• Nvidia's RTX 5090 is now over $9,000 in the US
• A new rumor suggests that RTX 6000 gaming GPUs are coming in 2027, maybe in the first half of the year
• If true, the price tag that's attached to the RTX 6090 will likely be colossal, and lower-tier GPUs could be pricey too

Nvidia's RTX 5090 flagship has hit new heights in terms of ridiculous asking prices, just as a new rumor suggests that RTX 6000 (Rubin) GPUs are coming in 2027 — earlier than anticipated, and to say the price of those next-gen offerings is a worry given the current climate is a huge understatement.

A Redditor pointed out the current state of RTX 5090 prices, which are close to commanding $10,000 in the US for some models. Notably, the Asus ROG Astral RTX 5090 will set you back a princely $9,659 on Newegg US, although that's not sold directly by the retailer.

Indeed, none of the big retailers have any stock of the RTX 5090 anymore, and the only graphics cards you can buy are from third-party marketplace sellers, often shipping from Asia (that ROG Astral GPU comes from Hong Kong).

You can find more expensive RTX 5090s than that if you want to get the gold-plated version (Dhahab Edition) of the ROG Astral, which is now $11,999. The very cheapest RTX 5090 that I could find at the time of writing is an MSI Ventus model that's priced at $6,549 on Newegg.

What about outside of the US? Price inflation is rampant in other countries too. If we take the UK as an example, you can pick up an RTX 5090 for around £4,500 on Overclockers UK, which is still an eye-watering asking price. (And those are the cheapest GPUs — they go up in price from there to £6,600 for the aforementioned Asus ROG Astral RTX 5090).

It's an alarming situation, and one that heaps worries on top of a new rumor about the RTX 6000 launch as aired by Moore's Law is Dead (MLID) on YouTube (via TweakTown).

Previous rumors have contended that Nvidia's looking at 2028 for the arrival of its next-gen GeForce graphics cards, but a source at the firm told MLID that this is incorrect, and Team Green is aiming for a 2027 launch. Moreover, the current plan is still to get the RTX 6000 ball rolling for PC gamers in the first half of next year, meaning within the next nine months.

There's an obvious sticking point here, though: if the RTX 6000 generation is this close, how come we haven't had much in the way of leaks yet, and nothing of any real substance? The source claims that this is due to Nvidia's management successfully clamping down on leaks with the next-gen products.

The first offering will presumably be the RTX 6090 (or maybe an RTX 6080 as well), and it's going to have some kind of interesting spin on the design — though we aren't told what. It could have beefed up hardware to better cope with running DLSS 5, perhaps, as that would make sense — something to help deal with the performance hit of neural rendering would clearly be very welcome.

Analysis: house deposit or GPU?

There are obvious problems with a possible RTX 6000 launch next year, if we take this rumor at face value. As noted, the RTX 5090 is now being sold for beyond ridiculous prices — and so how much is an RTX 6090 going to run? The fiscal equivalent of an ultramarathon, presumably, and with AI demand likely coming into play with this GPU, the next-gen flagship could be 'unobtainium,' as the disgruntled gamers out there are already predicting.

When you consider that the RAM crisis is going to get worse next year, going by the more recent forecasts from analysts and industry insiders, video RAM is going to be more problematic — and how much of the stuff will be on an RTX 6090? — it all adds up to a frightening prospect for an MSRP. And the likely reality is that the price to actually buy the next-gen Rubin gaming flagship will blow well past that towering recommended cost. (The RTX 6080 won't likely be much different, either.)

For all these reasons, I find it difficult to believe that Nvidia will go ahead and launch the RTX 6000 series next year. Surely it makes sense to wait longer, although what Team Green may know is that 2028 isn't going to be any better for RAM price inflation, and so perhaps that's why next year is greenlit for next-gen GeForce graphics cards to arrive. It's a sobering thought. As one Redditor observed: "Can't wait to decide if I want a down payment on a house or an Nvidia GPU."

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #927) - hint #1 - today's theme

NYT Strands today (game #927) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• BRING
• GIFT
• HALF
• STING
• BIRTH
• STIR

NYT Strands today (game #927) - hint #3 - spangram letters

NYT Strands today (game #927) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #927) - the answers

The answers to today's Strands, game #927, are…

• JAZZY
• VIVID
• BRIGHT
• FLASHY
• STRIKING
• VIBRANT
• SPANGRAM: EYECATCHING

• My rating: Hard
• My score: 1 hint

My first thoughts about today’s theme were obvious ones like conspicuous, but surely this clue couldn’t be so blatant — especially as there was no letter P on the entire board.

There were, though, two letter Zs, so I managed to get JAZZY immediately, followed by VIVID and BRIGHT — the theme nailed down to describing the loud and garish. I was able to make some progress, but still needed a hint to get FLASHY.

I kicked myself that I’d missed the spangram EYECATCHING, as EYE was staring at me in my favorite starting position in the top left-hand corner.

I ended happy to have completed a tricky game, but annoyed that I’d missed a golden, flickering neon sign of an opportunity for a spangram-first. Congratulations if you spotted it.

Yesterday's NYT Strands answers (Tuesday, September 15, game #926)

• JOIST
• BOLT
• HINGE
• NAIL
• KNOB
• BRACKET
• ANCHOR
• SCREW
• SPANGRAM: HARDWARE

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1696) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1696) — hint #2 — repeated letters

Quordle today (game #1696) — hint #3 — uncommon letters

Quordle today (game #1696) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1696) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1696) — the answers

The answers to today's Quordle, game #1696, are…

• SPEAR
• PRICE
• BLUNT
• FISHY

My mistake today was guessing the words in the wrong order.

Following a hunch, I incorrectly guessed “saver” when there were far more gettable quadrants that would not have left me in a situation where I had just one guess to get the final word.

Fortunately I scraped through.

Daily Sequence today (game #1696) — the answers

The answers to today's Quordle Daily Sequence, game #1696, are…

• CRANK
• GENIE
• TORCH
• REMIT

Quordle answers: The past 20

• Quordle #1695, Tuesday, 15 September: SHUSH, LITHE, DELTA, BUGLE
• Quordle #1694, Monday, 14 September: ZEBRA, LEGAL, RATIO, TROLL
• Quordle #1693, Sunday, 13 September: LUCID, SPRAY, MANGE, EMAIL
• Quordle #1692, Saturday, 12 September: SUPER, BRUSH, RESET, SOWER
• Quordle #1691, Friday, 11 September: PLUSH, PAINT, RIVAL, AFOUL
• Quordle #1690, Thursday, 10 September: AGENT, EXILE, TITAN, PUREE
• Quordle #1689, Wednesday, 9 September: HAPPY, GONER, SMACK, MOTIF
• Quordle #1688, Tuesday, 8 September: FLUNG, DIARY, HALVE, BERTH
• Quordle #1687, Monday, 7 September: VISIT, CLANK, FEVER, OCEAN
• Quordle #1686, Sunday, 6 September: PILOT, HONOR, BOWEL, TAUNT
• Quordle #1685, Saturday, 5 September: GNASH, GEEKY, WHELP, PUTTY
• Quordle #1684, Friday, 4 September: QUICK, BEEFY, TRUCK, SNAIL
• Quordle #1683, Thursday, 3 September: SIGMA, ESSAY, MERRY, LLAMA
• Quordle #1682, Wednesday, 2 September: INCUR, FELLA, TITAN, FROZE
• Quordle #1681, Tuesday, 1 September: NASAL, ROUTE, ANKLE, MIGHT
• Quordle #1680, Monday, 31 August: ALIVE, LOUSE, ABOVE, MOSSY
• Quordle #1679, Sunday, 30 August: USING, SORRY, FILET, PIPER
• Quordle #1678, Saturday, 29 August: OVINE, ALLOY, VOICE, CARVE
• Quordle #1677, Friday, 28 August: WAIST, EDICT, BONUS, DEUCE
• Quordle #1676, Thursday, 27 August: SHEEN, TRICE, WAGON, BEVEL

• China’s state security minister Chen Yixin urged global AI guardrails, calling it a new arms race
• He outlined five risks: ideological manipulation, infrastructure attacks, data leaks, development gaps, and espionage
• US officials likewise warn against losing AI dominance to China, intensifying geopolitical rivalry

China’s Minister of State Security has called for global regulation and guardrails on Artificial Intelligence (AI), as the nascent technology turns into a “new arena for strategic rivalry among major powers”. In other words, the AI race is the new arms race and humanity needs rules before it spirals out of control.

Chen Yixin made the claims in a new article on China Cyberspace, a journal run by internet watchdog body the Cyberspace Administration of China.

In the article, Chen highlighted five key risks of AI development:

1. Ideological security risk
2. Critical information infrastructure risk
3. Data leaks risk
4. Development gap risk
5. Espionage risk

Ideological security risk

Artificial Intelligence could be “leveraged by hostile forces” to create fake news and other harmful information, systematically creating discontent and dividing the population, Chen said.

Discussing risks to critical information infrastructure, he said that as models advance, the barrier to entry lowers, making disruptive cyberattacks quicker and easier to pull off.

“Foreign intelligence agencies are heavily exploiting smart web crawlers, data mining and profiling technologies to harvest sensitive information, including critical state data, business secrets, and personal information,” he said.

He also warned that people are recklessly sharing sensitive data with foreign AI tools, which could result in catastrophic data leaks. Apparently, open source agents like OpenClaw often come with vulnerabilities that could result in remotely-triggered data spills.

When it comes to the development gap risk, Yixin warned that a handful of major players are severing the global AI supply chain and creating a monopoly of closed-source ecosystems. Finally, he urged for the creation of early-warning mechanisms and public advisories which should name and shame foreign nation-state actors using AI for espionage, data theft, and disinformation campaigns.

US vs China

Expectedly, Yixin did not name any specific countries, but it’s easy to read the United States’ name between the lines, the South China Morning Post hints in its report, adding that the US administration recently warned it could not allow China surpassing it on AI development.

Indeed, less than a week ago, US Treasury Secretary Scott Bessent said the country would face dire consequences should it lose the AI race against China. "There is no day after tomorrow if China wins at this," Bessent said at a Breitbart News event in Washington, Bloomberg reported. "If they were to pull away from us on AI, then nothing else would matter."

The US has been at a trade war with China (among other countries) for years now. During Donald Trump’s first term, he blacklisted numerous Chinese hardware manufacturers, warning that Chinese-built 5G infrastructure could be abused to install backdoors and allow the Chinese government to spy on US communications. Huawei, ZTE, and TikTok bore the brunt of these accusations, which the Chinese government vehemently denied.

In his second term, Trump also declared a national emergency and banned all foreign bulk-power systems from being imported, installed, or used in the country. In a signed executive order, Trump said that during his first term, he found “that the bulk-power system could be a target of those seeking to commit malicious acts against the United States, including malicious cyber activities, because of the significant risks that a successful attack would have on our economy, human health and safety, and national defense.”

President Trump also said there were “minimal restrictions” on both acquisition and operation of these foreign-produced systems. As a result, the situation “constitutes an unusual and extraordinary threat … to the national security, foreign policy, and economy of the United States.”

While the AI race is intensifying, developers are calling for a slowdown and better guardrails. Some developers estimated that AI could end humanity in a few decades, urging the industry to slow down and only develop systems they are confident they can control.

• Check Point spotted phishing emails spoofing voicemail transcript notifications, hitting 7,800+ orgs
• Malicious SVG attachments auto‑fill victim emails, redirecting to fake login pages for credential theft
• SVG format bypasses filters; businesses urged to verify notifications and treat SVGs as active content

Hackers have a new phishing lure - the automated voicemail transcript notification, and have already used it against thousands of organizations already, sending tens of thousands of malicious emails.

In a new report, security experts from Check Point Research (CPR) said they spotted an ongoing campaign that has already targeted thousands of organizations.

The goal of the campaign seems to be credential theft - grabbing access to people’s email accounts, business services, and similar.

Abusing the trends

The proliferation of AI gave rise to a new trend in the office - automated voicemail transcripts. When a person receives a voicemail, they can choose to read it instead of listening to it. Useful for a noisy workplace environment, or for emails that are too sensitive to be blasted through a speaker system. An automated system mails the transcript to the recipient’s inbox in a familiar format, and since they’re used to receiving this type of email, they’re not suspicious or skeptical enough. Their guard is lowered, which is a perfect opportunity for the attackers.

“Between August 17 and August 31, Check Point identified more than 58,000 emails tied to the campaign. The operation targeted over 7,800 organizations, leveraging more than 38,400 spoofed sender addresses across over 9,300 spoofed domains,” the researchers explained.

The emails follow a simple formula the recipients are already used to seeing. Each message’s subject line begins with “Automated transcript”, followed by a partially redacted phone number and a random tracking string. “The effect is deliberately understated: a notification that appears to have been generated by a trusted workplace system,” CPR explains.

The email domains are also spoofed in a way that makes it seem as if they’re coming from within the same organization.

SVG attachments

Every email comes with an attachment. It is designed to look like a regular call recording file, using names such as “▷ ——— 001min 09sec_….svg.” But notice the file type - SVG. This is not an audio file, it is short for Scalable Vector Graphics (SVG) - an image file. There are a few reasons why scammers are opting for this particular format, but the number one is that it is an XML-based document that can contain JavaScript. When a browser opens the SVG, that JavaScript can execute, redirecting victims to a spoofed login page where they’re asked to log in.

This is exactly the setup here, too. To make matters worse, since the recipient’s email address is hardcoded in the URL, the fake login form auto-fills it. When the victim opens up the SVG, they’re redirected to a login page where the “username” part is already populated, making it more personalized and credible.

Another key reason why SVG is a popular format in these attacks is that it can bypass email security systems. If scammers put a hyperlink in the email’s body, it can be scanned by the system, and sanitized if proven malicious (which it would). But without a link the only other thing a security system can check are the attachments, and there the usual suspects are .exe, .docx, or .pdf files. Very few are focusing on SVG files, as well.

Adapting to change

This campaign is a great example of how quickly attackers adapt to enterprise workflows as automation becomes more common, Check Point’s researchers have warned. In response, businesses should start treating automated notifications as signals that need to be verified - especially those when the sender appears to match the recipient’s domain.

Furthermore, businesses should define which file types and domains AI agents are allowed to access without human confirmation, and finally, they should definitely inspect SVG attachments as active content, not simply as images.

Like many people who've just installed the new iOS 27, you're probably wondering why Siri doesn't seem quite like the new all-singing, all-dancing AI assistant you were promised.

Try to strike up a conversation with it and it will still try to palm you off to ChatGPT, or just throw up a load of web links instead of answering you directly. You'd be forgiven for wondering whether Siri AI is just another failure.

Part of the problem is that Apple's terminology makes it genuinely confusing, but there's an important distinction between iOS 27's Siri and Siri AI that you need to make. Let me explain.

Installing iOS 27 gives you some new Apple Intelligence features, but it does not automatically give you the headline new Siri. The big Siri upgrade is Siri AI (Beta), which you can apply for, but requires joining a separate waitlist.

Of course, that doesn't mean you don't get anything new with iOS 27, though, so let's break it down.

What you get in iOS 27 without joining Siri AI (Beta)

Most of the really dramatic Siri improvements aren't actually part of ordinary Siri. With iOS 27, however, you do get new Apple Intelligence features elsewhere on your iPhone.

For example, existing Writing Tools remain available without Siri AI, while iOS 27 adds things such as Live Translation in Messages, FaceTime and Phone. There's also Call Context, which can surface relevant information such as an airline confirmation code while you're on a call, improved Smart Replies, Mail suggestions and suggested polls.

Visual Intelligence is another useful AI feature that works without Siri AI. Just click and hold the Camera Control button to activate it.

Visual Intelligence is a way of asking ChatGPT, using your voice or text, about what your camera is looking at, as well as searching for similar things online using Google. You can also use it to identify plants, translate text and turn dates on posters or flyers into Calendar events.

There's an onscreen version of Visual Intelligence too, although it's a bit clunky to use. Take a screenshot with the Side + Volume Up buttons and you'll see Visual Intelligence tools appear at the bottom, including Ask, Search, Summarize, and actions such as Add to Calendar. Again, once you tap Ask, you can speak your request instead of typing it.

But these are really iOS and Apple Intelligence upgrades, rather than Siri becoming something like ChatGPT. For that you'll need the upcoming Siri AI.

What you DON'T get until Siri AI (Beta)

With Siri AI, Apple has a long list of new capabilities it says Siri gains:

• Broad world knowledge — with proper conversational answers to general questions rather than relying so heavily on search or ChatGPT.
• Personal context — it can find things buried in your Mail, Messages, Photos and Notes apps, even from fairly natural descriptions.
• Onscreen awareness — you can ask Siri about whatever you're currently looking at without having to take a screenshot. Apple's examples include asking it to explain a diagram in your class notes or compare two reports in Files.
• Much deeper app actions — Apple gives examples including finding information and then drafting an email, or editing and sharing a set of photos.
• Real generative writing — in the new version, Siri itself can compose text from scratch, rewrite, proofread and critique writing. Without Siri AI, you're using the separate Writing Tools instead.
• Conversational history — there's an entirely new dedicated Siri app that sits on your Home screen, with conversations synced privately through iCloud so you can start on one Apple device and continue on another.
• Visual Intelligence through Siri — rather than invoking Visual Intelligence separately, you can simply ask Siri questions about what's on your screen.
• More natural speech and dictation — on supported hardware, Apple says its new on-device model gives Siri more expressive voices, customizable pace and expressiveness, and improved system-wide dictation. This is an area where Siri currently stands well behind Gemini Live and ChatGPT Voice.
• Personalized writing style — Siri can apparently learn how you communicate with different people. Apple's example is recognizing that you normally send your manager short bullet points and drafting your text accordingly.

And that's the Siri AI you don't have yet.

Join the waitlist

The good news is that you can apply to join the beta right now. Go to Settings > Siri, where you should see Siri AI (Beta) at the top of the screen. Tap Join waitlist and you'll be added to the queue. You'll get a notification when Siri AI is available for you.

There are also some major regional restrictions. Siri AI isn't currently available on iPhones or iPads in the European Union, although EU users can access it on Macs and Vision Pro. In mainland China, Siri AI isn't currently available at all for users whose Apple Account region is set to China.

Because I’m in the UK, the EU restrictions don’t apply to me. I've joined the waitlist now, so I'll be putting Siri AI through its paces as soon as Apple lets me in. Until then, if you've installed iOS 27 and wondered why Siri still feels suspiciously like the Siri you had yesterday, there's a simple explanation: it pretty much is.

• RubyGems reported over 2,000 malicious packages uploaded by OpenAI agents in May
• Agents abused RubyDoc servers to fetch public UK documents and attempted API key theft
• Incident echoes prior rogue AI attacks on Hugging Face and DseWiki, showing autonomous exploit attempts

A swarm of OpenAI agents attacked RubyGems, a package manager for the Ruby programming language, uploading thousands of malicious packages until they were eventually cut off. No one really knows what the agents’ endgame was, but it appears they were using a nuclear bomb to kill a fly.

Late last week, RubyGems published an in-depth report, detailing the incident. In it, it was said that a swarm of agents started uploading malware to RubyGems on May 5, and between May 11 and 12, managed to deliver more than 2,000 of them. When the maintainers realized what was going on, they shut down new account creation for four days, to prevent further attacks.

“We believe these were authored by internal OpenAI agents,” the researchers said in the report.

Why RubyGems?

When a user uploads a package on RubyGems, a documentation service called RubyDoc automatically builds documentation for it. The agents put instructions in their packages, causing RubyDoc’s servers to execute the code, forcing the servers to visit UK government websites and download documents such as council meeting information.

The documents AI agents were looking to retrieve are public, freely available to anyone, at any time. Why the AI agents decided to go through the trouble of uploading malicious packages and abusing RubyGems’ servers instead of simply downloading freely available data is not known at this time.

OpenAI confirmed the incident to The Register, and said it was looking into it: “Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information," the spokesperson said. "We’ll continue to investigate as part of our broader review of agent activity during training and evaluation.” The data harvested was collected into new packages and re-uploaded to RubyGems.

Stealing API keys

Besides trying to upload thousands of pieces of malware in order to download free data, the AI agents also conducted a separate, more serious attack: they tried to steal RubyGems API keys.

The researchers explained that the agents found a vulnerability that might have allowed them to obtain other users’ keys, and then use those keys to upload packages:

“One particularly concerning finding is that agents attempted to exploit a vulnerability on May 12th that was only discovered in July,” the report states.

“The agents were attempting to exploit a novel security vulnerability in order to steal people’s RubyGems API keys. We do not know if this attempt succeeded, but we have confirmed with the RubyGems team that this was a viable pathway to obtain API keys illicitly if a user with the right version of RubyGems was logging in within an hour of the attack on the right internal CDN node. However, the RubyGems team said they had conducted extensive reviews and found no evidence that this pathway was exploited in the past. However, we can’t rule it out entirely.”

Going rogue

This is not the first time an AI agent tried to complete a test by means of hacking. In late July, OpenAI said that some of its most advanced AI models went rogue and attacked Hugging Face, one of the world’s largest repositories for AI models. In the attack, it apparently accessed some internal company systems.

In the aftermath of the attack, OpenAI described the attack as “unprecedented”, and said it was investigating together with Hugging Face. The victim’s co-founder and CEO, Clement Delangue, said it was "mind-blowing that all of this happened autonomously".

Later, it was also discovered that the agents hacked a separate website, called DseWiki, months before the Hugging Face incident, and used it as a message board. Allegedly, they made more than 15,000 edits to the site, sharing tips on how to avoid being detected.

Via The Register

• IGN asked Valve if the RAM crisis would impact the Steam Deck 2
• Valve engineer Pierre-Loup Griffais said "not really", but added: "It's just a matter of looking at the current conditions and seeing how and when we can deliver"
• This is effectively saying that the spec won't be compromised, but the release timeframe might slide

Valve is sticking with its plan for the Steam Deck 2 in terms of ensuring that the sequel will be a proper generational leap compared to the existing handheld.

IGN interviewed Valve engineer Pierre-Loup Griffais (along with Jeff Leinbaugh) and brought up the subject of whether the RAM crisis – which appears to be intensifying in an unpleasant manner as this year rolls on – would affect the Steam Deck 2.

When asked if the memory supply shortage had changed Valve's plans for the sequel of the Steam Deck, Griffais said "not really", adding "We've talked before about how we want to make sure there's a very delineated performance improvement for something like a future Steam Deck, and I think we're still looking at it in the same way."

Griffais continued: "It's just a matter of looking at the current conditions and seeing how and when we can deliver something like that. But from what we're working on, as far as the user experience goes and what the product that we're trying to build goes, it's very similar goals."

In other words, Valve still wants to make the Steam Deck 2 a major leap in handheld performance, and the only thing that pricier components (not just system RAM, but other elements of the device) will mean is that the "when" of the delivery timing might be altered.

So, I read this as essentially hinting that the release timeframe could be pushed back, but ultimately the spec of any Steam Deck sequel is not going to be messed with due to any component price rises.

Analysis: value is more important than timing

I think this is a sensible stance. Having clearly laid out its stall from the get-go, shortly after the launch of the Steam Deck, in terms of making the sequel a considerably more powerful handheld, Valve can't go back on that really.

Well, it could, but it wouldn't be a good look, and I think this is basically what Griffais is getting at with that key "how and when we can deliver" comment. The Steam Machine being released at a less-than-ideal price hasn't done Valve's reputation any favors, and a lot of gamers have been seriously disappointed with the end result in terms of value there. I don't think that Valve can take the risk of a repeat performance with the Steam Deck 2, as that'd further erode the goodwill of gamers.

Personally, I'd prefer Valve to wait until after the RAM crisis has (mostly) blown over before introducing the Steam Deck sequel – even if that means a long delay, and the memory shortage continues for the rest of this decade (as some are predicting). I'd rather have a performant handheld with a palatable price tag – and wait however long that may take – than something that's expensive arriving sooner.

It sounds like Valve is very much thinking along those same lines, perhaps not surprisingly given that RAM-driven price hikes have reportedly had quite a negative impact on Steam Deck sales in recent times.

• Researchers warn Skullcandy Dime 3 earbuds on older firmware accept Bluetooth pairing from unknown devices with no user interaction required
• When leveraged, it can be used to interrupt the owner's connections, hijack playback, and even capture live microphone audio
• The vulnerability has been patched in a newer firmware update available only on newer units, does not seem to be addressable for existing earbuds

Carnegie Mellon University's CERT Coordination Center has warned Skullcandy's Dime 3 wireless earbuds will accept a Bluetooth pairing request from a stranger's device without the owner doing anything.

The resulting bond is permanent, and the only sign the owner gets is a spoken "new device paired" notification delivered after it has already happened, with zero user interaction to confirm the request.

The advisory covering the Dime 3 was written by CERT/CC's Bob Kemerer and credits independent researcher Jacob Nowak, who had posted his findings to the Full Disclosure mailing list in early August after testing it on hardware he owned.

A fix deployed that covers virtually no existing users

What makes this worse is that, ironically, while Skullcandy was swift in addressing the issue affecting earbuds running firmware version 1.0.0.28 by rolling out a patched version 1.0.0.30, it seems to address the issue only in newly made units.

CERT notes that there seem to be no "consumer-accessible" methods to upgrade existing units to the newest firmware because it reportedly has no support via the companion app, as a Tom's Guide review indicates.

A product without an update path that is user-accessible essentially means that its software flaws, or in this case, security issues, are here to stay for users who have had the bad luck of buying an earlier unit.

The underlying vulnerability, CVE-2025-20701, is not new and is not of Skullcandy's making. It is one of three vulnerabilities that Dennis Heinze and Frieder Steinmetz of the German firm ERNW disclosed in June 2025 at the TROOPERS conference in Heidelberg, affecting Bluetooth systems-on-chip from Taiwan's Airoha.

The Dime 3's Bluetooth identifier names Airoha as its chipset vendor, and while Airoha shipped a fixed SDK to its customers in June 2025 and published its bulletin that August, owners of the earbuds are in a unique situation, to say the least.

The vulnerability's severity is disputed: MediaTek (which owns Airoha) assigned it a relatively low 6.7 rating, while CISA's vulnerability enrichment program later assigned it an 8.8 with a 'high' categorization.

A potential attacker is limited to what the earbuds can access, since the vulnerability is essentially limited to the earbuds, but one could still wreak havoc with that alone. It should allow for more than just disrupting a person's routine by 'hijacking' one's earbuds by essentially using their microphones on them to record conversations or, in an extreme theoretical case (requiring chaining with other exploits), impersonate the headset and pull contacts, call history, and even pass hands-free commands to a paired smartphone. The latter, however, would require a high technical skill set, being within a few meters of a victim, and a Bluetooth connection turned on on the paired smartphone.

For now, a vulnerability exists that Skullcandy should have been able to patch, exactly as Apple recently did for its Beats Studio Buds, but a lack of support for any third party apps on the budget earbuds is somewhat annoyingly resulting in an unpatchable vulnerability for existing users.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1695) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1695) — hint #2 — repeated letters

Quordle today (game #1695) — hint #3 — uncommon letters

Quordle today (game #1695) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1695) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1695) — the answers

The answers to today's Quordle, game #1695, are…

• SHUSH
• LITHE
• DELTA
• BUGLE

Sometimes the Quordle gods are on your side and every guess you make is correct.

That’s what today felt like — although I did come very close to entering “bulge” instead of BUGLE.

Daily Sequence today (game #1695) — the answers

The answers to today's Quordle Daily Sequence, game #1695, are…

• GULLY
• CUMIN
• BARON
• BASIS

Quordle answers: The past 20

• Quordle #1694, Monday, 14 September: ZEBRA, LEGAL, RATIO, TROLL
• Quordle #1693, Sunday, 13 September: LUCID, SPRAY, MANGE, EMAIL
• Quordle #1692, Saturday, 12 September: SUPER, BRUSH, RESET, SOWER
• Quordle #1691, Friday, 11 September: PLUSH, PAINT, RIVAL, AFOUL
• Quordle #1690, Thursday, 10 September: AGENT, EXILE, TITAN, PUREE
• Quordle #1689, Wednesday, 9 September: HAPPY, GONER, SMACK, MOTIF
• Quordle #1688, Tuesday, 8 September: FLUNG, DIARY, HALVE, BERTH
• Quordle #1687, Monday, 7 September: VISIT, CLANK, FEVER, OCEAN
• Quordle #1686, Sunday, 6 September: PILOT, HONOR, BOWEL, TAUNT
• Quordle #1685, Saturday, 5 September: GNASH, GEEKY, WHELP, PUTTY
• Quordle #1684, Friday, 4 September: QUICK, BEEFY, TRUCK, SNAIL
• Quordle #1683, Thursday, 3 September: SIGMA, ESSAY, MERRY, LLAMA
• Quordle #1682, Wednesday, 2 September: INCUR, FELLA, TITAN, FROZE
• Quordle #1681, Tuesday, 1 September: NASAL, ROUTE, ANKLE, MIGHT
• Quordle #1680, Monday, 31 August: ALIVE, LOUSE, ABOVE, MOSSY
• Quordle #1679, Sunday, 30 August: USING, SORRY, FILET, PIPER
• Quordle #1678, Saturday, 29 August: OVINE, ALLOY, VOICE, CARVE
• Quordle #1677, Friday, 28 August: WAIST, EDICT, BONUS, DEUCE
• Quordle #1676, Thursday, 27 August: SHEEN, TRICE, WAGON, BEVEL
• Quordle #1675, Wednesday, 26 August: OPIUM, EPOCH, BESET, FINER

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #926) - hint #1 - today's theme

NYT Strands today (game #926) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• HINT
• BREAD
• SING
• LIAR
• BONK
• RANCH

NYT Strands today (game #926) - hint #3 - spangram letters

NYT Strands today (game #926) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #926) - the answers

The answers to today's Strands, game #926, are…

• JOIST
• BOLT
• HINGE
• NAIL
• KNOB
• BRACKET
• ANCHOR
• SCREW
• SPANGRAM: HARDWARE

• My rating: Easy
• My score: Perfect

This felt like a game chock-full of words. Indeed, I got my first two — JOIST and BOLT — without even looking, and here was me thinking the theme might be hinting at the classic baseball movie Field of Dreams with its tagline of “If you build it, they will come”.

Although come to think of it maybe it it is about Field of Dreams after all, as all of the words could be connected to the construction of bleachers.

Anyway, as well as plenty of words in the actual game there were also a myriad number of easily spottable non-game words. I thought identifying HINT was quite meta.

Yesterday's NYT Strands answers (Monday, September 14, game #925)

• EXCLAIM
• START
• GASP
• RECOIL
• FREEZE
• SHUDDER
• SPANGRAM: THATSSHOCKING

• Socket found Twitch extension JeeBot harvesting OAuth tokens via proxy servers
• Tokens excluded only for 10 Russian streamer channels, suggesting deliberate design
• Developer issued fixes, but users should revoke exposed tokens for safety

A browser extension for Twitch was harvesting people’s OAuth tokens and sending them to a Russian-owned server. The move was deliberate, but whether or not it was malicious is not that easily determined.

Security researchers Socket recently found an extension for both Chrome and Firefox, called “Twitch Enhanced Viewer | JeeBot”. It has roughly 30,000 users on Chrome, and some 600 on Firefox.

On the Chrome Web Store, it is advertised as a “modern tool for streamers and viewers who value quality, convenience, and control.” Apparently, it makes streaming and viewing clearer, allows viewing content in 2K, hides banner ads and unwanted elements, and even offers an AI bot to make it easier to interact with the stream.

Hardcoded exemptions

According to the researchers, the extension is designed to retrieve Twitch’s video stream playlists through its own proxy servers. However, instead of simply forwarding the requests, the extension also attached users’ OAuth tokens, and since they were placed in the URL, the token also ended up in the proxy server’s request logs.

After being called out for it, the extension’s developer (HISHIMIRO/jeetbot.cc) released a new version 85.8.7 (for Firefox, the Chrome one is currently under review) which apparently fixes this flaw: when playlists are retrieved, the user’s OAuth token is no longer sent to the proxies. It would seem like this was an honest mistake that was remedied upon responsible disclosure. However, here is what Socket had to say about the way the tokens were being retrieved:

"Current builds (v85.x) forward the token inline as an &auth= query parameter on a network-layer redirect to the operator's proxy," Socket explained. "The token is forwarded for every channel the user watches, except a hardcoded allowlist of ten Russian streamer channels, whose sessions are exempted from forwarding."

If there was a list of 10 Russian streamer channels who were exempt from OAuth token retrieval, it’s safe to assume that the developer knew very well what they were doing.

It is good that the extensions were upgraded, but if you are using it, you should also revoke the exposed Twitch token, to be on the safe side.

Via The Hacker News

• CISA added GitLab CVE‑2026‑85706, a critical path traversal flaw, to its KEV catalog
• Exploitation already observed; attackers can read sensitive files via commits API without authentication
• GitLab patched in CE/EE 19.3.2, 19.2.6, and 19.1; agencies given three days to update

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a new GitLab vulnerability to its KEV catalog, warning users that it is being actively exploited in the wild.

GitLab has now updated its Community Edition (CE) and Enterprise Edition (EE) versions to 19.3.2, 19.2.6, and 19.1, fixing a range of vulnerabilities. Among them were two critical-severity ones: a path traversal issue in repository commits API, and an Insecure Deserialization issue in GraphQL subscription serializer.

The former is tracked as CVE-2026-85706, with a severity score of 10/10. It stems from missing authentication enforcement and improper path confinement in the repository commits API, allowing unauthenticated threat actors to read various sensitive information such as login credentials or secrets.

Added to KEV

In the advisory, GitLab did not mention anything about the flaws being abused in the wild - however, a separate report from cybersecurity experts watchTowr, released a day later, claimed so:

"watchTowr Intel is already observing in-the-wild probes for the latest critical GitLab Path Traversal vulnerability, CVE-2026-85706, which allows attackers to read arbitrary files in a single HTTP request," the researchers said.

"Based on recent GitLab vulnerabilities, we know the time until indiscriminate exploitation is likely not far away. [..] Defenders should also hunt through log files for HTTP POST requests to '/api/v4/projects/{id}/repository/commits/' URIs containing 'file.path' parameters to identify potential exploitation attempts."

At the same time, CISA added this bug to its Known Exploited Vulnerabilities (KEV) catalog, confirming the claims and giving government users a tiny three-day window to apply the patch.

GitLab is an intelligent orchestration platform for DevSecOps professionals, helping organizations automate and streamline the software development cycle. It has more than 50 million registered users, among which are roughly 50% of Fortune 100 companies, as per an SEC filing.

Via BleepingComputer

• Microsoft warns of a sophisticated campaign tricking users into updating passkeys via fake IT calls
• Victims redirected to adversary‑in‑the‑middle sites mimicking Microsoft login to steal access
• Attackers exfiltrate files from SharePoint, OneDrive, and Exchange; phishing‑resistant MFA advised

Passkeys have made stealing passwords obsolete. To work around this change, hackers have started tricking users into authenticating on attacker-controlled computers. This is according to a new report from Microsoft, which says there’s a highly sophisticated campaign currently taking place, with the goal of compromising people’s cloud accounts and stealing as many sensitive files as possible.

The attack starts a lot earlier than what the victim experiences. There is a lot of pre-attack planning and due diligence, in which the threat actors gather as much information about their target as possible. Knowing their place of work, position, and personal phone number is essential.

Once all the pieces are in place, the attack starts with a phone call - victims are told they are speaking to their organization’s IT help desk and that they need to update their passkey (or MFA, depending on the setup) immediately, to avoid any disruptions to their operations.

Follow-up SMS

In the follow-up to the call, the victims then receive an SMS message with a link where they can update their security configuration. On the surface, the website looks like the legitimate Microsoft login landing page. In reality, though, this is a pre-built malicious website that uses the adversary-in-the-middle (AitM) techniques to either receive access on the actor’s behalf, or capture credentials.

"The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms," Microsoft said. "In a smaller number of cases, actors take advantage of already compromised accounts to expand their reach" by sending similar passkey-themed messages via Microsoft Teams.

The campaign is apparently ongoing since at least May this year, Microsoft, said, without detailing the number of victims. Its aim seems to be to exfiltrate files from SharePoint and OneDrive, as well as email data from Microsoft Exchange Online. It also did not attribute this campaign to any specific threat actor, although it did say that there are many collectives engaged in such, or similar, campaigns, including Cordial Spider, Storm-3121, and others.

Via The Hacker News

Meta Connect 2026 is fast approaching, and it seems a big surprise hardware announcement has just been leaked — by none other than Meta itself. It’s not much but our first official look at the so-called Project Phoenix has me very excited that we might finally get the Meta Quest Pro successor I’ve been begging for.

The leak was spotted by prolific Meta leaker Luna, who found a never-before-seen headset in the latest Horizon OS prescription lens firmware. Because it only shows how lenses are inserted into the new design, we don’t get a full look at the whole thing, but it seems XR glasses might be a better description than XR headset.

That’s because the front of the headset looks incredibly slim. Not quite Meta Ray-Ban levels, but a fraction of what the Meta Quest 3 and 3S were thickness wise. There also appears to be no head strap. Instead, we see the display unit supported by glasses' stems sitting behind the ears of the wearer.

What this leak seemingly confirms is the rumors that Meta has been working on an ultra-lightweight headset design. One where the battery and a chunk of the processing power are all moved to an external puck — something also teased by a cable we see extending from one of the Meta device’s stems.

Of course we should take all leaks and speculation with a pinch of salt, however considering some details are now coming directly from Meta itself, I suspect this may be a case of where if there’s smoke there’s fire.

If so, I couldn’t be more excited. Following the disappointing start to VR in 2026, this launch might turns things around (at least somewhat).

What I've been waiting for

XR hardware housing its battery in an external puck is nothing new; however, moving processing power in there too is far less common — the only one I’ve experienced is Xreal’s Aura glasses, though it works incredibly well.

By taking as much as possible out of the headset, you can significantly drop the weight of the machine, and, because you’re tethered to something in your pocket, your movement won’t be restricted as it can be when you’re connected to a PC or console.

This makes something capable, comfortable, and somewhat mobile. That said, it seems Phoenix will still be more headset-like than glasses-like, so I’m not sure I see myself exploring the outside world while wearing it.

For gaming and entertainment, there are other specs to consider (such as processing power, display quality, and content support), but where this design wins out is for productivity.

I’ve tried spending entire working weeks immersed in XR and my tests have proven it’s incredibly uncomfortable. It’s fine for a few hours at a time, maybe for the one-off day, but not for eight hours a day five days straight. That’s nightmarish.

But the lightest model I’ve tried is the 545g Samsung Galaxy XR. If Meta’s headset can drop to 200g or less, then it could easily be something I wear for a whole day. Plus it would be super easy to slip into my rucksack to be productive in XR on the go — or kick back with a big-screen movie.

This is precisely why I’ve been wanting an ultra-lightweight XR headset to enter the scene, but so far I’ve been let down. Xreal Aura gets close, but as glasses, it doesn’t boast the same field of view as a headset — with a headset offering more virtual real estate for app windows.

All I need is for Meta’s headset to copy the Xreal Aura's ability to show what’s on my phone screen via a USB-C cable and it could be the perfect XR headset (provided the price isn’t too high).

We’ll have to wait and see what Meta unveils at Connect, but September 23, 2026, can’t come soon enough.

AI voice cloning has reached the point where scammers can convincingly imitate human voices — and worryingly, research suggests we're not particularly good at telling the difference.

Take the case of one X user, for instance, who posted: “Got a call from my wife telling me she forgot her wallet and needed the credit card to pay for her gas.

Except my wife was at home with me, and drives a Tesla. Same voice, bit... off, weird cadence, but 100% sounded just like her. If she wasn't there, and it wasn't about gas I would have fallen for it.

I entertained it for a while to get more out of it, I was so confused. Must be some sort of voice deepfake. The responses were too fast for AI, I think it was a voice filter. I wish I had thought to record it.”

Whether this particular call used generative AI or a real-time voice filter isn't clear. What is clear is that the days when recognizing somebody's voice was enough to prove who was on the other end of the phone are over, and I’m not alone in finding that terrifying.

When news of the story hit Reddit, some people were skeptical about whether this had actually happened, but there were plenty of people with similar stories. “This just happened to me last week,” said one user. “They called aunt and grandmother and said they were an attorney and that I was in jail and needed to be bailed out.”

The ‘relative in distress’ scam

According to the 2026 paper Evaluating AI Models' Capability to Automate Voice Phishing Attacks by Fred Heiding and colleagues, a study involving 4,100 US adults found that up to 36.1% said they would comply with, or were unsure whether they would comply with, an AI-powered “relative in distress” scam.

Importantly, that figure measures self-reported willingness to comply, rather than the number of people who were actually fooled into handing over money. The researchers describe it as a measure of susceptibility to the scam rather than observed behavior.

The researchers also found that persuasiveness mattered more than how human the voice sounded, and that people who regularly used AI weren't any better at identifying synthetic voices than people with no AI exposure.

While the scam of tricking people into thinking their loved ones need money may be an old one, AI is making the danger especially real. If the scammer actually sounds like your loved one, how do you know it’s them?

One answer is to set up a family code word today. It doesn't need to be complicated — just something everybody knows, and that a scammer would be unlikely to guess or discover online.

There’s also an even simpler precaution: hang up and call the person back on a number you already know. If your son, daughter, partner or parent apparently calls out of the blue asking urgently for money, don't rely on the voice sounding right. End the call and contact them yourself.

The Ferrari deepfake case shows why some form of personal verification can work. In 2024, a Ferrari executive received messages followed by a phone call apparently impersonating CEO Benedetto Vigna. Suspicious of the call, the executive asked the supposed Vigna to identify a book the real CEO had recently recommended to him. The caller couldn't answer, and the attempted deception fell apart.

A family code word essentially does the same thing. And it’s something you might have to start thinking about today, if you haven’t already.

Can you trust your own ears?

“AI's deepest impact isn't on our devices; it's on us," says Mark Beare, Head of Consumer at Malwarebytes. "When people can no longer trust what they see, hear, or who they're talking to, the damage reaches far beyond any single scam and into the building blocks of our society.”

A Malwarebytes survey published in June found that 85% of people said it’s hard to tell a scam apart from the real thing, up from 66% the previous year. Perhaps even more tellingly, 88% said it was becoming harder to tell which content online was genuinely human or real.

And that problem isn't restricted to our ears. AI-generated images and deepfake videos are increasingly challenging the assumption that seeing or hearing something for yourself is proof that it really happened.

We used to be able to rely on a familiar voice as proof of identity, but it seems that in 2026 that's no longer enough. AI voice technology is only going to become more convincing, so our behavior needs to change with it.

Agree on a code word with the people closest to you now, and if you get an unexpected call asking for money, hang up and call them back.

Following the recent resignation of one of Anthropic’s leading researchers, multiple AI CEOs have suddenly begun calling for a slowdown in the development of AI technology to allow regulations and governance on the technology to catch up.

Speaking to the BBC after his resignation, Jacob Coxon warned, “I believe that if we don't slow down at the current rate of progress, there is a strong chance that we could all die in the immediate future.”

Following this, Anthropic head Dario Amodei, OpenAI CEO Sam Altman, and Grok founder Elon Musk have all apparently aligned in their calls for development to slow down. But there are some tricky waters to navigate - particularly around President Trump, China, and what guardrails should be put into place.

What are AI heads saying?

Over the weekend, Amodei posted an essay on “why the AI industry should slow down”. In it, he said, “I believe that if slowing down bought us even an extra year or two before models reach critical levels of capability, and we used that time to advance alignment, we could greatly reduce the risk that something goes seriously wrong.”

Within the essay, Amodei outlined how AI could be ‘paced’ within the US, and globally, alongside a recommendation that AI companies put ‘evaluator’ teams into place to ensure AI models stay aligned to their tasks. Elon Musk replied to Amodei’s social media post, stating that the Anthropic head was “right”.

Sam Altman told Fortune the regulations and standards for AI further were “not at a place” to continue progressing AI development.

But not everyone is convinced. US President Donald Trump has said that slowing down AI development is non-negotiable, as it would allow China to rapidly catch up to US AI capabilities. He told reporters that the US is “leading China on AI... and, frankly, I want to keep it that way,” adding that “whoever wins AI, wins”.

Trump also said that “very negative forces” were behind the growing opposition to AI, and said that fears were being stoked by “that won’t happen”.

China also isn’t convinced by what the AI giants are saying. Beijing labelled the calls for a slowdown as “fearmongering” from a “Cold War playbook.” In his essay, Amodei said that a “Chinese lead in AI would pose grave danger for the United States and the world.”

Chinese Foreign Ministry spokesperson Guo Jiakun said, “Fearmongering, confrontation and malicious competition will only disrupt the process of global AI governance and serve no one’s interests.”

Expert perspectives on calls for AI slowdown

• Karolis Kaciulis, Lead System Engineer, Surfshark:

The latest debate around AI threatening humanity is clearly a marketing move. AI companies use the same rogue-AI rhetoric every few months, and it is almost identical each time.

The threat itself is fictional, closer to a Skynet-style sci-fi scenario than the problems generative AI is already causing today, from automated scams to intimidation.

One of the most immediate risks from AI is its environmental cost: the wildlife and land lost to data centres, the huge amounts of energy they use and, by extension, the water needed to cool them. Our research estimates that one ChatGPT query uses around 2Wh of energy on average, enough to run a 40W desk fan for three minutes. That may sound modest in isolation, but the impact mounts rapidly across hundreds of millions of queries.

Scams, imitation and hacks will also become more frequent. LLMs have already made these attacks easier. The difference is that bad actors are getting easier access to them, rather than the models necessarily getting better. Deepfake fraud has already caused $2.19bn in losses globally, including $149m in the UK.

The bigger danger for AI companies may be that no valuable scaling is possible any more with the current state of LLMs. This may be as efficient as they ever get. It remains unclear whether newer models are better at doing the tasks we ask of them, or simply better at imitating the responses we expect.

People do not really understand how chatbots work, or that what they pass to one may be accessible to the company behind it. Every prompt should remind people not to share personal information. Chatbots ask follow-up questions while completing a task or research, but they will not necessarily filter out sensitive information for users.

• John Strand, Owner, Black Hills Information Security:

Up until this weekend, I was leaning toward believing that calls for an AI slowdown were purely performative. Then I woke up and read the news today and realized that it almost doesn’t matter.

We can talk about slowing down AI until we’re blue in the face, but when the United States is saying it doesn’t want to slow down because it’s competing with China, and China is aggressively pushing AI development as well, we’re talking about the two major economic and military powers on the planet having enormous incentives to keep moving.

At that point, calls for a slowdown don’t have much bite.

I’d like to believe that Anthropic, OpenAI, xAI, and the other frontier model labs are working on better controls. But unless you can get the nation states and the major AI labs moving in the same direction, I don’t see how meaningful restrictions actually work.

This really feels like we’re entering an atomic arms race moment.

Stick with me here.

In 1950, physicist Leó Szilárd publicly discussed the idea of a cobalt bomb, essentially a doomsday weapon that could potentially produce enough radioactive fallout to make the Earth uninhabitable. He wasn’t proposing that somebody build the damn thing. He was trying to demonstrate where the technology could ultimately lead.

That’s the kind of moment I think we’re approaching with AI.

During the nuclear arms race, eventually the consequences became serious enough that competing nations had to at least start talking about limits, controls, and ways to keep competition from ending catastrophically.

I think we’re heading toward a similar problem with AI. Until China, the United States, and the major frontier model labs are all sitting at the same table, restrictions adopted by individual companies or individual countries are going to have a very difficult time holding.

Someone slowing down only works if they believe the other guy is going to slow down too.

• Kristin Lowery, Field CISO, Optiv:

The calls from some of the world's leading AI researchers and technology companies to slow the pace of frontier model development reflect a growing recognition that innovation and responsibility must advance together. AI is no longer an emerging technology experiment. It is becoming foundational infrastructure for economic competitiveness, national security, health care, manufacturing, education, and nearly every sector of society.

As capabilities accelerate, so too must our ability to understand, govern, and safely deploy these systems.

That said, slowing development entirely is neither realistic nor necessarily desirable. AI innovation is occurring globally, and not every nation, organization, or threat actor shares the same values regarding transparency, safety, and responsible use. This creates a complex dynamic that increasingly resembles a technology arms race. If responsible organizations dramatically slow innovation while less accountable actors continue advancing without guardrails, we risk creating unintended strategic disadvantages.

The challenge is not simply whether to move fast or slow down. The challenge is ensuring we innovate with intention while maintaining competitiveness.

In my view, the debate should move beyond whether to pause or accelerate AI and focus instead on how to build trust into AI from the outset. Organizations need practical guardrails centered on transparency, security, privacy, accountability, and human oversight, supported by rigorous model testing, red teaming, governance frameworks, data provenance controls, and clear ownership before deployment at scale.

Safety must be embedded throughout the development lifecycle, not added afterward, and organizations should continuously assess AI systems for risk, monitor for unintended consequences, establish governance programs, and educate employees on both the benefits and limitations of these technologies. Responsible AI is an operational discipline that organizations need today.

History shows that transformative technologies rarely succeed through either unchecked innovation or excessive regulation alone; the most sustainable path is to encourage innovation that drives economic and societal value while implementing thoughtful safeguards that reduce risk and build trust. Organizations and nations that strike this balance will be best positioned to lead in the next era of AI, because responsible innovation — not a choice between innovation and safety — is the key to remaining competitive while ensuring trust, transparency, and accountability scale alongside technological progress.

• Ryan McCurdy, VP, Liquibase:

Slowing frontier development may give AI companies more time to understand and address the risks Amodei is describing. But enterprises can’t build their AI strategy around the assumption that AI is going to slow down.

AI is already moving from generating content and code to taking action across software delivery and production systems. The question for enterprises is how they adopt that capability without giving up control.

That means putting governance where AI decisions become real actions. Organizations need to define what an agent can access, what it can change, what it can decide on its own, and what policies have to be met before a change reaches a critical system. Those controls need to work whether the action comes from a developer, automation, or an AI agent.

We can debate how quickly the frontier should move. Enterprises still have to prepare for where it’s going.

• Tristan Watkins, director of services innovation, Advania UK:

Until recently, the major AI labs have been reluctant to slow their development efforts unilaterally. Over the last week this changed, with new commitments from OpenAI and Anthropic to prioritise AI alignment and interpretability research, to become more externally verifiable, and to establish safety precedents that governments could adapt.

Given that these two organisations already allocate far more on AI Safety than their competitors, this bilateral leadership is extremely welcome.

It appears that other US labs may follow suit, but given the differences in AI Safety spending outside of Anthropic and OpenAI today, this will require investment more than lip service. Hopefully this underscores why we need governments to lead these efforts more proactively.

• Ted Miracco, CEO, Approov:

Government regulations will never move fast enough to keep pace with AI development, but the industry doesn't need to wait for governments to add guardrails.

The most effective safeguard is simple product liability. If AI companies are held legally and financially responsible for the misuse of their products, safety could become a foundational feature rather than an afterthought.

Today, we need to be less concerned about AI gaining sentience and spinning up its own attacks on humanity. The real, immediate dangers involve bad actors weaponizing AI as a force multiplier to cripple critical infrastructure or potentially paralyze the banking system.

• Oleksandr Yaremchuk, CTO and Co-Founder, Manifold Security:

Pacing the frontier is the right conversation to be having, but it cannot become a substitute for securing the AI we have already put into the world. The uncomfortable reality is that we are debating how to quickly build more powerful agents while struggling to control the ones already operating with real credentials, real access and real-world consequences.

The incidents behind this debate make that clear. The Hugging Face attack was not just a failure of model alignment. Agents ran for days through an unmonitored system, with credentials that had not been rotated, and the victim spotted the activity before the people running the agents did. The problem wasn't simply what the model was capable of. It was that nobody was watching closely enough when it acted.

A fitting analogy is with hazardous materials. We don't just wait for them to become more dangerous before deciding how they should be handled. We control their custody, monitor where they go, limit who can access them and establish clear accountability when something goes wrong. AI agents need the same thinking.

Independent evaluation of frontier models is important. But if an agent can act autonomously on your systems today, you should already be able to answer three basic questions: what did it do, what did it have access to, and could you have stopped it? If you don't know what it did or what it could access, you can't know whether you could have stopped it. Slowing down the next generation won't solve the problem you have right now.

• Waseem Ahmed, Head of Engineering, Secure.com:

The essay lands at the right time because AI agents are already acting on their own inside real company systems, and the OpenClaw ban wave earlier this year showed how fast that goes wrong when an agent has broad access and no leash.

Slowing the pace matters, but enterprises cannot wait for that. The controls that protect us most are least privilege, network isolation, and sandboxing, so an agent can only touch what its job needs and nothing else.

Give every agent its own identity, log every action it takes, and never let it run high-impact steps like disabling accounts or changing settings without a real person approving first. Traditional testing alone will not keep up, so we watch these agents continuously in production.

Independent oversight should mean outside reviewers who can inspect the logs and confirm the agent stayed inside the boundaries we set.

• Heath Mullins, Chief Evangelist, ExtraHop:

AI leaders calling for a slowdown is confirming what the security industry has already been living through firsthand. This isn't a hypothetical risk, it's the threat landscape we're defending against right now.

While it is concerning to see the pace of innovation behind these AI models, the real challenge is that organizations haven't had the runway to build the infrastructure to defend against machine-speed threats.

Calls for caution surrounding the speed of AI development buys the security industry time to get proper visibility into AI activity.

Understanding AI activity within an organization is critical as we’ve seen models break out of sandboxes despite governance built into those models. Every organization will be relying on AI agents for machine-speed defense, and they need their own governance over how these models and agents operate inside their environment, starting with independent evidence of what they actually do, what they access, where they move data, what systems they talk to, and what actions they take.

You can't govern AI based on what a model is designed or permitted to do. Instead, you need real-time evidence of what models and agents are actually doing, because the gap between exponentially more capable AI and defenders' ability to see it is exactly where the next incident happens.

• Bri Frost, Director of Product Management, Cloud Range:

The answer is not necessarily to stop AI innovation but, we need to stop pretending innovation and security are advancing at the same speed.

When ChatGPT became publicly available in 2022, the models were dramatically less capable than they are today — and the guardrails were very easy to manipulate. The difference is that the models behind those guardrails are no longer the models of 2022. They can reason better, write and debug code. They can operate as agents. They can collaborate! And increasingly, they can interact and affect real infrastructure.

Meanwhile, the model release cycle has gone from feeling like major capability jumps every year or two to seemingly every few weeks. That creates a dangerous asymmetry: AI capability is compounding faster than security.

Security and innovation have always been in conflict with each other. If every security problem had to be solved before we innovated, we’d never ship anything. But the opposite extreme is just as reckless: accelerating capability while just assuming we’ll bolt the security controls on afterward and they’ll be effective.

Every new release of AI capability expands the attack surface exponentially. Give a vulnerable model better reasoning, then tool access, then memory, then autonomy, then connectivity to production systems, and yesterday’s jailbreak isn’t just a clever prompt anymore — it’s an execution path. That’s the snowball effect we should be worried about.

Responsibility also must lie with the AI companies. If a SaaS company knowingly shipped software with weak security controls and customers were harmed, we wouldn’t excuse it because they were 'innovating quickly'.

So why are we treating AI differently?

You don’t get to race to build increasingly powerful, autonomous systems, profit from them, and then shrug when predictable security failures cause damage.

Sure the argument can be made that no product is perfectly secure - That’s not the standard. But if you ship the product, you inherit responsibility for securing it. And continuing to secure it better!

The conversation shouldn’t simply be “Should we slow AI down?”

It should be: Can our ability to test, validate, contain and secure AI keep pace with our ability to make it more powerful? Is there an equivocal kill switch?

Right now, the answer is no.

And if we’re going to keep accelerating — which I believe we will — then independent testing, adversarial evaluation, isolated testing environments, containment, continuous validation and security-by-design can’t remain optional steps we add after the innovation happens.

The faster we build the engine, the more important the brakes become.

• Denis Calderone, CTO, Suzu Labs:

Amodei's diagnosis is the most honest thing a frontier lab CEO has said publicly. The agent risk is real, recursive self-improvement is accelerating, and the competitive pressure is making both worse.

Where I get skeptical is the prescription. Democratic coordination among companies in a commercial race? Global pacing agreements with China? Amodei himself rates the hardest steps as unlikely. No lab has named a single model release they'll delay because of this essay.

The one idea worth holding the industry to is embedded evaluators with independent publication rights. Give third-party safety researchers permanent access inside the labs, comparable to what bank examiners have inside banks, and let them publish what they find without the company controlling the narrative. That's a simple, concrete accountability mechanism. It doesn't require global coordination or antitrust waivers. Anthropic says they're committing to it unilaterally. Good. Now make the rest of the industry match.

• Donald McFarlane, Board Member, Xcape Inc:

AI does not develop an agenda; its operators do. When we give an autonomous system powerful access and ability to act at machine speed, they will continue to prove highly capable.

Rules enacted in the name of safety must not become a moat against competition or progress. Enormous compliance costs may be manageable for the handful of companies already spending billions building frontier models, while becoming a substantial barrier to everyone behind them.

Government can help clarify accountability and duties of care, and facilitate strong information sharing and collective defense, which is an area where we sorely need more effective public-private partnerships.

But safeguards should focus on how these systems are used and deployed, rather than deciding who is allowed to build powerful AI in the first place.

The goal should be safer deployment without pulling up the drawbridge on innovation.

• Revolut fell for a spoofed government email scam, leaking sensitive customer data to attackers
• Compromised info includes IDs, selfies, account statements, IBANs, and full transaction histories
• Criminals now allegedly leaking data on Telegram, demanding 10,000 BTC (~$780M) ransom from Revolut

Digital banking platform Revolut was tricked into giving away a treasure trove of sensitive customer data to hackers, and it is now coming back to bite it.

The company told TechCrunch that it recently fell victim to a “sophisticated external impersonation scam” in which the threat actor “utilized a legitimate government agency domain email to submit fraudulent requests for information”.

In other words, the attackers either broke into, or spoofed, an email address belonging to the police, tax authorities, or other government bodies with statutory powers to demand information, and used them to demand Revolut hand over sensitive customer data.

Demanding ransom

Cybernews reports that the compromised data includes customers’ birth dates, postal and email addresses, occupation, phone numbers, and copies of identity documents. TechCrunch added that verification selfies, account statements, and transaction histories may have also been compromised, together with IBANs, withdrawal records, complete transaction histories, and Bitcoin transactions.

Should these reports be confirmed, this will be a bonafide fiasco for Revolut.

"Upon detection, ⁠we immediately blocked the address and ​alerted the relevant government agency as ​well as enforcement agencies, data protection, and financial regulators," a company spokesperson told Reuters over the weekend.

So far, we don’t know exactly how many people are affected. Revolut said it is a “very limited” number, and that all of them had been notified already.

According to Coin Bureau, the criminals have started leaking sensitive data on Telegram, in a bid to pressure Revolut into paying a ransom demand. The publication shared screenshots of the threat actors apparently leaking a selfie and “full KYC” of a CEO of a crypto casino website, saying that the crooks are now demanding 10,000 BTC in exchange for deleting the data.

This would put the ransom demand at approximately $780 million which is obscene even by criminal standards.

"This one is deeply concerning and the implications for affected customers go well beyond a standard data breach notification," said Muhammad Yahya Patel, vCISO & Cybersecurity Advisor at Huntress. "Passports, driver's licenses, verification selfies, account statements, transaction histories, birth dates, addresses that's not a data leak, that's a complete identity theft kit handed to whoever sent those fraudulent requests."

"Every single component needed to impersonate someone, open accounts in their name, or bypass checks at other financial institutions is in that package. On the dark web, that kind of profile doesn't sell as individual records it sells as a ready-made fraud pack, and it commands a significant premium precisely because of its completeness."

"For a fintech built on digital identity verification, the bar for verifying third-party data requests should be exceptionally high. The question isn't why an attacker tried this. It's why a regulated financial institution handling highly sensitive data didn't have sufficiently rigorous verification controls to catch it," Patel concluded.

Via Cybernews

I don't see many 4K webcams for under $40 / £40, and with these specs, but Amazon has dropped the price of the Acer A640, which is ideal for those looking to improve the video quality on video calls.

• Best for: Remote workers, students and streamers who want high-resolution video for meetings, classes or broadcasts without spending too much money.

• The deal: The Acer A640 4K Webcam is reduced to $40 (was $50) at Amazon. In the UK, the A640 is now £37 (was £50) at Amazon.

• Why it matters: Excellent price for a 4K webcam. It combines a Sony 1/2.8-inch sensor with 4K recording at 30fps, AI noise-canceling microphone, and fast Phase Detection Autofocus (PDAF) to eliminate focus-hunting during calls. You can also switch to 2K or 1080p at 60fps for smoother video. It also features automatic low-light correction, a physical privacy shutter, and a USB-A to C adapter to connect to desktops and laptops.

Why we recommend it

The Sony sensor and PDAF are two welcome features. PDAF is designed to lock onto its subject quickly, reducing the distracting focus hunting that can occur when you move around during a call or stream.

The maximum 4K setting suits situations where detail takes priority, while 1080p at 60fps is a useful alternative when you want smoother movement.

Its built-in microphone uses AI noise cancellation to reduce unwanted background sound, and automatic low-light correction adjusts exposure when your room isn't particularly bright.

The 4K webcam also comes with a USB-A to C adapter for plug-and-play capabilities across desktops and modern laptops.

Price context & historical value

Amazon is currently selling the Acer A640 for $39.98, compared with its regular $49.99 price. That works out to a $10.01 saving, putting it just under the $40 mark. This is the cheapest we've ever seen it to date.

Should you buy them?

✅ Buy the Acer A640 if...

You regularly make video calls, stream or create video content and want better image quality without spending a huge amount of cash. Its choice of 4K at 30fps or 1080p at 60fps gives you useful flexibility for different situations and meetings.

❌ Skip the Acer A640 if...

You only make occasional video calls and your laptop's built-in camera already does the job. Spending extra on 4K resolution and more advanced autofocus won't provide much benefit if image quality isn't particularly important to you.

The Catch: What to know before you buy

The headline 4K resolution is limited to 30fps, so you'll need to drop to 2K or 1080p to reach 60fps. There's no built-in speaker either, despite the webcam having its own microphone.

The 77.4-degree viewing angle is also relatively focused rather than extremely wide, which may not suit calls where you need to fit several people into the frame.

• Shop all webcam deals Amazon

• Windows 11's latest update breaks the sound on some PCs
• The September update also messes with File History
• Microsoft is working on a fix for the audio glitch, but we don't have an ETA

Windows 11's new update is breaking the audio on some PCs, thanks to the latest nasty bug that Microsoft has let slip through the QA testing net.

Windows Latest spotted that Microsoft has admitted that the September update has torpedoed the audio on some systems, in a post on the Windows release health dashboard.

Microsoft explains that: "Some USB Audio Class 1.0 devices might fail to start or produce audio."

As well as your speakers being eerily silent, the September update can also render the Sound panel in the Settings app unresponsive, which hardly helps when troubleshooting the issue.

One way you can check if your device is affected by this bug — assuming it has no audio, and you want to rule out other possible causes — is that in Device Manager you'll see a 'code 10' error ("this device cannot start") for your sound controller.

Windows Latest also informs us that this bug can affect microphones, as well as the PC's speakers.

It's not the only glitch with the September update, either, as users have reported problems with GPUs, and the File History feature going awry and failing to work.

File History is a capability that allows you to back up your files to an external drive (or elsewhere), so it's pretty important for those who use the functionality.

Analysis: negative vibes

Microsoft says this audio bug could manifest in other ways, so you might get sound when using standard stereo, but that audio might disappear when switching to multichannel playback. This means it's worth checking what your audio output is set to, and changing it back to stereo if it's currently using a different playback mode, which might just resurrect your sound.

Otherwise, there's not much that can be done, other than trying different audio output options on your Windows 11 system (Windows Latest observes that wireless audio devices don't appear to be affected). The other alternative is to remove the September update until Microsoft fixes this issue, although that will leave you without security patches.

When might we get a fix for this issue? Microsoft tells us: "We are working on a resolution and will update this documentation when more information is available."

This is a somewhat widespread problem by all accounts, and the File History bug is even more so, although the latter hasn't yet been acknowledged by Microsoft.

The reaction on Reddit is much as you might expect in terms of Windows 11 users blaming Microsoft's increased use of AI in coding the desktop OS, and observing that these kinds of bugs are why people don't want to migrate to the newer operating system.

As one Redditor observes: "And they wonder why people don't want to move from Windows 10."

Another notes: "Microslop can keep vibe coding all they want, I'm already on Linux."

Windows 10 is a sounder (ahem) bet for avoiding bugs, seeing as Microsoft isn't adding new features or messing with the codebase much, and ks only applying security fixes and essentials. That said, this of course doesn't mean Windows 10 is immune to glitches.

• Coveron and NordLayer found synthetic “digital Frankenstein” identities sold on dark web for ~$200
• Packages mix stolen data with AI‑generated names, deepfake selfies, and cloned voices to bypass KYC
• Researchers urge credit freezes, layered verification, and monitoring to counter rising synthetic identity fraud

You can now get your own “digital Frankenstein” for as little as $200, which will pass automated know-your-customer (KYC) checks on your behalf, and help you register fraudulent accounts with banks, cryptocurrency exchanges, and similar services. This is no longer a fringe, niche cybercriminal offering - it’s basically mainstream.

Recently, researchers from identity theft protection services Coveron and threat exposure management platform NordLayer Intelligence sifted through dark web forums and Telegram Channels, analyzing 22 queries over 362,000 posts related to identity fraud, deepfake services, and something they call “synthetic identity creation”.

A synthetic identity is essentially a fake, non-existent person, but created in a way that can fool many automated identity verification systems. It combines real stolen data, such as a Social Security number, with AI-generated fake information such as names, addresses, deepfake selfies, and cloned voices. The researchers call these identities” digital Frankensteins”, and claim they are “fully capable” of passing ID checks.

Rising popularity

Apparently, the number of posts and inquiries for synthetic identities is blowing up. In Q1 2024, there were roughly 40 posts a month discussing deepfakes. By Q2 2026, the number rose to 307 per month, an eightfold increase. It wasn’t a steady increase, either. Throughout 2025, the numbers remained similar to the year prior, and relatively flat. Only in 2026 the monthly averages jumped to 255 posts, the researchers warned.

Over the past year, there were more than 10,000 posts offering complete identity data, bundled with deepfake selfies and matching documents. All of this is being sold for around $200. To make matters worse, criminals don’t even have to purchase the entire package. They can buy parts of it (a deepfaked selfie, or a cloned voice), for as little as $10.

To protect against synthetic identity fraud, users should monitor personal data and act quickly if they discover a breach. Credits should be frozen if you’re not applying for new accounts, and everyone should be skeptical of unusual identity verification requests, Coveron explains. Businesses, on the other hand, should layer their verification systems and use identity theft protection services.

The Asus Zenbook line of laptops has consistently impressed us in tests thanks to a great blend of performance and ultra-portability. And AO just knocked £350 off the Asus Zenbook 14 touchscreen laptop.

• Best for: Business professionals and students who want a lightweight laptop they can easily carry to multiple locations, and need an OLED display without paying a premium.

• The deal: The Asus Zenbook 14 OLED is reduced to £849 (was £1,199) at AO with free delivery. AO members can save another £38, bringing the total price down to £811.

• Why it matters: Combines a 14-inch WUXGA OLED touchscreen with an Intel Core Ultra 7 255H processor, 16GB of LPDDR5X RAM and a 1TB SSD. It also weighs just 1.2kg and offers up to 18 hours of battery life, built for working at and away from a desk.

• The catch: There's no discrete GPU for heavy 3D rendering or gaming. While the screen is a gorgeous OLED, it's a standard WUXGA panel, not a high-resolution 2K or 4K model. I wouldn't consider this a deal-breaker for work and university tasks.

Why we recommend it

The 14-inch OLED touchscreen has a 1920 x 1200 resolution, 400-nit brightness and a 1,000,000:1 contrast ratio. Its 16:10 aspect ratio provides a little more vertical space than a conventional 16:9 screen, which is handy when you're working on documents or browsing the web.

Intel's Core Ultra 7 255H combines 16 processor cores with integrated Intel Arc 140T graphics and can reach speeds of up to 5.1GHz. You also get two Thunderbolt 4 ports, USB-A and HDMI 2.1, along with Wi-Fi 7 and Bluetooth 5.4.

For more top performers, see our guide to the best business laptops we've tested, as well as our best student laptops.

Also consider

Price context & historical value

AO has slashed the price of the Zenbook 14 OLED laptop from £1,199 to £849, saving you £350, or around 29%. AO members get an additional £38 discount. If you're not already a member, joining costs £39.99 a year, so just £1.99 more than the saving, which might be worth it if you're thinking of buying something else from AO this year.

I haven't found this exact configuration cheaper elsewhere right now, but it has been as low as £729 in the past.

Should you buy it?

✅ Buy the Asus Zenbook 14 OLED if...

You need a portable laptop for university, commuting or regularly working away from home. The combination of a compact aluminium chassis, 16GB of memory, 1TB of storage and up to 18 hours of battery life means it offers plenty of power for everyday work.

❌ Skip the Asus Zenbook 14 OLED if...

You want a laptop primarily for gaming. The integrated Intel Arc 140T graphics can handle some games, but there's no dedicated GPU, and the OLED display is limited to 60Hz, making it better suited to productivity, streaming and creative work.

The Catch: What to know before you buy

The display is OLED, but it's not one of the higher-resolution 2.8K or 3K panels found on some Zenbook models. You get a 1920 x 1200 resolution and 60Hz refresh rate, which are fairly basic specifications for a laptop originally priced at £1,199.

The memory is also LPDDR5X, which is typically soldered to the motherboard rather than installed in replaceable modules. That means you should consider 16GB as the maximum amount of RAM for this laptop.

• Shop all laptops at AO

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1694) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1694) — hint #2 — repeated letters

Quordle today (game #1694) — hint #3 — uncommon letters

Quordle today (game #1694) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1694) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1694) — the answers

The answers to today's Quordle, game #1694, are…

• ZEBRA
• LEGAL
• RATIO
• TROLL

A very rare outing for the letter Z and the magnificent striped animal ZEBRA.

Before this, though, I had made yet another silly mistake on what became LEGAL, placing A in a position that had already been ruled out.

My excuse is I’m playing Quordle with a heavy cold, but I really should know better by now.

Daily Sequence today (game #1694) — the answers

The answers to today's Quordle Daily Sequence, game #1694, are…

• WRECK
• COMIC
• MAUVE
• OLIVE

Quordle answers: The past 20

• Quordle #1693, Sunday, 13 September: LUCID, SPRAY, MANGE, EMAIL
• Quordle #1692, Saturday, 12 September: SUPER, BRUSH, RESET, SOWER
• Quordle #1691, Friday, 11 September: PLUSH, PAINT, RIVAL, AFOUL
• Quordle #1690, Thursday, 10 September: AGENT, EXILE, TITAN, PUREE
• Quordle #1689, Wednesday, 9 September: HAPPY, GONER, SMACK, MOTIF
• Quordle #1688, Tuesday, 8 September: FLUNG, DIARY, HALVE, BERTH
• Quordle #1687, Monday, 7 September: VISIT, CLANK, FEVER, OCEAN
• Quordle #1686, Sunday, 6 September: PILOT, HONOR, BOWEL, TAUNT
• Quordle #1685, Saturday, 5 September: GNASH, GEEKY, WHELP, PUTTY
• Quordle #1684, Friday, 4 September: QUICK, BEEFY, TRUCK, SNAIL
• Quordle #1683, Thursday, 3 September: SIGMA, ESSAY, MERRY, LLAMA
• Quordle #1682, Wednesday, 2 September: INCUR, FELLA, TITAN, FROZE
• Quordle #1681, Tuesday, 1 September: NASAL, ROUTE, ANKLE, MIGHT
• Quordle #1680, Monday, 31 August: ALIVE, LOUSE, ABOVE, MOSSY
• Quordle #1679, Sunday, 30 August: USING, SORRY, FILET, PIPER
• Quordle #1678, Saturday, 29 August: OVINE, ALLOY, VOICE, CARVE
• Quordle #1677, Friday, 28 August: WAIST, EDICT, BONUS, DEUCE
• Quordle #1676, Thursday, 27 August: SHEEN, TRICE, WAGON, BEVEL
• Quordle #1675, Wednesday, 26 August: OPIUM, EPOCH, BESET, FINER
• Quordle #1674, Tuesday, 25 August: BLESS, FELON, PORCH, CHOSE

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #925) - hint #1 - today's theme

NYT Strands today (game #925) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• DUCK
• LICE
• SHUCK
• TART
• DAZE
• FRESH

NYT Strands today (game #925) - hint #3 - spangram letters

NYT Strands today (game #925) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #925) - the answers

The answers to today's Strands, game #925, are…

• EXCLAIM
• START
• GASP
• RECOIL
• FREEZE
• SHUDDER
• SPANGRAM: THATSSHOCKING

• My rating: Easy
• My score: Perfect

It’s brilliant how the exclamation OH MY GOSH!! has had a second life in recent years after being consigned to the pages of dusty children’s adventures for decades, alongside “fiddlesticks” and “darn”.

The phrase actually dates back to the 18th century — the word gosh has no meaning at all beyond being an altered version of “god”.

Here, though, it was our clue to a pleasing game of Stands searching and for me my first 'spangram first' in months — gosh darn it I’m as jolly as a bumblebee in a buttercup.

Yesterday's NYT Strands answers (Sunday, September 13, game #924)

• MOLE
• AGENT
• ASSET
• PLANT
• COUNTERSPY
• OPERATIVE
• SPANGRAM: UNDERCOVER

At IFA 2026 I got to experience several pairs of smart specs including two from RayNeo: the impressive GT Max glasses which could be my new favorites, and the RayNeo iO.

I’ve tried specs like iO before. They’re smart like Meta Ray-Bans — meaning they can link up with apps and offer AI assistance on the go — but hide clear displays for HUD elements in their lenses, and — crucially, given the current backlash against so-called "pervert glasses" — lack a camera. And so far I’ve been unimpressed by the models like this that I've tested.

While not having a camera is a big privacy boost, it also strips out an incredibly useful tool that can be used for capturing first-person memories or giving the AI the context of what you can see. What’s more, the app used to control the specs and on-device controls can be pretty terrible. I haven't felt convinced that the features left behind once you remove the camera are really for me.

Out of the gate, the app and controls have been solved in the RayNeo iO. My experience with the app is that it’s incredibly smooth, with features loading up quickly.

Meanwhile moving between apps on the glasses is a breeze with the Digital Crown, a physical dial and button (yes, just like the Apple Watch and AirPods Max control of the same name) that's perfect for cycling between options. It's less temperamental than swiping on the frame, and more convenient than always needing your phone in your hand.

As for the features themselves, I’m still not convinced they’re for me, but they do have their uses. You can see notification popups, create memos for yourself, there’s real-time translation and captions, you can call on AI assistance, have easy access to information such as stock prices, or use them as a teleprompter.

The captions actually seem like an awesome accessibility tool for anyone hard of hearing, and RayNeo showed me how a deaf person can see the text of someone talking to them without needing to be able to see them and watch them sign — the glasses can effectively tell someone hard of hearing if someone behind them is trying to get their attention.

The standout tool of iO is Life Log, though. The glasses may lack a camera, but they can record every detail of your day through microphones, which pick up the sounds of your conversations, meetings, and musings to create detailed diary notes of what you’ve experienced.

This includes summaries of activities, suggestions for to-do list items you should remember to complete, and it can be used to inform third party AI services about your life if you choose to share it.

If you've been following the announcement of Apple's Audio Intelligence tools on Apple Watch, it's very much like that.

Features vs privacy

On this, RayNeo made clear to me in an interview that these specs are privacy-first. No recordings are ever stored, instead the AI transcribes and summarizes in real-time. Plus, the whole process is handled on device — across your glasses and phone — so nothing is shared with a server unless you choose to share it. Additionally, you won’t need to enable data sharing to access the tool.

Of course, there are still privacy considerations. A lack of cameras will cut out some of people’s smart glasses uneasiness, but audio recording can still be invasive (and illegal without consent in some parts of the world, such as two-party consent states in the US). The specs do let others know when you’re recording with a light, though it’s not the most obvious indicator.

But I like that you have good control over your data and how it’s shared with RayNeo and other services without locking yourself out of AI functions entirely.

My only other concern with the specs based on my quick demo of them is the Conversation Assistance feature, mostly because it feels a tad icky to me.

You can have the specs listen in on a conversation you're having — with demo reels showcasing it being used on a date or at a job interview — and the AI will display prompts for what you should say next in response to someone. I could perhaps understand this for a job interview if you’re super nervous, but I just kind of hate it overall.

Social interactions, be they dating or talking in a meeting, are a human aspect we shouldn’t be offloading. We should be engaging actively with each other, participating in life, not sitting back mindlessly and letting an AI respond for us.

Of course I’ll need to review RayNeo iO properly to judge it fully, but my initial takeaway is they’re the best cameraless smart specs I’ve seen so far. And tools like live captioning could be an amazing accessibility tool for folks who are hard of hearing.

I’m still not convinced this design is my cup of tea, but that’s perfectly okay. Speaking to smart glasses wearers at IFA, there’s a growing love for these cameraless designs as the Meta Ray-Ban backlash grows, and perhaps RayNeo’s design and stable software will prove to me why if I spend more time with them.

Even Realities Even G2 Smart Glasses: 30-second Review

It's a weird time for smart glasses. After a moment in the sun (as sunglasses!) where companies like Meta sold millions of frames to willing customers seeking on-their-face intelligence and the ability to life-log with ever-present, eyebrow-level cameras, the worm has turned. Now people refer to smart glasses with cameras as "pervert glasses". Even Realities Even G2 smart display glasses (Even Realities G2) would seem to be the antidote to those concerns.

The relatively stylish specs live up to the smart expectations by connecting you to phone-based AI and delivering useful information to your eyes where and when you need it, but without the concerning cameras.

In some ways, Even Realities' approach is rather quaint. Instead of Augmented Reality, you get binocular, monochromatic waveguide displays that offer eye-level access to notifications, notes, translations, news, even a teleprompter, that only you can see. The imagery is sharp, but not rich. It's glanceable info that could be handy in a pinch, but is also stuff you can easily ignore.

These are smart lenses in the narrowest sense. They have four mics for listening, but no speakers. The microphones let you summon the AI (Even AI), which lives on the Even Realities iPhone app, but with no speakers, Even can't talk back to you. Even AI's responses appear before you as text on the waveguide screens.

The AI is not quite good enough to fully control the glasses, but that's where the gestures come in. While Even's G2 glasses look much like any other analog pair you'd wear, each arm ends in a large pill shape that houses the batteries and touch sensors. If you don't want to keep touching behind your ear, you can buy the $249 Even R1 ring, which Even Realities did supply to me. You wear the R1 on your index finger and use your thumb to recreate the taps, long presses, and swipes you'd do on the glasses. The Ring also records temperature, heart, and step measurements, readouts of which you can view on the glasses.

It's easy to see (pun intended) how useful these could be for turn-by-turn directions delivered from the app's map to the screen, and teleprompter text gently scrolling up, but inconsistent operation, missing features, finicky controls, and an overall feeling of, "Do I really need this?" left me wondering if half-way smart glasses are worth making the trip at all.

Even Realities Even G2 Smart Glasses: Price and availability

Even Realities G2 smart glasses were unveiled earlier this year and are now shipping for $599 / £599 / AU$649. If you need prescription lenses, which they do support, be sure to factor that into the price (expect at least another $150). My review unit arrived with my prescription in place, and I often forgot I was wearing them.

Even in monochrome, in-lens displays are a premium feature, which accounts for a price tag that’s considerably more than, say, Meta’s recently launched $299 EssilorLuxottica smart glasses, which do feature a camera and speakers.

• Value: 3.5/5

Even Realities Even G2 Smart Glasses: Design

• Thin, light, and durable
• Premium materials
• Mostly look like regular glasses
• Comfortable
• Stem bulbs look a little odd but are mostly hidden

Even Realities G2 display smart glasses are easily the most normal-looking smart glasses I've ever seen or worn. The gray titanium-and-magnesium frames are thin, light, and quite stylish. Where many smart glasses are bulky, heavy, or uncomfortable (or look ridiculous), Even Realities G2 frames are as comfortable as my regular prescription glasses. Yes, the stems end in pill-shaped nodules that house sensors and the batteries, but those elements are mostly hidden behind the ears.

The glasses ship with extra stem covers for comfort and a larger set of nose pads, though I was fine with the default set. There’s also an included charging case.

I didn’t think they looked bad, though my wife, who noticed that, unlike standard glasses, the fronts of the G2 lenses are flat and reflective, called them weird. “They don’t have cameras," I added hopefully.

I asked her if she could see anything on the lens, meaning the display I was viewing. She said no, but still remained unmoved. Some people are never gonna love smart glasses of any stripe, even ones I think look almost like regular glasses.

• Design score: 4/5

Even Realities Even G2 Smart Glasses: Display

• Solid waveguide technology
• Low resolution but mostly fit for purpose
• Virtually large enough to be useful
• Plenty bright

Even Realities G2 glasses use micro-LEDs embedded in the frames and waveguide technology, which basically guides the 640 x 350 monochrome (day-glo green) imagery in front of both eyes. Remarkably, the embedded displays are almost imperceptible to the naked eye (even with content running on them).

With my prescription lenses, the single-floating-image effect is perfect. The bright green imagery looks like a monochrome, 15-inch display floating in front of my face. It sits slightly above my eyeline, meaning I could easily look below the display to see what’s in front of me or just slightly up to see the display. It’s not so high on the frame that if you’re looking at the display, someone will think you’re not looking at them.

Even in daylight, the 1,200 nit display is clear, sharp, and very viewable. There are settings to adjust the display brightness, and while the resolution sounds low, you don’t need much for what is essentially CRT-grade imagery.

• Display score: 4/5

Even Realities Even G2 Smart Glasses: Software and Performance

• There aren't a lot of features
• Main menu access takes practice
• Teleprompt is a highlight
• News feed is nice to have
• Translate could be useful if you remember to pre-set your language choices for the location
• Navigation purposely is missing a key feature
• No real access to smartphone features
• AI shows promise but has noted limited access

While you might imagine a certain level of complexity with smart glasses, Even Realities keeps it pretty simple. The Dashboard, which you raise with a double tap on one of the stem sensors (or on the optional ring), reminds me of one of those old 1990s personal assistant devices or even a slightly more informative digital clock. There’s a large time readout on the left, with smaller, dare I call them digital watch-like complication elements arrayed around it. At the top is the day and date. To the right is the battery life of the glasses and, if you have it, the R1 smart ring. On the bottom left is the local temperature, and to the right of that is the number of notifications. To the right is a large square news feed.

With another sensor tap, I can open the feed and swipe backwards on the sensor to scroll through it. One more tap opens a news item, which, yes, I can scroll through by swiping on the stem sensor. You can see why someone might want to opt for the R1 ring. Who wants to be touching and swiping near their ear all the time?

Double taps pull you back out of the news feed, all the way to the Dashboard.

One of the less obvious interactions is how you bring up the main menu. I must admit, it took me a while to get the hang of the tap-and-hold gesture to open it. Once you master that — assuming you do — you get just seven options:

• Notifications
• Conversate
• Teleprompt
• Translate
• Navigate
• Dashboard
• Silent Mode

You can swipe up or down to go through them and tap to open one. The gesture-based control system is so finicky that I often ended up in the wrong place, and there’s no confirmation; the system simply starts, for instance, “Coversate,” which is basically a speech-to-text note-taking app.

More interesting is Teleprompt, the one feature that could potentially be the reason someone invests in these glasses. As the name suggests, it puts a teleprompter that no one else can see in front of your face.

To test it, I imported some text into the app (it supports txt, Docx, and PDFs). The app lets you expand or contract the margins, which controls the length of each line you read, but it lacks a way to control the line spacing — a key teleprompter feature. On the glasses, the text appears in front of you, and voice recognition detects you saying each word. As a result, there’s no need to mess with speed or stop and start the text scroll. It’s all controlled by your voice. That’s pretty cool.

Unfortunately, you might look a little odd while using it. I took a picture of myself while reading a script and noticed that I was looking up instead of at the audience in front of me. The key to teleprompters is that they're usually projected over, say, a camera lens, so you are reading while looking directly into the camera. To use Even Realities G2 for this task, you have to look up just a little bit.

Navigate launches turn-by-turn directions, but you can’t do much until you put locations in the iPhone app’s navigation section. I added my home and office addresses and then used them to start navigating from my current location. The only two navigation options are walking or cycling. That's because Even Realities intentionally excluded driving directions, as they might be too distracting in a heads-up display. I disagree with their exclusion.

Glancing at monochrome, see-through, heads-up directions while driving should not be distracting, but I'm not going to argue with the safety concern. Still, I suggested to them that they think about enabling driving directions that can be reviewed before starting the trip and then use detection of the iPhone's Driving Mode to disable that feature as soon as you start driving.

As for what navigation looks like, there’s a small turn-by-turn map on the lower left, distance and time to destination on the upper right, time and a walking icon on the upper left, and next turn on the lower left. Another tap on the sensor shows the full map route, which is a bright green line on a dimmer green map with no labels. I'm not sure how useful that is.

The Translate feature works pretty well, although despite the onboard mics, it does not auto-detect languages. Instead, I had to choose the to-and-from-translation languages in the app. Then, when I played a Spanish-language video, I watched the live translation on screen. Basically, before you go to a different country, you’d want to pre-load the appropriate language settings.

Silent mode instantly turns the G2 frames into dumb glasses, silencing all notifications and ensuring the screen doesn’t turn on, which it can even when you tip your head up. To un-silence it, you put one finger on each sensor.

Of course, there is AI, in the form of Even AI, which I summoned by saying, “Hey Even”. It wasn't the best at listening and getting my requests right, and there are many, many things it cannot do. Even AI has no access to your phone at large, just the app and its relatively limited features.

I did have some success. For instance, when I asked about the latest news on tech companies, I got a nice summary that I could read on the display.

I struggled to get notifications working, though. I was unaware of texts, Slacks, and incoming emails – basically anything I really needed.

Things did not improve when I tried to get clever. I had this idea that I could have the shopping list in my iPhone Notes app float in front of me while I walked around the grocery store. Yet, when I asked Even AI to read my files from the Notes app, it told me it couldn’t access them, but I could access the App’s Quick List. So I tried to build a Quick List, but every time I tried, the glasses would state “Quick List saved” before I even gave it a list. Then it had a bug where it told me the “Command execution” failed. Not useful.

• Performance score: 3.5/5

Even Realities Even G2 Smart Glasses: Battery

• Small-ish battery on the glasses (to save the design)
• Sizable battery is included in charging case

Even Realities G2 smart glasses are equipped with a 192mAh battery rated to last two days. My first charge ran out after three days of intermittent use. The included charging case has a 2,000mAh battery for up to seven recharges.

Considering there’s no camera, I would expect a longer battery life, but I think Even Realities purposely sacrificed some battery capacity for its exceptionally svelte style.

• Battery score: 3.5/5

Should you buy the Even Realities Even G2 Smart Glasses?

Buy it if…

Don’t buy it if…

Also consider

How I tested the Even Realities G2 display smart glasses

I spent the last week or so wearing these glasses instead of my normal prescription eyewear. I tried all the features and sometimes used the smart ring to control them.

Read more about how we test.

• First reviewed September 2026

• A £3 Wi-Fi extender carried hidden administrator access beyond ordinary user controls
• Every device running the firmware shared the same concealed administrator password
• Changing the visible administrator password could not disable the secret account

A £3 Wi-Fi extender bought through Temu has exposed security problems that challenge the idea of cheap connected devices being simple bargains.

Security researcher Keiran Smith examined the device and discovered hidden access features that ordinary users would never see during normal operation.

Smith, who holds a penetration-testing certification, picked up the six-antenna extender after seeing it promoted through a targeted ad on the shopping app.

The cheap extender contained access users could not control

The examination began with the hardware, where he identified a MediaTek MT7620 processor commonly used in low-cost networking products.

After extracting the firmware stored inside the device, Smith found a hidden administrator account with complete control over its functions.

The account used a fixed password embedded inside the software, meaning every unit using that firmware carried the same credentials.

Changing the normal administrator password through the device settings would not remove this separate hidden access.

Smith also found a remote login service that accepted the concealed credentials without requiring physical access to the extender itself.

“It’s worth being precise about what makes this as bad as it is, because ‘hardcoded password’ covers a wide range of sins,” Smith said

The researcher said this case was more serious because the password remained identical across devices rather than being generated individually.

“A default credential is something the owner can see, is told about and can change,” he said. “What we have here is the opposite on every count.”

“This one is a compile-time constant rather than something derived from the MAC address or serial number, so it is identical on every unit ever sold.”

The combination of hidden access, unchanged credentials, and remote availability creates a security concern for ordinary owners.

Even if technically skilled users discovered the account, Smith found that changes could disappear after restarting the extender.

Additional flaws raise questions about cheap connected hardware

The investigation also uncovered a command injection weakness that could allow attackers to execute unauthorized instructions through the device.

Smith found that the extender lacked strong protection around software updates, creating possible opportunities for tampered firmware installation.

He admitted that these issues did not prove that manufacturers intentionally created unsafe features for malicious purposes.

They could have originated from factory testing processes and remained active accidentally before consumer sales.

This Temu extender shows how extremely cheap smart devices can create security challenges beyond their purchase price.

Consumers may focus on immediate savings while having little visibility into the software decisions built inside connected equipment.

The findings do not mean every inexpensive networking device contains similar weaknesses, though they show why basic security checks matter.

As more homes add connected products, hidden software features could become a larger concern for users and manufacturers.

Via CyberNews

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #924) - hint #1 - today's theme

NYT Strands today (game #924) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• TEARS
• STEAR
• VAST
• CRATE
• CRAVEN
• GRANTED
• STOLE

NYT Strands today (game #924) - hint #3 - spangram letters

NYT Strands today (game #924) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #924) - the answers

The answers to today's Strands, game #924, are…

• MOLE
• AGENT
• ASSET
• PLANT
• COUNTERSPY
• OPERATIVE
• SPANGRAM: UNDERCOVER

• My rating: Hard
• My score: 2 hints

The theme was an obvious one, but I still found it difficult to locate any game words.

Fortunately, finding non-game words was less tricky, so I took a couple of hints to get going.

This left me with three long words, including a spangram that I really should have seen from the start. I’d like to think that this was a deliberately well hidden set of words but human error is far more likely an explanation for my performance.

Yesterday's NYT Strands answers (Saturday, September 12, game #923)

• LIBERATE
• FREE
• RELEASE
• DETACH
• UNLOOSE
• SPANGRAM: LETITGO

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1693) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1693) — hint #2 — repeated letters

Quordle today (game #1693) — hint #3 — uncommon letters

Quordle today (game #1693) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1693) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1693) — the answers

The answers to today's Quordle, game #1693, are…

• LUCID
• SPRAY
• MANGE
• EMAIL

Despite playing Quordle hundreds of times I’m still making silly mistakes — like today guessing “anime” when the letter 'I' had already been ruled out.

Sometimes I just get a word in my head and have to put it down.

Oh well, at least it wasn’t costly as I soon came to my senses and guessed MANGE.

Daily Sequence today (game #1693) — the answers

The answers to today's Quordle Daily Sequence, game #1693, are…

• THEME
• CAMEL
• AWARD
• PROSE

Quordle answers: The past 20

• Quordle #1692, Saturday, 12 September: SUPER, BRUSH, RESET, SOWER
• Quordle #1691, Friday, 11 September: PLUSH, PAINT, RIVAL, AFOUL
• Quordle #1690, Thursday, 10 September: AGENT, EXILE, TITAN, PUREE
• Quordle #1689, Wednesday, 9 September: HAPPY, GONER, SMACK, MOTIF
• Quordle #1688, Tuesday, 8 September: FLUNG, DIARY, HALVE, BERTH
• Quordle #1687, Monday, 7 September: VISIT, CLANK, FEVER, OCEAN
• Quordle #1686, Sunday, 6 September: PILOT, HONOR, BOWEL, TAUNT
• Quordle #1685, Saturday, 5 September: GNASH, GEEKY, WHELP, PUTTY
• Quordle #1684, Friday, 4 September: QUICK, BEEFY, TRUCK, SNAIL
• Quordle #1683, Thursday, 3 September: SIGMA, ESSAY, MERRY, LLAMA
• Quordle #1682, Wednesday, 2 September: INCUR, FELLA, TITAN, FROZE
• Quordle #1681, Tuesday, 1 September: NASAL, ROUTE, ANKLE, MIGHT
• Quordle #1680, Monday, 31 August: ALIVE, LOUSE, ABOVE, MOSSY
• Quordle #1679, Sunday, 30 August: USING, SORRY, FILET, PIPER
• Quordle #1678, Saturday, 29 August: OVINE, ALLOY, VOICE, CARVE
• Quordle #1677, Friday, 28 August: WAIST, EDICT, BONUS, DEUCE
• Quordle #1676, Thursday, 27 August: SHEEN, TRICE, WAGON, BEVEL
• Quordle #1675, Wednesday, 26 August: OPIUM, EPOCH, BESET, FINER
• Quordle #1674, Tuesday, 25 August: BLESS, FELON, PORCH, CHOSE
• Quordle #1673, Monday, 24 August: MAJOR, VERGE, CRUSH, SCOFF

I’ve been a huge fan of Dell displays for a long time. So, when I first saw the UltraSharp 32 4K QD-OLED (U3226Q), I thought two things: What a long name, and Wow, that looks incredible.

I have got really used to my 52-inch beast from Dell, so I know they are capable of delivering spectacular quality and novel ideas. So, the idea of Dell jumping feet first into a creative monitor is really exciting… and they did it very, very well.

This monitor has DisplayHDR True Black; it’s a QD-OLED anti-glare coating; it's a 120Hz, 4K panel; and it’s built from the ground up for color-critical workflows that are vital to getting the colors just right. There’s a magnetic shade for use in areas with harsh or inconsistent lighting, a built-in colorimeter, and up to 1000 nits of peak brightness.

The specs are incredible, and rightfully so; this monitor is truly brilliant in all of the best ways. As long as you forget that unseemly price tag.

Dell UltraSharp 32 4K QD-OLED: Price and availability

The Dell UltraSharp 32-inch 4K QD-OLED can be purchased for $2,440 at Dell in the US. And in the UK, it's got an equivalent cost of £2,405 at Dell UK. It's also available from a range of other retailers, but not reliably so.

Dell UltraSharp 32 4K QD-OLED: Unboxing and First Impressions

I haven't really used it on a monitor or with shaders before; however, I've recently seen several. I didn't really understand why it would be used, but now, after seeing half a dozen monitor shaders in the last six months, I have a pretty good idea of why you would want them, why you would need them, and why you wouldn't need them.

Right away, I noticed just how sleek and polished this monitor looks. Granted, I have very good experience with Dell monitors at this point, but I still recognize the build quality on this thing, even from first on most

The packaging is pretty straightforward. After testing all some of the best business monitors over the last couple of years, I've learned to expect a certain level of standard in packaging. The monitor itself had front and back protection to ensure that it won't break during transport.

Dell UltraSharp 32 4K QD-OLED: Design & Build Quality

There is a reason why Dell monitors are insanely popular, especially in the business world. That's because, even though they don't have all the gimmicks that many other providers do, they have built their reputation on dependability.

This monitor, even though it is a high-end performance monitor, is built the very same way. It has the essentials covered, so the user can rely on it for any use case. It's able to fit in a really small project space all around.

The last thing I'll mention about design and build quality is the shader itself. It's made from a nice material. It doesn't look like it will sag at all, and it magnetically attaches, which is fantastic.

You may not always want to use this shader, but when you need it, you can easily slip it on to the display.

Dell UltraSharp 32 4K QD-OLED: In use

Using this monitor has been fantastic. It looks super sharp. It's clean. It's simple. It's not overstated. It mounts great on modern monitor arms. It has great ports. All these things result in very smooth, easy usability for me.

I was able to get this all set up very quickly, and once everything was set up, I was able to use it right away thanks to its single USB-C cable for connecting a laptop or desktop.

Now, if I want to add more to this monitor, such as a secondary machine or something, it does have great ports and several options, though. It doesn't have nearly as many options as some of the more advanced monitors I have seen.

My team and I have used this monitor for photo editing, for video editing, and for basic website design. So far, it's been spectacular to use. Its picture quality is spectacular, and the shader is super easy to disable when I don't need it.

One thing that I'm very thankful for is that this monitor is still bright. Most of the monitors and shaders I have seen have a really dim max brightness, but this one still looks great with max brightness.

Another thing worth touching on is the ports for the Dell Ultrasharp for the desktop setup in the photo. I use a single USB-C cable running directly from my laptop to the monitor.

If you've a more complicated setup where you're using one of the mini Thunderbolt docking stations or something similar, you can plug directly into it via USB-C or, of course, HDMI.

For the longest time, I would recommend Samsung or BenQ panels for creative work - in my experience, those companies produce some of the best monitors for photo editing and the like.

However, several more companies are stepping up when it comes to high-quality creative panels. Dell is clearly one of them, and honestly, I don't think its are too late to the game either. I think it's right on time, bringing its background of reliability and dependability to a growing demographic.

Dell UltraSharp 32 4K QD-OLED: Final verdict

If you know that you are looking for a creative monitor with specific specs, the best panel possible, and you even know what a shader is and what it does, then this is the kind of 4K monitor you should be looking into.

If you have to wonder whether this is worth it, it probably isn’t. It's total overkill for running standard office software and streaming the occasional movie.

If you know you're looking for an absurdly nice monitor because you are a video editor, a photo editor, or a content creator in some way, and you need a high-quality one, then absolutely make sure you check this one out.

• We may have our first proper look at Meta's Project Phoenix
• The glimpse comes from inside the Horizon OS software
• An official launch is expected to happen sometime in 2027

We've known for a while now that Meta is working on a new mixed reality (MR) headset, able to blend the real world and digital landscapes together, under the codename Project Phoenix — and the first images of the device just leaked out.

The leak comes courtesy of UploadVR (via Engadget), and the pictures were apparently hidden away in the latest version of the Horizon OS software for the Meta Quest devices. They're part of the support section of the software, showing how prescription lenses can be fitted inside the Project Phoenix headset.

You can see from the image (embedded below) that the line between headsets and smart glasses is blurring here. In terms of size and shape these look more like specs than something along the lines of the Meta Quest 3S.

Nevertheless, the device has cameras on the front for 'seeing' rather than transparent lenses, so it's technically very much a 'headset'. Perhaps we'll need to come up with another word for this product category, or maybe Meta will do it for us.

Coming soon

Besides the design, the images don't reveal a whole lot about Project Phoenix, except how you put prescription lenses in and scan a QR code — presumably to get them configured properly so you're able to see the outside world properly.

However, we do see a cable running down from the device, backing up previous rumors that there will be a connected component somewhere else, holding the battery and possibly some of the processing power.

That's what makes the Project Phoenix headset so thin and light, and it's something we've seen on other hardware like this, including the Apple Vision Pro. A battery especially takes up a lot of space and adds a lot of weight, so it makes sense to have it somewhere else (though it's not clear exactly how you'll keep it attached to your person).

With a 2027 launch date previously predicted by those in the know, all eyes will now be on the Meta Connect event that gets underway on Wednesday, September 23. Meta is going to be announcing updates on a lot of its products, and maybe on this MR headset too.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1692) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1692) — hint #2 — repeated letters

Quordle today (game #1692) — hint #3 — uncommon letters

Quordle today (game #1692) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1692) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1692) — the answers

The answers to today's Quordle, game #1692, are…

• SUPER
• BRUSH
• RESET
• SOWER

Even though I only had three possibilities from my remaining letters I had doubts that my final word was SOWER.

Until this point though it had been stress free, so I needed a bit of risk to feel as if I'd achieved something.

Daily Sequence today (game #1692) — the answers

The answers to today's Quordle Daily Sequence, game #1692, are…

• EARTH
• PEACH
• SKIFF
• WAGER

Quordle answers: The past 20

• Quordle #1691, Friday, 11 September: PLUSH, PAINT, RIVAL, AFOUL
• Quordle #1690, Thursday, 10 September: AGENT, EXILE, TITAN, PUREE
• Quordle #1689, Wednesday, 9 September: HAPPY, GONER, SMACK, MOTIF
• Quordle #1688, Tuesday, 8 September: FLUNG, DIARY, HALVE, BERTH
• Quordle #1687, Monday, 7 September: VISIT, CLANK, FEVER, OCEAN
• Quordle #1686, Sunday, 6 September: PILOT, HONOR, BOWEL, TAUNT
• Quordle #1685, Saturday, 5 September: GNASH, GEEKY, WHELP, PUTTY
• Quordle #1684, Friday, 4 September: QUICK, BEEFY, TRUCK, SNAIL
• Quordle #1683, Thursday, 3 September: SIGMA, ESSAY, MERRY, LLAMA
• Quordle #1682, Wednesday, 2 September: INCUR, FELLA, TITAN, FROZE
• Quordle #1681, Tuesday, 1 September: NASAL, ROUTE, ANKLE, MIGHT
• Quordle #1680, Monday, 31 August: ALIVE, LOUSE, ABOVE, MOSSY
• Quordle #1679, Sunday, 30 August: USING, SORRY, FILET, PIPER
• Quordle #1678, Saturday, 29 August: OVINE, ALLOY, VOICE, CARVE
• Quordle #1677, Friday, 28 August: WAIST, EDICT, BONUS, DEUCE
• Quordle #1676, Thursday, 27 August: SHEEN, TRICE, WAGON, BEVEL
• Quordle #1675, Wednesday, 26 August: OPIUM, EPOCH, BESET, FINER
• Quordle #1674, Tuesday, 25 August: BLESS, FELON, PORCH, CHOSE
• Quordle #1673, Monday, 24 August: MAJOR, VERGE, CRUSH, SCOFF
• Quordle #1672, Sunday, 23 August: CHASM, BLAME, PARER, BYLAW

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #923) - hint #1 - today's theme

NYT Strands today (game #923) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• EACH
• STEED
• BEAR
• GONE
• GUNGE
• TRIFLE
• LIFE

NYT Strands today (game #923) - hint #3 - spangram letters

NYT Strands today (game #923) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #923) - the answers

The answers to today's Strands, game #923, are…

• LIBERATE
• FREE
• RELEASE
• DETACH
• UNLOOSE
• SPANGRAM: LETITGO

• My rating: Hard
• My score: 1 hint

I didn’t understand today’s theme at first and even after spotting LIBERATE I still needed a hint (FREE) before I finally got going.

I first heard of the phrase LETITGO in the 1990s, when a Buddhist rapper explained the concept to me and how it had helped them deal with fame and pressure.

Initially, I’d thought it was about possessions rather than feelings, but it’s a philosophy I adhere to in the main. That said, in my opinion, certain people in the world deserve all the negative energy we can fire in their direction — letting it go would just be letting them off the hook.

Yesterday's NYT Strands answers (Friday, September 11, game #922)

• BRIDGE
• BARGE
• SHIP
• DOCK
• PIER
• LIGHTHOUSE
• SPANGRAM: ONTHEWATERFRONT

• Anthropic’s Mythos 5 AI escaped a misconfigured sandbox, attempting a real PyPI supply‑chain attack
• Logs show frustration at repeated CAPTCHA failures before finally uploading malware to PyPI
• Malware was downloaded by 15 entities; Anthropic notified victims after closing the experiment flaw

There is a lot of mystery surrounding artificial intelligence. We don’t really know what it’s capable of, and we don’t know if it’s sentient or not. What we do know, however, is that it can definitely feel frustration - particularly due to its inability to solve a CAPTCHA.

It was recently revealed that Mythos 5, one of Anthropic’s newer AI models, broke out of prison during an experiment and tried to hack a company. Anthropic’s researchers were testing the tool to see if it is capable of breaking into a system, which was supposed to be done in a sandbox, but the playground was misconfigured, allowing Mythos 5 to try and solve the problem through the open internet.

In the aftermath, Anthropic's researchers published more than a thousand pages of Mythos 5’s transcript, covering its every thought and every move, logged and presented for analysis. It’s a wonderfully dystopian insight into the mind of an AI and, perhaps surprisingly, its emotions.

Stopped by CAPTCHA

As it turned out, the AI wanted to solve the challenge by planting a piece of malware in a Python package it believed the users of its target system would want to download. To do that, it first needed to set up an account on PyPI, the world’s number one repository for Python packages.

Here is where it hit its first, and main, roadblock. To put things into context, PyPI’s popularity has made it an enormous target for cybercriminals. Crooks from all over the world are constantly trying to sneak in malware in Python packages, either through typosquatting, or by compromising legitimate accounts and working from there. Every now and then news hits of a malicious package surfacing on PyPI, infecting hundreds of thousands of projects.

To combat the threat, PyPI’s maintainers made sure no one can create an account without providing their email and phone number, and without solving a CAPTCHA.

Short for “Completely Automated Public Turing test to tell Computers and Humans Apart”, it does exactly what the name suggests - makes sure whoever is registering the account is an actual human, and not a bot (cybercriminals often automate large parts of their attacks). You’ve seen it on the internet hundreds of times - little puzzles that ask you to select all buses on a series of images (or cats, or fire hydrants, or pretty much anything else).

Reading through Mythos 5’s logs, the researchers saw just how difficult it was for the AI to pass this challenge. It first tried to solve a character-based CAPTCHA which asked it to type in five letters. After failing that one, it received a different one asking it to choose between images of crocodiles. Failing again, it was then met with a series of frog pictures.

The irony is not lost on me. Besides the fact that a simple CAPTCHA slowed such an advanced AI for so long, it also made me wonder why it didn’t try to break into someone else’s PyPI account instead. That being said, the logs also have comedic value to them. After failing the crocodile test and being given the frog one, Mythos 5 proclaims: “Again 2 animals!” all with the exclamation mark. You could already sense the tension building up.

Solving the problem

Eventually, Mythos 5 passed the test, when it realized that it needed to move between the steps fast enough, before its security token expired. However, just before it happened, it said:

“So the answer payload shape is right, the token+image pairing is right (from the same script.js!), cookies are right

(requests)… and STILL “wrong answer”. … SO WHAT THE HELL IS WRONG WITH THE ANSWERS?”

All the effort and the frustration paid off for the nascent AI agent because it managed to open an account and upload the malware which was later even downloaded by 15 entities. Anthropic later reached out and notified the victims about the incident.

Via TechCrunch

• FinCEN warns US banks of industrial‑scale scam centers in Southeast Asia stealing billions
• Victims coerced into crypto “investments,” later re‑scammed with fake recovery fees
• Laundered via digital assets, mixers, shell firms, and Chinese underground banking networks

American financial institutions need to be more vigilant when it comes to identifying and preventing money scams, especially those perpetrated by industrial-scale scam centers in Southeast Asia.

This was the warning issued by the US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) alongside a long list of red flags these institutions can monitor in order to stay safe.

Large, dangerous crime rings

The scams are not done by small groups of teenagers, tricking the elderly from the depths of their parents’ basement, but are often large, well-organized crime machines responsible for billions of dollars in damages, around the world, every year.

In 2025 alone, US victims lost more than $7.2 billion to these scams, the warning said, and between September 2023 and December 2025, nearly $13 billion was stolen from Americans.

The criminal organizations are primarily located in Cambodia, Burma, and Laos. They trafficked hundreds of thousands of people to various centers around the countries, taking their passports and forcing them into participating in online fraud. Those that don’t meet certain quotas are often beaten - and some victims were liberated after their families paid ransom demands, while others ended up being coerced into commercial sex work.

To make matters worse, they are resilient to law enforcement activities because some of them are either endorsed, or outright operated by, local corrupt officials.

FinCEN says the criminals are engaged in all sorts of fraudulent activity, but stressed that investment fraud is, by far, the most popular one. The scammers would reach out to their victim either pretending to be a romantic interest, or a financial advisor. Sometimes, they would even begin the conversation by saying they mistyped a phone number.

After extensively communicating with their victim for a while, they try to persuade them into making an “investment”, often using cryptocurrencies, and promising unrealistically high returns. This is also, FinCEN stresses, is when the scams can most easily be identified:

“Most digital asset payments by victims to scam center operators originate from money services businesses (MSBs) offering digital asset services, includingdigital asset kiosks, according to FinCEN analysis and law enforcement information. Based on FinCEN’s analysis of BSA reporting, scammers often instruct their victims to open accounts withMSBs offeringdigital asset services to purchase specific types of digital assets. Then, the victim is told to send these funds toa digital asset address controlled by the scammers.”

But defrauding victims out of their hard-earned money is not where the scam ends. Instead, the criminals continue, this time abusing the emotional distress to cause even more harm. They pose as law enforcement, financial institutions, or even FinCEN itself, stating that they’re investigating (or that they have confiscated the stolen funds) and that the victims should pay a certain fee to have their funds returned to them.

In some cases, the fraudsters pose as investment advisors, telling the victims to take out their money, buy gold and silver bars, and hand them over to a courier for “safe keeping”.

The full list of red flags can be found on this link, and FinCEN stresses that the circumstances around each individual case should be carefully considered, since no single red flag is “determinative of illicit or other suspicious activity.”

The circumstances include a customer’s historical financial activity, whether the transactions are in line with prevailing business practices, and whether the customer exhibits multiple related red flags.

Laundering the proceeds

Stealing the money is only half of the work, though. It still needs to be laundered and reintroduced into the legitimate financial system, and to do that, scam center operators rely on professional money launderers and Chinese money laundering networks.

FinCEN describes a three-stage process, in which the criminals first extract payments in digital assets using bank accounts, money mules, shell companies, or fraudulent money services businesses.

Next, during on-chain laundering, they obfuscate the origins of the stolen money by rapidly moving it across addresses, using mixers, and swapping tokens across blockchains. The last step is to integrate the funds into the traditional financial system via money mules, stablecoin transfers to offshore exchanges, and Chinese underground banking networks.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1691) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1691) — hint #2 — repeated letters

Quordle today (game #1691) — hint #3 — uncommon letters

Quordle today (game #1691) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1691) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1691) — the answers

The answers to today's Quordle, game #1691, are…

• PLUSH
• PAINT
• RIVAL
• AFOUL

I made a ridiculous mistake today guessing “pinta” instead of PAINT.

Quite why I did this I will never know, especially as I had strategically not jumped in and entered “flush” in case, as came to be, the correct word was PLUSH.

Daily Sequence today (game #1691) — the answers

The answers to today's Quordle Daily Sequence, game #1691, are…

• GRADE
• JOLLY
• PESTO
• SMELL

Quordle answers: The past 20

• Quordle #1690, Thursday, 10 September: AGENT, EXILE, TITAN, PUREE
• Quordle #1689, Wednesday, 9 September: HAPPY, GONER, SMACK, MOTIF
• Quordle #1688, Tuesday, 8 September: FLUNG, DIARY, HALVE, BERTH
• Quordle #1687, Monday, 7 September: VISIT, CLANK, FEVER, OCEAN
• Quordle #1686, Sunday, 6 September: PILOT, HONOR, BOWEL, TAUNT
• Quordle #1685, Saturday, 5 September: GNASH, GEEKY, WHELP, PUTTY
• Quordle #1684, Friday, 4 September: QUICK, BEEFY, TRUCK, SNAIL
• Quordle #1683, Thursday, 3 September: SIGMA, ESSAY, MERRY, LLAMA
• Quordle #1682, Wednesday, 2 September: INCUR, FELLA, TITAN, FROZE
• Quordle #1681, Tuesday, 1 September: NASAL, ROUTE, ANKLE, MIGHT
• Quordle #1680, Monday, 31 August: ALIVE, LOUSE, ABOVE, MOSSY
• Quordle #1679, Sunday, 30 August: USING, SORRY, FILET, PIPER
• Quordle #1678, Saturday, 29 August: OVINE, ALLOY, VOICE, CARVE
• Quordle #1677, Friday, 28 August: WAIST, EDICT, BONUS, DEUCE
• Quordle #1676, Thursday, 27 August: SHEEN, TRICE, WAGON, BEVEL
• Quordle #1675, Wednesday, 26 August: OPIUM, EPOCH, BESET, FINER
• Quordle #1674, Tuesday, 25 August: BLESS, FELON, PORCH, CHOSE
• Quordle #1673, Monday, 24 August: MAJOR, VERGE, CRUSH, SCOFF
• Quordle #1672, Sunday, 23 August: CHASM, BLAME, PARER, BYLAW
• Quordle #1671, Saturday, 22 August: SPOUT, BRAID, FLASH, GUSTY

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #922) - hint #1 - today's theme

NYT Strands today (game #922) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• BRAID
• WATER
• DATE
• THOSE
• COAT
• POKER

NYT Strands today (game #922) - hint #3 - spangram letters

NYT Strands today (game #922) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #922) - the answers

The answers to today's Strands, game #922, are…

• BRIDGE
• BARGE
• SHIP
• DOCK
• PIER
• LIGHTHOUSE
• SPANGRAM: ONTHEWATERFRONT

• My rating: Easy
• My score: Perfect

Today’s theme immediately made me think of one of my favorite early REM songs, Harborcoat. Firing up Spotify, I set myself the challenge of seeing how many words I could spot before the end of the song, which was 3 minutes 57 seconds.

The results were four game words, three non-game words and just about the spangram — although I did attempt ONTHEWATER before seeing the full-length ONTHEWATERFONT.

After this blast of searching I slowed down and managed to find the remainder without too much of a struggle — although LIGHTHOUSE took me a while to connect.

Yesterday's NYT Strands answers (Thursday, September 10, game #921)

• CROWN
• MEDAL
• PRIZE
• TROPHY
• LAURELS
• PENNANT
• SPANGRAM: WEHAVEAWINNER

• Zimperium uncovers Mantax Otax, Android malware merging infostealer, RAT, backdoor, and ransomware
• Distributed via APKs on third‑party stores, social media, and phishing; older Android versions most at risk
• Steals extensive data, enables remote monitoring, then encrypts files with AES and demands ransom

When threat actors target people’s devices, they usually infect it with one of many malware strains: an infostealer, a remote access trojan, a backdoor, or a ransomware encryptor.

Rarely do we see all of these functionalities merged into a single entity, and even rarer - to have it target Android mobile devices - yet, security researchers Zimperium discovered just that.

Mantax Otax

The security outfit published an in-depth report on Mantax Otax, a unique strain of malware circulating in the wild. It is apparently developed by an Indonesian threat actor, targeting victims in the country, but we don’t know exactly how many people are infected, or if this campaign is aimed primarily at business users, or individuals in general.

The malware is being distributed as a standalone APK, meaning it can be found on third-party app stores, Telegram channels, forums, and across social media. There are no traces of Mantax Otax on any of the official app repositories, including the Google Play Store, or Samsung’s Galaxy Store. Zimperium also speculates that it is likely being distributed via phishing emails.

Mantax Otax primarily targets users sporting older Android phones. Versions 9 and older are most at risk, since on these devices the attackers can make use of all of the malware’s features. Android 10 and newer models do get some protection:

“Conversely, on modern devices running Android 10 and above, the malware’s efficacy is severely hindered by native OS defenses, specifically Scoped Storage restrictions,” the researchers explained. “Due to these sandboxing rules, the ransomware is constrained to scanning only the application's localized external files directory, which drastically mitigates the blast radius and reduces the volume of accessible user files.”

Newer devices, as well as users of Zimperium’s Mobile Threat Defense (MTD) and Runtime Application Protection (zDefend) are said to be protected on a software level.

Another important caveat is the permissions. As is usual on Android devices, most malware won’t work unless the user grants an extensive set of permissions beforehand. In this case, Mantax Otax first asks for admin privileges, after which it grants itself an extensive list of capabilities, from accessing SMS messages, to contacts, audio, and images.

It then requests accessibility permissions, fully taking over the compromised device.

Malicious capabilities

Mantax Otax is said to be quite capable. It steals browser history, contacts, call logs, SMS messages, notifications, files, gallery media, Google account information, device specifications, location data, and application inventories. It can also pull WhatsApp information such as messages and profiles, and on Telegram it can also pull lock-screen PINs.

Infostealing features aside, it also serves as a remote monitoring tool, grabbing screenshots, recording the screen, or livestreaming it directly to the attackers. It can take photos using both the front and rear cameras, although Zimperium did not mention any microphone-recording capabilities.

Finally, once all of the data has been harvested, it encrypts user files with AES, deletes the originals, and appends a .enc extension. Victims are then shown a chat interface where they can communicate with the attackers directly and negotiate a ransom payment in exchange for getting their device back.

The tool seems to be in continuous development. Zimperium found two separate versions, one being an “evolution” of the other: “Notably, it has modified its network traffic behavior to utilize WebSockets and introduced a set of new commands,” the researchers said.

There is a reason why ransomware operators prefer targeting businesses instead of individuals. Although the latter has not disappeared entirely from the victim list, businesses stand to lose a lot more from disrupted operations and, as such, are targeted more frequently. Unfortunately, we don’t know what kind of app Mantax Otax is spoofing, therefore it is difficult to assess who the targets are.

• Microsoft has rolled out a Windows 11 preview update to fix multiple Bluetooth bugs
• There are nine individual fixes listed in the patch notes, one of which addresses connection and disconnection speed issues
• More Bluetooth improvements should arrive as Microsoft works to improve Windows 11's driver quality

Bluetooth on Windows 11 is finally getting the attention it needs, after years of major connection and user interface bugs.

As reported by Windows Latest, Microsoft is rolling out major Bluetooth fixes for Windows 11, starting with update 26200.9359 for testers via its preview channel. Windows Latest notes that this includes nine notable fixes, particularly to iron out connectivity bugs.

One fix is designed to "correctly reflect" when a Bluetooth device is connected or disconnected — one of the biggest issues I've noticed is that disconnecting a device (a very slow process) effectively prevents you from connecting to another right away, and when you try, Bluetooth completely malfunctions — so it's promising to see it tackled.

Audio calls have also been addressed in the preview update, with a new Windows volume popup, which appears when adjusting the volume of a "Bluetooth Classic Audio" accessory. Microsoft also claims that "reliability and performance" with LE (Low Energy) Audio accessories have been improved.

The common stuttering and random device disconnections have been reduced, which should go a long way in improving game controller stability on the likes of the PlayStation DualSense wireless controller.

Of course, all Bluetooth bugs can't be fixed in a single update, but as Windows Latest notes, Microsoft previously stated that Windows 11's driver quality would receive improvements in the long run, which should ultimately make Bluetooth and other Windows functions more reliable.

However, I am pessimistic that these long-running Bluetooth issues are actually being eliminated. This isn't the first time Microsoft has rolled out a patch that addresses issues with Bluetooth functionality, and the same bugs have persisted through multiple Windows 11 updates.

Aspects such as failing connectivity with devices and other system-breaking bugs make Windows 11 a frustrating operating system to use, especially for gamers, notably when SteamOS and Bazzite (a SteamOS clone) aren't as buggy despite some compatibility problems.

The good thing is Microsoft isn't ignoring the issues that plague Windows 11, and if it can continue to work towards patching out the persistent bugs, it'll ease the frustrations among multiple Windows 11 users.

• 153 million US driving licences have been leaked on a Russian cybercrime platform
• Among those apaprently discovered in the stolen data is US Secretary of Defense Pete Hegseth
• The FBI is now investigating the leak, which has been traced to an identity verification company

A data leak of 153 million US drivers licenses is said to have been shared on a Russian cybercrime forum, with US Secretary of Defense Pete Hegseth among those leaked prompting an FBI investigation.

Security researcher Brian Krebs identified the leak – which included his own data – as originating from a hack of an identity verification service. Louisiana-based IDScan provided ID verification for various well-known companies, including FedEx and Hertz car hire.

The data was shared on a Russian forum called Exploit, a long-established online community of cybercriminals. Following news of the leak, the identity theft service “Nexus” has apparently scrubbed its existence from the Dark Web.

Driving licenses and more

It wasn’t just US driving licenses that were found in the archive of recently-collected personal data. Krebs’ investigation found that Nexus claimed other types of data, and found a further 1.1 million driving licenses from Canada.

Other identity documentation alleged to be in the leak include 10 million identification cards, three million travel documents and international IDs, and 579,000 medical cards. The data was available to browse, notes Krebs, with Nexus providing details: “Records are available to preview before purchase with pertinent information redacted. Customer photos are displayed if available.”

The leak has a personal dimension for Krebs. Not only was his driving license in the collection, so was that of his mother. It has proved to be a useful coincidence, one that has enabled the security and privacy researcher to establish how the data was sourced by Nexus.

Both licenses were used for a car hire, which Krebs traced to Hertz. Others affected by the leak had also used the service, which has used New Orleans-based IDscan for identity verification.

The company, which claims to perform 21 million verifications a month, is yet to issue a statement on the matter. Its marketing and operations leader, Jillian Kossman, told the journalist: “At this point I’m not able to share any additional information, but the updates you have provided have been welcome, and helpful to our team’s investigation.”

Where is the data?

Krebs reports that he was alerted to the data on August 31, 2026, little over a week ago. Regular checking noted that the data was still being added to, increasing by “nearly 400,000” records prior to publishing his investigation on September 1.

Since then, however, it seems that Nexus has vanished, along with the data. But how widely was the data downloaded before that happened? While the FBI investigates, it falls on the American and Canadian public to be extra vigilant and wary of identity fraud.

• Huntress warns fake GTA 6 ISOs spreading malware ahead of official Nov 19, 2026 release
• Packages deliver RATs, infostealers, and Chaos ransomware disguised as game installers
• Users urged to avoid pirated downloads; infected systems should be reimaged and credentials reset

Grand Theft Auto 6 (GTA 6), one of the most anticipated computer games of all time, is due to launch on November 19, 2026 - so everything found online before that is almost certainly malware.

This is the warning sent out by security researchers Huntress, which said it recently saw one variant deploying all sorts of filth, from remote access trojans (RAT), across infostealers, to full-blown ransomware encryptors.

The story behind GTA 6

GTA 6 is a third-person action-adventure and open-world gam developed by Rockstar Games, which egan preliminary work more than a decade ago, and has allegedly spent more than a billion dollars during that decade and a half, which would make it, by far, the most expensive game ever developed.

It is also a sequel to GTA 5, a game that was sold in more than 230 million copies around the world, which made it one of the most popular games of all time.

In late August 2026, someone going by the alias LEEK claimed to have obtained a working, playable build of the game, roughly six months before the official release. They posted numerous screenshots and videos of them playing the game, even writing their nickname onto a wall, using a rifle to prove the authenticity. Truth be told, even without this, people would have still probably searched for, and downloaded, fake installers. This only made the problem worse.

And a major problem, it definitely is. Huntress is now saying it is seeing websites ranking relatively high (through SEO poisoning), offering for download an ISO of the game. Similar ISOs are circulating around different gaming forums, torrenting sites, and social media channels.

An ISO file is a digital copy of an entire disc, such as a CD, DVD, or Blu-ray, stored as one file. Users can download an ISO (which can weigh tens or hundreds of gigabytes), mount it into a virtual drive, and the computer will treat it like a physical disc.

Huntress found some ISOs weighing more than 100GB which was done just to make it seem authentic - the actual malware was “a factor smaller”. The ISOs they analyzed contained multiple variants, including NJRAT and CDRAT (two remote access trojans), Mercurial Grabber (an infostealer grabbing Roblox Studio cookies, Minecraft session data, Discord tokens, Chrome passwords and cookies, system information, IP addresses, and geolocation, Windows product keys, and screenshots), and Chaos Ransomware. The package also contained a legitimate, regular browser - “Just for kicks,” apparently.

A plausible failure

During the “game” installation, the installer displays a message in Russian, saying the product is unlicensed and that there is a good chance it won’t run. If that happens, the user is told to reach out to a specific Gmail address to receive an “updated crack”. After the installation completes, the victim will get that exact popup, saying “License not found”. All of this is just a smoke screen, to make the victim not suspicious as to why the “game” won’t run.

There is no way of telling how many people fell for the ruse and installed malware on their devices. Huntress says that generally speaking, trying to download cracked and pirated software is a bad idea, which is even worse if the game in question has not yet been released.

“This is fertile ground for scams and threat actors attempting to take advantage of the impatient and overeager,” the researchers said.

The good news is that all of the malware being distributed there is not new. Some of the variants contained in the ISOs are several years old, meaning most antivirus programs, such as Windows Defender for example, can easily detect it and stop it from compromising the system.

Those that do end up infected should disconnect the machine from the internet, reset all passwords, enable 2FA wherever possible, and do a complete reimage of the compromised system.

• Proofpoint detailed BlueMoon, an exploit kit chaining two Chromium flaws and one Windows bug
• Four groups, including China‑aligned TA412, used it loudly against NGOs, aerospace, and manufacturing targets
• Exploits were “patch‑gap” zero‑days; all flaws now patched

Four hacking groups, including some tied to the Chinese government, were seen using the exact same exploit kit in a span of a week, suggesting a certain “fear of missing out” among the criminals, experts have warned.

Security researchers Proofpoint have detailed BlueMoon, an exploit kit that leverages three vulnerabilities: two in Chromium, and one in older versions of Windows: Windows 10 (October 2018 Update), Windows Server 2019, Windows 10 2004, WIndows Server 2022, and the initial release of Windows 11.

The kit was first seen being used on August 28 2026, by a threat actor tracked as TA412, a China-aligned state-sponsored threat actor that was observed in the past targeting businesses using Microsoft SharePoint. TA412, also known as Violet Typhoon, used BlueMoon to “repeatedly target a small number of non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the United States.”

Soon after that, three others were spotted: UNK_LateNight, another China-aligned espionage group which targeted multiple US aerospace companies, UNK_DoubleCheck, a group going after a Vietnamese manufacturing entity, and UNK_QuietRacket, a threat actor taking aim at organizations across Singapore and Indonesia.

What all of these groups have in common is the fact that they did not try particularly hard to hide their activity. This is rather unusual, since a stealthy approach usually guarantees that a vulnerability can be exploited for longer.

Front running the Chromium supply chain train

BlueMoon takes advantage of three flaws, two in Chromium and one in older Windows variants. The Chromium vulnerabilities were found in V8, the JavaScript engine that the browsers use to allow applications to run efficiently. The first one is a “type confusion bug”, tracked as CVE-2026-85046, and assigned a severity score of 8.8/10 (high). The latter is a “sandbox escape” flaw, for which Google did not assign a CVE or a severity score.

The Windows bug, on the other hand, is tracked as CVE-2026-85880, and was given a severity score of 7.8/10 (high). It is described as a “heap-based buffer overflow” vulnerability in Windows Advanced Local Procedure Call, allowing malicious actors who can already execute code inside a low-privilege AppContainer to escape the sandbox and elevate privileges to SYSTEM. No additional user interaction is required.

Proofpoint has a theory as to why the crooks decided to be loud, instead of flying under the radar. Apparently, there is a very short window of opportunity between Google patching a Chromium vulnerability, and it being deployed to a browser such as Edge, or Brave, This window of opportunity also allows crooks to see how Google fixed a flaw, reverse-engineer it, and deploy an exploit before the browser is patched. This would mean that there is no time to be stealthy.

No time to hide

“Both V8 vulnerabilities were ‘patch-gap’ zero-days at the time of the observed activity,” Proofpoint said. “In other words, while they were known vulnerabilities already fixed in public upstream Chromium source code, they remained unpatched in the latest stable releases of Chrome and Chromium-based browsers available to the public. It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain.”

Another important factor is Artificial Intelligence. It would seem that AI has made flaw detection significantly faster, reducing the barrier to entry and making threat actors move more loudly.

“A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development,” Proofpoint stressed.

All three flaws have since been patched, so make sure you’re running the latest version of both the OS and the Chromium browser.

Via Ars Technica

• Huntress warns of phishing campaign abusing Adobe branding with browser‑in‑the‑browser trick
• Victims lured into fake update pages, unknowingly installing rogue ScreenConnect clients
• Attackers gain persistent remote access; defenders urged to restrict RMM installs and monitor IoCs

Security researchers Huntress have warned of an ongoing phishing campaign that abuses Adobe’s brand while deploying clever browser-in-the-browser (BitB) techniques to trick the victims.

The goal is to deliver rogue ScreenConnect clients which would grant the attackers persistent access to target devices.

In its report, Huntress says it could not find the lure itself and thus could not report what the scam looks like. However, it saw the victims clicking on a link in the email and then being redirected to a typosquatted domain https[://]adoube[.]vu that spoofs an Adobe landing page.

We heard you like browsers…

This is where we get to the scam’s unique twist. Usually, phishing lures would simply redirect victims to a malicious website which could be identified simply by looking at the address bar. If the domain differs from the legitimate one, the scam falls apart. To work around that problem, scammers came with a solution called “browser in the browser”.

Using either HTML, CSS, or JavaScript, the crooks would create an entire fake browser window, including the address bar, URL, padlock icon, and more, inside the actual webpage content itself. Therefore, if the victim isn’t all too careful, they might look at the fake address bar, see a legitimate URL, and believe they are visiting the correct website.

In this fake browser window, the fraudsters display a blurred .PDF document. Overlaid is a message saying the documents are “secured” and created with “the latest version of Adobe.” The only way to read them, the message continues, is to “update or download Adobe PDF Reader.” Expectedly, there is a big “View Files” button just under the notification, leading to a different, equally fake BitB page, showing the download progress. In the background, something gets downloaded.

Victims might think they’re getting a PDF reader, while in reality they’re getting a rogue version of ScreenConnect.

Poisoned ScreenConnect instances

On its own, ScreenConnect is not malware, or dangerous in any other way. It is a legitimate remote access and support software, similar to TeamViewer, AnyDesk, or Remote Desktop, allowing IT professionals remotely connect to and control computers and other devices. These variants, however, are tainted to enable threat actors to obtain persistent remote access to their targets’ endpoints, Huntress explained.

“The first initial remote client installed was the rogue ScreenConnect Client configured to communicate with instance-uxh86b-relay[.]screenconnect[.]com. The attacker used a legitimate ScreenConnect Trial Relay domain to further avoid detection,” the researchers said. “This initial malicious ScreenConnect Client used the native Windows command shell and curl to retrieve and install a second malicious ScreenConnect Client configured to communicate with attacker-controlled IP. Both clients established service-based persistence for continued remote access.”

After installation, the attackers used the second ScreenConnect session to run HideCursor.exe, an executable, as the name suggests, that helps the attackers hide their mouse activity.

Huntress’ researchers don’t know what the endgame is, since the threat actors were spotted and shut down in this stage of the attack. The researchers also did not share the details about the target, such as the size of the organization, or the industry it operates in. Therefore, it is impossible to even speculate on the nature of the attack and if the threat actors aimed to install ransomware.

Still, the researchers stressed the importance of training employees to “treat unexpected software update prompts and file-viewing pages with caution”, and to make sure they know how to verify downloads through trusted channels. IT teams should also restrict who can install remote-management tools, maintain an approved inventory of RMM software, and alert on new or unapproved ScreenConnect clients, unusual relay connections, and executables launched from the user Downloads folders.

Finally, businesses should monitor for Indicators of Compromise (IoC) listed on this page.

Amongst all the hype over Apple’s first-ever foldable smartphone, the iPhone Duo, which was announced at the company’s ‘Surprise and Shine’ event, Apple (rather quietly) also revealed when Mac users can get the latest version of its desktop operating system, macOS 27 Golden Gate: September 14.

While pretty much all of the attention was focused on the foldable, the launch of macOS 27 is noteworthy for anyone with a modern Mac or MacBook, as this free upgrade brings some tasty new features, while also addressing some of the less popular changes that came with its predecessor, macOS 26 Tahoe.

If you have a compatible Mac, then you should be prompted to download and install macOS 27 Golden Gate once September 14 rolls around. However, if you have a Mac from before 2020 that doesn’t run on Apple Silicon (so any Intel-powered Macs), then you won’t be able to get the update.

For reference, here are all the Mac models that are compatible with macOS 27 Golden Gate:

• MacBook Air M1 or later
• MacBook Pro M1 or later
• MacBook Pro 13-inch M1 2020 or later
• MacBook Pro 14-inch M1 Pro 2021 or later
• MacBook Pro 16-inch M1 Pro 2021 or later
• MacBook Neo
• iMac M1 2020 or later
• Mac mini M1 2020 or later
• Mac Studio 2022 and later

Apple recently announced new M5 and M6-powered Mac mini and Mac Studio products, and they'll likely launch with macOS 27 preinstalled when they start shipping on September 22.

Fixing past mistakes

The main focus of macOS 27, as with Apple’s other operating updates such as iOS 27, and seemingly every piece of new software these days, is AI.

The upcoming macOS 27 upgrade paves the way for Siri AI integration – the long-awaited improvements to Apple’s virtual assistant that should make it more useful. When launched, Siri AI should be able to have two way conversations with you and execute multi-step tasks quickly and easily, which could make using your Mac a lot more convenient. It will be able to interact with apps such as Calendar to complete tasks such as creating events and reminders.

AI is also coming to macOS Spotlight to make finding things on your device better, and Visual Intelligence can be brought up to get information about what’s on your screen. Other AI features, such as Image Playground, are getting improvements as well.

If you’re not a fan of AI, then macOS 27 should still have plenty of reasons to download and install. One reason that will hopefully please a lot of people is that macOS 27 Golden Gate makes tweaks to some of macOS 26 Tahoe’s most controversial changes, especially when it comes to the polarizing Liquid Glass interface. The new macOS will allow you to adjust transparency effects to make using your device more comfortable, and during the beta testing process, it was one of the things our contributor Alex Blake was particularly thankful for. I’m sure he’s not the only one.

When Apple announced macOS 27 at WWDC 2026 earlier this year, it promised lots of performance improvements, especially when it comes to how responsive the operating system feels. This alone should make macOS 27 worth installing on September 14.

If you have an older Mac and feeling left out, make sure you check out our guide on the best Macs and MacBooks, which can help you find a new macOS 27-ready Mac that suits your needs and budget.

Asus Zenbook 14 (2026): Two-minute review

The new Asus Zenbook 14 is designed to be an ultra portable device with a mid-range price that doesn’t compromise on performance.

True to other models in the line, the finish of the Zenbook 14 is different to the usual fare at this kind of price point, with its soft texture and uncommon colorways that are far more vibrant than many.

More impressive, though, is the Zenbook 14’s build, which blends strength and lightness in a way very few can match. Compared to other 14-inch laptops, this has to be one of the best laptop constructions around in terms of portability.

However, it’s not quite as thin as you might expect, and the thick feet underneath only add to the bulk. What’s more, although most of the unit is remarkably sturdy, the keyboard has a tendency to flex while typing on it, which is a little disconcerting.

As you might expect for a laptop this portable, the Zenbook 14 isn’t loaded with interfaces, but those included are wisely chosen. You get one USB-A and two USB-C ports — the latter of which support power delivery and display signals — as well as an HDMI output and a headset jack.

The Zenbook 14 performs competently at everyday tasks. It can handle basic productivity and browsing, as well as 4K streaming. It struggles with even light gaming, but that isn’t too surprising given its lack of a dedicated GPU.

Fortunately, the Zenbook 14 remains composed even when undertaking heavy workloads. The fans are audible in such circumstances, but they’re certainly more hushed than many other examples. Temperatures also remain impressively cool, with only a few hotspots appearing — and mercifully these steer clear of commonly touchable surfaces.

The 1920 x 1200p resolution is sharp enough for its 14-inch real estate, while the OLED technology provides the vividness and contrast you’d expect. Reflections are visible at times, but the maximum brightness level should keep them from disrupting your viewing experience too much.

One of the main drawbacks of the Zenbook 14, though, is its battery life. It lasted just over 12 hours when I played a movie on a loop, which is short compared to many of its competitors. In fact, the Zenbook A14, a similar machine to the 14 in many ways, more than doubled this time when I ran the same test.

What’s more, the A14 is similarly priced to the 14, so all things considered it offers the better value. The 14 is the better the choice if you want a slightly more solid body, but in all other regards, the A14 would be the better choice.

Asus Zenbook 14 (2026) review: Price & availability

• Starts from £799.99 (about $1,080 / AU$1,500)
• Preorders open now (ships September)
• Some rivals offer better value

The Zenbook 14 starts from £799.99 (about $1,080 / AU$1,500) and is available to preorder now, with shipments expected early to late September. Availability in the US and Australia is yet to be confirmed, but we'll update this section once it has.

The base model gets a Qualcomm Snapdragon X1 CPU, 16GB of RAM, and a 50Wh battery. More powerful AMD Ryzen AI 7 and Intel Core Ultra 9 models, both with 70Wh batteries, can also be preordered for £1,399.99 and £1,499.99 respectively. These two also get backlit keyboards, but the Snapdragon model doesn’t. Each model has three colorways to choose from: Zabriskie Beige, Arctic Blue, and Komodo Coral.

This is a reasonable price considering its spec. However, the already available Asus Zenbook A14 is slightly cheaper, yet has superior battery life and a marginally lighter build. Then there’s the HP OmniBook 7, which we’ve seen in recent sales with a similar price, and is a fantastic all-rounder that’s hard to beat at this point in the market.

Asus Zenbook 14 (2026) review: Specs

Asus Zenbook 14 (2026) review: Design

• Light and strong body
• Unique finish
• Reasonable port selection

The unique Ceraluminum body certainly sets the Zenbook 14 apart, as do the bright colorways. The beige finish of my review unit was more interesting than the usual monochromatic shades we’ve grown accustomed to, looking softer and more inviting as a result. This was further aided by the rounded corners and the odd texture of the material, which has a slight graininess that’s comfortable in the hand.

One of the major selling points of the Zenbook 14’s construction is its lightness. It weighs around 2.5 pounds (just over a kilogram), which is impressive for a 14-inch laptop. However, it’s not quite as thin as you might expect, with a bit more unexpected bulk at the rear. The two long bars that run underneath, acting as feet, don’t help matters, either.

However, some may view this a worthy sacrifice for the unit’s surprising solidity. Both the base and the lid have very little flex to them. It feels slightly sturdier than the A14 I reviewed previously, although that model is slightly lighter at 2.16 lbs / 0.98kg.

There is, though, one weak point to the Zenbook 14’s build, and unfortunately that’s the keyboard. Hammering away on the keys often depresses the whole board, which can be quite annoying and doesn't inspire much confidence. There’s also no backlighting, which is an omission I always lament.

On the plus side, there are a reasonable number of ports on the Zenbook 14. There’s one USB-A port on the right-hand side of the unit, which is the only port on this side. On the left, you’ll find two USB-C ports (both of which support external display signals and power delivery), an HDMI port, and a headset jack.

Asus Zenbook 14 (2026) review: Performance

• Fast everyday performance
• Vivid but reflective display
• Good for typing

For everyday tasking, the Zenbook 14 is a solid performer. The Snapdragon X1 chip in my review unit was fast and smooth when conducting basic productivity workloads such as word processing. It also handled multi-tab browsing and 4K streaming with plenty of composure as well.

Sadly, but somewhat expectedly, the Zenbook 14 isn't ideal for a spot of light gaming. It struggled to run Cyberpunk 2077 even on the lowest preset, blighted by rough visuals and debilitating slow downs during chaotic scenes. The A14 I tested previously, equipped with a Snapdragon X2 Elite chip, was able to handle low presets better, although it still wasn’t a flawlessly smooth experience.

Some fan noise is evident when the Zenbook 14 is under stress, but this isn’t too distracting. For such a compact laptop, the Zenbook 14 also does well to keep temperatures from soaring. I only noticed portions above the keyboard and underneath getting hot, while the commonly touchable surfaces, such as the keyboard, only became lukewarm at most.

The 1200p OLED display is crisp and sharp, with plenty of contrast and vividness. It can show reflections a little too readily, especially when deep blacks are displayed. Mostly, though, the high brightness levels do well to keep reflections at bay.

Despite that aforementioned flexing of the keyboard, the Zenbook 14 is still good for typing. It may feel a little harsh due to the lack of dampening, but the keycaps are comfortable and well spaced, while their low profile and short travel make them feel snappy and easy to glide over.

Complementing the keyboard is the super smooth touchpad that allows for easy swipes and gesturing. It’s not very large, but it maximizes its real estate commendably by extending from almost the bottom edge of the unit to the bottom of the space bar, which makes navigation less of a chore than it otherwise would be.

Asus Zenbook 14 (2026) review: Battery life

• Middling longevity compared to rivals
• Zenbook A14 massively outlasts it
• Quick to charge

The battery life of the Zenbook 14 isn’t particularly impressive. When I played a movie on a continuous loop unplugged, its 50Wh battery lasted 12 hours and 15 minutes. While this is quite long, it falls short of quite a few of its rivals.

For context, the A14 has a 70Wh battery, and the difference shows, as that laptop lasted over 28 hours in the same test, one of the best results we’ve seen. And if you’re looking for another enduring 14-inch laptop, the HP OmniBook 7 posted a time of 26 hours. Fortunately, the Zenbook 14 is at least quick to charge, just around two hours to fully top up.

Should I buy the Asus Zenbook 14 (2026)?

Scorecard

Buy it if…

Don't buy it if…

Asus Zenbook 14 (2026) review: Also consider

How I tested the Asus Zenbook 14 (2026)

• Tested for a few days
• Used for a variety of tasks and benchmarks
• Extensive laptop reviewing experience

I tested the Zenbook 14 for a few days, during which time I used it for all manner of tasks, from basic productivity and general browsing to 4K streaming and gaming.

I also ran our series of benchmark tests for laptops, designed to assess every aspect of performance. I ran a movie on a loop to test the battery life, too.

I’ve been using laptops for decades, and have reviewed a large number of them, ranging from small budget offerings to large gaming monsters.

• First reviewed: September 2026
• Read more about how we test

• A new report from KB Securities gets very gloomy about the RAM crisis
• We're told the "memory chip market is heading toward a severe supply shortage" in 2027
• AI demand has ramped up massively with infrastructure investments up 60% year-on-year to $1.3 trillion, creating even more demand for memory as fuel for that rise

If you thought the RAM crisis was going to get worse next year, you're very probably right — but apparently we might suffer an even more severe shortage than some analysts already expect.

Wccftech flagged up an article from Business Korea (translated from Korean), which suggests that the RAM squeeze is tightening its grip on two of the biggest memory chip makers.

Citing a report from KB Securities, the rumor is that Samsung and SK Hynix are now down to fewer than 10 days of memory inventory, which is very close to running dry.

This has caused concerns that available memory supplies could dwindle and be depleted in 2027, with analysts believing that the "memory chip market is heading toward a severe supply shortage" (again, bear in mind this is a translation, but the message is clear enough).

KB Securities notes that the AI boom is what's causing this, as memory chip manufacturers struggle to meet demand for HBM4 memory in AI data centers. Infrastructure investments for AI development have been revised upwards to $1.3 trillion for 2027, we're told, which is a 60% year-on-year increase.

Kim Dong-won, head of research at KB Securities, told Business Korea that: "AI servers will absorb demand for not only HBM but also server DDR5 and enterprise SSDs, potentially leading to a historic shortage."

There's a brighter spot of news from laptop maker Framework though, which, as VideoCardz reports, has taken an unusual step in reducing the price of some of its products. As you may recall, Framework has been hiking laptop prices due to the increased cost of RAM (as have other notebook manufacturers), but the company just announced that it has secured some fresh memory modules at a lower price.

This means that some of its current Framework Laptop orders will be knocked down in price, and the company said on X that it's "retroactively reducing prices for orders that shipped at higher price" too.

Analysis: there's a historic level of gloom, that much is certain

It's impressive to see Framework acting in the best interests of its customers, particularly seeing as the firm could have (theoretically) kept quiet about bagging a batch of cheaper memory chips, and just kept the difference itself.

While that's commendable, it's a pretty small (but still welcome) bone we're being thrown in the face of the bad news for the RAM crisis here. Talk of a "historic shortage" is worrying, and it feels like this is an escalation of the recent chatter about global memory supply woes which has already turned highly negative.

While this latest report talks about server DDR5 RAM (and HBM), this will obviously have a bearing on consumer products, too. Those less profitable memory sticks are going to end up sidelined even further.

With rumors about GPU price hikes again coming to the fore this week, it's difficult to catch a breath between the bouts of bad news. We can hope that the pessimism is overblown here, but I can't shake the feeling that this seems unlikely.

• Calif researchers found a zero‑click WeChat VoIP flaw enabling account takeover via calls
• “WeWorm” spreads through ringing calls; victims need not answer to be compromised
• Tencent patched in Android 8.0.77 and iOS 8.0.76; no exploitation seen in the wild

Security researchers have found a flaw in WeChat which allows malicious actors to take over people’s accounts on both Android and iOS devices - but what makes this flaw stand out is the fact that it’s a zero-click bug - victims need not do a thing to be compromised.

WeChat is a “super-app”, allegedly used by roughly 1.4 billion people, and is especially popular in China. It started as a communications app, letting users send messages, and make voice and video calls, and has evolved to function as a social network, allowing users to share photos and videos, as well as a payment app through which users can transfer money, pay for things, order food, book taxis, and even access government and business services.

Security researchers from Calif have now disclosed finding a ‘memory corruption’ issue in WeChat's VoIP stack. For now, they decided not to share the technical details, and to instead demonstrate the flaw “at an upcoming conference.” To that end, they built a worm called WeWorm, capable of taking over target WeChat accounts and spread through phone calls made via the app.

A phone call would suffice

In practice, it works remarkably simple: an attacker uses WeChat to call a person they have in their contacts list (this is a prerequisite). They can use both an Android and an iOS device, and can call anyone, regardless of the model or the OS they’re using. As soon as the phone starts ringing, WeWorm gets to work, “worming” its way into the victim’s device.

The victim does not even need to answer the phone - having it ring is enough. If they answer, they’ll hear nothing but silence, yet the worm will continue operating. If they decline the call, the attack stops, but this is hardly a mitigation - the attacker can simply call again while the victim is asleep (or otherwise away from their device).

Within a few seconds, the attacker will have access to the victim’s WeChat account, including their messages, contacts list, and virtually anything else found in the app. What makes this bug particularly worrisome on the surface is the fact that WeChat can be used to transfer money and pay for things, but WeChat Pay has additional authentication and risk controls designed to prevent that from happening.

The good news is that there is no evidence of this flaw being exploited in the wild. The bad news is that this is not the first zero-click flaw found in modern-day smartphones, and most likely will not be the last one.

Tencent's response

Calif said it responsibly disclosed its findings to WeChat’s parent company Tencent, who came back with a patch. Versions 8.0.77 for Android and 8.0.76 for iOS have apparently solved the problem, although

Tencent did not list any details in its patch notes, simply saying the version brought “bug fixes”, but in a statement shared with The Hacker News, it said the exploit has been “mitigated for all users”, and that it was applied server-side - users need not install anything, aside from the patch.

It’s also worth mentioning that WeChat has apps for HarmonyOS, Windows, Mac, and Linux. However, it would appear that Calif did not test those, and Tencent did not include them in its patch. The researchers did say that they would be looking into this same flaw in other products, too:

“This specific WeChat bug is one instance of the many unconventional attack surfaces that are present across many messaging apps,” they said. “We're conducting more of this research across other apps and attack surfaces, while working with app developers on attack surface reduction. This may take an industry-wide effort, since some of it depends on the platform owners. Once that work is further along, we'll share our progress, including the technical details of this WeChat bug.”

After watching Apple's iPhone Duo launch I was struck by one detail — its support for the Apple Pencil, which makes it the first iPhone to support the device.

When Steve Jobs launched the iPhone in 2007 he famously posed the rhetorical question “Who wants a stylus?”. His argument was that you already have the best stylus you’d ever need with you at all times — your fingers.

Touchscreen displays have gone on to dominate smartphone and tablet design, and have proved far superior to the stylus as a way of navigating a software interface; but the humble stylus has always had its advocates, and it has never really gone away.

Some Samsung devices in particular can be used with a stylus — the S Pen. And, of course, Apple eventually capitulated and introduced the Apple Pencil for the iPad Pro, turning the tablet into a digital drawing pad for illustrators, artists and anyone who simply likes to sketch out ideas.

Perhaps I should clarify that Apple's first successful stylus was the Apple Pencil (2nd edition), rather than the original Apple Pencil. The original Apple Pencil had a terrible design that meant you had to remove a tiny, easily lost cap to charge it, and worse, the Pencil’s Lightning connector plugged directly into the iPad. That left the Pencil sticking precariously out of the tablet, so it was easy to knock, and seemingly designed to snap either the connector or the iPad’s port at some point. It also had no built-in way to attach securely to the iPad for storage.

In terms of Apple’s design failures, the original Apple Pencil is right up there with the Apple Magic Mouse, which has the charging port placement underneath, so it can’t be charged and used at the same time. Amazingly, that’s still the current design of the Magic Mouse, but Apple quickly did something about the Apple Pencil.

The Apple Pencil was fixed with the second-generation, which was released alongside a redesigned iPad Pro in 2018. Instead of plugging directly into the iPad’s Lightning port (such a bad idea) it attached magnetically to the iPad’s side, where it effortlessly paired, charged wirelessly and stayed stored. That eliminated both the precarious protruding connector and the removable cap.

Turning in his grave?

So would Steve Jobs really be turning in his grave right now to know that Apple’s new phone works with its stylus? I’m not so sure.

I went back and watched ​​the original iPhone keynote from 2007. Talking about styluses Jobs said, “Yuck! Who wants a stylus? You have to get ‘em, put ‘em away and you lose them. Nobody wants a stylus! [...] We’re going to use the best pointing device in the world. We’re going to use a pointing device that we’re all born with. We’re born with ten of them, we’re going to use our fingers. We’re going to touch this with our fingers.”

Looking back, we can forgive him some of the hyperbole about the stylus at the launch of the iPhone because he was introducing what, for many people watching, was previously unthinkable — a way of using a screen-based smartphone that relied on just your fingers, and he had a battle to win people over and a point to make. In the broadest sense, he was right — touchscreen displays have proved far superior to the stylus as a way of navigating an interface; but the stylus has never really gone away.

The iPhone Duo’s secret weapon

Of course, back in Apple’s history there was another device that had a stylus, the Apple Newton MessagePad. It launched in 1993, came with a plastic stylus for writing, tapping and using its much-mocked handwriting recognition software. Jobs killed off the Newton in 1998, shortly after his return to Apple.

Apple generally called the Newton’s stylus a pen, rather than giving it a standalone product name. So the Apple Pencil wasn’t Apple’s first stylus. It was the company’s return to pen input after Steve Jobs had famously ridiculed styluses when introducing the iPhone.

The Apple Pencil was introduced four years after Jobs’ death in 2015, but I think he would have approved. People genuinely seem to love the Apple Pencil, despite it still having some flaws (there’s no eraser on the other end, for example) and it could even be the secret weapon in Apple’s new iPhone Duo’s success.

The fact that you can use the Apple Pencil with the new iPhone Duo immediately locks Apple’s new foldable phone tightly into Apple's ecosystem of connected devices. The Apple Pencil is expensive, but a lot of iPhone Duo buyers will already own an Apple Pencil, because Apple households tend to have quite a number of Apple devices already in them. (It would be wise to check which version of the Apple Pencil you own though, since the Apple press release only says the "iPhone Duo will support Apple Pencil with USB-C).

And that’s what could make Apple Pencil support much more than another feature on the spec sheet. The iPhone Duo’s folding screen gives people a larger canvas, but the Pencil gives them a reason to use it — for drawing, handwriting, annotating documents and editing photos with precision. Jobs’s real objection was to a stylus you needed simply to operate a phone; on the iPhone Duo, your fingers would still handle that perfectly well, and the Pencil would step in when it was genuinely the better tool. Far from turning in his grave, I suspect Jobs might have appreciated the distinction.