--- title: "Mozilla warns UK: Breaking VPNs will not magically fix Britain's age-check mess" type: raw source: newsletter source_url: https://www.theregister.com/security/2026/05/18/mozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess/5241770/ tags: [vietnam, cloud-computing, government, data-sovereignty] fetcher: jina sha256: dff0bfb52467943a ingested: 2026-05-20 --- # Mozilla warns UK: Breaking VPNs will not magically fix Britain's age-check mess Published Time: 2026-05-18T09:54:01.000Z Markdown Content: [Jump to main content](https://www.theregister.com/security/2026/05/18/mozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess/5241770/#main) Search TOPICS * Security * [All Security](https://www.theregister.com/security) * [Cyber-crime](https://www.theregister.com/cyber_crime) * [Patches](https://www.theregister.com/patches) * [Research](https://www.theregister.com/research) * [CSO](https://www.theregister.com/cso) * Off-Prem * [All Off-Prem](https://www.theregister.com/off_prem) * [Edge + IoT](https://www.theregister.com/edge_iot) * [Channel](https://www.theregister.com/channel) * [PaaS + IaaS](https://www.theregister.com/paas_iaas) * [SaaS](https://www.theregister.com/saas) * On-Prem * [All On-Prem](https://www.theregister.com/on_prem) * [Systems](https://www.theregister.com/systems) * [Storage](https://www.theregister.com/storage) * [Networks](https://www.theregister.com/networks) * [HPC](https://www.theregister.com/hpc) * [Personal Tech](https://www.theregister.com/personal_tech) * [Cx0](https://www.theregister.com/cxo) * [Public Sector](https://www.theregister.com/public-sector) * Software * [All Software](https://www.theregister.com/software) * [AI + ML](https://www.theregister.com/ai_ml) * [Applications](https://www.theregister.com/applications) * [Databases](https://www.theregister.com/databases) * [DevOps](https://www.theregister.com/devops) * [OSes](https://www.theregister.com/oses) * [Virtualization](https://www.theregister.com/virtualization) * Offbeat * [All Offbeat](https://www.theregister.com/offbeat) * [Columnists](https://www.theregister.com/columnists) * [Science](https://www.theregister.com/science) * [BOFH](https://www.theregister.com/bofh) * [Legal](https://www.theregister.com/legal) * [Bootnotes](https://www.theregister.com/bootnotes) * [Site News](https://www.theregister.com/site_news) * [About Us](https://www.theregister.com/about_us) * Special Features * [All Special Features](https://www.theregister.com/tag/special_features) * [HPE: AI Explainers](https://www.theregister.com/explainer/ai-explainer) * [RSA Conference](https://www.theregister.com/special_features/rsa) * [Agentic AI](https://www.theregister.com/special_features/agentic_ai) * [The Future of the Datacenter](https://www.theregister.com/special_features/future_of_the_datacenter) * [AWS:Reinvent](https://www.theregister.com/special_features/aws_reinvent) * [Nvidia GTC](https://www.theregister.com/special_features/nvidia_gtc) * [SC25](https://www.theregister.com/special_features/2025_11_sycomp_supercomputing) * [Supercomputing Month](https://www.theregister.com/special_features/2025_11_supercomputing_month) * Vendor Voice * [All Vendor Voice](https://vendorvoice.theregister.com/) * [Infinidat](https://vendorvoice.theregister.com/infinidat/) * [Everpure](https://vendorvoice.theregister.com/everpure/) * [Rubrik](https://vendorvoice.theregister.com/rubrik/) * [Make it real with Capgemini and AWS](https://vendorvoice.theregister.com/aws_capgemini/) * [Money Movement Hub](https://vendorvoice.theregister.com/aws_fis/) * [ZTE](https://vendorvoice.theregister.com/zte_news_and_stories/) * [Nutanix: Scale Kubernetes. Not Chaos.](https://vendorvoice.theregister.com/nutantix_cloud_native_apps/) * [AWS New Horizon](https://vendorvoice.theregister.com/aws_new_horizon/) * Resources * [Intelligence](https://intelligence.theregister.com/) * [Webinars & Events](https://intelligence.theregister.com/events/list/) * [Newsletters](https://account.theregister.com/login?r=https%3A%2F%2Faccount.theregister.com%2Fedit%2Fnewsletter%2F) Search [![Image 1: Go to frontpage. Logo, The Register](https://www.theregister.com/view-resources/dachser2/public/theregister/logo.svg)](https://www.theregister.com/)[![Image 2: Go to frontpage. Logo, The Register](https://www.theregister.com/view-resources/dachser2/public/theregister/logo.svg)](https://www.theregister.com/)[![Image 3: Go to frontpage. Logo, The Register](https://www.theregister.com/view-resources/dachser2/public/theregister/logo.svg)](https://www.theregister.com/) * [Sign in](https://account.theregister.com/login/) * [Datacenter](https://www.theregister.com/tag/datacenter) * [Security](https://www.theregister.com/security) * [Microsoft](https://www.theregister.com/tag/microsoft) * [AWS](https://www.theregister.com/tag/aws) * [Developer](https://www.theregister.com/tag/developer) * [Open Source](https://www.theregister.com/tag/open%20source) * [IT Careers](https://www.theregister.com/tag/tech%20jobs) * [Columnists](https://www.theregister.com/tag/columnists) * [Who, Me?](https://www.theregister.com/tag/who%20me) * [On Call](https://www.theregister.com/tag/on%20call/) REG AD [Security](https://www.theregister.com/security) Firefox maker says the tools are basic security infrastructure, not teenage contraband Carly Page[Carly Page](https://www.theregister.com/author/carly-page) [75](https://forums.theregister.com/forum/all/2026/05/18/20265/) Published Mon 18 May 2026 // 09:54 UTC [](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770)[](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770)[](https://bsky.app/intent/compose?text=Mozilla%20warns%20UK%3A%20Breaking%20VPNs%20will%20not%20magically%20fix%20Britain%27s%20age-check%20mess%0Ahttps%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770)[](https://www.reddit.com/submit?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770&title=Mozilla%20warns%20UK%3A%20Breaking%20VPNs%20will%20not%20magically%20fix%20Britain%27s%20age-check%20mess)[](https://api.whatsapp.com/send?text=Mozilla%20warns%20UK%3A%20Breaking%20VPNs%20will%20not%20magically%20fix%20Britain%27s%20age-check%20mess%0Ahttps%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770) Mozilla has warned Britain not to turn VPNs into collateral damage in the government's increasingly desperate hunt for ways to stop kids dodging Online Safety Act age checks. [![Image 4: fake mustache](https://image.theregister.com/5224997.webp?imageId=5224997&x=0.00&y=0.00&cropw=0.00&croph=0.00&heightx=0.00&heighty=0.00&heightw=0.00&heighth=0.00&width=960&height=432&format=jpg) ## Kids say they can beat age checks by drawing on a fake mustache READ MORE](https://www.theregister.com/security/2026/05/04/kids-can-bypass-some-age-checks-with-a-drawn-on-mustache/5224601) In a [submission](https://blog.mozilla.org/netpolicy/files/2026/05/Mozilla-submission_-Growing-up-in-the-digital-world-consultation.pdf) to the Department for Science, Innovation and Technology's "Growing up in the online world" consultation, Mozilla argued that VPNs are "essential privacy and security tools" used by millions of ordinary people, from those securing public Wi-Fi and remote work traffic to journalists, activists, and other vulnerable users. "VPNs serve as critical privacy and security tools for users across all ages," said Svea Windwehr, policy manager at Mozilla. "By hiding users' IP addresses, VPNs help protect users' location, reduce tracking and avoid IP-based profiling." Windwehr added that people rely on VPNs for everything from connecting remotely to school or work networks to avoiding censorship and "simply protecting their privacy and security online." REG AD The filing lands in the middle of an increasingly strange UK debate where privacy tools are being recast as a threat to online safety enforcement. REG AD [VPN usage in the UK surged almost immediately](https://www.theregister.com/on-prem/2025/07/28/uk-vpn-demand-soars-after-debut-of-online-safety-act/840693) after Online Safety Act age checks started rolling out last year, as users scrambled to avoid handing sensitive identity data to adult websites and platforms demanding facial scans or ID verification. Child safety advocates and officials then turned their attention to VPNs themselves, with the Children's Commissioner for England even [suggesting the government](https://www.theregister.com/offbeat/2025/08/19/uk-commissioner-suggests-govt-stops-kids-from-using-vpns/1226303) should explore ways to stop children from using them altogether. Mozilla's response argues the government is chasing the wrong target. ## MORE CONTEXT * ### [US state laws push age checks into the operating system](https://www.theregister.com/software/2026/03/06/us-state-laws-push-age-checks-into-the-operating-system/4750249) * ### [MPs want social media treated more like unsafe toys than harmless apps](https://www.theregister.com/security/2026/05/15/mps-want-social-media-treated-more-like-unsafe-toys-than-harmless-apps/5240578) * ### [Meta U-turns on encryption push for Instagram as DMs go plaintext](https://www.theregister.com/security/2026/05/08/meta-u-turns-on-encryption-push-for-instagram-as-dms-go-plaintext/5235705) * ### [UK age-gating plans risk breaking the internet, privacy groups warn](https://www.theregister.com/security/2026/05/06/uk-age-gating-plans-risk-breaking-the-internet-privacy-groups-warn/5230732) The company pointed to research from Internet Matters suggesting that relatively few children use VPNs in the first place, and that only a small minority use them specifically to bypass age restrictions. Mozilla instead argued that most successful workarounds involve fake birth dates, borrowed accounts, weak age assurance systems, or laughably fragile facial estimation tools that children have reportedly fooled with [drawn-on facial hair](https://www.theregister.com/security/2026/05/04/kids-can-bypass-some-age-checks-with-a-drawn-on-mustache/5224601). Mozilla also pointed out a central problem with age-gating VPNs: users would first need to hand over personal information before accessing software intended to reduce tracking and data collection. Britain is not the only country suddenly developing strong opinions about VPNs.[Denmark recently floated anti-piracy legislation](https://www.theregister.com/on-prem/2025/12/15/denmark-takes-a-viking-swing-at-vpn-enabled-piracy/2834366)broad enough to trigger fears that VPN usage itself could become legally risky, before ministers hurriedly insisted nobody was trying to ban VPNs.Across Europe, VPNs are being treated less like routine security software and more like an obstacle to enforcement as users turn to them to bypass restrictions. Unfortunately for regulators, the technology industry appears to be moving in the opposite direction. [Mozilla has already been testing built-in VPN functionality directly inside Firefox](https://www.theregister.com/on-prem/2025/10/14/mozilla-recruits-beta-testers-for-a-built-in-firefox-vpn/1190725), joining a wider browser trend toward integrating privacy features that previously required separate software. Blocking standalone VPN apps is one thing, but trying to untangle VPN functionality from modern browsers is a much bigger problem. Mozilla's submission repeatedly argues Britain is drifting toward "safety through surveillance" instead of addressing the recommendation systems, engagement algorithms, and platform incentives that actually drive online harms. ® [mozilla](https://www.theregister.com/tag/mozilla)[virtual private networks](https://www.theregister.com/tag/virtual%20private%20networks)[online safety act](https://www.theregister.com/tag/online%20safety%20act)[security](https://www.theregister.com/tag/security)[age verification](https://www.theregister.com/tag/age%20verification)[united kingdom](https://www.theregister.com/tag/united%20kingdom)[75](https://forums.theregister.com/forum/all/2026/05/18/20265/) [](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770)[](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770)[](https://bsky.app/intent/compose?text=Mozilla%20warns%20UK%3A%20Breaking%20VPNs%20will%20not%20magically%20fix%20Britain%27s%20age-check%20mess%0Ahttps%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770)[](https://www.reddit.com/submit?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770&title=Mozilla%20warns%20UK%3A%20Breaking%20VPNs%20will%20not%20magically%20fix%20Britain%27s%20age-check%20mess)[](https://api.whatsapp.com/send?text=Mozilla%20warns%20UK%3A%20Breaking%20VPNs%20will%20not%20magically%20fix%20Britain%27s%20age-check%20mess%0Ahttps%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F05%2F18%2Fmozilla-warns-uk-breaking-vpns-will-not-magically-fix-britains-age-check-mess%2F5241770) REG AD [![Image 5](https://image.theregister.com/5242942.jpg?imageId=5242942&panox=0.00&panoy=0.00&panow=100.00&panoh=100.00&heightx=0.00&heighty=0.00&heightw=100.00&heighth=100.00&width=960&height=432&format=webp&format=jpg) Software ## Firefox 151 helps you edit PDFs – and switch OSes Export a profile on Windows, restore it on Linux. Extensions and themes too](https://www.theregister.com/software/2026/05/19/firefox-151-helps-you-edit-pdfs-and-switch-oses/5242888) [Security ## America's top cyber-defense agency left a GitHub repo open with with passwords, keys, tokens – and incredibly obvious filenames I wonder what's in 'external-secret-repo-creds.yaml' and 'AWS-Workspace-Firefox-Passwords.csv'?](https://www.theregister.com/security/2026/05/19/americas-top-cyber-defense-agency-left-a-github-repo-open-with-with-passwords-keys-tokens-and-incredibly-obvious-filenames/5242915) ## [ZTE Showcases AI Interactive Flat Panel at the Broadband User Congress in Brazil AI interactive flat panel aimed at offices, elder care, and classrooms with built-in conferencing, automation, and monitoring features unveiled](https://www.theregister.com/systems/2026/05/19/zte-showcases-ai-interactive-flat-panel-at-the-broadband-user-congress-in-brazil/5242492) [HPC ## Airbus gets HPC-as-a-service supercomputer from Bull Aerospace giant rents new system over 5 years to help develop new aircraft](https://www.theregister.com/hpc/2026/05/19/airbus-gets-hpc-as-a-service-supercomputer-from-bull/5242756) [![Image 6](https://image.theregister.com/5241003.jpg?imageId=5241003&panox=0.00&panoy=0.00&panow=100.00&panoh=100.00&heightx=0.00&heighty=0.00&heightw=100.00&heighth=100.00&width=960&height=432&format=webp&format=jpg) Columnists ## Utah tells porn sites to take the P out of VPNs, and it's their fault that they can't Governments can't touch VPNs technically or commercially. The mess they'll make if they try will be off the scale](https://www.theregister.com/columnists/2026/05/18/utah-tells-porn-sites-to-take-the-p-out-of-vpns-and-its-their-fault-that-they-cant/5240978) [Security ## Clear your calendar, Drupal user: You have a critically urgent patch to install The org’s staying mum on the details, but Wednesday’s fixes reach back to unsupported 8.9 branches](https://www.theregister.com/security/2026/05/19/drupal-warns-admins-to-brace-for-highly-critical-core-patch/5242728) ### MOST POPULAR * [![Image 7](https://image.theregister.com/234872.jpg?imageId=234872&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=70&height=60)](https://www.theregister.com/security/2026/05/18/linus-torvalds-says-ai-powered-bug-hunters-have-made-linux-security-mailing-list-almost-entirely-unmanageable/5241633)[Security #### Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’](https://www.theregister.com/security/2026/05/18/linus-torvalds-says-ai-powered-bug-hunters-have-made-linux-security-mailing-list-almost-entirely-unmanageable/5241633) * [![Image 8](https://image.theregister.com/5240227.jpg?imageId=5240227&x=0&y=13.49&cropw=100&croph=84.87&panox=0&panoy=13.49&panow=100&panoh=84.87&width=70&height=60)](https://www.theregister.com/ai-ml/2026/05/13/google-users-fight-for-refunds-as-unauthorized-api-usage-bills-soar/5239160)[AI + ML #### Google users fight for refunds as unauthorized API usage bills soar](https://www.theregister.com/ai-ml/2026/05/13/google-users-fight-for-refunds-as-unauthorized-api-usage-bills-soar/5239160) * [![Image 9](https://image.theregister.com/5237766.jpg?imageId=5237766&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=70&height=60)](https://www.theregister.com/systems/2026/05/16/europe-built-sovereign-clouds-to-escape-us-control-then-forgot-about-the-processors/5237735)[Systems #### Europe built sovereign clouds to escape US control. Then forgot about the processors](https://www.theregister.com/systems/2026/05/16/europe-built-sovereign-clouds-to-escape-us-control-then-forgot-about-the-processors/5237735) * [![Image 10](https://image.theregister.com/5238164.jpg?imageId=5238164&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=70&height=60)](https://www.theregister.com/security/2026/05/11/anthropics-bug-hunting-mythos-was-greatest-marketing-stunt-ever-says-curl-creator/5238111)[Security #### Anthropic’s bug-hunting Mythos was greatest marketing stunt ever, says cURL creator](https://www.theregister.com/security/2026/05/11/anthropics-bug-hunting-mythos-was-greatest-marketing-stunt-ever-says-curl-creator/5238111) * [![Image 11](https://image.theregister.com/5238497.jpg?imageId=5238497&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=70&height=60)](https://www.theregister.com/networks/2026/05/12/veteran-network-architect-proposes-ipv8-to-improve-ipv4-not-leapfrog-v6/5238474)[Networks #### Veteran network architect proposes IPv8 – to improve IPv4, not leapfrog v6](https://www.theregister.com/networks/2026/05/12/veteran-network-architect-proposes-ipv8-to-improve-ipv4-not-leapfrog-v6/5238474) ## EVENTS * ### [The Hardware Crunch: How Supply Chain Turbulence Is Forcing a New IT Playbook Infrastructure teams are facing a perfect storm: extended hardware lead times, rising costs driven by AI demand, and accelerated platform timelines.](https://intelligence.theregister.com/paper/view/20113) * ### [Overcoming the trade-offs in data sovereignty What does data sovereignty actually mean for your network, which trade-offs are unavoidable? Learn more.](https://intelligence.theregister.com/paper/view/20260) * ### [From Prompt to Exploit: How LLMs Are Changing API Attacks Modern applications are API-driven, interconnected, and often over-permissioned, making them an ideal target for AI-assisted attacks.](https://intelligence.theregister.com/paper/view/20219) * ### [Identity Resilience: The New Mandate for Cyber Survival Join Druva experts for a compelling deep dive into what it takes to build an identity-first recovery strategy in this new threat landscape.](https://intelligence.theregister.com/paper/view/20091) * ### [Identity Resilience: The New Mandate for Cyber Survival Join Druva experts for a compelling deep dive into what it takes to build an identity-first recovery strategy in this new threat landscape.](https://intelligence.theregister.com/paper/view/20101) * ### [Unfriendly Followers: The Black Market For Your Identity They’ll reveal how attackers use your profile as intel and show you how to make yourself harder to target](https://intelligence.theregister.com/paper/view/20135) * ### [How Agents are Reshaping AI Security AI adoption is accelerating and with it comes a new security challenge.](https://intelligence.theregister.com/paper/view/20200) * ### [How Agents are Reshaping AI Security AI adoption is accelerating and with it comes a new security challenge.](https://intelligence.theregister.com/paper/view/20201) * ### [AI Found the Problem. Now What? AI is transforming the software development lifecycle, helping teams identify and remediate vulnerabilities before they reach production.](https://intelligence.theregister.com/paper/view/20158) * ### [Virtual Cyber Recovery Sim Step into the chaos of a live ransomware breach, test your response skills, and team up with other IT and security pros to outsmart cybercriminals](https://intelligence.theregister.com/paper/view/20261) [EXPLORE ALL OF OUR EVENTS](https://intelligence.theregister.com/events/list?_gl=1*8seb5h*_ga*NzgyNjE4NzEwLjE3NzExNzQ4MjA.*_ga_JXW44Y23NM*czE3NzY3NTY3MjIkbzEwNSRnMSR0MTc3Njc1Njg5NCRqOCRsMCRoMA..) ### [AI](https://beta.theregister.com/tag/ai) * [Software #### Firefox 151 helps you edit PDFs – and switch OSes Export a profile on Windows, restore it on Linux. Extensions and themes too](https://www.theregister.com/software/2026/05/19/firefox-151-helps-you-edit-pdfs-and-switch-oses/5242888) * [Security #### America's top cyber-defense agency left a GitHub repo open with with passwords, keys, tokens – and incredibly obvious filenames I wonder what's in 'external-secret-repo-creds.yaml' and 'AWS-Workspace-Firefox-Passwords.csv'?](https://www.theregister.com/security/2026/05/19/americas-top-cyber-defense-agency-left-a-github-repo-open-with-with-passwords-keys-tokens-and-incredibly-obvious-filenames/5242915) * [AI + ML #### Shadow AI invades the workplace, up 4x in the last year Employers increasingly blind to unauthorized AI use and where their staff are sending proprietary files](https://www.theregister.com/ai-ml/2026/05/19/shadow-ai-surges-in-the-workplace/5242868) * [HPC #### Airbus gets HPC-as-a-service supercomputer from Bull Aerospace giant rents new system over 5 years to help develop new aircraft](https://www.theregister.com/hpc/2026/05/19/airbus-gets-hpc-as-a-service-supercomputer-from-bull/5242756) * [Security #### Clear your calendar, Drupal user: You have a critically urgent patch to install The org’s staying mum on the details, but Wednesday’s fixes reach back to unsupported 8.9 branches](https://www.theregister.com/security/2026/05/19/drupal-warns-admins-to-brace-for-highly-critical-core-patch/5242728) ### [Infosec](https://beta.theregister.com/security) * [Software #### Firefox 151 helps you edit PDFs – and switch OSes Export a profile on Windows, restore it on Linux. Extensions and themes too](https://www.theregister.com/software/2026/05/19/firefox-151-helps-you-edit-pdfs-and-switch-oses/5242888) * [Security #### America's top cyber-defense agency left a GitHub repo open with with passwords, keys, tokens – and incredibly obvious filenames I wonder what's in 'external-secret-repo-creds.yaml' and 'AWS-Workspace-Firefox-Passwords.csv'?](https://www.theregister.com/security/2026/05/19/americas-top-cyber-defense-agency-left-a-github-repo-open-with-with-passwords-keys-tokens-and-incredibly-obvious-filenames/5242915) * [AI + ML #### Shadow AI invades the workplace, up 4x in the last year Employers increasingly blind to unauthorized AI use and where their staff are sending proprietary files](https://www.theregister.com/ai-ml/2026/05/19/shadow-ai-surges-in-the-workplace/5242868) * [HPC #### Airbus gets HPC-as-a-service supercomputer from Bull Aerospace giant rents new system over 5 years to help develop new aircraft](https://www.theregister.com/hpc/2026/05/19/airbus-gets-hpc-as-a-service-supercomputer-from-bull/5242756) * [Security #### Clear your calendar, Drupal user: You have a critically urgent patch to install The org’s staying mum on the details, but Wednesday’s fixes reach back to unsupported 8.9 branches](https://www.theregister.com/security/2026/05/19/drupal-warns-admins-to-brace-for-highly-critical-core-patch/5242728) ### [FOSS](https://beta.theregister.com/tag/FOSS) * #### [Airbus gets HPC-as-a-service supercomputer from Bull Aerospace giant rents new system over 5 years to help develop new aircraft](https://www.theregister.com/hpc/2026/05/19/airbus-gets-hpc-as-a-service-supercomputer-from-bull/5242756) * #### [SAP customers warned AI agents could put costs on autopilot Billing will be based on 'actions,' whatever those are, leaving enterprises to wonder how fast the meter might run](https://www.theregister.com/saas/2026/05/19/sap-customers-warned-ai-agents-could-put-costs-on-autopilot/5242646) * #### [Microsoft refreshes Surface for Business lineup, starts AI PC upsell at $1,499 Latest hardware adds Intel’s newest AI-focused processors as Redmond continues pushing enterprises toward Copilot+ PCs](https://www.theregister.com/ai-ml/2026/05/19/microsoft-refreshes-surface-for-business-lineup-starts-ai-pc-upsell-at-1499/5242697) * #### [X limits hot takes from freeloaders to 50 a day How will they manage? It's not like anyone can see their posts anyway](https://www.theregister.com/personal-tech/2026/05/19/x-limits-hot-takes-from-freeloaders-to-50-a-day/5242657) * #### [Shai-Hulud keeps burrowing: 314 npm packages infected after another account compromise Popular JavaScript modules including size-sensor and echarts-for-react hit as hijacked account closed GitHub warnings](https://www.theregister.com/cyber-crime/2026/05/19/shai-hulud-keeps-burrowing-314-npm-packages-infected-after-another-account-compromise/5242601) * #### [Broadcom finds a VMware customer willing to stick around: London Stock Exchange LSEG signs up for five more years of Cloud Foundation, but keeps quiet on how much it'll cost](https://www.theregister.com/off-prem/2026/05/19/broadcom-finds-a-vmware-customer-willing-to-stick-around-london-stock-exchange/5242543) ## [FEATURES](https://www.theregister.com/tag/features?_gl=1*esekfm*_ga*NzgyNjE4NzEwLjE3NzExNzQ4MjA.*_ga_JXW44Y23NM*czE3NzY3NTY3MjIkbzEwNSRnMSR0MTc3Njc1Njg5NCRqOCRsMCRoMA..) * [![Image 12](https://image.theregister.com/?imageId=5237766&panow=100&panoh=100&panoy=0&panox=0&heighty=0&heightx=0&heightw=100&heighth=100&width=530&height=238&format=webp)### Europe built sovereign clouds to escape US control. Then forgot about the processors](https://www.theregister.com/systems/2026/05/16/europe-built-sovereign-clouds-to-escape-us-control-then-forgot-about-the-processors/5237735) * [![Image 13](https://image.theregister.com/?imageId=5240833&panow=100&panoh=100&panoy=0&panox=0&heightx=0&heightw=100&heighth=100&heighty=0&width=530&height=238&format=webp)### Nobody believes the 'criminals and scumbags' who hacked Canvas really deleted stolen student data](https://www.theregister.com/cyber-crime/2026/05/14/security-pros-doubt-canvas-attackers-really-deleted-stolen-student-data/5240799) * [![Image 14](https://image.theregister.com/?imageId=5237381&panoy=0&panox=0&panow=100&panoh=100&heightw=100&heighth=100&heighty=0&heightx=0&width=530&height=238&format=webp)### Europe wants out from under US tech – but first it has to find the exits](https://www.theregister.com/public-sector/2026/05/11/europe-wants-out-from-under-us-tech-but-first-it-has-to-find-the-exits/5234898) * [![Image 15](https://image.theregister.com/?imageId=5219524&panoh=71.67&panoy=12.5&panox=0&panow=100&heighty=0&heightx=40.45&heightw=41.43&heighth=100&width=530&height=238&format=webp)### GNOME may rule Ubuntu Resolute Raccoon, but X.org isn't roadkill yet](https://www.theregister.com/oses/2026/05/06/gnome-may-rule-ubuntu-resolute-raccoon-but-xorg-isnt-roadkill-yet/5219477) * [![Image 16](https://image.theregister.com/?imageId=232540&width=530&height=238&format=webp)### OpenClaw, but in containers: Meet NanoClaw](https://www.theregister.com/software/2026/03/01/openclaw-but-in-containers-meet-nanoclaw/4932592) * [![Image 17](https://image.theregister.com/?imageId=4094240&width=530&height=238&format=webp)### Open source registries don't have enough money to implement basic security](https://www.theregister.com/security/2026/02/16/open-source-registries-underfunded-as-security-costs-rise/5168909) * [![Image 18](https://image.theregister.com/?imageId=4094152&width=530&height=238&format=webp)### Contain your Windows apps inside Linux Windows](https://www.theregister.com/software/2026/02/14/contain-your-windows-apps-inside-linux-windows/4334445) * [![Image 19](https://image.theregister.com/?imageId=253705&width=530&height=238&format=webp)### The Linux mid-life crisis that's an opportunity for Tux-led transformation](https://www.theregister.com/software/2026/02/09/linux-mid-life-crisis-a-tux-led-transformation-chance/4856690) * [![Image 20](https://image.theregister.com/?imageId=246863&width=530&height=238&format=webp)### Too much AI for some, too little for others: Why AMD can't win with investors](https://www.theregister.com/on-prem/2026/02/04/why-amds-q1-outlook-is-giving-wall-street-jitters/4464981) * [![Image 21](https://image.theregister.com/?imageId=226970&width=530&height=238&format=webp)### How agentic AI can strain modern memory hierarchies](https://www.theregister.com/special-features/2026/01/28/how-agentic-ai-strains-modern-memory-hierarchies/4429527) ✕ ![Image 22: Logo](https://www.theregister.com/files/2025/10/15/The_register_full_icon_white.svg) Biting the hand that feeds IT ## About Us [Contact us](https://www.theregister.com/profile/contact) [Advertise with us](https://situationpublishing.com/contact/) [Who we are](https://www.theregister.com/profile/about_the_register) [Newsletter](https://account.theregister.com/register/?product=reg_weekly) ## Our Websites [The Next Platform](https://www.nextplatform.com/) [DevClass](https://devclass.com/) [Blocks and Files](https://blocksandfiles.com/) [Situation Publishing](https://situationpublishing.com/) ## Your Privacy [Cookies Policy](https://www.theregister.com/Profile/cookies) [Privacy Policy](https://www.theregister.com/profile/privacy) [Ts & Cs](https://www.theregister.com/profile/terms_and_conditions_of_use) [Do not share my personal information](https://www.theregister.com/Profile/privacy_policy_california_residents/) [Your Consent Options](https://www.theregister.com/profile/terms_and_conditions_of_use) ## Archives [27 years of articles](https://www.theregister.com/archive) ![Image 23: Situation Publishing Logo](https://beta.theregister.com/files/2025/10/09/SituationPublishing_Logo_Evolution_Twolines-White-Barlow%20(1).svg) Copyright. All rights reserved © 1998-2026.