• Clicking 'Learn more' would skip Microsoft account demands when setting up Windows 11
• It now shows user data policies, so you'll have to sign in with your account (or create one)
• Having an account can make certain things easier, but it's one less choice for consumers

Microsoft has finally fixed one of the easiest ways for attackers to bypass its account requirements when installing Windows 11, but it's bad news for anybody who didn't want to sign in with – or create – a Microsoft account during setup.

Previously, users only had to click the 'Learn more' hyperlink on the sign-in screen to be taken to a local account creation screen.

Ultimately, it marks another step in the company's ongoing efforts to make Microsoft accounts mandatory during the initial setup of Windows 11 on consumer PCs.

Microsoft wants you to use an account to activate Windows 11

Before the fix, users could click the 'Learn more' link and be taken to a screen that allowed them to enter a local username, create a password, configure security questions and complete Windows 11 setup without ever entering their Microsoft username or password.

Instead, the link now opens a page that explains how the company managers user data.

The change "has been recently quietly patched server side," Bob Pony said in a Bluesky post after revealing that "a new method for skipping the mandatory Microsoft Account login in Windows 11 Home Edition has been discovered" just one month ago.

Local accounts remain supported to a certain degree, but creating them either requires technical knowledge to use a third-party tool or command-line methods, or enterprise versions of Windows rather than consumer-grade operating systems.

There are some benefits to signing in with a Microsoft account from the get-go, like speedier setup of system integrations with OneDrive, the Copilot app and other Microsoft products, however it eliminates user choice for those who prefer not to tie their PCs to their online account.

• Attackers exploited critical AhsayCBS backup software flaws to compromise organizations’ backup servers
• Intrusions deployed webshells and disguised XMRig cryptominers for persistence and stealth
• Researchers urge immediate patching, restricted access, and full system reimaging if compromised

In a particularly brazen hack, threat actors were seen targeting the servers that businesses use as backups in case of a cyberattack.

The vulnerabilities used in this attack have since been mitigated, but since the attack is currently ongoing, organizations using this particular backup method are urged to apply the fixes immediately and secure their premises.

AhsayCBS backup utility

At the core of this incident is a backup utility called Ahsay Cloud Backup Suite (or AhsayCBS), a server-based backup management platform developed by a company of the same name, based in Hong Kong.

Businesses, managed service providers (MSP), and IT admins use it to manage backups for their devices and clients across a range of virtual and physical servers, databases, and various software environments, with the tool widely used by IT service providers to manage their clients' data.

Security researchers Huntress noted that on October 4, 2026, two flaws in AhsayCBS were publicly disclosed: CVE-2026-105113, and CVE-2026-105134. The former is a medium-severity vulnerability affecting the checkSysPwd function, and can lead to improper authentication. The latter is a critical-severity flaw affecting the Replication Receiver component, which could lead to unauthenticated remote code execution as NT AUTHORITY/SYSTEM on the host.

“The API contains an authentication bypass that could allow for a random token to substitute valid credentials,” the researchers explained. “After exploitation, a threat actor configured a malicious receiver and dropped a Java Server Page (JSP) webshell into the application directory served by the CBS application.”

Just three days later, threat actors started exploiting these bugs - the first one to bypass authentication, and the second one to gain code execution and deploy webshells on exposed systems. The webshells served primarily as droppers, deploying a range of stage-two executables.

Mining crypto

Huntress also saw threat actors deploy a popular cryptominer called XMRig. This is a legitimate open-source miner that uses the computer’s hardware, electricity, and internet, to mine the Monero currency and deposit it to the attackers’ wallets.

Monero is the go-to currency for unsolicited crypto mining since it is designed as a privacy-first coin that is very difficult to trace across the blockchain.

The attackers went to lengths to hide XMRig on these backup servers. They disguised them as a Microsoft Edge process and installed them as fake Edge update services. They also made sure it hid when someone looked.

A script (apparently written by AI) shuts down the miner whenever Task Manager is opened. The same script would close Task Manager after an hour.

Backups are perceived as one of the strongest protections against ransomware attacks. Virtually all cybersecurity organizations and thought leaders are advising organizations deploy backups and frequently maintain and control them, to make sure they are not outdated or otherwise corrupted. The fact that they can be compromised with relative ease should be cause for alarm. Businesses who were struck could consider themselves lucky to have only gotten an XMRig infection and not a full-blown ransomware encryptor.

That being said, as of October 8, at least five organizations were already targeted, Huntress said. Therefore, it is essential all organizations using AhsayCBS apply the provided patch as soon as possible. All versions of the utility, through 10.3.4 are impacted, it was said.

Besides applying the fix, organizations should also restrict AhsayCBS management interface web access, since the exploit targets the external accessible web app service on the host. “Access should be limited to trusted IP addresses only or require VPN,” Huntress says. “If any of the IoCs listed in this blog have been uncovered, companies should carry out a full host re-image from a trusted backup; as attackers have been able to hide secondary backdoors for extended persistence.”

• Ahold Delhaize took systems offline after a cyberattack, though details remain limited
• Disruptions affected employee services and customer-facing websites across multiple retail brands
• Company is investigating the incident amid concerns of another major ransomware-related attack

Ahold Delhaize has suffered a cyberattack that forced it to pull parts of its IT network offline.

On October 12, 2026, the retail giant issued a brief statement, saying it is experiencing a “security issue” within its network. “Our teams are taking steps to assess and mitigate the issue,” it said. “This includes taking some systems offline to help protect them. At this time, our stores are open and serving customers.”

We don’t know which parts of the operation were affected, how the attack took place, and whether or not any sensitive company or customer data was exposed. We don’t know if customers were affected, how many, and to what extent.

Usually, when a company shuts down its network to contain an incident, it is due to a ransomware attack and its data exfiltration efforts. However, no threat actors have yet claimed responsibility for this attack, and no data has surfaced on the dark web, at press time.

“Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority,” the company concluded. “We apologize for any inconvenience this issue may have caused customers and partners.”

Hackers get ahold of Delhaize

Ahold Delhaize is a wholesale company and a multinational retailer running more than 9,400 stores across the United States, Europe, and Indonesia.

It counts roughly 400,000 employees, which serve some 60 million customers weekly, both in stores, and online. Brands under its umbrella include Delhaize, Maxi, Mega Image, Albert, bol, Alfa Beta, Etos, Gall & Gall, and Profi in Europe, and Food Lion, Stop & Shop, Giant Food, and Hannaford in the American market, as per BleepingComputer.

Unfortunately, it has plenty of experience with cyberattacks. In mid-November 2024, an attack on the company resulted in grocery stores and pharmacies in the US being unable to service their customers properly. Even then, Ahold Delhaize shut down parts of its network to contain the attack and had trouble with disabled phone lines. It was later confirmed that it was a ransomware attack launched by the INC Ransom threat actor.

In the attack, the hackers stole sensitive data on more than 2.2 million people, the company later confirmed via a filing with the Maine Attorney General’s Office. It said the data may have included internal employment records for both current and former employees.

The combination of stolen data varied from person to person, but generally, it included full names, postal addresses, email addresses, phone numbers, dates of birth, government-issued ID numbers, bank account numbers, health information, and other employment-related information.

Trouble for the retailers

That attack, which apparently took more than a week to remedy, was disruptive enough to have employees voicing their annoyance on social media. At one point, the pharmacy at Stop & Shop could not refill prescriptions. The Food Lion, on the other hand, had to address missing and delayed deliveries. Instacart orders return dates were constantly being pushed back.

BleepingComputer noted employees at the Stop & Shop American regional supermarket chain are now having trouble accessing their schedules and pay stubs as a direct consequence of the latest attack. Customers have been unable to use websites, apps, and customer service platforms at Albert Heijn, Etos, and Gall & Gall stores in the Netherlands, and Delhaize in Belgium.

The publication also reported, citing an internal memo shared by Lion Food employees in the United States, that the company flagged the attack as an IT outage, and told staff their “store may be unable to shop, stage, or hand off orders.”

• Intel's CEO has said that AI hardware will be in short supply for the next 2 to 3 years
• Of course, this refers to the ongoing memory crisis, and consumers will get shorter shrift than AI players
• A new report from Barclays also shows that contract pricing for RAM has risen 24% over the past quarter for DDR4 (and 20% for DDR5)

Need more fuel to stoke the idea that the RAM crisis is here to stay? Doubtless you don't, but sadly we've had a couple more indications that the memory shortage will last for a depressingly long time, with Intel's CEO the latest to weigh in.

Wccftech reports that Intel's Lip-Bu Tan was speaking in Singapore at the Asia Future Forward event, a conference organized by DBS Bank, where the CEO discussed his thoughts regarding trends with AI – including the amount of memory it's eating up.

As flagged by Theresa Perrin on X, Tan observed that "AI hardware will stay in short supply for the next 2 to 3 years" — primarily referring to memory — and that this was "driven by persistent constraints in the underlying tech supply chain."

While the CEO is talking directly about RAM (as well as GPUs, and to an extent CPUs) used in data centers for AI applications, the fact that the AI industry is going to be short on supply for perhaps the next three years means that consumer RAM is going to be even thinner on the ground. It's no secret that the greater profits to be had by catering to the AI industry mean that this memory is the priority for chip makers.

Wccftech also noticed another post on X, from 456X, highlighting a new report from Barclays that shows contract pricing (from chip makers) for DDR4 RAM has risen 24% over the last three months, and that DDR5 has gone up 20%.

Barclays further observed that one of the big memory chip makers, Micron, will see its supply levels of RAM remain constrained through 2028. In other words, we can expect that memory supply is going to keep on being a major problem for the next two years, with 'through' 2028 meaning that this year is included in the gloomy prediction.

Analysis: yet more doom nuggets — and then there's the rise of the robots

The reported rises in the contract price of RAM according to Barclays match what we've seen at retail over the past few months, with some notable jumps in the price of DDR5 memory (which in Germany has reached a ridiculous level of 544% up on the price it was before the RAM crisis began last July).

What Barclays, and Intel's CEO, are now telling us is that this kind of pain is likely to continue, and that RAM supply will continue to be frustratingly short until 2029. Unfortunately these kinds of forecasts are becoming more commonplace, with pretty much everyone's view appearing to align with the idea of the RAM crisis hanging around until the end of the decade.

At the very least, we can expect 2027 to be a repeat of this year — meaning more memory prices hikes, and other components besides, such as GPUs — with 2028 likely to follow in a similar vein. Indeed, Micron has said as much itself, while letting us know that robots (or 'physical AI') will be eating up a lot of RAM supply in the future.

• Malware infection at a third-party contractor may have exposed data of 8.7 million customers and employees
• Exposed records included personal details, though no payment data or confirmed misuse was reported
• Incident highlights supply-chain risks, with Daiichi Kosho investigating and reviewing contractor security

Even the entertainment industry is not safe from data-stealing cybercriminals - Daiichi Kosho, one of the biggest entertainment system makers in Japan, has disclosed a malware infection in its supply chain that may have resulted in the compromise of 8.7 million of both customer and employee information.

“Daiichi Kosho has received a report from Nippon Columbia Group (NCG), to which the Company outsources the handling of personal information, that a device used by an NCG employee was infected with malware and that the company’s customer information may have been leaked,” a machine-translated data breach notification letter reads.

“At this time, we have not confirmed that personal information was actually leaked externally or that it was misused as a result of this incident. However, as we cannot rule out the possibility that personal information was leaked, we are providing the information currently available and the actions we will take, as follows. We have also confirmed that the company’s systems were not affected.”

Supply chain attack

The wording is intentionally ambiguous - as this is obviously a supply chain attack, since Daiichi Kosho was not directly compromised.

Instead, it was Nippon Columbia Group, a group formed in 2025 after a restructuring of Faith. Nippon’s roots date back to 1910, when its predecessor became Japan’s first record company. Today, Faith established Nippon Columbia Group as a new organization focused on AI-powered entertainment and content distribution.

Daiichi Kosho, on the other hand, is one of Japan’s leading karaoke and entertainment companies. It was founded in 1973 and is today best known for its DAM karaoke systems and Big Echo karaoke venues. In fact, the company today runs more than 400 karaoke venues across Japan, including more than 100 in Tokyo alone.

The company both sells and rents karaoke gear, runs establishments and restaurants, and produces music and videos. Daiichi Kosho is a substantial business, generating roughly ¥163 billion (around $1.06 billion) in annual revenue a year.

Malware infection

According to BleepingComputer, Daiichi Kosho outsources the handling of its customers’ personal information to NCG. On October 5 2026, that company notified Daiichi Kosho that it found a malware infection and isolated the affected systems the day after. We don’t know exactly how the company ended up infected, or what kind of infection it was. What we do know is that it suspects records on 93,000 employees and 8,631,000 customers may have been exposed.

These records contain people’s full names, genders, dates of birth, email addresses, and telephone numbers. Customers of BIG ECHO, MEGA BIG, Karaoke CLUB DAM, Banana Club, B-GARAGE, and DK Dining, are among those affected by the attack. Passwords, loyalty points, or payment data, were not disclosed, the notice reads. Furthermore, there is no evidence of the data being misused on the dark web.

However, Daiichi Kosho did warn employees and customers to be wary of incoming email messages, especially unsolicited ones claiming to come from the company itself.

Personally identifiable information holds value on the black market because threat actors can use it to launch personalized, highly tailored phishing attacks.

Through these attacks, they can steal login credentials for corporate environments, or deploy infostealers to grab the passwords. That allows them to pivot to corporate IT infrastructure, steal business secrets and other data, and establish persistence. Ultimately, all of this allows the attackers to threaten to release the files to competitors and the public and thus pressure the victims into paying a ransom.

Daiichi Kosho said it will “continue to monitor the situation and take the necessary measures if we detect any signs of unauthorized use.”

It also said that, out of an abundance of caution, it was now inspecting other systems and was examining how it manages its contractors to see if there is room for improvement.

“If further investigation reveals any new facts, we will promptly provide an update, including the customers affected and the measures to be taken,” the machine-translated notice reads.

• Mozilla wants security-conscious companies to use Firefox Enterprise
• "Choice is a lie," Mozilla CEO says, referring to browser engines
• Thunderbird Enterprise is also in the works

Mozilla has introduced Firefox Enterprise, a brand-new version of its browser designed specifically for organizations that need extra security, governance and compliance controls.

The company argues businesses have become increasingly dependent on a small number of tech companies, handing over certain levels of control to third parties, however it believes that tech consolidation comes with its own risks.

It also acknowledges that these deep dependencies have made it harder for companies to switch providers, and all of this has been factored into its Firefox Enterprise browser.

Firefox Enterprise

"We see [the browser] as a key, but under-governed, layer," Mozilla said in an announcement, slating other browsers' dependencies largely on Google (Chromium) and Apple (WebKit). For reference Firefox runs on Gecko, a free and open-source browser engine developed by Mozilla itself.

"If all your options are built with the same technology underneath, ‘choice’ is a lie," CEO Anthony Enzor-DeMeo explained.

Firefox Enterprise's biggest selling point is control – customers can choose where data is stored and how it's governed, and it's designed to work with existing systems.

"Keep your identity provider. Keep your SIEM. Keep your MDM. Just add a browser whose management infrastructure you operate," Mozilla said.

Firefox claims to have 200 million monthly users, but per Statcounter data, it only accounts for 6% of desktop browsing sessions globally compared with 65% for Chrome.

France, Germany, Austria and Switzerland will be the first countries to get access to Firefox Enterprise, with other countries added later on. And as for emails, Thunderbird Enterprise "is also in development," so we can expect to hear more about that soon.

• Human error remains one of the biggest challenge to online security, according to industry leaders
• 68% of security professionals cite human error, compared with just 55% for email-based scams
• A worrying 80% of contributing factors in recent security incidents can be traced back to poor user practices or lack of training

New research into the challenges facing cybersecurity professionals has revealed the naked truth: that humans are considered the main challenge to security.

A new Kaseya survey of over 1,100 MSPs and IT professionals around the world uncovered a startling trend: that the risks posed by humans to their cybersecurity are considerable. Some 68% of respondents cited human error (including social engineering and distraction) as the most concerning attack vector over the next 12 months.

With the overwhelming majority of cybersecurity incidents attributable to human error, security suites and the teams that use them are increasingly focusing on ways to mitigate the challenges posed by people.

Human error

We know that humans need security as much as the data they’re working with. But the results of this survey illustrate a sad truth: that cybersecurity professionals are more concerned about user error and the vulnerabilities of “soft” targets than the threats from automated attacks against network hardware and servers.

Hackers know that humans make mistakes. Organizations need to be on the same page.

From the results of the report, we can see that after the prospect of risks caused by human error, social engineering, and distraction, 55% of those surveyed are concerned about attacks via email. Gullibility is also considered a risk (41%) as is a lack of cybersecurity training for users (40%).

Auditing isn’t always the answer, either. Of those surveyed, 65% said they would pass a compliance audit today, but 49% noted that incomplete documentation and procedures could create problems.

True cyber resilience

Worryingly, only 20% of IT departments have a budget that is growing in line with the risks they face, with 77% describing themselves as under-resourced.

“People aren’t perfect, and everyone knows it,” noted David Baggett, SVP and GM of Security Suite at Kaseya. “Yet much of cybersecurity still depends on people making the right decision every time.”

Unfortunately, it seems as though human error is here to stay. So what is the solution? Bagget says its about factoring in the poor practices and errors.

“The path to true cyber resilience isn’t about eliminating mistakes. It’s about building an organisation that can withstand them. Expect mistakes, account for constraints and engineer around them.”

As far as Kaseya is concerned, that means building security systems and practices that withstand those mistakes.

• Cybercrime group BYOD has published records on 3,615 Trump Mobile customers, including names, home addresses, phone numbers, and order details
• BYOD says it got in via malware on a Liberty Mobile employee's device, and that Trump Mobile told it there was "no team" to respond
• The published data appears to cover the wireless service rather than T1 phone orders, and includes abandoned sign-ups and the Trump Organization's own CIO

A newly formed cybercrime group calling itself BYOD says it has stolen and published personal data belonging to 3,615 Trump Mobile customers, the latest setback for the Trump-branded wireless venture and its gold-colored T1 smartphone.

Straight Arrow News first reported the leak after reviewing the dataset, which contains names, email addresses, phone numbers, home addresses, and order details, and contacting people listed in it.

Trump Mobile has not responded to Straight Arrow, and neither the Trump Organization nor Liberty Mobile, the Florida-based operator behind the service, answered questions from The Register.

A ransom note that skipped the ransom component

BYOD posted the data to its dark web leak site in late September 2026; a ransomware tracker cited by IBTimes UK dates the entry to September 29. The Register describes BYOD as a new ransomware-as-a-service operation, with Trump Mobile as only the third organization named on its site, though IBTimes UK notes that nothing published so far shows encrypted systems or a ransom demand.

The group's account of how it got in is consistent in outline, even if the details differ slightly: BYOD told International Cyber Digest it compromised a Liberty Mobile employee with an infostealer, while Cybernews and Android Authority describe a remote access trojan.

Regardless of how they got onto the device, BYOD's messaging indicates it pivoted from that foothold to exposed Trump Mobile subdomains, still has live access to a customer dashboard, and claims neither company used multi-factor authentication.

As proof, it sent Straight Arrow a dashboard screenshot showing one customer's personal details, but said access has not been independently confirmed yet. The more damning part of this is that Trump Mobile's answer to this has been "We have no team to handle this" and branding anyone who hacked it a terrorist, an exchange that BYOD alleges took place.

The data, however, has held up; Straight Arrow reached people who confirmed their details were accurate, Cybernews said its samples looked genuine and did not match earlier breaches, and PCMag reached three people in the file, one of whom was surprised to find an accurate record of canceling a 30-day unlimited plan.

BYOD may not even be the first to cash in: a separate group, EndZone, claimed on September 23 to have taken data on 4,000 Trump Mobile users, IBTimes UK reports, and security researcher Dominic Alvieri told The Register the EndZone dump "appears to be the same original breach." BYOD denies a formal tie, with a representative telling PCMag that one member "just knows a few people behind EndZone," according to IBTimes UK.

At launch in June 2025, Eric Trump promised that "Trump Mobile is going to revolutionize cell phones" - but what followed has been less revolutionary.

The "Made in America" promise disappeared from the website within two weeks. Shipping slipped from August 2025 to December, then March, then April, and in April the company rewrote its preorder terms to state that "a deposit is not a purchase." In January, lawmakers urged the FTC to examine the brand's marketing.

For consumers, there is a silver lining: No payment card data has been reported in the dump, so the immediate risk is phishing rather than direct fraud. This doesn't completely solve the problem, however: names, phone numbers, home addresses, and order histories are exactly what scammers need to pose convincingly as a carrier or a delivery service.

Anyone who signed up, or merely started signing up, with Trump Mobile should treat unexpected messages about orders, refunds, or account problems with suspicion at a time when Trump Mobile continues to drag its feet on the matter, much like its May breach, when the company said it was still deciding whether to notify people. This time is a little different, however: it has said nothing at all.

• Microsoft CEO Satya Nadella says Copilot Code and local AI make every Windows PC an infinite software factory with no cloud token spend
• Rather than killing app stores, Microsoft is moving app hosting into Copilot, while IT leaders stay wary of citizen-built tools
• Microsoft's own engineers say local inference doesn't make sessions offline, and the routing ships later this month

Microsoft CEO Satya Nadella has a new pitch for the Windows PC, and it targets one of the most lucrative ideas in consumer tech.

In a post on X summarizing Microsoft's recent Windows and Surface event, Nadella told followers they no longer have to settle for whatever an app store happens to stock, because Copilot can now build the software they need on the desktop without spending any cloud tokens.

He wrote this idea without mincing any words, saying, "Your PC becomes an infinite software factory."

From Gates' factory to your desk?

The narrative is a striking line from the head of a company that sells more software than almost anyone.

But read Microsoft's own engineering documentation for the same launch, and the infinite factory starts to look rather finite: it runs best on a $5,899 laptop, it still reaches into the cloud, and the businesses Microsoft most needs to convince have spent the past year telling researchers they are worried about exactly this kind of thing.

More importantly, the factory metaphor is not new for Nadella: In a 2025 staff memo, he recalled that Bill Gates had envisioned "not just a software company, but a software factory," and argued the AI era demanded a rethink.

At a recent customer gathering, the CEO said Microsoft had progressed from code assistance through agentic coding "to software factory all within one year," and he now wants customers to open software factories of their own, spending more with Microsoft along the way.

The October 7 2026 launch builds on this ambition: a Windows Experience Blog post by Windows and Devices chief Pavan Davuluri describes hybrid intelligence, in which Copilot reads local files with permission, acts across Windows, and hands work to on-device models.

Copilot's Code experience builds an app, dashboard, or workflow from a plain-language description, and on Windows, Microsoft says it can produce native apps from one prompt. Jared Spataro, Microsoft's chief marketing officer for AI at Work, argued that building such tools is becoming "as basic a skill as writing a memo or modeling a budget."

The engine underneath is MAI-Code-1.1 Flash, Microsoft's in-house 137-billion-parameter coding model, which Nadella's post said is now optimized to run on a PC. There is a catch, however: despite Microsoft painting it as a situation where consumers are finding their AI needs "outpacing what their cloud budgets can support."

Microsoft's own engineers are more grounded about what the process entails, saying GitHub Copilot's automatic mode decides task by task whether work runs locally or in the cloud, and one diagram caption is blunt: "local inference does not make the session offline."

That routing doesn't ship until the end of October 2026; the hybrid Copilot features reach Copilot+ PCs over the coming months, and Code is rolling out first through Microsoft's Frontier early-access program. This is interesting, but somewhat predictable, because Nadella's approach, as stated, would cannibalize Microsoft's token-based business model.

An approach that routes harder tasks back to the Azure cloud makes far more sense by conserving compute where possible while still putting Microsoft's cloud compute at the center of things.

The hardware is another factor that one might be overlooking here: according to the Command Line post, the on-device version of MAI-Code-1.1 Flash is quantized down to 53GB, roughly an 80% reduction from the cloud model, and peaked at 75.5GB of memory at full context on Microsoft's test machine, a Surface Laptop Ultra built on Nvidia's RTX Spark.

That matters because eight Surface Laptop Ultra configurations are in play; only one has more than 64GB of memory, per TweakTown: the 128GB model at $5,899, which costs $3300 more than the base model and isn't available to purchase yet, meaning that potential users can't really test out how well it does compared to cloud-based solutions at a time when all performance-related figures come from Microsoft.

The death of modern enterprise software? Not yet

Despite the hardware limitations in play, it might indicate a death sentence in the making for most basic enterprise-level software solutions, even as more ambitious ports have already been in play: Developer Brandon Thomas, for one, has just released seven open source Adobe Creative Cloud alternatives that he says he built with Anthropic's Claude Opus 5.5, declaring that "software is over."

His own roadmap, however, puts the Photoshop stand-in at roughly a quarter to a third of what a professional needs for daily work. Building software has become cheap. Building software someone can depend on has not.

The bigger issue will be enterprise IT, which will, I suspect, keep the gates closed for now; enterprises don't just buy features; they buy someone to call when it breaks, a patch schedule, an audit trail, and a vendor that carries liability.

Getting an open-source or AI-assisted app someone designed with zero liability in tow that could break things, create security risks, and may not come with future software updates that resolve either issue.

The survey data points the same way: a June 2026 Retool study of 307 CTOs, CIOs, and CISOs found 93% concerned about vibe-coded tools reaching production, though Retool sells an internal-tools platform pitched as the governed alternative.

A Harris Poll survey for Dataiku of 600 CIOs found 81% worried that citizen-built AI could expose sensitive data, and over half had already discovered unsanctioned AI in their organizations.

Gartner, meanwhile, predicts that over 40% of agentic AI projects will be scrapped by the end of 2027, with analyst Anushree Verma describing many as "mostly driven by hype and are often misapplied."

Microsoft's own launch materials quietly concede the same, even taking measures to ensure that agents do not run rogue while building software or solutions on-device.

The Command Line post admits Copilot's built-in file tools are policy-checked inside the app rather than isolated by the operating system, and GitHub requires Business and Enterprise administrators to enable a policy before staff can use MAI-Code-1.1 Flash at all, while Microsoft Execution Containers, which are now generally available, allow IT to define what agents can read, modify, or execute.

The real test for Nadella's factory isn't individuals with a $5,899 laptop and a tolerance for alpha software, but businesses willing to take the risk and trust Microsoft's safeguards. Until then, one could assume the AI factory narrative will continue to run well below its advertised potential.

It's time for your guide to today's Wordle answer, featuring my commentary on the latest puzzle, plus a selection of hints designed to help you keep your streak going.

Don't think you need any clues for Wordle today? No problem, just skip to my daily column. But remember: failure in this game is only ever six guesses away.

Want more word-based fun? TechRadar's Quordle today page contains hints and answers for that game, and you can also take a look at our NYT Strands today and NYT Connections today pages for our verdict on two of the New York Times' other brainteasers.

SPOILER WARNING: Today's Wordle answer and hints are below, so don't read on if you don't want to see them.

Wordle hints (game #1942) - clue #1 - Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Wordle hints (game #1942) - clue #2 - first letter

W is a fairly average letter when it comes to starting an answer. There are 82 solutions that begin with a W, with means that it ranks 13th – so right in the middle of the alphabet.

Wordle hints (game #1942) - clue #3 - repeated letters

Repeated letters are quite common in the game, with 748 of the 2,309 Wordle answers containing one. However, it's still more likely that a Wordle doesn't have one.

Wordle hints (game #1942) - clue #4 - ending letter

R is a very common letter to end a Wordle answer – it's actually the 4th most common there, behind E, Y and T.

Wordle hints (game #1942) - clue #5 - last chance

Still looking for more Wordle hints today? Here's an extra one for game #1942.

• Today's Wordle answer is broader in scope, size or extent.

If you just want to know today's Wordle answer now, simply scroll down – but I'd always recommend trying to solve it on your own first. We've got lots of Wordle tips and tricks to help you, including a guide to the best Wordle start words.

If you don't want to know today's answer then DO NOT SCROLL ANY FURTHER BECAUSE IT IS PRINTED BELOW. So don't say you weren't warned!

Today's Wordle answer (game #1942)

• NYT average score: 4.3
• My score: 4
• WordleBot's score: 4
• My skill score: 98
• My luck score: 47
• My start word performance: SANER (111 remaining answers)
• WordleBot's start word performance: SLATE (329)
• Tomorrow's start word: SANER

Today's Wordle answer (game #1942) is… WIDER.

Thought you might be getting an easier one after four tricky games in a row? Think again, because WIDER has an average score of 4.3.

It is, of course, an ER word — and we all know they tend to be difficult. How difficult? Well, here are some stats for you:

• Number of ER words in the original list: 141
• Number of ER words to have appeared so far: 113
• Number of non-original ER words: 4
• Number of remaining ER words: 32 (or more)
• Average score for all Wordles: 3.97
• Average score for ER words: 4.39
• My average score for ER words: 4.0

So as you can see, ER words play 0.4 guesses harder than standard Wordles on average, and given that there have been a few easy ones, that means that many have been considerably tougher than that.

In that company, WIDER is merely annoying rather than downright dangerous. Well, unless you play on hard mode, in which case good luck!

Even on hard mode, WIDER is not the worst such word, with CIDER, RIDER and the oft-forgotten EIDER being the big red herrings to have avoided catching today, or if your game played out in a different way than maybe WISER or WIPER.

Either way, it's not quite on a par with something like ROWER, which also has TOWER, POWER, LOWER, COWER and MOWER, plus a repeated letter (and which duly had an average of 5.6).

I managed a 4, the result of a fortunate first guess, SANER, which gave me the format (which is one of the reasons why I always start with it) followed by my go-to second guess in these scenarios, DIVOT, doing its thing and cutting 111 options to five.

These were easy to find at this stage: RIDER, EIDER, CIDER, HIDER, WIDER. I was not completely convinced by HIDER, so decided to look for a word that would rule out (or in) the other four. This was a very difficult task, because I couldn't think of a word that contained C and W and also started with R or E, which is what I needed here. I've since checked and there are none.

Then I had a brainwave and realized that another approach was to include two Es, which would have the effect of ruling out EIDER if one stayed gray. That allowed me to play RECCE (the 'Bot preferred RENEW, but it did the same job), which pointed the way to WIDER as the only possible solution. A fun challenge, as ER words always are.

Yesterday's Wordle hints (game #1941)

In a different time zone where it's still Monday? Don't worry — I can give you some clues for Wordle #1941, too.

• Wordle yesterday had vowels in two places*

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

• The first letter in yesterday's Wordle answer was Y.

Y is not a common starting letter at all. In fact, it's the third least common ahead of only Z and X!

• There were no repeated letters in yesterday's Wordle.

Repeated letters are quite common in the game, with 748 of the 2,309 Wordle answers containing one. However, it's still more likely that a Wordle doesn't have one.

• The last letter in yesterday's Wordle was L.

L is a really common letter to find at the end of a Wordle. There are 155 games that finish with an L, and it ranks as the fifth most likely letter there.

Still looking for more Wordle hints? Here's an extra one for game #1941.

• Yesterday's Wordle answer is a singing sound.

Yesterday's Wordle answer (game #1941)

• NYT average score: 4.2
• My score: 3
• WordleBot's score: 4
• My skill score: 92
• My luck score: 60
• My start word performance: SANER (167 remaining answers)
• WordleBot's start word performance: SLATE (98)
• Tomorrow's start word: SANER

Yesterday's Wordle answer (game #1941) was… YODEL.

Another day, another NYT addition to the Wordle word list. And another 3 for me but a 4 for the 'Bot — that's three wins in a row for me. In fact, I've only lost to it three times but have beaten it on four days in the past two weeks. Maybe I should swap jobs with it; I quite like the idea of my duties consisting of nothing more than making patronizing comments all day (my team would say I already do that, though).

YODEL is also another relatively tricky Wordle. It has an average of 4.2, placing it between yesterday's UNCAP (4.0) and Saturday's BUMPY (4.4) in the difficulty stakes.

The biggest complication is undoubtedly that Y at the start, because that's a really uncommon occurrence. In fact, Y is the letter with the biggest difference between its probability at the start and end of a word — it ranks second top at the end, but third bottom at the start, ahead of only Z and X.

As you might guess, there are no games in which X is the lead letter, while Z turns up there three times among the 2,309 original solutions. Y is the first letter in six games — although of course that's slightly skewed by the fact that today's is not one of the originals, so really it's at least seven.

Still, the important thing is that it's unusual, and that probably explains the high average.

Given the great luck I had with BUMPY and UNCAP over the weekend, the fact that I solved YODEL in 3 too might start raising suspicions. But once again, I got incredibly lucky.

SANER had not made good progress at all, giving me only a green E, which I duly left out of my second guess, CLOUT. CLOUT, meanwhile, turned up a yellow L and O, which meant there were 17 words that now fit.

I found only seven of those — YODEL, MODEL, DOWEL, HOVEL, YOKEL and GOLEM — although in my defense, eight of the others were ED words that I don't think will be real solutions; HOLEY, VOWEL and BOWEL probably are solutions, admittedly.

Among the words I had, YODEL was a great next choice, because it would guarantee me a 4 at worst — so I went with that expecting to maybe get a green Y for YOKEL or yellow D for DOWEL etc etc.

Instead, all five letters turned green for the third day in a row. And don't worry, I am well aware it will all come crashing down around me soon.

Wordle answers: The past 50

I've been playing Wordle every day for more than four years now and have tracked all of the previous answers so I can help you improve your game. Here are the last 50 solutions starting with yesterday's answer, or check out my past Wordle answers page for the full list.

• Wordle #1941, Monday 12 October: YODEL
• Wordle #1940, Sunday 11 October: UNCAP
• Wordle #1939, Saturday 10 October: BUMPY
• Wordle #1938, Friday 9 October: MAJOR
• Wordle #1937, Thursday 8 October: STREW
• Wordle #1936, Wednesday 7 October: PROVE
• Wordle #1935, Tuesday 6 October: DIMLY
• Wordle #1934, Monday 5 October: MOCHA
• Wordle #1933, Sunday 4 October: SHACK
• Wordle #1932, Saturday 3 October: PEEVE
• Wordle #1931, Friday 2 October: USURY
• Wordle #1930, Thursday 1 October: RITZY
• Wordle #1929, Wednesday 30 September: RIVER
• Wordle #1928, Tuesday 29 September: SCUBA
• Wordle #1927, Monday 28 September: TRUNK
• Wordle #1926, Sunday 27 September: SLOOP
• Wordle #1925, Saturday 26 September: ELEGY
• Wordle #1924, Friday 25 September: COPSE
• Wordle #1923, Thursday 24 September: MESSY
• Wordle #1922, Wednesday 23 September: FORTH
• Wordle #1921, Tuesday 22 September: STOKE
• Wordle #1920, Monday 21 September: PAGER
• Wordle #1919, Sunday 20 September: SHONE
• Wordle #1918, Saturday 19 September: WAKEN
• Wordle #1917, Friday 18 September: SNOWY
• Wordle #1916, Thursday 17 September: THETA
• Wordle #1915, Wednesday 16 September: WISPY
• Wordle #1914, Tuesday 15 September: DEALT
• Wordle #1913, Monday 14 September: RINSE
• Wordle #1912, Sunday 13 September: FOCUS
• Wordle #1911, Saturday 12 September: NIFTY
• Wordle #1910, Friday 11 September: ASTER
• Wordle #1909, Thursday 10 September: DRYLY
• Wordle #1908, Wednesday 9 September: BURST
• Wordle #1907, Tuesday 8 September: LIVEN
• Wordle #1906, Monday 7 September: BLIND
• Wordle #1905, Sunday 6 September: BEIGE
• Wordle #1904, Saturday 5 September: SOUPY
• Wordle #1903, Friday 4 September: WAGER
• Wordle #1902, Thursday 3 September: JOIST
• Wordle #1901, Wednesday 2 September: RULER
• Wordle #1900, Tuesday 1 September: REMIX
• Wordle #1899, Monday 31 August: MOUND
• Wordle #1898, Sunday 30 August: INTEL
• Wordle #1897, Saturday 29 August: BLOOD
• Wordle #1896, Friday 28 August: TWEEN
• Wordle #1895, Thursday 27 August: UNCUT
• Wordle #1894, Wednesday 26 August: CAPON
• Wordle #1893, Tuesday 25 August: CLICK
• Wordle #1892, Monday 24 August: RUNNY

What is Wordle?

If you're on this page then you almost certainly know what Wordle is already, and indeed have probably been playing it for a while. And even if you've not been playing it, you must surely have heard of it by now, because it's the viral word game phenomenon that took the world by storm in 2022 and is still going strong in 2026.

We've got a full guide to the game in our What is Wordle page, but if you just want a refresher then here are the basics.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1723) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1723) — hint #2 — repeated letters

Quordle today (game #1723) — hint #3 — uncommon letters

Quordle today (game #1723) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1723) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1723) — the answers

The answers to today's Quordle, game #1723, are…

• FLUFF
• DEBUT
• TEETH
• STEIN

I didn’t make any mistakes today, but this game still took me a long time to complete.

My difficulty was in finding a three-letter combination beginning with U from the letters I had left. Eventually I landed on the only possibility and a rare five-letter word containing three of the same letter — FLUFF.

Daily Sequence today (game #1723) — the answers

The answers to today's Quordle Daily Sequence, game #1723, are…

• TIDAL
• PAUSE
• SUING
• SHYLY

Quordle answers: The past 20

• Quordle #1722, Monday, 12 October: HELLO, BELOW, RIGHT, SLANT
• Quordle #1721, Sunday, 11 October: LILAC, INLET, TRIAD, SHAPE
• Quordle #1720, Saturday, 10 October: SWEAT, THIRD, RURAL, CLASP
• Quordle #1719, Friday, 9 October: OLDEN, DUNCE, SWATH, HILLY
• Quordle #1718, Thursday, 8 October: MINTY, ROWER, BROOD, RESET
• Quordle #1717, Wednesday, 7 October: PALER, FROTH, DOZEN, ERASE
• Quordle #1716, Tuesday, 6 October: FRESH, SKULK, BATCH, ENSUE
• Quordle #1715, Monday, 5 October: SIXTH, SPEAK, SEDAN, HEIST
• Quordle #1714, Sunday, 4 October: INFER, RAINY, THING, ARENA
• Quordle #1713, Saturday, 3 October: CHORE, FLYER, STICK, PURSE
• Quordle #1712, Friday, 2 October: IVORY, SADLY, ANGEL, LLAMA
• Quordle #1711, Thursday, 1 October: NAVEL, SHEER, BIRTH, TACKY
• Quordle #1710, Wednesday, 30 September: CHOKE, BATCH, MOSSY, EAGER
• Quordle #1709, Tuesday, 29 September: BILGE, MEDAL, LODGE, PORCH
• Quordle #1708, Monday, 28 September: BRUNT, TORSO, STONE, HEATH
• Quordle #1707, Sunday, 27 September: VALET, CHEST, VIGIL, PUREE
• Quordle #1706, Saturday, 26 September: SNORT, BIBLE, LAPSE, CRANE
• Quordle #1705, Friday, 25 September: SWEAR, FLOOD, GUPPY, GROAN
• Quordle #1704, Thursday, 24 September: TOPIC, METRO, SCALP, FREED
• Quordle #1703, Wednesday, 23 September: SHEET, BLAND, JOIST, GUAVA

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #954) - hint #1 - today's theme

NYT Strands today (game #954) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• SOME
• BREWS
• PART
• PATH
• FROM
• FROGS

NYT Strands today (game #954) - hint #3 - spangram letters

NYT Strands today (game #954) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #954) - the answers

The answers to today's Strands, game #954, are…

• EMBARRASS
• APPALL
• NONPLUS
• CHAGRIN
• MORTIFY
• SPANGRAM: CRINGEWORTHY

• My rating: Hard
• My score: Perfect

I’m classing this as tricky because despite getting by without hints it still took me longer than usual to complete the board.

After getting the spangram fairly quickly I was confident I’d roar through the board at speed, chuckling at memories of CRINGEWORTHY scenes from Something About Mary and Meet The Parents.

Alas, after getting EMBARRASS I struggled to think of any other synonyms for awkward; I thought NONPLUS meant you were indifferent. Ah well, every day’s a school day.

Yesterday's NYT Strands answers (Monday, October 12, game #953)

• PARLANCE
• JARGON
• VERNACULAR
• LINGO
• DIALECT
• SPANGRAM: TURNOFPHRASE

• Mozilla accused Microsoft of using Windows, Edge, Bing, and Copilot to steer users toward Edge
• Firefox maker claims stricter EU regulations force fairer browser choice than elsewhere
• Browser competition increasingly overlaps with the fight for AI distribution and user reach

Mozilla has accused Microsoft of abusing its dominant position wherever it can to push people towards Edge, and away from other browsers.

The company framed the story as if it wants “better for the people”, while Microsoft only does it when it’s forced to, but is that really the case?

In a newly released blog, Mozilla noted it has now been 100 days since it published Over The Edge 2.0, a report from “leading experts on deceptive design Dr. Harry Brignull and Cennydd Bowles on how Windows, Edge, Bing, and Copilot are designed to steer people away from the browser they choose.”

Better for the people

In the report, Mozilla said that in the European Economic Area (EEA), where the Digital Market Acts (DMA) is being enforced, Microsoft is forced to “play fair”.

Anywhere else around the world, including the US, UK, India, and other parts of the planet, it still uses its “shady tactics”. These include the Windows 10 message “You’re almost done setting up your PC” which allegedly uses “tricky wording” to pull people off the default they picked, Windows Search and Widgets opening links in Edge instead of the default browser, and Windows keeping Edge as the default for common browser file types like PDF and SVG, even after another browser were set up as the default.

Mozilla claims that even within the EU, Microsoft is doing all it can to steer people towards Edge. That includes pre-pinning the browser to the taskbar which, according to the company, “seems to directly violate the ‘principled approach to app pinning and app defaults’, Copilot opening web links in a side-panel instead of in the browser, and Windows Backup “silently” trying to set Edge as the default when it restores a PC and “fails to properly bring the user’s own browser along. “

“Most of the 2024 patterns are still there. The 2026 patterns are worse. Microsoft is using new surfaces like Copilot and the migration to Windows 11 to further undermine user choice,” Mozilla claims.

“We also shared the report with Microsoft and talked to them about the issues raised in the report. We knew that an immediate change was unlikely, but we hoped that, when faced with independent evidence of harmful design practices impacting Windows users, they would also want better for people,” Mozilla said.

“Instead, it became clear that Microsoft will respect user choice only when it is forced to. Microsoft’s standard for respecting people’s choices is legal compliance. Not what’s best for its users. Not its own published principles. Not what’s technically feasible. Not even what it already does for users in Europe.”

A story on AI

Mozilla said it shared the report with Microsoft but did not say if the company replied in any way. We’ve reached out to Microsoft with a request for comment and will update this article when we hear from them.

In the meantime, we believe it is also important to mention what Mozilla said in the blog’s introduction:

“As AI reshapes our online experiences, the stakes couldn’t be higher. Browsers are a key distribution layer for AI tools and services, while still determining many of the privacy and security functionality people rely on every day. Steering people toward one browser can therefore shape which AI services reach users and the protections that come with it.”

So the question becomes - is this really about wanting better for people, or wanting people to use one AI model instead of another AI model? If demanding equal browser opportunity is fair game, then demanding equal AI opportunity is also fair game, so why not just say so? Why hide behind alleged altruistic causes and principles?

In the blog, Mozilla says it has a “simple” ask - to expand the “fairer designs” currently being enforced in the EEA everywhere on the planet, and to “stop the remaining harmful design practices that persist in the EEA.”

The company concluded the blog by saying there will be no more mister Nice Guy. It says it “stepped up” public pressure on the company and has reached out to regulators and policy makers.

“We hope that regulators in the US, the UK, India, and Brazil are paying attention.”

• Budget Android phones shipped with firmware-level malware preinstalled before reaching customers
• Malware generated fraudulent ad revenue and turned infected devices into residential proxies
• Victims spanned 150 countries, with cleanup often requiring firmware-level remediation

Imagine buying a brand new, sealed Android phone, and later realizing it came with preinstalled malware rooted deeply into the firmware and thus almost impossible to remove - generating fraudulent ad clicks for a malicious third party, and even turning the phones into residential proxies to be used for whatever sinister purposes.

Security researchers Bitdefender found an unidentified threat actor managed to compromise the supply chain of multiple smartphone manufacturers and added malware on a firmware level before the devices were even shipped to stores.

A number of brands were mentioned, including Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X - both Chinese smartphone manufacturers building budget, rugged Android phones.

The reports also mention ripoff devices impersonating Samsung and Apple products. In general, these are devices using MediaTek chipsets, which were infected in a way that allowed the attackers to tamper with applications, grant themselves higher privileges, and even do remote code execution (RCE) attacks without the victim’s knowledge.

Victims across the world

Unfortunately, these devices were shipped all over the world, and Bitdefender claims “thousands” of people were victims, scattered across some 150 countries around the world, with the highest concentration found in Mexico, France, Italy, United States, Germany, Brazil, and Spain.

The malware comes in different shapes and sizes. So far, Bitdefender uncovered 32 malicious apps, including those pretending to be weather apps, file managers app lockers, OCR tools, and audio editors. All of these do the same thing - create an invisible overlay over different apps and register an ad being viewed, despite the fact that the user never actually saw it.

That way, whoever installed the malware scams the ad network into thinking the ad was served to thousands of users which, in turn, generates profit. We don’t know exactly how many devices are compromised this way, or how much money the crooks stole this way.

"The system app itself doesn’t register the fraudulent impressions and clicks," Bitdefender said. "The revenue engine is driven by the dropped cover apps, including real-looking weather, app-lock, note, and OCR apps, which load genuine ads through a legitimate ad SDK. The goal is simple: to load an invisible window on top of apps that registers ads being shown."

Spilling into the Play Store

Bitdefender also said that one of the uncovered applications (the app locker one), contained a TCP proxy element that registered the compromised phones with a remote command server. After successful registration, the attackers were able to forward traffic through the phone, essentially creating a residential proxy service that criminals can use for different things, from launching DDoS attacks to participating in spam and wire fraud.

They also found more than a dozen applications on the Google Play Store with the same fraudulent advertising code, as well as the same communications infrastructure. These, however, required manual installation and required users to grant them the requested permissions, which might have raised flags with the users.

Removing the malware isn’t as easy as simply uninstalling the app. The researchers said that many of the devices require cleanup on the firmware level, or disabling the malicious component using Android Debug Bridge (ADB), which could be too technical for many victims.

The easier and more elegant solution is also a more expensive one - don’t buy devices from brands with a shady reputation.

• Attackers abused Microsoft Power BI dashboards to lure victims into downloading ScreenConnect software
• Public dashboards mimicked blurred documents and redirected users to attacker-controlled sites
• Campaign established persistent remote access, potentially enabling ransomware, espionage, or data theft

Microsoft's Power BI has seemingly become the latest in an ever-growing line of legitimate software being abused in phishing attacks.

Security researchers Huntress said they uncovered a new campaign that leverages publicly accessible Power BI dashboards to trick people into downloading remote monitoring and management software (RMM) called ScreenConnect. The end game of the campaign is not known at this time.

Power BI

Power BI is Microsoft’s business intelligence and data visualization platform, allowing users to create charts, reports, and various dashboards, out of their data and other raw information. The tool itself can collect data from sources such as spreadsheets, databases, cloud services, and more, and users can publish reports and dashboards online, or share them with colleagues privately.

In this campaign, which started on or around September 10 2026, the threat actors created a public dashboard, likely using a throwaway Microsoft account (or a compromised one). Huntress does not confirm how that account was obtained, but says that the dashboard was designed to look like a blurred document with a button labeled “Download Reference”.

The blurred document trick is rather common in phishing emails. Other services such as DocuSign, Dropbox, and even Office 365, were being abused in the same way. To “unblur” (or unlock) the document, victims are told to click a link and follow along.

Sometimes they were asked to download a “premium” version of a document reader, or an “updated” one, and sometimes they were asked to log in using their Office or Google credentials. This attack is no different - clicking on the “Download Reference” button redirects the victim to an attacker-controlled website outside Microsoft’s infrastructure, where an automatic download of ScreenConnect is launched.

On its own, ScreenConnect is not malicious. It is a legitimate remote access and support tool developed by ConnectWise, and designed to help IT staff manage devices remotely. Through the product, users can connect other devices on the internet, troubleshoot problems, transfer files, and install software. Once installed and connected to an attacker-controlled endpoint, ScreenConnect can provide persistent remote access.

Establishing persistence

The researchers didn’t discuss how the emails were delivered, but since they contained a link to a legitimate Microsoft service, they most likely evaded at least some email filters and landed in people’s inboxes. After all, this is probably why Power BI was used in the first place (aside from the fact that it’s not commonly abused this way).

But what’s particularly interesting about this attack is that after deploying one ScreenConnect instance, the attackers deployed a second one and configured a scheduled task to repeatedly execute a PowerShell script. In at least one incident, they also deleted the first instance.

Why they did it remains a mystery. An educated guess would be that they were trying to establish reliable, persistent remote access, while at the same time making sure their activities were harder to detect and disrupt. If defenders were to discover and remove one malicious ScreenConnect installation, a second one might remain available.

This is all in the domain of speculation, unfortunately, since Huntress stopped the observed attack before it progressed beyond establishing remote access. Therefore, we don’t know if the goal was to steal data, deploy ransomware, or engage in financial fraud. What we do know is that with two ScreenConnects, they were able to establish a durable foothold inside corporate networks, which they could subsequently leverage for espionage, data theft, ransomware, or other financially motivated attacks.

As a general rule of thumb, the best way to defend against these types of attacks is to be highly skeptical of incoming emails, especially those with links to “locked” documents, and even more so those that end up with a ScreenConnect deployment.

• A PC maker in the US says 'retail GPU pricing is expected to climb significantly'
• A further rumor suggests AMD just put up the cost of VRAM, which will affect the prices of graphics cards
• Rounding off a trio of fresh rumors is a claim that Nvidia has discontinued the RTX 5090

There have been a few developments in the GPU world over the weekend — and none of them bode well for the prices of graphics cards down the line.

For starters, Wccftech reports that according to the Board Channels — a reliable enough forum for chatter from the supply chain over in China — AMD has increased the cost of the GDDR6 video RAM it sells to board-making partners. This means that those graphics card makers will inevitably pass that cost on to consumers — if this rumor is accurate of course.

Bench Life further observes that more expensive VRAM isn't the only upward pricing pressure here, and that the cost of other graphics card components — including the main circuit board itself — is also rising.

Secondly, as Wccftech also noticed, we have a custom PC maker in the US, StinceBuilt, informing us on X that it is "starting to see increasing supply constraints on graphics cards" and that, "Retail GPU pricing is expected to climb significantly, and these elevated prices could stick around for quite some time."

Finally, VideoCardz highlighted another post on X from regular leaker MegaSizeGPU, who claims Nvidia will not allocate any more GB202 (Blackwell) chips to make the RTX 5090, and that all this silicon is going to be used in RTX Pro (AI) graphics cards.

In theory, that means it's the end of the line for the flagship RTX 5090, with its replacement (the RTX 6090 in theory) still quite some way off in the distance (a more recent rumor indicates that it's probably due to land in 2028).

Analysis: a cacophony of warning bells

Of all those sentiments, the last one needs the most seasoning, although it's believable enough that Nvidia is essentially canning the RTX 5090. By that I mean that if this is true, I don't think this will be an official (announced) discontinuation, but the way it'll play out is that Nvidia will allocate so few chips for the GeForce flagship that stock will effectively dwindle to next to nothing.

Arguably we're already seeing some evidence of this, certainly in the US where at Newegg, for example, you can't buy an RTX 5090 directly from the retailer, but only from third-party sellers (often in Asia). And the cost of the graphics card is tipping up towards $9,000, such is its scarcity — and you'll pay from £6,000 upwards in the UK, although at least stock is available to buy directly from retailers in that country. Still, I wonder how long that will last; and the idea of Nvidia pulling the plug on the RTX 5090 in a stealthy behind-the-scenes manner certainly feels like it's possible.

Meanwhile, the suggestion of AMD's Radeon GPU price rises backs up similar recent rumors, and the warning from the PC maker in the US that price tags are set to 'climb significantly' is another ominous addition to the warning bells that have been sounded of late.

I'm still very much of the opinion that it's a good idea to buy sooner rather than later, even though GPUs are already overpriced, because I fear that the situation could get substantially worse in 2027, as the grapevine indicates.

The key question is how long a recovery from these pricing pressures might take in the case of GPUs. Again, I have a suspicion that it might take a lot longer than we might hope.

• IDC's latest figures show that PC shipments are down 20% year-on-year
• TrendForce predicts that next year is going to see further drops in PC sales and possible price hikes, which aligns with IDC's thinking
• If you're looking for a laptop, it might be a good idea to pull the trigger sooner rather than later – maybe during Black Friday

PC shipments have plunged dramatically, with analyst firms predicting that the sales of computers and laptops are set to slump next year as well.

PC Gamer noticed that IDC Research has a new report for Q3 of 2026 showing that global PC shipments are down 20.1% compared to the same quarter last year, dropping from 78.5 million units to 62.7 million.

The reason why is obvious: it's due to the RAM crisis and rising prices across a range of PC components (not just memory).

Another analyst firm, TrendForce, also produced a report (flagged by Wccftech) observing that the rising cost of those components threatens to weaken the demand for notebooks in 2027.

TrendForce claims that: "Global notebook shipments are currently projected to decline by a low-single-digit percentage in 2027."

However, the firm cautions that if RAM and CPU prices stay high (which seems almost inevitable), notebook makers "may be forced to pass more of these costs on to consumers", with high retail prices meaning fewer consumers buy new laptops – potentially pushing the drop in notebook sales to high single digits.

So, we could be looking at a near 10% drop in laptop sales next year, on top of an already gloomy picture and flagging sales for PCs as seen currently.

Analysis: act now or dig in for a lengthy wait

Both IDC and TrendForce observe that part of the problem for 2026 is that those looking at buying a new laptop purchased earlier in the year – due to the (very real) fear of price hikes coming in – meaning there are fewer sales now than there would normally have been. This is why there was a much sharper fall in Q3 compared to IDC's report for Q2 (although PC shipments were still down 3.8% year-on-year in that previous quarter).

Laptop makers are also running thin on components they purchased at lower prices (in anticipation of hikes, just like consumers), and so they are going to face worsening pressures on their profits margins due to rising RAM, storage and CPU costs. (TrendForce doesn't mention GPUs, but these will be a factor for some notebooks, notably gaming laptops, too). If they don't raise prices, laptop manufacturers will be forced to cut corners with specs.

TrendForce pulls out an interesting stat on the current state of play with the cost of building a laptop these days, namely that in a typical mid-to-upper-range ($900) notebook, 68% of the bill of materials (cost of the raw components) is taken up by the CPU, RAM and SSD. In other words, those core components now comprise two-thirds of the cost of the laptop.

IDC also predicts gloom for next year, or certainly the first half of 2027 anyway, noting that: "[PC] prices will remain elevated. With macro conditions worsening, the risk is that the outlook for the next few quarters gets worse before it gets better."

The only brighter spot here is that IDC says that with retailers worrying about "carrying too much inventory into a market where high prices are suppressing demand", we may see "promotions and some short-term relief for consumers" – meaning some possibly tempting Black Friday deals. Although the analyst firm makes it clear that pricing won't be "anywhere near what it was a year ago."

There will likely be some bargains to be had – we've seen some recently with Prime Day, and elsewhere for that matter – and if you are in the market for a laptop, it's looking like the smart move is to act on a decent deal if you see one for the type of notebook you're after.

Almost every prediction about the RAM crisis these days is negative, with a steadily growing weight of pessimistic sentiment, so unless a lot of analysts and industry pundits or insiders have got things very wrong, it's not a good idea to be waiting until next year to buy new hardware. Grab it now or hold out for the longer-term seems to be the right approach, certainly for laptops or PCs, and I'd say graphics cards, too.

• Vibe-coded clones of Word, Excel, and PowerPoint have appeared
• They're from the same developer who cloned the Adobe apps
• The developer says other open source software is 'broken'

The developer who used AI tools to clone the Adobe Creative Cloud suite and release the copied versions for free has now done the same with Microsoft Office.

As Tom's Hardware reports, there are now open-source versions of Word, Excel, and PowerPoint available, all looking very similar to the Microsoft apps and all with rebranded names: WordCraft, GridCraft, and DeckCraft, respectively.

These programs don't appear to be as far along in development as the Adobe clones, but the intention is there — and it's going to be a serious concern for large software companies wanting to protect their products.

The clones are the work of software engineer Brandon Thomas, who has been taking to social media to point out that he has years of experience in coding, even if he has been using the Anthropic AI Claude to do the bulk of the work on these recent projects.

'GIMP sucks'

There has also been criticism aimed at Thomas for choosing AI 'vibe coding' rather than supporting current open-source software like LibreOffice, GIMP, and Thunderbird. However, the developer doesn't seem to be a fan of these projects.

"GIMP sucks," says Thomas. "It has always sucked. There is no reason to save broken software." He's also recently related the story of a bad experience with LibreOffice that "killed a 40-page essay I wrote the week it was due, during finals".

The reaction on Reddit is split between those who see this as a "game-changing" positive for the software industry, and those who say "no job is safe" from the relentless march of AI and the increasingly powerful capabilities of these bots and agents.

Other commenters point out that free programs like LibreOffice and Google Docs have existed for years without damaging Microsoft Office sales too much, and question whether this lone developer will be able to keep up with bug fixes and upgrades.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1722) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1722) — hint #2 — repeated letters

Quordle today (game #1722) — hint #3 — uncommon letters

Quordle today (game #1722) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1722) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1722) — the answers

The answers to today's Quordle, game #1722, are…

• HELLO
• BELOW
• RIGHT
• SLANT

Everything fell into place for me today, with every word being the most expected.

In brief, exactly the sort of game I needed after losing my win stream on Saturday.

Thank you, Quordle gods.

Daily Sequence today (game #1722) — the answers

The answers to today's Quordle Daily Sequence, game #1722, are…

• OPERA
• TULLE
• FEVER
• DEMUR

Quordle answers: The past 20

• Quordle #1721, Sunday, 11 October: LILAC, INLET, TRIAD, SHAPE
• Quordle #1720, Saturday, 10 October: SWEAT, THIRD, RURAL, CLASP
• Quordle #1719, Friday, 9 October: OLDEN, DUNCE, SWATH, HILLY
• Quordle #1718, Thursday, 8 October: MINTY, ROWER, BROOD, RESET
• Quordle #1717, Wednesday, 7 October: PALER, FROTH, DOZEN, ERASE
• Quordle #1716, Tuesday, 6 October: FRESH, SKULK, BATCH, ENSUE
• Quordle #1715, Monday, 5 October: SIXTH, SPEAK, SEDAN, HEIST
• Quordle #1714, Sunday, 4 October: INFER, RAINY, THING, ARENA
• Quordle #1713, Saturday, 3 October: CHORE, FLYER, STICK, PURSE
• Quordle #1712, Friday, 2 October: IVORY, SADLY, ANGEL, LLAMA
• Quordle #1711, Thursday, 1 October: NAVEL, SHEER, BIRTH, TACKY
• Quordle #1710, Wednesday, 30 September: CHOKE, BATCH, MOSSY, EAGER
• Quordle #1709, Tuesday, 29 September: BILGE, MEDAL, LODGE, PORCH
• Quordle #1708, Monday, 28 September: BRUNT, TORSO, STONE, HEATH
• Quordle #1707, Sunday, 27 September: VALET, CHEST, VIGIL, PUREE
• Quordle #1706, Saturday, 26 September: SNORT, BIBLE, LAPSE, CRANE
• Quordle #1705, Friday, 25 September: SWEAR, FLOOD, GUPPY, GROAN
• Quordle #1704, Thursday, 24 September: TOPIC, METRO, SCALP, FREED
• Quordle #1703, Wednesday, 23 September: SHEET, BLAND, JOIST, GUAVA
• Quordle #1702, Tuesday, 22 September: COMFY, LOBBY, DRESS, PANEL

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #953) - hint #1 - today's theme

NYT Strands today (game #953) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• SLING
• RANGER
• FOUL
• GONE
• LONG
• RACON

NYT Strands today (game #953) - hint #3 - spangram letters

NYT Strands today (game #953) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #953) - the answers

The answers to today's Strands, game #953, are…

• PARLANCE
• JARGON
• VERNACULAR
• LINGO
• DIALECT
• SPANGRAM: TURNOFPHRASE

• My rating: Easy
• My score: Perfect

Another easy game where I got the Spangram second (there are no prizes or badges for that, unfortunately). Very annoying, although I did appreciate how TURNOFPHRASE took a turn across the board.

I was expecting to find the word “slang” on the board, but made do with the non-game word “sling”. Instead, we had the many different ways in which languages can be described.

Personally, I think DIALECT is fascinating, particularly how someone in the same country can ask for a cup of coffee in a hundred different ways depending on where they come from

Yesterday's NYT Strands answers (Sunday, October 11, game #952)

• PAGER
• ICEBOX
• INKWELL
• TYPEWRITER
• TELEGRAM
• SPANGRAM: OLDFASHIONED