Dell makes some of our favorite laptops, and the company's 15.6-inch touchscreen model offers a useful combination of performance, screen space, and connectivity.

For Black Friday, it's on sale for $650 (was $1000) at Best Buy. That's a 35% saving on a laptop with a 2K resolution touchscreen and Core i7 processor. And we'd definitely recommend it.

• Best for: Remote and hybrid workers who need a dependable Windows laptop for spreadsheets, video meetings, browser-based applications, and everyday office tasks.

• What we like: Dell's business laptop range has also proved reliable in our tests - for general work, it's well-specced. However, the real highlight is the lifted hinge that angles the keyboard slightly when opened. It's a small design detail, but one that could improve typing. The enlarged keyboard gives you more room to tap away, and the separate numeric keypad will be handy for anyone who regularly enters figures into spreadsheets or accounting software.

Why we recommend it

There's a lot we like about this business-oriented laptop. Under the hood, Intel's 10-core Core i7-1355U processor offers enough performance for everyday use. The processor can boost to 5GHz when additional performance is needed. Dell's ComfortView software helps reduce blue light emissions, which will make working long hours more comfortable.

Price context & historical value

The $350 reduction represents a massive 35% discount and at $649.99, you're getting a touchscreen Windows laptop with a capable processor and a reasonable amount of memory and storage for everyday business use. This is the cheapest we've seen this particular model on sale, and coming from Dell it's a great deal.

Should you buy it?

✅ Buy Dell's 15.6-inch touchscreen laptop if...

You want a well-equipped Dell laptop for home office duties, general productivity, and occasional travel. The combination of a large display and physical number pad makes it particularly suitable for administrative work.

❌ Skip Dell's 15.6-inch touchscreen laptop if...

You need a lightweight machine for frequent commuting, a brighter display for working outdoors, or dedicated graphics for demanding creative applications and modern games. A more portable laptop or one with a powerful GPU would be a better fit.

• Shop all Windows laptops at Best Buy

• Meta has announced the end of support for two of its popular VR headsets
• The devices affected are the Quest 2 and the Quest 2 Pro
• Support will be discontinued at the end of 2027

If you own a Meta Quest 2 or a Meta Quest Pro virtual reality headset, we’ve got some bad news: Meta has announced it is planning to wind down support for these devices next year, leaving large numbers of users without support for their VR products.

An announcement on the Meta blog aimed at developers details how things stand for creators of apps and services made for these headsets. With the two devices “reaching the end of feature development⁠,” big changes are on the way.

For one thing, new app submissions for these devices will be closed in December 2027. For another, version 2.13 of the Quest’s operating system (due out in March 2027) will be the last one to work with these headsets. Quarterly security patches and critical bug fixes will continue “through the end of 2027,” Meta said.

Still, Meta attempted to reassure developers of apps made for these VR headsets, stating that “People on Quest 2 and Quest Pro can still find, buy, download, and play your apps.” Cross-play with Quest 3 and Quest 3S headsets will continue, and developers can keep sending out updates to Quest 2 and Quest 2 Pro users.

And Meta’s app store for VR headsets will continue to be available to users of these soon-to-be-discontinued devices, with the firm saying that “people keep access to everything they’ve purchased, and no apps will be removed from the Store because of this change.”

Time to upgrade?

The Quest 2 launched in 2020, making it six years old at this point. Although we scored it highly in our review, it’s since been succeeded by the Quest 3, which is our pick for the best VR headset around. Evidently, Meta feels it’s now time to retire the Quest 2 and its Quest 2 Pro sibling, with the Quest Pro line having allegedly been phased out entirely in 2024.

Meta framed the change as one that’s paving the way for its upcoming VR Glasses. The company said that the Quest 3 and Quest 3S are “the baseline for Meta VR gamers” with its VR Glasses due to bring “another leap forward” for the industry. In that world, there’s apparently no more room for the Quest 2 and Quest 2 Pro.

Continuing app development for the Quest 2 and Quest 2 Pro might prove to be tricky, as Meta says it will not test new operating system and SDK releases on these products. Instead, it’ll be up to developers to ensure their apps function as intended.

Meta urged developers to assess how much of their audience is using Quest 2 and Quest 2 Pro devices and to consider splitting their releases to accommodate those on older headsets. If developers want to end support for these products, they should give users at least 180 days’ notice if customers could end up losing access to content or services as a result.

If you’ve got a Meta Quest 2 or Meta Quest 2 Pro at home, you’ll need to think about what you want to do going forward. While you should be able to continue using your headset, the lack of critical bug fixes after the end of 2027 could prove to be a problem. In that case, it might finally be time to upgrade to one of the best VR headsets to ensure you don’t miss out on anything.

• Synology warned of active ransomware attacks exploiting long-patched DSM vulnerabilities on unupdated NAS devices
• Attackers are reportedly deploying the C3rb3r encryptor and demanding thousands of dollars in ransom
• Users are urged to patch immediately, restrict internet exposure, and secure NAS access to prevent compromise

Synology, a major network-attached storage (NAS) manufacturer, is warning users about ongoing ransomware attacks targeting devices running outdated software. It urged all users to apply provided patches and secure their devices without delay.

In a brief announcement, Synology said it “identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM.” The goal of the attacks seem to be data encryption and a ransom demand.

“Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems. Synology also recommends enabling automatic updates to keep DSM up to date at all times.”

C3rb3r attacks

The announcement is rather stingy on the details. We don’t know which vulnerability the threat actors are exploiting, where exactly, or how successful they are.

We also don’t know how many devices are at risk - the Shadowserver Foundation tracks a total of 380,000 internet-connected endpoints (many of which are, most likely, running the latest software version and are thus protected).

The company also did not say who the threat actors are, but according to BleepingComputer, there has been a “massive wave of reports” from Synology customers whose data was apparently locked down by the “C3rb3r” encryptor. These customers were asked to pay “thousands of dollars” in ransom, in exchange for the decryption key. The publication says the first reports started surfacing more than two weeks ago.

There are two main ways for cybercriminals to access an electronic device and encrypt the data found there - either by exploiting a zero-day vulnerability (one that has not yet received a patch), or by exploiting years-old n-day vulnerabilities (ones that were patched months ago) on devices that were never updated and secured.

With Synology users, the latter seems to be the case. The company said the attackers were exploiting a vulnerability patched in December 2024, and linked to a November 2024 security advisory, in which it listed three fixed bugs: CVE-2024-10441 (arbitrary code execution), CVE-2024-50629 (arbitrary file read), and CVE-2024-10445 (a bug that allows writing files on compromised devices).

DSM 7.2.2 owners should upgrade to 7.2.2-72806-1 or above, DSM 7.2.1to 7.2.1-69057-6 or above, and DSM 7.2 to 7.2-64570-4 or above. DSM 7.1 should upgrade to 7.1.1-42962-7 or above, while those running DSM 6.2 to 6.2.4-25556-8 or above. Only in the last version - 6.2 - is the vulnerability labeled as “moderate”. In all other cases it was deemed “critical”.

Why are NAS devices being targeted?

NAS devices are dedicated storage systems that businesses can connect to their local network and allow employees to access, share, and manage files stored in a centralized location. They are rather popular among SMBs that lack the resources to maintain a more complex enterprise storage infrastructure.

Besides being used as a hybrid cloud of sorts, NAS is also used to store business documents and often acts as a centralized backup. The relative low cost, straightforward deployment, and easily expandable storage capacity makes NAS devices an attractive alternative to both dedicated file servers and cloud storage subscriptions.

However, this also makes them a valuable target for cybercriminals, as we’ve seen in this Synology case. The best way to defend against ransomware attackers is to either completely pull the NAS from the public internet or at least limit access to a handful of vetted identities. Keeping the devices updated with the latest firmware and software is also recommended.

It is worth mentioning that NAS devices usually come with RAID redundancy and built-in backup features, but these do not necessarily protect against ransomware encrypting the stored data.

• Security researcher combined audio analysis, flight data and a lot of number-crunching to identify audio locations
• Aircraft that are inaudible on the soundtrack can still reveal the recorder's location
• The technique is apparently accurate to within 100m

If, like me, you grew up watching corny FBI shows where computers could do the impossible through made-up technology with a single command of "enhance!", you're going to love the apparently impossible thing that YouTuber Colsto has just described in a new viral video.

Using a Doppler effect technique (more on that below), the location of a video or audio recording can be identified to within 100 meters through a combination of inaudible audio, flight data and math. This is no movie magic or scriptwriter invention: it's real and it's a little bit scary too.

I've embedded the video below and would really recommend watching it, because Colsto goes into great detail about how it's done, what it can't do and what precautions you might want to take if you don't want your background to betray you.

How your video background can betray you

As Colsto explains, the key is the 'Doppler effect'. That's the way sounds appear to change based on the distance between a moving source and the listener. You hear it all the time: it's what makes fire engine and ambulance sirens, car stereos and airplane propellers seem to change pitch as they go past.

What's clever here is that Colsto has focused on the sounds made by aircraft in the backgrounds of videos. In many parts of the world the skies are very busy, and a faraway airplane that's inaudible to you or other listeners might still leave a sonic footprint on your video or audio that can be isolated and analyzed. That's definitely the case in the US data Colsto used.

Once you've got the audio, the aircraft sound can then be matched with publicly available flight data and Doppler curve measurements. By triangulating the sound from multiple aircraft, you can then identify where the audio was recorded. This is enormously clever.

Colsto explains the detail in the video — what aircraft data was used, how it was analyzed, how the Doppler measurements were filtered and what corrections were made — but isn't posting any software or other tools to actually do it for you. Instead, you'll get an assessment of preventive measurements including why normal signal processing such as high-pass filters or noise reduction can be ineffective.

How scary is this?

Colsto was keen to point out that the video is designed to be educational about open-source intelligence (OSINT) techniques, rather than an attempt to fear-monger.

"The odds that someone can and does actually do this is pretty slim. In reality, there's probably a hundred easier ways to find you than this," he says.

However, these are some potential use cases. "The audio we used is just from some random security camera, but it could have just as well been footage from a investigation or a video online. Something with literally zero visual clues could be located using this," he added.

So despite the somewhat niche application, there's something deeply scary about this kind of thing, I think, and from similar revelations such as Wi-Fi routers that can be used to locate you indoors and Wi-Fi signals that can help track your movements, even if you're not carrying a phone that connects to them.

And I know that fear is probably a bit silly when everywhere I go I carry a phone, use a tablet or drive a car that's leaking identifiable information to God-knows-who. But I can't help asking the question: if the possibilities we know about are this scary, what on Earth is the tech we don't know about capable of?

Thinking of buying a new TV?

Try our TV size and model finder! You tell it how far you sit from your TV, we'll tell you what size to buy based on viewing angle advice from image quality experts, and we'll recommend our three top TVs at that size for different prices.

• Cybercriminals are stealing AI API keys and cloud credentials to hijack expensive LLM services and infrastructure
• Stolen access is used to run AI workloads, create proxy services, and rack up massive bills for victims
• Google warns “LLMjacking” is evolving into a specialized cybercrime ecosystem with dedicated monetization operators

Threat actors are using large language models (LLM) to support almost every stage of a cyberattack, from researching potential victims to developing malware and automating various attacks. However, using AI is not cheap, and for those eager to use frontier models, costs can stack up relatively quickly.

But cybercriminals are used to stealing things, so why not steal someone else’s tokens, too?

A new report from Google’s Threat Intelligence Group (GTIG) says that different hacking groups are doing exactly that and that the practice - known as LLMjacking - has been steadily growing more popular over the last couple of years.

Most groups start by focusing either on publicly exposed LLM endpoints, or on obtaining valid LLM application programming interface (API) keys. In many cases, the crooks would use exposed or stolen cloud identity tokens (IAM credentials, Service Account keys, GitHub Personal Access Tokens, and active session tokens) to establish an initial foothold into the target organizations’ infrastructure.

From there, they would “systematically work” to escalate privileges, solidify their access, and identify targets for further compromise.

LLMjacking

The endgame is LLMjacking, which GTIG describes as “the monetization and resource-hijacking of foundation models, which actors achieve through token proxying, automated model streaming, and GPU hardware provisioning.” In other words, someone else is using your AI subscription while you get the bill.

The bills can cause quite the headache, too. With cryptojacking, for example, token mining is relatively slow and steady, and a certain amount of time needs to pass for the charges to really stack up. With LLMjacking, however, costs can go into six digits in six minutes.

“Upon acquiring LLM API access keys, UNC6993 attempted to generate additional API keys and enable associated services within victim cloud projects, quickly accumulating over $100,000 in billing charges,” Google says in the report.

“Another threat actor subscribed victim accounts to Pay-As-You-Go agreements, selecting premium foundation models and launching high-volume inference streams. To bypass rate limits, the threat actor deployed a "burn and rotate" strategy, continuously creating and deleting short-lived service accounts while auditing the cloud provider’s billing interface to monitor financial impact.”

In some cases, threat actors also used the acquired access to host their own proxy endpoints and agentic workloads. Google says that one threat actor enabled agents, deployed publicly accessible reverse proxies, and used custom Node.js proxy bundles to expose endpoints compatible with multiple frontier LLMs rebranded under a persona known as D1337-KAIROS.

This actor deployed a containerized backdoor which queried an upstream LLM to reason through instructions and execute commands locally.

A growing ecosystem

The LLMjacking ecosystem is young, but growing fast and maturing even faster. Google says that there is already a division of labor between hacking groups that establish initial access to compromised environments, and operators who manage downstream monetization infrastructure. The latter are called “LLM Mixers” and they operate as a routing gateway that proxies, aggregates, and resells unauthorized LLM access to underground subscribers.

“In one investigation, GTIG observed two distinct operational clusters coordinating to compromise and monetize enterprise LLM infrastructure, demonstrating the sophisticated specialization emerging in this space,” Google said.

By using open source API gateways and custom relay infrastructure, the attackers were able to pool stolen credentials, meter usage, and hide where the requests really originated from.

Google is now sounding the alarm, saying it expects threat actors to “increasingly prioritize” LLMjacking at the expense of other resource theft practices. It urges organizations to increase their visibility of LLM platforms, prioritize detection of modifications to LLM accounts and services, and treat any unauthorized enablement as a critical security event. It also advised organizations to enforce the principle of least privilege and make sure accounts and users only have permissions they absolutely need to get the job done.

Buying a printer is one thing, but keeping it supplied with ink can quickly become massively expensive, especially if you regularly print documents, homework, or photographs. Epson's EcoTank ET-2980 is one of our favorite cheap ink tank printers, saving a fortune on replacement ink cartridges.

Now, the value-led cartridge-free printer sees a price cut down to $285 (was $330) at Amazon, while in the UK, it's listed under the name EcoTank ET-2950, down to £230 (was £280). It's the same model, though. And the price delivers an even better deal on the machine we called "a bargain of this bottle-fed printer."

• Best for: Households, students, and home office workers who print a lot and want to keep ongoing ink costs down without loss of everyday printing, scanning, and copying capabilities.

• Why it matters: You get refillable ink tanks with up to three years of ink included. There’s also Wi-Fi, Wi-Fi Direct, a 100-sheet paper tray, automatic double-sided printing, and borderless photo printing.

Why we recommend it

The biggest attraction of the EcoTank ET-2980 is Epson's approach to running costs. The included ink can produce up to 6,600 black pages or 5,500 color pages, and each replacement bottle set is equivalent to approximately 90 individual ink cartridges.

Refilling is straightforward, thanks to Epson's EcoFit bottles, which have keyed nozzles designed to help prevent you from putting the wrong color into a tank.

In his four-star review, our expert Jim said it: "printed reliably on everything from envelopes to thick 300g/m² cardstock. It’s not a fast printer, but automatic duplexing is a welcome convenience. Pigment black ink produces crisp, smudge-resistant text, while dye-based colors look bright and punchy. Photographs are slightly soft and oversaturated towards red, but perfectly acceptable for occasional use."

He added that: "The biggest attraction is the ink economy. Epson is putting plenty of ink in the box and replacement bottles are cheap. I think its low running costs, reliable performance and essential duplexing feature make it excellent long-term value."

For more top performing units, see our guides to the best home printers and best ink tank printers.

Price context & historical value

Amazon's current $285 asking price is $44.99 below how much it usually sells for. That's not the cheapest we've seen it sell for in the past though. It was as low as $229.99 earlier in the year, and it's possible it will be reduced more the closer to Black Friday we get.

The British equivalent model, the EcoTank ET-2950, is usually priced at £279.99 and is currently down to £229.99.

If you want to save on other units, see our guide to the best printer deals we've seen this week.

Should you buy it?

✅ Buy the Epson EcoTank ET-2980 if...

You regularly print documents, school assignments, or photographs and want to reduce your reliance on ink cartridges. The ET-2980 also offers automatic double-sided printing, which can help cut paper consumption.

❌ Skip the Epson EcoTank ET-2980 if...

You only print occasionally or need a dedicated business printer with advanced document-handling features. A cheaper cartridge-based model may be more economical for light use.

• See all ink tank printers at Amazon

Apple's Mac mini is a fantastic option if you want a powerful Mac without losing much desk space. We love the older M4 model, and wondered during tests whether it might be the best Mac for most people (it's certainly one of the best mini PCs we've ever reviewed).

Now, ahead of Black Friday, the new Apple Mac mini M6 is down to $779 (was $899) at Amazon, while UK readers can grab it for £824 (was £899). The latest 2026 model takes that familiar five-inch design and upgrades it with the M6 chip, making it even more powerful.

• Best for: Anyone wanting a compact but capable Mac for everyday productivity, multitasking, programming, photo editing, or creative work without paying for a more expensive Mac Studio.

• What we like: This is the latest upgrade of one of our favorite desktop computers. One of the Mac mini's biggest advantages is that it packs plenty of processing power in a package that measures just 5 x 5 inches and stands a mere 2 inches tall.

• What you need to know: The older and more affordable M4 Mac mini is still a worthwhile investment for general work and light creative tasks, though it lacks the power of the new model.

Today's best Apple Mac mini (M6) deal

Why we recommend it

The M6 chip is designed to handle everything from routine office applications to more demanding creative tasks. Its hardware-accelerated media engine supports H.264, HEVC, ProRes, and ProRes RAW, which is particularly useful for video editing and playback.

The M6 features Neural Accelerators in its GPU cores and a dual 16-core Neural Engine, designed to speed up supported machine-learning applications without relying entirely on cloud processing.

We haven't reviewed the M6 version of the Mac mini yet, but we're seriously impressed with what it offers.

For more picks, we've rounded up the best mini PCs we've tested.

Price context & historical value

At $779, the Mac mini M6 is $120 cheaper than its usual $899 asking price, a hefty 13.3% reduction.

The same configuration has previously sold for $769, although the current offer is just $10 higher, and definitely worth considering.

Should you buy it?

✅ Buy the Mac mini M6 if...

You want a modern Mac desktop with enough performance for demanding everyday applications, creative projects, and multitasking. It's also a sensible option if you already own a suitable monitor, keyboard, and mouse.

❌ Skip the Mac mini M6 if...

You already have a recent Apple silicon Mac mini, like the M4 version, that handles everything you need. The M6's improvements may not justify replacing a perfectly capable machine, particularly if your work doesn't benefit from the newer processor.

• John Ternus has warned that: "What we're seeing with memory pricing right now is unprecedented."
• The Apple CEO cautioned that RAM costs are going to climb higher in this final quarter of 2026
• It sounds even bleaker than Apple's previous statements on the RAM crisis, and follows many other warnings that 2027 is set to be a miserable year price-wise

Apple is warning of an 'unprecedented' rise in the cost of RAM, adding to the cacophony of alarm bells that have been ringing about the price of memory chips (and other PC components besides) recently.

The Guardian reports that in a conference call following Apple's fiscal Q3 results — which were better than analysts expected, driven by the iPhone, Mac mini and sales in China — Apple's new CEO John Ternus touched on the subject of the RAM crisis.

Ternus, who recently took the reins from Tim Cook, cautioned bleakly that: "What we're seeing with memory pricing right now is unprecedented."

He then observed that memory costs would climb even higher in the final quarter of 2026 compared to the rest of the year, during which, as you've doubtless seen, we've already witnessed a steep climb in pricing.

Despite its financial results outperforming analyst forecasts, Apple informed investors that these higher memory costs are going to erode some of its profit margins, which meant the company's stock dropped.

Apple raised the prices of Macs earlier this year, as well as iPads and more recently iPhones, and Ternus acknowledged that this had "provided some offset" for Apple in terms of the ongoing cost crisis around components.

Analysis: Ternus takes a turn for the sterner

It's an ominous utterance from Ternus, and sounds more severe than the warning Apple issued back before the Mac (and other) price hikes happened in June 2026. Back then, when Cook was still chief executive, he warned about "significantly higher memory costs" that would "drive an increasing impact" on Apple's products, which, as noted, came to pass.

Now we're hearing the word "unprecedented", which sounds a lot more concerning than "significant"; although in fairness, this is referencing what's already happened this year as much as what's to come. But we're clearly being primed for more price-hike misery by Ternus here, and it's difficult to see how this won't have a further impact on Macs, iPhones and iPads, if not in this quarter, then in 2027.

We don't, of course, know to what extent profits might be eroded by more expensive memory chips, or how this might be balanced by consumers having to foot that bill. Only time will tell on that score.

Mac mini sales were mentioned in the report — which quoted Ben Barringer, the head of technology research at investment management firm Quilter Cheviot — as being responsible for part of Apple's boosted earnings for the most recent quarter, and that's down to the increasing demand for local AI.

The Mac Studio is major part of that picture, too, and this particular PC just popped up as an example of how ridiculous RAM pricing has just become at the very top end of the Apple product tree. If you want a Mac Studio with 512GB of RAM, you'll now pay more than double the cost of a Mac Studio that has 256GB of memory, meaning that it's cheaper to buy two of the latter computers (while getting two CPUs/GPUs in the process).

It's a bizarre situation, but this is what we've arrived at with memory upgrades, which were always seriously pricey with Apple, even before the RAM crisis kicked off (that goes for storage, too).

And this situation is only going to get worse, seemingly, according to Ternus, which is also, of course, the view of the wider industry and various analysts. I can't begin to count the warnings we've had in the past couple of months about the RAM crisis becoming even more dire, so at this point it's just a question of how much worse things might get.

I fear that some categories of tech and PC components are going to become increasingly unaffordable next year, and I recently wrote about why Black Friday could be a good time to move on certain purchases.

• Reddit wants to overturn Australia’s social media ban for under-16s
• It is challenging the law in the Australian High Court
• Government says it’s defending the law from "sustained ideological attack"

In late 2025, Australia became the first nation in the world to ban social media for under-16s — and as you would expect, that hasn’t gone down particularly well with the app makers affected. Reddit, for example, has issued a stinging rebuke to the Australian government and is in the process of challenging the ban in court.

A lawyer representing Reddit called the ban “ill thought out” (via Reuters) and said it was a “profound ‌restriction on political debate.” The attorney was speaking at the Australian High Court, where Reddit is seeking to contest the country’s new law.

Together with a libertarian advocacy group, Reddit claimed in court that the social media ban was “a very substantial restriction on what young people can now do” and that it could stifle political debate. It added that the restrictions may stop users creating content and responding to posts.

Although Reddit said it supported the aims of the law, it branded the legislation “inept,” saying that it did not have any specific means to keep minors off social media and failed to regulate other platforms where cyberbullying might take place, such as on gaming websites. And the fact that users who were not logged in could still view huge amounts of material undermined the law, Reddit argued.

Could Reddit overturn the ban?

Since the Australian law came into effect, several studies have shown that large numbers of teenage users targeted by it are still able to access restricted material. Sometimes, that might be as simple as using a VPN service to disguise your location, while at other times, social media firms are simply not taking action to restrict usage by under-16s.

Despite Reddit’s criticism, the Australian government has said it will defend its legislation. In court, the state’s lawyer, Joanna Davidson, said that children were more vulnerable to harmful online content because their brains were not fully developed compared to those of adults.

And speaking outside the High Court, communications ⁠minister Anika Wells ​said: “We ​are here to defend a fundamental tenet of Australian democracy, which is an Australian’s right, and particularly an Australian child’s right, to be free from harm. We seek ​to defend that from sustained ideological attack.”

The government has doubled the maximum fine for non-compliance with the law to AU$99 million (about $69.5 million / £51.5 million), increased the discovery powers of the eSafety Commissioner, and said it is preparing enforcement action against some of the largest social media platforms operating in Australia.

Whatever side you take on this matter, it’s clear that neither the Australian government nor Reddit are preparing to back down anytime soon. And with other nations considering similar laws, many people around the world will be watching closely.

• Google leads efforts to dismantle 1.3 million device residential proxy botnet built through malware preinstalled on Android hardware
• Researchers say manufacturer Videostrong intentionally shipped malware and sold botnet access to cybercriminals
• Google seized infrastructure, blocked the company from Android certification, and strengthened device security checks

Google has revealed its role in taking down a massive residential proxy network and the malware that built it - with the unusual twist that the developer was a seemingly legitimate business with multiple products and countless trusting customers.

In a blog post, the company said that together with its partners, it dismantled a backdoor called XCPE. This malware was apparently used for ad fraud, served as a dropper for additional malware, and used for assimilating devices into an illegal residential proxy network.

In total, more than 1.3 million set-top boxes alone were part of the network, the company said.

No supply chain attack

Malicious residential proxy networks are nothing new - they emerge and get dismantled on a regular basis. But this one was unique, as it came preloaded on Android devices built and sold by a certified Android Original Equipment Manufacturer (OEM) and Original Design Manufacturer (ODM). In other words, people were thinking they were buying a legitimate product from a legitimate, Google-vetted company, but were instead getting malware-laden hardware that abused their trust and sold their bandwidth to cybercriminals.

In this case, not only did the company know what it was doing, but it was actively developing the malware and even worked on hiding it from Google and everyone else.

“A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users,” Google said, not hiding its disappointment with the manufacturer.

Videostrong ended up selling two things: On the surface, it was selling Android-powered smartphones and similar devices that contained malware that built a botnet. Under the table, it was selling access to that botnet to cybercriminals.

Google was joined by a number of other companies and agencies in this operation, including Japan’s National Police Agency, Lumen, HUMAN Security, Plume, Synthient, and TrendAI.

Threat actors are always in need of residential proxy botnets. They can use them to launch powerful Distributed Denial of Service (DDoS) attacks, hide their addresses as they operate, conduct large-scale credential stuffing campaigns, bypass geographical restrictions, scrape websites at scale, and more. We don’t know how much Videostrong made from selling access to the botnet, or who used it.

Taking down the C2 domains

To disrupt both the malware and the network, Google took down the domains and servers the company used to control the botnet and install malware modules, took down C2 domains that were used by over a dozen malware families loaded as modules via the XCPE backdoor, and banned Videostrong and all future subsidiaries and affiliates from building and selling Android devices in the future, or supplying software to other certified vendors.

Google also said it had improved its firmware integrity checks for certified Android TV devices to prevent similar incidents involving other manufacturers.

“Google requires OEMs go through a comprehensive suite of compatibility and security tests to ensure a consistent and safe user experience across the Android ecosystem,” it stressed. “However, Videostrong employed obfuscation techniques to exploit a gap in our tests and load malicious code after the device's first boot. As a result, Google has implemented changes to its existing review process to better safeguard against similar activity in the future.”

This is not the first time an electronic device came with malware off the shelf. Last month, security researchers Bitdefender found Android phones from multiple manufacturers, including Doogee and Cubot (both Chinese firms) being sold with preloaded malware. However, in those cases, the supply chain was compromised and the malware was included without the OEM’s knowledge, or consent.

• A zero-click Android flaw let attackers crash phones with a specially crafted SMS message
• Repeated messages could trigger reboot loops, disrupt calls, and even affect emergency connectivity
• Google patched supported Android versions, but many end-of-life devices remain permanently vulnerable

Picture this: You’re talking on your Android phone when all of a sudden you just lose mobile connectivity and your phone call drops. No explanation, no notification. Soon after, it happens again. And again. At one point, the device goes into recovery mode, rebooting every minute and a half until you finally perform a factory reset.

This is not a theoretical scenario - it is a real possibility, thanks to a critical-severity vulnerability in Android tracked as CVE-2026-58882.

Google has patched the issue for newer versions of Android, but those who are past their end-of-life date will remain at risk.

Sending an evil message

The bug was discovered by security researcher Mark Blah and described as a zero-click denial of service (DoS) vulnerability. In more technical terms, it is an “improper validation of a header-length value” bug in Android’s WapPushOverSms.decodeWapPdu function. It was nicknamed “SMS of Death” because it can be exploited with nothing more than an SMS message, which the victims doesn’t even have to open (hence the ‘zero-click’ part).

As Blah discovered, a threat actor could send a malformed eight-byte WAP Push message to an Android device’s port 2948: 01 06 88 80 80 80 00 BE.

Since this is a hex message, when it gets translated into a signed 32-bit integer, it becomes -2147483648. Android can then try to allocate memory using this negative value, triggering a NegativeArraySizeException error that crashes the com.android.phone process. Since this process manages cellular functions, the call is dropped and mobile connectivity is disrupted. Even emergency services are susceptible, it was said.

It gets worse. Android processes messages before they reach the inbox, meaning the victim will not be notified of the SMS and won’t even know it’s the text message that’s crashing the system. Also, some carriers will attempt to redeliver messages that never reached the inbox, extending the agony. Android also does its part by constantly trying to process messages already stored on the phone.

Finally, Blah found that if a malicious actor sends 20 or more messages, they can force the device into a reboot loop. On an Android 12 device, they can force looped recovery mode, leaving factory reset as the only viable option.

Patching the SMS of Death

Initially, all Android versions were affected, it was said. Google patched it for versions 14 through 17, but older devices will not be getting a patch and thus will remain at risk indefinitely. The fix is called “Fix remote DoS in decodeWapPdu”, and apparently it prevents the crashes by catching exceptions triggered when Android processes malformed text messages. It also deletes these messages from the SMS database so that they don’t trigger repeat crashes.

Blah has released a proof-of-concept (PoC), showing the wider community exactly how to exploit the flaw, and BleepingComputer reported that a GitHub contributor found a way to remove the malicious message, but it requires more technical knowledge, which is something the majority of mobile phone users probably won’t have. Still, those interested in tinkering should know that it can be removed via a computer, using Android Debug Bridge (ADB).

Google apparently patched the bug in its October 2026 Android security updates, but that doesn’t automatically mean all Android users are safe. Unlike Apple’s ecosystem, Android is diversified, and different manufacturers have different update cadences.

Therefore, while we can assume Pixel users have likely already received this update, Samsung users, as well as those using Xiaomi, Motorola, or OnePlus devices, will probably have to wait a little longer until their manufacturers apply the fix to their devices and push the update.

Still, since the PoC has been released, it’s safe to assume most Android manufacturers have already pushed their updates. Users are advised to install them as soon as possible.

• New malware uses AI to analyze stolen data, rank victims, and identify the most profitable targets
• VOLTA-AUTODOXER steals credentials, crypto wallets, tokens, and personal information before generating AI dossiers
• Researchers warn the malware could commoditize AI-powered victim profiling for ransomware and cybercrime operators

Stealing sensitive data from a lot of people is one thing, but determining whether or not that data is worth anything to anyone - that’s an entirely different ball game.

Now, it seems cybercriminals found a way to easily profile their victims’ information and they’re using - you guessed it - Artificial Intelligence (AI).

Cybersecurity researchers Cisco Talos uncovered a new malware strain through Cognitive Artificial Intelligence Research Network (CAIRN) - an open source cybersecurity research kit built to identify and track AI-powered malware.

The strain is called VOLTA-AUTODOXER and its operation is split into four key steps: 1) steal as much information as possible; 2) share it with an AI for assessment; 3) exfiltrate the data to attacker-controlled infrastructure; and 4) remove yourself from the victim’s system.

Analyzing the data

Cisco Talos did not say where exactly the malware was found, how many devices it infected, or how it is being disseminated. It said that, on surface level, it looks just like any other infostealer. It grabs browser passwords, cookies, payment cards, cryptocurrency wallet seed phrases, Discord, Telegram, Steam, and Roblox sessions, Microsoft OAuth tokens, SSH and cloud-provider keys, Wi-Fi profiles, and screenshots.

But this is where it splits from the industry standard, by building a structured evidence bundle about the person behind the system.

It pulls the device’s geographical location, home address, employer and employer domain, inferred birth year, the last 4 digits of their credit cards, Slack workspaces, document authorship metadata, iPhone backup indicators, and even a live Roblox account valuation. Then it moves to Gmail, looking for mails from UberEats and DoorDash in order to confirm the home address.

VOLTA then bundles and serializes the bundle, before POSTing it to OpenRouter, an AI infrastructure platform where users can access hundreds of LLMs through a single API.

There, the AI gives a model a prompt to behave as a “forensic intelligence analyst drafting a target assessment”. In other words, the AI is tasked with assessing whether or not the data pulled is worth any trouble, and if so - how much. Victims are ranked by value, giving the attackers more time to do what seems to be the end goal here - ransomware.

The default model is Claude, but if it refuses to comply for any reason, the malware is instructed to fall back to Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash. If neither of the models end up working, the malware will just send raw data back to the attacker. This is usually done via a Telegram channel.

Running away

After the work has been completed, VOLTA is instructed to delete itself from the system, likely to cover its tracks. A separate file, named volta_debug.txt apparently remains on the system, showing what was collected and whether or not the AI-powered assessment was a success.

The researchers believe VOLTA is designed to be sold on the black market. Elements such as the Telegram channel, or API keys, are not hardcoded, and the malware comes as a template with six swappable slots that are filed in at build time.

“This suggests it’s a builder model: The author sells access, the customer provides their values, and the builder compiles a custom binary for each order,” Cisco Talos explains. “If VOLTA is indeed a commoditized malware, then the AI dossier capability isn't something the author invented for their own operations. It is a feature which enables a customer of any level of sophistication to point it at victims and start receiving ranked target assessments in their Telegram inbox.”

If you suspect an infection, revoke or rotate all API keys and tokens, and change all of your passwords. Also, double-check your crypto wallets and move all funds to a new wallet with a fresh seed.

• The FBI formally attributes $6.7 billion Binance cryptocurrency theft to North Korea’s TraderTraitor group
• Investigators say the attackers are laundering stolen assets across multiple blockchains and DeFi services
• The breach highlights ongoing threats from Lazarus-linked campaigns targeting crypto, DevOps, and software professionals

The FBI has publicly accused a North Korean state-sponsored threat actor of being behind the recent attack on cryptocurrency exchange Binance.

One of the largest cryptocurrency exchange platforms on the planet was forced to freeze deposits and withdrawals, before confirming a threat actor stole around $6.7 billion worth of different cryptocurrencies.

Analysts were quick to investigate, with some claiming a known North Korean state-sponsored group called TraderTraitor was behind the heist. TraderTraitor is apparently part of Lazarus Group - a huge cybercriminal operation on North Korea’s payroll, allegedly tasked with stealing money to fund the country’s state apparatus and weapons program.

TraderTraitor

Now, the FBI has issued a new statement, official naming TraderTraitor as the attackers.

“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as ‘TraderTraitor’.,” the announcement reads.

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”

Binance said one of its DevOps engineers had their laptop compromised which “gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.” Some speculated the engineer fell to a classic fake job scam, while others argued it was a romance scam.

In the meantime, Binance resumed operations and has covered most of its losses.

Initial reports found that the attackers siphoned out money from 10 different chains, including Bitcoin, Ethereum, Solana, XRP, Arbitrum, and others. For Ethereum, they even set up a smart contract that automatically withdrew any new money that was flowing into the account. The silver lining in the attack is that these were not user funds, but rather those of the exchange itself.

Cryptocurrency exchanges are obliged to have two separate wallets - one for their own funds, and one for those of their customers. Binance has a security fund called SAFU (Secure Asset Fund for Users), designed to protect user assets during extreme platform-level incidents, such as this one.

Operations DreamJob and Contagious Interview

Obviously, North Korea has not commented on these allegations, but the cybersecurity community has logn warned about Lazarus Group targeting organizations in the West, sometimes tasked with stealing money, and sometimes with cyber-espionage and eavesdropping.

The group is split into numerous sub-groups, one of them being TraderTraitor, and among other things, the group runs two major scam campaigns: Operation DreamJob, and Contagious Interview. Both are aimed at software developers, blockchain programmers, and DevOps professionals, and the wider software development industry.

As part of these scams, the attackers would create fake companies, fake employees, and fake job offers. They would reach out to their targets on LinkedIn and offer lucrative job positions, only to infect their computers with malware during the interviews. In some cases, they would apply for open positions, impersonating Chinese, Vietnamese, or Thai nationals and would, when they get the job, use the position to steal sensitive data and money.

North Korea is under heavy sanctions from the US, and the country does not allow its companies to hire, or do business with, individuals and organizations in North Korea.

The FBI shared a long list of wallets it believes contain the stolen funds, and has asked THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from these addresses.

• 'Heartwood' is a wood-based gaming PC that took seven years to build
• It's stunningly neat, and the hidden trick is that it routes the cooling and other cables outside the PC
• Those pipes and cables run underneath the desk, which the PC is effectively built into, and down into the basement below, where the full cooling system resides

Fancy custom PC builds come along with some regularity, but every now and then something really unusual presents itself — and I'd class this as the smartest and neatest desktop computer I've ever seen.

Wccftech spotted the rig in question, which was posted in the PC build subreddit by Mithiral67. The gaming PC is called 'Heartwood', and it took a rather incredible seven years to build.

It's based on an Inwin 909 case (which looks impressive in itself in brushed aluminum) using a semi-open concept, with the motherboard sitting in an empty space (there's no rear panel with the build here, as you can see in the YouTube video below that shows off this PC).

This desktop looks incredibly neat and slick decked out in wood and aluminum, with the nifty lighting in the top of the case too, but where's the cooling and other cabling? That's when the full extent of this build becomes clear, because it also includes the desk underneath the PC.

What the maker has done is route the liquid cooling and power cables down through the bottom of the case and the desk, with these running around the underside of the desk, and then down a leg into the floor, to the basement of the house, where all the water-cooling gubbins (built around a Mora 400) resides.

Not only was this build a time-consuming labor of love, it was also a very costly one. Another Redditor enquires about the price of the materials, and according to Mithiral67 the wood itself was around $4,000 – and they said they didn't even want to get into the cost of the woodworking tools.

As for the components, the PC is built on a Ryzen 9800X3D processor plus Nvidia RTX 5090 GPU.

Waiting out the GPU pricing nightmares

So, this was a pricey build, and a complex one, but even then, seven years seems like a very long time for putting the PC together — it means Mithiral67 started their project before the pandemic.

What gives? Well, as they explain: "For those asking, 7 years was mostly waiting for a GPU at MSRP, literally took 4 generations to get lucky at Micro Center."

There you have it. Those hoping to feature an RTX 5090 in their custom build are looking at paying an absolute fortune currently, of course, and getting the Nvidia flagship at list price now seems almost as miraculous a feat as the construction and thoughtful crafting witnessed with this PC.

Mind you, even then Mithiral67 had to buy the RTX 5090 as part of a full PC to get it at the equivalent of the sticker price (which worked out fine, as it meant they could use that other PC for playing games while they painstakingly finished off the work of art that is 'Heartwood').

As one admiring Redditor summed up nicely: "This is genuinely the most beautiful setup I've seen, in every aspect from the choice of wood, color, design, and function."

There's no shortage of commenters approving of the build, or indeed those pointing out that Sam Altman doubtless disapproves of the amount of RAM used in this desktop, too. Don't you know that's memory which could have powered another AI agent from a data center somewhere?

• Applebee’s fixes mobile app flaw that exposed customer data through hardcoded database credentials
• Researchers found access to personal information including names, contact details, birthdays, and account metadata
• No evidence of abuse was found, but the incident highlights the persistent risk of hardcoded secrets in software

Applebee’s has fixed a serious flaw in its mobile app that exposed sensitive customer information to pretty much anyone. Whether or not anyone malicious actually found this vulnerability and exploited it is not known at this time.

The chain has an Android mobile app that allows customers to browse the menu, customize meals, place orders for delivery or pickup, save their favorites, or receive personalized food recommendations.

A security researcher from What Security called Robert Wiggins, used AI to analyze the source code of the app and found a gaping hole - hardcoded credentials for a company database.

Notifying the business

The database contained plenty of sensitive information: customer names, their email addresses (both verified and unverified ones), dates of birth, phone numbers, ZIP codes, veteran status, the number of logins, dates of account creation, and the IP address of the most recent login session.

We don’t know exactly how many people had their sensitive data exposed that way, but the app has more than a million downloads on the Google Play Store.

Wiggins soon realized that there was no way to report the issue either to Applebee’s itself or to its parent company, Dine Brands, so he reached out to TechCrunch. The publication verified his claims by finding the exposed credentials itself, and even created a new entry which Wiggins was later able to extract, and also confirmed the credentials allowed users to modify database entries.

TechCrunch managed to get ahold of Dine Brands, who plugged the hole and thanked everyone involved: “We appreciate TechCrunch and the security researcher for bringing this matter to our attention,” the company said. “Our security team promptly launched an investigation and has not currently found any evidence of unauthorized access.”

“Our investigation is ongoing, and we will take appropriate steps based on our findings,” the company added.

Hardcoded credentials are a very common mistake that sometimes has dire consequences. During production, software developers would leave login credentials inside the code to work faster, allowing the app to skip the tedious process of identifying every single time. However, the credentials are supposed to be temporary and are usually removed from the code before launch.

Sometimes, though, the credentials don’t get spotted during final code review and end up in the live version. Crooks who scan the codes for vulnerabilities can then use the information for unauthorized access.

A common error

Unfortunately, it is a very common problem. In March 2025, security researchers from Cybernews analyzed more than 156,000 iOS apps and found more than 815,000 hardcoded secrets, thousands of which were “very sensitive and could lead directly to breaches or data leaks.” It’s worth mentioning that in this case, a “secret” means more than just passwords - it also includes API keys and encryption keys. The average app's code exposed 5.2 secrets, and 71% of apps leak at least one secret, Cybernews reported at the time.

A few months later, in July, HPE patched a similar bug in Aruba Instant On Access Points, and at roughly the same time, a similar flaw was found in Cisco’s Unified CM, enterprise-grade IP telephony call control platform providing voice, video, messaging, mobility, and presence services.

The leaks continued in 2026 - in February, news broke of Chinese state-sponsored threat actors abusing hardcoded credentials found in Dell’s RecoverPoint for Virtual Machines.

Applebee’s did not notify its customers about the incident, and it did not publicly disclose it on its website or social channels, at press time. Also, there are no indications that any threat actors exfiltrated this data or leaked it to the dark web.

Sam Altman has been making headlines for his claims that consumers don’t deserve DRAM because it is only utilized “5% of the time.” In his opinion, DRAM supplies should be prioritized for data centers where its utility can be maximized powering cloud environments.

Altman’s perspective is like a utilitarian's fantasy. Humanity’s endurance of short-term pain - by handing over every bit of DRAM we have - will lead to a morally right outcome in the form of a world powered by time-saving, efficiency-increasing, productivity-boosting AI.

Sounds great if you’re the head of an AI company, but less so if you just want memory to be affordable again.

But what the OpenAI head seems to forget is that the DRAM shortage is part of a crisis he had a hand in creating. When OpenAI’s Stargate datacenter buildout was announced in early 2025, it was predicted that the project would require 40% of the world’s global supply. Supply issues were compounded as leading producers of memory entered a production turndown just a few years before to help stabilize pricing.

Will Sam Altman break into your house to steal your RAM?

The good news is that there is little Sam Altman himself can do to take your RAM off you. One reddit user asked Google AI the question we’ve all been thinking: “Is Sam Altman going to break into my house and steal my RAM?”

Google reassured the user with, “No, Sam Altman is not going to break into your house to physically steal your RAM.” So at least there's that.

But given how constrained the current memory supply is, there are a few ways that AI and other future tech could make the whole situation worse.

The worst could still be yet to come

One of the world’s leading memory manufacturers, SK Hynix, has predicted that the supply shortage could “persist through 2030,” making any hopes of a return to affordable pricing in the next few years a distant dream.

With OpenAI and Anthropic both set to hit the public market within that window, there is a lot of uncertainty over how the memory giants that control around 90% of the world’s supply will shift production.

Given the difference in revenue between the consumer memory market and the AI market, it wouldn’t be surprising to see a significant production swing towards the high-bandwidth memory required for AI inference and training.

This could be compounded by AI’s effect on the job market, with numerous firms enacting hiring freezes as AI strategies help cut out repetitive rote work. Higher unemployment and a lack of open positions could further reduce the demand for consumer memory, swinging production further in favor of AI.

But other emerging industries are also looking to take a bite out of the memory market.

Robots and autonomous vehicles are coming for your RAM

There has been a recent explosion in the robotics industry: from humanoid bots competing in their very own Olympics, to warehouses staffed by fleets of micro-bots. As AI improves and converges with the robotics industry to produce bots with near-human fine motor control, numerous industries spanning manufacturing, hospitality and logistics could buy robots in place of humans.

After all, a robot can work around the clock, doesn’t need to rest, and doesn’t have any rights to be violated with unsafe working conditions or excessive hours. The same goes for an autonomous taxi or cargo truck.

But they will need memory to run their little AI brains. And serving the corporate overlords is much more important (and much more profitable) than expanding memory production for the consumer market, so don’t expect things to improve any time soon.

• Windows 11 just got a revamped internet speed test in preview
• This feature was shuttled swiftly through development using agentic AI in combination with human oversight
• Microsoft boasts that this is about: "Getting from idea to customer value faster. Without AI slop." Others are more cynical, though

Windows 11 just got a useful change in preview, with its built-in internet speed test being revamped, and the new version was produced using AI (in conjunction with human oversight, I should add).

Windows Latest spotted that Marcus Ash, Microsoft's VP of Windows Design and Research, posted on X to explain that the "team moved pretty fast on this one", adding that following feedback asking for the speed test to be improved, "within a day, Diego had a working prototype." (Diego Baca is VP of Design for Windows).

Ash tells us: "From there, our connectivity team worked with partners to bring the experience into Windows. The design and build work was driven by an agentic AI workflow, with a person guiding the process in their spare time."

The Microsoft exec further explains that this is where he sees "a lot of potential in AI" and using agentic workflows, in terms of "Getting from idea to customer value faster. Without AI slop. That is the way."

Analysis: AI, oversight, bugs, and jobs

Of course, this is a controversial topic. Mention AI being involved in the coding of Windows 11 and some tempers will flare online, even though we know this is happening anyway. Microsoft has made no secret of that fact.

Indeed, among the AI hate and flames on social media, a lot of people are point out that these days pretty much all software is being developed in conjunction with Large Language Models (LLM agents) — even Linux.

As one Redditor makes clear: "Newsflash — every single piece of software you use, except for open source projects that are making a statement, you should expect to have AI written code in it. It is pervasive, it is everywhere."

The key aspect here is exactly how the AI agent in question is employed.

It's one thing for such an agent to be given a task to write a piece of code for a certain feature, and then just to slap that into your software or operating system as it is (or maybe after a cursory glance through the work). It's another thing to have a human programmer working on a feature and using an agent to perform grunt-work (easy but perhaps time-consuming) coding therein — and then to properly check the AI's output.

Theoretically, there's nothing wrong with the latter approach, at least in terms of the soundness of the coding work. And as Microsoft's Ash points out, this is really accelerating development times — meaning Windows 11 users will get new features (hopefully capabilities they want, like this improved internet speed test) much more swiftly. Which is exactly why almost every developer is now utilizing this tech.

There are problems here, though, and they're bound up in the public perception of Microsoft. Do Windows 11 users trust the company to be using AI in the right — i.e., properly checked and vetted — way? Not really, in many cases, as there remains a lot of doubt over the overall quality of Windows 11 code, and rightly so given the regularity, and severity, of the bugs we've seen (with more prevalence since 2024, and that 24H2 update).

As another Redditor observes: "People aren't calling Windows slop because it's being made using AI these days. They're calling it slop because it's being made using AI with woefully insufficient human oversight and even more woefully insufficient QA, leading to repeated disastrous bugs making it to production and end users being treated as beta testers. You want people to stop calling your product slop? Stop shipping updates that take down people's computers or break existing features."

The other issue here is that of AI stealing coding jobs from people. Agents may make things happen a lot more quickly, but as Ash notes, this revamped speed test was implemented mainly by an agent — including its design — with the software engineer "guiding the process in their spare time", making it sound like a rather casual amount of effort on the human side of the equation.

Is it a particularly sensitive approach to be touting the benefits of AI — as real as they may be for an operating system's ongoing development and maintenance — in this way at a time when Microsoft has been swinging the axe with various job cuts and pushing staff towards voluntary redundancy in a big way? I'd suggest it isn't, and the timing of this particular push of the value of agentic AI is dubious in that respect.

At least in this case Microsoft is being upfront and transparent about what it's doing — and we can expect a good deal more AI acceleration of Windows 11's development going forward.

• The Explorer 100D is a palm-sized 30,000mAh portable power station
• It uses a long-lasting lithium iron phosphate battery
• It has a maximum total output of 158W and supports direct solar input

Jackery has just launched a new portable power station that combines a high capacity with an impressively small and lightweight design.

Dubbed the Jackery Explorer 100D, it measures 11.87 x 8.26 x 8.57cm and weighs 850g, which sounds fairly compact when you consider that it has 30,000mAh of power. Indeed, it’s 14% smaller and 12% lighter than the Explorer 100 Plus, making it Jackery's smallest portable power station yet.

So, while it will certainly add some weight to your bag, it's small enough to carry around in a backpack, so you can keep your devices powered when out and about or on trips. It’s designed to comply with lithium battery transport standards, too, so you can take it on planes and trains, and even though it’s palm-sized, it also includes a built-in handle and supports an optional shoulder strap.

An LFP battery with solar support

The Jackery Explorer 100D also uses a lithium iron phosphate (LFP) battery rather than the more common lithium-ion ones, meaning it’s theoretically both safer and longer-lasting, with Jackery claiming it has an up to 8-year lifespan and will retain at least 80% of its capacity across 3,000 charging cycles.

It has two 140W USB-C ports and an 18W USB-A port, so you can charge, for example, a laptop, phone, and tablet all at once. That said, it tops out at 158W of combined charging power, so you can’t use all of those ports at full power simultaneously.

When you need to charge the 100D itself, you can of course plug it in to any outlet, but it also supports up to 100W of direct solar input, making it suited to an off-grid setup.

So there’s a lot to like here, and while this isn’t the cheapest 30,000mAh power station, it’s reasonably affordable too, coming in at $99 / €99 (roughly £75 / AU$140). It’s not currently available in the UK or Australia, but Jackery does have a presence in both regions, so that might change.

Earlier this week, Apple did the thing we’ve all known it would for months and finally unveiled its touchscreen MacBook Pro. Awkwardly dubbed the “PROLED XDR Display,” Apple says the touchscreen panel gives pro users “a whole new way to interact with their content.”

Yet, to say I’m unconvinced would be an understatement. While I’m excited for that OLED goodness, I’ve long been skeptical of the benefits of touchscreen laptops, as I find their gesture interactions to be by turns unnecessary and uncomfortable to use for long periods of time. And if something is either so unnecessary that you don’t use it or so uncomfortable that it causes your arms to ache, it probably shouldn’t be in a product.

But hey, what do I know? Practically every Windows laptop manufacturer offers at least one touchscreen version, and now Apple has got in on the act. I’m sure Apple will do what it often does and blow everyone else away with a perfected feature that redefines what a touchscreen display should be about … right?

Actually, scratch that, I’m still totally unconvinced. Because not only has Apple completely sidestepped the entire issue of arm fatigue, but it seems the company can’t even convincingly explain why anyone should buy a touchscreen MacBook in the first place (and let’s not even talk about the $2,899 starting price or the $14,549 maximum configuration). No, I think I’ll be sitting this one out. Here’s why you might also want to.

Simply the best?

If we want to understand why this touchscreen MacBook Pro exists — and maybe why you should buy one — we should look at how Apple frames it. The company says that “Graphic designers can now use the entire display as their canvas, no longer constrained by the area of the trackpad when drawing,” and that “musicians can play software instruments right onscreen.”

But does Apple actually think that doing either of those things is going to be remotely comfortable for more than about 10 seconds? There’s a reason why people play keyboards horizontally, after all: because playing an entire gig with your arms held rigid and outstretched is a quick path to aching limbs. Why would it be any different on a laptop?

Surely Apple doesn’t picture long-term usage like that, so my guess is it expects you’ll do a few quick taps on-screen and then go back to a normal, sane way of using your laptop. But if you only interact with the touchscreen for a few seconds at a time, is it really worth it? Is that kind of limited interaction good value for money when you’re paying a $400 premium over the regular MacBook Pro?

Maybe, maybe not, but the fact that Apple’s big, expensive, flagship feature is something many people will simply shrug their shoulders at suggests a failure of inspiration on Apple’s part.

Yes, you get a beautiful OLED panel as well for your $400, and that I think is easily justified. But every feature in a product you buy should be able to justify its existence, especially in an Apple product and especially in these expensive times. Yet the touchscreen panel just feels like it’s come along for the ride.

After all, Apple is the company that has reinvented category after category, from portable music players to smartphones to tablets and beyond. And now the best it can do is a feature that isn’t comfortable to use for long periods and that is best employed in short bursts with extended periods of inactivity in between.

If Apple, of all companies, can’t blow you away with a feature that resets expectations of how the category should work, why is it bothering at all? Apple’s mantra has long been not to be first, but to be best. Does this touchscreen really feel like the best in the industry, or just another addition to the pile?

An uninspired feature

In hands-on demos across the land, plenty of people have said that using the touchscreen MacBook Pro feels great — or “totally and wonderfully natural,” in the words of my colleague Lance Ulanoff — and I don’t doubt that it does.

But that doesn’t negate Steve Jobs’ criticisms of the idea of touchscreen laptops at all. In his famous critique, Jobs said that “after a short period of time you start to fatigue, and after an extended period of time your arm wants to fall off.”

I’m sure that Apple has crafted its touchscreen display in such a way that it does indeed feel amazing when you first start using it. A few taps and swipes and you’re probably ready to part with your cash.

The problem is that, unless I’ve missed something, our arms haven’t evolved in the 16 years since Jobs made that oft-cited pronouncement. Keep using a touchscreen laptop, whether it’s made by Apple or anyone else, and you will eventually start to feel fatigue and pain.

Given the laws of biology haven’t changed, I was hoping that Apple at least had some sort of killer feature up its sleeve for the touchscreen display. Sadly, I’ve come away disappointed.

Even John Ternus, Apple’s new CEO, can’t seem to sell it well. When asked by Wired why Apple decided to release a touchscreen MacBook, Ternus had this to say:

“We needed to get to a point where adding touch didn’t make the product lesser in any way. It didn’t make it heavier. It didn’t make it thicker. That came together with the OLED screen, the best display we’ve ever put into a Mac. All of these things, and, oh yeah, it has touch as well.”

“Oh yeah, it has touch as well.”

It feels like that sums up the inclusion of the touchscreen almost too well. Why did Apple include it in the MacBook Pro? “Yeah, I guess we may as well do it.” That’s the way it sounds to me.

Is that the attitude of a company that leads? Of one that prides itself on inspiration and innovation? Or just one that sees everyone else doing touchscreen laptops and thinks it should probably tag along?

Look again at what Ternus said. The time was right to include a touchscreen because Apple could do so without making the MacBook Pro worse. Not the time was right because including a touchscreen would elevate the MacBook Pro to exciting new heights. Just, “hey, what’s the worst that could happen?”

Apple’s playbook has often been to let others go first and wait until it has the capability to blow everyone else away, not to let others go first and then add their own thing because “I suppose the time is right.” It just screams of passive, unimaginative thinking. Where’s the drive, the passion? The desire to make something “insanely great”?

Are we really expected to believe that Steve Jobs made the first iPhone a touchscreen product because he wanted the company’s customers to say “oh yeah, it has multi-touch as well”? That designing an Apple device was a checkbox exercise of adding what you could as long as it didn’t make the experience crap? Jobs was famous for his conniptions, and you can bet everything you’ve got he’d have one if that’s how his teams thought.

And yet here we are, with Apple’s own CEO making the headline feature of his latest MacBook Pro feel like an afterthought that half of the company’s users might not even notice. It boggles the mind.

Before the PROLED MacBook Pro launched, my colleague Lance Ulanoff pointed out that Steve Jobs often changed his opinions and argued that Jobs would have loved the idea of a touchscreen MacBook Pro. Maybe so, but he would have hated the milquetoast way that Apple has framed it.

Making it easier to repair an old smartphone or laptop, rather than buying a new one, has long been a goal of tech enthusiasts, and the EU took a big step towards making that a reality in June 2025 with the introduction of its "Ecodesign" requirements.

The European Commission's rules require manufacturers of smartphones and certain tablets to meet new obligations covering spare parts, repair information, and the fundamental design of their devices. Laptops aren't covered by these particular rules, although other EU regulations apply to them.

More than a year later, there are some real signs of improvement – but also lingering questions about the difficulty and cost of repairs.

So, how much has actually changed? Are smartphones easier to repair, and are laptops heading in the same direction? To make sense of the EU's repairability push, TechRadar spoke to three experts.

Europe's repair revolution

The EU's rules stop short of mandating anything too drastic. Apple does not have to make the iPhone a 10/10 on iFixit's repairability scale, or turn it into something resembling a Fairphone.

Instead, much of the focus is on spare parts: manufacturers must make specified replacement components, including screens and batteries, available for at least seven years after a model stops being available on the EU market.

Manufacturers must also deliver parts within five working days for the first five years, rising to 10 days for the remaining two, while providing repair documentation and access to necessary software tools.

Batteries must meet minimum durability standards, too.

For consumers, perhaps the most visible change is an A–E repairability rating on the EU's new energy labels, based on factors such as disassembly difficulty and replacement parts.

The EU has also introduced a separate Right to Repair Directive, which member states had to implement by July 2026, adding protections for certain products, although laptops aren't yet covered.

The changes could have implications beyond Europe, too. "The regulation clearly influenced products sold outside Europe, because few vendors engineer a separate phone for one region," says IDC's Francisco Jeronimo.

Cracking the repair problem

In June 2026, the European Consumer Organisation (BEUC) carried out an investigation into the availability of spare parts and repair instructions across Europe, comparing smartphones with battery-powered vacuum cleaners.

"The new Ecodesign rules for smartphones have improved consumers’ access to spare parts and repair instructions," says Silvia Barlassina, the group's ecodesign project coordinator. "However, as the rules have been in force for only a year and a half, it is too early to assess whether they have led to an increase in consumer repairs."

Of course, getting hold of replacement parts is only half the battle. Thomas Opsomer, an EU policy specialist at repair advocacy group iFixit, is less convinced that the rules have changed how smartphones are actually repaired.

"As a result, the regulation did not really change the current mainstream smartphone design, which is one that requires heating to release the screen adhesive in order to get access to the inside of the phone for any type of repair – a procedure that is quite daunting to most users."

A recent iFixit teardown of the iPhone 18 Pro shows that, despite a screwed-in battery tray and modular cameras, accessing the battery still requires removing the glued-down display.

In fact, iFixit says it damaged the plastic display frame in three of the four phones it opened, although it cautioned that further testing was needed to establish whether this was a widespread problem.

Physical repairs aren't the only problem. In a separate September 2026 investigation, Right to Repair Europe and iFixit examined 2,334 smartphone-model records in the EU's official product database, finding widespread gaps in the availability of repair instructions and spare-part prices.

"We found 80% of models on the market to be non-compliant, which is not the same as 80% of units sold," says Opsomer. "We have seen dramatic improvements in the availability of instructions for self-repair from the leading manufacturers, who were previously quite reluctant to share those."

Many of the shortcomings are instead concentrated among cheaper, lesser-known smartphone brands, Opsomer adds, potentially leaving budget-conscious consumers particularly exposed.

There has also been progress on parts pairing, the software checks that can restrict the use of replacement components. Manufacturers such as Apple must now allow users and independent repairers to restore the functionality of replacement parts, "removing a significant barrier to self-repair and independent repair," says Opsomer.

The €400 question

New smartphones are expensive – and prices are being pushed even higher as demand from AI data centres drives up the cost of components like memory chips, even for giants like Apple.

With replacement parts becoming easier to find, you might expect repairing a smartphone to be substantially cheaper than buying a new one. Unfortunately, the reality isn't quite so straightforward.

"For one high end device we examined in our recent market check, the cost of replacing the display exceeds €400," says Barlassina. "When compared to the average original retail price of the device, this represents roughly 30% of the total cost."

Research cited in the European Commission's impact assessment suggests consumers are typically willing to spend around 20% of a product's purchase price on repairs. Damningly, BEUC's €400-plus figure, meanwhile, only covers the replacement component, before labour and other expenses.

The EU's new A–E repairability labels account for factors like disassembly difficulty and the tools required, but crucially not the cost of replacement parts or repair services. This, Barlassina says, "can give an incomplete picture to consumers."

The cost of fixing individual devices illustrates the problem. Samsung's Irish repair pricing page lists a recommended €267 for an out-of-warranty screen repair on the Galaxy S26 Ultra, including a replacement battery, although additional work could increase the charge.

Meanwhile, Fairphone's replacement display for the Fairphone 6 costs just €89.95, while a replacement battery costs €39.95. Both are parts-only prices, with Fairphone designing them to be replaced at home.

"The economics of repair are key," says Opsomer. "When their phone breaks, users consciously or unconsciously make a tradeoff between the repair costs and the perceived residual value of their phone, which is lowered by incessant messaging extolling the virtues of the latest and greatest model."

Laptops are opening up

Laptops weren't covered by the EU's June 2025 smartphone Ecodesign rules, but some manufacturers have made substantial improvements anyway.

Notably, iFixit gave the Lenovo ThinkPad T14 Gen 7 a provisional 10/10 repairability score, praising its accessible battery, replaceable USB-C ports, keyboard, RAM, and storage. iFixit had also consulted with Lenovo on its design.

Even Apple is leaning into repairability with the MacBook Neo, which got a 6/10 score from iFixit, the highest MacBook score in around 14 years. The Neo uses a screwed-in battery rather than a glued-down one, although its RAM and storage remain soldered.

But are these examples part of an industry-wide shift, or still the exceptions?

"We see a shift towards repairability in smartphones and laptops, but not to the extent that I would call it a broader industry shift," says Jeronimo. "There are clear signs of movement, and Apple and Lenovo are two good examples."

There's a commercial argument for repairability, too. Jeronimo points out that consumers paying more for their devices increasingly expect them to last longer, giving manufacturers another reason to make repairs easier.

"A repairable device tends to hold its value for longer, which means a higher residual value when the consumer trades it in for a new one," he says.

Still some fixing to do

More replacement parts and better repair manuals are all well and good, but are consumers actually making repairability a priority?

According to IDC's research, consumers are now keeping smartphones for around 3.5 to 4.5 years on average.

"Consumers are keeping phones longer, but repairability is not what drives it," says Jeronimo. "In a 2025 IDC consumer survey, battery life, connectivity, price and build quality ranked highest among the purchase criteria."

Governments are also looking at ways to make repairs more attractive. Under the EU's Right to Repair Directive, member states must introduce at least one measure encouraging repairs, potentially including financial incentives such as repair vouchers.

Member states have until July 2029 to notify the Commission of the measures they've taken, although they can introduce them sooner. "Among these options, financial incentives would be by far the most effective," says Opsomer.

More than a year after the EU's repairability rules came into force, things are slowly improving. Enthusiasts who want to keep their smartphones and laptops forever – or at least several more years – have more options than before.

The challenge now is making repair a realistic choice for everyone else.

The RAM crisis has grown even more limbs during the month of October. If the memory shortage was incarnated in physical form, it'd have more legs than a spider at this point, and be a multi-limbed monstrosity with a bite that's getting nastier by the day as more negative news seems to roll in at a frightening pace.

Just this week, we've witnessed SK Hynix predicting that RAM supply woes are going nowhere and will persist through to 2030, after Dell's CEO recently warned that we're stuck with this crisis until the end of the decade, and Intel's chief exec agreed – on top of other similar forecasts from earlier this month.

The latest nugget of doom is from Samsung, with the memory chip maker giving out similar vibes to its rival SK Hynix when reporting its financial results (as Wccftech spotted), informing us that RAM shortages will get worse next year, and supply will remain thin on the ground in 2028, too.

You can barely catch a breath between the various dire predictions during the past month. Naturally, in the face of such grimness, it's human nature to try to look on the bright side, or in this case, at least attempt to find a glimmer of light shining through from somewhere. There must be something, right?

Well, there is: Black Friday. An event with a distinctly gloomy name, ironically, but I'm increasingly of the opinion that this is going to be a very important sales season from the computing and PC point of view (and likely other tech, too). Mainly because I expect that the deals you'll get this year will likely be the best prices to be had in a long while, and possibly this entire decade, if those 'it's here until 2030' voices are correct in their assertions about the RAM crisis.

But I hear you (possibly) cry: given all these price hikes, isn't Black Friday going to be a wash anyway? At least based on what we saw with Amazon's recent Prime Day sales? And yes, that's a fair point. You should manage your expectations with the discounts that'll be on offer, certainly, and don't expect to snag a bargain on RAM sticks or that beefy SSD you've been dreaming about. That just isn't happening (to no one's surprise).

However, on Prime Day, there were some decent deals to be had, for example on GPUs. Notably on the RTX 5080, where if you grabbed the deal I highlighted back then, you saved yourself 20% (£300) compared to the price of the cheapest model of that Nvidia GPU on Amazon now (at the time of writing).

So, given that, what should you be looking at buying this Black Friday, which is less than a month away now (with early offers starting already)? Well, the best deals will likely be in the products set to be more affected by the memory shortage as time rolls on, and I'm going to highlight what I believe are a few key areas bargain hunters should focus on when it comes to the PC sphere.

Graphics cards

I'm putting this one front and center because I believe this should be a priority for PC owners who are looking at a GPU upgrade at some point in the not-too-distant-future. As I already mentioned, there were some decent graphics card deals on Prime Day earlier this month – albeit when it comes to the higher-end GPUs, the word 'decent' translates to 'not inflated', which isn't quite the same thing.

Still, the problem is that prices are likely to rise a good deal more next year, and if you do need a higher-end GPU in particular, during 2027 I think there's a good chance pricing will get a lot worse. Meaning that what you'll pay on Black Friday, with the odd scattered deal on the likes of an Nvidia RTX 5070 model or AMD RX 9070 XT – and maybe even an RTX 5080 – will be a relative bargain (maybe for quite some time to come).

I think this is especially true given the rumors around the RTX 5090 being discontinued (Nvidia has insisted it isn't, but even so, something's clearly amiss with the flagship GPU somewhere), and the ridiculous inflation the RTX 5080 has seen over the past month. All of this indicates a rocky picture with Nvidia's GPUs, and with memory (VRAM) difficulties set to worsen next year – and AMD also rumored to be implementing price hikes with Radeon graphics cards – my advice is to get in ahead of wider GPU price spikes next year.

The catch is that Black Friday deals on graphics cards could be thin on the ground, but we may actually get some decent price cuts in the mid-to-lower-end of GPU territory.

Gaming laptops

If you're thinking about buying a gaming laptop, I think there's scope for some good deals on Black Friday – traditionally laptop discounts are plentiful among the massed ranks of portables, and gaming devices have more headroom for cuts, too.

What you need to consider here is that serious gaming laptops run with a discrete GPU, and as noted above, graphics card price increases are very much on the table. Indeed, this is already happening, and XMG is pushing up prices for its top-end gaming laptops with the RTX 5090 in a major way, while promising that "other laptop GPUs are also facing supply constraints." Further price rises are coming, then, and with RAM getting more costly next year too, we can expect some painful hikes.

As a result, I'd be inclined to keep a careful watch on what Black Friday presents in the way of gaming laptop price cuts, and move sooner rather than later if at all possible.

Laptops

Outside of the gaming arena, everyday laptops are another area where I'd seriously think about trying to nab a Black Friday bargain. As mentioned, there are usually a lot of laptop deals – we highlight the top offers at TechRadar, of course, and notebooks represent quite a number of the bargains we pick out – and while there may not be so many this year, expect them to be there.

With the rising tide of RAM prices and the worsening of the crisis next year, it seems inevitable that this will jack up the asking prices of all laptops (and especially gaming laptops, as noted, due to the extra pressure added by the video RAM of discrete GPUs).

Analyst firms are already predicting that laptop manufacturers are soon going to ramp up pricing as they run short of stockpiled components (purchased at a cheaper cost). And one analyst outfit, IDC, recently advised that the only positive glimmer here is that some retailers are carrying too much notebook stock (given flagging PC sales this year) which may result in "promotions and some short-term relief for consumers," which is clearly referring to Black Friday.

I agree, of course, and think that if you want a new laptop in the next couple of years, Black Friday 2026 is likely to be the best time to make your move.

What else?

On the PC side, then, I feel that laptops – particularly gaming notebooks – and desktop GPUs are the key areas to focus on for Black Friday bargains.

The trouble with other key desktop PC components aside from graphics cards is that pricing has got so high with RAM and SSDs that even a 'bargain' with a big price cut feels like a very sour purchase compared to prices last year. These components are just depressingly expensive (especially system memory), so it's difficult to recommend buying at all unless you're absolutely forced to. (Top-end GPUs are now in this territory too, of course).

That said, there may just be a half-decent deal on storage somewhere (we did see one or two of those in the most recent Prime Day).

On a lighter note, you might well see some solid deals on CPUs if you're on the hunt for a new processor. This is likely to be the exception in terms of the other core PC components aside from GPUs, although I'm not expecting CPU prices to face the same upward pricing pressures that graphics cards will encounter next year, so there isn't the same sense of urgency to buy in that respect. I could be wrong in that, mind – and the same goes for all my musings here – so season this advice liberally.

It's the largest cryptocurrency theft in history: hackers from North Korea allegedly swiped $6.36 billion in funds from Binance in the space of just 20 minutes, which has left customers reeling and the financial industry in shock.

The heist raises all kinds of questions about how this was allowed to happen, what might happen next, and whether Binance customers are going to get any of their stolen money back.

Even if you never owned any cryptocurrency before, there are bigger questions too — like what this means for global financial stability, and what the aftershocks might be for everyone outside the Binance world.

Looking for a quick five-minute primer on the Binance hack? We've been speaking to industry experts to get some answers...

1. What actually happened?

The basics are now pretty clear — $6.36 billion in cryptocurrency was stolen from the Binance exchange in the space of just 20 minutes. Security analysts are pointing the blame at North Korea's TraderTraitor hacking group, which has a history of this kind of heist. What's less clear is exactly how the hackers got access. Early reports identified a Binance employee's compromised laptop as a potential way in, though it now seems there's more to the story.

"A compromised laptop may explain where an attack started, but it does not, on its own, explain how billions of dollars could leave an exchange," Pieter Arntz, researcher at cybersecurity firm Malwarebytes, told TechRadar. "The real question is what allowed that initial foothold to become access to withdrawal systems — and which safeguards failed to stop unauthorized transactions."

"According to blockchain analysts, the attacker spent at least a day and a half preparing, including testing their tools on public blockchains where anyone could see," Ben Bernstein, manager of cybersecurity advisors at Huntress, told TechRadar. "Then most of the $6.3 billion left Binance's wallets in about 20 minutes. That's common in attacks we investigate. The attacker does most of the work long before anything is stolen."

2. Will anyone get their money back?

Binance has promised to reimburse customer losses through its backup and emergency funds, but in the meantime we're seeing deposits and withdrawals frozen on the platform while the hack is investigated. It's a warning that even the largest and most sophisticated exchanges can still be vulnerable.

"Binance says it'll cover every cent," Nigel Green, CEO of the deVere Group, said in a press statement. "I hope so. The emergency fund is around $1.2 billion and the gap is several times bigger, so the rest has to come from the company’s own balance sheet. The market will want to see the numbers, and the new proof of reserves can’t come soon enough."

"Long term holders have just been reminded, very expensively, why keys kept offline matter. Crypto has spent years pushing back against heavy regulation, and plenty of those arguments were fair. This one's harder to argue with. Platforms holding billions of other people's money need enforceable security standards. I expect regulators in the US, Europe and Asia will likely move faster after this week," he added.

In the meantime, the US Secret Service has said in a statement that it's "working around the clock" with partners in the private sector "to identify, freeze, trace, and recover funds" that have been stolen from Binance.

3. What follow-up scams might appear?

Whether you're a Binance customer or not, you need to keep your wits about you over the next few days. It's likely that scams trying to literally cash in on the hack will start appearing — perhaps warning you that you need to quickly claim refunds, lock your account against a particular threat, or go through a bogus verification process.

"Criminals routinely use major breaches as a hook for phishing campaigns," Dray Agha, senior manager for tactical response at Huntress, told TechRadar. "Consumers should be highly suspicious of any emails or messages claiming to be from Binance offering urgent account recovery steps. You must only check your account status through the official application or website rather than clicking links in unsolicited messages."

According to the team at Huntress, you should watch out for social media posts, emails, and text messages that use the Binance hack as a hook — perhaps a fake news story suggesting that now's the time to buy crypto, while prices are down.

As always, think twice about following links or entering sensitive information into online forms and portals you're not familiar with.

4. How does this affect the average consumer?

If you don't own any cryptocurrency, the good news is that you're largely going to be unaffected by what's happened here. There's not going to be a stock market crash, or a run on the banks, or a global recession — not because of this hack, at least. However, it's always worth weighing up your own personal privacy and security setup.

"If you don't own crypto, the direct impact on you is small," Ben Bernstein from Huntress told us. "Your bank account and your card are not affected by this. The bigger takeaway for consumers is that attackers often get in by targeting people rather than technology, through a convincing email, a fake login page or a phone call from someone posing as IT support," he said.

"That makes security awareness everyone's job, at home and at work. If you pause before you click a link, approve a login or share a code, you're making it harder for an attacker, whether they're after your savings or your employer's systems," he added.

5. What does this mean for the future of money?

This clearly raises a lot of questions about the safety of cryptocurrency and the exchanges that it sits on — and of course it's far from the first crypto heist we've seen. In the longer term, it may lead to less confidence in crypto as a whole, but the experts we spoke to don't think it will bring the industry down. What will be important is making sure the risks of this happening again are minimized as much as possible.

"Despite the scale of the theft, this is not a threat to global financial stability," Feike Hacquebord, Principal Threat Researcher at TrendAI, told TechRadar. "Around half of the stolen funds have already been frozen, while the regulated banking system is well equipped to absorb a shock of this size. This is a major crisis for Binance, not a crisis for the global financial system."

"The change I’d like to see, for crypto firms, banks and every other business, is working on the assumption that someone will get in eventually," Ben Bernstein told us. "Keeping attackers out matters, but it isn't enough on its own. Companies also need someone watching around the clock, especially for logins and account activity that don't look right, so they can find and remove an intruder before the money starts moving," he added.

• AI-generated code security improved for the first time in a year, with vulnerability rates dropping from 44% to 38%
• Top models performed better at preventing common flaws like XSS, but still struggled with complex security reasoning
• Researchers stress AI-generated code still requires independent security testing and verification before deployment

Computer code generated by frontier AI models has gotten more secure and consequently - contains fewer vulnerabilities.

This is according to a new report by Veracode, which claims this is the first significant improvement in a year.

In July 2025, Veracode started releasing its GenAI Code Security Report, which analyzed code generated by LLMs for vulnerabilities and security risks. Since then, the company’s researchers noticed a trend - the code was functioning almost perfect, but on the security side it left much to be desired.

Are XSS flaws worth the trouble?

“We’ve been analyzing code generated by multiple LLMs for more than a year. Until now, we have not seen a marked improvement in AI code security, despite consistently near-perfect functionality,” said Chris Wysopal, Co-founder & Chief Security Evangelist at Veracode.

“This is the first time since running our study that we’ve been able to report a meaningful move on the security dial.”

That meaningful move is a jump from 56% to 62% in overall AI-generated code security. At the same time, there’s been a drop in vulnerabilities from 44% to 38%, Veracode added, saying this was the most significant improvement since the reports started coming out. Anthropic's Claude Opus 5.5 and OpenAI's GPT-6-Sol co-lead the rankings at 73%, surpassing the previous high of 68% set by GPT-5.5 in July 2026.

“Ten models now clear 60%, up from four in the last report, and the overall average has jumped six percentage points,” Wysopal said. “With around half of code now generated by AI, today’s results are truly encouraging.”

To draft the report, Veracode tested 18 models across four languages (Python, C#, JavaScript, and Java), and four Common Weakness Enumeration (CWE) categories (CWE-89, CWE-327, CWE-80, CWE-117). Claude Opus 5.5 and GPT-6-Sol claimed the top spot with 73% followed by GPT-5.5 which holds 68%. In July, six of 11 models scored between 50 and 53, while today only two remain in that band, while 10 scored at least 60%. The bottom is still at 44% - 50% percent.

While the results are definitely commendable, there is a caveat. Apparently, the main driver of the overall gain was on cross-site scripting (XSS), which is arguably one of the weakest categories. XSS rose to 18% which is also the single biggest change in the dataset. According to Veracode, XSS is the “easiest vulnerability to fix through pattern recognition”, which is exactly how LLMs improve. In cases where data-flow reasoning across multiple functions is required (such as, in log injection cases, for example), LLMs continue to stall.

Low-hanging fruit

In other words, AI has just picked low-hanging fruit and called it a day. We’re not sure if we should be disappointed with this, since XSS attacks are common and the vulnerability is still present across the web.

In the report, Veracode also said that water was wet and the sky is mostly blue: it found that top-performing models cost more.

However, they said throwing money at the problem most likely isn’t the best solution: “The models that produce the most secure code are the ones that cost the most to run at scale, yet they still fail on more than one in four security tasks,” Wysopal said. “The answer should never be to use the most expensive model and hope for the best. A mid-tier model at a 60% pass rate plus Veracode scanning is more accurate, more cost-effective, and more scalable than a frontier model at 73% with no verification.”

In conclusion, the improvement is there, but “mends a small part of a larger wound”, Veracode said. Organizations should make sure they combine AI code with continuous and independent security verification that can catch what the models miss.

• Google's subsidiary Tuike Finland cleared and drained 330 hectares of forest at Muhos for a data center site
• The company failed to get the necessary environmental impact assessments completed before carrying out the felling
• A preliminary police investigation is now taking place, based on 'ambiguities and ‌shortcomings in the drainage and water management', although the results of this won't be known until 2027

A preliminary police investigation is now underway into Google's clearing of a forest in Finland to make space for an AI data center.

As The Guardian reports, the allegation is that Google's subsidiary Tuike Finland cleared and drained 330 hectares of forest at the site in Muhos before it had ensured the necessary environmental impact assessments were completed.

Yle (Finland's public broadcasting company) further reports that the police have said that the investigation is into suspected environmental damage, but the other possible charges could be added depending on its ongoing findings.

Finnish police said: "Based on preliminary information, there have been ambiguities and ‌shortcomings in the drainage and water management at the construction site of Tuike Finland ​Oy's datacentre project."

The investigation will be far from a short process, though, and won't be completed until some point in 2027.

Construction work was stopped on the data center in Muhos, and also at a second data center site at Kajaani-Otanmäki, on October 14. In both cases, the environmental assessments were apparently incomplete.

Antti Järvinen, who heads up Google Finland as country manager, apologized for the forest clearances, but said that Google had acted according to the "best understanding we had of the legislation at the time."

Analysis: the rush for AI data centers

Some 400,000 trees have reportedly been felled across both sites (250,000 of those at Muhos). As The Guardian makes clear in a separate report from last week (via Tom's Hardware), there are a lot of very unhappy Finnish people, as you might imagine.

Many of them question the building of data centers at all, and the AI gold rush that's the driving force behind this activity. There's apparently little direct benefit for the people of the country where these projects are underway, with only a small number of local jobs created. As a professor of computer science at the University of Helsinki, Jussi Kangasharju points out, "Really, for Finland, there are no benefits. They are international companies serving international customers. Datacentres ultimately have little benefit for others except the datacentre operator."

Others obviously worry about the impact on wildlife. Finnish conservationists inform us that the three-toed woodpeckers in the forest have been displaced, and The Guardian highlighted that in Otanmäki, wolves that had nowhere to go when the trees were felled ended up coming into a local village.

It will be some time before the criminal investigation is completed, as noted, but you can bet that the results are going to be closely watched.

I reviewed the MacBook Neo way back in March, and even then I knew there was very little chance that I'd be giving our Laptop of the Year award to any other device at the TechRadar Product of the Year 2026 Awards.

It's not necessarily the best choice for everyone — many far more powerful laptops have been released this year, and if you want to play PC games on your laptop don't even think of buying the Neo — but what Apple did with the MacBook Neo is pretty incredible, and it set the tone for a lot of other laptops that have come out this year.

Apple has always been seen as a premium brand, offering expensive devices that (usually, but not always) justify their price tags with superior build quality, and the kind of lifespans that owners of Windows laptops, who feel they have to upgrade every five years, can only dream of.

With the MacBook Neo, however, Apple has produced a (relatively) cheap laptop that manages to keep a lot of what we love about Apple's more expensive MacBooks, while making it affordable for more people.

The timing couldn't have been better, as a global cost-of-living crisis has meant that more people are struggling to afford day-to-day essentials, let alone 'luxury' purchases like laptops. At a time when a lot tech is also increasing in price because of the RAM crisis, it was very welcome to see a company like Apple release a relatively inexpensive new device.

Before the Neo's announcement, rumors had been swirling that Apple was planning on announcing a cheaper MacBook, but I don't think any of us were expecting the earthquake of its $599 / £599 / AU$1,049 starting price.

I say 'earthquake' because not only was it a lot cheaper than expected, it changed the landscape of the laptop market, shaking Apple's competitors, and leaving them scrambling to come up with a response.

And respond they did, with the likes of Dell and Acer releasing laptops at a similar price point that were explicitly pitched as competitors to the MacBook Neo when I discussed them with the makers.

A victim of its own success?

The fact that the MacBook Neo has had such an influence on the laptop market is one of the key reasons why I've picked it as TechRadar's Laptop of the Year. The likes of the Dell XPS 13 (2026) and Acer Swift Air 14 have made affordable Windows 11 laptops worth buying again, and the higher price of the new Googlebook laptops have a more difficult time justifying their price tags when the MacBook Neo, and the laptops it inspired, offer such good value.

In fact, you could almost argue that the MacBook Neo proved a bit too successful in inspiring its competitors, especially given that, a few months after launch, Apple increased the price of the MacBook Neo by $100 / £100. Not only did this make the MacBook Neo less groundbreaking value (and less of an 'instant recommendation' when people asked me which laptop they should buy), but its competitors seem to have mostly held steady with their initial pricing.

All of a sudden, Apple appeared to have inspired its competitors to make rival products that were cheaper than the MacBook Neo. Whoops.

Despite that price bump, the MacBook Neo remains an excellent laptop that continues to offer plenty of value. If you're looking for a dependable, well-built laptop for day-to-day tasks that doesn't cost a fortune, it's still one of the best laptops you can buy — and it remains the cheapest way to get into the Mac ecosystem.

The MacBook Neo proved that, at a time when hardware prices appear to be rising inexorably, it's still possible to make an impressive, affordable device, without making too many sacrifices — and that's exactly what we need in 2026.

• Researchers report the first confirmed PHP2Shell compromises, targeting organizations linked to the US government
• Attackers chained PHP2Shell with a Linux privilege-escalation flaw to gain root access and persistence
• Breaches progressed from initial compromise to Active Directory attacks within minutes, underscoring patching urgency

We now have confirmation of the first successful exploits of the infamous PHP2Shell vulnerability discovered earlier this month.

The news comes courtesy of cybersecurity outfit Dream, who claim to have seen attackers breach organizations affiliated with the US government.

PHP2Shell is a name given to two critical-severity vulnerabilities found in PHP. When they were first disclosed, most of the cybersecurity community went full panic mode, given that PHP powers roughly 70% of all websites and web apps on the internet, and there was no patch at the time. The flaws allegedly enabled complete website takeover, and some government and education organizations in Europe even preemptively shut down their websites, in anticipation of mass exploitation attempts.

But after the dust settled, a strange thing happened - there were no successful attacks. Researchers were seeing attempts and probes, but no successful breaches. Amazon said it observed first attacks four days before the patch, and Cloudflare later tracked “thousands” of attempts in the 10 hours before the patch was announced. This grew to tens of thousands within an hour of disclosure, and hundreds of thousands within two hours. Now, it’s gone into the millions.

Some said exploiting the bugs was easier said than done, and that threat actors were hitting different roadblocks, including Address Space Layout Randomization, a security feature that randomly changes where a program’s code and data are stored in memory every time it runs. Still, they warned that all of that might be temporary, and that a successful hit was a question of “when”, not “if”.

Targeting firewalls

Now it seems the claims were on point, as Dream says Chinese threat actors successfully chained PHP2Shell with a Linux kernel privilege-escalation flaw against Palo Alto Networks firewalls, breaching 25 servers, some allegedly belonging to US government-affiliated organizations.

The attacks started on October 23 2026, probing firms in the US, Japan, Taiwan, and South Korea, and soon focused on Palo Alto Networks’ PAN-OS-powered devices, running an older, vulnerable version of the OS.

According to Dream, the crooks chained PHP2Shell with Fragnesia, a local privilege escalation flaw that allows unprivileged users to obtain root access. It was disclosed in mid-May this year and is tracked as CVE-2026-46300.

After breaking into the devices, the attackers ran some 40 custom post-exploitation scripts, Dream added.

“Within hours of compromising a US government-affiliated firewall, they had tunneled into the internal network, compromised a third server using the same PHP2Shell exploit, and launched a full Active Directory attack campaign - all through a chain that started with a single unauthenticated HTTPS request to a management interface that should never have been exposed to the internet,” the company’s report reads.

Not automated

To make matters worse, the researchers believe the attackers still have unabated access.

“The total chain - from unauthenticated HTTPS connection to persistent root webshell - completes in under 15 minutes,” Dream said. The researchers could not say what the endgame was here because that information was not found in the artifacts they retrieved. Besides the obvious, which seems to be persistent access and credential theft, the threat actors could do anything from dropping backdoors to exfiltrating sensitive information.

In the context of “Black October”, and the fact we’re seeing a significant increase in automated attacks, it is also worth mentioning that this incident was likely not AI-powered.

Dream did find evidence of AI usage but believes it was not fully automated. Claude Code was installed, as was an offensive security platform called AIscan, which was configured with Chinese AI models DeepSeek and Kimi. Furthermore, they found API keys for FOFA, a Chinese counterpart to the Shodan search engine.

With the help of FOFA, the attackers allegedly identified around 19,000 internet-connected Palo Alto Networks firewalls, which they used as a starting point for their attacks.

Via The Register

• Attackers allegedly stole $6.36 billion from Binance in a record-breaking cryptocurrency exchange breach
• Investigators linked the attack to North Korea’s Lazarus Group, exploiting access from a compromised engineer
• Binance said customer funds remain safe, while authorities and partners froze billions in stolen assets

Cybercriminals, allegedly from an infamous North Korean hacking organization, have gained access to one of the biggest cryptocurrency exchanges on the planet - Binance - and in less than half an hour withdrew $6.36 billion worth of different tokens.

Security researchers TRM Labs said the attack was carried out by a group called TraderTraitor, which it describes as “North Korea’s premier hacking unit”.

“We base this assessment on robust on and off-chain intelligence sources,” TRM Labs said in a report, noting that TraderTraitor is part of Lazarus Group, North Korea’s state-sponsored threat actor blamed for some of the biggest crypto heists in history, with the FBI blaming it for the $1.5 billion Bybit hack that took place on February 21, 2025.

Gone in 20 minutes

Binance’s experts, as well as independent researchers, are still piecing together what happened, so information might change throughout the day(s). What we know so far is that a DevOps engineer had their laptop compromised, which was confirmed by Richard Teng, Binance co-CEO, in a LinkedIn post.

“That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions,” he said.

Right now, no one really knows what exactly happened and what it means that a DevOps engineer’s laptop was compromised. However, we do know that Lazarus is famous for running operations DreamJob and Contagious Interview, in which they set up fake companies and fake jobs, and then approach software engineers working on crypto projects. They entice them with lucrative job offers and exciting opportunities, and sneak malware during the multiple interview rounds.

But Binance’s security measures are more robust than that, and simply installing malware on one device could not have sufficed. Teng confirmed that, too, saying “the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process.”

Funds are SAFU

TRM Labs said the attackers pulled funds from 10 different chains, including Bitcoin, Ethereum, XRP, Tron, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. The Ethereum chain was the hardest one hit, losing roughly $3.79 billion. It could be because of the chain’s smart contracts feature, which allowed the attackers to keep withdrawing funds as they were landing into the wallet.

Binance is one of the biggest and most popular cryptocurrency exchanges on planet Earth, and as such it holds billions of dollars in user funds. This attack, however, did not target user funds, but rather Binance itself. This was confirmed by both Teng and TRM Labs, with the co-CEO saying “your funds are safe”, and “Binance will cover all losses from the SAFU fund and company funds.”

In response to the attack, Binance temporarily restricted deposits and withdrawals. Numerous users took to X this morning to say their transaction requests were denied. The police and other relevant entities were notified, and around $3 billion were already frozen on-chain, apparently.

Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, TRM Labs confirmed, while Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly $2.7 billion.

What’s particularly interesting about this incident is how the market responded. In 2013, when Mt.Gox (at the time the biggest crypto exchange in the world) got hacked for $450 million, it was considered a “black swan” event, sending bitcoin down by more than a third (35%) in a few weeks. The 2025 Bybit hack sent BTC down approximately 7.5%. In response to the Binance hack, BTC dropped a measly 6.7%, which is just another Friday in the crypto world.

Phishing incoming

Trouble always comes in pairs, and this Binance hack will most likely be no exception. Security researchers NordVPN are warning users that other hacking groups might try to take advantage of the news to target users with phishing emails.

“Another risk is criminals exploiting the confusion and fear among crypto owners on other platforms. An email claiming your funds are at risk, a fake support account offering help or a message urging you to move your cryptocurrency to a ‘safe wallet’ could be an attempt to steal from you,” said Marijus Briedis, Chief Technology Officer at NordVPN.

“Check updates through the Binance app or a website address you already trust. Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase. Pressure to act immediately should be a reason to pause and verify the request.”

“These steps can reduce the risk of someone taking over your account, but they cannot prevent a breach of the platform itself. Cryptocurrency firms typically have watertight cybersecurity, as they are digital-first businesses, so if one can be involved in the biggest hack in history, it shows just how lucrative a single flaw can be.”

• Reddit has announced plans to switch to a primarily logged in experience
• This would mean most of the site won't be accessible without creating and logging in to an account
• Reddit users seem almost universally unhappy about this planned change

Reddit — a site that once had the tagline “the front page of the internet” — looks set to become a lot less accessible, and therefore far less of a front page, as the company plans to require users to be logged in.

Currently, you can access pretty much the entire site without having to log in or create an account, and this has a lot of upsides. It means people who get there through search results can find the information they’re looking for more easily and seamlessly, and it means you can browse Reddit without giving the site any information about yourself, or being subject to any personalization algorithms.

But in a post on the site, CEO Steve Huffman (known as Spez on Reddit) has explained that the site will now evolve to become a primarily logged-in experience.

Tests of this change will begin in select markets outside the US in the coming months, but once the details have been ironed out and tested, it sounds like this shift will become global and permanent.

According to Huffman, this is being done because it’s “better for user experience, better for our ads business, is more in line with safety regulations, and more protective of Reddit data,” but despite Huffman's claims, it’s a change that isn’t going down well with users.

Heading down a worrying path

Responses to Huffman’s post include “hard disagree,” “knew it was going to get worse,” and “truly fascinating to witness a CEO consistently act against their company's interests,” among many others. In fact, just about every reply to the post is negative.

Beyond not wanting to be forced to log in for all the reasons above, users also worry that this change will lead Reddit down the same road as Pinterest. As one commenter said: “this sounds like exactly what Pinterest did... and then Pinterest kinda died.”

So, this sounds like it’s going to be a bad change for just about everyone other than Reddit’s C-suite, though if it does die, then it’s bad for them too. Hopefully, though, if this does lead to a meaningfully worse experience, we’ll see an alternative rise up to take its place, much as the likes of Bluesky and Threads did when Twitter became X. Still, it would be sad to see Reddit go.

• Researcher finds exposed database containing 42 million documents and hundreds of thousands of records with personal data
• The CitySourced-linked repository exposed names, contact details, complaint reports, and internal records for years
• Database was secured after disclosure, highlighting ongoing risks from misconfigured cloud storage

Millions of documents, many exposing personally identifiable information (PII), were sitting online, in an open database accessible to anyone with a browser and the knowledge of where to look. The database belonged to a GovTech company called CitySourced, and has since been locked down.

Cybersecurity researcher Jeremiah Fowler reported finding a database contained roughly 42 million documents and 450,000 JSON files containing PII in plaintext.

The exposed records consisted primarily of images of complaints or code violation reports, but after analyzing a limited sample, Fowler found the database held people’s names, postal addresses, email addresses, phone numbers, and “thousands of internal records dating from 2016 to 2026”.

This kind of information is a gold mine for cybercriminals. By knowing private information about their targets, they can create custom, personalized phishing messages, increasing their chances of success. Data like this is frequently shared and sold on the dark web, and is often used as leverage in ransomware negotiations.

CitySourced reacts

The exposed repository contained different top-level application directories, Fowler explained, listing names such as Api, Content, Customers, Data, Developers, FileStorage, json, Product, Public, Support, Widget, temp, Logs, and others. Apparently, the archive also contained multiple .sdk and .exe files - which are quite out of place and could indicate that someone tried to plant malware.

The name of the database and files inside led Fowler to conclude they belonged to a US company called CitySourced. This is a US civic technology company (GovTech) that develops software that residents can use to report local issues such as potholes or malfunctioning streetlights to municipal authorities. It was founded in 2009 and merged with Rock Solid Technologies in 2019. Three years later, the company was acquired by government technology provider Granicus.

When reporting on these databases, Fowler usually stresses that owning and operating are two different things, and that he could not determine if a third-party contractor managed it or not. Still, after reaching out to CitySourced, the company locked the database down and thanked Fowler for his efforts:

"Thank you again for the responsible disclosure and for following up,” CitySourced said. “Granicus has reviewed the information you provided, investigated the matter internally, and is taking action to address the issue."

How to secure a database

Misconfigured databases continue to be one of the leading causes of data leaks. Some businesses don’t know they are responsible for the security of the data they create and instead believe it’s the responsibility of their cloud provider. Others are simply unaware of the misconfiguration, leaving data widely available and risking reputational damage and even class-action lawsuits.

Fowler says businesses can secure their infrastructure by segmenting customer environments and internal data.

There is no reason for all eggs to be in one basket, so in case of a compromise, configuration error, or unauthorized access involving one tenant, information belonging to other organizations remains secure.

“Storage systems, backups, and sensitive data should be encrypted and protected against unauthorized access,” he added. “Tenant isolation, access controls, and encryption provide a good first layer of defense that could limit the overall impact of a data security incident.”

Individuals should assume that cybercriminals already know something about them. There were so many breaches over the years that it’s almost impossible anyone’s data remained entirely private - at least things like names and emails. Therefore, they should always approach incoming email with skepsis, especially unsolicited ones, and those carrying links, attachments, or messages of utmost urgency.

• Kaspersky says Lazarus's Operation FlashHole, active since at least July 2025, hit at least three South Korean software, construction, and telecom equipment firms
• An updated LPEClient tool uses four ML-KEM-1024 key exchanges to protect payload delivery, a design Check Point also documented
• The post-quantum layer guards traffic against future decryption, not endpoint detection, and the most likely way in for the hackers was still phishing

North Korea's most notorious hacking group has been caught protecting its malware with the same post-quantum cryptography that governments and tech firms are still rolling out to safeguard their own data.

In its analysis of a campaign dubbed Operation FlashHole, Kaspersky's Global Research and Analysis Team (GReAT) says an updated version of LPEClient, a Lazarus Group tool, now uses ML-KEM-1024, a key exchange mechanism designed to resist attacks from future quantum computers, to secure the channel it uses to download more malware.

The findings describe a campaign active since at least July 2025 that has hit at least three South Korean organizations in the software, construction, and wired communication equipment manufacturing sectors.

A fake AI-tailored résumé, a mandatory plugin, and quantum-resistant encryption

The way in was familiar: Kaspersky found a GitHub Pages site tied to a GitHub account, created in September 2025, that the attackers used for command and control. The site first showed the résumé of a supposed senior network appliance developer, likely seen by an employee of the communications equipment maker, before the attackers swapped it in January 2026for an interior design showcase that probably targeted the construction firm.

Kaspersky assesses with medium-to-high confidence that targets received spear-phishing emails linking to these sites, which loaded JavaScript from attacker-controlled domains, though it could not determine exactly what triggered the infection.

From there, the chain ran through INISAFE CrossWeb EX, financial security software South Koreans need in order to use many online banking and government websites. How it was abused is unclear, but the malware ended up running in memory with elevated privileges, spawned by a CrossWeb EX build released in 2023 after a public advisory from South Korea's KrCERT.

That is a well-trodden route; Kaspersky says Lazarus abused CrossWeb EX in 2021, 2022, and 2023, and in Operation SyncHole, disclosed in April 2025, it used Cross EX, a related program, to compromise at least six organizations, and we also reported on the group exploiting a zero-day in MagicLine4NX, another South Korean authentication tool.

Kaspersky believes the photo on the résumé site was AI-generated, citing missing EXIF metadata and an unnatural texture, and that AI most likely built the site too, given a candidate name resembling Korea's equivalent of "John Doe" and a portfolio stuffed with filler details and unrelated companies.

ojun Ryu, senior security researcher at Kaspersky GReAT, said the findings suggest Lazarus is "bringing AI into its long-established playbook," a shift Kaspersky has also seen among other Lazarus-aligned groups. That fits a broader pattern, from Kimsuky using ChatGPT to forge a South Korean military ID to North Korean IT workers using generative AI to get hired at Western firms.

The more striking change is inside LPEClient, a profiling and payload delivery tool that first appeared in 2019. The new version no longer stores its own server address; instead, it relays traffic through ClientHub, a newly discovered loader with a variant that talks to its operators via Dropbox. It profiles installed security products and the Windows patch level, now also checks whether protections such as Shadow Stack are enabled, and encrypts that report with GOST, Russia's national cipher standard.

A security-conscious hacker group?

Then comes the post-quantum part of the equation. The server sends four ML-KEM-1024 public keys, LPEClient derives four shared secrets from them, and those are combined into a single 128-byte key for Threefish, a tweakable block cipher originally built for the Skein hash function. That key decrypts the next payload, which is loaded straight into memory.

ML-KEM-1024 is the strongest of three parameter sets in NIST's FIPS 203 standard, and the one the NSA specifies for key establishment under CNSA 2.0, its algorithm suite for US national security systems. Kaspersky's report notes, with some irony, that the group seems to have "adopted more secure post-quantum cryptography faster than many legitimate security products."

Ryu said the part that "deserves closer attention" is the group's "adoption of cryptography designed to withstand future quantum threats," which Kaspersky traces back to at least September 2024. If that holds, Lazarus was using the technology within weeks of NIST finalizing its first post-quantum standards on August 13, 2024, and more than two years before this month's disclosure.

Kaspersky is not the first to spot this, either. In August 2026, Check Point Research described a module in a separate Dream Job wave against defense companies that fetched four public keys from its server and used Kyber/ML-KEM to agree on a key to download FudModule, a rootkit that exploited the since-patched Windows zero-day CVE-2026-68820. Kaspersky identifies the module as LPEClient, and the campaign received widespread coverage at the time.

No publicly known quantum computer can yet break the classical key exchanges that protect most internet traffic, so ML-KEM only gives Lazarus an edge if someone records its traffic today and decrypts it once such a machine exists- the "harvest now, decrypt later" scenario driving the civilian migration.

For a state espionage operation whose opponents include well-funded intelligence agencies, keeping its tooling sealed against that possibility is a rational, if forward-looking, choice. Kaspersky's own reading is that the group wants to hide its later-stage payloads.

It does not, however, hide the malware where it runs; the post-quantum layer protects data in transit, and Kaspersky's analysis of the malware itself laid the whole exchange bare. Kaspersky says the work points to a dedicated developer, and the rest of the toolkit supports that view: ClientHub uses the SNOW stream cipher, a first for Lazarus according to Kaspersky, and copies headers sent by Chromium-based browsers to blend in.

Kaspersky believes the focus on software firms, the only sector hit in both SyncHole and FlashHole, reflects an appetite for source code that can be mined for new vulnerabilities. It also distinguishes FlashHole's espionage from a parallel cluster of attacks built on Lazarus's COPPERHEDGE backdoor that appears to be about making money.

For potential defenders, the lesson is the delivery rather than the cryptography: a convincing fake résumé and a trusted security plugin. Kaspersky's advice, which also promotes its own products, covers verifying unexpected links even when they lead to polished professional sites, patching quickly, removing unneeded components, restricting user privileges, and watching connections to cloud services such as GitHub and Dropbox that can double as command channels.

Since the post-quantum layer does nothing to hide what the malware does on the machine itself, capable endpoint protection software remains the realistic place to catch it. Whether its newly-found AI-assisted approach is a game changer, however, remains to be seen.

Now that I've seen and touched the touchscreen MacBook Pro, I'm starting to understand that, despite the invention of a Frankenstein-ed new display term ('PROLED'?), this display might be something special. It looks extraordinary, and when compared visually with, say, the Lenovo Yoga Pro 9i Aura Edition, which also has a Tandem OLED, it doesn't even seem to be of the same species.

There are good reasons for this, which span from the fabrication process to the core specs of what is clearly Apple's most advanced laptop display yet.

Starting with manufacturing, Apple says it employed an unnamed manufacturing partner to build these panels in what's known as a Gen-8 OLED Fab. Seeing as there are just four of these cutting-edge facilities in the world, and that one of them is operated by Samsung Display, which has reportedly partnered with Apple on display tech previously, I'd guess it's Samsung.

One of the most notable features of these manufacturing facilities is their massive size. Whoever the partner is, we know that the touchscreen MacBook Pro's panels are being manufactured in a chamber around the size of the Colosseum in Rome. These huge facilities improve yield, efficiency, and costs.

Though less than a millimeter thick, the laptop PROLED XDR panel is comprised of 50 layers. Even what appear to be individual panels have many layers, sometimes just a nanometer thick. The two stacks of OLED have, for instance, 30 layers, though the organic self-emissive material is layered onto the panels and dried, making the layers range from one nanometer to hundreds of nanometers thick. FWIW, I held some of these individual panels, and they are incredibly thin and light.

Behind the OLED is the TFT (thin-film transistor) glass substrate that powers and drives the imagery on the surface.

What's not mentioned here is the digitizing layer (basically the same touch technology you find on the iPhone and iPad) that drives touch; that's because it's integrated with the whole in a process that, if it isn't already, probably should be patented.

Despite working with a third party, the production is another Apple trademark bespoke process, and one not necessarily replicated in other Tandem OLED or even basic OLED display manufacturing processes.

The specs bear that out. Where the Lenovo Yoga Pro 9i Aura Edition touch display has a pleasing 1,000,000:1 contrast ratio, Apple's touchscreen MacBook Pro boasts 10,000,000:1. In person, and even under bright lighting conditions, the blacks and definition I saw on the touchscreen MacBook Pro PROLED XDR are stunning.

The MacBook Pro display also looks better because Apple equipped it with up to 2,000 nits for HDR and SDR content, and both an anti-reflective screen and the option of the nano-etched one, as well. Essentially, I could see myself reflected in the Lenovo, and could not detect my reflection in the MacBook Pro.

Also, for those concerned about fingerprints collecting on the touchscreen MacBook Pro, Apple has applied an oleophobic coating to the standard and etched displays. In my hands-on time with several of the new laptops, I didn't notice any significant fingerprints.

Compared to the Lenovo Yoga Pro 9i's 1,600 nits, the touchscreen MacBook Pro looks better equipped for working in direct sunlight. Based on what I saw, the MacBook Pro also maintains much better off-axis color quality.

Looking beyond direct visual comparisons with pro-grade Windows laptops, Apple is positioning the touchscreen MacBook Pro display as both a color reference screen and one that has grayscale precision reportedly sufficient for medical diagnostics. This is basically a reference monitor on a laptop frame.

So, sure, the story is that we finally have a touchscreen MacBook, but it may be the visual quality that ultimately wins over creative, business, medical, and film professionals. It's probably the best display Apple has ever produced, not just for a laptop, but possibly for any Mac system.

Of course, a screen panel alone does not make a laptop, and there are questions around whether everyone wants or needs touch, if the redesigned hinge is stable enough to keep the laptop from wobbling with every touch — and if touch capability is worth the almost $1,000 premium.

• Report says AI is being given too much authority and autonomy to handle business-critical security decisions
• 70% of organizations delegate decisions to AI that would have been made by a human 12 months ago
• A “control gap” exists between the authority given to AI and an organization’s ability to audit it

Delegating complicated decisions to AI is leading organizations to place relatively new technology in charge of user permissions, in control of sensitive data, and risk security issues, new research has claimed.

A study by Illumio looked into how organizations are handing decision recently performed by humans to AI, without apparently taking into account the potential for serious issues to arise.

It found the majority (70%) of organizations are delegating previously human-made decisions to AI, but only around half (49%) can see what action is taken by an AI agent an audit it.

AI recommendations

The nature of AI agents makes this a particularly risky strategy, and the research has found that an incredible 56% of organizations are willing to accept greater cyber risks than 12 months ago. Almost half of that group (47%) have admitted to permitting AI actions in production environments.

Allowing AI agents to have free run of enterprise data, applications, and infrastructure is leading to wholly avoidable situations. Illumio’s research found that a control gap between the rules that organizations believe AI agents are operating within and what the technology is actually capable of.

Some 76% of organizations have experienced one or more security issues thanks to AI in the past year, with 35% revealing that following AI recommendations would result in a security risk. Meanwhile, 26% reported AI agents or tools had connected to other systems without the necessary approval.

More worrying is the 24% of organizations reporting AI’s drive to access data it shouldn’t be able to see, and another 24% stating it has triggered (or produced) an unauthorized action.

Strict limits

Of course, AI is already used within cybersecurity, and has proved successful with multiple vendors rolling out AI-enhanced solutions. But while 67% of organizations are using AI cybersecurity tools, 32% let AI conduct investigations without human oversight and 29% permit the software to deploy code changes completely unsupervised.

“The biggest AI risk may not be a system that breaks its rules. It may be one that was never given meaningful limits in the first place," noted Raghu Nandakumara, VP of Industry Strategy at Illumio.

Unleashing AI agents without constraints has left businesses struggling to control the software.

As Nandakumara observes, AI agents are persistent, and attempting to outwit their next move is pointless. Instead, “businesses must set strict limits on what they can access and do, then enforce those limits within the application and across the underlying infrastructure. That is how you contain unexpected behavior before it causes real damage.”

• Attackers used SEO-poisoned GitHub pages and fake AI clients to lure victims into downloading malware
• The Yoba malware establishes persistence, evades analysis, and ultimately deploys XMRig cryptominers
• Campaign abuses interest in popular AI tools like GPT and Claude to monetize victims’ computing resources

Cybercriminals are, once again, exploiting people’s interest in AI tools to distribute cryptojackers and make money - this time around, opting for a combination of spoofed popular products, trusty old GitHub, and a little SEO poisoning.

The campaign was spotted by security experts from Check Point Research (CPR), who’ve been tracking it for the past two months, noting that the unnamed attackers created fake downloadable clients for GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, and hosted them on GitHub.

Usually, when threat actors spoof legitimate software and try to disseminate it via GitHub, they go the extra mile to feign legitimacy - they artificially inflate download numbers, deploy bots to ramp up stars or forks numbers, and post fake comments. That way, when a victim opens the page, they have no reason to doubt they’re looking at legitimate, popular software.

In this case, however, they didn’t bother with GitHub. However, CPR says that the pages still appear at the very top of Google’s search engine results pages for certain keywords, indicating that they’ve invested heavily in SEO poisoning.

SEO poisoning

Search Engine Optimization (SEO) poisoning is a simple practice - criminals purchase hundreds (if not thousands) of articles, blogs, and social media posts on the dark web, and have them uploaded and published across the internet.

Each post carries a link to the desired GitHub page, giving Google the signal that that specific page is popular and relevant for certain terms.

As a result, Google pushes it to the top of its results, unknowingly aiding the attackers into reaching their targets quicker. The attackers have also created separate GitHub websites to serve as descriptions for the applications and linked them directly to downloadable installation files.

As a practice, SEO poisoning was popular even before the advent of AI, but now it’s gotten even easier, since the tools can easily generate as many articles as needed, for a fraction of the previous cost. Obviously, these texts are extremely low-quality, and Google has been working on labeling them as spam, but the process is still ongoing.

When victims land on these GitHub pages and download the executables, they think they’re getting a standalone client for an AI tool. What they’re getting instead is a piece of malware called Yoba.

Once a victim downloads and runs it, Yoba establishes persistence by creating a mechanism that would launch it automatically every time the system restarts. Average computer users might have a tough time spotting it, too, since it presents itself as legitimate Windows software.

Yoba then checks the device it’s running on to make sure it’s not in a sandbox, or infecting someone in a “friendly” country. It can deliberately delay execution for two weeks to make analysis more difficult, and checks the computer’s keyboard to avoid infecting systems from Russia, Belarus, Kazakhstan, and Uzbekistan. CPR did not say where the attackers are from, but this filter could give a strong indication.

Deploying XMRig

The malware’s final step is to contact the C2 server and pull the final payload. While this can be virtually anything - from infostealers to ransomware encryptors, CPR says it is currently being used to deploy XMRig.

XMRig is an entirely legitimate, open-source program used to mine the Monero cryptocurrency.

Unfortunately, it is extremely popular among cybercriminals because Monero is designed to be a “privacy first” coin and, unlike Bitcoin or Ethereum, cannot be as easily tracked across the blockchain. Mining requires significant computing and electricity resources, as well as for the devices to be connected to the internet. By installing XMRig to countless devices, crooks can generate a hefty amount of tokens, leaving the victims to pick up the inflated energy and compute bill.

Well, it’s finally happened: Apple has got with the times and finally made a laptop with a touchscreen. However, while the new MacBook Pros with PROLED screens look like fantastic devices, I think Apple has made a mistake by putting its first laptop touchscreen on the more expensive MacBook Pro, rather than the more mainstream MacBook Air… or even the MacBook Neo.

The 14-inch MacBook Pro with a touchscreen starts at $2,899 / £2,899 / AU$4,599, and the 16-inch model starts at $3,399 / £3,399 / AU$5,499. That’s a big ask for most people, especially these days.

Of course, MacBook Pros, as the name suggests, are aimed at professionals, and thanks to their high-end components, they should really be seen as investments that allow you to speed up your workflow.

Interestingly the new touchscreen MacBook Pros come with Apple’s M5 Pro and M5 Max chips. If you want Apple’s latest M6 chip, you’ll need to go for the non-touchscreen 14-inch MacBook Pro that was announced a few days earlier. Perhaps confusingly, the M6 is less powerful than the M5 Pro and M5 Max, and so far there are no hints that Apple is preparing to release M6 Pro and M6 Max chips.

My point is that by putting its first-ever laptop touchscreen on its most powerful — and expensive — MacBooks, Apple is severely limiting the potential audience for the technology. Had it instead put a touchscreen on the more affordable MacBook Air, it could have had a real hit on its hands.

Who’s it for?

As someone who has used plenty of Windows laptops and Chromebooks with touchscreens in the past, I know how useful they can be for certain tasks, and I often miss them when using a MacBook.

Being able to scroll down a website with a finger, turn a page in an ebook, or quickly tap a menu item feels natural and intuitive, and I’m sure it will on the new MacBooks. My daughter, who grew up with touchscreens on everything, would also instinctively poke an often sticky, grubby (kids, you’ve got to love them!) finger at a MacBook screen and be surprised when nothing happened.

These are all pretty simple tasks and gestures. What I've never used touchscreens on laptops for, however, is for complex tasks and tools, such as recording and editing music in Ableton Live, or editing videos in Adobe Premiere Pro.

Instead, for things that needed precision or complexity, nothing beat the good old combo of keyboard and touchpad (or even better, keyboard and a mouse), as well as other external peripherals such as MIDI controllers and drawing tablets. Which leads me to wonder why Apple picked the MacBook Pro, a device that’s supposedly designed for exactly those type of tasks, to showcase its first laptop touchscreen.

If you’re dropping $3,000+ on a touchscreen laptop to mostly just to use the touchscreen for browsing websites, then you’re either super-rich or you should get help with your budgeting.

The 16-inch MacBook Pro with M5 Pro and no touchscreen starts at $2,999 / £2,999 / AU$4,799. As the MacBook Pro with the PROLED XDR touchscreen with the same specs costs $400 / £400 / AU$700 more, that’s quite a premium for the touchscreen.

Yes, I know the PROLED XDR screen offers better image quality as well thanks to its tandem OLED tech (check out our explainer on why this is a big deal), but if you don’t need that additional image quality, which includes better contrast, higher brightness levels, and support for the Adobe RGB color gamut, and are just interested in the touchscreen, then essentially yeah, you’re paying $400 extra for it.

If you’re a professional, especially one in the creative industry, you’ll need to think long and hard if that investment is worth it. Meanwhile, the likes of the MacBook Air and MacBook Neo aren’t really used for complex creative tasks, and instead used for casual day-to-day use, where touchscreens are much more useful.

Granted, adding an extra $400 / £400 / AU$700 to the price of a MacBook Neo or MacBook Air wouldn’t be great, especially as they’ve just had a price bump earlier this year, but Apple wouldn’t need to include the OLED tech and advanced image-quality options included in the MacBook Pro. A touchscreen MacBook Neo for $899, say, could be a real hit, especially if Apple was to also keep the non-touchscreen model for people who still want the ultimate affordable way to get into the Mac ecosystem.

This isn’t just an Apple problem, of course. The new laptops powered by Nvidia’s RTX Spark SoC, which are aimed at the same creative professionals and heavy local AI users as the MacBook Pro (with similarly high price tags), come with touchscreens. I’ve spent a decent amount of time with each one at various events, and I found that the touchscreen was the least-used part of the laptop — in fact, I often forgot those laptops had one. Because there aren’t cheaper, non-touch, models, though I didn’t resent its inclusion.

As I said, I do get the appeal of touchscreen laptops, but I find the technology is best used in 2-in-1 devices where the keyboard can be flipped behind the screen (or removed entirely) so that it can be used as a tablet-like device.

In an ideal world, then, Apple would have put its touchscreen on an entirely new 2-in-1 MacBook, but I can’t see that happening any time soon. Apple sort of has a device like that — the powerful iPad Pro, which can be paired with a Magic Keyboard that turns it into a touchscreen laptop. The problem there, however, is that despite coming with Apple’s powerful M-series chips, the same you’ll find in MacBooks, the iPad Pro is limited to the iPadOS operating system and mobile apps.

Put macOS on that bad boy, however, and allow us to run full desktop applications on it, and hey presto: Apple has a touchscreen MacBook that utilizes the tech in a way that’s actually useful. Until then, I’ll stick with my standard MacBook Pro, and just try to remember not to prod it with my sausage fingers too often.

• YouTube announced it's hit 150 million subscribers across Premium and YouTube Music
• The platform also generated $11.2 billion in ad revenue
• Users say free tier ads are only getting worse, with some calling them 'unbearable'

YouTube announced that it has surpassed a whopping 150 million subscribers across its Premium and YouTube Music experiences — marking a huge milestone for the video platform and one of the best music streaming services.

Alphabet Inc CEO, Sundar Pichai, announced the figures in the platform’s Q3 earnings release on Wednesday (October 28), which increased by 25 million from a total of 125 million subscribers in March 2025, though individual numbers for Premium and YouTube Music weren’t disclosed. Pichai also shared that YouTube’s ad revenue rose to more than $11.2 billion compared to $10.3 billion in 2025.

Speaking about the milestone, Google’s Chief Business Officer, Philipp Schindler, said "With Premium and Premium Lite, viewers have choice. As more people opt into premium experiences, it’s a win for viewers, creators, and our business. Subscriptions help fund the creator ecosystem and drive the platform forward."

YouTube has accumulated over 25 million subscribers between now and when it last confirmed its total membership count in March 2025. When you break that down, that’s approximately 1.25 million new subscribers signing up each month, and it’s only going to increase.

While it’s not a traditional on-demand film and TV content platform, YouTube has emerged as a serious competitor among the best streaming services. In 2017, the company launched YouTube TV, and according to a recent report from Nielsen, it has surpassed Netflix in popularity for TV viewing. In July 2026, 49% of TV time was viewed via streaming platforms, with YouTube making up 14.2% of that, followed by Netflix at 7.8%.

There’s no denying YouTube Premium is rising in popularity, but as the company puts more effort into improving its paid services, a number of users have said its free version is becoming increasingly difficult to use because of the number of ads.

Earlier this year, I bit the bullet and signed up to a YouTube Premium free trial and, annoyingly, the experience was vastly more enjoyable. Not only does it grant you ad-free viewing, you get background and offline listening, as well as small but handy control tools and full access to YouTube Music. But once you go back to its free version, that’s when you truly realize how out of control YouTube’s ads have become — and I’m not the only one who’s noticed (see below).

In addition to YouTube’s ‘completely unbearable’ ads, users have also pointed out the rise in AI-generated sponsored content which one Redditor claims advertise "obvious scam products". The combination of the two is the main catalyst for users abandoning YouTube as a platform altogether, and tech-savvy users are already opting for alternative ways to bypass ads.

One of the most popular ways YouTube viewers are working their way around ads is downloading browsers such as Brave, which users on Reddit have praised. Browsers like this come with built-in ad blockers, so it can automatically skip over ads when you’re streaming YouTube for free.

While YouTube gives you the option to tailor your ad experience and block certain types of promotional content, some users claim that when they do this, YouTube only feeds these ads to them even more. One user on Reddit used Old Spice as an example, saying "it's like blocking them has a reverse effect." Similarly, another user had an experience where they reported a potential scam ad, only for YouTube to email them with a counterargument.

I’m with a lot of other users who continue to call out YouTube for how expensive Premium has become (it now costs $15.99 / £12.99 / AU$22.99 a month), especially when you factor in your existing streaming subscriptions, so many of us just put up with its free service. Despite enjoying what Premium had to offer during my free trial, it doesn’t justify adding another subscription plan to my roster — my bank account will fall out with me.

• Attackers abused camera management software to gain initial access and establish persistence on networks
• Campaign used DLL sideloading and reverse shells to evade detection and maintain control
• Researchers urge treating camera systems as security-sensitive assets and monitoring them for abnormal activity

Security researchers have warned of an ongoing campaign targeting an apparent vulnerability in camera management software. The vulnerability is being used for initial access, allowing threat actors to establish a foothold on company infrastructure.

The warning bells were sounded by security outfit Huntress, whose researchers Harlan Carvey and Lindsey O'Donnell-Welch said that in September and October 2026, they observed a “handful of incidents” originating from camera management software.

In all cases the attackers abused a legitimate camera management system to side-load a malicious DLL file and gain access to the underlying system.

Who watches the watchmen?

Surprisingly, the team could not determine which camera software was being targeted, nor by whom.

“Huntress analysts were unable to determine the full name or creator/vendor of the software, as the file did not contain an embedded File Version Information section,” they said.

However, they did find an executable containing a few notable strings, which led them to believe a Korean company called 3R Global could be involved. They couldn’t confidently say that the Camera Management System (CMS) executable was downloaded from that company’s website, though.

Unfortunately, without knowing the exact name of the software being targeted, it is impossible to tell how many victims there were, or how big the attack surface is. Huntress’ “handful” designation does very little to explain just how dangerous this vulnerability is.

While the lack of key data limited their visibility into exactly how the threat actors were compromising the software, they could see what they were doing once they were inside - launching a reverse shell and side-loading malicious DLLs.

Once the initial access had been established, the attackers would drop a file named rs.win32.exe to the endpoint and would launch it via a command line. The command line would supply a remote IP address and port, and include an admin username.”This led us to see this as a reverse shell,” they said.

From there, they would drop a file called WpcMon.exe - a legitimate Microsoft Windows Parental Control Monitor file, used for parental-control and activity-monitoring features. In this case, however, the file is used to load malicious DLLs called IPHLPAPI.DLL and samcli.dll. On the surface, both appear to be legitimate zlib compression libraries, but in fact, they were changed to provide beaconing, contacting the external C2 server from time to time.

Huntress watches the watchmen watching the watchmen

“Part of the infection process also included creating persistence by adding a reference to the newly installed WpcMon.exe in a value beneath the user's Run key,” the researchers explained. “Threat actors typically add a program path to a user's Run registry key so Windows automatically launches their payload whenever that user signs in.”

Side-loading malicious DLL files is a popular infection technique. Instead of deploying an obviously malicious program (which might get flagged by antivirus products), the attackers drop a DLL file containing weaponized code, and then get a legitimate program (such as the parental control software) to run it. Since the process starts with a legitimate executable, it is more difficult to identify as malicious.

It does not guarantee evasion of security software, though.

Defenders should treat cameras and their management platforms as potential entry points into the broader business environment, Huntress warned. They should inventory the software, restrict its access, and monitor for unusual processes and outbound connections.

The researchers also advise defenders to use application control to prevent unapproved executables and DLLs from running in user-writeable paths, and to investigate the sequence of CMS.exe, rs.win32.exe, abnormal WpcMon.exe, and unapproved outbound connections.

• FBI and international partners seized infrastructure tied to Virtualine, a hosting provider allegedly serving cybercriminals
• Authorities say the service facilitated phishing, ransomware operations, illicit crypto activity, and other crimes
• Investigators seized servers and customer data, though no arrests have been announced so far

The FBI has announced it seized the website of Virtualine, a bulletproof hosting service that allegedly allowed child pornography, laundered stolen and extorted crypto, and facilitated a wide range of other criminal activities.

The operation was carried out in partnership with German and Dutch authorities, as well as multiple private companies, with police raiding a data center in Limburg to seize “dozens of physical servers” that also hosted “hundreds” of virtual servers. As a result, they gained access to information about more than 3,000 of Virtualine’s customers, it was said.

“The police are currently taking follow-up actions towards these users,” the Dutch police said, although it’s difficult to say how valuable the information will be, since most bulletproof hosting providers don’t ask for private data, and criminals are good at hiding it, as well.

Bulletproof hosting

Every website, including hacking forums, criminal service providers, even fraudulent landing pages, needs a server that hosts it. Hosting providers renting out these servers are generally compliant with law enforcement agencies, so when the police requests a takedown or files a complaint, most of them comply. However, there is a subset of hosting providers, colloquially called “bulletproof hosting”, which are unusually resistant to pressure from the authorities.

It doesn’t mean all of them are inherently illegal or malicious. There are cases where such services are necessary - in countries with strong censorship, or where website owners want to protect their identities.

In this case, however, Virtualine was openly criminal, with the US Department of Justice (DOJ) saying it advertised its services to criminals on cybercrime forums saying, on at least one occasion, “You can use Virtualine for all illegal/black hat activities (including phis[h]ing, carding, email spam, port scanning and all others) except for child contents and terrorism activities.”

The company took it a step further. In March 2026, it introduced an “additional protection plan” that offers customers who receive takedown requests “another shell company not affiliated with Virtualine, after which the server is reactivated.”

Interestingly enough, Virtualine said it did not accept child porn or terrorism content, but according to the DOJ - did exactly the opposite.

One of its clients created a forum that allowed users to post and sell access to “nude, sexually suggestive, and/or sexually explicit images and videos of minors and adults,” while also promoting a hack-for-hire service that broke into people’s accounts and stole their explicit photos and videos. Virtualine was even notified about it by law enforcement agencies from Germany, Canada, and Australia, but decided to ignore the warnings and continue hosting the client.

At the same time, Virtualine’s customers were allowed to pay in Bitcoin, offering an unhosted bitcoin address that allowed customers “to direct pay without concern their funds would be flagged as illicit”. Citing Chainalysis data, BleepingComputer said the company’s wallet was seen receiving funds from ransomware operations, infostealers, Russian-language cybercrime forums, and more.

“Virtualine then laundered those proceeds to conceal their origin,” the blockchain company added.

Piercing the kevlar

Besides confiscating the servers and the data, the main website - virtualine.net - was defaced and now shows the usual FBI “this website has been seized” message. Unfortunately, no arrests have been made, which means the service will most likely continue operating.

According to BleepingComputer, it is “partially online” but its network prefixes currently have very low routing visibility, which could mean that much of its infrastructure was pulled offline.

Usually, disruptions such as this one are only temporary, and it won’t take long before they are remedied and the service becomes fully operational again.

• Ofcom has assessed the best ways of enforcing age checks online
• The regulator also identifies methods that aren't effective
• Around 4 in 10 under-16s plan to try to get around the ban in the UK

Back in June, the UK government ruled that under-16s should be banned from social media platforms, with enforcement scheduled to start during the first half of 2027. Now the communications regulator Ofcom has set out the ways it expects tech companies to abide by the law.

In its new announcement (via the BBC), Ofcom highlights four "highly effective" methods for keeping under-16s out of apps and off sites they shouldn't be accessing — and they're all going to be familiar to anyone who's used age-gated services online in recent times.

The four methods are photo ID matching (using something like a passport or driving license), bank-based checks (Ofcom says 90% of UK 16-17 year-olds have a bank account), digital ID services (a third-party service like EasyID or Yoti), and facial age estimation via a webcam (which Ofcom says is best deployed as a secondary check).

This is a "rapid assessment" from Ofcom, and none of these approaches are confirmed yet — UK lawmakers will take the suggestions on board, and decide the best way to enforce the rules at a later date, most probably before the end of the year. All of these methods can be delivered "in a way that protects users' privacy" according to Ofcom.

Ultimately though, it will be down to tech companies to decide how to implement age checks that fulfil the requirements set down by the government. "Here are things that can work, they must preserve privacy, they must protect people's data, but it's on you to put in place what you think works for you," Ofcom CEO Dame Melanie Dawes told the BBC.

Challenges ahead

Ofcom also lists checks that it thinks are ineffective: self-declaration, general contractual agreements, and verifiable parental consent. The regulator also acknowledges that "the risk of circumvention cannot be entirely eliminated", but says that correctly implemented safeguards should "significantly reduce the likelihood" of unauthorized access.

In its rapid assessment announcement, Ofcom also encourages app stores to take more responsibility over age checks. Right now, self-declarations are most commonly used to unlock downloads for age-restricted content.

These are going to be tough rules to enforce, whatever the approach is: recent research from EE suggests that 42% of 11-15 year-olds are planning to try and get around whatever restrictions are put in place. This could be by switching to apps or platforms not covered by the new laws, including messaging services and gaming sites.

Last week Ofcom also admitted that the Online Safety Act introduced in July 2025 had so far made "no significant change" to the harmful content children had been exposed to online. The act was intended to ensure protection from content involving pornography, serious violence, suicide material, racism, misogyny, and bullying.

"This finding is concerning and shows that further progress is needed to protect children online," says Ofcom. The regulator also recommended adding material around body stigma and depression to the primary content categories that children should be protected from online.

Analysis: What do privacy experts think?

Ofcom's proposals are likely to spark some familiar privacy concerns — and security experts told us they aren't without foundation.

“The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check," said Pieter Arntz, Senior Malware Intelligence Analyst at Malwarebytes. "Photo ID matching brings highly sensitive documents and facial images into the process, potentially creating another attractive target for criminals. The risks aren’t hypothetical: as I reported last year, a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users," he said.

Even if facial estimation techniques are more secure, there are are still downsides. "Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction," Pieter Arntz added. "Ofcom itself acknowledges that some technologies have a margin of error of a few years at 16, meaning people near the threshold may face an additional verification check," he said.

"My preference is double-blind verification: a provider confirms that you meet the age requirement but doesn’t learn which service you’re accessing, while the service receives proof of age without learning your identity. Proving you are old enough should not mean revealing who you are," he said.

Others feel the risks are more around teenagers finding workarounds.“The challenge for social media platforms is that teenagers don’t like to be told ‘no’. Many will conform, but tech-savvy young people are going to search for an open window on the ground floor," said Olli Krebs, SVP EMEA at the identity verification software provider Incode. "If the process is clunky, users of all ages will actively seek ways around it," he added.

Those workarounds could unintentionally make the problem worse. "The experience of countries such as Australia is that there will be a real risk of an increasingly technologically sophisticated population of young people will resort to a variety of circumvention techniques (primarily, but not exclusively VPNs) to access content hosted outside of the UK," said Will Richmond-Coggan, Partner specialising in Data and Privacy Disputes at Freeths.

"Such content is liable to be less well regulated generally, and to pose further risks of users gaining unsupervised access to progressively more dangerous and problematic content in relation to which the UK online safety legislation is largely powerless to take action," he added.

“None of this will be perfect. Young people will always push boundaries, and anyone promising a hundred per cent online safety is being unrealistic," concluded Olli Krebs from Incode. Exactly how successful it is depends very much on how the social media giants implement Ofcom's suggested age-check methods.

What you think of the social media ban, and Ofcom's new proposals? Let us know in the comments below.

• Sony Network Communications discloses breach affecting roughly 2.5 million ISP customers and former users
• Exposed data included personal details, while some email service users also lost email passwords
• Company contained the intrusion, notified authorities, and warned customers about phishing and fraud risks

A subsidiary of Sony Network Communications, the Japanese tech giant’s Internet Service Provider (ISP) arm, has confirmed suffering a data breach which saw it lose sensitive data on roughly 2.5 million people.

Among the stolen files were people’s phone numbers, email addresses, and in some cases - email passwords.

The company confirmed the news in an apology and notice letter in which it said threat actors accessed So-net, the company’s consumer-facing ISP service brand. The identity of the attackers was not disclosed, and nor was the method they used to break in. The breach happened on Monday, October 19 2026, and was spotted four days later, on October 23.

“Immediately after confirming the incident, we shut down the affected server and blocked communications from the source of the unauthorized access,” the machine-translated letter reads. A day later, the investigation determined that the attackers exfiltrated a total of 2,141,986 sensitive records belonging to both current and former members.

Trickling down to NTT Docomo

Of that number, roughly 1.8 million belong to current members, who had their names, phone numbers, email addresses, user IDs, dates of birth, genders, and internet connection IDs exposed to the hackers. Passwords were not leaked, Sony said.

There were also more than 440,000 records taken from plala (S Course), and this part also affects NTT Docomo, a separate internet service provider that uses Sony Network Communications’ underlying infrastructure as part of its service.

NTT Docomo issued a separate statement, notifying its customers of the incident, and urging them to stay vigilant with incoming emails and other communications:

“There is a risk of suspicious communications from those who misuse potentially leaked information in the future,” the machine-translated notice reads. “Please pay attention to the following points:

・Do not respond to emails, SMS, or phone calls

・Do not open links in the body

・Do not open attached files.”

The company added that the incident affects all Hikari service clients, as well as those that cancelled from May 2026, onwards.

Some So-net members’ email addresses and email passwords were, indeed, taken. A separate set of data affecting Email Service (G), A-Box (an additional mailbox service), So-net VAIO Mail, and PostPet Mail Account Service was nabbed, and the company reported 24,655 affected addresses for Email Service (G), 17,672 for A-Box, 7,005 for So-net VAIO Mail, and 5,069 for PostPet Mail Account Service. The breach affects both current So-net customers, and those that cancelled their subscriptions in March 2026 or later. Those that cancelled by the end of February were not affected, according to the announcement.

Banking data struck, too

Some customers also had their banking data exposed - but not many. “We confirmed the leakage of 16 records containing bank account information, including financial institution name, bank code, branch name, branch code, deposit account type, account number, and account holder's name,” the company said.

It stressed that it does not hold bank account PINs and therefore, they could not have been compromised. “We will individually contact the affected customers to apologize,” the notice reads.

Sony Network Communications said it notified the country’s Personal Information Protection Commission and other relevant government and law enforcement organizations and is currently investigating the attack.

So far, no hacking groups have claimed responsibility for the attack, and the data has not yet appeared anywhere on the dark web. There is also no word of this being an extortion attempt.

The attack comes less than a week after Japanese internet giant GMO Group told its customers to scan their computers for viruses, back up all of their data, disconnect the devices from the internet and then shut them down.

Via BleepingComputer

• Windows 11 has a new preview (optional) update
• This introduces the ability to fully tailor the right-click (context) menu to your liking, as well as speeding up its performance
• That's great, but you're best off steering clear of a preview update and waiting for the full release in under two weeks – but even then, this feature will be on a gradual rollout

Windows 11 now has one of the most-wanted interface capabilities for many people, namely the ability to customize the right-click menu – but it's not quite fully finalized yet (although that's imminent).

The menu that pops up when you right-click on a file (or folder) is also known as the 'context' menu as it presents a bunch of options that vary contextually based on the type of file clicked – but in Windows 11, it's currently a sprawling affair.

Those who hate the lengthy right-click menu will now be able to customize it after installing a new Windows 11 update, although this is an optional release, meaning it's still in preview. This feature will be in next month's patch, the November update, though, so you haven't got long to wait for the full release (less than two weeks, in fact).

The customization settings for the right-click menu include the ability to remove Windows commands you're not fond of – like 'Send to' for example – or add abilities that you'd like to have, and also choose the apps you want to appear in the context menu.

It's a full range of customization and you can also elect to have the top panel of the menu (cut, paste, rename and so forth) directly integrated instead, so these functions appear alongside everything else (in a Windows 10 style – and you can shift the layout around too, moving Properties to the foot of the menu for example).

Microsoft boasts that the new right-click menu is faster, too: "The updated menu opens more quickly, reduces clutter, and gives you more control over the commands and app extensions that appear when you right-click."

As you may have noticed, all this work has been in testing for a while now.

Analysis: rolling frustrations and a lengthy wait

The immediate response on the likes of Reddit seems positive, and there are Windows 11 users who have taken the plunge with this preview update who are observing that the right-click menu is indeed a lot faster.

One Redditor enthuses: "The new context menu is so good! Way faster, customization is cool."

Others acknowledge that this is undoubtedly a good move, but don't understand why it took Microsoft so long to get here: "Not bad imo. Crazy it took them 5 years though."

While the feedback is generally positive, there are complaints from those who have installed the update but haven't received the new context menu. This is because the right-click revamp has been implemented via a gradual rollout, so it's only being drip-fed through to a certain amount of PCs at a time (of those who have installed the optional update). As another Redditor puts it: "Those gradual rollouts though…"

You can force the feature to be deployed to your PC using a Windows configuration utility (ViVeTool), but I wouldn't recommend that approach. Microsoft tests the waters in a limited way for good reasons, especially with features still in preview, so you're running a larger than normal risk of some nasty bug ruining your day.

Anyway, you've waited five years for this performance and options tuning, as those on Reddit are keen to point out – so what's another couple of weeks? I'd hold on for the official November update, keeping clear of this preview, but even then, it'll still be a gradual rollout, and you may need some patience.

Still, the good news is that the context ball is rolling, and it hopefully won't be too long before the majority of Windows 11 users gain access to this important upgrade for a key piece of the UI.

For Apple fans, the touchscreen MacBook Pro PROLED XDR tandem OLED display may be the gift that keeps on giving. Obviously, new integrated digitizing technology made the touchscreen possible, but the ultra-thinness of the display tech can also be credited with enabling the return of a beloved MacBook feature.

The touchscreen MacBook Pro is the first MacBook in almost a decade to feature an illuminated Apple logo on the back. I've seen it in person, and it somehow looks like polished metal when closed, and then a glowing bright white when open.

Apple bringing back the illuminated logo back is directly attributable to the PROLED XDR display. Each pixel in an OLED panel is emissive, which means there's no need for a backlight. Even after Apple made the laptop lid thinner, it still had some room left there — and it turns out there was enough room left to give the Apple logo its own backlight.

As improbable as it seems, there's now a dedicated light for the logo, but not for the rest of the screen. And it still doesn't take up extra space (nor eat up measurable energy).

Do it for the fans

Why did Apple do this? Well, Apple's not telling us, but it's clearly a nod to the fans.

CEO John Ternus tried to tell us the glowing logo was returning in his tiny X tease that showed light shining on the logo, which was on a flat surface. I simply thought it was another way of highlighting the Apple brand, and the big news to come. Granted, I was never that hooked on the old light-up logo.

In fact, my strongest memory around the Apple logo on the back of MacBooks is a conversation I had with Ternus when he was still Apple's hardware lead, during which he explained how Apple milled an ultra-thin and shiny stainless steel Apple logo for the MacBook 12 (the rest of the chassis was brushed aluminum). That was a big deal back then, even if it didn't light up

When Ternus revealed that the glowing logo was returning to the new MacBook Pro during the launch presentation ("the logo is back"), the crowd basically lost their collective minds. It's a big deal.

The illuminated logo also serves another purpose, instantly telegraphing that you're using a special MacBook Pro — the first with a touchscreen.

What Apple is not sharing, though — and it merits further investigation — is how it managed to make the glowing logo look like polished metal when the laptop is closed. It's an engineering secret that I suspect Apple execs and engineers will take to their graves, even after the inevitable teardown.

• Knicks employees expecting free championship rings received mandatory cybersecurity training instead
• A fake championship ring offer exposed employees to an internal phishing test
• Madison Square Garden admitted that using championship jewellery as bait was inappropriate

The New York Knicks have faced criticism after sending employees an email promising complimentary NBA championship rings that turned out to be a cybersecurity exercise.

Staff members who accepted the invitation were reportedly required to complete cybersecurity training instead of receiving jewellery commemorating the franchise's historic victory.

The incident involved workers at Madison Square Garden, where expectations of receiving championship memorabilia had already grown following the team's successful season.

Fake championship ring offer triggers mandatory training

The deceptive message circulated in late September, offering recipients personalized jewellery supposedly manufactured by the same company responsible for producing players' rings.

Employees could select between two advertised designs, Championship Gold and Garden Classic, before following a link to register their preferred choice.

However, the invitation was actually part of an internal security assessment intended to identify workers susceptible to fraudulent messages and credential theft.

Those who followed the instructions were reportedly assigned compulsory cybersecurity lessons, although the organization has not disclosed how many employees were affected.

Joe Vardon, a senior NBA journalist at The Athletic, reported that several individuals familiar with the situation verified the exercise's purpose.

The report also raised questions about whether the invitation contained recognizable warning signs that might have helped employees identify the deception.

Such exercises commonly use suspicious addresses or misleading website links, although the specific indicators included in this particular message remain unknown.

The controversy followed the Knicks' first NBA championship since 1973, making the promised jewellery particularly significant for employees celebrating the achievement.

Receiving commemorative jewellery was also a reasonable expectation because NBA organizations commonly distribute less expensive versions to personnel outside their playing squads.

Madison Square Garden acknowledges its mistake

Madison Square Garden Sports subsequently acknowledged the incident, describing its decision to exploit employees' expectations as inappropriate.

“Using the rings as a lure to gain employees’ attention was an unfortunate mistake,” it said in an official statement.

The organization explained that its security concerns stemmed from an earlier cyberattack in which employee credentials were compromised through a similar fraudulent communication.

Hackers had reportedly used those credentials to access company systems and subsequently extort the organization, prompting additional efforts to improve employee awareness.

The company also disclosed plans to distribute more than 275 commemorative items among players, coaches, employees and other individuals associated with the franchise.

According to the organization, those gifts, comprising championship rings and other jewellery, carry a combined estimated value exceeding $3.7 million.

However, the distribution arrangements have attracted attention because several assistant coaches initially received empty presentation boxes during the championship celebration.

The assistants are expected to obtain their rings later, although numerous long-time arena employees and business personnel reportedly remain excluded entirely.

The organization has not specified exactly how many workers will receive individual rings rather than alternative jewellery under its announced distribution arrangements.

Via Arstechnica

SteelSeries Sensei Pro Mini: Review

The Sensei Pro Mini brings pro-grade wireless performance to those who prefer less of a handful, thanks to its state-of-the-art polling technology and ceaseless power.

It has the same symmetrical shape as its larger sibling but on a smaller scale. Its size should prove suitable for those with smaller hands, allowing them to get a secure grip around the entire unit. At just 49g, it’s very light, too — lighter than the standard model by 4g — which makes it easy to maneuver.

The sidewalls have a pronounced cinch that forces you to clamp your thumb and ring finger further inwards than is typical, which some may prefer for added security. Grip tape is included in the box if you require more traction, which is entirely possible given the smoothness of the outer shell. The central hump might prove contentious in terms of fit, though: in my experience, it didn’t sit back far enough in my hand, landing underneath my knuckles rather than in the middle of my palm.

To customize and tweak the Sensei Pro Mini, you can use SteelSeries’ GG peripheral software. Here you can rebind all six buttons, with a fair amount of mapping options available, including keyboard inputs and shortcuts for media controls and system actions. You’ll find some standard performance tweaks as well, including DPI adjustments, although the range is larger than you’ll usually find on other gaming mice (between 1 to 65,000). There are five presets to customize, which you can cycle through using the DPI button underneath the mouse.

There are more advanced tweaks in addition to these, though. You can adjust the click response between 0ms and 20ms, and set the lift-off and landing distances independently, each with a range of 0.7 to 1.7 (presumably this refers to millimeters, though no unit of measurement is given). You can also enable a feature called Scroll Jump Protection, which ignores your first scroll unless a second is performed within a certain time of the first. This threshold is adjustable between 100ms and 1500ms. Motion Sync and Angle Snapping toggles are here as well, with the latter featuring a slider with 10 levels to adjust its straightening effect.

This isn’t all, though: a further section lets you adjust acceleration, with several graph curve presets available to alter cursor speed relative to movement speed, as well as the angle of the mouse’s sensor by 45 degrees either side of center to match the natural angle of your hand movements.

Then there are the polling and sensor adjustments. You can set the ultra-wideband (UWB) polling rate and the sensor report rate independently, each with a range of 125Hz to 8KHz (with added 9KHz overpolling). There are five presets containing various combinations of both rates, which can be cycled through using the button on the UWB base station.

GG is clearly laid out and proved fast and stable during my time with it. It also contains explanations for many of its settings, which is something I’m always glad to see. One minor gripe I had is that the actual area to make adjustments and customizations opens in a second window, which is somewhat inconvenient.

The first thing that’s noticeable about the Sensei Pro Mini’s performance is just how smoothly it glides. This is no doubt thanks to the large PTFE skates underneath. There’s almost no friction when gliding over a mouse mat, which makes the Sensei Pro Mini feel incredibly gratifying to fling around, yet also allows for super-controlled slow movements.

Next is the Sensei Pro Mini’s buttons. Clicks are light and snappy enough for quick spams, yet still provide enough feedback to allow for controlled inputs. They also have just enough dampening to make them satisfying to use. The side buttons are great to use as well, being easy to reach and offering a clicky, tactile feel. The same is true of the middle click, and I didn’t trigger miscrolls when using it, since the notching, while light, is tight enough to prevent accidental knocks from registering. This also means that quick flicks and controlled single scrolls are both relatively easy to perform.

My one issue with the inputs concerns the DPI button. It’s underneath the Sensei Pro Mini, which makes it harder to access. This is exacerbated by the fact it’s placed on the thumb side (for right handers) rather than the pinkie side, which means you can’t wrap your fingers underneath to press it without turning the mouse over.

I didn’t experience any connectivity issues with the Sensei Pro Mini. Given the sheer size of the UWB station itself I would’ve been disappointed if I had. Also, the cable provided to connect it to your PC is long enough to give you versatile placement options to avoid interference. It’s a shame a mouse this expensive doesn’t have additional Bluetooth support, though; many other wireless gaming mice feature this, allowing you to hot-switch between two devices.

To power the Sensei Pro Mini, SteelSeries has kitted it out with its ‘infinite’ battery system, something it and a few other brands have used in mice and other peripherals before. The idea is that you’ll never need to go wired (the Sensei Pro Mini doesn’t even have a USB port) to charge. Instead, you’re provided a pair of removable batteries that you cycle between your mouse and the charging dock in the UWB station.

This system works well, as it’s quick and easy to remove and insert the batteries — just as well, since the battery life drains rapidly when every performance setting is at maximum, barely lasting a day. At less intensive settings, though, the battery’s longevity is much better, lasting more like several days.

There will be gamers who would like the reassurance of additional wired support, though, should connectivity be compromised for whatever reason (I’m reminded of inference issues derailing a recent Valorant tournament). At this very high price point, such an addition would be especially welcome, as would Bluetooth. As it stands, the Sensei Pro Mini is an elite gaming mouse with all the wireless performance a pro could hope for, and it’s perhaps only this cohort that’ll see the value in it.

SteelSeries Sensei Pro Mini review: Price & availability

• $179.99 / £169.99 (about AU$260)
• Available now in black and white variants
• Top-end of the wireless gaming mouse market

The Sensei Pro Mini costs $179.99 / £169.99 (about AU$260) and is available now in black or white. A full-size variant is also available for the same price. It comes with two swappable batteries, the UWB base station (which doubles as the battery charging dock), and a braided USB-C-to-A cable, as well as spare PTFE skates and optional grip tape.

Even for a pro-grade wireless gaming mouse, the Sensei Pro Mini is expensive. It’s the same price as the Razer Naga V3 Pro, although that mouse has additional Bluetooth and wired support, as well as a lot more buttons. If you want the same limitless battery power, you can pair it with Razer’s charging mouse mat, although this a costly addition to an already expensive mouse.

Another pointer with a similar battery swapping system is the AngryMiao AM Infinity.97. This is even lighter than the Sensei Pro Mini at 47g. However, its garish style won’t be for everyone, and its software pales in comparison to the tweaking depth on offer in GG.

SteelSeries Sensei Pro Mini review: Specs

Should I buy the SteelSeries Sensei Pro Mini?

Scorecard

Buy it if…

Don't buy it if…

SteelSeries Sensei Pro Mini review: Also consider

How I tested the SteelSeries Sensei Pro Mini

• Tested for a few days
• Used for various tasks, including gaming
• Plentiful PC gaming experience

I tested the Sensei Pro Mini for a few days, using it for not just gaming, but also working and general browsing.

I played Counter-Strike 2, which is a great test for gaming mice, since it demands quick and accurate movements and clicks.

I’ve been PC gaming for over a decade, and used a great deal of pointers in that time. I’ve also reviewed plenty of them before, including the full size Steelseries Sensei Pro.

• Read TechRadar’s reviews guarantee
• First reviewed: October 2026

Apple has unveiled its first OLED MacBook Pro laptops, and that means we've got a new bit of display branding: PROLED XDR. You can have the laptop in 14-inch or 16-inch variants, pre-orders are open now for shipping on or after the 6th of November — and we've gone hands-on with them. Literally, because they're also the first touchscreen Macs.

The name 'PROLED XDR' is a new piece of jargon that Apple's debuting with this machine. So what actually is it?

The short answer is that it's a 'Tandem OLED' panel, which means that it uses multiple layers of organic light-emitting diodes — in this case, two layers. Two OLED layers are better than one because the result is considerably brighter than a single-layer OLED: you literally have two OLEDs firing per pixel. It also boosts longevity, because each of the two layers doesn't have to work as hard, so they have a longer lifespan and are more likely to avoid burn-in.

Apple has stayed away from OLED for its MacBook Pro displays in the past, and clearly that's changed. According to Apple that's because PROLED XDR "finally" overcomes the traditional limitations of OLED: low and variable brightness, off-axis color shift and the risk of burn-in from displaying the same interface elements, such as toolbars and palettes, whenever the screen is on.

The confusing thing, however, is that this isn't Apple's first use of Tandem OLED. It used the technology in its shift to OLED in the iPad Pro, but those aren't branded as PROLED XDR. Those are called 'Ultra Retina XDR' displays.

So let's look at the performance differences listed by Apple that put the 'pro' in PROLED.

What's so special about PROLED XDR displays

The Tandem OLED inside the new MacBook Pros is very bright, delivering up to 2,000 nits of peak HDR brightness (ie, in a small area of the screen for a short time) and up to 1,000 nits of sustained fullscreen brightness (ie, across the entire screen at once, without having to dim quickly).

The iPad Pro (2025)'s display is also capable of 1,000 nits of fullscreen brightness, but has a rated peak brightness of 1,600 nits — so the MacBook Pro is 25% brighter. That will bring a nice extra boost to clarity in bright HDR scenes, but won't make a huge difference really — the fullscreen brightness is the most important factor, and that's the same on both.

Because it's OLED, it gives you the blackest of black tones — there's no backlight to leak light into areas it shouldn't go — and a very high contrast ratio, in this case 10,000,000:1. That again is an interesting difference from the iPad Pro, which has a claimed contrast ratio of 2,000,000:1.

Why a 5x difference if the brightness is only 25% different? Apple hasn't explicitly said, but it must come down the lowest level of brightness that can be measured on the screen. Doing the math on the iPad's 1,600-nit display with a 2,000,000:1 ratio gives us a lowest brightness of 0.0008 nits. On the PROLED XDR's display, a 2,000-nit panel with a 10,000,000 contrast ratio gives us a lowest brightness of 0.0002 nits.

We can assume this is down to the new panel design, aimed at "minimizing internal reflections common in traditional OLED designs" — so less light is reflected within the panel itself, which could be the difference between those two different black levels.

But if you're looking at 0.0008 nits and 0.0002 nits and thinking the difference must be indistinguishable, then… yes, correct. They will both appear totally black to the human eye when they're supposed to. But it produces a big difference in contrast ratio, because multiplication is overdramatic.

There are other indications that the MacBook Pro's PROLED XDR display might beat the iPad Pro's in other areas. Apple says it can achieve over 80% of the BT.2020 color gamut, which suggest it's likely to hit close to 100% of the DCI-P3 color gamut — the iPad Pro was measured by our lab at around 82% of DCI-P3, so that would be a clear jump here.

The screen is powered by a display engine that's been built into the M5 Pro and M5 Max chips, which Apple says "continuously compensates each pixel for content, usage, temperature, and ambient conditions".

Refresh rates are variable from 10Hz to 120Hz (with discrete options for film-makers: 47.95Hz, 48Hz, 50Hz, and 59.94Hz), and as we've seen with other Apple products there's a nano-texture glass option for people who'll be working in overly bright environments.

The big selling point here is reference monitor accuracy that you can take wherever you go, making these MacBook Pros ideal for video pros and mobile creatives of all kinds.

So do you need it? If you're making the next Wildwood — go see this movie, it's incredible — or working with high-res, high-quality video then these are by far the best Mac mobile laptops that Apple has ever made. But I suspect most of them will end up with people who aren't video pros, but who really like really good displays. I'd love to see Cyberpunk 2077 on one of these.

If you're technically minded Apple has put together a full technical paper on the new displays, and you can read it right here.

Confirming one of Apple's worst-kept secrets, Apple finally unveiled its first-ever touchscreen MacBook Pro in 14-inch and 16-inch models on Wednesday, October 28, in Los Angeles. The news comes just days after Apple unveiled M6-class MacBook Pros. Notably, the new PROLED touchscreen laptops are running M5 Pro and M5 Max Apple silicon.

Apple CEO John Ternus didn't waste much time on stage, quickly announcing the laptops and running through key innovations like the tandem OLED (PROLED) screens and relatively lightweight (3lbs for the 14-inch model and 4lbs for the 16-inch one) before leaving the stage and directing the assembled group of media, analysts, creators, and Apple execs to an adjacent space where I got my first experience ever with a touchscreen MacBook.

You've been waiting for this

If you read no further, know this: it felt totally natural to tap, swipe, gesture with three fingers, pinch, zoom, and more on a MacBook Pro display. It feels like I've been waiting my whole life to do this on a MacBook (or at least as long as I've been using MacBooks).

As a former Windows user, and more specifically a longtime Surface Pro fan, I'm actually quite used to touching a screen, though maybe not one quite as beautiful as this.

For those unfamiliar with tandem OLED technology, which Apple first introduced a few years ago with the iPad Pro, it sandwiches two ultra-thin, light-emitting OLEDs together. This increases the brightness while maintaining incredibly inky blacks (they're gorgeous). It also allows for a far thinner display panel because you don't need a backlight.

Though there now is a "backlight of a sort. This touchscreen MacBook Pro lineup marks the return of the glowing Apple logo on the back of the display. It lights up when you open the laptop and turns off when you close it (people at the Hollywood, California, event were cheering for that).

I played mostly with the larger, 16-inch model, which still features the expansive, backlit Magic Keyboard and a huge ForceTouch Trackpad, which honestly is gonna get a little bit less use now that a touchscreen is just inches away.

A pair of large speaker grills sits on either side of the keyboard, though I couldn't hear them over the din of the demo room. As with previous MacBook Pros, there's still an SD Card slot, three Thunderbolt 5 ports, one USB-4 port, HDMI, and the headphone jack.

In my hands, the 4 lb, 16-inch model felt a tad lighter than previous 16-inch MacBook Pros, though the 14-inch (which might be my preference) felt lightweight at 3lbs.

Touch it, touch it, please say you want to

Let's talk, though, about using the touchscreen.

I tried a 3D design app where I used a couple of fingers to spin a model of a guy in battle armor and then a single finger to paint gold on some of the armor.

I opened Maps and used two fingers to spin the map, then pinch-and-zoom.

I used three fingers to swipe through desktops.

I could use two fingers to grab a window, flip it to one side of the screen, and watch it instantly dock itself as a half-screen app (yes, I've done something very similar on a Surface Pro).

I played touchscreen piano with all my fingers.

At no moment did I hesitate and wonder how I did this or that thing. It's obvious. It never felt uncomfortable, and my arm never got tired. Put another way, a touchscreen is a perfect fit for the MacBook Pro family,

Now, you cannot take the screen and flip it all the way to the back of the laptop (something many touchscreen Windows laptops can do). That might be a shame because I could also use my finger to paint and, though I haven't done it yet, draw.

Speaking of which, there is no indication that the touchscreen MacBook Pro supports the Apple Pencil. Honestly, if it can't fold back at least flat, there's no point in this support anyway.

There is, by the way, a Dynamic Island that's basically copied from the iPhone, but I didn't see it do very much.

As I used the touchscreen MacBook Pro, I was not only reminded of my time with the Microsoft Surface Pro but of my initial weeks and even months with the MacBook after I switched platforms. Yes, I found myself touching the inert MacBook screen and had to retrain myself to stop doing it.

Point is, touch was something I reflexively used on the Surface Pro, and I am now certain I will happily use it on the touchscreen MacBook Pro. You probably will, too.

You will pay for the privilege of touch. The 14-inch MacBook Pro with touch starts at $2,899 / £2,899 / AU$4,599, and the 16-inch model starts at $3,399 / £3,399 / $5,499. Pre-orders are live today, and the laptops ship on November 6.

• Researchers find Bluetooth flaws in warehouse barcode scanners that could provide a foothold into enterprise networks
• Attackers could spoof scanner input, inject keystrokes, and potentially pivot to ransomware or data theft
• Kaspersky urges stronger device authentication, network segmentation, and stricter security controls for warehouse infrastructure

Cybercriminals could use barcode scanners in warehouses to break into IT infrastructure and wreak havoc, security researchers have claimed, urging organizations to take preemptive measures and secure their warehouse grounds before it’s too late.

Kaspersky researchers set out to see if there are any hidden attack vectors on warehouse infrastructure and are now claiming they found one through a barcode scanner model “from a major manufacturer”.

Opening the floodgates

In a report shared with TechRadar Pro, Kaspersky said the vulnerable device has two components: the handheld scanner, and the base station, which is then connected to a workstation, or a separate business system.

The two components communicate via Bluetooth, but apparently there are no authentication methods between the two.

So, in theory, a malicious actor could obtain the Bluetooth address of the base station through passive eavesdropping on Bluetooth traffic. Then, through the established Bluetooth connection, they could send a malicious payload to the base station which simulates keyboard strokes. The base station would “think” the keystrokes are legitimate, coming from the user of the handheld device, and forward them to the connected workstation or separate business system.

“This attack pattern was observed across devices from multiple vendors,” Kaspersky said in its report.

Through this method, a theoretical attacker could gain an initial foothold on a computer within the warehouse network. Obviously, the scanner is only the entry point and not the actual target. The target is the wider network, where malicious actors could conduct reconnaissance, exfiltrate sensitive information, or deploy malware and ransomware.

“Modern retail and logistics are profoundly digital, from enterprise-wide management platforms down to every device in a worker’s hands. This pervasive connectivity means that any technology at any tier can become an entry point for a cyberattack capable of destabilising the entire ecosystem — as our research shows, even a single barcode scanner”, said Sergey Sidorov, Head of Industrial Security Services at Kaspersky.

“The warehouse sector, and the broader retail industry, should treat cybersecurity as a top priority across every layer of their operations,”

Are other devices vulnerable, too?

Kaspersky says the same scenario can be applied to other warehouse devices like Portable Data Terminals (PDR), or thermal printers, to gain access to Warehouse Management Systems (WMS) and similar infrastructure.

Therefore, the researchers are urging companies to secure their environments by verifying every new device before it connects to the network, disabling any unused Bluetooth interfaces, enforcing strong authentication mechanisms, segmenting warehouse networks so that only essential connections are permitted, applying security updates to both devices and the WMS as soon as possible, restricting account permissions to the minimum required, and regularly conducting full‑scale attack‑path exercises.

Unfortunately, we don’t know the name of the manufacturer, or how many devices in a series could be susceptible. The researchers are saying the risk is quite large, since these devices are “widely used” in warehousing, retail, and multiple other sectors.

Global e-commerce sales are expected to reach $6.88 trillion this year, making up more than a fifth (21.1%) of total retail sales worldwide.

At the same time, according to logistics research firm Interact Analysis, there are more than 180,000 warehouses in the world, so the attack surface could be significant. But warehouses are not the only sector at risk here. Barcode scanners and related handheld terminals are also widely used in retail stores, manufacturing facilities, hospitals, pharmaceutical operations, and transportation networks.

There is no reliable way to estimate how many organizations are vulnerable, but the possibility of using an everyday operational device to gain access to a connected workstation makes the findings relevant to a broad range of industries.

• SK Hynix just published its Q3 2026 financial results
• These came with a prediction of the RAM crisis lasting until 2030
• After that, expect a further drain on memory supply from "physical AI such as autonomous driving and robotics"

Apologies for bringing you more negative news about the RAM crisis, but we've heard yet another prediction that supply woes are going to last for the rest of this decade.

This time it's SK Hynix (again) weighing in, a memory chip maker that has just issued its latest earnings report, as Wccftech noticed. Profits are booming, unsurprisingly, but SK Hynix also shared its most recent thinking on the RAM crisis, and how likely it is to be a protracted affair.

In the press release for its Q3 2026 results, SK Hynix announced succinctly: "Memory supply shortage to persist through 2030."

That was the title of a section briefing us on the memory shortage, where SK Hynix further observed: "The company assessed that supply … is not keeping pace with the growth of the market. Given technical difficulty of leading-edge processes and the long lead time required to build new production facilities, it expects the structure in which demand exceeds supply to persist through 2030."

The firm also predicted it will sustain its growth and revenue, which exceeded 100 trillion won in Q3 — the first time that's ever happened in a quarter by the way — thanks to enterprise and AI demand in the shorter-term, and "over the mid-to-long term, demand for physical AI such as autonomous driving and robotics."

Analysis: a 'virtuous cycle' for shareholders – a nightmare for consumers

It's interesting to note that SK Hynix is forecasting that longer-term demand for memory will be driven by robots or 'physical AI' even if software AI (agents) falls away somewhat as the decade rolls to a close. Micron is predicting the exact same thing, and recently went into even more precise detail in estimating that 'humanoid robots' could need 200GB (or more) of RAM and multiple terabytes of storage in every unit.

So there's similar thinking from the big memory module makers here, but we shouldn't be surprised by that. They need to talk up their future profits, after all, and reassure markets that we aren't in a bubble, so it's only natural that they'd want to make predictions of major future revenue sources to be tapped.

Still, there's clearly some substance to these predictions, and it's concerning for consumers that a growing number of analysts and big players in the tech industry are talking about the RAM crisis lasting until 2030, and that robots are apparently set to take the baton from AI data centers and push demand for more memory as we head into the next decade.

We can but hope that Micron and SK Hynix are overshooting with their expectations of the hungry robots eating all our RAM in a few years' time, although how that land lies will depend on how widely robots are adopted, as well as how much memory they'll need.

Meanwhile, SK Hynix asserts that the "virtuous cycle" which has resulted from AI-powered productivity gains driving increased investment in infrastructure (data centers) will continue, and moreover "broaden to include general enterprises and nation-level initiatives", the upshot being that the "global AI data center infrastructure market will continue to grow steadily."

I don't think many PC owners or gamers feel that the way things have gone with memory of late is all that 'virtuous' at all, but the shareholders of SK Hynix and other big chip makers certainly won't be complaining. They can probably afford themselves a very nice PC even in the current super-inflated component climate, after all.

• Researchers uncover critical UEFI firmware flaw that could enable remote code execution on servers
• Public release of patch code may accelerate exploit development before many vendors deploy updates
• Delayed firmware patching across hardware ecosystems leaves organizations exposed despite available fixes

Cybersecurity researchers from Anthropic and Google have discovered a critical-severity vulnerability in boot-time firmware used by practically every server in existence today.

A patch is available, but given the fragmented market of UEFI manufacturers, it could take months before most of the servers are secured. In the meantime, patch code was made publicly available, which means cybercriminals will have their work laid out for them.

Discovering the bug

Virtually all modern servers today run UEFI (Unified Extensible Firmware Interface), software built into the server’s motherboard that helps start the device and load the operating system. It includes security features like Secure Boot, which helps stop unauthorized programs from running when the machine starts.

The free, open source toolkit developers use to build this firmware is called TianoCore EDK II - it serves as a common foundation for creating UEFI firmware for different types of hardware.

Alex Matrosov of Anthropic and Dan Holmes of Google recently found that EDK II contained a critical buffer overflow vulnerability. The National Vulnerability Database (NVD) describes it as a bug in BIOS “where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access.” “Successful exploitation of this flaw can result in remote arbitrary code execution, " it added.

Just like other UEFI vulnerability exploits, this one would be difficult to remediate in the wild. Deploying malicious code before security solutions, or even the operating system for that matter, means that whatever anti-malware or endpoint protection solutions are installed won’t be able to spot, or remove it. Reinstalling the operating system won’t help, and neither would replacing the hard drive.

The bug is now tracked as CVE-2026-97631, and was given a severity score of 9.5/10 (critical). Luckily enough, it doesn’t seem to have been exploited in the wild. However, that might change very soon, given that the security community botched the disclosure efforts.

Multiple companies and hardware manufacturers develop their own UEFI, and many rely on shared codebases such as EDK II. When a vulnerability is discovered in the code, fixing it upstream (in the codebase) is only half the work - each affected firmware vendor must patch their own product and then distribute the new firmware to their customers. This process can take time, leaving a window between the availability of the fix and its deployment across affected systems.

Discretion is advised

That is why discretion is paramount, and some participants seem to have dropped the ball, with Ars Technica claiming the two researchers who found the bug arranged for it to stay private until a coordinated disclosure that was planned for January 2027.

However, AMI - one of the manufacturers building motherboards - apparently published a pull request last month that not only detailed the vulnerability but also included a fix for the code.

Since the cat was out of the bag, TianoCore Project members then published a public advisory about the flaws, as well.

“With publicly available patch code, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits,” Ars Technica’s Dan Goodin writes. “Further compounding the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming.”

Exploiting this flaw is not that easy, though. Threat actors need to have some level of access to the target device beforehand, meaning that the bug will be mostly used by state-sponsored threat actors, and large, highly organized hacking collectives.

It really is turning out to be Black October - especially since the PHP2Shell flaws were inadvertently disclosed to the public in similar fashion.

Acer Swift Spin 14 AI review: Two Minute Review

I really like the Acer Swift Air 14 and not just because of the price. It’s very portable, attractive in that clean minimalist way popularised by a certain Cupertino company, and comes with a battery life that’s as good as any other I’ve come across.

Acer has been impressing me with its recent Swift laptops, and this one is no exception. Of course, the price tag makes it a no-brainer for anyone wanting a solid, portable laptop at an almost budget price tag. It’s not sub-$500 / £500, but it’s close. I certainly think it’s one of the best laptops for the price.

It does, however, have some of the shortcomings that even the best Ultrabooks have. It’s not the most powerful laptop out there, by any stretch of the imagination – this is for people who just want to go online and do some office work or stream, not game or edit video. And the audio suffers from the laptop's smaller design.

Those things actually don’t bother me. That’s not what this laptop is supposed to be used for. But, Acer makes the same weird design choice that even Apple makes on more budget models, where there are two USB-C ports, both of which can be used for power, but, for whatever reason, they’re on the same side of the computer.

Still, quibbles aside, the amount of computer you get for the price in the Acer Swift Air 14 is pretty impressive.

Acer Swift Air 14 review: Price & Availability

• How much does it cost? $699.99 / £749.99 (about AU$1,010)
• When is it available? Available now
• Where can you get it? Available in the US and UK

If you’re looking for the Windows version of the Apple MacBook Neo, the Acer Swift Air 14 offers just as much value. The base configuration might start at a higher $699.99 / £749.99 (about AU$1,010) price tag, but if you want to match the Swift Air 14’s 512GB of storage, then two laptops end up at the same price. Unfortunately, that currently excludes Australia as it hasn’t yet been released there.

Granted, you’re not getting the most powerful laptop out there. If you’re looking for something similar but better, the Acer Swift Spin 14 AI is that computer. Sure, it’s $1,499.99 / £1,399 (about AU$2,150), but its Qualcomm CPU has double the cores and triple the NPUs than the base version of the Acer Swift Air 14’s Intel Core 5 320 CPU. You can upgrade the Acer Swift Air 14 to a configuration with the Intel Core 7 350 CPU and 12GB of RAM, but it’s still not going to do the same heavy lifting. Plus, the Acer Swift Spin 14 AI has a 360-degree hinge, touchscreen, and stylus.

It might be better to consider the Acer Swift Air 14 as Acer’s budget entry in its Swift line. It’s an excellent value while still functioning as a competent Ultrabook.

• Value score: 5 / 5

Acer Swift Air 14 review: specs

The Acer Swift Air 14 comes in two variants. The base configuration comes with the Intel Core 5 320 CPU with 8GB of RAM, and a model with an Intel Core 7 350 and 12GB of RAM. The difference in processors aren’t that different, except that the Intel Core 7 350 can be boosted to a higher turbo frequency, 4.8GHz vs 4.6, and has 21 TOPS NPU compared to the Intel Core 5 320’s 20 TOPS NPU.

Beyond those internal configuration differences, the Acer Swift Air 14 is available in four different colors – Sage Green, Frost Blue, Blossom Pink, and Lilac Purple with only the Sage Green and Blossom Pink available in the UK. EMEA countries, including the UK, also sport more minimalist etchings on the lid.

Acer Swift Air 14 review: Design

• Very attractive, portable design
• Keyboard and touchpad are good but not amazing
• Both USB-Cs are on the left

The Acer Swift Air 14 is a gorgeous laptop. I’ve only seen the Sage Green color in person – the color of the test unit for this review – but the colors, lid etchings, and aluminum chassis all present a very aesthetically pleasing package. I imagine that the other three colors look just as good in that way that I think makes this an attractive alternative to the Macbook Neo.

Also in its favor is its utter portability. It weighs just over two and a half pounds. That’s about the same as an ankle weight. And it’s just over a half inch thick at its thinnest point. I don’t think you can really get any more portable without going down in screen size to a 13-inch laptop.

Speaking of which, its 14-inch screen is a good-looking, if not amazing, non-touch display with a 16:10 aspect ratio and 1920x1200p resolution. It does get up to 300 nits of brightness – I typically have the brightness up only halfway when I’m using it.

I appreciate the 180-degree hinge, but that’s mostly because I feel like I don’t have to be as gentle with the Acer Swift Air 14 when opening it. I could see its use, though, if you want to share your screen with someone sitting across from you. If you do that, the viewing angle is more than enough for both people to see at 170 degrees.

Moving on, the keyboard is pleasant to use if nothing spectacular. I used the Acer Swift Air 14 to write this review and didn’t feel fatigue from typing. At the same time, it’s a linear keyboard with a somewhat short travel.

The trackpad is fairly responsive and accurate, though I found it to be a little too sensitive at times when my thumb was a little too close to it and had trouble getting the cursor to cooperate.

The port selection is about as minimal as one would expect on a laptop like this. Along with a USB-A port and headphone jack are two USB-C ports. Unfortunately, they’re both on the left side, a design choice that I always dislike since I find myself regularly having to plug the computer in on the right side, sometimes from a distance too.

• Design score: 4.5 / 5

Acer Swift Air 14 review: Performance

• Decent for day-to-day work
• Slows down if using multiple RAM-intensive tabs
• Sound quality is just okay

One of the downsides of a laptop built for a sub-$1,000 price tag is that either the design or performance (or both) suffer. The design on the Acer Swift Air 14 is pretty good... so it goes that the performance is what is throttled.

Now, Acer built this laptop to hit a price point, but the company also built it to an expectation. This is supposed to be an extremely portable laptop with long battery life for not much money.

With that in mind, Acer used the affordable Intel Core 5 320 six-core CPU with a speed of 1.5GHz and 20 TOPs (21 for the Core 7 350) and put only 8GB of RAM in the computer. At least the 512GB SSD storage is sufficient.

If you’re looking for a laptop to work on while in a cafe responding to emails in between social media side quests, then what the Acer Swift Air 14 does is more than enough. Even using the AI features like Acer PurifiedView and PurifiedVoice during video calls, both of which work well, or messing with CoPilot+ doesn’t tax this laptop.

But it’s not too hard to push the Acer Swift Air 14. When I’ve tabs open that require a lot of RAM and try to switch windows, I’ve experienced some freezing. And anything but the least demanding games are a jittery mess. I wouldn’t use this laptop for 4K video editing, either. A powerhouse this is not. Then again, it’s not meant to be.

As far as the sound quality goes, the Acer Swift Air 14 suffers from what ails just about all thin and light laptops. There’s just no room for any speakers capable of producing a full sound and it shows. There’s not much bass and the sound is on the thinner side. That said, it’s not harsh, so listening to music in the background while working is still pleasant.

• Performance score: 4 / 5

Acer Swift Air 14 review: Battery life

• Almost 17 hours of battery life
• Charges relatively quickly

The new benchmark for a good laptop battery life these days is anything over ten to twelve hours. So, the fact that the Acer Swift Air 14 can hit almost seventeen hours in our benchmark is remarkable. Note that this benchmark requires the laptop to run for that entire amount unplugged.

I’ve been using this laptop regularly for a little over a week and I don’t think I’ve seen it go below 50%. I have charged it a few times, mostly out of habit, but I have yet to be compelled to find an outlet. Plus, it does a good job of holding its charge when the lid is closed.

Acer advertises that the Swift Air 14 has fast charging, which might be true on certain settings, but I found it to charge at a still-good 1% a minute rate when set to a balanced performance mode.

• Battery Life score: 5 / 5

Should I buy the Acer Swift Air 14?

Buy it if…

Don't buy it if…

Acer Swift Air 14 review: Also Consider

If our Acer Swift Air 14 review has you considering other options, here are two laptops to consider...

How I tested the Acer Swift Air 14

• Tested for a week and a half
• Used it for work, gaming, and streaming
• Messed with its AI capabilities

I used the Acer Swift Air 14 for a week and a half. I used it for work, including typing up this review (along with the requisite online research). I used it to stream video. I even did some light gaming and attempted some semi-serious gaming. I played around with the AI as well.

After spending time with the Acer Swift Air 14, it’s clear that this is meant for those that want a portable and attractive laptop that’s nice to use on a limited budget.

I’ve spent the last few years reviewing tech gear for gaming and otherwise, where I’ve gotten a feel for what to look for and how to put a piece of kit through its paces to see whether it’s worth the recommendation.

• First reviewed: October 2026

• AI startup Cathedral used autonomous agents to breach Anthropic systems through weaknesses in third-party software
• Agents accessed HR, sales, and IT data, exposing limited customer and partner information
• Incident highlights how AI-powered attackers can rapidly exploit vendor weaknesses despite strong internal defenses

An AI startup seemingly gave Anthropic a taste of its own medicine when it used AI agents to break into the company and expose sensitive data.

The company in question is called Cathedral, which was founded by former members of the defunct US Department of Government Efficiency (DOGE), a US government initiative established to reduce federal spending and bureaucracy, while modernizing government technology and operations.

Anthropic is running a two-fold bug bounty program through HackerOne. One part is focused on finding technical flaws in Anthropic’s systems, while the other is an invite-only program that rewards researchers for finding universal jailbreaks that bypass Claude’s safety protections.

Cathedral apparently shared its results with Anthropic through the bug bounty program. After its human researchers unsuccessfully tried breaking in for a few days, they deployed AI agents which took less than 12 hours to find a way in, by exploiting flaws in third-party business software.

Violating the rules

After accessing the company’s network, the agents accessed meeting transcripts, information on salaries and job offers, as well as Slack messages. Employee conversations with Claude were not exposed, it seems.

Anthropic confirmed the news, saying Cathedral accessed a “limited set” of sales, human resources, and IT systems, and compromised contact information and basic user account records belonging to certain customers and partners. Source code and AI model weights were not accessed.

“Our monitoring flagged some of Cathedral’s activity before they reported it to us,” Anthropic said in a statement shared with The Washington Post. “We shut off their access the same day.”

According to Gizmodo, Anthropic accused Cathedral of violating the program’s rules by failing to disclose the full extent of its activity. We don’t know if that means Anthropic won’t release the payment for the bounty, but it sure sounds like it.

Paying the bounty could be the least of Anthropic’s concerns, though. The company is currently gearing up for its Initial Public Offering (IPO), with a valuation of $1.4 billion. Leaking sensitive data to anyone, including white hat hackers, is definitely not a good signal.

A 'bunch of kids' wreaking havoc

“The fact that weaknesses in ordinary enterprise software can compromise the infrastructure of even the most advanced organizations should be a wake-up call for every company in America,” the Washington Post cited Cathedral’s report as saying.

At the same time, a senior Trump administration official allegedly told Via The Independentthat “if a bunch of kids who have just started a company can do this, then potentially the Chinese aren’t far behind.”

Cathedral can hardly be described as “a bunch of kids” - it is an AI startup focused on offensive and defensive cyber operations for the US military and government. Its founders include Gavin Kliger (former Pentagon chief data officer), Luke Farritor (best known for helping decipher ancient Roman scrolls using machine learning), Marko Elez (former SpaceX staffer), and Jack Stein (apparently worked as an investment banking associate at Salem Partners before joining DOGE).

The cybersecurity community had something to say about it. Jacob Krell, Senior Director for Secure AI Solutions & Cybersecurity at Suzu Labs, wasn’t particularly phased, saying if third-party vendors are a risk everywhere, then they’re a risk at Anthropic.

"Cathedral's agents got into Anthropic the same way attackers get into everyone else, through the vendors,” Krell said. “Security maturity is capped by the weakest vendor you integrate with, and no amount of in-house engineering changes that."

Darin Fredde, Senior Director of Technical Marketing Engineering at Ridge Security, praised Anthropic’s response: "Anthropic deserves credit for reporting that its monitoring detected some of the activity and for taking containment measures. But the real measure of remediation is independent verification that those attack paths are closed. We need to stop confusing a successful patch with a verified security outcome. Otherwise, we're just closing the front door and hoping nobody discovered the spare key."