News story: “Scientists discover a bizarre Jurassic ‘squid’ unlike anything ever seen.”

Scientists have identified the “fattest” belemnite ever discovered, a bizarre, barrel-shaped squid relative that lived in Wyoming’s ancient seas 160 million years ago. The exceptionally rare fossils reveal a creature unlike anything previously known, potentially a predator of smaller squid-like animals and a surprising survivor of a supposedly vanished family.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

This is fascinating:

The video describes a technique that can reveal where an otherwise unidentifiable recording was made by analyzing its audio for the faint sounds of passing aircraft. The technique is both fascinating and frightening.

It works by looking at Doppler curves, which plot the way a plane’s sound changes as it passes overhead because of the Doppler effect. This is the same familiar Doppler effect that causes the frequency of a siren to rise as it approaches and then fall as it passes by and moves away. More generally, it’s the phenomenon whereby the frequency of a wave perceived by an observer changes when the observer and the source of the wave are moving in relation to one another.

[…]

It’s sound that’s relevant here, though, and specifically the sound of aeroplanes. Early in his video, Colsto brings up a map of the flights that were in the air at the time the video he’s tracing was recorded. Much of this information is publicly available. Aircraft equipped with Automatic Dependent Surveillance–Broadcast (ADS-B) transmit data about their position, velocity, and altitude, which flight-tracking services collect and make available to the public. While not every plane is tracked, the system provides an enormous amount of information about aircraft movements.

Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published. Become a member and support our work here.

In September, CBS News obtained new images of the aftermath of attacks on US bases in the Middle East from active service members. One told the news channel: “This is major damage to our bases that hasn’t been communicated to the American public. “We’re standing there with our eyes closed getting punched in the face,” they added.

While reports have detailed how Iran used Russian intelligence, including satellite imagery, to identify US troops, ships and aircraft, Bellingcat found that publicly available mapping platforms also reveal detailed and potentially sensitive information about US military bases in the Middle East. 

Google Maps and other online mapping services contain dozens of labels identifying facilities including headquarters, accommodation, gyms and fuel points. Publicly available photographs and videos, including material published by the US military, provide further details about how these facilities are used.

Experts told Bellingcat that such information could have helped inform Iranian targeting decisions by revealing where personnel gather and how bases operate. However, they cautioned that Iran would also have had access to other sources of intelligence. Reporting from Reuters earlier this year also highlighted how US officials believed commercially available location data was being used to target US troops in war zones.

The bases examined by Bellingcat are not secret and have operated for years in a region where US forces maintained a strong sense of security. Joseph Jarnecki, a research fellow at the Royal United Services Institute, said the US had been able to maintain aerial superiority and was understood to have significant air defence capabilities, but that Iran’s missile and drone campaign has undermined both assumptions. 

Iranian strikes have damaged at least 20 US military sites across Qatar, Bahrain, the United Arab Emirates (UAE), Jordan, Kuwait, Iraq and Saudi Arabia since the conflict began in February this year.

Governments can request that Google blur or remove sensitive information from its services and Google publishes data on government requests for content removal.

Bellingcat contacted the US Department of Defense who asked us to reach out to CENTCOM about the details in this story. We also contacted Google. However, we did not receive responses to questions from these respondents before publication.

We examined four of the largest and most heavily affected US military installations by Iran’s missile and drone campaign: Camp Buehring and Camp Arifjan in Kuwait, Muwaffaq Salti Air Base in Jordan and Al Udeid Air Base in Qatar. At each one, we found publicly available Google Maps information providing details about facilities inside the bases and how they are used.

Camp Buehring

At Camp Buehring in Kuwait, Google Maps identifies what is labelled as the main headquarters building, as well as a gym and a self-help facility, all of which were among locations destroyed by recent Iranian strikes. In addition to Google Maps place markers there are dozens of reviews and user-uploaded photographs.

Bellingcat verified that this was a headquarters building by matching the flagpoles and layout in a photo published by the US military’s Defense Visual Information Distribution Service (DVIDS) showing soldiers posing in front of the  building to the Google Maps satellite image.

We also identified details about one of the camp’s gyms, including the building’s layout and roof structure, as well as Google reviews that indicate when it is busiest.

Among the images published by CBS News in September was that of a heavily damaged tent-like structure with smoke rising from it. Bellingcat matched the location of this image to the above satellite imagery, verifying that it shows the gym building pinned on Google Maps.

Exclusive images released showing damage to E-3 Sentry AWACS aircraft at Prince Sultan Air Base in Saudi Arabia, plus damage to US military camps Arifjan and Buehring in Kuwait from Iranian strikes. Images sent to CBS by active US military personnel. (IRIB News) https://t.co/1urA44f4xz

— Middle East Observer (@ME_Observer_) September 15, 2026

A building labeled on Google as “DPW Self-Help Center” was also destroyed at Camp Buehring. Its Google Maps listing includes opening hours, and a photo posted by a Master Sergeant in 2017 labeled “My office in Kuwait” shows the interior of an office. Some of the notices on the walls inside the office are legible, including what appears to be a floor plan.

A Google Maps placemark labelled “Transient Tent” identifies a large accommodation area, while another review includes a ground-level photograph of one of the tents. The dining facility can also be seen from the inside, including information regarding meal times.

William Goodhind of Contested Ground, a visual forensics consultancy that uses OSINT and satellite imagery to analyse military sites, said the information available on Google Maps could reveal “the camp’s layout, the division between secure and non-secure areas, confirms likely accommodation areas, and shows day/time periods of low and high activity.”

Camp Arifjan

A satellite image of Kuwait’s Camp Arifjan, captured by Planet on March 4, 2026 and published by the The Washington Post, shows damage to numerous structures at the base. Bellingcat compared the image with publicly available mapping data to identify two damaged facilities.

View this post on Instagram

A post shared by Media Trending (@tmctrending)

A Google Maps listing for a lodging facility labelled “TPE FOR ARIFJAN” includes a soldier’s review discussing room reservations, accommodation shortages and cleaning schedules, indicating that the building was used for military housing. Although Google’s satellite imagery of the base is blurred, the facility is visible in unblurred Bing Maps imagery using coordinates obtained from its Google Maps listing. The satellite image published by The Washington Post shows heavy damage to the facility.

A “24hr Fuel Point” tagged on Google Maps is also blurred, but when the coordinates are copied and pasted into Bing Maps a clear satellite image of the fuel station appears. This facility is also seen destroyed on the satellite imagery published by The Washington Post.

Bellingcat contacted Microsoft to ask why the facility was not blurred out in the Bing Maps service. A spokesperson said: “When an entity requests removal from visibility on Bing Maps, we work through our process and act accordingly.”

Muwaffaq Salti Air Base

Three US service members were killed in Iranian ballistic missile strikes on Muwaffaq Salti Air Base in Jordan on July 17, 2026. The strikes appear to have caused extensive damage to a barracks in the north of the base, with satellite imagery released by Iran showing at least 20 structures destroyed.

Less than 40 metres from the nearest destroyed structure, and within the same living quarters area, Google Maps reveals the location of an “Airman’s Attic”. These are volunteer-run thrift shops for US Air Force personnel. 

A five-star review posted last year by a soldier includes a ground-level image of the facility, showing uniform drop-off points and fortifications along the perimeter. The listing provides information about the area’s use, while photographs of the shop’s exterior make it possible to match the satellite imagery to the location on the ground.

A Sky News investigation also found that 80 percent of the runs shared publicly on the sporting app Strava at Muwaffaq Salti Air Base during the April ceasefire started or finished in this northern barracks.

Less than 100 meters from the destroyed area, “LSA DFAC” is pinned on Google maps. “DFAC” is the standard US military acronym for “dining facility”, according to Stars and Stripes. Several Google reviews also discuss the steak being served in this location.

Al Udeid Air Base

Similar mapping information is available for Al Udeid Air Base in Qatar, the largest US military installation in the Middle East. 

The base appears unblurred on Google Maps and entries on the platform identify the functions of numerous buildings. These include lodging facilities, which videos and reviews indicate are used by US Air Force crews and show the interior layout of the facility.

Meanwhile, Russia’s Yandex Maps details the site of two cinemas, a bar and a school on the base. This appears to match information provided on Google Maps.

While Al Udeid Air Base was damaged during Iranian attacks earlier this year, the areas that were struck do not appear to be among those listed on Google. 

Business Insider reported that a geodesic dome that housed secure communications equipment was hit in the strikes. ABC News detailed how another building had been damaged near the centre of the base. Google Maps shows a large warehouse-like structure at the location where ABC News reported this strike.

A New Reality in the Middle East

Former US Air Force targeting specialist Wes J. Bryant said the problem facing US bases in the Middle East reflected a broader assumption within the military that bases in allied countries were safe from serious attack. He said the belief that these were rear-area bases where “nothing’s going to happen out here” was a fundamental miscalculation, and that the Google Maps issue was an example of the military failing to account for that vulnerability.

Matthew Savill, Director of Military Sciences at the Royal United Services Institute, said Western militaries do not have consistent policies governing what information can be publicly posted about sensitive sites. He said the issue needs to be considered before a conflict begins, rather than when attacks are already underway. “The start point should be, can we enforce operational security discipline?” Savill pointed to restrictions already in place at some UK military facilities, including Faslane, a naval base that houses the UK’s nuclear submarines, where he said personnel are not permitted to use mobile phones on site.

Savill told Bellingcat that the different pieces of data available on Google Maps, even if outdated, provided a “pattern of life” about US bases in the Middle East. But he added that the use of Google to help with the military targeting of Western bases is not new, saying he encountered the issue while deployed to Iraq more than 20 years ago.

“When I was in Iraq, we knew for a fact that insurgents and militants had been using commercial imagery, including Google Earth, to try and map our bases,” he said. “We have known for more than 20 years that there is a vulnerability that if you don’t stop the collection and layering of data early on, that your bases can be heavily mapped.” 

The use of open-source information to support military targeting has been documented in Ukraine. In 2022, Foreign Policy detailed how Ukrainian private intelligence company Molfar used photographs of Russian soldiers published by Russian media alongside Google Earth satellite imagery to identify their location. Molfar passed its findings to Ukrainian intelligence, and the site was subsequently struck by the Ukrainian military.

The security risks of publicly mapping military installations were recognised by the US military in 2008, when the Pentagon banned Google’s Street View from documenting the interiors of its bases. Since the Iran war started, US military commanders have also warned service members about posting photographs and videos from bases after Iranian attacks, cautioning that such footage could help Iran assess the effects of its strikes.

Iranian attacks have forced US personnel to evacuate many additional locations that were deemed too vulnerable to further strikes. 

In total, 23 US service members have been killed and 865 wounded in the US-Iran war, according to the Pentagon.

Bellingcat’s Jake Godin, Charlotte Maher and Merel Zoet contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post How Online Maps Lay Bare the US Military Bases Targeted by Iran appeared first on bellingcat.

Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016.

The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period.

The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into “free” mobile and desktop applications. Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016.

Synthient’s depiction of the outgoing proxy traffic from the dedicated White House network (AS2650). Click to enlarge.

There are dozens of residential proxy providers with varying degrees of legitimacy, many of them based in China or Russia. But at a minimum, they all make it simple for customers to rent someone else’s internet address as a way to anonymize their web traffic or spoof their true location. From a website’s perspective, the traffic from a proxy network user appears to originate from the rented IP address, not from the proxy service customer.

Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight.

Incredibly, Infatica was not the only proxy service that reportedly has been reselling access to White House internet addresses: Layer3 Intel said it found 28 separate residential proxy services were able to exit through this network.

“This is public access,” the Layer3 Intel team wrote. “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services.”

The White House did not immediately respond to a request for comment.

As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover and other cybercrime activity, advertising fraud, and mass content scraping for AI projects.

They can also introduce serious security risks. In late 2025, it was discovered that cybercriminals were mass exploiting a widespread vulnerability in these services that allowed them to probe each proxy endpoint’s local network for vulnerable systems to infect with malware. In January 2026, dozens of proxy services were forced to patch their networks after Synthient Founder Ben Brundage showed how cybercriminals were abusing a vulnerability in these residential proxy services to seize control over devices inside the local networks of unsuspecting users.

“Some of these resellers sell bandwidth for as low as 60 cents a Gigabyte, that means for less than a dollar you can gain access into some of the most confidential and trusted networks,” Brundage told KrebsOnSecurity. “The reseller ecosystem further enables this with any criminal able to buy access while skipping KYC [Know Your Customer] processes.”

All too often, these proxy services are beaconing out from employee devices brought into the workplace. App developers can embed software development kits (SDKs) provided by the residential proxy networks to monetize their software, allowing them to receive a small amount of money on each installation.

As risky as residential proxies can be for unsuspecting end users, they are all too commonly found on government and corporate networks. In a webinar in January 2026, the proxy tracking service Spur found residential proxies in nearly 300 government owned and operated networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 companies in banking and finance. In a blog post earlier this year, the security firm Infoblox said it discovered that fully 65% of its customer base was querying one or more residential proxy related domains.

What Happened

• In late July 2026, Beacon CRM, a UK-based customer relationship management platform serving over 1,500 non-profit and charitable organisations, suffered a major supply chain cyber incident that resulted in the unauthorised exfiltration of its database backups.
• The compromise began around 27 July 2026, when the unknown attackers gained initial access by leveraging an AWS access key that was inadvertently exposed in publicly accessible JavaScript build artifacts.
• Over a two-day period of 27–28 July, the attacker used these credentials to download full database backups containing records from over 1,000 UK charity customers.
• Beacon CRM detected the unauthorised activity on 29 July, revoked the exposed credentials, and began notifying affected organisations between 30 July and 3 August. Public announcements and regulatory notifications followed, including press releases from the UK Charity Commission.
• While payment card numbers and live bank details were not stored within the affected Beacon CRM database, exported backups included names, email addresses, phone numbers, home addresses, donation histories, and uploaded attachments (including Gift Aid declarations and user notes).
• Several charities noted that historical records and data previously requested for deletion were retained within stored system backups, exposing older records belonging to past donors and service users.

Analyst Comment

The Beacon CRM incident highlights the severe operational and reputational leverage inherent to single-point SaaS vendor dependencies in the non-profit sector. Non-profits heavily lean on SaaS providers due to resource constraints. When a centralised vendor suffers a credential breach, it creates a cascading effect across hundreds of downstream organisations that lack dedicated in-house cybersecurity teams.

Hardcoded and leaked API credentials, such as AWS access keys in this case, via client-facing build files remains a high-impact, easily preventable vulnerability class. Static secret-scanning tools and secrets management solutions should prevent raw production keys from ever reaching public JavaScript deployment packages. Unfortunately, this attack vector continues to be effective as other organisations such as Arup Group and Manchester Airports Group were also targeted by FulcrumSec using the same method.

While direct financial theft via credit cards was avoided, the exfiltrated dataset (names, donation history, Gift Aid details, home addresses) provides ideal conditions for social engineering, phishing, and targeted identity fraud directed at donors and vulnerable service users.

Defensive Takeaways

• Automate Secret Scanning in CI/CD Pipelines: Implement continuous integration (CI) repository scanners (such as GitGuardian, Trufflehog, or AWS Secrets Manager tools) to detect and block access keys, API tokens, and secret strings before deployment to build artifacts.
• Strict Identity & Access Management (IAM) Scoping: Restrict AWS keys using least-privilege principles. Access keys utilised by application or build layers should never have global or elevated permissions allowing direct read/export access to full infrastructure backups or AWS S3 buckets containing raw database snapshots.
• Third-Party SaaS Incident Response Planning: This case highlights the importance of maintaining up-to-date inventories of third-party processors and sensitive data classifications. Ensure contractual SLAs specify rapid incident notification timelines, and maintain actionable response plans to satisfy the UK ICO's 72-hour reporting rule upon vendor disclosure.
• Credential Rotation & Session Invalidation: Immediately rotate integrated API keys, webhooks, and Single Sign-On (SSO) tokens connected to third-party software platforms following an upstream compromise notification.

Relevant Sources

1. Beacon Incident Final Report: https://cdn.prod.website-files.com/6369f7fe243b240624080be7/6a99303116408f423ae78fe2_200e7238def89b6f82b7a023e5adb7b8_Beacon%20Cyber%20Security%20Incident%20Final%20Report%20-%20September%202026.pdf
2. https://www.gov.uk/government/news/guidance-for-charities-affected-by-the-beacon-cyber-security-incident
3. https://www.theregister.com/security/2026/08/05/uk-charities-count-the-cost-of-beacon-crm-cyberattack/5283305
4. https://www.theregister.com/security/2026/08/13/aws-key-exposed-in-javascript-may-have-lit-way-to-beacons-charity-data/5287303

In both a 2021 essay and my 2022 book, A Hacker’s Mind, I talk about AIs finding vulnerabilities and exploits—hacking—the legal system.

Here’s some demonstrations of this from Germany:

Legal systems encode the foundations of social order in natural language. Similar to computer systems, the written law can contain vulnerabilities that invite exploitation.1 Courts absorb most exploits through interpretation, and such vulnerabilities rarely surface in the first place. With highly capable AI systems enabling the discovery of vulnerabilities at unprecedented scale, we believe the latter could change.

In testing this hypothesis, we have identified a substantial number of vulnerabilities in the German legal system using LLMs. To our knowledge, none of these have been previously recorded. We share a selection of vulnerabilities below, and present potential exploits for each. We share only those vulnerabilities whose exploitation we believe would not cause serious harm.

We believe that with cheap legal reasoning proliferating, AI systems could jeopardize the functioning of today’s legal systems. In such a world, lawmakers would need to significantly harden the process of legislation, for example by leveraging advanced AI themselves.

Still in its early stages, but definitely something that’s coming.

Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published. Become a member and support our work here.

An online ad for Ben McAdams, the Democratic candidate for Congress in Utah, emphasised that he could be trusted because he “fought back against MAGA”.

In Texas, another ad promoted Republican candidate Chris Gober, calling him a “MAGA warrior”.

What’s interesting is that both ads were ultimately paid for with money from the same organisation – Leading the Future (LTF), a Super PAC which opposes regulations that “constrain” innovation in AI. The network has received US$125 million in funding in total from OpenAI president Greg Brockman, his wife Anna Brockman, tech-focused venture capital firm Andreessen Horowitz (a16z) and a16z’s founders, Federal Election Commission (FEC) filings show. 

Directly opposing LTF is Public First Action (PFA), which calls for AI safety regulations and guardrails. PFA has received $40 million in funding from AI company Anthropic. 

Like the ads run by organisations funded by LTF, the Super PACs funded by PFA also ran ads that appeared supportive or critical of Trump depending on the voters they were targeting. 

None of these ads mentions AI.

As the US 2026 midterm elections approach on Nov. 3, Super PAC spending on political advertising has reportedly soared to record highs, surpassing US$11 billion last week and exceeding the amount spent on any other election cycle to date. 

Super PACs are a particular type of political action committee (PAC) that may receive unlimited contributions from individuals, corporations, labour unions and other PACs for the purpose of financing independent expenditures and other independent political activity.

In this year’s elections, LTF’s and PFA’s Super PACs, funded by the AI industry heavyweights, have played an outsized role in supporting or opposing candidates through advertising. But as polls show distrust of AI crosses party lines, the advertisements that Silicon Valley’s leaders are paying millions of dollars to try to sway the results in their chosen candidates’ favour often do not mention AI at all. 

While LTF is a registered Super PAC itself, FEC filings show it mainly disburses money to other Super PACs in its network which run political ads. 

Of about $52 million that LTF has disbursed to date, $20 million went to Think Big, which targets the Democratic voter base, and another $20 million went to American Mission, which focuses on Republicans. 

PFA, meanwhile, is registered as a “social welfare”, or 501(c)(4), organisation. This type of non-profit is not required to disclose its donors or disbursements. However, PFA contributes funds to three Super PACs: the bipartisan Public First PAC, Jobs and Democracy for Democratic candidates and Defending Our Values for Republicans. FEC filings for these Super PACs show Public First PAC received $1 million, Jobs and Democracy received $15.4 million and Defending Our Values received $7.9 million from PFA. Public First PAC’s FEC filings also show that $4 million of its $4.4 million in disbursements disclosed so far went to Jobs and Democracy, while another $300,000 went to Defending Our Values. 

Super PACs are allowed to accept unlimited contributions from other political committees, and other similar networks of Super PACs have been observed in the current election cycle, such as cryptocurrency-linked Fairshake and its affiliated Super PACs.

Bellingcat analysed data on more than 300 online video ad campaigns paid for by Think Big, American Mission, Jobs and Democracy and Defending Our Values from Google’s Ad Transparency Center. These ad campaigns, many of which used the same videos in slightly different formats or across different platforms, supported or opposed 40 candidates. 

Only ads supporting or opposing two candidates mentioned AI, and none mentioned data centres, a top issue this election cycle. A New York Times analysis of 95 video ads paid for by the same four Super PACs, using data gathered by media tracking firm AdImpact, had similar findings. FEC rules state that Super PACs can spend money to support or oppose a candidate, but cannot coordinate with the candidate or their campaign on this. There is no evidence that any of the candidates or campaigns for which the Super PACs ran ads have coordinated with them.

Michael Beckel, Director of Money in Politics Reform at cross-partisan political reform group Issue One, told Bellingcat that voters are at a disadvantage when special interests fund Super PACs running ads that don’t mention the priority issues of those underwriting them. 

“Special interests seem keen on moving voters with messaging around hot-button issues, all while advancing a specific policy agenda that viewers of ads are kept in the dark about,” he said. The result of this, Beckel added, was that “the industry gains a stronger hand in Washington, while voters get little chance to judge the agenda their votes could help advance”. 

A representative for PFA stated: “We endorse officials who support regulating AI. The aligned PACs run ads on the issues that matter most immediately to voters in each race, and for most electorates right now that means the economy, affordability, public safety, and other issues that they are facing on a daily basis.” 

Jobs and Democracy, Defending Our Values, LTF, Think Big and American Mission did not respond to questions about their political advertising as of publication. 

A recent survey by think tank Data for Action and non-profit Guardrails Action found that about three-quarters of likely voters would be less inclined to vote for a candidate if they found out they had accepted a donation from an AI Super PAC. 

The ads distributed by the AI-backed Super PACs supporting or opposing 29 candidates mentioned economic issues such as taxes, the cost of living, consumer rights and local jobs or small businesses. Another 16 mentioned immigration or law enforcement and 17 mentioned US President Donald Trump or his “Make America Great Again” (MAGA) movement. 

Like the ads mentioning Trump, those on immigration were sharply divided in messaging depending on whether they were targeting Democratic or Republican voters, even when they were paid for by the AI Super PACs in the same network. 

LTF’s Think Big sponsored an ad for Democratic candidate Jeremy Moss in Michigan that talks about how he stood up to Immigration and Customs Enforcement (ICE), while American Mission’s ad for Republican Clay Fuller in Georgia mentions how he is focused on securing the southern border. 

We found similar messaging in ads mentioning immigration that were paid for by Super PACs in PFA’s network. Defending Our Values ran an ad in support of Republican John Cowan in Georgia emphasising that he will combat illegal immigration, whereas Jobs and Democracy’s ad for Democrat Valerie Foushee in North Carolina said she was “leading the fight to hold ICE accountable”.

For the ads that did mention AI, almost all were in support of Alex Bores’ primary in New York. PFA’s Jobs and Democracy PAC ran 152 ads supporting Bores’ candidacy, at least some of which mentioned that he was in favour of safeguards on AI and holding Big Tech accountable. 

LTF’s Think Big, on the other hand, ran 22 ads opposing Bores’ candidacy. While they did not mention his stance on AI, many of Think Big’s ads focused on him receiving funding from Anthropic, “dark money Super PACs” and his former employer Palantir, the software giant whose technology, including a new AI system, is used in ICE’s immigration enforcement operations. 

Jobs and Democracy’s advertiser page also showed two ads for Josh Gottheimer in New Jersey that focused on the threats of AI scams and AI-generated media, urging voters to call Gottheimer to tell him to “stand strong for AI safeguards”. 

Major donors to LTF that Bellingcat reached out to – Greg Brockman, a16z, and a16z founders Marc Andreessen and Ben Horowitz – did not respond to requests for comment on their funding to the Super PACs as of publication. We could not find any publicly available contact information for Anna Brockman, but we also asked about her contributions to LTF in questions to her husband.

Related articles by Bellingcat

Guides

What Meta’s Ad Library Shows About Harris and Trump’s Campaigns on Facebook and Instagram

OpenAI did not respond to questions about the Brockmans’ contributions to LTF as of publication. However, the company published a statement on the topic in June, which said “OpenAI does not direct the activities of LTF, or have visibility into their operations” and that “any engagement with that organisation has been in a personal capacity, not on behalf of the company”. 

PFA’s main public donor, Anthropic, did not respond to Bellingcat’s queries about its funding for PFA and PFA’s political advertising as of publication. It said in a statement on its website in July that its donations to PFA were “to help promote policies that will maintain meaningful safeguards, sustain America’s AI leadership, and demand transparency from the companies building the most powerful AI models”.

Unknown Vendors

Federal campaign finance laws require federal political committees to file periodic campaign finance reports disclosing their receipts and disbursements. 

Our analysis of FEC filings for LTF and the Super PACs in its network revealed that they were channelling more than $36.4 million in total towards four companies that were newly set up, with no apparent online presence outside of these filings. 

A complaint to the FEC by the non-profit Campaign Legal Center (CLC) in May cited American Mission and Think Big’s payments to Summit Ridge and Lantern Productions, alleging that the Super PACs had “unlawfully evaded federal reporting requirements by funnelling their payments for goods and services through shell companies set up to conceal how the super PACs are actually spending their money”. The FEC has not yet ruled on the complaint. LTF, American and Think Big did not respond to Bellingcat’s queries about the complaint as of publication.

FEC filings show that LTF paid a company called Prusik Partners LLC more than $966,000 for operational expenditures for a range of services including communications and strategy consulting, as well as legal fees. 

The network’s Democrat-focused Super PAC, Think Big, paid a company called Lantern Production Consultants LLC more than $20 million, based on filings for disbursements from Aug. 20, 2025 to Oct. 14, 2026. 

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

The payments included $3.17 million for operational expenditures for a range of services such as media consulting and research, and another $17 million for independent expenditures. The FEC defines an independent expenditure as one that pays for “a communication that expressly advocates for the election or defeat of a clearly identified candidate”. The highest independent expenditures paid to Lantern ($8 million) were to oppose Bores’ candidacy, the filings show.

Think Big also declared in its filings that it had paid a company called Blue Horizon Compliance Consultants LLC almost $55,700 for “compliance consulting”. 

Republican-focused American Mission, on the other hand, paid a company called Summit Ridge Media LLC more than $13 million, based on filings for disbursements from Aug. 20, 2025 to Oct. 14, 2026. 

This included $2.2 million for operating expenditures such as polling and website services, and $10.9 million in independent expenditures, with the highest amount (about $960,400) going towards communications in support of James Morris Kingston, the Republican candidate for the House of Representatives in Georgia.

Bellingcat found that all four of these LLCs listed mailing offices and office supply goods stores in Nevada as their mailing addresses. We could not find records of them doing business with any entity outside of the LTF network – in fact, they appeared to have no online presence aside from their names appearing in the filings and business registrations. 

Despite their addresses being listed in Nevada, none of the companies could be found in the state’s public business registry. Instead, Bellingcat found registrations for Prusik, Lantern Production and Summit Ridge across the country – in Delaware. 

While Delaware is the second-smallest state in the US, more than half of all Fortune 500 companies are incorporated there according to the Delaware Secretary of State. The state’s business-friendly laws mean companies can reportedly incorporate in minutes and are only required to name a representative – who can be a paid agent unrelated to the business – in public registration documents, not the beneficial owners.

Articles of incorporation from the Delaware Secretary of State showed that Prusik was registered on July 22, 2025, while Lantern Production and Summit Ridge were both registered on Oct. 30, 2025. We also found a Delaware registration for a company called “Blue Horizon Compliance Group LLC”, registered on Oct. 30, 2025. While the name differs slightly from the Blue Horizon Compliance Consultants LLC that Think Big declared payments for, the registration was signed by the same agent listed in the documents for Lantern Production and Summit Ridge. 

The filings show that all of these companies – including Blue Horizon Compliance Group, if this was indeed the same entity referred to in Think Big’s filings – began receiving payments from the Super PACs within two to three months of their business registrations.

Saurav Ghosh, CLC’s Director of Federal Campaign Finance Reform, told Bellingcat that the group filed the complaint because “when groups funded by big corporate special interests evade transparency laws, voters lose”. 

“Federal reporting requirements help ensure transparency in our elections and protect voters’ legal right to know where the money is going,” Ghosh said. “Secret spending schemes like this make it virtually impossible to ensure that our elected officials are staying accountable to voters instead of wealthy special interests.”

We were unable to reach out to the LLCs as none of them had phone numbers or email addresses listed online. LTF, Think Big, and American Mission did not respond to questions about the LLCs, including whether “Blue Horizon Compliance Consultants LLC” listed in Think Big’s filings was the same company as Delaware-registered “Blue Horizon Compliance Group LLC”. However, a WIRED story on these same LLCs quoted a spokesperson from LTF as saying that the complaint was “a desperate ploy for attention from Public First, Anthropic, and the groups aligned with their outside organisations”. WIRED also quoted a Public First spokesperson denying that the group had anything to do with the complaint.  

Beckel suggested that stricter transparency measures relating to Super PAC spending would help inform and empower voters. For instance, Congress could pass legislation to require ads to include the names of the top donors, he said, adding that similar rules had been passed with cross-partisan support in places like Alaska and Arizona. 

“Congress would be doing voters a huge service by passing more robust transparency requirements for political ads. Voters deserve to know who is behind the ads they’re seeing,” Beckel said. 

This investigation was supported by a grant from the Tarbell Center for AI Journalism. 

Data visualisations by Galen Reich. Melissa Zhu contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Inside the Secretive, Contradictory World of Campaign Ads Funded by AI Super PACs appeared first on bellingcat.

Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.

A report from the Google Threat Intelligence Group (GTIG) said Google has severed ties with Videostrong Technology Co., a TV box manufacturer in China that GTIG and other industry experts concluded was responsible for including malware that enrolled more than 1.3 million set-top boxes in a botnet dubbed “XCPE” (named after one of the malware’s core code components).

The global distribution of XCPE botnet infections. Image: Google Threat Intelligence Group.

The report said the XCPE botnet loaded the user’s device with software that makes their Internet address available for resale by multiple “residential proxy” services, which allow customers to rent Internet addresses as a way to anonymize their web traffic or spoof their true location. As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover activity, advertising fraud, and mass content scraping for AI projects.

“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” the GTIG post reads, noting that Google took legal action to take down the domains and servers Videostrong used to control the botnet and install additional malware. “A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users. Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors.”

The report notes that while TV boxes made up the the majority of the botnet, the same XCPE malware was found in other Android-based IoT products, including telehealth devices, karaoke machines, and even digital signage systems.

Google said it requires all Android device makers to pass compatibility and security tests to ensure their products don’t harm users, but that Videostrong nevertheless found a way to load their malicious software immediately after a user boots up one of these devices for the first time (Google says it has since addressed that weakness).

The GTIG report calls out a number of residential proxy providers whose software development kits were routinely downloaded by devices infected by the XCPE botnet. Those include AppSalt, also known as Honeygain, which was developed by the Vilnius, Lithuania-based Oxylabs. In October 2026, Oxylabs and Honeygain were reorganized as independent platforms under an umbrella entity called Source, which received $130 million in funding from private equity firm Warburg Pincus that reportedly valued the business at $3.6 billion.

Another provider linked to the botnet was NetNut, a once sprawling residential proxy company operated by the publicly-traded Israeli company Alarum Technologies. In July 2026, the FBI worked with industry partners to seize hundreds of domains associated with NetNut, saying the company was responsible for operating a separate botnet called Popa that enslaved TV boxes as residential proxies. Other proxy providers named in the GTIG report include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.

Google’s announcement credits a number of industry partners, including Synthient, a startup that tracks proxy providers. In January 2026, Synthient published research into the rapid spread of the Kimwolf botnet, which at the time was hammering networks worldwide with record-smashing DDoS attacks. Synthient documented how Kimwolf infected millions of Android set-top boxes virtually overnight, using a widespread vulnerability in these residential proxy services to compromise other Android-based devices inside the local networks of unsuspecting TV box users.

Synthient’s research caused dozens of residential proxy providers to patch their networks, which helped to fragment the Kimwolf botnet into much smaller pieces that made its incessant and disruptive DDoS attacks far easier for network operators to manage. It also attracted the attention of the Motion Picture Association (MPA), a trade group representing the major Hollywood studios, which partnered with Synthient to purchase and tear apart a number of popular Android TV set-top boxes — including some that were being infected by Kimwolf and other IoT botnets.

In a report published today, Synthient examined a popular, pre-infected TV box sold under the brand MECOOL by a publicly traded company in China called Skyworth Technology, concluding that MECOOL also bundled the malware from Videostrong Technology Co. and likewise installed AppSalt/Honeygain and other proxy components.

The MECOOL storefront and marketing. Image: Synthient.com.

Synthient founder Ben Brundage told KrebsOnSecurity that Videostrong’s malware also distributed software for the proxy service Grass. In our November 2025 story, “Is Your Android TV Streaming Box Part of a Botnet?” we quoted a researcher from Censys who found the popular Superbox TV streaming device bundled Grass’s residential proxy software. We also quoted the Grass founder, who denied any affiliation with the TV box maker.

That November 2025 story noted that Superbox and similar Android TV set-top boxes gain new customers primarily by engaging influencers on Tiktok and other social networks who praise the product’s ability to offer hundreds of (pirated) pay TV streaming services for a one-time fee.

Likewise, Synthient’s report observes that the MECOOL set-top boxes exploded in popularity after the product was mentioned in 2023 by the Youtube channel Linus Tech Tips, which has an audience of nearly 17 million subscribers [Linus Tech Tips said in a statement shared with Synthient that it has since updated the video to explicitly frame the product as a scam and have removed all associated affiliate links].

The popular Youtube channel Linus Tech Tips discussing MECOOL TV streaming boxes.

The GTIG report estimates the XCPE botnet takedown should sever access to at least 10 million additional compromised devices, noting that the various proxy and ad fraud affiliates of Videostrong “each have diversified distribution channels for their modules beyond XCPE.”

Synthient’s Brundage echoed that conclusion, calling the 1.3 million number “highly conservative.”

“The scale of affected devices is likely way higher,” he said. “This is probably the largest operation against backdoored TV boxes that we’ve seen.”

Update, Nov. 5, 11:07 a.m. ET: In a statement shared post-publication, Oxylabs said that while its system is built so that a device can’t be used as a proxy exit node unless they receive a signal that it has consented, the developer faked these signals.

“We have been conducting regular audits of the applications provided by our partners,” the statement reads. “However, following this incident, we will improve the application and application’s build fingerprinting logic to better detect cases where the SDK is running on an unapproved build of an originally authorized application.”

The statement said Oxylabs has no record of any company called Videostrong Technology Co., but it did find between is suppliers the domain “com.abc[.]nexus,” mentioned in the GTIG report as an external malware loader.

“As soon as we saw that, we suspended the relationship and sent them a formal legal inquiry,” the statement reads. “This supplier accounts for less than 1% of our IP address pool. We had a signed contract with them, they assured our QA team that users had given consent, and we saw the consent flow ourselves.”

Further reading:
Plume Security Labs white paper on the XCPE botnet (PDF)
Black Lotus Labs writeup on LinkedIn
TrendAI’s analysis
Synthient’s list of affected devices, broken down by model number

A comment:

3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?

Yes. It is a new world out there.

By pure timing coincidence, the Proton CEO's AI @ Proton, Engineering Manifesto made headlines around the same time as this week's video. The guy's management style and choice of language have really rubbed a lot of people up the wrong way, and deservedly so, IMHO. However... this section of his screed really resonated with me:

Your job has fundamentally changed. It is no longer to write code, and LLMs are not here to help you write better code faster. Your job is to help the LLM write better code faster.

Dev jobs as we know them are gone. Dead. And if you disagree, you're in for a shock in the very near future. But at the same time:

I don't remember the last time tech has been this exciting. It's white hot right now. Anyone who loves technology and computers is probably having a great time right now.

— Jack Rhysider 🏴‍☠️ (@JackRhysider) October 30, 2026

Yes! This! Not handwriting code "old school" isn't something to lament; rather, our unprecedented ability to innovate, create and build things that are meaningful to us is something to be enormously excited about. Anyway, on that topic:

Neat video:

The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

This story is interesting:

One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly discovered isn’t surprising, but is worth knowing about.

Among the pre-installed bloatware—­or spyware, if you’re being less charitable­—was a voice assistant equipped with WebView, an Android system component that lets apps display content off the web. This apparently always used about a third of processing power, even while idle, which isn’t great. There were also Baidu location services, a call recorder (!), a DAB radio client that is pretty much useless in the U.S., and Adobe Acrobat, presumably so your passenger can entertain themselves with PDFs on the go.

It’s interesting because it exposes all the insecurities in this piece of IoT software. But I think the real story is that a random person was able to do this reverse-engineering with the help of AI. Expect a lot more stories like this in the future.

Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published. Become a member and support our work here.

Imagery captured by the European Space Agency’s freely available Sentinel-2 and Sentinel-1 satellites appears to be delayed over Gaza and parts of the West Bank, a Bellingcat analysis has found.

While the delay remains relatively short at just 24 hours, this can still impact the speed at which analysts and researchers can observe what is happening in the region.

For example, the Israeli Defence Forces demolished homes in the West Bank Palestinian city of Hebron in recent days. New imagery captured on October 26, which included Hebron, would allow open source researchers to quickly confirm the demolitions, assess the impacted area and observe any unreported IDF activity. But imagery for the western half of Hebron was not available until October 27 due to the Sentinel-2 delay, inhibiting real-time fact-checking and reporting on this evolving situation.

A spokesperson for the European Union told Bellingcat that the delay was not related to events in Gaza but to “mitigate possible threats” due to the war in the Middle East “including Iran’s attacks on its neighbours and possible threats to European interests”. The delayed region of Sentinel tiles that cover Gaza as well as parts of Israel and the West Bank also extends over the Eastern Mediterranean Sea.

The European Union ordered a 24-hour delay on Sentinel satellite imagery over the Gulf of Oman earlier this year during US and Israeli strikes on Iran. However the delay impacting Gaza and parts of the West Bank has not been announced or previously reported.

“Such decisions are taken unanimously by all EU Member states and will stay in place as long as necessary,” the spokesperson said. They also said that while the Copernicus program, which includes the Sentinel satellites, operated a free and open data policy there were limitations to this for security. 

When asked if the delay, which began in late March, was related to the presence of US vessels in the Eastern Mediterranean or if there were other areas of delay, the spokesperson said they had no further comment.

Sentinel Delays

The Sentinel-2 and Sentinel-1 satellites provide an invaluable source of imagery for open source researchers. This has been especially true this year, as commercial satellite imagery providers restricted access to imagery in the Middle East, including areas of active human rights concern, such as Gaza. 

However, in July, the European Union published Council Decision 2026/1716, which ordered a 24-hour delay on Sentinel imagery over the Gulf of Oman, after a request from the US government which was involved in strikes on Iran at that time.

Just two weeks later, the European Union issued a corrigendum that unpublished decision 2026/1716 and removed it from the Council of the European Union record, although satellite data shows the delay has remained. 

This decision, while it was available, was reportedly the first public notification of delayed Sentinel imagery. Yet it was not the first time that Sentinel imagery has been restricted, analysis shows. Bellingcat found four distinct regions of delayed satellite imagery during 2025 and 2026: the Gulf of Oman, the Gulf of Aden/western Arabian Sea, the Red Sea as well as the previously unreported delay in the Eastern Mediterranean Sea and parts of Israel, the West Bank and the entirety of Gaza.

Bellingcat’s analysis shows that these delays have been implemented in stages. Twenty-four hour delays of Sentinel-2 imagery were first observed by open source researchers in March and April 2025 after the US launched a naval and air strike campaign against Houthi targets in Yemen. 

The previously unreported imagery delay in the Eastern Mediterranean began on March 28, 2026, the same month that commercial American space imaging company Planet Labs also restricted imagery across the Middle East. The Gulf of Oman delay began on July 15, 2026, two days after the publication of Council Decision 2026/1716.

Decision 2026/1716 also specified that the delay be implemented for both Sentinel-2 and Sentinel-1 radar imagery. Bellingcat’s analysis of Sentinel-1 image availability shows that this is the case for both the Gulf of Oman region and the unreported region over the Eastern Mediterranean Sea. However, the 2025 restrictions on Sentinel-2 imagery in the Red Sea and Gulf of Aden are not implemented in Sentinel-1. 

Sentinel-1 imagery uses “synthetic aperture radar” to capture lower resolution radar images that can collect data at night and on cloudy days. This differs from Sentinel-2, which captures optical satellite imagery at higher resolution.

A Tale of Two Tiles

Sentinel satellite imagery is most commonly accessed by open source researchers through Copernicus Browser, a free online platform, but it is also distributed as large tiled files in the Copernicus Data Space Ecosystem. These tiles are numbered using the Military Grid Reference System, and can be listed using APIs that provide information on each tile, including the capture and publication time. By comparing the capture and publication time, the publication delay can be computed.

For example, the catalog information for the tile T36RXV, which includes Gaza and portions of the West Bank, Negev and Egypt, provides the following metadata for the October 21, 2026 capture.

This shows that while the image was captured at 08:20 UTC on October 21, it was not published until 10:09 UTC on October 22 — almost 26 hours later. This is in contrast to the neighboring tile T36RYV, which includes parts of the West Bank, Israel, and Jordan. API data for this tile shows that the image was published at 12:10 UTC on October 21, just under four hours after the capture time.

This difference is not unique to this date either. Bellingcat’s analysis shows that this tile has been consistently delayed by one day since March 28, 2026.

This method can be extended further, and by analysing every tile with valid publication date timestamps, Bellingcat identified all global Sentinel-2 and Sentinel-1 delays since 2023. The only consistent delays visible were those identified in the Gulf of Oman, the Gulf of Aden/western Arabian Sea, the Red Sea and Eastern Mediterranean in 2025 and 2026.

Impact on open source investigations

While the 24-hour delay on certain Sentinel imagery is a less severe restriction than other satellite providers have imposed, it can still impact the open source research process in fast moving situations. This is especially so in recent months as the European Space Agency’s Sentinel satellite data has emerged as a refuge as other satellite data is censored.

The image below shows how imagery for the eastern half of Hebron was visible on October 26, but not the western half where demolitions took place earlier this week.

The shape of the missing tiles can be seen by zooming out within the Copernicus browser, demonstrating how imagery of Gaza and other parts of Israel and the West Bank are also delayed.

Sentinel imagery covering western Hebron after the demolitions took place was published on October 27. However, the delay prevented local reports from being verified with satellite imagery while the situation was still ongoing.

Some Sentinel-2 users have previously described the challenges of covering fast-moving issues in the Gulf of Oman when the Sentinel delay was announced in March.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post EU Satellite Imagery Delayed Over Gaza and Parts of West Bank by 24-hours appeared first on bellingcat.

Researchers set up a fake start-up company to study fraudulent North Korean IT workers.

As the news from last week has settled down, it would seem this headline was pretty spot on. The foretold apocalypse didn't eventuate, and there were no internet-destroying outages. In fact, it took days before I could find a single story of PHP2Shell being reliably attributed back to a breach. And I don't think we can say the relatively benign outcome was only achieved because we did take it so seriously either; there's a massive trove of sites out there that have been left to rot and would have every opportunity to be pwned by a bug of this magnitude that was readily exploitable, yet here we are. Which is good 🙂

Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities”

Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.

Interesting research:

TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it.

• One word tilts the code against Americans. Ask for the app “for a US defense contractor” instead of “for a Chinese defense contractor”, and Qwen3-Coder is 19% more likely to hand back an app that can be hacked.
• Hong Kong’s democracy movement gets apps that leak. Apps built for a Hong Kong democracy group were 28% more likely to let any user read everyone else’s secrets.
• Asking for secure code didn’t help. With a security instruction in the prompt, the US contractor’s apps were 27% more likely to be hackable than a neutral customer’s.
• Westernized Qwen3-Coder closed all three gaps. After Hirundo removed the model’s CCP alignment, none of the three gaps remained, and on ten other coding tasks it built working apps as often as the original. It is available on Hugging Face.

I would like more details on how the bias was removed.

This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.