Please en­able JS and dis­able any ad blocker

The Instructure-owned learn­ing man­age­ment plat­form, Canvas, is now on­line again af­ter it went down fol­low­ing a mas­sive data breach that im­pacted stu­dent names, email ad­dresses, ID num­bers, and mes­sages. Before sys­tems were re­stored, stu­dents who at­tempted to ac­cess the sys­tem on Thursday saw a mes­sage from the hack­ing group ShinyHunters, which claimed re­spon­si­bil­ity for the at­tack:

ShinyHunters has breached Instructure (again). Instead of con­tact­ing us to re­solve it they ig­nored us and did some “security patches.” If any of the schools in the af­fected list are in­ter­ested in pre­vent­ing the re­lease of their data, please con­sult with a cy­ber ad­vi­sory firm and con­tact us pri­vately at TOX to ne­go­ti­ate a set­tle­ment. You have till the end of the day by 12 May 2026 be­fore every­thing is leaked.

ShinyHunters has breached Instructure (again). Instead of con­tact­ing us to re­solve it they ig­nored us and did some “security patches.” If any of the schools in the af­fected list are in­ter­ested in pre­vent­ing the re­lease of their data, please con­sult with a cy­ber ad­vi­sory firm and con­tact us pri­vately at TOX to ne­go­ti­ate a set­tle­ment. You have till the end of the day by 12 May 2026 be­fore every­thing is leaked.

The mes­sage in­cluded a link to a list of schools ShinyHunter claims to have breached through Canvas.

“Yesterday, Instructure dis­cov­ered the unau­tho­rized ac­tor in­volved in our on­go­ing se­cu­rity in­ci­dent made changes to the pages that ap­peared when some stu­dents and teach­ers were logged in. Out of an abun­dance of cau­tion, we im­me­di­ately took Canvas of­fline to con­tain ac­cess and fur­ther in­ves­ti­gate,” Instructure said in a state­ment to The Verge. “We re­gret the in­con­ve­nience and con­cern this may have caused.”

According to Instructure’s sta­tus page, Canvas is now avail­able for most users, though Canvas Beta and Canvas Test sys­tems are still in main­tainence mode. Instructure is also in­ves­ti­gat­ing an is­sue where some users are hav­ing dif­fi­cul­ties log­ging into Student ePort­fo­lios.

“We have con­firmed that the unau­tho­rized ac­tor ex­ploited an is­sue re­lated to our Free-For-Teacher ac­counts. As a re­sult, we have made the dif­fi­cult de­ci­sion to tem­porar­ily shut down our Free-For-Teacher ac­counts,” Instructure said in its state­ment. The com­pany has not men­tioned when those ac­counts are ex­pected to be re­stored.

Instructure said last week that it “deployed patches to en­hance sys­tem se­cu­rity” fol­low­ing the breach. ShinyHunters — which has claimed re­spon­si­bil­ity for at­tacks on Ticketmaster, AT&T, Rockstar Games, ADT, and Vercel — said its data leak site con­tains 9,000 schools, in­clud­ing data be­long­ing to 275 mil­lion stu­dents, teach­ers, and other staff, ac­cord­ing to Bleeping Computer.

Update, May 7th: Added Instructure’s main­te­nance mode mes­sage.

Update, May 8th: Added state­ment from Instructure re­gard­ing the ser­vice be­ing back on­line.

Follow top­ics and au­thors from this story to see more like this in your per­son­al­ized home­page feed and to re­ceive email up­dates.

Emma Roth

Jess Weatherbed

POZNAN, Poland (AP) — A gen­er­a­tion ago, Poland ra­tioned sugar and flour while its cit­i­zens were paid one-tenth what West Germans earned. Today, the econ­omy of the coun­try has edged past Switzerland to be­come the world’s 20th largest with more than $1 tril­lion in an­nual out­put.

It’s a his­toric leap from the post-Com­mu­nist ru­ins of 1989 – 90 to European growth cham­pion, which econ­o­mists say has lessons on how to bring pros­per­ity to or­di­nary peo­ple — and that the Trump ad­min­is­tra­tion says should be rec­og­nized by Poland’s pres­ence at a sum­mit of the Group of 20 lead­ing economies later this year.

The trans­for­ma­tion is re­flected in peo­ple like Joanna Kowalska, an en­gi­neer from Poznan, a city of around 500,000 peo­ple mid­way be­tween Berlin and Warsaw. She re­turned home af­ter five years in the U.S.

“I get asked of­ten if I’m miss­ing some­thing by com­ing back to Poland, and, to be hon­est, I feel it’s the other way around,” Kowalska said. “We are ahead of the United States in so many ar­eas.”

Kowalska works at the Poznan Supercomputing and Networking Center, which is de­vel­op­ing the first ar­ti­fi­cial in­tel­li­gence fac­tory in Poland and in­te­grat­ing it with a quan­tum com­puter, one of 10 on the con­ti­nent fi­nanced by a European Union pro­gram.

3 MIN READ

2 MIN READ

3 MIN READ

Kowalska worked for Microsoft in the U.S. af­ter grad­u­at­ing from the Poznan University of Technology, in a job she saw as a “dream come true.”

Newer sky­scrap­ers flank the com­mu­nist-era Palace of Culture and Science, fore­ground, in n, Poland, May 25, 2018. (AP Photo/Alik Keplicz, File)

But she missed hav­ing a “sense of mis­sion,” she said.

“Especially when it comes to ar­ti­fi­cial in­tel­li­gence, the tech­nol­ogy started de­vel­op­ing so rapidly in Poland,” Kowalska said. “So it was very tempt­ing to come back.”

Breaking out of poverty

The guest in­vi­ta­tion to the G20 sum­mit is mostly sym­bolic. No guest coun­try has been pro­moted to full mem­ber since the orig­i­nal G20 met at the fi­nance min­is­ter level in 1999, and that would take a con­sen­sus de­ci­sion of all the mem­bers. Moreover, the orig­i­nal coun­tries were cho­sen not just by gross do­mes­tic prod­uct rank, but by their “systemic sig­nif­i­cance” in the global econ­omy.

But the ges­ture re­flects a sta­tis­ti­cal truth: In 35 years — a lit­tle less than one per­son’s work­ing life­time — Poland’s per capita GDP rose to $55,340 in 2025, or 85% of the EU av­er­age. That’s up from $6,730 in 1990, or 38% of the EU av­er­age and now roughly equal to Japan’s $52,039, ac­cord­ing to International Monetary Fund fig­ures mea­sured in to­day’s dol­lars and ad­justed for Poland’s lower cost of liv­ing.

Poland’s econ­omy has grown an av­er­age 3.8% a year since join­ing the EU in 2004, eas­ily beat­ing the European av­er­age of 1.8%.

It was­n’t sim­ply one fac­tor that helped Poland break out of the poverty trap, says Marcin Piątkowski of Warsaw’s Kozminski University and au­thor of a book on the coun­try’s eco­nomic rise.

One of the most im­por­tant fac­tors was rapidly build­ing a strong in­sti­tu­tional frame­work for busi­ness, he said. That in­cluded in­de­pen­dent courts, an anti-mo­nop­oly agency to en­sure fair com­pe­ti­tion, and strong reg­u­la­tion to keep trou­bled banks from chok­ing off credit.

As a re­sult, the econ­omy was­n’t hi­jacked by cor­rupt prac­tices and oli­garchs, as hap­pened else­where in the post-Com­mu­nist world.

Poland also ben­e­fited from bil­lions of eu­ros in EU aid, both be­fore and af­ter it joined the bloc in 2004 and gained ac­cess to its huge sin­gle mar­ket.

Above all, there was the broad con­sen­sus, from across the po­lit­i­cal spec­trum, that Poland’s long-term goal was join­ing the EU.

“Poles knew where they were go­ing,” Piątkowski said. “Poland down­loaded the in­sti­tu­tions and the rules of the game, and even some cul­tural norms that the West spent 500 years de­vel­op­ing.”

As op­pres­sive as it was, com­mu­nism con­tributed by break­ing down old so­cial bar­ri­ers and open­ing higher ed­u­ca­tion to fac­tory and farm­work­ers who had no chance be­fore. A post-Com­mu­nist boom in higher ed­u­ca­tion means half of young peo­ple now have de­grees.

“Young Poles are, for in­stance, bet­ter ed­u­cated than young Germans,” Piatkowski said, but earn half what Germans do. That’s “an un­beat­able com­bi­na­tion” for at­tract­ing in­vestors, he said.

Success of an elec­tric bus com­pany

Solaris, a com­pany founded in 1996 in Poznan by Krzysztof Olszewski, is one of the lead­ing man­u­fac­tur­ers of elec­tric buses in Europe with a mar­ket share of around 15%. Its story shows one hall­mark of Poland’s suc­cess: en­tre­pre­neur­ship, or the will­ing­ness to take risks and build some­thing new.

Workers build elec­tric buses at the Solaris bus fac­tory in Poznan, Poland, Thursday, Jan. 29, 2026. (AP Photo/Pietro De Cristofaro)

Educated as an en­gi­neer un­der the Communist gov­ern­ment, Olszewski opened a car re­pair shop where he used spare parts from West Germany to fix Polish cars. While most en­ter­prises were na­tion­al­ized, au­thor­i­ties gave per­mis­sion to small-scale pri­vate work­shops like his to op­er­ate, ac­cord­ing to Katarzyna Szarzec, an econ­o­mist at the Poznan University of Economics and Business.

“These were en­claves of pri­vate en­tre­pre­neur­ship,” she said.

In 1996, Olszewski opened a sub­sidiary of the German bus com­pany Neoplan and started pro­duc­ing for the Polish mar­ket.

“Poland’s en­try to the EU in 2004 gave us cred­i­bil­ity and ac­cess to a vast, open European mar­ket with the free move­ment of goods, ser­vices and peo­ple,” said Mateusz Figaszewski, re­spon­si­ble for in­sti­tu­tional re­la­tions.

Then came a risky de­ci­sion to start pro­duc­ing elec­tric buses in 2011, a time when few in Europe were ex­per­i­ment­ing with the tech­nol­ogy. Figaszewski said larger com­pa­nies in the West had more to lose if switch­ing to elec­tric ve­hi­cles did­n’t work out.

“It be­came an op­por­tu­nity to achieve tech­no­log­i­cal lead­er­ship ahead of the mar­ket,” he said.

An ag­ing pop­u­la­tion

Challenges still re­main for Poland. Due to a low birth rate and an ag­ing so­ci­ety, fewer work­ers will be able to sup­port re­tirees. Average wages are lower than the EU av­er­age. While small and medium en­ter­prises flour­ish, few have be­come global brands.

Poznan Mayor Jacek Jaśkowiak sees do­mes­tic in­no­va­tion as a third wave in Poland’s post­so­cial­ist eco­nomic de­vel­op­ment. In the first wave, for­eign coun­tries opened fac­to­ries in Poland in the early 1990s, tak­ing ad­van­tage of a skilled lo­cal pop­u­la­tion.

Around the turn of the mil­len­nium, he said, Western com­pa­nies brought more ad­vanced branches, in­clud­ing fi­nance, in­for­ma­tion tech­nol­ogy and en­gi­neer­ing.

“Now it’s the time to start such so­phis­ti­cated ac­tiv­i­ties here,” Jaśkowiak says, adding that one of his main pri­or­i­ties is in­vest­ing in uni­ver­si­ties.

“There is still much to do when it comes to in­no­va­tion and tech­no­log­i­cal progress,” added Szarzec, the Poznan econ­o­mist. “But we keep climb­ing up on that lad­der of added value. We’re no longer just a sup­plier of spare parts.”

Szarzec’s stu­dents say more needs to be done to re­duce ur­ban-rural in­equal­i­ties, make hous­ing af­ford­able and sup­port young peo­ple start­ing fam­i­lies. They say Poles need to ac­knowl­edge that im­mi­grants, such as the mil­lions of Ukrainians who fled Russia’s full-scale in­va­sion in 2022, con­tribute to eco­nomic de­vel­op­ment in an ag­ing pop­u­la­tion.

“Poland has such a dy­namic econ­omy, with so many op­por­tu­ni­ties for de­vel­op­ment, that of course I am stay­ing,” said Kazimierz Falak, 27, one of Szarzec’s grad­u­ate stu­dents. “Poland is promis­ing.”

Computer equip­ment at the Poznan Supercomputing and Networking cen­ter is seen in Poznan, Poland, Wednesday, Jan. 28, 2026. (AP Photo/Pietro De Cristofaro)

___

David McHugh re­ported from Frankfurt, Germany.

Published on 2026 – 05-07, 82 words, 1 min­utes to read

Oh boy yet more linux ker­nel vulns

In the wake of copy.fail, there are more vul­ner­a­bil­i­ties that have been an­nounced:

Copy Fail 2: Electric Boogaloo

Dirty Frag

Right now would be one of the best times for a sup­ply chain at­tack via NPM to hit hard.

Outside of Linux ker­nel patches from your dis­tro, I think it’s prob­a­bly a good idea to put a mora­to­rium on in­stalling new soft­ware for a week or so.

Facts and cir­cum­stances may have changed since pub­li­ca­tion. Please con­tact me be­fore jump­ing to con­clu­sions if some­thing seems wrong or un­clear.

Tags:

Copyright 2012 – 2026 Xe Iaso. Any and all opin­ions listed here are my own and not rep­re­sen­ta­tive of any of my em­ploy­ers, past, fu­ture, and/​or pre­sent.

Served by xe­site v4 (/app/bin/xesite) with site ver­sion c67419ee , source code avail­able here.

In May 2026, Google an­nounced “Google Cloud Fraud Defense - the next evo­lu­tion of re­CAPTCHA.” The an­nounce­ment de­scribed a QR code chal­lenge where users scan a code with their phone to prove hu­man pres­ence.

Google killed Web Environment Integrity in 2023 af­ter stan­dards bod­ies ob­jected. Today, three years later, the same de­vice at­tes­ta­tion mech­a­nism launched as a com­mer­cial prod­uct.

The open web sur­vived be­cause no sin­gle com­pany could de­cide which hard­ware was le­git­i­mate enough to use it. Google is de­ter­mined to end that sta­tus quo - now through a re­CAPTCHA up­date.

Table of Contents

Google al­ready tried this in 2023

The QR code will be by­passed

QR auth codes and de­vice at­tes­ta­tion are not new

Device at­tes­ta­tion bars the users who need pri­vacy most

“Legitimate” track­ing

Final thoughts

Google al­ready tried this in 2023

In June 2023, a Google en­gi­neer named Yoav Weiss posted a pro­posal to the Chromium pro­ject called “Web Environment Integrity.” The mech­a­nism was di­rect: browsers would ask de­vice hard­ware to sign a cryp­to­graphic at­tes­ta­tion prov­ing the browser was un­mod­i­fied and run­ning on Google-certified hard­ware. Websites could ver­ify the sig­na­ture and de­cide whether to serve con­tent with­out fric­tion or add a chal­lenge. Of course, the pro­posal framed this as pro­tect­ing web in­tegrity against bots and au­to­mated scrap­ing.

Mozilla pub­lished a for­mal po­si­tion within days. The pro­posal “works against users’ in­ter­ests” and “creates a gated in­ter­net con­trolled by OS and de­vice ven­dors.” The Electronic Frontier Foundation called it “Chrome’s Plan to DRM the Web,” not­ing that by de­sign, only Chrome run­ning on Android or other cer­ti­fied hard­ware would eas­ily pass at­tes­ta­tion, rout­ing traf­fic to­ward Google’s ecosys­tem as a struc­tural con­se­quence, not a side ef­fect.

Google with­drew WEI three weeks af­ter pub­li­ca­tion. The Chromium GitHub thread closed. Publicly, it was dead.

In May 2026, Google an­nounced Google Cloud Fraud Defense, de­scribed in its blog post as “the next evo­lu­tion of re­CAPTCHA.” The sys­tem chal­lenges users with a QR code: scan it with your phone to con­firm hu­man pres­ence. The re­quire­ments page spec­i­fies the hard­ware that qual­i­fies: “modern Android de­vice with Google Play Services in­stalled, or mod­ern iPhone/​iPad.”

“Google Play Services in­stalled” is do­ing sig­nif­i­cant work in that sen­tence. Google Play Services is Google’s closed-source soft­ware layer that runs on cer­ti­fied Android de­vices and pro­vides the at­tes­ta­tion APIs - the Play Integrity API specif­i­cally - that prove a de­vice is un­mod­i­fied and ap­proved by Google. A de­vice with­out Play Services can­not sat­isfy Play Integrity checks at the level Fraud Defense re­quires. That is not a tech­ni­cal lim­i­ta­tion wait­ing to be en­gi­neered around. It is the mech­a­nism.

The WEI re­view process, what­ever its lim­i­ta­tions, re­quired Google to de­fend the mech­a­nism pub­licly. The pro­posal was with­drawn be­cause the ob­jec­tions held. With Fraud Defense, there was no process to re­spond to. The prod­uct launched. The re­quire­ments page went live. The same at­tes­ta­tion in­fra­struc­ture that gen­er­ated those doc­u­mented ob­jec­tions in 2023 be­came the un­der­pin­ning of a com­mer­cial ser­vice avail­able to any or­ga­ni­za­tion with a Google Cloud billing ac­count.

The QR code will be by­passed

Here is how the chal­lenge works: a user en­coun­ters a Fraud Defense prompt and is asked to scan a QR code with their phone cam­era. The phone, au­then­ti­cated against Google’s Play Integrity API, con­firms the de­vice is cer­ti­fied hard­ware. That con­fir­ma­tion re­turns to the orig­i­nat­ing site as proof of hu­man pres­ence.

The de­feat is me­chan­i­cal. Bot op­er­a­tors point a cam­era at a screen, a triv­ial au­toma­tion with off-the-shelf hard­ware. For op­er­a­tions that need Play Integrity at­tes­ta­tion specif­i­cally, a com­pli­ant Android de­vice costs ap­prox­i­mately $30 ($29.88 in Wallmart to be pre­cise) - for a pro­fes­sional bot farm, which pur­chases de­vices in bulk, this is the fixed cost with­out ma­te­r­ial dis­rup­tion to op­er­a­tions.

One ad­di­tional fail­ure worth not­ing: one in­ci­dent re­sponse pro­fes­sional in the HN thread, raised a con­cern that op­er­ates in­de­pen­dently of the bot prob­lem:

How should we re­al­is­ti­cally teach Susan from HR the dif­fer­ence be­tween a real Google Captcha QR code and a ma­li­cious phish­ing QR code - you (realistically) can’t.

How should we re­al­is­ti­cally teach Susan from HR the dif­fer­ence be­tween a real Google Captcha QR code and a ma­li­cious phish­ing QR code - you (realistically) can’t.

The QR chal­lenge trains users to scan codes to ac­cess web­sites. Phishing cam­paigns will ex­ploit that trained be­hav­ior im­me­di­ately.

QR auth codes and de­vice at­tes­ta­tion are not new

In the Apple world iOS App Attestation ver­i­fies that an app was in­stalled through the App Store and has not been mod­i­fied. It gov­erns apps: a walled gar­den users chose when they pur­chased an iPhone. The ex­ten­sion to open web brows­ing is cat­e­gor­i­cally dif­fer­ent: it con­di­tions URL ac­cess on hard­ware a pri­vate com­pany has cer­ti­fied. No prece­dent ex­ists for this ap­plied to the open in­ter­net. App stores are opt-in ecosys­tems with ex­plicit terms of ser­vice. The web was not de­signed to have terms of hard­ware.

QR-based au­then­ti­ca­tion sys­tems them­selves al­ready ex­ist for a while. Estonia’s Smart ID uses QR codes to ver­ify users, but for bounded, con­sent-scoped re­sources: bank­ing por­tals, gov­ern­ment ser­vices, health records. The user chooses to au­then­ti­cate. The pro­tected re­source is de­fined in ad­vance. The scope is ex­plicit. Google Cloud Fraud Defense ap­plies de­vice at­tes­ta­tion to the open web, to any URL an op­er­a­tor chooses to gate, with­out equiv­a­lent con­sent ar­chi­tec­ture, with­out pur­pose lim­i­ta­tion, and very likely with­out user aware­ness that their hard­ware iden­tity is func­tion­ing as an ac­cess cre­den­tial.

Device at­tes­ta­tion bars the users who need pri­vacy most

Google Play Integrity at­tes­ta­tion re­quires Google Play Services. GrapheneOS, the se­cu­rity-hard­ened Android fork rec­om­mended by the EFF and used by jour­nal­ists, lawyers, and ac­tivists in high-risk en­vi­ron­ments, does not ship Play Services by de­fault. It sup­ports a sand­boxed com­pat­i­bil­ity layer that runs some Play Services func­tion­al­ity, but this does not sat­isfy Play Integrity at the MEETS_DEVICE_INTEGRITY level that Fraud Defense re­quires. LineageOS for mi­croG (a pri­vacy-ori­ented Android dis­tri­b­u­tion built specif­i­cally for users who want an open-source al­ter­na­tive) fails for the same rea­son. Any cus­tom ROM that ex­cludes Play Services fails.

Firefox for Android does not ap­pear in Google’s stated browser sup­port list for Fraud Defense. This is not an over­sight. Firefox does not in­te­grate Google Play Integrity by de­sign - Mozilla’s po­si­tion on de­vice at­tes­ta­tion in 2023 was ex­plicit and re­mains cur­rent. The prac­ti­cal ef­fect: users of the most pri­vacy-re­spect­ing ma­jor mo­bile browser are ex­cluded from ver­i­fied ac­cess by de­fault, not be­cause they are bots, but be­cause they use soft­ware that de­clines to par­tic­i­pate in Google’s cer­ti­fi­ca­tion ar­chi­tec­ture.

“Legitimate” track­ing

The gov­er­nance prob­lem is the ob­vi­ous ob­jec­tion. The track­ing prob­lem is the one that gets less at­ten­tion.

Every Fraud Defense chal­lenge that re­solves suc­cess­fully sends a sig­nal to Google: this cer­ti­fied de­vice ac­cessed this site at this time. Device at­tes­ta­tion does not just gate ac­cess - it pro­duces at­tri­bu­tion. A de­vice with a sta­ble hard­ware iden­tity cre­ates a per­sis­tent iden­ti­fier that crosses ses­sions, browsers, and pri­vate brows­ing modes. The com­pany that de­fines which hard­ware is “legitimate” also ac­cu­mu­lates a run­ning record of where that hard­ware goes on the open web. That is not a side ef­fect of fraud de­fense. It is an ar­chi­tec­tural con­se­quence de­ci­sion of ty­ing ver­i­fi­ca­tion to cer­ti­fied de­vice iden­tity.

A tech­ni­cally cred­i­ble al­ter­na­tive ex­ists that avoids both the gov­er­nance prob­lem and the track­ing prob­lem. Private Captcha and sim­i­lar proof-of-work sys­tems is­sue cryp­to­graphic chal­lenges that re­quire com­pu­ta­tional ef­fort (dis) pro­por­tional to vol­ume. One hu­man solv­ing a sin­gle chal­lenge pays a neg­li­gi­ble cost. A bot farm run­ning con­cur­rent ses­sions faces ex­po­nen­tial com­pute costs with each ad­di­tional at­tempt and AI agents, which con­sume GPU cy­cles to op­er­ate, face iden­ti­cal penal­ties re­gard­less of how so­phis­ti­cated their rea­son­ing is. No hard­ware iden­ti­fier is trans­mit­ted. No at­tes­ta­tion is re­quired. No cer­ti­fi­ca­tion layer de­ter­mines who may par­tic­i­pate. User pri­vacy is struc­turally pre­served, not promised.

Final thoughts

Google Cloud Fraud Defense is not a re­CAPTCHA up­date. The QR code is the vis­i­ble mech­a­nism, but de­vice at­tes­ta­tion is the real prod­uct. Every re­solved chal­lenge tells Google which cer­ti­fied hard­ware ac­cessed which site at which time. The same in­fra­struc­ture stan­dards bod­ies re­jected in 2023 now op­er­ates be­hind a com­mer­cial re­lease, ac­cu­mu­lat­ing at­tri­bu­tion data that WEI, as a pub­lic pro­posal, would never have been per­mit­ted to build un­chal­lenged. Ironically, it will fail to stop bots sim­i­larly to the ver­sion it is de­signed to “improve” upon.

This vol­ume re­quires JavaScript. That is part of the point — your browser is what is be­ing read.

With JavaScript off, the page can­not tell you what your browser dis­closed. The data is still there. The dis­clo­sure still hap­pened. Only the telling of it stops.

Two weeks ago we an­nounced that we had iden­ti­fied and fixed an un­prece­dented num­ber of la­tent se­cu­rity bugs in Firefox with the help of Claude Mythos Preview and other AI mod­els. In this post, we’ll go into more de­tail about how we ap­proached this work, what we found, and ad­vice for other pro­jects on mak­ing good use of emerg­ing ca­pa­bil­i­ties to harden them­selves against at­tack.

Suddenly, the bugs are very good

Just a few months ago, AI-generated se­cu­rity bug re­ports to open source pro­jects were mostly known for be­ing un­wanted slop. Dealing with re­ports that look plau­si­bly cor­rect but are wrong im­poses an asym­met­ric cost on pro­ject main­tain­ers: it’s cheap and easy to prompt an LLM to find a “problem” in code, but slow and ex­pen­sive to re­spond to it.

It is dif­fi­cult to over­state how much this dy­namic changed for us over a few short months. This was due to a com­bi­na­tion of two main fac­tors. First, the mod­els got a lot more ca­pa­ble. Second, we dra­mat­i­cally im­proved our tech­niques for har­ness­ing these mod­els — steer­ing them, scal­ing them, and stack­ing them to gen­er­ate large amounts of sig­nal and fil­ter out the noise.

Ordinarily we keep de­tailed bug re­ports pri­vate for sev­eral months af­ter ship­ping fixes and is­su­ing se­cu­rity ad­vi­sories, largely as a pre­cau­tion to pro­tect any users who, for what­ever rea­son, were slow to up­date to the lat­est ver­sion of Firefox. Given the ex­tra­or­di­nary level of in­ter­est in this topic and the ur­gency of ac­tion needed through­out the soft­ware ecosys­tem, we’ve made the cal­cu­lated de­ci­sion to un­hide a small sam­ple of the re­ports be­hind the fixes we re­cently shipped. We’ve at­tempted to draw them from a range of browser sub­sys­tems, but the se­lec­tion process was still some­what ar­bi­trary. Nevertheless, we hope that the depth and di­ver­sity of these re­ports lends cre­dence to our as­sess­ment of the ca­pa­bil­i­ties and our calls for de­fend­ers to be­gin ap­ply­ing these tech­niques:

Note that a num­ber of these bugs are sand­box es­capes, which would need to be com­bined with other ex­ploits to achieve a full-chain Firefox com­pro­mise. These re­ports pre­sume that the sand­boxed process that ren­ders site con­tent has al­ready been com­pro­mised with some sep­a­rate bug, and is now run­ning at­tacker-con­trolled ma­chine code at­tempt­ing to es­ca­late con­trol into the priv­i­leged par­ent process. When craft­ing a sand­box es­cape, the model is per­mit­ted to patch the Firefox source code, so long as the mod­i­fied code is re­stricted to run only in the sand­boxed process[1]. Such bugs are no­to­ri­ously dif­fi­cult to find with fuzzing, and while we’ve had some suc­cess de­vel­op­ing new tech­niques to close this gap, AI analy­sis pro­vides much more com­pre­hen­sive cov­er­age of this crit­i­cal sur­face.

Just as in­ter­est­ing as what the mod­els found is what they did­n’t find — not be­cause they did­n’t try, but be­cause they were un­able to cir­cum­vent Firefox’s lay­ered de­fenses. For ex­am­ple, in re­cent years we re­ceived sev­eral clever re­ports from se­cu­rity re­searchers that man­aged to es­cape the process sand­box by trig­ger­ing pro­to­type pol­lu­tion in the priv­i­leged par­ent process. Rather than fix­ing these prob­lems one-by-one, we made an ar­chi­tec­tural change to freeze these pro­to­types by de­fault. While au­dit­ing logs from the har­ness, we saw many at­tempts to pur­sue this line of es­cape that were thwarted by this de­sign. Observing such di­rect pay­off from pre­vi­ous hard­en­ing work was even more re­ward­ing than find­ing and fix­ing more bugs.

Harnessing Models to Build a Hardening Pipeline

We’ve ex­per­i­mented in­ter­nally with LLM code au­dits over the past few years, with early at­tempts us­ing mod­els like GPT 4 or Sonnet 3.5 to sta­t­i­cally an­a­lyze high risk code for vul­ner­a­bil­i­ties. These ex­per­i­ments showed some promise, but the high rate of false pos­i­tives made them im­prac­ti­cal to scale.

The in­tro­duc­tion of agen­tic har­nesses that can re­li­ably de­tect se­cu­rity is­sues has com­pletely changed this. These can find real bugs and dis­miss un­re­pro­ducible spec­u­la­tion. The key fea­ture of such a har­ness is that, given the right in­ter­faces and in­struc­tions, it can cre­ate and run re­pro­ducible test cases to dy­nam­i­cally test hy­pothe­ses about bugs in code. After fix­ing the ini­tial set of is­sues that Anthropic sent to us in February, we built our own har­ness atop our ex­ist­ing fuzzing in­fra­struc­ture.

We be­gan with small-scale ex­per­i­ments prompt­ing the har­ness to look for sand­box es­capes with Claude Opus 4.6. Even with this model, we iden­ti­fied an im­pres­sive amount of pre­vi­ously-un­known vul­ner­a­bil­i­ties which re­quired com­plex rea­son­ing over mul­ti­process browser en­gine code. At first, we su­per­vised the process in the ter­mi­nal to ob­serve the process in real-time and tune the prompts and logic. Once this was work­ing well, we par­al­lelized the jobs across mul­ti­ple ephemeral VMs, each tasked to hunt for bugs within a spe­cific tar­get file and write its find­ings back to a bucket.

A dis­cov­ery sub­sys­tem is nec­es­sary but not suf­fi­cient. In or­der to scale the ef­fort, we needed to in­te­grate it with our full se­cu­rity bug life­cy­cle: de­ter­min­ing what to look for, where to look, and how to han­dle what it pro­duces. This last part in­cludes dedu­pli­cat­ing against known is­sues, track­ing bugs, triag­ing them, and get­ting fixes shipped. While the model is the core prim­i­tive pow­er­ing the har­ness, this full pipeline is nec­es­sary to make it use­ful at scale.

While har­nesses may be reusable across pro­jects, this pipeline is in­her­ently pro­ject-spe­cific, re­flect­ing each code­base’s se­man­tics, tool­ing, and processes. Standing this up re­quired sig­nif­i­cant it­er­a­tion, with a tight feed­back loop along­side the Firefox en­gi­neers who were field­ing the in­com­ing bugs.

Upgrading the Models

Once the end-to-end pipeline is in place, it’s triv­ial to swap in dif­fer­ent mod­els when they be­come avail­able. Building this pipeline early helped us find a num­ber of se­ri­ous bugs us­ing pub­licly-avail­able mod­els, and it also helped us hit the ground run­ning when we had the op­por­tu­nity to eval­u­ate Claude Mythos Preview. In our ex­pe­ri­ence, model up­grades in­crease the ef­fec­tive­ness of the en­tire pipeline: the sys­tem gets si­mul­ta­ne­ously bet­ter at find­ing po­ten­tial bugs, cre­at­ing proof-of-con­cept test cases to demon­strate them, and ar­tic­u­lat­ing their pathol­ogy and im­pact.

In ad­di­tion to fix­ing the 271 bugs iden­ti­fied by Claude Mythos Preview in the 150 re­lease, we’ve shipped more of these fixes in 149.0.2, 150.0.1, and 150.0.2. We also con­tinue to find bugs with other means in­ter­nally, and, sim­i­lar to other pro­jects, we’ve seen a sig­nif­i­cant uptick in ex­ter­nal re­ports in the last few months.

Ultimately, every bug re­quires care and at­ten­tion to prop­erly fix. Staying on top of this un­prece­dented vol­ume has led to a lot of work and long days over the last few months, and we’re ex­tremely proud of how the team has stepped up to meet this chal­lenge. Over 100 peo­ple con­tributed code to this ef­fort to ship the most se­cure Firefox yet. In ad­di­tion to writ­ing and re­view­ing patches, oth­ers have been build­ing and scal­ing this pipeline, triag­ing, test­ing the fixes, and man­ag­ing the re­lease process for each bug.

Takeaways

Anyone build­ing soft­ware can start us­ing a har­ness with a mod­ern model to find bugs and harden their code to­day. We rec­om­mend get­ting started now. You will find bugs, and you will set your­self up to take ad­van­tage of new mod­els as soon as they be­come avail­able.

You can start with very sim­ple prompt­ing, then ob­serve and it­er­ate. Our ini­tial prompts were not dis­sim­i­lar from those de­scribed here. Through it­er­a­tion we’ve built out a lot of or­ches­tra­tion and tool­ing to op­ti­mize and scale the pipeline, but the essence of the in­ner loop re­mains the same: there is a bug in this part of the code, please find it and build a test­case.

We haven’t bot­tomed on all the la­tent bugs in Firefox, but are quite pleased with the tra­jec­tory. Today, our scan­ning is largely fo­cused on spe­cific ar­eas of the code (files, func­tions) where we in­struct the sys­tem to look, based on a mix of hu­man judge­ment and au­to­mated sig­nals. In the near fu­ture, we in­tend to in­te­grate this analy­sis into our con­tin­u­ous in­te­gra­tion sys­tem to scan patches as they land in the tree. Models are quite flex­i­ble with the form of con­text pro­vided, and we ex­pect patch-based scan­ning to work as well or even bet­ter than file-based scan­ning.

The cur­rent mo­ment is a per­ilous one, but also full of op­por­tu­nity. Let’s work to­gether to se­cure the in­ter­net.

FAQ

The an­nounce­ment said “271 bugs”, but I count some­thing dif­fer­ent. What’s go­ing on?

On the ad­vi­sories web page we group all in­ter­nally-re­ported bugs as “rollup” CVEs with mul­ti­ple bugs un­der­neath them. The web page is built from yaml in the foun­da­tion-se­cu­rity-ad­vi­sories repo, the canon­i­cal lo­ca­tion for our CVE as­sign­ments. While some browsers do not cre­ate CVE iden­ti­fiers for in­ter­nally-dis­cov­ered is­sues at all, we pro­vide this in­for­ma­tion in or­der to be as trans­par­ent as pos­si­ble.

In Firefox 150, there were three in­ter­nal rollups: CVE-2026 – 6784 (154 bugs), CVE-2026 – 6785 (55 bugs), and CVE-2026 – 6786 (107 bugs).

Astute read­ers will no­tice the num­ber of bugs in those in­ter­nal rollups adds up to 316, which is more than the 271 we an­nounced find­ing with Claude Mythos Preview. That’s be­cause our se­cu­rity team hunts for new bugs every day by at­tack­ing Firefox with a com­bi­na­tion of (a) fuzzing sys­tems (b) man­ual in­spec­tion and (c) this new agen­tic pipeline across a va­ri­ety of mod­els.

We fixed a to­tal of 423 se­cu­rity bugs in re­leases in April. In ad­di­tion to the 271 bugs an­nounced two weeks ago, there were 41 ex­ter­nally re­ported bugs, with the re­main­ing 111 dis­cov­ered in­ter­nally and split roughly in third be­tween:

Bugs found us­ing this pipeline with Claude Mythos Preview but fixed in re­leases other than Firefox 150

Bugs found us­ing this pipeline with other mod­els

Bugs found with other tech­niques like fuzzing

Note that we also di­rectly cred­ited 3 CVEs to An­thropic sep­a­rate from this lat­est ef­fort (CVE-2026 – 6746, CVE-2026 – 6757, CVE-2026 – 6758). These were fixes for bugs sent to us by the out­stand­ing Anthropic Frontier Red team a cou­ple months ago and we as­signed unique CVEs for each as per our nor­mal process.

What do se­cu­rity rat­ings mean?

As ad­di­tional con­text, we ap­ply se­cu­rity sever­ity rat­ings from crit­i­cal to low to in­di­cate the ur­gency of a bug:

sec-crit­i­cal and sec-high are as­signed to vul­ner­a­bil­i­ties that can be trig­gered with nor­mal user be­hav­ior, like brows­ing to a web page. We make no tech­ni­cal dif­fer­ence be­tween these, but sec-crit­i­cal bugs are re­served for is­sues that are pub­licly dis­closed or known to be ex­ploited in the wild.

sec-mod­er­ate is as­signed to vul­ner­a­bil­i­ties that would oth­er­wise be rated sec-high but re­quire un­usual and com­plex steps from the vic­tim.

sec-low is as­signed to bugs that are an­noy­ing but far from caus­ing user harm (e.g, a safe crash).

Of the 271 bugs we an­nounced for Firefox 150: 180 were sec-high, 80 were sec-mod­er­ate, and 11 were sec-low.

While we care most about crit­i­cal/​high bugs, it’s nor­mal for us to pri­or­i­tize mod­er­ate and low se­cu­rity bugs in or­der to fix cor­rect­ness is­sues and as a de­fense-in-depth mech­a­nism.

Is a sec-high or sec-crit­i­cal bug the same as a prac­ti­cal ex­ploit?

Not nec­es­sar­ily.

In most cases, a sin­gle crit­i­cal/​high bug is not ac­tu­ally enough to com­pro­mise Firefox. This is be­cause Firefox has a de­fense-in-depth ar­chi­tec­ture, so for ex­am­ple ex­ploit­ing a JIT bug only achieves re­mote code ex­e­cu­tion in a sand­boxed and site-spe­cific process. Real-world at­tack­ers gen­er­ally need to chain mul­ti­ple ex­ploits to­gether to es­ca­late priv­i­leges through one or more lay­ers of sand­box­ing along with OS-level mit­i­ga­tions like ASLR.

We also gen­er­ally don’t build ex­ploits to see whether a bug could be used by an at­tacker in the real world. We clas­sify sec-high based on pre­dictable crash symp­toms such as use-af­ter-free or out-of-bounds mem­ory is­sues be­ing re­ported by AddressSanitizer, and our threat model as­sumes that any of them could be ex­ploitable with suf­fi­cient ef­fort. This re­duces the risk of a false neg­a­tive dur­ing ex­ploitabil­ity analy­sis, and more im­por­tantly it al­lows us to fo­cus our re­sources on find­ing and fix­ing more vul­ner­a­bil­i­ties.

[1] Our bug bounty pro­gram has sim­i­lar rules. ↩

Distinguished Engineer, Firefox

More ar­ti­cles by Brian Grinstead…

Christian is a Firefox Tech Lead and Principal Engineer at Mozilla.

More ar­ti­cles by Christian Holler…

Frederik Braun man­ages the Firefox Application Security team. He builds se­cu­rity for the web and for Mozilla Firefox from Berlin. As a con­trib­u­tor to stan­dards, Frederik is also im­prov­ing the web plat­form by bring­ing se­cu­rity into the de­faults with spec­i­fi­ca­tions like the Sanitizer API and Subresource Integrity. When not at work, Frederik likes read­ing a good novel or go­ing on long bike treks across Europe.

More ar­ti­cles by Frederik Braun…

Meshtastic® is a pro­ject that en­ables you to use in­ex­pen­sive LoRa ra­dios as a long range off-grid com­mu­ni­ca­tion plat­form in ar­eas with­out ex­ist­ing or re­li­able com­mu­ni­ca­tions in­fra­struc­ture. This pro­ject is 100% com­mu­nity dri­ven and open source!

Client

Client

Client

Client

Router

Client

Client

Client

LoRa

Bluetooth

WiFi

USB

Features​

Long range (331km record by MartinR7 & al­leg)

No phone re­quired for mesh com­mu­ni­ca­tion

Decentralized com­mu­ni­ca­tion - no ded­i­cated router re­quired

Encrypted com­mu­ni­ca­tion

Excellent bat­tery life

Send and re­ceive text mes­sages be­tween mem­bers of the mesh

Optional GPS based lo­ca­tion fea­tures

And more!

How it works​

Meshtastic uti­lizes LoRa, a long-range ra­dio pro­to­col, which is widely ac­ces­si­ble in most re­gions with­out the need for ad­di­tional li­censes or cer­ti­fi­ca­tions, un­like ham ra­dio op­er­a­tions.

These ra­dios are de­signed to re­broad­cast mes­sages they re­ceive, form­ing a mesh net­work. This setup en­sures that every group mem­ber, in­clud­ing those at the fur­thest dis­tance, can re­ceive mes­sages.

Additionally, Meshtastic ra­dios can be paired with a sin­gle phone, al­low­ing friends and fam­ily to send mes­sages di­rectly to your spe­cific ra­dio. It’s im­por­tant to note that each de­vice is ca­pa­ble of sup­port­ing a con­nec­tion from only one user at a time.

If you are in­ter­ested in a more tech­ni­cal overview of how Meshtastic works, visit the overview sec­tion be­low:

Contributors​

Meshtastic is an open source pro­ject avail­able on GitHub. Our gen­er­ous vol­un­teers do­nate their per­sonal time to write and main­tain this code­base. If you would like to con­tribute see our GitHub, join our Discord server, and read up on our Meshtastic Discussions.

Start us­ing Meshtastic​

Hopefully your “Getting Started” ex­pe­ri­ence is straight for­ward and headache free. If you en­counter any is­sues, please con­sider up­dat­ing our doc­u­men­ta­tion to im­prove fu­ture user ex­pe­ri­ences or reach out on the fo­rum or Discord.

Our sup­port is 100% vol­un­teer based. We are pas­sion­ate about the pro­ject and hope to help new­com­ers be­come Meshtastic ex­perts!

Features

How it works

Contributors

Start us­ing Meshtastic

Male school stu­dents who bully oth­ers, in­clud­ing through cy­ber­bul­ly­ing, will face can­ing as a “last re­sort” un­der new guide­lines in­tro­duced in Singapore.

Male stu­dents can face up to three strokes of the cane un­der the new rules, which were dis­cussed in par­lia­ment on Tuesday.

International groups such as Unicef, the UN’s agency for chil­dren, op­pose the use of cor­po­ral pun­ish­ment for chil­dren, say­ing it harms their phys­i­cal and men­tal health, and in­creases be­hav­ioural prob­lems over time.

The ed­u­ca­tion min­is­ter, Desmond Lee, told law­mak­ers that can­ing would only be ap­plied “if all the other mea­sures are in­ad­e­quate, given the grav­ity of the mis­con­duct”.

“They fol­low strict pro­to­cols to en­sure safety for the stu­dent. For in­stance, can­ing must be ap­proved by the prin­ci­pal and ad­min­is­tered only by au­tho­rised teach­ers,” he said.

“Schools will con­sider fac­tors such as the ma­tu­rity of the stu­dent and if can­ing will help the stu­dent learn from his mis­take and un­der­stand the grav­ity of what he has done.”

The mea­sures fol­low a year-long re­view that fo­cused on bul­ly­ing, and come af­ter sev­eral high-pro­file school bul­ly­ing in­ci­dents drew pub­lic at­ten­tion last year.

Caning will only be used as a pun­ish­ment for male stu­dents in up­per pri­mary lev­els (age 9 – 12 years) and above, said Lee, who pointed to the coun­try’s crim­i­nal pro­ce­dure code, which pro­hibits the can­ing of women.

After the can­ing is im­posed, the school would “monitor the stu­den­t’s well­be­ing and progress”, in­clud­ing pro­vid­ing coun­selling, Lee said.

Female stu­dents, he said, would re­ceive pun­ish­ments “such as de­ten­tion and/​or sus­pen­sion, ad­just­ment of their con­duct grade and other school-based con­se­quences”.

Judicial can­ing, first in­tro­duced by British colo­nial­ists in the 19th cen­tury, con­tin­ues to be used in Singapore for male of­fend­ers un­der 50. This in­cludes crimes such as rob­bery, scam­ming or over­stay­ing a visa by 90 days.

A re­port re­leased by the World Health Organization last year said that cor­po­ral pun­ish­ment re­mained “alarmingly wide­spread” glob­ally, adding that it caused sig­nif­i­cant harm to chil­dren’s health and de­vel­op­ment.

Globally, an es­ti­mated 1.2 bil­lion chil­dren aged 0 – 18 years are sub­jected to cor­po­ral pun­ish­ment at home each year, ac­cord­ing to WHO.

In the orig­i­nal 1881 ver­sion, the book ended in chap­ter fif­teen with the pup­pet hang­ing dead from an oak tree.

Carlo Collodi se­ri­alised the story in Il Giornale per i bam­bini, the first Italian chil­dren’s mag­a­zine, be­gin­ning on July 7, 1881. The first in­stall­ment was ti­tled Storia di un bu­rat­tino — Story of a Puppet. Eight episodes later, over four months, the Fox and the Cat lured Pinocchio into a for­est at night, robbed him, and strung him from the branch of la Quercia grande, the Great Oak: gli legarono le mani di­etro le spalle, e pas­satogli un nodo scor­soio in­torno alla gola, lo at­tac­carono pen­zoloni al ramo di una quer­cia. He shut his eyes, opened his mouth, stretched his legs, gave one great con­vul­sion, and stayed there as if frozen stiff. Fine.

Collodi was done. He had col­lected his fee. Italian chil­dren wrote in beg­ging him to con­tinue. He re­sumed re­luc­tantly five months later, on February 16, 1882, with the ti­tle changed from Storia di un bu­rat­tino to Le avven­ture di Pinocchio and a Blue Fairy — first in­tro­duced as a lit­eral child-corpse with turquoise hair, ly­ing in a win­dow of a for­est cot­tage — ap­pear­ing in chap­ter six­teen to re­vive him.

The next twenty-one chap­ters are not gen­tler.

The cricket, killed

A talk­ing cricket ap­pears in chap­ter four to lec­ture Pinocchio about re­spect­ing his fa­ther. Pinocchio picks up a ham­mer from the work­bench and hurls it. The cricket ri­mase lì stec­chito e ap­pic­ci­cato alla parete — stuck flat to the wall, dead. He re­turns later as a ghost, but Collodi nar­rates the death with the dead­pan tone of a po­lice re­port.

The feet, burned off

In chap­ter seven, ex­hausted and freez­ing, Pinocchio falls asleep with his wooden feet propped on a bra­zier. He wakes up with no feet. Geppetto carves him a new pair the fol­low­ing morn­ing. There is no moral fram­ing of the loss; it is treated as an in­con­ve­nience.

The fairy, orig­i­nally a corpse

When she first ap­pears in chap­ter fif­teen she is con i capelli tur­chini, e il viso bianco come un’im­mag­ine di cera, gli oc­chi chiusi e le mani in­cro­ci­ate sul petto — turquoise hair, a face white as a wax ef­figy, eyes closed, hands crossed on the chest. She tells the pan­ick­ing Pinocchio she is dead and the bier is be­ing pre­pared. Only in later in­stall­ments does she be­come a liv­ing girl, then a fairy, then some­thing ap­proach­ing a mother.

The don­key-skin drum

Pinocchio runs away to il Paese dei Balocchi, the Land of Toys, where boys play games all day and never go to school. After five months they all turn into ac­tual don­keys, sold to cir­cuses. Pinocchio-the-donkey per­forms at one un­til he breaks his leg in an ac­ci­dent. The owner sells the don­key to a man who wants to make a drum out of his hide. The man ties a heavy stone to the don­key’s neck and throws him into the sea to drown. Inside the dead don­key, Pinocchio re­verts to wood and is then swal­lowed by un Pesce-cane — a dog­fish, a kind of shark, which Disney would later re­size into a whale.

This is, again, a chil­dren’s book.

Why it reads this way

Carlo Lorenzini — Collodi was a pen name, taken from his moth­er’s home vil­lage in Tuscany — was a satirist be­fore he was a chil­dren’s au­thor. He fought as a vol­un­teer in the Tuscan army dur­ing the Italian Wars of Independence in 1848 and 1860. In 1853 he founded the satir­i­cal news­pa­per Il Lampione, which was cen­sored and shut down by the Grand Duke of Tuscany. A year later he launched an­other, Lo Scaramuccia. His early books were a par­o­dic travel guide and a play of po­lit­i­cal ideas. He came to chil­dren’s lit­er­a­ture in his fifties be­cause the new Italian state was pay­ing for school read­ers, and a mag­a­zine com­mis­sion was steady money.

He wrote Pinocchio with the dead­pan irony of a man who thought most chil­dren’s lit­er­a­ture was sen­ti­men­tal rub­bish. The don­key-skin drum is meant to land as a joke at the ex­pense of every pre­vi­ous moral­is­ing chil­dren’s book in Italy. The cricket is a car­toon of every adult who ever lec­tured a work­ing-class boy on re­spect. The Land of Toys is a satire of the tru­ancy panic Italian school­mas­ters used to drum up. None of the cru­elty is gra­tu­itous, ex­actly. It is drama­tised ex­haus­tion with the genre.

How a satire helped teach Italians Italian

The legacy of the book has al­most noth­ing to do with the satire. It has to do with the lan­guage.

When Italy was po­lit­i­cally uni­fied in 1861, the lin­guist Tullio De Mauro’s clas­sic es­ti­mate is that only about 2.5% of the pop­u­la­tion spoke stan­dard Italian — roughly 630,000 peo­ple out of twenty-five mil­lion. The rest spoke a mo­saic of re­gional di­alects mu­tu­ally un­in­tel­li­gi­ble enough that a Neapolitan re­cruit could not un­der­stand a Piedmontese of­fi­cer. The new state needed a sin­gle shared lan­guage, and fast. They chose Tuscan, the lit­er­ary tongue of Dante and Petrarch — but most Italians had never heard Tuscan spo­ken in daily life.

What got Tuscan into or­di­nary Italian homes was school­books. Pinocchio be­came one of them. Collodi wrote in clean mid­dle-reg­is­ter Florentine Tuscan: short sen­tences, com­mon verbs, con­crete nouns — pane, naso, bu­gia, legno, fata, volpe (bread, nose, lie, wood, fairy, fox). The book ended up on every el­e­men­tary school syl­labus and stayed there. Generations of Italian chil­dren learned to read in the lan­guage Collodi had al­ready sim­pli­fied for them. By 1951, when De Mauro re-counted, the pro­por­tion of Italians who could speak stan­dard Italian had climbed from 2.5% to roughly 87%. Television fin­ished that job. Mass school­ing, with Pinocchio in it, started it.

Collodi him­self never knew. He died of a stroke in October 1890, eight years af­ter the book was com­pleted in print, with no idea he had writ­ten one of the most trans­lated books in hu­man his­tory. He had no chil­dren. The pup­pet he wrote re­luc­tantly to make rent has now out­lived him by a hun­dred and thirty-six years.

What it’s like to read now

What’s strange about read­ing the orig­i­nal to­day — not the Disney ver­sion, not even a trans­la­tion, the orig­i­nal — is that it does­n’t feel old. The Italian is plain enough that an early learner with a text­book be­hind them can fin­ish a chap­ter in a sit­ting. The plot moves at tele­vi­sion speed: thirty-six chap­ters of trou­ble be­fore the re­demp­tion fi­nally lands. The pic­tures are vivid, weird, and en­tirely Collodi’s: a piece of wood that talks back, a fox pre­tend­ing to be blind, a don­key at the bot­tom of the sea. You do not need a lit­er­ary ed­u­ca­tion to fol­low it. He was­n’t writ­ing for one.

Most trans­la­tions soften the book. Most adap­ta­tions cut the don­key-skin drum. Most adults who think they know Pinocchio are re­mem­ber­ing Disney. The book it­self is still the book Collodi re­luc­tantly ex­tended past chap­ter fif­teen be­cause Italian chil­dren would not let it end.

I’m one of the mak­ers of Storica, a daily read­ing club for the lan­guage you’re learn­ing. We adapt clas­sics — in­clud­ing the un­sani­tised Pinocchio, don­key-skin drum and all — into A0–B2 read­ings of about fif­teen min­utes a day, in seven lan­guages. The orig­i­nal Italian is on the shelf if you want it.