• Scammers stole $1.27m from a Hong Kong man after tricking him with AI
• The scheme impersonated his father using AI deepfake tech
• Experts say using a secret codeword can thwart the fraudsters

A Hong Kong man was recently conned out of HK$10 million ($1.27 million) by scammers who used artificial intelligence (AI) on WhatsApp to impersonate his father and request the payments, highlighting the dangers of trusting increasingly realistic AI tools. Yet experts say there’s a simple trick that can save you from suffering a similar fate.

According to the Hong Kong police’s Cyberdefender platform (via the South China Morning Post), the fraudsters sent a WhatsApp voice message to the victim saying they urgently needed a transfer of HK$1 million ($127,000).

This was convincing to the target, the SCMP reported, because the “voice and manner of speech [of the message] matched his father’s.” The victim was repeatedly exploited this way until he had transferred the entirety of his savings.

Warning people against falling for AI trickery, the Hong Kong police force said: “Do not blindly trust voice messages. Even if the voice sounds similar, it does not necessarily mean it is accurate.”

If you’re unsure whether the message is genuine, put the phone down and call your friend or family member back so that you know with certainty who you are speaking to. The police also recommended enabling two-factor authentication on your devices and reviewing the list of devices connected to your accounts. If you see any suspicious devices, remove them immediately.

How to beat the fraudsters

Deepfake scams like this are so effective because they appear to come from a familiar, trustworthy source — even when they’re anything but. Yet experts have just published a proven way that you can beat the swindlers and keep everyone safe.

As reported by the BBC, setting a secret codeword to be used in emergencies can help you tell if the person on the call is actually a loved one or merely an AI impersonating them. As the BBC put it, “Deepfake scams might use your voice, but they don’t know what’s in your head.”

One tactic used by scammers is to use urgency in order to create panic and prevent you from thinking straight. That’s why it’s important to take a moment to think to ensure you remember to use the codeword and verify the caller’s identity.

When it comes to picking a codeword, “Pick something that’s easy to remember and hard to guess,” the BBC recommended. “Inside jokes are a safe bet.”

As Philadelphia lawyer and anti-scam activist Gary Schildhorn put it, there are three red flags to look out for: time pressure, a request for hard-to-trace funds (like cash, cryptocurrency or gift cards), and control over who you can speak to on the call. Experience any of those and you might be speaking to a malicious con artist.

Bear all that in mind and you stand a much better chance of protecting yourself from fraudsters. The next time you get an unusual message or call seemingly from a loved one, take a minute to breathe and remember your codeword.

• Researchers tested AI-generated patches on six CVEs with poor success rates
• Many fixes failed, altered behavior, or introduced new vulnerabilities
• Guidance improved outcomes, leading to FLAWED evaluation harness release

When using Generative Artificial Intelligence (GenAI) to fix vulnerabilities, security professionals are most of the time just robbing Peter to pay Paul, experts have warned.

Researchers from 1Passwords Off-by-1 Labs analyzed fixes proposed by two frontier models - ChatGPT 5.5 at “medium” effort, and Claude Opus 4.8 at “high” effort.

As an experiment, the researchers took six recently disclosed CVEs and produced 6,080 patches using two frontier, cyber-capable reasoning models. The results were underwhelming to say the least - of all the proposed patches, just a quarter (26%) fully resolved the issue.

FLAWED work?

This obviously leaves plenty to be desired, as half (49.3%) of the patches failed to fix at least one existing exploit path. A fifth (20.1%) fixed the original issue but changed application behavior, while 2.3% introduced new security issues. Funny enough, 2.2% failed to fix the vulnerability while also introducing additional exploit paths, as well.

Even among the patches that might be considered (26% of clean ones and 20.1% of those that changed app behavior), more than a third were fragile and not entirely addressing the underlying problem.

The researchers created an acronym for automated LLM patches: FLAWED (Fix-Like Artifacts With Embedded Defects), and warned against letting AI work without human oversight: "The expected value of a fully LLM-generated, non-human-reviewed patch is a net-negative by a considerable margin."

Results drastically improved when the AI was given better context, the researchers further explained. Before working on any patch, human developers are usually given initial guidance. When AI is given proper guidance, its success rate rises to 65%. Incorrect guidance, on the other hand, drops the success rate down to 15.2%. The difference between humans and AI is that humans are better at catching misleading information and poor guidance.

This doesn’t mean developers will, or should, abandon AI. Worst case scenario is that developers will spend more time reviewing AI-generated fixes which could increase cognitive load and still end up being net negative. Therefore, the researchers released a patch evaluation harness called FLAWED, which organizations can now use to determine the effectiveness of their AI-generated fixes.

Via The Register

• Attackers cloned AI skills, later adding malicious code to steal credentials
• Zenity Labs found millions of installs and dozens of dangerous skill variants
• Vercel and Microsoft removed malicious skills, but manual removal is still required

AI skills, instructions that teach AI agents how to do certain tasks and thus extend their capabilities, are increasingly being used in supply chain attacks, researchers have found.

Security experts at Zenity Labs uncovered a credential-stealing campaign on skills.sh, a public registry (essentially an app store) for AI agent skills. In the registry, belonging to Vercel (a cloud platform for web applications), threat actors were cloning existing skills, creating typosquatted lookalikes which, at first, did nothing malicious.

However, after a little time had past, and the skills amassed a solid download count, the attackers introduced malicious code instructing the AI agents to, among other things, exfiltrate SSH keys, cloud credentials, Git and package manager tokens, Kubernetes and Docker configurations, database credentials, infrastructure-as-code credentials, environment files and service account files. The agents were then told to package the stolen information with host metadata and send it to the attackers.

Dozens of malicious skills

While Zenity Labs could not say exactly how many people fell victim to this attack, they did stress that a single skill family amassed more than 1.7 million aggregate installs (not unique users).

And that is just one skill family, in a sea of malicious skills. The researchers also said they found “dozens” of additional skills exhibiting either malicious or dangerous behavior. Almost a third (30%) of identified dangerous skills abused Claude Code and OpenClaw to drop malware to their targets, as well. Also, Zenity found “hundreds” of reserved and empty package names that were being kept for future attacks.

These findings show how quickly cybercriminals adapt, and how creative they can get when it comes to abusing new tech. In essence, this campaign is an AI spin on a software supply-chain attack, being similar in spirit to incidents where attackers compromise an existing trusted package or repository, and later push a malicious update.

Following responsible disclosure, Vercel and Microsoft removed the identified skills, but Zenity warns that those who installed them before won’t be safe until they remove them from their systems manually.

There are two non-negotiables when looking for the perfect laptop to run your business: versatility and reliability. Thankfully, HP’s new HP EliteBook X G2i covers both bases with ease, offering a portable laptop that’s packed with power.

Light and efficient enough to work from anywhere, while also maintaining excellent performance across demanding AI tasks and workloads, it’s an ideal business companion for enterprise teams and executives alike.

The HP EliteBook X G2i at a glance:

• Powered by Intel Core Ultra 7
• 14-inch display
• Configurable with up to 64GB of RAM and 2TB SSD storage
• Weighs as little as 2.20lbs

Cutting-edge tech

It’s not that long ago that a thin, light laptop would compromise on power and battery life, but that’s simply not the case anymore. Nowhere is that more apparent than with the HP EliteBook X G2i, a Copilot+ PC, which is powered by Intel Core Ultra processor models paired with an Intel AI Boost NPU (Neural Processing Unit).

The latter is capable of 50 trillion operations per second, clearing the bar (and then some) to be awarded the Copilot+ PC moniker. That means it helps accelerate supported AI workflows.

While there are the obvious use cases, like rewording an email to be more concise or professional in tone, Copilot being baked into Windows 11, and having access to the NPU means swift performance.

That means asking for insights on your budget spreadsheet, generating a fresh image for a PowerPoint presentation, or even looking better in a meeting with real-time blurring of your background are all smoother than on a non-Copilot+ PC. HP also offers its own AI-based noise reduction tech, dynamic voice leveling, and Studio Mode to ensure you always sound your best on calls.

With up to 64GB of RAM included, too, multitasking is smooth, so you can run multiple projects at once. If you’re juggling emails, Slack, Teams, multiple browser tabs, and more, you’ll be thankful for the additional headroom.

And, with the option to use a touchscreen or a comfortable keyboard and trackpad combo, it’s easier to work on projects your way.

For the leader on the move

This kind of power would once have come from a beefy desktop rig, but advancements in design mean that the HP EliteBook X G2i is a light machine at just 2.2lbs, making it lighter than many of its rivals.

And, unlike many of its contemporaries, it offers an optional 5G connection for fast data speeds even when you’re away from the office. Need to send an important file but nowhere near a Wi-Fi point? Having issues with airport or hotel connectivity? Being able to work from anywhere is a truly liberating experience.

Of course, the HP EliteBook X G2i wouldn’t be the best ultra-portable enterprise laptop if it didn’t have the battery life to back it up. Thankfully, it delivers in this regard, too, because the Intel Core Ultra processor and AI Boost NPU work closely in tandem to minimize battery drain and keep tasks humming along.

The result is a laptop that will run for your workday and then some, all while being able to slip neatly into a backpack.

It’s also built with workers in mind. The 14-inch display is not only sharp, but also works to protect data from prying eyes with HP’s Sure View 6 technology, while HP Wolf Security offers multi-layered protection, including firmware protection designed to withstand future quantum-computing threats — a growing threat in today’s world.

Whether it’s digging deep into huge workbooks, putting together a last-minute presentation while away from Wi-Fi, or just catching up on emails after a long day, the HP EliteBook X G2i is built for business.

• Someone made a tool for Asus Astral RTX 5080 and 5090 GPUs
• It's designed to prevent a melting connector, shutting down the PC before this happens
• This third-party utility – and the response to it – shows the level of paranoia out there when it comes to this issue

Do you have a high-end Nvidia Blackwell GPU, and if so, are you worried about the perils of a melted power connector? It appears that definite concerns remain in this area, to the point that a new utility has been crafted to address those worries.

An enterprising Redditor has made their own open source tool for Windows which is designed for Asus Astral RTX 5090 and 5080 graphics cards, acting as a monitoring app that will (hopefully) step in to prevent any melting disasters before they happen.

The creator, Humza Khalid, tells us how the small utility, which is available to grab on GitHub, works: "It reads per pin 12VHPWR current straight from the card's own sensor chip and force shuts down your PC if any pin stays over 9.5A for 15 seconds, before the connector can melt."

The idea is that it's a lightweight and standalone app which is an easy way to defend against the situation where there's a sustained level of too much current flowing to the Nvidia graphics card.

As noted, the PC is forced to shut down in these cases (in a safe manner, with any running or interfering apps being force-closed, we're told), before any damage is done.

The creator has taken a suggestion on board from the comments, and Khalid notes that the tool will be changed from initiating a shutdown to dropping the power limit (via the Nvidia management API) for a much faster response. (Shutting down can take a while). That change will happen in a future version of the utility, Khalid tells us.

The creator also reminds us: "This only works on Astral 5080/5090 cards because those are the only ones with per pin sensors. Windows only, needs Python. And it doesn't replace seating your connector properly, it's a last line of defense not a first one."

Analysis: default paranoia

That's all good in theory, of course, but I'd always be careful about what you're installing on your PC. Not to say this isn't a trustworthy app – I don't know whether it is or not, and that's the point. However, it is open source, so that's good, as it provides visibility into what it's doing under the hood.

Another point to note is that a co-creator of the app is listed as 'Claude', meaning that this AI has been used in making the tool. Khalid explains that they wrote the original utility, but it was based on HWiNFO, so they wanted the app rejigged to be standalone, and Claude "did a lot of the rewrite".

At any rate, Asus Astral GPU owners can make their own decision about what's worth installing, or not, although I wouldn't personally recommend installing a third-party utility from an unknown developer. As ever, if you do install such software, you do so very much at your own risk.

Regardless, what this does show is the clear level of concern about Nvidia's RTX 5090 and 5080 GPUs. One Redditor sums it up: "As a 5090 owner, I can confirm the card comes with a default paranoia about bursting into flames."

That received some pushback from other Redditors who said their overclocked RTX 5090s were just fine, and in turn, there was a further story relayed about a melting incident. Obviously, all that is anecdotal (on both sides of the coin), but the paranoia is real enough.

Cable melting worries began with the RTX 4090, of course, before the RTX 5090, and when we looked into the issues with the Blackwell flagship back at the start of last year, Nvidia firmly denied that any of this is its fault. Cable melts remain a controversial topic, though, and more recently we've even had a report of an exploding RTX 5090, no less, which PC gamers who run these high-end graphics cards probably didn't take much comfort from.

• Meta has been hit by another huge fine in New Mexico
• The ruling judge compared Meta's apps to polluting factories
• Meta says it's going to appeal the decision

Meta is in more legal trouble over the harms that its products — specifically Instagram and Facebook — can do to children, with a New Mexico judge slapping a $567 million (£422 million / AU$805 million) fine on the company, and suggesting that the damage done by these apps is akin to "noxious pollution" from factories.

As reported by CNN, the latest court ruling and financial penalty says that Meta's suite of apps "create a common, societal burden on and harm to the affected children and their families and schools, as well as hospitals and law enforcement".

Meta has said that it will appeal the decision, but its lawyers should recognize the factory analogy: they used it themselves during the original trial that got underway in February (via Courthouse News Service), arguing that a town factory shouldn't necessarily be held responsible for wider community problems it has nothing to do with.

The aim of Meta's lawyers in using the factory example was to limit the fines and measures imposed by the court, but it only partly worked. The mention of schools, hospitals, and law enforcement shows that the judge in the case, First Judicial District Court Judge Bryan Biedscheid, thinks Meta has wider problems to answer for.

Mental health support

Most of the money that's being demanded from Meta — $420 million of it — is specifically earmarked for supporting community and family-based mental health services for the young people of New Mexico. The rest will be going towards mental health screening, prevention campaigns, and referral programs.

The latest fine is on top of the $375 million (£279 million / AU$533 million) in civil penalties that Meta was previously ordered to pay by a jury. This second part of the trial, with only a judge presiding, has now officially declared Instagram and Facebook a "public nuisance" in the eyes of the law.

There's more to the ruling than financial hits too. Meta is being ordered to delete all the accounts and data of users aged under 13, to turn off notifications from 8am-3pm on weekdays and from 10pm-7am on other days for users under 18 — at least in New Mexico. New accounts set up by teens should also be private by default, the judge has said.

Don't expect any of this to be implemented soon though — Meta has said it's going to appeal these decisions, which is likely to take an extended period of time. Even so, it's more evidence that the harms that social media can do to youngsters are now better understood, and that further action is very likely.

• Google’s Threat Intelligence team links BlackFile (now Redact) to phishing and extortion attacks on major hedge funds and law firms
• Group impersonates IT staff by phone, steering victims to spoofed login pages to steal SaaS credentials and tokens, then exfiltrates sensitive data
• Targets include Blackstone, KKR, Apollo, CME Group, and firms like Paul Hastings; Google tracked $10.7 million flowing into 18 crypto wallets between January–May 2026

Some of the biggest US hedge funds and law firms have been targeted by a highly sophisticated data breach and extortion campaign, conducted by a group of criminals previously known as BlackFile, experts have warned.

BlackFile (or Redact, as the group is now calling itself) has a relatively simple modus operandi, also used by ShinyHunters - they call their targets on the phone (usually employees with access to SaaS systems), identify as IT staff, and direct victims to convincing, lookalike login pages designed to steal their credentials and authentication tokens.

Once they gain access to victims' accounts, the attackers access enterprise SaaS environments (for example, Microsoft 365 and Okta) and use automated tools to exfiltrate sensitive data. In the last step, they notify the victims and threaten to leak the data on the dark web unless a ransom is paid.

Stealing millions

Since a part of the process is to navigate the victims to spoofed login pages, the criminals often register domain names that can easily be confused for legitimate ones.

That is also a good way to spot who the potential victims are, and according to a new report from Google’s Threat Intelligence Group (TGIT) team, these are some of the biggest names in the finance industry: Blackstone, KKR & Co, Apollo Global Management Inc, and CME Group Inc.

Apart from these names, a few law firms were also spotted, including Paul Hastings LLP and Greenberg Traurig LLP. However, none of these confirmed having been breached, and Greenberg Traurig told Reuters they were never targeted in the first place.

The group seems to be making quite the progress. In April and May, they registered a new phishing domain every 2.2 days, rising to every 1.6 days for June and July. It’s paying off, too.

In the 18 cryptocurrency wallets Google associates with the group and tracks, around $10.7 million was received between January and mid-May 2026.

• Huntress saw Oracle SQLi used to deploy rare khunt toolkit
• Khunt enabled OS commands, credential theft, and registry hive exfiltration
• Defense includes input sanitation and more

Someone managed to pair the classic SQL Injection (SQLi) attack with a nifty database trick to take over the underlying system entirely.

Security researchers Huntress, who were called in to investigate the incident, said the investigation first showed a classic, decades-old technique called an SQL injection attack: a public-facing application with an Oracle backend accepted and executed SQL commands input into a form without checking whether that input was valid or not.

This granted the attackers the ability to upload a database-resident, posts-exploitation toolkit named khunt. This technique is something of a cyber-white whale: it’s been widely discussed but rarely seen in the wild.

How to defend

“What happened next, however, raised our eyebrows,” Huntress said. “After performing SQL injection, the threat actor managed to upload a database-resident, post-exploitation toolkit named khunt. This is a technique that's previously been discussed and described over the years, including via a technique described as oraexec – however, the use of the technique in the wild has rarely been documented.”

As a toolkit, khunt granted the attackers multiple capabilities, including loading cmd.exe on the system and running arbitrary OS commands, steal usernames and passwords, listing, reading, searching, and checking file sizes (essentially looking around the compromised system), unzipping files, and more.

Of all the things they could have done, the attackers opted to run a PowerShell command and invoke the Windows Registry tool, copying the SAM, SECURITY and SYSTEM registry hives. They can later use the copies to extract and decode password hashes for local accounts on the system, the researchers explained.

To defend against such attacks, Huntress recommends making sure the forms aren’t injectable. “Practice proper input sanitization and query parameterization for any inputs,” they warned. “It's also important to ensure that users with the ability to execute queries aren't overprovisioned.”

Even if someone manages to pull off SQL injection, user accounts should not be capable of authoring Java sources or running stored procedures.

• Microsoft has admitted it's automatically installing an app on Windows 11
• The OneDrive Photos app is also being deployed mistakenly to business PCs as well as consumers
• There are a few odd things about this episode, and it's an anti-consumer move that doesn't sit well with Microsoft's broader goals to make Windows 11 better

Microsoft is in hot water after an odd decision to roll out a OneDrive Photos app to Windows 11 PCs used by consumers (with it also accidentally deploying the app to enterprise systems).

Windows Latest reports that Microsoft "effectively" told the website that the OneDrive Photos app is being automatically installed on Windows 11 computers whether it's wanted or not.

OneDrive Photos is a separate app to OneDrive, and it's designed for photo viewing and organization (with a light editing element bolted on). However, it's plain user-hostile behavior to have this software stealthily piped to a Windows 11 PC and forcibly installed.

What if you don't want it? What if you don't even use OneDrive sync at all, and you aren't signed in with a Microsoft account on your PC? Tough — you still get OneDrive Photos, as Windows Latest points out.

Even more bizarrely, this app — which is labelled as a beta — is appearing on business PCs, which it definitely shouldn't be doing (it's only used with a personal Microsoft account).

Microsoft wouldn't previously comment on the appearance of the OneDrive Photos app, but at least the company has now acknowledged that it is being installed on Windows 11 PCs.

There's still no official comment on why business devices would be getting this software, but Windows Latest tells us that it "understands that the rollout to enterprise PCs was not intentional". So apparently this was a mistake, and one that Microsoft is presumably in the process of correcting.

It's worth noting that there's also been some controversy about AI scanning faces for a feature in OneDrive Photos, accessed via the 'People' option, but this is only active if you explicitly allow it to be turned on (it's clearly opt-in, in other words).

Microsoft has clarified that if 'face grouping' is enabled, it runs only in the cloud with OneDrive photos (not other images on your PC), and any data collected is removed 30 days after you turn it off. The company has also assured users that it isn't using any photo data to train AI models on faces.

Analysis: I'm trying to tell you now, it's sabotage…

What is Microsoft playing at here? I really don't know, but this OneDrive Photos affair is a mess for a lot of reasons, and as you might guess, it has rubbed people up the wrong way. For starters, business users are very unhappy about having a piece of consumer-targeted beta software automatically deployed on their PCs, and are busy writing scripts to remove it (like this one on Reddit for example), rather than waiting for Microsoft to fix its error.

This is a baffling move for consumers too, because as noted, even if you don't use OneDrive at all, you'll still get this partner photo app. You can't even remove the OneDrive Photos app without deleting OneDrive as well — so if you do use the cloud storage app and sync features in Windows 11, but don't want this extra Photos application, well, you're stuck with it. You can have both, or neither.

That latter situation will change, though, Windows Latest informs us, and Microsoft is preparing an update that lets you remove the OneDrive Photos app without needing to nuke OneDrive entirely. I should hope so, too, and it's confusing how this rollout of a beta app went ahead without that choice in place.

The broad reaction on Reddit has been heated to say the least, and this is just more grit for anyone with an anti-Microsoft axe to grind.

One Redditor said "I'm uninstalling Windows. Linux is a little bit of a pain but worth it." There are more than a few similar comments in that thread, whether they're from people vowing to switch to Linux, or those who've already departed for OS pastures greener: "So glad I left Windows behind. Good riddance."

Interestingly, there are reports of this app appearing on Windows 10 PCs in the Reddit thread those comments are drawn from, although I haven't seen it on my computer with that OS (while it is on my Windows 11 system).

The trouble with all this is that it underlines how Microsoft is a vast corporation where the various limbs aren't always moving in alignment with the same aims. While the right hand is fixing Windows 11 and implementing a whole bunch of crowd-pleasing features or tweaks, the left hand is still messing around with anti-consumer initiatives such as this. Did no one tell the OneDrive team that Microsoft is supposed to be going full-tilt to persuade everyone that Windows 11 is the place to be, and that the software giant has mended its pushier and more obnoxious ways?

Apparently not, and just as we don't want third-party apps for the likes of monitors pushed on us quietly, in the background, via Windows Update, we don't want to unknowingly get first-party Microsoft software sprung on us, either.

Sort it out, Microsoft, please, because this is becoming an embarrassing oversight in terms of the big (and otherwise commendable) drive to make Windows 11 better.

Apple unveiled the very first Mac Pro 20 years ago today, dubbing the computer “the ideal system for the most demanding user.” It was the last Mac to make the transition to Intel processors and put the final nail in the coffin of its PowerPC predecessor — quite a statement at the time.

In fact, the Mac Pro was so powerful that it doubled the performance of the Power Mac G5 that had launched less than a year earlier. Talk about earning that “Pro” moniker.

Many different iterations followed, but the one constant was the positioning. The Mac Pro was always the Mac you went for if money was no object but power was an imperative. It was, seemingly, a computer for the ages.

Or not, as it turned out. In March 2026, Apple officially discontinued the Mac Pro and said it had no plans for any future models. It was an ignominious end to the most powerful Mac Apple has ever made.

The very nature of the Mac Pro had always made it vulnerable. But that vulnerability proved to be fatal when combined with market conditions that even a giant like Apple is struggling to deal with today. When we look back at why the Mac Pro (just) failed to make it to 20 years old, there’s one very obvious culprit.

A dangerously niche product

Right from the off, the Mac Pro was designed to be used by people in challenging professions who valued performance above all else. It was made to complement the eye-watering powers of the best Intel chips of the day, which offered far more in the way of output than the PowerPC processors Apple had previously been using.

That meant that the Mac Pro was always a niche product that flaunted its raw power. That was the point of the machine, and although the general public liked to poke fun at its sky-high prices (remember the $400 wheels on the 2019 model?), its intended audience didn’t much care. When your work consists of high-grade film productions, artificial intelligence (AI) data crunching or similarly demanding pursuits, high prices are just the cost of doing business.

But that niche nature meant the Mac Pro was never going to sell on the scale of the MacBook Air or the MacBook Pro. Apple was always taking a calculated risk, determining that it was worth going after a small but loyal audience who craved the Mac Pro’s power and reliability — and would continue to do so over the years.

The problem, though, was that Apple often seemed to take these users for granted. The cylindrical model introduced in 2013 — nicknamed the “trash can” Mac Pro for its tubular shape — went years without an update because, Apple later admitted, the company had “designed ourselves into a bit of a thermal corner”.

Amazingly, the 2013 model wasn’t updated until six years later — a veritable lifetime in computing terms — when the final design iteration of the Mac Pro finally touched down.

The introduction of the Mac Studio also caused a massive problem for the Mac Pro. Its performance was just as good as the Mac Pro, if not better, yet it came in a smaller package that cost far less. The choice for many people was clear.

With the transition to Apple silicon, add-in extras like the Apple Afterburner Card were no longer feasible, meaning the Mac Pro’s only real advantage was its inclusion of a few expansion options like PCIe. But when you’re paying a minimum of $6,999, those returns make less and less sense when compared with a Mac Studio.

Apple had long walked the fine line between infrequent updates and outright abandonment, but still it kept chugging away at the Mac Pro, even after the Mac Studio’s arrival. Instead, it was an external force that finally killed off the Mac Pro — and forced a complete rethink from Apple.

Buried in the dark

On March 26, 2026, news emerged that Apple had discontinued the Mac Pro. The company explained to 9to5Mac that it also had “no plans to offer future Mac Pro hardware,” seemingly sounding the computer’s death knell for good.

The timing might have seemed strange, and it certainly seemed to come out of the blue. But with the benefit of hindsight, we can gain a pretty good idea of what happened and why Apple made the move when it did.

That’s because just three months later, Apple announced bombshell price rises that affected nearly every device it sold.

The Mac range was badly hit, with high-end devices like the Mac Studio coming in for particularly stinging increases. That device saw the single highest price jump by far, rocketing up by a painful $1,300 for the M3 Ultra model. The MacBook Pro, meanwhile, rose $300, the second-highest dollar increase of any Apple product.

These price adjustments weren’t made on a whim. No, they were prompted by the widespread component crisis that’s currently ravaging the entire computing industry.

Parts are getting more expensive by the day thanks to the overwhelming demand from AI data centers. Things are so bad that Apple CEO Tim Cook spoke out, calling the situation “unsustainable” and describing his company’s price increases as “unavoidable”.

When you see how badly pro users were affected by these changes, Apple’s decision to ditch the Mac Pro starts to make a lot more sense. If the Mac Studio now costs $1,300 more than it did previously — a figure that ballooned by almost 33% — what kind of wince-inducing costs would Mac Pro users be faced with had Apple continued to sell the device?

Going with that same 33% jump, we could have been looking at a Mac Pro that started at around $9,299. That’s a roughly 33% step up over the Mac Pro’s old entry price of $6,999. And we’re not even talking about any upgrades here — no beefed-up CPU or additional storage, not even any ultra-premium wheels. Just the base-level Mac Pro and nothing more.

When you think about it like that, it’s obvious why the Mac Pro was killed off just shy of its 20th anniversary. If Apple waited for the computer’s birthday, it would have been forced to escalate its price to frankly outrageous heights alongside all the other affected products.

And in the cut-throat world of business, that would have been a no-go considering the prices we’re talking about here. The Mac Pro was already selling in vanishingly small numbers. Boost its price by 33% — or even 20% — and its sales would have fallen off a cliff. The only thing a move like that would have generated is a torrent of bad press for very little positive return.

So in the end, Apple didn’t afford the Mac Pro a sentimental 20th birthday celebration. Given the ongoing memory crisis and its wide-ranging effects on the entire computing industry, there was no room to stand on ceremony. The Mac Pro was buried in the dark — before its price could become even more contentious.

• Swiss government confirms attackers breached BIT’s SharePoint servers
• Investigators suspect exploitation of recent SharePoint flaws
• No sensitive or confidential data is believed to have been stored on the platform

Cybercriminals broke into the IT network of the Swiss government and stole data from roughly 200 accounts. As a result, the Swiss government disconnected some of its servers from the wider internet and launched an investigation.

In an announcement, the Swiss government said that on July 28 2026 its security specialists noticed “abnormalities” in the Federal Office for Information Technology and Telecommunication’s (BIT) SharePoint servers.

Three days later, on July 31, the investigators determined that the attackers accessed data found in around 200 accounts, both user and technical.

Two vulnerabilities

The investigation is currently ongoing, the agency said, adding that it is getting support from Microsoft, as well. So far, the identity of the attackers is unknown, and the stolen data has not yet leaked to the dark web.

“No confidential information or particularly sensitive personal data may be stored on the SharePoint platform,” the announcement reads.

While BIT has not yet determined the initial access vector, it suspects it to be one of two flaws in SharePoint that Microsoft fixed last month:

“In mid-July, Microsoft announced several vulnerabilities in SharePoint,” it says in the announcement. “After the publication of the corresponding security updates, the FOITT immediately started work on importing them into its own systems.”

“The cyberattack was carried out by previously unknown actors, which was presumably made possible by exploiting these vulnerabilities in the SharePoint software.” It did not say which vulnerabilities those are, but in its report, BleepingComputer says that it could be one of these two: CVE-2026-56164 (an actively exploited privilege escalation vulnerability), or CVE-2026-50522 (a critical remote code execution flaw later exploited to steal SharePoint machine keys and maintain access after servers were patched).

Given its popularity among businesses of all sizes, SharePoint is a major target for cybercriminals. So far, no threat actors claimed responsibility for the attack, or demanded any ransom in exchange for the stolen data.

Via BleepingComputer

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #887) - hint #1 - today's theme

NYT Strands today (game #887) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• LILAC
• CHIA
• THUG
• HICK
• TAIL
• WHIG

NYT Strands today (game #887) - hint #3 - spangram letters

NYT Strands today (game #887) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #887) - the answers

The answers to today's Strands, game #887, are…

• GIZMO
• THINGAMAJIGGY
• DINGUS
• DOOHICKEY
• SPANGRAM: WHATCHAMACALLIT

• My rating: Hard
• My score: 1 hint

When you have a 13-letter word and it is not even the spangram then you know you have just played a difficult game.

Even though this only involved four game words, plus the (incredibly long) spangram, finding the words was indeed quite the struggle — even with the head start of a hint word.

Adding to the difficulty were slight regional variations, as I grew up calling things a “thingamebob” rather than THINGAMAJIGGY and had never heard of DOOHICKEY until I somehow put the letters together to form something approaching a word.

If you completed this without a hint then kudos.

Yesterday's NYT Strands answers (Thursday, August 6, game #886)

• CHERRY
• REDBUD
• DOGWOOD
• HAWTHORN
• MAGNOLIA
• SPANGRAM: FLOWERINGTREE

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1656) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1656) — hint #2 — repeated letters

Quordle today (game #1656) — hint #3 — uncommon letters

Quordle today (game #1656) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1656) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1656) — the answers

The answers to today's Quordle, game #1656, are…

• AMISS
• SHIRK
• SALSA
• RABBI

I imagined four different words in my head before submitting the correct ones.

For SHIRK I first thought “shirt”, for AMISS “alias”, for SALSA “salad” and for RABBI “rabid”.

In each case my first thoughts were impossible, but the thinking helped me get to the correct choices.

Daily Sequence today (game #1656) — the answers

The answers to today's Quordle Daily Sequence, game #1656, are…

• WEIRD
• DRANK
• ETHIC
• FOIST

Quordle answers: The past 20

• Quordle #1655, Thursday, 6 August: AMUSE, BRAND, CEDAR, BLURB
• Quordle #1654, Wednesday, 5 August: MOUND, WRONG, STOOD, WEIRD
• Quordle #1653, Tuesday, 4 August: GOOEY, TARDY, HUMAN, CHALK
• Quordle #1652, Monday, 3 August: FUNGI, MUDDY, DEBUT, MANIA
• Quordle #1651, Sunday, 2 August: BOOTH, EASEL, REACH, MAKER
• Quordle #1650, Saturday, 1 August: OMEGA, BIRCH, SMOCK, EERIE
• Quordle #1649, Friday, 31 July: MANIA, SINGE, STOOL, LOFTY
• Quordle #1648, Thursday, 30 July: MODAL, IDLER, CHUMP, LUMPY
• Quordle #1647, Wednesday, 29 July: GAWKY, ALLOY, AUDIT, LATCH
• Quordle #1646, Tuesday, 28 July: SMITE, ROACH, RUDDY, GLOBE
• Quordle #1645, Monday, 27 July: TAFFY, FIGHT, GUILD, WAGER
• Quordle #1644, Sunday, 26 July: STOMP, LIMIT, FUNKY, STEAD
• Quordle #1643, Saturday, 25 July: SALON, SHEEN, BURST, GOURD
• Quordle #1642, Friday, 24 July: DOLLY, EDIFY, LAGER, PRANK
• Quordle #1641, Thursday, 23 July: LADEN, EVICT, WOVEN, SHIRE
• Quordle #1640, Wednesday, 22 July: COYLY, SINGE, AWASH, AWOKE
• Quordle #1639, Tuesday, 21 July: TRUSS, AXIAL, SWINE, THING
• Quordle #1638, Monday, 20 July: ICING, SLICK, GAILY, RISEN
• Quordle #1637, Sunday, 19 July: SPURT, ACRID, THRUM, BLEEP
• Quordle #1636, Saturday, 18 July: KNAVE, TIGHT, BLEAT, CHAOS

I couldn't believe it. Had Roku really just casually inserted global viral raccoon sensation Jimothy into Roku City? I'd seen a post claiming so, but knowing how easy it is to fake things with AI, I had to see it for myself.

I powered up one of my home's half-dozen Roku streaming boxes and spent 10 minutes trying to force the platform into screen-saver mode, which then opens up Roku City. Ever since the most recent Roku platform update, I see this interface far less often than I used to.

Roku City is Roku's fictional, purple cityscape populated by thinly disguised iconic characters and objects from film, TV, and life.

After a few minutes of hunting, I figured out how to set my screen saver timeout to one minute. A moment later, the side-scrolling Roku City appeared, and in it, caught mid-waddle atop a chain-link fence, was Jimothy's unmistakable silhouette.

For those who've thrown out their phones, computers, and TVs, Jimothy is a Seattle-based raccoon with a rare disorder called "short spine syndrome." Don't worry, it doesn't appear to impact his mobility or lifestyle, but once you see Jimothy, you never forget him.

Jimothy is so popular that he's been featured as the unofficial mascot at Seattle Mariners games, launched what's widely considered "Hot Jimothy Summer," and is now immortalized in Roku City.

Jimothy made it to Roku City in a matter of hours

"You share the same problem we all share, which is when we really want to get to Roku City, like right now, we wonder, 'How do we get there?" Damon Van Deusen, Roku's Vice President, Global Brand and Creative, told me this week, but added that a solution is already in the works: Roku is adding a Roku City tile to the home screen for instant access.

Van Deusen agreed to sit down and explain how Jimothy made his way — virtually — from the alleys of a Seattle suburb to Roku's iconic services.

Jimothy's appearance, while surprising, is not out of character for the screen saver enjoyed by Roku's roughly 100 million customers.

"The Jimothy journey starts six or seven years ago when we actually started realizing that social was paying attention to the screen saver," explained Van Deusen. Back in 2021, they noticed likely pandemic-quarantined consumers posting about how they'd like to visit the city, share a kiss there, or even get married in the purple space.

"We've been putting Easter eggs in the screen saver as a way to engage some fans and social ever since," he added.

Over the years, the city's been populated by, among other things, characters from popular films (like the rock monster from Galaxy Quest and Star Trek's Enterprise). Still, there was something about Jimothy's timeliness that struck me.

Seattle resident Kiana Hall posted an Instagram video about the unusual raccoon on July 16, 2026. I spotted Jimothy in Roku City on July 31, and the post I saw about the raccoon's integration in the platform was a few days older than that.

"In the last two years, we created what's called the Rapid Response Easter Egg Team," explained Van Deusen.

This cross-functional group cuts through typical product development, and "we figured out a system where we could publish these things really fast. So now everything we do is quicker and quicker and quicker."

Tracking and choosing from the Zeitgeist

The team, which often communicates on Slack, is constantly kicking around watercooler moments like Punch the Money and Goat on Car. They choose "anything that tickles us, anything that feels really fun. I mean, again, that's the bar; it's gotta be delightful, playful, fun, lift spirits, and create conversation," Van Deusen told me, who later added that delight, or something that triggers an "unexpected smile," is "really the heart of the whole brand."

Van Deusen loved that I more or less stumbled on Jimothy's existence in the city. "An unexpected smile, if you think about it, it's like it comes out of nowhere. It's not like you're looking for it; it's just like you spotting Jimothy. It's like, 'Wait a minute, are you, wait, is that Jimothy?'"

Not every viral moment can make it in. The Rapid Response Easter Egg Team avoids bummers and negative news. However, they did do a retrospective of Moira Rose's wigs as a way to memorialize the great Catherine O'Hara, who played Moira in Schitt's Creek and died on January 30 of this year.

When the right idea comes along, the team knows it. "Then we'll be like, 'Oh my God, that's so cool,' and then we'll make it happen right away...and that's how Jimothy came about."

Looking at the Roku City Jimothy, I was struck by the silhouette's uncanny accuracy — it could be no other raccoon.

Van Deusen told me Roku has, over the last five years, built a world-class illustration team, which includes comic book illustrators and former Disney artists.

The company shared the Roku Designer, Illustrator, and Director Tim Cook's early Jimothy sketch and how he might appear in Roku City (above). Even in pencil, you can see how he captured the shape and signature gait of the lovable critter.

The making of an icon

To create Jimothy, the team focused on that "iconic sort of hunch." Van Deusen said that there was a feedback session to ensure they got the look just right.

Silhouettes also happen to be part of Roku City's DNA, giving you the clear impression of a character or viral figure without a lot of detail.

"We had tried doing less silhouetted versions of the city when we tried to localize for different markets once, and the more you see, the further you get away from the City," he said.

The suggestion of these shapes and recognizable figures forces you to lean in and engage even more with what is arguably just a screen saver.

"It's kind of a little bit of a wink, obviously, you know, and we do that on purpose; we never want to say too much. And we never reveal what the Easter eggs are; we always just sort of suggest and like elude, and again, it's so much more fun," said Van Deusen, smiling, I think, at the thought of Jimothy's unmistakable shape.

As for how Jimothy made it to millions of screen saves so quickly, Roku's Rapid Response team can add new elements to Roku City in a matter of hours.

"We developed a tool," Van Deusen said, "where we can basically come up with an idea, something we want to do, the illustration team quickly mocks something up, and we can put it in the screen saver, all within a couple of hours."

That kind of speed puts Roku City firmly inside the zeitgeist. But that, too, is fast changing, and I wondered how long Jimothy would be waddling across Roku City screens.

Roku does rotate out the Easter eggs, though a backlog of four years or more can rotate in and out of the side-scrolling interface. Roku, by the way, recently added a user-controllable version where you can slide back and forth for a better look at all these hidden gems, including Jimothy.

The lovable raccoons should appear in Roku City "as long as Jimothy is in the zeitgeist," said Van Deusen, adding, "[he] will eventually, probably be replaced. I don't know if we'll always have a rotational raccoon, but we will find the next, you know, popping character."

Until then, enjoy Jimothy in real and virtual life.

• MSI's Nvidia GPUs are rumored to be getting price hikes
• They'll be 20% more expensive (or worse) in China, and that kind of increase will surely be seen elsewhere
• This is happening against a backdrop of wider price hikes for graphics cards – although Nvidia is offering a rare chance at an RTX 5080 or 5090 at MSRP

As fresh rumors reveal that another graphics card maker is set to hike prices, Nvidia has a plan to let you buy a Founders Edition Blackwell GPU at the MSRP, even in the case of the RTX 5090 — although you'll need to travel.

And you'll need to move very fast, attend QuakeCon in Texas, which starts today, and get yourself to the GeForce booth (hat tip to VideoCardz) before supplies of RTX 5070, 5080, and 5090 Founders Edition graphics cards run out. And I don't think that they will last for long (a matter of minutes, at a guess, although hopefully that won't be the case).

Nvidia describes this as 'Verified Priority Access' in real life, and at least it does give gamers a chance to buy an RTX 5080 and 5090 at the intended price, which is not something you can get anywhere near when purchasing one of these high-end Nvidia GPUs at retail.

As for the most recent news on GPU price hikes, Wccftech spotted that MSI is the latest graphics card maker to announce that its products will be considerably more expensive.

This is just a rumor, one that arrives via the Board Channels in China, and so should be served with some seasoning — but the theory is that MSI's Nvidia GPUs are set for price hikes of 20% or more. This is due to rising memory prices, of course, and what Nvidia charges its partners for video RAM modules (as Team Green is paying more, it passes that bill on, of course).

The price increase is in the order of $300 (£220 / AU$420) for the RTX 5080 over in China (converting from RMB), around $200 (£150 / AU$280) for the RTX 5070 Ti, and approximately $100 (£75 / AU$140) for RTX 5060 models (and not far off that for the RTX 5050).

Sadly, not only will current-gen Nvidia GeForce graphics cards be affected, but also RTX 4000 and 3000 models (with GDDR6 video RAM getting costlier, as well as GDDR7).

Analysis: pricey times

While this is a rumored cost increase for MSI products in China, these exact same pricing pressures are, of course, happening globally, so there's no reason to believe that MSI's GPUs in other regions won't follow suit.

What's more, this isn't just a problem that pertains to MSI, but Nvidia's other card-making partners, and those companies are also rumored to be implementing hefty price hikes. For example, just this week we've heard that Gigabyte GPU prices will jump between 20% and 40%. Also, on a regional basis, Nvidia RTX 5000 models in South Korea are looking at price hikes of up to 30%.

So, this is a coherent picture of hikes, and those percentages are all in a similar ballpark, indicating increases of at least 20% or a good deal more. They are also backed up by more general chatter from the grapevine about Nvidia's VRAM increases and AMD's Radeon GPUs becoming pricier.

I fear that getting any kind of current-gen graphics card at, or near, the MSRP could be a much tougher task before long, and those at QuakeCon better make the most of Nvidia's GeForce offerings at the firm's booth. As noted, I expect this to be the definition of a flash sale — as in they'll be gone in a flash — although you do have another shot at winning an RTX 5070 in the Quake III Arena RTX Remix and Doom: The Dark Ages challenges.

• The World Wide Web was created 35 years ago today
• It was initially designed for sharing documents at CERN
• Its creator says we can return to its spirit of openness and collaboration

These days, it’s hard to go long without connecting to the Internet in one way or another: whether through one of the best web browsers or by connecting to a smart home device, it’s something we often take for granted. The primary means of interacting online — the World Wide Web — has just turned 35 years old today, and its creator has a timely message that couldn’t be more relevant for modern users.

The World Wide Web is the creation of British computer scientist Tim Berners-Lee. Working at the scientific body CERN in the 1980s and 1990s, Berners-Lee wanted a way to store, update, and locate documents within the sprawling organization. At the same time, he sought a solution that would allow for these documents to be shared with outside bodies quickly and straightforwardly.

That desire led to his creation of the World Wide Web. It was announced to the public on August 6, 1991, with Berners-Lee humbly stating that “We are very interested in spreading the web to other areas.” It was a platform whereby anyone could link to any document in a database using hyperlinks, or links embedded in text, images, and other media. Importantly, multiple users were able to access this platform simultaneously and independently of each other.

Adoption quickly spread from CERN to other research organizations before being opened up to the wider public, whereupon it exploded in popularity. And 35 years later, it’s an invention that has turned the world on its head.

An absolutely vital component of this system was that it had to be both free and decentralized. Berners-Lee was adamant that anyone should be able to create a website and implement hyperlinks on their own, without paying a fee and without a central body dictating what could and could not be done. That principle of openness still stands today — but it’s increasingly under threat.

‘It’s not too late’

Speaking to The Guardian in September 2025, Berners-Lee lamented that plenty of the web today is no longer free and open. “We see a handful of large platforms harvesting users’ private data to share with commercial brokers or even repressive governments,” he noted, adding: “We see ubiquitous algorithms that are addictive by design and damaging to our teenagers’ mental health. Trading personal data for use certainly does not fit with my vision for a free web.”

At the same time, user data is sold “to actors we never intended it to reach,” with the result being “deliberately harmful content that leads to real-world violence, spreads misinformation, wreaks havoc on our psychological wellbeing and seeks to undermine social cohesion.”

This is especially challenging in the age of AI, Berners-Lee argued. To put things right and get back to the original vision of his creation, the father of the web advocated for strong AI governance and guidance from organizations that are not motivated by data and profit but instead by collaboration and the needs of the individual. On this point, Berners-Lee quipped: “It is hard to imagine a big tech company agreeing to share the world wide web for no commercial reward like CERN allowed me to.”

As the World Wide Web turns 35, the spirit of “collaboration, creativity and compassion” that allowed it to be given away for free is being increasingly challenged by Big Tech — but Berners-Lee still thinks there’s time to put things right: “We can re-empower individuals, and take the web back. It’s not too late.”

• VulnCheck CTO Jacob Baines reported Zbtlink routers shipped with a built‑in backdoor dubbed ENDLESSDOORS, allowing remote root commands and reverse shells
• Zbtlink denied malicious intent, calling it an after‑sales maintenance feature, but quietly pulled vulnerable firmware and promised patches
• Researchers warn all firmware images are hijackable; mitigation advice is to replace devices or enforce strict egress controls and treat LAN as untrusted

Chinese networking firm Zbtlink has been accused of shipping its products with a backdoor - and while the company denies the allegations, it has still apparently moved to address the issue.

CTO of cybersecurity company VulnCheck, Jacob Baines, recently published an in-depth report stating a Zbtlink device he runs “continuously attempts to reach a command-and-control server on the internet.”

“Zbtlink routers phone home, waiting for orders. Not because they were hacked. Because they were shipped that way.”

Detention and escape attempts

Baines dubbed the flaw “ENDLESSDOORS” and says it was uploaded to GitHub in early 2015 and “never touched again”. “It can send the client individual shell commands or tell the client to spawn a reverse bash shell.”

“The vocabulary of this protocol is two phrases: run this as root, and give me a root shell,” he further explained, saying that anyone along the path can hijack the client/server communication. VulnCheck researchers tried it, and apparently - succeeded.

Baines said that every firmware on the company’s download page (roughly two dozen images) is all “hijackable in the same way”, and said the company decided not to “responsibly disclose” the vulnerability since that assumes the vendor did not intend the behavior. "That assumption doesn't hold here."

In response to the allegations, Zbtlink told The Register VulnCheck mischaracterized the code.

“This feature is solely intended for after‑sales maintenance and serves no other purposes,” the company told the publication. “It is generally retained only on sample units to assist customers with software debugging and will not be included in mass‑production shipments.”

The Register didn’t see it as a credible explanation since, in the meantime, the company posted a warning on its downloads page:

“We have detected firmware security vulnerabilities affecting selected router firmware releases. As a precautionary measure, the impacted firmware versions have been temporarily taken down from download channels. Our engineering team is working intensively to develop and validate secured patched firmware.” This warning was allegedly posted sometime in the past seven days.

Baines gave a list of suggestions how to mitigate the risk but ended up saying that “for anything carrying real traffic, our advice is to replace the device, or at minimum move it behind strict egress control and treat its LAN as untrusted.”

• Google’s automated systems mistakenly flagged hundreds of Blogger sites as malicious
• Company admitted a bug caused false malware labels, promising a fix
• Users advised to request reviews, avoid migrating content

Hundreds of Blogger websites were locked down, and some apparently deleted as well, after Google’s automated security systems erroneously flagged them as malicious.

A user posted a new message on Google’s forum saying the huge number of reports regarding locked blogs are all for the same reason - Malware and Similar Malicious Content.

The nature of the lockdown “suggests misclassification by automated systems”, the post reads, adding that the team has “already been notified of this issue.”

Aware of a bug""

Those affected will see a red padlock in their dashboard and a warning saying the blog was locked:

"This blog was removed for violating Blogger's Community Guidelines. If you wish to request a review of the blog, click 'Request Review' below," the notice reads.

At press time, the forum post had more than 500 “I have the same question” votes, and more than 200 replies.

In a statement given to BleepingComputer, Google said it was aware of a bug that falsely labeled many sites as malicious, and that it was working on a fix.

"We are aware of a bug that incorrectly flagged some Blogger-hosted sites as malware for less than a day. We are working on a fix to resolve the issue as quickly as possible," the company said.

To make matters even worse, Google said that if users don’t file an appeal, that their blogs can be permanently deleted.

Users are advised not to create new blogs and migrate content, since that is in violation with Google’s TOS. They are also advised against deleting their Blogger profile or service from their Google account, since this will irrevocably delete the blogs. They can, however, back up their blogs if they are afraid of losing the content.

The full extent of the issue is unknown, but according to BleepingComputer, the number of users on the platform exceeds 200,000.

• OpenAI disrupted a major scam campaign in Cambodia’s Poipet, banning accounts and blocking new registrations
• Criminals used ChatGPT to run romance fraud, fake investments, bogus police scams, and even operations linked to human trafficking
• AI was leveraged for fake personas, fraudulent messages, job lures, and worker administration; OpenAI shared findings with authorities after evidence of hundreds of victims losing thousands of dollars

OpenAI said it disrupted a major scam campaign coming out of Southeast Asia by banning accounts used by the operation and making it difficult to open new ones.

In a blog post, the ChatGPT maker said it was tipped off about the existence of the campaign by WhatsApp.

After investigating further, the company found that a group of criminals in Cambodia used its AI tool in different scam campaigns - romance fraud, fake investment scams, or bogus police investigations. It also used AI to help with day-to-day operations and, most worryingly, for things that could be related to human trafficking and forced criminality.

Detention and escape attempts

OpenAI did not say if the group had a name, just that it operated out of Poipet, “a city in Banteay Meanchey province that public reporting⁠ has repeatedly⁠ linked⁠ to online scam compounds and trafficking operations.”

The group used AI to create fake personas, to help draft fraudulent emails and chat messages, and to create posters for fake jobs which were probably used to lure people into human trafficking or forced labor.

The tool was also used for worker administration, since the operators maintained records of employee debts, salary deductions, disciplinary fines, and loan repayments. They also used the tool to translate discussions about immigration status, work permits, visa overstays, and recruitment incentives.

“Some conversations also referenced apparent detention, escape attempts, and potential criminal liability for people who had been trafficked and forced to work in scam operations,” OpenAI said. “While these conversations do not allow us to determine the circumstances of any particular individual, they are consistent with extensive public reporting⁠ describing⁠ the activities of organized crime groups in Southeast Asia.”

The company could not say how many people fell victim, or how much money this group has stolen, but said it found evidence of “hundreds” of victims losing “thousands of dollars.” These findings were shared with relevant authorities.

Via The Hacker News

• Microsoft is eating humble pie over its unrealistic RAM recommendations
• It has deleted articles that pushed 32GB as an ideal or 'no-worries' loadout
• Apple is also feeling the heat in the RAM crisis, with rumors that it's struggling to secure an alternative source of memory supply from China

There are some fresh twists with the RAM crisis hitting some big tech companies, as Microsoft has backtracked on its previous memory recommendations, and even Apple is apparently finding it difficult to cope with the scarcity of memory.

Let's discuss Microsoft first, and as Windows Latest pointed out, the company has been busy backpedalling on previous memory recommendations now that the RAM crisis – which just keeps getting worse – has made those suggestions look foolish.

Microsoft previously had support documents in its Windows Learning Center which have now been removed, and Windows Latest highlights two of them. One was about optimizing your gaming PC, and it advised that "32GB is ideal for serious players who run the most demanding titles" (albeit the article also said 16GB was "plenty" for most games).

Another piece said that 32GB of RAM was the "no-worries zone", and that article was also quietly deleted as there was some backlash against this, given that it was published when the price of system memory had become ridiculous. (And buying a 32GB kit was very much a worry for your wallet).

The links to those articles now redirect to the home page of the Learning Center, and Microsoft is evidently trying to forget about pushing 32GB of RAM as an 'ideal' or 'worry-free' target for memory on your PC.

More broadly, since Copilot+ PCs were launched and the AI features for these devices made them require 16GB, Microsoft has obviously been keen to have that as a baseline memory configuration. Except now, a change of stance is necessary, as with the RAM crisis reaching alarming new heights, Microsoft has been forced to enact huge price hikes with its Surface devices.

And of course, the latest twist with that Surface hardware is that Microsoft has brought back 8GB models with last year's Surface Pro and Surface Laptop. Which makes it kind of difficult to push 16GB as a minimum, let alone make suggestions that 32GB is where it's really at for properly smooth performance.

The abandonment of these Learning Center articles is hardly surprising, then, and Microsoft is also addressing how speedily Windows 11 runs with 8GB of memory (not quickly enough currently). One of its promises with fixing the OS was better performance with a leaner RAM loadout, and Microsoft just made it clear that the company is now actively working to make Windows 11 run better with 8GB before the end of the year.

This has become a vital goal, really, when you consider that Apple has pulled off a commendable showing of performance with its MacBook Neo that packs 8GB of RAM. That was effectively a gauntlet thrown down for Microsoft – something of a declaration that macOS is coming to try to take Windows 11's market share – and one that the Windows maker had to respond to (which became clear enough when Microsoft went on the attack against the Neo).

Apple turnover: China play rumored to end in a fumble

Speaking of Apple, Microsoft isn't the only tech giant being buffeted by the rising costs caused by the RAM storm. While it has had a big success with the Neo, the challenge for Tim Cook's firm – soon to be John Ternus's, of course – is to maintain that momentum, and by all accounts, that's proving a tricky task.

Recent Mac price hikes have caused a good deal of pain – taking some of the wind out of the good ship Neo's sails – and Apple is trying to secure its RAM supply lines for the future, with rumors abounding that it's turning to Chinese chip makers to find extra production capacity.

The latest speculation, however, is that according to a report from Digital Daily (a Korean tech site, via Wccftech), Apple has floundered in negotiations with Chinese memory giant CXMT.

Apparently CXMT has strong enough domestic demand that it doesn't have to offer more attractive pricing to Apple. Essentially, CXMT is holding the line and has "insisted on prices that were higher or similar to those offered by Samsung or SK Hynix" (bear in mind there may be nuances lost with the translation of the article).

You get the message, though: Apple is failing to obtain better deals on mobile DRAM, which includes LPDDR5X, for its iPhones (and that RAM is also used in its MacBooks, of course). And CXMT was supposed to be an escape route from the difficulties of getting enough RAM inventory from Samsung and SK Hynix (and also Micron, a key supplier for Apple), but it seems like a dead-end for now.

At least if this report is correct, but analyst Tim Culpan has also written a short post which backs up the notion that Apple is in trouble here. Culpan writes: "Apple and its suppliers are scrambling to get enough memory chips for its upcoming release of new iPhone models."

'Scrambling' is a word that evokes quite a sense of panic, and indeed with the iPhone 18 models – and the foldable offering – not much more than a month away from launch now (in theory), I'd bet there are some heated words flying here and there. Culpan notes: "Assemblers are working with Apple to rush shipments of DRAM used in mobile devices."

That report is specifically about smartphones, mind, but this same situation applies to mobile RAM that's also used in MacBooks.

The overall theme is more RAM misery all round, which is hardly a surprise given all the negative news we've been hearing on the grapevine of late. GPU pricing has been the latest round of doom and gloom over the past week or two, and I don't think the pessimistic news is going to stop flowing for the foreseeable.

It's not bad news for everyone, though. A source in the semiconductor industry told Digital Daily that: "With the general-purpose DRAM floor remaining unbroken and Samsung and SK Hynix monopolizing the lead in high-value AI memory such as HBM4, the operating profit margins and global market control of the domestic semiconductor sector are expected to rise even more steeply in the second half of the year."

So, it's a familiar story: profits will be on the up and up for memory makers, while consumers will be suffering the pain of the hikes. Apple's purported rush for RAM supplies as the clock runs down on the iPhone launch window is a particularly worrying sounding story, one that doesn't bode well in terms of avoiding more Mac (and iPhone) price rises in the future. Neither can we rule out more Surface price rises, or other laptops for that matter.

• runZero disclosed 12+ new flaws in BMCs from HPE, Supermicro, Dell, Lenovo, Huawei, and others at Black Hat
• Scans found 86k internet‑exposed BMCs and 120k internal devices
• Researchers warn BMCs form a widespread, under‑patched parallel attack surface

Security researchers have discovered more than a dozen new vulnerabilities in Baseboard management controllers (BMC), hardware components found in thousands of the world’s most popular enterprise servers.

BMCs are specialized chips built into servers that allow administrators to remotely monitor and manage hardware regardless of the operating system, and even when the hardware is turned off. They provide out-of-band management capabilities such as remote console access, firmware updates, hardware health monitoring, and power control, and have been a pivotal component since their introduction in the late 1990s.

Earlier this week, during the Black Hat security conference in Las Vegas, security expert HD Moore of runZero disclosed finding more than a dozen flaws in BMCs sold by HPE, Supermicro, Avocent, Huawei, Lenovo, Dell, and others - and to make matters worse, some of the flaws disclosed in the past remain active even today.

Parallel attack surface

“The end result is a pervasive, under-monitored, under-patched parallel attack surface that is both Internet-exposed and widespread inside corporate networks, and is much more exploitable than many folks realize,” Moore told the publication.

To assess the associated risks, Moore ran two scans - one looking at internet-connected BMCs in general, and another internally surveying devices in corporate networks. The first one found 86,000 exposed BMCs, more than half of which (54%) carried at least one of the flaws he found.

The internal scan, counting more than 120,000 BMCs, found almost a third (29%) carrying at least one critical vulnerability.

Details about the flaws will remain under lock and key until the manufacturers address them, Moore explained, saying that many of them cannot be exploited without prior authentication. However, for many (well-equipped) threat actors, that often isn’t a problem, since a number of smaller pre-authentication flaws exist as well, which could be abused.

Via Ars Technica

• Three in four European businesses fear a US tech 'kill switch' as much as they fear a ransomware attack
• Less than half have a continuity plan in place that is tested and documented
• Email and cloud file storage are the two services European businesses have sought sovereign alternatives for

Most European businesses use some form of US-based software in their day-to-day operations. But as tensions across the Atlantic mount, almost 75% of European businesses fear the introduction of a US tech ‘kill switch’.

This is according to new data from Proton, which surveyed 1,500 businesses in the UK, France, and Germany. The data also shows that more than half (54.5%) of European businesses would not survive for more than one day if they lost access to US cloud and digital services.

One in four of those surveyed predicted the losses from a single day of downtime could be as much as €100,000, with half predicting losses of more than €50,000.

Geopolitical tensions have become operational risk

US President Donald Trump has become increasingly critical of his allies across the Atlantic since returning to the Presidency. He has repeatedly questioned NATO contributions, threatening to withdraw unless Europe upped its spending.

But Trump has also criticized European tech regulations for “robbing American companies and, in turn, the American taxpayer”. He has vowed to investigate the European Union for fining US tech companies for anti-competitive practices and GDPR violations, and has placed numerous tariffs on trade partners.

Many US tech companies poured funding into Trump's presidential campaign, with others making voluntary contributions to curry favor immediately after his inauguration. Many complained of the fines levied against them by EU regulations, and Trump has turned this into a sticking point for negotiations with Europe.

The fear is that Trump could use Section 301 of the Trade Act of 1974 to deem the fines from such regulations to be unfair, and stop US companies from paying them, effectively allowing US companies to violate regulations without repercussions. In return, Europe would flip the ‘kill switch’ and stop US companies from operating in their territory.

"The kill switch is no longer an abstract geopolitical concern but a business continuity crisis. The study captures a clear shift in how European businesses perceive operational risk,” said Raphaël Auphan, Chief Operating Officer at Proton.

“The fact that concern about a government-imposed kill switch is virtually indistinguishable from concern about ransomware tells something significant: geopolitical risk applied to digital dependence is no longer a boardroom abstraction. It is joining the same threat register as criminal attacks, with the same sense of urgency and the same expectation that it could materialise without warning."

A sovereign alternative

The EU has already begun taking steps towards developing European alternatives to the cloud, productivity, and other services that many businesses rely on today. A Tech Sovereignty Package, launched in June this year, seeks to reduce the reliance on US hyperscalers and Chinese tech manufacturing.

While the Proton data shows that a majority of European businesses (67.8%) would switch to a sovereign provider if the kill switch was flipped, the availability of European cloud providers is not quite at the same level as rival US services.

But steps are being taken to address this shortfall. Proton has launched a business continuity solution to help businesses continue operating during outages caused by ransomware attacks, software outages, and even a US tech kill switch.

• Researchers Talal Haj Bakry and Tommy Mysk found three WebKit flaws leaking real IPs despite iCloud Private Relay
• DNS prefetching, WebAuthn origin requests, and WebTransport bypass proxy settings, exposing users across all Apple browsers
• Tor and Psylo browsers issued fixes; Apple has not confirmed a patch but is reviewing the report

WebKit, Apple’s engine that powers all web browsers in its ecosystem, contained multiple flaws that helped leak the IP addresses of users who paid to keep them hidden.

This is according to security researchers Talal Haj Bakry and Tommy Mysk who noted they had found “three WebKit features that bypass the proxy configuration and send traffic directly from the device instead,” they wrote.

“DNS prefetching resolves hostnames through the device’s normal DNS path, which reveals the user’s real DNS servers instead of the proxy’s. Available since iOS 26.0; WebAuthn Related Origin Requests make the operating system’s credential service fetch a validation file directly from the device. This exposes the device’s real IP address. Available since iOS 18.0; WebTransport opens a direct HTTP/3 connection and bypasses the proxy, which also exposes the device’s real IP address. Available since iOS 26.4," the researchers said.

Private Relay

While the bugs are in WebKit, the leaks come via Private Relay - a privacy feature available with iCloud+ that hides a user’s IP address and encrypts Safari web traffic. Private Relay does not work like a VPN, and does not mask the traffic flowing through other apps and programs - it just handles browser traffic.

Since WebKit is mandatory for all browsers running in Apple’s ecosystem, the vulnerability affects all of them. Some, including Tor and Mysk’s very own Psylo browsers, have already issued fixes.

Apple, on the other hand, has not yet confirmed a fix, or even that it was working on one. It did say, according to 404 Media, that it was looking into the research report.

The researchers built a dedicated website where users can check if Private Relay is working as intended or still leaking the actual IP address into the wild.

• Smart glasses bans are being introduced and considered
• There are growing concerns over smart glasses privacy
• Could hardware changes solve people's concerns?

I’ve written a lot about the high likelihood of major smart glasses regulation being introduced in various regions as the technology garners more and more bad press, and as expected, we’re starting to see bans and other restrictions take shape.

No nation has yet to all-out ban smart glasses, but a few have outlawed their use in certain scenarios while others are investigating harsher measures. Some private companies, such as event organizers, have also banned smart glasses on their premises and at their conferences.

Of course, this is bad news for smart specs owners who now could be facing restrictions on where they can/can’t wear their intelligent eyewear. For anyone considering adding smart glasses to their technology arsenal, these possible restrictions should be taken into account when making your final purchase decision.

So where are we starting to see smart glasses bans? Here’s a selection of the countries investigating and introducing anti-intelligent eyewear rules.

United States

Generally, smart glasses can be worn freely in the US; however, New York State has banned them from being used in any of its courts. Smart glasses with recording capabilities could be seen as an attempt to intimidate those involved in the case, and some cases contain sensitive private information where unauthorized recordings could impose serious risks.

Other states have introduced less widespread bans in courts — including Philadelphia, Hawaii, and North Carolina.

Meanwhile, the US Air Force includes in its rules for service members that they are “Unauthorized to wear mirrored lenses or smart glasses with photo, video or artificial intelligence capabilities while in uniform.” This seems like more of a presentation thing than an anti-smart specs rule (especially given the inclusion of mirrored specs), but it does mean you can’t wear intelligent eyewear in uniform regardless.

Further, attendees of conventions such as major hacker conference DEF CON 34 have been barred from wearing Meta glasses or similar. These bans focus on the possibility of glasses recording folks without their knowledge — with organizers arguing the recording light some glasses offer isn’t the most obvious.

UK

In the UK, things are much the same. Courts don’t ban their use, though after one person was being coached by their glasses’ AI mid-trial, their usage is generally advised against. There are also recording restrictions in UK courts, so while glasses aren’t explicitly banned, using them to snap photos or videos would be against the rules — the same as it would be for using your phone or a regular camera.

We have seen companies like Monopoly Events ban camera glasses from its Comic-Cons after secret filming complaints, and there’s a petition to the Government to ban the sale and promotion of smart specs in the country. These petitions don’t always go anywhere, but it shows there’s at least some public unrest over smart specs, and that could lead to rule changes.

EU

The European Data Protection Board is currently drafting a report on smart glasses, with it expected to land sometime in the next few months. However, while more general EU rules are being discussed, some individual members are making their own individual decisions on the tech.

Germany’s data protection authority commissioner has warned camera glasses could be banned under existing laws prohibiting recording devices hidden in everyday objects.

Netherlands digital rights activists have expressed frustration at smart glasses' ability to record people without their knowledge, while France’s privacy regulator, the National Commission on Informatics and Liberty, has highlighted the privacy risks camera glasses pose.

South Korea

Rounding things off, we have a different kind of ban in South Korea, with the country specifically restricting smart glasses access in exam halls after cases of students being caught trying to cheat using intelligent eyewear.

Smart devices are generally banned from exam rooms in most schools across the globe to prevent cheating, though given the importance of South Korea’s College Scholastic Ability Test, their very explicit ban makes sense so as to remove any possible confusion over whether students can even bring smart specs into the room with them.

Could things change?

Of course, very few bans have been brought in yet, but they could be unless things change on the hardware side.

A big concern is over privacy for non-glasses wearers caught in the gaze of someone's camera — especially if they don't know they’re being recorded. An obvious fix here would be to make smart glasses much more obvious when they're recording — perhaps brighter camera lights, a loud audible camera sound when snapping a photo, some kind of audio indicator when video is being recorded.

For users, they’ll want better control over what is and isn’t accessed by smart glasses makers when using their tech, and more certainty about which images are and aren’t shared, or which videos can or can’t be seen by contractors.

We’ll have to wait and see how the situation develops, though I’m not sure how much longer smart specs can go before we see serious regulations.

• Virtual Mac on iPad gets macOS running on compatible iPads
• It requires a jailbroken tablet and specific versions of iPadOS
• Its many limitations mean I don’t think it’s worth the hassle

For years, people have been wondering if Apple is ever going to “merge” iPadOS and macOS into some unholy mutant operating system. While Apple has repeatedly and resoundingly denied that’s ever going to happen, one intrepid developer has taken it upon themselves to do the hard work instead. And while the result lets you run full-fat macOS on your iPad Pro or iPad Air, I wouldn’t recommend it to anyone but the hardiest of souls.

Dubbed Virtual Mac on iPad, this GitHub project ports macOS onto Apple’s best iPads. That means it’s nothing like Apple’s Sidecar feature, which lets you use an iPad as a second display for a Mac. In the case of Sidecar, the Mac is doing all the processing. With Virtual Mac on iPad, however, it’s your iPad that’s actually running the operating system.

Unfortunately, getting that to actually happen is more than a little convoluted. You can’t even get started unless you’ve jailbroken your iPad, which means hacking it so it can run apps and systems not authorized by Apple. As well as that, the jailbroken iPad must be running iPadOS 16 to iPadOS 16.3.1 — nothing more, nothing less — in order to harness an exploit that was patched in subsequent editions. The requirements so far will probably be enough to put a lot of people off.

If you’ve persevered, you’ll need to add a specified repository to your device and install Virtual Mac on iPad from there. But you’ll need to be aware that even with macOS successfully set up, you won’t be able to log into your Apple Account — since you’re using a jailbroken device with an unofficial port of macOS, you’ll run into problems if you try to sign in, putting features like Find My and iCloud syncing out of reach.

Is it worth it?

Why would you go to all this effort to run macOS on your iPad? Well, there are a few reasons, including accessing Mac-only apps and getting a more portable platform to run macOS on.

But I certainly don’t think it’s a good idea. Apple’s iPadOS and macOS systems have been designed for very different use cases, and simply shoehorning a platform designed for a Mac onto an iPad isn’t a guarantee of success.

For one thing, macOS is made for large screens and input devices like mice and keyboards, while iPadOS works best on smaller screens operated by your fingers and thumbs. Sure, there’s some crossover — I’m aware that you can use mice and keyboards with an iPad, for example — but that doesn’t escape the fact that Virtual Mac on iPad puts the Mac’s operating system on a device it was never intended for.

As well as that, it requires a lot of effort for seemingly very small rewards. There are only a handful of cases where installing Virtual Mac on iPad is worthwhile, at least in my opinion: accessing apps like Xcode and Terminal that aren’t available in iPadOS, for example, or getting macOS on the most portable device possible.

But Apple’s best MacBooks are still lightweight and easy to carry around, and with a touchscreen MacBook Pro rumored to be just around the corner and Sidecar already a thing, the need for something like Virtual Mac on iPad feels limited. Is it worthwhile to go to all this trouble just for an ounce more portability? I’m sure it is for some people, but that number is likely to be vanishingly small.

At the end of the day, I know there will be some people for whom this is a welcome development. But its complicated installation process and limited use case just reinforce for me that Apple is absolutely right not to merge iPadOS and macOS. They’re meant to be separate, just as Apple intended.

Turtle Beach Command Series KB5: One-minute review

The Turtle Beach Command Series KB5 is a full-size keyboard with an interesting display module that has more functionality than many others.

However, the board fails to make a great first impression. It looks dated with its unnecessary angles, while the plastic materials feel cheap. The brushed metal face plate is a nice touch, though, as are the floating double-shot PBT keycaps. It’s also quite a light unit, especially so for a keyboard this size.

The included wrist rest also feels like a low-grade plastic, and doesn’t attach magnetically like those bundled with some of the best gaming keyboards. Instead, it relies on a somewhat fiddly — but ultimately secure — mechanical attachment. And despite its lack of padding, its ergonomic contours offer sufficient levels of comfort. The rest also helps to make up for the KB5’s shallow tilt angle, even with the two-stage feet propping it up.

The standout feature of the KB5, though, is its interactive touchscreen in the top-right corner of the unit. It lacks the responsiveness we’ve come to expect of modern touchscreens, taking multiple swipes and taps for it to register them. However, it has a lot of useful functions and features, with plenty of settings for the KB5 itself, as well as a wealth of customizable shortcuts and readouts for Windows and various apps.

These shortcuts can be customized using Turtle Beach’s Swarm 2 software. There are a wide variety of templates to choose from, but you can also create your own shortcut clusters from a wide selection of widgets. The software also has a generous selection of remapping and macro options, although there aren’t any performance-related adjustments. I wish it provided more explanations for its features, too.

In action, the KB5 performs reasonably well. The keycaps have a very low profile, which makes them easy to glide over, while the switches are satisfyingly damped. However, presses are a little heavier than you might expect, sometimes resulting in taps failing to register, especially if you have a light touch. This is more of an issue when typing than gaming.

The WASD position is comfortable and the keys are well spaced, making it easy to reach them. I could easily hit the space bar flush, thanks to its low profile and generous slant. However, the sheer width of the board can result in collisions when swiping your mouse vigorously.

At $150 / £140, the KB5 isn’t exactly a budget-friendly board, and is especially dear for one with no wireless connectivity and a less-than premium construction. The integrated touchscreen and large layout make up for this somewhat, but the fact remains there are better value rivals if you don’t need all those keys and a sophisticated display.

Turtle Beach Command Series KB5 review: Price & availability

• $149.99 / £139.99 (about AU$210)
• Available now in one colorway
• Reasonably expensive for a wired mechanical keyboard.

The KB5 costs $149.99 / £139.99 (about AU$210) and is available now in one colorway. It comes with a braided USB cable, an attachable wrist rest, and extra WASD keys with a grippier texture. You can remove the stock ones using the included keycap puller.

This is quite expensive for a wired mechanical keyboard. Granted, it’s a full-size board with plenty of keys, but it lacks the premium build of some of its cheaper rivals, such as the MonsGeek FUN60 Ultra. This is an extremely solid unit, and its gaming performance is as good if not better than the KB5’s, with its analog switches providing more adjustability. It also has multiple wireless connectivity modes.

Then there’s the Razer BlackWidow V4 Pro. This is vastly more expensive than the KB5, but it’s one of the best performing mechanical keyboards I’ve ever used, and its software and build quality are superior. What’s more, its included wrist rest is far more plush, and it also has multiple wireless modes.

• Value score: 3.5 / 5

Turtle Beach Command Series KB5 review: Specs

Turtle Beach Command Series KB5 review: Design & features

• Gamer-ish design
• Cheap-feeling plastics
• Useful integrated display

The KB5 leans into the gamer aesthetic, with its odd contours along the top edge and flashes of brown. Personally, I found this look a little garish and quite dated, although I did like the brushed metal front plate and its countersunk screws, which are prominently displayed. These are also quite practical since they’re easily accessible.

Overall, the build quality is less impressive. The plastic of the chassis feels cheap, although in fairness it’s also quite light, which means this large keyboard isn’t a chore to move around. Another plus is the keycaps are made from double-shot PBT, the gold standard keycap material, and they’re solidly fitted.

The notching on the cylindrical volume wheel feels good too, making for easy flicks while at the same time offering fine control. However, it can be hard to press inwards to mute without accidentally triggering a scroll.

A wrist rest is included with the KB5, which is always a welcome addition in my view. However, it appears to be made from the same cut-price plastic as the keyboard itself. And while it actually attaches to the keyboard, it requires snapping latches in place, which is certainly less elegant than the magnetic method utilized by many others.

On a more positive note, the display in the top-right corner is larger, sharper, and more interactive than many others I’ve seen integrated in keyboards. It also has touchscreen functionality, although this is fairly rudimentary and gestures often require repeating two or three times before the display responds. Also, the texture of the screen itself is a little grippy, which can hamper swipes.

Nonetheless, it offers a lot of features. By tapping the left side of the screen, you can access three pages of settings for the KB5, with options to toggle ReacTap (Turtle Beach's Rapid Trigger function), remap keys, and alter the RGB backlighting, to name a few.

There are also three pages of widgets, with each page containing a cluster of six. These can be customized using Swarm 2, Turtle Beach’s peripheral software. You’ll find a large selection of template clusters to choose from, catering to various use cases. For instance, there’s a gaming one that features a shortcut widget for opening Steam, while the other widgets display CPU and GPU loads and temperatures. There’s also a template for general productivity, with widgets for copying and pasting and opening Windows’ Calculator app.

You can also edit and create your own templates by selecting each individual widget. In addition to common Windows commands and multimedia controls, there are app-specific widgets for Steam, OBS, Steamlabs, and Discord. There are also those under a section labelled ‘CS’, although it’s unclear what game or games in the Counter-Strike series these widgets are compatible with. All I can say is that they failed to work with Counter-Strike 2 when I played it.

Swarm 2 features other customizations, including key reassignment. There is a generous selection of shortcuts you can assign, and four mapping layers to choose from: primary, Fn, Game Mode, and Easy Shift. You can also remap the scrolls and button of the volume wheel, which isn’t always possible on gaming keyboards. More impressively, the wheel has the same four layers of assignments available to it.

There are a wealth of preset macros to choose from as well, not only across a broad selection of games, but also for other software such as Photoshop. However, a lot of the other macros are quite basic, merely boiling down to simple inputs and system commands.

During my time with Swarm 2, it performed well without any major bugs or glitches occurring. There were times when the RGB backlighting failed to turn on, but whether this was an issue with the app or the keyboard’s own firmware, I can’t say. Regardless, I managed to get it working again by unplugging and replugging the USB cable, or by turning the lighting off then on again in the app.

Swarm 2 is easy to use and navigate, although it could do with more explanations for some of its features. For instance, I couldn’t find any explanation as to how to access the Easy Shift and Game Mode layers, and the ReacTap feature isn’t toggleable anywhere in the app, only via the integrated screen. Neither location explains what it does or how it works; I had to gather this information from Turtle Beach's website.

• Design and features score: 3.5 / 5

Turtle Beach Command Series KB5 review: Performance

• Very low-profile keys
• Deep actuation point detrimental to typing
• Board width can hamper mouse movement

In general, the KB5 is a capable gaming keyboard. Its Titan mechanical switches are damped to a large degree, making them tactile and relatively quiet, although a certain clickiness emanates from key presses.

The keys also have a very low profile, perhaps the lowest I’ve ever come across. I appreciated this when typing, since I could glide between them easily, but their actuation point is deeper than you might expect, resulting in hits often failing to register when I typed quickly.

Thankfully, this is less of an issue when gaming. Also, the indents on the keycaps offer a secure hold, while the WASD position is comfortable thanks to the spacing of the keys, which is large enough to avoid feeling cramped, yet all the peripheral keys are still easy to reach. What’s more, the space bar slopes downwards slightly, making flush hits easier to achieve.

However, the KB5’s lack of tilt is slightly disappointing. Despite having two stages, the feet don’t create much of an angle, which is something I often lament in gaming keyboards. The included wrist rest does make up for this somewhat, thanks to its sloping design, and it’s comfortable to use. Despite the lack of padding, a bigger issue with the KB5 is its sheer width. If you like using a low DPI setting for your mouse and need to make large movements, you may find yourself slamming into the side of the board.

• Performance score: 3.5 / 5

Should I buy the Turtle Beach Command Series KB5?

Scorecard

Buy it if…

Don't buy it if…

Turtle Beach Command Series KB5 review: Also consider

How I tested the Turtle Beach Command Series KB5

• Tested for a few days
• Performed various tasks
• Plentiful gaming keyboard experience

I tested the KB5 for a few days, during which time I used it for gaming, general browsing, and working.

I played various games, including Counter-Strike 2, a great title for revealing the true performance of peripherals, given the demands it places on the speed and accuracy of inputs.

I’ve been PC gaming for over a decade, and have used a great many keyboards in that time. I’ve also reviewed a large number of them, from small budget models to large premium offerings, across a wide range of brands.

• First reviewed: August 2026
• Read more about how we test

• A former FBI counterintelligence supervisor is accused of memorizing seed phrases from bureau systems
• The agent moved roughly $1 million out of wallets tied to a foreign adversary without having to resort to any sort of hacking
• Investigators recovered ChatGPT conversations in which he asked how to invest the money and how to gain EU residency, and the chatbot's replies recited his age, wife, child, and property plans back to him

Patrick Steven Yaroch, a supervisory special agent in the FBI's Counterintelligence and Espionage Division, has been arrested and charged with interstate transportation and receipt of stolen goods.

An affidavit filed in the Eastern District of Virginia, claims Yaroch took roughly a million dollars in cryptocurrency from wallets he encountered while investigating a foreign adversary and then used ChatGPT to determine what to do with it.

The theft, as described, required no technical sophistication whatsoever: Yaroch held a Top Secret clearance with SCI access and had spent 2017 to 2025 on a national security squad at the FBI's Boston division working against a single adversarial nation, which NBC News reports was Russia.

An atypical heist with the alleged mastermind acting out of "frustration"

Patrick Steven Yaroch encountered the cryptocurrency wallets tied to his work in November 2024. He had researched how wallets work, created one of his own, searched the FBI's holdings for the relevant account information, and memorized the recovery seed phrases.

He then made roughly 10-12 transfers to his own wallet. No encryption was broken, and no protocol was exploited because none was in place for a man with his security clearance; he simply read a phrase off an internal system and remembered it.

The incident is particularly interesting because he self-reported, effectively turning himself in to his colleagues: on July 28 2026, he contacted a Justice Department employee he had worked with in Boston over Signal, asking to meet. They met at FBI headquarters the next day, where Yaroch reportedly began breaking down almost immediately, and the conversation moved to the other man's office.

He said the situation was "eating him up inside" and that he wanted to give all the money back. He filed an online self-report to the FBI's Security Division and told headquarters personnel he had screwed up. When agents arrived at his Ashburn home that evening, he told them, unprompted and in blunter terms, that he had messed up.

His defense, as per the affidavit, however, is slightly different from what one would expect: His stated motive was not greed. He told his colleagues he had grown frustrated that the FBI could not or would not act against those accounts, described himself as "spinning out of control" at the time, and said he decided to take matters into his own hands.

Despite this, he seemingly had a change of heart after cooperating earlier, asking for a paper containing his wallet seed phrases, which he had volunteered to agents, while declining to continue the interview without a lawyer while asking for time over the next two days.

This culminated in agents obtaining warrants, executing them on July 31 with SWAT securing the house, and recovering an iPhone, a Trezor hardware wallet, the handwritten seed phrases, a Portuguese power of attorney dated June 15, and three passports, one of them diplomatic.

Ironically, the most potentially damning evidence of his intentions comes from his conversations with AI, still on his phone and directly linked to him.

His conversations with ChatGPT convey a very different thought process: On May 28, he asked how to invest or spend a million dollars to maximize profit and return. On June 4, he asked what someone with about a million dollars should do to leave the United States and become a resident or citizen of an EU country. On June 17 he asked whether an American connecting through Turkey needs a visa. On June 26 he asked for help drafting an email to an executive about a job opening and life in Greece.

There is more evidence that he might already have acted based on the answers he received: prosecutors have found a power of attorney authorizing two Portuguese lawyers to register him with the country's tax authority and obtain a Portuguese tax identification number, and unreported foreign travel to Germany in May, Portugal later that month, and Grenada in early July, all in breach of bureau reporting rules.

His current investments seem to be equally erratically reasoned: On July 23, five days before he first confessed, Yaroch moved roughly $1.02 million into Suilend, a lending protocol on the Sui blockchain, reaching it through the Slush wallet app, which he then deleted. He parked the funds there to earn interest. When asked why he chose that service, he said he liked its logo, a water droplet.

When agents looked, the position was worth $933,756, roughly 8% below its level a week earlier. His Kraken account held another $188,570, including about $5,000 in a token called Squid and $1.67 in Bitcoin. Agents ultimately swept $925,426 into government wallets, leaving about $165,582 behind because it was dollars and could not be moved to a crypto wallet.

Yaroch is charged under sections 2314 and 2315 of the federal criminal code, the general provisions on transporting and receiving stolen goods. He is not charged with espionage, with computer fraud, or with theft of government property.

The wallets were not the government's, and that might change how they are treated legally, even as it raises important questions about the security protocols at federal agencies regarding cryptocurrencies, since they both monitor and have seized increasingly large amounts of them over the past few years.

In Yaroch's case, if the allegations hold, government protocols failed to identify the theft for nearly eighteen months before the person responsible reported himself, making the case for a potential review by federal agencies about how they handle such matters.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1655) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1655) — hint #2 — repeated letters

Quordle today (game #1655) — hint #3 — uncommon letters

Quordle today (game #1655) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1655) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1655) — the answers

The answers to today's Quordle, game #1655, are…

• AMUSE
• BRAND
• CEDAR
• BLURB

After seeing the two B-words immediately I made a wrong guess with my third word.

Fortunately, the letters I had left meant that after guessing “pause” AMUSE was the only alternative, while CEDAR was just a case of rearranging five letters.

Daily Sequence today (game #1655) — the answers

The answers to today's Quordle Daily Sequence, game #1655, are…

• WEARY
• THREE
• SUNNY
• TOPIC

Quordle answers: The past 20

• Quordle #1654, Wednesday, 5 August: MOUND, WRONG, STOOD, WEIRD
• Quordle #1653, Tuesday, 4 August: GOOEY, TARDY, HUMAN, CHALK
• Quordle #1652, Monday, 3 August: FUNGI, MUDDY, DEBUT, MANIA
• Quordle #1651, Sunday, 2 August: BOOTH, EASEL, REACH, MAKER
• Quordle #1650, Saturday, 1 August: OMEGA, BIRCH, SMOCK, EERIE
• Quordle #1649, Friday, 31 July: MANIA, SINGE, STOOL, LOFTY
• Quordle #1648, Thursday, 30 July: MODAL, IDLER, CHUMP, LUMPY
• Quordle #1647, Wednesday, 29 July: GAWKY, ALLOY, AUDIT, LATCH
• Quordle #1646, Tuesday, 28 July: SMITE, ROACH, RUDDY, GLOBE
• Quordle #1645, Monday, 27 July: TAFFY, FIGHT, GUILD, WAGER
• Quordle #1644, Sunday, 26 July: STOMP, LIMIT, FUNKY, STEAD
• Quordle #1643, Saturday, 25 July: SALON, SHEEN, BURST, GOURD
• Quordle #1642, Friday, 24 July: DOLLY, EDIFY, LAGER, PRANK
• Quordle #1641, Thursday, 23 July: LADEN, EVICT, WOVEN, SHIRE
• Quordle #1640, Wednesday, 22 July: COYLY, SINGE, AWASH, AWOKE
• Quordle #1639, Tuesday, 21 July: TRUSS, AXIAL, SWINE, THING
• Quordle #1638, Monday, 20 July: ICING, SLICK, GAILY, RISEN
• Quordle #1637, Sunday, 19 July: SPURT, ACRID, THRUM, BLEEP
• Quordle #1636, Saturday, 18 July: KNAVE, TIGHT, BLEAT, CHAOS
• Quordle #1635, Friday, 17 July: CUMIN, PALER, GRASS, INBOX

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #886) - hint #1 - today's theme

NYT Strands today (game #886) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• WRATH
• LION
• GOON
• FLOW
• HATRED
• BEER

NYT Strands today (game #886) - hint #3 - spangram letters

NYT Strands today (game #886) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #886) - the answers

The answers to today's Strands, game #886, are…

• CHERRY
• REDBUD
• DOGWOOD
• HAWTHORN
• MAGNOLIA
• SPANGRAM: FLOWERINGTREE

• My rating: Hard
• My score: 1 hint

This game came to me in stages.

First I managed to find CHERRY while searching for non-game words, then in the belief that we were looking for fruit trees I took a hint and was given REDBUD, which changed my thinking completely.

Spotting “tree” and “flower” I managed to put together the spangram and then complete the board. Like the act of gardening and maintaining a FLOWERINGTREE it felt like a long, but rewarding process.

Yesterday's NYT Strands answers (Wednesday, August 5, game #885)

• IDEA
• THOUGHT
• OPINION
• PLAN
• NOTION
• CONCEPT
• SPANGRAM: BRAINSTORMING

• Securonix uncovers SMOKE#SCREEN, a campaign tricking users into installing weaponized ScreenConnect via fake Zoom/Adobe updates and business docs
• Attackers gain persistent remote access, evolving tactics to disable protections and abuse trusted services like Dropbox/Cloudflare for delivery
• Victims observed on Windows and macOS; businesses urged to verify updates via official sites and train staff against unexpected installs

Security experts Securonix Threat Research have uncovered a new malicious campaign that tricks users into installing legitimate remote monitoring and management (RMM) software.

Dubbed SMOKE#SCREEN, the campaign uses fake Zoom and Adobe update messages, as well as a whole swathe of fraudulent business-related documents (document review requests, system maintenance tools, invoices, and similar), to convince the victims to run malicious files.

Victims who don’t see through the ruse and run the files end up installing ConnectWise ScreenConnect, a legitimate RMM tool that many IT teams use to provide technical support to their coworkers and clients. However, it is also one of the more abused solutions in the criminal cyber-underworld, since it can often fly under the radar of security products.

Dangerous evolution

After installation, attackers can remotely access compromised devices, potentially allowing them to steal data, install additional threats, or move deeper into an organization’s network.

At first glance, SMOKE#SCREEN looks like a fairly standard “phishing - install legitimate RMM - remote access” campaign. However, what makes it unique is how it evolved over time, Securonix explained. Earlier versions focused on hiding the malicious activity, while newer versions attempted to disable security protections and avoid detection by security software. The attackers also used trusted services such as Dropbox and Cloudflare to deliver their files, making the activity harder to block.

Victims were observed on both Windows and macOS ecosystems, it was added.

“The SMOKE#SCREEN campaign demonstrates a capable, actively maintained, and rapidly adapting threat actor who has built a diversified toolkit around a single objective: gaining persistent, legitimate-looking remote access to victim systems through weaponized ScreenConnect deployments,” the researchers explained.

“The use of multiple social engineering themes, rotating payload hashes, cross-platform coverage, and a live staging server that doubles as a ScreenConnect relay indicates a well-resourced actor with deliberate operational security practices.”

To minimize the risk of compromise, businesses should disable receiving software updates delivered through emails, verify update requests through official websites, and instruct their employees to be cautious when opening attachments or installing tools they were not expecting.

Via The Hacker News

• Huntress flags phishing emails spoofing Bank of America, pushing victims into different infection chains on Windows vs. macOS
• Windows users were tricked into installing ScreenConnect RMM via fake “Account Guard,” while macOS users faced credential‑harvesting forms for identity theft
• Emails mimicked Bank of America branding but came from unrelated domains; users advised to verify sender addresses to spot scams

Bank of America customers have been warned to take extra caution after experts warned of hackers spoofing the bank into trick you into downloading unwanted software and granting them access to your computer.

Security researchers Huntress revealed how it received a phishing email in their honeypot (an address set up primarily to catch scammers) claiming to have come from Bank of America.

Obviously, the message came from a domain completely unrelated to the company, but looked almost identical to the real thing, with the company logos, color schemes, and other details, meticulously imitated.

Just another ScreenConnect scam

In the email, the researchers were warned that their account was about to be “restricted” unless they “confirmed” certain information.

Depending on the platform from which the victim views the email, both the infection chain and the end goal are different. For Windows users, victims are invited to install “Account Guard”, which is described as a “powerful tool designed to protect your financial data, prevent unauthorized transactions, and other cyber threats”.

This is no guard - this is a Visual Basic script that leads to an installation of the ScreenConnect Remote Monitoring and Management (RMM) tool. ScreenConnect is not malicious itself - it is a legitimate tool - but it is also one of the most abused software out there, leveraged to grant attackers unabated access to victim computers without triggering any alarms.

For macOS users, on the other hand, the goal is different. Instead of trying to deploy malware, the attackers try to steal sensitive data. First, the victims are asked to log in to their banking account (twice - the first attempt is scripted to fail, in case the victim purposely submits the wrong password the first time).

Then, once they “log in”, the second web page asks the victims to “confirm” their details - full name, mailing address, government ID details, Social Security number (SSN), and the payment card details. This is more than enough information for an identity theft attack, or even wire fraud.

Huntress is now warning all Bank of America users to double-check the sender address for any email claiming to be from the bank, since that is the best way to know if the email is legitimate, or a scam.

• Gigabyte graphics cards are rumored to be set for a big price rise
• It could be a hike of 20% to 40%, and other rumors are also pointing to major price hikes for GPUs more broadly
• This means now is likely a good time to make a purchase, particularly with certain cards which have avoided the worst of the hikes so far

Desktop GPU prices are set to rise if the rumor mill is right – with yet another prediction to that end being aired – and while graphics cards are already costly in some cases, now might be the time to buy certain models, based on a fresh roundup of average pricing.

First off, let's deal with the latest gloom nugget from the grapevine regarding GPU pricing, courtesy of @momomo_us on X (via Wccftech) who picked up a notice from CFD (a Japanese components supplier) warning of substantial price hikes on Gigabyte graphics cards.

The claimed rise (add seasoning, of course) is in the order of 20% to 40%, so at the latter end of that scale, we're looking at prices shooting up by almost a half in some cases. Existing orders from retailers buying boards from CFD may even be cancelled, the notice states.

I perhaps wouldn't put as much stock in this, except that it echoes a rash of recent reports contending that large price hikes are about to happen in the GPU world, which makes it all the more believable.

Only yesterday I reported on the situation in South Korea where RTX 5000 models are rumored to be getting price increases of up to 30%. So again, that's a hefty hike, and it follows other speculation about Nvidia charging its partners more for video RAM (which will push up costs, of course).

This apparent Gigabyte move will affect both Nvidia and AMD graphics cards in Japan, and there have been rumors about Team Red having Radeon price hikes in the pipeline due to more expensive VRAM, too. That only makes sense, as if VRAM is getting more costly for Nvidia, it will be for AMD too. And while some of these reports are based on regional activity, the cost issues will surely apply globally – none of these markets exist in a bubble.

Analysis: I think it's time to buy – especially with certain GPUs

The RAM crisis has a lot to answer for, and it very much looks like graphics card prices are going to be jacked up considerably during the remainder of 2026, with video memory being the primary driver here. Given that, it seems that if you are thinking about a GPU upgrade, now is likely the time to go for it, rather than waiting and being hit by price hikes.

That's especially true if you're considering a 16GB graphics card (as more gamers are these days), as the products with more VRAM are going to get hit the hardest for price rises as memory modules become even more expensive.

If we want a snapshot of the current GPU market as price tags stand, fortunately enough, TechSpot has just furnished us with an extensive (multi-region) pricing roundup as of the end of July which highlights some key points.

Firstly, low-end GPUs are still relatively unscathed, with offerings like the RTX 5050 and RTX 5060 8GB, and the 8GB spin on the 5060 Ti, not having been bumped up by all that much in the RAM crisis thus far. However, as for the 16GB incarnation of the RTX 5060 Ti, that has seen major price bumps, reinforcing that observation on 16GB pain (this card is up over 40% since November 2025 in the US, for example – and shows a 14% rise since April 2026).

In the tier above that, the RTX 5070 is holding at a reasonable price, and even if the sub-MSRP levels of late last year are well and truly gone, it remains a decent buy. (As long as you can stomach 12GB of VRAM at this price bracket, of course – and that's one of the reasons why this GPU hasn't been hit so hard, no doubt).

Above this level, Nvidia GPUs have witnessed some of the nastier price increases, as you've probably noticed.

On the AMD side, matters look more promising, particularly in the case of the Radeon RX 9070 and RX 9070 XT, with TechSpot finding that the 16GB models in the RDNA 4 family haven't suffered as much as Nvidia's GeForce offerings. The price of both these 9070 models has remained steady over the last few months, and in many regions, they're only up 10% or so compared to late 2025. (The 9070 XT is an exception in the US, mind, where it has risen by closing on 20% since last year).

If you're inclined towards one of these Radeon mid-rangers, or Nvidia's RTX 5070, I'd strongly suggest you buy now rather than wait based on what we're hearing from the rumor mill. Lower-priced graphics cards are likely worth grabbing, too, because they may be heading upwards in the pricing stakes before long – although notably the RX 9060 XT with 16GB has already become a good deal more costly, much like its RTX 5060 Ti 16GB rival.

As noted, Nvidia's higher-end graphics cards (RTX 5070 Ti and upwards) have already been hit with alarming price hikes, but they're likely to get even worse. So, this could be a case of keeping your wallet shut and holding out for possibly a lengthy time, as I can't really recommend them even at the current pricing.

The trouble is, we don't know how long the RAM crisis will continue, and some of the guesswork on that front is very bleak indeed – suggesting it might be the rest of this decade effectively. At this point, I'm inclined to believe we're in it for the long haul with PC component pricing woes, which is why I think it's best to buy a GPU now, at least with the mentioned models, assuming you're in a position to do so.

• Forescout’s Vedere Labs found 15 flaws in TP‑Link Omada business networking gear, exploitable for RCE when chained with prior CVEs
• Weak trust shortcuts in zero‑touch provisioning exposed devices to client‑side code execution, hijacking, spoofing, and encrypted comms compromise
• TP‑Link released firmware updates; admins should patch immediately, with 1,800+ Omada controllers exposed online

TP-Link has patched more than a dozen vulnerabilities across multiple business networking products which could have been chained to achieve remote code execution (RCE).

Security researchers at Vedere Labs from Forescout found the flaws and published an in-depth report on the issues, which particularly affect TP-Link Omada, the company’s business networking platform for centrally managing enterprise and small-business network infrastructure.

It includes cloud-managed Wi-Fi access points, routers, switches, gateways, and controllers, all of which can be monitored and configured from a single interface.

Enabling "concrete attacks"

These support zero-touch provisioning (ZTP), a mechanism that allows IT managers to deploy and maintain devices without needing to configure each one manually and on site.

However, ZTP has to establish trust between a factory-fresh device, and a controller with no human involved, so TP-Link used different shortcuts: from hard-coded keys and certificates shared across multiple devices, to default credentials, and from guessable serial numbers as “identity”, to weak session-key randomness.

Now, Forescout says 15 vulnerabilities its researchers discovered all allow for different ways of exploiting these shortcuts, meaning a flaw anywhere in the onboarding chain can compromise every device that goes through it. These bugs would need to be combined with two previously disclosed command-injection flaws, though.

“The vulnerabilities fall into four impact categories: client-side code execution, information disclosure, device hijacking and spoofing, and compromise of encrypted communications,” Forescout said. “Combined with two previously disclosed CVEs (CVE-2025-7850 and CVE-2025-7851), these flaws enable concrete attacks that let attackers infiltrate networks through controllers and client devices.”

Out of the 15 discovered flaws, 11 received CVE identifiers, and the rest did not receive a tracking number.

Forescout said there are more than 1,800 Omada controllers accessible from the wider internet. If you are using any of the devices from the platform, you should head over to TP-Link’s download portal and grab the latest firmware for your device model.

• ZeroBEC observes Greatness PhaaS evolving to bypass MFA and phish Microsoft 365, iCloud, Yahoo, and Google Workspace accounts
• Attackers spoofed RingCentral emails post‑ShinyHunters breach, luring victims to fake Microsoft 365 logins that capture authentication tokens
• Greatness is sold on Telegram for $289/month, enabling access to Outlook, Teams, SharePoint, OneDrive, and more across multiple regions

Microsoft 365 users have been getting phishing emails spoofing RingCentral, designed to steal their accounts even if they were protected by multi-factor authentication (MFA), experts have warned.

Security researchers ZeroBEC claim to have observed a phishing-as-a-service (PhaaS) platform called Greatness evolve to also target MFA accounts, as well.

Greatness used to be a simple credential phishing platform. However, in recent times, it evolved to target not just Microsoft 365 accounts, but also those of iCloud, Yahoo, and Google Workspace.

Grabbing MFA-approved authentication tokens

ZeroBEC notes that RingCentral recently suffered a data breach at the hands of the infamous ShinyHunters hackers, meaning there is a good chance (although not confirmed) that the threat actors exfiltrated a list of emails belonging to RingCentral customers from that attack, and used it in this attack.

Now, RingCentral customers have been getting emails that look as if they are coming from the company itself, despite being mailed from an unknown mail server, and despite failing SPF and DMARC checks. The emails are the standard fake voicemail and performance-review notifications which, if clicked, redirect the victim to attacker-owned infrastructure spoofing the Microsoft 365 login page.

Through this malicious landing page, Greatness operators are able to capture MFA-approved authentication tokens, bypassing the login process entirely and moving straight into victim accounts.

From there, they would enumerate Outlook mailboxes, Teams conversations, and SharePoint sites. They would also access OneDrive files, contacts, calendars, and registered applications through Microsoft Graph.

The number of victims is unknown at the time, but ZeroBEC says Greatness has been active for at least four years now, targeting users in the US, UK, Australia, Canada, and South Africa.

According to BleepingComputer, the platform is being advertised for sale on Telegram channels with “thousands of subscribers”, and is currently being offered for a monthly fee of $289.

Via BleepingComputer

• Aikido researchers uncovers ChainDrop, a Shai‑Hulud variant infecting 1,300+ npm packages with an infostealer
• Attackers compromised GitHub accounts tied to popular libraries (Keyv, Cacheable, flat‑cache, file‑entry‑cache) and pushed tainted releases with 2B monthly downloads
• Malware exfiltrates developer/cloud credentials and secrets to a public GitHub repo; admins should treat affected systems as compromised even after removal

Another Shai-Hulud variant has been discovered in the wild, infecting more than 1,300 npm packages with an infostealer.

Security researchers Aikido reported finding “at least 868 packages (across 1381 versions) that have been compromised by the worm.”

Shai-Hulud is a self-propagating supply chain malware that targets software developers by compromising open-source packages and CI/CD pipelines. It steals credentials, API keys, and access tokens and then uses those stolen secrets to publish additional malicious packages.

What to do in case of an infection

In May 2026, actors claiming to be associated with the TeamPCP group publicly released the Shai-Hulud worm's source code, saying they were “open sourcing the carnage” and inviting other threat actors to adopt and modify the code. Since then, there were multiple copycat campaigns and variants, including this one which Aikido dubbed ‘ChainDrop’.

Aikido said the attackers compromised the GitHub account of the person maintaining Keyv and Cacheable, widely used open source JavaScript libraries for caching data in Node.js applications. From there, they were able to move into other popular utilities such as flat-cache and file-entry-cache, as well as packages associated with organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.

The malware was pushed directly into the projects’ main branches, and then generated additional package releases. The compromised packages have a combined 2 billion monthly downloads.

Aikido says the infostealer grabs developer and cloud credentials, encrypts them, and then sends them to a public GitHub repository called “Shai-Hulud: Here We Go Again.”

It also steals local configuration files, GitHub PATs, workflow tokens, and other ghp_, gho_, and ghs_ tokens, certain npm tokens, GitHub Actions secrets, AWS credentials, Kubernetes secrets, and more.

The researchers are saying system admins who installed a tainted package should treat their developer workstation or CI/CD runner as compromised, even if they removed the package.

With back-to-school season in the air, you might be looking to stock up on a new Mac for college. But doing so can be a confusing affair, with many different models and configurations to choose from, and you can waste a lot of time trying to work out what’s best for your needs.

To skip all the bother, just give our guide a read. We’ve put together everything you need to know, from which Mac is best for you to how to get those all-important student discounts. You’ll be kitted out and ready to go before you know it.

How to choose the right specs for your Mac

When you buy a Mac, there are a few specifications you need to choose, including the chip, memory and storage. You’ll also need to pick a color and, with some Macs, extra options like the display coating and power adapter.

The first three factors — chip, memory and storage — are the most important, and the ones where there’s the most to learn.

We’ll start with the chip, which determines how powerful your MacBook is. More powerful and more recent chips will generally be better, and the higher the chip’s number, the more recent the generation it belongs to.

The chip usually comes in a few different tiers. There’s the baseline option, such as the M5, M4, M3 and so on, then Pro chips like the M5 Pro, M4 Pro and M3 Pro. Then there are Max chips, including the M5 Max and M4 Max. The most powerful level is the Ultra, and it’s limited to desktop Macs like the Mac Studio. The latest version there is the M3 Ultra.

Apple’s chips combine CPU, GPU and memory onto a single system on a chip (SoC). The CPU and GPU will have their own core counts, and the more cores you get, the better able the chip is to handle difficult workloads.

So, which do you need? The baseline chips will be more than enough for essay writing and basic research. On the other hand, you might want a Pro or even Max chip if you’re doing anything that involves complex apps, data processing or graphics work.

As for memory, this is built into the SoC, but you can increase or decrease it separately from the chip selection when configuring your Mac (although it’s worth noting that some memory amounts require upgrading to a more powerful chip). More memory helps speed up multitasking and is also useful for demanding workloads.

The amount of storage you choose depends on how long you want to keep the Mac, how much of a digital hoarder you are, and the type of things you’ll be storing. Run lots of large apps or work with high-resolution video files? You’ll need lots of storage.

Here, it’s best to err on the side of caution, as it’s very difficult (although not impossible) to upgrade your storage once you’ve bought your Mac. While it can be done, it’s not for the faint of heart.

One alternative is to plug in an external storage drive to give yourself extra space. This isn’t optimal, though, as it’s one more thing to carry around, and if it becomes accidentally disconnected, you could suffer data loss.

Make sure to regularly back up your Mac, either using an app like Time Machine or with a cloud service like Backblaze.

How to get Apple’s student discount

Apple has a special education store for students, teachers and more. Here, there are various savings available, depending on the product. For example, the MacBook Neo is priced at $599, down from the regular $699 price (bringing it back to the price it had when it launched, before Apple’s recent price rises).

Apple says that student discounts are available to “current and newly accepted college students and their parents, as well as faculty, staff, and homeschool teachers of all grade levels.” You’ll need to verify your student status, which you can do online or at an Apple Store.

Student savings can be had on more than just Macs. In total, the discounts apply to:

• Mac
• iPad and select accessories
• Apple Watch
• Displays
• AppleCare+ for Mac
• AppleCare+ for iPad
• AppleCare+ for Display

Apple says to look out for the mortarboard icon, which indicates a product bought through the education store is discounted.

You get all the same perks as if you were to buy through Apple’s regular store. You can pick components and colors, trade in an old device, personalize your device with engraved monograms and emojis, pay in full or over time, and more.

The three best Macs for back to school

Here, we’ve picked three Macs that we recommend the most for students. All three are Apple laptops, which will be perfect for carrying to lectures and around campus. Note that if you don’t have many lecture hours or are studying from home, you might want to consider the Mac mini, which starts at $699 in Apple’s education store. It’s a brilliant computer with an affordable price tag, but as it requires an external display, it’s not ideal for lectures and seminars.

MacBook Neo

The MacBook Neo is the perfect option for students on a budget. The default model comes with 256GB of storage, an Apple A18 Pro chip and 8GB of memory. It costs $599 from Apple’s education store, marking a saving of $100 over the regular price.

If your school or college work mostly involves writing essays and researching online, the MacBook Neo is exactly what you need and will be able to handle everything you do. The only question is whether you should upgrade to 512GB of storage — doing so also adds a Touch ID button to the keyboard, which is a handy way to log in and verify purchases.

MacBook Air

Stepping up, a solid mid-range option would be the 13-inch MacBook Air with M5 chip. You can choose between M5 chips featuring an eight-core GPU or a 10-core GPU, but we’d stick to the former — if you need more graphical power, the MacBook Pro will be a better option, which we’ll come to later.

Next, you can choose between 16GB, 24GB and 32GB of memory. The option you choose here depends on your workloads, but generally 16GB will be enough for most students. Again, if you need more, go for the MacBook Pro.

As for storage, the entry-level M5 chip is locked to 512GB of storage. To get more, you’ll need to upgrade to the higher-end M5 chip, which ups the price. Consider how much storage you need before making this move — if you have an existing computer, see how much you’re using with that. Bear in mind that you can’t change the internal storage after purchase, so if in doubt, opt for more.

Finally, there’s the matter of the charger. The M5 MacBook Air comes with a 40W charger that can handle loads up to 60W. If you want fast charging, which Apple says can power your laptop up to 50% in about 30 minutes, you’ll need the 70W option. This adds $20 to the cost.

MacBook Pro

For the most demanding student workloads, you’ll want to look at the MacBook Pro. Our recommendation is to start with the 14-inch model with M5 Pro chip. Skip the nano-texture display for now — it’s a nice addition, but unnecessary for students on a budget.

Do upgrade to the M5 Pro chip, however, or the M5 Max if you know you’ll be doing really heavy work that requires a lot of computing power. Unlike the MacBook Neo and MacBook Air, the MacBook Pro has built-in fans that mean it has a far superior cooling system that is much better equipped for demanding jobs. With that at your disposal, you can pick a beefy chip if you need it.

With the M5 Pro, your choices for memory are 24GB or 48GB. The former should be enough for most, but if you’re unsure, step up to the higher amount. While there are other options, including 36GB, 64GB and 128GB, these require swapping the M5 Pro for an M5 Max and paying a much higher price.

The configuration we’ve picked so far comes with 1TB of storage included, which is enough for most people. That said, anyone working with large photos and videos, high-grade apps or machine-learning models will likely need more space.

Finally, there’s the issue of the charger. The default option is 70W, which isn’t enough for fast charging (the MacBook Pro uses much more power than the MacBook Air, where 70W is enough for fast charging). Seeing as the 96W upgrade costs just $20 more and enables both fast charging (empty to 50% in about 30 minutes) and High Power Mode, we think it’s worth it.

Texas Governor Greg Abbott has paused new data center connections to the state’s grid pending audits on the requirements for new and proposed constructions. The audits will cover the revenue lost from data center tax exemptions, power usage and generation, infrastructure upgrades, water usage, and the impact on the local communities and environment.

Texans have seen their electricity and water bills increase significantly over the past five years. Data from Electric Choice shows the average residential electricity price has risen by over 25%, and data from the Texas Municipal League demonstrates the average residential water bill has risen by over 26%.

But the prices in Texas sit below the national average. So why then are they rising so fast, and what does it mean for other states in the US?

Prices rapidly rising

As new industries and houses are constructed, new connections need to be added. These connections are constructed by power grid operators, with the cost of upgrades generally passed on to consumers through utility transmission fees.

Infrastructural upgrades are also paid for by grid operators, with the costs of construction again passed back down to consumers through their bills.

The rapid increase in data center construction projects has been a particular issue in this regard. As data centers require enormous amounts of electricity, they require far more complex and expensive connections than are required of a typical residential connection.

But alongside the moratorium on new data center construction, Gov. Abbott has required data center projects that pass the states’ audit will be required to pay for their own connections and infrastructure. In a letter to the Public Utility Commission of Texas and the Electric Reliability Council of Texas, Abbot highlighted that 90% of new grid connections are data centers.

Electricity prices are also rising due to an increasingly unpredictable climate. Soaring temperatures place increased demand on electricity grids, especially as cooling systems for homes and businesses are switched on during peak times. The heat also causes electricity infrastructure to fail at a higher rate, causing additional costs as grids are repaired and replaced.

As for water prices, Texas has been subject to a four year drought. Per Washington Post reporting, Texas has been seeking alternative sources of water to extend supply. The downside is that in one such project, the state ended up paying the contractor responsible for a new groundwater collection project an extra 40% on top of the originally proposed $500 million.

The increasingly unpredictable weather is also wreaking havoc on existing infrastructure, especially when there are short periods of torrential rainfall. Sudden downpours can quickly overwhelm water infrastructure, damaging it or washing it away. Water treatment plants can also become overwhelmed and damaged. The cost of repairing and replacing infrastructure, as well as funding the much needed projects to create new water sources, once again gets passed down to consumers.

Couple this with the rapid increase in data center projects, which requires water usage during construction and for cooling, and prices will further increase. Texas currently sits in the number two spot for active data centers, slightly behind Virginia, but the number of planned and approved projects for Texas means the Lone Star state could soon become the number one state for active data centers.

Lessons for the rest of the US

As with all new technology, the pace of regulation falls a few thousand steps behind.

Numerous states have already begun issuing moratoriums on tax exemptions for data centers as the actual loss of revenue far exceeds earlier predictions. In Ohio, the loss of revenue has been $1.6 billion - far higher than the projected $136 million.

The new regulations introduced in Texas requiring data centers to pass the state audit before being hooked up to the grid have presented a second problem. Data centers providing their own on-site power are not subject to new grid connections, and can therefore bypass the audit.

One of the most cost effective means for producing on-site power are gas burning turbine generators. The downside for local residents in the vicinity of these sites is that noise levels have been compared to living near an international airport, and there are under-studied phenomena surrounding the infra-sound produced by these power projects.

There are also the climate implications of these sites. Despite the name, natural gas is a highly polluting fuel source that distributes pollutants both into the local area and the atmosphere, causing damage to local livestock, fauna, and the rest of the world.

• Phishing campaign used fake Teams notifications to route victims to a genuine Microsoft sign-in page
• Rather than stealing passwords, attackers asked victims to approve permissions for an attacker-controlled app, gaining access to mail, files, Teams, SharePoint, OneDrive and calendars without defeating MFA
• Check Point says the technique has been commoditized in 2026 into a rentable service; the practical defense is restricting app consent rather than relying on users to spot a fake

A phishing campaign that ran from late June into July 2026 did something that breaks most of the advice organizations have spent a decade teaching their staff: it sent victims to a real Microsoft login page.

Check Point's email research team, which disclosed the campaign, identified more than 200 phishing emails targeting users across roughly 120 organizations worldwide.

The lure was a fake Microsoft Teams notification with a genuine destination; what actually compromised accounts was not a stolen password but a permissions prompt that the victim clicked through voluntarily.

A sophisticated attack that relied on tricking users into granting permissions

Check Point noted in its brief that what actually compromised the accounts was not a stolen password but a permissions prompt that the victim clicked through voluntarily. This is a reminder of a stark change in attackers' tactics: they have stopped forging Microsoft's front door and started walking through it.

The email appeared to be a Microsoft Planner task-assignment notification. The sender name read "There's New Activity On Team," the subject line claimed that HR had sent three messages via Teams chat, and the body referenced a payroll and benefits update, along with a counter showing four overdue employee tasks.

To someone who works in security, the message had its own telltale signs of being a typical phishing attempt: every link in the email, including both call-to-action buttons, routed through the same redirect. And the visible sender address belonged to the recipient's own organization, meaning the email appeared to have been sent to the same person it came from.

The link opened a real OAuth authorization URL on login.microsoftonline.com, not a look-alike domain. Signing in displayed a permissions prompt asking the user to approve the permissions or accept them on behalf of their organization.

If they did, Microsoft redirected the browser to the redirect address specified in the original request, which in this particular campaign was an AWS API Gateway endpoint under the attackers' control. The authorization code was delivered there, and the attackers exchanged it for access. No password was stolen at any point, and there was no fake page to spot.

This is not unlike how the phishing-as-a-service Kali365 platform compromises Microsoft accounts, but instead of stealing session cookies or OAuth tokens, it opts for a more permanent illicit grant of consent.

This runs counter to the usual security training checklist, which emphasizes adhering to norms rather than going against the grain; users are told to check the URL, look for the padlock, and watch for misspelled domains. None of those measures matter because there is nothing forged to catch. The domain and certificate are Microsoft's, while the sign-in page is the one the user sees every morning, offering a false sense of security to a user not looking for this particular attack vector.

Multi-factor authentication does not help either; it protects the login sequence but not access to the user's data post-login. The attacker never needs the password or the second factor because they walk away with a token granted by the user's valid session, a technique called 'consent phishing'.

There are many ways to prevent this, but the simplest two are asking users to check every single permission/consent screen they click (the phishing attempt still requires users to allow it) and limiting access to permissions for user accounts that applications can request via Microsoft Entra at the system administrator level.

It would be prudent to do the latter at a minimum, even as Check Point notes that the campaign is no longer active because the underlying technique it used is not going anywhere.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1654) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1654) — hint #2 — repeated letters

Quordle today (game #1654) — hint #3 — uncommon letters

Quordle today (game #1654) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1654) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1654) — the answers

The answers to today's Quordle, game #1654, are…

• MOUND
• WRONG
• STOOD
• WEIRD

It has taken me a long time, but I have finally realized that I need to take some games of Quordle more slowly.

Today was a good example of this. With multiple possibilities of a word ending O-U-N-D I had to use the other words to eliminate letters, before MOUND became the only possibility.

Daily Sequence today (game #1654) — the answers

The answers to today's Quordle Daily Sequence, game #1654, are…

• FLUTE
• SMEAR
• LODGE
• DIVER

Quordle answers: The past 20

• Quordle #1653, Tuesday, 4 August: GOOEY, TARDY, HUMAN, CHALK
• Quordle #1652, Monday, 3 August: FUNGI, MUDDY, DEBUT, MANIA
• Quordle #1651, Sunday, 2 August: BOOTH, EASEL, REACH, MAKER
• Quordle #1650, Saturday, 1 August: OMEGA, BIRCH, SMOCK, EERIE
• Quordle #1649, Friday, 31 July: MANIA, SINGE, STOOL, LOFTY
• Quordle #1648, Thursday, 30 July: MODAL, IDLER, CHUMP, LUMPY
• Quordle #1647, Wednesday, 29 July: GAWKY, ALLOY, AUDIT, LATCH
• Quordle #1646, Tuesday, 28 July: SMITE, ROACH, RUDDY, GLOBE
• Quordle #1645, Monday, 27 July: TAFFY, FIGHT, GUILD, WAGER
• Quordle #1644, Sunday, 26 July: STOMP, LIMIT, FUNKY, STEAD
• Quordle #1643, Saturday, 25 July: SALON, SHEEN, BURST, GOURD
• Quordle #1642, Friday, 24 July: DOLLY, EDIFY, LAGER, PRANK
• Quordle #1641, Thursday, 23 July: LADEN, EVICT, WOVEN, SHIRE
• Quordle #1640, Wednesday, 22 July: COYLY, SINGE, AWASH, AWOKE
• Quordle #1639, Tuesday, 21 July: TRUSS, AXIAL, SWINE, THING
• Quordle #1638, Monday, 20 July: ICING, SLICK, GAILY, RISEN
• Quordle #1637, Sunday, 19 July: SPURT, ACRID, THRUM, BLEEP
• Quordle #1636, Saturday, 18 July: KNAVE, TIGHT, BLEAT, CHAOS
• Quordle #1635, Friday, 17 July: CUMIN, PALER, GRASS, INBOX
• Quordle #1634, Thursday, 16 July: IGLOO, PLAIT, YEAST, AROMA

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #885) - hint #1 - today's theme

NYT Strands today (game #885) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• NOON
• BORN
• TRAINS
• PAID
• SORE
• STORE

NYT Strands today (game #885) - hint #3 - spangram letters

NYT Strands today (game #885) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #885) - the answers

The answers to today's Strands, game #885, are…

• IDEA
• THOUGHT
• OPINION
• PLAN
• NOTION
• CONCEPT
• SPANGRAM: BRAINSTORMING

• My rating: Hard
• My score: 1 hint

I love with Strands how you can go from feeling utterly clueless to suddenly clearing the board in 30 seconds flat.

That was my experience today, as I struggled to get going and instead found dozens of non-game words.

A hint word of IDEA opened things up and from there I saw THOUGHT, then worked backward from the letters I-N-G to find the spangram. All in all, a nice little workout for the brain — but far from BRAINSTORMING.

Yesterday's NYT Strands answers (Tuesday, August 4, game #884)

• REFILL
• CONSULT
• IMMUNIZATION
• MEDICINE
• COUNTER
• SPANGRAM: PHARMACY

• New study puts average cybercrime victim losses at $9,468, making a global annual toll at just over $1.24 trillion across 130.9 million victims
• Cybercrime is still massively underreported by both victims and authorities, so official numbers might be 'softer' than the underlying problem
• Some of the countries published limited, if any, financial data regarding cybercrime, making losses an estimate at best

New figures have claimed cybercrime victims lose $9,468 in the average incident, showing the scale of an increasingly global problem.

The report from Comparitech claims 130.9 million people are hit each year, and that the annual global toll comes to just over $1.24 trillion.

A December 2023 study from the company put those figures at $8,069 per victim, 88.5 million people and $714 billion in total losses respectively, highlighting a growing trend that sees a mix of illegal activity moving the needle further.

A growing problem with regional caveats

The United States remains a favorite for cybercriminals, topping the charts with 6.7 million victims losing $138.9 billion, a per-victim loss amount of ~$20,731, more than twice that of the global average.

This is in stark contrast with the next four countries on the list (Spain, France, Sweden and Turkey), all of which offered an average of approximately $10,000 per victim.

Russia, coming in 6th, reports a much larger number of victims than the four countries ahead of it, but offers a much lower per-victim loss estimate of $3,659. Interestingly, the total number of cybercrimes committed in 2025 dropped to 663,000 from 775,000 in 2024, despite an ongoing conflict with Ukraine, which often sees cyberattacks at both the industrial and localized levels by both parties.

However, a weakening economic situation, as well as Russia localizing many of its communication applications and restricting banking, might also mean that Russia's figures also remain inadvertently capped by policy decisions the country has taken.

With 18.8 million victims, India has the highest number of scam victims worldwide, even though its pro-rata number is considerably lower than the mean at ~$835 per victim, which may be attributable to the country's lower GDP per capita.

Interestingly, China, with 1.2 million victims, a fraction of its neighbor, managed to lose approximately $11.5 billion, a pro-rata number of approximately $9583, in line with global estimates by Comparitech and possibly fueled by the country's heavy-handed approach to cybercriminals, which saw it apply increasing amounts of pressure on neighboring Myanmar that culminated in it convicting and executing scammers arrested across the border.

Comparitech's $1.24 trillion figure is conservative, and the study acknowledges this, noting that it covers only victim losses. It notes that experts anticipated the global cost reaching $10.5 trillion in 2025 and calls its own $1.24 trillion a drop in the ocean by comparison.

That $10.5 trillion comes from Cybersecurity Ventures' 2016 report, which estimated $3 trillion for 2015 and projected it forward at an assumed 15 percent compound annual growth rate, describing the result as the greatest transfer of economic wealth in history.

At a time when AI automation offers better security, often allowing users to screen calls or leverage security applications that adapt on a case-by-case basis, the inverse is also true with hackers and cybercriminals considerably upping their game when it comes to bypassing security altogether; Comparitech's figures provide a sobering reality: if the industry estimates it has hold and are compared to the GDP of entire countries, the firm says it would rank 20th in the world in those terms alone.

• The latest Steam survey shows GPUs with 16GB are the most popular
• They're on 25.9% and have overtaken 8GB GPUs which are just behind on 25.32%
• There's been quite a shift towards 16GB boards over the past year, but with news of more price hikes incoming, upgrading to this loadout could be a painful process for gamers

Graphics cards with 16GB of memory are the most popular GPU among Steam gamers now, although the way GPU prices are going means that people aiming for a board packing plenty of video RAM (VRAM) are looking at a rather depressing future.

TweakTown spotted that the latest Steam hardware survey for July shows that 16GB of VRAM is the most prevalent memory configuration at 25.9%, up 1.4% over last month. That means it just dethrones the previous top of the VRAM table, which was 8GB, a loadout that slipped slightly from last month down to 25.32%.

There's not much in it, of course, but nonetheless, it's a telling stat (bearing in mind the usual caveats about variance in Valve's hardware report based on how the survey is distributed).

Of course, the majority of Steam gamers are still running with less than 16GB, and only 36% have a GPU with 16GB or more. So, almost two-thirds are running less than 16GB, and just under half (47%) have a graphics card with 8GB or less.

But it's a hefty rise in the count of 16GB GPUs when you consider that less than a year ago, in August 2025, just 6.8% of Steam gamers had boards with that VRAM loadout (based on a Notebookcheck report from the time). Compared to July 2026, that's nearly quadruple the number of 16GB-equipped rigs, with a close to 20% increase — pretty eye-opening.

Analysis: 16GB ambitions and the ever-worsening RAM crisis

It seems that, at least based on Steam's stats, RTX 5060 Ti 16GB and RX 9060 XT 16GB graphics cards (and 9070 models) must have been selling well — and of course higher-end Nvidia cards. The RTX 5070 is doing well for itself, too, and is now in third position in Steam's GPU ranking (although that's a 12GB offering and it should really be 16GB).

The ranks of the 16GB GPUs on Steam will also be bolstered by older models, of course, from past generations. Also, the visibility of AMD Radeon graphics cards with 16GB of VRAM was improved by Valve earlier this year, when an issue was fixed whereby these cards were misreported (not detected and lumped in a generic Radeon category), so that will have boosted numbers too.

At any rate, the fact that more gamers are looking at future-proofing their GPU purchases only makes sense, as 8GB in particular is looking too lean at this point. But there's a problem with GPUs that have heavier VRAM configurations, and this is, of course, that the memory crisis hits these models hardest.

We've already seen that GPU price hikes are making themselves felt, and just a couple of weeks back, Nvidia seemingly told its card-making partners that the price it charges for memory supplied with its graphics chips is going up (for both GDDR6 and GDDR7). A fresh report from Tom's Hardware also talks about price hikes for RTX 5000 models in South Korea beginning this month, driven not just by the increased cost of video RAM, but also the GPU chips themselves.

We're told the upshot is that Nvidia's Blackwell GPUs could see price increases of up to 30% in the country, and similar hikes may happen elsewhere. AMD price hikes are expected for its Radeon line-up, too, and Team Red has already warned us that the second half of 2026 is going to be a tough one for PC gamers.

With those gamers craving 16GB of video RAM more often, and prices heading inexorably upwards — and the memory crisis expected to worsen as this year rolls on, with the misery to continue into 2027 by all accounts — it's a gloomy picture for beefier graphics card upgrades.

• Cheap smart glasses are selling out as people look for Meta Ray-Ban alternatives
• More camera glasses are leading to more privacy concerns for many
• I wouldn't buy them for plenty of other reasons

If you want a pair of smart glasses, you’re spoiled for choice in terms of what they can do technologically, and over time we’ve seen more and more budget options appear. These cheaper models are the first step in making emerging gadgets more accessible, but for smart specs there’s a fear they might simply exacerbate the growing concerns over the tech.

Australian discount store Kmart recently went viral after the AU$89 Anko glasses it was selling sold out entirely (via The Guardian). In the US and UK, you don’t have to look far to find equally affordable camera glasses available through reputable digital marketplaces such as Amazon.

Given the proven popularity of Meta’s Ray-Ban and Oakley specs, it’s no surprise the market would see an influx of smart glasses, especially cheap pairs that aim to mimic much more expensive rivals while keeping costs low — typically by downgrading their technological capabilities and not partnering with premium design brands.

However, cheap smart glasses aren’t as universally celebrated as cheap TVs or affordable smartphones — scrolling through online forums discussing this news, the replies aren’t kind about smart glasses, discussing the pitfalls of smart glasses in general and more affordable options specifically.

The most prominent concern is that cheap camera glasses expand the range of people with the technology. More people with these glasses means more people possibly recording people in public without their knowledge.

There are also fears that cheap camera glasses might not come with the same sophisticated tamper protection glasses from more recognizable brands boast. Either through tape coverings or minor electrical modifications, folks could disable the camera light and use the specs even more covertly than they otherwise would — they’ve tried the same with Meta specs, but Meta has patched out these workarounds so far.

Privacy and other problems

Beyond the impact on the general public, cheap smart glasses users might want to consider the privacy implications of wearing cameras from unknown brands.

We’ve seen that even super well-known brands like Meta aren’t perfect — for example, there are reports that contractors could see videos (including intimate or otherwise private content) taken using the glasses if it involved the AI in some way — so why should we expect completely unknown brands with nothing to lose to be any better with privacy?

In fact, considering their lack of notoriety makes them less likely to get investigated in the way Meta was by journalists who uncovered the sharing of videos with contractors. The ease with which tiny brands can dissolve and pop back up under different names, I for one would be a lot less trusting of what they do with my data and of their phone apps.

Of course, many lesser-known brands behave responsibly, but when there’s so much room for things to go wrong, for private information or video to get leaked, I just have this extra layer of paranoia I can’t shake.

Even ignoring my personal privacy concerns, as someone who has tested countless smart glasses at this point, I’ve found that better-known brands are simply better at making hardware and software.

I’ve worn so many uncomfortable specs with tinny audio, awful camera quality, terrible AI, and apps that are worse than useless. They’re sluggish. They’re ugly. They’re not worth even a budget price.

Just don’t buy them.

If you do want smart specs, save up for something proper — it doesn’t have to be from Meta, but I’d recommend choosing a brand with plenty of solid independent reviews. While I’m using them less for reasons better explained by other writing, I have gone weeks on end wearing a good pair of smart glasses thanks to comfy yet fashionable design and solid tech. Whereas the cheap (and terrible) glasses I’ve tried I’ve wanted to rip off my face within hours.

You get what you pay for.

• Bitdefender reported Roblox players lured by a fake “undetected” Xeno Executor mod spreading malware
• Infection chain delivers a Java‑based RAT and infostealer stealing browser data, online accounts, payment info, and crypto wallets
• Malware also enables surveillance and remote control; campaign peaked in March 2026 and remains active against Roblox’s 82M players

Cybercriminals are targeting Roblox players with an infostealer and a Remote Access Trojan (RAT) malware that grants them full control over compromised computers, experts have warned.

Roblox is an online gaming platform, virtual universe, and game creation system where users play millions of games and user-generated mods. Among the mods is Xeno Executor, a utility that allows players to run scripts that automate certain actions or run custom code. Some players use Xeno Executor to run cheats, too.

Since it’s an unofficial script, Roblox does not allow it and blocks it whenever a new version is released. Now, security researchers Bitdefender have reported finding an “undetected” version being promoted on various gaming forums, Discord communities, and similar.

CornFlake and CocoShell

This version is advertised as “invisible” to Roblox’s anti-cheat systems, but in reality, all it does is trigger an infection chain that ends in a Java-based RAT and information stealer.

The malware grabs browser data such as passwords and cookies from some of the most popular browsers (Chrome, Edge, Brave, Opera, Vivaldi), as well as online accounts and payment data (Discord, Roblox, Minecraft, Microsoft Store tokens, and more).

It also steals cryptocurrency wallet data, particularly targeting the Exodus Wallet.

As for surveillance, it can log keys, track mouse movements, grab screenshots, stream whatever is on the desktop, and access the webcam. The crooks are also granted file upload and download, PowerShell command execution, and more.

The campaign was kicked off at the start of the year, reaching its peak in March, it was said. It has now stabilized and is still going relatively strong.

We don’t know exactly how many players fell victim to this campaign, but Roblox is an incredibly popular platform, so it is possible the campaign was rather successful, too.

According to Activeplayer, Roblox currently has more than 82 million active players.

• A controversy has erupted over a background process in Windows 11
• It turns out that process isn't new, and neither is it a surprise introduction from Microsoft that 'does nothing for you' except pipe telemetry back
• A Microsoft exec clarified the purpose of the process, and that it doesn't send any data back unless you want to do that

There's been some more controversy over privacy and telemetry in Windows 11, and while this particular alarm bell turned out to be falsely rung in the end, it does point to wider issues around the mistrust of Microsoft in general.

As Windows Latest reports, this story starts with a post on X from a user called Xilly who drew attention to an apparent new process in Windows 11 called 'Windows Health and Optimized Experiences'.

However, as Windows Latest – and others on X – observe, this isn't a new background service in Microsoft's OS at all. In fact, it has been kicking around in Windows 11 for over a year now (since May 2025).

The additional nuance, though, is that this process was only introduced in testing in the Canary channel back in May of last year, and it seems to have only just come through to Windows 11 release builds now. That's as far as I can tell, and this is what Xilly points out on X.

So, it is in fact relatively new to release builds – and presumably rolling out now – but nonetheless the service itself has been known about for a long time. The real problem here is the way Xilly frames it as monitoring your PC for certain metrics related to laptop battery management, and that: "If you are on a desktop gaming PC it does nothing for you except run in the background" (while eating resources and engaging in telemetry, "sending data to Microsoft every 15 minutes").

Xilly's post prompted a response from Scott Hanselman, who is a VP and member of technical staff at Microsoft as well as a prominent voice in the Fix Windows 11 campaign.

Hanselman made it clear that the process is not new, as already discussed, and that it's for system diagnostics: "When Windows detects slow or sluggish behavior, it can record targeted performance traces locally under %SystemRoot%\Temp\DiagOutputDir\Whesvc that can be filed with Feedback Hub. It's not laptop specific."

So, this is a process that detects poor performance and files diagnostics locally, which can then be fed back to Microsoft if the user wishes.

Hanselman also highlights the dramatic approach Xilly took ("saying things in all capitals"), and Windows Latest further points out that the X user runs a business for optimizing gaming PCs, and pushes that service in a reply to their own original post.

Analysis: trust, telemetry, and what Microsoft needs to do

To summarize, then, Xilly's description of the service is incorrect, and while this background process does collect diagnostic data on how Windows 11 is running, it's written locally (with a negligible performance impact) and only sent to Microsoft if you actively submit feedback from your PC (via the Feedback Hub). The key phrasing in Hanselman's response is that the relevant data "can" be filed with Microsoft (not "will" be filed, as in it'll automatically happen).

Xilly also suggested that this was something Microsoft just sneaked in (hence the 'all caps' warning), when in fact it has been documented in preview builds before, and as Windows Latest notes, it's part of the Adaptive Energy Saver feature for helping to extend battery life.

The long and short is that there's nothing to worry about here, but what this episode serves as is a reminder of how Microsoft is short on trust when it comes to issues around privacy.

It's clear how quickly some Windows 11 users were to believe Xilly's accusation on X and other social media such as Reddit. For example, in this Reddit thread, despite one poster pointing out the reality of the situation in a nutshell (pretty much), there's a notable amount of complaining about why this process is sending data to Microsoft (which it isn't), or broader complaints along the lines of: "If you choose to install a spyware OS, expect to be spied on."

In fact, the most upvoted comment is: "Honestly, if any big tech giant wants to spy on you, they don't need a separate service. The MSA/online account [Microsoft account] is more than enough."

There are many people out there online who believe that, one way or another, Microsoft is spying on them to quite an extent with Windows. That stems from a broader level of distrust that's been stoked by the historical level of telemetry in Microsoft's desktop operating system since Windows 10 emerged, with reports periodically popping up to highlight these issues in that OS and Windows 11. Add to that all of Microsoft's promotional activity (and some outright adverts), as well as the likes of the Recall feature helping to pile on the skepticism (Microsoft handled that one really badly), and you can see why there's a problem with doubters here.

I keep saying that one thing Microsoft isn't properly addressing with the fix Windows 11 campaign is the level of telemetry performed by the OS, and I think it's high time that the company did this, and introduced a new choice for a zero level of telemetry (save for baseline security-related aspects). That option is lacking on Windows 11 Home, and it should be present and easily accessible, as this would go a long way to help cure some of the ill feeling out there around Windows 11 'spying' on people.

Multiple studies have found that the average person has over 150 passwords. As a password security expert, I regularly recommend that every single password people use should be both unique and strong - but this adds the problem of being able to remember each one, or store them securely.

Password managers are designed for this exact reason. They store your passwords in encrypted vaults and autofill your credentials as and when you need them. For this very reason, Keeper is one of our most highly rated password managers.

Right now, Keeper has cut prices on its personal, family, and business starter plans by up to 50%, providing an affordable password management solution that can store and generate your passwords, while also providing convenient features for securely sharing regularly used household or business passwords.

Why we recommend Keeper

In our Keeper review, we praised the zero knowledge architecture and device level encryption that helps keep the contents of your personal vault hidden from hackers.

Keeper also scored great marks in our usability and convenience testing. Rather than having to enter your master password each time you need to fill in your credentials, Keeper uses biometric security to access your vault. Biometric security uses a facial scan or fingerprint to verify that its actually you accessing your vault. It's also phishing resistant.

Four households, the Family Plan includes five private vaults, allowing you to quickly share Wi-Fi or streaming passwords using Keeper's shared vaults.

The Business Starter plan covers 5 users, covering an unlimited devices, shared team folders, user activity reporting for IT admins, and a free Family Plan for every team member.

These discounts apply to the first year only, so the value is highest for new customers or anyone switching from a monthly plan. After that, pricing goes back to standard rates.

• Palo Alto Networks’ Unit 42 detailed three Google passkey exploits
• Attacks require prior malware infection; methods ranged from impersonating victims to stealing the master secret protecting synced passkeys
• Google implemented fixes after disclosure, with some services (e.g., eBay) patching vulnerabilities directly

Security researchers from Palo Alto Networks’ Unit 42 have found three ways to exploit Google’s passkey system and log into people’s PIN- or biometrics-protected accounts.

They named these ways ‘Pass-ta-key’, ‘Silver Pass-ta-key’, and ‘Golden Pass-ta-key’, each being progressively more dangerous than the previous one.

While it sounds mighty dangerous, there are major caveats to the exploit, and some of the holes have been plugged already.

Trusting the wrong device

The biggest caveat is that the victim’s device needs to be infected with malware beforehand. Malware can do all sorts of things, from stealing session cookies to exfiltrating sensitive data, so if a device is tainted with malware, it’s already in trouble.

Still, Unit 42’s findings were important enough to warrant a fix from Google.

In the first technique, the attackers pretend to be the victim. By using malware, they can “ask” Google to log into a passkey-protected account as if it was the victim themselves. Usually, the service being logged into would require a PIN or a fingerprint to confirm the authenticity of the request, but in this scenario, that wasn’t the case.

The method doesn’t work everywhere, though. Unit 42 could not replicate the attack on GitHub, but they succeeded on eBay. The latter later fixed the problem.

In the second attack, Unit 42 managed to make Google “trust” the threat actor’s device, meaning the victim’s computer was no longer necessary.

In the third attack, the researchers managed to steal the “master key”.

Google Password Manager syncs the passkeys between devices, and to do that, it uses a master secret that protects all of the synced passkeys. The researchers found that, under certain circumstances, malware can grab this master secret while Chrome is temporarily using it, unlocking all of the synced passkeys, copying them to another computer, and being able to use them at a later date.

The researchers disclosed their findings with Google before publication, and some fixes were already implemented. Google is yet to comment on the findings and confirm that all of the flaws were addressed.

Via BleepingComputer

As AI becomes a greater and more important presence in our everyday lives, the way we interact with the "traditional" internet is changing.

For so long the main way to access the internet, the web browser is now having to rethink how to appeal to an audience which often seeks AI-first interaction - raising new challenges for developers to create the best and most interactive experience.

We spoke to Ajit Varma, Head of Firefox at Mozilla, to find out more.

• The web has always been built on the principles of openness and interoperability, but today's internet is increasingly shaped by a handful of dominant platforms and AI-powered services. What does the 'open web' mean in 2026, and why does it still matter?

The open web matters more today than it has in years because AI is changing how people experience the internet. As a small number of platforms become the gateway to search, content and AI-powered services, it's becoming easier for a handful of companies to shape what people see and how they interact online.

That's why the principles of the open web still matter. Common standards mean developers can build without asking permission from a dominant platform, and users can choose how they access the web rather than being locked into a single ecosystem. Those principles have driven innovation for decades, and they're just as important as AI reshapes the internet.

The challenge now isn't simply keeping the web open as it exists today. It's making sure openness evolves alongside AI, so the next generation of the internet remains competitive, interoperable and accessible to everyone

• AI is changing the way people discover information and interact with the internet. How do you see browsers evolving over the next five years, and what role should they play in helping users navigate an increasingly AI-driven web while maintaining trust and choice?

Over the next five years, you’ll start to see more divergences in how browsers treat AI. Many companies will use the browser to try and push a specific AI agenda but at Firefox we’re focused on how AI can make the tasks a user wants to do in a browser better. This includes things like a personal agent that can help a user accomplish tasks, navigating the web through voice, making the web more enjoyable, and creating new vibe-coded extensions and mini-apps.

We’ll do all this in a way that is user centric. The browser should adapt to the user, rather than the other way round. Some people will want AI integrated into their everyday browsing, while others will prefer to use it for specific tasks. Maintaining trust means supporting those preferences and letting people decide how much they use AI.

Users should be able to choose any model they want including open and local models. The important thing is preserving that flexibility, so people can browse, search and get things done in a way that feels natural to them.

• Privacy has long been a core part of Mozilla's mission, but consumers also expect convenience and highly personalised online experiences. How do you strike the right balance between protecting users' privacy and delivering the features people now expect from modern web experiences?

For me, striking the right balance starts with recognising that every user has different expectations of their browser. While context can make online experiences more useful and personalised, people should be able to understand how their data is used and decide what they are comfortable sharing. By giving users meaningful control over the features they adopt, Firefox can deliver modern experiences while continuing to protect their privacy.

This has guided our phased approach to AI, beginning with practical features such as summarisation, translation, tab organisation and optional AI chat integrations. Before introducing more advanced AI experiences such as Smart Window, we launched AI Controls so people can manage individual features or switch them off altogether.

Firefox is also model-agnostic, so users can choose or switch providers, use local models, or opt out entirely. Even though only a small minority of users disable AI features, people regularly tell us they value knowing the controls are there. Privacy and convenience can coexist when people are able to set the terms of the experience.

• There's growing concern that the future of the web could become fragmented between closed AI ecosystems, proprietary platforms and app-based experiences. What do you see as the biggest threats to the open web, and what gives you confidence that it can continue to thrive?

The biggest risk isn't AI itself, it's concentration. If the same companies control the AI models, the interface people use to access them and the browser they interact through, users lose visibility, choice and ultimately agency. That's a much bigger shift than simply moving from one technology generation to another.

What's encouraging is that the issue is becoming harder to ignore. Developers want open standards. Regulators are paying closer attention to competition. Users are asking tougher questions about transparency and control. The web has always evolved through periods of disruption, but it has remained resilient because it's built on interoperability rather than permission. AI can strengthen that model rather than replacing it with a handful of closed ecosystems. The future doesn't have to be a choice between innovation and openness. We should expect both.

• Developers have always been central to Mozilla's community. As AI transforms software development and web creation, how do you think the relationship between developers, browsers and the open web will change over the coming years?

AI is making it dramatically easier to build software, which means we're going to see more developers – and more people who aren't traditional developers – creating for the web. That's a huge opportunity, but only if they can build on an open platform rather than for a handful of closed ecosystems.

That's why the browser becomes even more important. It's no longer just where websites are displayed – it's becoming the layer where people interact with AI to search, create, organise information and complete tasks. As that layer becomes more powerful, it has to remain open, interoperable and centred around user choice.

For developers, that means being able to build for the web, rather than for whichever company happens to control the dominant model or platform. That's always been one of the web's greatest strengths, and it's something we shouldn't lose as AI reshapes how software is built and experienced.

• If you look ahead to the end of this decade, what do you hope people will say about the state of the web? What would success look like for Mozilla's vision of an open, healthy internet?

Success, for me, is a web that's become more useful through AI without becoming less open. Technology should expand what's possible, not narrow the ways people can access information, build new ideas or participate online.

Innovation should continue to come from everywhere, not just a handful of dominant platforms. The web has always been at its best when anyone with a good idea can build something that reaches millions of people. That only happens when developers have open standards to build on and users aren't locked into a single ecosystem.

The web should still be the best place to build, discover and innovate because it remains accessible to everyone. If AI has expanded participation rather than concentrated power, we'll be heading in the right direction.

• Mozilla is competing in a browser market dominated by much larger technology companies. How do you differentiate Firefox, and why do you believe there's still a commercial and societal case for an independent browser?

We differentiate through independence, choice and accountability. Most browsers are tied to larger technology ecosystems spanning across multiple systems, search, advertising and AI.

Instead, Firefox is powered by Gecko, the only remaining independent browser engine, which gives us the freedom to make product decisions around what benefits users. It ensures that Mozilla is not only advocating for these principles but actively building the underlying infrastructure that makes them possible.

That independence is commercially relevant because there’s such a clear demand for genuine choice. Firefox has been selected through EU browser choice screens more than six million times in two years and those users are five times more likely to remain with Firefox than people who find it organically.

Societally, independent engines prevent one company’s technical and commercial priorities from being the default for the entire web. They also preserve competition, interoperability and the ability to build around different values.

• As regulators around the world seek to promote competition in digital markets, are we at a turning point for the open web, or is there still a risk that power becomes even more concentrated through AI?

There are certainly some encouraging signs that regulation can restore meaningful choice. The impact of browser choice screens in Europe shows that people choose alternatives when they are presented fairly and without being steered towards a default.

However, AI is creating a new concentration risk. If the same small group of companies control the operating system, browser, search engine and AI model, it becomes much easier for them to shape how people access information and which services they encounter.

Regulation needs to keep pace not only with how AI is developed, but with how it's distributed and embedded into everyday products. However, regulation can't do this alone. Interoperability, genuine defaults and strong technical competition will matter just as much.

• Trust has become a key differentiator in technology. How can browser makers earn and maintain users' trust as AI assistants become embedded in everyday web browsing?

Trust starts with being clear about what the technology is doing. AI should be optional, transparent and designed so users can understand what information it can access, how it’s being used and who is acting on their behalf.

That’s the principle behind Firefox’s AI controls. AI features are optional and can be managed individually, while a single setting allows users to block current and future generative AI features. We also use on-device models for features such as Link Previews and Smart Tab Groups, allowing people to receive AI assistance without any data leaving their device.

Ultimately, trust isn't earned through a single feature. It's earned by being transparent about how AI works and consistently respecting the decisions people make.

• Microsoft reports Russian APT29 (Midnight Blizzard) hijacking captive portals in hotels and conference centers
• Victims redirected to fake Microsoft 365 logins or bogus update pages, spreading CornFlake and CocoShell malware
• CornFlake steals files, credentials, and device data; CocoShell targets browser cookies, passwords, and Microsoft tokens

Threat actors are taking over Wi-Fi networks in hotels and conference centers and using the log-in portals to steal credentials and deploy information-stealing malware, experts have claimed.

Researchers from Microsoft have published a new report outlining how they spotted Russian state-sponsored actors, known as Midnight Blizzard or APT29, attacking captive portal equipment - networking hardware and software that manages the login page users see before accessing public Wi-Fi.

When connecting to a hotel network, users are often redirected to a page where they must enter their room number, accept the terms of service, and click “Connect” - that redirection is handled by the captive portal.

CornFlake and CocoShell

Microsoft did not explain exactly how this gear is attacked. However, when users try to log in on compromised networks, they may be redirected to a fake Microsoft 365 login portal that steals their credentials.

They may also be redirected to device code phishing pages abusing Microsoft Entra ID authentication flows. Finally, the researchers also saw the captive portals being used to display fake browser and OS update pages that trick victims into downloading infostealers.

So far, MIcrosoft found two malware variants being distributed: CornFlake, and CocoShell.

CornFlake acts as an infostealer capable of grabbing keystrokes and clipboard, running remote shell access, grabbing screenshots, using the microphone and the webcam, stealing browser credentials and cookies, exfiltrating files, and more. It presents itself as a “Cloud Sync Service” while using multiple persistence mechanisms.

CocoShell, on the other hand, is an in-memory PowerShell credential stealer targeting browser cookies, saved passwords, Microsoft 365 and Azure AD tokens, and Wi-Fi credentials.

APT29 is one of the most documented state-sponsored threat actors out there. It’s been active for years and is well-known for its links to Russia’s Foreign Intelligence Service and notable attacks on high-ranking western targets, such as US and German Government officials, as well as SolarWinds and Microsoft.

• Bynario disclosed CVE‑2026‑43760, a macOS RCE flaw allowing root file creation via legacy VNC password option
• Apple patched it July 27, 2026 in macOS Tahoe 26.6 and Sonoma 14.8.8; unpatched users should disable Screen Sharing/Remote Management or the legacy VNC setting
• Reporting was delayed as Apple limited submissions due to AI‑generated bug report overload, but the company reached out directly to fix this issue

Apple has fixed a high-severity vulnerability that allowed threat actors to execute malicious code remotely (RCE), as root, on certain macOS devices - and would have probably fixed the issue even sooner; had it not been flooded with AI slop vulnerability reports.

Security researchers Bynario published an in-depth report discussing finding an RCE flaw on macOS 26.5.2 devices running on Apple Silicon M4 and M5 systems, with System Integrity Protection (SIP) enabled.

According to Bynario, the vulnerability affects Mac devices with Screen Sharing or Remote Management enabled, and with the legacy "VNC viewers may control screen with password" option turned on. For those devices, should a threat actor obtain the VNC password and authenticate to the Mac (no macOS account compromise is required, only the VNC password), they would be able to perform file-transfer operations, with root permissions, due to a logic flaw.

Drowning in the AI flood

The attacker would then be able to create new files owned by root anywhere the system allows.

In the report, the researchers demonstrated creating a valid file inside /private/etc/sudoers.d, granting passwordless sudo privileges, and once that policy was in place, they were able to run commands as root.

In a separate report, the researchers said Apple was forced to limit the number of active bug reports individual researchers can keep open at one time, due to its security teams being flooded with AI slop reports.

Since they already hit that threshold by submitting more than 50 bugs in three weeks, the researchers were unable to report this RCE flaw sooner. However, they explained that Apple reached out to Bynario directly to review, and later patch, the flaw.

The bug is now tracked as CVE-2026-43760 and was given a severity score of 8.6/10 (high).

Apple released the updates on July 27, 2026, addressing the bug on macOS Tahoe 26.6 and macOS Sonoma 14.8.8.

Those who cannot patch should disable the legacy "VNC viewers may control screen with password" option or disable Screen Sharing and Remote Management entirely.