GitHub confirmed on Wednesday that an employee installed a trojanized VS Code extension, giving attackers access to roughly 3,800 internal repositories. The company removed the malicious extension from the VS Code marketplace, isolated the compromised device, and began incident response. The hacker group TeamPCP claimed responsibility on a cybercrime forum, offering the stolen source code for at least $50,000. GitHub said the exfiltration was limited to internal repos and that customer data stored outside those repos was not affected. The breach highlights the risk of supply-chain attacks through developer tools: VS Code extensions have been used in multiple campaigns to steal credentials and deploy malware. TeamPCP was previously linked to attacks on PyPI, NPM, and Docker, and more recently to a campaign that also compromised two OpenAI employees.
The VS Code marketplace has repeatedly hosted malicious extensions. In January, two AI-coding-assistant extensions with 1.5 million installs exfiltrated data to servers in China. GitHub's platform is used by over 180 million developers and 90% of Fortune 100 companies.
President Trump purchased between $15,000 and $50,000 of Thermo Fisher Scientific stock on March 11, the same day he toured the company's Ohio facility and publicly praised it as 'a great company.' He had also bought Thermo Fisher stock in February and early March, accumulating up to $215,000 worth before the visit. The trades were disclosed only on May 14, buried in a 113-page filing. In a separate instance, Trump bought more than $1 million in Dell stock and, nine days later, told a Georgia audience to 'go out and buy a Dell computer.' The transactions were marked 'unsolicited,' meaning the customer, not a broker, initiated them, undercutting the Trump Organization's claim that an independent outside advisor manages all investment decisions. The pattern raises questions about whether the president is using his office to boost personal holdings.
Federal disclosure rules require officials to report stock trades, but only in broad dollar ranges and with a delay. Trump has not placed his assets in a blind trust; instead they are in a trust managed by his son Donald Trump Jr., with no legal barrier to his involvement.
The nuclear-powered aircraft carrier USS Nimitz steamed into the Caribbean this week, a show of force as President Trump openly threatened to invade Cuba. The administration has not publicly detailed the casus belli, but the rhetoric marks a dramatic escalation in US-Cuba relations, which had been relatively stable in recent years. The Nimitz strike group includes destroyers and an air wing capable of launching strikes. Cuban officials called the threats 'an act of war' and warned of resistance. The deployment comes amid broader US military posturing in the region, including increased naval patrols. Analysts note that an invasion would face significant logistical and diplomatic hurdles, and could destabilize the Caribbean.
The US has not invaded Cuba since the failed Bay of Pigs operation in 1961. The Nimitz is one of the Navy's 11 aircraft carriers, each carrying around 5,000 personnel and 60+ aircraft.
The Trump administration resisted allowing two American doctors exposed to Ebola in the Democratic Republic of the Congo to return to the US for treatment and monitoring, according to five people close to the response. Surgeon Peter Stafford, 39, who tested positive for the virus, was evacuated to a hospital in Berlin. Another doctor, Patrick LaRochelle, who was exposed but asymptomatic, was sent to Prague. The White House denied refusing entry, calling the report 'absolutely false,' but CDC officials repeatedly dodged questions about why the Americans were not brought home. The US has multiple specialized biocontainment units capable of treating Ebola patients. The outbreak, caused by the rare Bundibugyo strain, has grown to 528 suspected cases and 132 deaths since it was confirmed on Friday, prompting the WHO to declare a public health emergency of international concern.
Ebola is a severe hemorrhagic fever with fatality rates up to 90%. Early treatment improves survival. The US has treated Ebola patients before, including during the 2014 West Africa outbreak, when several Americans were repatriated.
A study published in Nature on May 20 finds that the large-scale activity patterns of neurons across the mouse brain can be explained by a simple mathematical model: linear dynamics driven by a random symmetric matrix that is critically normalized. Researchers analyzed neural recordings and showed that the eigenvalue spectrum and temporal properties matched those of such a matrix, except in hippocampal area CA1, where activity resembled an efficient, uncorrelated code optimized for information storage. The model reproduces the power-law scaling of variance across neural modes observed in spontaneous brain activity. The findings suggest that biological neural networks may operate near a critical initialization point that confers computational advantages, analogous to careful weight initialization in artificial neural networks. The authors demonstrate that these dynamics can support zero-shot working memory tasks. The work bridges random matrix theory and neuroscience, offering a mechanistic explanation for emergent macroscopic coordination.
Random matrix theory has been used to study artificial neural network initialization; the 'semicircle law' describes eigenvalue distributions. This paper applies similar ideas to biological data, suggesting evolution may have tuned connectivity to a critical regime.
A photograph of a failed western blot experiment that resembled a panda's face sparked a wave of satirical academic journals among Chinese graduate students. The image, posted on RedNote in February, led a Beijing master's student to create Rubbish, a mock journal that 'welcomes unexplainable experiment results, anecdotes, and gossip.' Within 24 hours, the account gained nearly 10,000 followers. Soon, spin-offs appeared with names parodying real journals: Rubbish Communications, NoTrue, Silence, and Call. More than 200 such 'bottom journals' have been launched, tracked by a website called Web of Absurd that assigns them impact factors. The trend channels frustration over China's publish-or-perish culture and what many researchers call a credibility crisis. Submissions range from failed experiments to lab gossip, and the journals publish in both Chinese and English. Organizers say the humor provides a pressure valve for early-career scientists.
Chinese academia places heavy emphasis on publishing in high-impact international journals, which affects career advancement. The satirical journals echo earlier phenomena like the Journal of Irreproducible Results, but with a distinctly Chinese social-media twist.
Bard College's board of trustees voted in late April to end President Leon Botstein's 51-year tenure, contradicting his May 1 announcement that framed the departure as a voluntary retirement. The vote followed an independent investigation by law firm WilmerHale into Botstein's ties to convicted sex offender Jeffrey Epstein. Three trustees, including board chair James Cox Chambers, resigned in the weeks after the decision. Emails obtained by The Guardian show remaining trustees criticizing the vote as rushed and lacking a financial plan; one called it 'the end of our college as we know it.' Some trustees objected that WilmerHale lawyers stayed in the room during the vote, compromising the process. The student group Take Back Bard, which had pushed for Botstein's removal, said they were unsurprised. Botstein will stay on as a music professor.
Botstein became Bard's president in 1975 and transformed it into a prominent liberal arts college. His connection to Epstein, who donated to Bard, drew scrutiny after Epstein's 2019 arrest. The board commissioned an outside investigation in 2025.
Intuit, the maker of TurboTax and QuickBooks, will lay off 17% of its workforce, roughly 3,000 employees, to redirect resources toward artificial intelligence, according to an internal memo from CEO Sasan Goodarzi. The cuts aim to simplify the corporate structure and accelerate AI integration into its products. The layoffs are part of a broader tech industry trend: more than 100,000 jobs have been cut in 2026, with companies from Amazon to Meta citing AI refocusing as a reason. Intuit's shares have lagged the S&P 500 over the past year as investors question whether traditional software firms can keep pace with AI-native competitors. The company reported $4.65 billion in revenue and $693 million in net profit for its fiscal second quarter, up 17% and 48% respectively. Goodarzi's compensation totaled $36.8 million last year.
Intuit employs 18,200 people worldwide. The 'AI pivot' narrative has become common among tech firms reporting strong profits while cutting staff, raising questions about whether AI is a genuine strategy or a cover for cost-cutting.
Google inadvertently published working exploit code for a vulnerability in the Chromium browser engine that remains unpatched after 29 months. The flaw, discovered by independent researcher Lyra Rebane and reported in late 2022, exploits the Browser Fetch API to create a persistent service worker that can monitor user activity, proxy traffic, and enlist the device into a botnet for denial-of-service attacks. The vulnerability affects Chrome, Microsoft Edge, and virtually all Chromium-based browsers. Google posted the proof-of-concept to its public bug tracker on Wednesday, apparently believing a fix had been shipped; the company removed it after realizing the patch was not yet deployed, but the code persists on archival sites. Rebane said the long delay stemmed from the vulnerability not crossing defined security boundaries, which may have caused developers to deprioritize it. The bug was rated S1, the second-highest severity.
Chromium is the open-source browser project that underpins Chrome, Edge, Brave, and many others. The Browser Fetch API allows background downloads of large files. Service workers can run even after the browser is closed, making the exploit persistent.
SpaceX postponed the debut test flight of Starship V3, the tallest and most powerful version of the rocket at 407 feet, to the evening of May 21. The launch was originally set for May 16, the same day a contractor died in a fall at the company's Starbase facility in Texas; OSHA has opened an investigation. SpaceX has not said whether the delay is related to the fatality. The suborbital flight will test the new hardware's performance; most previous Starship tests ended in explosions, though the last two succeeded. The test is critical for NASA's plans to use Starship to land astronauts on the moon by 2028, and its outcome could influence SpaceX's anticipated IPO, which may value the company at $1.75 trillion. The launch window opens at 6:30 p.m. EDT, with a livestream on SpaceX's website.
Starship is a fully reusable super-heavy-lift rocket designed to carry over 100 metric tons to orbit. V3 is the third major iteration. SpaceX has conducted 11 test flights, with the first successful landing only in 2025. The company also operates the Starlink satellite internet constellation.
