For decades,
black holes have carried a simple reputation: cosmic vacuum cleaners that pull
in everything nearby and never let go. New observations suggest that picture is
incomplete, and a little too tidy.
Astronomers led by Dr. Noel Castro Segura at the
University of Warwick tracked a stellar-mass black hole system called Swift
J1727.8−1613 through a dramatic outburst that began in 2023. Using the European
Southern Observatory’s Very Large Telescope, the team watched as the black hole
pulled gas from a nearby companion star, the classic feeding behavior everyone
expects. But it also expelled large amounts of that material back out through
powerful jets and winds, and kept doing so even after the outburst had visibly
faded.
That’s the surprising part. Black hole activity is
usually judged by brightness, how much light the infalling matter gives off as
it heats up. This system kept expelling gas at roughly the same rate it was
consuming material even after it had dimmed to about one-hundredth of its peak
brightness. In other words, the black hole looked like it had gone quiet, but
it was still actively processing and returning matter to its surroundings.
The findings help settle a longer-running debate in
astrophysics about whether black holes eject material through jets (narrow,
fast-moving beams) or winds (broader, slower outflows), or both at once, and
under what conditions. Earlier work on a different system had suggested jets
and winds were mutually exclusive, only one active at a time. The Warwick
team’s data on J1727 offers a rare direct measurement showing outflow can
roughly match inflow even at low accretion rates, a number theorists need to refine
their models of how black holes shape the galaxies around them.
It’s a small but telling correction to a story we
thought we already understood: black holes aren’t just consuming machines.
They’re closer to a digestive system, taking in, processing, and returning a
surprising share of what they catch.
Source:
University of Warwick / ESO, published July 31, 2026, in Monthly Notices of the
Royal Astronomical Society.
The custom-made hardware device plugged
into a connector (center) acts as a third party that takes over between the
communications from key computers in the cockpit (left) and the flight
management computer (right). Credit: University of California San Diego
Physical
access to an aircraft has not typically been considered a cybersecurity
risk—but it should be, according to a team of computer scientists at the
University of California San Diego. In a paper presented Aug. 13 at the USENIX Security Symposium in Baltimore, Maryland, former UC San Diego
Ph.D. student Sam Crow showed that physical access to an aircraft, even for a
brief period, would allow an attacker equipped with a custom-made hardware
device to take over communications between two key onboard computers.
The device needs to be plugged into a
port inside the plane's belly—an action that the researchers estimate would
take less than 60 seconds. This would require access to the aircraft either
when it is parked at a gate or in an airport hangar during regular maintenance.
Access to these areas is carefully controlled but not always successfully, the
computer scientists note in the new paper.
The researchers successfully
demonstrated the attack on a test bed made of actual Boeing 737 airplane parts
and software. The proof-of-concept attack allowed researchers to change the
plane's flight path and alter data that could make takeoff conditions unsafe.
But they are careful to note that the attack requires someone to do significant
planning and engineering work ahead of time. The research team communicated
closely with Boeing, disclosed the vulnerability in 2020, and further tested
and validated its findings in Boeing's own lab.
Of note, the Boeing 737 is one of the
most commonly used aircraft in commercial aviation, with 8,000 in service
today. It makes up about 25% of Delta's existing fleet, 38% of American's, 53%
of United's and all of Southwest Airlines' fleet. However, while the team's
implementation is designed specifically for the Boeing 737, the researchers
believe their findings are relevant to the aviation industry more generally.
"Our goal with this research is to
alert the aviation community to this class of risks, so they may be
appropriately mitigated well before they become dangerous. All of the authors
of this paper routinely travel on Boeing 737 aircraft and expect to continue
doing so," said UC San Diego computer scientist and cybersecurity expert
Aaron Schulman, one of the senior authors of the work.
The research team was led by Schulman
and Stefan Savage, both professors in the UC San Diego Department of Computer
Science and Engineering.
The researchers designed, built and
programmed a small hardware device, which acts as a third-party entity that
takes over two key computers on a 737 aircraft. Credit: University of
California San Diego
This computer that displays this path
information, along with other critical flight data for the pilots in the
cockpit. The screen displays "bus driver" to show that the
researchers have control of it. Credit: Erik Jepsen/University of California
San Diego
How does the attack work?
The researchers discovered an
unused maintenance port in the plane's Electronics and Equipment Bay, which
houses key electronic systems. This bay is located just under the plane's nose,
can be reached from the ground and is not locked. The maintenance port provides
access to data transmitted between two critical onboard computers.
One computer
is the flight management computer, which controls the plane's flight path and
approach path before landing and supplies critical information during takeoff.
The other is the computer that displays this flight path information, along
with other critical flight data, for the pilots in the cockpit. Information and
instructions to and from these two computers are carried by hardwired
communication systems known as buses—in this case, two ARINC 429 buses, which
were invented in 1977.
Buses, like
the ARINC 429, convey data via current flowing through two wires and a set of
resistors. Because the system is decades old, it does not have data security
features, such as message authentication.
The
researchers designed, built and programmed a small hardware device that acts as
a third-party entity and takes over these buses. It does so by driving more
current, allowing it to override any legitimate transmissions with its own.
This approach allows the device to covertly transmit new instructions to the
flight management computer while suppressing indications that changes have been
made.
Using their proof-of-concept
demonstration, the researchers showed that their implant could reroute a plane
in flight or modify data about weight, balance and temperature, which could
lead to an unsafe takeoff. While pilots could override such changes, they would
need to detect that a compromise had occurred.
"We believe we have made a strong
case that time-limited physical access (e.g., 60 seconds) represents a
realistic goal for a motivated attacker and that the consequences of even such
short access can be significant (and hence worthy of attention)," the
researchers write.
