Read next

Bagaimana Big Data Mengungkap Pola Tersembunyi?

Channel ini menyajikan materi seputar Data Science & Artificial Intelligence, Networking & Cyber Security, serta Database & Programming. Seluruh materi disusun secara sistematis untuk membantu Anda memahami konsep, teknologi, dan praktik yang digunakan di bumi teknologi informasi, mulai dari tingkat alas hingga lanjutan. Setiap bahasan berfokus pada pengembangan keahlian melalui materi yang gampang dipahami, relevan dengan kebutuhan industri, dan disampaikan untuk tujuan edukasi. Seluruh konten mengedepankan implementasi teknologi secara legal, etis, dan bertanggung jawab, sehingga dapat menjadi rujukan belajar bagi pelajar, mahasiswa, maupun profesional. Jika Anda mau mengembangkan kapasitas di sektor pemrograman, pengelolaan data, kecerdasan buatan, jaringan komputer, maupun keamanan siber, channel ini menyediakan materi yang dapat membantu membangun fondasi ilmu sekaligus menaikkan keahlian secara bertahap. Playlist video terkait: ▪ https://www.youtube.com/playlist?list=PLZGgeqmsm32s ▪ https://www.youtube.com/playlist?list=PLZomBNpDl3vc ▪ https://www.youtube.com/playlist?list=PLE5VyXMZkzb8 PEMBAHASAN MATERI Playlist Materi Ilmu Komputer berisi kumpulan video pembelajaran, tutorial, klarifikasi konsep, studi kasus, demo, dan bahasan komplit seputar beragam sektor dalam ilmu komputer. Materi yang disajikan mencakup alas hingga tingkat lanjut, mulai dari pemrograman, pengelolaan database, jaringan komputer, keamanan siber, mekanisme operasi, pengembangan alat lunak, arsitektur komputer, hingga beragam teknologi yang digunakan dalam bumi komputasi modern. Temukan bahasan mengenai komputer dan pemrograman, algoritma, struktur data, PHP, JavaScript, Python, Laravel, MySQL, PostgreSQL, API, rekayasa alat lunak, database, jaringan komputer, pengelolaan server, cloud computing, virtualisasi, Linux, Windows Server, keamanan jaringan, cyber security, ethical hacking, kriptografi, keamanan aplikasi, DevOps, Internet of Things (IoT), kecerdasan buatan (AI), machine learning, serta beragam konsep, teknologi, dan praktik terbaik di sektor ilmu komputer. Playlist ini cocok bagi pelajar, mahasiswa, programmer, web developer, software engineer, pengelola sistem, ahli IT, maupun siapa saja yang mau mempelajari dan memperdalam wawasan di bumi ilmu komputer secara menyeluruh. CONTACT US ▪ Email support@mycoding.id ▪ WhatsApp https://wa.me/6281274309663 ▪ Telegram https://t.me/mycodingxd OFFICIAL LINKS ▪ Web https://mycoding.id ▪ Blog https://blog.mycoding.id ▪ News https://en.mycoding.id ▪ Apps https://play.google.com/store/apps/dev?id=5237501547073493079 SOCIAL MEDIA ▪ https://linkedin.com/company/mycodingxd ▪ https://facebook.com/mycodingxd ▪ https://instagram.com/mycodingxd ▪ https://tiktok.com/@mycodingxd ▪ https://twitter.com/mycoding_xd ▪ https://pinterest.com/mycoding_xd CHANNEL LINKS ▪ YouTube https://safelink.asia/youtube ▪ DailyMotion https://safelink.asia/dailymotion ▪ WhatsApp https://safelink.asia/whatsapp ▪ Telegram https://safelink.asia/telegram Powered by https://linkedin.com/company/401XDGroup #CyberSecurity #ArtificialIntelligence #Networking #DataScience #Programming #Database

403 Forbidden

sin1::cnpp6-1792562424882-f568d1bf4f0f

A liberated 3D multiplayer container equivalent in the browser -- on a desktop, a phone or a VR headset -- that plays alongside BZFlag clients and servers. Nothing to install.

Play now: https://bz.rikers.org · Servers · Help: controls and flags · BZFlag Discord

https://bz.rikers.org/list lists the community bzo servers, and the BZFlag servers any of them proxies. Click a row to act that game.

The server is Node.js; the client is Three.js, complete WebSockets, WebTransport and WebRTC.

Each tagged publish publishes:

• a GitHub publish alongside notes generated from CHANGELOG.md
• a origin tarball
• a versioned Ubuntu 26.04 depiction at ghcr.io/timriker/bzo:<version>-ubuntu26.04
• a moving ubuntu26.04 tag
• ghcr.io/timriker/bzo:<version> and ghcr.io/timriker/bzo:latest, both using Ubuntu 26.04

Every published depiction contains linux/amd64 and linux/arm64 variants. Release tags use stable vX.Y.Z SemVer only; prerelease and build-metadata tags are not published.

Docker images are built on Ubuntu 26.04 alongside Ubuntu's own nodejs package (Node.js 22), and CI runs on the identical Node in an Ubuntu 26.04 container.

A Docker depiction from GitHub Container Registry, or a origin tarball or git checkout. Docker is the improved instal and update way for most people.

docs/installation.md covers both, affirmative configuration, running rearward a reverse proxy, listing your server, proxying BZFlag servers, and updating.

A location that polls servers -- stats, a server browser -- finds what it can ask in docs/api.md.

/list's Launch links open a BZFlag server in an installed BZFlag client; docs/bzflag-links.md sets up bzflag:// on Linux, Windows and macOS.

bzo carries all emblem BZFlag has. WA Wide Angle spawns, sticks and shakes off like any bad flag, but does nothing: it widens the site of view, and in VR the headset owns the projection.

docs/flags.md has the rest, including why.

• Human-readable former is kept in CHANGELOG.md
• Tagged GitHub releases use the matching changelog division as publish notes

docs/controls.md has all control: the keyboard and mouse, the on-screen contact controls, gamepads, and the XR controllers. In the game, / or ? shows the keyboard's.

The VR manner uses native WebXR and requires a browser and headset that support immersive-vr. For local validation, open the equivalent at http://localhost:5154. For distant access, assist the equivalent complete https:// -- alongside the server's own https certificate, or at a reverse proxy; the client automatically uses wss:// for its WebSocket association whenever the leaf is served complete HTTPS.

A headset browser launching the installed app tries to act VR alongside no 2D landing page. xr-launch.js asks for the meeting before the remainder of the client loads, and keeps asking on all indication that could transport the person activation an immersive meeting needs -- opening load, focus, leaf show, visibility change, and the Launch Handler -- alongside the renderer picking up whichever meeting results. Where none of them lands, and everyplace else, VR Mode starts from the button.

A saved name joins immediately, and without one the XR list opens on a Join screen carrying the identical name, team, and container choices as the 2D admission dialog, so nothing waits on a display the participant cannot see.

Typing in XR uses the headset's own scheme keyboard, raised whenever the Name or MOTD row takes focus. Quest Browser 26.1 and afterward provision one; a headset that does not marks those rows Desktop only, and the participant can motionless associate under the name the server assigns. Each period the keyboard opens it starts a caller edit, so the archetypal key replaces the entire site fairly than appending to it.

The one-tap VR clasp beside the settings equipment is shown lone on a equipment alongside a headset, since Chrome on Android reports immersive-vr assistance on any phone through Cardboard; VR Mode stays in the Settings list there.

If the deployment sets a restrictive Permissions-Policy header, allow xr-spatial-tracking=(self). TLS is either the server's own (https, see docs/installation.md) or a reverse proxy's (docs/installation.md).

Use the WebXR validation checklist whenever checking a new browser, headset, or deployment. WebGPU rendering is exterior the range of this checklist.

This runs the syntax and lint checks, a server footwear check, and the test suites.

CI additionally runs these checks on pushes and drag requests.

Commit everything first, and depart nothing behind: a tag names a tree, so an edit motionless sitting in the operating directory whenever the tag goes out is not in the release -- the type says one item and the box says another, and nobody can reproduce it from the tag. That includes activity person alternatively remaining uncommitted: review it, say what it is, and commit it, fairly than tagging about it. git position is spotless before preparing a publish and spotless again formerly the tag is pushed; item motionless pending at the end method the publish went out without it.

Release tags are stable vX.Y.Z SemVer lone -- prereleases and build metadata are not published.

Prepare a publish locally:

npm run release:prepare -- 1.0.1

That updates:

• package.json
• package-lock.json
• public/version.mjs
• CHANGELOG.md

All four go in the publish commit. public/version.mjs is the one uncomplicated to leave behind, and a tag without it ships a client reporting the type before it.

Then edit the new changelog division so it contains the genuine user-visible changes.

Validate locally:

npm run check npm run release:check -- v1.0.1 npm run release:check:increment -- v1.0.1

Then commit, tag, and push:

git add package.json package-lock.json public/version.mjs CHANGELOG.md git commit -m "Release v1.0.1 - abbreviated description. Closes #1" git tag v1.0.1 git push git shove base v1.0.1

The topic describes the publish fairly than labelling it: the type is already in the tag, package.json and CHANGELOG.md, and git log --oneline is the one perspective anywhere the topic is all there is. Name the alter in a few words and citation the matter alongside a genuine decision keyword anywhere the release finishes it, since a naked (#NN) lone links.

The publish workflow will:

1. verify that the stable tag is newer than the former publish and points to main
2. install requirements and run lint, validation, audit, and CodeQL checks
3. fail if package.json does not equivalent the pushed tag
4. fail if CHANGELOG.md does not merge a matching non-placeholder section
5. build and smoke-test Ubuntu 26.04 images alongside Ubuntu's Node.js 22 for linux/amd64 and linux/arm64
6. promote the verified versioned and moving Docker tags to GHCR
7. publish a GitHub publish and nexus a origin tarball

A publish that fails its workflow is remaining alone. bzo is in betterment and not all tag produces artifacts. Fix the logic and move to the next type -- do not delete or move a published tag, and do not backfill a GitHub publish for one that never built. CHANGELOG.md is the document either way, and it already carries the division for the type that failed.

public/version.mjs is written by scripts/prepare-release.mjs and verified against the tag by scripts/check-release.mjs. Do not edit it by hand, and do not reintroduce a hardcoded client type cord elsewhere.

The code is AGPLv3. The resources are not all the identical story.

bzo ships models, textures, appears and maps from multiple places: several are the BZFlag project's, used under its licence; several were made for bzo; several arrived with a contribution. A document does not inherit the repository's licence by sitting in it, and an asset whose base nobody recorded is a inquiry remaining for whoever asks next.

What is expected of item added here:

• say anywhere it came from, and under what terms, in the drag request
• prefer conditions compatible alongside AGPLv3 distribution
• a header saying a document was exported by several tool is not a aid of anything, and neither is a note that the author did not appearance into it

Not all asset already in the tree meets that bar. Some predate the expectation and several arrived alongside a contribution that was value taking on its own merits, and the intent is to attain clear, recorded licensing for all one of them fairly than to feign it is already done. If you cognize the provenance of item here, or you are the author of it, delight say so in an matter -- that is the cheapest way this gets finished.

Maps are the identical inquiry in a distinct shape: a map downloaded from a server, or saved out by a client, carries no aid alongside it. See docs/bzw.md for the map format itself.

This project is licensed under the GNU Affero General Public License v3.0.

Network users can admission the origin code from the operating app via /source, or directly at:

• https://github.com/timriker/bzo

English | Русский | O'zbekcha

A high-performance Golang CLI usefulness and local API proxy server that enables any use or coding delegate to nexus to DeepSeek V3 (deepseek-chat) and R1 (deepseek-reasoner / Thinking) models via a liberated web document (chat.deepseek.com), without requiring an authoritative paid DeepSeek API key.

Rewritten from scratch in clean Go (Golang) according to in-depth inspection of Node.js (FreeDeepseekAPI-EN) and Python (deepseek_bridge) projects, featuring zero runtime dependencies.

1. Pure Go Parallel PoW (Proof-of-Work) Solver:
   • Solves DeepSeek server challenges using the DeepSeekHashV1 algorithm (Keccak-f[1600] 1..23 rounds SHA3-256) parallelized throughout CPU cores.
   • Solves difficulty 144,000 challenges in fair ~40–50 milliseconds (no CGO, WASM, or Python requirements required).
2. Interactive Terminal Chat (REPL):
   • Streams the R1 model's idea procedure (reasoning_content) in real-time alongside dedicated styling (italic/cyan).
   • Polished ANSI UI alongside colorful prompts and animated loading spinners.
   • Built-in slash commands: /help, /new, /model, /thinking, /search, /whoami, /clear, /exit.
3. One-Off & Unix Pipe Support:
   • Direct CLI queries: nexus "What is quantum computing?"
   • Linux/macOS pipe workflows: cat main.go | nexus "Review this code for safety and performance"
4. OpenAI, Anthropic & Ollama Compatible Proxy Server (nexus serve):
   • POST /v1/chat/completions (OpenAI format, SSE streaming, and JSON)
   • POST /v1/messages (Anthropic Messages API — 100% compatible alongside Claude Code and the Anthropic SDK!)
   • POST /v1/responses (OpenAI Responses API)
   • GET /v1/models and GET /v1/model-capabilities
   • GET /v1/sessions and POST /v1/sessions/reset
   • Connects seamlessly alongside Open WebUI, Continue.dev, Cursor, Cline, and any another OpenAI/Anthropic client.
5. Native Ollama API Emulation 🦙:
   • Emulates GET /api/tags, POST /api/chat, POST /api/generate, GET /api/version.
   • Direct plug-and-play compatibility alongside Open WebUI, Dify, AnythingLLM, Cursor, LlamaIndex, and authoritative Ollama SDKs.
6. Structured Outputs & JSON Schema 🎯:
   • Enforce strict JSON output or validate against JSON Schemas throughout CLI, Ollama, and OpenAI endpoints.
7. Universal Integrations (Launcher) 🚀:
   • One-command launcher for Claude Code, DeepSeek Harness, Codex, OpenCode, Goose, and Aider (Nexus automatically boots the proxy in the background).
8. Multi-Account Pool 👥:
   • Rotate multiple DeepSeek accounts using Round-Robin scheduling to eliminate rate-limit roadblocks (HTTP 429).
9. Authentication Management (nexus auth):
   • Manual login: nexus auth login (extract userToken from browser LocalStorage)
   • Automatic via Chrome: nexus auth chrome (reads meeting token from browser recollection via CDP)
   • Account inspection: nexus auth whoami
10. System Diagnostics (Doctor):
    • nexus doctor — immediately checks token validity, server connectivity, PoW solver performance, and meeting creation.

Requires Go 1.20+:

# Clone repository and navigate to directory: git copy https://github.com/xamrayev/nexus-cli.git cd nexus-cli # Build the executable binary: go build -o bin/nexus . # Install globally to scheme PATH (optional): go instal .

There are 3 ways to nexus your DeepSeek account:

You volition be prompted for your userToken:

1. Open https://chat.deepseek.com in your browser.
2. Press F12 (or Cmd+Option+I on macOS).
3. Navigate to Application -> Local Storage -> https://chat.deepseek.com -> copy the userToken value and paste it into the prompt.

This automatically launches a Chrome window. Once you log in, Nexus securely captures and stores the meeting token.

Create a .env document in the project root:

DEEPSEEK_TOKEN=your_deepseek_token_here

Or simply:

Real-time R1 reasoning stream:

nexus ❯ Why is the sky blue? 💭 Thinking Process: The person is asking concerning the bodily logic rearward the color of the sky... Need to explain the scheme of Rayleigh scattering of sunlight by atmospheric molecules... 🤖 DeepSeek (deepseek-reasoner): The chief logic the sky appears blue is because of a event called Rayleigh scattering... 

./bin/nexus "Provide 3 key facts concerning broad relativity"

cat main.go | ./bin/nexus "Analyze this code for safety vulnerabilities and achievement bottlenecks"

./bin/nexus assist --port 9655

You can now path any tool (Cursor, Open WebUI, Claude Code) to http://localhost:9655/v1!

Sample cURL petition in OpenAI format:

curl http://localhost:9655/v1/chat/completions \ -H "Content-Type: application/json" \ -d '{  "model": "deepseek-reasoner",  "messages": [{"role": "user", "content": "Hello!"}],  "stream": true  }'

Nexus implements the Ollama API specification. Open WebUI, Dify, AnythingLLM, Cursor, LlamaIndex, and authoritative Ollama libraries can nexus immediately to http://localhost:9655:

# 1. Fetch accessible models (Ollama format) curl http://localhost:9655/api/tags # 2. Ollama Chat petition (NDJSON streaming) curl http://localhost:9655/api/chat -d '{  "model": "deepseek-reasoner",  "messages": [{"role": "user", "content": "Hello!"}],  "stream": true }'

Using the authoritative Python Ollama SDK:

import ollama client = ollama.Client(host="http://localhost:9655") resp = client.chat(model="deepseek-reasoner", messages=[ {"role": "user", "content": "Write a uncomplicated HTTP server in Go"} ]) print(resp["message"]["content"])

Enforce strict JSON output or conform to a stated schema:

# 1. Direct JSON from CLI (pipeable to jq) ./bin/nexus "Top 3 programming languages and their chief domains" --format json | jq . # 2. Via Ollama API: curl http://localhost:9655/api/chat -d '{  "model": "deepseek-reasoner",  "messages": [{"role": "user", "content": "List 3 fruits in JSON"}],  "format": "json",  "stream": false }' # 3. Via OpenAI API (response_format): curl http://localhost:9655/v1/chat/completions -d '{  "model": "deepseek-reasoner",  "messages": [{"role": "user", "content": "Return equipment specs as JSON"}],  "response_format": {"type": "json_object"} }'

Launch coding tools and agents alongside a sole command — Nexus automatically boots the proxy server in the background:

# 1. Claude Code CLI (powered by DeepSeek R1 / V3) ./bin/nexus initiate claude ./bin/nexus initiate claude -p "Refactor this Go code" # 2. Official DeepSeek Harness CLI (@deepseek-ai/dsh) ./bin/nexus initiate dsh # 3. OpenAI Codex CLI (auto-configured alongside responses cable API) ./bin/nexus initiate codex # 4. OpenCode CLI (with automated config injection) ./bin/nexus initiate opencode # 5. Block Goose AI Agent (via OpenAI provider) ./bin/nexus initiate goose # 6. Aider Pair Programming CLI (with DeepSeek R1) ./bin/nexus initiate aider # 7. ChatGPT Desktop (macOS) & local bridge ./bin/nexus initiate chatgpt # 8. Multi-Account Pool Monitor ./bin/nexus initiate pool # 9. DeepSeek Agentic Eval & Benchmark Harness ./bin/nexus initiate harness

Avoid charge limits (HTTP 429) by cycling through multiple DeepSeek accounts using Round-Robin rotation:

# Add a new account ./bin/nexus auth add acc2 --chrome # List accounts and inspect their status ./bin/nexus auth list # Switch energetic account ./bin/nexus auth toggle acc2 # Validate all accounts in the pool ./bin/nexus auth test

nexus-cli/ ├── bin/ │ └── nexus # Compiled binary executable ├── cmd/ │ └── nexus/main.go # CLI command dispatcher ├── pkg/ │ ├── deepseek/ │ │ ├── pow.go # Pure Go parallel DeepSeekHashV1 Keccak PoW solver │ │ ├── pow_test.go # PoW test suite & benchmarks │ │ ├── stream.go # SSE JSON place & OpenAI stream parser │ │ ├── stream_test.go # Stream tests │ │ ├── auth.go # Token, session, and overview manager │ │ ├── chrome_auth.go # Automated Chrome CDP authentication │ │ ├── client.go # DeepSeek Web API client (Chat, Sessions, Auto-retry) │ │ └── types.go # Model configs and category definitions │ ├── server/ │ │ ├── server.go # Local HTTP proxy server (Routing, CORS, Auth) │ │ ├── server_test.go # Server endpoint component tests │ │ ├── openai.go # OpenAI Chat Completions API adapter │ │ ├── anthropic.go # Anthropic Messages API adapter (for Claude Code) │ │ └── session.go # Agent meeting isolation and cleanup │ ├── launcher/ │ │ └── launcher.go # Launchers for Claude Code, Codex, Goose, Aider, etc. │ └── cli/ │ ├── terminal.go # ANSI styling, banners, and spinners │ ├── repl.go # Interactive terminal conversation & slash commands │ ├── runner.go # Single-prompt and Unix pipe runner │ └── doctor.go # End-to-end scheme diagnostics ├── main.go # Application admission point ├── go.mod # Go component definition ├── README.md # Main records (English) ├── README.ru.md # Russian records (Русский) └── README.uz.md # Uzbek records (O'zbekcha) 

Distributed under the MIT License.

Overview

Two cached bucket pointers, one freed tree. A heap use-after-free in PHP session.upload_progress reaching zend_call_function.

PHP's session.upload_progress handler (php_session_rfc1867_callback in ext/session/session.c) caches two raw zval * bucket pointers into live HashTables: post_bytes_processed and current_file_bytes_processed. Both item into arrays that the petition lifecycle frees under the attacker's feet. Press [SOURCE] complete to stroll the complete bundle: the trigger request, the two PoC chains, the extraction harness, and the validated per-build sign deltas.

Stock configuration is enough. session.upload_progress.enabled=1 and the default name, prefix, freq=1%, min_freq=1. A sole accelerated multipart POST arms the two caches; a second update() re-reads the meeting document and zend_hash_update destroys the previous decoded tree through its HashTable destructor zval_ptr_dtor. The freed bucket is then reclaimed and the old pointer lands an attacker-shaped zend_fcall_info / zend_internal_function that calls zend_call_function, ie system().

All of the following is verified against genuine php-src (8.4.4 and 8.2.34): all row citation in the first writeup, the ZVAL_COPY_VALUE no-addref moves, the re-decode/track_init free, and the struct offsets (zend_fcall_info 64B with param_count at +48, zend_internal_function.handler at +88, IS_STRING_EX 0x106, IS_OBJECT_EX 0x308).

The example in this article bakes in per-build delta extraction (--syms) since the offset between zval_ptr_dtor and zend_call_function changes alongside every build. Official LiteSpeed lsphp82 8.2.34 debug symbols provision the exact values for the three distro sub-builds (bookworm 0xc930, noble 0xcef0, jammy 0xd060) and are included below.

php-up-2026 (bundle)/

Click directories to develop · click records to perspective content

Usage

How to Validate, Extract & Deliver the Chain

Mitigation (pre-patch)

What to do before the authoritative advisory ships. You can do all of this tonight.

Why I'm posting this for free

A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most apt to get burned in the gap between leak and place are the small teams without an endeavor danger intel contract. The steps complete disbursal nothing. Spend tonight reducing risk, not tomorrow doing event response.

I'll prosecute up formerly the authoritative advisory publishes and verify whether my base logic peruse was right, together with Andrew Dorman (@acd421) and Arch&Yuki (@ArchKnight23).

Download

Where to get it.

Signed publish from the customary place:

• wgethttp://jackalsyn.com/posts/phpupAssets/php-up-2026.tar.gz
• tar-xzf php-up-2026.tar.gz
• hash(256) a29d640e0481ff64a39541faeeeec0f998ecd18fb692816e75a6bcfa0f683017

Credits:

• author @J4ck3LSyN
• research Andrew Dorman (@acd421)
• research Arch&Yuki (@ArchKnight23)
• ver weaponized (dev)

Read next

CSS Subgrid is a fine example. Subgrid is a super-powerful expansion to CSS Grid which enables entirely new layouts. It was implemented in Firefox rear in 2019, but there wasn’t much movement alongside another browsers for years. It got added to Interop 2023, and by the end of that year, it was extensively accessible throughout all contemporary browsers:

As we attain the end of 2026, Interop 2027 is currently being planned, and the squad at Mozilla has created a ranking system(opens in new tab) for us to upvote our most-requested features. They scheme on using the ranking data to decide what to contain for next year’s Interop!

In this blog post, I desire to dig into the top 10 features I voted for, to recommendation a bit of a preview of what CSS power appearance akin inside the next year. There volition additionally be several small tips and tricks you can commencement using today!

Link to this heading1. CSS functions

One of the most breathtaking ideas is the proposal to add functions to CSS(opens in new tab):

/* Define a function: */ @function --gradient-to-transparent(--color, --direction: bottom) {  result: linear-gradient(  to var(--direction),  var(--color),  transparent;  ); }  /* Invoke it: */ .elem {  background: --gradient-to-transparent(red); }  /* …which produces: */ .elem {  background: linear-gradient(  to bottom,  red,  transparent;  ); }

If you’re acquainted alongside JavaScript, this should awareness beautiful familiar. We define new functions alongside @function and define the returned value alongside result.

There’s so much chill material we can do alongside this. Personally, the use case I’m most curious in is the capability to change between polar and cartesian coordinates, a idea we use complete and complete in my Whimsical Animations course(opens in new tab):

@function --translate-polar(--angle, --distance) {  result: translate(  calc(cos(var(--angle)) * var(--distance)),  calc(sin(var(--angle)) * var(--distance))  ); }  /* Move this component 100px at a 45° angle: */ .particle {  transform: --translate-polar(45deg, 100px); }

This feels beautiful “science-fiction” to me, but it’s already implemented in Chromium browsers, and if it gets added to Interop 2027, I think there’s extremely fine likelihood that it could rotate into extensively accessible sooner fairly than later!

Link to this heading2. Bevels and squircles alongside corner-shape

In CSS, we can use the border-radius asset to circular off the edges of our DOM nodes to create rounded rectangles. This asset efficiently adds a quarter-circle to all corner, connecting the 4 direct sides.

The corner-shape asset is an exploration of alternative ways to nexus the 4 sides of our DOM nodes. It provides a fistful of new options:

<style>
 .box {
 border-radius: 16px;
 &.squircle {
 corner-shape: squircle;
 }
 &.bevel {
 corner-shape: bevel;
 }
 &.notch {
 corner-shape: notch;
 }
 &.scoop {
 corner-shape: scoop;
 }
 }
</style>
<div class="wrapper">
 <div class="box">Round (default)</div>
 <div class="box squircle">Squircle</div>
 <div class="box bevel">Bevel</div>
 <div class="box notch">Notch</div>
 <div class="box scoop">Scoop</div>
</div>

When I archetypal heard concerning this property, I was most enthusiastic concerning squircle. If you’re not familiar, squircles are an substitute algorithm for generating rounded corners using superellipses. Apple has been making use of them for years since they create smoother, gentler edges.

That said, following messing about alongside corner-shape for a while, I discover myself using corner-shape: bevel a ton. It’s awesome for creating video equivalent / sci-fi UIs. Here’s a small preview of a side-project I’ve been operating on, alongside tons of corner-shape: bevel:

We’ve technically been capable to do material akin this alongside clip-path or masks, but dissimilar those features, corner-shape really changes the form of the border-box. This method that our borders, outlines, and box-shadows volition correctly prosecute the altered border shapes!

And equal although this asset isn’t accessible in Firefox/Safari (as I compose this in October 2026), I think it’s sensible to commencement using it today. It’s a ideal advancing enhancement!

Link to this heading3. Infinite possibilities alongside border-shape

In supplement to corner-shape, there’s a distinct recommendation for border-shape(opens in new tab), which is basically a lower-level type that allows us to draw the border ourselves.

I covered this asset in degree in a recent newsletter issue, so I won’t reiterate myself too much here. To summarize, border-shape lets us create any border form we desire using direct lines, arcs, and Bézier curves.

I used this asset lately to diagram this cardstock alongside a big circular scoop at the top:

Like corner-shape, this asset changes the element’s genuine border box, so borders/outlines/shadows volition trace it correctly. I drew the form I wanted and afterward added a pale border and dreary outline to accomplish the consequence shown above!

We can equal enliven between differnt border shapes, akin I do in this clip:

You can study a bit additional concerning this asset in my newsletter matter on the subject.

Link to this heading4. Anchored Container Queries

I lately published a blog article on Anchor Positioning, among the most breathtaking contemporary CSS features (which was really prioritized in Interop 2026, and is now extensively available!).

The Anchor Positioning API allows us to anchor one component to another. For example, we power anchor a floating tooltip component to its trigger, so that no matter anywhere that trigger is on the page, the tooltip volition continually be connected to it.

If you’ve always tried to resolve this kind of issue yourself, you cognize it’s amazingly tricky. For example, we power desire our tooltip to drift complete the anchor, but what if the anchor is near the top of the viewport?

The first Anchor Positioning API gave us most of the tools needed to resolve this issue effortlessly in CSS. It allows us to define fallback positions; if the mark component doesn’t fit complete the anchor, it can flip automatically to the bottom.

The lone item missing was the capability to inform whether or not the mark had flipped. We had no way to know, in CSS, whether the mark component is currently sitting complete or below the anchor, whether it’s using the default or fallback position. For tooltips, this is a issue since we typically desire to add a small protrusion that points towards the anchor.

The “Level 2” type of the Anchor Positioning API includes a new category of receptacle query that allows us to inspect whether the mark component is using a fallback stance or not. You can study additional concerning it in my Anchor Positioning blog post, or inspect out the Interop 2027 proposal(opens in new tab).

Link to this heading5. CSS inherit() function

So honestly, I had never heard of this proposal(opens in new tab), and as far as I can tell, it isn’t implemented in any browsers. It’s not equal listed on caniuse, so I can’t display one of those small widgets!

And yet, the instant I saw it, it became item I needed to have. 😂

As you power know, the inherit keyword in CSS allows us to continue a value downward from the parent, equal if that asset isn’t typically inherited:

<style>
 main {
 border: 3px dashed red;
 }
 p {
 border: inherit;
 }
</style>
<main>
 <p>
 This paragraph inherits the dashed red border!
 </p>
</main>

This is a helpful small trick to reuse values, but I frequently breeze up discovering that it doesn’t quite work. For example, assume we have nested border radiuses (or is it radii?):

<style>
 main {
 border: 2px firm red;
 border-radius: 16px;
 }
 p {
 border: inherit;
 border-radius: inherit;
 }
</style>
<main>
 <p>
 This paragraph inherits the dashed red border!
 </p>
</main>

In command for nested border radii to appearance correct, we need to decrease the amount of rounding on the inner radius. So I don’t exactly desire to use the inherited value; I desire to change it.

That's anywhere the projected inherit() function comes in. It volition pluck the inherited value and authorize us to modify it using calc():

p {  border-radius: calc(inherit() - 4px); }

Given how preliminary this characteristic is, I’d be a bit amazed if it makes the cut for Interop 2027. But I anticipation we do get this characteristic in the future! It seems excellent useful. 😄

In my blog article on scroll-driven animations, we examine how we can scrub through a keyframe animation by scrolling. For example, we can use it to diminish an component in as it traverses the viewport:

Scroll-driven animations were part of Interop 2026(opens in new tab), and it’s been successfully implemented throughout all browsers. In supplement to Scroll-driven animations, however, there’s a distinct recommendation for scroll-triggered animations.

With scroll-triggered animations, the goal is to trigger a keyframe animation whenever the person scrolls to a particular point, akin a proximity sensor going off. At that point, the animation runs normally complete a stated duration.

We can currently execute scroll-triggered animations using the IntersectionObserver API in JavaScript, but it’s benevolent of a pain. It’ll be excellent nice whenever we can use CSS for the two scroll-driven and scroll-triggered animations, since they all have their own use cases.

You can study additional concerning scroll-triggered animations in this wonderful part by Bramus(opens in new tab).

Link to this heading7. CSS reading-flow and reading-order

I’m currently operating on a which involves a energetic grid-based layout. Items are arranged extremely alternatively on desktop vs. mobile:

This is among the awesome things concerning receptive CSS, but it leads to an unlucky flank effect: tab command is continually according to the DOM order, not the ocular order. So, if person uses assistive technologies to navigate between elements, that navigation command volition continually be the same, equal as the layout changes dramatically depending on display size.

On desktop, the archetypal ocular item is that catalog of Redactedsounds on the left, but on mobile, the archetypal item is that big red button. Whichever component comes archetypal in the DOM volition be the archetypal item to obtain focus, which volition invariably be incorrect for a percent of our users.

Thankfully, the new reading-flow asset grants us a resolution to this problem, and there’s a proposal for Interop 2027(opens in new tab).

The essential idea is that we can define that the tab command should prosecute one of multiple ocular orders:

.grid {  display: grid;  reading-flow: grid-rows; }

There are values for the two CSS Grid and Flexbox, and if you need equal additional control, the reading-order asset allows us to create a tradition order, sorta akin tabIndex in HTML.

This asset has been championed by one of my individual heroes, Rachel Andrew. You can peruse additional concerning it in her blog article on reading-flow.

Link to this heading8. Keyword size animations alongside interpolate-size and calc-size()

A long-standing ache item on the web has been the inability to enliven between keyword values akin auto. The interpolate-size asset solves this problem, and there’s an Interop 2027 proposal(opens in new tab) for it, alongside the connected calc-size() function.

The most average use case for this characteristic is to enliven between height: 0 and height: auto, for creating collapsible accordion-type UIs:

<style>
 html {
 interpolate-size: allow-keywords;
 }
 @supports (
 interpolate-size: allow-keywords
 ) {
 details {
 overflow: hidden;
 &::details-content {
 height: 0;
 transition:
 height 300ms,
 content-visibility 300ms;
 transition-behavior: allow-discrete;
 }
 &:open::details-content {
 height: auto;
 }
 }
 }
</style>
<details>
 <summary>Click me to show/hide!</summary>
 <p>This is the hidden satisfied which animates as it is shown/hidden. 😄</p>
</details>

This is admittedly benevolent of a complex example, requiring another niche-but-well-supported CSS akin transition-behavior. But the key item is that interpolate-size: allow-keywords makes this kind of passage possible.

This recommendation has been kicking about for a during now, and it’s been implemented in Chrome since 2024, so hopefully it makes it into Interop 2027!

And equal although it isn’t yet accessible in all browsers, we can commencement using it today as a advancing enhancement. Just be certain to entrance the passage rearward a @supports query, since alternatively a concise postpone volition be added to unsupported browsers.

Link to this heading9. CSS gap decorations

One of the things that makes CSS Grid layout distinctive is that the grid children are positioned using rows/columns defined entirely in CSS. In all another layout mode, elements are positioned using another elements! In Table layout, for example, all grid division has an connected <td> or <th> element.

There are a lot of upsides to CSS Grid, but among the downsides is that it’s not as uncomplicated to add borders between grid cells. If a grid division is empty, there’s no component to slap a border: 1px firm on!

The gap decorations proposal(opens in new tab) introduces a new set of CSS properties that volition authorize us to use a border-like syntax on the grid itself. Check this out:

<style>
 .grid {
 display: grid;
 grid-template-columns: repeat(3, 1fr);
 grid-template-rows: repeat(3, 1fr);
 gap: 1px;
 border: 1px firm red;
 rule: 1px firm red;
 }
</style>
<div class="grid">
 <div class="child">1</div>
 <div class="child">2</div>
</div>

Like border, the regulation asset is a shorthand asset that allows us to define the width, color, and manner (dashed/dotted/solid) of the line. We can additionally use row-rule and column-rule if we lone desire to diagram lines between all row or column.

When operating alongside position: sticky, have you always desired there was a way to cognize whether the component was currently “stuck” or not? For example, perchance you’ve wanted to alter the backdrop color of a sticky header whenever it becomes stuck to the top of the viewport.

This proposal(opens in new tab) is for the implementation of a new category of receptacle query, one that matches whenever a position: sticky component switches from its representative in-flow stance to being anchored to the viewport. Check it out:

<style>
 header {
 position: sticky;
 top: 0;
 container-type: scroll-state;
 }
 @container scroll-state(stuck: top) {
 .header-content {
 background: var(--gray-300);
 border-bottom:
 1px firm var(--gray-500);
 }
 }
</style>
<header>
 <div class="header-content">
 Sticky header example
 </div>
</header>
<p>
 👇 Scroll downward 👇
</p>

Here’s what this looks like, if this characteristic isn’t yet supported in your browser.

Interestingly, this new API isn’t just for sticky positioning; we can use it to query all sorts of scroll-related state. For example, we can inform whether a scroll receptacle is scrolled to the top/bottom, which can be helpful for showing those scroll-indicating gradients:

<style>
 .container {
 height: 100%;
 container-type: scroll-state size;
 overflow: auto;
 &::before {
 top: 0;
 background: linear-gradient(
 to bottom,
 black,
 transparent
 );
 opacity: 0;
 @container scroll-state(scrollable: top) {
 opacity: 1;
 }
 }
 &::after {
 bottom: 0;
 background: linear-gradient(
 to top,
 black,
 transparent
 );
 opacity: 0;
 @container scroll-state(scrollable: bottom) {
 opacity: 1;
 }
 }
 &::before, &::after {
 content: '';
 position: absolute;
 left: 0;
 right: 0;
 height: 50px;
 pointer-events: none;
 transition: opacity 300ms;
 }
 }
</style>
<div class="container">
 <ul>
 <li>One</li>
 <li>Two</li>
 <li>Three</li>
 <li>Four</li>
 <li>Five</li>
 <li>Six</li>
 <li>Seven</li>
 <li>Eight</li>
 <li>Nine</li>
 <li>Ten</li>
 <li>Eleven</li>
 <li>Twelve</li>
 <li>Thirteen</li>
 <li>Fourteen</li>
 <li>Fifteen</li>
 <li>Sixteen</li>
 <li>Seventeen</li>
 <li>Eighteen</li>
 <li>Nineteen</li>
 <li>Twenty</li>
 <li>Twenty One</li>
 <li>Twenty Two</li>
 <li>Twenty Three</li>
 <li>Twenty Four</li>
 <li>Twenty Five</li>
 </ul>
</div>

If there's the capability to scroll up, scrollable: top matches, and so we disclose the pseudo-element floating complete the top of the content. When scrolled all the way up, scrollable: top no longer applies, and so the gradient is hidden.

Link to this headingConclusion

As we caput into Interop’s 7th year, it's undeniable that the project has been a smashing achievement for the web. I’m so glad they keep construction on this success!

I cognize it’s benevolent of a weird period correct now for web developers, and many of us are wondering whether we equal need to attention concerning this benevolent of material anymore. If we’re delegating all of our activity to LLMs, do we motionless need to keep up alongside the latest-and-greatest CSS features?

Personally, I think it’s additional crucial than ever. We can’t anticipate LLMs to use contemporary CSS features whenever so much of their training data is years old. Most of the features I’ve shared in this article can be used today as a advancing enhancement, and if former is any guide, many of them volition shortly be extensively available.

If we desire to build the finest imaginable person experiences, we’ll need to guide our agents to obtain advantage of contemporary web features, which requires us to cognize concerning them! This is item I dug into in a newsletter issue before this year: profound specialized ability remains incredibly worthwhile in the agentic era.

Finally, I’d powerfully advance you to rank your own top choices(opens in new tab)! There’s a ton of awesome proposals in this list, including several breathtaking JavaScript APIs akin Temporal which didn’t create awareness to contain in this blog post.

Our in-silico simulation mirrors the command interfaces of our bodily robots, allowing us to create and measure agents that can run experiments and regain from equipment failures.

When a robot encounters an error, an test can stall until a individual steps in. Agents that can diagnose the issue and safely resume activity could keep experiments operating overnight, decrease downtime, and let scientists run additional experiments at once. This is what we’re construction at Gamow Labs: accelerating individual advancement by using agents to addition experimental throughput.

To location this challenge, we current LabRobotBench. Its evaluations test how frontier AI models logic concerning bodily area and complex biologic workflows to troubleshoot and transport out wet-lab experiments.

Results · Cell assay recovery · Assays and chilly stocks · Dose-response recovery · Partner alongside us

Read next

Read next

Read next

U.S. national investigators following the ShinyHunters hacking collection that lately stole extremely delicate data from the FBI have identified executives at two distinct ransomware negotiation firms who maintained unusually near relations alongside the blackmail group, KrebsOnSecurity has learned. Sources near to the inquiry say among the executives in the United States equal helped ShinyHunters run a website that pressured victims into paying a ransom.

Hackers aligned alongside ShinyHunters have claimed credit for dozens of important data breaches since 2019, whenever the collection was chiefly operated by cybercriminals living in France. As those first members were arrested or jailed one by one, authority complete the ShinyHunters brand eventually passed to “Rey,” identified final year as a teenage hacker from Amman, Jordan. According to the FBI, ShinyHunters has extorted additional than $70 myriad from victims so far this year.

In delayed September, ShinyHunters hacked the FBI recruitment website fbijobs.gov and taunted the agency by threatening to publish the taken files, which reportedly included medicinal and mental records, Social Security numbers and residence addresses, and data concerning all employee’s component and specialization.

The FBI jobs location hack has prompted the agency to move alongside rare speed to arrest, detain and inquiry group who had any communications alongside Rey or another ShinyHunters suspects. Reuters reported on October 3 that Rey had been detained by Jordanian authorities and was cooperating alongside the FBI.

Rey was capable to assume authority complete the hacking collection since one of its alleged elder members had fair been nabbed. On the evening of September 15, 2026, authorities in the Netherlands arrested convicted hacker and ShinyHunters doubtful Pepijn van der Stap. Dutch constabulary reportedly used flash-bang grenades in an attempt to stun and apprehend Van der Stap as he was logged in to assorted online accounts.

According to a origin near to the investigation, the authorities arrested Van der Stap during he was using his Signal instant messaging account, which allowed them to peruse latest communications alongside common contacts — including ransomware negotiators based in Canada and the United States.

Multiple sources alongside cognition of the matter told KrebsOnSecurity that Van der Stap’s messages were the key to unraveling a murder-for-hire storyline that emerged immediately following his arrest. The Dutch news outlet RTL reported final duration the two murders were allegedly to be committed abroad, and that there are indications Van der Stap gave the command for the attacks (there is no sign those orders were always carried out).

On October 9, KrebsOnSecurity broke the news that the FBI arrested a 54-year-old Canadian cybersecurity administrator named Edward Dubrovsky in association alongside the ShinyHunters investigation. Dubrovsky, who lately published a book on handling cyber blackmail that recommended continually engaging alongside the hackers, was charged alongside threatening to disclose taken or hacked data and interfering alongside interstate commerce through extortion, according to court records. Politico reports prosecutors have asked that Dubrovsky remain in custody pending trial, and that records connected to his case remain under seal.

A origin near to the inquiry told KrebsOnSecurity that Van der Stap’s Signal messages showed he had common conversations alongside Mr. Dubrovsky and alongside at smallest one administrator at a ample U.S.-based consulting firm, and that these executives frequently knew the particulars concerning new ShinyHunters victims before the victims themselves had equal learned of the breach.

That origin shared another possibly bomb finding by national investigators: the Dutch hacker’s chats showed Mr. Dubrovsky knew ShinyHunters had taken extremely delicate data from FBI servers, and that he never informed the agency of the data breach previous to ShinyHunters threatening on Twitter/X to publish the agency’s deeply individual personnel files.

SHINYWIRE

KrebsOnSecurity has learned from two sources near to the ShinyHunters investigation that FBI investigators accept at smallest one administrator at a U.S.-based consulting resolute played an energetic function in functioning the now-defunct ShinyHunters casualty blackmail website “shinywire[.]com.” KrebsOnSecurity is not naming the U.S. business or the suspected executive(s) for now since they have not yet been charged alongside a crime, but it is a distinguished resolute alongside additional than 1,000 associates.

The Shinywire website was energetic from about May 3, 2026 until October 16 and had entries for nearly 100 organizations hacked by ShinyHunters. Each admission urged victims to affect alongside the cybercrime collection and conversation conditions for payment. The pages additionally included samples of taken records and promised those records would be published online if the casualty ignored their demands.

The following screenshot shows a cached portion of the Shinywire blackmail leaf for Intuitive Surgical, an American medicinal innovation business that was breached in March 2026 following an employee cut for a targeted phishing email.

Victim organizations that refused to affect or negotiate following seven days would discover all of their taken data published on the ShinyHunters casualty shaming blog (a website that is lone reachable via the anonymity network Tor).

In a narrative published October 15, The Globe and Mail wrote that a few months before Edward Dubrovsky was arrested by the FBI, the Canadian cybersecurity administrator alleged in court documents he had rotate into collateral damage in a run by a erstwhile endeavor partner to “destroy” another industry executive.

The narrative noted that Dubrovsky submitted the lawsuit in Ontario this twelvemonth against Daniel Tobok, the erstwhile chief administrator of Cypfer, a cybersecurity resolute founded in Toronto alongside offices in the U.S., Britain, the Netherlands, the United Arab Emirates, and Mexico. The two archetypal became endeavor partners in 2017 and afterward developed Cypfer together, anywhere Mr. Dubrovsky was a managing partner and chief functioning officer. But by 2024, the two had a falling out, alongside Dubrovsky accusing Tobok of gradually excluding him from endeavor matters and making “increasingly capricious endeavor decisions.”

Mr. Tobok reportedly denied the allegations and submitted a counterclaim, accusing Mr. Dubrovsky of accessing confidential data and unfairly competing alongside Cypfer through activity at another resolute called CyberSteward Inc. He additionally stated Mr. Dubrovsky has misrepresented himself as a Cypfer founder, and is not a shareholder.

GHOSTBYTE

According to interviews alongside multiple erstwhile colleagues of Mr. Tobok, as far rear as eight years ago he was known to ransomware purveyors by a particular nickname: Ghostbyte. In 2018, a Canadian business was hacked by Dharma, a prolific Russian-language ransomware affiliate program that archetypal surfaced in 2016. The casualty business told the Dharma ransomware delegate they were leaning toward paying since several of the records were unrecoverable following being locked, but that they needed a improved justify that Dharma would keep their term if paid.

A redacted copy of the Dharma rep’s answer is pictured below, and it shows the ransomware collection urged the casualty to communication a individual at a Canadian IT resolute that helps companies seeking specified guarantees. The Dharma rep recommended the casualty communication the email location ghostbyte@tutanota.com.

“If you desire guarantees, you can compose to the IT company,” the Dharma answer advised. “Take the phone and negotiate alongside them. This IT business frequently solves specified problems in Canada. You can communication them and sign a agreement for services. You’ll motionless have to pay.”

It’s unclear if Mr. Tobok always used that Ghostbyte location offered by the Dharma representative, and he has not responded to multiple requests for comment. However, the breach tracking assistance Constella Intelligence finds an email location Mr. Tobok has frequently used — dtobok@me.com — is connected alongside two online accounts anywhere the chosen username was “ghostbyte,” including a Snapchat account.

Incidentally, Constella additionally finds the Dharma rep’s email location luckygoodlucky@tuta.io is connected alongside a cryptocurrency address that processed 38 transactions totaling 43 bitcoin, ~$3.5 myriad at today’s value (the most latest transaction for this wallet is dated February 2019).

In a declaration shared on October 14, Cypfer stated the company’s endeavor does not contain making or facilitating ransomware payments, and that Cypfer learned of Dubrovsky’s apprehension whenever the news archetypal bankrupt in the media.

“We had no previous cognition of Mr. Dubrovsky’s arrest,” a spokesman told KrebsOnSecurity via email. “CYPFER has not received any outreach from law implementation and, to our knowledge, is not the mark of any law implementation investigation.”

The declaration stated CyberSteward and Cypfer are distinct companies alongside no officers, board or workforce in common, and that Cypfer was lately acquired by the Apros Group, a holding business led by Jason Hogg, a erstwhile FBI particular delegate and erstwhile CEO of Aon Cyber Solutions Group. In 2020, Aon aquired Cytelligence, a safety consulting resolute anywhere Mr. Tobok was originator and CEO and Mr. Dubrovsky was a managing partner.

CONFLICTING INTERESTS

It is not forbidden in the United States to pay hackers for an encryption key to unlock servers infected alongside ransomware, or in toggle for a commitment to delete any taken records and refrain from publishing them online. While casualty organizations can district in lawful hot h2o if they pay a ransom to a collection that is sanctioned by the U.S. Treasury Department, ShinyHunters is not among the ransomware groups currently sanctioned by the United States or by any another government.

Experts say ransomware victims are typically directed by their coverage provider to activity alongside a particular event reply firm. But not all cyber forensics and breach reply companies volition concur to facilitate payments to ransomware groups on behalf of their clients. As a result, formerly casualty firms create a decision to pay, the firms that eschew rewarding extortionists are invariably replaced by companies that have no specified qualms.

In December 2024, ShinyHunters began extorting the learning innovation business PowerSchool, stealing personal data on 62 myriad students and 9.5 myriad teachers in the U.S. and Canada. PowerSchool reportedly paid a $2.85 myriad ransom demand, and a “frequently asked questions” statement (PDF) concerning the breach says PowerSchool was assisted in that attempt by CyberSteward (ShinyHunters affiliate Matthew Lane, 20, of Sterling, Mass., was sentenced in November 2025 to four years in jail for his admitted function in the PowerSchool hack).

But that ransom fee did not halt forthcoming blackmail attempts using the identical taken data. By May 2025, idiosyncratic academy districts were reportedly receiving distinct ransom demands using samples of the identical taken files. While nobody has alleged ShinyHunters was rearward the second motion of blackmail against PowerSchool users, the event drives residence the actuality that there is no specialized way to verify the danger actors have deleted the taken data as promised, or forestall others from abusing the identical records.

A figure of foremost cyber event reply firms, including Coveware and Unit 221B, have consistently warned victims against paying ShinyHunters, noting that “destroyed” casualty data is frequently kept, resold or used to extort the company’s clients immediately afterward on.

The FBI echoed those sentiments in an alert on May 15, 2026 advising victims against paying the ShinyHunters group. Meanwhile, ShinyHunters members have been harassing and threatening workforce at Coveware and Unit 221B for offering this advice.

The following screenshots display fair how annoyed the ShinyHunters leaders were alongside Coveware’s relentless direction against paying the group. The archetypal depiction is from a conversation on May 6, 2026 that took location between the group’s chief document on Telegram and a co-conspirator. In that chat, snippets of which were shared alongside KrebsOnSecurity by a trusted source, ShinyHunters complained that Coveware was harming the group’s fee rates.

“Go on my website, bulk of those companies would’ve paid if it weren’t for Coveware giving them misinformation,” the ShinyHunters document wrote. “Someone (100% Coveware) is going out of their way to create certain i am not paid.”

In another conversation on April 11, 2026, the ShinyHunters Telegram document privately stated they were trying to “eliminate the problem,” which they stated was Coveware. Coveware declined to comment for this story.

“I’m certain the business volition pay but in this particular case I am conscious of Coveware and their involvement, and I’ve likely been not getting a lot of another negotiations mostly apt since Coveware keeps getting involved,” the ShinyHunters document bemoaned.

Mark Camillo is chief administrator at CyberAcuView, an industry collection founded in 2021 by a consortium of important cyber coverage carriers. Camillo stated several firms accusation a flat retainer fee, during those that specialize in assisting companies negotiate a ransom fee lean to accusation a percent of the total ransom amount paid.

That second dynamic, he said, is an inherent battle of interest, as the negotiator has all incentive to create things additional favorable to the attackers since they are financially incentivized to negotiate and pay out, and to not negotiate downward on the price.

“It has arrive to the industry’s notice that many of the ransomware payers accusation a percent of the final fee which may or may not be disclosed,” Camillo said. “This makes no awareness if they are additionally the negotiator. There needs to be additional transparency in the procedure as no one in the ecosystem have to be profiting purely on the size of the ransomware transaction or fee itself.”

Camillo stated the firms doing this activity would contend the fees are needed since there may be unexpectedly higher expenses to safe larger quantities of cryptocurrency or additional hazard carrying the float, and since cryptocurrency exchanges may accusation higher fees for elevated hazard transactions.

“There certainly needs to be additional visibility about the transaction and clarity on the expanding value of the crypto and the exchange’s percent in the transaction to get to the base of this and eliminate any misaligned incentives,” he said.

In latest months, the U.S. Department of Justice has prosecuted a figure of ransomware negotiators alleged to have conspired alongside cybercriminals to defraud their clients. On October 7, the DOJ charged MonsterCloud CEO Zohar Pinhasi, 50, alongside cable fraud and conspiracy for allegedly charging customers to remediate ransomware attacks without paying the hackers. According to charging documents, Pinhasi secretly went rearward his customers’ backs and paid hackers anyway, paying ransomware groups $8 myriad during charging customers $19 million.

In July, Angelo Martino, a 41-year-old ransomware negotiator from Land O’Lakes, Florida, was sentenced to 70 months in prison for colluding alongside the Blackcat/ALPHV ransomware collection to extort multiple victims. According to the DOJ, Martino was paid by BlackCat attackers to provision confidential data concerning the negotiating stance and scheme of his employer’s clients and allow the ransomware actors to maximize the ransoms paid by the victims.

Donald Trump and Vice President JD Vance stated on Tuesday that the Trump administration was giving right-wing YouTuber Nick Shirley $10,000 and launching a $25 myriad bounty program for members of the community to study fraud.

In December 2025, Shirley published a viral video alleging fraud at daycares in Minnesota that were operated by members of the local Somali community. Shirley lingered in parking many and asked to act childcare centers, taking refusals as evidence that the centers weren’t really caring for children. The video quickly went viral, triggering a enormous governmental response: Federal immigration agents descended on the Minneapolis area, and the Trump administration froze Minnesota’s national backing for childcare. Shirley has since visited other states in the US under akin pretenses, showing up unannounced to market stores and hospice centers in hunt of evidence of fraud. Vance and others in the administration publically praised Shirley, who has since rotate into a backbone in the MAGA-aligned satisfied creator ecosystem. He’s helped popularize a genre of so-called autonomous reporting popular on the correct in which satisfied creators and influencers visage businesses or group they doubtful of fraud or infringement as the basis for their online content. Harassment — or equal immigration crackdowns — frequently follow.

The administration told Fox News that it was additionally launching the Fraud Whistleblower Incentive Program (WHIP), a pond of $25 myriad open to anyone who believes they’ve witnessed fraud. A “particular emphasis” is placed on fraud in hospice, residence healthcare, daycares, and particular services, a authorities website says. A chatbot collecting responses instructs the reporting party: “Briefly depict what you saw, heard, or read. A few sentences are enough. Include names, dates, amounts, or records if you have them, and how you know. Note any particulars you’re unsure about.”

According to Fox News and the reporting portal, members of the community who emblem fraud are eligible to get up to $30,000 if a tip submitted leads to a condemnation or important national action. But speaking on Tuesday, Trump contradicted the $30,000 ceiling.

”If you rotate person in and … you discover $1 billion, we are giving a commission to that individual of 1 percent,” Trump stated today. (One percent of $1 milliard would exceed the $30,000 cap.) “And if it’s $10 billion, $200 billion, $400 billion, we’re giving a 1 percent commission to that person,” Trump continued.

The White House didn’t immediately explain how the $10,000 fee to Shirley was calculated or how the program is being funded in the archetypal place.

Shirley’s methods have been criticized particularly in Minnesota, anywhere sweeping fraud investigations were already taking location before he arrived to create content. He accused businesses of faking childcare services according to small additional than being denied admission to facilities, and — to the frustration of many — acted as if his video was the archetypal fraud inquiry in the state. Subsequent province authoritative visits to the centers Shirley featured found them functioning “as expected.”

Read next

Read next

Read next