• Geekom has admitted a software driver contained malware
• A LAN driver on a legacy page was hosting the Asruex backdoor
• The malware can track keystrokes, steal passwords, and intercept data

Hardware maker Geekom has admitted that a network driver for multiple mini PC variants hosted Asruex backdoor malware, potentially putting users at risk

The LAN driver for Geekom’s range of A7, A8, AE7, AE8, AX7 Pro and AX8 Pro mini-PCs hosted the malicious package with administrator-level permissions that allowed it to monitor everything you type, steal data, and even swipe passwords from your machine. The malicious software also connects to a command and control (C2) network to send and receive information from hackers.

Geekom has issued an apology and removed the software package in question, but if you have a Geekom mini PC from the aforementioned range and have installed the LAN driver, I’d definitely recommend doing a full system virus scan, with a wipe and reset just to be sure.

Geekom ships malware-riddled LAN driver

Videocardz first broke the story after investigating claims from a Reddit user who reported finding a malicious executable file contained within the LAN driver.

Videocardz then independently investigated the claim using FileScan.IO, MetaDefender VirusTotal, and YARAify. Each antivirus engine detected the executable as malicious.

In Geekom’s statement about the malicious file, the company said that the driver was hosted on a “legacy page [that] had already been replaced and was no longer accessible through the normal Support navigation, although it remained indexed by search engines.”

So when users searched for the LAN driver using Google, the result that came up was the malicious file. I always recommend users install drivers and other software from the official distributor rather than using Google listings as hackers can use tactics such as SEO poisoning or promoted pages to offer dodgy software. But in this case the legacy page was official.

Geekom has confirmed that none of its mini PC range were shipped with the malicious driver preinstalled, so if you haven’t directly downloaded the malicious software from the legacy page, you should be okay. But consider running a Windows Defender scan to be sure.

In order to guarantee that your mini PC is free of the malicious driver, perform a complete wipe and reset of Windows, and install a new Windows image direct from Microsoft’s official page. Going forward, only install software and drivers from the official support pages of the manufacturer.

• Heights Finance breach exposed sensitive customer data via a compromised third‑party cloud platform
• Stolen records included contact details, financial info, and government identifiers
• Over 700,000 Texans affected; company offers credit monitoring and identity protection

US loan company Heights Finance has revealed it suffered a cyberattack earlier in 2026 in which it lost sensitive data on hundreds of thousands of its customers.

The company published a data breach notification on its website, disclosing that on May 7 2026, it saw an “unauthorized actor” gaining access to a cloud-based platform, hosted by a third party, which the company uses to store certain customer data.

The breach was limited to that cloud platform only and did not affect its loan management system, or other systems and networks.

At least 700,000 victims

As is standard practice in these incidents, Heights Finance notified the relevant authorities and brought in outside cybersecurity help.

The subsequent investigation determined that the attackers - which were not named - stole contact details (names, postal addresses, phone numbers, email addresses), financial information (account details, bank account information such as bank name, account number, routing number), government identifiers (Social Security numbers, tax IDs, driver’s license numbers), and other miscellaneous data.

“Your information may be involved if you received a loan through Heights, or if you inquired about or applied for a loan product (including through a third party),” the company said. “Your information may also be involved if you were a former borrower of Curo Management or any of its former or current related brands.”

The exact number of affected individuals is not known at this time. Heights Finance told regulators in Texas that the breach affected more than 730,000 of its residents, and added that it affected those living in Alabama, Tennessee, Georgia, Texas and South Carolina.

We don’t know which cloud-based platform Heights Finance is using, and the threat actors are yet to claim responsibility for the attack. In the meantime, the company is offering affected customers credit monitoring and identity protection services through Epiq.

Via The Record

• Windows 11's right-click menu has some big changes in testing
• This context menu is being streamlined and is now more responsive
• You can also customize the entries in the menu, or even switch it to be like Windows 10's version

Microsoft is finally streamlining Windows 11's context menu — the one which pops up when you right click something on the desktop — as well as bringing in more customization choices.

In a blog post for a new preview build in the Experimental channel, Microsoft announced that it's rolling out a redesigned context menu for File Explorer (meaning the files and folders on your desktop).

It's "designed to feel faster, cleaner, and easier to tailor to the way you work", and Microsoft has made two major improvements here.

Firstly, the right-click menu is a lot less cluttered, with far fewer options now appearing in the list by default (building on some previous work along these lines). On top of that, there's new functionality in Windows 11's settings, enabling you to customize what appears in the context menu.

Windows Central reports that it has tried this revamped right-click menu, and that it's not just trimmed down, but also faster to load (no doubt reducing the bloat has helped to improve performance).

You can also choose to have a Windows 10-style context menu, where the elements at the top in the horizontal panel (cut, copy, rename and so forth) are integrated into the vertical menu list (removing the top panel, essentially).

It's possible to ditch any entry you don't want from the menu, too, so gone are the days when you installed a third-party app and it annoyed you by placing itself in the context menu when you didn't want that to happen. You can now simply banish the offender.

Analysis: it's about time

In my opinion, you should have been able to tailor the right-click menu to your own preferences right from the very off in Windows 11. Or at least you should have been able to remove the likes of third-party additions to the menu, even if Microsoft kept the core defaults set in stone.

Still, Microsoft has improved the context menu immeasurably here, and the more responsive performance is great to hear about. Windows 11 users have long complained that it's ridiculous that right-clicking on something could mean a delay of a few seconds before the menu actually appears. This is a basic piece of interface functionality, and not one that should be running slowly on an average PC.

Bear in mind that this is just in testing for now, so this new layout and options may take some time to arrive in the full version of Windows 11. That'll likely happen later this year, although you can't be sure whether Microsoft will keep everything as it is now (some choices could be scrapped, changed, or more might be added, even).

For now, a good many Windows 11 users are impressed by this work, but there are some who, like me, are still a bit sore about it taking so long to happen. One Redditor said: "They had 5 years to do that. Better late than never I guess."

There are others who have already left Windows 11 behind and can't resist making it clear that they won't be coming back, no matter how far Microsoft takes its drive to fix Windows 11. This Redditor observed: "Too little too late, I will refuse to ever go back to MS," adding that: "They've lost me and everyone who listens to me for IT advice."

Others point out that the performance work to fix Windows 11's sluggishness is a decision driven by necessity and the RAM crisis. Someone else on Reddit pointed out: "Probably has a lot more to do with having to figure out how to get Windows 11 working on 8GB of memory since they can't control the price of memory."

And another Redditor replying to that agreed, saying, "This is exactly why this is happening. All the 'fixes' started after they announced 8GB Surfaces."

It's easy to be overly negative on Windows 11, yes, but responses like these are ultimately Microsoft's fault, and a result of the attitude it has shown with the development of the operating system through the years.

With that said, it does very much feel like a fresh leaf has been turned over, and I'm very happy that this is the case. Hopefully Microsoft can apply changes to Windows 11 that'll continue to surprise us, and make this desktop OS a more enticing prospect — although it's unlikely those more disgruntled Linux defectors out there will ever be tempted back.

• Hacker “TheHatman” claims to have stolen millions of Azure/Entra employee records from major firms
• Data includes names, emails, job titles, privileged accounts; risks include impersonation and fraud
• Victims dispute scope, but researchers say infostealer‑based theft makes the leaks likely authentic

A cybercriminal is selling millions of user records on the dark web, which they claim to have stolen from large organizations such as McDonalds, Tata Consultancy Services, and Wyndham Hotels.

A hacker going by the alias “TheHatman” posted multiple threads on dark web forums, claiming to have stolen information from Azure and Entra environments.

TheHatman said they broke in using compromised login credentials, targeting almost a dozen organizations.

What was stolen and from whom?

Among the victims and the number of records exposed, are:

McDonald’s Corporation: 1,700,000 records
TCS (Tata Consultancy Services): 800,000 records
Vodafone: 425,000 records
HCL Technologies: 250,000 records
InterContinental Hotels Group (IHG): 185,000 records
Kyndryl: 170,000 records
Gap Inc.: 80,000 records
Hexaware Technologies: 20,000 records
Wyndham Hotels: 9,000 records

They are now looking for a buyer: “I’m selling McDonald’s Corporation internal employee dump downloaded directly from Azure Tenant using compromised credentials,” TheHatman said in one of the posts.

In their writeup, security researchers from Cybernews said they analyzed one of the samples posted on the dark web and said the entries were “consistent with Azure directory exports”.

They contained employee names, emails, phone numbers, job titles, workplace addresses, IDs, the departments they work in, user group memberships, service accounts, and highly privileged account records.

What are the risks?

Stealing information such as names, email addresses, and workplace details might not sound like a worrisome breach of privacy, but the implications are rather big. Cybercriminals can use it to impersonate a business partner or a major client, and try to trick their employees into installing ransomware, or making a fraudulent wire transaction. That way, they can escalate what seems like a relatively benign breach, into a full-blown cyberattack with material and legal consequences.

For example, a criminal might discover a Vodafone employee that regularly handles payments to a particular supplier. They might impersonate that supplier’s finance director, engage in conversation and, while requesting a new payment, warn that the company changed their bank account. This is not a purely theoretical scenario - it’s been documented time and time again.

What did the victims say?

Most organizations are yet to give an official statement about these claims. Gap told BleepingComputer that it found no evidence of the breach and suggested that the attackers merely repackaged data from an older incident.

“Our preliminary investigation indicates that the data in question is limited in scope, non-sensitive and dated back to several years ago. Notably, there is no evidence to suggest that our corporate systems have been compromised,” Gap told the publication.

Tata Consultancy Services notified the Indian National Stock Exchange about the breach last week, also suggesting that this was a resurfacing of an older incident.

“The Company has investigated the matter and has not found any credible evidence of a breach of TCS systems or customer environments,” TCS said in the filing. “The information referenced appears to be more than four years old and limited to basic employee information. There is no indication that customer data, customer systems, or TCS operational systems have been impacted.”

TCS said the attackers broke in using credential stuffing, something that could have only been done years ago: “The attacker claims to have used password spray and Multi-Factor Authentication (MFA) fatigue as the attack vector. The Company has had strong safeguards in place against such techniques for more than two years.”

Not everyone agrees with that assessment, though. Security researchers Hudson Rock believe the attackers stole login credentials with an infostealer, rather than through password spraying.

“Judging by the massive size of the organizations impacted, it appears highly likely that this campaign originates from targeted exploitation of Infostealer infections rather than a systemic zero-day vulnerability in Azure,” the researchers said in their report. “If this were a widespread vulnerability, we would likely see a much broader spectrum of organizations impacted, including smaller businesses, rather than just these massive Fortune 500-level enterprises.”

Hudson Rock also described the stolen data as “likely highly authentic”, hinting that just because it’s older, it doesn’t mean it’s not useful.

• Pokémon Center UK orders disrupted after CEVA Logistics cyberattack on July 30 2026
• Customer names, addresses, emails, and order details likely exposed, but accounts and payments safe
• Around a dozen organizations confirmed affected; no group has claimed responsibility yet

Customers who recently ordered their favorite Pikachu toy from Pokémon Center might have to do it all over again, since the company suffered a third-party cyberattack which disrupted its operations.

The official store for Pokémon merchandise in the UK has reached out to its customers via email to warn them about a recent cyberattack and its consequences.

According to BleepingComputer, which has seen a copy of the email, the company told its customers they had to “cancel your recent order due to an unforeseen fulfilment issue”.

CEVA Logistics

The company’s website is also showing a notification saying the company is “currently experiencing delays affecting some orders for our UK customers.”

“These orders may take longer than usual to process, dispatch, and deliver. We apologize for the inconvenience and appreciate your patience.”

The company said the attack struck its logistics provider, CEVA Logistics.

"CEVA Logistics, the vendor Pokémon Center utilizes to ship products from PokemonCenter.com for customers in the United Kingdom and Germany, has informed us that unfortunately they were a victim of a cyber attack commencing on 30 July, 2026."

Last week, one of the biggest shipping and logistics companies in the world disclosed an incident that forced it to shut down parts of its IT infrastructure and affected eight warehouses. At the time, a handful of its customers reported being affected by the breach, including Dutch retailers Bol and De Bijenkorf, and PC gaming powerhouse Valve.

Pokémon Center said the data most likely exposed in this incident includes people’s full names, mailing addresses, phone numbers, email addresses, and details about what they previously ordered on the site. User accounts are apparently safe, and so are payment details.

So far, around a dozen organizations are confirmed as having been affected. No threat actors have claimed responsibility yet.

Keychron K8 Ultra 8K: One-minute review

The Keychron K8 Ultra 8K is a wireless mechanical keyboard with an impressive spec that hopes to compete with the more premium offerings in the space.

It exhibits the brand’s typical design language, with its sizable keycaps and retro looks. The whole unit is black, save for some grey and green keycaps. To liven things up, it features some bright backlighting with plenty of customization options, although the keycap legends aren’t transparent, so it doesn’t illuminate them. This makes them harder to see in dark environments, which somewhat defeats the backlight’s purpose.

The board base is very thick, which means you have to angle your wrists considerably to reach the tall keys. It’s in dire need of wrist support, which is an oversight since a lot of the best keyboards come with a rest. It’s also quite heavy, thanks to its metal construction. This does help to keep it planted, though, and it’s as solid as you would expect it to be.

To customize the inputs of the K8 Ultra 8K, you’ll have to use Keychron’s Web Launcher. Here you’ll find a reasonable selection of rebinding options, and there’s also a basic but functional SOCD function for altering key priority. It’s a relatively easy app to use, and despite being web-based, it’s quick and responsive; I didn’t encounter any disruptive loading times during my time with it.

In action, the K8 Ultra 8K performs well. The keys are sufficiently damped, although some clickiness remains, which can be a little harsh at times, but mostly they’re satisfying to use. They’re snappy and responsive, too, while being forgiving of accidental nudges. The indents and shape of the keycaps are comfortable and offer a secure hold.

However, the switches of my review unit didn’t have the smoothest of motions. The keys are also spaced quite far apart, which can make reaching certain inputs a stretch. What’s more, the aforementioned angle your wrists are forced to adopt can lead to strain after short periods. I had no issues with connecting the K8 Ultra 8K via 2.4GHz or Bluetooth, and switching between them was quick and easy.

The K8 Ultra 8K is a reasonable price when you consider all that it offers. There are certainly much dearer mechanical keyboards, such as the Razer BlackWidow V4 Pro 75%, but there are also cheaper ones, such as the MonsGeek FUN60 Ultra. However, the K8 Ultra 8K remains a solid choice if you like a substantial board — just pair it with a wrist rest.

Keychron K8 Ultra 8K review: Price & availability

• $119.99 (about £90 / AU$170)
• Available now in three switch types
• Good price for a wireless mechanical keyboard

The K8 Ultra 8K costs $119.99 (about £90 / AU$170) and is available now from Keychron’s website, with shipping rates varying according to region. It can be had with a choice of three switch types: Red, Brown, or Banana. It comes with a braided USB cable, several spare keycaps, and a keycap puller.

This is a good price for a wireless mechanical keyboard with hot-swappable switches. Similar models from bigger names can cost considerably more, such as the Razer BlackWidow V4 Pro 75%. However, the performance of that board is far superior, being perhaps the best mechanical keyboard I’ve ever tested. Its switches are a joy to press, while the companion software offers more customizations and tweaks.

If you’re after a more budget-friendly gaming keyboard, the MonsGeek FUN60 Ultra is hard to beat for value. It has a surprisingly high-quality design, while its analog switches feel almost as good as mechanical ones, with added actuation adjustments.

Keychron K8 Ultra 8K review: Specs

Keychron K8 Ultra 8K review: Design & features

• Retro look
• Solid, thick, and heavy
• Reasonable web app for customizations

The K8 Ultra 8K adopts Keychron's signature aesthetics, which is to say it has a thick base, tall keycaps, and a black colorway. However, there are a few grey peripheral keys, as well as a green Escape key, to add some contrast.

Allied to its thick chassis is a substantial weight. This helps the K8 Ultra 8K to stay planted, but makes it a chore to move around frequently. Build quality is also impressive, with its metal frame feeling as solid as you would expect it to feel, while the keycaps have only a hint of play.

What’s disappointing about them, though, is their opaque symbols. This means the vivid RGB backlighting doesn’t get a chance to shine through them; in fact, it can actively obscure them in dark environments, which defeats at least part of the backlighting’s purpose. Fortunately, it still shines through the spaces between the keys, and there are plenty of customizable patterns for it.

Like some other Keychron models, the K8 Ultra 8K’s USB port is located on the left side of the unit, rather than at the back. This is an interesting location and can help to reduce the cable interfering with deskspace, depending on your particular setup. The included cable’s jack protrudes slightly from the side, but since it’s L-shaped, it's actually quite discreet. This shape also helps the cable to naturally follow a path less intrusive to deskspace.

Keychron doesn’t offer a downloadable app for the K8 Ultra 8K; instead, you’ll have to use the Keychron Web Launcher via a browser. Quite often, such web apps can be slow and awkward, with frequent loading times and connectivity issues. However, I found Keychron’s fast and easy to use.

What’s more, it offers a reasonable amount of customization. Besides standard key assignments, there are quite a few shortcuts for various system commands and media controls. There’s also a SOCD feature with three different modes, as well as a section for altering the bounce (more commonly referred to as debounce) times of key presses and resets, with sliders for each ranging from 10ms to 50ms, with single millisecond increments selectable.

Keychron K8 Ultra 8K review: Performance

• Tactile and damped switches
• Snappy yet forgiving
• Uncomfortable thickness

True to its mechanical nature, the K8 Ultra 8K is quite a satisfying board to use. The Brown Tactile switches in my review unit were sufficiently damped, though there was some clickiness to them. For the most part I liked this aspect, although hard presses can feel a little harsh. Worse is the roughness of their motion as they travel, which doesn’t feel particularly pleasant. Fortunately, this doesn't completely sap the joy out of presses, and it didn’t affect my performance in any significant way.

The switches are also quite snappy, requiring only a light touch to actuate. Better yet, they’re forgiving at the same time: whenever I accidentally grazed a key I didn’t intend to hit, often it wouldn’t register. This combination makes it ideal for fast typing.

The keycaps themselves are comfortable, thanks to their ergonomic indents, which also provide security. This comfort extends to the space bar, which I could easily hit flush when in the WASD position. That’s not something I can say about every space bar I’ve experienced.

Less comfortable, however, is the wide spacing of the keys. I often welcome this aspect, but I found it too great on the K8 Ultra 8K. Reaching certain keys was a stretch, especially when touch typing, or when trying to reach certain peripheral keys such as R and T when gaming in the WASD position.

The aforementioned thickness of the chassis also creates issues. Combined with the tall keycaps, this means you have to angle your wrists to a large degree, and what’s more I frequently caught my fingers on the edges of keys as I glided around them when typing. I’m not sure I’ve come across a keyboard in more desperate need of wrist support.

On the issue of connectivity, I had no qualms with the K8 Ultra 8K. It connected to my Windows PCs with ease via both Bluetooth and the 2.4GHz dongle. Hot-switching between these devices was also quick and easy, merely requiring the flick of switch on the side of the unit.

Should I buy the Keychron K8 Ultra 8K?

Scorecard

Buy it if…

Don't buy it if…

Keychron K8 Ultra 8K review: Also consider

How I tested the Keychron K8 Ultra 8K

• Tested for a few days
• Used for a variety of tasks
• Plentiful keyboard experience

I tested the K8 Ultra 8K for a few days, during which time I used it for gaming, working, and general browsing.

One of the games I played was Counter-Strike 2, as it serves as the ideal test for peripherals, since it demands fast and precise inputs.

I’ve been using gaming keyboards for years, and reviewed a great number of them, including other Keychron models as well as those from well-known brands like Razer, SteelSeries, and Corsair.

• First reviewed: August 2026
• Read more about how we test

• Firefox’s iOS app comes with a new built-in ad blocker
• It stops all kinds of ads, but there are some exceptions
• The move could convince me to finally switch from Safari

I’ve been a loyal Firefox user for 20 years now, but that’s only been true for the desktop app. Despite Firefox being one of the best web browsers around, I’ve resolutely stuck with Safari on my iPhone — but a new Firefox feature could finally convince me to make the switch on mobile.

In a support document, Firefox developer Mozilla explains that its browser now comes with an “experimental” ad blocker that is based on the EasyList filter, allowing Firefox to “block many ads before they load.”

The ad blocker puts a stop to a variety of advertising types. That includes third-party advertising networks, ad-related trackers, third-party ads served on websites, and more intrusive formats such as pop-ups and overlays.

The feature is being rolled out gradually and is disabled by default, but you can enable it by opening Firefox, tapping the '…' button, then selecting Settings. From there, go to Browsing and enable the toggle next to Ad Blocker. Alternatively, you can enable it by opening the app menu when browsing a web page.

It’s worth noting that there are a couple of exceptions to what the feature blocks. For one thing, it won’t stop sponsored content on the Firefox Home or New Tab pages, nor will it block search engine ads, as these are both sources of income for Mozilla.

As well as that, Mozilla warns that some ads might slip through the net because “some websites serve ads in ways that are not covered by the current filter list".

Finally making the switch

Although Safai on iOS can block website pop-ups, it doesn’t have a built-in ad blocker and requires you to use a third-party extension if you want to shut down annoying ads. With Firefox gaining this functionality natively, Mozilla has given its browser a leg up over the competition — and has given me a strong reason to switch.

And since I’m a strong believer in user privacy — its robust privacy stance is one reason why I’ve stuck with Firefox for so long — this is exactly the type of feature that appeals to me. Given how invasive ads and trackers are, blocking them is a priority for me.

I’ve long stuck with Safari due to inertia. I have a lot of tabs open on Apple’s browser and don’t want to lose most of them. But with my beloved Firefox adding a built-in ad blocker on iOS, tab hoarding feels like a bad reason to stick with Safari.

Now could be the time to finally kick that inertia and make the switch. If you hate website ads and want to look out for your privacy, Firefox just gave you a great reason to give it a try.

One trillion dollar bills could wrap around the Earth almost three times, which means the $1.4T in fines Meta could face if it loses the huge, multi-state lawsuit arguing that the company's social media and the technology behind it encouraged addictive use in teens is more than enough financial rope to potentially squeeze it into submission or worse.

Opening arguments in the case kick off tomorrow (August 18), with Meta founder and CEO Mark Zuckerberg and Instagram CEO Adam Mosseri expected to testify.

The suit[PDF], which is in some ways the culmination of numerous cases against Meta and its alleged practices, comes on the heels of multiple legal setbacks for Meta. In March, Meta lost a case in LA Superior Court and was, along with YouTube, found negligent in causing a 20-year-old's mental health issues. That ruling came a day after Meta lost a similar case in New Mexico. Just a few weeks ago, the company was ordered to pay almost half a billion dollars after Meta's platforms were found to be, at least according to New Mexico law, a public nuisance.

This latest case, though, might not only change the face of social media but also seriously hamper Meta's ability to function.

As in other cases, AGs across 32 US states argue that Meta has used its technology to hook teens (and younger), lock them into using the platforms, and then, it argues, ignored the potential harms.

Here's how the lawsuit puts it:

"Meta has harnessed powerful and unprecedented technologies to entice, engage, and ultimately ensnare youth and teens. Its motive is profit, and in seeking to maximize its financial gains," and "it has ignored the sweeping damage these Platforms have caused to the mental and physical health of our nation’s youth. In doing so, Meta engaged in, and continues to engage in, deceptive and unlawful conduct in violation of state and federal law."

Meta, which has spent the last few years updating its parental controls across all its platforms and marketing those changes to the public, calls the AGs' claims "unsubstantiated" and the potential penalties "vastly disproportionate."

It then adds:

"The AGs offer no proof anyone in their states was misled, claim benign features like having an additional Instagram account somehow harmed their residents, and attempt to penalize Meta for industry-wide challenges like age verification. Rather than sticking to the facts or the law, the states have instead decided to chase an outlandish payout. We stand by our record of creating strong protections for teens, and look forward to making our case in court."

So there you have, in a nutshell, the two sides, but while Meta is putting on a strong front, I don't imagine Zuckerberg and Mosseri will enter the courtroom feeling particularly confident about their chances.

The changing social media landscape

Ever since prosecutors shifted their efforts from trying to prove that Meta and other social media companies were responsible for the online content that appears on their platforms to how each company built these systems and all the ways they engineered them to keep us swiping and engaged, they've been on a winning streak.

And that's probably because it's more provable.

During the golden age of social media, when it was Facebook versus YouTube, versus Twitter, versus Snap, there was no more important metric than monthly active users. Meta (formerly just called Facebook) often touted user numbers and how growth was spreading around the globe. When Facebook surpassed 1 billion global users, Zuckerberg said the milestone was "amazing, humbling and by far the thing I am most proud of in my life.”

That scale also built Meta's value, since it could monetize those eyeballs through ads. It's no secret that, no matter your age, the more time you spend on the platform, the more ads you see and the more money Meta makes.

Even though Facebook's early format was more or less a meritocracy of content, it shifted in 2007 with visual updates organized by Edgerank, a basic algorithm that ranked content based on interactions, what you were likely to look at, and ongoing popularity.

More sophisticated algorithms followed, essentially feeding you more and more of what you'd most likely want to see or would like (to the exclusion of other content), helping further extend time on Facebook and Instagram. It's only in recent years that Meta has given users control of some of those algorithms so they could tailor the content of their feeds.

Of course, that's the current environment, and while these lawsuits want to force more changes, like the end of endless scrolls, their main contention is that Meta built its platforms to addict users and then, they claim, ignored warning signs (even within the company) that Instagram and Facebook might be harming youth and teens.

The intent wasn't harm but was it neglect?

I've never believed Meta intended to harm anyone, but I am convinced its top priority was growing the platform, and it used every tool at its disposal to do it.

It's also incontrovertible that some children and teens have been harmed by social media (Meta is not alone in this). Even Zuckerberg appears to agree with this in some form.

During a 2024 congressional hearing over social media's alleged harms, Zuckerberg (and other social media CEOs) stood up, turned to face parents in the gallery, and offered this apology:

"I’m sorry for everything you have all been through. No one should go through the things that your families have suffered, and this is why we invest so much, and we are going to continue doing industry-wide efforts to make sure no one has to go through the things your families have had to suffer.”

It appeared to be an admission, if not of wrongdoing, that perhaps Meta and other social media companies had not done enough to protect young people on their platforms.

I don't expect an apology this time. Instead, Zuckerberg and Mosseri will offer a full-throated defense and, as noted, bring up all the ways these platforms have adjusted to give parents and teens more control.

Even so, Meta could lose, and if so, the AGs will see that $1.4T penalty, which, unsurprisingly, more or less matches the company's current market capitalization.

A loss could push Meta into a difficult financial situation that might result, if not in closure or bankruptcy, at least in a fundamental change in how it operates online. Imagine, for instance, having to pay a monthly subscription fee to use Instagram, Facebook, and WhatsApp, or, at the least, Meta introducing an ad-free subscription tier. Prices of the VR hardware could go up.

Finally, Meta might abandon children and teens as a potential market and shift its marketing efforts to adults only.

That seems unlikely, but I promise you a loss will trigger some kind of change.

Meta will ultimately sense if and when the case is slipping away from it and get to work on an out-of-court settlement. It'll still pay, but instead of over a trillion dollars, it'll be, say, $2 billion or so, devoted to supporting mental health services for teens, and some money parceled out to Meta's billions of US-based users.

That should mark the end of this chapter...until the next lawsuit.

As someone who writes about tech deals for a living, I was amazed to see a deal on TikTok that claimed you could get a MacBook Neo for only $119.99. That's a shocking discount, so much so that I thought there had to be strings attached, or maybe it was just too good to be true. And it was.

The $119 MacBook Neo offer, claimed as a "back-to-school deal," was a scam. Advertised on TikTok and Instagram as a real deal at Target, but the retailer has no such discount or promotion.

When you click on the offer, it takes you to a third-party website that promises up to $750 in Target gift cards if you complete 3 to 5 partner deals that include offers, trials, and sign-ups. Generally, if you have to jump through those hoops, it's a good sign it's a scam.

This scam has become viral because who wouldn't want Apple's shiny new MacBook Neo for only $119? Ever since the price hike on Apple's MacBooks in July, you couldn't find Apple's budget MacBook for under $699.

The 13-inch Neo is Apple's cheapest MacBook on the market, yet it's packed with premium features, including a 13-inch Liquid Retina display, Apple's powerful A18 Pro chip for speedy performance, and AI capabilities. In our MacBook Neo review, we called it 'the best budget laptop you can buy right now', praising its design, build quality, and performance for the price.

While direct discounts are sparse, I've listed today's best deals on the MacBook Neo, including a trade-in offer and a free Starbucks gift card at Best Buy, a $10 price cut from Amazon, and Apple's popular $100 education discount for students and teachers.

Today's best discounts on Apple's MacBook Neo

• Akira ransomware tried Safe Mode boot to disable defenses but broke its own encryptor
• Defender later flagged and quarantined payload, leaving attackers with only stolen data
• Huntress advises VPN brute‑force alerts, MFA, SIEM logging, and Safe Mode monitoring

A recent ransomware attack saw the operators Akira (figuratively) shoot themselves in the foot - and they still walked away with sensitive data, albeit limping.

Akira is a well-known ransomware group, considered one of the most active cybercriminal organizations on the internet. Its modus operandi is simple in theory: they look for an exposed VPN instance (for example, one with a default or weak password), access the domain controller, enumerate Active Directory, steal sensitive data, and deploy an encryptor.

With the encryptor they leave a ransom note, instructing the victim to reach out and negotiate a payment in exchange for the decryption key and for deleting the stolen documents and information.

However, in a recent attack, they tried to first disable the device’s antivirus and endpoint detection and response (EDR) solutions. The process backfired, resulting in the security solutions successfully spotting and quarantining the encryptor.

The good and the bad of Safe Mode with Networking

A new report published by security researchers Huntress said that after establishing persistence on a device, Akira rebooted it into Safe Mode with Networking. This Windows startup mode boots the OS with only the essential drivers and services, excluding important components such as antivirus programs or EDR agents. At the same time, it grants internet access which, for Akira, is the perfect combination.

“This means Defender real-time protection was down too,” Akira explained. “For the entire Safe Mode window, the host had no working EDR, and AV was blinded. This is MITRE ATT&CK T1688: Impair Defenses: Safe Mode Boot, a technique that ransomware families like Snatch and AvosLocker have used for years. However, this is the first time we have seen Akira use it.”

What Akira didn’t bank on was Safe Mode with Networking also preventing its encryptor from running. “Safe Mode boots with a stripped-down environment and constrained virtual memory, and the Akira process tree appears to have starved it, getting the "Out of Virtual Memory" pop-up and the cascade of PowerShell hard errors line up exactly with the moment the payload tried to kick things off.”

The operators had no other choice but to boot the device back up normally, at which point a scheduled Defender scan detected the encryptor, flagged it, and ultimately quarantined it.

“The takeaway is a little uncomfortable. While Safe Mode blinded our controls, it may also have prevented the encryption it was meant to enable. That's a lucky side effect of the attacker's own mistake in these circumstances, not a defense you can plan around,” Huntress warned, stressing that not every victim might get such a lucky break.

“Ultimately, this could be a case of winning the battle, but not the war. It's possible that a host with more physical memory or a larger page file might give akira.exe enough virtual memory to encrypt the endpoint in Safe Mode. Akira's developers or affiliates could retool the encryptor to reduce its memory demands or make its Safe Mode launch sequence more reliable, meaning that the same failure may not occur in a future intrusion.”

How to defend against Akira ransomware

To defend against Akira, Huntress recommends users set up alerts on bursts of failed VPN logins against multiple usernames from one source. It works well because Akira starts its breach with a brute-force attack against the VPN. It also says users should correlate those failures with a successful login from the same IP or ASN within a short window.

The second step is to turn on multi-factor authentication (MFA) on every VPN account. Users should also disable or IP-allowlist the SSL VPN during active attacks and, if compromised, rotate all AD and VPN credentials. “Treat everything in that Get-ADUser dump as exposed,” the researchers warn.

EDR should be deployed to every host, as well as SIEM and ingest VPN + Windows Event Logs. “The first VPN logons were visible hours before any detonation—this time advantage is only possible if the logs are on SIEM.”

Finally, users can set up alerts on boot-configuration changes and Safe Mode boots, to catch Akira red handed.

• Apple Fitness+ could be getting Peloton-style live workouts
• The fitness platform has been 'under review' since earlier this year
• Spotify recently expanded into fitness, so Apple might one-up its rival with live workouts

Something is going on at Apple Fitness+, the tech giant’s flagship fitness service, and it could be hinting at a new Peloton-style live workout hub.

A job listing posted by Apple advertises a Studio Producer role for Fitness+, implying there’s about to be a new upgrade coming to the health service, which is asking for a candidate with a "strong foundation in live or live-to-tape multi-camera production and a genuine curiosity about where live content is headed next."

Apple Fitness+ was introduced back in 2020, offering subscribers a one-stop shop of on-demand workout videos run by in-house fitness experts, integrating real-time workout metrics from your Apple Watch. Apple Fitness+ doesn’t host live workouts with live leaderboards in the way that Peloton does, so an upgrade could give the service the new lease of life it needs.

Despite its rich library of pre-recorded workout videos and guided meditations, Apple Fitness+ has been declining over the years. Earlier this year, we reported that Apple Fitness+ was ‘under review’, with the possibility of the firm merging with the existing Apple Health app to offer a combined subscription, but as it stands, the future of Apple Fitness+ is still undecided.

Bloomberg’s ($/£) Mark Gurman said that "there’s no telling what will end up happening," so not even seasoned leakers are able to predict where it’s going. A direct partnership with a fitness giant like Peloton hasn’t been hinted at, but since Spotify recently ventured into the fitness world, Apple Fitness+ might have some fresh competition.

A few weeks ago, Spotify expanded its services into fitness and I sat down with its developer, Austin Lamon, who described it as a “natural extension of how people already use Spotify today”. The new Fitness hub packs curated Running Mode playlists, as well as a section packed with pre-recorded workout guides from Peloton’s flagship personal trainers — and it’s all included in the Premium plan on top of access to music, audiobooks, and podcasts.

Though Apple Fitness+ got there first with its own roster of on-demand workout videos, Spotify has combined its Fitness hub with services that subscribers are already paying for, whereas Apple’s music and fitness platforms are separate entities. And yes, Spotify is prone to a price hike every now and then, but its new fitness content doesn’t come with any add-on costs.

The only thing that Spotify Fitness hasn’t jumped on yet is the idea of hosting its own live workouts, which opens a door for Apple Fitness+ to snatch an opportunity. If Apple started pumping out its own Peloton-style live workouts, it could give the service an edge over rivals and give iOS fans a new reason to stay put. Perhaps we'll find out more during Apple's upcoming product launch in September?

TP-Link BE6300 One Minute Review

I liked TP-Link’s BE3200 range extender, which helped to tackle the Wi-Fi deadspot in my office quickly and easily, and at a competitive price.

However, the BE3200 is very much an entry-level option for Wi-Fi 7, with a relatively modest top speed of 3.2Gbps. If you’re looking for something a little faster for gaming or streaming 4K video then you could consider the BE6300 model, which doubles that speed without doubling the price.

Both range extenders keep the price down by sticking with dual-band Wi-Fi, which uses just the 2.4GHz and 5.0GHz frequency bands, but omits the high-speed 6.0GHz band that is available with the fastest Wi-Fi 7 models.

But, as the name suggests, the BE6300 is still almost twice as fast as the BE3200, stepping up to a top speed of 6.3Gbps, which should be more than fast enough for most home users.

As you’ve probably guessed, the term ‘BE6300’ refers to the speed of the range extender, but it’s also known by the model number RE403BE, so keep your eyes peeled if you’re buying online.

TP-Link BE6300 review: Price & release date

• Where is it available? US-only
• Available Now
• Price: $149.99

The BE6300 is currently only available in the US. You can’t buy it direct from TP-Link either, so you’ll need to shop around online, with the average price sitting at around $149.99.

Oddly, though, there is a similar model called the BE6500 (model RE605BE) available in the UK and Australia. This is slightly faster than the BE6300 that we review here, with a top speed of 6.5Gbps, and costs £188.00/AU$265.

TP-Link BE6300 review: Specs

TP-Link BE6300 review: Design

Unsurprisingly, the BE6300 looks very similar to its little brother, with a chunky, white rectangular design that plugs straight into any convenient mains power supply.

However, the extra speed of this model means that it requires a little more power and the BE5300 is therefore quite a bit larger, and also sprouts an extra pair of antennae – four in total - to boost performance.

The body of the BE6300 measures 161mm high, but unfolding the top and bottom antennae extends that to a full 261mm. It’s wider too, at 81mm, which means that the bulky device could block any adjacent power sockets if you have two or more sockets that sit close together.

You’ll also need plenty of room if you want to use the Ethernet port that's located on the right-hand side of the range extender. Mind you, it’s possible to plug the BE6300 into a mains extender, rather than plugging it straight into a wall socket, although that’s not a very neat solution as it leaves you with additional cables trailing on the floor.

TP-Link BE6300 review: Features

As mentioned, the BE6300 provides dual-band Wi-Fi 7, using the 2.4GHz and 5.0GHz frequency bands with a top speed of 6.3Gbps.

It may not support the high-speed 6.0GHz band, but it does include a Wi-Fi 7 feature called MLO – multi-link operation – that allows computers and mobile devices with Wi-Fi 7 to boost performance by transmitting data on both bands simultaneously. The Ethernet port on this model is faster too, now running at 2.5Gbps.

As we’ve seen before, TP-Link’s Tether app is well designed and easy to use, making it easy to get started even if you’ve never used a range extender before. It recommends that you initially plug the BE6300 into a power socket close to your main broadband router in order to avoid any interference during the initial set-up process.

The app is then able to automatically detect the range extender and guides you through the process of connecting it to both the 2.4GHz and 5.0GHz networks set up by your main router.

If you want to keep things simple then you can tell the range extender to just use the same network name and password as your original network, or you can give the range extender a new name and password for extra security.

Once that’s done you can unplug the range extender and move it closer to the room where you need to boost the Wi-Fi signal. The app can help here too, by checking the strength of the Wi-Fi signal so that you can find the best spot to place it.

The app can also show you all the devices that are connected to the range extender, and allows you to block devices, such as a child’s tablet or smartphone at night-time. There’s also an Eco mode that helps to reduce power consumption, and you can schedule a time for the range extender to turn itself off as well.

TP-Link BE6300 review: Performance

I have a Wi-Fi deadspot in an office at the back of my building, and when I tested the less expensive BE3200, I found that its 2.4GHz band couldn’t quite achieve the full speed of 150Mbps provided by my office broadband service.

That was no longer a problem when I set up the BE6300 in a nearby hallway, and it was easily able to maintain a smooth 150Mbps for both the Ookla Speed Test and for file downloads from Steam. Needless to say, the faster 5.0GHz band worked equally well, cruising along at 150Mbps throughout all my tests.

Not everyone will need a range extender with a speed of 6.3Gbps, so many homes will still get perfectly good performance from a less expensive range extender such as the BE3200. But, if you do need strong performance for gaming or streaming video, then the BE6300 fits the bill at a competitive price.

Should you buy the TP-Link BE6300?

Buy it if…

Don’t buy it if…

Also consider

• Read TechRadar’s reviews guarantee
• First reviewed August 2026

• CVE‑2026‑65400 macOS Screen Sharing flaw exploited for cryptojacking within days of disclosure
• Attackers gained root via exposed port 5900 and deployed Monero miners using XMRig
• Apple patched in Sequoia 15.7.9, Sonoma 14.8.9, Tahoe 26.6.1; users urged to update immediately

Less than a week after being publicly disclosed, a macOS vulnerability plaguing Screen Sharing was observed as being used in cryptojacking attacks.

Alfredo Pesoli, a security researcher from Bynario, discovered an authentication issue in macOS Screen Sharing and reported it to Apple. Screen Sharing is a built-in macOS tool that allows users to remotely connect, and use, another Mac device. It is similar to third-party tools such as AnyDesk or TeamViewer and comes in rather handy for IT teams accessing Macs stored in closets or used by remote and home-working employees.

The bug allows a remote attacker to bypass authentication and gain access to a vulnerable Mac device without valid credentials. It apparently stems from a logic issue in the Screen Sharing server’s authentication process, affecting systems where the service is exposed to the internet.

The Netherlands issue a warning

Soon after disclosure, Apple released an out-of-bound fix, signaling that this is, indeed, a dangerous vulnerability. “Apple does not ship an update out of band unless something is critical,” security researchers Calif said in their technical writeup. The National Vulnerability Database (NVD) assigned it an identifier - CVE-2026-65400 - and gave it a severity rating of 9.6/10 (critical).

Approximately at the same time the patch was released, the flaw was also showcased at the 2026 Black Hat conference, with a video demonstration was made public a few days later.

Apple said it fixed it with improved state management, addressing the bug in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1.

Now, less than a week after the disclosure, researchers are saying the bug is being leveraged in actual cyberattacks, with Dutch security officials being first to react

“The NCSC has received a report showing that active abuse of this vulnerability has been observed on several systems on which port 5900 was accessible from the internet,” the Netherlands National Cyber Security Centrum (NCSC) said in a machine-translated report. “In all these cases, root access was gained on the affected system and a Monero crypto miner was placed.”

Why Monero?

Monero is considered an “altcoin” - a cryptocurrency built as an alternative to Bitcoin. It is one of the oldest active altcoins out there, having been launched more than 12 years ago. Most cryptocurrencies rarely live through a single four-year bitcoin cycle but Monero, just like Ethereum, Litecoin, Solana, and a handful of others, endures.

It is similar to Bitcoin because it, too, can be “mined” (unlike Ethereum, for example). It differs on the privacy front. Unlike Bitcoin, whose transactions are recorded on a public ledger and can often be traced, Monero is designed to obscure the sender, recipient, and the amount of transactions. This privacy feature has, unfortunately, also attracted criminals.

Another key feature that made crooks choose Monero for their cryptojackers is the fact that the altcoin uses a proof-of-work (mining) algorithm optimized for general-purpose CPUs, making mining relatively profitable on ordinary servers, desktops, and cloud machines.

Although it was not specifically stated, it is safe to assume that in this incident, the attackers were deploying XMRig. It is, by far, the most popular cryptojacker and one that mines primarily Monero (its ticker is XMR).

How to stay safe

The best way to go about it is to install the patch Apple just released. This effectively plugs the hole and makes the device secure. Those who are unable to deploy the patch immediately should block Screen Sharing and enable it only when it is actually needed and used. To do that, users can go to System Settings > General > Sharing and toggle the Screen Sharing switch off.

Finally, it is worth mentioning that the NCSC stressed the crooks could only exploit the flaw when the target device’s port 5900 is exposed to the internet. Therefore, setting routers and firewalls to block the port can also work, although we’d only recommend it as a last resort. Installing the patch is still the best way to go.

Right now, no groups claimed responsibility for this attack, and there is no evidence it is being used for anything else. In theory, though, it can also be used for data exfiltration, malware deployment, and possibly even ransomware attacks.

• GPU price hikes are coming later this year, PC Partner Group warns
• The parent company of Zotac notes that entry-level GPUs will suffer 'more severe shortages'
• A manufacturer of gaming monitors, KTC, has also warned on price hikes

PC gamers should be aware that there are further signs that GPUs could get more expensive, and gaming monitors too, so you might want to consider buying now rather than waiting.

First off, the gloomy GPU news which comes from PC Partner Group (PC PG), an Asian graphics card giant based in Singapore and the parent company of Zotac, Inno3D, and Manli.

VideoCardz reports that PC PG just published its latest fiscal results that came with a warning on GPU pricing as part of the trends and conditions which are likely to affect the company's finances in the upcoming year.

PC PG notes that "graphics memory costs are expected to rise further, leading to a substantial increase in VGA Card costs in the second half of the year." VGA Card simply refers to discrete PC graphics cards, and although it's a well outdated term now, it's one still used behind the scenes in the industry.

PC PG says that shipments of GPUs "declined substantially" in the first half of this year, and that they're likely to drop further in the second half of 2026. The firm writes that: "Beyond the price increases, entry-level VGA Cards are expected to face even more severe shortages, which may further drive ASP [the 'average selling price'] upward in the second half of 2026."

The company also highlights that other PC components, including system RAM and CPUs, are taking longer to get hold of.

VideoCardz also noticed that monitor pricing could be on an upward trajectory, too, as manufacturer KTC has issued a notice of a likely 'product price adjustment' in the future.

KTC observes that the "production cost of monitors has increased significantly" and that it can no longer absorb those pressures, therefore: "KTC's monitor product line may see a price increase in the future."

While that's just a 'may' rather than a 'will' or a certainty, it sounds like there's a high likelihood of it happening. Particularly because KTC advises: "For users with a clear need to purchase a device [monitor] in the near future, the current pricing window offers excellent value for money, and we recommend planning your purchase time accordingly."

And at the end of its statement, KTC talks about price adjustments being a "necessary measure", so it sounds pretty much like they're coming no matter what.

Analysis: is anything immune to the component crisis?

This isn't the only warning on monitor price increases, as AOC recently said that the rising cost of components for its products will mean price hikes starting from this month. Is this the start of a growing trend? The bigger monitor producers will, of course, have more financial wherewithal to weather component rises, but it may only be so long before even those firms start to jack up prices.

The way things are going, I wouldn't bet against it, and this latest news has people on social media asking what isn't immune to the RAM crisis – and what might we expect to see hit next?

How about pricier PC cases, one Redditor jokes: "Wouldn't you enjoy a simple case costing like $300?"

The crisis does feel rather relentless at this point, but the clearest worry is now GPUs. PC Gamer is tracking graphics card prices on a weekly basis, and there have been some clear cost increases coming through in the last few weeks, which suggests that PC PG's prediction is on the money here. And there are multiple other rumors of late warning that graphics cards are set for considerable price hikes. For me, this noise is becoming too consistent to ignore.

As I recently advised, if you need a graphics card upgrade, or think you will in the next year or two, I believe now is the right time to get in and buy. It's particularly notable that according to this latest rumor, entry-level GPUs are mentioned as apparently coming under more pressure, meaning that mainstream buyers are going to be suffering.

The effects of pricier video RAM, and other pressures besides, are no longer going to be mostly about high-end (or 16GB) cards becoming ridiculously expensive, and we could see some unfortunate hikes with lower-end GPUs.

There's very little good news of late across the gamut of PC components, and as we've already seen today, RAM and SSDs are getting even more expensive.

This week, OpenAI added Google Drive to your ChatGPT Library. You could already connect to Google Drive, but now it means you can select a whole Drive folder and ask ChatGPT to look for answers working across all the files it contains.

This can save a lot of time compared to uploading each file individually to ChatGPT’s library and asking ChatGPT to work with it, especially for working with images. Now they’re effectively all in there already.

Now, I don’t know if you’re anything like me, but I tend to treat the root folder of my Google Drive like a very messy desktop. I’ve had my Google account for years, and I just chuck files in there without really organizing them into folders unless I really have to.

The result is that it has built up into one big mess of old and new files floating about in a kind of digital soup. I’m sure there are important things in there that I’m at risk of forgetting about forever.

So, when I heard that ChatGPT can now look at the documents your Drive folder contains and organize them for you too, I was intrigued.

10 years of junk

To test this out, I thought I’d ask ChatGPT to connect to my Google Drive and take a look at what it could find:

“I've got a load of files in my Google Drive that aren't in folders — go through everything here and identify things I’ve forgotten, unfinished tasks, contradictions, deadlines, duplicate work and anything that looks like it still needs action. Also suggest how it could be organized and what files should go where.”

The result was impressive. It thought for what felt like about 30 seconds, then came back with some results. I had to re-authorize it to connect to my Drive a couple of times first, but everything went smoothly.

It turns out that I have a real penchant for saving files called “Untitled document” into Drive. Chat was able to go through them all and work out what they were about and what was important.

It found a lot of material from various books I’d been writing and suggested how to organize them together. Old invoices were also collected, and there were a lot of forgotten idea fragments that it thought were worth reviewing.

It also found duplicate files and multiple versions of “household_budget_tracker”. Sadly, I never got that project off the ground!

A better structure

The whole process led me to discover things from the last 10 years that I’d pretty much forgotten about, and Chat suggested a folder structure for me to use to keep them more organized. Its ability to spot half-finished ideas and documents from years ago was incredibly useful. In particular, it found the outline of a book I'd started in 2018 and hadn't thought about for years. I've actually started looking at a few of those old writing projects again because of it.

But analyzing the mess and proposing a structure isn’t the only trick ChatGPT can do. I discovered it could actually make those changes itself. Just tell ChatGPT to create a new folder and put a load of files into it, and it will actually do it. So, for example, I asked, “Can you make a folder called Invoices and put all my invoices in there?” All this was possible from within ChatGPT, and I didn’t even need to touch Google Drive myself.

Sadly, the new features aren’t available to ChatGPT Free or Go users. You’ll need a Plus, Pro, or Business account. Another new feature is that it can keep Docs, Sheets, and Slides from your Drive open alongside the conversation while you interrogate them, but today I was more interested in how ChatGPT could help me organize the mess that is my Google Drive.

Seeing ChatGPT casually surface abandoned writing projects from years ago was a slightly strange experience, but I finally feel like I’ve cleaned out my digital junk drawer and got a handle on 10 years of clutter. Perhaps the most useful thing ChatGPT did wasn't organizing my Google Drive. It made the fact that I hadn't organized it properly for the last decade matter a lot less.

• DDR5 RAM pricing has risen swiftly again in Germany
• That means two months of sharp increases, backing up recent rumors that memory is going to get pricier
• An exec from the storage world has also said that SSD-related pricing pain is seemingly going to last until 2030

I've recently been writing about how the RAM crisis appears to be reaching new levels of severity, and unfortunately there's more evidence that the situation is worsening with the price of system memory and storage.

Wccftech noticed that 3D Center has a new set of monthly figures for the German retail market which shows that as of mid-August, DDR5 RAM pricing has risen to 486% of the cost it was in July 2025. So, effectively it's five times pricier than before the crisis began a year ago.

That's a substantial jump from the 445% level seen last month, and an even bigger increase than the previous month, in which prices were at 419%. To look at it another way, prices have risen 16% in August compared to the cost of DDR5 in mid-June.

Internal SSD prices have also increased 7.7% month-on-month in the German retail market – and those drives are now 2.2 times as expensive as they were pre-crisis – and Wccftech also picked up another interesting but bleak storage revelation.

Pua Khein-Seng, the CEO of Phison, which makes controllers for SSDs, observed that the NAND market (flash memory chips for SSDs) is in deeper trouble than was previously believed in terms of the time needed to ramp up production.

Taiwan's Commercial Times reports that Pua said he recently had a conversation with senior executives from a NAND manufacturer, and that he asked about how long it would take from investment (being made now) to actual mass production being realized.

The CEO noted (bear in mind translation issues): "He originally estimated it would take about two years, but the answer they gave was 'four years.'"

What this means is that the expectation is now that NAND supply difficulties are going to persist through to 2030 (rather than 2028).

Analysis: there may be trouble ahead…

That's an unsettling prediction from the storage world, coming as it does on top of a lot of other recent bad news suggesting that the RAM crisis will last a long time, and possibly to 2030 and beyond – and that the remainder of this year, and 2027, are going to see matters get worse.

The German retail market appears to be a clear indicator of how things are going, seeing as DDR5 pricing had dropped slightly and then plateaued (more or less) since the beginning of 2026, but started a sharp climb in July as noted. Yes, this is just one source of info, but it's a snapshot of the market of a large European country, and it correlates with all the gloomy predictions we're hearing of late.

As 3D Center points out (again, this is translated): "The bigger picture now points to a worrying price trend, which is likely to break exorbitant levels very soon, unless this trend is halted – for which there are currently no indications."

Sadly, it seems that RAM and storage prices really are going to increase as 2026 rolls on. While there would appear to still be room for further hikes to SSDs (sadly), with system RAM it's arguable how much more consumers can take before they completely refuse to buy until costs come down at least somewhat. That said, new desktops and laptops are still going to be sold, so this isn't just about refusing to upgrade your home PC's memory, of course.

TP-Link BE10000 One Minute Review

Wi-Fi 8 may be looming on the horizon, but routers and range extenders that use Wi-Fi 7 can still be pretty expensive.

One way of keeping prices down is to provide basic dual-band support, which uses the 2.4GHz and 5.0GHz frequency bands while omitting the high-performance 6.0GHz band.

Dual-band routers and range extenders can still perform well, though, as we’ve seen with TP-Link’s BE3200 and BE6300 extenders. But, if you want to pay a little extra in order to get maximum performance then you could step up to its top-of-the-range BE10000 model.

This is a tri-band range extender that adds support for the 6.0GHz band, boosting the maximum Wi-Fi speed to a blazing 10Gbps. You’ll need computers or mobile devices that have Wi-Fi 7 – or Wi-Fi 6E, which also supports the 6.0GHz band – to get the full benefit of the BE10000, but it could be a great option for boosting the Wi-Fi connection for gaming or streaming video in one or two rooms that suffer from a Wi-Fi ‘deadspot’ within your home.

TP-Link BE10000 review: Price & release date

• Where is it available? US-only
• Available Now
• Price: $199.99

The BE10000 is currently only available in the US, and you can’t buy it directly from TP-Link’s own web site so you’ll need to shop around online or try to find it in a local bricks-and-mortar retailer. Online prices also seem to vary a lot too. TP-Link quotes a price of $199.99, but we’ve seen prices ranging from $149 - $249, so it’s definitely worth comparing prices before buying.

The BE10000 is not available in the UK or Australia, although there is a similar model called the BE11000 available in those regions that – you won’t be surprised to find - runs at 11Gbps.

However, this is priced at a rather hefty £299.99/$449, which is considerably higher than the price of the BE10000 in the US, even if you take into account the slightly faster speed of 11Gbps.

TP-Link BE10000 review: Specs

TP-Link BE10000 review: Features

At first glance, the BE10000 looks very similar to the dual-band BE6300, with a bulky rectangular design and four large antennae. However, the BE10000 is even larger, with the body of the range extender measuring 161mm high, although this increases to a full 350mm with the antennae fully extended.

You’ll need a power socket with plenty of free room around it in order to plug in the BE10000, and I found that it was so wide – at 81mm – that it also blocked the adjacent power socket in my office as well. You’ll also need a bit of extra space if you want to plug an Ethernet cable into the Ethernet port on the side of the range extender.

It may be big and bulky, but the tri-band BE10000 certainly earns its keep. The name implies a Wi-Fi speed of 10Gbps, although it’s actually 10.2Gbps, which is more than fast enough to handle gaming and streaming video, while the 2.5Gbps Ethernet port provides a high-speed wired connection as well.

As always, TP-Link’s Tether app makes it easy to get started. You do need to initially plug the BE10000 into a power socket close to your main broadband router, but the Tether app can then automatically detect the range extender and guide you through the process of linking it to your existing Wi-Fi network.

The app allows you to connect to the 2.4GHz, 5.0GHz and 6.0GHz bands separately, perhaps to devote the fastest 6.0GHz band to a gaming PC that needs maximum performance.

The app’s security features allow you to set different network names and passwords for each band, or you can simply carry on using the same name and password as your main Wi-Fi router. Other features include the ability to boost the power supply to the BE10000 in order to increase the range of its Wi-Fi signal, or you can use Eco Mode to save power instead.

TP-Link BE10000 review: Performance

I have an office that suffers from a Wi-Fi deadspot in my building, but I almost feel that I should apologise to the BE10000 for asking it to tolerate my puny office Wi-Fi.

I placed the range extender in a hallway, about halfway between my main broadband router and the office with the deadspot, and the BE10000 seemed to roll its eyes – or, rather, its blinking LEDs – as it picked up my feeble 150Mbps Wi-Fi signal and boosted it into that office.

Unsurprisingly, the BE10000 was able to hit the full 150Mbps on all three frequency bands, when running the Ookla Speed Test and also downloading large game files from Steam.

Ironically, though, that effortless performance is the only real disadvantage of the BE10000. Its 10.2Gbps Wi-Fi 7 is so fast that few homes really need that level of performance. But, if you have a gaming PC with Wi-Fi 7, or that is used for streaming 4K video, then the BE10000 will eliminate any troublesome Wi-Fi deadspots with no trouble at all.

Should you buy the TP-Link BE6300?

Buy it if...

Don't buy it if...

Also Consider

• Read TechRadar’s reviews guarantee
• First reviewed August 2026

• An Incogni survey has found people are becoming more frustrated with the internet
• Users cite AI slop and data leaks as the main reasons for stress and anxiety when using the internet
• Many users want to spend less time online, and are deleting social media profiles and messaging

For years, personal data collection for advertising, tracking, and service improvement was thought to be the fair price to pay to access the world wide web. But now, many people believe that using the internet will lead to their data being leaked or exposed.

A new Incogni survey found more than half of internet users believe their personal data will inevitably be exposed, with 63% stating that this fear causes anxiety when using the internet.

But beyond this, internet users now fear they can no longer tell what is real content uploaded by a human and what is AI generated, not only eroding trust in the internet, but also making people not want to use the internet at all. Almost half of internet users are less sure of what is real on the internet.

Inevitable data exposure

You’ve likely been prompted thousands of times to accept or reject cookies, or review a privacy policy before using a website. Every cookie you accept will collect data on your browsing habits and behavior on sites in order to display personalized adverts that you are more likely to click. Cookies also help keep you logged in and store your information on websites.

While this helps make many websites across the web free to use for those accessing them, sometimes your data is sold to advertisers or third-parties where it is stored insecurely, and can be stolen or leaked.

Among the 1,000 internet users surveyed, the fear of data exposure was strongest among the Millennials and Gen X generations. 56% of Gen X and 55% of Millennials believed that their data would at some point be breached or exposed, showing just how normal data breaches and exposure have become online.

Just 11% of those surveyed believed there was little likelihood of their data being breached.

AI is making the internet less real

AI content creation has exploded in recent years. Social media sites are full of AI ‘creators’ whose pages either share AI generated content or scrape the internet for content that users are likely to interact with, and share it through their own pages. These profiles require little human input, but can share content at an industrial scale and reap huge rewards from advertisers.

If you’ve been on Instagram lately, you may have seen videos from AI creators all sharing the same captions. “Tonight, V stepped into the crowd..” or “Japan is transforming footsteps into electricity.” These captions use keywords to abuse Instagram’s algorithm on popular topics to drive engagement, regardless of whether the content actually has anything to do with the caption.

But they’re also making it harder to know what is real on the internet.

48% of those surveyed said that they are less sure of what’s real, with 40% also stating that the lack of accountability for deepfake creators was a bother.

Additionally, 27% said that AI generated content made them want to spend less time online, with 16% also saying that navigating an internet full of low quality AI content made them feel more tired or fatigued. Just 8% of respondents said that AI generated content improved their online experience.

There are some positive attitudes to AI content online. 12% said that AI-generated content made information more accessible, with slightly less (11%) saying that they were excited about the creative possibilities AI offers.

Time to go offline?

Attitudes to how long people spend online are also changing. Over half (51%) of Gen Z internet users believe they spend too much time on consuming content on the internet, with 43% of Millennials and 42% of Gen X respondents having a likeminded view.

Whether it’s responding to emails, navigating networking platforms, finding new furniture, or looking for where to go to eat - the internet is now a life requirement for most people. And every time you access another website in work or your personal life, there is more data that could be leaked.

The ultimate effect of this is that people are being driven away from using the internet. 58% of respondents said that they had deleted a social media account or messaging app because of stress, anxiety, or privacy concerns.

“It seems that the costs of engaging with these platforms are starting to outweigh any perceived or actual benefits,” the Incogni survey said.

Or time to pay for privacy?

Incogni also asked if users would be willing to pay for an internet where tracking and algorithms did not exist. 30% of respondents said they would, but this largely relied on income. Those with a higher income were more likely to pay for this ‘private’ internet, while those with a lower income were less likely.

For many internet users, privacy shouldn’t be a luxury, but a guarantee. There is a level of trust involved when sharing personal data with advertisers, and the expectation is that the data won’t be leaked or stolen. Unfortunately, the opinions show that this is far from what's expected.

The recently introduced VESA DisplayHDR True Black 1400 standard boasts an impressive level of immersion for the next generation of OLED displays. With its peak brightness levels of 1,400 nits, it promises a high dynamic range experience greater than we have seen from even the best gaming monitors and productivity panels in 2026.

The numbers sound impressive and all, but what exactly is True Black 1400? More importantly, what are the broader utility and use cases of next-generation monitor technology for gaming, media playback, and content creation? I'm going through absolutely everything you need to know and how it fits into the way we consume media and play video games now and in the future.

What is DisplayHDR True Black 1400?

DisplayHDR True Black 1400 is the latest tier of Vesa's high dynamic range certification standard. Panels that reach this tier feature a peak luminance of at least 1400 cd/m² with 700 cd/m² full-screen brightness. In short, it means a significantly higher luminance performance with unparalleled color contrast, with the deepest, darkest blacks that are physically possible from an emissive monitor.

All DisplayHDR True Black standards feature a 95% range of color with a maximum black level luminance of 0.0005. However, the latest 1400 standard features a 40% jump in peak and sustained luminance over the previous highest standard, meaning things such as explosions, sun glare, reflections, and other peak lighting details will pop significantly more. With a sustained full brightness of at least 700 nits, it means a greater punch of color without as much of the harsh dimming used to regulate power and heat.

Most exciting of all with DisplayHDR True Black 1400 is how it brings OLED panel tech back in the race against mini-LED displays with full-screen brightness. Traditionally, OLED has offered the deepest blacks due to the organic (self-lit) diodes instead of a backlight; they physically turn off rather than being dimmed with a local dimming zone on a backlight. However, that means that peak overall full-screen brightness has suffered.

DisplayHDR True Black 1400 bolstered by Tandem OLED tech

The trade-off when considering OLED over mini-LED always came down to peak and full-screen brightness; it was commonly accepted that you had to choose between deeper blacks and higher contrast or a brighter overall display. If we take DisplayHDR True Black 1400 in its rawest terms, 1,400 peak nit brightness and 700 nits full-screen brightness, then we can start to see how it competes with some of the top-performing mini-LED displays.

You only need to look as far as the Asus ProArt Display PA32UCG-K, Philips Evnia 34M2C7600MV, and AOC AGON Pro AG327UXM to see just how bright and vivid a 1,400-nit display can be even when using older panel tech. In those instances, you were paying a premium for the high dynamic range to be maxed out. Whether mini-LED or an older panel backlit panel tech, the standard used promised 1,400 nits peak luminance with 95% DCI-P3 color range, and a 50,000:1 contrast ratio.

Last month, Samsung made its first appearance at Bilibili World in Shanghai with the unveiling of its new OBLYX brand, a designation for its gaming laptop displays. The panels will be offered in 14-inch, 16-inch, and 18-inch configurations, supporting 120Hz, 165Hz, and 240Hz with a 0.2ms response time and a 100% DCI-P3 color gamut. It's a component brand that could be adopted by the likes of Asus and MSI, just like Samsung makes panels that are used by LG, Sony, and other manufacturers.

It's further bolstered by tandem OLED technology, which we've seen on desktop displays over the last couple of years now. As the name implies, this tech utilizes two organic layers on top of each other, which increases peak brightness, reduces power consumption, and extends the display's overall lifespan. In short, reduced wear, higher efficiency, and a slimmer profile.

Tandem OLED is also used to offer dual modes, such as with the Asus ROG Swift PG27AQWP-W's ability to run in either QHD at 540Hz or 1080p at 720Hz, or the upcoming ASRock Taichi TCo27QXB OLED's 4K 240Hz or 480Hz in 1080p double-duty. The execution then becomes the prospect of having the brightest panels possible (1,400 nits) that last longer, are better on power efficiency, and can flex dynamically depending on your use case.

OLED peak luminance (if the price is right)

So, DisplayHDR True Black 1400 pushes the peak luminance and full-screen brightness to Mini-LED-killing levels, but what about the adoption level from the wider consumer market? To gauge this, we need to look at how companies (and people) took to the previous display brightness standard, DisplayHDR 1400, back in 2019. More than seven years ago, VESA targeted content creators, video editors, and gamers with the best standard possible, but which manufacturers actually utilize it?

Notable examples include the Mini-LED-backed Asus ROG Swift PG32UQX with a 4K resolution, 144Hz refresh rate, peak brightness of 1,400 nits, and a total of 1,152 local dimming zones. It launched all the way back in June 2021, with an eye-watering MSRP of $2,999 / £3,299. The same can be said of the ViewSonic Elite XG321UG with its 4K resolution, 144Hz refresh rate, Mini-LED panel, and 3ms GTG. However, it didn't come cheap, with its asking price of $2,499.99 / £2,200. You were paying a premium for the highest possible fidelity.

Thankfully, sustained highlight brightness would get cheaper over time, just not from the major manufacturers.

We can see this with the likes of the KTC Mini-LED gaming monitor, which features a fast IPS 4K at 160Hz and 1080p at 320Hz dual-mode display, backed by DisplayHDR 1400 certification for just $430 / £399.99. The vast majority of manufacturers would instead prefer the DisplayHDR 1000 standard, which is commonly available on budget and mid-range offerings, such as the Asus ROG Swift PG32UQXR ($699 / £459) and MSI MAG 274UPDF ($449 / £399).

DisplayHDR 1400 was (largely) abandoned as the highest standard for LCD monitors because of the shift to OLED and QD-OLED instead. Contrast became more important than peak brightness, as you could buy a similarly priced DisplayHDR True Black 400 or True Black 500 OLED panel for less. Specifically, you can see this shift in the Lenovo Legion Pro 27Q-10 ($520 / £500) and Alienware AW2725D ($499 / £489).

Where DisplayHDR True Black 1400 could succeed where DisplayHDR 1400 failed

Pricing aside, the one major factor that kneecapped DisplayHDR 1400 certified monitors when they arrived on the market was the thermal performance and bulk. Pushing that 1,400 nits of peak brightness with a traditional backlight setup generated a ton of heat and drew an incredible amount of power. It meant a weighty chassis that could even feature active cooling, such as in the case of the Asus ROG Swift PG32UQX, which also weighed in at an unsubtle 24.03 lbs / 10.9 kg.

Sticking with this panel, the PG32UQX's 1,152 local dimming zones were configured with a total of 4,096 individual mini-LEDs, which contributed to its intense 75W power draw when in full brightness as well. When we think about how DisplayHDR True Black 1400 can be different, we see how tandem OLED solves the problem here. The average tandem OLED display uses around 40% less power than a standard OLED display, as well as running four to eight degrees cooler. On average, they run between 30W and 55W, depending on the manufacturer, screen size, etc.

Tandem OLED is getting cheaper and becoming more affordable as well. Wholesale costs are coming down because more manufacturers are leaning on the technology in monitors and laptop screens. This will give tech companies the edge needed to produce the brightest and most vivid displays possible without the high production costs and obvious drawbacks, now that they are not beholden to the confines of LCD.

Will DisplayHDR True Black 1400 displays be worth it?

I've already established all the ways that the latest DisplayHDR True Black 1400 standard excels against all others: peak 1,400 nits brightness, full-screen brightness of 700 nits, and the near-instant 0.03 ms response time. However, the argument of whether brightness to this degree is worth it or not entirely depends on how you want to use the monitor or laptop display. As touched on above, there aren't the problems of the mini-LED (or LCD) models, but if price isn't an object, then what else could hold you back?

The average brightness of a gaming monitor varies massively depending on the panel type. Generally speaking, SDR (Standard Dynamic Range) peaks at between 250 and 400 nits, with the average Mini-LED or OLED model performing at its most comfortable between 400 and 800 nits. You have to consider just how close to the display you will actually be. A darker or dimly lit room will need less of a brightness range than when playing against the glare of an oppressive sun, which could use anywhere from 15 to 50% of a monitor's peak brightness settings.

It's worth remembering that a peak brightness of 1,400 nits does not mean blasting that full brightness all the time; it's instead used for highlights as the HDR punches through, accenting things rather than being a constant presence. Playing in a brighter environment or playing video games geared specifically towards HDR will have the greatest impact.

So, in its strictest use case, DisplayHDR True Black 1400 excels for content creation and media playback. The reason DisplayHDR True Black 1400 has a chance to become more mainstream is that the monitors will be cheaper, more power-efficient, and last longer thanks to tandem OLED. This should mean that more companies will adopt the standard: brighter, more vivid gaming monitors and laptop screens now that the restrictions have been lifted. The ceiling has been raised, even if we are still years away from seeing the tech be properly actioned.

The RAM crisis is everywhere you look these days, and it’s impossible to go a day without seeing more headlines predicting doom and gloom for tech lovers worldwide. But there’s another side to this grim situation — one that I wouldn’t even have thought about if it wasn’t directly affecting me.

It all comes down to the hidden costs of upgrading your PC, costs that sky-high memory prices have stretched to breaking point. Because for certain people, picking some new components for your computer is more complicated than simply wincing as you add a new set of memory to your online basket. When one new part necessitates changing several others, costs can balloon and upgrading becomes a whole lot more daunting.

There’s not been much conversation about this, but it’s a very real problem for a lot of people. And with the RAM crisis showing no signs of abating any time soon, it’s likely to claim more victims as the months roll on.

A galling prospect

My gaming PC is starting to show its age. Aside from a new Nvidia RTX 5070 Ti that I somehow managed to get at below retail price last year (don’t @ me), it’s not exactly running on the newest hardware.

It’s powered by an AMD Ryzen 5 5600X CPU from 2020, a B550 motherboard, and 32GB of DDR4 memory. I’ve noticed it slow down and struggle in certain tasks, so I’ve been thinking about upgrading. The problem for me, though, is that this is a much more involved process than simply buying a new CPU or a fresh set of RAM.

Because my 5600X CPU is part of the final desktop AM4 generation, any upgrade would mean stepping up to AM5. And because we’re talking about a different platform, I’d also need to purchase a new motherboard and set of memory modules to ensure that everything is compatible (AM5 only supports DDR5 RAM).

And now my problem becomes apparent. This is not just a simple swap out situation — I need to rip out and replace half of my rig if I want to freshen things up. I can’t just snap up a speedy new CPU and be done with it.

In any ordinary timeline, that would be a costly undertaking, but not one that could potentially bankrupt you. Now, though, it’s a very different situation — and a substantially more expensive one — because my existing DDR4 memory would need to be replaced, opening me up to a whole new world of pricing pain.

Tot up the combined outlay for all the new components and it’s enough to put anyone off. Thanks to the RAM crisis, my mooted upgrade is a far more galling prospect than would normally be the case — and it doesn’t look like things are going to get better any time soon.

Work out the true costs involved

For people like me who are looking to change from one hardware platform to an entirely new one, the memory shortage takes on a whole new level of pain. It’s a hidden cost that not everyone thinks about when they look at the soaring costs of RAM.

If you find yourself in a similar situation, you’ve got two choices: wait it out and accept lower performance than you’d like for longer than you’d like, or stump up a much weightier pile of cash than you’d ever hoped to. It’s not exactly a win-win scenario, but we’re short of options at the moment.

If you can upgrade other parts of your rig, as I did with my graphics card, take that opportunity to lock down gains where you can. Of course, even that is a money-gouging endeavor, but GPU prices haven’t quite kept pace with those of RAM or storage in recent months — although recent reports suggest they’re about to get much worse. Now could well be the time to act.

And if you’re considering changing any part of your PC setup, think carefully about all the costs involved. That means looking beyond the one component you want to upgrade and considering any knock-on effects that might be created thanks to compatibility issues.

That could lead to a rather unpleasant dose of sticker shock when you work out the true cost of your PC upgrade. But the last thing you want is to be surprised when you go to pull the trigger and see how much you really have to spend.

Two US senators have proposed a new Water Cyber Shield Act to provide the EPA with additional funding and tools to conduct cybersecurity assessments on critical water infrastructure.

The act would provide $300 million annually to allow for upgrades to water utility infrastructure. Numerous coordinated attacks have been launched against US water infrastructure in recent years across 12 states, with 30 Minnesota utilities hit by Iran earlier this month.

But a separate Water Watch Center group has been set up to monitor 91% of the roughly 50,000 community water systems nationwide following a two-year pilot. The group, set up by DEF CON Franklin and the National Rural Water Association, will offer managed detection and response services provided by five cybersecurity firms.

Why are water utilities being attacked?

The FBI, CISA, NSA, and many more agencies have issued warnings about the increased threat to water utilities from Iran.

Water utilities are considered a low risk, high reward attack for state-sponsored hackers looking to cause as much damage as possible as many of the water control systems rely on internet connected operational technology (OT) devices and logic controllers.

These devices are widely deployed across water infrastructure to control water treatment and are connected to computers at monitoring stations. Theoretically if a hacker gained control of these systems, they could turn off the treatment of water or open sewage gates to contaminate water supplies.

Many water treatment systems are designed to last decades, with these OT devices and logic controllers expected to last as long as possible. But as new tech and hardware is developed, these devices stop receiving software updates that can put them at a greater risk of being attacked.

For many in the cybersecurity industry though, the Water Cyber Shield Act is too little, too late.

Expert perspectives on hardening water utilities

Will the Water Cyber Shield Act be passed?

Dahvid Schloss, OSCP, Chief Operating Officer, Suzu Labs:

While it's always exciting to see Congress attempt to get some good cybersecurity hygiene laws in place, it's likely a far reach from what will actually happen. The Water Cyber Shield Act feels a lot like a round two attempt from when this was attempted back in 2023 under the existing Safe Drinking Water Act authority as a rule, but that got shut down when water industry groups and a coalition of GOP states argued that it would increase costs on ratepayers, and then the EPA folded and pulled the rule. (More info can be found here)

I hate to say it, but historically speaking, this is likely to fail before making it to a vote, just like all other bills that have been attempted to improve water cybersecurity in the past. If we look at just the 118^th and 119^th Congress, we have had 9 bills introduced, as far as I'm aware, that pushed language that would have focused on either providing monetary assistance for, directly enforcing industry standards, and/or regulation around cybersecurity for water systems and CI, each varying in degree of what they would have provided and who they would have protected (rural vs non), but of those 9, all from within the 118th congress died within committees and without comments or markup, meaning no one even bothered to fight for them to get a vote across. Technically, the 4 from this congress (119) are still "pending' but considering no movement has occurred on them, they will likely reach the same fate.

Ultimately, Congress has been unreliable in pushing forward regulation and standards towards CI for quite some time, and the mantle thankfully has been picked up by private organizations and security practitioners who wish to have a safer and more secure water source. Even though it shouldn't be dependent on the goodwill of private citizens to protect public infrastructure.

Hopefully, in light of recent attacks, this will push Senators and House Representatives to actually move the needle forward, but this isn't the first time we have had this situation happen before. So, my fingers are crossed, but I'm not holding my breath.

Too little, too late?

John Strand, Owner, Black Hills Information Security, Inc.:

I think this type of legislation is important, but it’s also long overdue. People have known about the security weaknesses in critical infrastructure, especially within municipalities, for well over a decade.

Unfortunately, this is another example of a reactive approach to cybersecurity. Too often, meaningful action doesn’t happen until the damage has already been done.

My concern is that by the time these programs are fully implemented and organizations begin benefiting from them, many of the municipalities with the same vulnerabilities that enabled recent attacks will have already been compromised.

It’s a positive step, but it’s arriving years after the underlying risks were widely understood. This is the kind of investment that should have been made more than a decade ago, not after the attacks have already demonstrated the consequences of inaction.

Is $300 million even enough?

Damon Small, Board of Directors, Xcape, Inc.:

The Water Cyber Shield Act attempts to address a major regulatory gap by granting the Environmental Protection Agency explicit authority to enforce baseline security standards and allocate $300 million annually for utility upgrades, but federal dollars alone cannot fix this sector's systemic fragility.

Spread across roughly 50,000 community water systems nationwide, that funding yields a negligible $6,000 per facility, an amount that barely covers an initial architecture audit, let alone operational technology overhauls.

The industry already possesses robust reference architectures and standards for protecting control systems, so the primary barrier is execution rather than a lack of guidance. Furthermore, claiming that capital injections will solve the threat ignores the reality that maintenance windows are rare in continuous operational technology environments.

Rather than waiting on Congressional appropriations, security leaders and asset owners must immediately execute foundational controls: strictly isolate industrial control networks from corporate IT, eliminate publicly exposed management interfaces to the Internet, enforce multi-factor authentication, and replace default device credentials.

Operational security standards already exist; what utilities lack is not awareness, but the uptime flexibility to actually apply patches.

As many attendees of this year’s DEF CON hacker conference departed Las Vegas recently, many unsuspecting passengers on Delta Flight 591 attempted to access an onboard Wi-Fi network.

What they didn’t know was that ‘Delta WiFi Fast’ was actually a fake network, allegedly set up by a fellow passenger intended to mimic the actual onboard Wi-Fi network and scam other users.

The unknown passenger was able to disable the legitimate Wi-Fi networks for 30 minutes while they launched the attack, and in doing so, may have violated United States federal law.

How did the attack take place?

According to Aircraft Communications Addressing and Reporting System (ACARS) messages, the situation was first brought to light by the crew of the flight, who shared the following message:

“HEY ALERT CORP SECURITY WE HAVE A PAX [passenger] ON THAT HAS CREATED A SCAM WIFI CALLED DELTA WIFI FAST WE BELIEVE THEY ARE TRYING TO SCAM THE OTH PAX”

Another message read:

“NO INFO AS OF NOW WE HAVE A BUNCH OF PAX THAT WERE AT A CYBER CONFRENCE IN LAS THE WERE ABLE TO JAM OUR WIFI AND BRODCAST THERE SIGNIAL”

The actual details of what happened on the flight outside of these messages isn’t clear, but according to Monika Hathaway, head of press for DEF CON, similar attacks happened in Las Vegas: “Our conference this year also suffered from multiple similar ‘deauthorization’ Wi-Fi attacks and it impacted some of our operations.”

Delta airlines confirmed that no aircraft operating systems were affected and flight safety was never in question.

Wi-Fi deauthorization attacks can be launched with cheap, widely available ‘deauth boards’ which are small, battery powered devices that send deauthentication frames to devices within their range. On board a plane, these could easily reach most devices.

Once the legitimate Wi-Fi has been jammed and the other users booted from the network, the attacker can then set up an ‘evil twin’ network that users will attempt to connect to, which can be used to snoop on their internet traffic, steal credentials, and perform other malicious activities.

Expert perspectives on the Delta Wi-Fi attack

‘Evil twin’ attacks and the risks of connecting

Aras Nazarovas, Senior Information Security Researcher at Cybernews:

An evil twin attack is when hackers create fake Wi-Fi networks with the goal of stealing sensitive information from people, or exploiting known vulnerabilities present on victim devices. The fake networks often have a very similar (or identical) name to the legitimate network, which was the case here.

Once a person connects to the hacker’s Wi-Fi network, the hacker may be able to see what the victim is doing online and what data they transfer. However, since most websites have HTTPS/TLS encryption, much of what the user does, even on the rogue network, is private.

The risk here is that the hacker may attempt to redirect the victim to a phishing website – for instance, in this case, it may have been a fake Delta login page asking for personal data like name, email, address, etc. Or, the hacker may even go further and provide fake login pages for banks, social media, and try to extract login details from the victims.

Connecting to such a network comes with some risk in itself. Connecting to a network controlled by a threat actor allows them to probe your device for potential vulnerabilities and maliciously redirect your internet traffic to their own servers.

If a person entered credentials into a Wi-Fi login page, noticed security warnings popping up after visiting a website, downloaded something, or entered payment information into an unfamiliar page, then they may have had their data stolen. In that case, the victim should immediately change any passwords that were transmitted, do a thorough scan of their device for malware, and if bank details were transmitted, freeze the bank account until new credentials are received.

However, if a user just connected and disconnected to the Wi-Fi without entering any details or clicking suspicious links, they should be fine.

Who would launch the attack?

Seemant Sehgal, Founder & CEO, BreachLock:

Flying out of Vegas after Black Hat myself just a few days before this incident, I can tell you the security conference crowd that passes through that airport is unlike any other, and the crew on Flight 591 made the right call with the information they had in front of them.

Rogue access points impersonating a legitimate network are one of the oldest tricks in the book, and doing it on an aircraft to scam passengers is a federal crime regardless of the sophistication involved.

The people most likely to pull something like this on a DEF CON departure flight are the ones who know exactly where that line is, which makes crossing it a choice rather than a mistake. Disabling the Wi-Fi and investigating was exactly the right instinct.

Denis Calderone, CTO, Suzu Labs:

Hackers will hack. I go to DEF CON most years, and it's pretty common to have a terrible wifi experience on those flights because everyone is playing with their WiFi Pineapples and whatnot. That said, my flight home this year had no rogue SSIDs that I could see, and although, as usual, the wifi was shoddy, I never took the time to analyze the radio signals in the cabin, but if a few deauths were flying around, I wouldn't have been too surprised. It is concerning to hear about attempted credential harvesting on the flight though, and I feel that that's taking the expected hijinks way too far.

The deauthentication and evil twin combination used on Flight 591 is a well-documented attack that the security community has been demonstrating for a good two decades. These sorts of wifi threats are very common. DEF CON still displays their famed Wall of Sheep which displays the sniffing clear text credentials on the conference network, and every year the WiFi Pineapples have been selling out at the Hak5 booth.

But there's a significant difference between demonstrating a technique at a conference and deploying it against 199 unsuspecting passengers on a commercial aircraft. Last November, an Australian man was sentenced to seven years and four months in prison for running the exact same attack on domestic flights using a WiFi Pineapple and now the FBI is already involved in this case. There is definitely a legal exposure here.

For anyone who travels for work, in-flight WiFi should be treated as an untrusted network, period. The enterprise advice is encrypted DNS through your MDM and always-on VPN with captive portal remediation configured. But honestly, a VPN is something every traveler should be using, not just corporate road warriors. I make sure mine is on whenever I travel, and my family does the same.

Beyond that, if a WiFi network on a plane doesn't match what the crew announced or what's printed on the seat card, don't connect to it. If a network asks you to log in with your Google account or email credentials to get WiFi access, that's not how airline WiFi works. Airline captive portals ask for a credit card or a loyalty account, not your personal email password. If you're being asked for something that doesn't make sense for the context, you're probably not on the real network.

Reputational harm for the cybersecurity industry

Jacob Warner, Director of IT, Xcape, Inc.:

While a rogue Wi-Fi access point on a commercial airliner poses zero direct risk to air-gapped flight safety controls, it creates a serious enterprise security hazard for business travelers relying on inflight networks.

Dismissing an onboard network impersonation as a harmless prank ignores the reality of man-in-the-middle attacks, credential harvesting, and fake authentication portals targeting captive passengers connecting to the Internet.

Given that the flight departed Las Vegas immediately following DEF CON, it requires little imagination to conclude an attendee deployed the unauthorized access point.

This juvenile behavior is precisely why hackers suffer such a poor reputation among non-technical audiences and why security professionals struggle to build mainstream trust. Enterprise security teams must mandate always-on virtual private networks or zero-trust network access, disable automatic connections to open SSIDs on corporate endpoints, and instruct travelers to treat cabin wireless environments as untrusted networks.

Setting up an evil twin at 30,000 feet does not make you a clever researcher; it just proves why we cannot have nice things.

John Strand, Owner, Black Hills Information Security, Inc.:

This one hits differently because this is my community. These are my people. When security professionals engage in this kind of behavior, they’re betraying the very community they’re claim to represent.

There’s nothing impressive about it. It doesn’t make you look clever, and it certainly doesn’t make you an elite hacker. In most cases, these attacks aren’t even technically sophisticated. They’re simply people with enough technical knowledge taking advantage of others who don’t have the experience to recognize what’s happening. That isn’t skill. It’s bullying.

I hope the people responsible are held accountable. This isn’t funny, it isn’t clever, and it doesn’t demonstrate technical excellence. It’s just people abusing their knowledge to prey on those who are at a disadvantage. That’s not what this profession should stand for.

If you've been eyeing up any of the latest best gaming keyboards or the best PC controllers hitting the market over the last few years, then you've no doubt come across the terms 'Hall Effect' and 'TMR'. Magnets are at the heart of the user experience for both peripherals, and are becoming widely adopted by all major manufacturers as standard.

But what exactly is Hall Effect or TMR? More importantly, how do the two technologies compare and contrast? While it may seem like a marketing gimmick or the latest new buzzword, there's actually plenty to be excited about. In this article, I'll be going through how both technologies work in detail and analyzing their strengths and weaknesses.

What is Hall Effect and how does it work?

Put simply, the Hall Effect is the difference in voltage across an electrical conductor from an electronic conductor, which was named after the scientist who discovered it, Edwin Hall, in 1879. It's the effect that pushes charges to one side, directing electrons in a current flow through a straight line. Specifically, this charge separation is what's known as Hall Voltage.

In the most straightforward sense of the concept, the Hall effect is simply a semiconductor and a magnet, with the magnetic field generating a voltage as the semiconductor moves. In the gaming or modern tech scene, it's defined by how magnetic sensors detect movement rather than the previous method of mechanical components. It means greater precision, enhanced durability, and fewer points of failure.

When it comes to points of failure, stick drift has been affecting even top gaming controllers, and remains a constant fear, as a DualSense or Xbox Wireless Controller could (eventually) see its analog sticks drifting (so the game thinks you're moving the analogue stick on a gamepad, when you're not), or the dead zones no longer trigger as intended. This happens due to wear and tear on the potentiometers, which feature small metal contacts over a resistive track that can wear away with many years of use.

Things are similar with the Hall Effect keyboards when compared to regular mechanical or optical decks. With a standard mechanical gaming keyboard, two metal pieces come together to close an electrical circuit. With Hall Effect, however, it's simply a magnet in the switch itself that moves closer to the board, without metal ever actually touching.

In real-world terms, this is what allows Hall Effect gaming keyboards to have fully adjustable actuation points (usually 0.1mm to 4.0mm) instead of the fixed depth of older, mechanical models. Because Hall Effect lacks any physical connections, switches using that technology will (theoretically) last far longer, too.

What is TMR and how does it work?

TMR (or Tunnel Magnetoresistance) is the far newer technology of the two, being discovered in 1975 by Michel Jullière. In its simplest explanation, tunnelling magnetoresistance is a quantum mechanical effect that occurs in a magnetic tunnel junction, based upon changes in an external magnetic field. It's the changes in resistance between two ferromagnetic layers, with one being fixed and the other free to react, with an insulating barrier between them.

Tunnelling magnetoresistance is used in gaming for contactless magnetic sensor technology, promising precise inputs, no stick drift, and low overall power consumption. Because it works by detecting even the slightest and smallest difference in magnetic fields, it allows for incredibly exact actuation when used in gaming keyboards and PC gaming controllers. It's signal actuation down to a granular scale. Because TMR measures resistance and not voltage, it needs less signal amplification, resulting in a low overall power draw.

Is TMR better than Hall Effect? Yes, but there's a catch...

Now that I've outlined the key differences and similarities, it's time to talk about exactly why TMR is the superior magnetic sensor technology for today's tech. We can start by reiterating TMR's key advantages over Hall Effect: a massive resistance delta, extremely low noise floor, low power consumption, smaller micro magnets with low-strength flux fields, and ultra-high positional precision when weighed up against the older Hall Effect tech.

With that being said, why isn't TMR the more recognizable and more popular standard across the industry? Well, there are a few key reasons why Hall Effect remains the more familiar of the two magnetic methods.

Fundamentally, it comes down to the high costs of TMR components, combined with the fact that peripheral makers often need to make major changes to their production lines if they switch to using TMR.

Hall Effect components have been in use considerably longer than TMR in game controllers and gaming keyboards, with manufacturers already having SMT assembly pipelines, key suppliers, and proven benchmarks for what Hall Effect quality control looks like.

We also need to consider the key use cases for TMR for gamers. Its incredibly high sensitivity potential requires adept calibration. Because a magnetic sensor is only as good as the firmware that interprets the signal, we just haven't seen the level of maturity of firmware and engineering understanding with TMR, compared to the older and more reliable Hall Effect standard.

I also need to talk about diminishing returns with the (seemingly) boundless potential of how TMR could be implemented in our tech. It comes down to the limitations of the human body, particularly when considering just how granular a movement we really need to make when using our thumbs on an analog stick.

TMR is technically capable of far smaller deviations than Hall Effect; however, a human thumb, even from the best gamers in the world, just isn't really going to be able to take advantage of the sub-millimeter differences in micro-adjustments here.

Specifically sticking with the example of using a game controller, we also need to consider dead zones, which are baked into most modern games at 3-5%, allowing for player error. A controller's dead zone is designed to ignore small movements to stop your in-game character model (or the camera) from moving, while keeping your aim fast, and (theoretically) removing any shakiness. This feature is found in even top esports games such as Fortnite, Rocket League, and Apex Legends.

In gaming keyboard terms, both Hall Effect and TMR greatly innovate over standard mechanical decks through rapid trigger, which dynamically resets a key at the exact moment it's pressed and turns off the instant it is released with no fixed rebound. Because there's no need for metal-on-metal contact, there's no spring-back time, and it's instantaneous; it allows for superior counter-strafing in Counter-Strike and gives you a far better chance to land that Vandal five-stack in VALORANT, provided you actually let go of the key before micro-adjusting with your mouse.

The direct comparison of whether rapid trigger is actually any better with TMR than with Hall Effect again comes down to an infinitesimal difference for a human finger. If you're able to measure both magnetic technologies with 0.1mm precision and an 8,000Hz polling rate, effectively eliminating latency, then the higher raw signal resolution of TMR just isn't going to make any tangible impact here, because (unless you're in the top 0.01% of gamers) you will be the bottleneck.

What are the best Hall Effect and TMR controllers and keyboards right now?

There's no shortage of high-quality Hall Effect controllers and keyboards dominating the gaming market, particularly from the major players in the peripherals scene. The Boomslang brand aside, you only need to look as far as the Corsair Vanguard Pro 96, the Asus ROG Falchion Ace 75 HE, the SteelSeries Apex Pro TKL Wireless Gen 3, Wooting 80HE, or the Pulsar Gaming Gears eS HE 70 to see how gamers have welcomed magnetic sensor tech.

By comparison, there are relatively few gaming keyboard manufacturers turning their attention to TMR in 2026, with the most prominent examples of these boards being the Cherry K5 Pro TMR Compact or the Cherry MX 8.2 Pro TMR Wireless, as well as the latest decks made by Keychron. Again, TMR keyboards face the hurdle of being far more expensive to produce, with supply chain issues and dubious consumer knowledge and understanding, despite being the superior way to play (at least on paper).

TMR controllers are far more commonplace than gaming keyboards that have adopted the tech, thankfully. You only need to look as far as the Steam Controller (2026), the Razer Wolverine V3 Pro 8K, and the Asus ROG Raikiri 2 for proof of this. It's not just the pricier name-brands getting in on this action, either. That's because there is a wealth of budget TMR gamepads worth considering, such as the GameSir G7 Pro 8K and the Gulikit ES Pro, too.

What does the future hold for TMR and Hall Effect tech?

Neither Hall Effect nor TMR will disappear anytime soon. In fact, considering that TMR technology is becoming cheaper to produce and is starting to become more widespread in keyboards and controllers, it's highly likely that more manufacturers will see the advantages of magnetic resistance when weighed against magnetic voltage.

Prices will come down, particularly when the larger manufacturers start to mass produce items which will (inevitably) be revised and innovated upon in the next handful of years.

HE and TMR may sound like buzzwords added to the names of peripherals at the moment, but eventually, they will be the standard, and a lack of magnetic tech could be seen as a dealbreaker.

True, breaking into the mainstream will depend on how the 10th console generation goes; if Sony and Microsoft adopt TMR tech for their new controllers, then that will signal the changing tide. Considering the eye-watering price next-gen consoles could command, it's certainly possible.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1664) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1664) — hint #2 — repeated letters

Quordle today (game #1664) — hint #3 — uncommon letters

Quordle today (game #1664) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1664) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1664) — the answers

The answers to today's Quordle, game #1664, are…

• RIDER
• MOLDY
• MEALY
• LYMPH

Another day featuring a word without vowels.

I already had the Y here, so it was simply a case of finding the P to make up LYMPH.

Y was the hero letter of the day featuring in the trickiest word but also helping out at the end of two others — MOLDY and MEALY — making for an easier game than usual.

Daily Sequence today (game #1664) — the answers

The answers to today's Quordle Daily Sequence, game #1664, are…

• FIBRE
• JUMPY
• LATHE
• LIVER

Quordle answers: The past 20

• Quordle #1663, Friday, 14 August: SEIZE, MYRRH, SANER, GLOAT
• Quordle #1662, Thursday, 13 August: TOPAZ, PURGE, WHINE, SIGHT
• Quordle #1661, Wednesday, 12 August: HOTLY, CROWD, HEART, SWASH
• Quordle #1660, Tuesday, 11 August: ONSET, BRAWL, TEPID, SLANG
• Quordle #1659, Monday, 10 August: GAVEL, CRUSH, SPEED, ETHOS
• Quordle #1658, Sunday, 9 August: KAPPA, WIDEN, FOLIO, STEEP
• Quordle #1657, Saturday, 8 August: FUROR, BUGLE, REUSE, SCOOP
• Quordle #1656, Friday, 7 August: AMISS, SHIRK, SALSA, RABBI
• Quordle #1655, Thursday, 6 August: AMUSE, BRAND, CEDAR, BLURB
• Quordle #1654, Wednesday, 5 August: MOUND, WRONG, STOOD, WEIRD
• Quordle #1653, Tuesday, 4 August: GOOEY, TARDY, HUMAN, CHALK
• Quordle #1652, Monday, 3 August: FUNGI, MUDDY, DEBUT, MANIA
• Quordle #1651, Sunday, 2 August: BOOTH, EASEL, REACH, MAKER
• Quordle #1650, Saturday, 1 August: OMEGA, BIRCH, SMOCK, EERIE
• Quordle #1649, Friday, 31 July: MANIA, SINGE, STOOL, LOFTY
• Quordle #1648, Thursday, 30 July: MODAL, IDLER, CHUMP, LUMPY
• Quordle #1647, Wednesday, 29 July: GAWKY, ALLOY, AUDIT, LATCH
• Quordle #1646, Tuesday, 28 July: SMITE, ROACH, RUDDY, GLOBE
• Quordle #1645, Monday, 27 July: TAFFY, FIGHT, GUILD, WAGER
• Quordle #1644, Sunday, 26 July: STOMP, LIMIT, FUNKY, STEAD

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #895) - hint #1 - today's theme

NYT Strands today (game #895) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• BASE
• PULP
• CLAN
• SELL
• CHIP

NYT Strands today (game #895) - hint #3 - spangram letters

NYT Strands today (game #895) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #895) - the answers

The answers to today's Strands, game #895, are…

• PULPIT
• BIBLE
• ALTAR
• HYMNAL
• CANDLES
• LECTERN
• SPANGRAM: INCHURCH

• My rating: Easy
• My score: Perfect

Some days the theme puzzles me, but today was one of those where you get it immediately and spot the spangram first.

After this it was just a case of finding the various churchy things — of which there are legions.

My favorite thing you see INCHURCH was not included: stained glass windows. I love them and think they should be everywhere — schools, supermarkets, police stations, stadiums — not just picturing the life and times of saints but also the incredible wonders of the secular world.

Yesterday's NYT Strands answers (Friday, August 14, game #894)

• SLINKY
• VELCRO
• PLASTIC
• MICROWAVE
• PENICILLIN
• SPANGRAM: INVENTIONS

• Researchers uncovered “Download more RAM” flaw in consumer DDR4/DDR5 memory
• Attack bypassed Windows VBS and HVCI, disabling antivirus and protections
• Microsoft patched CVE‑2026‑23670; tools now help enable memory write protection

Microsoft has recently fixed a vulnerability that allowed threat actors to bypass advanced security measures, disable antivirus software, and expose the target device to full system takeover.

All of this, it seems, could have been possible with a very simple script, and a single click from the victim’s side.

Luckily, the vulnerability was discovered by white hat hackers, reported to Microsoft and remedied before falling into the wrong hands.

Download more RAM

During the 2026 USENIX Security Symposium, security researchers from the University of Birmingham and Durham University presented a discovery they called “Download more RAM”.

According to the researchers, some consumer memory chips (DDR4 and DDR5 DIMM) allowed software to alter the configuration reports it sends to the motherboard. In practice, it means that a threat actor could instruct the RAM chip to tell the computer it was bigger than it actually was, making the device “think” it has twice as much RAM memory as it actually has.

The researchers then established that this phantom extra memory can serve as an alias for real memory locations, granting them the ability to both read, and modify, memory allocations that should be under the processor’s, and Windows’ protection.

This window let them work around both Virtualization-based Security (VBS) and Hypervisor-Enforced Code Integrity (HVCI).

VBS, first introduced with Windows 10, is a security feature that uses hardware virtualization to isolate critical security functions from the OS, while HVCI uses virtualization to make sure only trusted and verified code can run in the Windows kernel.

The researchers also used the flaw to disable both antivirus and endpoint detection and response (EDR) software, re-introduce older, vulnerable drivers, compromise corporate systems under lockdown, and bypass kernel-level game anti-cheat protections.

The worst part is that this entire process can be chained together into a one-click script. In theory, if a victim is served this script as a file and they run it, they would trigger a chain of events that includes creating memory aliases, rebooting the computer, and disabling security protections.

"Our work exploits the fact that all processes share the same memory to bypass Windows' strongest security guarantees,” said Professor Tom Chothia, from the University of Birmingham. “Previous attacks of this kind needed a screwdriver and physical access to the machine. This one just needs a script. That changes who can carry it out and how far it can spread."

Who is vulnerable and how to stay safe

The attack surface is rather large, as well. The researchers analyzed the market and found three major manufacturers (Corsair, G.Skill, and ADATA) shipping at least one consumer memory product line in which the configuration chip was left entirely unprotected. Together, these vendors make up more than half (55%) of the high-performance consumer memory market and more than 70% of the gaming market (this doesn’t mean that 55% of the high-performance market is vulnerable - many devices are running other modules, too).

Modules from Crucial, Kingston and HyperX, and some G.Skill lines, were found to use partial write protection, but still enough to keep the device secure.

Before publishing their work, the researchers disclosed their findings to Microsoft, who quickly addressed it. The bug is now tracked as CVE-2026-23670, and is described on the National Vulnerability Database (NVD) as an “untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave” which “allows an authorized attacker to bypass a security feature locally.”

The bug was given a severity score of 5.7/10 (medium), and was fixed as part of the April 2026 Patch Tuesday cumulative update. Therefore, systems with Secure Boot running should be protected against this vulnerability.

Corsair added a feature to its iCue tools that lets users retroactively enable write protection on their memory modules. There is also a free tool called HWinfo with the same functionality, the researchers said, stressing that it mitigates the issue on non-Corsair models. Also, some motherboards offer a BIOS setting to block writes to memory configuration chips, which users can enable as an interim measure.

“The ‘Download More RAM’ attack demonstrates once more the importance of understanding systems, especially in terms of security guarantees. If a lower layer can become compromised, it puts the full system at risk,” said Dr Marius Muench, from the University of Birmingham.

“Windows makes a strong promise: that even an attacker with administrator rights can't touch the secure kernel. We found that promise rests on the assumption that your memory is telling the truth about itself - on a lot of the memory people actually buy, it doesn't have to."

• Huntress uncovers Shopify refund scam using fake orders and app notifications
• Attackers embed contact details in shipping addresses to trick victims into paying
• Users advised to ignore suspicious info, verify refunds, and report fake stores

Hackers are targeting businesses and individuals running Shopify stores with a highly sophisticated fake refund scam, experts have warned.

Security researchers at Huntress outlined how the fake refund scam works: first, a victim gets a notification that they received a refund. It could be for a returned iPhone, or a canceled service or order. The “refund” can be anywhere from a few hundred, to a few thousand dollars. Soon after, the scammers call (or mail) the victim, say they work at the company that gave the erroneous refund, and convince the victim to return the funds.

If the victim complies, they are actually sending their own money to the victims, since the “refund” part never happened.

Abusing Shopify's infrastructure

There are a couple of ways to pull this attack off: sometimes the scammers really make the initial transaction, but are able to cancel it and return the funds; in other scenarios, they create spoofed pages showing the transactions, tricking those slightly more gullible.

In most cases, fake refund scams can be spotted relatively easily, which is why they are not that popular nowadays. However, this new campaign comes with a sinister twist that will make even hardened veterans wince.

Huntress’ report notes the attackers start by creating a Shopify store of their own (or use a compromised one). The one the researchers observed was called “My Store” and was later deleted before it could be further scrutinized. Then, the attackers make a fake order themselves, setting their targets as the recipients using their phone numbers, or email addresses.

This type of information isn’t that difficult to come by these days. There are hundreds of email and phone number databases leaked on the dark web, which can be picked up for free (or for a handful of dollars). When they submit the purchase order, a notification appears in the victim’s Shop apps.

Yes, that’s right. In the Shopify app itself. Coming through Shopify infrastructure. As such, it can easily be confused for an authentic notification. It is even worse for users that enabled push notifications on their mobile phones, since they’ll see a notification with the Shopify logo, next to all the other notifications on their phone.

But the attackers still need to pull off the hardest part - getting the victim to “return” the money. In this case, instead of calling or messaging them, they leave their contact information in the shipping address, hoping victims would panic and reach out themselves.

In one shared example, the shipping address was listed as: Owen Nolan “2856 If You Didnt Place This Order Call Us at 1_888_690_3420-”, Albany NY United States 1_888_690_3420.”

For those treading carefully through the internet’s wastelands, the message included in the shipping address is an immediate red flag. Grammar mistakes, all letters capitalized, and a phone number completely out of place should be quite an obvious sign of an attempted fraud. However, since these kinds of scams bet on people being fast, reckless, overworked, and afraid, it might just work.

Huntress did not say if the scam made any meaningful impact among the Shopify’s community, or if it targeted a specific subgroup of users.

Defending against fake refund scams

To protect against such attacks, the researchers advise users never interact with phone numbers, email addresses, or links contained in an order that aren’t recognizable. They also advise users concerned about the security of their SHop account or personal data to contact support, and stress users should check their bank accounts to confirm whether they were actually changed. If they weren’t, they can report the order as “Not my order” in the shop app.

Finally, when purchasing from a store on Shop in general, users should check the store and its product reviews to learn about other customers’ experiences. If users are concerned that a product or store could be fake, it can easily be reported. Many of the shops in this scam were brand-new, with some using a "coming soon" description, as well.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1663) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1663) — hint #2 — repeated letters

Quordle today (game #1663) — hint #3 — uncommon letters

Quordle today (game #1663) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1663) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1663) — the answers

The answers to today's Quordle, game #1663, are…

• SEIZE
• MYRRH
• SANER
• GLOAT

I really messed up today’s game and lost my win streak in the process.

Instead of playing tactically and getting MYRRH sooner (I spotted too late that without vowels there was only one possibility) I persisted in trying to get a word with too many options and ran out of guesses.

Daily Sequence today (game #1663) — the answers

The answers to today's Quordle Daily Sequence, game #1663, are…

• EASEL
• INDEX
• ERROR
• POINT

Quordle answers: The past 20

• Quordle #1662, Thursday, 13 August: TOPAZ, PURGE, WHINE, SIGHT
• Quordle #1661, Wednesday, 12 August: HOTLY, CROWD, HEART, SWASH
• Quordle #1660, Tuesday, 11 August: ONSET, BRAWL, TEPID, SLANG
• Quordle #1659, Monday, 10 August: GAVEL, CRUSH, SPEED, ETHOS
• Quordle #1658, Sunday, 9 August: KAPPA, WIDEN, FOLIO, STEEP
• Quordle #1657, Saturday, 8 August: FUROR, BUGLE, REUSE, SCOOP
• Quordle #1656, Friday, 7 August: AMISS, SHIRK, SALSA, RABBI
• Quordle #1655, Thursday, 6 August: AMUSE, BRAND, CEDAR, BLURB
• Quordle #1654, Wednesday, 5 August: MOUND, WRONG, STOOD, WEIRD
• Quordle #1653, Tuesday, 4 August: GOOEY, TARDY, HUMAN, CHALK
• Quordle #1652, Monday, 3 August: FUNGI, MUDDY, DEBUT, MANIA
• Quordle #1651, Sunday, 2 August: BOOTH, EASEL, REACH, MAKER
• Quordle #1650, Saturday, 1 August: OMEGA, BIRCH, SMOCK, EERIE
• Quordle #1649, Friday, 31 July: MANIA, SINGE, STOOL, LOFTY
• Quordle #1648, Thursday, 30 July: MODAL, IDLER, CHUMP, LUMPY
• Quordle #1647, Wednesday, 29 July: GAWKY, ALLOY, AUDIT, LATCH
• Quordle #1646, Tuesday, 28 July: SMITE, ROACH, RUDDY, GLOBE
• Quordle #1645, Monday, 27 July: TAFFY, FIGHT, GUILD, WAGER
• Quordle #1644, Sunday, 26 July: STOMP, LIMIT, FUNKY, STEAD
• Quordle #1643, Saturday, 25 July: SALON, SHEEN, BURST, GOURD

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #894) - hint #1 - today's theme

NYT Strands today (game #894) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• VOICE
• SINK
• CRAVEN
• LINE
• COIL
• NICE

NYT Strands today (game #894) - hint #3 - spangram letters

NYT Strands today (game #894) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #894) - the answers

The answers to today's Strands, game #894, are…

• SLINKY
• VELCRO
• PLASTIC
• MICROWAVE
• PENICILLIN
• SPANGRAM: INVENTIONS

• My rating: Hard
• My score: 2 hints

There were so many Vs in today’s game that I convinced myself that the word “vinyl” was in the grid somewhere and that the theme was all about crate digging and finding some secret album.

I could not have been more wrong. Something I only learned after two hints gave me SLINKY and VELCRO and I realized I had wasted five minutes daydreaming about record shops.

It was not until I got the spangram — and eliminated the last of the Vs — that I finally realized what the search was about and how one of the greatest medical discoveries of history was connected to a spring that goes downstairs.

Yesterday's NYT Strands answers (Thursday, August 13, game #893)

• FIERCE
• HEATED
• TORRID
• INTENSE
• ZEALOUS
• SPANGRAM: FIREBRAND

• China launched a fully autonomous vulnerability hunting attack against Taiwan
• The attack leveraged eight open-source AI models to hunt for new attack vectors
• The attack hit Taiwan government accounts, personnel records, the nuclear safety agency, and more

A first-of-its-kind cyberattack using autonomous AI has been spotted attacking Taiwan, and it compromised 85 government accounts and stole over 2,500 personnel records before moving on to hit the country’s nuclear safety agency and at least seven energy companies.

The attack used eight open-source AI models to build a hacking program that was able to independently conduct reconnaissance and intrusion, and was able to chain vulnerabilities and change tactics whenever it was blocked.

The intrusion took place over the course of four days, and was first exposed by The Financial Times on August 12, 2026. The FT article covered research performed by Dream, an Israeli AI and cyberdefense company that first identified the breach.

Autonomous AI attack

The attack was first uncovered during routine monitoring of cyber criminal activity. Dream found a 160MB online archive of 1,395 files. Further examination of the files revealed that the attack relied on Hermes and OpenClaw - two open-source AI agents.

As is typical of attacks relying on AI models, the hackers had framed the context of the intrusion as a routine cyber readiness test in order to bypass the built-in guardrails of the AI models.

The attack used multiple agents to hunt for new vulnerabilities and access points across the internet, providing the tool with multiple attack paths to take if one failed to gain entry.

AI agents have been quickly integrated into the attacks of cybercriminal organizations and state-sponsored threat actors alike, enhancing their abilities to launch highly complex attacks at scale. “This must be the basic assumption of every government around the globe,” said Amir Becker, Dream's chief strategy officer.

Dream did not tie the attack to any specific cybercriminal group, nor did it confirm the target of the attack, but said it had alerted a government in the “Asia-Pacific.” Documentation within the recovered archive contained Simplified Chinese, which is the official written language used in mainland China.

The archive also contained data collected from the targets, which was written in Traditional Chinese. This form of written Chinese is widely used in Taiwan, Hong Kong, and Macau.

Taiwan's Ministry of Digital Affairs has refused to comment on the breach, and the Chinese authorities have not responded to requests for comment.

China has long considered Taiwan to be a part of mainland China. Taiwan declared its independence following the end of the Chinese Civil War in 1949. A report from Taiwan’s National Security Bureau earlier this year revealed that the country was subject to 2.5 million Chinese cyberattacks per day in 2025.

Expert perspective on autonomous AI attack

Collin Hogue-Spears, senior director of solution management at Black Duck:

The agents ran the intrusion end to end and invented nothing new to run it with. Familiar identity and API failures opened every confirmed path into Taiwan's systems. Dream Research Labs documented up to eight subagents working concurrently across twelve waves, ranking attack paths, redirecting when a technique failed, and researching alternatives online before trying again.

What they found was exposed development endpoints, an API accepting authentication tokens with the signature check disabled, unauthenticated data APIs, and passwords built from employee ID numbers.

The framework also ran its own AI static analysis hunting unknown flaws, but Dream says it worked against two public single sign-on SDK sample projects, and none of those findings produced a confirmed exploit on the live systems. No zero-day appears anywhere in the report, but a nuclear safety regulator does.

In conventional web and identity logs, this reads as a security scan. The distinguishing signal is the sequence across systems, not any single request. The tell is not the request. It is what the same account does next, somewhere else.

Conventional scanners have tested thousands of endpoints at machine speed for twenty years, so raw coverage is not the change here. What Dream Research Labs describes is chaining: password spraying, then fresh SSO sessions, then access to routes an account had never touched, then the same suspected weakness retested until it held, then one identity surfacing across several connected applications.

Simplified Chinese in the operator's notes is one signal. Traditional Chinese in the stolen files is just Taiwan. Dream rested its China assessment on a code-switching observation, and only half of it points at the attacker. Per Chinese-language coverage of the report, Simplified characters appeared in the operators' internal communications and Traditional characters appeared in the exfiltrated data. The first describes the operator's working language. The second describes the victim, because that is what Taiwanese government files look like [Traditional Characters].

The evidence therefore supports a Chinese Mainland-language operator against a Taiwanese target, with a target profile consistent with mainland collection priorities. It does not name a group or establish state direction. The report also publishes no indicators, no hashes, and no victim confirmation; it does not identify the model, and its executive summary claims installed backdoors while its own attack chain says authentication blocked the web shell.

Security leaders must reject unsigned authentication tokens and prohibit the alg:none setting outright, and separately require reauthentication or multi-factor at any single sign-on boundary into a sensitive system. Dream describes two independent identity failures in Taiwan, and closing one leaves the other open. Provider guardrails cannot compensate for a password-only SSO bridge.

They must also monitor route diversity per source, per session, per account, and per device rather than by request rate alone, because a distributed set of agents spreads requests across addresses and sessions that no single volume threshold catches. If your detection assumes one attacker at one address working one path at a time, you have modeled the wrong shape.

Your thresholds were built for one attacker on one path. This was eight, in parallel. And they must ask two questions of any AI attack disclosure before acting on it: which model ran the operation, and what can we hunt on tomorrow morning?"

Via United24

It's no secret that it's hard to find a decent deal on a gaming laptop these days. The spiralling price of components has really hit all machines — not just laptops.

I think I've just spotted a rare listing at Walmart, however, that almost reminds me of a pre-RAM crisis deal. It's this Gigabyte A16 with an RTX 5070 for $1,249 (was $1,849).

While it's not exactly cheap, this Gigabyte's combination of an RTX 5070 graphics card and 32GB of RAM has caught my eye. Such a pairing is rare these days at $1,500, let alone for under $1,300. With such components, you should get a decent level of performance with most modern titles.

There are a few caveats, of course. The 13th-gen Core i7 chipset in this Gigabyte laptop isn't exactly the latest on the market. The A16 is also one of the more budget-oriented machines from the brand, so I wouldn't expect a particularly lightweight design or a very high-end display. This machine is definitely more about the sheer bang for the buck, rather than any fancy bells and whistles.

RTX 5070 gaming laptop deal at Walmart

• See more: check out all of today's deals at Walmart

I could see this laptop being a good option for prospective students headed off to college later this year. In terms of power, it's definitely enough to play most of the latest titles at relatively high graphical settings. It's perfect for a dorm room gaming setup away from home if you still want to play all your favorite games.

It's worth noting, however, that this isn't a super portable machine. It's just over 8lbs, so relatively heavy, and I would assume the 13th-gen i7 chipset won't have the best battery life. You'll almost certainly have to carry a power brick with you with this laptop, which can obviously add a lot of additional weight.

• Apple's MacBook Air is facing supply constraints, as delivery estimates last up to a month
• The delivery delays are a direct result of the ongoing RAM crisis
• Consumers may have to look at Windows alternatives, as the RAM crisis gets worse

PC hardware manufacturers can't catch a break from the ongoing RAM crisis, and unfortunately, Apple arguably knows that more than anyone.

As reported by 9to5Mac, MacBook Air shortages are worsening, as delivery estimates for configurations on Apple's online store are longer than usual. Nearly all configurations have a 2-3 week shipment estimate, while those with 32GB of RAM have up to 4-5 weeks.

It's increasingly clear that RAM shortages are causing supply issues for Apple, and the extended delivery estimates come shortly after Apple's recent slate of price hikes on Macs and iPads. Notably, the MacBook Air M5 saw a $200 price increase earlier in June, and despite that, shortages remain.

Supply is so bad that 9to5Mac notes that Apple retail employees state that the MacBook Air shipments are "more constrained than they can ever recall", and that's a fitting statement since the PC hardware market is possibly at its worst state ever.

Fresh rumors also point to Apple being set on a price increase for its iPhone 17 — so without a doubt, proceedings aren't looking great for the tech giant (and several other hardware companies) in terms of supply stability.

Apple also has a history of rarely dropping prices for its devices, so the only other options consumers have are to buy MacBooks from other retailers or consider Windows alternatives.

What now?

Outside of Apple's online store, Amazon currently has the 13-inch M5 MacBook Air available at a lower price ($1,256) and a shorter delivery window using Prime. The same applies to several other configurations, including the 15-inch model.

Apple's RAM and supply constraints won't end anytime soon, so Windows alternatives are also sensible for consumers to aim for. The Lenovo Yoga Slim 7x, Yoga Slim 7i Aura, and even Dell's XPS 13 are solid laptop options. They may not all match the MacBook Air in performance, but they are enough to get the job done.

There's no better time than now for consumers to act on purchasing a new laptop, as insiders like Mark Gurman and even Apple chief financial officer Kevan Parekh indicate that Apple's supply constraints aren't set to improve, but only worsen — and that likely extends to 2027 and beyond.

• Nightmare Eclipse discloses ShieldBreak, a new Windows privilege‑escalation zero‑day
• Flaw bypasses a recent patch and works on fully updated Windows 11 systems
• Researcher’s ongoing exploit spree leaves multiple Windows vulnerabilities still unpatched

Nightmare Eclipse has struck again! The notorious zero-day researcher with a Microsoft grudge disclosed its latest vulnerability, and just as in previous instances, they picked their timing and released their research hours after Microsoft published its August Patch Tuesday cumulative update in order to maximize the hurt.

The newest flaw is called ShieldBreak, and is described as a local escalation of privilege vulnerability that allows threat actors to gain SYSTEM-level privileges on vulnerable systems. Speaking of vulnerable systems, the list is rather long because it includes all versions of Windows 11, including those with the latest security patches.

“The PoC was tested in the latest version of windows 11 25h2 (+Canary channel) and windows server 2025, the PoC also have a 100% success rate,” Nightmare Eclipse said on their GitHub account. “Please note that Windows 10 (and respective server editions) are not currently supported, they are however vulnerable to ShieldBreak as well.”

A bypass for the RoguePlanet fix

The mysterious attacker also said that the bug was actually a bypass for the patch Microsoft issued to fix their earlier work, called RoguePlanet.

“Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass,” the GitHub read entry.

Microsoft, on the other hand, responded in pure enterprise fashion, sharing a boilerplate statement that it was “investigating” and that it “supports coordinated vulnerability disclosure”.

In response to an enquiry by The Register, a company spokesperson said Microsoft "is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims."

"Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible,” the statement reads. “Importantly, we support coordinated vulnerability disclosure, an industry standard that protects customers and supports the research community by ensuring their findings are thoroughly investigated and addressed before being made public."

A hacker on a mission

Together with ShieldBreak, the number of disclosed Windows vulnerabilities and exploits now counts 10. Nightmare Eclipse’s campaign began in April 2026, when they demonstrated BlueHammer, a Windows Defender local privilege-escalation flaw that gives low-privileged users SYSTEM-level access. The researcher claimed BlueHammer, now tracked as CVE-2026-33825, was previously reported to Microsoft, but the company allegedly mishandled the disclosure.

Just before publishing the work, they said “someone violated our agreement and left me homeless with nothing. They knew this will happen and they still stabbed me in the back anyways, this is their decision not mine.”

At first, Microsoft took a tough stance, calling the public release “never justifiable” and even warning that it might pursue legal cases against people who put customers at risk.

The community interpreted this statement as a threat of legal action against Nightmare Eclipse, which triggered a backlash. Microsoft later backed away, saying “to be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research.”

In the meantime, Nightmare Eclipse (also known as Chaotic Eclipse) went on a full-blown rampage. They released RedSun and UnDefend (both targeting Defender), YellowKey (a BitLocker bypass), GreenPlasma (a CTFMON-based privilege-escalation flaw), MiniPlasma (a regression of a vulnerability Microsoft had originally fixed in 2020), RoguePlanet (another Defender privilege-escalation bug), GreatXML (a BitLocker/Windows Recovery Environment bypass), LegacyHive (a Windows User Profile Service privilege-escalation flaw), and now ShieldBreak.

BlueHammer was fixed in April, RedSun and UnDefend in May, and YellowKey, GreenPlasma, and MiniPlasma, in June. RoguePlanet was patched in July, while LegacyHive, GreatXML, and ShieldBreak, remain unpatched.

It is also worth mentioning that not all of Nightmare Eclipse’s releases were equally complete or reproducible by third parties. For GreenPlasma, independent researchers said it contained the vulnerability but turning it into a reliable working exploit required significant additional technical work. Some of the early Defender exploits were also apparently difficult to reproduce, mostly because they relied on delicate race conditions and very specific sequences of Windows components.

ShieldBreak, however, seems to be more dangerous in that respect. Speaking to The Register, security researcher Kevin Beaumont confirmed it as working: “I've tried it, it works on latest Windows 11,” he told the publication.

He also said that while ShieldBreak was described as a bypass for the RoguePlanet fix, the two flaws actually operated quite differently.

“RoguePlanet was a filesystem race condition vuln that uses virtual disks and NT native file manipulation to trick quarantine process into overwriting system files,” Beaumont explained. “ShieldBreak user-mode callback hook to change file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API).”

No one knows how much ammunition Nightmare Eclipse still has, but we will certainly be paying attention to them in the hours after next month’s Patch Tuesday, as well.

• WindRelay campaign used vishing plus custom malware to turn phones into POS skimmers
• Victims installed personalized RATs and NFC malware, enabling real‑time card theft
• Attacks were highly targeted across Eastern Europe, with only a few individuals hit

Hackers are turning people’s smartphones into malicious Point of Sale (POS) devices and stealing their money directly from their payment cards, experts have warned.

Security researchers Group-IB spotted multiple such attacks across Eastern Europe, and named the campaign WindRelay, after the custom-built malware used during the attacks.

The report notes this is a highly sophisticated, custom-tailored attack designed specifically for the victim. It starts with some form of reconnaissance, in which the attackers learn their victim’s identity, phone number, and likely other details. Although the researchers don’t discuss it, it is quite possible that the attackers obtained (or purchased) the data from unrelated data breaches and leaks.

Vishing and malware

After learning a little bit about their target, the attackers get to work. They first prepare a remote access trojan (RAT) named SpyNote. They personalize the label with the victim’s own name (instead of it being a generic or impersonated brand), to build trust with their victim:

“Such tactics are more effective at weakening a victim’s natural defenses and suspicions,” the researchers noted in the report. “It removes the one cue people are trained to check before installing something unfamiliar — a strange or generic app name — right at the moment they’re most likely to hesitate.”

Then, they call the victim on the phone and introduce themselves as employees of their target’s bank. They claim the victim has a problem with their bank card, and instruct them to deploy SpyNote through the device’s package installer (the standard way to sideload apps outside an official app store).

SpyNote is a classic RAT that the attackers then use to deploy stage-two malware themselves. In this next step, they personally (as opposed to having the victim do it) install WindRelay, custom near-field communication (NFC) malware designed to capture contactless payment card data in real-time, when a card is tapped against the phone.

In other words, the malware turns the smartphone into a POS, and when a victim taps their card against it, the information is relayed to an attacker’s terminal.

Vishing + malware

Vishing + malware combo is nothing new. We’ve seen it deployed numerous times before, and ShinyHunters are probably the shiniest example of the practice (pun definitely intended). Over the last couple of years, ShinyHunters have been calling their victims on the phone, impersonating the IT department, and getting their victims to log in via fake login portals which relay the credentials to the attackers.

They then use the credentials to access their victims’ SaaS products, exfiltrate as much sensitive data as possible, and then demand ransom in exchange for deleting the stolen files.

This new campaign, however, is a testament to the technique’s evolution. While ShinyHunters’ operatives only stay on the phone call until the victim logs in, these crooks remain on the line for as long as it takes. Group-IB says the average call lasts around 13 minutes, and by that moment, the victim will have installed both SpyNote and WindRelay, and has tapped their bank card against the phone, making unwanted payments.

In at least one case, the attackers successfully applied for a loan at the victim’s bank, stealing not only the money they had on their account, but also money they would have earned in the future.

The identity of the attackers is unknown at the time. We also don’t know exactly how many victims there were, but given the highly personalized nature of the attack, it’s safe to assume that there were only a handful.

Group-IB says it observed attacks in Czechia, Slovakia, and Slovenia, suggesting a threat actor focused primarily on Eastern European victims. The researchers also said they identified 23 samples uploaded to VirusTotal between November 2025 and July 2026, meaning the campaign was active for approximately seven months, targeting 23 individuals.

“The samples mimic various institutions from the targeted countries and contain text in the language of each targeted country,” the researchers said. “Some samples contain personalized UI elements and labels, such as the name of the victim, similar to the personalized RAT. This suggests the threat actor behind these campaigns most likely has the capability to dynamically build malicious applications tailored to individual victims.”

Group-IB says users should treat personalized app labels as a red flag and should apply extra friction to loan applications.

• Microsoft is again under fire for aggressively pushing Edge
• A survey conducted by the Browser Choice Alliance shows how deep some problems run
• That includes encountering 'challenges' while attempting to change default browsers, and users who get stuck with Edge when they don't want it

Microsoft has again come under fire for the way it pushes the Edge browser on Windows 11 users.

Windows Central highlighted a survey from the Browser Choice Alliance (BCA) which makes it clear that there are still issues around the way Edge is promoted in Microsoft's desktop operating system.

This was a poll of 2,000 adults in the US who own a Windows PC (either a laptop or desktop), and it found that the majority of respondents (86%) believe they should have "primary control over default browser choice", and moreover, most of those (80%) believe there should be a one-click system to pick that default.

The survey also found that: "72% of Windows users who tried changing default browsers in the past 1-2 years reported that they encountered challenges while attempting to do so."

That includes Windows "recommending or redirecting them back to the pre-installed browser" (Edge), or having website links or apps still open in Edge when it's not their default choice.

The BCA further observed: "Even after selecting a preferred browser, nearly 1 in 3 Windows users report experiences and tactics that undermine their ability to maintain that choice over time. They've fallen into a Reset Trap."

On that subject, 29% of users said that a Windows system update had "contributed to their browser preference being changed or reset".

Interestingly, 19% of respondents said that Edge was their preferred browser — which seems high compared to global stats — although 26% indicated that Microsoft's browser was set as their default in Windows 11. That means 7% of those surveyed had Edge as their default when they didn't want it.

Some of those presumably 'stuck' in this way may be older Windows 11 users, based on the survey's discovery that 44% of those over the age of 65 reported that changing their browser was a "complex" task in Windows 11, compared to 15% of those in the 18 to 44 age group.

61% of those aged over 65 felt "slightly or not at all confident in their own ability to consistently select and run the browser of their choice", which is a worryingly large percentage.

The survey maker concludes: "Microsoft should respect consumer preferences by removing unnecessary barriers and ensure users, not its operating system, remain in control over their browser experience."

Analysis: choice not challenges, Microsoft

It's worth noting that the Browser Choice Alliance is an organization that contains some rival browser makers, including Google (Chrome), Opera and Vivaldi. This doesn't make the report any less valid, but it's something to bear in mind.

I don't think there's any arguing with the broad conclusion drawn here, and that there are unnecessary hoops to jump through, and various annoyances, pertaining to Edge being foisted on Windows 11 users. On top of links unexpectedly opening in Edge, or outright resets of browser preferences in some situations, there's also Microsoft pushing folks to use its browser through 'recommendations' or ads of one kind or another.

It's all anti-consumer nonsense that needs to be stopped, and the fact that just over 70% of those who took the survey said they had "encountered challenges" in trying to change their default browser really isn't good enough.

Microsoft can do better than this, and in the EU, it does do better than in the US (or other regions) as another recent report commissioned by Mozilla (the maker of Firefox) pointed out.

Mozilla alleges that Microsoft engages in trick wording, nagging, preselection, and other underhand tactics to try to get Edge picked as the browser for Windows 11. However, due to regulations in the EU, countries in that region escape a lot of the more dubious activity in this regard. So, why doesn't Microsoft apply this improved approach with less hassling elsewhere? We know the answer to that, of course: it doesn't make any business sense.

It's not a good look if a company only implements pro-consumer policies because it's forced to, and for no other reason. But here we are…

Microsoft is certainly hearing Windows 11 users as part of the great campaign to fix the operating system, so maybe it'll start listening to browser users who want a fairer, more level playing field in the desktop OS. History very much suggests that it won't, though.

Over the last couple of days, I've become intimately aware of basically every product on sale at the new MSI UK Store than I thought one human ever could be. Why? Well, it's all because of a launch promotion that gives you the chance to buy one product each day for just £1.

As part of the MSI Cheat Code event, a voucher code has been hidden on one of the category or product pages on the MSI Store. The task is simple: search through those pages to find the hidden code, enter it at the checkout, and you'll come away with the product of the day for a single pound coin.

The catch, of course, is that the code is squirreled away in one of the hundreds of pages that make up the site. Plus, there's only one code available. So, as soon as someone finds it and uses it, the offer for the day expires.

Quite how or where it's hidden, I can't say for sure. It could be just in a part of the item description, or superimposed over one of the product images, or maybe even just hidden as white text somewhere on the page. I honestly don't know, as I still haven't found one yet. I don't think I'm smart enough to come up with a way to search through the page source to find anything easier, either — if that's even possible.

So far, a few lucky so-and-sos have come away with a monitor and a motherboard and AIO cooler bundle for a quid. Today's offer on a mesh Wi-Fi system is still yet to be claimed at the time of writing, so you can head over to the MSI Store to start searching now.

My eyes are on some of the products being featured in the next few days, though. Already confirmed are a case and power supply, a QD-OLED monitor, and, most importantly of all, an RTX 5060Ti. Bagging the latter for just £1 would be the bargain of the year, especially with all the ongoing issues with prices around PC components.

Whether anyone is successful or not, I'm sure this will at least make the metrics look good for MSI's new store, as loads of people repeatedly scour through every category and product page to try and find the hidden code. Now, if you'll excuse me, I'm returning to the hunt. I'll be interested to know in the comments if you have any luck.

• US government to allow private firms to conduct legal cyberattacks on foreign organizations targeting Americans
• Firms will be allowed to disrupt and destroy physical and virtual information systems and networks
• US victims of cyber scams and fraud lose around $20,000

President Trump has signed a memo which allows private US firms to partner with the US government in operations designed to surveille and disrupt Transnational Criminal Organizations (TCOs).

According to the memo, the partnership “will enhance our ability to counter TCO threats and combat transnational cybercrime, fraud, and other predatory schemes against American citizens,” essentially turning private companies into privateers with the ability to launch cyber attacks against foreign entities.

The memo marks a significant shift in how the US tackles foreign cybercrime. “American businesses’ innovative capabilities have historically been underutilized in efforts to identify and disrupt criminal networks operating in cyberspace,” the memo states. But what does this actually mean in practice?

US to leverage private sector for cyber defense

The US is the most targeted country in the world for cyber attacks and cybercrime, with 6.7 million victims losing $138.9 billion in the last year, placing the average loss per-victim at around $20,731.

The program will effectively create a global cyber surveillance network that acts as an early warning system against attacks targeting critical national infrastructure, such as the recent Iranian attacks targeting over 30 US water systems. Private companies that “discover an imminent cyber-attack against United States critical infrastructure” will be required to notify the National Coordination Center (NCC).

The US government isn’t just looking to work alongside the big tech companies. Big companies will be part of the picture to “provide critical capacity,” but smaller companies will also have the opportunity to become involved with the program as they are “more agile,” and “may be better suited for specialized or discrete tasks.”

When a threat is detected, private companies will put together a “cyber operations package” to be reviewed and approved by the Program Executive Directors. These packages will likely include plans for surveillance and offensive cyber operations.

Private companies looking to become part of the program will be vetted according to government guidelines, and will have to operate within a set of operating procedures under the oversight of the federal government. “No operation may be approved unless it complies with these operating procedures,” the memo says.

There is however a caveat that those involved within the program must “maintain a bond or escrow in an amount not less than $1 million,” which would be forfeit should a private company “enter non‑compliance with its contractual agreement.”

The memo also sets our parameters to prevent private companies from accidentally or intentionally targeting US citizens, or US information systems at home and abroad, with the company required to “cease such operation, conduct minimization procedures, and immediately notify the NCC,” in the event that a company “discovers operational activity exceeding the parameters and restrictions of the cyber operation”.

Additionally, “any activity authorized by the Program must be conducted subject to the oversight, operational control, and legal authorities of the United States Government”.

The memo is the latest step in the Trump administration’s efforts to allow private companies to legally launch cyberattacks on behalf of the US government. “The American private sector is the most innovative and technologically advanced in the world, and its scale, speed, and capacity secure a critical offensive cyber advantage for the United States,” the memo states.

The program will also put together a report on its progress every year, as well as reviewing the performance of each private company within the program within the same time frame.

• Photos of a Lenovo IdeaPad Vibe laptop have been leaked
• It's clearly similar to Apple's MacBook Neo in terms of its overall appearance and striking colors
• That said, the Lenovo device offers a better port selection and hints suggest it'll be more powerful, so likely pricier – but all of this is just theorizing

Lenovo appears to be readying a rival to the MacBook Neo, based on leaked photos of the laptop that have just surfaced.

Windows Latest got hold of the promo images of Lenovo's IdeaPad Vibe, publishing a bunch of them to give us a good look at the notebook (add your own seasoning around any such leak, but the material looks authentic enough).

Going by the trendy name, the 'Vibe' and the range of punchy colors (including a striking yellow, green and pink), it seems clear enough that this is aimed squarely at the Neo's territory – not to mention that it looks more than a little similar to Apple's laptop.

There are differences, of course: you won't find a Copilot key on a MacBook (mind you, a good many people don't want to find it on their Windows laptop, either).

Lenovo has also pushed for more connectivity than the MacBook Neo, and that's the biggest difference we can see just looking at the photos.

There's a pair of USB-A ports on one side, and two USB-C connectors on the other, along with an HDMI port, headphone jack and a microSD slot. As a reminder, you only get two USB-C ports with the Neo, plus a headphone jack, a barebones allocation for connectivity (and that's before we even mention the older USB speeds the MacBook Neo uses).

The photos also show cooling vents on the underside of the IdeaPad Vibe, so there'll be a fan for cooling (the Neo is passively cooled, meaning there's no fan).

There are thin bezels around the screen, and a tiny panel on top to house the webcam which also has a privacy shutter.

While the leak doesn't provide any specs, we do learn that based on the image file names, there will be one model with an AMD CPU, and one with a Qualcomm Snapdragon chip – although they both look identical.

Analysis: competitive vibes

The MacBook Neo has certainly stirred things up in the world of Windows laptops. It did this by coming in at a price point that surprised many (myself included), with Apple offering a lot of value with its new lowest-tier MacBook, which was very much recognized by buyers – it started flying off the shelves. Part of the cost-cutting effort here was dropping the RAM to 8GB, as you may recall, but despite this the Neo still manages to provide enough pep to cover everyday computing duties.

Since then, we've seen a host of planned 8GB laptops that run Windows 11, which was inevitable really, given the RAM crisis pushing up the price of memory (and storage, as well as other components) so much. The Neo also gave these machines a mainstream lead to follow, as it were.

An obvious sticking point, however, is Windows 11's performance running on 8GB compared to macOS. Now, Microsoft is working on fixing Windows 11 so it's speedier with just 8GB, and I'd argue that the Neo is a big reason for this happening. Well, that and the RAM crisis, of course.

In short, the MacBook Neo has forced Windows laptop makers (and Microsoft) to up their game, and Lenovo's effort here couldn't be a much clearer statement of echoing Apple's tactics with its budget laptop.

That said, the IdeaPad Vibe looks to be a more premium device than the Neo, with clues to that such as the privacy shutter, the much beefier port selection, as well as the overall sleek lines, and the active cooling. The latter means the Vibe will likely offer a good deal more performance grunt than the Neo, and it's surely going to be pricier as a result.

We don't get a hint of the price tag, but I'm betting that even after Apple's MacBook Neo price hike – it's no longer quite as affordable as it was at launch – the Lenovo machine's going to be a fair bit more expensive. We shall see, but the price is the main concern here, along with the people on Reddit who have reservations about Lenovo's build quality compared to Apple's (which really nailed quality in a lower-priced laptop).

One Redditor is skeptical and observes: "Pretty sure it won't share the same build quality [as Apple]."

Another adds: "IdeaPad 3 I had, had pretty bad hinges, lasts 1-2 year only."

The IdeaPad Vibe will obviously have to perform well enough on the build quality front if it does want to get in on the action and capitalize on the Neo's current popularity.

With a new school year almost upon us, Apple has brought back its education offer on MacBooks and iPads, making it a smart time to buy if you're shopping for some new tech.

• View all offers at Apple's Education Store

On top of small savings on several of its most popular laptops and tablets, you can also get a gift card of up to £120 with your purchase. While that can't be used on the product you're buying, you can put it towards other extras you might want, such as AirPods, accessories such as the Apple Pencil, or software like Apple Creator Studio.

One important point: you need to be an eligible student, parent, educator, or homeschooler verified on Unidays to take advantage of the offer. Once that's all set up, though, you simply go through the checkout process at the Apple Store using the same email address to prove that you qualify for the discount.

You can check out all of the best deals I've found below.

5 best Apple Education Store deals

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1662) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1662) — hint #2 — repeated letters

Quordle today (game #1662) — hint #3 — uncommon letters

Quordle today (game #1662) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1662) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1662) — the answers

The answers to today's Quordle, game #1662, are…

• TOPAZ
• PURGE
• WHINE
• SIGHT

A rare 5-vowel-game that also featured a rare letter.

Fortunately, I could only think of one word involving T, P, O, and A, so took the leap with few doubts.

Daily Sequence today (game #1662) — the answers

The answers to today's Quordle Daily Sequence, game #1662, are…

• BLURT
• FRONT
• ALLOY
• DITTO

Quordle answers: The past 20

• Quordle #1661, Wednesday, 12 August: HOTLY, CROWD, HEART, SWASH
• Quordle #1660, Tuesday, 11 August: ONSET, BRAWL, TEPID, SLANG
• Quordle #1659, Monday, 10 August: GAVEL, CRUSH, SPEED, ETHOS
• Quordle #1658, Sunday, 9 August: KAPPA, WIDEN, FOLIO, STEEP
• Quordle #1657, Saturday, 8 August: FUROR, BUGLE, REUSE, SCOOP
• Quordle #1656, Friday, 7 August: AMISS, SHIRK, SALSA, RABBI
• Quordle #1655, Thursday, 6 August: AMUSE, BRAND, CEDAR, BLURB
• Quordle #1654, Wednesday, 5 August: MOUND, WRONG, STOOD, WEIRD
• Quordle #1653, Tuesday, 4 August: GOOEY, TARDY, HUMAN, CHALK
• Quordle #1652, Monday, 3 August: FUNGI, MUDDY, DEBUT, MANIA
• Quordle #1651, Sunday, 2 August: BOOTH, EASEL, REACH, MAKER
• Quordle #1650, Saturday, 1 August: OMEGA, BIRCH, SMOCK, EERIE
• Quordle #1649, Friday, 31 July: MANIA, SINGE, STOOL, LOFTY
• Quordle #1648, Thursday, 30 July: MODAL, IDLER, CHUMP, LUMPY
• Quordle #1647, Wednesday, 29 July: GAWKY, ALLOY, AUDIT, LATCH
• Quordle #1646, Tuesday, 28 July: SMITE, ROACH, RUDDY, GLOBE
• Quordle #1645, Monday, 27 July: TAFFY, FIGHT, GUILD, WAGER
• Quordle #1644, Sunday, 26 July: STOMP, LIMIT, FUNKY, STEAD
• Quordle #1643, Saturday, 25 July: SALON, SHEEN, BURST, GOURD
• Quordle #1642, Friday, 24 July: DOLLY, EDIFY, LAGER, PRANK

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #893) - hint #1 - today's theme

NYT Strands today (game #893) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• CRIED
• SALE
• FORT
• BRAND
• ROVER
• EVENT

NYT Strands today (game #893) - hint #3 - spangram letters

NYT Strands today (game #893) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #893) - the answers

The answers to today's Strands, game #893, are…

• FIERCE
• HEATED
• TORRID
• INTENSE
• ZEALOUS
• SPANGRAM: FIREBRAND

• My rating: Hard
• My score: 2 hints

I don’t think I have seen a game that featured so many non-game words, which is possibly why I found it so hard to find the words we were actually looking for.

This, though, is what hints are for, although it took me two before I understood that today’s game had nothing to do with heating and everything to do with attitude.

Yesterday's NYT Strands answers (Wednesday, August 12, game #892)

• GIVE
• DONATE
• ENDOW
• BESTOW
• CONTRIBUTE
• SPANGRAM: PHILANTHROPY

• DapuStor's R6060 packs 512TB into a single E2 form-factor drive
• The drive doubles the capacity of E3.S and U.2 alternatives
• PCIe 5.0 and NVMe 2.0 protocols power this massive drive

DapuStor has unveiled a massive 512TB NVMe SSD at the FMS 2026 storage trade show event, pushing enterprise storage capacity into half-petabyte territory for demanding data center applications.

The drive, officially named the R6060, belongs to the company's high-capacity family and uses its newer E2 form factor design for enterprise storage systems.

At 512TB, the R6060 holds exactly twice the storage capacity of E3.S or U.2 drives, which top out near 256TB.

DapuStor packs half a petabyte into one drive

The 512TB SSD belongs to DapuStor’s high-capacity NVMe family and measures approximately 200 × 76 × 9.5 mm, giving it substantial capacity within a relatively compact enterprise storage form factor for NAND placements, allowing manufacturers to pack substantially more flash memory inside each device.

The drive pairs DapuStor's in-house DP800 controller with PCIe 5.0 connectivity and the newer NVMe 2.0 protocol standard used industry-wide.

DapuStor uses QLC NAND because modern workloads increasingly require huge storage capacity rather than maximum performance from every individual drive.

Artificial intelligence workloads require large repositories for training datasets, while inference systems can also generate substantial demand for high-capacity cache storage.

Video, audio, and other rapidly expanding datasets are creating similar demands, making high-capacity drives increasingly useful for data centers managing enormous volumes of information.

A server equipped with 36 E2 drive bays could theoretically accommodate 16PB of raw storage using these 512TB drives.

That density could reduce the number of servers, processors, memory modules, and networking components required for certain storage-heavy deployments.

The approach is particularly relevant to systems designed around 1PB and beyond, where physical infrastructure can become substantial.

Bigger drives could also reduce infrastructure requirements

The E2 approach can add more storage capacity to a single-CPU or dual-CPU server, potentially reducing overall system requirements.

Fewer processors, memory modules, chassis and network interfaces could also lower power consumption when storage capacity remains the primary requirement.

However, NAND pricing has become an increasingly important factor in determining the overall economics of extremely high-capacity solid-state storage.

Higher flash memory costs can make smaller drives more attractive, as multiple lower-capacity devices may offer greater flexibility in some deployments.

E2 could nevertheless offer another option by accommodating more NAND locations while using lower-density flash components in certain configurations.

That flexibility could potentially create lower-cost capacity points without requiring manufacturers to rely exclusively on the highest-density NAND available.

The 512TB R6060 therefore tries to increase storage density for systems handling rapidly expanding datasets and AI infrastructure demands.

DapuStor has not provided a confirmed price, although current NAND pricing suggests the drive will sit in the premium segment of enterprise storage.

The DapuStor R6060 arrives as NAND and DRAM suppliers report stronger market conditions following periods of weaker demand.

Via ServeTheHome

• Windows 11's August update is now rolling out
• It brings faster launch speeds to apps via functionality that was previously only available for certain Windows menus
• There's also a smart feature for Voice Access that deals with background noise interference, and some tweaks for search in Windows 11

Windows 11's August update has arrived, and it's mostly minor work, although there are a few notable moves with this new patch.

One important introduction is that Microsoft is extending a previously rolled-out feature — a secret sauce for faster launch times — to cover apps in Windows 11. That's good news for the performance you'll experience in the OS in general, and there are a couple of other nifty improvements besides.

Let's take a look at those, and I'll also round up some highlights of the rest of the work that's present in Windows 11's latest patch for those who are planning to grab it.

1. Faster app launches

One key move here is that apps are now going to launch faster in Windows 11, thanks to the extension of a previously rolled-out feature called Low Latency Profile (LLP).

Windows Latest flagged the deployment of this capability, which speeds up the launching of apps considerably. Note that LLP first debuted in June, but it only applied to certain parts of the Windows 11 interface (like the Start menu, for example, or Notification Center), and now it works for all your apps.

LLP nudges the processor when an app (or menu) is launched, asking for a brief speed boost so that the app in question will load a lot more quickly. If you have Task Manager open when you run an app, you'll see that as you start it, the CPU will ramp up its speed for a second or two, before returning to normal once the program is running.

Bear in mind that this ability is on a controlled rollout, which is normal for this sort of feature, as Microsoft tests the waters to make sure it's working as intended. This means you may have to wait a little while before getting it.

(While you can force the enablement of LLP with apps by using a bit of trickery via a Windows configuration tool, I wouldn't recommend this approach, and I'd advise simply waiting for the rollout to happen naturally. There could be a good reason why your PC has been swerved for this particular feature).

2. Voice Access improved to filter out background noise

Windows 11's built-in voice functionality (Voice Access) also gets a boost this month with a new feature called Voice Isolation. If this is switched on, it filters out any background noise, including other people speaking, so only your voice is picked up. Microsoft informs us (in the optional June update release notes, which was this patch in preview) that there's a setup process required to recognize your voice, but you only have to do this once.

There's another setting that just removes background noise (any non-speaking sounds), which doesn't require any setup. For those who do want the full Voice Isolation experience, you'll find the setup is accessed in Voice Access settings > Improve speech recognition.

3. Windows search improvements

Microsoft keeps taking steps to make Windows 11 search more user-friendly, and there are a couple of worthwhile additions in this update. First off, we're told that when searching for apps, Windows will handle typos better, so if you misspell the software you're hunting for, it should still be found. Likewise, partial app names will produce a result.

Furthermore, when you're searching for a Windows 11 setting, the more useful options should now appear higher in the returned search results. While these are more minor tweaks, Microsoft is clearly making strides towards search becoming a good deal better, and that includes some important streamlining work that's inbound (including ditching web results).

What else is new?

Other changes delivered by the August update for Windows 11 include new gesture controls for precision touchpads, which include the ability to adjust the default speed for zoom and scroll gestures. In the latter case, you also get scrolling acceleration applied so the more you repeat the gesture, the faster the scrolling becomes, allowing you to zip through long documents or web pages.

A useful piece of functionality has returned for laptops, too, namely the ability to set a level for when Energy Saver should be turned on (in Settings > System > Power & Battery). This was previously removed as Microsoft wanted the energy-saving feature to manage itself, but users were confused as to where the option had gone, and still wanted a manual setting present — so it's back (for now).

Widgets have also been tidied up so that the Lock screen only shows the weather by default (rather than multiple widgets), and notification badges in the taskbar use the Windows accent color rather than being red (making them less of a distraction).

There's a whole raft of minor tweaks, including Windows Hello getting support for peripheral fingerprint sensors and the addition of a "parental controls notice" during Windows 11 setup that points out online safety features for families.

• Lazarus expanded Dream Job with a zero‑day, new backdoor, and advanced relays
• Fake job lures, trojanized PDFs, and spoofed sites enabled high‑level compromises
• Targets included defense and aerospace firms, prompting stronger phishing awareness

Security experts from Check Point Research say they have uncovered a new wave of "Operation Dream Job" attacks, leveraging a previously undocumented backdoor, a brand new Windows zero-day vulnerability, and a never-before-seen webshell/relay.

Lazarus Group is a hacking collective on the payroll of the North Korean government. It is a state-sponsored threat actor known for targeting cryptocurrency developers and other professionals in the Web3 industry, stealing their tokens and using the money to fund the country’s weapons program and the wider state apparatus.

It is also known for running Operation Dream Job - a hacking campaign that’s been going on for years, and that lures victims with highly lucrative but bogus job opportunities.

What is Operation Dream Job?

The scam works like this: the attackers come up with a fake company, often in the software development, defense, aerospace, or military industries.

They create the fake company’s website, LinkedIn account, as well as fake people supposedly employed there. Then, they reach out to their targets, offering great working conditions, amazing salaries, and an opportunity to work on exciting projects.

Victims that take the bait are then led through a series of “interviews” and somewhere along the line, they are either given weaponized PDF files or asked to download and run executables and other code, as part of a “training exercise” or “skill evaluation”. At this moment, the victims get compromised, while the attackers gain access to their actual employers’ infrastructure.

From there, the ending can be relatively different. Lazarus has, on at least one occasion, stolen more than a billion dollars in cryptocurrency from one of its victims.

Ante up

Perhaps the biggest finding is that Lazarus even managed to fool Google - fake Lockheed Martin and Enveil job postings all made it through filters, while spoofed, malicious websites were showing at the top of search results.

Then, there is the new Windows vulnerability the group has been exploiting. A zero-day, now tracked as CVE-2026-68820, is described as a “use-after-free bug in Windows Ancillary Function Driver for WinSock”, allowing authorized attackers to elevate privileges locally.

This bug was found in a core Windows networking component and allows an attacker who already deployed a piece of malware on the machine to escalate privileges to the highest level. Microsoft patched it on August 11 2026.

Lazarus used this bug to deploy a previously undocumented backdoor called Troy. This malware comes with 17 commands, including file upload and download, interactive shell access, in-memory DLL injection, and process termination.

The group was also using compromised Roundcube webmail and CMS servers as C2 relays, instead of simply running their own infrastructure, and they were deploying a new PHP webshell called RelayShell. This one doesn’t behave like a conventional backdoor, since it passes commands and responses between victims and operators through text files.

In one of the observed infection chains, Check Point also found the crooks using SecurityPDF, a trojanized PDF viewer which they were hosting on websites impersonating a legitimate business called Enveil. The drake viewer scans PDF files for a particular hidden marker and, if it finds it, decrypts it and loads Troy directly into memory.

Lazarus usually targets cryptocurrency and software developers. This time around, however, it set its sights on defense organizations, aerospace companies, as well as those working in aviation. Most of the victims are located in Europe and India, with confirmed activity in France, Germany, Brazil and India.

Check Point also said that not all victims were also targets - some of the organizations compromised in the attacks were later used as infrastructure. In at least one case, Lazarus compromised a Western European organization and used it to send spear-phishing messages to additional victims, effectively exploiting that organization’s reputation and trusted communications.

Since these attacks primarily start with a social engineering element, the best course of action is to educate employees on the dangers of phishing and the fact that, if someone is reaching out with a job offer too good to be true - it most likely is.

• The Trump administration has lifted the TikTok ban for federal devices
• The app was banned from being installed by government employees in 2022
• TikTok in America is now majority owned by a US company, with ByteDance still holding around a 20% share

The Trump administration has lifted a ban on government employees having TikTok on their mobile devices.

The law was introduced in 2022 when TikTok was deemed to be a national security threat because of potential ties between TikTok’s parent company ByteDance, and the Chinese government.

A memo released by the Office of Management and Budget (OMB) states, “TikTok may be used on government devices.”

Government to go back to doomscrolling

The details as to why the government banned the app in the first place have not been fully disclosed. Discussions within the senate centered around data collection and Chinese government influence over the app’s algorithm.

TikTok briefly went offline in the US in 2025 as the Trump administration forced ByteDance to sell the app to American owners or have the app be permanently blacklisted in the US.

The two settled on having an American version of the app for American audiences controlled by TikTok USDS Joint Venture.

The Department of Transportation, Treasury Department, and Health and Human Services have all since created official accounts on the app and have begun posting. The White House also has an official account which mainly posts hype edits of the President.

Via Engadget

The laptop deals keep rolling in this week, with several new and returning offers that are great buys if you need a new device for work, school, college, or for home use.

I've picked out deals for both the US and the UK, including some super-cheap Chromebooks that will just get the job done, mid-range laptops that offer good levels of performance for the price, and high-end powerhouses for more demanding tasks. There should be something below that suits both your budget and needs.

For example, in the US, I think it will be hard to beat this Dell XPS 13 for $599 (was $899.99) when you apply the student discount. Even if you aren't eligible for the extra $100 off, it's still a tempting $699.99, which is a fantastic price for a fast, powerful and stylish machine.

That's just one option, so do have a browse through all of the best laptop deals I've found right now.

US laptop deals

UK laptop deals

• Google cut seven billion daily Android Chrome notifications using layered defenses
• Chrome now limits abusive sites, revokes permissions, and blocks high‑volume spam
• Android improvements simplify managing alerts and reduce scam and malware exposure

Google says it has cut the number of notifications Chrome users get on their Android devices by seven billion a day.

In a new report, the company outlined how it has built a multi-layered defense system to shield its users from unwanted notifications, protecting them from spam and malware, and helping their devices’ battery last longer.

Most importantly, Google says the achievement significantly improved the overall user experience on Android.

Notification bombardment

For the longest time, individual websites were allowed to send push notifications directly to their users’ phones, even when they were not actively browsing them.

When a user visits a certain website, they get prompted to “show notifications”, and if they tap “allow”, the website starts sending the alerts. Sometimes, users do it without fully realizing what they’re agreeing to.

Once granted, the notifications (sent through Chrome) get shown next to other alerts (such as the ones coming from WhatsApp, Gmail, or other apps).

Unlike other notifications - which usually alert users to unread messages, calendar events, or similar - these mostly promote new content, deals, or other updates. They can also alert users of breaking news, which is arguably the most useful type among the ones mentioned here.

Legitimate websites use the feature responsibly and generally don’t flood their users with unwanted pings. However, some sites abuse the privilege, bombarding users with unwanted advertising, misleading alerts, clickbait articles, and other formats, just to get them to open the page (where they’re often served ads). More worryingly, malicious or compromised websites can use notifications to push scam messages, fake virus warnings, phishing links or other potentially dangerous content.

Because these alerts are served through Chrome and resemble ordinary system notifications, users may not immediately realize the risk.

But because they are served through Chrome, Google can do something about it, and the company has now “pulled back the curtain” on the toolkit that made these improvements possible.

Swiss cheese

Described as a “swiss cheese” model, Google says it created overlapping protections that cover the entire notification lifecycle. Chrome now automatically revokes notification permissions for sites users haven’t engaged with in a little while.

So, if a site keeps flooding the visitor with notifications that they’re not responding to, Chrome will eventually shut them off. Same goes for sites that have “repeatedly received suspicious notification warnings”. Google did not say how many is considered “repeatedly” and in what timeframe.

The second layer is analyzing signals such as service worker activity. By looking for coordinated behaviors, Google claims it can now pinpoint networks that serve malicious content, and block them.

On the Firebase Cloud Messaging (FCM) server side, the company introduced message rate limits that disallow high-volume notification abuse. Google now evaluates sites based on factors such as message volume relative to time spent on site, the frequency of permission prompts, and general engagement levels.

In other words, if a user spends 10 minutes on a website but then receives 50 notifications, it will raise quite a few red flags. Same goes for users that don’t really interact with the website a lot. “Disruptive domains” are now limited to 1,000 messages per minute and will receive HTTP 429 responses if they exceed this threshold, Google explained.

Finally, the company updated how notifications are handled on Android phones. Users can update their preferences directly from the notification bar, simplifying the process for users who can’t be bothered to dig deep into system settings.

“These integrated efforts effectively shield users from sophisticated scams that leverage notifications to distribute malware, harvest personal information, or solicit fraudulent payments,” Google said.

“Beyond security enhancements, this strategy has substantially decreased unnecessary background activity, reduced user device battery consumption, and transformed the notification lifecycle so users receive only the content they find truly valuable.”

• A new 8-in-1 smart display dock is now on Kickstarter
• Cabletime's ScreenDock features a 5.5-inch screen which can be used as a secondary display
• The device could prove an interesting alternative to Corsair's Xeneon Edge thanks to its extra docking capabilities

Multi-tasking on a PC is made easier using Corsair's Xeneon Edge touchscreen LCD as a secondary display — but now this solution seemingly has some strong competition.

As reported by Notebookcheck, the Cabletime ScreenDock is a new 8-in-1 smart dock with a 5.5-inch built-in display, and it could be ideal as a secondary display alongside a desktop PC or laptop. This device is a Kickstarter project with an early-bird price of $119.

There are some marked differences in comparison to Corsair's Xeneon Edge. The ScreenDock has a much smaller 5.5-inch display (with a 1080 x 720 resolution) instead of 14.5-inches, and it lacks any touchscreen capability. The latter is what gives the Xeneon Edge its Stream Deck-style functionality (Elgato's shortcut command center with programmable keys), especially with the official virtual Stream Deck widget.

However, the ScreenDock serves the same broad purpose as Corsair's handy display, allowing PC owners to use it for overlays, third-party applications, or simply as an extended screen on Windows 11.

And the ScreenDock has two major advantages itself. Unlike the Xeneon Edge, Cabletime's device is also a dock, with multiple USB-C, USB-A, and Ethernet ports, as well as an HDMI port (4K 60Hz). The ScreenDock has a foldable design too, helping users preserve desk space, with brightness and power on/off buttons which aren't present on Corsair's display.

Caution first

If you're liking the look of Cabletime's ScreenDock, bear in mind that it's still at a relatively early stage. A lot could go wrong with a crowdfunded device as we've seen in the past, between potential manufacturing issues or shipping delays, so be suitably cautious about committing your cash.

If this crowdfunding effort is successful, it could serve as a strong competitor to Corsair's device, which has been considered overpriced (starting at $249.99 / £219.99 / AU$389).

The ScreenDock is only at early-bird pricing right now, so naturally it will be more expensive at its full price. With its 8-in-1 smart dock capabilities, it will be interesting to see how it stacks up against Corsair's premium device.

• AI‑found Zoom flaws enabled device takeover through malicious annotation messages
• Exploits worked across all platforms and required only joining a video call
• Researchers warn AI now enables rapid, nation‑state‑level exploit development

Experts have warned that Zoom, one of the most popular collaboration tools in the world, carried multiple vulnerabilities that allowed malicious actors to take over people’s devices, entirely.

What makes these vulnerabilities particularly dangerous is that the victims need not do much to be compromised - participating in a video call with the attacker is enough.

The bugs were said to be present in every version of Zoom, on every device and operating system - Windows, Mac, iPhone, Android, and Linux, in all versions up to and including 7.0.5 - with patches available now, so be sure to update immediately.

AI-powered security

The flaws were discovered by security researchers A Security, which focuses on “autonomous offensive security”, using AI agents to simulate real-work attacks, identify vulnerabilities, and chain them into exploitable attack paths.

The company “simply” used publicly available frontier models and within 24 hours and fewer than 20 prompts, went from finding the flaws to building a working exploit.

The flaws are described as memory corruption bugs exploiting Zoom’s annotation feature. That feature, built on a proprietary protocol (meaning it has no public documentation or specifications, as opposed to being open source), meant that the Zoom client parsed everything it received, including specially crafted, malicious messages.

During the call, a malicious actor could send a message to each visitor that would corrupt their device’s memory and execute weaponized code, all without the victim knowing, being prompted to do anything, or clicking anything at all.

The vulnerability can be exploited regardless of if the attacker hosted, or simply joined, a call. All participants, regardless of their status in the call, were equally at risk. There were no visual cues indicating the compromise whatsoever.

Once the threat actor runs the malware on the victim’s device, they can do all sorts of things, from stealing sensitive files, to switching on the device’s camera or microphone. They can also deploy stage-two malware, steal login credentials and crypto wallet information, access the inbox, and more.

A Security responsibly disclosed their findings to Zoom, who labeled the vulnerabilities as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, and all given a severity score of 9.0/10 (critical).

Furthermore, all Zoom Workplace clients on all supported platforms before version 7.1.5 and 7.0.6 using end-to-end encryption settings are considered vulnerable. A Security recommends updating the client to the latest version.

Lowering the barrier

In its writeup, A Security stressed the simplicity and ease with which it managed to find the bugs and develop the exploits. It warned that AI has dramatically lowered the barrier for entry, and argued that in the pre-AI era, exploits like these were “reserved” for nation-state threat actors with virtually limitless resources:

“This class of capability would previously have only been available to nation-state threat actors, but the model requiring elite teams, months of effort, and weapons-grade budgets has collapsed,” the researchers warned. “Today, a single researcher was able to develop a nation-state-level exploit in less than a day.”

To add insult to injury, these flaws were found using “publicly available frontier models” such as GPT-5.6 Sol, Claude Opus 5, and the likes. Besides the frontier models, these companies also have dedicated cybersecurity programs where they offer specialized models with fewer guardrails and more flexibility for both offensive and defensive actions.

Earlier this week, OpenAI said that its Daybreak project now offers GPT-5.6-Cyber, a model built on GPT‑5.6 Sol and trained to improve capabilities on several specialized cybersecurity tasks such as finding zero-day vulnerabilities and developing exploit chains.

Daybreak came as a direct response to Anthropic’s Project Glasswing. This is an offering that came with Mythos Preview, an AI model that proved unusually capable at cybersecurity tasks. Allegedly, Mythos can autonomously identify and exploit zero-day flaws across major operating systems and browsers, as well as develop complex exploit chains. Because of those capabilities, Anthropic did not release Mythos Preview broadly. Instead, it made the model available to a limited group of organizations.

While some expressed their skepticism over Mythos, saying Anthropic is engaging in fear-based marketing, others have backed the company, saying Mythos proved exceptionally useful at identifying and fixing flaws. Microsoft, for example, is one of the original Project Glasswing partners, and ever since it started using it, the number of flaws patched through its Patch Tuesday cumulative update quadrupled.

Mozilla is also among those showering Mythos with praise, saying earlier this year that it is “every bit as capable” as the world’s best security researchers.

If A Security managed to find such dangerous flaws with publicly available models, there’s no telling what these dedicated models can do.

Via The Hacker News