Project Zero 的 Seth Jenkins 详述了他们开发的一条针对 Google Pixel 10 的新型零点击漏洞利用链，该工作建立在此前攻破 Pixel 9 的成果之上。原始的 Dolby UDC 漏洞（CVE-2025-54957）经少量调整后被移植到 Pixel 10，但由于 Pixel 10 使用 RET PAC 而非 -fstack-protector，利用中需要覆盖 dap_cpdp_init 而不是 __stack_chk_fail 。该更新后的利用链针对安全补丁级别为 2025 年 12 月或更早的未修补设备有效。

利用链中的本地权限提升部分无法直接移植，因为 Pixel 10 上不存在 BigWave 驱动。不过，研究人员发现了 Tensor G5 上 Chips&Media Wave677DV VPU 的新驱动。该驱动由与 BigWave 相同的团队开发，直接将芯片硬件接口暴露给用户空间，允许用户态映射芯片的 MMIO 寄存器接口，而不是通过标准的 V4L2 API 。

在 VPU 驱动的 vpu_mmap 处理函数中发现了一个严重漏洞：该处理函数仅根据 VMA 的大小调用 remap_pfn_range，而没有将映射范围限定在实际寄存器区域的大小内。这导致用户态可以从 VPU 寄存器区域的物理地址起映射任意物理内存。由于内核镜像位于更高的物理地址，攻击者可以访问并修改内核。结合 Pixel 设备上固定的内核物理地址，这几乎是一种任意内核读写原语——实现基本原语只需五行代码，完成完整利用通常不到一天时间。

该漏洞于 2025 年 11 月 24 日被报告，Android VRP 将其评为高危（High），比类似的 BigWave 漏洞获得了更高的严重性评级。漏洞在 71 天后的 2 月 Pixel 安全公告中得到修补，这是作者报告的 Android 驱动漏洞首次在 90 天内被修复，反映了 Android 漏洞分类与修补流程的改进与加速。

尽管这是积极进展，研究仍强调 Android 驱动代码需更强的安全意识与更严格的审计。 VPU 漏洞在 BigWave 问题曝光仅五个月后被发现，表明相关驱动并未得到充分的横向审计。加强驱动安全仍是当务之急，建议厂商采取更主动的软件安全策略，强化代码审计与漏洞修补流程，防止类似问题流向终端用户。 Seth Jenkins of Project Zero details the development of a new zero-click exploit chain targeting the Google Pixel 10, building on prior work that compromised the Pixel 9. The original Dolby UDC exploit (CVE-2025-54957) was adapted for the Pixel 10 with minor adjustments, though the Pixel 10's use of RET PAC instead of `-fstack-protector` required overwriting `dap_cpdp_init` instead of `__stack_chk_fail`. This updated exploit targets unpatched devices with a security patch level of December 2025 or earlier.

The local privilege escalation component of the chain could not be ported because the BigWave driver is absent on the Pixel 10. However, a new driver for the Chips&Media Wave677DV VPU on the Tensor G5 chip was identified. This driver, developed by the same team behind BigWave, directly exposes the chip's hardware interface to userspace, including allowing userspace to map the chip's MMIO register interface, rather than integrating with the standard V4L2 API.

A critical vulnerability was discovered in the VPU driver's `vpu_mmap` handler. The handler calls `remap_pfn_range` based solely on the size of the VMA, without bounding it to the actual size of the register region. This allows userspace to map arbitrary physical memory starting from the VPU register region's physical address. Since the kernel image resides at a higher physical address, it can be accessed and modified. Combined with the kernel's fixed physical address on Pixel devices, this provides an arbitrary read-write primitive on the kernel with minimal effort, requiring only five lines of code for the basic primitive and less than a day for a full exploit.

The vulnerability was reported on November 24, 2025, and rated High severity by Android VRP, an improvement over the Moderate rating given to the similar BigWave bug. It was patched 71 days later in the February Pixel security bulletin, marking the first time an Android driver bug reported by the author was patched within 90 days. This demonstrates progress in Android's triage pipeline and efforts to patch serious vulnerabilities efficiently.

Despite this positive step, the research highlights the ongoing need for more robust and security-aware code in Android drivers. The VPU vulnerability was found just five months after the BigWave bugs were reported, suggesting that developers did not adequately audit their other drivers for similar issues. Strengthening driver security remains a crucial priority, and vendors are encouraged to adopt proactive approaches to software security, code auditing, and vulnerability patching to prevent such issues from reaching end-users.

Turso 正在终止运行近一年的漏洞赏金计划。该计划曾向能复现导致数据损坏的漏洞的提交者支付 1000 美元奖励，但大量低质量、 AI 生成的提交（被称为"slop"）使得该计划不可持续。尽管计划识别出少数优秀的贡献者，经济激励却也吸引了大量自动化、无意义的拉取请求，耗费维护者大量时间来审核和驳回。

该计划最初是为了在重写 SQLite 时增强外界对 Turso 可靠性的信心。团队虽然采用了确定性模拟、模糊测试以及与 SQLite 的差分测试等严格方法，但也承认自动化测试有其局限。赏金的初衷是发现这些工具遗漏的边缘情况，起初确实有效——吸引了一些技术过硬的人，他们不仅发现了真实问题，还为测试基础设施的改进做出贡献。

然而，先进的 AI 工具改变了局面。 1000 美元的奖励成为一些人利用 LLMs 大规模生成漏洞报告的目标，不问真假就大量提交。例如有的 PR 故意破坏数据库头部便宣称发现"bug"，或者误解并发写入等核心特性而提交错误报告。这类提交通常夹杂乱码和虚假断言，维护者要花数小时去处理，而提交者只需几分钟即可生成。

Turso 曾引入担保机制以自动关闭疑似机器人的提交，但这只促使机器人继续开新的问题，要求人工复核。生成 slop 的成本极低，而人工评估的成本很高，这种不对称使赏金计划难以为继。尽管 Turso 重视开放贡献模式，团队最终认为在开放体系中任何金钱激励都会被 AI 利用，不得不终止该计划，以维护维护者的精力和项目的完整性。 Turso is retiring its bug bounty program, which offered $1,000 for demonstrating bugs that lead to data corruption, after nearly a year of operation. The decision stems from an overwhelming influx of low-quality, AI-generated submissions, referred to as "slop," that have made the program unsustainable. While the initiative successfully identified a handful of exceptional contributors, the financial incentive attracted a flood of automated, nonsensical pull requests that consume significant maintainer time to review and dismiss.

The program was originally launched to bolster confidence in Turso's reliability as it rewrites SQLite, a system renowned for its stability. Despite employing rigorous testing methods like deterministic simulation, fuzzing, and differential testing against SQLite, the team acknowledged that automated tests have limitations. The bounty was designed to uncover edge cases their tools missed, and it initially worked well, attracting skilled individuals who found genuine issues and even contributed to improving the testing infrastructure itself.

However, the rise of advanced AI tools changed the landscape dramatically. The $1,000 reward became a target for users leveraging LLMs to generate bug reports at scale, regardless of validity. Examples include PRs that manually corrupt database headers and claim discovery of a "bug," or reports that misunderstand core features like concurrent writes. These submissions, often filled with garbled text and false claims, require hours of maintainer effort to address, while costing the submitters mere minutes to produce.

In response, Turso implemented a vouching system to auto-close suspected bot submissions, but this only led to bots opening new issues demanding manual review. The asymmetry between the low cost of generating slop and the high cost of human evaluation made the bounty untenable. Although Turso values its open contribution model, the team concluded that any financial incentive in an open system is now exploited by AI, forcing them to retire the program to preserve maintainer bandwidth and project integrity.

Amazon 员工正面临越来越大的压力，被要求把人工智能融入日常工作；但由于缺乏清晰的使用指导，一些员工为了满足使用预期而制造不必要的 AI 任务。据 Financial Times 报道，Amazon 通过内部工具 MeshClaw 追踪员工的 AI 代币消耗，有人仅为抬高数据而生成多余的 AI 代理，并未真正提升生产力。

几位匿名员工描述了这样一种职场文化：AI 使用已成不可忽视的指标。一位员工说"使用这些工具的压力很大"，有同事主要通过 MeshClaw 来最大化代币消耗。尽管 Amazon 表示 AI 使用统计不会纳入绩效考核，员工仍心存疑虑。另一位员工指出，经理确实在关注这些数据，追踪机制带来了"扭曲的激励"，有人甚至把 AI 使用数据当成竞赛标尺。

据称，公司目标是每周有 80% 的开发者使用 AI，员工的代币消耗还在内部排行榜上显示。但 Amazon 否认这些说法，称公司没有全员统一的 AI 使用指标，也没有用于员工互比的内部排行榜，员工只能在个人仪表板上查看自己的使用情况。

MeshClaw 是争议的核心工具，灵感来自 OpenClaw——一款既有提升效率潜力又存在风险的工具。与云端模型不同，这两款工具都在用户的本地硬件上运行，因而拥有较高的自主性。这种独立性引发担忧：今年早些时候，Meta Superintelligence Labs 的对齐主管在使用 OpenClaw 时差点被删除整个邮箱，此事走红网络，凸显了赋予 AI 过多访问与控制权限的危险。 Amazon employees are facing increasing pressure to integrate AI into their daily workflows, but the lack of clear direction on how to use it productively has led to some workers creating unnecessary AI tasks just to meet usage expectations. According to a report by the Financial Times, Amazon is tracking employees' consumption of AI tokens through its internal tool MeshClaw, and some workers are generating extraneous AI agents simply to inflate their numbers rather than to improve actual productivity.

Several anonymous Amazon employees described a workplace culture where AI usage has become a metric that feels impossible to ignore. One worker said there is "just so much pressure to use these tools," with some colleagues using MeshClaw primarily to maximize their token consumption. While Amazon has told employees that AI usage statistics won't factor into performance evaluations, workers remain skeptical. Another employee noted that managers are paying attention to these metrics, and the tracking creates "perverse incentives," with some people becoming competitive about their AI usage numbers.

The company reportedly has a target of 80% of developers using AI each week, and employees' token consumption is tracked on an internal leaderboard. However, Amazon has pushed back on these claims, stating there is no company-wide metric for AI usage and no internal leaderboards where employees are measured against each other. Instead, the company says employees can only view their own AI usage on personal dashboards.

MeshClaw, the tool at the center of this controversy, is inspired by OpenClaw, another AI tool known for both its productivity potential and its risks. Unlike cloud-based AI models, both tools run locally on users' hardware, giving them significant autonomy. This independence has raised concerns, as demonstrated earlier this year when the director of alignment at Meta Superintelligence Labs went viral after OpenClaw nearly deleted her entire email inbox, highlighting the dangers of granting AI too much access and control.

Radicle 是一个基于 Git 的开源点对点代码协作栈，旨在作为集中式代码托管平台的去中心化替代方案。与由单一实体控制的服务不同，Radicle 在主权网络上运行，仓库在节点间复制，用户对自己的数据和工作流拥有完全控制权。最新版 Heartwood 代表了协议的新一代，项目提供通过简单的 shell 命令安装或从源码构建的方式，目前支持 Linux 、 macOS 和 BSD 系统；对于偏好图形界面的用户，也提供桌面客户端。

Radicle 的架构基于若干核心原则：使用加密身份来管理代码和社交工件，利用 Git 实现高效的数据传输，并通过自定义的 gossip 协议交换元数据。所有社交工件（如 issues 和 discussions）都存储在 Git 中，并用公钥密码学签名，保证内容的真实性和作者可验证性。该系统采用本地优先的设计，能够在无网络的情况下运行，且用户完全拥有自己的数据，便于迁移与备份。其模块化结构包含 CLI 、 Web 界面和 TUI，由 Radicle Node 与 HTTP Daemon 提供后端支持，并通过 Collaborative Objects (COBs) 实现可扩展性，便于开发者构建自定义的协作流程。

Radicle 采用定期发布的开发节奏，截至 2026 年 3 月，最新版本为 1.8.0，项目有频繁更新的历史，最近的发布包括 1.7.1 和 1.7.0，并在 2025 年中期推出了 Radicle Desktop 客户端。团队通过 Zulip 、 Mastodon 、 Bluesky 和 Twitter 等平台与社区积极互动，并维护博客，发布关于与 Jujutsu 集成、使用 Radicle CI 等主题的文章。鼓励通过 Zulip 或电子邮件提交反馈，相关内容会自动发布到专用频道。该项目在 MIT 和 Apache 2.0 许可下免费开源，欢迎社区贡献。 Radicle is an open-source, peer-to-peer code collaboration stack built on Git, designed as a decentralized alternative to centralized code hosting platforms. Unlike services controlled by a single entity, Radicle operates on a sovereign network where repositories are replicated across peers, giving users full control over their data and workflow. The latest version, Heartwood, represents the most recent generation of the protocol, and the project provides installation via a simple shell command or building from source, currently supporting Linux, macOS, and BSD systems. A graphical desktop client is also available for those who prefer a visual interface.

The architecture of Radicle is built on several core principles. It uses cryptographic identities for code and social artifacts, leverages Git for efficient data transfer, and employs a custom gossip protocol for metadata exchange. All social artifacts like issues and discussions are stored in Git and signed with public-key cryptography, ensuring authenticity and authorship verification. The system is designed to be local-first, meaning it functions without internet access and allows users to own their data for easy migration and backup. Its modular design includes a CLI, web interface, and TUI backed by a Radicle Node and HTTP Daemon, allowing for extensibility through Collaborative Objects (COBs) that enable developers to build custom collaboration flows.

Radicle's development follows a regular release cycle, with version 1.8.0 being the latest as of March 2026. The project has a history of frequent updates, including recent releases like 1.7.1 and 1.7.0, and the launch of the Radicle Desktop client in mid-2025. The team actively engages with the community through platforms like Zulip, Mastodon, Bluesky, and Twitter, and maintains a blog with posts on topics such as integrating with Jujutsu and using Radicle CI. Feedback is encouraged via Zulip or email, which is automatically posted to a dedicated channel. The project is free and open source under MIT and Apache 2.0 licenses, inviting contributions from the community.

2026 年 4 月 23 日，一个纯 OCaml 实现的 CCSDS（Consultative Committee for Space Data Systems）协议栈，代号为 Borealis，在 DPhi Space 的 ClusterGate-2 载荷模块中成功在低地球轨道启动。该项目由 Parsimoni 开发，实现了端到端加密的命令与控制以及后量子密钥轮换，全部用安全的 OCaml 编写。这一里程碑是历经十年工程攻关、为 OCaml 5 带来安全且高性能多线程能力的成果；Parsimoni 团队把曾被戏言"会到达月球"的设想字面化，将协议栈部署到一颗每 90 分钟绕地球一圈的卫星上。

Borealis 作为守护进程运行在 Arm SoC（四核 Cortex-A53 、 4 GB RAM）的托管载荷环境中。由于卫星没有直接的网络连接，系统采用延迟容忍网络模型，命令和遥测被序列化为 BPv7（Bundle Protocol version 7）包并写入文件系统，DPhi Space 的 API 在卫星过境时转发这些文件。为保障共享硬件上的安全——以防像 "Dirty Frag" 或 "Copy Fail" 之类的内核级漏洞破坏租户隔离——每个数据包都被封装在 BPSec（Bundle Protocol Security）扩展块中。这个加密信封对有效载荷进行加密和认证，确保即便底层 Linux 内核被攻破，卫星运营方或其他租户也无法读取、篡改或伪造内容。

系统还实现了 OTAR（Over-The-Air Rekeying）用于后量子签名密钥 ML-DSA-65，设计以覆盖卫星的 10 到 15 年寿命，允许运营方在无需物理重刷硬件的情况下进行密钥轮换。当前飞行循环在接收新密钥时即刻激活，但协议也支持更保守的地面驱动激活步骤，允许运营方在提交前验证安装。值得注意的是，一旦卫星在轨，主密钥并无轮换路径——在缺乏硬件安全元件（如 TPM）的长期任务中，这是一种现实存在的失败模式。

为提升性能，团队正在引入 OxCaml（Jane Street 的 OCaml 编译器分支）。通过使用 `exclave_ stack_` 注解将分配标记为栈绑定，开发者可以在热路径上消除垃圾回收压力。在一项涉及 2500 万个 CCSDS 包调度的基准测试中，该方法将单包 p99.9 延迟从 29 ns 降至 9 ns，并完全消除了 394 次次要 GC 。这种抖动的减少对具有严格调度截止的实时机载调度至关重要——这是欧盟 ORCHIDE Horizon Europe 项目的核心负载之一。

选择 OCaml 源于对数学严谨性与内存安全的需求：在该领域，C/C++ 的内存损坏约占严重 CVE 的 70% 。采用 OCaml 可消除一整类攻击面，例如在现有 C 库（如 NASA CryptoLib）中常见的堆缓冲区溢出。开发流程采用"纵深防御"策略：针对传输格式使用类型化 schema 、用 GADTs（Generalized Algebraic Data Types）在编译时强制有效的协议状态转换，并与参考实现做互操作测试。这遵循 nqsb-TLS 的做法：同一段代码既可作为飞行软件、地面软件，又可作为测试判定器，从而实现跨角色的逐字节比对。

Borealis 协议栈建立在为期十年的 MirageOS 生产级库之上，MirageOS 最初为云 unikernel 设计。尽管当前部署以 Linux 进程形式运行，而非 unikernel，但它展示了这些函数式系统的适用性。 Parsimoni 的下一个挑战是将该方案扩展到卫星编队，重点包括安全部署、签名更新、载荷隔离和认证。随着把硬件送入轨道变得常态化，行业中最有趣的问题正逐步转向软件层面，这与云计算的发展轨迹相呼应——最终，堆栈比服务器本身更重要。 On April 23, 2026, a pure-OCaml implementation of the CCSDS (Consultative Committee for Space Data Systems) protocol stack, codenamed Borealis, successfully booted in low Earth orbit aboard DPhi Space's ClusterGate-2 payload module. Developed by Parsimoni, the project features end-to-end encrypted command and control with post-quantum key rotation, all written in safe OCaml. This milestone follows a decade-long engineering effort to bring safe, performant multi-threading to OCaml 5, which its creators speculated would eventually reach the moon. The team at Parsimoni took that vision literally, deploying the stack on a satellite that circles the Earth every ninety minutes.

Borealis functions as a daemon running on an Arm SoC (four Cortex-A53 cores, 4 GB RAM) within a hosted-payload environment. Because the satellite lacks direct network connectivity, the system uses a delay-tolerant network model where commands and telemetry are serialized into BPv7 (Bundle Protocol version 7) bundles and written to a filesystem. DPhi Space's API then forwards these files during orbital passes. To ensure security on shared hardware where kernel-level vulnerabilities like "Dirty Frag" or "Copy Fail" could break tenant boundaries, every bundle is wrapped in BPSec (Bundle Protocol Security) extension blocks. This cryptographic envelope encrypts and authenticates the payload, ensuring that even if the underlying Linux kernel is compromised, the satellite operator or other tenants cannot read, modify, or forge the contents.

The system also implements OTAR (Over-The-Air Rekeying) for post-quantum signing keys (ML-DSA-65), designed to last the 10-to-15-year lifespan of the satellite. This allows operators to rotate keys without physically re-flashing the hardware. While the current flight loop activates new keys upon receipt, the protocol supports a more cautious ground-driven activation step where operators verify the installation before committing. The master key, however, has no rotation path once the satellite is in orbit, representing an honest failure mode for long missions lacking hardware-backed secure elements like TPMs.

Looking toward performance optimization, the team is integrating OxCaml, Jane Street's compiler branch for OCaml. By using `exclave_ stack_` annotations to mark allocations as stack-bound, developers can eliminate garbage collection pressure on the hot path. In benchmarks involving 25 million CCSDS packet dispatches, this approach reduced p99.9 latency from 29 ns to 9 ns per packet and eliminated 394 minor GCs entirely. This reduction in jitter is critical for real-time on-board dispatch with hard scheduling deadlines, a workload central to the EU's ORCHIDE Horizon Europe project.

The choice of OCaml is driven by the need for mathematical rigor and memory safety in a domain where C/C++ memory corruption accounts for roughly 70% of severe CVEs. By using OCaml, the team removes entire classes of attack surfaces, such as the heap buffer overflows found in incumbent C-based libraries like NASA CryptoLib. The development process relies on a "defense in depth" strategy: typed schemas for wire formats, GADTs (Generalized Algebraic Data Types) to enforce valid protocol state transitions at compile time, and interop testing against reference implementations. This follows the nqsb-TLS approach, where the same code serves as flight software, ground software, and a test oracle, allowing for byte-for-byte comparison across roles.

The Borealis stack is built on a decade of production-tested libraries from MirageOS, originally designed for cloud unikernels. While the current deployment runs as a Linux process rather than a unikernel, it demonstrates the versatility of these functional systems. The next challenge for Parsimoni is scaling this to a fleet of satellites, focusing on safe deployment, signed updates, payload isolation, and attestation. As launching hardware into orbit becomes routine, the industry's most interesting problems are shifting to the software layer, mirroring the evolution of cloud computing where the stack eventually mattered more than the servers.

Sam Smith 创建了一个名为 Geofile Explorer 的项目，通过把真实世界的位置呈现在电脑文件夹中，重新构想数字化探索。该项目仍在开发中，允许用户将地球当作电脑上的一个文件夹来浏览。用户可以拖放图片上传到文件夹，或右键单击添加文字笔记。该项目受多种基于网页的实验和工具启发，这些项目模拟桌面环境或以创造性方式探索数据，例如 Neal.fun 的 Wiki Files 、 Depths of Wikipedia 以及 Readme 文件中列出的其他项目。 Readme 还说明，"Wikipedia"和"Media"部分中的所有文件夹和文件均为 Wikimedia 及其各自所有者所有，并鼓励用户通过编辑 Wikipedia 和 Wikimedia Commons 来帮助完善文件夹结构。界面包含类似 Windows 的常用元素，如 "My Documents"、"Control Panel" 和 "Help and Support"，为用户提供熟悉的桌面交互体验。该项目旨在借助文件系统的概念，使信息更易获取且更具互动性。 Sam Smith has created a project called Geofile Explorer, which reimagines digital exploration by presenting real-world locations as folders on a computer. The project is currently in progress and allows users to explore the Earth as a folder on their computer. Users can drag and drop images to upload them to the folder or right-click to write a text notes. The project is inspired by various web-based experiments and tools that simulate desktop environments or explore data in creative ways, such as Neal.fun's Wiki Files, Depths of Wikipedia, and others listed in the Readme file. The Readme also clarifies that all folders and files in the "Wikipedia" and "Media" sections are properties of Wikimedia and their respective owners, encouraging users to help improve the folder structure by editing Wikipedia and Wikimedia Commons. The interface includes standard Windows-like elements such as "My Documents," "Control Panel," and "Help and Support," suggesting a familiar desktop environment for user interaction. The project aims to make information more accessible and interactive by leveraging the concept of a file system.

2026 年初，偏远的 Tristan da Cunha 岛爆发医疗紧急情况：一名从 MV Hondius 下船的岛民疑似感染汉坦病毒。岛上小医院的关键物资如医用氧气迅速告罄，随即向英国政府求援。 Tristan 岛极为孤立，距最近的 St Helena 机场约 1,510 英里且无飞机跑道，常规运输无法实现；国防部遂制定了一项前所未有的空投方案，动用伞兵与货物降落伞进行救援。

任务在后勤上极为复杂，需周密策划。英国皇家空军的 A400M 运输机被选中执行，伴随一架 Voyager 空中加油机以应对长距离航程。物资和人员先在 RAF Brize Norton 集结，随后飞越约 4,200 英里抵达 Ascension Island，作为最后一段的出发点。 5 月 9 日凌晨，条件符合，代号 Flight RRR4989 的 A400M 自 Ascension 起飞；空中加油后飞往 Tristan，但受强风影响，抵达时间从原定的下午 3:30 推迟到约下午 5 点。

行动本身既精准又勇敢。来自 British Army Pathfinder 排的一队伞兵与一名顾问医生和一名 ICU 护士分两组跳伞入岛。首组伞兵从 7,000 英尺跳下，尽管风力强劲且多变，仍在 Back Fence 与高尔夫球场附近着陆，随即在 Patches 设立指引站，指挥后续物资投放；医务人员随后以双人伞降落，安全落在高尔夫球场。共计 3.3 吨医疗物资在 Patches 上空进行了三次低空投放，飞机最低飞行高度仅 175 英尺。

这是一场与冬日余晖竞速的救援。绝大多数物资当晚由岛民收集并运送到定居点，最后一批则在次日早晨取回。军事队伍受到社区热烈接待，住进当地宾馆，并在 Prince Philip Hall 设立临时基地。到 5 月 10 日星期日，所有物资已送达 Camogli Hospital，抵达的医务人员开始为人手吃紧的本地医护提供关键支持；病人被报告为情况稳定。

岛上对救援行动既感激又惊讶。行政长官 Philip Kendall 称赞了英国武装部队与政府的"惊人合力"。对居民而言，看到固定翼飞机低飞掠过定居点、降落伞缓缓降下，是一次既历史性又近乎超现实的经历，暂时掩盖了事件本身的危机感。社区与世界各地的支持者纷纷表达谢意；岛上警员 Barry Thacker 用诗歌纪念此事，向从伞兵和飞行员到当地厨师与通信员在内的所有参与者致敬。军事队伍将继续留岛执行医疗任务，任务完成后再乘船离开。 In early 2026, the remote island of Tristan da Cunha faced a medical emergency when an islander who had disembarked from the cruise ship MV Hondius fell ill with suspected hantavirus. The island's small hospital quickly began running low on critical supplies like medical oxygen, prompting urgent requests for assistance from the UK Government. Given Tristan's extreme isolation, 1,510 miles from the nearest airport on St Helena and with no airstrip of its own, conventional delivery was impossible. The Ministry of Defence devised an unprecedented plan: a military airdrop operation involving paratroopers and cargo parachutes.

The mission was logistically complex and required meticulous planning. An RAF Airbus A400M transport aircraft was chosen for the task, supported by a Voyager air-to-air refuelling tanker due to the vast distances involved. Supplies and personnel were first assembled at RAF Brize Norton in England, then flown over 4,200 miles to Ascension Island, the staging point for the final leg. Early on May 9th, conditions were deemed suitable, and the A400M, designated Flight RRR4989, departed Ascension. After refuelling mid-flight, it headed toward Tristan, though adverse winds delayed its arrival until around 5:00 PM, later than the initially announced 3:30 PM.

The operation itself was a remarkable feat of precision and bravery. A team from the British Army's Pathfinder Platoon, along with a consultant doctor and an ICU nurse, parachuted onto the island in two groups. The first group of paratroopers jumped from 7,000 feet, landing near the Back Fence and the golf course despite strong, unpredictable winds. They immediately set up a guidance station at the Patches to direct subsequent cargo drops. The medics followed on tandem parachutes, landing safely on the golf course. In total, 3.3 tonnes of medical supplies were successfully dropped in three low-altitude passes over the Patches, with the aircraft flying as low as 175 feet.

The operation was a race against the fading winter daylight. While most cargo was collected and transported to the settlement by islanders that evening, the final load had to be retrieved the following morning. The military team was warmly welcomed into the community, housed in local guest houses, and set up a base in Prince Philip Hall. By Sunday, May 10th, all supplies had been delivered to Camogli Hospital, where the arriving medical personnel began providing crucial support to the overstretched local staff. The patient was reported to be stable.

The island's reaction was one of profound gratitude and astonishment. Administrator Philip Kendall praised the "amazing combined effort" from the UK armed forces and government. For the residents, the sight of a fixed-wing aircraft flying low over the settlement and parachutes descending was a historic and almost surreal event, momentarily overshadowing the crisis that prompted it. The community, along with supporters worldwide, expressed deep thanks for the support. The event was poetically commemorated by island policeman Barry Thacker, who wrote a verse honoring all involved, from the paratroopers and pilots to the local cooks and communicators. The military team was set to remain on the island to continue their medical mission until their work was complete, at which point they would depart by ship.

Mullvad VPN 在每台服务器上使用多个出口 IP，并根据用户的 WireGuard 密钥以确定性方式分配这些 IP；密钥会在 1 到 30 天内轮换一次。虽然这种设计有助于将用户分散到不同 IP 以避免被封锁，但也带来了指纹识别的风险。对 9 台服务器的测试表明，出口 IP 并非随机分配，而是遵循可预测的模式。每台服务器的 IP 池按比例划分，用户在不同服务器上获得的 IP 会始终位于各自池中的同一百分位；例如，有的用户在每台服务器上总是落在大约第 81 百分位。

这种现象源自 Mullvad 在 Rust 中使用基于种子的随机数生成器（RNG）。对于同一种子，RNG 会产生一致的浮点值，再按服务器 IP 池的大小进行缩放。因此即便理论上存在数万亿种 IP 组合，实际上用户只落入观测到的 284 种组合之一。池大小相同的服务器（如 Chile 和 South Africa）会共享相同的 IP 索引，进一步证实了 RNG 的确定性行为。这可能是 Rust 中 random_range 的比例缩放方式导致的意外后果，许多开发者（包括 Mullvad 的）可能未曾预料到这一点。

组合数量受限使得关联攻击成为可能。研究者开发了一个工具来估算一组 IP 对应的浮点区间，结果显示约 0.34% 的用户会共享相同组合。按约 100,000 名活跃 Mullvad 用户估算，约有 340 人可能在不同服务器间被关联。例如，当论坛上两个账户的 IP 日志显示重叠的浮点区间时，很大概率它们属于同一人。该漏洞在数据泄露或法务索取的 IP 日志中同样可被利用，从而可能去匿名化 VPN 背后的用户。

缓解建议：尽量不要在同一 WireGuard 密钥周期内频繁切换服务器，最好每个密钥只切换一次；若需强制轮换密钥，可退出 Mullvad 客户端重新登录。这样可以降低跨会话被关联的概率。此问题凸显了负载均衡与隐私之间的权衡：确定性分配虽有助于扩展和负载均衡，但也会为每个用户留下独特的指纹。 Mullvad VPN uses multiple exit IPs per server, assigning them deterministically based on a user's WireGuard key, which rotates every 1 to 30 days. While this design helps distribute users across IPs to avoid blocks, it introduces a fingerprinting risk. Testing 9 servers revealed that exit IPs are not randomly assigned but follow a predictable pattern. Each server's IP pool is divided proportionally, so a user's IP across different servers consistently lands in the same percentile of its pool. For example, one user might always get an IP around the 81st percentile of each server's range.

This behavior stems from Mullvad's use of a seed-based random number generator (RNG) in Rust. The RNG produces a consistent float value for a given seed, which is then scaled to the server's IP pool size. This means that even with trillions of possible IP combinations, users end up with one of only 284 observed combinations. Servers with identical pool sizes, like those in Chile and South Africa, share the same IP indexes, confirming the RNG's deterministic nature. This might be an unintended consequence of how Rust's `random_range` function works, as many developers, including Mullvad's, may not have anticipated this proportional scaling.

The limited number of combinations allows for correlation attacks. A tool was created to estimate the float range for a set of IPs, showing that about 0.34% of users share the same combination. With an estimated 100,000 active Mullvad users, this means around 340 people could be linked across different servers. For instance, if two accounts on a forum show overlapping float ranges in their IP logs, there's a high probability they belong to the same person. This vulnerability extends to data breaches or legal IP logs, potentially deanonymizing users behind the VPN.

To mitigate this, users should avoid switching servers more than once per WireGuard key and force rotate their key by logging out of the Mullvad app. These steps reduce the chance of being tracked across sessions. The issue highlights a trade-off between load balancing and privacy, where the deterministic IP assignment, while practical for scaling, creates a unique fingerprint for each user.

英国政府通过用内部团队开发的自研系统取代用于管理 Homes for Ukraine 难民项目的 Palantir IT 系统，节省了数百万英镑。 MHCLG 表示，新系统更灵活、符合更高的安全标准，同时大幅降低了运行成本，已于 2025 年 9 月投入使用。

Homes for Ukraine 项目在 2022 年 3 月俄国全面入侵后不久启动，旨在将难民与提供免费住宿的人匹配。 Palantir 最初免费提供其 Foundry 平台六个月以便迅速搭建系统，但据 National Audit Office 的报告，随后签订了两份为期 12 个月的合同，金额分别为 450 万英镑和 550 万英镑。报告指出，政府首席商务官对 Palantir 以零成本或名义成本的初始报价换取商业立足点表示担忧，认为这与要求公开竞争的公共采购原则相悖。

该项目高级数字负责人 Coco Chan 表示，部门希望以更灵活的技术方案取代商业平台，以节省开支并掌控数据与代码。她称，内部替代系统每年已为 MHCLG 节省数百万英镑的运行成本，这一做法为减少对外部供应商依赖、发展所谓"主权技术"树立了先例。

此举正值外界对 Palantir 在英国公共服务领域合同的广泛批评之际，涉及的机构包括 NHS 、 Ministry of Defence 、 Financial Conduct Authority 以及 11 个警察部门。批评者指出，Palantir 参与美国移民执法和与以色列军方的合作，加上其几位知名创始人的立场，使其并非合适的合作伙伴；人们也担心英国对大型美国科技供应商的依赖。

但也有人认为，外部专家能带来宝贵经验并能迅速部署大规模团队，这对紧急国家项目至关重要。 Palantir 为其工作辩护，称很自豪能支持该项目，并在短短 9 天内搭建出解决方案，使超过 157,000 名难民得以安全安置；该公司还表示，系统更换证明客户不会被锁定在其技术平台上。 The UK government has saved millions of pounds by replacing a Palantir IT system used to manage the Homes for Ukraine refugee scheme with an in-house solution built by its own experts. The Ministry of Housing, Communities and Local Government (MHCLG) said the new system is more flexible and meets high security standards, while significantly reducing running costs. The replacement system became operational by September 2025.

The Homes for Ukraine scheme was launched in March 2022, shortly after Russia's full-scale invasion, to match refugees with people offering free accommodation. Palantir initially provided its Foundry platform for free for six months to help set up the system quickly. However, subsequent 12-month contracts were awarded, one worth £4.5 million and another £5.5 million, according to a National Audit Office report. The report noted concerns from the Government's chief commercial officer about Palantir's practice of offering zero or nominal-cost initial offers to gain a commercial foothold, which he argued was contrary to public procurement principles requiring open competition.

Coco Chan, a senior digital leader on the project, said the department wanted to replace the commercial platform with a more flexible technology solution to save costs and control data and code. She said the in-house replacement was already saving MHCLG millions of pounds a year in running costs. The move sets a precedent for reducing reliance on external suppliers and developing what some call "sovereign technology."

The shift comes amid broader criticism of Palantir's contracts across UK public services, including with the NHS, Ministry of Defence, Financial Conduct Authority, and 11 police forces. Critics argue the firm's involvement with US immigration enforcement and Israel's military, as well as the beliefs of its prominent founders, make it an unsuitable partner. There are also concerns about the UK's reliance on large US tech suppliers.

However, others note that external specialists can bring valuable experience and the ability to deploy large teams quickly, which is important for urgent national programmes. Palantir defended its record, saying it was proud to have supported the scheme and stood up a solution in just nine days, enabling the safe resettlement of more than 157,000 refugees. The firm also said the change to a new system showed there was no risk of firms being locked into using its technology.

专家：超过一半的美国正遭遇数十年来最严重的干旱

目前美国有超过 60% 的地区处于干旱状态，其中超过 20% 被评为极端干旱。 Virginia Tech 的气候学家 Andrew Ellis 表示，因强度和覆盖范围罕见，这次干旱可谓数十年来最严重。他解释了成因、受影响最严重的地区以及可能的缓解前景。

干旱的主要原因是一次非典型的 La Niña，即西赤道太平洋异常冷却。过去的秋冬季里，这一现象在美国南部带来了持续干燥。虽然在 La Niña 年份里，西部、南部大平原和东南部常见干旱，但 Ellis 指出此次不同寻常的一点是太平洋西北部也异常干燥。 La Niña 时风暴通道通常向北移至美加边境附近，导致美国南部缺乏带来降水的风暴动力。另外，气候变暖也在加剧干旱：气温上升会通过蒸散作用增加土壤失水。

最令人担忧的两个地区是 Colorado 和东南部，尤其是 Georgia 和 Florida，这些地方广泛出现极端和严重干旱。更大范围来看，从 deep South 到 mid-Atlantic 的美国东南象限正经历严重干旱，central Rocky Mountains 和高海拔的 Great Plains 地区也在受影响。从 New Jersey 到 Arkansas 的诸州在 La Niña 年份特别容易在秋冬出现干燥，因为它们依赖来自墨西哥湾和东南海岸的水汽——而这一水源在过去六到八个月基本被切断。相对而言，Ohio Valley 在 La Niña 年份通常更湿润，今年也基本没有出现干旱。

在暖季要实现显著的干旱缓解很困难。最常见的缓解往往来自夏末或初秋的热带系统，但这些系统伴随强风和短时强降雨的风险。对于 Rocky Mountains 和高海拔 Great Plains 来说，夏季缓解尤其困难，因为这些地区高度依赖冬季积雪和大尺度冬季风暴系统。东南部和 mid-Atlantic 虽然可能出现由墨西哥湾和大西洋水汽驱动的湿润夏季，但这类降水通常不够持久，难以彻底消除深层干旱。展望秋冬，Ellis 提到有可能出现一次历史性的 El Niño，理论上这可能带来与去年 La Niña 相反的气候格局。

Andrew Ellis 是 Virginia Tech College of Natural Resources and Environment 下 Department of Geography 的教授，研究领域包括气候科学、气象学、降雪变率、干旱监测以及干旱和半干旱地区淡水资源可持续性的评估。 ## Expert: More than half of U.S. faces worst drought in decades

More than 60 percent of the United States is currently experiencing drought conditions, with over 20 percent classified as extreme drought. Andrew Ellis, a climatologist at Virginia Tech, described these conditions as among the worst in decades due to the rare combination of intensity and aerial coverage. He explained the causes, the areas most impacted, and the outlook for relief.

The primary cause of the drought is an atypical La Niña condition, which involves the cooling of the western equatorial Pacific Ocean. This phenomenon brought dryness across the southern tier of the United States during the past fall and winter. While dryness is typical in the West, southern Great Plains, and Southeast during La Niña years, Ellis noted this event was unusual because the Pacific Northwest also remained exceptionally dry. During La Niña, the storm track typically moves north along the U.S.-Canadian border, leaving the southern U.S. without the storm dynamics needed for precipitation. Additionally, climate warming is exacerbating the situation by increasing air temperatures, which leads to greater water loss from the soil through evapotranspiration.

The two areas of greatest concern are Colorado and the Southeast, particularly Georgia and Florida, where extreme and exceptional drought conditions are widespread. More broadly, the southeastern quadrant of the U.S. from the deep South to the mid-Atlantic is experiencing deep drought, along with the central Rocky Mountains and high Great Plains regions. States from New Jersey to Arkansas are especially susceptible to fall and winter dryness during La Niña years because they rely on moisture from the Gulf of Mexico and the Southeast coastline, a source that has been largely cut off for the past six to eight months. Conversely, the Ohio Valley tends to be wetter during La Niña years and has remained largely drought-free this year.

Significant drought relief is difficult to achieve during the warmer months. The most significant relief often comes from late summer or early fall tropical systems, though these carry risks of damaging winds and excessive rainfall in short periods. Relief in the Rocky Mountains and high Great Plains is particularly challenging in summer, as those regions depend heavily on winter snowpack and large-scale winter storm systems. While the Southeast and mid-Atlantic can experience wet summer periods driven by Gulf and Atlantic moisture, these events are rarely persistent enough to eliminate a deep drought. Looking beyond summer, Ellis suggested that a historic El Niño event may occur next fall and winter, which could theoretically produce the opposite conditions to this past year's La Niña.

Andrew Ellis is a professor in the Department of Geography within Virginia Tech's College of Natural Resources and Environment. His expertise includes climate science, meteorology, snowfall variability, drought monitoring, and assessing the sustainability of freshwater resources in arid and semi-arid climates.