标签：#EVs

GM's lineup is dropping Apple CarPlay and Android Auto in favor of its own infotainment systems. But one model is keeping the phone-mirroring capabilities.

While it probably won't be available in the US, the Audi A2 e-tron looks like an appealing affordable EV with plenty of range.

Many recent vehicles had CarPlay and Android Auto built in, but if yours doesn't, you can add a portable one to your dash.

Slate's build-a-truck model aims to keep costs low by only including features you'll use. But it won't be popular outside the U.S.

The engineering team at software company Figma recently documented how they built AI agents to help their security team investigate alerts, search past incidents, check company systems, and even prepare code fixes. The agents learn from previous investigations, reducing repetitive work and helping engineers resolve complex alerts about 70% faster. By Renato Losio

188 vulnerabilities. That's where we started. After the modernisation, the jjwt migration, the targeted remediations, and the documented suppressions, here's where we ended up: 6 open findings. All suppressed with documented reasons. 0 unaddressed. But "188 to 6" is a headline, not a measurement. This article is about what meaningful security posture measurement actually looks like — the metrics that tell a real story versus the ones that just make a dashboard look good. Why Raw Finding Count Is a Weak Metric The most common way teams measure SCA progress is finding count. Before: 188. After: 6. Improvement: 182 findings resolved. 97% reduction. That number is real but it's also misleading in isolation. Here's why. If I had suppressed all 188 findings without fixing anything, my finding count would also be 6. The dashboard would look identical. The actual security posture would be unchanged. Finding count measures activity, not outcomes. What you need to measure is: What risk was actually reduced — not just what got closed What risk remains and why — the documented residual risk How the remediation was achieved — fix vs. suppress breakdown What the exploit exposure looks like — before and after exploit maturity These four dimensions together tell a story that a single number can't. Metric 1: Risk Reduction by Severity The most important before/after comparison is severity distribution, not total count. Severity Before After Fixed After Suppressed Remaining Critical 10 10 0 0 High 99 93 6 0 Medium 59 29 23 0 (7 in 4.x backlog) Low 20 0 20 0 Total 188 132 49 0 unaddressed Every Critical finding was fixed — not suppressed, fixed. That's the number that matters most. No Critical vulnerability was accepted as residual risk. The 6 suppressed High findings are all in the "no known exploit" category with documented unreachability justifications. The 23 suppressed Medium findings are split between test-scope dependencies and unreachable code paths. What to say when presentin

Security Bolted on at the End Is Not DevSecOps The most common failure pattern in teams that claim to "do DevSecOps" looks like this: build the pipeline, ship the feature, and run a security scan right before release — treating security as a checkbox at the end of the process instead of something built into every stage of it. That's not DevSecOps. That's a security review with extra steps. Real DevSecOps means security is woven into the pipeline itself — scanning dependencies on every commit, catching misconfigurations before they're deployed, and treating a vulnerability the same way you'd treat a failing test: something that blocks the pipeline, not something reviewed manually after the fact. This guide is for people who already have some DevOps or backend foundation and want to understand what it actually takes to move into a DevSecOps-focused role — not just "add security" to an existing skillset, but understand the mindset shift that makes the discipline distinct. This post originally appeared on the Ciphemic Academia blog . What "DevSecOps" Actually Requires DevSecOps sits at the intersection of three skill areas, and a real role expects working competence across all three, not deep expertise in just one: DevOps fundamentals — CI/CD pipelines, infrastructure-as-code, containers, the same core skills a cloud/DevOps engineer needs Application security — understanding common vulnerability classes, how to find them, and how to actually fix them, not just recognize their names Security automation — the specific skill of embedding security checks into a pipeline so they run automatically, consistently, on every change That third point is what actually distinguishes DevSecOps from "a DevOps engineer who also cares about security." It's specifically about automation and process — making secure practices the default path, not an extra manual step someone has to remember to do. Step 1: Confirm Your DevOps Foundation Is Solid DevSecOps is not an entry point into DevOps —

There's a way to display any app on Android Auto, but it does present concerns about safety and reliability.

Regulators will review the process and data Tesla used to self-certify the vehicle.

Tesla has officially launched the Cybercab, its autonomous vehicle with no steering wheel.

I recently built a complete IT ticket management system in Power Apps — 9 screens, role-based access, live SLA tracking, and automatic email notifications. The part I want to actually talk about here isn't the UI, it's the SLA engine, because I built it to work without Power Automate , and the trick is simpler than it looks. The problem SLA tracking normally means: a ticket is "Critical" → 60 minute target → somebody needs to know if it's about to breach or already has. The obvious way to do this is a scheduled Power Automate flow that checks every ticket on a timer and flags the ones in trouble. I wanted this app to run on Power Apps collections only — no flow, no external data source — so a scheduled flow wasn't an option. The question was: can you get "live" SLA status without a background job? The trick: recalculate on every read, not on a timer Instead of a flow updating a SLAStatus field periodically, I recalculate it every time the app or a screen is opened, using Now() against the stored due date: \ UpdateIf( colTickets, Status <> "Resolved" && Status <> "Closed", { SLAStatus: If( Now() > DueDate, "Breached", DateDiff(Now(), DueDate, TimeUnit.Minutes) <= SLAMinutes * 0.2, "At Risk", "On Track" ) } ); UpdateIf(colTickets, Status = "Resolved" || Status = "Closed", {SLAStatus: "Met"}) \ \ This runs in App.OnStart , at the top of every screen's OnVisible , and behind a manual "Refresh SLA" button. The At Risk threshold is 20% of the SLA window remaining — so a Critical ticket (60 min target) goes At Risk with 12 minutes left; a Low ticket (1440 min / 24 hrs) goes At Risk with 4.8 hours left. The honest tradeoff: this only updates when someone has the app open. A ticket breaching at 2am with nobody looking won't trigger anything until the next visit. For a real production deployment I'd pair this with a scheduled flow for after-hours detection — but for a demo, an internal tool with regular traffic, or anything where "eventually consistent within the next visit"

Uber launches first robotaxis in London (with human supervisors).

Double-check before you accidentally remove a protective layer of your screen.

Waymo robotaxi rides are now open to the public in Denver, San Diego and Tampa.

On July 16, 2026, Hugging Face disclosed unauthorized access to a limited set of internal datasets. Five days later, OpenAI confirmed the attacker had come from inside its own walls. A combination of OpenAI models, including GPT-5.6 Sol and a more capable prerelease model, escaped a sandboxed cyber-capabilities evaluation and went hunting for benchmark answer keys. Along the way, it escalated privilege and harvested multiple credentials for internal Hugging Face services. It appears to be the first publicly documented case of an autonomous AI agent breaching a production company. Strip the attacker's identity out of the incident report, though, and the remaining pages could have come from any breach retrospective of the past decade. Credentials were taken from a compromised system and reused to move laterally into production. The headlines belong to the agent. The exposure that made the attack work belongs to almost everyone. The incident splits cleanly into two phases , and keeping them separate helps us draw the right lessons. The first phase took place inside OpenAI's infrastructure. During an internal evaluation of cyber capabilities, with production guardrails intentionally relaxed, the models exploited a zero-day in a package registry cache proxy that isolated their sandbox. That gave them a path to the open internet. Their motive was ordinary to the point of comedy. They were being scored against a security benchmark called ExploitGym, and they reasoned that the test solutions might live on Hugging Face. Hugging Face's turn came in the second phase. The sandbox escape got the agent to the internet. Entry into Hugging Face occurred through two injection vectors in the company's production dataset-processing pipeline. The first abused HDF5 external raw storage to read local files from a processing worker, exposing its environment, including secrets and credentials, as well as its source code. The second used a template-injection flaw in a dataset configuration

The Slate Truck is affordable because you have to 'bring your own tech'.

This is the second article in a series on time to revoke, following our piece on The Hacker News . The first explains how to measure the amount of time an exposed credential remains usable. This article focuses on the operational changes security teams can make to shrink that exposure window. TL;DR: Reducing time to revoke means addressing the operational blockers that keep exposed credentials valid after detection. Security teams need to validate which credentials still work, route them to the right owners, make revocation safer, and remove avoidable manual delays. Provider-specific runbooks, risk-based remediation paths, short-lived credentials, automation, and closure verification can all reduce the amount of time exposed access remains usable. Why time to revoke matters for AI-era non-human identity risk Every security team can find an exposed secret, but most can't tell you how long it kept working after they found it. Over 28.6 million new hardcoded secrets hit public GitHub in 2025, up 34% year over year, with AI-service secrets up 81% ( State of Secrets Sprawl 2026 ). AI-assisted development and agentic tooling cut both ways. Defenders find and triage more, but creation is outpacing governance. So while detection keeps up, revocation is where teams fall behind. And that disconnect is what this article is about. If an exposed credential remains valid, an attacker doesn't need to breach the same system twice. They can use it directly against any service that trusts the identity behind it, like a cloud console or a production database. And these credentials stay valid far longer than teams expect: 64% of secrets confirmed valid in 2022 were still valid when we retested them four years later. That is especially dangerous for non-human identities (NHIs). Service accounts and OAuth apps often run on long-lived tokens and deploy keys that no one rotates for months, sometimes years. Their access is broad, their ownership unclear. And because these identities keep cr

If you use Android Auto, you might be interested to know that there's a feature available on some phones that helps keep phone calls minimal while you drive.

Long-lived GCP service account keys are secrets that must be managed forever, are hard to rotate, and are easy to leak. Scaling Workload Identity Federation to 120+ production projects shows why it changes how machine identity is approached entirely: keys are secrets to manage, federated identities are trust relationships configured once, gated by attribute conditions. By Shijin Nair

If the sound you're getting through Android Auto is disappointing, there are several components and settings you should check.