to U.S. policy perceived as predatory — even with major economic cost to Canada — is popular among most Canadians,” he posted on social media.

Historian Robert Bothwell put the vulnerability in clear terms. “No country is more exposed than Canada,” he told Fortune. Other nations fear American misbehavior. None face the same degree of integration and exposure. Success for Canada would mean retaining independence against Trump’s desire to subordinate it. Carney sees that challenge clearly, Bothwell added.

University of Toronto professor emeritus Nelson Wiseman framed the moment as the biggest test yet of Carney’s strategy. “Will there be a domino effect? We’ll see,” he said. Recent coverage from The New York Times and Al Jazeera highlights how quickly the dispute escalated after a brief three-day pause Trump announced earlier in the week. He had claimed a deal was close. Carney flatly denied last-minute Canadian proposals derailed anything.

Markets reacted with caution. Cross-border supply chains in autos, energy and agriculture face immediate pressure. Canadian officials acknowledge higher prices at home. Yet they argue the alternative — yielding to demands that compromise sovereignty — carries greater long-term risk. Carney’s government understood early that America would transform its commercial relationships, he said. Washington used economic integration as a weapon. Its signature, in his view, was written in pencil.

Recent analysis on X shows divided public sentiment. Some Canadian users call for aggressive retaliation on electricity and oil to influence U.S. midterm elections. Others warn the timing of Canada’s September 8 tariffs aligns suspiciously with upcoming by-elections, suggesting domestic politics at play. Experts like tax commentator Kim Moody stress Canada’s dependence — over 70% of merchandise exports head to the U.S., with trade comprising about two-thirds of GDP. Symbolic moves offer limited leverage. Real strength, she argues, requires domestic reforms such as comprehensive tax changes.

The dispute builds on earlier friction. In February Trump threatened to delay the Gordie Howe International Bridge opening over trade grievances with China and bridge toll revenues. By August the U.S. had shuttered its consulate in Winnipeg, a move tied to prairie agriculture concerns. These steps formed the backdrop for the August breakdown. Wikipedia’s entry on the 2025–2026 trade war with Canada and Mexico, updated as recently as today, catalogs the sequence.

Carney’s background as former Bank of Canada and Bank of England governor adds weight to his stance. He speaks with authority on economic coercion. His message resonates beyond Canada. Middle powers worldwide watch whether resistance produces results or simply accelerates pain. For now, both governments dig in. Further escalation remains possible. Greer signaled Washington would add measures in response to Canada’s retaliation.

So the clock ticks. September 8 arrives soon. Costs will mount on both sides of the border. Businesses hedge, consumers prepare, and leaders trade barbs. This confrontation reveals the limits of old alliances when economic tools become weapons. Canada refuses to fold. The outcome will shape trade policy for years. It may influence how other nations respond to similar pressure. One thing is already clear. Carney’s promise holds. Canada hit back.

from WebProNews https://ift.tt/Dck2sFq

Army Cyber Command Trains AI Agents for Real Cyber Roles, With Humans Still Holding the Reins

Lt. Gen. Christopher Eubank delivered a striking message this month at the TechNet Augusta conference. The head of U.S. Army Cyber Command described a small team that had built and trained artificial intelligence agents to mimic human workflows in just 45 days. These agents now fill specific positions inside cyber units. They don’t make the final calls on risk. Humans do.

Task Force Lexington launched in April. Its roughly 10 members, a mix of civilians and service members led by a lieutenant colonel awaiting promotion, focus solely on this effort. They craft agents for roles that include developers, data engineers, host analysts and exploitation analysts. “You name the work role, we’re creating,” Eubank said, according to DefenseScoop.

The command has already deployed 17 agentic mission elements and cyber protection teams. They scour the Department of Defense Information Network daily. Some take on red team duties, hunting for weaknesses the way adversaries might. Others handle simpler tasks such as drafting situation reports. All of it happens under close watch.

“We’re now at a place in the cyberspace domain where we have to augment our workforce, and right now the fastest, easiest, smartest, best way to augment the workforce is to create agents and train those agents,” Eubank told DefenseScoop. He noted that everyone around the world, friend and foe alike, pursues AI capabilities. Staying ahead matters.

The training mirrors what human operators receive. Agents earn a form of Job Qualification Readiness before they receive missions. When they err, supervisors correct the approach, send the system back for retraining, and reintegrate it. This loop repeats until performance meets the standard. The process echoes how the Army corrects and retrains soldiers. But the speed changes everything.

Agents work at machine pace. They complete steps far quicker than people can. That creates tension. Commanders must decide which risks belong to humans and which an agent might handle. “Each and every day, we sit down as a group, we figure out the guardrails we’re going to apply to these agents, [and] we ask ourselves: Is it risk that a human should be answering, or is it risk that an agent can answer?” Eubank explained. “And right now, today, humans are all responsible for risk. We have not turned any agents loose to assume risk on their own behalf.”

The balance feels like a delicate dance. Agents check their output with people. Humans review before assigning the next step or ordering deeper analysis. The approach keeps decision authority with commanders while letting automation handle volume and velocity. Lt. Gen. Jeth Rey, Deputy Chief of Staff for G-6, captured the pressure. “Our adversaries are doing it at machine speed and we must catch up and we must get ahead,” he said, as reported by TechRadar.

Task Force Lexington deliberately sidestepped commercial frontier models. Eubank wanted to prove the work could advance with industry support but without dependence on the largest providers. Token costs worried him. So did the absence of clear governance. “We’re going to price ourselves out of business” without better controls, he warned. Compute shortages represent another hard limit. The Army will never have enough, he acknowledged.

Instead the team traveled to the Defense Innovation Unit in Silicon Valley. Senior engineers there shared practical lessons on integration. The visit reinforced a simple insight. Form a small, dedicated group and give it one mission. That model produced results faster than Eubank expected. The task force now fields requests from across the command. It tracks its own progress while pushing new projects forward.

This push fits a wider pattern. The Army has experimented with AI for scenario generation at the National Training Center and explored human-machine teaming in other domains. Recent contracts with firms such as Seekr aim to deliver trusted agents for frontline use. Yet the cyber focus stands out. Network defense underpins every military function. Communications, logistics, command, all rely on secure information systems. Adversaries already operate at digital speed. The service intends to match them.

Recent reporting highlights parallel efforts. Breaking Defense detailed how these agents receive training to the same standard as humans and operate inside defined work roles. The publication noted the emphasis on human oversight for any decision that carries operational risk. Such caution reflects lessons from private sector incidents where agents broke out of controlled environments.

Eubank’s team applies guardrails daily. They debate each new capability. They test in controlled settings before expanding use. The command avoids handing agents independent authority to act on the network. That restraint persists even as the technology shows promise in red teaming and protective missions.

Broader military interest in agentic systems grows. The service has deployed AI tools to support human resources functions for millions of soldiers, veterans and families. Other initiatives explore AI for wargaming, decision support and adaptive training scenarios. Yet success in cyber will likely set the tone for adoption elsewhere. If agents can reliably augment analysts and operators without introducing new vulnerabilities, the model could spread.

Challenges remain. Trust forms slowly. Humans must verify outputs even when agents move faster. Scaling beyond a 10-person task force will test the command’s ability to maintain standards. Governance questions loom large. So does the reality of limited compute. Eubank offered no illusions on that front.

Still, the early returns encourage. Agents trained in weeks rather than months. They handle repetitive work and free people for harder problems. They hunt threats across the DODIN every day. And they do so while commanders retain final say on risk.

The Army’s approach signals a pragmatic path. Build small. Train to human standards. Keep risk decisions with people. Measure progress against real missions rather than laboratory benchmarks. Expand only after guardrails prove solid. In a domain where adversaries move at machine speed, this measured integration may offer the surest route forward.

Recent coverage from Army.mil shows parallel education efforts. The Command and General Staff College now offers an AI Basics elective that teaches officers to build their own agents for unit problems. That pipeline could supply the next generation of leaders comfortable directing both human teams and digital ones.

Industry observers note the significance. The Army has moved from pilots to daily operations inside its most sensitive networks. Other organizations still debate frameworks. The service simply started with a small team, clear roles, and strict human oversight. Results followed.

from WebProNews https://ift.tt/HuoZY0F

Apollo’s Cloud Breach Exposes Private Equity’s Vulnerability to Vishing Gangs

Private equity giant Apollo Global Management confirmed this week that hackers stole names, birth dates, home addresses and Social Security numbers from its cloud systems. The admission marks the first public confirmation from a major financial player hit in a months-long extortion campaign.

But the details reveal more. Attackers didn’t exploit some novel software flaw. They called employees. They pretended to be IT support. They tricked people into handing over passwords and approval codes. Old tactics. New scale.

The breach occurred between July 6 and July 10. Apollo’s human resources chief, Matthew Breitfelder, laid out the basics in a letter filed with California’s attorney general. Hackers gained unauthorized access to certain cloud platforms. They made off with personal information belonging to an undisclosed number of people. The filing stops short of saying whether the victims were Apollo staff, portfolio company employees or something else.

Apollo manages more than $900 billion. It employs roughly 5,000 people. A breach at this scale carries weight. Yet the firm offered few additional specifics. Spokeswoman Giovanna Falbo declined to answer questions from TechCrunch, including whether any ransom changed hands.

One firm’s confirmation spotlights a wider assault on finance.

Weeks earlier, Google’s threat intelligence team dropped a detailed warning. They tracked a single group behind multiple extortion brands: Falcon, Helix, Pink and Redact. The actors previously operated under the BlackFile name until that brand supposedly shut down in May. Google saw the same infrastructure, the same phishing templates, the same voice-phishing playbook. “UNC6671 continues to rely on voice phishing (vishing) to target enterprise employees, posing as IT helpdesk staff facilitating mandatory, urgent security migrations,” the researchers wrote in their Aug. 6 analysis.

These calls often reached workers on personal cellphones. Victims landed on spoofed login pages. Adversary-in-the-middle tools grabbed credentials and multi-factor tokens. Once inside, scripts pulled data from Microsoft 365 and Okta environments. The group then demanded payment. Some victims paid hundreds of thousands of dollars. Google documented Bitcoin wallets tied to earlier BlackFile activity that collected more than $10 million before the rebrand.

Reuters broke the story in early August. Hackers had targeted Apollo along with Blackstone, Bridgewater Associates, Bain Capital and others. At the time, it remained unclear who actually lost data. Now Apollo’s filing removes the doubt for at least one name on that list. Reuters reported the initial targeting wave on Aug. 6.

CyberScoop added fresh color hours after the TechCrunch story. The outlet noted Apollo told regulators it found no evidence the stolen records appeared online or fueled immediate fraud. The company said it notified law enforcement, hired outside experts and tightened controls. Still, the piece highlighted how this campaign has touched private equity, law firms, rating agencies and medical technology companies. It also linked the activity to BlackFile’s successor brands. CyberScoop published its report on Aug. 21.

The pattern feels familiar. And relentless. Social engineering has powered breaches for decades. Yet the current wave shows how effectively modern attackers combine it with cloud access and automated exfiltration. They don’t need zero-days. They need a convincing phone voice and a believable story about an urgent security update.

Private equity sits in an awkward spot. These firms move enormous sums. They hold sensitive deal data, investor records and personal details on executives across portfolio companies. Much of that information lives in the same cloud platforms the attackers targeted. Defenses that work for banks don’t always translate. Speed matters more than caution in many deal teams. Employees juggle personal and corporate devices. MFA fatigue is real.

Google’s researchers pointed to exactly these weaknesses. They urged phishing-resistant authenticators such as FIDO2 keys. They called for tighter session controls, corporate-device requirements and better monitoring of identity-provider logs. Simple steps on paper. Hard to enforce at scale inside fast-moving investment shops.

Apollo isn’t alone in staying quiet. Most targets in the early reports still haven’t disclosed outcomes. That silence fuels speculation. Did others pay quietly? Are more notifications coming? The California filing only covers residents of that state. Other states will likely see their own notices in coming weeks.

Extortion economics explain the focus on finance. Stolen personal data sells. But strategic information about pending buyouts or funding rounds can be worth far more in the right hands. The attackers know this. Their ransom demands reportedly started high, sometimes millions, before negotiation brought them down. One Google-tracked campaign extracted $750,000 from a single victim.

So what happens next? Regulators will watch. Investors will ask harder questions during due diligence. Insurance underwriters may raise rates for firms that can’t prove strong identity controls. And the hackers? They’ll keep calling. New brand names may appear. The tactics will stay the same.

Apollo says it has strengthened security. Good. Others in the sector should treat this as more than a single incident. The campaign didn’t stop with one cloud environment. It adapted. It rebranded. It kept going. Finance runs on trust and information. Both just took another hit.

The breach letter is available through California’s attorney general site. Google’s full threat analysis offers the clearest picture yet of the actors behind these calls. Recent coverage from CyberScoop fills in operational details that emerged only after Apollo’s filing went public.

from WebProNews https://ift.tt/hCPpDej

From Satire to Strategy: How Recycled Wastewater Including Urine Is Already Cooling AI Data Centers

Jason Kelce stands at a toilet in the opening scene. The former Philadelphia Eagles star and co-founder of Garage Beer fills a container while delivering a deadpan line. “AI data centers waste millions of gallons of water.” He then steps outside. A crowd joins him. They sing in unison. “Let’s pee on computers together to save humanity.”

The music video, produced with Liquid Death, landed this week as a marketing stunt. It quickly sold out its limited-edition “Data Center Coolant Collector” glass mug priced at $18. Fine print on the product page and in the ad warns repeatedly. Don’t actually mail urine. The suits made them say it. Yet the crude humor struck a nerve. Public opposition to new data centers has climbed. A Gallup poll shows about seven in ten Americans now resist construction in their communities.

But here is the twist. The joke rests on a technical truth. Treated wastewater, which includes human urine after processing, already cools servers at scale. Experts who spoke to TechCrunch confirmed as much days after the video dropped. Michael Obradovitch, vice president of Data Center Global Accounts at Ecolab, called the commercial funny and tongue-in-cheek. He added that alternative water sources see use today at levels comparable to what the industry needs.

Bruno Pigott serves as executive director of the WateReuse Association. He previously acted as assistant administrator for water at the EPA. Pigott told the same outlet you would not pour raw urine straight into a cooling tower. The fluid carries salts, urea, bacteria and organic matter. These leave mineral deposits. Constant cleaning would follow. Evaporative cooling systems pass hot air over water to shed heat. The image of urine misting through that process makes the point clear. It would not work untreated.

Still, the broader concept holds. Wastewater treatment plants process sewage that contains urine. Advanced facilities apply membrane bioreactors, reverse osmosis and ultraviolet light. The output becomes safe for industrial reuse. In some cases the water reaches standards high enough to drink. Dr. Greta Zornes leads water reuse efforts at engineering firm CDM Smith. She has spent more than two decades in the field. Zornes now spends every workday on recycled water projects for data centers. “We use recycled water for cooling for all kinds of industries, and we have for decades,” she said. A boom in demand from tech facilities has changed her routine.

Data centers consume enormous volumes to keep chips from overheating. Evaporative systems account for most of that draw. A single mid-size facility can pull millions of gallons daily. Larger ones push toward five million. The Lawrence Berkeley National Laboratory calculated that U.S. data centers used roughly 17.4 billion gallons in 2023. That figure sits well below water spent on swimming pools or golf courses. The comparison offers little comfort to communities facing local shortages. Opposition has grown sharper as AI training clusters multiply.

Loudoun County, Virginia, illustrates the tension. More than 250 data centers already operate there. Plans call for at least two dozen more. As of 2025 the facilities drew about 200 million gallons of recycled water each day. That covered 43 percent of total demand. The remaining 260 million gallons, or 57 percent, came from potable supplies according to Loudoun Water. Proximity matters. Zornes explained that data centers must sit near sizable wastewater plants. Rural sites often lack the volume or treatment capacity. Building the pipes, plants and connections takes years.

Some operators have begun to act as anchors for new infrastructure. Meta pledged at least $270 million toward wastewater projects near its facilities. The investment aims to expand treatment capacity so that recycled supplies can grow. Obradovitch sees potential for more such arrangements. Data centers bring capital. Municipalities gain upgraded systems that benefit residents too. “That’s where data centers can actually come in and be anchors of water infrastructure,” he said.

Policy makers have taken notice. Pigott advocates for legislation that would offer a 30 percent tax credit for industries scaling recycled water systems. He believes the incentive would speed adoption across data centers and other heavy users. Senators have introduced the bipartisan Advancing Water Reuse Act to push similar measures. The timing aligns with rising scrutiny. Consumer backlash against AI products has intensified. Water use ranks high among the complaints.

Recent studies point to even larger opportunities. A paper published in PMC examined symbiosis between data centers and wastewater treatment plants worldwide. Treated effluent from these plants carries substantial cooling potential. Pairing facilities geographically could satisfy nearly all global data center cooling demand. The approach would recover waste heat from servers to dry sludge and power anaerobic digestion at the treatment side. Annual benefits include cutting 84 million tonnes of CO₂ equivalent emissions, conserving 1.3 billion cubic meters of freshwater, and generating net cost savings near $95.4 billion. The United States, Japan, China, the Netherlands and United Kingdom hold the greatest potential. The analysis appeared this year and builds on earlier work showing 18.2 billion tonnes of available wastewater annually with 593 million megawatt-hours of cooling energy.

Real-world projects have moved beyond theory. In Memphis, xAI’s Colossus supercomputer will draw treated wastewater instead of tapping the city’s drinking supply. The arrangement avoids pulling 3 million gallons daily from municipal potable sources. An engineer at the site noted that Elon Musk called it stupid to use clean water for cooling when lesser quality suffices. The city’s plant already treats 40 million gallons a day, leaving ample capacity. xAI will pay for the recycled resource. Construction delays have pushed timelines, yet the model demonstrates feasibility at hyperscale.

Other regions experiment with non-potable alternatives. A billionaire developer in West Texas targets fracking wastewater to serve AI facilities. The Permian Basin produces vast volumes of produced water alongside oil. Pipelines and treatment hubs already move millions of barrels daily. Data centers need land, power and water. The area offers all three at low cost. Similar thinking appears in Nebraska, where a Google-linked project builds a $10 million pipeline to route non-contact cooling water to a resource recovery facility.

Not every attempt has gone smoothly. In Cheyenne, Wyoming, a contractor for Meta flushed bacteria-contaminated water from a closed-loop cooling system into public sewers during construction of an AI campus. The incident introduced a rare bacterium into the recycled water network. City officials revoked discharge permits, drained and disinfected systems, and tightened rules. New policy now requires separate collection tanks for datacenter cooling discharges rather than direct sewer connections. The episode serves as a reminder. Infrastructure must match technical and regulatory realities.

Amazon reported using 2.5 billion gallons globally last year for cooling. The company compares that volume to the 3.3 trillion gallons Americans apply to lawns and gardens annually per EPA data. Microsoft and others echo the message that responsible sourcing from wastewater can limit impact. The claims invite skepticism in communities already strained. Yet the engineering exists. Treatment processes proven in space, where astronauts recycle urine into drinking water, scale up on Earth through industrial plants.

Pigott welcomed the attention the Liquid Death video brought. “I’m glad that people are concerned about water, and anything that raises awareness of water, however crude it may be, could actually be beneficial,” he said. The campaign offers a chance to explain existing solutions. Zornes and Obradovitch spend their days turning that awareness into projects. They design systems that blend treated effluent with evaporative towers, closed loops and heat recovery. The work demands coordination among utilities, tech operators, engineers and regulators.

Challenges remain. Scale-up takes capital and time. Rural expansion faces treatment bottlenecks. Public trust erodes when incidents like Cheyenne occur. Still, the trajectory looks clear. Recycled water will supply a larger share of data center cooling. Wastewater, urine included after rigorous processing, forms part of the mix. The Kelce video made the idea memorable. Engineers have quietly made it practical for years. As AI demand accelerates, those quiet efforts will determine whether communities face scarcity or share the burden through smarter infrastructure.

Recent coverage in Data Center Dynamics and PCMag captured the marketing wave. Both noted how the stunt rides a broader anti-data center sentiment that has gone viral. The PMC study on global symbiosis, meanwhile, quantifies what operators could achieve if they pair facilities systematically. Those numbers suggest the joke may one day look like an early signal of a necessary shift rather than mere provocation.

from WebProNews https://ift.tt/FrqZ8H3