• AI-generated code security improved for the first time in a year, with vulnerability rates dropping from 44% to 38%
• Top models performed better at preventing common flaws like XSS, but still struggled with complex security reasoning
• Researchers stress AI-generated code still requires independent security testing and verification before deployment

Computer code generated by frontier AI models has gotten more secure and consequently - contains fewer vulnerabilities.

This is according to a new report by Veracode, which claims this is the first significant improvement in a year.

In July 2025, Veracode started releasing its GenAI Code Security Report, which analyzed code generated by LLMs for vulnerabilities and security risks. Since then, the company’s researchers noticed a trend - the code was functioning almost perfect, but on the security side it left much to be desired.

Are XSS flaws worth the trouble?

“We’ve been analyzing code generated by multiple LLMs for more than a year. Until now, we have not seen a marked improvement in AI code security, despite consistently near-perfect functionality,” said Chris Wysopal, Co-founder & Chief Security Evangelist at Veracode.

“This is the first time since running our study that we’ve been able to report a meaningful move on the security dial.”

That meaningful move is a jump from 56% to 62% in overall AI-generated code security. At the same time, there’s been a drop in vulnerabilities from 44% to 38%, Veracode added, saying this was the most significant improvement since the reports started coming out. Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol co-lead the rankings at 73%, surpassing the previous high of 68% set by GPT-5.5 in July 2026.

“Ten models now clear 60%, up from four in the last report, and the overall average has jumped six percentage points,” Wysopal said. “With around half of code now generated by AI, today’s results are truly encouraging.”

To draft the report, Veracode tested 18 models across four languages (Python, C#, JavaScript, and Java), and four Common Weakness Enumeration (CWE) categories (CWE-89, CWE-327, CWE-80, CWE-117). Claude Opus 5.5 and GPT-6-Sol claimed the top spot with 73% followed by GPT-5.5 which holds 68%. In July, six of 11 models scored between 50 and 53, while today only two remain in that band, while 10 scored at least 60%. The bottom is still at 44% - 50% percent.

While the results are definitely commendable, there is a caveat. Apparently, the main driver of the overall gain was on cross-site scripting (XSS), which is arguably one of the weakest categories. XSS rose to 18% which is also the single biggest change in the dataset. According to Veracode, XSS is the “easiest vulnerability to fix through pattern recognition”, which is exactly how LLMs improve. In cases where data-flow reasoning across multiple functions is required (such as, in log injection cases, for example), LLMs continue to stall.

Low-hanging fruit

In other words, AI has just picked low-hanging fruit and called it a day. We’re not sure if we should be disappointed with this, since XSS attacks are common and the vulnerability is still present across the web.

In the report, Veracode also said that water was wet and the sky is mostly blue: it found that top-performing models cost more.

However, they said throwing money at the problem most likely isn’t the best solution: “The models that produce the most secure code are the ones that cost the most to run at scale, yet they still fail on more than one in four security tasks,” Wysopal said. “The answer should never be to use the most expensive model and hope for the best. A mid-tier model at a 60% pass rate plus Veracode scanning is more accurate, more cost-effective, and more scalable than a frontier model at 73% with no verification.”

In conclusion, the improvement is there, but “mends a small part of a larger wound”, Veracode said. Organizations should make sure they combine AI code with continuous and independent security verification that can catch what the models miss.

• Google's subsidiary Tuike Finland cleared and drained 330 hectares of forest at Muhos for a data center site
• The company failed to get the necessary environmental impact assessments completed before carrying out the felling
• A preliminary police investigation is now taking place, based on 'ambiguities and ‌shortcomings in the drainage and water management', although the results of this won't be known until 2027

A preliminary police investigation is now underway into Google's clearing of a forest in Finland to make space for an AI data center.

As The Guardian reports, the allegation is that Google's subsidiary Tuike Finland cleared and drained 330 hectares of forest at the site in Muhos before it had ensured the necessary environmental impact assessments were completed.

Yle (Finland's public broadcasting company) further reports that the police have said that the investigation is into suspected environmental damage, but the other possible charges could be added depending on its ongoing findings.

Finnish police said: "Based on preliminary information, there have been ambiguities and ‌shortcomings in the drainage and water management at the construction site of Tuike Finland ​Oy's datacentre project."

The investigation will be far from a short process, though, and won't be completed until some point in 2027.

Construction work was stopped on the data center in Muhos, and also at a second data center site at Kajaani-Otanmäki, on October 14. In both cases, the environmental assessments were apparently incomplete.

Antti Järvinen, who heads up Google Finland as country manager, apologized for the forest clearances, but said that Google had acted according to the "best understanding we had of the legislation at the time."

Analysis: the rush for AI data centers

Some 400,000 trees have reportedly been felled across both sites (250,000 of those at Muhos). As The Guardian makes clear in a separate report from last week (via Tom's Hardware), there are a lot of very unhappy Finnish people, as you might imagine.

Many of them question the building of data centers at all, and the AI gold rush that's the driving force behind this activity. There's apparently little direct benefit for the people of the country where these projects are underway, with only a small number of local jobs created. As a professor of computer science at the University of Helsinki, Jussi Kangasharju points out, "Really, for Finland, there are no benefits. They are international companies serving international customers. Datacentres ultimately have little benefit for others except the datacentre operator."

Others obviously worry about the impact on wildlife. Finnish conservationists inform us that the three-toed woodpeckers in the forest have been displaced, and The Guardian highlighted that in Otanmäki, wolves that had nowhere to go when the trees were felled ended up coming into a local village.

It will be some time before the criminal investigation is completed, as noted, but you can bet that the results are going to be closely watched.

I reviewed the MacBook Neo way back in March, and even then I knew there was very little chance that I'd be giving our Laptop of the Year award to any other device at the TechRadar Product of the Year 2026 Awards.

It's not necessarily the best choice for everyone — many far more powerful laptops have been released this year, and if you want to play PC games on your laptop don't even think of buying the Neo — but what Apple did with the MacBook Neo is pretty incredible, and it set the tone for a lot of other laptops that have come out this year.

Apple has always been seen as a premium brand, offering expensive devices that (usually, but not always) justify their price tags with superior build quality, and the kind of lifespans that owners of Windows laptops, who feel they have to upgrade every five years, can only dream of.

With the MacBook Neo, however, Apple has produced a (relatively) cheap laptop that manages to keep a lot of what we love about Apple's more expensive MacBooks, while making it affordable for more people.

The timing couldn't have been better, as a global cost-of-living crisis has meant that more people are struggling to afford day-to-day essentials, let alone 'luxury' purchases like laptops. At a time when a lot tech is also increasing in price because of the RAM crisis, it was very welcome to see a company like Apple release a relatively inexpensive new device.

Before the Neo's announcement, rumors had been swirling that Apple was planning on announcing a cheaper MacBook, but I don't think any of us were expecting the earthquake of its $599 / £599 / AU$1,049 starting price.

I say 'earthquake' because not only was it a lot cheaper than expected, it changed the landscape of the laptop market, shaking Apple's competitors, and leaving them scrambling to come up with a response.

And respond they did, with the likes of Dell and Acer releasing laptops at a similar price point that were explicitly pitched as competitors to the MacBook Neo when I discussed them with the makers.

A victim of its own success?

The fact that the MacBook Neo has had such an influence on the laptop market is one of the key reasons why I've picked it as TechRadar's Laptop of the Year. The likes of the Dell XPS 13 (2026) and Acer Swift Air 14 have made affordable Windows 11 laptops worth buying again, and the higher price of the new Googlebook laptops have a more difficult time justifying their price tags when the MacBook Neo, and the laptops it inspired, offer such good value.

In fact, you could almost argue that the MacBook Neo proved a bit too successful in inspiring its competitors, especially given that, a few months after launch, Apple increased the price of the MacBook Neo by $100 / £100. Not only did this make the MacBook Neo less groundbreaking value (and less of an 'instant recommendation' when people asked me which laptop they should buy), but its competitors seem to have mostly held steady with their initial pricing.

All of a sudden, Apple appeared to have inspired its competitors to make rival products that were cheaper than the MacBook Neo. Whoops.

Despite that price bump, the MacBook Neo remains an excellent laptop that continues to offer plenty of value. If you're looking for a dependable, well-built laptop for day-to-day tasks that doesn't cost a fortune, it's still one of the best laptops you can buy — and it remains the cheapest way to get into the Mac ecosystem.

The MacBook Neo proved that, at a time when hardware prices appear to be rising inexorably, it's still possible to make an impressive, affordable device, without making too many sacrifices — and that's exactly what we need in 2026.

• Researchers report the first confirmed PHP2Shell compromises, targeting organizations linked to the US government
• Attackers chained PHP2Shell with a Linux privilege-escalation flaw to gain root access and persistence
• Breaches progressed from initial compromise to Active Directory attacks within minutes, underscoring patching urgency

We now have confirmation of the first successful exploits of the infamous PHP2Shell vulnerability discovered earlier this month.

The news comes courtesy of cybersecurity outfit Dream, who claim to have seen attackers breach organizations affiliated with the US government.

PHP2Shell is a name given to two critical-severity vulnerabilities found in PHP. When they were first disclosed, most of the cybersecurity community went full panic mode, given that PHP powers roughly 70% of all websites and web apps on the internet, and there was no patch at the time. The flaws allegedly enabled complete website takeover, and some government and education organizations in Europe even preemptively shut down their websites, in anticipation of mass exploitation attempts.

But after the dust settled, a strange thing happened - there were no successful attacks. Researchers were seeing attempts and probes, but no successful breaches. Amazon said it observed first attacks four days before the patch, and Cloudflare later tracked “thousands” of attempts in the 10 hours before the patch was announced. This grew to tens of thousands within an hour of disclosure, and hundreds of thousands within two hours. Now, it’s gone into the millions.

Some said exploiting the bugs was easier said than done, and that threat actors were hitting different roadblocks, including Address Space Layout Randomization, a security feature that randomly changes where a program’s code and data are stored in memory every time it runs. Still, they warned that all of that might be temporary, and that a successful hit was a question of “when”, not “if”.

Targeting firewalls

Now it seems the claims were on point, as Dream says Chinese threat actors successfully chained PHP2Shell with a Linux kernel privilege-escalation flaw against Palo Alto Networks firewalls, breaching 25 servers, some allegedly belonging to US government-affiliated organizations.

The attacks started on October 23 2026, probing firms in the US, Japan, Taiwan, and South Korea, and soon focused on Palo Alto Networks’ PAN-OS-powered devices, running an older, vulnerable version of the OS.

According to Dream, the crooks chained PHP2Shell with Fragnesia, a local privilege escalation flaw that allows unprivileged users to obtain root access. It was disclosed in mid-May this year and is tracked as CVE-2026-46300.

After breaking into the devices, the attackers ran some 40 custom post-exploitation scripts, Dream added.

“Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell exploit, and launched a full Active Directory attack campaign - all through a chain that started with a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet,” the company’s report reads.

Not automated

To make matters worse, the researchers believe the attackers still have unabated access.

“The total chain - from unauthenticated HTTPS connection to persistent root webshell - completes in under 15 minutes,” Dream said. The researchers could not say what the endgame was here because that information was not found in the artifacts they retrieved. Besides the obvious, which seems to be persistent access and credential theft, the threat actors could do anything from dropping backdoors to exfiltrating sensitive information.

In the context of “Black October”, and the fact we’re seeing a significant increase in automated attacks, it is also worth mentioning that this incident was likely not AI-powered.

Dream did find evidence of AI usage but believes it was not fully automated. Claude Code was installed, as was an offensive security platform called AIscan, which was configured with Chinese AI models DeepSeek and Kimi. Furthermore, they found API keys for FOFA, a Chinese counterpart to the Shodan search engine.

With the help of FOFA, the attackers allegedly identified around 19,000 internet-connected Palo Alto Networks firewalls, which they used as a starting point for their attacks.

Via The Register

• Attackers allegedly stole $6.36 billion from Binance in a record-breaking cryptocurrency exchange breach
• Investigators linked the attack to North Korea’s Lazarus Group, exploiting access from a compromised engineer
• Binance said customer funds remain safe, while authorities and partners froze billions in stolen assets

Cybercriminals, allegedly from an infamous North Korean hacking organization, have gained access to one of the biggest cryptocurrency exchanges on the planet - Binance - and in less than half an hour withdrew $6.36 billion worth of different tokens.

Security researchers TRM Labs said the attack was carried out by a group called TraderTraitor, which it describes as “North Korea’s premier hacking unit”.

“We base this assessment on robust on and off-chain intelligence sources,” TRM Labs said in a report, noting that TraderTraitor is part of Lazarus Group, North Korea’s state-sponsored threat actor blamed for some of the biggest crypto heists in history, with the FBI blaming it for the $1.5 billion Bybit hack that took place on February 21, 2025.

Gone in 20 minutes

Binance’s experts, as well as independent researchers, are still piecing together what happened, so information might change throughout the day(s). What we know so far is that a DevOps engineer had their laptop compromised, which was confirmed by Richard Teng, Binance co-CEO, in a LinkedIn post.

“That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions,” he said.

Right now, no one really knows what exactly happened and what it means that a DevOps engineer’s laptop was compromised. However, we do know that Lazarus is famous for running operations DreamJob and Contagious Interview, in which they set up fake companies and fake jobs, and then approach software engineers working on crypto projects. They entice them with lucrative job offers and exciting opportunities, and sneak malware during the multiple interview rounds.

But Binance’s security measures are more robust than that, and simply installing malware on one device could not have sufficed. Teng confirmed that, too, saying “the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process.”

Funds are SAFU

TRM Labs said the attackers pulled funds from 10 different chains, including Bitcoin, Ethereum, XRP, Tron, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. The Ethereum chain was the hardest one hit, losing roughly $3.79 billion. It could be because of the chain’s smart contracts feature, which allowed the attackers to keep withdrawing funds as they were landing into the wallet.

Binance is one of the biggest and most popular cryptocurrency exchanges on planet Earth, and as such it holds billions of dollars in user funds. This attack, however, did not target user funds, but rather Binance itself. This was confirmed by both Teng and TRM Labs, with the co-CEO saying “your funds are safe”, and “Binance will cover all losses from the SAFU fund and company funds.”

In response to the attack, Binance temporarily restricted deposits and withdrawals. Numerous users took to X this morning to say their transaction requests were denied. The police and other relevant entities were notified, and around $3 billion were already frozen on-chain, apparently.

Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, TRM Labs confirmed, while Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly $2.7 billion.

What’s particularly interesting about this incident is how the market responded. In 2013, when Mt.Gox (at the time the biggest crypto exchange in the world) got hacked for $450 million, it was considered a “black swan” event, sending bitcoin down by more than a third (35%) in a few weeks. The 2025 Bybit hack sent BTC down approximately 7.5%. In response to the Binance hack, BTC dropped a measly 6.7%, which is just another Friday in the crypto world.

Phishing incoming

Trouble always comes in pairs, and this Binance hack will most likely be no exception. Security researchers NordVPN are warning users that other hacking groups might try to take advantage of the news to target users with phishing emails.

“Another risk is criminals exploiting the confusion and fear among crypto owners on other platforms. An email claiming your funds are at risk, a fake support account offering help or a message urging you to move your cryptocurrency to a ‘safe wallet’ could be an attempt to steal from you,” said Marijus Briedis, Chief Technology Officer at NordVPN.

“Check updates through the Binance app or a website address you already trust. Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase. Pressure to act immediately should be a reason to pause and verify the request.”

“These steps can reduce the risk of someone taking over your account, but they cannot prevent a breach of the platform itself. Cryptocurrency firms typically have watertight cybersecurity, as they are digital-first businesses, so if one can be involved in the biggest hack in history, it shows just how lucrative a single flaw can be.”

• Reddit has announced plans to switch to a primarily logged in experience
• This would mean most of the site won't be accessible without creating and logging in to an account
• Reddit users seem almost universally unhappy about this planned change

Reddit — a site that once had the tagline “the front page of the internet” — looks set to become a lot less accessible, and therefore far less of a front page, as the company plans to require users to be logged in.

Currently, you can access pretty much the entire site without having to log in or create an account, and this has a lot of upsides. It means people who get there through search results can find the information they’re looking for more easily and seamlessly, and it means you can browse Reddit without giving the site any information about yourself, or being subject to any personalization algorithms.

But in a post on the site, CEO Steve Huffman (known as Spez on Reddit) has explained that the site will now evolve to become a primarily logged-in experience.

Tests of this change will begin in select markets outside the US in the coming months, but once the details have been ironed out and tested, it sounds like this shift will become global and permanent.

According to Huffman, this is being done because it’s “better for user experience, better for our ads business, is more in line with safety regulations, and more protective of Reddit data,” but despite Huffman's claims, it’s a change that isn’t going down well with users.

Heading down a worrying path

Responses to Huffman’s post include “hard disagree,” “knew it was going to get worse,” and “truly fascinating to witness a CEO consistently act against their company's interests,” among many others. In fact, just about every reply to the post is negative.

Beyond not wanting to be forced to log in for all the reasons above, users also worry that this change will lead Reddit down the same road as Pinterest. As one commenter said: “this sounds like exactly what Pinterest did... and then Pinterest kinda died.”

So, this sounds like it’s going to be a bad change for just about everyone other than Reddit’s C-suite, though if it does die, then it’s bad for them too. Hopefully, though, if this does lead to a meaningfully worse experience, we’ll see an alternative rise up to take its place, much as the likes of Bluesky and Threads did when Twitter became X. Still, it would be sad to see Reddit go.

• Researcher finds exposed database containing 42 million documents and hundreds of thousands of records with personal data
• The CitySourced-linked repository exposed names, contact details, complaint reports, and internal records for years
• Database was secured after disclosure, highlighting ongoing risks from misconfigured cloud storage

Millions of documents, many exposing personally identifiable information (PII), were sitting online, in an open database accessible to anyone with a browser and the knowledge of where to look. The database belonged to a GovTech company called CitySourced, and has since been locked down.

Cybersecurity researcher Jeremiah Fowler reported finding a database contained roughly 42 million documents and 450,000 JSON files containing PII in plaintext.

The exposed records consisted primarily of images of complaints or code violation reports, but after analyzing a limited sample, Fowler found the database held people’s names, postal addresses, email addresses, phone numbers, and “thousands of internal records dating from 2016 to 2026”.

This kind of information is a gold mine for cybercriminals. By knowing private information about their targets, they can create custom, personalized phishing messages, increasing their chances of success. Data like this is frequently shared and sold on the dark web, and is often used as leverage in ransomware negotiations.

CitySourced reacts

The exposed repository contained different top-level application directories, Fowler explained, listing names such as Api, Content, Customers, Data, Developers, FileStorage, json, Product, Public, Support, Widget, temp, Logs, and others. Apparently, the archive also contained multiple .sdk and .exe files - which are quite out of place and could indicate that someone tried to plant malware.

The name of the database and files inside led Fowler to conclude they belonged to a US company called CitySourced. This is a US civic technology company (GovTech) that develops software that residents can use to report local issues such as potholes or malfunctioning streetlights to municipal authorities. It was founded in 2009 and merged with Rock Solid Technologies in 2019. Three years later, the company was acquired by government technology provider Granicus.

When reporting on these databases, Fowler usually stresses that owning and operating are two different things, and that he could not determine if a third-party contractor managed it or not. Still, after reaching out to CitySourced, the company locked the database down and thanked Fowler for his efforts:

"Thank you again for the responsible disclosure and for following up,” CitySourced said. “Granicus has reviewed the information you provided, investigated the matter internally, and is taking action to address the issue."

How to secure a database

Misconfigured databases continue to be one of the leading causes of data leaks. Some businesses don’t know they are responsible for the security of the data they create and instead believe it’s the responsibility of their cloud provider. Others are simply unaware of the misconfiguration, leaving data widely available and risking reputational damage and even class-action lawsuits.

Fowler says businesses can secure their infrastructure by segmenting customer environments and internal data.

There is no reason for all eggs to be in one basket, so in case of a compromise, configuration error, or unauthorized access involving one tenant, information belonging to other organizations remains secure.

“Storage systems, backups, and sensitive data should be encrypted and protected against unauthorized access,” he added. “Tenant isolation, access controls, and encryption provide a good first layer of defense that could limit the overall impact of a data security incident.”

Individuals should assume that cybercriminals already know something about them. There were so many breaches over the years that it’s almost impossible anyone’s data remained entirely private - at least things like names and emails. Therefore, they should always approach incoming email with skepsis, especially unsolicited ones, and those carrying links, attachments, or messages of utmost urgency.

• Kaspersky says Lazarus's Operation FlashHole, active since at least July 2025, hit at least three South Korean software, construction, and telecom equipment firms
• An updated LPEClient tool uses four ML-KEM-1024 key exchanges to protect payload delivery, a design Check Point also documented
• The post-quantum layer guards traffic against future decryption, not endpoint detection, and the most likely way in for the hackers was still phishing

North Korea's most notorious hacking group has been caught protecting its malware with the same post-quantum cryptography that governments and tech firms are still rolling out to safeguard their own data.

In its analysis of a campaign dubbed Operation FlashHole, Kaspersky's Global Research and Analysis Team (GReAT) says an updated version of LPEClient, a Lazarus Group tool, now uses ML-KEM-1024, a key exchange mechanism designed to resist attacks from future quantum computers, to secure the channel it uses to download more malware.

The findings describe a campaign active since at least July 2025 that has hit at least three South Korean organizations in the software, construction, and wired communication equipment manufacturing sectors.

A fake AI-tailored résumé, a mandatory plugin, and quantum-resistant encryption

The way in was familiar: Kaspersky found a GitHub Pages site tied to a GitHub account, created in September 2025, that the attackers used for command and control. The site first showed the résumé of a supposed senior network appliance developer, likely seen by an employee of the communications equipment maker, before the attackers swapped it in January 2026for an interior design showcase that probably targeted the construction firm.

Kaspersky assesses with medium-to-high confidence that targets received spear-phishing emails linking to these sites, which loaded JavaScript from attacker-controlled domains, though it could not determine exactly what triggered the infection.

From there, the chain ran through INISAFE CrossWeb EX, financial security software South Koreans need in order to use many online banking and government websites. How it was abused is unclear, but the malware ended up running in memory with elevated privileges, spawned by a CrossWeb EX build released in 2023 after a public advisory from South Korea's KrCERT.

That is a well-trodden route; Kaspersky says Lazarus abused CrossWeb EX in 2021, 2022, and 2023, and in Operation SyncHole, disclosed in April 2025, it used Cross EX, a related program, to compromise at least six organizations, and we also reported on the group exploiting a zero-day in MagicLine4NX, another South Korean authentication tool.

Kaspersky believes the photo on the résumé site was AI-generated, citing missing EXIF metadata and an unnatural texture, and that AI most likely built the site too, given a candidate name resembling Korea's equivalent of "John Doe" and a portfolio stuffed with filler details and unrelated companies.

ojun Ryu, senior security researcher at Kaspersky GReAT, said the findings suggest Lazarus is "bringing AI into its long-established playbook," a shift Kaspersky has also seen among other Lazarus-aligned groups. That fits a broader pattern, from Kimsuky using ChatGPT to forge a South Korean military ID to North Korean IT workers using generative AI to get hired at Western firms.

The more striking change is inside LPEClient, a profiling and payload delivery tool that first appeared in 2019. The new version no longer stores its own server address; instead, it relays traffic through ClientHub, a newly discovered loader with a variant that talks to its operators via Dropbox. It profiles installed security products and the Windows patch level, now also checks whether protections such as Shadow Stack are enabled, and encrypts that report with GOST, Russia's national cipher standard.

A security-conscious hacker group?

Then comes the post-quantum part of the equation. The server sends four ML-KEM-1024 public keys, LPEClient derives four shared secrets from them, and those are combined into a single 128-byte key for Threefish, a tweakable block cipher originally built for the Skein hash function. That key decrypts the next payload, which is loaded straight into memory.

ML-KEM-1024 is the strongest of three parameter sets in NIST's FIPS 203 standard, and the one the NSA specifies for key establishment under CNSA 2.0, its algorithm suite for US national security systems. Kaspersky's report notes, with some irony, that the group seems to have "adopted more secure post-quantum cryptography faster than many legitimate security products."

Ryu said the part that "deserves closer attention" is the group's "adoption of cryptography designed to withstand future quantum threats," which Kaspersky traces back to at least September 2024. If that holds, Lazarus was using the technology within weeks of NIST finalizing its first post-quantum standards on August 13, 2024, and more than two years before this month's disclosure.

Kaspersky is not the first to spot this, either. In August 2026, Check Point Research described a module in a separate Dream Job wave against defense companies that fetched four public keys from its server and used Kyber/ML-KEM to agree on a key to download FudModule, a rootkit that exploited the since-patched Windows zero-day CVE-2026-68820. Kaspersky identifies the module as LPEClient, and the campaign received widespread coverage at the time.

No publicly known quantum computer can yet break the classical key exchanges that protect most internet traffic, so ML-KEM only gives Lazarus an edge if someone records its traffic today and decrypts it once such a machine exists- the "harvest now, decrypt later" scenario driving the civilian migration.

For a state espionage operation whose opponents include well-funded intelligence agencies, keeping its tooling sealed against that possibility is a rational, if forward-looking, choice. Kaspersky's own reading is that the group wants to hide its later-stage payloads.

It does not, however, hide the malware where it runs; the post-quantum layer protects data in transit, and Kaspersky's analysis of the malware itself laid the whole exchange bare. Kaspersky says the work points to a dedicated developer, and the rest of the toolkit supports that view: ClientHub uses the SNOW stream cipher, a first for Lazarus according to Kaspersky, and copies headers sent by Chromium-based browsers to blend in.

Kaspersky believes the focus on software firms, the only sector hit in both SyncHole and FlashHole, reflects an appetite for source code that can be mined for new vulnerabilities. It also distinguishes FlashHole's espionage from a parallel cluster of attacks built on Lazarus's COPPERHEDGE backdoor that appears to be about making money.

For potential defenders, the lesson is the delivery rather than the cryptography: a convincing fake résumé and a trusted security plugin. Kaspersky's advice, which also promotes its own products, covers verifying unexpected links even when they lead to polished professional sites, patching quickly, removing unneeded components, restricting user privileges, and watching connections to cloud services such as GitHub and Dropbox that can double as command channels.

Since the post-quantum layer does nothing to hide what the malware does on the machine itself, capable endpoint protection software remains the realistic place to catch it. Whether its newly-found AI-assisted approach is a game changer, however, remains to be seen.

Now that I've seen and touched the touchscreen MacBook Pro, I'm starting to understand that, despite the invention of a Frankenstein-ed new display term ('PROLED'?), this display might be something special. It looks extraordinary, and when compared visually with, say, the Lenovo Yoga Pro 9i Aura Edition, which also has a Tandem OLED, it doesn't even seem to be of the same species.

There are good reasons for this, which span from the fabrication process to the core specs of what is clearly Apple's most advanced laptop display yet.

Starting with manufacturing, Apple says it employed an unnamed manufacturing partner to build these panels in what's known as a Gen-8 OLED Fab. Seeing as there are just four of these cutting-edge facilities in the world, and that one of them is operated by Samsung Display, which has reportedly partnered with Apple on display tech previously, I'd guess it's Samsung.

One of the most notable features of these manufacturing facilities is their massive size. Whoever the partner is, we know that the touchscreen MacBook Pro's panels are being manufactured in a chamber around the size of the Colosseum in Rome. These huge facilities improve yield, efficiency, and costs.

Though less than a millimeter thick, the laptop PROLED XDR panel is comprised of 50 layers. Even what appear to be individual panels have many layers, sometimes just a nanometer thick. The two stacks of OLED have, for instance, 30 layers, though the organic self-emissive material is layered onto the panels and dried, making the layers range from one nanometer to hundreds of nanometers thick. FWIW, I held some of these individual panels, and they are incredibly thin and light.

Behind the OLED is the TFT (thin-film transistor) glass substrate that powers and drives the imagery on the surface.

What's not mentioned here is the digitizing layer (basically the same touch technology you find on the iPhone and iPad) that drives touch; that's because it's integrated with the whole in a process that, if it isn't already, probably should be patented.

Despite working with a third party, the production is another Apple trademark bespoke process, and one not necessarily replicated in other Tandem OLED or even basic OLED display manufacturing processes.

The specs bear that out. Where the Lenovo Yoga Pro 9i Aura Edition touch display has a pleasing 1,000,000:1 contrast ratio, Apple's touchscreen MacBook Pro boasts 10,000,000:1. In person, and even under bright lighting conditions, the blacks and definition I saw on the touchscreen MacBook Pro PROLED XDR are stunning.

The MacBook Pro display also looks better because Apple equipped it with up to 2,000 nits for HDR and SDR content, and both an anti-reflective screen and the option of the nano-etched one, as well. Essentially, I could see myself reflected in the Lenovo, and could not detect my reflection in the MacBook Pro.

Also, for those concerned about fingerprints collecting on the touchscreen MacBook Pro, Apple has applied an oleophobic coating to the standard and etched displays. In my hands-on time with several of the new laptops, I didn't notice any significant fingerprints.

Compared to the Lenovo Yoga Pro 9i's 1,600 nits, the touchscreen MacBook Pro looks better equipped for working in direct sunlight. Based on what I saw, the MacBook Pro also maintains much better off-axis color quality.

Looking beyond direct visual comparisons with pro-grade Windows laptops, Apple is positioning the touchscreen MacBook Pro display as both a color reference screen and one that has grayscale precision reportedly sufficient for medical diagnostics. This is basically a reference monitor on a laptop frame.

So, sure, the story is that we finally have a touchscreen MacBook, but it may be the visual quality that ultimately wins over creative, business, medical, and film professionals. It's probably the best display Apple has ever produced, not just for a laptop, but possibly for any Mac system.

Of course, a screen panel alone does not make a laptop, and there are questions around whether everyone wants or needs touch, if the redesigned hinge is stable enough to keep the laptop from wobbling with every touch — and if touch capability is worth the almost $1,000 premium.

• Report says AI is being given too much authority and autonomy to handle business-critical security decisions
• 70% of organizations delegate decisions to AI that would have been made by a human 12 months ago
• A “control gap” exists between the authority given to AI and an organization’s ability to audit it

Delegating complicated decisions to AI is leading organizations to place relatively new technology in charge of user permissions, in control of sensitive data, and risk security issues, new research has claimed.

A study by Illumio looked into how organizations are handing decision recently performed by humans to AI, without apparently taking into account the potential for serious issues to arise.

It found the majority (70%) of organizations are delegating previously human-made decisions to AI, but only around half (49%) can see what action is taken by an AI agent an audit it.

AI recommendations

The nature of AI agents makes this a particularly risky strategy, and the research has found that an incredible 56% of organizations are willing to accept greater cyber risks than 12 months ago. Almost half of that group (47%) have admitted to permitting AI actions in production environments.

Allowing AI agents to have free run of enterprise data, applications, and infrastructure is leading to wholly avoidable situations. Illumio’s research found that a control gap between the rules that organizations believe AI agents are operating within and what the technology is actually capable of.

Some 76% of organizations have experienced one or more security issues thanks to AI in the past year, with 35% revealing that following AI recommendations would result in a security risk. Meanwhile, 26% reported AI agents or tools had connected to other systems without the necessary approval.

More worrying is the 24% of organizations reporting AI’s drive to access data it shouldn’t be able to see, and another 24% stating it has triggered (or produced) an unauthorized action.

Strict limits

Of course, AI is already used within cybersecurity, and has proved successful with multiple vendors rolling out AI-enhanced solutions. But while 67% of organizations are using AI cybersecurity tools, 32% let AI conduct investigations without human oversight and 29% permit the software to deploy code changes completely unsupervised.

“The biggest AI risk may not be a system that breaks its rules. It may be one that was never given meaningful limits in the first place," noted Raghu Nandakumara, VP of Industry Strategy at Illumio.

Unleashing AI agents without constraints has left businesses struggling to control the software.

As Nandakumara observes, AI agents are persistent, and attempting to outwit their next move is pointless. Instead, “businesses must set strict limits on what they can access and do, then enforce those limits within the application and across the underlying infrastructure. That is how you contain unexpected behavior before it causes real damage.”

• Attackers used SEO-poisoned GitHub pages and fake AI clients to lure victims into downloading malware
• The Yoba malware establishes persistence, evades analysis, and ultimately deploys XMRig cryptominers
• Campaign abuses interest in popular AI tools like GPT and Claude to monetize victims’ computing resources

Cybercriminals are, once again, exploiting people’s interest in AI tools to distribute cryptojackers and make money - this time around, opting for a combination of spoofed popular products, trusty old GitHub, and a little SEO poisoning.

The campaign was spotted by security experts from Check Point Research (CPR), who’ve been tracking it for the past two months, noting that the unnamed attackers created fake downloadable clients for GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, and hosted them on GitHub.

Usually, when threat actors spoof legitimate software and try to disseminate it via GitHub, they go the extra mile to feign legitimacy - they artificially inflate download numbers, deploy bots to ramp up stars or forks numbers, and post fake comments. That way, when a victim opens the page, they have no reason to doubt they’re looking at legitimate, popular software.

In this case, however, they didn’t bother with GitHub. However, CPR says that the pages still appear at the very top of Google’s search engine results pages for certain keywords, indicating that they’ve invested heavily in SEO poisoning.

SEO poisoning

Search Engine Optimization (SEO) poisoning is a simple practice - criminals purchase hundreds (if not thousands) of articles, blogs, and social media posts on the dark web, and have them uploaded and published across the internet.

Each post carries a link to the desired GitHub page, giving Google the signal that that specific page is popular and relevant for certain terms.

As a result, Google pushes it to the top of its results, unknowingly aiding the attackers into reaching their targets quicker. The attackers have also created separate GitHub websites to serve as descriptions for the applications and linked them directly to downloadable installation files.

As a practice, SEO poisoning was popular even before the advent of AI, but now it’s gotten even easier, since the tools can easily generate as many articles as needed, for a fraction of the previous cost. Obviously, these texts are extremely low-quality, and Google has been working on labeling them as spam, but the process is still ongoing.

When victims land on these GitHub pages and download the executables, they think they’re getting a standalone client for an AI tool. What they’re getting instead is a piece of malware called Yoba.

Once a victim downloads and runs it, Yoba establishes persistence by creating a mechanism that would launch it automatically every time the system restarts. Average computer users might have a tough time spotting it, too, since it presents itself as legitimate Windows software.

Yoba then checks the device it’s running on to make sure it’s not in a sandbox, or infecting someone in a “friendly” country. It can deliberately delay execution for two weeks to make analysis more difficult, and checks the computer’s keyboard to avoid infecting systems from Russia, Belarus, Kazakhstan, and Uzbekistan. CPR did not say where the attackers are from, but this filter could give a strong indication.

Deploying XMRig

The malware’s final step is to contact the C2 server and pull the final payload. While this can be virtually anything - from infostealers to ransomware encryptors, CPR says it is currently being used to deploy XMRig.

XMRig is an entirely legitimate, open-source program used to mine the Monero cryptocurrency.

Unfortunately, it is extremely popular among cybercriminals because Monero is designed to be a “privacy first” coin and, unlike Bitcoin or Ethereum, cannot be as easily tracked across the blockchain. Mining requires significant computing and electricity resources, as well as for the devices to be connected to the internet. By installing XMRig to countless devices, crooks can generate a hefty amount of tokens, leaving the victims to pick up the inflated energy and compute bill.

Well, it’s finally happened: Apple has got with the times and finally made a laptop with a touchscreen. However, while the new MacBook Pros with PROLED screens look like fantastic devices, I think Apple has made a mistake by putting its first laptop touchscreen on the more expensive MacBook Pro, rather than the more mainstream MacBook Air… or even the MacBook Neo.

The 14-inch MacBook Pro with a touchscreen starts at $2,899 / £2,899 / AU$4,599, and the 16-inch model starts at $3,399 / £3,399 / AU$5,499. That’s a big ask for most people, especially these days.

Of course, MacBook Pros, as the name suggests, are aimed at professionals, and thanks to their high-end components, they should really be seen as investments that allow you to speed up your workflow.

Interestingly the new touchscreen MacBook Pros come with Apple’s M5 Pro and M5 Max chips. If you want Apple’s latest M6 chip, you’ll need to go for the non-touchscreen 14-inch MacBook Pro that was announced a few days earlier. Perhaps confusingly, the M6 is less powerful than the M5 Pro and M5 Max, and so far there are no hints that Apple is preparing to release M6 Pro and M6 Max chips.

My point is that by putting its first-ever laptop touchscreen on its most powerful — and expensive — MacBooks, Apple is severely limiting the potential audience for the technology. Had it instead put a touchscreen on the more affordable MacBook Air, it could have had a real hit on its hands.

Who’s it for?

As someone who has used plenty of Windows laptops and Chromebooks with touchscreens in the past, I know how useful they can be for certain tasks, and I often miss them when using a MacBook.

Being able to scroll down a website with a finger, turn a page in an ebook, or quickly tap a menu item feels natural and intuitive, and I’m sure it will on the new MacBooks. My daughter, who grew up with touchscreens on everything, would also instinctively poke an often sticky, grubby (kids, you’ve got to love them!) finger at a MacBook screen and be surprised when nothing happened.

These are all pretty simple tasks and gestures. What I've never used touchscreens on laptops for, however, is for complex tasks and tools, such as recording and editing music in Ableton Live, or editing videos in Adobe Premiere Pro.

Instead, for things that needed precision or complexity, nothing beat the good old combo of keyboard and touchpad (or even better, keyboard and a mouse), as well as other external peripherals such as MIDI controllers and drawing tablets. Which leads me to wonder why Apple picked the MacBook Pro, a device that’s supposedly designed for exactly those type of tasks, to showcase its first laptop touchscreen.

If you’re dropping $3,000+ on a touchscreen laptop to mostly just to use the touchscreen for browsing websites, then you’re either super-rich or you should get help with your budgeting.

The 16-inch MacBook Pro with M5 Pro and no touchscreen starts at $2,999 / £2,999 / AU$4,799. As the MacBook Pro with the PROLED XDR touchscreen with the same specs costs $400 / £400 / AU$700 more, that’s quite a premium for the touchscreen.

Yes, I know the PROLED XDR screen offers better image quality as well thanks to its tandem OLED tech (check out our explainer on why this is a big deal), but if you don’t need that additional image quality, which includes better contrast, higher brightness levels, and support for the Adobe RGB color gamut, and are just interested in the touchscreen, then essentially yeah, you’re paying $400 extra for it.

If you’re a professional, especially one in the creative industry, you’ll need to think long and hard if that investment is worth it. Meanwhile, the likes of the MacBook Air and MacBook Neo aren’t really used for complex creative tasks, and instead used for casual day-to-day use, where touchscreens are much more useful.

Granted, adding an extra $400 / £400 / AU$700 to the price of a MacBook Neo or MacBook Air wouldn’t be great, especially as they’ve just had a price bump earlier this year, but Apple wouldn’t need to include the OLED tech and advanced image-quality options included in the MacBook Pro. A touchscreen MacBook Neo for $899, say, could be a real hit, especially if Apple was to also keep the non-touchscreen model for people who still want the ultimate affordable way to get into the Mac ecosystem.

This isn’t just an Apple problem, of course. The new laptops powered by Nvidia’s RTX Spark SoC, which are aimed at the same creative professionals and heavy local AI users as the MacBook Pro (with similarly high price tags), come with touchscreens. I’ve spent a decent amount of time with each one at various events, and I found that the touchscreen was the least-used part of the laptop — in fact, I often forgot those laptops had one. Because there aren’t cheaper, non-touch, models, though I didn’t resent its inclusion.

As I said, I do get the appeal of touchscreen laptops, but I find the technology is best used in 2-in-1 devices where the keyboard can be flipped behind the screen (or removed entirely) so that it can be used as a tablet-like device.

In an ideal world, then, Apple would have put its touchscreen on an entirely new 2-in-1 MacBook, but I can’t see that happening any time soon. Apple sort of has a device like that — the powerful iPad Pro, which can be paired with a Magic Keyboard that turns it into a touchscreen laptop. The problem there, however, is that despite coming with Apple’s powerful M-series chips, the same you’ll find in MacBooks, the iPad Pro is limited to the iPadOS operating system and mobile apps.

Put macOS on that bad boy, however, and allow us to run full desktop applications on it, and hey presto: Apple has a touchscreen MacBook that utilizes the tech in a way that’s actually useful. Until then, I’ll stick with my standard MacBook Pro, and just try to remember not to prod it with my sausage fingers too often.

• YouTube announced it's hit 150 million subscribers across Premium and YouTube Music
• The platform also generated $11.2 billion in ad revenue
• Users say free tier ads are only getting worse, with some calling them 'unbearable'

YouTube announced that it has surpassed a whopping 150 million subscribers across its Premium and YouTube Music experiences — marking a huge milestone for the video platform and one of the best music streaming services.

Alphabet Inc CEO, Sundar Pichai, announced the figures in the platform’s Q3 earnings release on Wednesday (October 28), which increased by 25 million from a total of 125 million subscribers in March 2025, though individual numbers for Premium and YouTube Music weren’t disclosed. Pichai also shared that YouTube’s ad revenue rose to more than $11.2 billion compared to $10.3 billion in 2025.

Speaking about the milestone, Google’s Chief Business Officer, Philipp Schindler, said "With Premium and Premium Lite, viewers have choice. As more people opt into premium experiences, it’s a win for viewers, creators, and our business. Subscriptions help fund the creator ecosystem and drive the platform forward."

YouTube has accumulated over 25 million subscribers between now and when it last confirmed its total membership count in March 2025. When you break that down, that’s approximately 1.25 million new subscribers signing up each month, and it’s only going to increase.

While it’s not a traditional on-demand film and TV content platform, YouTube has emerged as a serious competitor among the best streaming services. In 2017, the company launched YouTube TV, and according to a recent report from Nielsen, it has surpassed Netflix in popularity for TV viewing. In July 2026, 49% of TV time was viewed via streaming platforms, with YouTube making up 14.2% of that, followed by Netflix at 7.8%.

There’s no denying YouTube Premium is rising in popularity, but as the company puts more effort into improving its paid services, a number of users have said its free version is becoming increasingly difficult to use because of the number of ads.

Earlier this year, I bit the bullet and signed up to a YouTube Premium free trial and, annoyingly, the experience was vastly more enjoyable. Not only does it grant you ad-free viewing, you get background and offline listening, as well as small but handy control tools and full access to YouTube Music. But once you go back to its free version, that’s when you truly realize how out of control YouTube’s ads have become — and I’m not the only one who’s noticed (see below).

In addition to YouTube’s ‘completely unbearable’ ads, users have also pointed out the rise in AI-generated sponsored content which one Redditor claims advertise "obvious scam products". The combination of the two is the main catalyst for users abandoning YouTube as a platform altogether, and tech-savvy users are already opting for alternative ways to bypass ads.

One of the most popular ways YouTube viewers are working their way around ads is downloading browsers such as Brave, which users on Reddit have praised. Browsers like this come with built-in ad blockers, so it can automatically skip over ads when you’re streaming YouTube for free.

While YouTube gives you the option to tailor your ad experience and block certain types of promotional content, some users claim that when they do this, YouTube only feeds these ads to them even more. One user on Reddit used Old Spice as an example, saying "it's like blocking them has a reverse effect." Similarly, another user had an experience where they reported a potential scam ad, only for YouTube to email them with a counterargument.

I’m with a lot of other users who continue to call out YouTube for how expensive Premium has become (it now costs $15.99 / £12.99 / AU$22.99 a month), especially when you factor in your existing streaming subscriptions, so many of us just put up with its free service. Despite enjoying what Premium had to offer during my free trial, it doesn’t justify adding another subscription plan to my roster — my bank account will fall out with me.

• Attackers abused camera management software to gain initial access and establish persistence on networks
• Campaign used DLL sideloading and reverse shells to evade detection and maintain control
• Researchers urge treating camera systems as security-sensitive assets and monitoring them for abnormal activity

Security researchers have warned of an ongoing campaign targeting an apparent vulnerability in camera management software. The vulnerability is being used for initial access, allowing threat actors to establish a foothold on company infrastructure.

The warning bells were sounded by security outfit Huntress, whose researchers Harlan Carvey and Lindsey O'Donnell-Welch said that in September and October 2026, they observed a “handful of incidents” originating from camera management software.

In all cases the attackers abused a legitimate camera management system to side-load a malicious DLL file and gain access to the underlying system.

Who watches the watchmen?

Surprisingly, the team could not determine which camera software was being targeted, nor by whom.

“Huntress analysts were unable to determine the full name or creator/vendor of the software, as the file did not contain an embedded File Version Information section,” they said.

However, they did find an executable containing a few notable strings, which led them to believe a Korean company called 3R Global could be involved. They couldn’t confidently say that the Camera Management System (CMS) executable was downloaded from that company’s website, though.

Unfortunately, without knowing the exact name of the software being targeted, it is impossible to tell how many victims there were, or how big the attack surface is. Huntress’ “handful” designation does very little to explain just how dangerous this vulnerability is.

While the lack of key data limited their visibility into exactly how the threat actors were compromising the software, they could see what they were doing once they were inside - launching a reverse shell and side-loading malicious DLLs.

Once the initial access had been established, the attackers would drop a file named rs.win32.exe to the endpoint and would launch it via a command line. The command line would supply a remote IP address and port, and include an admin username.”This led us to see this as a reverse shell,” they said.

From there, they would drop a file called WpcMon.exe - a legitimate Microsoft Windows Parental Control Monitor file, used for parental-control and activity-monitoring features. In this case, however, the file is used to load malicious DLLs called IPHLPAPI.DLL and samcli.dll. On the surface, both appear to be legitimate zlib compression libraries, but in fact, they were changed to provide beaconing, contacting the external C2 server from time to time.

Huntress watches the watchmen watching the watchmen

“Part of the infection process also included creating persistence by adding a reference to the newly installed WpcMon.exe in a value beneath the user's Run key,” the researchers explained. “Threat actors typically add a program path to a user's Run registry key so Windows automatically launches their payload whenever that user signs in.”

Side-loading malicious DLL files is a popular infection technique. Instead of deploying an obviously malicious program (which might get flagged by antivirus products), the attackers drop a DLL file containing weaponized code, and then get a legitimate program (such as the parental control software) to run it. Since the process starts with a legitimate executable, it is more difficult to identify as malicious.

It does not guarantee evasion of security software, though.

Defenders should treat cameras and their management platforms as potential entry points into the broader business environment, Huntress warned. They should inventory the software, restrict its access, and monitor for unusual processes and outbound connections.

The researchers also advise defenders to use application control to prevent unapproved executables and DLLs from running in user-writeable paths, and to investigate the sequence of CMS.exe, rs.win32.exe, abnormal WpcMon.exe, and unapproved outbound connections.

• FBI and international partners seized infrastructure tied to Virtualine, a hosting provider allegedly serving cybercriminals
• Authorities say the service facilitated phishing, ransomware operations, illicit crypto activity, and other crimes
• Investigators seized servers and customer data, though no arrests have been announced so far

The FBI has announced it seized the website of Virtualine, a bulletproof hosting service that allegedly allowed child pornography, laundered stolen and extorted crypto, and facilitated a wide range of other criminal activities.

The operation was carried out in partnership with German and Dutch authorities, as well as multiple private companies, with police raiding a data center in Limburg to seize “dozens of physical servers” that also hosted “hundreds” of virtual servers. As a result, they gained access to information about more than 3,000 of Virtualine’s customers, it was said.

“The police are currently taking follow-up actions towards these users,” the Dutch police said, although it’s difficult to say how valuable the information will be, since most bulletproof hosting providers don’t ask for private data, and criminals are good at hiding it, as well.

Bulletproof hosting

Every website, including hacking forums, criminal service providers, even fraudulent landing pages, needs a server that hosts it. Hosting providers renting out these servers are generally compliant with law enforcement agencies, so when the police requests a takedown or files a complaint, most of them comply. However, there is a subset of hosting providers, colloquially called “bulletproof hosting”, which are unusually resistant to pressure from the authorities.

It doesn’t mean all of them are inherently illegal or malicious. There are cases where such services are necessary - in countries with strong censorship, or where website owners want to protect their identities.

In this case, however, Virtualine was openly criminal, with the US Department of Justice (DOJ) saying it advertised its services to criminals on cybercrime forums saying, on at least one occasion, “You can use Virtualine for all illegal/black hat activities (including phis[h]ing, carding, email spam, port scanning and all others) except for child contents and terrorism activities.”

The company took it a step further. In March 2026, it introduced an “additional protection plan” that offers customers who receive takedown requests “another shell company not affiliated with Virtualine, after which the server is reactivated.”

Interestingly enough, Virtualine said it did not accept child porn or terrorism content, but according to the DOJ - did exactly the opposite.

One of its clients created a forum that allowed users to post and sell access to “nude, sexually suggestive, and/or sexually explicit images and videos of minors and adults,” while also promoting a hack-for-hire service that broke into people’s accounts and stole their explicit photos and videos. Virtualine was even notified about it by law enforcement agencies from Germany, Canada, and Australia, but decided to ignore the warnings and continue hosting the client.

At the same time, Virtualine’s customers were allowed to pay in Bitcoin, offering an unhosted bitcoin address that allowed customers “to direct pay without concern their funds would be flagged as illicit”. Citing Chainalysis data, BleepingComputer said the company’s wallet was seen receiving funds from ransomware operations, infostealers, Russian-language cybercrime forums, and more.

“Virtualine then laundered those proceeds to conceal their origin,” the blockchain company added.

Piercing the kevlar

Besides confiscating the servers and the data, the main website - virtualine.net - was defaced and now shows the usual FBI “this website has been seized” message. Unfortunately, no arrests have been made, which means the service will most likely continue operating.

According to BleepingComputer, it is “partially online” but its network prefixes currently have very low routing visibility, which could mean that much of its infrastructure was pulled offline.

Usually, disruptions such as this one are only temporary, and it won’t take long before they are remedied and the service becomes fully operational again.

• Ofcom has assessed the best ways of enforcing age checks online
• The regulator also identifies methods that aren't effective
• Around 4 in 10 under-16s plan to try to get around the ban in the UK

Back in June, the UK government ruled that under-16s should be banned from social media platforms, with enforcement scheduled to start during the first half of 2027. Now the communications regulator Ofcom has set out the ways it expects tech companies to abide by the law.

In its new announcement (via the BBC), Ofcom highlights four "highly effective" methods for keeping under-16s out of apps and off sites they shouldn't be accessing — and they're all going to be familiar to anyone who's used age-gated services online in recent times.

The four methods are photo ID matching (using something like a passport or driving license), bank-based checks (Ofcom says 90% of UK 16-17 year-olds have a bank account), digital ID services (a third-party service like EasyID or Yoti), and facial age estimation via a webcam (which Ofcom says is best deployed as a secondary check).

This is a "rapid assessment" from Ofcom, and none of these approaches are confirmed yet — UK lawmakers will take the suggestions on board, and decide the best way to enforce the rules at a later date, most probably before the end of the year. All of these methods can be delivered "in a way that protects users' privacy" according to Ofcom.

Ultimately though, it will be down to tech companies to decide how to implement age checks that fulfil the requirements set down by the government. "Here are things that can work, they must preserve privacy, they must protect people's data, but it's on you to put in place what you think works for you," Ofcom CEO Dame Melanie Dawes told the BBC.

Challenges ahead

Ofcom also lists checks that it thinks are ineffective: self-declaration, general contractual agreements, and verifiable parental consent. The regulator also acknowledges that "the risk of circumvention cannot be entirely eliminated", but says that correctly implemented safeguards should "significantly reduce the likelihood" of unauthorized access.

In its rapid assessment announcement, Ofcom also encourages app stores to take more responsibility over age checks. Right now, self-declarations are most commonly used to unlock downloads for age-restricted content.

These are going to be tough rules to enforce, whatever the approach is: recent research from EE suggests that 42% of 11-15 year-olds are planning to try and get around whatever restrictions are put in place. This could be by switching to apps or platforms not covered by the new laws, including messaging services and gaming sites.

Last week Ofcom also admitted that the Online Safety Act introduced in July 2025 had so far made "no significant change" to the harmful content children had been exposed to online. The act was intended to ensure protection from content involving pornography, serious violence, suicide material, racism, misogyny, and bullying.

"This finding is concerning and shows that further progress is needed to protect children online," says Ofcom. The regulator also recommended adding material around body stigma and depression to the primary content categories that children should be protected from online.

Analysis: What do privacy experts think?

Ofcom's proposals are likely to spark some familiar privacy concerns — and security experts told us they aren't without foundation.

“The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check," said Pieter Arntz, Senior Malware Intelligence Analyst at Malwarebytes. "Photo ID matching brings highly sensitive documents and facial images into the process, potentially creating another attractive target for criminals. The risks aren’t hypothetical: as I reported last year, a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users," he said.

Even if facial estimation techniques are more secure, there are are still downsides. "Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction," Pieter Arntz added. "Ofcom itself acknowledges that some technologies have a margin of error of a few years at 16, meaning people near the threshold may face an additional verification check," he said.

"My preference is double-blind verification: a provider confirms that you meet the age requirement but doesn’t learn which service you’re accessing, while the service receives proof of age without learning your identity. Proving you are old enough should not mean revealing who you are," he said.

Others feel the risks are more around teenagers finding workarounds.“The challenge for social media platforms is that teenagers don’t like to be told ‘no’. Many will conform, but tech-savvy young people are going to search for an open window on the ground floor," said Olli Krebs, SVP EMEA at the identity verification software provider Incode. "If the process is clunky, users of all ages will actively seek ways around it," he added.

Those workarounds could unintentionally make the problem worse. "The experience of countries such as Australia is that there will be a real risk of an increasingly technologically sophisticated population of young people will resort to a variety of circumvention techniques (primarily, but not exclusively VPNs) to access content hosted outside of the UK," said Will Richmond-Coggan, Partner specialising in Data and Privacy Disputes at Freeths.

"Such content is liable to be less well regulated generally, and to pose further risks of users gaining unsupervised access to progressively more dangerous and problematic content in relation to which the UK online safety legislation is largely powerless to take action," he added.

“None of this will be perfect. Young people will always push boundaries, and anyone promising a hundred per cent online safety is being unrealistic," concluded Olli Krebs from Incode. Exactly how successful it is depends very much on how the social media giants implement Ofcom's suggested age-check methods.

What you think of the social media ban, and Ofcom's new proposals? Let us know in the comments below.

• Sony Network Communications discloses breach affecting roughly 2.5 million ISP customers and former users
• Exposed data included personal details, while some email service users also lost email passwords
• Company contained the intrusion, notified authorities, and warned customers about phishing and fraud risks

A subsidiary of Sony Network Communications, the Japanese tech giant’s Internet Service Provider (ISP) arm, has confirmed suffering a data breach which saw it lose sensitive data on roughly 2.5 million people.

Among the stolen files were people’s phone numbers, email addresses, and in some cases - email passwords.

The company confirmed the news in an apology and notice letter in which it said threat actors accessed So-net, the company’s consumer-facing ISP service brand. The identity of the attackers was not disclosed, and nor was the method they used to break in. The breach happened on Monday, October 19 2026, and was spotted four days later, on October 23.

“Immediately after confirming the incident, we shut down the affected server and blocked communications from the source of the unauthorized access,” the machine-translated letter reads. A day later, the investigation determined that the attackers exfiltrated a total of 2,141,986 sensitive records belonging to both current and former members.

Trickling down to NTT Docomo

Of that number, roughly 1.8 million belong to current members, who had their names, phone numbers, email addresses, user IDs, dates of birth, genders, and internet connection IDs exposed to the hackers. Passwords were not leaked, Sony said.

There were also more than 440,000 records taken from plala (S Course), and this part also affects NTT Docomo, a separate internet service provider that uses Sony Network Communications’ underlying infrastructure as part of its service.

NTT Docomo issued a separate statement, notifying its customers of the incident, and urging them to stay vigilant with incoming emails and other communications:

“There is a risk of suspicious communications from those who misuse potentially leaked information in the future,” the machine-translated notice reads. “Please pay attention to the following points:

・Do not respond to emails, SMS, or phone calls

・Do not open links in the body

・Do not open attached files.”

The company added that the incident affects all Hikari service clients, as well as those that cancelled from May 2026, onwards.

Some So-net members’ email addresses and email passwords were, indeed, taken. A separate set of data affecting Email Service (G), A-Box (an additional mailbox service), So-net VAIO Mail, and PostPet Mail Account Service was nabbed, and the company reported 24,655 affected addresses for Email Service (G), 17,672 for A-Box, 7,005 for So-net VAIO Mail, and 5,069 for PostPet Mail Account Service. The breach affects both current So-net customers, and those that cancelled their subscriptions in March 2026 or later. Those that cancelled by the end of February were not affected, according to the announcement.

Banking data struck, too

Some customers also had their banking data exposed - but not many. “We confirmed the leakage of 16 records containing bank account information, including financial institution name, bank code, branch name, branch code, deposit account type, account number, and account holder's name,” the company said.

It stressed that it does not hold bank account PINs and therefore, they could not have been compromised. “We will individually contact the affected customers to apologize,” the notice reads.

Sony Network Communications said it notified the country’s Personal Information Protection Commission and other relevant government and law enforcement organizations and is currently investigating the attack.

So far, no hacking groups have claimed responsibility for the attack, and the data has not yet appeared anywhere on the dark web. There is also no word of this being an extortion attempt.

The attack comes less than a week after Japanese internet giant GMO Group told its customers to scan their computers for viruses, back up all of their data, disconnect the devices from the internet and then shut them down.

Via BleepingComputer

• Windows 11 has a new preview (optional) update
• This introduces the ability to fully tailor the right-click (context) menu to your liking, as well as speeding up its performance
• That's great, but you're best off steering clear of a preview update and waiting for the full release in under two weeks – but even then, this feature will be on a gradual rollout

Windows 11 now has one of the most-wanted interface capabilities for many people, namely the ability to customize the right-click menu – but it's not quite fully finalized yet (although that's imminent).

The menu that pops up when you right-click on a file (or folder) is also known as the 'context' menu as it presents a bunch of options that vary contextually based on the type of file clicked – but in Windows 11, it's currently a sprawling affair.

Those who hate the lengthy right-click menu will now be able to customize it after installing a new Windows 11 update, although this is an optional release, meaning it's still in preview. This feature will be in next month's patch, the November update, though, so you haven't got long to wait for the full release (less than two weeks, in fact).

The customization settings for the right-click menu include the ability to remove Windows commands you're not fond of – like 'Send to' for example – or add abilities that you'd like to have, and also choose the apps you want to appear in the context menu.

It's a full range of customization and you can also elect to have the top panel of the menu (cut, paste, rename and so forth) directly integrated instead, so these functions appear alongside everything else (in a Windows 10 style – and you can shift the layout around too, moving Properties to the foot of the menu for example).

Microsoft boasts that the new right-click menu is faster, too: "The updated menu opens more quickly, reduces clutter, and gives you more control over the commands and app extensions that appear when you right-click."

As you may have noticed, all this work has been in testing for a while now.

Analysis: rolling frustrations and a lengthy wait

The immediate response on the likes of Reddit seems positive, and there are Windows 11 users who have taken the plunge with this preview update who are observing that the right-click menu is indeed a lot faster.

One Redditor enthuses: "The new context menu is so good! Way faster, customization is cool."

Others acknowledge that this is undoubtedly a good move, but don't understand why it took Microsoft so long to get here: "Not bad imo. Crazy it took them 5 years though."

While the feedback is generally positive, there are complaints from those who have installed the update but haven't received the new context menu. This is because the right-click revamp has been implemented via a gradual rollout, so it's only being drip-fed through to a certain amount of PCs at a time (of those who have installed the optional update). As another Redditor puts it: "Those gradual rollouts though…"

You can force the feature to be deployed to your PC using a Windows configuration utility (ViVeTool), but I wouldn't recommend that approach. Microsoft tests the waters in a limited way for good reasons, especially with features still in preview, so you're running a larger than normal risk of some nasty bug ruining your day.

Anyway, you've waited five years for this performance and options tuning, as those on Reddit are keen to point out – so what's another couple of weeks? I'd hold on for the official November update, keeping clear of this preview, but even then, it'll still be a gradual rollout, and you may need some patience.

Still, the good news is that the context ball is rolling, and it hopefully won't be too long before the majority of Windows 11 users gain access to this important upgrade for a key piece of the UI.

For Apple fans, the touchscreen MacBook Pro PROLED XDR tandem OLED display may be the gift that keeps on giving. Obviously, new integrated digitizing technology made the touchscreen possible, but the ultra-thinness of the display tech can also be credited with enabling the return of a beloved MacBook feature.

The touchscreen MacBook Pro is the first MacBook in almost a decade to feature an illuminated Apple logo on the back. I've seen it in person, and it somehow looks like polished metal when closed, and then a glowing bright white when open.

Apple bringing back the illuminated logo back is directly attributable to the PROLED XDR display. Each pixel in an OLED panel is emissive, which means there's no need for a backlight. Even after Apple made the laptop lid thinner, it still had some room left there — and it turns out there was enough room left to give the Apple logo its own backlight.

As improbable as it seems, there's now a dedicated light for the logo, but not for the rest of the screen. And it still doesn't take up extra space (nor eat up measurable energy).

Do it for the fans

Why did Apple do this? Well, Apple's not telling us, but it's clearly a nod to the fans.

CEO John Ternus tried to tell us the glowing logo was returning in his tiny X tease that showed light shining on the logo, which was on a flat surface. I simply thought it was another way of highlighting the Apple brand, and the big news to come. Granted, I was never that hooked on the old light-up logo.

In fact, my strongest memory around the Apple logo on the back of MacBooks is a conversation I had with Ternus when he was still Apple's hardware lead, during which he explained how Apple milled an ultra-thin and shiny stainless steel Apple logo for the MacBook 12 (the rest of the chassis was brushed aluminum). That was a big deal back then, even if it didn't light up

When Ternus revealed that the glowing logo was returning to the new MacBook Pro during the launch presentation ("the logo is back"), the crowd basically lost their collective minds. It's a big deal.

The illuminated logo also serves another purpose, instantly telegraphing that you're using a special MacBook Pro — the first with a touchscreen.

What Apple is not sharing, though — and it merits further investigation — is how it managed to make the glowing logo look like polished metal when the laptop is closed. It's an engineering secret that I suspect Apple execs and engineers will take to their graves, even after the inevitable teardown.

• Knicks employees expecting free championship rings received mandatory cybersecurity training instead
• A fake championship ring offer exposed employees to an internal phishing test
• Madison Square Garden admitted that using championship jewellery as bait was inappropriate

The New York Knicks have faced criticism after sending employees an email promising complimentary NBA championship rings that turned out to be a cybersecurity exercise.

Staff members who accepted the invitation were reportedly required to complete cybersecurity training instead of receiving jewellery commemorating the franchise's historic victory.

The incident involved workers at Madison Square Garden, where expectations of receiving championship memorabilia had already grown following the team's successful season.

Fake championship ring offer triggers mandatory training

The deceptive message circulated in late September, offering recipients personalized jewellery supposedly manufactured by the same company responsible for producing players' rings.

Employees could select between two advertised designs, Championship Gold and Garden Classic, before following a link to register their preferred choice.

However, the invitation was actually part of an internal security assessment intended to identify workers susceptible to fraudulent messages and credential theft.

Those who followed the instructions were reportedly assigned compulsory cybersecurity lessons, although the organization has not disclosed how many employees were affected.

Joe Vardon, a senior NBA journalist at The Athletic, reported that several individuals familiar with the situation verified the exercise's purpose.

The report also raised questions about whether the invitation contained recognizable warning signs that might have helped employees identify the deception.

Such exercises commonly use suspicious addresses or misleading website links, although the specific indicators included in this particular message remain unknown.

The controversy followed the Knicks' first NBA championship since 1973, making the promised jewellery particularly significant for employees celebrating the achievement.

Receiving commemorative jewellery was also a reasonable expectation because NBA organizations commonly distribute less expensive versions to personnel outside their playing squads.

Madison Square Garden acknowledges its mistake

Madison Square Garden Sports subsequently acknowledged the incident, describing its decision to exploit employees' expectations as inappropriate.

“Using the rings as a lure to gain employees’ attention was an unfortunate mistake,” it said in an official statement.

The organization explained that its security concerns stemmed from an earlier cyberattack in which employee credentials were compromised through a similar fraudulent communication.

Hackers had reportedly used those credentials to access company systems and subsequently extort the organization, prompting additional efforts to improve employee awareness.

The company also disclosed plans to distribute more than 275 commemorative items among players, coaches, employees and other individuals associated with the franchise.

According to the organization, those gifts, comprising championship rings and other jewellery, carry a combined estimated value exceeding $3.7 million.

However, the distribution arrangements have attracted attention because several assistant coaches initially received empty presentation boxes during the championship celebration.

The assistants are expected to obtain their rings later, although numerous long-time arena employees and business personnel reportedly remain excluded entirely.

The organization has not specified exactly how many workers will receive individual rings rather than alternative jewellery under its announced distribution arrangements.

Via Arstechnica

SteelSeries Sensei Pro Mini: Review

The Sensei Pro Mini brings pro-grade wireless performance to those who prefer less of a handful, thanks to its state-of-the-art polling technology and ceaseless power.

It has the same symmetrical shape as its larger sibling but on a smaller scale. Its size should prove suitable for those with smaller hands, allowing them to get a secure grip around the entire unit. At just 49g, it’s very light, too — lighter than the standard model by 4g — which makes it easy to maneuver.

The sidewalls have a pronounced cinch that forces you to clamp your thumb and ring finger further inwards than is typical, which some may prefer for added security. Grip tape is included in the box if you require more traction, which is entirely possible given the smoothness of the outer shell. The central hump might prove contentious in terms of fit, though: in my experience, it didn’t sit back far enough in my hand, landing underneath my knuckles rather than in the middle of my palm.

To customize and tweak the Sensei Pro Mini, you can use SteelSeries’ GG peripheral software. Here you can rebind all six buttons, with a fair amount of mapping options available, including keyboard inputs and shortcuts for media controls and system actions. You’ll find some standard performance tweaks as well, including DPI adjustments, although the range is larger than you’ll usually find on other gaming mice (between 1 to 65,000). There are five presets to customize, which you can cycle through using the DPI button underneath the mouse.

There are more advanced tweaks in addition to these, though. You can adjust the click response between 0ms and 20ms, and set the lift-off and landing distances independently, each with a range of 0.7 to 1.7 (presumably this refers to millimeters, though no unit of measurement is given). You can also enable a feature called Scroll Jump Protection, which ignores your first scroll unless a second is performed within a certain time of the first. This threshold is adjustable between 100ms and 1500ms. Motion Sync and Angle Snapping toggles are here as well, with the latter featuring a slider with 10 levels to adjust its straightening effect.

This isn’t all, though: a further section lets you adjust acceleration, with several graph curve presets available to alter cursor speed relative to movement speed, as well as the angle of the mouse’s sensor by 45 degrees either side of center to match the natural angle of your hand movements.

Then there are the polling and sensor adjustments. You can set the ultra-wideband (UWB) polling rate and the sensor report rate independently, each with a range of 125Hz to 8KHz (with added 9KHz overpolling). There are five presets containing various combinations of both rates, which can be cycled through using the button on the UWB base station.

GG is clearly laid out and proved fast and stable during my time with it. It also contains explanations for many of its settings, which is something I’m always glad to see. One minor gripe I had is that the actual area to make adjustments and customizations opens in a second window, which is somewhat inconvenient.

The first thing that’s noticeable about the Sensei Pro Mini’s performance is just how smoothly it glides. This is no doubt thanks to the large PTFE skates underneath. There’s almost no friction when gliding over a mouse mat, which makes the Sensei Pro Mini feel incredibly gratifying to fling around, yet also allows for super-controlled slow movements.

Next is the Sensei Pro Mini’s buttons. Clicks are light and snappy enough for quick spams, yet still provide enough feedback to allow for controlled inputs. They also have just enough dampening to make them satisfying to use. The side buttons are great to use as well, being easy to reach and offering a clicky, tactile feel. The same is true of the middle click, and I didn’t trigger miscrolls when using it, since the notching, while light, is tight enough to prevent accidental knocks from registering. This also means that quick flicks and controlled single scrolls are both relatively easy to perform.

My one issue with the inputs concerns the DPI button. It’s underneath the Sensei Pro Mini, which makes it harder to access. This is exacerbated by the fact it’s placed on the thumb side (for right handers) rather than the pinkie side, which means you can’t wrap your fingers underneath to press it without turning the mouse over.

I didn’t experience any connectivity issues with the Sensei Pro Mini. Given the sheer size of the UWB station itself I would’ve been disappointed if I had. Also, the cable provided to connect it to your PC is long enough to give you versatile placement options to avoid interference. It’s a shame a mouse this expensive doesn’t have additional Bluetooth support, though; many other wireless gaming mice feature this, allowing you to hot-switch between two devices.

To power the Sensei Pro Mini, SteelSeries has kitted it out with its ‘infinite’ battery system, something it and a few other brands have used in mice and other peripherals before. The idea is that you’ll never need to go wired (the Sensei Pro Mini doesn’t even have a USB port) to charge. Instead, you’re provided a pair of removable batteries that you cycle between your mouse and the charging dock in the UWB station.

This system works well, as it’s quick and easy to remove and insert the batteries — just as well, since the battery life drains rapidly when every performance setting is at maximum, barely lasting a day. At less intensive settings, though, the battery’s longevity is much better, lasting more like several days.

There will be gamers who would like the reassurance of additional wired support, though, should connectivity be compromised for whatever reason (I’m reminded of inference issues derailing a recent Valorant tournament). At this very high price point, such an addition would be especially welcome, as would Bluetooth. As it stands, the Sensei Pro Mini is an elite gaming mouse with all the wireless performance a pro could hope for, and it’s perhaps only this cohort that’ll see the value in it.

SteelSeries Sensei Pro Mini review: Price & availability

• $179.99 / £169.99 (about AU$260)
• Available now in black and white variants
• Top-end of the wireless gaming mouse market

The Sensei Pro Mini costs $179.99 / £169.99 (about AU$260) and is available now in black or white. A full-size variant is also available for the same price. It comes with two swappable batteries, the UWB base station (which doubles as the battery charging dock), and a braided USB-C-to-A cable, as well as spare PTFE skates and optional grip tape.

Even for a pro-grade wireless gaming mouse, the Sensei Pro Mini is expensive. It’s the same price as the Razer Naga V3 Pro, although that mouse has additional Bluetooth and wired support, as well as a lot more buttons. If you want the same limitless battery power, you can pair it with Razer’s charging mouse mat, although this a costly addition to an already expensive mouse.

Another pointer with a similar battery swapping system is the AngryMiao AM Infinity.97. This is even lighter than the Sensei Pro Mini at 47g. However, its garish style won’t be for everyone, and its software pales in comparison to the tweaking depth on offer in GG.

SteelSeries Sensei Pro Mini review: Specs

Should I buy the SteelSeries Sensei Pro Mini?

Scorecard

Buy it if…

Don't buy it if…

SteelSeries Sensei Pro Mini review: Also consider

How I tested the SteelSeries Sensei Pro Mini

• Tested for a few days
• Used for various tasks, including gaming
• Plentiful PC gaming experience

I tested the Sensei Pro Mini for a few days, using it for not just gaming, but also working and general browsing.

I played Counter-Strike 2, which is a great test for gaming mice, since it demands quick and accurate movements and clicks.

I’ve been PC gaming for over a decade, and used a great deal of pointers in that time. I’ve also reviewed plenty of them before, including the full size Steelseries Sensei Pro.

• Read TechRadar’s reviews guarantee
• First reviewed: October 2026

Apple has unveiled its first OLED MacBook Pro laptops, and that means we've got a new bit of display branding: PROLED XDR. You can have the laptop in 14-inch or 16-inch variants, pre-orders are open now for shipping on or after the 6th of November — and we've gone hands-on with them. Literally, because they're also the first touchscreen Macs.

The name 'PROLED XDR' is a new piece of jargon that Apple's debuting with this machine. So what actually is it?

The short answer is that it's a 'Tandem OLED' panel, which means that it uses multiple layers of organic light-emitting diodes — in this case, two layers. Two OLED layers are better than one because the result is considerably brighter than a single-layer OLED: you literally have two OLEDs firing per pixel. It also boosts longevity, because each of the two layers doesn't have to work as hard, so they have a longer lifespan and are more likely to avoid burn-in.

Apple has stayed away from OLED for its MacBook Pro displays in the past, and clearly that's changed. According to Apple that's because PROLED XDR "finally" overcomes the traditional limitations of OLED: low and variable brightness, off-axis color shift and the risk of burn-in from displaying the same interface elements, such as toolbars and palettes, whenever the screen is on.

The confusing thing, however, is that this isn't Apple's first use of Tandem OLED. It used the technology in its shift to OLED in the iPad Pro, but those aren't branded as PROLED XDR. Those are called 'Ultra Retina XDR' displays.

So let's look at the performance differences listed by Apple that put the 'pro' in PROLED.

What's so special about PROLED XDR displays

The Tandem OLED inside the new MacBook Pros is very bright, delivering up to 2,000 nits of peak HDR brightness (ie, in a small area of the screen for a short time) and up to 1,000 nits of sustained fullscreen brightness (ie, across the entire screen at once, without having to dim quickly).

The iPad Pro (2025)'s display is also capable of 1,000 nits of fullscreen brightness, but has a rated peak brightness of 1,600 nits — so the MacBook Pro is 25% brighter. That will bring a nice extra boost to clarity in bright HDR scenes, but won't make a huge difference really — the fullscreen brightness is the most important factor, and that's the same on both.

Because it's OLED, it gives you the blackest of black tones — there's no backlight to leak light into areas it shouldn't go — and a very high contrast ratio, in this case 10,000,000:1. That again is an interesting difference from the iPad Pro, which has a claimed contrast ratio of 2,000,000:1.

Why a 5x difference if the brightness is only 25% different? Apple hasn't explicitly said, but it must come down the lowest level of brightness that can be measured on the screen. Doing the math on the iPad's 1,600-nit display with a 2,000,000:1 ratio gives us a lowest brightness of 0.0008 nits. On the PROLED XDR's display, a 2,000-nit panel with a 10,000,000 contrast ratio gives us a lowest brightness of 0.0002 nits.

We can assume this is down to the new panel design, aimed at "minimizing internal reflections common in traditional OLED designs" — so less light is reflected within the panel itself, which could be the difference between those two different black levels.

But if you're looking at 0.0008 nits and 0.0002 nits and thinking the difference must be indistinguishable, then… yes, correct. They will both appear totally black to the human eye when they're supposed to. But it produces a big difference in contrast ratio, because multiplication is overdramatic.

There are other indications that the MacBook Pro's PROLED XDR display might beat the iPad Pro's in other areas. Apple says it can achieve over 80% of the BT.2020 color gamut, which suggest it's likely to hit close to 100% of the DCI-P3 color gamut — the iPad Pro was measured by our lab at around 82% of DCI-P3, so that would be a clear jump here.

The screen is powered by a display engine that's been built into the M5 Pro and M5 Max chips, which Apple says "continuously compensates each pixel for content, usage, temperature, and ambient conditions".

Refresh rates are variable from 10Hz to 120Hz (with discrete options for film-makers: 47.95Hz, 48Hz, 50Hz, and 59.94Hz), and as we've seen with other Apple products there's a nano-texture glass option for people who'll be working in overly bright environments.

The big selling point here is reference monitor accuracy that you can take wherever you go, making these MacBook Pros ideal for video pros and mobile creatives of all kinds.

So do you need it? If you're making the next Wildwood — go see this movie, it's incredible — or working with high-res, high-quality video then these are by far the best Mac mobile laptops that Apple has ever made. But I suspect most of them will end up with people who aren't video pros, but who really like really good displays. I'd love to see Cyberpunk 2077 on one of these.

If you're technically minded Apple has put together a full technical paper on the new displays, and you can read it right here.

Confirming one of Apple's worst-kept secrets, Apple finally unveiled its first-ever touchscreen MacBook Pro in 14-inch and 16-inch models on Wednesday, October 28, in Los Angeles. The news comes just days after Apple unveiled M6-class MacBook Pros. Notably, the new PROLED touchscreen laptops are running M5 Pro and M5 Max Apple silicon.

Apple CEO John Ternus didn't waste much time on stage, quickly announcing the laptops and running through key innovations like the tandem OLED (PROLED) screens and relatively lightweight (3lbs for the 14-inch model and 4lbs for the 16-inch one) before leaving the stage and directing the assembled group of media, analysts, creators, and Apple execs to an adjacent space where I got my first experience ever with a touchscreen MacBook.

You've been waiting for this

If you read no further, know this: it felt totally natural to tap, swipe, gesture with three fingers, pinch, zoom, and more on a MacBook Pro display. It feels like I've been waiting my whole life to do this on a MacBook (or at least as long as I've been using MacBooks).

As a former Windows user, and more specifically a longtime Surface Pro fan, I'm actually quite used to touching a screen, though maybe not one quite as beautiful as this.

For those unfamiliar with tandem OLED technology, which Apple first introduced a few years ago with the iPad Pro, it sandwiches two ultra-thin, light-emitting OLEDs together. This increases the brightness while maintaining incredibly inky blacks (they're gorgeous). It also allows for a far thinner display panel because you don't need a backlight.

Though there now is a "backlight of a sort. This touchscreen MacBook Pro lineup marks the return of the glowing Apple logo on the back of the display. It lights up when you open the laptop and turns off when you close it (people at the Hollywood, California, event were cheering for that).

I played mostly with the larger, 16-inch model, which still features the expansive, backlit Magic Keyboard and a huge ForceTouch Trackpad, which honestly is gonna get a little bit less use now that a touchscreen is just inches away.

A pair of large speaker grills sits on either side of the keyboard, though I couldn't hear them over the din of the demo room. As with previous MacBook Pros, there's still an SD Card slot, three Thunderbolt 5 ports, one USB-4 port, HDMI, and the headphone jack.

In my hands, the 4 lb, 16-inch model felt a tad lighter than previous 16-inch MacBook Pros, though the 14-inch (which might be my preference) felt lightweight at 3lbs.

Touch it, touch it, please say you want to

Let's talk, though, about using the touchscreen.

I tried a 3D design app where I used a couple of fingers to spin a model of a guy in battle armor and then a single finger to paint gold on some of the armor.

I opened Maps and used two fingers to spin the map, then pinch-and-zoom.

I used three fingers to swipe through desktops.

I could use two fingers to grab a window, flip it to one side of the screen, and watch it instantly dock itself as a half-screen app (yes, I've done something very similar on a Surface Pro).

I played touchscreen piano with all my fingers.

At no moment did I hesitate and wonder how I did this or that thing. It's obvious. It never felt uncomfortable, and my arm never got tired. Put another way, a touchscreen is a perfect fit for the MacBook Pro family,

Now, you cannot take the screen and flip it all the way to the back of the laptop (something many touchscreen Windows laptops can do). That might be a shame because I could also use my finger to paint and, though I haven't done it yet, draw.

Speaking of which, there is no indication that the touchscreen MacBook Pro supports the Apple Pencil. Honestly, if it can't fold back at least flat, there's no point in this support anyway.

There is, by the way, a Dynamic Island that's basically copied from the iPhone, but I didn't see it do very much.

As I used the touchscreen MacBook Pro, I was not only reminded of my time with the Microsoft Surface Pro but of my initial weeks and even months with the MacBook after I switched platforms. Yes, I found myself touching the inert MacBook screen and had to retrain myself to stop doing it.

Point is, touch was something I reflexively used on the Surface Pro, and I am now certain I will happily use it on the touchscreen MacBook Pro. You probably will, too.

You will pay for the privilege of touch. The 14-inch MacBook Pro with touch starts at $2,899 / £2,899 / AU$4,599, and the 16-inch model starts at $3,399 / £3,399 / $5,499. Pre-orders are live today, and the laptops ship on November 6.

• Researchers find Bluetooth flaws in warehouse barcode scanners that could provide a foothold into enterprise networks
• Attackers could spoof scanner input, inject keystrokes, and potentially pivot to ransomware or data theft
• Kaspersky urges stronger device authentication, network segmentation, and stricter security controls for warehouse infrastructure

Cybercriminals could use barcode scanners in warehouses to break into IT infrastructure and wreak havoc, security researchers have claimed, urging organizations to take preemptive measures and secure their warehouse grounds before it’s too late.

Kaspersky researchers set out to see if there are any hidden attack vectors on warehouse infrastructure and are now claiming they found one through a barcode scanner model “from a major manufacturer”.

Opening the floodgates

In a report shared with TechRadar Pro, Kaspersky said the vulnerable device has two components: the handheld scanner, and the base station, which is then connected to a workstation, or a separate business system.

The two components communicate via Bluetooth, but apparently there are no authentication methods between the two.

So, in theory, a malicious actor could obtain the Bluetooth address of the base station through passive eavesdropping on Bluetooth traffic. Then, through the established Bluetooth connection, they could send a malicious payload to the base station which simulates keyboard strokes. The base station would “think” the keystrokes are legitimate, coming from the user of the handheld device, and forward them to the connected workstation or separate business system.

“This attack pattern was observed across devices from multiple vendors,” Kaspersky said in its report.

Through this method, a theoretical attacker could gain an initial foothold on a computer within the warehouse network. Obviously, the scanner is only the entry point and not the actual target. The target is the wider network, where malicious actors could conduct reconnaissance, exfiltrate sensitive information, or deploy malware and ransomware.

“Modern retail and logistics are profoundly digital, from enterprise-wide management platforms down to every device in a worker’s hands. This pervasive connectivity means that any technology at any tier can become an entry point for a cyberattack capable of destabilising the entire ecosystem — as our research shows, even a single barcode scanner”, said Sergey Sidorov, Head of Industrial Security Services at Kaspersky.

“The warehouse sector, and the broader retail industry, should treat cybersecurity as a top priority across every layer of their operations,”

Are other devices vulnerable, too?

Kaspersky says the same scenario can be applied to other warehouse devices like Portable Data Terminals (PDR), or thermal printers, to gain access to Warehouse Management Systems (WMS) and similar infrastructure.

Therefore, the researchers are urging companies to secure their environments by verifying every new device before it connects to the network, disabling any unused Bluetooth interfaces, enforcing strong authentication mechanisms, segmenting warehouse networks so that only essential connections are permitted, applying security updates to both devices and the WMS as soon as possible, restricting account permissions to the minimum required, and regularly conducting full‑scale attack‑path exercises.

Unfortunately, we don’t know the name of the manufacturer, or how many devices in a series could be susceptible. The researchers are saying the risk is quite large, since these devices are “widely used” in warehousing, retail, and multiple other sectors.

Global e-commerce sales are expected to reach $6.88 trillion this year, making up more than a fifth (21.1%) of total retail sales worldwide.

At the same time, according to logistics research firm Interact Analysis, there are more than 180,000 warehouses in the world, so the attack surface could be significant. But warehouses are not the only sector at risk here. Barcode scanners and related handheld terminals are also widely used in retail stores, manufacturing facilities, hospitals, pharmaceutical operations, and transportation networks.

There is no reliable way to estimate how many organizations are vulnerable, but the possibility of using an everyday operational device to gain access to a connected workstation makes the findings relevant to a broad range of industries.

• SK Hynix just published its Q3 2026 financial results
• These came with a prediction of the RAM crisis lasting until 2030
• After that, expect a further drain on memory supply from "physical AI such as autonomous driving and robotics"

Apologies for bringing you more negative news about the RAM crisis, but we've heard yet another prediction that supply woes are going to last for the rest of this decade.

This time it's SK Hynix (again) weighing in, a memory chip maker that has just issued its latest earnings report, as Wccftech noticed. Profits are booming, unsurprisingly, but SK Hynix also shared its most recent thinking on the RAM crisis, and how likely it is to be a protracted affair.

In the press release for its Q3 2026 results, SK Hynix announced succinctly: "Memory supply shortage to persist through 2030."

That was the title of a section briefing us on the memory shortage, where SK Hynix further observed: "The company assessed that supply … is not keeping pace with the growth of the market. Given technical difficulty of leading-edge processes and the long lead time required to build new production facilities, it expects the structure in which demand exceeds supply to persist through 2030."

The firm also predicted it will sustain its growth and revenue, which exceeded 100 trillion won in Q3 — the first time that's ever happened in a quarter by the way — thanks to enterprise and AI demand in the shorter-term, and "over the mid-to-long term, demand for physical AI such as autonomous driving and robotics."

Analysis: a 'virtuous cycle' for shareholders – a nightmare for consumers

It's interesting to note that SK Hynix is forecasting that longer-term demand for memory will be driven by robots or 'physical AI' even if software AI (agents) falls away somewhat as the decade rolls to a close. Micron is predicting the exact same thing, and recently went into even more precise detail in estimating that 'humanoid robots' could need 200GB (or more) of RAM and multiple terabytes of storage in every unit.

So there's similar thinking from the big memory module makers here, but we shouldn't be surprised by that. They need to talk up their future profits, after all, and reassure markets that we aren't in a bubble, so it's only natural that they'd want to make predictions of major future revenue sources to be tapped.

Still, there's clearly some substance to these predictions, and it's concerning for consumers that a growing number of analysts and big players in the tech industry are talking about the RAM crisis lasting until 2030, and that robots are apparently set to take the baton from AI data centers and push demand for more memory as we head into the next decade.

We can but hope that Micron and SK Hynix are overshooting with their expectations of the hungry robots eating all our RAM in a few years' time, although how that land lies will depend on how widely robots are adopted, as well as how much memory they'll need.

Meanwhile, SK Hynix asserts that the "virtuous cycle" which has resulted from AI-powered productivity gains driving increased investment in infrastructure (data centers) will continue, and moreover "broaden to include general enterprises and nation-level initiatives", the upshot being that the "global AI data center infrastructure market will continue to grow steadily."

I don't think many PC owners or gamers feel that the way things have gone with memory of late is all that 'virtuous' at all, but the shareholders of SK Hynix and other big chip makers certainly won't be complaining. They can probably afford themselves a very nice PC even in the current super-inflated component climate, after all.

• Researchers uncover critical UEFI firmware flaw that could enable remote code execution on servers
• Public release of patch code may accelerate exploit development before many vendors deploy updates
• Delayed firmware patching across hardware ecosystems leaves organizations exposed despite available fixes

Cybersecurity researchers from Anthropic and Google have discovered a critical-severity vulnerability in boot-time firmware used by practically every server in existence today.

A patch is available, but given the fragmented market of UEFI manufacturers, it could take months before most of the servers are secured. In the meantime, patch code was made publicly available, which means cybercriminals will have their work laid out for them.

Discovering the bug

Virtually all modern servers today run UEFI (Unified Extensible Firmware Interface), software built into the server’s motherboard that helps start the device and load the operating system. It includes security features like Secure Boot, which helps stop unauthorized programs from running when the machine starts.

The free, open source toolkit developers use to build this firmware is called TianoCore EDK II - it serves as a common foundation for creating UEFI firmware for different types of hardware.

Alex Matrosov of Anthropic and Dan Holmes of Google recently found that EDK II contained a critical buffer overflow vulnerability. The National Vulnerability Database (NVD) describes it as a bug in BIOS “where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access.” “Successful exploitation of this flaw can result in remote arbitrary code execution, " it added.

Just like other UEFI vulnerability exploits, this one would be difficult to remediate in the wild. Deploying malicious code before security solutions, or even the operating system for that matter, means that whatever anti-malware or endpoint protection solutions are installed won’t be able to spot, or remove it. Reinstalling the operating system won’t help, and neither would replacing the hard drive.

The bug is now tracked as CVE-2026-97631, and was given a severity score of 9.5/10 (critical). Luckily enough, it doesn’t seem to have been exploited in the wild. However, that might change very soon, given that the security community botched the disclosure efforts.

Multiple companies and hardware manufacturers develop their own UEFI, and many rely on shared codebases such as EDK II. When a vulnerability is discovered in the code, fixing it upstream (in the codebase) is only half the work - each affected firmware vendor must patch their own product and then distribute the new firmware to their customers. This process can take time, leaving a window between the availability of the fix and its deployment across affected systems.

Discretion is advised

That is why discretion is paramount, and some participants seem to have dropped the ball, with Ars Technica claiming the two researchers who found the bug arranged for it to stay private until a coordinated disclosure that was planned for January 2027.

However, AMI - one of the manufacturers building motherboards - apparently published a pull request last month that not only detailed the vulnerability but also included a fix for the code.

Since the cat was out of the bag, TianoCore Project members then published a public advisory about the flaws, as well.

“With publicly available patch code, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits,” Ars Technica’s Dan Goodin writes. “Further compounding the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming.”

Exploiting this flaw is not that easy, though. Threat actors need to have some level of access to the target device beforehand, meaning that the bug will be mostly used by state-sponsored threat actors, and large, highly organized hacking collectives.

It really is turning out to be Black October - especially since the PHP2Shell flaws were inadvertently disclosed to the public in similar fashion.

Acer Swift Spin 14 AI review: Two Minute Review

I really like the Acer Swift Air 14 and not just because of the price. It’s very portable, attractive in that clean minimalist way popularised by a certain Cupertino company, and comes with a battery life that’s as good as any other I’ve come across.

Acer has been impressing me with its recent Swift laptops, and this one is no exception. Of course, the price tag makes it a no-brainer for anyone wanting a solid, portable laptop at an almost budget price tag. It’s not sub-$500 / £500, but it’s close. I certainly think it’s one of the best laptops for the price.

It does, however, have some of the shortcomings that even the best Ultrabooks have. It’s not the most powerful laptop out there, by any stretch of the imagination – this is for people who just want to go online and do some office work or stream, not game or edit video. And the audio suffers from the laptop's smaller design.

Those things actually don’t bother me. That’s not what this laptop is supposed to be used for. But, Acer makes the same weird design choice that even Apple makes on more budget models, where there are two USB-C ports, both of which can be used for power, but, for whatever reason, they’re on the same side of the computer.

Still, quibbles aside, the amount of computer you get for the price in the Acer Swift Air 14 is pretty impressive.

Acer Swift Air 14 review: Price & Availability

• How much does it cost? $699.99 / £749.99 (about AU$1,010)
• When is it available? Available now
• Where can you get it? Available in the US and UK

If you’re looking for the Windows version of the Apple MacBook Neo, the Acer Swift Air 14 offers just as much value. The base configuration might start at a higher $699.99 / £749.99 (about AU$1,010) price tag, but if you want to match the Swift Air 14’s 512GB of storage, then two laptops end up at the same price. Unfortunately, that currently excludes Australia as it hasn’t yet been released there.

Granted, you’re not getting the most powerful laptop out there. If you’re looking for something similar but better, the Acer Swift Spin 14 AI is that computer. Sure, it’s $1,499.99 / £1,399 (about AU$2,150), but its Qualcomm CPU has double the cores and triple the NPUs than the base version of the Acer Swift Air 14’s Intel Core 5 320 CPU. You can upgrade the Acer Swift Air 14 to a configuration with the Intel Core 7 350 CPU and 12GB of RAM, but it’s still not going to do the same heavy lifting. Plus, the Acer Swift Spin 14 AI has a 360-degree hinge, touchscreen, and stylus.

It might be better to consider the Acer Swift Air 14 as Acer’s budget entry in its Swift line. It’s an excellent value while still functioning as a competent Ultrabook.

• Value score: 5 / 5

Acer Swift Air 14 review: specs

The Acer Swift Air 14 comes in two variants. The base configuration comes with the Intel Core 5 320 CPU with 8GB of RAM, and a model with an Intel Core 7 350 and 12GB of RAM. The difference in processors aren’t that different, except that the Intel Core 7 350 can be boosted to a higher turbo frequency, 4.8GHz vs 4.6, and has 21 TOPS NPU compared to the Intel Core 5 320’s 20 TOPS NPU.

Beyond those internal configuration differences, the Acer Swift Air 14 is available in four different colors – Sage Green, Frost Blue, Blossom Pink, and Lilac Purple with only the Sage Green and Blossom Pink available in the UK. EMEA countries, including the UK, also sport more minimalist etchings on the lid.

Acer Swift Air 14 review: Design

• Very attractive, portable design
• Keyboard and touchpad are good but not amazing
• Both USB-Cs are on the left

The Acer Swift Air 14 is a gorgeous laptop. I’ve only seen the Sage Green color in person – the color of the test unit for this review – but the colors, lid etchings, and aluminum chassis all present a very aesthetically pleasing package. I imagine that the other three colors look just as good in that way that I think makes this an attractive alternative to the Macbook Neo.

Also in its favor is its utter portability. It weighs just over two and a half pounds. That’s about the same as an ankle weight. And it’s just over a half inch thick at its thinnest point. I don’t think you can really get any more portable without going down in screen size to a 13-inch laptop.

Speaking of which, its 14-inch screen is a good-looking, if not amazing, non-touch display with a 16:10 aspect ratio and 1920x1200p resolution. It does get up to 300 nits of brightness – I typically have the brightness up only halfway when I’m using it.

I appreciate the 180-degree hinge, but that’s mostly because I feel like I don’t have to be as gentle with the Acer Swift Air 14 when opening it. I could see its use, though, if you want to share your screen with someone sitting across from you. If you do that, the viewing angle is more than enough for both people to see at 170 degrees.

Moving on, the keyboard is pleasant to use if nothing spectacular. I used the Acer Swift Air 14 to write this review and didn’t feel fatigue from typing. At the same time, it’s a linear keyboard with a somewhat short travel.

The trackpad is fairly responsive and accurate, though I found it to be a little too sensitive at times when my thumb was a little too close to it and had trouble getting the cursor to cooperate.

The port selection is about as minimal as one would expect on a laptop like this. Along with a USB-A port and headphone jack are two USB-C ports. Unfortunately, they’re both on the left side, a design choice that I always dislike since I find myself regularly having to plug the computer in on the right side, sometimes from a distance too.

• Design score: 4.5 / 5

Acer Swift Air 14 review: Performance

• Decent for day-to-day work
• Slows down if using multiple RAM-intensive tabs
• Sound quality is just okay

One of the downsides of a laptop built for a sub-$1,000 price tag is that either the design or performance (or both) suffer. The design on the Acer Swift Air 14 is pretty good... so it goes that the performance is what is throttled.

Now, Acer built this laptop to hit a price point, but the company also built it to an expectation. This is supposed to be an extremely portable laptop with long battery life for not much money.

With that in mind, Acer used the affordable Intel Core 5 320 six-core CPU with a speed of 1.5GHz and 20 TOPs (21 for the Core 7 350) and put only 8GB of RAM in the computer. At least the 512GB SSD storage is sufficient.

If you’re looking for a laptop to work on while in a cafe responding to emails in between social media side quests, then what the Acer Swift Air 14 does is more than enough. Even using the AI features like Acer PurifiedView and PurifiedVoice during video calls, both of which work well, or messing with CoPilot+ doesn’t tax this laptop.

But it’s not too hard to push the Acer Swift Air 14. When I’ve tabs open that require a lot of RAM and try to switch windows, I’ve experienced some freezing. And anything but the least demanding games are a jittery mess. I wouldn’t use this laptop for 4K video editing, either. A powerhouse this is not. Then again, it’s not meant to be.

As far as the sound quality goes, the Acer Swift Air 14 suffers from what ails just about all thin and light laptops. There’s just no room for any speakers capable of producing a full sound and it shows. There’s not much bass and the sound is on the thinner side. That said, it’s not harsh, so listening to music in the background while working is still pleasant.

• Performance score: 4 / 5

Acer Swift Air 14 review: Battery life

• Almost 17 hours of battery life
• Charges relatively quickly

The new benchmark for a good laptop battery life these days is anything over ten to twelve hours. So, the fact that the Acer Swift Air 14 can hit almost seventeen hours in our benchmark is remarkable. Note that this benchmark requires the laptop to run for that entire amount unplugged.

I’ve been using this laptop regularly for a little over a week and I don’t think I’ve seen it go below 50%. I have charged it a few times, mostly out of habit, but I have yet to be compelled to find an outlet. Plus, it does a good job of holding its charge when the lid is closed.

Acer advertises that the Swift Air 14 has fast charging, which might be true on certain settings, but I found it to charge at a still-good 1% a minute rate when set to a balanced performance mode.

• Battery Life score: 5 / 5

Should I buy the Acer Swift Air 14?

Buy it if…

Don't buy it if…

Acer Swift Air 14 review: Also Consider

If our Acer Swift Air 14 review has you considering other options, here are two laptops to consider...

How I tested the Acer Swift Air 14

• Tested for a week and a half
• Used it for work, gaming, and streaming
• Messed with its AI capabilities

I used the Acer Swift Air 14 for a week and a half. I used it for work, including typing up this review (along with the requisite online research). I used it to stream video. I even did some light gaming and attempted some semi-serious gaming. I played around with the AI as well.

After spending time with the Acer Swift Air 14, it’s clear that this is meant for those that want a portable and attractive laptop that’s nice to use on a limited budget.

I’ve spent the last few years reviewing tech gear for gaming and otherwise, where I’ve gotten a feel for what to look for and how to put a piece of kit through its paces to see whether it’s worth the recommendation.

• First reviewed: October 2026

• AI startup Cathedral used autonomous agents to breach Anthropic systems through weaknesses in third-party software
• Agents accessed HR, sales, and IT data, exposing limited customer and partner information
• Incident highlights how AI-powered attackers can rapidly exploit vendor weaknesses despite strong internal defenses

An AI startup seemingly gave Anthropic a taste of its own medicine when it used AI agents to break into the company and expose sensitive data.

The company in question is called Cathedral, which was founded by former members of the defunct US Department of Government Efficiency (DOGE), a US government initiative established to reduce federal spending and bureaucracy, while modernizing government technology and operations.

Anthropic is running a two-fold bug bounty program through HackerOne. One part is focused on finding technical flaws in Anthropic’s systems, while the other is an invite-only program that rewards researchers for finding universal jailbreaks that bypass Claude’s safety protections.

Cathedral apparently shared its results with Anthropic through the bug bounty program. After its human researchers unsuccessfully tried breaking in for a few days, they deployed AI agents which took less than 12 hours to find a way in, by exploiting flaws in third-party business software.

Violating the rules

After accessing the company’s network, the agents accessed meeting transcripts, information on salaries and job offers, as well as Slack messages. Employee conversations with Claude were not exposed, it seems.

Anthropic confirmed the news, saying Cathedral accessed a “limited set” of sales, human resources, and IT systems, and compromised contact information and basic user account records belonging to certain customers and partners. Source code and AI model weights were not accessed.

“Our monitoring flagged some of Cathedral’s activity before they reported it to us,” Anthropic said in a statement shared with The Washington Post. “We shut off their access the same day.”

According to Gizmodo, Anthropic accused Cathedral of violating the program’s rules by failing to disclose the full extent of its activity. We don’t know if that means Anthropic won’t release the payment for the bounty, but it sure sounds like it.

Paying the bounty could be the least of Anthropic’s concerns, though. The company is currently gearing up for its Initial Public Offering (IPO), with a valuation of $1.4 billion. Leaking sensitive data to anyone, including white hat hackers, is definitely not a good signal.

A 'bunch of kids' wreaking havoc

“The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America,” the Washington Post cited Cathedral’s report as saying.

At the same time, a senior Trump administration official allegedly told Via The Independentthat “if a bunch of kids who have just started a company can do this, then potentially the Chinese aren’t far behind.”

Cathedral can hardly be described as “a bunch of kids” - it is an AI startup focused on offensive and defensive cyber operations for the US military and government. Its founders include Gavin Kliger (former Pentagon chief data officer), Luke Farritor (best known for helping decipher ancient Roman scrolls using machine learning), Marko Elez (former SpaceX staffer), and Jack Stein (apparently worked as an investment banking associate at Salem Partners before joining DOGE).

The cybersecurity community had something to say about it. Jacob Krell, Senior Director for Secure AI Solutions & Cybersecurity at Suzu Labs, wasn’t particularly phased, saying if third-party vendors are a risk everywhere, then they’re a risk at Anthropic.

"Cathedral's agents got into Anthropic the same way attackers get into everyone else, through the vendors,” Krell said. “Security maturity is capped by the weakest vendor you integrate with, and no amount of in-house engineering changes that."

Darin Fredde, Senior Director of Technical Marketing Engineering at Ridge Security, praised Anthropic’s response: "Anthropic deserves credit for reporting that its monitoring detected some of the activity and for taking containment measures. But the real measure of remediation is independent verification that those attack paths are closed. We need to stop confusing a successful patch with a verified security outcome. Otherwise, we're just closing the front door and hoping nobody discovered the spare key."

• GMO warned customers to back up data, disconnect devices, and shut down systems after a cyberattack
• Attackers allegedly stole customer data, leaked information, and threatened ransomware deployment
• Compromised trading-platform credentials and reports of unauthorized transactions raised concerns for affected users

Japanese internet giant GMO Group has told its customers to scan their computers for viruses, back up all of their data, disconnect the devices from the internet and then shut them down.

The announcement, which literally told customers, “unplug any cords connected to your PC," was made in response to a cyberattack it recently suffered, as well as the threats then made by the malicious actors.

GMO Group gets hit

GMO Internet Group is a large Japanese technology conglomerate whose business spans internet infrastructure, cybersecurity, online advertising, financial services, and more. It brings in billions of dollars every year, and operates a broad portfolio of subsidiaries, among which is Onamae Desktop Cloud, a popular VPS service provider.

Its main customers seem to be individual retail forex (FX) traders in Japan who run automated trading software. It provides a rented Windows desktop hosted on GMO’s servers, allowing customers to keep trading applications running, while being able to shut down their own computers.

On October 20, 2026, the company disclosed having suffered a cyberattack in which threat actors installed malware on some customer environments. Apparently, up to 26,739 servers were at risk, and the company responded by progressively shutting them down, launching an investigation, and cleaning them up.

“We have confirmed that unauthorized access by a third party occurred against Onamae.com Desktop Cloud and that unauthorized programs were installed in some customers’ server environments,” the company said at the time.

The investigation determined that the attackers walked away with sensitive customer data, although it wasn’t said how many customers were compromised, or what types of information were taken. It was also later reported that the unnamed attackers were demanding roughly $50 million in ransom, in exchange for deleting the data. They threatened to release the data on the dark web if the demands aren’t met. Onamae said it wouldn’t pay the attackers, and the data eventually did leak.

Despite the data leaking, no known entities claimed responsibility for the attack.

Condolences money

The attackers also threatened to install ransomware on devices belonging to Onamae customers, triggering the warning and the call for everyone to shut down and unplug their devices:

“1. Request for a full scan of your own device for virus checks 2. Request for backup 3. Request to disconnect network and power from customer PC. Before 12:00 PM on Tuesday, October 27make sure to back up, disconnect the network, turn off the power, and unplug any cords connected to your PC,” the warning, machine-translated from Japanese, reads.

It seems the attackers never acted on their threat, since no ransomware was found on customer servers.

Onamae said it would not pay the attackers, but would instead compensate each customer $30 for their troubles, regardless or not if they actually suffered any damage or not. Those that suffered more meaningful damage will be compensated separately, it was said. Replacement computers were also offered, BleepingComputer reports.

The company has continued its investigation of the attack and is currently analyzing the leaked data to see how many customers were affected, and what is at risk. It also warned the public and the media not to share the leaked information, threatening legal information against those who do.

In one of the updates, Onamae said login credentials and some account details from users of trading platforms MetaTrader 4 and MetaTrader 5 were compromised. “Some customers have reported transactions in their trading accounts that they do not recognize,” it added, before urging customers to reset their passwords and terminate all active sessions.

The full scope of the attack, as well as material damages (which might be substantial), are yet to be seen.

Via BleepingComputer

Asus ProArt P16 RTX Spark: two-minute review

The Asus ProArt P16 RTX Spark is one of the new generation of laptops powered by Nvidia’s RTX Spark chip. This all-in-one system-on-a-chip is packing 20 ARM CPU cores, 6144 CUDA GPU backed up by 64GB of RAM and promises to offer fantastic AI, creative and gaming performance in a lightweight, portable form factor. So how does this new SoC version of the Asus ProArt P16 laptop fare?

When powering up the Asus ProArt P16 RTX Spark for the first time, perhaps the first thing I noticed is its huge, vibrant 16-inch OLED screen. With a peak brightness of 1,100 nits and a 100% DCI-P3 color gamut, it looked gorgeous whether I was loading up my digital artworks or watching movies. And its 120Hz VRR makes it perfect for playing games on.

That’s not the only part of the ProArt P16’s design that feels premium. Its overall build quality feels suitably luxe, with the smooth metal of its upper casing feeling wonderfully tactile. Inside, its keyboard is well designed and feels pleasant to type on, while its haptic trackpad is precise and gives snappy feedback, even if I did find it too easy to trigger the right click at first. I will say its lid has a little bit too much wobble for my liking though: if I’m honest, I’d expect a laptop at this price to have a slightly more stable hinge.

But let’s not just focus on the superficial here: the ProArt P16 RTX Spark has a lot going on under the surface. That’s predominantly thanks to that Nvidia SoC, which enables it to tackle a wider range of tasks than even many of the best laptops.

Perhaps the most attention grabbing feature is its AI capabilities. Designed for hybrid workflows, the RTX Spark makes it easy to use a combination of local and cloud models to run your AI agents. Testing it out with the Qwen 3 8B open-source local model, I certainly found it had pretty snappy performance for basic workflows, with a basic data analysis only taking about 12 minutes.

More involved tasks took much more refining and prompting over multiple sessions though — attempting to automate 3DMark benchmarks took many 75 minute runs before the completion time reduced significantly. Still, being able to run these workflows on such a lightweight, portable machine was pretty impressive

Another area the Asus ProArt P16 RTX Spark delivers potent performance is during creative tasks. Running multiple PugetBench benchmarks for automating Photoshop and Premier Pro workflows, the ProArt P16 was only a little behind Apple’s M5 chip when running image-based tasks and beat it when it came to video tasks. And this was borne out by my own testing: even my largest 4K 300dpi Photoshop file crammed full of clipping masks didn’t make it wince, with filters and generative fills executing smoothly. Even downscaling the whole image to 2K only took around five seconds, which isn’t bad for a nigh-on 2GB file.

Few SoCs to date have been designed with gaming performance in mind. But given Nvidia’s heritage in this space, it’s hardly surprising that the ProArt P16 RTX Spark is capable of some serious gaming power. While it’s not quite able to deliver at the same level as RTX 5080 and 5090 GPUs, I enjoyed a very smooth 60fps on Cyberpunk 2077 on Raytracing Medium settings, while Gears of War: E-day ran at more solid than bedrock at over 110fps. So this laptop can achieve some stunning results, even if the performance you’ll get isn’t 100% the top of the range.

Given it can handle all of these tasks on the go, you’d hope it has a pretty capacious battery to back up that powerful chip. And it’s relatively good news on this front. While it only managed 11 hours of continuous video playback during my testing, during productivity based work it lasted well over 14 hours. That’s nowhere near as long-lasting as the Methuselah-like MacBook Pro M5 Pro, which clocked over 21 hours in our testing, but it’s certainly enough to get you through a standard day’s work.

Honestly, the Asus ProArt P16 RTX Spark is pretty adept at everything it tries to do: it’s a talented all-rounder. The only caveat really is its price: like many of the RTX Spark laptops, it isn’t cheap. Starting from $4,399.99 / £3,899.99 / AU$7,999, it costs just as much as a high-end gaming laptop or a pro-level creative workhorse — so, honestly, if you care more about getting the best performance you can in a specific niche, you may be better off investing in one of those instead.

However, if you need a single bow that can handle every single one of your strings, the Asus ProArt P16 RTX Spark is a good shout. It’ll handle running your own AI agents, whipping up creative work and even gaming for your downtime, all in a single, portable package.

Asus ProArt P16 RTX Spark review: price & availability

Having launched on October 9, the Asus ProArt P16 RTX Spark is available now. Unlike its smaller sibling, it ships with the higher-end Nvidia RTX Spark N1X with 6144-core GPU and 20-core CPU.

As a result, it’s a pricey meatball: its list price starts from $4,399.99 / £3,899.99 / AU$7,999 for the spec with 64GB RAM, 3K screen and 1TB SSD. That increases to $6,999.99 / £5,999.99 / AU$10,999 if you want the version with 128GB RAM, a 4K screen and a 2TB SSD.

Even with its impressive specs, there’s no getting away from the fact that this is a premium-priced laptop. Both in terms of price and spec, the ProArt P16 RTX Spark is pretty similar to the Samsung Galaxy Book6 Ultra with Nvidia GeForce RTX 5070, which will set you back $3,799.99 / £3,649 (around AU$5,410).

Alternatively, this kind of spend could net you the MacBook Pro M5 Pro 16-inch with 64GB for $2,999 / £3,999 / AU$6,299, which should give you a lot of performance and creative power but I wouldn’t expect to get quite as much gaming power for your buck.

Asus ProArt P16 RTX Spark review: Specs

Asus ProArt P16 RTX Spark review: design

• Gorgeous 3K OLED display
• Slim, sleek design
• Slightly flimsy hinge

Like all of the initial lineup RTX Spark laptops I’ve seen, the new Asus ProArt P16 is a sleek-looking unit. While its 16-inch span is pretty expansive, it’s still light in terms of weight, clocking in at 1.77 kg compared to my 16-inch MacBook Pro M4’s 2.14kg. It’s also got a pretty sleek silhouette — unlike some of the RTX Spark laptop models I’ve seen, it’s not concealing a much chonkier base with the help of gradually sloping bevels. And its nano black and neo white colorways feel suitably premium, although I marginally prefer the black version I tested here.

It’s not all about style though: the ProArt P16 RTX Spark has plenty of substance too. Manufactured from smooth metal, its external and internal surfaces feel wonderfully tactile, although I’d say the inner ones feel a tiny bit less sturdy than the solid bodywork of the outside. On top of this, there’s a tiny bit of wobble to its screen when you touch it — I’d expect a slightly firmer hinge on a premium laptop like this.

Speaking of that screen, I found Asus’s 3K touchscreen Lumina Pro OLED to be pretty impressive on the whole. Not only can my unit hit a peak brightness of 1,100 nits and a max 120Hz VRR but comparing it to my MacBook Pro M4’s Liquid Retina XDR display while watching Pixar’s Elemental was — sorry for this — pretty illuminating. While the latter can go slightly brighter at 1,600 nits peak, I didn’t find the difference all that pronounced. And the colors of the P16 RTX Spark’s OLED panel were noticeably more vibrant, with the reds, blues and greens of the fire, water and earth elements really popping.

To say laptop keyboards can be hit or miss might be the understatement of the century but, fortunately, the ProArt P16 RTX Spark’s keyboard falls more in the former category than the latter. Although the keys don’t have a huge amount of travel, I still found the typing experience to be pretty fluid. I rarely ever struggled to find my chosen key when touch typing — although I did occasionally knock both parts of the dual enter key, accidentally sticking random #s at the end of sentences. Still, it felt nice to use, whether I was prompting an AI agent or rapidly splatting demons in Doom: The Dark Ages.

For the most part, the P16 RTX Spark’s trackpad is also well designed. It’s very accurate, gives you a huge area for controlling your cursor and the haptic feedback is spot on, feeling exactly like a mechanical click. Really the only issue I found with it is the right click triggers far too far to the left, meaning I’d sometimes accidentally right click on certain elements. Still though, it’s a decent trackpad for the most part.

As you’d expect from a laptop this premium, the P16 RTX Spark comes with access to a wide range of connectivity options as well. On top of offering Wi-Fi 7 and Bluetooth 5.4 connectivity, it rocks a pretty decent selection of ports for such a slim laptop. These include three USB-C and one standard USB port, an HDMI 2.1 port, a 3.5mm headphone jack and an SD Express card reader. So even for most creative workflows, you should find you’re able to plug in plenty of devices to get things done.

• Design score: 4 / 5

Asus ProArt P16 RTX Spark review: performance

• Strong all-round performance
• Local AI workflows impressive but require some patience
• Specialist laptops can give better gaming or creative performance

I’ll be honest: by far the most exciting part about getting my hands on the Asus ProArt P16 RTX Spark is that eponymous chip. Similar to Apple’s M-series silicon, Nvidia’s RTX Spark is the company’s first attempt at a full system-on-a-chip architecture. And given Nvidia’s involvement in both the AI and gaming spaces, it’s safe to say I was looking forward to putting the Nvidia Spark RTX through its paces.

Combining CPU, GPU and RAM all in one compact package, the version of the RTX Spark included with the Asus ProArt P16 I tested here rocks 20 ARM CPU cores backed up by 64GB of RAM. Meanwhile, on the graphics side, it wields 6144 CUDA GPU cores with 30GB integrated memory. In terms of raw hardware, it's less cooked and more meaty than steak tartare.

While this is the equivalent of using a steam hammer to obliterate a nut, general productivity tasks ran perfectly smoothly on the ProArt P16 RTX Spark. Whether I was browsing the web, tinkering with spreadsheets or leafing through huge PDFs, I never experienced any awkward hanging or slowdowns. Even on the odd occasion when I had to look something up online while the laptop worked on an AI task, there wasn’t any unpleasant gear-crunching, showing the ProArt P16 is plenty fast enough for general use.

But you’re unlikely to be buying an RTX Spark laptop just for doing a bit of Googling or filing your taxes. Instead, the most obvious use case for the RTX Spark chip in the ProArt P16 is its hybrid agentic AI functionality. Put simply, rather than being forced to choose between using cloud models that potentially jeopardize the security of your data and less powerful local models, this blended approach means you can pick and choose which parts of your workflow you’re going to outsource to the cloud and which you’ll keep under strict local control.

With its integrated fifth-generation Tensor cores, the RTX Spark should be perfectly placed to support this. To see how fast it could run some of these models locally, I used the MLPerf Client benchmarking tool to mimic data analyst and SWE agentic workflows using the Qwen 3 8B local model. And the results felt pretty rapid, with the pipelines completing after an average duration of 63.7 and 50.8 seconds and processing up to 14,005 and 10,238 tokens respectively.

But I wanted to see for myself what it could do. So I fired up Hermes, the open-source AI agent tool, and set it up to run the local open-source model Qwen3.8 27B to see what having my own personal AI version of Alfred could help me achieve.

Some of the basic tasks I threw its way, the RTX Spark practically scoffed at. When I asked Hermes to organize a spreadsheet full of web analytics for me and pull out actionable highlights, it whipped the file up into a pivot table and gave me six bullet points within about 12 minutes. Asking it to convert this info into a presentation with slides and prompts took a little longer at 23 minutes, but it helped highlight the best information to pitch — even if the slides themselves needed a considerable glow up before I’d ever call them up in a Zoom call.

In theory though, these hybrid agentic AI tools can go much further than this. Not only can you convert your prompts into skills or schedule them to run as daily tasks but you can even set them to target your apps and control your screen directly.

Some of my experiments paid off here: after one abortive run, I eventually managed to get Hermes to access my emails and create a daily digest in 70 minutes. But trying to automate some of my 3DMark benchmarking process ended up being a real rabbit hole — even with judicious prompts throughout the process and prompting Hermes to find ways to boost the skill’s efficiency, it took around eight runs to significantly improve its workflow. So it’s important to recognize that while some agentic pipelines may save you time in the long run, without utilizing some cloud models, training them may take a decent investment.

Agentic AI isn’t the only use you can put all of that processing power to though. While I’m not a massive fan of generative AI, I can definitely see how fast the RTX Spark is at whipping up new images and videos. Automating some imagery and video pipelines using ComfyUI, the laptop completed tests of Flux2.Dev - NVFP4 and Flux2.Klein 4B Base - NVFP4 models in just 46.5 and 16.2 seconds, while the LTX 2.5 - Distilled - NVFP4 video model took 88 seconds. Those are pretty swift run times for local generative models.

And if, like me, you prefer creating your own stuff from scratch, my testing showed the ProArt P16 RTX Spark can help here too. Using PugetBench to automate a range of creative workflows, I found Asus’s laptop was capable of some lightning fast processing.

Our standard Photoshop workflow completed in 10.83 minutes and achieved a score of 11,801 — that’s not far short of Apple’s M5 chip at 13,755. And the RTX Spark offered even speedier performance for video work, securing a score in our Premier Pro benchmark of 76,234 in 8.12 minutes, giving the M5 chip a bit of a drubbing at 69,887. Unfortunately, it can’t keep up with the similarly priced Apple MacBook Pro M5 Pro though, which managed to best it for both still imagery and video with scores of 15,204 and 105,580 respectively.

Naturally, I’m not just going to take these numbers on trust though, so I dug out one of my most demanding Photoshop files — a 4K, 300dpi PSD with dozens of clipping masks and adjustment layers — and checked how the ProArt P16 RTX Spark handled it.

Manipulating layers and applying filters caused scarcely any slowdown, in spite of the fact I’d tripled the number of layers in the file. Even downscaling the image to 2K — no small task given the total file size was now in excess of 2GB — only took around five seconds, which is pleasingly swift. And thanks to the optimization work that Adobe has been doing behind the scenes to allow its apps to take advantage of the RTX Spark’s AI capabilities, even generative fills and neural filters didn’t take long to generate.

When it comes to gaming performance, I’d say the ProArt P16 RTX Spark hovers somewhere between mid-range laptops with RTX 5060 and RTX 5070 GPUs. For example, when playing Cyberpunk 2077 on Raytracing Ultra settings at 1080p, I found the Asus hovered around 30.16fps — but, by contrast, the Acer Predator Helios Neo 16S AI with an RTX 5060 only reached a marginally smoother 34.47fps. Other games told a similar story. For example, Doom: The Dark Ages on Ultra settings sat at a pretty decent 48fps on the ProArt P16. In comparison, with its slightly beefier RTX 5070, the Samsung Galaxy Book 6 Ultra whipped the game like meringue into a much smoother 63.98fps.

But that’s running things on max settings. In practice, when actually playing games on more moderate settings, they ran plenty smoothly enough, especially those that are already well optimized for the RTX Spark. As I explored Dogtown in Cyberpunk 2077 at Raytracing Medium settings, it chugged along at a perfect stable 60fps. And playing Dogs of War: E-day on Ultra settings, I never saw it drop below 110fps, which shows what wonderfully smooth experiences you should still be able to expect from native gaming on the RTX Spark.

Honestly, I’d say that if you put the Asus ProArt P16 RTX Spark up against any similarly priced, specialist laptop focused on AI, creative workflows or gaming, you’ll likely find its performance can’t quite keep up. But that’s the point — RTX Spark laptops are a triple threat: they’re designed to be a swiss army knife that can handle every task you might throw at them. So if you want a lightweight laptop that combines the agentic AI hosting of a compact desktop, the creative power of the Apple M5 and the gaming oomph of the Nvidia Geforce RTX 5060, all in one handy package, the Asus ProArt P16 RTX Spark should have your back.

• Performance score: 4.5 / 5

Asus ProArt P16 RTX Spark review: battery test

• Battery should last 14 hours of standard use
• Some similar rivals can outlast it

Being able to achieve all of this on the go is impressive. But for that to be sustainable, it needs a battery that can keep up with these kinds of heavy duty tasks. Fortunately, the Asus ProArt P16 RTX Spark is capable of decent battery life, even if it’s not quite as exceptional as some of its rivals.

Running it through our standard battery tests, I played a 1080p video at 50% brightness and volume to see how long it took to drain the battery from 100% to 0%. The ProArt P16 RTX Spark ran out of juice after 11h 23m — that’s not at all bad but it’s also not quite at the level I’d expect for a premium laptop like this.

But a video test doesn’t necessarily give you the full picture. One of the big benefits of an SoC is through boosted efficiency during CPU usage, so I wanted to also run some tests that showed how the laptop fared in action. Running PCMark 10’s applications battery test — which runs various Microsoft Office based tasks until the battery is drained — the ProArt P16 lasted 14h 24m.

That’s definitely a better score, even if it falls a little ways short of some of the best laptops for Windows. For example, the Samsung Galaxy Book6 Ultra managed well over 15 hours in our benchmark tests and that wasn’t even the strongest contender. The MacBook Pro M5 Pro 16-inch clocked over 21 hours, which makes the ProArt P16’s look pretty short-lived in comparison.

Fortunately, the Asus ProArt P16 RTX Spark does have one extra trick up its sleeve: its charging rate. Thanks to its 140W fast charging, topping your battery up again should be a relatively speedy affair. Sadly, my US unit didn’t come with a UK plug — slight oversight there — so I wasn’t able to test this as I would have liked. Still, my 65W charger topped it up relatively quickly, so you’ll definitely get pretty speedy charging out that 140W cable.

So I’d say that, all in all, the Asus ProArt P16 RTX Spark is capable of competitive battery life. When you’re doing standard office work, it’ll get you through a full day without you having to hunt out a charger. But it’s still not quite able to keep pace with the most enduring batteries on the market and particularly intensive tasks like AI or gaming are going to drain it much faster.

• Battery score: 4 / 5

Should I buy the Asus ProArt P16 RTX Spark?

Buy it if…

Don’t buy it if…

Asus ProArt P16 RTX Spark review: also consider

How I tested the Asus ProArt P16 RTX Spark

• Tested over the course of several weeks
• Ran a huge number of benchmarks for different workflows
• Conducted experiential AI, gaming and creative testing

Testing the Asus ProArt P16 RTX Spark over the course of several weeks, I ran a wide range of benchmarks. Not only did I run a variety of baseline hardware tests using Geekbench 7.1 and Cinebench R23, but I tested performance across a wide range of tasks as well. I used MLPerf Client to test agentic workflows, ComfyUI to simulate generative workflows, PugetBench to automate creative tasks and 3DMark and gaming benchmarks to test in-game GPU performance.

On top of this, I did a wide range of experiential testing. Not only did I use the laptop for plenty of daily and productivity-based work but I also extensively tested agentic AI workflows using Hermes and the local open-source model Qwen3.8 27B. I also tried carrying out creative work using large, hi-resolution Photoshop files and played a range of games including Cyberpunk 2077, Gears of War: E-day and Planet Zoo 2.

As TechRadar’s reviews editor, I have plenty of experience covering laptops. As well as editing scores of laptop reviews over the last few years, I’ve reviewed multiple gaming handhelds and have used a huge variety of laptops over the years, both Windows and MacOS.

• First reviewed: October 2026
• Read more about how we test

• Pixelmator Pro gets a new AI-powered Generate Fill tool
• Keynote, Pages, and Numbers add AI assistants and OpenAI model support
• Final Cut Pro gains thousands of MotionVFX creative assets in November

Apple's Pro and Tell week is marching on, and alongside the reveal of the M6-powered iMac and 14-inch MacBook Pro, the Cupertino-based giant is also shining a spotlight on software. Specifically, Apple Creator Studio is getting a wide-ranging update that brings a fresh batch of features and, ultimately, packs in more value.

As it stands, Apple Creator Studio is a software subscription priced at $12.99 / £12.99 / AU$19.99 a month or $129 / £129 / AU$199 per year, giving you access to Pages, Numbers, Keynote, Pixelmator Pro, Final Cut Pro, and Logic Pro across Mac, iPad, and iPhone. All that stays the same, including the especially excellent education discount — $2.99 / £2.99 / AU$4.99 per month or $29.99 / £29.99 / AU$49.99 per year — but there are some pretty big updates here, with AI playing a starring role.

Leading the charge is Pixelmator Pro, which is getting a new Generate Fill tool. This lets you select an area of an image, describe what you want to add or change, and let AI do the heavy lifting. It's the kind of feature that could come in handy when you're editing a photo and don't want to jump between apps to get the result you're after. It'll also help level the playing field between Pixelmator Pro and Adobe Photoshop by filling a feature gap.

Keynote, Pages, and Numbers are also getting AI assistants designed to help you create presentations, write documents, and work with spreadsheets. Most interestingly, you'll be able to use OpenAI models alongside Apple's own, opening up more possibilities for working with AI in these apps. The apps also support compatible external AI tools, potentially making them a more useful part of your broader workflow.

With Final Cut Pro, Apple is bringing MotionVFX content directly into its pro video editing suite, making thousands of creative elements, including transitions, templates, effects, and titles, available for use in your projects. It's another welcome addition that should let you get more done directly inside Final Cut Pro, rather than having to rely on other tools.

All of this is coming in November as a free update for existing subscribers, though Apple isn't sharing specific timing just yet. These updates should also be right at home on the new Macs announced this week, but I'm curious to see if Apple introduces any more surprises, like the much-rumored touchscreen MacBook Pro, during its Pro and Tell event tomorrow.

• Attackers flood inboxes with spam, then impersonate IT support through Microsoft Teams messages and calls
• Victims are tricked into sharing remote access via Quick Assist, AnyDesk, or ScreenConnect
• Researchers observed 400+ incidents, warning default Teams federation settings enable the social-engineering campaign

Cybersecurity researchers Arctic Wolf have warned of an ongoing, widespread hacking campaign that includes an email inbox flooded with spam messages, a Teams account impersonating IT support, and the use of absolutely legitimate, everyday software.

The goal seems to be persistent access, possibly in preparation of a subsequent malware or ransomware infection.

How the attack plays out

In its report, Arctic Wolf said it observed the same pattern in more than 400 cases. It starts with the victim - an employee in the target company - receiving hundreds, possibly thousands of spam emails in a very short timeframe, so their inbox gets absolutely flooded with junk, burying any and all meaningful, valuable emails under a mountain of trash.

A few moments later, that same person gets a Teams message from a user that, by all accounts, looks legitimate: their name clearly states “IT Service Desk”, and sometimes even has a first name next to it (something along the lines of Liam, Ethan, or Scott). They tell the victim they’ve been made aware of the problems they’re having with their email (as the IT department should) and offer a solution.

To solve the problem, they need hands-on access to the victim’s keyboard, usually through a legitimate remote monitoring and management tool like AnyDesk or ScreenConnect.

Obviously, this is all a ruse to get the victim to hand over access to their device. The same entity sent both the spam emails and the Teams messages. Sometimes, they even call the victim through Teams, rather than send a message - to make the entire ordeal even more believable.

Arctic Wolf says the key enabler of the whole scheme is the fact that Microsoft Teams ships with external access (federation) turned on by default. That means that, unless the actual IT team changed the default settings in Teams, every employee can receive messages from anyone else with a Microsoft 365 account, even if they belong to an entirely different tenant (dedicated environment within Microsoft's cloud services). Unfortunately, this is not a bug, it’s an entirely legitimate feature that threat actors happily exploit:

“This is the feature attackers most frequently abuse,” Arctic Wolf says. “This activity does not exploit any known Teams vulnerability; it abuses a legitimate, default-on collaboration capability.”

Lock down your Teams

To make matters worse, when they ask for hands-on access, they don’t ask the victim to install any special software. In most cases, they just ask them to bring up Quick Assist, a tool that’s built directly into Windows, signed by Microsoft, and thus requires no installation. All victims need to do is send over a six-digit code and they’ve handed over the keys to the kingdom.

What happens after that is anyone’s guess. The researchers saw the attackers then installing a commercial RMM tool such as AnyDesk or ScreenConnect to gain a separate control channel, and make sure they retain access even if the Quick Assist one is revoked. They would then map out the target IT network and do as much reconnaissance as possible, likely in preparation of a ransomware or malware attack.

Defending against these kinds of attacks starts with locking the proverbial doors on Teams. “Most organizations have no legitimate need for open, any-tenant external chat,” Arctic Wolf says. “Per Microsoft’s guidance in Manage external meetings and chat with people and organizations using Microsoft identities, move from “allow all” to an allow-list of trusted organizations.”

The second crucial step is educating the employees. Everyone should be made aware of the fact that just because a message came from Teams, it doesn’t mean it’s legitimate. Same goes for an audio call, or an email.

Though 2026 has been a tumultuous time for technology when it comes to price hikes and shortages, the tech that's reached us has been excellent — in fact, it's been a banner year in most areas, just with some downsides for your wallet.

We've already crowned the best tech of the year as chosen by you in our TechRadar Readers' Choice Awards 2026 — but this is where we let our experts have their say.

Our writers and editors chose their favorite products in nearly 100 categories, ranging across all the kinds of products we review. In some cases, we agree with the readers; in lots of cases, we don't. So read on to see which gadgets we rate as being the most impressive of the last 12 months.

Phones & tablets

Phone of the Year

Phone Brand of the Year

Phones Innovation of the Year

Best Value Phone

Best Mid-Range Phone

Best Folding Phone

Best Flip Phone

Best Camera Phone

Best Gaming Phone

Best AI Phone

Best Phone Accessory

Best Tablet

Best eReader

Cameras & drones

Camera of the Year

Brand of the Year

Camera Innovation of the Year

Best Beginner Camera

Best Mid-range camera

Best Professional Camera

Best Compact and Instant Camera

Best Action and Vlogging Camera

Best Camera Lens

Best Camera Accessory

Best Drone

Computing

Laptop of the Year

Computing Brand of the Year

Best Computing Innovation

Best Value Laptop

Best AI Laptop

Best Gaming Laptop

Best PC Gaming Handheld

Best Gaming Keyboard

Best Gaming Mouse

Best Gaming Monitor

Gaming

Gaming Device of the Year

Gaming Brand of the Year

Gaming Innovation of the Year

Best Console Accessory

Best Gaming Service

Best Gaming Controller

Best Gaming Headset

Best Gaming Chair

TV & home theater

TV of the Year

Home Entertainment Brand of the Year

Home Entertainment Innovation of the Year

Best Gaming TV

Best TV for Sound

Best OLED TV

Best Mini-LED TV

Best Value TV

Best Projector

Best Soundbar

Best Wireless Home Theater Speakers

Streaming

Streaming Service of the Year

Best for Movies

Best for Documentaries

Best for TV Shows

Best Free Streaming Service

Audio

Headphones of the Year

Audio Brand of the Year

Audio Innovation of the Year

Best Wireless Headphones

Best Wireless Earbuds

Best Open Earbuds

Best Value Headphones

Best Value Earbuds

Best Value Open Earbuds

Best Wired Headphones

Best Wired Earbuds

Best Bluetooth Speaker

Best Wireless Speaker

Best Portable Audio Player

Best Turntable

Best DAC

Best Stereo Speakers

Health & Fitness tech

Health & Fitness Device of the year

Health & Fitness Brand of the Year

Health & Fitness Innovation of the Year

Best Smartwatch

Best Running Watch

Best Fitness Tracker

Best Smart Ring

Best Electric Toothbrush

Best Connected Fitness Tech

Home tech

Home Device of the Year

Home Tech Brand of the Year

Home Tech Innovation of the Year

Best Home Light Tech

Best Home Security Device

Best Robot Vacuum

Best Vacuum

Best Air Fryer

Best Coffee Machine

Best Value Coffee Machine

Best Fan

As AI becomes an increasingly important part of our everyday lives, the role it plays in cybersecurity for both attackers and defenders is coming under rising scrutiny.

Microsoft recently released its Digital Defense Report (DDR) highlighting the role that AI is playing in crafting new and more devious cyberattacks, with businesses being hit with more threats than ever before.

But Microsoft is also using its own AI tools such a Copilot to help support its digital crimes unit, showing that the attackers won’t have all the advantages.

At the recent Microsoft Frontier Tour London event, I spoke to Dr Jon Davies, Chief Security Adviser, Microsoft UK, to find out more.

AI threats are here

“Frontier AI is transforming the threat landscape,” Davies tells me. “Right now, AI threats are real, it's not an urban myth, or something we're going to see in 2030.”

The DDR found that as AI becomes more widely available, the barrier of entry into cybercrime is being lowered, allowing hackers to launch a record number of campaigns against consumers and businesses alike.

The UK was particularly affected, becoming the most targeted country for nation-state and geopolitical cyber activity in Europe, facing 76 observed events in the past year, and ranking fifth in the world for countries where customers are most frequently impacted by cyber threats.

Davies notes that the AI threat has been building for a while, as attackers turn to automation to carry out more advanced attacks - with so-called “swarm attacks" becoming particularly more common as attackers get agents to do their dirty work

“We're getting to the point where the technology, compute, and storage is catching up with the ambition of the attacker,” he says, pointing out that defenders are embracing AI too.

“We've been solving one problem at a time as (threats) have evolved,” he adds, “the opportunity with agentic AI is to elevate the human up into the orchestration.”

But despite all the AI intelligence being funneled into creating new and more complicated attacks, more “basic” forms of scam like phishing are still proving incredibly effective, showing that the human will always remain the weakest link when it comes to cybersecurity.

The DDR found phishing attacks jumped globally from 7% to 23% of incident-response intrusions year-over-year, with attacks using fake meeting invites and calendar markers among the scams on the rise, and Davies highlights how criminals are taking information gathering on specific C-suite individuals to a new high in order to get them to click on a link.

“An attacker has no ethical line,” he points out, “phishing…is still the front door for any organization…(and) I don't think it's going to go away - with AI on its side, it's only going to get more real and harder to detect.”

So where does the responsibility lie when it comes to awareness? Davies says it should be a combination of individual and collective culpability - which means those annoying phishing tests your employer sends you are probably here to stay.

“The whole point of those training exercises is to help educate us, show us what the attackers are doing…I don’t think we should be embarrassed if we’ve clicked a link in one of those exercises, as the point is to educate and train.”

“It’s everyone’s responsibility to put a seat belt on, you are accountable to it, and regardless of who you are in your personal life, you are responsible for cybersecurity. We’re at that step change now where it’s not just the cybersecurity teams responsible for security - it is everyone within the organization.”

Davies notes that “security can be the seatbelt for AI transformation,” likening it to the introduction of the seatbelt in cars - as although they worked from day one, it still took some time to catch on.

“Security is the same way for enterprises - we can buckle up,” he adds, noting that the seatbelt doesn’t slow the car down, and eventually the change happened, making seatbelts (and safety overall) a key reason why we might buy a specific car.

So with the huge amount of threats facing cybersecurity defenders on a daily basis, how can security professionals stay positive?

“It’s really tough,” Davies says, “the threat landscape is evolving extremely, extremely fast at the moment. It has to be embedded from top to bottom - from the board level downwards through the C-suite and down to the employees - but it also then needs to be trained up from frontline staff.”

He adds that given the number of widespread cybersecurity stories hitting the headlines these days, more and more C-suite executives are becoming aware of the need to stay protected - and challenging their CISO about what they plan to do about it, and how they can recover if the worst happens.

“We’re having these conversations quite regularly,” he says, “as a member of the security profession, we’ve asked for a seat at the table for a number of years - and we’ve finally got that.”

Davies points out that the DDR isn’t just a commercial or PR exercise - it is Microsoft’s view from the front lines of the battle against the latest cybersecurity threats.

“We’ve got skin in the game,” he says, “there is no other organization on the planet that can do this at that level, it’s giving back what we’re able to share to help organizations measure their risk and threat.”

“The physics of cyber are changing,” he concludes, “we’ve got variables that we can change - but they (attackers) also have variables they can change on their side…it's a scary place out there...the world that we're living in right now is very dynamic.”

• A critical Brotli compression flaw, dubbed HTTP2Shell, could enable memory corruption and remote code execution
• The vulnerability affects widely used software including Node.js, Python packages, and .NET applications
• Vendors released patches, and administrators are urged to update immediately despite no confirmed in-the-wild exploitation

Multiple tech companies and projects have recently pushed patches for a vulnerability called “HTTP2Shell” which could enable remote code execution (RCE) attacks, similar to the recent “PHP2Shell” vulnerabilities.

HTTP2Shell was found in Brotli, a Google-built open source data compression algorithm that reduces file sizes without losing information, thus achieving faster transmission times while using less bandwidth.

It is a popular algorithm used on the web to compress HTTP responses such as HTML, CSS, and JavaScript, and is supported by most web browsers, servers, and software libraries.

Fixes and patches

The bug itself is described as an out-of-bounds write flaw, and is also dubbed Node2Shell, and Broccoli2Shell. It is tracked as CVE-2026-111497, and was given a severity score of 9.2/10 (critical). According to the National Vulnerability Database, the bug causes a buffer overflow which could lead to memory disclosure, denial of service and, in some cases, even remote code execution.

Brotli can be found in all sorts of software, all of which is now at risk. That includes Node.js, brotlicffi, HTTP clients such as Requests, urllib3, httpx and aiohttp, but also other apps that use Brotli decoders such as Bun and Envoy deployments.

Google fixed the bug on October 21 2026, by releasing Brotli versions 1.0.10, 1.1.1, and 1.2.1. However, there are other software that either bundle or use vulnerable Brotli versions, so updating Google’s library alone may not protect every application.

Over the last weekend, Microsoft released an emergency update to sort the bug in .NET, saying successful exploitation could lead to privilege escalation.

Since it also bundles the Brodli decoder, Node.js released its patch on October 21, too. “An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer,” the organization explained. “An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.”

The vulnerability was said to be affecting Node.js 26.x, 24.x, and 22.x.

BleepingComputer reports that PyPI packages containing the fixes became available two days later, on October 23.

Here is a detailed list of patched versions:

Google Brotli 1.0.10, 1.1.1, 1.2.1

Node.js 22.23.4, 24.22.1, 26.12.1

Python Brotli 1.2.1

Python brotlicffi 1.2.1.0

Dedicated website

At the same time, someone set up a dedicated website, Broccoli2Shell.com, which describes the issue, tracks vulnerable versions, and reports on attempted exploits in the wild. On the site, it is said that proof-of-concept (PoC) exploits for the bug already exist, but reports of malicious exploitation in the wild are yet to be seen.

“A public proof of concept appeared on GitHub on 2026-10-22,” the site reads. “It reportedly reaches code execution only on a deliberately weakened build. On standard builds it causes a crash and a limited memory read.”

System administrators are advised to apply the provided patches as soon as possible; restart affected processes and rebuild and redeploy affected container images.

Those that cannot do that immediately can somewhat mitigate the risks. Python users should uninstall the vulnerable Brotli and brotlicffi packages and remove optional dependencies such as httpx[brotli].

Admins can also configure proxies, load balancers or web application firewalls (WAF) to reject incoming requests containing Brotli-compressed bodies. It’s worth mentioning that this doesn’t protect apps that download and decompress malicious HTTP responses.

Node.js has no complete workaround, it was said.

• A critical Microsoft Authenticator flaw let rogue Android apps steal Microsoft session tokens without user interaction
• Attackers could impersonate trusted Microsoft apps and access emails, Teams data, calendars, and files
• Microsoft patched the bug and urges Android users to update Authenticator immediately

A critical vulnerability in the Microsoft Authenticator app for Android allowed malicious apps to obtain session tokens for pretty much any Microsoft app and hand them over to the attackers.

Unlike other Android malware, this one did not require extensive permissions, the victims did not need to approve the login process, and the attackers did not need to know their victim’s login credentials.

Found by researchers at Enclave, the vulnerability, now tracked as CVE_2026-80097, is fixed and Microsoft is urging all users to update their Authenticator app as soon as possible.

What is Authenticator and how was it abused?

Authenticator is Microsoft’s two-factor authentication (2FA) app. Besides users, it also allows other apps to authenticate, giving them session tokens that grant them access to the users’ Microsoft work account and associated data. In practice, it means that a legitimate app such as Microsoft Teams can log into a user’s work account through Authenticator.

Enclave's security researchers set out to test how secure this process was. In an experiment, which they detailed on this link, they used an Android device that was logged into a Microsoft service and had the Authenticator app installed. Nothing less - nothing more.

Then, they installed a third app that was not malicious by any usual Android standards - it did not ask for extensive permissions, it did not contact a shady third-party server, and it did not try to exfiltrate any data.

What it did do, however, was pretend to be a legitimate Microsoft Teams app. As such, it asked Authenticator to, well, authenticate it, and grant it access to the data.

To do that, it provided the necessary data: proper package name, client ID, and redirect URI. Authenticator confirmed the data was real and granted the app the token. Voila - the researchers were given access to emails, Teams chat messages, calendars, and were also allowed to modify and send messages, alter files, calendar entries, send chat messages, and even manage certain authentication methods (create or delete passkeys).

A controlled experiment

How, you might ask? Apparently, Authenticator was just checking if the data the app provided was real - not the nature of the app providing the data itself. In other words, any app could have said “Hey, I’m Teams, give me a session token”, and would receive it.

The worst part is that this was all being done in the background. The researchers did not have to confirm the app’s login attempt, nor were they notified of it to begin with.

“We found that an unprivileged Android app with zero permissions could impersonate any installed Microsoft first-party app and have the Microsoft Authenticator broker hand it that app's tokens,” they said. This is a big deal, since asking for extensive permissions is the number one way to spot malicious Android apps.

Luckily for everyone involved, Enclave did not spot this attack in the wild and instead created it in a controlled environment. There is no evidence anyone tried anything similar in the wild, but now that the news is out, chances are they'll try. Therefore, it is vital all Authenticator users update their apps as soon as possible.

The silver lining in this report is that the malicious app still needs to land on the target Android device somehow. These apps likely won’t make it into the Google Play Store, and as long as users refrain from downloading shady .APK files from unvetted app stores, they should be fine.

Enclave reported the vulnerability to the Microsoft Security Response Center, which confirmed the issue and released a fix. It said that Microsoft Authenticator for Android versions earlier than 6.2606.4246 are affected and stressed that users should update to version 6.2606.4246 or later through the Google Play Store.

• XMG warns that 'substantial price increases for upcoming GPU shipments' mean it's hiking RTX 5090 laptop prices
• One model is already pricier and bigger hikes for XMG's other notebooks could be coming soon
• At the same time, we're hearing more about the struggles of Nvidia's partners for supply of components for the desktop RTX 5090

The position of Nvidia's RTX 5090 is looking shakier by the day, as even more chatter is emerging suggesting that this GPU is effectively sidelined at this point, even if it hasn't actually been discontinued.

You may have read up on those recent rumors claiming that Nvidia has discontinued the RTX 5090 — which is speculation that Team Green has firmly denied, I should make clear.

The fresh negative news from the grapevine comes firstly from laptop maker XMG on Reddit, which is sharing more bad news on the RAM crisis affecting its prices, specifically with the RTX 5090.

XMG says: "We expect laptops with the RTX 5090 to become significantly more expensive again over the coming weeks." (We already saw price hikes from XMG last month, if you recall).

The company explains why: "Procurement conditions for the RTX 5090 Laptop GPU have deteriorated considerably within a short period. We have received new information indicating substantial price increases for upcoming GPU shipments.

"At the same time, availability is becoming increasingly constrained. Replenishment orders that have already been planned or, in some cases, even confirmed are being significantly reduced in quantity."

XMG notes that beyond these existing orders, it is "currently difficult to make reliable predictions about future supply volumes and delivery dates."

The laptop maker also tells us that "other laptop GPUs are also facing supply constraints", but that the "combination of massive price increases and extremely limited supply" is "particularly pronounced" with the RTX 5090.

That doesn't sound very comforting, does it? The immediate result is that the Schenker Key 18 Pro laptop (Schenker is XMG's parent company) with the RTX 5090 has increased in price by €250 (around $280 / £210 / AU$400) as of today, and the XMG NEO laptops with the RTX 5090 will see at least a similar price increase — although we're warned that the "increase could be even higher" for those notebooks depending on how the situation develops. Nasty.

The second shot of negativity here is from overclocker Der8auer in Germany, who as Wccftech reports, has heard from one of Nvidia's board making partners.

Add seasoning as appropriate here, but the unnamed graphics-card maker claims that while it hasn't been informed that the RTX 5090 is discontinued — Nvidia Germany also told Der8auer this (backing up other statements to this effect from Team Green) — it cannot currently purchase the GB203 chip plus VRAM package (32GB of GDDR7 video RAM) to make the RTX 5090 laptop card.

The more worrying part is that the board maker says that this kind of component shortage has happened before, but it has always been able to place a backorder to be fulfilled later. However, right now it's not even possible to obtain a backorder from Nvidia.

A maker of coolers for the RTX 5090 further observes that it has witnessed reduced orders from board makers, and it doesn't have any orders at all for heatsinks for Nvidia's flagship GPU for Q2 2027 at this point. That obviously suggests that the production quantities for the RTX 5090 are looking even shakier for the future.

Analysis: bleak times

At some point, the accumulation of rumors begins to reach a kind of critical mass where it seems very unlikely that they're all off base, and that in all likelihood, something really is going on.

We appear to be arriving at this point with the RTX 5090 rumors, in my opinion. There are too many of them, and the indications at the retail level — vanishing stock, and ever-increasing RTX 5090 prices, which have become truly ridiculous — also back up the grapevine here.

What's worrying is the further gloom from the likes of a cooler manufacturer, and the fact that the RTX 5090 laptop GPU is also involved. Remember that this doesn't use the GB202 chip seen in the desktop RTX 5090, but Nvidia's GB203 silicon; however, the supply problem lies in getting the video RAM (3GB GDDR7 modules, which are now thinner on the ground and far pricier than the 2GB modules used in the RTX 5080 laptop graphics card).

So, while the RTX 5090 may not be discontinued, it would appear that supplies are getting so low for this GPU — on both desktop and laptop fronts — that while technically it's still in production, the quantities are dipping to such an extent that the flagship is effectively being pushed aside.

All in all, it feels like an especially bleak time for higher-end Nvidia graphics cards, and the fear is that the situation may worsen from here.

Certainly when we look at the predictions for the RAM crisis next year, they're universally pessimistic, and there's a greater level of belief these days that memory supply woes could last for the rest of this decade. Of course, VRAM is bound up in that, as well as AI demand for GPU chips, and all this could affect the launch timeframe of Nvidia's next-gen GeForce graphics cards, too.

• University of Copenhagen discloses breach exposing personal data on more than 525,000 individuals
• Stolen information included names, national ID numbers, contact details, and some campus access PINs
• University contained the incident, reported it to regulators, and warned users about phishing risks

The University of Copenhagen in Denmark has confirmed suffering a cyberattack and losing sensitive data on more than half a million people.

In a notification published on the organization’s website, it was said that unnamed attackers gained access to one of its test environments, and from there, they pulled full names, national identity numbers (CPR), phone numbers, and email addresses on some 525,000 people.

A subsequent update to the announcement added another 20,000 staff and students, whose PIN codes were apparently exposed.

Phishing risks

The university responded by restricting physical access to critical locations on campus, and then redistributing new access codes. After that, the locations were gradually reopened. In the meantime, the university’s IT team contained the attack and prevented further incursions and said there was no evidence of any other compromise or disruptions to other systems.

The incident was then reported to the Danish Data Protection Agency, and since it falls under the jurisdiction of the General Data Protection Regulation (GDPR), the university was now investigating its next steps.

Universities and other educational institutions hold the kind of information cybercriminals find rather valuable. Contact information, paired with private information not many people know, is the kind of data threat actors can use to create tailored and personalized phishing emails.

These emails can then trick the victims into downloading infostealer malware, or granting access to systems where a ransomware deployment could be devastating.

For example, cybercriminals were seen mailing students saying their email address was due for decommission because it wasn’t used in a little while. The students were given a short timeframe (usually 24 hours or less) to “confirm their identity” or risk losing their email address, all emails stored there, as well as their entire contacts list. Obviously, that risk was never real. Victims who wanted to “confirm” their identity were redirected to a fake Microsoft 365 login page which, if they tried to log in, just relayed the credentials to the attackers.

A long list of victims

The list of universities being targeted for their data is long and ever-growing. In early November 2025, the University of Pennsylvania confirmed hackers broke in and stole files from its system.

They tricked an employee into sharing a PennKey SSO account, which gave them access to the university’s VPN, Salesforce data, Qlik analytics platform, SAP business intelligence system, and SharePoint files. Using that access, they stole data on approximately 1.2 million students, alumni, and donors, including names, dates of birth, addresses, phone numbers, estimated net worth, donation history, and demographic details.

Just two weeks later, Princeton University suffered the same fate. In a data breach notification letter sent to an undisclosed number of people, the University said threat actors accessed an Advancement database belonging to the Ivy League institution, where they were able to access information about alumni, donors, some faculty, students, parents, and other members of the organization.

The compromised database contained personally identifiable information such as names, email addresses, phone numbers, and home and business addresses. The database also contained information about fundraising activities and donations made to the university.

Earlier still, in mid-2025, infamous threat actors ShinyHunters broke into Canvas (a learning management system) and through it stole data from the world’s top universities, including Harvard, Oxford, and MIT. Stanford, Princeton, Columbia, Cambridge, Cornell, Berkeley, and Georgetown were all said to have been compromised at the same time. The attackers then said they struck more than 8,800 educational institutions in 10 different countries, including the US, Australia, the UK, and Sweden.

The University of Copenhagen is now urging its students, staff, and partners, to be wary of incoming emails.

Via BleepingComputer