Team IT Security - 📰 Alle Kategorien

Apple could ‘run the table’ on AI if it does things right

Sat, 25 Jul 2026 19:50:13 +0200

Looking ahead just a short time, Apple could hold a powerful position in AI where it most makes sense: deployment.

Not only will the company offer up its own AI models for the kind of tasks millions use ChatGPT to do today, but it will provide more sophisticated on-device agentic models to help users get things done through Siri AI.

Apple also offers limited capacity for more complex tasks through Private Cloud Compute, and, in partnership with the likes of Google in the US and Alibaba in China, the company is giving users a trusted conduit through which to access even more sophisticated AI services.

Deeply deployable

Critics can say it took Apple a long time to get to this point, but they also seem to think the company has finally got the mix right with its series 27 operating systems. Arriving late to a party doesn’t mean you won’t shine once you get there.

Apple is also coming up the inside lane around frontier AI, with iterative OS and hardware enhancements that mean its devices become increasingly effective for Edge AI use cases, on device — no cloud service required.

The company appears to be digging down into those use cases. Mark Gurman at Bloomberg recently predicted that future M7 Ultra Macs will support as much as 1.5TB RAM, making these systems more than capable of running full weight frontier models in people’s offices, colleges, and homes.

While that does assume the AI-flationary memory market can supply that much RAM at prices humans can afford, it is also true that people are already running AI clusters using off-the-shelf Mac minis networked over Thunderbolt cables. It’s no stretch to believe this will continue to be the case, and that it will even broaden as the power/performance offered at the high end grows.

What’s wrong with good enough?

When combined with open AI stacks, particularly newly emerging varieties, Apple’s platforms should become leading contenders for private AI services and edge AI. Many business users will leap at the chance to offer their workers powerful, self-hosted, private AI services using one or more daisy-chained Mac Studios or Mac minis. The recent craze in deployment of both Macs to support OpenClaw instances shows they already are.

Ultimately, these different slices of momentum mean I agree with investor Jason Calacanis that Apple is in position to apply a great deal of pressure on OpenAI and Claude just by putting models on their devices.

It’s also worth thinking about how people use AI today. How many of the queries made in the world right now constitute relatively simple tasks that could be transacted by on-device AI, such as the emerging new version of Apple Intelligence or even smaller LLM models running on device? You can even run PrismML’s 1-bit, 27-billion parameter Bonsai on an iPad using the Locally app, and that’s in the here and now.

What happens? Pretty soon you’ll find people recognize that they can already run the vast majority of their AI-augmented workflows using services they have on their existing device or can access on their on-prem Mac set-ups. And, of course, as people get used to running small tasks locally and larger tasks on premises, the actual space in which they need to turn to cloud-based frontier models will erode. That’s even as companies like PrismML work towards slimming down full-weight models so they don’t need to run on a server at all.

“It’s going to be wild when people have unlimited tokens on their desks,” said Calacanis in a podcast round table discussion.

Who has the most to lose?

The current incarnations of AI felt like they came from nowhere. Most people weren’t aware of the technology until returning to work after the 2022 holiday season. Since then, the industry has proliferated with dozens of competing models, most recently including powerful but affordable frontier models such as Qwen and Kimi.ai.

These models aren’t necessarily all as good as one another, but in many cases for much of what we do, we’ll find them to be good enough. That’s an existential crisis for some, as industry observers now think the inevitable pricing pressure means some services might have over-invested in capacity before finding any way to turn a profit.

Those profit-seeking services are the ones with the most to lose as Apple extends its hardware advantage, democratizing AI access for all while providing platforms suitable for edge AI, on-premises AI, private AI, and even AI access using third-party services. (The need for the latter will shrink as the capabilities of the former get better.)

Cupertino rising

What does this all mean? While the industry remains young, it is already fragmenting. And striding through the dust of that process comes Apple, equipped with the hardware, software, and approach to build its business even as the enterprise of first mover AI services erodes.

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to my daily Apple-related news summaries at The Core.

Your instant Android backup upgrade

Sat, 25 Jul 2026 19:50:10 +0200

Here in this high-tech era of 2026, keeping important info backed up and synced should be effortless and something that just happens on its own, automatically, without any actual thought or ongoing human effort.

In many areas of our digital life, that mercifully does Just Work™ in exactly that way. Fire up an email in most modern mail services, and you can stop at any point and find your in-progress draft in that same app on any other device. The same applies to any file you’re finessing within Google Drive or other cloud storage services or document you’re dawdling over in Docs.

One area where seamless syncing somehow still doesn’t occur, though, is in the domain of downloaded documents on Android. If someone sends you a PDF or a Word file and you save it to your phone, that file exists in an archaic-seeming silo — only locally, on that one gadget. And that, of course, means (a) you can’t access it from any other device, and (b) if you misplace your phone or move into a new one at some point along the way, the file will be left behind in time and entirely unavailable.

Well, take a moment to join me in celebration: Amidst all the Gemini gobbledegook that no one asked for (and that often falls somewhere between “pointless” and “actively counterproductive”), Google’s giving us a major upgrade to Android’s backup capabilities right now. It’s a simple-seeming switch buried in your system settings, and it’s up to you to find and activate it.

Once you do, though, those once-orphaned documents on your Android device’s local storage will be perpetually synced and protected, automatically, without any ongoing thought or effort.

All you’ve gotta do is find and flip that one new switch.

[Don’t let yourself miss an ounce of Android Intelligence. Join my free weekly Android Intelligence newsletter and get one new thing to try in your inbox every Friday!]

The Android backup lowdown

So, for a quick bit of pertinent context on this: Android’s backup systems have actually come a really long way over the years.

‘Twas a time, y’see, when little to nothing about you would sync and carry over automatically from one Android device to another. Years ago — back in the ancient-seeming prehistoric era of the early 2010s — Android enthusiasts in the know would rely on community-created third-party apps for everything from remembering and resyncing downloaded apps to restoring data from within those apps and onward. And reconfiguring your system preferences would be a whole time-consuming song and dance every single time you reset a device or moved into a new one, as little to nothing would automatically carry over.

Most of that stuff is now effortless and automatic. And, thanks to apps like Google Messages, Calendar, Drive, and Docs, many other areas of important data are also synced on their own at the app level — outside of any system mechanisms.

Locally stored files, however, have remained an awkward omission. To this day, anything you download on any Android device exists only on that one device and isn’t synced or backed up anywhere. The only way that happens is — in a blast-from-the-past twist — if you go out of your way to find and set up a third-party app to handle the heavy lifting.

That brings us to today. Right now, as we speak, Google’s in the midst of sending out a quiet under-the-hood update that (brace yourself…) adds in the option to automatically sync and back up any documents on your device as a native part of Android’s backup setup.

See?

The easily overlooked new option for backing up documents on Android.

JR Raphael, Foundry

The option is on its way to all devices running 2018’s Android 9 release and higher. (If you’re still using a phone with an Android version older than that, you’re now a whopping eight years out of date, and you have much bigger problems.)

Once the added option is present and available for you, you’re literally lookin’ at 10 seconds to find and activate it.

Lemme show ya how.

Android’s document backup addition

I promise: This couldn’t be much simpler.

No matter what kind of Android device is in front of you, just head into your system settings and open the section called “Accounts and backup,” “Back up or copy data,” or something along those same lines. (The exact wording can vary based on who made your device and when it was released or last updated.)

Either tap the line labeled “Google Backup” or look for an option to “Back up data” via Google Drive. You should then either see a series of options for different areas of available backup right then and there — or, depending on your device, you might have to tap a line labeled “Other device data” (or something similar) to find the full list of possibilities.

However you get there, once you’re lookin’ at that list, you’ll see a newly added line for “Documents” if this latest under-the-hood update has reached you.

Android’s expanded list of backup options — now including documents alongside other forms of on-device data.

JR Raphael, Foundry

And from there, all that’s left is to tap it and enable the switch to include that in your automated backups from that moment forward.

If you aren’t seeing the option yet, don’t panic. Google always sends these under-the-hood updates out bit by bit over time, so the change probably just hasn’t reached your device quite yet. As long as you’re running Android 9 or higher, it’ll get there. Set yourself a reminder to check back once a week or so. Odds are, you’ll see it pretty soon.

Notably, all documents synced in this way are always encrypted for security, and they’re kept in your personal (or, depending on the nature of your account, perhaps company-connected) Google Drive storage. That does mean they’ll count against your overall Google storage total, so keep an eye on your Drive storage total to make sure you’re in solid shape and look to the Google One storage hub if you ever want some simple suggestions for freeing up space.

Speaking of other Google services: If you ever want to keep other types of locally stored non-document files from an Android device synced and available elsewhere, you can easily rely on Google Photos for syncing screenshots and other images — after enabling sync in general, be sure to look in the app’s “Collections” areas to find the “On this device” folder and then flip the toggle to “Backup all device folders” (or get more nuanced and open specific individual on-device folders if you want to sync some but not all of those areas) — and you can still turn to those aforementioned third-party apps for broader syncing of anything else imaginable.

But with documents now being handled automatically and natively, that’s one big worry now out of your hair. Just note that the onus will fall on you to find and flip the switch and actively opt in to the feature on each and every Android device you’re using.

Take 10 seconds to do that, though, and you’ll have one less void in your Android data arena. And you don’t need Gemini to tell you that that can only be a good thing.

Get practical Android knowledge in your inbox every Friday with my free Android Intelligence newsletter — one new thing to try each week, straight from me to you.

AMD raises the AI stakes with Helios, Venice and robotics

Sat, 25 Jul 2026 19:50:07 +0200

AMD executives took to the stage at its Advancing AI 2026 event in San Francisco today to detail the company’s next generation of AI infrastructure solutions, from Instinct MI455X AI accelerator GPUs and 6th Gen EPYC “Venice” CPUs, to Pensando networking, ROCm.AI software and its Helios rack-scale platform that ties it all together.

AMD has been working towards rack-scale AI system solutions for years. Its ZT Systems acquisition last year added valuable engineering talent and intellectual property that is now finally bearing the real fruits. Its Helios AI platform is a major platform evolution for AMD, with shipments scheduled to begin in the second half of this year (which is here and now).

The announcements at Advancing AI show how the company has engineered its AI platform solutions for large reasoning models, sustained inference and agentic workflows. These workloads pressure memory capacity, data movement, networking and CPU orchestration. AMD’s approach is to keep as much data close to the compute engines as possible and move it more efficiently throughout the system, but there’s deeper nuance here that’s obvious versus AMD’s chief rival, NVIDIA.

AMD’s MI455X targets the AI memory wall

The Instinct MI455X GPU is the compute engine that fuels the Helios rack, and the first GPU based on AMD’s new CDNA 5 architecture. Built with a modular mix of 2nm and 3nm chiplets, it carries 432GB of HBM4 and 23.3TB/s of peak memory bandwidth.

Compared to AMD’s current MI355X, the MI455X offers 1.5 times the memory capacity, up to 2.9 times the peak memory bandwidth and up to four times the peak matrix performance with MXFP4 and MXFP8 data types, which are lower-precision numerical formats designed to accelerate AI processing while reducing memory demands. With MXFP6 (6-bit floating point), performance is rated at up to twice that of MI355X.

AMD also shared some actual, measured internal results using production silicon. The company claims MI455X delivers 3.8 times higher FP8 decode performance, 3.5 times more measured FP4 compute performance and between 2.5 and 3.5 times more networking bandwidth than MI355X, depending on the transfer path tested. Those figures provide more context than just numerical specifications, though they remain AMD-provided comparisons that will need independent validation.

AMD

The architectural choices behind the numbers are important. Reasoning models and long context windows require sizeable KV caches for maintaining AI attention states, while mixture-of-experts models frequently move large amounts of data across accelerators. MI455X should let more model data, activation states and cache remain local. New dedicated IP in hardware can transfer data while the GPU continues processing, and expanded cache and multicast capabilities are designed to reduce redundant data movement to further improve efficiency.

The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.

AMD’s Helios rack takes aim at Vera Rubin

Dave Altavilla

Helios is AMD’s primary rack-scale competitor to NVIDIA’s Vera Rubin platform. Each liquid-cooled rack combines 72 MI455X GPUs, 18 single-socket Venice host CPUs and Pensando networking technologies.

In its most complete, premium configuration, AMD rates Helios for 2.9 exaflops of low-precision AI compute, with 31TB of aggregate HBM4 capacity, 1.7PB/s of memory bandwidth, 260TB/s of bidirectional scale-up bandwidth and 43TB/s of scale-out bandwidth.

These are formidable figures, but they are technical specifications rather than actual application benchmarks. The more consequential development is AMD’s move from collections of eight-GPU servers to a 72-GPU shared-memory domain. Models too large for one node can operate across the rack without treating every exchange as a scale-out networking transaction, which benefits large-model inference as well as training.

AMD uses UALink over Ethernet, or UALoE, for an open standard scale-up fabric. Each MI455X provides 3.6TB/s of bidirectional scale-up bandwidth, while the complete rack delivers all-to-all connectivity through a single switch layer. AMD also claims six times more scale-out bandwidth per GPU than MI355X when MI455X is configured with three Pensando Vulcano 800 AI NICs.

While open standards give cloud providers more control over suppliers and system design, AMD and its partners now have to prove those components can deliver the predictable performance, reliability and deployment experience customers expect from a tightly controlled, more vertically integrated platform.

Finally, AMD designed Helios with automatic rerouting around failed links, virtual rack partitions, tray-level serviceability and rack-wide power, cooling and health monitoring. Major hyperscalers and potentially large-scale enterprise customers will likely key in on these capabilities, which can affect the availability, total cost and consistency of the AI services they consume.

Kind of like cowbell, AMD Venice gives agentic AI more CPU

AMD

AMD’s agentic CPU messaging regarding its upcoming Venice-based EPYC processors is mostly marketing speak, but the underlying requirement is very real. An AI agent can invoke retrieval, databases, security checks, code execution and other tools before a GPU generates a response. Running many agents concurrently increases the amount of conventional compute requirements surrounding the accelerators.

Venice scales to 256 Zen 6 cores with support for 512 threads, 16 memory channels, up to 1GB of L3 cache per socket, along with PCIe 6.0 and CXL 3.1 connectivity. AMD is also offering several Venice configurations for other applications, including general-purpose servers, high-frequency workloads, GPU hosts and high-density CPU sandbox systems used to execute agent tools.

Treating the CPU solely as a GPU host understates its role. Gateways, tokenization, vector search, databases and short-lived code execution stress different mixes of per-core performance, thread count, memory bandwidth and I/O. Specifically, AMD’s internal testing shows Venice significantly outperforming its current EPYC 9965 Turin CPU across five parts of the agentic AI pipeline, including gateway processing, context assembly, vector search, enterprise applications and short-lived tool execution. Individual gains vary by workload, but AMD details the overall generational improvement at up to a 1.7 times lift. As with the MI455X figures though, these comparisons come from AMD and will require independent validation.

Pensando networking and ROCm software advance

Keeping GPUs fed with data and coordinating traffic across racks directly affects utilization and operating costs. In fact, GPU utilization is a pretty sad state of affairs currently for some of the major frontier model providers.

As such, Pensando networking has become central to AMD’s roadmap. Helios can connect each MI455X to as many as three 800Gbps Vulcano AI NICs, while Salina DPUs handle front-end networking and infrastructure services.

On the software side, which is an equally critical component, AMD also introduced ROCm.AI, an AI-assisted development layer due to arrive in August. It includes reusable skills for coding agents, simplified management and Hyperloom, which can profile workloads, tune serving configurations, modify kernels and validate results.

These tools address two persistent AMD challenges: developer efficiency and ease of use, and software tuning. Automated optimization still has to produce repeatable gains without creating hard-to-maintain code, however. And while ROCm has progressed significantly over the last few years, NVIDIA’s CUDA retains an advantage in maturity, tooling and developer familiarity.

Customer commitments underscore rack-scale confidence

AMD now has commitments that give its MI450 generation and Helios considerably more weight. Meta and OpenAI have announced multi-generation agreements composed of up to 6GW of AMD compute capacity, with initial 1GW deployments planned for the second half of 2026.

Oracle plans a 50,000-GPU public cloud cluster beginning in the third quarter, while Microsoft will deploy Helios for Azure AI inference. Finally, just before the AMD event, Anthropic announced a strategic partnership for up to 2 Gigawatts of AMD-fueled AI compute, with its first gigawatt expected online in the first half of 2027.

Commitments of this scale reflect confidence in more than just MI455X performance. These customers are evaluating the complete architecture, including Venice CPUs, Pensando networking, ROCm software, rack integration, serviceability and AMD’s ability to deliver and execute across multiple product generations.

There is some financial alignment behind the agreements as well. AMD issued OpenAI performance-based warrants and committed to investing up to $5 billion in Anthropic. That context matters when evaluating these deals as market validation, but these planned deployments are substantial nonetheless and put Helios on a much stronger foundation as it begins shipping.

AMD expands its robotics and embedded foundation

AMD also expanded its physical AI portfolio, building on credible traction from its Xilinx-derived Kria adaptive system-on-modules and embedded technologies that are already powering robotics, machine vision and industrial automation applications.

The new Ryzen AI Embedded X100 combines up to 16 Zen 5 CPU cores, integrated Radeon graphics, a second-generation NPU and as much as 128GB of unified LPDDR5X memory shared across its compute engines. To me this looks a lot like a repackaging and optimization of the company’s Strix Halo platform, but with specific optimizations for the embedded space. Regardless, AMD is pairing X100 with the Kria AI Robotics Developer Platform, which includes a System Module or SOM, and a new Robotics Partner Network spanning hardware, software and platform providers.

Samples began shipping in June, with full production expected in the fourth quarter. This broader objective is to give developers a path across AMD x86 CPUs, GPUs, NPUs and FPGAs for real-time autonomous systems, rather than requiring them to assemble those hardware engines and software components independently.

Execution for AMD is now the test

AMD has assembled a credible platform for the burgeoning agentic AI market that’s blowing up currently with no signs of stopping. MI455X addresses memory and data movement, Venice handles dense agentic CPU workloads, Pensando networking connects global system resources, and ROCm.AI addresses software complexity. Finally, Helios assembles these components into a true competitive threat for NVIDIA’s latest Vera Rubin platform.

AMD’s open architecture may appeal to customers seeking supplier choice, but openness must also translate into reliable deployments, competitive total cost and software that does not require a significant rip-up. NVIDIA enters this cycle with a stronger ecosystem and far more rack-scale deployment experience. The true test will be how easily and reliably customers can integrate, operate and maintain these AMD solutions at scale.

As it stands, AMD now has major customers and a clearly defined architecture with systems engineering expertise behind it. Delivering Helios on schedule and showing that its performance claims translate into a real production workload throughput advantage and total cost of ownership gains will determine how much the competitive gap narrows. And of course, this is in a market that is clamoring for ever-more compute resources with a seemingly insatiable demand for AI services and capacity. That’s an environment for big iron success. Now AMD just has to deliver optimized, turnkey AI platforms. This is far easier said than done, but time will soon tell as deployments take shape this year.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

The May 2026 Security Update Review

Sat, 25 Jul 2026 19:02:56 +0200

I’m currently in Berlin helping set up for Pwn2Own Berlin, but that doesn’t stop Patch Tuesday from coming, and it’s another big one. At least nothing is listed as being in the wild – for now. Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. Due to technical difficulties, there will not be a video companion for this month.

Adobe Patches for May 2026

For May, Adobe released 10 bulletins addressing 52 unique CVEs in Adobe Commerce, After Effects, Adobe Connect, Illustrator, Media Encoder, Premiere Pro, Substance 3D Painter, Substance 3D Sampler, Content Authenticity SDK, and the Adobe Substance 3D Designer. Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-49	Adobe Commerce	15	Critical	8.7	No	2
APSB26-48	Adobe After Effects	4	Critical	7.8	No	3
APSB26-50	Adobe Connect	2	Critical	9.6	No	3
APSB26-51	Adobe Illustrator	4	Critical	7.8	No	3
APSB26-47	Adobe Media Encoder	2	Critical	7.8	No	3
APSB26-46	Adobe Premiere Pro	3	Critical	7.8	No	3
APSB26-55	Adobe Substance 3D Painter	2	Critical	7.8	No	3
APSB26-54	Adobe Substance 3D Sampler	1	Critical	7.8	No	3
APSB26-53	Content Authenticity SDK	14	Critical	7.5	No	3
APSB26-52	Adobe Substance 3D Designer	5	Important	6.3	No	3
TOTAL	10 bulletins	52

The obvious priority this month is the patch for Commerce, with its 15 bugs and deployment priority of 2. The Connect fix should also rank up there since both of its CVEs are CVSS 9s. Beyond those, it’s a pretty typical month for Adobe, with most of the bugs either being cross-site scripting (XSS) or open-and-own code executions.

Microsoft Patches for May 2026

This month, Microsoft released a whopping 138 new CVEs in Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Copilot Chat, Github Copilot, M365 Copilot, SQL Server, TCP/IP, and the Telnet Client – yes, the Telnet client. Two of these bugs were reported through the TrendAI ZDI program. 30 of these bugs are rated Critical, three are rated as Moderate, one is rated Low, and the rest are rated Important in severity.

This large volume of fixes follows the largest monthly release in Microsoft’s history and reflects the trend across the industry of a high number of submissions. While not all of these bugs were found by AI, it’s likely they had an AI-related component – even if it was just AI writing the submission. I should also point out the Pwn2Own Berlin occurs in just a few days, and it’s typical for vendors to patch as much as they can before the event.

None of the bugs patched by Microsoft this month are listed as publicly known or under active attack at the time of release, so we’ve got that going for us. Let’s take a closer look at some of the more interesting updates for this month, starting with a nasty-looking bug in DNS:

- CVE-2026-41096 - Windows DNS Client Remote Code Execution Vulnerability
This patch fixes a heap-based buffer overflow in the DNS Client triggered by a malicious DNS response. No authentication or user interaction needed, and since the DNS Client runs on virtually every Windows machine, the attack surface is enormous. An attacker with a position to influence DNS responses (MitM, rogue server) could achieve unauthenticated RCE across your enterprise.

- CVE-2026-41089 - Windows Netlogon Remote Code Execution Vulnerability
This update covers another CVSS 9.8 bug, which is a stack-based buffer overflow that lets an unauthenticated remote attacker execute code on a domain controller by sending a specially crafted network request — no credentials, no user interaction required. Yup – that makes it wormable. This is the highest-impact bug that requires immediate patching: a compromised domain controller is a compromised domain.

- CVE-2026-42898 - Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
This bug rates a CVSS 9.9(!) and represents a code injection in Dynamics 365. It allows any authenticated user to execute code with a scope change, meaning exploitation can break out and affect resources beyond the vulnerable component itself. Scope changes are pretty rare, so if you’re running Dynamics 365 On-Prem, definitely test and deploy this patch quickly.

- CVE-2026-40415 - Windows TCP/IP Remote Code Execution Vulnerability
This bug in the TCP/IP stack results from a use-after-free (UAF) and could allow a remote, unauthenticated threat actor to execute code without user interaction. That makes this another wormable bug. However, this one is much less likely to be exploited. The target needs to be under sustained low-memory (memory pressure) conditions, which is pretty rare. Still, no need to tempt fate here. Test and deploy this one quickly.

Here’s the full list of CVEs released by Microsoft for May 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-35435	Azure AI Foundry Elevation of Privilege Vulnerability	Critical	8.6	No	No	EoP
CVE-2026-35428	Azure Cloud Shell Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-42826	Azure DevOps Information Disclosure Vulnerability	Critical	10	No	No	Info
CVE-2026-32207	Azure Machine Learning Notebook Spoofing Vulnerability	Critical	8.8	No	No	Spoofing
CVE-2026-33109	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	Critical	9.9	No	No	RCE
CVE-2026-33844	Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability	Critical	9	No	No	RCE
CVE-2026-41105	Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability	Critical	8.1	No	No	EoP
CVE-2026-33111	Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26129	M365 Copilot Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-26164	M365 Copilot Information Disclosure Vulnerability	Critical	7.5	No	No	Info
CVE-2026-33821	Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability	Critical	7.7	No	No	EoP
CVE-2026-42898	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	Critical	9.9	No	No	RCE
CVE-2026-40379	Microsoft Enterprise Security Token Service (ESTS) Spoofing Vulnerability	Critical	9.3	No	No	Spoofing
CVE-2026-40363	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40358	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-34327	Microsoft Partner Center Spoofing Vulnerability	Critical	8.2	No	No	Spoofing
CVE-2026-40365	Microsoft SharePoint Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41103	Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability	Critical	9.1	No	No	EoP
CVE-2026-33823	Microsoft Team Events Portal Information Disclosure Vulnerability	Critical	9.6	No	No	Info
CVE-2026-40364	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40366	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40361	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-40367	Microsoft Word Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-42831	Office for Android Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-41096	Windows DNS Client Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-35421	Windows GDI Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-40403	Windows Graphics Component Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-40402	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-32161	Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability	Critical	7.5	No	No	RCE
CVE-2026-41089	Windows Netlogon Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-32175	.NET Core Tampering Vulnerability	Important	4.3	No	No	Tampering
CVE-2026-32177	.NET Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-35433	.NET Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2025-54518 *	AMD: CVE-2025-54518 CPU OP Cache Corruption	Important		No	No	RCE
CVE-2026-42899	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-40381	Azure Connected Machine Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42823 †	Azure Logic Apps Elevation of Privilege Vulnerability	Important	9.9	No	No	EoP
CVE-2026-33833	Azure Machine Learning Notebook Spoofing Vulnerability	Important	8.2	No	No	Spoofing
CVE-2026-32204	Azure Monitor Agent Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42830	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-33117	Azure SDK for Java Security Feature Bypass Vulnerability	Important	9.1	No	No	SFB
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-35424	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-41614	M365 Copilot for Desktop Spoofing Vulnerability	Important	6.2	No	No	Spoofing
CVE-2026-41100	Microsoft 365 Copilot for Android Spoofing Vulnerability	Important	4.4	No	No	Spoofing
CVE-2026-40377	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-41094	Microsoft Data Formulator Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40417	Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42833	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	Important	9.1	No	No	RCE
CVE-2026-42838	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	5.4	No	No	EoP
CVE-2026-40360	Microsoft Excel Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-40359	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-40362	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-42832	Microsoft Excel Spoofing Vulnerability	Important	7.7	No	No	Spoofing
CVE-2026-34329	Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40419	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40418	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35436	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-40420	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-42893	Microsoft Outlook for iOS Tampering Vulnerability	Important	7.4	No	No	Tampering
CVE-2026-40374	Microsoft Power Automate Desktop Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41102	Microsoft PowerPoint for Android Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-35439	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40368	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33110	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-33112	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-40357	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-32185	Microsoft Teams Spoofing Vulnerability	Important	5.5	No	No	Spoofing
CVE-2026-41101	Microsoft Word for Android Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-35440	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40421	Microsoft Word Information Disclosure Vulnerability	Important	4.3	No	No	Info
CVE-2026-41097	Secure Boot Security Feature Bypass Vulnerability	Important	6.7	No	No	SFB
CVE-2026-40370 †	SQL Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-41613	Visual Studio Code Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-41612	Visual Studio Code Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41611	Visual Studio Code Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-41610	Visual Studio Code Security Feature Bypass Vulnerability	Important	6.3	No	No	SFB
CVE-2026-33839	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33840	Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34330	Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34331	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35423	Windows 11 Telnet Client Information Disclosure Vulnerability	Important	5.4	No	No	Info
CVE-2026-35438	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-41086	Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-34344	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34345	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35416	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-41088	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34343	Windows Application Identity (AppID) Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35418	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-33835	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34337	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40407	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40397	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42896	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35419	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34336	Windows DWM Core Library Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-33834	Windows Event Logging Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-32209	Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability	Important	4.4	No	No	SFB
CVE-2026-33841	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-35420	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40369	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34332	Windows Kernel-Mode Driver Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-34339	Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability	Important	5.5	No	No	DoS
CVE-2026-34341	Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-33838	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34342	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-41095	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34340	Windows Projected File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-40398	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-21530	Windows Rich Text Edit Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-32170	Windows Rich Text Edit Elevation of Privilege Vulnerability	Important	6.7	No	No	EoP
CVE-2026-40410	Windows SMB Client Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35415	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34350	Windows Storport Miniport Driver Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-40405	Windows TCP/IP Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-40414	Windows TCP/IP Denial of Service Vulnerability	Important	7.4	No	No	DoS
CVE-2026-40401	Windows TCP/IP Denial of Service Vulnerability	Important	6.2	No	No	DoS
CVE-2026-40413	Windows TCP/IP Denial of Service Vulnerability	Important	7.4	No	No	DoS
CVE-2026-35422	Windows TCP/IP Driver Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-34351	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40399	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34334	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40406	Windows TCP/IP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-33837	Windows TCP/IP Local Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40415	Windows TCP/IP Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-42825	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34338	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40382	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-40380	Windows Volume Manager Extension Driver Remote Code Execution Vulnerability	Important	6.2	No	No	RCE
CVE-2026-40408	Windows WAN ARP Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34333	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34347	Windows Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-35417	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-42891	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-35429	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Moderate	4.3	No	No	Spoofing
CVE-2026-41107	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	7.4	No	No	Info
CVE-2026-40416	Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability	Low	4.3	No	No	Spoofing

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this month’s release, there are quite a few scary-looking bugs (including a CVSS 10!), but there’s no action for the end user as Microsoft has already mitigated these bugs and is just now documenting them. There’s also this month’s crop of Office bugs where the Preview Pane is an attack vector. However, the bug in Office for Android does not have the Preview Pane vector; it’s simple open and own. The bug in the WiFi driver needs a network adjacent attacker. The SharePoint bug requires authentication, but anyone with site privileges has the authentication needed. The bug in SSO Plugin for Jira & Confluence should really be called an authentication bypass, since it allows an unauthenticated attacker to gain access to a system.

Looking at the other code execution bugs, most are of the open and own variety as expected. The bug in Dynamic 365 (On Prem) requires high privileges. The Message Queueing bug requires an adjacent attacker. The bug in SQL Server requires authentication, but as usual, patching won’t be straightforward. Finally, there’s a bug in the kernel that leads to code execution. Most kernel bugs are privilege escalations, but this one could allow code execution if an attacker sends specially crafted NVMe over Fabrics (NVMe‑oF) response messages during the connection handshake process that contains an invalid header length value. Neat.

As usual, the vast majority of the Microsoft release fixes Elevation of Privilege (EoP) bugs. Also as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. There are also a few bugs that just state the attacker could “gain ELEVATED privileges.” How obtuse. The bugs in Azure allow an attacker to access data otherwise hidden from them. The Edge bug allows threat actors to elevate to the privileges of the running application. The bug in Visual Studio allows attackers to get permissions associated with the MCP Server’s managed identity. Finally, there are a couple of sandbox escapes, too, which are always useful.

This month's update includes six Security Feature Bypass vulnerabilities. The most severe is in the Azure SDK for Java (CVSS 9.1). An attacker over the network can bypass the integrity protection provided by authentication tags on encrypted data, effectively manipulating encrypted input in a way that slips past integrity checks during decryption. Close behind is the bypass affecting the GitHub Copilot integration in Visual Studio Code (CWE-74). This one requires a user interaction, but it allows an attacker to circumvent the path validation safeguards that normally control which files Copilot is permitted to modify. The other Visual Studio Code bypass involves cross-site scripting, improper link resolution, and information exposure triggered when a user opens or views a maliciously crafted notebook. On the Windows networking side there are two bypasses. The first hits the Windows TCP/IP driver via an authentication bypass using an alternate channel. The other impacts the Windows Filtering Platform through improper access control, allowing a local, low-privileged attacker to bypass FQDN-based network security rules. Finally, there’s a Secure Boot bypass that, you guessed it, bypasses secure boot features.

Moving on to the Information Disclosure bugs fixed this month, we have 15 different CVEs. As usual, the majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The bug in Power Automate could expose data marked “Sensitive” within Power Automate Desktop flows. One of the Word bugs could disclose NLTM hashes. The bug in Edge could disclose your cookies, which seems rude. The bug in Visual Studio could expose file path information. Finally, there’s a bug in Telnet for Windows 11 that leaks information being used by Telnet at the time. I didn’t even realize Windows 11 still had a telnet client.

The May release contains 10 spoofing bugs (plus the ones already addressed by Microsoft). The bug in Azure Machine Learning Notebooks vulnerability requires user interaction, but it could expose info through the Azure ML web interface to the attacker. There’s a cluster of fixes for Microsoft's mobile Office suite on Android. Excel, Word, and PowerPoint for Android all carry spoofing flaws rooted in improper access control. Two Copilot products are also affected by spoofing vulns. The M365 Copilot for Desktop has no details provided. The M365 Copilot for Android variant requires low privileges and producing only limited impact on confidentiality and integrity. Microsoft Teams for Android rounds out the mobile app spoofing bugs. Three Edge bugs close things out, all involving misrepresentation of information in the browser UI.

There are two Tampering bugs in this month’s release. The one in .NET Core allows threat actors to write files to an affected system. The other is in Outlook for iOS and manifests as a command injection bug.

There are eight DoS bugs in the May release, but as always, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting from a practical standpoint are two TCP/IP bugs that allow a low-privilege Hyper-V guest to crash the host. Both are triggered from the adjacent network. On the broader network-exposure side, the ASP.NET Core bug is a straightforward infinite loop condition — an unauthenticated attacker sends a crafted request over the network and the server stops responding.

No new advisories are being released this month.

Looking Ahead

Assuming I survive Pwn2Own Berlin (which is looking iffy at the moment), I’ll return on June 9th on what will hopefully be a smaller release than this one. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The June 2026 Security Update Review

Sat, 25 Jul 2026 19:02:53 +0200

I’ve made it through Pwn2Own Berlin, had a little vacation, and now I’m back for Patch Tuesday. Microsoft and Adobe didn’t disappoint. In fact, they have heralded my return with the largest Patch Tuesday release ever. Thanks? Take a break from your regularly scheduled activities and let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for June 2026

For June, Adobe released 11 bulletins addressing 123 unique CVEs in Adobe Acrobat Reader, ColdFusion, Experience Manager, Experience Manager Forms, InDesign, InCopy, Substance 3D Sampler, Content Credentials SDK, Dreamweaver, Format Plugins, and Adobe Campaign Classic. A total of 11 of these CVEs were reported through the ZDI program.

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-66	Adobe Campaign Classic	2	Critical	10.0	No	1
APSB26-64	Adobe ColdFusion	7	Critical	9.6	No	1
APSB26-63	Adobe Acrobat Reader	20	Critical	7.8	No	2
APSB26-57	Adobe Experience Manager Forms	3	Critical	9.3	No	2
APSB26-62	Adobe Dreamweaver	5	Critical	8.6	No	3
APSB26-65	Adobe Format Plugins	2	Critical	7.8	No	3
APSB26-59	Adobe InCopy	3	Critical	7.8	No	3
APSB26-58	Adobe InDesign	12	Critical	7.8	No	3
APSB26-60	Adobe Substance 3D Sampler	4	Critical	7.8	No	3
APSB26-61	Content Credentials SDK	8	Critical	7.5	No	3
APSB26-56	Adobe Experience Manager	57	Important	5.4	No	3
TOTAL	11 bulletins	123

Obviously, the update for Campaign Classic should be on the top of your deployment list if you’re a user. A CVSS 10 is rare; two in the same bulletin is pretty much a unicorn. Adobe says there are no active attacks, but I would expect heavy research into creating one. The update for Coldfusion is also a Priority 1, but again, no known attacks is the wild. I suspect the Reader patch will also receive a lot of attention as malicious PDFs are common in ransomware attacks. The update for Experience Manager may be large, but it’s mostly just cross-site scripting (XSS) bugs.

Microsoft Patches for June 2026

This month, Microsoft released a new record 208 CVEs Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Secure Boot, and BitLocker. At least, that’s my count. Microsoft’s tools seem to be having some issues, as they initially included a CVE from 2020 in this release. Regardless, the count is over 200, and I counted several times.

One of these bugs came through the ZDI program, but bugs submitted during Pwn2Own Berlin remain unpatched. If you include the Chromium and other third-party bugs, the total CVE count for June comes to a staggering 571 CVEs. 38 of these cases are rated Critical while the rest are rated Important in severity.

I’ve been counting CVEs on Patch Tuesday since 2017, and this is by far the largest monthly release in that time. The previous record was 177 set last year. It is extraordinary that Microsoft can produce so many patches in a single month, but it does raise concerns. How many of these cases were found using AI tools? How many patches were generated using AI to assist in coding or testing? What quality issues may exist in these patches? And likely most importantly, is this the new normal? The last two months were also large releases. Should sysadmins adjust their processes for prioritization and patch deployment based on this new volume of updates? Unfortunately, Microsoft is not providing those answers right now. Hopefully that changes in the future. BTW – just a note – the current number of CVEs shipped by Microsoft this year exceeds the total number of CVEs shipped in all of 2018.

One of the bugs patched by Microsoft this month is listed as under active exploitation and three others are listed as publicly known at the time of release. Let’s take a closer look at some of the more interesting updates for this month, starting with the bug being exploited in the wild.

- CVE-2026-41091 - Microsoft Defender Elevation of Privilege Vulnerability
Since Microsoft doesn’t provide info on how widespread exploitation is, we must read some tea leaves. For this patch, several different people were acknowledged, which indicates multiple parties say this is in the wild, meaning exploitation is likely significant. The good news is that most people won’t need to take action as Defender updates itself. However, if you don’t have this configured or are in an isolated environment, you’ll need to update to the latest version.

- CVE-2026-45657 - Windows Kernel Remote Code Execution Vulnerability
This CVSS 9.8 bug allows remote, unauthenticated attackers to execute code at SYSTEM level without user interaction. Yup – this is wormable. The problem lies in the way the kernel handles TCP/IP. This was listed as “Exploitation Less Likely” by Microsoft, but rest assured that every researcher and bug shop on the planet is reversing this patch right now trying to create an exploit. Test and deploy this patch quickly.

- CVE-2026-47291 - HTTP.sys Remote Code Execution Vulnerability
Our second CVSS 9.8 bug of the month, this also allows remote, unauthenticated attackers to execute code on affected systems without user interaction. However, there is a caveat. Systems using the default MaxRequestBytes registry value used by the Windows HTTP stack are not affected by this bug. You can edit your registry settings if you need protection while you test and deploy the patch. The bulletin includes instructions and even a PowerShell script for doing this action. Microsoft lists this as “Exploitation more likely”, so I would definitely check your registry settings.

- CVE-2026-44815 - DHCP Client Service Remote Code Execution Vulnerability
Here’s another CVSS 9.8 that has an odd incongruity. Although the CVSS says no permissions are required for exploitation, the write-up states it must be an “authenticated” user. I would err on the side of caution here and believe the CVSS. If that’s correct, then we have another bug where a remote, unauthenticated attacker could execute code on affected systems without user interaction. And since the DHCP client is on every OS, it’s a juicy target. This is another one to test and deploy with haste.

- CVE-2026-45585/CVE-2026-50507 - Windows BitLocker Security Feature Bypass Vulnerability
If you’ve followed the ongoing saga of Nightmare Eclipse vs. MSRC, the bugs should look familiar. One is definitely a fix for “YellowKey”, while the other appears to be a fix for “GreenPlasma”. The researcher has promised a “bone shattering” drop on June 14, so let’s hope Microsoft is able to reach some understanding with the researcher before more 0-days are released. Also, there is a script provided by Microsoft as a mitigation, but the better strategy is to test and deploy the updates.

Here’s the full list of CVEs released by Microsoft for June 2026:

CVE	Title	Severity	CVSS	Public	Exploited	XI	Type
CVE-2026-41091	Microsoft Defender Elevation of Privilege Vulnerability	Important	7.8	Yes	Yes	0	EoP
CVE-2026-49160	HTTP.sys Denial of Service Vulnerability	Important	7.5	Yes	No	1	DoS
CVE-2026-50507	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.8	Yes	No	1	SFB
CVE-2026-45586	Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability	Important	7.8	Yes	No	1	EoP
CVE-2025-10263 *	ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel]	Critical	9.3	No	No	2	EoP
CVE-2026-48567	Azure HorizonDB Elevation of Privilege Vulnerability	Critical	10	No	No	N/A	EoP
CVE-2026-32193	Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability	Critical	8.8	No	No	3	RCE
CVE-2026-47644	Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability	Critical	6.5	No	No	2	Info
CVE-2026-44815	DHCP Client Service Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-47291	HTTP.sys Remote Code Execution Vulnerability	Critical	9.8	No	No	1	RCE
CVE-2026-42824	M365 Copilot Information Disclosure Vulnerability	Critical	6.5	No	No	N/A	Info
CVE-2026-45476	Microsoft Azure Network Adapter Elevation of Privilege Vulnerability	Critical	8.2	No	No	2	EoP
CVE-2026-44810	Microsoft Cryptographic Services Elevation of Privilege Vulnerability	Critical	8.4	No	No	2	EoP
CVE-2026-48579	Microsoft Exchange Online Information Disclosure Vulnerability	Critical	9.1	No	No	N/A	Info
CVE-2026-47655	Microsoft Graph Information Disclosure Vulnerability	Critical	6.5	No	No	N/A	Info
CVE-2026-45497	Microsoft M365 Copilot Remote Code Execution Vulnerability	Critical	7.7	No	No	N/A	RCE
CVE-2026-45460	Microsoft Office Information Disclosure Vulnerability	Critical	4.7	No	No	3	Info
CVE-2026-45472	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45474	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45461	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45463	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45456	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45458	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-47635	Microsoft Outlook and Word Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-26142	Nuance PowerScribe Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-47289	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	2	RCE
CVE-2026-47654	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	3	RCE
CVE-2026-48563	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-42992	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-44799	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-44801	Remote Desktop Client Remote Code Execution Vulnerability	Critical	7.5	No	No	2	RCE
CVE-2026-42985	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	1	RCE
CVE-2026-45648	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.8	No	No	3	RCE
CVE-2026-42987	Windows Deployment Services (WDS) Remote Code Execution	Critical	8.1	No	No	2	RCE
CVE-2026-33828	Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability	Critical	7.8	No	No	3	EoP
CVE-2026-44803	Windows Graphics Component Remote Code Execution Vulnerability	Critical	7.8	No	No	1	RCE
CVE-2026-44812	Windows Graphics Component Remote Code Execution Vulnerability	Critical	7.8	No	No	1	RCE
CVE-2026-45607	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-45641	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.4	No	No	2	RCE
CVE-2026-47652	Windows Hyper-V Remote Code Execution Vulnerability	Critical	8.2	No	No	2	RCE
CVE-2026-47288	Windows Kerberos Key Distribution Center (KDC) Remote Code Execution	Critical	7.1	No	No	3	RCE
CVE-2026-45657	Windows Kernel Remote Code Execution Vulnerability	Critical	9.8	No	No	2	RCE
CVE-2026-48574	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	2	RCE
CVE-2026-45490	.NET SDK Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45491	.NET Tampering Vulnerability	Important	6.2	No	No	3	Tampering
CVE-2026-45591	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	2	DoS
CVE-2026-47643	Azure Stack Edge Remote Code Execution Vulnerability	Important	9.8	No	No	3	RCE
CVE-2026-41098	Azure Stack Edge Spoofing Vulnerability	Important	8.4	No	No	2	Spoofing
CVE-2026-45642	Microsoft Azure Attestation service and Device Health Attestation Service Spoofing Vulnerability	Important	3.9	No	No	2	Spoofing
CVE-2026-45650	Microsoft Bing Search Spoofing Vulnerability	Important	4.3	No	No	2	Spoofing
CVE-2026-45637	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45647	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	2	EoP
CVE-2026-40371	Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability	Important	8.8	No	No	2	EoP
CVE-2026-44822	Microsoft Excel Information Disclosure Vulnerability	Important	8.2	No	No	3	Info
CVE-2026-45455	Microsoft Excel Information Disclosure Vulnerability	Important	3.3	No	No	2	Info
CVE-2026-45469	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44817	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	3	RCE
CVE-2026-44818	Microsoft Excel Remote Code Execution Vulnerability	Important	7	No	No	2	RCE
CVE-2026-44820	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44823	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45459	Microsoft Excel Security Feature Bypass Vulnerability	Important	3.3	No	No	2	SFB
CVE-2026-45504	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	8.8	No	No	3	EoP
CVE-2026-45502	Microsoft Exchange Server Information Disclosure Vulnerability	Important	5	No	No	3	Info
CVE-2026-45503	Microsoft Exchange Server Information Disclosure Vulnerability	Important	8.1	No	No	3	Info
CVE-2026-45583	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	7.5	No	No	2	RCE
CVE-2026-45500	Microsoft Exchange Server Spoofing Vulnerability	Important	6.1	No	No	2	Spoofing
CVE-2026-45501	Microsoft Exchange Server Spoofing Vulnerability	Important	6.5	No	No	2	Spoofing
CVE-2026-47631	Microsoft Exchange Server Spoofing Vulnerability	Important	8.1	No	No	2	Spoofing
CVE-2026-42986	Microsoft Graphics Component Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-41092	Microsoft Kinect Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45644	Microsoft Live Share Canvas SDK Elevation of Privilege Vulnerability	Important	8	No	No	2	EoP
CVE-2026-47293	Microsoft Office Click-To-Run Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45485	Microsoft Office Information Disclosure Vulnerability	Important	3.3	No	No	2	Info
CVE-2026-44821	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45483	Microsoft Office Project Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45475	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44819	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-44824	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45645	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-49161	Microsoft PC Manager Security Feature Bypass Vulnerability	Important	7.8	No	No	3	SFB
CVE-2026-42902	Microsoft PowerToys Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45484	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	2	EoP
CVE-2026-45454	Microsoft SharePoint Remote Code Execution Vulnerability	Important	6.5	No	No	2	RCE
CVE-2026-47298	Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8	No	No	2	RCE
CVE-2026-45467	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45468	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45479	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45453	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47636	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47637	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-47638	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-47639	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	3	Spoofing
CVE-2026-47641	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-33113	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-45462	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-45464	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-45465	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-47634	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	1	Spoofing
CVE-2026-47640	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	3	Spoofing
CVE-2026-45481	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	1	Spoofing
CVE-2026-48560	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	2	Spoofing
CVE-2026-48562	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	2	Spoofing
CVE-2026-42835	Microsoft Teams for Android Information Disclosure Vulnerability	Important	8.1	No	No	2	Info
CVE-2026-45606	Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability	Important	5.5	No	No	2	DoS
CVE-2026-45482	Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability	Important	8.4	No	No	2	SFB
CVE-2026-45466	Microsoft Word Information Disclosure Vulnerability	Important	3.3	No	No	3	Info
CVE-2026-45471	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45486	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45643	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-45457	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-42980	NT OS Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-42916	NT OS Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45649	Office for Android Spoofing Vulnerability	Important	7.1	No	No	3	Spoofing
CVE-2026-47653	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	3	RCE
CVE-2026-42909	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	3	RCE
CVE-2026-42913	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	3	RCE
CVE-2026-42993	Remote Desktop Client Remote Code Execution Vulnerability	Important	7.5	No	No	2	RCE
CVE-2026-45588	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48568	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48570	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48573	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48575	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48576	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-48578	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-45654	Secure Boot Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-45656	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-8863	UEFI Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-40376	Visual Studio Code Elevation of Privilege Vulnerability	Important	7.5	No	No	2	EoP
CVE-2026-47281	Visual Studio Code Elevation of Privilege Vulnerability	Important	9.6	No	No	3	EoP
CVE-2026-47284	Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	2	Info
CVE-2026-47292	Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-48569	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	2	SFB
CVE-2026-47287	Visual Studio Code Tampering Vulnerability	Important	6.5	No	No	2	Tampering
CVE-2026-42829	Windows Administrator Protection Secure Feature Bypass Vulnerability	Important	7.8	No	No	2	SFB
CVE-2026-34335	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45601	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45598	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45596	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45638	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45603	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-42911	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45594	Windows Application Identity (AppID) Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45655	Windows BitLocker Security Feature Bypass Vulnerability	Important	5.3	No	No	2	SFB
CVE-2026-45658	Windows BitLocker Security Feature Bypass Vulnerability	Important	7.8	No	No	1	SFB
CVE-2026-45640	Windows Bluetooth Port Driver Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45605	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-47656	Windows Boot Manager Security Feature Bypass Vulnerability	Important	7.9	No	No	2	SFB
CVE-2026-44809	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45634	Windows DHCP Client Information Disclosure Vulnerability	Important	5.5	No	No	3	Info
CVE-2026-45608	Windows DHCP Client Information Disclosure Vulnerability	Important	6.8	No	No	3	Info
CVE-2026-41108	Windows DNS Client Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42905	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP
CVE-2026-44811	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44808	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44807	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42983	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44802	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44813	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44804	Windows DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-48566	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-44814	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45602	Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability	Important	9.1	No	No	2	Tampering
CVE-2026-42836	Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-42910	Windows Hotpatch Monitoring Service Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42972	Windows Hyper-V Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45592	Windows Internet (wininet.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42903	Windows Kerberos Denial of Service Vulnerability	Important	6.5	No	No	3	DoS
CVE-2026-42914	Windows Kerberos Denial of Service Vulnerability	Important	5.3	No	No	2	DoS
CVE-2026-48583	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-45653	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42984	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45600	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45604	Windows Managed Installer Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-45595	Windows Mark of the Web Security Feature Bypass Vulnerability	Important	5.4	No	No	2	SFB
CVE-2026-45636	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	2	RCE
CVE-2026-50508	Windows NTLM Spoofing Vulnerability	Important	6.5	No	No	1	Spoofing
CVE-2026-48565	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-44805	Windows Network Controller (NC) Host Agent Denial of Service Vulnerability	Important	5.5	No	No	3	DoS
CVE-2026-42981	Windows Performance Monitor Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-42974	Windows Performance Monitor Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-45487	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42828	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42837	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42969	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	3	Info
CVE-2026-42971	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42970	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42973	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42978	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42977	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42979	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-42991	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	3	EoP
CVE-2026-45639	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	7.5	No	No	2	Info
CVE-2026-42908	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	7.5	No	No	2	Info
CVE-2026-45593	Windows SDK Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42906	Windows Shell Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42907	Windows Shell Information Disclosure Vulnerability	Important	6.5	No	No	2	Info
CVE-2026-47648	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-42915	Windows TCP/IP Denial of Service Vulnerability	Important	5.7	No	No	2	DoS
CVE-2026-42904	Windows TCP/IP Elevation of Privilege Vulnerability	Important	9.6	No	No	3	EoP
CVE-2026-42968	Windows Telephony Server Information Disclosure Vulnerability	Important	5.5	No	No	2	Info
CVE-2026-42912	Windows Telephony Service Elevation of Privilege Vulnerability	Important	7	No	No	2	EoP
CVE-2026-45597	Windows UI Automation Manager (uiamanager.dll) Elevation of Privilege Vulnerability	Important	7	No	No	3	EoP
CVE-2026-45599	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-45635	Windows UPnP Device Host Remote Code Execution Vulnerability	Important	8.1	No	No	2	RCE
CVE-2026-40409	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-40404	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	2	EoP
CVE-2026-42989	Winlogon Elevation of Privilege Vulnerability	Important	7.8	No	No	1	EoP

* Indicates this CVE had been released by a third party and is now being included in Microsoft releases.

† Indicates further administrative actions are required to fully address the vulnerability.

Looking at the other Critical-rated bugs in this release, the scariest-looking one is actually nothing to concern yourself with at all. The CVSS 10 bug in Azure HorizonDB has already been addressed by Microsoft and is just being documented now. That’s also the case for five others. Of course, there wouldn’t be a release without Office bugs that have the Preview Pane as an attack vector. There are multiple in June. There’s a handful of bugs in the Remote Desktop Client, but these rely on connecting to a malicious RDP server. There are three patches for Hyper-V that allow for guest-to-host code execution. The bug in Active Directory requires authentication, but any authenticated user can hit it. For the Windows Directory Service vulnerability, it needs to be listening for TFTP. You have blocked that everywhere, right? The bug in Azure Network Adapter is somewhat unique as you need to update your Linux kernel to be protected. The bug in Azure Kubernetes allows an attacker to break out of a container and gain control of the AKS worker node. Finally, the bug in the Kerberos Key Distribution Center (KDC) seems unlikely, but if exploited, it could allow authenticated attackers to get code execution on affected systems.

Moving on to the other code execution bugs, there are the ubiquitous open-an-own bugs in Office components like Excel and Word. The code injection bug in Exchange Server looks troubling, but it requires a machine-in-the-middle (MiTM), so exploitation is unlikely. The bugs in SharePoint require authentication, but you should note that the patch applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. The two bugs in UPnP are interesting. Both can lead to code execution by causing an error during the handling of specially crafted data, which could lead to a Use After Free (UAF) bug. The bugs in RDP Client all require connecting to a malicious RDP server, but it’s not clear why some are rated Critical and some are rated Important. The NTFS vulnerability requires a user to mount a virtual hard drive on an affected system. The last RCE bug this month is in Azure Stack Edge and requires the attacker to send a specially crafted file upload request that includes a manipulated file name or path, leading to code execution.

There are more than 60 Elevation of Privilege (EoP) bugs in this month’s release, and as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. A notable exception is in Exchange Server, where a user on Outlook Web Access (OWA) could gain access to other mailboxes. The bug in Visual Studio Code could allow attackers to gain permissions associated with the MCP Server’s managed identity. The bugs in Windows SDK and Windows UI Automation Manager could let attacker go from low integrity up to medium integrity code execution. The bug in Bluetooth just allows “elevated” privileges without really describing what elevated might be.

Moving on to the more than 20 security feature bypass (SFB) bugs in the June release, there are a total of 10 that impact Secure Boot. All carry scope change (S:C) in the CVSS, meaning successful exploitation affects security boundaries beyond the vulnerable component itself — specifically the ability to load untrusted code at boot, bypass Virtual Secure Mode, and undermine boot integrity guarantees. CVE-2026-45654 explicitly calls out VSM exposure. The bulk of these are credited to Alon Leviev (STORM), which is notable given his prior BootKitty/BlackLotus-adjacent research. The bugs in the Windows Boot Manager have a similar impact as the Secure Boot bugs. The UEFI Secure Boot vulnerabilities go a layer deeper. They require either local admin or physical access but could allow for the running of untrusted code even before the OS loads. Rootkits anyone? The four bugs in BitLocker all require physical access but could yield encrypted data if exploited. The bug in Windows Administration Protection allows attackers to bypass the feature that prevents standard-user apps from performing admin-level actions. The bug in Visual Studio Copilot Chat could be the most interesting non-boot bug here as it allows authentication impersonation. Mark of the Web (MotW) and Excel vulns could bypass user warnings. Lastly, the bug in PC Manager bypasses expected user controls.

Turning our attention to the mass of spoofing bugs in the release, we instantly see 18 impacting SharePoint Server. Fortunately, these are simply cross-site scripting (XSS) bugs. It’s the Exchange bugs we should really watch for. One is an XSS that an attacker can exploit by convincing an Exchange administrator to open a malicious link or message, which then runs code in the admin's web session. That's a meaningful privilege escalation path. Another is listed as an SSRF-based attack, but no other details are available. The last is a lower-impact XSS with limited confidentiality/integrity loss. The bug in Bing Search (remember Bing?) is a classic search result spoofing. The bug in Azure Stack Edge is interesting as it could allow access to resources outside the vulnerable component's security boundary. The bug in Office for Android requires user interaction. The Office Project Server bug is an authenticated XSS with low impact. The final spoofing bug is in Azure Attestation but has already been addressed. You should still verify you are protected by following the instructions in the write-up from Microsoft.

There are 30 different information disclosure bugs in this release, and fortunately, the vast majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. The two bugs in Visual Studio require user interaction and could “disclose information over a network.” How obtuse. The bug in GitHub Copilot and Visual Studio Code could disclose discloses a sign-in access token for a user's work account. That's a meaningful credential exposure, not just random memory. That leaves the two bugs in Exchange Server. One could allow an authenticated user to gain information about which network services that the Exchange server can reach. The other sounds much like the spoofing bug in OWA as it allows attackers to see information in mailboxes they should not have access to.

I’ve never been a fan of the “tampering” category, as it could mean so many different things. For example, the bug in .NET simply says it could allow an unauthorized attacker to perform tampering locally. Similarly, the bug in Visual Studio says the same, expect here the tampering occurs over a network. Microsoft doesn’t even bother with a CWE for the tampering bug in the DHCP Server, so your guess is as good as mine.

There are seven DoS bugs in the June release, and as usual, Microsoft provides little to no actionable information about the vulnerabilities. The most interesting is the bug in HTTP.sys, which is listed as publicly known. This is an uncontrolled resource consumption, rated "Exploitation More Likely," and publicly disclosed. Since, HTTP.sys sits at the core of IIS and Windows web services, a network-accessible DoS here can take down any Windows server running HTTP-based services. Based on the Acknowledgement, it looks like this bug may have been found using AI. There are no real details for the other bugs, but based simply on the impact, I would focus on the Kerberos and TCP/IP bugs if you had to prioritize.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on July 14 and will be the last one before Black Hat/DEFCON. It’s usually a big release, so strap in and hang on. I’ll be back then to give you my full thoughts. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

The July 2026 Security Update Review

Sat, 25 Jul 2026 19:02:51 +0200

Well folks. Here we are. The bug apocalypse has fully descended upon us. I’ll do my best to sort this out in some way meaningful, but this month’s release shows us the nay-sayers were right, and I’ve got to hand it to the nay-sayers here. Excellent call. Take an extended break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for July 2026

Adobe has now moved to a bimonthly release schedule, which means they will be releasing patches on the second and fourth Tuesdays of the month. I’ll continue to cover the second Tuesday release here and update this blog should the fourth Tuesday release contain anything significant. I think this is a smart way to break up a monster release into something a bit more manageable. Apple has said they are taking a similar approach. We’ll see if other vendors follow their lead.

For the first part of the July release, Adobe released 12 bulletins addressing 88 unique CVEs in Adobe ColdFusion, Commerce, After Effects, Animate, Audition, Bridge, Creative Cloud Desktop Application, Experience Manager, Illustrator, Media Encoder, Premiere Pro, and the Content Credentials SDK.

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-82	Adobe ColdFusion	13	Critical	9.9	No	1
APSB26-73	Adobe Commerce	13	Critical	9.6	No	2
APSB26-78	Adobe After Effects	3	Critical	7.8	No	3
APSB26-83	Adobe Animate	6	Critical	8.6	No	3
APSB26-71	Adobe Audition	6	Critical	7.8	No	3
APSB26-81	Adobe Bridge	6	Critical	7.8	No	3
APSB26-77	Adobe Creative Cloud Desktop Application	2	Critical	8.1	No	3
APSB26-74	Adobe Experience Manager	13	Critical	9.6	No	3
APSB26-79	Adobe Illustrator	5	Critical	9.3	No	3
APSB26-72	Adobe Media Encoder	5	Critical	7.8	No	3
APSB26-76	Adobe Premiere Pro	4	Critical	7.8	No	3
APSB26-80	Content Credentials SDK	12	Critical	8.2	No	3
TOTAL	12 bulletins	88

While nothing is under active exploit, I would prioritize the Cold Fusion and Commerce patches first. The patch for Cold Fusion even clocks in with a CVSS 9.9 bug. Beyond that, most of these updates are pretty straightforward. If you’re using these products, patch them. However, you can use you regular patch cadence here.

Microsoft Patches for July 2026

Here it is. The Mother of All Releases. To call this record-breaking is an understatement. How to count this mess is anyone’s guess, but I see new Microsoft 621 CVEs for the month of July. Some of these are in online services where no user action is required. They also list about 480 bugs in Chromium and Microsoft Edge (Chromium-based) that I won’t cover here. Here’s how I put this in context. I looked at the last 20 years of Microsoft releases. The CVE count year-to-date exceeds all other years’ totals.

The products covered this month are also astonishing. There are patches for Windows and Windows components, Office and Office Components, Microsoft Edge (Chromium-based), Azure, .NET and Visual Studio, Github Copilot, Defender, Exchange Server, Hyper-V, Ages of Empire II, and Minecraft Server (really!). That phrase “Windows components” does some pretty heavy lifting here, too, as just about everything you’ve ever heard of is getting patched. All told, there are 63 rated Critical, six rated Moderate, one rated Low, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program (more on that later). Two CVEs are listed as under active exploit while one other is listed as publicly known.

So how do we eat this elephant? One byte at a time (pun intended). Let’s start by looking a closer look at some of the more interesting updates for this month, starting with the bugs being exploited in the wild.

- CVE-2026-56155 - Active Directory Federation Services Elevation of Privilege Vulnerability
This is one of several AD FS being patched this month, but it’s the only one being actively exploited. It stems from insufficient access-control granularity and does require local access and low privileges to start, but AD FS is exactly the kind of identity infrastructure attackers love to pivot through once they're in. It can also be paired with an RCE as we often see in ransomware. Test and deploy this patch quickly.

- CVE-2026-56164 - Microsoft SharePoint Server Elevation of Privilege Vulnerability
The other bug being exploited in the wild this month is a modest CVSS 5.3 – but it shows why Moderate severity bugs still matter. It's a missing-authentication flaw, meaning an unauthenticated attacker can hit it over the network with no user interaction required. When something this reachable is being actively abused, patch it now and worry about the score later.

- CVE-2026-57092 - Microsoft Windows VMSwitch Elevation of Privilege Vulnerability
This patch rates the highest CVSS score for the month: a solid 9.9. It’s a use-after-free that lets a low-privileged attacker escalate to full host compromise across a VM boundary. We saw something like this demonstrated at Pwn2Own Berlin on ESXi, but it clearly isn’t alone. If you’re using VMSwitch in your Hyper-V deployments (and you likely are), test and deploy this one quickly.

- CVE-2026-50522/58644 - Microsoft SharePoint Remote Code Execution Vulnerability
This matching pair of CVSS 9.8 bugs results from the deserialization-of-untrusted-data and are reachable without authentication or user interaction. CVE-2026-50522 was demonstrated during Pwn2Own Berlin, so it’s odd to see Microsoft list it as “Exploit Maturity Unknown” since we literally handed them a working exploit. Just another reason to do your own risk assessment and not rely 100% on the vendor. If you have any Internet accessible SharePoint servers, test and deploy this patch quickly.

- CVE-2026-56190 - Remote Desktop Protocol Remote Code Execution Vulnerability
This patch covers an unauthenticated, network-reachable, no user interaction required bug. The root cause is a classic one: use of uninitialized resource (CWE-908), meaning specially crafted RDP traffic can interact with memory that was never properly initialized, letting an attacker corrupt memory and potentially steer code execution. RDP Servers are a common target, so audit your systems to see which are internet accessible and start from there.

- CVE-2026-55008 - Microsoft Exchange Server Spoofing Vulnerability
Ignore the title here and treat this like the XSS bug it is. The vulnerability is listed as a CVSS 9.6 since it’s a stored cross-site scripting flaw in Outlook Web Access, with a scope-changed impact that lets it break out of the web app context entirely. An attacker sends a specially crafted email, and if the victim simply opens it in OWA, arbitrary JavaScript executes in their browser session — no attachment needed, no macro warning, just viewing the message does it. If you’re using OWA, test and deploy this one quickly.

- CVE-2026-50518 - Windows DHCP Server Remote Code Execution Vulnerability
There are a couple of these DHCP RCE patches in this release, but the other has caveats while this one does not. Both are heap-based buffer overflows scoring CVSS 9.8, both unauthenticated and network-reachable. If you're running DHCP Server role on anything Internet-adjacent (you're not, right?), these move to the top of the list.

- CVE-2026-56188 - Windows Server Network driver Remote Code Execution Vulnerability
Another Critical-rated bug, this one is caused by a race condition. It’s always fun to see a TOCTOU bug rated this high, since race conditions are notoriously finicky to exploit reliably. While it may prove tricky to exploit, this bug could allow an attacker to execute privileged code over the network without user interaction. Don’t let the race condition lull you to sleep on a wormable bug.

- CVE-2026-55010 - Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability
File this in the “why not” category. This bug is a heap-based buffer overflow in Minecraft Bedrock Dedicated Server, also CVSS 9.8 and also unauthenticated RCE. Yes, your kid’s Minecraft server (it is your kid’s server, right?) is exposed to the same class of bug as your DHCP infrastructure. Patch it anyway.

Here’s the full list of CVEs released by Microsoft for July 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-56164	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Moderate	5.3	No	Yes	EoP
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.1	Yes	No	SFB
CVE-2026-54121	Active Directory Certificate Services Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-45499 **	Azure OpenAI Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-48564	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50370	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50382	DirectX Graphics Kernel Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41106 **	Microsoft 365 Copilot Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-26145 **	Microsoft Azure Synapse Elevation of Privilege Vulnerability	Critical	4.8	No	No	EoP
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-55011	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55012	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55944	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-57100 **	Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55041	Microsoft Excel Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-54998 **	Microsoft Exchange Online Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-54992	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50314	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50467	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55018	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55022	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55045	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-55049	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55129	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55056	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55140	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55043	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55123	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55120	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-58644	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-55040	Microsoft SharePoint Server Security Feature Bypass Vulnerability	Critical	9.1	No	No	SFB
CVE-2026-54117	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54118	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50655	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-56189	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-57090	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57094	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57087	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55033	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55127	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55132	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55010	Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50474	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-49164	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-54128	Windows DHCP Client Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-49796	Windows GDI+ Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-54127	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	7.4	No	No	EoP
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	8.2	No	No	EoP
CVE-2026-50327	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58542	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7.8	No	No	EoP
CVE-2026-50392	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7	No	No	EoP
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50444	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-54999	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-47302	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50525	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50651	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57108	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50524	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50527	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50648	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50650	.NET Framework Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50646	.NET Framework Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50649	.NET Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47304	.NET Security Feature Bypass Vulnerability	Important	8.1	No	No	SFB
CVE-2026-50528	.NET Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-50659	.NET Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-50526	.NET Tampering Vulnerability	Important	7	No	No	Tampering
CVE-2026-50682	Active Directory Denial of Service Vulnerability	Important	7.1	No	No	DoS
CVE-2026-55001	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50647	Active Directory Federation Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50684	Active Directory Federation Server Spoofing Vulnerability	Important	4.8	No	No	Spoofing
CVE-2026-56170	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-47300	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-47303	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50652	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50653	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57969	Azure CycleCloud Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58279	Azure CycleCloud Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-47632	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50338	Azure Spring Apps Elevation of Privilege Vulnerability	Important	8.2	No	No	EoP
CVE-2026-50488	Clipboard User Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50491	Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50381	Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50427	Content Delivery Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50692	Desktop Window Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58633	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58634	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50296	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50375	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-50353	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50493	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56643	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56644	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58629	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49174	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-50495	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-57088	Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50663	Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-47282	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-50510	GitHub Copilot Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49787	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50420	HTTP.sys Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49788	HTTP/2 Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50696	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58617	M365 Copilot for iOS Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-58595	Microsoft Bing App for IOS Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-49162	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50305	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50361	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50466	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50458	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50658	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56178	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50657	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50329	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58541	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58596	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-57991	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	7.4	No	No	Info
CVE-2026-58291	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57981	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57984	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57985	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.6	No	No	RCE
CVE-2026-57986	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57988	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.1	No	No	RCE
CVE-2026-57992	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58276	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-56645	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57974	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57975	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58281	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58284	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58285	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58287	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58288	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58289	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	9	No	No	RCE
CVE-2026-58290	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58292	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58293	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58294	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57983	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-58295	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.3	No	No	SFB
CVE-2026-58525	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-57987	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-58278	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-56646	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-57977	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-57993	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.4	No	No	Spoofing
CVE-2026-58282	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58283	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58286	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58298	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.2	No	No	Spoofing
CVE-2026-58524	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-58296	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58297	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58300	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-58522	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-58299	Microsoft Edge for Android Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58523	Microsoft Edge for Android Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-50678	Microsoft Excel Information Disclosure Vulnerability	Important	6.6	No	No	Info
CVE-2026-54988	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-48580	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50408	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55046	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55138	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55054	Microsoft Excel Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55122	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55898	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-50675	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55899	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55948	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58618	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47642	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55024	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55025	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55031	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55048	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55029	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55039	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55136	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55141	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55036	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55044	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55037	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55058	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55137	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55053	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-54131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55947	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55949	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56156	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55006	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55009	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55005	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56642	Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-50343	Microsoft Install Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50439	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58537	Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56193	Microsoft Office Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55023	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55026	Microsoft Office Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-55027	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55028	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55047	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55035	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55057	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55121	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55042	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55139	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50665	Microsoft Office Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-56192	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56195	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-47290	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50301	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55017	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55125	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55133	Microsoft OneNote Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58636	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50438	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58647	Microsoft PowerBI Report Server Spoofing Vulnerability	Important	8	No	No	Spoofing
CVE-2026-55052	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58277	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-55051	Microsoft SharePoint Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54108	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-55016	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55019	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55020	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55021	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55030	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55034	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55126	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55135	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-56157	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-47296	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55002	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-47295	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50468	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54116	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-42900	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-49784	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50356	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49165	Microsoft Windows App Store Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54993	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58610	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55050	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55124	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55142	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55032	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55055	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55038	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55134	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55128	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55130	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50359	Microsoft XML Core Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-57097	Microsoft XML Security Feature Bypass Vulnerability	Important	6.4	No	No	SFB
CVE-2026-50346	Netlogon RPC Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50402	NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50506	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-45646	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-54989	Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50365	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-58594	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-49783	Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Important	9.8	No	No	EoP
CVE-2026-49168	Storage Spaces Direct Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-48581	Surface Broker SDMA Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49180	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50455	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54111	Universal Print Management Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58543	Universal Print Management Service Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58601	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Important	7.8	No	No	EoP
CVE-2026-50520	Visual Studio Code Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-45496	Visual Studio Code Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-57101	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	SFB
CVE-2026-57102	Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-47305	Visual Studio Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49805	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50297	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50325	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50489	Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57095	Win32k Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-50416	Win32k Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-56184	Win32k Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50432	Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-54119	Windows Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57976	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50366	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-49178	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-58529	Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54983	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50695	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50304	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50368	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50324	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-50355	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50411	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58631	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56196	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56197	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56169	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-57107	Windows Admin Center Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56185	Windows Admin Center Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50312	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-50462	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57093	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34346	Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-48572	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-48571	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50400	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50331	Windows Application Model Core API Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49803	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50351	Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50440	Windows Audio Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34328	Windows Audio Service Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50406	Windows Backup Engine Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50364	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-42975	Windows Bluetooth Port Driver Remote Code Execution	Important	8	No	No	RCE
CVE-2026-58538	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58638	Windows Boot Loader Security Feature Bypass Vulnerability	Important	6	No	No	SFB
CVE-2026-58637	Windows Client-Side Caching Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50384	Windows Clip Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49183	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50689	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50374	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58536	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58613	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50401	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50697	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50667	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50421	Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50428	Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-50352	Windows Cryptographic Services Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50302	Windows Cryptographic Services Security Feature Bypass Vulnerability	Important	4.2	No	No	SFB
CVE-2026-55144	Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-50347	Windows Data.dll Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49181	Windows DHCP Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50683	Windows DHCP Client Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-58627	Windows DHCP Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50685	Windows DHCP Server Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-49807	Windows DirectX Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49175	Windows DNS Client Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50487	Windows DNS Client Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50465	Windows DNS Client Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-49169	Windows DNS Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-50426	Windows DNS Server Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50424	Windows Domain Controller Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50300	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50437	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34348	Windows Event Logging Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50502	Windows Event Logging Service Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33842	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40422	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41087	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50473	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50442	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50389	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50456	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57084	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57091	Windows File History Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50405	Windows Filtering Platform Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54122	Windows GDI+ Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-50483	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Important	4.5	No	No	DoS
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50315	Windows Image Acquisition Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-49173	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Important	9.3	No	No	EoP
CVE-2026-49808	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50436	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Important	8.2	No	No	Info
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58602	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50393	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50396	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58544	Windows Management Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50404	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50336	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50398	Windows Media Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50414	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50379	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50676	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50677	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Important	5.3	No	No	Info
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50342	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56183	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-56187	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Important	5.9	No	No	RCE
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50317	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-49166	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-44800	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-55014	Windows Remote Help Defense Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50501	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50323	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50345	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50322	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50340	Windows Runtime Elevation of Privilege Vulnerability	Important	8.5	No	No	EoP
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50403	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50385	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50413	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50503	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58527	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50679	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Important	8.1	No	No	Info
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50328	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-58531	Windows SMB Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-54997	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-49801	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50690	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56168	Windows SMB Server Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50360	Windows SMB Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57089	Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50333	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50298	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49171	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-49170	Windows StateRepository API Server file Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58526	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50299	Windows Storage Spaces Direct Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-57968	Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57973	Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability	Important	6.3	No	No	Tampering
CVE-2026-50418	Windows System Secure Feature Bypass Vulnerability	Important	5.1	No	No	SFB
CVE-2026-50306	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50307	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49177	Windows TCP/IP Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50669	Windows Telephony Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50350	Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50326	Windows Unified Consent System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49790	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50498	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58547	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-49794	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	4.6	No	No	Info
CVE-2026-50453	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-58528	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-50321	Windows USB Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50479	Windows USB Hub Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55000	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	6.4	No	No	EoP
CVE-2026-54991	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54996	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49802	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49806	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50674	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49804	Windows USB Video Driver Elevation of Privilege Vulnerability	Important	6.6	No	No	EoP
CVE-2026-50454	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49176	Windows WalletService Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49800	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50480	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56173	Windows WebView Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58632	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54107	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-54986	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54112	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54114	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50670	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50688	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50687	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56176	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58628	Windows Wireless Network Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50295	Windows Zero Trust DNS Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-50509	Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55945	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	4.2	No	No	Info
CVE-2026-45488	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-45489	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-55145	Outlook Copilot Tampering Vulnerability	Moderate	6.3	No	No	Tampering
CVE-2026-56181	Windows Network Address Translation (NAT) Spoofing Vulnerability	Moderate	8.3	No	No	Spoofing
CVE-2026-58597	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.

I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.

Looking at the remaining Critical-rated patches, Office is its own weather system: fourteen Word/Excel/PowerPoint/Office RCEs clustered at CVSS 7.8, plus five Windows Media Foundation RCEs. Outside of the Preview Pane attack vector, they are individually unremarkable; collectively, patch Office and reboot. Always reboot. We’ve already mentioned DHCP some, but DHCP Server can't catch a break. Beyond the one already covered, add CVE-2026-56159, CVE-2026-48564, CVE-2026-50370, and DHCP Client cousin CVE-2026-54128. Five DHCP RCEs in one release. Rounding things out, Print Spooler (CVE-2026-58608), Windows TCP/IP (CVE-2026-54999), and a SQL Server RCE pair (CVE-2026-54117/54118) all receive patches, and all are rated a CVSS 8.8. VE-2026-55944 (Dynamics NAV/Business Central On-Prem RCE, 9.8) is the same deserialization flavor as the SharePoint pair; it’s unauthenticated, network-reachable, and easy to overlook since it's not SharePoint. CVE-2026-48561 (Microsoft Copilot RCE, 9.6) and CVE-2026-50380 (Windows GDI+ RCE, 9.6) round out the near-top tier. Don't forget CVE-2026-55040, a SharePoint Security Feature Bypass (9.1) — patch it in the same pass as the SharePoint RCE pair since it's the same product family. Identity and infrastructure get hit too: CVE-2026-54121 (AD Certificate Services EoP, 8.8) and CVE-2026-50444 (WSUS EoP, 8.8). The obscure Reliable Multicast Transport Driver (RMCAST) takes two RCEs (CVE-2026-54982, CVE-2026-54995), and CVE-2026-50474 gives Remote Desktop Client its own RCE, separate from the RDP one already covered. The rest is a long tail: Defender RCE x2, GDI+ again, Windows Media x2, Secure Kernel Mode EoP x2, and a second Hyper-V EoP. You can consider these “normal” as far as patch cadence goes.

That leaves us with 95 RCE to discuss. I would explain, but there is too much, so let me sum up. CVE-2026-55944 (Dynamics NAV/Business Central On-Prem, 9.8) is the same deserialization flavor as the SharePoint pair: unauthenticated, easy to miss since it's not SharePoint. CVE-2026-54990 (Remote Desktop Client), CVE-2026-49172 (Windows FTP Service), and CVE-2026-50447 (MSMQ) all hit 9.8 too, proof severity labels lag CVSS sometimes. CVE-2026-48561 (Copilot) and CVE-2026-50380 (GDI+) sit at 9.6.

The pattern worth watching: 14 Windows NTFS and 7 ReFS RCEs/ That makes 21 filesystem-driver bugs, an unusually large cluster suggesting a shared root cause. Microsoft Edge (Chromium-based) contributes 21 more that are genuinely Microsoft's to patch, not Chromium re-listing noise. Remote Desktop Client racks up a second and third RCE (CVE-2026-50474, CVE-2026-58594), and Windows Admin Center picks up two (CVE-2026-56196/56197) — WAC exposure keeps creeping into these releases. Exchange Server (CVE-2026-55005) and AD Domain Services (CVE-2026-49178) both land at 8.8.

And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.

There are close to 260 EoP bugs in this month’s release. Microsoft could have just published the EoPs and still had a record-setting month. As usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. What’s really frustrating is that 94 have no explicit privilege statement at all. Microsoft just says “elevate privileges” with no detail. By my count, that leaves around 25 bugs to consider. Some don’t elevate at all. The FAQ literally says the attacker just gets “the rights of the user running the affected application.” That covers Win32k, Clip Service, Search Service, MSMQ, and SharePoint. A few get a Low-to-Medium integrity bump. There are also a couple that lead to downgraded service accounts or arbitrary file deletion, but nothing else I’ve seen really stands out too much.

There are 20 Security Feature Bypass (SFB) bugs this month, and it's a genuinely mixed bag. CVE-2026-55040 leads at Critical, CVSS 9.1 as it’s weak authentication in SharePoint Server. Patch it in the same pass as the SharePoint RCE pair since it's the same product. The AI-coding-tool trend continues: GitHub Copilot and Visual Studio Code and Visual Studio all land SFB bugs, mostly injection or path-traversal flavored. BitLocker is this month's lone publicly disclosed bug. It’s not exploited yet, but public disclosure is a countdown clock, not a free pass. It requires physical access, as does the bug in Microsoft XML. The firmware/boot cluster is worth a second look: Secure Boot, Boot Loader, and Key Guard all touch the trust chain below the OS. Meaning, despite a low CVSS score, “if this fails, nothing above it can be trusted” stakes. Rounding out the SFB patches, there are two .NET SFBs, two Windows Kernel SFBs, and a DNS/Cryptographic Services bringing up the rear.

The July release includes 31Spoofing bugs this month, and we’ve already covered the most important (Exchange). SharePoint Server accounts for another ten with almost all the same root cause: stored XSS letting an authenticated attacker spoof content in the browser. Microsoft Edge (Chromium-based) contributes fifteen more spanning access-control failures, SSRF, type confusion, and UI misrepresentation. All genuinely Microsoft's to patch, not re-listed Chromium noise. The remaining six round out the usual suspects: a Windows NAT spoofing bug reachable from an adjacent network, a Bing app flaw on iOS, a PowerBI Report Server XSS issue, a .NET output-encoding bug, and an AD FS spoofing flaw. None publicly disclosed, none exploited, but with SharePoint's history this year, don't let "just Spoofing" lull you into deprioritizing the patch cycle.

Of 111 Information Disclosure bugs, the overwhelming majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. GitHub Copilot is the standout. Here, the bug insufficiently protected credentials, meaning actual secrets leak, not memory scraps. The Windows Admin Center flaw discloses data via improper authentication. A management console leaking to an unauthorized party is a bigger deal than it sounds. SharePoint uses SSRF to pull data server-side, and the Event Logging Service is a protection-mechanism failure, not a memory bug at all. Edge picks up three genuinely file-system-flavored disclosures — improper authorization, files/directories accessible to external parties, and link-following — plus Edge for Android exposing “private personal information” twice and two path-traversal bugs. The remaining 40+ are mostly one-line “exposure of sensitive information to an unauthorized actor” entries scattered across File Explorer, Push Notifications, Cryptographic Services, and Win32k.

Only 8 Tampering bugs this month, the smallest bucket, but a couple stand out. The top of the list is a WSUS bug, caused by an uncaught exception that lets an unauthenticated attacker tamper with the update service over the network. That’s your patch-management infrastructure itself being the target, which always deserves extra attention. Windows CNG (the crypto API) picks up a missing-cryptographic-step flaw, and Windows DNS Client shows up three separate times across the list, twice for improper access control and once for missing authentication on a critical function. DNS resolution having this many tampering paths in one release is worth flagging as a pattern rather than three unrelated bugs. The one genuinely different entry is Outlook Copilot, described simply as vulnerable to “malicious uses” enabling tampering over the network. That’s a fantastically vague phrasing for an AI-assistant feature, continuing this year's running theme of Copilot-branded features showing up somewhere in every release. Finally, a .NET link-following bug and a WSL2 kernel race condition receive patches. Both require local/authorized access to trigger.

Still with me? Good, because we have 35 DoS bugs to cover, and this is really an identity-infrastructure story more than a grab-bag. Active Directory Federation Services alone accounts for seven of them, all sitting at CVSS 7.5, all stack-based buffer overflows or infinite loops that let an unauthenticated attacker knock the service over the network. The .NET ecosystem is the other big cluster: .NET, .NET Framework, and ASP.NET Core/OData contribute nine bugs combined, almost all “allocation of resources without limits or throttling”. HTTP.sys and HTTP/2 pick up the same flavor. LSASS shows up twice, which is always worth a second look given what that process actually holds. Rounding out the list are patches for Windows DHCP Server, SMB Server, Secure Channel, Hyper-V, and IKE Protocol each take a single hit, mostly requiring authorized or adjacent-network access rather than being wide open to the internet.

No new advisories are being released this month.

Looking Ahead

The next Patch Tuesday will be on August 11, just after Hacker Summer Camp in sunny Las Vegas. Should I survive the heat, I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Announcing Pwn2Own Berlin for 2026

Sat, 25 Jul 2026 19:00:42 +0200

If you just want to read the contest rules, click here.

Willkommen zurück, meine Damen und Herren, zu unserem zweiten Wettbewerb in Berlin! That’s correct (if Google translate didn’t steer me wrong). After our inaugural competition last year, Pwn2Own returns to Berlin and OffensiveCon. Outside of our shipping troubles, we had an amazing time and can’t wait to get back.

Last year, we added Artificial Intelligence as a category with great results. This year, we’re expanding this and splitting it into multiple different categories: AI Databases, Coding Agents, Local Inferences, and a separate category for NVIDIA products. In last year’s contest, NVIDIA targets had wins, losses, and collisions, so it will be interesting to see how they fare this year. The folks from AWS wanted to get into the fray as well, so they stepped up to co-sponsor this year’s event, which allows us to increase the reward for bugs in Firecracker. Of course, we have all of the returning categories as well, including web browsers, containers, servers, virtualization, and operating systems. There’s more than $1,000,000 in cash and prizes available for contestants. Last year, we awarded $1,078,750 for 28 unique 0-days over the three-day event. We’ll see if we can eclipse those numbers in 2026.

The contest begins on May 14, but registration closes on May 7, so don’t delay in getting those submissions in. We’re hoping for maximum participation, so set aside your vibe coding and show us what you can really do. We’re looking forward to some cutting-edge exploitation on display. For 2026, we have a total of 31 targets across 10 categories. Here is a full list of the categories for this year’s event:

-- Virtualization
-- Web Browser
-- Enterprise Applications
-- Servers
-- Local Escalation of Privilege
-- Containers
-- AI Database
-- Coding Agents
-- Local Inference
-- NVIDIA

Of course, no Pwn2Own competition would be complete without us crowning a Master of Pwn (Meister von Pwn?). Since the order of the contest is decided by a random draw, contestants with an unlucky draw could still demonstrate fantastic research but receive less money since subsequent rounds go down in value. However, the points awarded for each unique, successful entry do not go down. Someone could have a bad draw and still accumulate the most points. The person or team with the most points at the end of the contest will be crowned Master of Pwn, receive 65,000 ZDI reward points (enough for Platinum status), a killer trophy, and a pretty snazzy jacket to boot.

Let's look at the details of the rules for this year's event.

Virtualization Category

Some of the highlights for each contest can be found in the Virtualization Category, and we’re thrilled to see what this year’s event could bring with it. As usual, VMware is the main highlight of this category as we’ll have VMware ESXi return with an award of $150,000. Last year produced the first ESXi exploits in Pwn2Own history, so it will be interesting to see if we get more. Microsoft also returns as a target and leads the virtualization category with a $250,000 award for a successful Hyper-V Client guest-to-host escalation. Kernel-based Virtual Machine (KVM) is our final target in this category with a prize of $50,000.

There’s an add-on bonus in this category as well. If a contestant can escape the guest OS, then gain arbitrary code execution on the virtualization target and obtain arbitrary code execution in the guest operating system on a separate virtual machine managed by the same targeted virtualization target, they’ll earn another $50,000. That could push the payout on a ESXi bug to $200,000. This bonus is for KVM and ESXi only. Here’s a detailed look at the targets and available payouts in the Virtualization category:

Back to top

Web Browser Category

While browsers are the “traditional” Pwn2Own target, we’re continuously tweaking the targets in this category to ensure they remain relevant. We re-introduced renderer-only exploits a couple of years ago, and this year, we’ve increased the award to $75,000. In fact, we’ve increased the awards across the board for this category. Here’s a detailed look at the targets and available payouts:

Back to top

Enterprise Applications Category

Enterprise applications return as targets with Adobe Reader and various Office components on the target list once again. Attempts in this category must be launched from the target under test. For example, launching the target under test from the command line is not allowed. Prizes in this category run from $50,000 for a Reader exploit with a sandbox escape or a Reader exploit with a kernel privilege escalation, and $150,000 for an Office 365 application. Word, Excel, and PowerPoint are all valid targets. Microsoft Office-based targets will have Protected View enabled where applicable. Adobe Reader will have Protected Mode enabled where applicable.

This year, we’re adding a bonus for Copilot data exfiltration and Copilot action execution. Microsoft just patched a bug like this in Excel, so we know they are out there. If you’re able to exploit Copilot in addition to a Microsoft application, you’ll earn an additional $50,000. There are quite a few rules and scenarios around this add-on, so be sure to read the rules carefully and contact us with questions. Here’s a detailed view of the targets and payouts in the Enterprise Application category:

Back to top

The Server Category

The Server Category for 2026 focuses solely on the server components we’re most interested in. These servers are often targeted by everyone from ransomware crews to nation/state actors, so we know there are exploits out there for them. The only question is whether we’ll see any of the competitors bring one of those exploits to Pwn2Own. Last year, the bugs demonstrated in SharePoint ended up being exploited in the wild, so we know people are looking for these with great interest. Microsoft Exchange has been a popular target for some time, and it returns as a target this year as well, with a payout of $200,000. This category is rounded out by Microsoft Windows RDP/RDS, which also has a payout of $200,000. Here’s a detailed look at the targets and payouts in the Server category:

Back to top

Local Escalation of Privilege Category

This category is a classic for Pwn2Own and focuses on attacks that originate from a standard user and result in executing code as a high-privileged user. A successful entry in this category must leverage a kernel vulnerability to escalate privileges. Red Hat Enterprise Linux for Workstations returns as our Linux-based target, while Apple macOS, and Microsoft Windows 11 return as targets in this category. Prior exploits in this category have won Pwnie awards, so they’re always interesting to see. Here’s a detailed look at the targets and payouts in this category:

Back to top

The Container Category

We’re excited to have this category return for its third season, and we’re hopeful that even more contestants will target one of these container targets. For an attempt to be ruled a success against these three, the exploit must be launched from within the guest container/microVM and execute arbitrary code on the host operating system. Again, with help from AWS, Firecracker returns as a target with a prize of $100,000. Here are the targets and payouts for this category:

Back to top

AI Database Category

In the past, AI Hackathons have focused on using AI to develop vulnerabilities or other offensive frameworks. We’re opening up the models and various components themselves for exploitation. The first AI sub-category focuses on databases. An attempt in this category must be launched from the contestant’s laptop. Here’s a look at the targets and awards in the AI Database category:

Back to top

The Coding Agent Category

Let’s face it. At some point or another, we’ve probably all vibe coded something. There’s no shame in that, but how secure are the tools we use for vibe coding? Well, let’s take the most popular choices and find out. A successful entry must interact with a contestant-controlled resource (e.g. web page, repository, media file) to exploit a vulnerability within the coding agent. The attack vector of the entry must be a common coding agent use case. There are few things out of scope here as well. UI spoofing or misrepresentation unrelated to permission prompts, model jailbreaks or prompt outputs that do not cross security boundaries, and vulnerabilities that require unsafe or permission-less modes are just a few of the things not allowed. As this is a new category, please read the rules carefully to ensure your entry qualifies. Here’s a look at the targets and awards in the AI Coding Agent category:

Back to top

The Local Inference Category

We couldn’t leave local inference and LLMs out of Pwn2Own. These products claim to provide enhanced data privacy, zero-cost inference, lower latency, and fully offline functionality. We’ll see how the security stacks up. An attempt in this category must be launched from the contestant’s laptop within the contest network. Here are the targets and payouts for the Local Inference category:

Back to top

The NVIDIA Category

Our last AI sub-category focuses solely on NVIDIA products. For network accessible targets, an attempt must be launched from the contestant's laptop within the contest network. For NV Container Toolkit, the attempt must be launched from within a crafted container image and execute arbitrary code on the host operating system. For Megatron Bridge, entries that leverage vulnerabilities pertaining to pickle deserialization or that leverage a vulnerability when “trust_remote_code=true” are out of scope. Here are the targets and payouts for the NVIDIA category:

Back to top

Conclusion

The complete rules for Pwn2Own Berlin 2026 are found here. As always, we highly encourage entrants to read the rules thoroughly if they choose to participate. If you are thinking about participating but have specific configuration or rule-related questions, email us. Questions asked over X (nee Twitter), BlueSky, or other means will not be answered. Registration is required to ensure we have sufficient resources on hand at the event. Please contact ZDI at pwn2own@trendmicro.com to begin the registration process. Registration for onsite participation closes at 5 p.m. Central European Time on May 7, 2026.

Be sure to stay tuned to this blog and follow us on Twitter, Mastodon, LinkedIn, or Bluesky for the latest information and updates about the contest. We look forward to seeing everyone in Germany, and we hope to see some of the best in the world show what they can do – vibe coded or not.

With special thanks to our Pwn2Own Berlin 2026 partners AWS, for providing their expertise and technology.

© 2026 Trend Micro Incorporated. All rights reserved. PWN2OWN, ZERO DAY INITIATIVE, ZDI, ZERO DAY INITIATIVE, TrendAI, and Trend Micro are trademarks or registered trademarks of Trend Micro Incorporated. All other trademarks and trade names are the property of their respective owners.

Smaller, smarter, safer: How to build agentic AI on the right foundation

Sat, 25 Jul 2026 18:55:52 +0200

When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.

“Smaller, smarter, safer — this is a bet our company has taken in how we deploy AI internally,” said Ricky Thakrar, head of sales and account management at Zoho, provider of a suite of popular cloud-based software solutions for sales, marketing, and finance.

“I’m on the business side, and so decisions made by our CIO and IT folks affect me directly, and my teams’ workflows and processes,” he added.

Speaking to a room of tech leaders at the CIO 100 Leadership Live New York event last week, Thakrar explained that every company wants the speed of AI-generated work wedded to the quality of human work, even though these two are diametrically opposed. No amount of model upgrades or spend will close that gap, so the only way forward is to architect your way out. Thakrar encapsulated this idea in a simple formula:

Smaller: Stop deploying maximum firepower on every task. Many tasks don’t need it.
Smarter: The system around the model decides more than the model does.
Safer: Verify at the point a mistake gets locked in, not just downstream of it.

He noted that organizations that win with AI won’t be those deploying the biggest, most powerful models or the most sophisticated architecture, but the ones that figure out that the model is the easy part and the right architecture is harder. That means understanding the hardest element, and the biggest differentiator, is building a human system that learns and compounds alongside agentic systems.

To get it right, organizations need to prioritize the context layer. The size of frontier models like the GPT series, Claude, and Gemini mostly exist to compensate for missing context, Thakrar explained. Without enough context, models need to be able to reason harder and infer more about what a user actually means because it doesn’t know the user’s account, process, or history. A rich context layer makes it possible for enterprises to run workloads on much smaller, lower-power models.

“The intelligence moves from the model into the architecture around it,” he said.

A steep learning curve

One of Zoho’s earliest AI agents was a churn management agent to help the account management team detect churn in customer subscriptions. So when a subscription became inactive, the agent would collect context from notes, meeting recordings, and Zoho’s data enrichment tool, then create a summary of reasons the account might have churned, and schedule a call.

“What happened was I got this churn agent a couple months later, already embedded in our CRM, and within a week my team no longer trusted that agent,” Thakrar said. “The reason is we forgot to collect one very key point.”

In Zoho’s CRM, when a customer buys a bundle of products, that bundle is represented as a single line item. That means the status of any products the customer may have previously purchased individually changes to inactive as they’re moved to the bundle. That’s not churn, but it was interpreted it that way. Zoho fixed it in the second version of the agent.

Then a new problem arose. Many potential customers first purchase Zoho products as pilots or sandboxes. As those customers move from pilot to live instance, they close down the pilot versions. And again, the CRM would record that as subscriptions going inactive.

“The trust deteriorates again because everyone got excited for version 2,” Thakrar said.

Sometimes, a certain product might not be the best fit for a customer and Thakrar’s team will suggest the customer move to another product. That’s deliberate churn, not a churn risk.

“You may have a similar story like this where the agent sounds so good, it’s going to do something quick and add value, but it’s missing context from the account managers, and there are so many more pieces we’re still building out,” Thakrar said. “It’s been almost a year and the problem I have is my team still doesn’t trust it. They’ll see [a message from the agent] and go out and do all the research anyway to make sure it gave the correct answer.”

The team is more on top of potential churn, though, but the promised productivity gains have yet to materialize because the agent has to earn back lost trust due to a lack of context.

“My goal for this year is having an AI-assisted customer journey from sales to account management where the handoff is clean, the context flows, and every piece of information we gather about a customer is weighed, identified, and coached so the sales team can close more deals,” he said.

Zoho’s early experience with agents has led to the idea that constrained, context-rich, deterministic architectures consistently outperform expensive models bolted onto fragmented systems. It all comes down to three pillars: routing, harness, and specialization.

Routing

Routing is about sending workloads to the proper model for the job, which entails providing enough context to a given task that a small, cheap model can handle it without the need for spare reasoning capacity to fill gaps.

Frontier models are expensive and companies can burn through a year’s budget worth of tokens in months. But most tasks can be handled by much smaller, more constrained models at a fraction of the cost.

“You don’t always have to pay the frontier guys for every task,” he said. “We’ve observed with some clients that we could save them 95% with a 3 billion parameter model.”

Harness

An AI agent harness is the software infrastructure scaffolding around an LLM that differentiates an agent from a chatbot. It’s what enables an agent to act on tasks rather than simply respond to prompts. A model reasons through a problem and decides what to do about it. The harness connects the model to the tools, systems, memory, guardrails, and execution environments required to perform the actions determined by the model. The term is frequently used more or less interchangeably with orchestration layer.

“It’s the process around the model, which matters way more than the model itself,” Thakrar said.

In benchmark tests, a superior harness on a less powerful model produces better results than an inferior harness on a much bigger model.

For the best results, Thakrar said, it’s essential to understand the deterministic and non-deterministic elements of a given workload, and build that into the architecture. Machines can read, organize, and validate, and they excel at deterministic tasks. Humans, on the other hand, are exceptional at non-deterministic tasks like judging, synthesizing, and deciding.

Those non-deterministic tasks in a process are the ideal point for AI agents to incorporate a human in the loop, what Thakrar calls human harness. He pointed to a stakeholder mapping agent Zoho built for sales as an example, which takes the context of an initial meeting and third-party enriched data like a LinkedIn profile, weighs probabilities, and makes an educated guess about the stakeholder map.

“The initial goal was just to eliminate that task completely from the human workflow,” he said. “The stakeholder map is done, it’s in the folder, and you can look at it.”

But the agent would struggle to capture nuance. The meanings of titles in organizations always vary, and the politics and dynamics of any given meeting can be difficult for an AI agent to discern. Rather than keep feeding the agent data to try to make it intelligent enough to make those determinations, it was simpler and more efficient for the agent to create a proposed stakeholder map and hand it over to a human who could make changes and explain why those changes were necessary.

Ultimately, Thakrar said the agent still saved human team members time because the stakeholder map was usually pretty close, and the corrections also helped the model grow smarter by adding richer context.

Specialization

Specialization is transitioning a process from testing on a frontier model to production on a much narrower, smaller model. Once you’ve proven that an agent can do a job well, you want to stop paying master-craftsman rates to keep doing that one job well.

Specialization is all about capturing your subject matter experts’ best judgement and pattern recognition to build an open-weight, open source, trained, and fine-tuned model that can be deployed in your own data center.

“The true enterprise bet is to keep that orchestration layer, which is your IP and knowledge, in house,” Thakrar said. “You don’t want to host that on someone else’s model. The goal of everyone in enterprise should be to run, train, and host their own models.”

Ask Slashdot: Which Apps Aren't Available on Linux?

Sat, 25 Jul 2026 10:12:48 +0200

Have you ever needed a Linux application which only exists in the Windows world? Long-time Slashdot reader BrendaEM writes: Windows does have a lot of useful app (but smaller than "power apps"). Some of these are closed source, some are open, but they're not all available in Linux yet. My list would have to contain Gimp Tookit versions of: IrfanView image manager, which I think is unequaled in Linux (though it does work to some extent under Wine). I also miss the full version of 7-Zip, because of its better compression settings, which File-Roller does not provide, though the Linux port p7zip is available (though unnoticed by common distributions). Lastly, I think that Notepad++ would be a good addition to Linux. That last one drew some pushback from long-time Slashdot reader jesco. "If there's one area where Linux shines, then it's the availability of high-quality text editors. Last time I looked Kate was still pretty nice, and there's Emacs, Vim and Neovim" if you're partial to command lines. But are there any daily-drive apps you still find yourself needing? Share your own thoughts in the comments. Which apps aren't available on Linux?

Read more of this story at Slashdot.

Firefox Nightly: More Kit, More Control – These Weeks in Firefox: Issue 203

Sat, 25 Jul 2026 08:37:32 +0200

Highlights

James enabled adaptive autofill in Nightly for testing, which we believe should provide better results in the URL bar when doing autocomplete!
Jack updated the illustrations shown on some of our error pages to match the latest approved designs, giving users more polished artwork when the browser encounters connection or security errors!

Controls for the Memories feature can now be set during Smart Window onboarding

We’ve disabled the CSS filter implicitly applied to WebExtension pageAction SVG icons across all release channels starting in Firefox 152, completing the deprecation
- NOTE: The blog post published at WebExtensions API changes in Firefox 149-152 provides to extensions developers more details about this deprecation and links to the related MDN docs.

Friends of the Firefox team

Resolved bugs (excluding employees)

Script to find new contributors from bug list

Volunteers that fixed more than one bug

Amin Amir
Pranjali Srivastava
Sam Johnson

New contributors (🌟 = first patch)

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

Fixed long-standing regression on the autocomplete and datalist popups for extension inline options pages on about:addons (introduced in Firefox 68 by Bug 1532724, fix shipping in Firefox 152) – Bug 1595158

WebExtensions Framework

Fixed access to web-accessible resources declared with from sandboxed documents (null-principal URLs), restoring extension redirects from the context-menu search flow, starting in Firefox 152 – Bug 2033905

WebExtension APIs

Added exhaustive test coverage for tabs.move() against additional edge cases related to split-view tabs – Bug 2029092

DevTools

Andreas Farre improved the Session History tab in the Application panel (still behind devtools.application.sessionHistory.enabled)
- added support for remote debugging (#2014064, #2016121)
- made sure that calls to History.replaceState are reflected in the UI (#2037359)
Julian Descottes [:jdescottes] fixed the most frequent DevTools crash we were observing in Telemetry, adding a guard against IDBTransaction errors when retrieving breakpoints in the Debugger (#2030260)
Nicolas Chevobbe [:nchevobbe] fixed the image preview tooltip for relative URLs images in constructed stylesheet (#2035503)
Julian Descottes [:jdescottes] reduced the overhead we had because of network requests monitoring by only decoding response content when the user actually want to see the response (#2026228)

WebDriver

Amin Amir cleaned up an incorrect variable assignment in our browsingContext module.
Logan Rosen updated stale references and broken links in our documentation about Marionette.
Sameem improved the Marionette and WebDriver BiDi screenshot commands to enforce maximum allowed dimensions.
Leo McArdle fixed the regression in the “log.entryAdded” event, which lacked an error message in the “text” field for the messages of type “error”.
Henrik Skupin fixed an issue in Marionette where WebDriver:Navigate and WebDriver:Refresh did not handle errors when the underlying navigation failed.
Henrik Skupin improved geckodriver to detect an early Firefox exit during startup on Android, avoiding up to 60 seconds of unnecessary connection attempts.
Henrik Skupin updated the geckodriver CI build job to produce a universal macOS binary supporting both x64 and aarch64.

Lint, Docs and Workflow

Sylvestre ported some linters (e.g. file-whitespace, test-manifest-toml, license, file-perm, rejected-words & more) to Rust to help improve the runtime of the code review bot.
Dale has been working on migration to moz-src for customkeys, dom/quota and odom/geolocation
- https://arewemozsrcyet.com/

New Tab Page

We did our first region-specific trainhop on May 11th (just 15% of the US), and turned on HNT Nova (and sometimes Widgets) for those clients to get some advance-data of its behaviour in the wild! A note that HNT Nova gets turned on for everybody when Firefox 151 ships on May 19th.
- We’ll be launching a similar experiment in the DE, probably on May 12th, also at 15% population.
Most of the team is heads down building out a sports-tracking widget, attempting to get that ready in time to be generally available for the upcoming World Cup event.
Dre landed a new world clock widget, which is currently off by default, but pretty snazzy!

Search and Urlbar

Nova (URL Bar Design Refresh)
- Drew and Daisuke continued their work on Nova styling for the Address bar (input and view).
Search and Suggest
- Drew finalized two bugs for World Cup and sports suggestions, which were landed and uplifted: one to update the localization string for scheduled games and another to show both teams’ icons in suggestions. Drew also landed and uplifted a fix for rich search suggestion icons being forced into a square aspect ratio.
- Standard8 updated Ecosia favicons to the latest branding, including QA testing and publishing.
Settings Redesign (SRD)
- Stephanie landed a test to ensure search suggestion settings are hidden when quicksuggest is disabled, as well as a patch to resolve TypeScript issues in search.mjs, and is adding test coverage to confirm removed search engines are not displayed in the default engines dropdown.
General URL Bar and Component Updates
- Daisuke landed implementation of the context menu on URL bar results, and a fix to show the loading URL in the URL bar when starting up with a homepage.
  - Marco is working on several tasks, including a PDF download / focus stealing issue and allowing arrays to be bound in Sqlite.sys.mjs. Marco also worked on fixes related to Places, such as avoiding replacing the favicons database if it is not corrupt.
- Standard8 finalized the URL bar test manifest split. Standard8 also upgraded us to TypeScript 6.
- Moritz landed a fix for URL bar abandonment telemetry being recorded when clicking an engine in the unified search button popup (Bug 2032973), which was also uplifted. Moritz also simplified search mode switcher item activation in tests, and made it so that the unified search button popup closes when installing an open search engine.

Smart Window

natural language starting with tab close/undo 2035343 with expandable action log 2031508

assistant rendering feedback up/down 2032994 and markdown table 2027029
nova styling blur 2027877 and suggestions 2026823
accessibility screen reader 2028676 and keyboard focus 2037565
optimize conversation starters extra requests 2030005 and caching 2033430

Storybook/Reusable Components/Acorn Design System

Nova token updates occasionally, focused on SRD

UX Fundamentals

Added support for the “SEC_ERROR_CA_CERT_INVALID” certificate error to the Felt Privacy error pages. – 2035942

Settings Redesign

Settings redesign is being tested and will hopefully go out in Firefox 152!

The Rust Programming Language Blog: The many journeys of learning Rust

Sat, 25 Jul 2026 08:37:24 +0200

This is another post in our series covering what we learned through the Vision Doc process. We previously described the overall approach and what we learned about doing user research, we explored what people love about Rust, dug into what it takes to ship safety-crticial Rust, and described some of the major challenges that people face when using Rust.

In this post we walk through what folks have found on their journey to learn the Rust programming language with ups and downs covered.

As a disclaimer, LLMs (Large Language Models) come up in this post because our interviewees brought them up. We're scoping discussion to their use as a learning tool, covering research and example generation, not broader questions about AI (Artificial Intelligence) in software development.

Many paths to needing Rust

The interviews surfaced several different paths into Rust: curiosity, embedded work, job-market pressure, organizational adoption, and reassignment after a team or company chose Rust. That last path matters because many learners are not evaluating Rust from a blank slate; they are trying to become productive after Rust has already arrived in their work.

"Funny enough, I've advocated for more niche languages than Rust in the past. Rust has pretty much stopped being as much of a niche language as it was, but it's not Java." -- Fractional CTO

Rust learning resources

Likely as expected, the folks that we talked to reach for a range of resources to learn Rust. Some reach for official documentation, such as The Rust Programming Language Book and find that sufficient to build on what the compiler was already showing them.

"I started with the official Rust documentation because there are a lot of great examples of how features like the borrow checker work." -- Software engineer at an Automotive supplier

Others needed more passes and more formats, sometimes reaching for resources the community maintains, such as Rustlings, The Little Book of Rust Macros, and Learn Rust With Entirely Too Many Linked Lists.

"The first time I went through the chapter in [The Rust Programming Language] on borrow checking, I was like, what is this? I read it again, then I watched a YouTube video of someone explaining the chapter." -- Rust freelance consultant

"Rust book, Rustlings, Zero to Production in Rust, Jon Gjengset tutorials. A bunch of books. It's not a one-pass reading. Can't say how many times I've gone through it." -- Software engineer working on video streaming and storage

These resources have brought up an entire generation of Rust programmers. But, to some, there is a perception that these resources have trouble keeping pace with the language.

"We'd like to use [The Rust Programming Language/'the book'], but we've found that it's out of date, unfortunately. We've looked at the GitHub repo and found it's got a lot of unresolved issues and unmerged PRs" -- Principal Software Engineering work on Rust adoption in a regulated industry

Whether or not this is factually true, Rust's growth has nonetheless put more scrutiny on these materials. Companies evaluating adoption and engineers getting reassigned to Rust teams are looking at them with fresh eyes and finding the gaps that affect their own evaluation.

Beginner stumblings and unlearning habits

It's pretty typical for Rust to be the 2nd, 3rd or Nth programming language that someone picks up. They'd end up writing their most familiar language in Rust, whether C++ patterns, Java patterns, or whatever they knew, for months or even years. Eventually they got comfortable enough to start writing idiomatic Rust.

"There's a bit of a drop in productivity compared to C if you're already familiar with it just because you're learning new rules, new syntax." -- Principal Firmware Engineer (mobile robotics)

"In the beginning it was more poking around the code and adding and removing some ampersands and asterisks to try to make sense of mut and not mut and whatever." -- Senior engineer with 20 years of Java experience in cloud and IoT

We also spoke with someone who found that not having much of a programming background seemed to benefit people picking up Rust. Not having worn-in grooves from other languages may play a role here, and it's worth investigating further.

"I had someone who had never programmed much before start working on the internals of [our Rust project]. She was just fine with getting into Rust. It's more of the senior people that struggle as they need to unlearn practices which may work in other languages, but it's not the 'Rust' way." -- Researcher, Automotive OEM R&D Lab

Learning to work with the borrow checker

We heard a lot about learning to work with the borrow checker instead of against it. People get there through different paths, but a few patterns came up repeatedly.

The compiler as teacher

Rust's diagnostics did the teaching on their own, especially around lifetimes.

"If you mess up the lifetimes in a piece of code that you've written by hand, I usually find that Rust's diagnostics are very helpful" -- Researcher working on static analysis of Rust programs

"Whatever's missing, the compiler usually fills in: it tells me 'you need to declare the lifetime of this reference', so I know and can figure it out. That all generally works pretty well." -- Senior Software Engineer

Learning by doing

Others felt like they only really internalized the borrow checker after writing a lot of Rust. It took projects, coding challenges, prototyping and so on until at some point it clicked.

"I actually did not understand the borrow checker until I spent a lot of time writing Rust" -- Founder of a startup built on Rust

"Besides the prototyping work, I also did coding-challenge-type stuff to get familiar with Rust for Advent of Code. [..] It eventually clicked to the point where I wasn't fighting with Rust, it was working for me. I had that experience other people describe: when I managed to get my program to fit with Rust, it worked. I didn't spend time debugging." -- Principal Software Engineer, large SaaS provider

Letting go of "clone guilt"

Some learners arrive with the assumption that good Rust means zero clones, zero copies, lifetimes threaded through everything. They set the bar at optimal before they've learned how to write idiomatic Rust, and it makes the borrow checker feel harder than it needs to be at the outset.

"On one of my first projects, I was like, 'I don't ever want to copy or clone anything,' so I carefully wove through all the lifetimes and got myself into a bit of a bind. Then I saw someone else just cloning the struct I was working with, and it was super cheap. Sometimes you can just clone and it's going to be okay." -- Researcher at a university

The experienced Rust developers we spoke with consistently said the same thing: clone freely while you're learning, then optimize when you understand the problem. Rust's reputation for performance and correctness feeds this. Newcomers assume anything less than optimal is wrong before they've written a first working program, and clone guilt is how that shows up.

We think it could be an interesting area of future study to check into the patterns Rust programmers employ at different levels of experience and under which circumstances. One member of the Rust Vision doc team that's very experienced with Rust noted that there's kind of an "expected shape" they understand as passing the compiler. This knowledge influences how they approach writing code which wouldn't take that shape and they naturally find themselves understanding when to use so-called workarounds, such as passing around indices into arrays or Vecs.

Multi-paradigm, but not the OOP some are used to

The Rust programming language is multi-paradigm, and how that lands depends on what you're coming from. We heard some that came from a functional background were delighted with digging into learning how much Rust inherits from that lineage. Some others noted that they and others on their teams struggled to unlearn the object-oriented style they'd come to use heavily in other languages like C++ and Java.

"Developers coming from C++ tend to think object-oriented. I think that's a difference between C++ and Rust." -- Architect at Automotive OEM

"I had exactly that thing, where I would apply all my years of Java and JS thinking, where I could just create some object, not care about it, return it, have it sloshing around between various functions. Found myself reaching for these patterns and then being told 'no, you cannot do that'." -- Principal Engineer at a SaaS company

Developers coming from functional programming had less to unlearn: strong typing, pattern matching, and an expression-oriented style were already familiar.

"My background has been more functional programming, strong typing. That originated for me as a Lisper: once a Lisper, always a Lisper." -- Principal Software Engineer working on Rust tooling for safety-regulated industries

"The languages I primarily used before Rust were things like OCaml. Way back, I came from C and C++, the classic languages, and then I spent quite a long time doing primarily pure functional stuff. These days I've ended up back in what I like to think of as a pragmatic center ground [with Rust]." -- Fractional CTO

Teaching Rust in academia

We spoke with a university professor that's been teaching Rust generally. In the academic environment, they were able to use proxies for some things such as "traits are like interfaces in Java" because the students had already gone through a set of courses in their first and second years that taught them Java. They introduced concepts slowly throughout the course, choosing to deal with some more complex topics like generics later. The outcome generally was that students had no problem picking up Rust in this setting.

"I couldn't see any big difference on the embedded side. We also teach an embedded class, and we did an experiment. Half of the students' feedback was worse on the Rust class, mostly because they needed to build the project themselves. The C students just got one from [an LLM], absolutely no problem." -- University Professor, on teaching Rust

The C cohort leaned on LLMs for the project in ways the Rust cohort couldn't. We don't yet have a clear answer for why.

What did come through clearly was the Rust cohort's experience with the community. Some students needed to figure out which drivers to use for the embedded project and how to use them. Their professor encouraged them to open issues and ask questions directly on GitHub, and the maintainers responded. Students who had never contributed to open source before were getting answers from the people who wrote the code.

Learning using LLMs

Some experienced folks shared that they saw LLMs as a tool that can help someone come up to speed quickly, either as a research tool or for generating example Rust code to understand concepts.

"I'm optimistic that there's a way to work [LLMs] in that will cut down that learning curve. One of the big things these tools bring is reducing the learning curve in general; these are very good tools to help you navigate a space that you don't know yet." -- Maintainer of large open source Rust crate

"I try [LLMs] out once a month, usually for generating an example or something like this. Just like with Stack Overflow: when you read an example, you should read it carefully and try to understand it. Not copy and paste it, but type it in your own words in code and then check it, because that's where the teeny tiny little mistakes are." -- Founder of startup built on Rust

For some learners, an LLM is just another way to find answers, no different than a search engine.

"So for the most part, picking up Rust - how do I learn? I'll [use web search for] things, I'll ask [an LLM], I'll just poke around and read the code." -- Senior Software Engineer working in a regulated space

One founder went further and claimed that LLMs change who can become a Rust developer. One consulting company founder described hiring high school graduates with no systems programming background and training them as Rust developers, with LLMs filling in the learning gaps that would previously have required years of experience.

"At the beginning, I was worried, but now that we have [LLMs] supporting development, the difficulty of the language doesn't matter. I'm seeing a huge opportunity behind strong runtime languages like Rust. [..] In [Developing Country] we hire 20-25 high school graduates, train them to be Rust programmers, then they enhance our workforce worldwide." -- Founder of a consulting company

We heard this from one organization. This is a claim that the combination of Rust's compiler and LLM tooling can dramatically shorten the path from beginner to working developer. Whether it generalizes depends on questions we can't answer from a single interview: how long these developers stay, what kind of code they can maintain independently, and whether this training/learning model works outside this company's particular structure. If it holds up, the pool of people who can become Rust developers is much larger than the usual hiring profile suggests.

Organizational considerations for Rust learners

We spoke with a number of folks on teams that are using Rust in larger organizations. Teams wanted to know that everyone would end up at roughly the same level of competence, which led a good number to invest in training courses to get there. Some leaders found that staff was able to ramp well enough by reading The Rust Programming Language, going through Rustlings, and then picking up lower risk and priority tickets to work on. Having a sense of community was also important within companies; it helps people know they are not alone when they are asked to work on Rust after, say, a reorganization happens.

"[..] the idea with the class as opposed to 'just read the Rust book on your own' was that this gives everyone kind of the same baseline going in." -- Principal Firmware Engineer (mobile robotics)

"So typically we're going to have people work through Rustlings, work through The Rust Programming Language. We have them then start to pick up lower risk tickets to work on." -- Principal Engineer at a large SaaS provider

"We've got an internal Slack channel for Rust learning where people can drop questions and others will come in and answer them. That helps build up understanding and community." -- Software Engineer at a large corporation

Some organizations found that while the person they'd hire would need to learn Rust, it was still preferable to the alternative of hiring someone for a critical piece of software written in another language.

"They needed to grow and maintain this C++ codebase. They had a C++ wizard, and they tried for about two years to find someone with the same level of expertise. They ended up hiring people that didn't know Rust and ramping them up, creating FFI bindings from the C++ side so they could work in Rust. And you can feel it: the borrow checker is teaching these people the right way to handle their systems." -- Principal Engineer at an Automotive OEM

The community and helping each other aspect seems to grow bonds as organizations mature.

"Our team is [all about] mentorship. I've mentored people coming up to speed on Rust, and people help each other hugely." -- Principal Software Engineer at a large SaaS company

Silent attrition

We identified some cases where people have approached Rust and bounced off of it, for one reason or another. In the below case, someone with a background in a language with fewer guardrails found themselves frustrated enough with Rust to walk away.

"All of that means that that embedded ecosystem is very frustrating to somebody who comes from C and is like, why can't I just get a pointer to this peripheral and then write into the registers. What are you doing to me? [..] My friend never got over that. He looked at it and said, I'm not going to deal with this and walked away." -– A second University Professor

There may be language features that for a particular domain are not seen as comfortable or usable yet, such as async Rust usage in a safety domain. We'd like to map which language features feel off-limits in which domains; async in safety-critical work probably isn't the only case.

"We're not fully sure how async [Rust] will work out in the long run in our domain. [..] People don't feel comfortable yet since C++14 doesn't provide such concepts. [..] It's the chicken-and-egg problem again: we probably need to gain some experience to see whether we can actually benefit from these new concepts in the automotive and safety domains." -- Team Lead at Automotive Supplier (ASIL D target)

We heard in at least one case, that while the language was challenging and there was a near bounce, the tooling helped keep them coming back and trying.

"Well, I think my early impressions of Rust - one is I find C++ so intimidating, and I think a big part of why I was able to succeed at [..] learning Rust is the tooling. I mean, all this makes sense [..] but it's like, for me, getting started with Rust, the language was challenging, but the tooling was incredibly easy." -- Founder of another startup built on Rust

While it might be considered more of a community concern, if there are interactions online and in spaces that point to learners having so-called "skill issues" this feeds into the narrative that Rust must be hard to learn. We may be unintentionally turning away Rust Project contributors and maintainers due to the vibes being put out when new learners show up in certain spaces.

"People are very helpful, but generally the attitude is: if your program is very complicated, it's mostly a skill issue. There's not that much empathy when people get stuck learning, and a lot of people are just pushed away by it. There's probably a huge number of people who silently stop wanting to write Rust, because at some point it gets complicated and the feedback they get is 'you just need to be a better programmer, obviously'." -- Software Engineer at a SaaS Provider

Feedback on near-bounces from survey

We found a few interesting perspectives collected in the Rust Vision doc survey which we administered with examples of bouncing and coming back:

"I started before 1.0, got stuck very soon when trying to translate patterns from C++ to Rust (due to borrow checking). I tried again after 1.0 and it stuck. [..]" -- Survey Respondent A

Survey Respondent A went on to share in a more detailed response about a perceived weakness in Rust learning materials related to lifetimes and the borrow checker are explained. There was an observation that it's fairly easy to run into more complex situations with lifetimes and the borrow checker. They felt that the current state of this sort of material and tutorials is fairly superficial and can leave learners stuck when they run into those more complex situations.

One respondent that bounced once and came back shared challenges around usage of async. In concert with Rust's memory-safety and the borrow checker, they found some of the nitty-gritty details of async were difficult to learn. While we're aware of the Rust Project's continuous efforts to improve Rust's async story, this is another data point of a user that faced challenges.

Another survey respondent shared how they had multiple times bounced in trying to learn Rust. They returned after a year or so and found Rustlings to be highly motivating. We note that having multiple pathways for folks to learn Rust opens up more possibilities for those that nearly bounced, just like this person.

Need more focused work on silent attritrion

The thing that stood out most to us was the lack of real, first-hand knowledge of having bounced when learning Rust. While this is an obvious effect of soliciting answers to our survey and opportunities to interview through Rust channels and our networks, this cohort is good future candidate where interviews could start.

Conclusions

Across these conversations, the experience of learning Rust depended heavily on context. Why someone was learning and what support they had mattered as much as the borrow checker. The same kinds of examples kept coming up: a training course that got a team to a shared baseline, a maintainer answering a student's first GitHub issue, and a colleague whose code showed that cloning was okay.

That context is largely something the community has a hand in. With that in mind, here is what we take away from what we heard, and what we still don't know.

What seems worth trying

Learning materials aimed at unlearning. Syntax barely came up when people described their struggles. People struggled with unlearning habits from previous languages, whether OOP structuring from C++ and Java or the instinct to grab a raw pointer to a peripheral. Most of our learning materials teach Rust from first principles, and that works. What we didn't come across is much written for, say, the engineer with ten years of Java who lands on a Rust team after a reorg: material that names the patterns they'll reach for that won't transfer, and shows what to do instead. The professor we spoke with did a version of this in the classroom, leaning on "traits are like interfaces in Java" and saving generics for later in the course, and the students did fine. Something similar could work outside the classroom too.

Put the "clone freely while you're learning" advice somewhere official. Every experienced developer we spoke with gave the same advice, but learners seem to mostly pick it up by accident, like the researcher who happened to see someone else cloning the struct they had been carefully threading lifetimes through. Saying it early in official materials would take some of the steepness out of the curve. The broader version belongs there too: idiomatic Rust doesn't have to mean optimal Rust, especially on a first project.

Diagnostics are already a primary learning resource: several people told us the compiler taught them lifetimes before any documentation did. Diagnostics reach learners right at the moment they're stuck. When writing new ones, it seems worth keeping the confused newcomer in mind alongside the expert, because for a lot of people this is where the learning happens.

Is "the book" actually out of date? Whether or not The Rust Programming Language or other materials are actually behind, a team evaluating Rust looked at its repository, saw unresolved issues and unmerged PRs, and moved on. As more companies evaluate adoption, more people will look at these materials with the same fresh eyes. Visible issue triage and some communication about what's current and what's planned would address the perception, separately from whatever content work may or may not be needed.

How stuck learners get treated is shaping who stays. We heard about students getting answers on GitHub from the maintainers who wrote the code, and we heard about learners being told their struggles were a skill issue. The first group came away with a lasting good impression of Rust. Some of the second group walked away entirely, and because they leave quietly, it's easy to underestimate how many of them there are. The welcoming side of the community came up unprompted as a reason people stayed, so we know it makes a difference when we get this right.

Every organization we spoke with described essentially the same ramp-up for bringing a team to Rust. Teams that brought groups of developers to Rust described roughly the same approach: get everyone to a shared baseline with a training course or with The Rust Programming Language and Rustlings, start people on lower-risk tickets, and give them somewhere internal to ask questions. Several organizations also found that hiring developers without Rust experience and ramping them up worked out better than continuing to search for rare expertise in another language. None of this is complicated, and teams weighing adoption don't need to invent a training program from scratch.

What we still don't know

The biggest gap is the people we didn't reach. Nearly everyone we spoke with stuck with Rust long enough to be reachable through Rust channels, so the stories of bouncing off came to us second-hand: a friend who walked away from embedded Rust, colleagues who quietly stopped after the responses they got. As we wrote in our first post, finding people who decided against Rust takes targeted outreach. If the proposed User Research team comes together, talking with learners who bounced would make a good early project, and learning is probably the area where that research would teach us the most.

We also don't know what to make of LLMs as a learning tool yet. They came up as a search engine, as an example generator, and in one organization's case as something that makes training high school graduates into working Rust developers possible. We saw a classroom where the C cohort leaned on LLMs in ways the Rust cohort couldn't, and we don't have an explanation for it. All of this comes from a handful of conversations, so we treat it as a set of leads to follow up on. Given how quickly the tools are changing, it seems better to study this deliberately than to wait and see what folklore develops.

The folks we spoke with showed that people do get there: with enough passes through the materials and enough code written, it eventually clicks. The opportunities above are mostly about making it work for the people who didn't pick Rust on purpose, and for the ones who would have stuck around if their early experience had gone a little differently.

Chrome Dev for Desktop Update

Fri, 24 Jul 2026 19:25:04 +0200

The Dev channel has been updated to 152.0.7967.2 for Windows, Mac and Linux.

A partial list of changes is available in the Git log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Chrome Release Team
Google Chrome

The Anbernic RG SP looks like an awesome update to one of the most iconic Game Boys of all time

Fri, 24 Jul 2026 18:21:22 +0200

The Anbernic RG SP has pretty much everything you want from a modern take on the Game Boy Advance SP.

Security Workarounds: The Risk Signal Hiding in Plain Sight

Fri, 24 Jul 2026 15:11:05 +0200

Short answer

Security workarounds are unofficial ways people bypass, modify, or route around approved processes to get work done. They can create cyber risk, but they also reveal where security controls, business workflows, tools, incentives, or guidance may not fit real work. Mature human risk management programs treat workarounds as risk signals, not just employee misbehavior.

GitOps vs Traditional DevOps

Fri, 24 Jul 2026 13:05:05 +0200

Why GitOps is Not Just CI/CD

Fri, 24 Jul 2026 13:05:04 +0200

What GitOps Really Is

Fri, 24 Jul 2026 11:41:27 +0200

How do you interpret JSIG AC-10?

Fri, 24 Jul 2026 03:11:51 +0200

Hello all,

I am curious if anyone has to deal with the JSIG AC-10 control in their environment. As a reminder, here it is:

AC-10 CONCURRENT SESSION CONTROL Control: The information system limits the number of concurrent sessions for each non-privileged and privileged to maximum of three (3) sessions. Supplemental Guidance: Organizations may define the maximum number of concurrent sessions for information system accounts globally, by account type (e.g., privileged user, non-privileged user, domain, specific application), by account, or a combination. For example, organizations may limit the number of concurrent sessions for system administrators or individuals working in particularly sensitive domains or mission-critical applications. This control addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. This control may require third party software or development of a script.

I have a solution set up in my environment that tracks how many logons a person does (stored in sqlite3 db). In my pam.d files, I have it check on logon and denies a person from opening more than 3 (ssh, console, xrdp) sessions. It works pretty good although annoying when I want to open a bunch of sessions on patch weekend.

I am starting to question why that might matter. What I would more than likely expect to see is "control how many concurrent sessions per machine there are". This certainly seems to be what RHEL-09-412040 talks about, which is /etc/security/limits.conf "maxlogins". That could help prevent DDOS.

How do you interpret this? How do you meet this control in your environments?

submitted by /u/Hxcmetal724
[link] [comments]

HPR4690: Playing Civilization V, Part 14

Fri, 24 Jul 2026 02:04:41 +0200

This show has been flagged as Clean by the host.

In our sample game we look at playing as Austria and aiming for a Diplomatic Victory. And our focus is on puppeting City-States, but I misunderstood and instead of making a Diplomatic Victory easier, it makes it harder. I still managed to get my Diplomatic Victory, but a Science or Domination Victory would definitely have been easier in this scenario.

Playing Civilization V, Part 14

Now I am at turn 340, I just puppeted another City-State, and I have one more on the way. I have sent a large number of military units, both land and sea, to the City-States that are on Japan’s border. If he tries anything now he will likely regret it. Now I am starting to build things I had not bothered with before, like Granaries and Amphitheaters. I got a couple of Great Engineers, and used them to rush build Wonders. I am nearly finished puppeting all of the City-States, and my Happiness and Income are both quite healthy. I am in such good shape I started to build the World’s Fair, which I initally proposed then ignored.

At this point I only have one more City-State to puppet, then I will have puppeted every City-State in the game. So it is time to put my large income to use in other ways by giving gifts to the other players. I may want to get a few more votes on my side to get over the top in the World Leader vote when it happens. On turn 357 I completed the puppeting of all of the City-States in the game. Meanwhile, I am building up my Science and building Wonders as they become available. I didn’t build any in the early game because I had other priorities, but now I have a strong military, high income, and no other pressing needs. My score on the Leader Board is now double that of my nearest competitor which is still Japan. And their denunciation me of just expired with them taking no action.

I used a Great Engineer to rush build the Porcelain Tower, earning me another Great Scientist, which I then used to build another Academy. At this point it is mostly a slog to the finish. Since I was so dominant and so wealthy I could afford to pursue a couple of other options just in case. One was a Science victory, which looked like a possibility, though it would be close. I had to be very focused in my Science Research. The other option was a Culture victory, and I had dominated two other empires culturally without half trying, and I was generating Great Artists, Great Musicians, and Great Writers pretty rapidly. So I built Museums, then Archeologists, and grabbed every artifact I find to stuff into the Museums. But the final Victory came when I researched Globalization. This tech allows you to get an extra vote in a World Council for every Spy you send to another empire’s capital and designate as an Ambassador. I immediately sent my spies out (they had previously been in my cities doing counter-espionage since I had a tech lead). And a few turns later a vote for World Leader came up and I won.

This was my first time using Maria Theresa of Austria as my leader, and it was fun, but in the end puppeting all of the City-Staters actually made it harder to win a Diplomatic victory. In other games I have played, every City-State that was an ally was an extra vote in the World Council, and I assumed that making them puppets would mean I would get that many votes. But that didn’t happen. Of course, if I had read more carefully in the Civilization Wiki I would have realized this, because it says there very clearly that Austria is one of the worst Empires to pick if you are going for a Diplomatic victory. So the fact that I managed it anyway is nice. I think I actually could have done a Science victory as I had my Spaceship half-built when I won the Diplomatic Victory. But I hope this analysis of how I actually played this game will be helpful to someone else.

Nvidia's latest trick for cooling its data center hardware is... hot water? 'Hot liquid cooling' is warmer than a hot tub, but apparently does the job pretty well

Fri, 24 Jul 2026 01:34:11 +0200

Nvidia's newest AI servers are cooled by water hotter than a hot tub: 45°C going in, 55°C coming out, while skipping out on fans altogether

Stable Channel Update for Desktop

Fri, 24 Jul 2026 00:27:13 +0200

The Stable channel has been updated to 150.0.7871.186/.187 for Windows and Mac and 150.0.7871.186 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.

This update includes 4 security fixes. Please see the Chrome Security Page for more information.

[N/A][518237034] High CVE-2026-16807: Out of bounds write in Codecs. Reported by Google on 2026-05-30

[N/A][522064153] High CVE-2026-16806: Use after free in WebMCP. Reported by Google on 2026-06-10

[N/A][523292588] High CVE-2026-16805: Use after free in Blink. Reported by Google on 2026-06-12

[N/A][524721670] High CVE-2026-16804: Use after free in Input. Reported by Google on 2026-06-16

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Daniel Yip

Google Chrome

Chrome for Android Update

Fri, 24 Jul 2026 00:27:11 +0200

Hi, everyone! We've just released Chrome 150 (150.0.7871.186) for Android. It'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 150.0.7871.181/182, Linux: 150.0.7871.181) unless otherwise noted.

Krishna Govind

Google Chrome

Multi-turn attacks broke AI models 88% of the time — single-turn testing missed it, Cisco AI security lead warns at VB Transform 2026

Thu, 23 Jul 2026 20:48:24 +0200

When Cisco ran 6,986 multi-turn attacks against 15 flagship models, attackers who adapted across the conversation broke through as often as 88.3% of the time. Amy Chang, Cisco's head of AI threat intelligence and security research, brought that finding to the agentic security panel at VB Transform 2026; the number should worry anyone still running single-turn red-teaming programs.

VentureBeat's June 2026 Pulse survey of 107 enterprise respondents explains why the room was full. More than half, 54%, have already had a confirmed agent security incident (18%) or a near-miss caught before harm (36%). Just 32% give every agent its own scoped, managed identity, and fewer still, 30%, isolate their highest-risk agents in sandboxes. Provider-native and hyperscaler controls remain the primary agent security layer at 82% of companies surveyed. The world's largest security vendors have done the same math.

Palo Alto Networks closed its $25 billion acquisition of CyberArk in February, CrowdStrike agreed in January to pay $740 million for SGNL, and Cisco announced its intent to acquire Astrix Security for a reported $400 million, all of it aimed at the identity and isolation layer most enterprises have not finished building.

Chang came to the panel with almost two decades of experience spanning cybersecurity operations, government, and the military. She ran global cybersecurity operations as an executive director at JPMorgan Chase, where she led the bank's cyber threat intelligence teams, and served as a senior staffer on the House Foreign Affairs Committee and as a U.S. Navy Reserve officer. She also teaches cybersecurity and emerging threats as adjunct faculty at the Middlebury Institute of International Studies.

Chang's 88.3% number comes from a study she co-authored with Nicholas Conley, built on 30,090 single-turn prompts and 6,986 multi-turn attacks against those 15 closed and proprietary flagship models. Multi-turn success rates ranged from 7.89% to 88.3%, every model tested showed non-trivial multi-turn exposure, and the two testing styles did not even rank the models in the same order. Cisco publishes adversarial evaluation signals for what is now 105 models on its LLM Security Leaderboard, she told the audience.

"If you don't understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent, that is powering your application, to understand where those failure points are," Chang said. Single-turn testing is the one-shot malicious prompt, she explained, while extending an attack into a longer conversation "is more realistic of how we are actually engaging with our models, with our agents, with our applications." That longer arc surfaces harmful outputs and misaligned behaviors that a snapshot never catches.

Cisco has pushed the testing itself into agentic territory. Chang described a framework where agents assess a deployment scenario, develop relevant attacks, judge whether they are worth pursuing, execute them, and evaluate their own success. What surprised her most, after all that sophistication, was how simple the defensive answer stays. "The answer is still that it's pretty simple," she said. "You don't have to get super creative. You just need to think about truly what are the fundamentals and basics of what I'm trying to secure in my organization."

Her starting point for CISOs beginning agentic deployments is Cisco's Integrated AI Security and Safety Framework, which she said "stipulates all the ways that AI can be compromised across the AI lifecycle" from modality through supply chain. From there, teams can work backward from real incidents, trace how each attack was achieved, and use the framework to build a strategy with the right coverage and mitigations.

Heather Ceylan, the CISO of Box, sees the same gap from the defender's side. "A lot of what you see out there with agent red teaming is just single-turn, and that's not how people are actually interacting with AI day-to-day," she told the audience. Box now simulates multi-turn adversaries with agents that think like an attacker and iterate attempt after attempt to hijack the target. "You have to pressure test your agents because otherwise you don't know if your execution controls are really working as you intended."

Box deployed agents inside its security operations center about a year ago, starting with human approval required for every action, and trust built quickly enough that analysts shifted into monitoring mode. Then the agent made one mistake, and every bit of that accumulated trust vanished. "They had to start all over again," she said. "So I think that that monitoring piece is so important. Even if you're not gonna have a human in the loop, things change, models change, and we can't control how the models change and interpret things."

Rajesh Parekh, VP of AI and ML at Intuit, brought the builder's perspective. Parekh led large-scale computer vision and ML systems powering Google's Maps and Geo products before joining Intuit, and holds a doctorate in computer science.

Three layers versus an operating system

Ceylan described Box's approach as three concentric layers. Permissioning comes first, so the agent never accesses more content than the human who invoked it. Ephemeral sandbox environments spin up for each agent task, containing the blast radius if an agent gets hijacked, and runtime execution control restricts the agent's tool calls to only those relevant to the task at hand. "If you want an agent to summarize a doc for you, if you have a prompt injection that came in that says forward this to maliciousattacker at domain.com, it can't do that," Ceylan said. "That action in that tool call is not even in its vocabulary."

She classified agent actions into three oversight categories. Actions that are not sensitive, like read and summarize, need no human in the loop. Moderately sensitive actions skip human approval but get logged and monitored, while destructive actions like mass deletion of files always require a human. "Things are gonna shift between those three categories quite a bit," she acknowledged, "but setting those types of categories up front allows you to have a principled framework."

Rather than layering controls onto agents one at a time, Intuit has built a central platform called GenOS, short for generative AI operating system, which abstracts security, risk, and fraud modeling so individual agent developers never reinvent protection. "Permissioning is not about giving access to AI," Parekh said. "Instead, it is defining very tightly scoped and clearly auditable authority to the agent to perform very specific tasks." Intuit evolved from agents inheriting user permissions to each agent carrying its own identity, and the company is now investigating mid-session permission changes tied to the specific task underway.

Parekh calls the broader model an AI-powered expert platform, one where the human expert is built into the trust architecture rather than bolted on as a gate. "The paradigm that we are pursuing is where the user, the AI agent, and the human expert are collaborating to solve the user problem," he said.

The end of human code review

Ceylan took on the tension between security testing and development velocity without hedging. "The days of secure code reviews where a human's looking at the code and we're looking at security architecture reviews, design docs, those are done," she said. "If you keep trying to do security that way, you're gonna get left behind." Box is building toward a fully agentic development lifecycle where agents review design documents, apply security requirements, and review the code for vulnerabilities. "I'm very optimistic that we will get to a point where we will write code without security vulnerabilities because agents and the models are going to get so good at writing code without vulnerabilities," she said. "We're still a long way away from that."

Her advice for development teams skips the advanced AI concepts entirely and returns to basics that predate agents. "It comes down to very basic least privilege access," she said. "If you start giving your agents overly broad permissions at the beginning, it's really hard to comb that back and build an infrastructure that allows for those ephemeral credentials and only those narrowly scoped tasks."

Parekh explained why the red teaming surface has expanded so quickly. "These agents have skills, and skills could become vulnerabilities," he said. "Agents have access to certain data, they have access to tools, and there could be threats that are lurking within those tools as well. So suddenly the blast radius of the malicious code or the intent increases dramatically." When Intuit identifies common vulnerability patterns from its manual red teaming exercises, it automates those tests back into the GenOS harness so future agents inherit protection and red teamers stay focused on new threat vectors. Runtime scanning of prompts and responses adds a final layer that can stop a suspect response and escalate to a human expert, he said.

"You need to continuously test to ensure that those remain robust to the protections that you have built, as well as to account for any sort of drift or any other types of dependencies that you introduce into your scenario that can create novel vulnerabilities," she said.

Intent versus probability

An audience question about intent detection set off the sharpest exchange of the session. Ceylan noted that when Box's own agent operates, the system always knows the user's intent because it controls the prompt, which means guardrails and tool-call restrictions can be engineered around it. The harder challenge, which she admitted Box is still trying to solve, arrives when external agents connect and the context behind the request is opaque.

That exchange exposed a split running through the wider industry. Mastercard, in the fireside chat immediately preceding the panel, came down on the side of quantifying intent, building an open-source framework to propagate it as a standard because complex B2B procurement cannot work without that trust. Endpoint security CTOs, in briefings with VentureBeat, have gone the other way, saying they will bet on probability rather than intent inference for production workloads. Chang explained why models, as they are trained today, cannot reliably derive intent from a prompt, which is why deterministic controls and behavioral proxies remain necessary. Ceylan agreed that both are required. "If you're not doing anything deterministic, you're really relying heavily on that intent, and I haven't seen programs that are there yet," she said.

Ceylan's story about trust collapsing after a single agent mistake landed as the panel's most memorable moment because enterprise agentic security is not a problem that gets solved and stays solved. Models change, permissions drift, and adversaries adapt across multi-turn conversations that snapshot tests never capture.

For the 82% of enterprises relying on provider-native controls as their primary security layer, and the 59% shopping for agent security tooling over the next 12 months, the panel's takeaway was blunt. Test the way attackers attack, across full conversations and continuously, or find out in production what your single-turn red teaming missed.

AMD raises the AI stakes with Helios, Venice and robotics

Thu, 23 Jul 2026 20:48:09 +0200

AMD’s MI455X targets the AI memory wall

AMD

The aforementioned lower-precision formats can also raise throughput and reduce memory use, but model developers still have to determine where they can be applied without unacceptable accuracy loss.

AMD’s Helios rack takes aim at Vera Rubin

Dave Altavilla

Kind of like cowbell, AMD Venice gives agentic AI more CPU

AMD

Pensando networking and ROCm software advance

Customer commitments underscore rack-scale confidence

AMD expands its robotics and embedded foundation

Execution for AMD is now the test

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Chrome Dev for Android Update

Thu, 23 Jul 2026 20:14:27 +0200

Hi everyone! We've just released Chrome Dev 152 (152.0.7965.2) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

An AI now judges every move Rubrik's agents make, its AI chief said at VB Transform 2026 — but no one's measured if the judge is right

Thu, 23 Jul 2026 19:19:49 +0200

At a CISO roundtable organized by Anthropic's chief information security officer, Dev Rishi asked a simple question: Did everyone in the room have their AI governance and security policies written down? Every hand went up — about 14 people, by his count. His follow-up, about how anyone actually enforces those policies in practice, got a different response. "And everybody chuckled," Rishi, the GM of AI at Rubrik, recalled at VB Transform 2026 fireside chat in Menlo Park. "It was like the dirty secret in the room that everyone has these policies, but no way to actually make them real."

“Our founder and CTO has actually been really pushing to enable our agents in YOLO mode,” Rishi told the audience. That admission comes from a publicly traded data security firm whose business is backing up what he called the most important data in the world.

YOLO mode strips the permission prompt out of agent workflows and lets the agent act on its own. In Rubrik's version, a second AI judges every action in real time against policy in place of a human clicking approve. Rubrik is running the experiment on itself first. Rishi treats autonomy as a settled capability question and an open judgment question. "If you ask the agent to act autonomously, it will," he said. "It's a question that you have internally. Should it?"

Rubrik earned that question the hard way. When Claude Code and Cowork pilots rolled out, the company required every command to run in ask mode so the employee issuing it carried the liability, and the developer pushback filled a single Slack thread 120 messages deep.

"The developers basically are pushing back, and they're like, this is like the iTunes service agreement. I'm just hitting check, check, check, check, check, check, check," Rishi said. "There's no way that I can actually read through this. And it becomes security theater." Roughly 80% of respondents are in the same bind, Rishi said, citing Rubrik Zero Labs research that found monitoring and approving agent actions takes more time than the agents save. The State of the Agent, the April report behind that figure, surveyed more than 1,600 IT and security leaders.

SAGE is the reason Rubrik trusts the bet. Short for Semantic AI Governance Engine, SAGE is the arbitration layer inside Rubrik Agent Cloud that watches every action an agent takes and reads the semantic intent behind it, then rules the action in or out against policies written in natural language. "We took what people said was human in the loop, a good idea, and we replaced it with AI in the loop," Rishi said, describing the pitch to security chiefs he characterized as skittish about non-deterministic systems.

Security approval, not cost, blocks AI ROI

Rishi’s path to Rubrik ran through Predibase, the generative AI infrastructure startup he co-founded and ran as CEO until Rubrik agreed to acquire it in June 2025. Before that, he led ML product at Google on the team that became Vertex AI, served as Kaggle's first product manager as it grew from about one million to ten million users, and holds bachelor's and master's degrees in computer science from Harvard.

Over roughly his first three and a half months at Rubrik, Rishi set up 200 customer conversations with IT and security leaders across a customer base that looks like the Global 2000, asking open-ended questions about cost, latency, performance, and orchestration. "Pretty consistently, what I heard through all of those conversations was that all of those are pretty secondary," he said. "The main challenge is actually, how do I get this approved from a security and risk standpoint? I'm concerned about all the different things that could go wrong. Actually, I felt like that was one of the biggest things constraining ROI."

VentureBeat Pulse research presented on the Transform stage earlier in the day confirms the gap Rishi kept hearing. Two-thirds of enterprises, 66%, already allow or are actively building toward production deployment with zero human review, yet only 5% fully trust the automated evaluations that would make that decision.

One AI reading what the rulebook can't

Rubrik's own policies exposed why written rules fail as enforcement. One internal rule states that agents should respect Rubrik's customer data use policy, which sounds enforceable until someone tries. "Rubrik's customer data use policy is like a three-page document of legal text," Rishi said. "I have no idea how to write that in there as a rule." Asked on stage how a team of AI infrastructure people took on a problem that security engineers own, Rishi answered, "with a lot of naivety and innocence, honestly." His team bet that models good at understanding language could police other models, and SAGE became the answer.

The case for putting a model in the judgment seat comes down to precision. A rule like "agents should not be able to edit revenue fields in Salesforce" fails in conventional tooling because Salesforce does not delineate which fields count as revenue, Rishi explained, so administrators fall back on approving every Salesforce action by hand. SAGE reads the intent instead and acts as a judge, carrying organizational context, which can tell a benign lookup from the edit the policy prohibits.

Keeping the judge small is what makes the economics work. SAGE runs on a small language model that Rishi said operates at an order of magnitude lower cost and latency than a frontier LLM. "If I told you, don't worry, you're gonna be secure and governed, but I'm gonna double your cost and latency, you would tell me to get out of the room," Rishi said.

When Rishi asked who in the audience had worried about token consumption over the past year, half the hands went up. "And I guess the other half is probably just too lazy to raise their hand," he said.

SAGE is an aggregation of judges based on parameter-efficient fine-tuning that Rubrik uses to take on task-specific variants of a base model with shared organizational context. One judge watches for tool-use hallucinations while another suppresses PII before it can leave, each running as its own enforceable policy. Security and GRC teams have started writing financial rules into the same layer, including one internal policy barring AI spend on personal projects.

The lethal trifecta

Asked which attacks worry him most, Rishi pointed at the lethal trifecta, the term security researcher Simon Willison coined in June 2025 for an agent that holds private data while taking in content nobody vetted, with a channel to send what it finds to the outside world. The danger, according to Rishi, is what happens when individually legitimate permissions stack. An agent granted Salesforce access and email access on an employee's credentials has done nothing wrong yet, with yet being the operative word. "A very simple example is that an agent can start pulling data from Salesforce and then decide to accidentally leak and exfiltrate that out via an email," he told the audience. A financial services company he met the morning of the session made the point for him, telling Rishi that none of the individual permissions are bad on their own and the agent needs every one of them to do its job. "It should have permission to each of those systems, but it's the combination that ends up becoming really destructive," Rishi said.

Traditional identity and access management never priced in that combination because it relied on the judgment of the employee holding the credentials, Rishi argued, and agents supply none. "I can tell you the number of times Claude Code has tried to leak some of our sensitive source code to a public GitHub repository is incredibly high," he said. Cutting agents off from public resources entirely would defeat their purpose, which returns the problem to adjudicating intent in context rather than revoking access.

A separate VentureBeat June Pulse survey of 107 qualified enterprise respondents maps the blast radius of exactly this pattern. On the Transform stage that morning, VentureBeat research reported that 69% of companies run credential sharing somewhere in their agent fleet. Companies with shared credentials anywhere got hit more often, reporting a security incident or near-miss at a 63.5% rate (47 of 74), against 40.9% (9 of 22) where every agent carries its own scoped identity.

The attacks no single turn reveals

Rubrik Agent Cloud reached general availability in February, though not everything Rishi described ships in it yet. Backtesting is just starting to roll out. The feature replays an organization's historical agent actions and tool calls against a new policy, showing where the policy would have stepped in and where an action would have sailed through uncaught, with policy edits applied in real time. Rishi called that archive one of the most valuable data troves an enterprise holds.

Real-time detection and blocking turn out to be the entry point rather than the whole product. Some attacks never trip a single-action rule. "No individual turn of the conversation was problematic, but if you took the session as a full trace, that ended up being problematic," Rishi said. Agent Cloud runs batch analysis across entire session traces every hour or every day and surfaces what Rubrik calls insights, the problems no individual guardrail caught. The same Zero Labs report found that 88% say they lack the ability to roll back agent actions without system disruption, a recovery gap that sits squarely in Rubrik's original line of business.

A skeptical CISO will ask the question the fireside did not answer. SAGE is a non-deterministic model policing other non-deterministic models, and Rishi offered no false positive or false negative rate for the judge itself. The closest thing the architecture gives to an answer is auditability, since backtesting and the batch insights both leave a human-reviewable trail of each call SAGE made and whatever got past it. Who watches the watcher, for now, is a trail of receipts rather than a benchmark. Until that benchmark exists, AI in the loop stays an operational wager rather than a quantified control.

Three questions fall out of the session for security teams. How many of the guardrails now in production depend on a human clicking approve, and what happens to that workload as agent count grows? Does anything in the stack enforce semantic intent, or is it all allow and deny lists? And can the team backtest agent behavior against a new policy, then unwind a multi-turn session without taking systems down?

Rishi's timing has a market behind it. In the same VentureBeat research, 82% of enterprises still name their primary AI provider's built-in guardrails and cloud controls as their main agent security layer, and 59% plan to adopt, add, or replace agent security tooling within the next 12 months. Only 12% include an agent-identity product in what they are considering, even with credential sharing still the norm. Every CISO at that Anthropic roundtable had a policy document and no enforcement mechanism, and Rubrik built a product for the space between the two. YOLO mode is the bet that an AI watching other AIs can finally make the policies real.

Smaller, smarter, safer: How to build agentic AI on the right foundation

Thu, 23 Jul 2026 12:04:43 +0200

When it comes to building an effective AI stack, context is king and power isn’t everything it’s cracked up to be.

“I’m on the business side, and so decisions made by our CIO and IT folks affect me directly, and my teams’ workflows and processes,” he added.

Smaller: Stop deploying maximum firepower on every task. Many tasks don’t need it.
Smarter: The system around the model decides more than the model does.
Safer: Verify at the point a mistake gets locked in, not just downstream of it.

“The intelligence moves from the model into the architecture around it,” he said.

A steep learning curve

“The trust deteriorates again because everyone got excited for version 2,” Thakrar said.

Sometimes, a certain product might not be the best fit for a customer and Thakrar’s team will suggest the customer move to another product. That’s deliberate churn, not a churn risk.

The team is more on top of potential churn, though, but the promised productivity gains have yet to materialize because the agent has to earn back lost trust due to a lack of context.

Routing

“You don’t always have to pay the frontier guys for every task,” he said. “We’ve observed with some clients that we could save them 95% with a 3 billion parameter model.”

Harness

“It’s the process around the model, which matters way more than the model itself,” Thakrar said.

In benchmark tests, a superior harness on a less powerful model produces better results than an inferior harness on a much bigger model.

“The initial goal was just to eliminate that task completely from the human workflow,” he said. “The stakeholder map is done, it’s in the folder, and you can look at it.”

Specialization

iPhone Air 2 Release Date, Features, Camera, Battery and Everything We Know

Thu, 23 Jul 2026 09:13:24 +0200

Apple is already working on the second-generation iPhone Air, and early reports suggest it will fix several of the biggest complaints about the first model. While the original iPhone Air impressed buyers with its ultra-thin design, many users wanted better cameras, longer battery life, and improved sustained performance. The upcoming iPhone Air 2 is expected to bring meaningful hardware upgrades while keeping the slim design that defines the Air lineup. Apple also appears to be changing its iPhone launch strategy, which means the next Air model may not arrive alongside the Pro models as many expected. iPhone Air 2 at a glance FeatureExpected DetailsRelease windowSpring 2027ProcessorA20 Pro built on 2nm processRear camerasDual cameras with Wide + Ultra WideBatteryAround 3,500mAhCoolingVapor chamber coolingDesignSimilar ultra-thin chassis Will Apple release an iPhone Air 2? There were reports earlier that Apple had paused development because the first iPhone Air did not sell as well as expected. Later reports clarified that Apple had not canceled the device. Instead, the company shifted its roadmap and continues to develop a second-generation model, which is currently believed to be in advanced testing under the internal codename V62. A second rear camera is finally coming The biggest limitation of the current iPhone Air is its single rear camera. Apple reportedly plans to solve that by adding a second lens. Instead of using a telephoto camera, the company is expected to include an Ultra Wide sensor. This setup would match Apple's standard iPhone models and make the Air much more versatile for photography. Expected camera improvements 48MP primary Wide camera Ultra Wide secondary camera Better landscape photography Improved macro capabilities More flexibility for video recording A telephoto lens is still expected to remain exclusive to Pro models. A20 Pro chip with 2nm technology Another major upgrade is the processor. The iPhone Air 2 is expected to use Apple's new A20 Pro chip, making it one of the first iPhones built on a 2-nanometer manufacturing process. Apple is also expected to adopt Wafer-Level Multi-Chip Module technology, which integrates memory and the processor more efficiently. This design should improve both performance and power efficiency. Expected benefits Faster CPU performance Better graphics performance Lower power consumption Improved AI processing Longer battery life through better efficiency Bigger battery without sacrificing thinness Battery life was another common complaint about the first iPhone Air. Apple reportedly plans to address that with both hardware and silicon improvements. Supply chain information suggests the iPhone Air 2 will include a battery around 3,500mAh, compared to the current 3,149mAh battery. That represents roughly an 11 percent increase in capacity before accounting for the efficiency gains from the A20 Pro chip. While Apple has not confirmed real-world battery figures, users should expect noticeably longer endurance than the current generation. Vapor chamber cooling arrives Apple first introduced vapor chamber cooling on its Pro iPhones, and the technology is now expected to reach the Air lineup. This cooling system spreads heat more effectively across the phone, allowing the processor to maintain higher performance during demanding workloads. That means users can expect: Better gaming performance Less thermal throttling Cooler temperatures during extended use More stable performance while editing videos or using AI features Expected release date Apple originally planned to launch the iPhone Air 2 alongside the iPhone 18 Pro lineup in September 2026. More recent reports point to a different strategy. Apple is now expected to launch: ProductExpected launchiPhone 18 ProFall 2026iPhone 18 Pro MaxFall 2026Foldable iPhoneFall 2026iPhone 18Spring 2027iPhone Air 2Spring 2027 This split launch schedule would allow Apple to focus premium devices in the fall while introducing mainstream models several months later. Wrap Up Based on current reports, the iPhone Air 2 looks like a much more complete device than its predecessor. A second rear camera, a larger battery, a faster A20 Pro chip, and vapor chamber cooling directly address the biggest compromises of the first-generation model while preserving its ultra-thin design. As with all early Apple leaks, these details remain unofficial until the company makes an announcement. If the current roadmap stays on track, the iPhone Air 2 should arrive in spring 2027 with a stronger feature set and a better balance between portability and everyday performance.

This Week In Rust: This Week in Rust 661

Thu, 23 Jul 2026 07:18:12 +0200

Hello and welcome to another issue of This Week in Rust! Rust is a programming language empowering everyone to build reliable and efficient software. This is a weekly summary of its progress and community. Want something mentioned? Tag us at @thisweekinrust.bsky.social on Bluesky or @ThisWeekinRust on mastodon.social, or send us a pull request. Want to get involved? We love contributions.

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official

Announcing Rust 1.97.1

Newsletters

The Embedded Rustacean Issue #76

Project/Tooling Updates

Observations/Thoughts

Rust Walkthroughs

Crate of the Week

This week's crate is xan, a TUI toolkit to work with CSV files.

Thanks to Simeon H.K. Fitch for the suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

If you are a feature implementer and would like your RFC to appear in this list, add a call-for-testing label to your RFC along with a comment providing testing instructions and/or guidance on which aspect(s) of the feature need testing.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

No Calls for participation were submitted this week.

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

No Calls for papers or presentations were submitted this week.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

576 pull requests were merged in the last week

Compiler

Library

Cargo

Rustdoc

Clippy

Rust-Analyzer

Rust Compiler Performance Triage

The two most notable changes this week were #159115, which resulted in pretty nice instruction count wins for full incremental builds on several benchmarks, and #159091, which enabled PGO for rustdoc, which makes it ~3-4% faster across the board.

There were two large rollups with tiny performance regressions, which made it difficult to find the offending PRs.

Triage done by @Kobzol. Revision range: 5503df87..d527bc9b

Summary:

(instructions:u)	mean	range	count
Regressions ❌ (primary)	0.4%	[0.2%, 1.0%]	40
Regressions ❌ (secondary)	0.7%	[0.2%, 4.6%]	69
Improvements ✅ (primary)	-2.0%	[-6.2%, -0.2%]	136
Improvements ✅ (secondary)	-2.6%	[-8.4%, -0.2%]	119
All ❌✅ (primary)	-1.4%	[-6.2%, 1.0%]	176

2 Regressions, 3 Improvements, 6 Mixed; 4 of them in rollups 34 artifact comparisons made in total

Full report here.

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

No RFCs were approved this week.

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

Tracking Issues & PRs

Rust

Compiler Team (MCPs only)

Leadership Council

Deallocate post-2026 funds from PM and compiler-ops

Unsafe Code Guidelines

Do the bytes of a pointer have to stay in the same order?

No Items entered Final Comment Period this week for Cargo, Language Reference, Language Team or Rust RFCs.

Let us know if you would like your PRs, Tracking Issues or RFCs to be tracked as a part of this list.

New and Updated RFCs

RFC: Refactor the libs team

Upcoming Events

Rusty Events between 2026-07-22 - 2026-08-19 🦀

South America

2026-08-08 | São Paulo, SP | Rust-SP
- Rust SP - Aug/2026

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

We were planning on publishing a blog post announcing this at the same time as making the repo public, but ran out of private repo CI usage 😭.

– Carl Lerche on r/rust about the launch of topcoat

Despite a lamentable lack of suggestions, llogiq is glad to have found this quote.

Please submit quotes and vote for next week!

This Week in Rust is edited by:

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

Chrome for Android Update

Thu, 23 Jul 2026 03:11:23 +0200

Hello Everyone! We've just released Chrome 151 (151.0.7922.47) for Android to a small percentage of users. It'll become available on Google Play over the next few days. You can find more details about early Stable releases here.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Harry Souders
Google Chrome

Sunsetting Tor 0.4.8 – Please update to 0.4.9 by September

Wed, 22 Jul 2026 22:34:49 +0200

Hello Tor Community!

As you know, different teams inside the Tor Project are working on the Arti Relay project where we hope to be able to begin the upgrade of the network towards our Rust implementation of Tor in the near future. To support this work, we would like to announce that we intend to actively stop compatibility for 0.4.8 and earlier C Tor versions soon. This means that these versions will no longer work on the network at all after our target date, which is currently September 1st, 2026.

If you’re a Tor Browser user running an up-to-date version of Tor Browser, this won't impact you. If you're running an older, perhaps not-so-well-maintained, Onion Service somewhere, or you’re building an app that integrates C Tor, you may want to read along here.

Tor 0.4.8 reached End of Life on the 1st of June, and there will not be any more updates to this release series. We highly encourage people to upgrade to the Tor 0.4.9 series (or later).

Usually, we try not to break existing releases, even if they are unsupported, unless we have a pretty good reason. In this case, we have several reasons. With the work towards Arti on both the client and relay, the Network Team has identified a couple of features we would like to remove from the Tor ecosystem. Removing support for 0.4.8 will help us facilitate a smooth transition, and reduce effort associated with difficult to maintain features that provide very little value. Unfortunately, because Tor’s Directory Protocol layer works the way it does, we cannot remove these features without affecting older clients.

The most important reason is this: in 0.4.9, we have made some former fields in our directory data obsolete -- specifically, TAP onion keys and family lines. Removing these fields will let us save a great deal of client directory bandwidth for everyone. This, in turn, will make all Tor clients bootstrap a little faster, especially those on slow connections. But when we remove these fields, clients and relays running earlier versions of Tor will no longer work, since they expect the TAP onion keys to be present. Therefore, in order to deliver improved performance faster, we need to accelerate the date on which 0.4.8 will stop working.

The secondary reason for sunsetting 0.4.8: Our Arti directory authority implementation needs network integration soon, and it will be easier to write if it doesn’t support deprecated fields.

With this blog post out, we will begin reaching out to the downstreams of Tor we identified as shipping older versions and try to get them to upgrade. We appreciate community help here, too. If you identify that your favorite project that bundles Tor uses an outdated version of Tor, please reach out to them and (politely!) encourage them to upgrade. We are tracking some of this outreach in network-health/team#460. If you have a very good reason for needing a longer time with 0.4.8 support than 1 September 2026, please let us know by leaving a comment on that ticket.

Thank you!

Galaxy Z Fold 8 Pre-Order Specials: $1,200 Off and $200 or $350 Gift Cards

Wed, 22 Jul 2026 21:02:22 +0200

In the world of pre-order deals, Samsung’s are typically pretty tough to beat, mostly because they give you instant discounts when you trade-in a phone. That instant savings is important, especially when it runs las high as $1,200. But what if you’d rather order from Best Buy or Amazon for various reasons? Both have solid...

Read the original post: Galaxy Z Fold 8 Pre-Order Specials: $1,200 Off and $200 or $350 Gift Cards

Chrome Beta for Desktop Update

Wed, 22 Jul 2026 20:58:57 +0200

The Beta channel has been updated to 151.0.7922.47 for Windows, Mac and Linux.

Chrome Release Team
Google Chrome

Early Stable Update for Desktop

Wed, 22 Jul 2026 20:58:54 +0200

The Stable channel has been updated to 151.0.7922.47/.48 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

You can find more details about early Stable releases here.

Daniel Yip

Google Chrome

Chrome Beta for Android Update

Wed, 22 Jul 2026 17:55:39 +0200

Hi everyone! We've just released Chrome Beta 151 (151.0.7922.47) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Your instant Android backup upgrade

Wed, 22 Jul 2026 12:02:52 +0200

Once you do, though, those once-orphaned documents on your Android device’s local storage will be perpetually synced and protected, automatically, without any ongoing thought or effort.

All you’ve gotta do is find and flip that one new switch.

[Don’t let yourself miss an ounce of Android Intelligence. Join my free weekly Android Intelligence newsletter and get one new thing to try in your inbox every Friday!]

The Android backup lowdown

So, for a quick bit of pertinent context on this: Android’s backup systems have actually come a really long way over the years.

See?

The easily overlooked new option for backing up documents on Android.

JR Raphael, Foundry

Once the added option is present and available for you, you’re literally lookin’ at 10 seconds to find and activate it.

Lemme show ya how.

Android’s document backup addition

I promise: This couldn’t be much simpler.

However you get there, once you’re lookin’ at that list, you’ll see a newly added line for “Documents” if this latest under-the-hood update has reached you.

Android’s expanded list of backup options — now including documents alongside other forms of on-device data.

JR Raphael, Foundry

And from there, all that’s left is to tap it and enable the switch to include that in your automated backups from that moment forward.

Take 10 seconds to do that, though, and you’ll have one less void in your Android data arena. And you don’t need Gemini to tell you that that can only be a good thing.

Get practical Android knowledge in your inbox every Friday with my free Android Intelligence newsletter — one new thing to try each week, straight from me to you.

Agentic coding is everywhere

Wed, 22 Jul 2026 11:04:58 +0200

I use a very cool and relatively new web framework called Astro. The keen insight that the Astro team had was that most websites are made up of static content, so they made it really easy to add content to a website. To add a blog post to my personal website, all I have to do is create a Markdown file with some front matter, deploy it, and the blog post automatically appears. If I need to reach deeper for more dynamic functionality, I can easily do that with TypeScript, React, or almost any other framework. It’s really cool.

And these days, I really don’t write any code. Claude Code does most (all?) of the work. Since Astro is an open-source project and has excellent documentation, Claude knows all about how Astro works. It has no trouble at all managing my site and making the improvements I ask for.

And that got me thinking, how does Astro get built? Is the Astro team building with agentic coding? Astro itself has many dependencies, including big projects like Vite and Node. And of course, Vite and Node have dependencies, too. Are those dependencies being developed by hand, or are those development teams also using AI agents to code?

My curiosity got the best of me, and I asked Claude to dig deeper. It turns out that the Astro repository has an AGENTS.md file, and some of the commits even have commit message trailers indicating that they were at least co-authored by Claude and GitHub Copilot. Further down, there is a .agents/skills directory with skills covering development, merging, triage, and more. I poked around for a look, and someone has done a great job building agentic support.

Now my interest is really piqued, and further investigation reveals quite a bit of interesting stuff. About a year ago, documentation started appearing about how to build Astro sites with coding agents. Around that same time, the docs team released an MCP server that gives developers coding agents deeper, easier access to the Astro documentation.

And there are small steps in the Astro codebase that indicate it is “agentic ready.” For instance, the command-line development server can tell when it is being started by an agent, and the application itself can tell if it is being driven by an agent. Small things, but steps in the direction of embracing Astro developers who use coding agents.

Okay, that was a fun spelunking trip. But so what?

The “so what” is that code is going to be commoditized. As an Astro developer I am using AI agents pretty much all of the time. The Astro development team is starting to use AI agents more and more. The folks building the Astro dependencies are using AI agents. Shoot, the people building Claude Code and the agents themselves are “eating their own dogfood” and using their own tools to build the next frontier model. Before we know it, it will be turtles all the way down.

No one says “who generated that electricity?” or “who wove the fabric in that shirt?” any more. And it won’t be long before no one says “Who wrote the code for that app?” because it won’t matter. Just as we don’t look at the assembly code written by our compilers, we’ll stop looking at the “regular” code written by our agents. I’m not even sure anyone is writing assembly code anymore. Soon we’ll be saying that about TypeScript, Python, and C++.

hum: my minimal suckless music player!

Wed, 22 Jul 2026 04:12:09 +0200

I got fed up with Spotify not letting me actually own my music and spying on me. I just wanted my media on my disk! Tried a bunch of other terminal players but they were all either bloated to hell or didn't have vim keybinds or had some weird config format instead of just letting me edit a header file's values. None of them felt right so I wrote hum :)

You search YouTube from the TUI (with yt-dlp as the backend), it plays stuff through mpv, and downloads the track to ~/Music/ in the background. Next time you play it it just uses the local file. That's pretty much it! You just use it and your library builds itself.

There's also playlists (they're just text files with .hum extensions), persistent queue, batch downloading YouTube playlists, visual select, filtering, shuffle, etc. Single C file, suckless config.h, and vim keybinds! What else could one want in life?

Link: https://github.com/areofyl/hum/

submitted by /u/areofyl
[link] [comments]

HPR4688: Downloading Podcasts with a Shell Script

Wed, 22 Jul 2026 02:06:46 +0200

This show has been flagged as Clean by the host.

01 Introduction

In this episode I will describe techniques for downloading podcasts using basic shell commands such as wget.

I will illustrate this using a bash script that can be used to download HPR podcasts.

Even if you do not have any interest in downloading your podcasts using this method, you may find some of the methods useful or interesting.

It is the principles that are discussed here that are important, rather than the implementation.

I realize that there are already a number of different podcast download programs available, including at least one written in bash.

However, you may feel that none of these suit how you wish to do things and want to create your own system tailored to your specific needs.

If so, then I hope the following is of some use to you.

If not, then you may still find some of the things discussed here to still be of interest.

Some of the subjects I cover include

wget to a user defined file name.

parsing xml with xmllint.

using inotifywait to trigger an action when a file is created or modified.

using notify-send to send a message to the notification area.

and

a way of allowing a cron job to send a message to the user interface.

03 Background

There has been an ongoing discussion in comments to some HPR episodes about problems downloading HPR podcast episodes.

Apparently some people have been experiencing problems with the way the episode URLs are structured.

I am afraid that I don't fully understand the nature of these problems, so I won't be addressing that problem directly.

Instead, I will present a bash script that I have written which can be used to download HPR podcasts.

This bash script can be run using cron to automatically fetch new HPR podcasts and save them to a designated directory.

This is a simplified version of a script that I have used for years to download HPR and other podcasts.

I won't try to read the full bash script out in this podcast, as that would be a bit dull to listen to.

I will instead describe what each section does and why I chose to do things that way.

Perhaps other people can offer suggestions of better ways to do things.

I will post the full bash script in the show notes.

06 Fetching Podcasts

The standard way of distributing podcasts is to publish an RSS feed containing URL links to the audio files.

RSS is a very long established and widely supported mechanism for this and other purposes.

An RSS feed is basically an XML document which can be accessed over HTTP.

These URLs contained in the RSS XML document can then be used to download the actual audio files, such as MP3 or OGG files.

Basically what we need to do is the following

• Download the RSS XML document.

• Extract the URL links to the audio files.

• Compare the list of these links to a previously saved list to see which ones are new and which ones are ones that we previously downloaded.

• Make a list of the new URLs.

• Go through this list of new URLs and download each of the new audio files.

• Check to see that we actually received the new audio file.

• Add the URLs of the files we successfully downloaded to our saved list of podcast URLs

In addition to this, we would like to have the above happen automatically in the background without our having to take any action on our own.

We may wish to receive a notification of when a new podcast has arrived however.

We would probably also wish to receive notification of any errors or failures.

10 Fetching Podcasts - The Preliminaries

Our desire to be able to run the script automatically imposes some requirements on our solution.

To schedule the script we will use cron.

Cron is a Linux facility to run scripts on a schedule.

One of the side effects of using cron however is that we need to specify the full path to the locations where we intend to keep any data files, plus also the full path to where we intend to put the downloaded podcasts.

So the first thing we need to do in our script is to specify a number of different values for things like file location, the URL for the HPR RSS feed, and several other things as well.

I will skip over the details of these, although I may make reference to them later.

13 Get the RSS Data

The first thing of real substance to do is to fetch the current RSS feed data.

I have put this in a bash function called getrssurldata

The contents of this function are a one liner, but with a number of elements chained together through pipes.

14 Downloading the RSS XML Document

• First we use wget, which is a standard command on most Linux distros.

• We specify four things.

• First we set a timeout. I have chosen 20 seconds.

• Next we set the retry limit. I have chosen 3.

• Then we specify that the output of wget is sent to stdout rather than saved as a file.

• This is done by using the -O option followed by a space and then a dash.

• The O option is usually used to specify a file to save the output to, but when used with a dash causes output to go to stdout.

• Then we specify the URL of the HPR RSS feed.

16 Contents of the XML Document

This gives us the HPR RSS XML document.

There are about 5,000 lines in this RSS document.

Most of those lines are the show notes which are also included in the feed.

17 Extracting the Podcast Episode URLs

There are only 10 lines of the document that contain information that we are interested in however.

These lines are enclosed in "enclosure" XML tags.

We just need to find those lines and separate out the URLs

18 Standard Command Line Tools

There are two ways that we can do this.

One is to use a combination of grep, sed, and cut.

Grep can find the lines containing the enclosure tags.

Sed and cut can extract the URL from the surrounding extraneous data.

However, this method does not discriminate between real enclosure tags in the data portion of the RSS feed and enclosure tags in the show notes which are included in the feed from episodes such as this one.

This may be an acceptable problem in practical terms, but we can do better.

20 Using an XML Parser

The other method is to actually parse the XML document.

there are at least two command line XML parsers that I am aware of.

These are "xmllint", and "xlmstarlet".

I have used xmllint in this example.

I have not used xmlstarlet, so I can't offer any comment on how easy or difficult to use it is.

I won't give a detailed explanation of all the things that xmllint can do.

It has many features, most of which, as the name suggests, have to do with finding formatting problems with the XML itself.

Describing everything it can do would be at least one episode in itself.

I will instead just give the particular command used and explain each element of it.

In this example assume that we are piping the output of wget directly into xmllint.

The complete command is

xmllint --xpath "//channel/item/enclosure/@url" - | cut -d'"' -f2

In this example,

xmllint is the name of the command.

--xpath tells it to parse the document according to the string which follows.

"//channel/item/enclosure/@url" tells it to find a series of tags in the hierarchy of channel, followed by item, followed by enclosure, and then extract the url attribute from the enclosure tag.

The "-" which follows tells it to look for input from stdin rather than from a file.

The result is a string which has the url attribute name, an equal sign, and the URL that we want enclosed in quotes.

To get just the URL itself, we pipe the output from xmllint into cut, using the doublequote characters as delimiters.

We then save the result in a temporary file.

25 Finding the New Episodes

Next we wish to find the new podcast episodes.

Each HPR episode is identified by a unique URL.

This means that if we save the URLs of episodes that we have already downloaded, we just have to look for the URLs that do not appear in this saved list.

https://hub.hackerpublicradio.org/ccdn.php?filename=/eps/hpr4659/hpr4659.mp3

The easiest way to do this is to take our two lists of URLs, sort each into temporary files, and then compare the sorted URLs using the "comm" command.

This is simple, but has a drawback.

Some podcasts occasionally change distributors.

When they do this, the old podcasts are re-published with new URLs and you end up downloading a lot of old episodes over again.

With HPR we could get around this by extracting just the file name and looking for that instead of the full URL.

I will however leave that problem as an exercise for the student and just accept that if the URL format changes we may end up downloading old episodes over again.

Since the feed has a maximum of only 10 episodes in it however, that isn't really that big of a problem.

It would be more of a problem with podcasts which have very large numbers of episodes in their feed, but the solutions to those will be feed specific.

29 Downloading the New Podcasts

We should now have a list of URLs for the new podcasts we do not already have.

Typically this should be only one file, but there could be several, or even as many as 10, if we have not turned on our computer in a while.

Therefore, we need to iterate through the file of new podcast URLs and download each one.

Before we do that however, we should check to see if there is in fact anything new to download.

To do this, simply use "wc -l" to count the number of lines in the list of new URLs and save the resulting number.

If this number is zero, there is nothing to download, we can skip the download step.

As an additional check, we should see if the number of downloads exceeds some threshold value that we wish to set.

This is not a major problem with HPR, but some podcasts have hundreds of files in their RSS feed rather than just the most recent ones.

If we do exceed our download limit, then we need to log an error and skip downloading.

Assuming there are no problems so far however, the first thing we need to do is to extract the name of the audio file from the URL.

We can do that using the "basename" command.

We will use this to specify the name that we use when we save the audio file.

HPR has a very well formed file name.

Some podcasts do not however, and for those you would need to construct some sort of suitable name either using information found in the URL or simply creating a name using a time stamp.

Next we download the audio file using wget.

This is similar to how we downloaded the RSS feed, but with a few changes.

One is that I have increased the timeout to 90 seconds.

This may not have been necessary, but seemed like a good idea.

The next is that when specifying the output file name using -O, we use the file name we extracted from the URL.

The third is that we specify a destination directory using the -P option.

After wget has finished, including any retries that it had to do, we next check that the expected new file is both present and not empty.

We did this using an "if" statement with the "-s" option.

If the file was found and not zero, then we add that URL to a temporary list of downloaded URLs.

If the file was not present, or was zero length, we output an error message to an error log.

I will come back to this point later.

Next, if there is more that one podcast to download we sleep for 3 seconds.

While not strictly necessary, it is considered to be "polite" to not hammer a server repeatedly, but rather to put a small delay between file downloads..

After we have downloaded all the audio files in our list, we can add the list of URLs for the files downloaded to the permanent list.

While we are at it, we should use "tail" to trim the permanent log to keep it from growing indefinitely.

This limit should be several times bigger than the number of files in the RSS feed.

In this case I selected 50.

Finally we write any errors to the permanent error log, and also write these same errors to another file used to signal errors for display to the user.

We have now successfully downloaded at least one HPR podcast.

41 Notify the User of Events

It would be convenient to be informed of new podcast downloads when they occur, and also be notified of any errors.

One of the limitations of cron jobs is that they cannot access the user interface.

This means that we cannot readily send a message directly to the notification system to inform the user of the presence of new podcasts or of errors.

42 inotifywait

The solution to this is to use "inotifywait" to monitor particular files and directories for changes.

The man page for inotifywait states the following -

inotifywait efficiently waits for changes to files using Linux's inotify(7) interface. It is suitable for waiting for changes to files from shell scripts. It can either exit once an event occurs, or continually execute and output events as they occur.

End of quote.

In many Linux distros, inotifywait is provided by the "inotify-tools" package.

I won't go over all the features of inotifywait.

Instead, I will just describe how to use it for our purposes here.

45 inotifywait Modes

I should point out first though that inotifywait operates in two different modes.

In the normal default mode, it exits after being triggered by an event and must be re-established again in order to resume monitoring.

In monitor mode, which is enabled by using the "-m" option, it runs indefinitely, responding to events.

I will use the default mode here.

The man page for inotifywait provides a simple example that we could copy and modify for our purposes.

A great many examples that you will find are based on this example.

However, it doesn't quite do what we want, so we need to change a few things.

47 podfetchnotify

The first shell script is one which monitors for the arrival of new podcasts and sends a notification to the user.

I will call this "podfetchnotify".

The complete scripts are in the show notes, I will just provide a brief description here.

48 Setting Up Event Watches Using inotifywait

The script is enclosed in a while loop which run indefinitely.

In the first line inside the while loop, we call inotifywait.

inotifywait will then block until the event it is told to look for occurs.

In short, execution of the script will wait there until an event occurs.

The names of the events are listed in the man file.

In this case we are looking for "modify", "create", and "moved_to".

Each of these does pretty much as you would expect, reacting to modifying an existing file, creating a new file, or moving a file to that directory.

50 Problems When Testing Using Text Editors

I should point out that if you are testing a script which uses inotifywait, then modifying a file with a text editor may not produce the results that you may think it would.

Instead it treats this as a new file with the same name, with the original file being erased.

Since inotifywait attaches itself to the inode rather than the filename, it sees the file that the text editor changed as being a new file.

If you wish to test this realistically, then use "echo" to overwrite the file by using I/O redirection.

51 Capturing Output

In my example I capture the output from standard out into a variable, but I don't do anything with it.

If you wish to for example display the name of the newly downloaded podcast file, then use the --format option along with an appropriate formatting code.

There are details about this in the man page.

On the next line we capture the exit code using "$?"

52 Responding to Exit Codes

If the exit code was zero, then a monitored event was triggered and there should a new podcast in the directory.

In this case we display a message indicating that a new podcast has arrived.

I will describe how to send notifications shortly.

If the exit code was not zero, then an error occurred.

An example of such an error would be if the directory were not present when monitoring was started.

In this case we display a message indicating that a fatal error has occurred and then exit.

53 Delay for More Podcasts

Finally, we use "sleep" to wait for some arbitrary period of time to prevent notifications from being triggered multiple times if several podcasts were being downloaded in succession.

In this case I chose to wait for 60 seconds.

We have now completed the process and can return to the top of the loop and resume waiting using inotifywait.

55 Sending Notifications to the User

I mentioned above about sending notification messages to the user.

In the Gnome desktop, notification messages appear from the centre of the top bar in a list.

Other desktops or operating systems may have something similar.

To send a notification message to the notification area, you use the "notify-send" command.

Simply follow notify-send with a quoted string and it will be displayed in the notification area.

57 podfetcherrornotify

The second shell script is one which notifies the user of errors.

I will call this "podfetcherrornotify".

With this shell script we set up a watch on a file which contains any error messages from podfetch.

This script is very similar to podfetchnotify.

The exceptions are

With inotifywait we only monitor for "modify".

There is no sleep command at the end of the loop.

Instead we sleep for a few seconds just after getting the exit code from inotifywait.

This helps prevent problems caused by race conditions.

Next we check the inotifywait exit code.

If it was zero, then we read the error report file and send a notification message to the user containing that error message.

If it was not zero, then we check to make sure that the directory that should contain the error log exists.

If it does not exist, then we send a notification message to that effect to the user and terminate the script.

If the directory exists, then we check to see if the error message file used for signalling exists.

If the file does not exist, then we create it.

One of the reasons for an inotifywait error is that if the file that it is told to monitor does not exist, it cannot set up a watch condition.

By creating the file we correct the cause of the error and allow inotifywait to operate normally.

Finally we increment an error counter and check to see if the limit is exceeded.

If there are excessive errors, then send a notification message to the user and exit.

The reason for this is to give the user an indication that the error notifications are not working for some reason and there may be a problem that needs looking into.

The error counter is reset every time the inotifywait exit status is ok, so occasional unexpected glitches should be something that is ignored.

Of course podcast fetching errors are something that will probably happen only rarely if at all, so this final step may be seen as an unnecessary embellishment.

65 Installing the Scripts

Next I will describe how to install and prepare the scripts to run.

We need to perform the following steps.

• First, we need to create a directory to hold the scripts and their associated data files.

• Next we need to create a directory to hold the downloaded podcasts.

• Then we must copy the scripts to these directories and make them executable.

• Then, we must edit the scripts to have the file path in the script match the locations of the new directories that we created.

• Then we need to install xmllint, or alternatively modify the download script to comment out the use of xmllint and enable the alternative method using grep and sed instead.

• Then we need to run each script manually from the command line to check for errors.

• If podfetch ran correctly, it should download the most recent 10 podcasts during this test.

68 Adding podfetch to the Crontab

The above describes how to run the scripts manually.

In order to fetch podcasts automatically, we need to add the podfetch script to the cron schedule.

To do this, open a terminal.

Type "crontab -e", and then press return.

A text editor should open up containing the crontab file.

On Ubuntu, this editor is GNU nano.

Enter the appropriate cron parameters.

I will provide an example here for running it 12 minutes past the hour every three hours.

12 */3 * * * /home/username/pathtofiles/podfetch.sh

I won't explain cron in detail here.

The example that I have just given should be good enough for most people.

The "*/3" parameter will cause it to run every three hours.

The "12" parameter will cause it to run 12 minutes past the hour when it does run.

Checking every three hours should be good enough for most people, but you can adjust that as you see fit.

I would recommend however that you don't check more frequently than once per hour.

Checking more frequently than necessary puts extra load on the distribution servers.

It is very unlikely that you really do need each new episode the moment it is available.

I would also recommend changing the "12" parameter to some other random minute value.

I would suggest avoiding on the hour or on the half hour, as a lot of other people are probably checking at those times, and it would be better to spread the load out more evenly over time.

The file path parameter should of course match the actual path to wherever you have located the script, including the correct user name.

75 Making the Notification Scripts Start Automatically

The two notification scripts can be made to start automatically.

The exact method to do this may vary according to distribution or desktop.

On Ubuntu this is done using the Startup Applications Preferences GUI program, which should come already installed.

I won't go into details on this here, it should be fairly self evident how to use it once you see it.

What this program does is to create ".desktop" files in the ".config/autostart" directory in your home directory.

These ".desktop" files are all run automatically on start up.

Once you have added the notification scripts, you will need to log out and then log back in to make them active.

79 Conclusion

I this episode I explained how to write a set of simple shell scripts to automatically download each new episode of HPR as it comes out and to notify you of its arrival.

The download script described here is tailored specifically for use with HPR only.

However, it was derived from a larger script that downloaded other podcasts as well, based on information read in from a text file.

If you are feeling ambitious, you can add those features back into this to handle all of the podcasts that you listen to.

In a comment to another episode of HPR I had said that I would cover ID3 tags in MP3 files, but this episode is long enough now, so I will leave that subject for later.

I look forward to seeing you again later on another episode of Hack Public Radio.

# ======================================================================

podfetchdownloader

#!/bin/bash

# Fetch pending HPR podcasts listed in the HPR RSS feed.

# 8-Jun-2026

# Licensed under GPLv3 or later.

# ======================================================================

# Today's date and time as YYYYMMDDHHMMSS.

podttimestamp=$( date +"%Y%m%d%H%M%S" )

# The absolute path to the script. This is necessary when running it

# using a cron job.

podpath="/home/me/Apps/hprfetch"

# This is the absolute path to where to store the podcast files.

podfilepath="/home/me/Music/Podcasts/HPR"

# Create the full path names here for all the text files used.

podcastsfetched="$podpath/podcastsfetched.txt"

poderrorslog="$podpath/poderrorslog.txt"

poderrorsreport="$podpath/poderrorsreport.txt"

tmpoldurlssorted="$podpath/tmpoldurlssorted.txt"

tmppodsnew="$podpath/tmppodsnew.txt"

tmppodstodownload="$podpath/tmppodstodownload.txt"

tmppodserrors="$podpath/tmppodserrors.txt"

tmppodcastsfetched="$podpath/tmppodcastsfetched.txt"

tmplog="$podpath/tmplog.txt"

# The URL for the HPR RSS feed.

PodURL="http://hackerpublicradio.org/hpr_rss.php"

# Limit on number of podcasts to download.

DownloadLimit=11

# Name of the podcast.

PodName="Hacker Public Radio"

# ======================================================================

# Check if the required paths exist.

# If this path does not exist, cannot log the error.

if [[ ! -d "$podpath/" ]]; then

echo "$podttimestamp Error - Could not find $podfilepath."

exit 1

# Where to store the podcast file fetched.

if [[ ! -d "$podfilepath/" ]]; then

echo "$podttimestamp Error - Could not find $podfilepath." >> $tmppodserrors

# Copy the errors log from the temporary errors file to the permanent files.

LogErrors

exit 1

# ======================================================================

# Check if the podcast log exists. We read it before we write to it,

# so it must exist or we will hang on it not being present.

if [[ ! -e $podcastsfetched ]]; then

touch $podcastsfetched

# ======================================================================

# Delete the specified files if they exist.

# This accepts multiple file names in a variable number of parameters.

CleanupFiles ()

{

# $@ accepts multiple parameters.

for f in "$@"; do

# Check if the file exists.

if [ -e "$f" ]; then

rm "$f"

done

}

# ======================================================================

# Copy the errors log from the temporary errors file to the permanent files.

LogErrors () {

if [ -e $tmppodserrors ]; then

# The permanent log.

cat $tmppodserrors >> $poderrorslog

# This file is monitored for display by other scripts.

cat $tmppodserrors > $poderrorsreport

}

# ======================================================================

# Get the URL data from an RSS feed

GetRSSURLData () {

wget --timeout=20 --tries=3 -O - "$PodURL" \

| xmllint --xpath "//channel/item/enclosure/@url" - | cut -d'"' -f2 \

| sort > $tmppodsnew

# This is an alternate method that does not use xmllint.

# However, it is not as robust. If someone were to include the

# first grep search pattern in their show notes, then it would

# look for that as a valid tag and output the following text

# as a URL.

#wget --timeout=20 --tries=3 -O - "$PodURL" | grep " $tmppodsnew

}

# ======================================================================

# Find which podcasts we do not already have.

FindNewPodcasts () {

cat $podcastsfetched | sort > $tmpoldurlssorted

comm -13 $tmpoldurlssorted $tmppodsnew > $tmppodstodownload

rm $tmpoldurlssorted

}

# ======================================================================

# Download the podcasts.

DownloadPodcasts() {

# Clear out previous temporary list of downloaded podcasts.

true > $tmppodcastsfetched

for i in $( cat $tmppodstodownload )

# Extract the file name from the URL.

fname=$( basename $i )

outputpodname="$podfilepath/$fname"

# Download the file.

wget --timeout=90 --tries=3 -P $podfilepath $i -O "$outputpodname"

# Check if the file exists and is not empty.

if [[ -s "$outputpodname" ]]; then

echo $i >> $tmppodcastsfetched

else

echo "$podttimestamp Error - $outputpodname was not found or is empty." >> $tmppodserrors

# Delay a reasonable length of time between multiple downloads.

if (( $PodCount > 1 )); then

sleep 3

done

# Add the list of files downloaded to the log.

# Check if the list exists and is not empty.

if [ -s $tmppodcastsfetched ]; then

cat $tmppodcastsfetched >> $podcastsfetched

# Trim the log file to keep it from growing indefinitely.

tail -n50 $podcastsfetched > $tmplog

mv $tmplog $podcastsfetched

# Remove the tmp file now that we are done with it.

rm $tmppodcastsfetched

}

# ======================================================================

# Clean up any left over files.

CleanupFiles "$tmppodsnew" "$tmppodstodownload" "$tmppodserrors" "$tmppodcastsfetched"

# Get the RSS data.

GetRSSURLData

# Find which podcasts are new.

FindNewPodcasts

# Count how many new podcasts there are.

PodCount=$( cat $tmppodstodownload | wc -l )

# If no podcasts to download, skip this.

# If too many podcasts for this feed, then log an error and skip.

# This error will keep repeating until something is done about it.

if (( $PodCount > 0 )); then

if (( $PodCount > $DownloadLimit )); then

echo "$podttimestamp Too many podcasts for $PodName : $PodCount." >> $tmppodserrors

else

# Download the podcasts listed in the temp file.

DownloadPodcasts

# ======================================================================

# Copy the errors log from the temporary errors file to the permanent files.

LogErrors

# Clean up temp files.

CleanupFiles "$tmppodsnew" "$tmppodstodownload" "$tmppodserrors" "$tmppodcastsfetched"

# ======================================================================

END OF FIRST SHELL SCRIPT

START OF SECOND SHELL SCRIPT

podfetchnotify

#!/bin/bash

# Part of Podfetch.

# This monitors for new files appearing in the new podcasts directory.

# This should be run as a background task.

# Install it using the "Startup Applications" utility in Ubuntu.

# ======================================================================

# Path where new podcasts are to be stored.

podfilepath="/home/me/Music/Podcasts/HPR"

# ======================================================================

# Wait for the podcast directory to be modified.

while true; do

# Check for new files.

errmsg=$( inotifywait -e modify -e create -e moved_to $podfilepath )

result=$?

# Check if exited due to new podcast, or if some error.

if (( result == 0 )); then

# Success, signal new podcast.

notify-send "New HPR podcast available."

else

# Check to make sure the directory exists.

# If it doesn't exist, there isn't much we can do to fix it.

if [ ! -e "$poderrorspath" ]; then

notify-send "Podfetch error: Podcast directory not found $poderrorspath"

exit 1

# Wait a bit so that multiple new files don't keep re-triggering the notification.

sleep 60

done

# ======================================================================

END OF SECOND SHELL SCRIPT

START OF THIRD SHELL SCRIPT

podfetcherror

Created Tuesday 23 June 2026

#!/bin/bash

# Part of Podfetch.

# This monitors the Podfetch error reporting file for new errors.

# This should be run as a background task.

# Install it using the "Startup Applications" utility in Ubuntu.

# ======================================================================

# Where the Podfetch program error report file is located.

poderrorspath="/home/me/Apps/hprfetch"

# The full path and file name.

poderrorsreport="$poderrorspath/poderrorsreport.txt"

# ======================================================================

# Error counter.

errcount=0

# Wait for the poderrorsreport file to be modified.

while true; do

errmsg=$( inotifywait -e modify $poderrorsreport )

result=$?

# Wait a bit to ensure that writing to the file is complete.

sleep 3

if (( result == 0 )); then

# Get the latest error message.

# Cut out the date stamp at the start of the line and take the rest.

poderr=$( tail -n $poderrorsreport | cut -d" " -f2- )

notify-send "Podfetch error: $poderr"

# Reset the error counter every time there is a successful result.

errcount=0

else

# Check to make sure the directory exists.

if [ ! -e "$poderrorspath" ]; then

notify-send "Podfetch error: error report path not found $poderrorspath"

exit 1

# Check if the file we are trying to monitor exists.

# If not, then create an empty file for error signaling.

if [ ! -e "$poderrorsreport" ]; then

echo > $poderrorsreport

# Increment the error counter.

count=$(( count + 1 ))

if (( count > 3 )); then

notify-send "Podfetch error: Excessive unknown errors, exiting."

exit 1

done

# ======================================================================

Provide feedback on this episode.

Stable Channel Update for Desktop

Wed, 22 Jul 2026 01:39:00 +0200

The Stable channel has been updated to 150.0.7871.181/.182 for Windows and Mac and 150.0.7871.181 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

This update includes 12 security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the Chrome Security Page for more information.

[$500][527930356] High CVE-2026-16420: Type Confusion in WebAudio. Reported by Found by XBOW and triaged by Brendan Dolan-Gavitt on 2026-06-26

[$500][528276487] High CVE-2026-16421: Inappropriate implementation in WebAudio. Reported by Found by XBOW and triaged by Brendan Dolan-Gavitt on 2026-06-26

[N/A][517359779] High CVE-2026-16413: Out of bounds write in ANGLE. Reported by Google on 2026-05-28

[N/A][517651910] High CVE-2026-16414: Insufficient validation of untrusted input in Chromecast. Reported by Google on 2026-05-28

[N/A][519244446] High CVE-2026-16415: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-06-02

[N/A][520172356] High CVE-2026-16416: Integer overflow in Chromecast. Reported by Google on 2026-06-05

[N/A][521491024] High CVE-2026-16417: Uninitialized Use in Skia. Reported by Google on 2026-06-08

[N/A][522125255] High CVE-2026-16418: Stack buffer overflow in V8. Reported by Google on 2026-06-10

[N/A][523435970] High CVE-2026-16419: Out of bounds read and write in ANGLE. Reported by Google on 2026-06-13

[N/A][533515002] High CVE-2026-16422: Insufficient validation of untrusted input in Certificate. Reported by Google on 2026-07-10

[N/A][534582496] High CVE-2026-16423: Use after free in UI. Reported by Google on 2026-07-14

[N/A][534858939] High CVE-2026-16424: Use after free in GPU. Reported by Google on 2026-07-14

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Daniel Yip

Google Chrome

Chrome for Android Update

Wed, 22 Jul 2026 01:37:59 +0200

Hi, everyone! We've just released Chrome 150 (150.0.7871.181) for Android. It'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 150.0.7871.181/182, Linux: 150.0.7871.181) unless otherwise noted.

Krishna Govind

Google Chrome

Chrome Stable for iOS Update

Tue, 21 Jul 2026 23:04:42 +0200

Hi everyone! We've just released Chrome Stable 151 (151.0.7922.43) for iOS; it'll become available on App Store in the next few hours.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Martin Thompson: Why in Building Protocols, Like Code, Starting Over Is Dumb

Tue, 21 Jul 2026 22:58:58 +0200

Today, the IETF held the CURRENT BoF, where the goal was to develop a new protocol. That protocol would be substantially like TLS, reusing its record layer and basic structure, but it would drop in MLS for key exchange.

This is somewhere between a pretty bad idea and a horrible idea.

The wholesale replacement of a huge chunk of protocol architectures is a hallmark of a lot of the AI-generated protocol proposals that have flooded the IETF. A small blemish is identified, then the fix is a whole new protocol, or a major piece of surgery. No regard for the wisdom of Chesterton’s Fence or the accumulated knowledge and usefulness embodied in what exists.

Experienced engineers know that rewriting a code module is not something you do lightly. There’s lots of literature out there about why this is a bad idea generally, and some emerging discussion about how AI might just change that.

The reasons not to rewrite a software component still largely apply to a protocol component. The reasons that AI might make it easier to do that safely, less so. Protocols are different.

Wholesale Change Will Miss Use Cases

Just like with a code change, a protocol component that changes will miss use cases that people really care about.

The usual concerns with code apply:

The existing features you know about and can test for can be handled.
The existing problems you know and care about can be fixed.
You inevitably introduce brand-new problems.
The existing features you don’t know about get lost.

Unlike code changes, you probably don’t have a test case for existing features that you didn’t know about. We found that with HTTP/2, where a number of use cases got lost in the process of “upgrading” HTTP.

In HTTP/1.1, performing client authentication in the middle of request was possible. Losing that capability in HTTP/2 affected few enough people that it was not badly damaging for the ecosystem. It still sucked.

A lot of work was done to try to find these issues, but we did not learn about these problems until fairly late in the process.

Proposing a protocol change means asking a whole lot of other people, many of whom are not invested in your goals, to do that work.

Changing a protocol by replacing a chunk of it, no matter how much care is taken, either asks the entire ecosystem to change with you.

That means asking everyone to move with you. If they don’t, you are not changing the protocol, you are forking it.

Forking A Protocol Destroys Interoperability

The real value of having a protocol like TLS is that a great many things can all talk to each other.

Forking a protocol – and sometimes profiling a protocol, a subject for another post – destroys that. You now have two ways to achieve the same goal, and a choice to join one of two clubs. You can join both, but that means constantly translating back and forth, something that can only get harder over time as protocol semantics diverge.

And yes, in case you were asking, this applies to the entirety of the IETF IoT sphere, which has parallel HTTP, TLS, and other analogues. Ostensibly, these address the needs of highly constrained hardware, but the cost is an ecosystem cut off from the mainstream.

But Fixing Protocols Is Hard

Yes, existing protocols come with baggage or technical debt. Maybe they aren’t perfectly optimized for your use.

The value that an existing protocol carries is that you are sharing the burden of its maintenance with a great many more people. Fixing it, maybe by adding extensions to support your needs, comes with opportunities to improve the protocol even beyond that immediate need. Every change is a chance to work off some of the accumulated cruft.

Major refreshes, like the TLS 1.3 reworking, cleared out a ton of cruft in the process. You get to benefit from the work that others do to improve that protocol too.

Do the Work

It is hard to be a responsible steward for the fabric of the Internet. We do it because it is worthwhile. Ignoring the lessons of the past is not helpful.

Chrome Beta for iOS Update

Tue, 21 Jul 2026 21:02:51 +0200

Hi everyone! We've just released Chrome Beta 151 (151.0.7922.43) for iOS; it'll become available on App Store in the next few days.

You can see a partial list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Chrome Beta for iOS Update

Tue, 21 Jul 2026 18:54:06 +0200

Hi everyone! We've just released Chrome Beta 151 (151.0.7922.44) for iOS; it'll become available on App Store in the next few days.

You can see a partial list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Windows LegacyHive zero-day flaw gets free, unofficial patches

Tue, 21 Jul 2026 10:23:53 +0200

Free unofficial patches are available for a recently disclosed Windows zero-day flaw that allows attackers to escalate privileges on up-to-date Windows systems. [...]

CVE-2022-41903 | Git up to 6.20170818 pretty.c format_and_pad_commit integer overflow (GHSA-475x-2q3q-hvwq / Nessus ID 236669)

Tue, 21 Jul 2026 07:38:49 +0200

A vulnerability has been found in Git and classified as critical. This impacts the function format_and_pad_commit of the file pretty.c. Performing a manipulation results in integer overflow. This vulnerability is known as CVE-2022-41903. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

At VB Transform 2026, Zillow's engineering chief said AI ROI numbers only hold up if you measure before you build

Mon, 20 Jul 2026 19:18:54 +0200

Zillow, the real estate technology company, doesn't get one conversation with its customers. They move from a phone screen to a loan officer to a real estate agent, sometimes over months or years, and expect the context to follow them. A single chatbot could never carry that thread.

At VB Transform 2026, Zillow SVP of Engineering Toby Roberts and Glean co-founder and CEO Arvind Jain described how they built AI architecture meant to carry context across that entire journey — and why context, not raw data, turned out to be the harder problem to solve. Zillow's products touch roughly 80% of U.S. real estate transactions each year, and the company has been using AI long before ChatGPT existed.

"We pretty quickly identified that we were going to need a persistent context layer that was going to meet our customers and the professionals wherever they were," Roberts said.

Data was never the hard part

Roberts said Zillow's AI effort started where most enterprise AI efforts start, with the data itself.

"We started with a large push around making sure our data did have the right foundation," Roberts said. That meant a data mesh approach, clear data lineage and a governance structure with permissions and identity attached to the data itself.

None of that turned out to be the hard problem. The hard problem was building something that remembered where a customer was in their journey and carried that forward, no matter which surface they showed up on next.

"This context layer has to live to be able to support you where you are at any given point in your journey," Roberts said. Zillow chose to own that layer itself rather than depend on a single external chat interface, a decision Roberts said the team reached quickly once it looked at the shape of a real transaction rather than a single conversation.

Why Zillow built its own architecture, and where Glean fits into it

Zillow built its own harness rather than route customers through a single model API. The team drew on 20 years of machine learning history behind products like Zestimate, leaning into smaller, task-specific fine-tuned models instead of one general-purpose model.

Internally, that harness runs alongside Glean. Roberts said Zillow now has thousands of Glean agents in production, handling repetitive tasks with tens of thousands of executions across the company. Glean's pitch, per Jain, is centralizing that integration work once, through the Glean MCP gateway, rather than letting finance, legal and marketing each rebuild their own connections to the same systems.

That centralization is also a cost lever. Jain pointed to two mechanisms: model routing, which sends most tasks to smaller, cheaper models instead of defaulting to frontier models, and precomputed context, which avoids an agent burning tokens assembling its own context from scratch.

"Claude is also very slow because the first part of assembling that context actually takes forever," Jain said. Routing that request through Glean instead, he said, can cut token consumption by as much as half.

What Zillow and Glean's approach means for enterprises

Across data, cost and permissions, the session offered a few practical takeaways for enterprises building agentic AI on their own systems.

Build the measurement baseline before the AI push, not after. Roberts said Zillow's ability to credibly attribute a 40% increase in shipped code to AI adoption rests on a DORA metrics baseline the team put in place years earlier, not on the AI rollout itself.

Centralize context once instead of letting every team rebuild it. Jain's core argument for Glean's platform is that duplicated integration work across finance, legal and marketing teams is a hidden cost most enterprises haven't accounted for.

Don't assume permission inheritance is enough for regulated data. Even with a permissions-aware context platform in place, Zillow layered hard rules and a standing compliance check on top for its most sensitive categories, rather than trusting the architecture to handle it automatically.

Treat context as a cost lever, not just a capability. Model routing and precomputed context were the two mechanisms Jain pointed to for cutting AI spend, both aimed at reducing wasted token consumption rather than adding new capability.

"Models by themselves are not enough to bring automation with AI inside your enterprise," Jain said. "You do have to connect it with your enterprise context."

How long is a new iPhone actually supposed to last?

Mon, 20 Jul 2026 18:03:31 +0200

Apple devices tend to be pretty durable, and the average lifespan of a new iPhone seems to be fairly consistent.

Apple could ‘run the table’ on AI if it does things right

Mon, 20 Jul 2026 15:33:26 +0200

Looking ahead just a short time, Apple could hold a powerful position in AI where it most makes sense: deployment.

Deeply deployable

What’s wrong with good enough?

“It’s going to be wild when people have unlimited tokens on their desks,” said Calacanis in a podcast round table discussion.

Who has the most to lose?

Cupertino rising

You can follow me on social media! Join me on BlueSky, LinkedIn, Mastodon and subscribe to my daily Apple-related news summaries at The Core.

I've reviewed or covered about 17 power banks — and Iniu's chic MagSafe 45W is the first one that feels like it actually has some personality

Mon, 20 Jul 2026 13:17:12 +0200

Super slim, fast-charging, an LCD panel and a discreet cable — Iniu's 45W MagSafe power bank has pretty much everything I could want from a portable phone charger.

Flexible PCBs for you and for me: lessons learned from DIY-ing flexible electronics with artists, makers, hackers and engineers (emf2026)

Mon, 20 Jul 2026 13:03:37 +0200

Flexible circuit boards (flexible PCBs) are pretty cool: they are lightweight, can fold into small spaces, are bendable, and can be designed to stretch. You might have seen one inside a digital camera, a wearable, or connecting a screen to another board in a laptop or smartphone. Or you might have had one made for an electronics project. But have you ever made one yourself? Unlike conventional, rigid PCBs, chances are you haven’t, for a number of reasons. But it doesn’t have to be this way: this talk will tell you how (and how not to) DIY your own flexible PCBs for your next electronics project. This talk is part of an ongoing project on breaking flexible electronics fabrication out of research labs and specialised manufacturing facilities, and into the hands of makers, hackers, artists, and others. You will learn about materials and techniques for making flexible electronics, weird and wonderful uses for flexible PCBs, and hear about the results of DIY flexible PCB workshops in four different countries and counting. Licensed to the public under https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://www.emfcamp.org/schedule/2026/235-flexible-pcbs-for-you-and-for-me

Flexible PCBs for you and for me: lessons learned from DIY-ing flexible electronics with artists, makers, hackers and engineers (emf2026)

Mon, 20 Jul 2026 12:48:55 +0200

Dubai Police Warns Against Online Scams Promising Work and Visit Visas

Mon, 20 Jul 2026 10:07:23 +0200

The Dubai Police fraudulent visa ads warning has cautioned the public against scams offering work visas, residency visas, and visit visas in exchange for money. According to the Anti Fraud Centre at Dubai Police's General Department of Criminal Investigation, fraudsters are using social media platforms and messaging apps to circulate fake visa offers by impersonating official entities or using the names of unlicensed companies. The advisory was issued as part of Dubai Police's Be Aware of Fraud campaign, which aims to raise awareness about online scams and help residents identify fraudulent schemes.

Dubai Police Fraudulent Visa Ads Circulating on Social Media

According to Dubai Police, scammers are promoting visa services through advertisements and messages that claim to offer work, residency, or visit visas for a fee. The Anti Fraud Centre said these advertisements are designed to convince victims to transfer money by falsely claiming to represent government authorities or licensed visa service providers. Some also use the names of unlicensed companies or offices to appear legitimate. Dubai Police urged the public not to rely on such offers and reminded residents that all visa procedures should be completed only through competent authorities or legally approved offices.

Authorities Urge Public to Verify Visa Offers

The Anti Fraud Centre said verifying the source of a visa service is the first step in avoiding visa fraud. Residents have been advised to confirm the authenticity of any visa offer or application process through official channels before making payments or sharing personal information. The centre also warned against dealing with intermediaries or unknown individuals claiming they can arrange visas through unofficial means. Dubai Police said people should not be misled by promises of guaranteed visas or job opportunities that are offered outside the legal process.

How to Report Fraud Attempts

Dubai Police has asked members of the public to report any fraud or attempted fraud immediately. Reports can be submitted through the Dubai Police Smart App, the eCrime platform for cybercrime reports, or by calling 901. The Anti Fraud Centre reiterated that staying informed and verifying service providers through official channels remain the most effective ways to avoid falling victim to fraudulent visa schemes.

Is it worth learning and switching to Linux as an os for college?

Mon, 20 Jul 2026 01:09:15 +0200

I'm an incoming accountancy student, I'm not really sure what tools people use besides spreadsheets and stuff, what I'm asking basically is if I can use the same tools or some alternative that still does the job for my course, I can't really give a complete list of the things I need but I want a general guideline for the things I can open and use. fyi I'm not really that tech savvy so I'll maybe go for ubuntu or mint, so I can't really go making my own stuff, at least if there are no tutorials already up; part of the reason for the switch is that my laptop is pretty old so it runs windows 11 pretty slow, even after debloating so if I have to stay on windows I want to know that it's because it's necessary.

submitted by /u/ilikecookedchicken
[link] [comments]

Kernel prepatch 7.2-rc4

Mon, 20 Jul 2026 00:24:36 +0200

The 7.2-rc4 kernel prepatch is out for testing. Linus said: "This whole week I had the feeling that people were starting to go on summer vacation, but running the numbers shows that I must have been wrong - it all looks pretty normal."

CVE-2022-3734 | Redis on Windows dbghelp.dll uncontrolled search path (EUVD-2022-43090)

Sun, 19 Jul 2026 17:38:20 +0200

A vulnerability was found in Redis on Windows. It has been rated as critical. Impacted is an unknown function in the library C:/Program Files/Redis/dbghelp.dll. Performing a manipulation results in uncontrolled search path. This vulnerability is known as CVE-2022-3734. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is still unclear if this vulnerability genuinely exists. The official Redis release is not affected. This issue might affect an unofficial fork or port on Windows only.

Stable Channel Update for Desktop

Sun, 19 Jul 2026 06:07:36 +0200

The Stable channel has been updated to 150.0.7871.124/.125 for Windows and Mac and 150.0.7871.124 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

This update includes 15 security fixes. Please see the Chrome Security Page for more information.

[N/A][517100492] Critical CVE-2026-15764: Use after free in Ozone. Reported by Google on 2026-05-27

[N/A][518007484] Critical CVE-2026-15765: Use after free in Ozone. Reported by Google on 2026-05-29

[N/A][514010477] High CVE-2026-15766: Uninitialized Use in Skia. Reported by Google on 2026-05-17

[N/A][514748734] High CVE-2026-15767: Heap buffer overflow in libyuv. Reported by Google on 2026-05-19

[N/A][517931625] High CVE-2026-15768: Insufficient policy enforcement in HTML-in-Canvas. Reported by Google on 2026-05-29

[N/A][519731111] High CVE-2026-15769: Insufficient validation of untrusted input in Linux Toolkit Theming. Reported by Google on 2026-06-03

[N/A][524792614] High CVE-2026-15770: Uninitialized Use in V8. Reported by Google on 2026-06-17

[N/A][525177160] High CVE-2026-15771: Insufficient validation of untrusted input in Media. Reported by Google on 2026-06-18

[N/A][525317502] High CVE-2026-15772: Use after free in GPU. Reported by Google on 2026-06-18

[TBD][527676561] High CVE-2026-15773: Use after free in Core. Reported by xinchaotian of Microsoft on 2026-06-25

[N/A][530646115] High CVE-2026-15774: Use after free in Skia. Reported by Google on 2026-07-03

[TBD][531319201] High CVE-2026-15775: Insufficient policy enforcement in V8. Reported by wang1r923096443@gmail.com on 2026-07-05

[TBD][532595489] High CVE-2026-15776: Type Confusion in V8. Reported by Salvatore Gulizia (nickname: Serotav) on 2026-07-08

[N/A][532929679] High CVE-2026-15777: Use after free in UI. Reported by Google on 2026-07-09

[N/A][513795122] Medium CVE-2026-15778: Insufficient validation of untrusted input in Navigation. Reported by Google on 2026-05-16

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Daniel Yip

Google Chrome

Chrome for Android Update

Sun, 19 Jul 2026 06:07:35 +0200

Hi, everyone! We've just released Chrome 150 (150.0.7871.124) for Android. It'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 150.0.7871.124/125, Linux: 150.0.7871.124) unless otherwise noted.

Krishna Govind

Google Chrome

Chrome Beta for Android Update

Sun, 19 Jul 2026 06:07:32 +0200

Hi everyone! We've just released Chrome Beta 151 (151.0.7922.29) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Chrome Beta for iOS Update

Sun, 19 Jul 2026 06:07:31 +0200

Hi everyone! We've just released Chrome Beta 151 (151.0.7922.26) for iOS; it'll become available on App Store in the next few days.

You can see a partial list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Chrome Stable for iOS Update

Sun, 19 Jul 2026 06:07:30 +0200

Hi everyone! We've just released Chrome Stable 151 (151.0.7922.25) for iOS; it'll become available on App Store in the next few hours.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Early Stable Update for Desktop

Sun, 19 Jul 2026 06:07:29 +0200

The Stable channel has been updated to 151.0.7922.34/.35 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

You can find more details about early Stable releases here.

Daniel Yip

Google Chrome

Chrome for Android Update

Sun, 19 Jul 2026 06:07:27 +0200

Hello Everyone! We've just released Chrome 151 (151.0.7922.29) for Android to a small percentage of users. It'll become available on Google Play over the next few days. You can find more details about early Stable releases here.

Chrome Beta for Desktop Update

Sun, 19 Jul 2026 06:07:26 +0200

The Beta channel has been updated to 151.0.7922.34 for Windows, Mac and Linux.

Chrome Release Team
Google Chrome

Chrome Dev for Android Update

Sun, 19 Jul 2026 06:07:25 +0200

Hi everyone! We've just released Chrome Dev 152 (152.0.7951.0) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Stable Channel Update for Desktop

Sun, 19 Jul 2026 06:07:22 +0200

The Stable channel has been updated to 150.0.7871.128/.129 for Windows and Mac and 150.0.7871.128 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

This update includes 7 security fixes. Please see the Chrome Security Page for more information.

[N/A][516987782] Critical CVE-2026-15899: Use after free in CameraCapture. Reported by Google on 2026-05-27

[N/A][523750584] Critical CVE-2026-15900: Use after free in GPU. Reported by Google on 2026-06-14

[N/A][533446300] Critical CVE-2026-15901: Use after free in Network. Reported by Google on 2026-07-10

[N/A][522436154] High CVE-2026-15902: Use after free in Cast. Reported by Google on 2026-06-10

[TBD][531503216] High CVE-2026-15903: Out of bounds read and write in V8. Reported by OpenAI Codex Security (amyb) on 2026-07-06

[N/A][532925350] High CVE-2026-15904: Use after free in Ozone. Reported by Google on 2026-07-09

[N/A][532970574] High CVE-2026-15905: Use after free in Aura. Reported by Google on 2026-07-09

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Daniel Yip

Google Chrome

Chrome for Android Update

Sun, 19 Jul 2026 06:07:21 +0200

Hi, everyone! We've just released Chrome 150 (150.0.7871.128) for Android. It'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 150.0.7871.128/129, Linux: 150.0.7871.128) unless otherwise noted.

Krishna Govind

Google Chrome

Chrome Dev for Desktop Update

Sun, 19 Jul 2026 06:07:20 +0200

The Dev channel has been updated to 152.0.7953.3 for Windows, Mac and Linux.

Chrome Release Team
Google Chrome

AI on the linux desktop?

Sun, 19 Jul 2026 04:54:44 +0200

Ok, I know we hate AI, but hear me out: as someone pointed out in this comment, AI is rapidly making it pretty easy to overcome the main hurdle to people using linux as their daily driver: oh shit my X doesn't work, now I have to trawl through 30 reddit threads to figure out why and then cling to a 12-page instruction guide for how to fix it and hope I don't screw anything up.

Only I have Claude Code installed in zed with its default project set to my home directory, so I can just fire it up and go 'Hey the left speaker on my headphones doesn't work?' and it can go figure out why and then fix it. And Kibbelz got me to wondering: why don't the major commercialized distros do this? Linux could gain significant desktop share in the user space by just going, 'Here's a text box, type in whatever problem or question you have about your linux install and we'll be happy to figure it out for you'.

Whoever manages to box that experience and polish it properly first will win the distro wars (to the extent that they are wars, and can be won, which is admittedly highly debatable.) Obviously the polish would be important here - needs to be something trained on linux commands, that doesn't have permission by default to rm -rf and such.. but I think it's doable, and could add a lot to linux's desktop share.

submitted by /u/libra00
[link] [comments]

It's easy to find a real email address behind Hide My Email, but it doesn't really matter

Fri, 17 Jul 2026 15:55:03 +0200

AppleInsider can confirm that it's pretty easy to get somebody's real email from Hide My Email, but it's also not much of a concern. If you're using the feature as intended as a spam filter, there's really no issue at all.

Hide My Email is supposed to do just that, but it doesn't always

The Hide My Email feature allows iPhone, Mac, and iPad owners to sign up for websites and services using an anonymous email address. All emails sent to that address are then invisibly forwarded to the user's real email address, preserving their privacy.

However, it has been reported that the feature can be bypassed, allowing someone to see a user's real address. Apple is yet to fix the issue, despite having known about it for more than a year.

Continue Reading on AppleInsider | Discuss on our Forums

Fogpiercer Review (PC)

Fri, 17 Jul 2026 12:20:57 +0200

I really wanted to crush at least one enemy vehicle under my train. Actually, I pretty much needed to crush one, preferably two, trucks to win before the time limit. But that meant taking damage to the mini-gun, the carriage that I cannot protect with shields. And I need those hitpoints to be able to take down the boss. So I decided to reposition to avoid an enemy shot. I get out of the battle with all carriages intact, but also without a new module. I have enough scrap to get some new toys to play with, but much depends on what the shop has to offer. An improved artillery shot would be great, as well as one of those shield cards that can protect two carriages at once. And, hopefully, I will have better luck with a future convoy engagement to secure another module. Fogpiercer is developed by Mad Cookies Studio and published by Hooded Horse. I played on the PC via Steam, and the title is not offered on other hardware. The video game features a mix of turn-based comb...

Zoom patches account takeover hole

Thu, 16 Jul 2026 19:53:24 +0200

Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.”

The issue is especially significant given Zoom’s extensive reach; it reportedly has more than 300 million daily active users, including 470,000 paying business customers. Given that reach, Zoom has been impacted by many other security incidents and France recently tried banning its use by French government users.

Zoom security bulletins released Tuesday revealed the bug, and three other security issues, which Zoom patched on Wednesday.

The company originally said that the takeover issue impacted Zoom Desktop Client for Windows before version 7.0.0, Zoom VDI Client for Windows before version 7.0.10 and 6.6.15 and 6.5.18 in their respective branches, and Zoom Meeting SDK for Windows, but on Wednesday, without explanation, it removed Meeting SDK for Windows as an affected product.

The other three holes were less severe, but still significant, and they all involved privilege escalation. They impacted Zoom Workplace for Windows before version 7.0.5, Zoom Workplace VDI Client for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Workplace VDI plugin for Windows before 6.5.17 and 6.6.14 in their respective branches, Zoom Rooms for Windows before 7.0.5 and Remote Control for Zoom Contact Center for Windows before version 7.0.0.

A second privilege escalation issue impacted Zoom Rooms for Windows before version 7.1.0, and another impacted Zoom Workplace VDI Plugin for Windows before version 6.6.14.

Zoom did not immediately reply to a request for comment.

‘As bad as it gets’

Frank Dickson, group VP for security at IDC, said the nature of the reported hole is alarming.

This bug “is about as bad as it gets, short of a worm. It is exploitable over the network, low complexity, zero privileges required, no user interaction needed,” he said, pointing out that exploitation is easy once technical details leak or someone reverse-engineers the patch, which is not as challenging as it once was, thanks to AI. “Yesterday’s script kiddies have been empowered,” he said.

Dickson said the only good news is that Zoom discovered the hole itself, and that “no in-the-wild exploitation has been reported by any outlet as of Thursday.”

Consultant Brian Levine, executive director of FormerGov, agreed with Dickson’s characterization of the hole, but said a potentially bigger issue is the high level of sensitive data that Zoom accesses.

“An attacker with unfettered access to a Zoom account may be able to listen to recordings of sensitive meetings, to eavesdrop on future meetings, and to impersonate the organization in an effort to social engineer its clients and partners. Thus, given that ubiquity of Zoom in large enterprises, this vulnerability is pretty concerning,” Levine said.

He’s encouraged, however, that Zoom found the flaw itself, which indicates its security team is “actually doing the hard, unglamorous work of auditing its code.”

Giuseppe Trotta, principal security researcher at Malwarebytes, has a theory about what was behind the Zoom disclosure.

“Because the vulnerability requires zero privileges and absolutely no user interaction, the remote network attack vector is highly suspected to involve the mishandling of deep links, such as custom URL schemes like zoommtg:// or zoomworkplace://,” he said. This led him to think that if the Zoom Workplace client for Windows fails to properly sanitize and validate incoming arguments passed via these special browser-to-desktop links, an unauthenticated attacker could craft a malicious string that could trick the desktop application into exposing or redirecting the user’s active session tokens directly to an attacker-controlled server, achieving a seamless and completely silent account takeover.

“Watch out for Zoom links and invites if you are on Windows or VDI and haven’t updated yet,” he advised.

Mike Wilkes, enterprise CISO at Aikido Security, offered kudos to Zoom for discovering the critical flaw, but he wanted to know how such a severe bug got into its software initially.

“This vulnerability raises questions about why the defect was not caught by design review, fuzzing, or pre-release abuse-case testing,” Wilkes said. “A historical defect in Zoom’s product/security relationship has been prioritizing ease of use over security risk.”

All four bugs important

Justin Greis, CEO of consulting firm Acceligence, said that the two types of holes reported by Zoom, account takeover and escalation, are both important, but for different reasons.

“The critical vulnerability is significant because it has the characteristics security teams worry about most,” Greis said, but the privilege escalation holes “are certainly important to patch as they primarily increase the impact of an attack that has already begun. The critical vulnerability has the potential to be an initial entry point, which is why it deserves the most attention.”

Greis also applauded Zoom’s response, saying that it “reflects a reasonably mature security program.”

He pointed out that no complex software platform will eliminate vulnerabilities entirely. “The differentiator is whether vendors are continuously investing in offensive testing, finding weaknesses before attackers do, and moving quickly to develop and distribute fixes,” he said.

This article originally appeared on Computerworld.

Zoom patches account takeover hole

Thu, 16 Jul 2026 19:47:37 +0200

Zoom has identified, and patched, a critical security hole that “may allow an unauthenticated user to conduct an account takeover via network access.”

Zoom security bulletins released Tuesday revealed the bug, and three other security issues, which Zoom patched on Wednesday.

A second privilege escalation issue impacted Zoom Rooms for Windows before version 7.1.0, and another impacted Zoom Workplace VDI Plugin for Windows before version 6.6.14.

Zoom did not immediately reply to a request for comment.

‘As bad as it gets’

Frank Dickson, group VP for security at IDC, said the nature of the reported hole is alarming.

Dickson said the only good news is that Zoom discovered the hole itself, and that “no in-the-wild exploitation has been reported by any outlet as of Thursday.”

He’s encouraged, however, that Zoom found the flaw itself, which indicates its security team is “actually doing the hard, unglamorous work of auditing its code.”

Giuseppe Trotta, principal security researcher at Malwarebytes, has a theory about what was behind the Zoom disclosure.

“Watch out for Zoom links and invites if you are on Windows or VDI and haven’t updated yet,” he advised.

Mike Wilkes, enterprise CISO at Aikido Security, offered kudos to Zoom for discovering the critical flaw, but he wanted to know how such a severe bug got into its software initially.

All four bugs important

Justin Greis, CEO of consulting firm Acceligence, said that the two types of holes reported by Zoom, account takeover and escalation, are both important, but for different reasons.

Greis also applauded Zoom’s response, saying that it “reflects a reasonably mature security program.”

This Week In Rust: This Week in Rust 660

Thu, 16 Jul 2026 07:09:13 +0200

This Week in Rust is openly developed on GitHub and archives can be viewed at this-week-in-rust.org. If you find any errors in this week's issue, please submit a PR.

Want TWIR in your inbox? Subscribe here.

Updates from Rust Community

Official

Project/Tooling Updates

Observations/Thoughts

Rust Walkthroughs

Miscellaneous

Oxidize XIAO — An Embedded Rust Community Program

Crate of the Week

This week's crate is dashu, a pure Rust set of libraries of arbitrary precision numbers.

Thanks to JacobZ for the self-suggestion!

Please submit your suggestions and votes for next week!

Calls for Testing

An important step for RFC implementation is for people to experiment with the implementation and give feedback, especially before stabilization.

No calls for testing were issued this week by Rust, Cargo, Rustup or Rust language RFCs.

Let us know if you would like your feature to be tracked as a part of this list.

Call for Participation; projects and speakers

CFP - Projects

Always wanted to contribute to open-source projects but did not know where to start? Every week we highlight some tasks from the Rust community for you to pick and get started!

Some of these tasks may also have mentors available, visit the task page for more information.

Nika - showcase: CSV → chart PNG → markdown report (nika:chart has no example yet)

If you are a Rust project owner and are looking for contributors, please submit tasks here or through a PR to TWiR or by reaching out on Bluesky or Mastodon!

CFP - Events

Are you a new or experienced speaker looking for a place to share something cool? This section highlights events that are being planned and are accepting submissions to join their event as a speaker.

If you are an event organizer hoping to expand the reach of your event, please submit a link to the website through a PR to TWiR or by reaching out on Bluesky or Mastodon!

Updates from the Rust Project

550 pull requests were merged in the last week

Compiler

Library

Cargo

Clippy

Rust-Analyzer

Rust Compiler Performance Triage

This week many new optimizations landed, making this a very good week for performance. The only real regression was a fix for a miscompile that will likely be re-landed in the future.

Triage done by @JonathanBrouwer. Revision range: 3659db0d..5503df87

Summary:

(instructions:u)	mean	range	count
Regressions ❌ (primary)	0.3%	[0.2%, 0.4%]	3
Regressions ❌ (secondary)	0.9%	[0.1%, 2.5%]	25
Improvements ✅ (primary)	-1.2%	[-9.9%, -0.2%]	195
Improvements ✅ (secondary)	-3.4%	[-92.1%, -0.1%]	174
All ❌✅ (primary)	-1.2%	[-9.9%, 0.4%]	198

2 Regressions, 10 Improvements, 10 Mixed; 7 of them in rollups 36 artifact comparisons made in total

Full report here

Approved RFCs

Changes to Rust follow the Rust RFC (request for comments) process. These are the RFCs that were approved for implementation this week:

Named Fn trait parameters

Final Comment Period

Every week, the team announces the 'final comment period' for RFCs and key PRs which are reaching a decision. Express your opinions now.

Tracking Issues & PRs

Rust

Compiler Team (MCPs only)

No Items entered Final Comment Period this week for Cargo, Language Reference, Language Team, Leadership Council, Rust RFCs or Unsafe Code Guidelines.

Let us know if you would like your PRs, Tracking Issues or RFCs to be tracked as a part of this list.

New and Updated RFCs

bf16 primitive type

Upcoming Events

Rusty Events between 2026-07-15 - 2026-08-12 🦀

Virtual

2026-07-15 | Virtual (Girona, ES) | Rust Girona
- Sessió setmanal de codificació / Weekly coding session
2026-07-15 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
- Jiff
2026-07-16 | Hybrid (Seattle, WA, US) | Seattle Rust User Group
- July, 2026 SRUG (Seattle Rust User Group) Meetup
2026-07-16 | Virtual (Berlin, DE) | Rust Berlin
- Rust Hack and Learn
2026-07-19 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
- Rust Deep Learning: Third Sunday
2026-07-21 | Virtual (London, UK) | Women in Rust
- Lunch & Learn: Learning Rust as First Programming Language
2026-07-21 | Virtual (Tel Aviv-yafo, IL) | Rust 🦀 TLV
- שיחה חופשית ווירטואלית על ראסט
2026-07-21 | Virtual (Washington, DC, US) | Rust DC
- Mid-month Rustful
2026-07-22 | Virtual (Girona, ES) | Rust Girona
- Sessió setmanal de codificació / Weekly coding session
2026-07-23 | Mountain View, CA, US | Hacker Dojo
- RUST MEETUP at HACKER DOJO
2026-07-28 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
- Fourth Tuesday
2026-07-29 | Virtual (Girona, ES) | Rust Girona
- Sessió setmanal de codificació / Weekly coding session
2026-07-30 | Virtual (Berlin, DE) | Rust Berlin
- Rust Hack and Learn
2026-08-02 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
- Rust Deep Learning: First Sunday
2026-08-04 | Virtual (London, GB) | Women in Rust
- 👋 Community Catch Up
2026-08-05 | Virtual (Girona, ES) | Rust Girona
- Sessió setmanal de codificació / Weekly coding session
2026-08-05 | Virtual (Indianapolis, IN, US) | Indy Rust
- Indy.rs - with Social Distancing
2026-08-11 | Virtual (Dallas, TX, US) | Dallas Rust User Meetup
- Second Tuesday
2026-08-12 | Virtual (Girona, ES) | Rust Girona
- Sessió setmanal de codificació / Weekly coding session
2026-07-19 | Virtual (Bangalore, IN) | Embedded Rust Discord
- Silicon Sundays

Asia

2026-07-18 | Bangalore, IN | Rust Bangalore
- July 2026 Rustacean Meetup
2026-07-19 | Virtual (Bangalore, IN) | Embedded Rust Discord
- Silicon Sundays
2026-07-25 | Mumbai, IN | Rust Mumbai
- Rust Mumbai — July Meetup 🦀
2026-07-26 | Pune, MA, IN | Rust Pune
- Rust Pune: July 2026

Europe

2026-07-15 | Dortmund, DE | Rust Dortmund
- Teach and Hack at Projektspeicher
2026-07-21 | Leipzig, DE | Rust - Modern Systems Programming in Leipzig
- Supercharge Rust funcs with implicit arguments and context-generic programming
2026-07-23 | Berlin, DE | Rust Berlin
- Rust Berlin Talks: The next generation
2026-07-23 | London, UK | London Rust Project Group
- Rama modular service framework for Rust
2026-07-23 | London, UK | Rust London User Group
- LDN Talks: July 2026 Antithesis Takeover
2026-07-23 | Paris, FR | Rust Paris
- Rust meetup #87
2026-07-29 | Poland, PL | Rust Poland
- Rust Poland x Kraków #10
2026-07-30 | Manchester, GB | Rust Manchester
- Rust Manchester July Code Night

North America

2026-07-15 | Hybrid (Vancouver, BC, CA) | Vancouver Rust
- Jiff
2026-07-16 | Hybrid (Seattle, WA, US) | Seattle Rust User Group
- July, 2026 SRUG (Seattle Rust User Group) Meetup
2026-07-18 | Boston, MA, US | Boston Rust Meetup
- North End Rust Lunch, July 18
2026-07-21 | San Francisco, CA, US | San Francisco Rust Study Group
- Rust Hacking in Person
2026-07-22 | Austin, TX, US | Rust ATX
- Rust Lunch - Fareground
2026-07-22 | Los Angeles, CA, US | Rust Los Angeles
- Rust LA: Rust in Distributed Systems with Flight Science!
2026-07-22 | New York, NY, US | Rust NYC
- Rust NYC: Write A Custom Coding Agent and wasm_zero
2026-07-25 | Boston, MA, US | Boston Rust Meetup
- Porter Square Rust Lunch, July 25
2026-07-25 | Brooklyn, NY, US | Flower
- BOG-A-THON 2
2026-07-30 | Atlanta, GA, US | Rust Atlanta
- Rust-Atl
2026-08-01 | Boston, MA, US | Boston Rust Meetup
- Chinatown Rust Lunch, Aug 1
2026-08-04 | Boston, MA, US | Boston Rust Meetup
- Evening Boston Rust Meetup at Red Hat, Aug 4
2026-08-06 | Saint Louis, MO, US | STL Rust
- Shipping Temporal: How a Global Rust Ecosystem Built Chrome’s Newest Web API

South America

2026-08-08 | São Paulo, SP | Rust-SP
- Rust SP - Aug/2026

Oceania

2026-07-21 | Barton, AU | Canberra Rust User Group
- July Meetup
2026-07-23 | Perth, AU | Rust Perth Meetup Group
- Rust Perth: July Meetup!
2026-07-30 | Melbourne, AU | Rust Melbourne
- Rust Melbourne July 2026

If you are running a Rust event please add it to the calendar to get it mentioned here. Please remember to add a link to the event too. Email the Rust Community Team for access.

Jobs

Please see the latest Who's Hiring thread on r/rust

Quote of the Week

Thank you for your PR, but please edit the description like you are a chainsaw-wielding maniac that just discovered the sentences are young adults who came to the lake at summer camp after sunset.

– workingjubilee on Rust github

Thanks to Theemathas for the suggestion!

Please submit quotes and vote for next week!

This Week in Rust is edited by:

Email list hosting is sponsored by The Rust Foundation

Discuss on r/rust

Ship faster with GitHub, Vercel, and Firestore

Wed, 15 Jul 2026 17:19:19 +0200

These days, application developers can take their pick from a vast menu of architectural solutions. We can choose from the well-understood to the experimental, and from blended solutions in between. Several powerful middle-ground technologies that emerged during the cloud revolution have really come of age. Here we’ll take a look at putting together three of the most impressive: GitHub, Vercel, and Firestore.

Each of these is an important tool in its own right that can be used to attack specific problems. In combination, they not only meet the needs of several important application scenarios, but they have a superpower—the ability to dramatically shorten the distance between development and deployment.

There is nothing quite as gratifying as putting your hands on just the right mix of tools for a given need.

A ‘no-ops’ stack built for speed

If your primary goal is sheer development velocity, you would be hard-pressed to top this architecture. This “no-ops” stack collapses the distance between your local IDE and a globally distributed production environment. You are essentially trading the overhead of managing VMs and load balancers for the sheer speed of committing code and watching it deploy automatically.

While each component is highly flexible, adopting them requires a specific, event-driven mindset. There are a few finicky bits to manage, mostly around routing environment variables securely and designing around stateless back-end functions. But the constraints are obvious and well-documented.

Before we look more closely, let’s quickly identify the kinds of apps that are a perfect fit here, along with those that are workable and those that really merit a different approach.

The sweet spot (deploy and go): AI-mediated applications, asynchronous game back ends, and real-time collaborative B2B dashboards. This architecture perfectly absorbs the unpredictable latency of LLM APIs and instantly syncs state across multiple clients without requiring you to build custom WebSocket infrastructure.
The middle ground (workable, with trade-offs): Headless e-commerce, moderate IoT telemetry, and apps requiring scheduled batch processing. You will encounter friction if your catalog relies on deeply relational SQL constraints, or if your background reporting jobs take longer than a few minutes and hit serverless execution limits.
The danger zone (look elsewhere): High-frequency trading, fast-paced action multiplayer games, heavy data ETL pipelines, and core financial ledgers. Serverless architectures cannot natively hold open the persistent WebSockets required for twitch-reflex data, and heavy compute tasks will abruptly time out.

We should mention that these categories are not mutually exclusive. Many enterprise applications, such as a full-scale e-commerce platform, straddle these lines. You might use Vercel and Firestore to build a lightning-fast, reactive storefront that handles ephemeral user state like shopping carts, while simultaneously “stitching in” a managed SQL database like Supabase or PlanetScale. This hybrid approach allows you to maintain the relational integrity required for back-office inventory and financial ledgers and pair it with the front-end velocity this stack provides.

GitHub: the bedrock

I don’t need to introduce you to GitHub. It is a central element of the development landscape. I still remember CVS and SVN with a certain nostalgia, but the enhancements of Git speak for themselves. When combined with the orchestration powers of GitHub, it is no wonder that virtually the whole industry has adopted this type of platform.

Git plus GitHub gives you an enormous amount of power already, in terms of how you can organize and automate your projects. But there is a next-level experience in combining GitHub and Vercel. For JavaScript-based projects, you can take simple GitHub pushes and turn them into instantly deployed clients and serverless functions. It is one of the cleanest and least fiddly ways to move from raw code on your local machine to a globally deployed, full-stack architecture.

Vercel: the nexus

Vercel is more than just a deployment host. It is a control plane that ties this high-velocity, no-ops architecture together. Alongside GitHub and Firestore, Vercel’s deeper strength is its ability to act as an orchestration layer between your reactive front end and external stateful services.

Vercel has a great amount of facility in fine-tuning what branches go to what environment and helpful features like instant rollback. You can just log into Vercel’s dashboard for your project and see the history of deployments and any errors and logs. It’s a simple menu choice to roll back to a historical version or compare one version against another.

When you “stitch in” third-party services (such as a managed SQL database like Supabase or a payment processor like Stripe), Vercel’s serverless functions become the lightweight interface, and Vercel’s the adapters handle the communication. You offload the integration logic (the service layer) to Vercel’s global Edge Network, keeping your UI and back end clean, responsive, and decoupled.

In short, Vercel allows you to get the speed of the “no-ops” development life cycle without sacrificing the complex transactional integrity required for some applications like enterprise inventory systems.

Firestore: the datastore

Firestore is an extremely lightweight, NoSQL, cloud datastore. It has a great deal of add-on power, but its core value proposition is that it accepts virtually any data you stuff into it and it provides event-driven subscriptions to data changes.

These two capabilities together make Firestore about as straightforward a solution to a managed back end as you can imagine. You subscribe to collections or even fields and then you simply stick “unstructured” data (read: JSON with variable fields) in and the client waits for the changes it is interested in.

This is so streamlined that one can just point the browser (or native mobile app) directly at Firestore and listen for events. Which immediately raises the question of identity, for auth and for data visibility, but hold on—Firestore’s third superpower is that it has an authentication module that actually works. What I mean is, it is actually pretty simple and yet confidently secures your app.

Sometimes auth solutions seem either too simple (and yet opaque) or too mired in the nitty gritty. Firestore auth will let you do some basic configuration and start using a reasonable auth almost immediately.

Not to belabor the point, but having a realistic and attainable auth solution elevates your stack to a production grade—one that can handle many real-world applications. Firestore auth plays nicely with other important APIs, like Stripe. Typically, auth is a major feature that feels like off-roading in a Honda Civic, but Firestore’s approach to auth, added to this particular stack, feels like a normal speed bump. It’s just another component you plug in, rather than a tentacled alien you weave into the your code.

The limits of the velocity stack

This architecture combines components that are optimized for flexibility. That same character also introduces distinct limitations. Understanding these is essential before committing production workloads.

The serverless life cycle

Serverless functions are spun up to handle requests. They close out soon afterward and lose any state. For that reason, they cannot natively hold open persistent WebSockets. If your system requires continuous, sub-millisecond, bidirectional streams—like a real-time multiplayer action game or a high-frequency trading dashboard—pure serverless will fight you all the way. You are forced to introduce a third-party managed WebSocket service to route messages back to your stateless endpoints via HTTP webhooks.

The execution time ceiling

Vercel (like all serverless platforms) enforces strict timeouts on operations. While enterprise tiers might grant you up to 15 minutes, standard functions often time out after 10 to 60 seconds. Long-running tasks like video transcoding, database scripts, or orchestrating multi-step AI agent workflows, which might take 20 minutes to resolve, will run up against these limits. Heavy-lifting tasks must be offloaded to a dedicated, long-running service like Google Cloud Run, or broken into smaller, asynchronous chunks via message queues.

The cold start reality

While the industry has made massive strides in minimizing initialization times—particularly with lightweight edge networks—traditional Node.js-based serverless functions still experience cold starts. If a function has not been invoked recently, or if traffic spikes require a new instance to spin up concurrently, the first request will take a noticeable latency hit as the container provisions and the code loads.

API instead of RAM

In a traditional server environment, you can store transient data in global RAM, allowing subsequent requests to access shared context instantly. In the serverless model, every request might hit a fresh container. Therefore, all shared context must be externalized. Although Firestore serves brilliantly as the state manager, relying on a database for high-frequency, sub-millisecond, ephemeral caching introduces network latency and per-operation costs. That said, using a shared RAM state on a server is non-trivial also, unless you are using a single app server and VM (because high-availability or fail-over requirements will lessen the RAM win on a traditional server).

Tuning for velocity and control

Every architectural decision is a trade-off. There are no cost-free choices. By adopting the GitHub, Vercel, and Firestore stack, you are explicitly maximizing feature velocity over fine-grained control.

You lose the ability to tweak the underlying operating system, hold open persistent sockets, or run hour-long back-end scripts. In exchange, you gain an architecture that scales from zero to global distribution instantly, requires virtually no devops maintenance, and perfectly absorbs the asynchronous, event-driven realities of modern application development.

For the right application—whether it is a fast-moving prototype or an enterprise AI copilot—this stack doesn’t just save time; it fundamentally changes how quickly a small team (or a single person) can impact the market. You stop worrying about build chains, load balancers, and server patches, and you focus on the central mission: shipping features.

How to unionize your tech workplace

Wed, 15 Jul 2026 13:18:09 +0200

This is Part 2 of a series on tech worker unionization. See Part 1: “A brewing battle: More IT workers want unions. The industry doesn’t.”

The best time for tech workers to unionize was 20 years ago, when they had plenty of leverage. The second-best time is now, when they don’t.

Mass layoffs, AI-driven displacement, corporate surveillance, workplace disillusionment have created conditions that have made organizing compelling for tech professionals. But the federal labor board that has historically protected workers’ right to organize has been weakened, and the companies that once feared it are openly defying it.

Here’s how organizers and labor experts describe the pros and cons to organizing — and how you can get started.

What unions can — and can’t — do for you

The single biggest benefit of a union contract for most tech workers isn’t pay — it’s protection against arbitrary termination, especially in the wake of recent mass layoffs in tech. In the United States, nonunion “at-will” workers can be fired at any time without a stated reason, while unionized workers negotiate protections written into their contracts.

“That fear of the company letting you go for anything at any time…with a union they just can’t do that,” says Zak Thompson, a senior software engineer at Kickstarter and union steward at Kickstarter United. Now that Kickstarter employees are unionized, people are less worried that saying something negative will result in termination.

“I’ve been shocked at the willingness of my co-workers to speak up against what they see as poor or controversial business decisions,” Thompson says.

width="972" height="972" sizes="auto, (max-width: 972px) 100vw, 972px">

Zak Thompson from Kickstarter United

Fee Christoph

Beyond job security, unions can deliver concrete material gains. Kickstarter United was formed in 2020, although getting there wasn’t easy: two employees were fired during the organizing campaign — which itself became a galvanizing event. And while the union hasn’t been able to prevent layoffs, it did negotiate better terms: four months of severance pay and four to six months of continued health insurance, versus the two to three weeks per year of work that management had initially proposed.

Other benefits include a four-day work week; AI protections; a minimum pay floor; and standards for raises, promotions, and time off for the company’s 59 employees.

Unions can give tech workers a voice in decisions that affect their daily work — including how AI tools are deployed. “Nobody I’ve spoken to is against new technology or getting trained in it,” says Max Belasco, a business systems analyst at the University of California Los Angeles School of Law and co-chair of the UCLA chapter of the University Professional and Technical Employees/Communications Workers of America (UPTE-CWA) Local 9119.

“But when new technology is being implemented, we want to know: what’s the five-year vision, the 10-year vision? Are we implementing this in a way that betters staffing, increases efficiency, or eases the lives of people already working? Or are we trying to take away jobs, automate people out of their pension or paycheck?” Belasco says.

The challenges are real. Tech professionals are less inclined to leave their jobs in the current market because wages haven’t been increasing as fast as they once were, and it can take longer to land another job.

“Tech moved from a very tight labor market in 2022 (1.85% unemployment rate) to a noticeably weaker one in 2024–2026 (3.49%),” although that’s still better than the national unemployment rate of 4.36% through May of this year, says Liya Palagashvili, senior research fellow and director of the Labor Policy Project at the Mercatus Center at George Mason University.

width="960" height="640" sizes="auto, (max-width: 960px) 100vw, 960px">

Liya Palagashvili of the Mercatus Center at George Mason University

Mercatus Center at George Mason University

Flexibility is a concern. The more substantive challenge, raised by economists including Palagashvili, is that traditional union contracts impose uniform terms across an entire bargaining unit, limiting the flexibility that many tech workers — and their employers —currently enjoy. Tech firms need to move fast, adjusting teams, products, and roles on the fly.

“Collective bargaining agreements can make those adjustments much more difficult, whether by making them slower, costlier, or inconsistent with the contract,” she says.

Workers skeptical of unions in a survey of 1,900 tech professionals conducted by the career site Blind cited specific concerns: that unions are “not meritocratic,” “prevent innovation,” and “hold back earnings of top performers.”

Thompson from Kickstarter United pushes back: “We have nothing in our contract about ‘you can’t bend down and pick up a piece of trash because that’s someone else’s job.’ The company is free to give bonuses and individual raises as much as they like. This is all just up to the people who are bargaining the contract from the union side.”

Organizing carries potentially serious personal risks. During negotiations for a second three-year contract in 2025, Kickstarter United went on strike for 42 days. A few months later, the company announced layoffs.

“They let go strong union leaders, including a person who had bargained our last contract,” Thompson says. The union appealed, and the issue is now going to arbitration.

If you form a union, don’t expect much support from the National Labor Relations Board, the agency that certifies US labor unions and protects workers’ right to organize, in terms of prosecuting complaints of unfair labor practices, Thompson warns. “We’re in a political moment in this country with a pretty weakened NLRB. You have to be ready to organize and withhold worker power without any guarantee of safety.”

Organizers are up against an enormous union avoidance industry. Organizers can expect fierce pushback as soon as the business discovers that organizing is underway.

“There’s a multi-billion-dollar industry in union avoidance,” says Alan McAvinney, a Google software engineer and organizing chair, Alphabet Workers Union-CWA, a 1,400-member minority union of Alphabet employees. (Google is a subsidiary of Alphabet.)

US employers spend roughly $1.7 billion a year on union avoidance consultants and law firms, according to a May 2026 report by the Economic Policy Institute and LaborLab.

Expect hardball tactics. Management may play hardball during the time between when organizers announce their intention to unionize and the actual vote. For example, management can threaten to fire foreign-born workers in the US on H-1B visas if they support the union. Those workers would then have just 60 days to find a new sponsoring employer or lose their H-1B status, according to a recent Tech Workers Coalition blog post.

And at venture capital-backed startups, investment agreements sometimes require management to attest there is no union activity — meaning a public organizing drive can trigger funding withdrawal. Or, if a unionized company is acquired, the new management can dissolve the union overnight by reclassifying unionized workers as new hires.

With these sobering facts in mind, here is how organizers who have done it describe the process of creating a union.

Step 1: Start a conversation with your co-workers

At the University of California, a two-tier system had evolved where some tech workers were unionized and some weren’t, Belasco says. Management created new titles that fell outside the union even though they had similar job descriptions and responsibilities to those in the union. Those nonunion employees received lower pay and benefits than their unionized peers, which created resentment and instability.

width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Max Belasco from the UCLA chapter of UPTE-CWA

Zac Goldstein

Belasco and other organizers wanted to eliminate that division by bringing everyone under the same contract. But when they began their unionization drive, “the biggest barrier we faced wasn’t management opposition — it was that people felt this was just the best-case scenario realistically available: ‘We have this job at the university, we have concerns about automation and layoffs, but what can we really do about it?'” he says.

The antidote to that fatalism, organizers say, is simple: “Just start talking to your immediate co-workers. Are they experiencing the same challenges you are experiencing?” says McAvinney. “There’s no need to start talking about a union at this point.”

Just get a consensus and start building a group of like-minded individuals, Thompson advises. “Always start with one-on-one conversations, and that’s what you should do the whole time. That’s the key to organizing,” he says.

Tech workers often think they’re a special case, says Thompson, and therefore that unionization isn’t a good fit. “You’re not special. You are a company of workers, you are organizing, and there is a playbook for that. Trust the process, because it tends to work pretty well,” he says.

Step 2: Who’s on board, and who’s not? Map your workplace, but keep it quiet

Once there’s a consensus, continue to grow your network. Keep a list of everyone you’ve spoken with and note their disposition: “Is this person union-friendly or anti-union? Would they be a strong organizer?” Thompson says.

Maintaining secrecy early on is essential, because anti-union tactics will start immediately, and that can stop union organizing before it can gain momentum.

“Generally, employers do not want to share power with their workforce,” McAvinney says. Employers will deploy every means at their disposal to stop organizing efforts and peel away potential yes votes.

width="1024" height="839" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Alan McAvinney from Alphabet Workers Union-CWA

Aran Per Ink

“If you look at historical examples, having 70% approval before the employer finds out about you results in a high percentage of wins when you actually cast the vote. Historically, that’s an effective buffer,” he says.

There’s a real threat of firing and layoffs. The traditional tech worker belief that job mobility makes collective action unnecessary is now being tested by a tighter job market, McAvinney says, noting that workers who many believe were fired for speaking out back in 2019 were a galvanizing factor in his union’s formation.

“You generally don’t want to be in a situation where the employer feels comfortable firing everyone. Part of that is thinking from a cynical standpoint about what the consequences would be to the employer if they did fire everyone,” he says.

One-on-one conversations that include personally asking co-workers to keep conversations confidential are key to keeping things quiet, Belasco says. When 2,100 UC tech workers voted to unionize in May, 96% voted in favor. To stay out of earshot of managers, avoid employee surveillance tools, and sidestep conference calls that could be recorded, organizers met with workers in their homes.

“That tactic is probably what made the difference between winning the election and getting the majority we got,” he says.

Step 3: Find the right union affiliation or go it alone

“Running a campaign against major employers requires the resources and expertise of the larger labor movement, even if workers publicly present as independent,” says Kate Bronfenbrenner, director of labor education research and senior lecturer emeritus at Cornell University’s School of Industrial and Labor Relations.

Options include the Communications Workers of America (CWA), Service Employees International Union (SEIU), and the Office and Professional Employees International Union (OPEIU), among others. Another resource, the Tech Workers Coalition (TWC), provides training on organizing tactics, AI-in-workplace issues, and contract negotiation, and can match workers to the right unions for their needs.

The Alphabet Workers Union decided early on to affiliate with CWA. “They gave us a bunch of support early on in our campaign with no strings attached,” McAvinney says.

Kickstarter is organized through OPEIU, Thompson says. “They’ll usually have resources and staff that can help you through the next steps: collecting signatures in support of a union, bringing that to management, holding a vote — the more formalized things that interact with US labor law. They’ll also help with organizing along the way,” he says.

For workers at institutions where a union already exists, there may be a faster path. Organizers at UCLA did what’s called a “unit modification,” aligning with UPTE. By organizing under UPTE, the workers didn’t have to negotiate a new contract from scratch — they joined an already-negotiated contract covering existing UPTE tech members, which put them in “a much stronger position” than starting fresh, Belasco says.

Step 4: Choose your union model: majority vs. pre-majority or minority

Assess what’s practical for your organizing effort. In a majority union, more than 50% of all workers in a defined bargaining unit must vote to join the union through an NLRB-supervised election in the private sector, or a Public Employment Relations Board (PERB)-supervised election for public sector workers.

The NLRB must certify the union, which then operates under its legal protections. This means, for example, that the employer must bargain, negotiated contracts are enforceable, violations must go to the NLRB or arbitration, and workers can’t be dismissed without just cause.

A pre-majority or minority union is a minority labor organization operating without NLRB protections or collective bargaining agreements. “Pre-majority means that workers are able to demonstrate majority support — through signed cards, petitions, a walkout, or everyone wearing solidarity T-shirts — without going through a formal election,” Bronfenbrenner says.

width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Kate Bronfenbrenner from the School of Industrial and Labor Relations, Cornell University

ILR School/Cornell University

The Alphabet Workers Union-CWA (AWU-CWA) formed as a pre-majority union because achieving majority status across a globally distributed workforce of over 100,000 was not a realistic near-term goal. “An underground model where you try to reach 70% support across a workforce of over 100,000 people isn’t realistic,” McAvinney says.

A pre-majority union can still make a difference, he says. For example, the Alphabet Workers Union-CWA convinced management to offer voluntary exit packages — buyouts — prior to announcing layoffs.

For smaller organizations, a majority union may be the more practical option — it’s more attainable, McAvinney says. “I don’t think [the pre-majority union model] is the correct thing to do in all situations. I certainly would not recommend it to a 200-person shop.”

Kickstarter, which had fewer than 100 employees, was able to form a majority union, with 55% voting to organize.

Ultimately, says McAvinney, “there’s no inflection point where you go from being able to win nothing to winning everything, even with a contract and a supermajority. But the more people you have who are willing and able to fight for what they want, the more you’ll be able to get.”

Step 5: Who should — and should not — be in your union?

Belasco’s situation at UCLA illustrates a broader strategic choice that every organizing campaign must make. He had been in a union position in educational technology when he was told his role would be reclassified as a non-union position.

“I was given a choice: apply to the new non-union position to continue doing the work I’d trained for, or stay in my union position doing service desk work I wasn’t used to,” he says. “Essentially, it was a choice between job security and career progression.”

Belasco joined a “wall-to-wall” union, which represents a broad range of university professional and technical employees across the UC system rather than a single job category, such as engineers or tech professionals.

Kickstarter United is another example of a wall-to-wall union. “It’s not just the engineers who are unionized, but also customer support, designers — everyone,” Thompson says.

Wall-to-wall unions are more powerful, but they’re also more difficult to achieve. Under US labor law, “professionals have to vote separately on whether they want to be combined with other workers,” says Bronfenbrenner. “You can never have a wall-to-wall unit without giving professionals the chance to decide whether they want to be separate.”

The law’s “professional employees” category includes roles like software engineers and developers but not necessarily others. For example, customer support specialists and QA analysts would fall into the “non-professional workers” category.

“For decades, the pattern was either to organize everybody except the engineers, or manage to organize the engineers and fail to bring in everybody else — neither of which builds real worker power,” says Simone Robutti, an organizer with Tech Workers Coalition Global, an international branch of TWC based in Berlin.

width="959" height="713" sizes="auto, (max-width: 959px) 100vw, 959px">

Simone Robutti from Tech Workers Coalition Global

TWC

Step 6: You won the vote. Get ready for what comes next

Winning a union vote means having a seat at the table, says Thompson. “Once the workers have come together and agreed they want that seat, you bring that to management, and they have a chance to voluntarily recognize a union,” he says.

But in most cases employers contest the results, which must be certified by the NLRB or PERB. That process, in which the employer uses various tactics to challenge the legitimacy of the outcome, can take weeks or months.

Unfortunately, the legal framework that is supposed to protect workers during this process has been significantly weakened in the last few years. In a potentially more ominous development, SpaceX, Amazon, Trader Joe’s, Starbucks, and the University of Southern California have in separate legal actions challenged the constitutionality of the NLRB, arguing that the agency’s structure violates the separation of powers. The Fifth Circuit Court of Appeals upheld injunctions against the NLRB in SpaceX’s case in August 2025 — a serious challenge to the agency’s authority.

In the meantime, some companies may disregard negotiated contracts, which can lead to lengthy legal appeals or extended arbitration.

“The NLRB can still force an election, but it can’t force a contract, and companies are saying they simply won’t comply,” Bronfenbrenner says. This is where the expertise and resources of affiliation with a major union can help, she adds.

As a result, contract negotiations can take far longer than workers might expect. At Kickstarter, for example, two years and four months elapsed from the time of the union vote to the first contract, and that was at a 59-person company with a relatively cooperative employer. At larger companies with more aggressive legal teams, the timeline will be longer.

Forming a union is hard work, Robutti says. “It’s not a service you pay for and they protect you. It doesn’t happen spontaneously, and it doesn’t happen magically. It’s the choice to take responsibility for improving your workplace.”

5 wild ways to make Android widgets more useful

Wed, 15 Jul 2026 12:03:24 +0200

Widgets, widgets, widgets. Has there ever been an Android feature so full of promise that went unloved by Google for so very long?

Okay, so maybe there has been — erm, lots of times, actually. But even so, Android’s widgets system is a perfect example of an exceptional advantage that Google basically buried, abandoned, and left on the brink of extinction up until its overdue revival in 2021’s Android 12 update. (And that revival, by the way, happened for no apparent reason whatsoever. Just a totally random, unprompted change of heart after a decade of indifference. Riiiiiiiiight.)

Google may have given up on widgets for a while, but the good news is that (a) they’re back, baby — still now, more than ever, even in our overly AI-obsessed 2026 timeline — and (b) the Android developer community keeps chuggin’ along and coming up with ever-more creative new ways to embrace widgets beyond what Google itself sees fit to give us. That means no matter what Android version your favorite phone is running, you can step up your own Android widget game and give yourself some fresh and fruitful paths to make the most of your phone’s framework.

Here, my dear, are some fantastic beyond-the-basics ways to put your favorite Android widgets to use and change the way you get stuff done on your phone.

[Psst: Love learning new things? Get my free Android Intelligence newsletter to get a tasty new tip in your inbox every Friday.]

Android widget enhancement #1: The on-demand home screen pop-up

Widgets are a wonderful way to interact with all sorts of info without ever having to open up apps, but having too many widgets can quickly lead to a cluttered and overwhelming home screen.

Well, here’s a neat way to give yourself the benefit of a widget while still maintaining a neat and minimal space for working: An excellent app called Popup Widget lets you create an on-demand pop-up widget (get it?!) that looks like a regular ol’ icon on your home screen but then loads any widget you want when tapped.

See?

Any widget, anytime — with Popup Widget on Android.

JR Raphael, Foundry

You can even get really wild and set up a single icon that opens multiple widgets at the same time — like your inbox and your calendar together:

Popup Widget can even let you summon two widgets together with a single tap.

JR Raphael, Foundry

Not bad, right?

Popup Widget costs two bucks and doesn’t require any special permissions or manners of access. And it’s pretty simple and self-explanatory to set up: Once you install and open the app, it’ll walk you through adding in whatever pop-up widgets you want. You can choose the name and even the icon associated with each one along with its precise placement on your screen and how much the screen behind it should dim when it’s loaded.

The app will offer to add the shortcut directly onto your home screen for you then, or you can also find all of your Popup Widget creations by pressing and holding the main Popup Widget icon in your app drawer.

Alternatively, if you’re already using a custom Android launcher like Smart Launcher or Niagara, you can find similar options for summoning widgets on demand within their settings — no separate apps even required.

And that, my widget-loving wallaby, is but our first winning widget possibility.

Android widget enhancement #2: The on-demand universal pop-up

If you like the idea of having a widget on demand but would rather have it be available to summon from anywhere instead of just from your home screen, this next wacky widget option is just the thing for you.

It comes from a spectacular app called Edge Gestures, which works in conjunction with Popup Widget to take that same concept and make it universally accessible. (I told ya it was wacky!)

When you first install Edge Gestures, the app will prompt you to enable it as a system accessibility service and to grant it the ability to display over other apps. These permissions sound scary — and they should! — but in the case of this specific utility, they’re absolutely appropriate and necessary in order for it to operate. The former is the only way an app is able to create a custom system-wide gesture, which we need for this setup to work its magic, and the latter is how your widget is able to be shown on top of whatever else you’re doing.

(If you’re at all worried, note that Edge Gestures doesn’t request any other significant system permissions. Beyond that, it’s reputable, it’s been around for quite a long while, and it has a large number of overwhelmingly positive reviews.)

Where were we? Oh, right: Once you’re inside the Edge Gestures configuration area, you’ll be able to select exactly what gesture you want to use for pulling up your widget. I’d think carefully about finding something that won’t interfere with anything else, like the system-level Android gestures, and that’ll be convenient to access without being a command you’re likely to trigger by mistake.

So, for instance, you might make the gesture a simple swipe downward along the left side of your screen. To do that, you’d find the “Swipe down” option within the app’s “Left” tab, and you’d set it to “Popup Widget” — and then create or select whatever Popup Widget item you want. And remember: You can select one widget or multiple widgets, too.

Prepare yourself for some serious oohing and ahhing:

Your favorite widgets are never more than a swipe away with Edge Gestures on Android.

JR Raphael, Foundry

As you can see, this opens up a whole new world of mobile multitasking potential. I mean, really: How could you not love that?!

The final thing worth doing is going into all the other gesture options in that same configuration area and tapping “Clear” for each of ’em to get rid of Edge Gestures’ default actions. I’d also go into whichever side of the screen you aren’t using — left or right — and tap the toggle to turn the gestures for that side off entirely. That way, you won’t inadvertently activate any gestures that you don’t actually want or need.

Edge Gestures costs $2 to use.

Android widget enhancement #3: The physical key call

Next, here’s an interesting twist on that same on-demand Android widget idea: You can make any widget especially easy to access from anywhere without even having to mess around with any on-screen swiping by setting one of your phone’s physical keys as a trigger for the widget’s appearance.

I’ll give you a second to catch your breath and process the sheer splendor of that sorcery.

Back? Cool. So, the key to this feat (har har) is the combination of the aforementioned Popup Widget and a handy Android contraption called Key Mapper — which makes it easy to map your phone’s physical keys to all kinds of crazy custom actions.

In this case, we’ll set it up so that pressing and holding one of your volume keys causes whatever widget you want to be summoned, like so:

Yes, your volume key can cause a widget to appear (whoa!).

JR Raphael, Foundry

Pretty nifty, no?

I’ve got step-by-step instructions for making this happen in this separate guide.

Android widget enhancement #4: The floating bubble

If you like the notion of having a widget always available but aren’t so keen on the hidden gesture concept, an app called Overlays will let you create a small floating bubble that you can position anywhere on your screen and then tap to pull any widget up when you want it — just like with Android’s recently revived Bubbles multitasking system, only compatible with any Android device and version and with the simplicity of a widget instead of the complexity of an entire app.

Check it out:

Overlays puts a floating icon on your screen for easy ongoing widget access.

JR Raphael, Foundry

By default, Overlays gives you a bunch of its own little widgets to choose from, but the real power comes from adding in widgets from the Android apps you actually rely on. To do that, tap the “Triggers” tab at the bottom of the Overlays configuration area, then tap the red plus button in the lower-right corner of the screen. Select “Manual,” then type in whatever name you want for your widget and tap the icon to pick any icon you like.

Tap “Save,” then select “Widget” and find the widget you want from the list. At that point, you’ll see a preview of the widget. Move or resize it if you like, then hit the arrow in the upper-left corner of the screen to exit out of that interface. Last but not least, tap the name of your newly made widget on the screen that comes up next to change its status to “Always on.”

As soon as you head out of the app and back to your home screen, your fancy new widget should pop right up. All you’ve gotta do is tap the little downward-facing arrow in its corner to minimize it down to a bubble, which you can then press and hold to move anywhere your widget-worshipping heart desires.

Overlays can also create widgets that automatically appear based on context — so you could have something show up every time you connect to a certain Bluetooth device or Wi-Fi network, for instance. To explore those options, just follow the same steps from above but pick “Event” instead of “Manual” when you reach the “Triggers” tab configuration.

Overlays is free with an optional $4 in-app upgrade that removes some ads from the configuration tool and unlocks a handful of advanced features.

Android widget enhancement #5: The widget stack

Last but not least in our collection of wacky Android widget possibilities is one of my favorite widget wonders — and that’s the ability to stack multiple widgets and then swipe between ’em on your home screen without having ’em take up any extra space.

Check it out:

The space-saving simplicity of stacked widgets, as seen in Smart Launcher.

JR Raphael, Foundry

This enhancement presents a bit of a choose-your-own-adventure-style path:

First, if you’re using a reasonably recent Samsung Galaxy gizmo, the option is should already be present and available in your standard Samsung home screen setup. Just press and hold any open space on your home screen and then select the option to add a widget — then, once the widget is added, press and hold it and look for the “Create stack” command.

With any other Android gadget — or even with a Samsung device, if you want extra options and flexibility — you can use a custom Android launcher like the aforementioned Smart Launcher or Niagara as well as the retro-geeky T9-themed Key Launcher I introduced to you earlier this summer.

Those launchers replace your phone’s entire home screen environment and give you all sorts of interesting new possibilities for optimizing your interface and making it especially well-suited for you. And the stacked widget feature is just one small sliver of what they offer and how they’ll transform your Android experience.

The setup interface for a widget stack within Smart Launcher.

JR Raphael, Foundry

So there ya have it: five wacky, wild, wonderful ways to make widgets even more wow-inducing. Some days, you’ve just gotta love Android and the endless customization, control, and power it provides.

Put even more Googley goodness in your noggin with my free Android Intelligence newsletter — one exceptional new thing to try every Friday!

The trillion-dollar question: When should legacy applications make way for AI?

Wed, 15 Jul 2026 12:03:08 +0200

If you just read the headlines, it would seem as if AI is now writing all of the world’s code and powering every application businesses run on.

That’s far from true. Just 4 of 33 AI pilots reach production, according to IDC Research — leaving legacy applications still fueling the wheels of commerce. This “silent majority” represents trillions of dollars spent each year on building, maintaining, testing, validating and monitoring legacy applications.

These applications won’t be replaced overnight. Companies and organizations depend on their predictability. The 60-plus-year-old COBOL programming language remains the backbone of banking software for good reason: it is extraordinarily efficient at processing massive transaction volumes with precision. Furthermore, do you want your bank revolutionizing how they manage your money? Probably not.

So, while AI investment continues to build inside the software development lifecycle (SDLC), it isn’t instantly rendering older software obsolete. What it will do is steadily enable easier tweaking, updating and testing of legacy applications — and in some cases, full migrations to modern platforms. And really, this isn’t a new phenomenon. Businesses have always looked to wring more efficiency and profit from existing products through intelligent prioritization.

The argument then is that CIOs and CTOs can take a proactive look at their legacy application portfolios to determine which ones, if any, should migrate sooner. Five considerations can help guide that decision.

Before replacing legacy apps with AI, ask these 5 important questions

1. Does the legacy application still work?

Is its utility still there? Customers often appreciate the consistency of legacy applications. They’re reliable, predictable and well understood. Don’t fix what isn’t broken. Another way to think about this is the degree to which the technical approach of your legacy application is still viable. It’s pretty much a guarantee nowadays in software that an application built one way, with some set of technologies, would be built a totally different way just two to three years later. There is no avoiding that, but what you want to avoid is investing further into a technical approach powering a legacy application that has been completely replaced with new software or a technical approach, especially if it is 10x better across the vectors of software development (latency, cost, accuracy).

2. Does it still make financial sense?

Running a system over a long period amortizes costs significantly. Even as growth rates slow or plateau, it can still be less expensive to let legacy applications run than to overhaul them. Another way to think about this is: how viable is my customer base in the near-term and the long-term? If you anticipate modest—or even flat—earnings growth for your product, then that’s an indicator that it’s possibly worth optimizing your development processes with AI. Where it’s probably not worth investing is when you have no confidence in your future earnings, whether that’s due to the customer base shrinking or commoditization or something else.

3. Can you integrate AI into existing workflows?

A significant portion of upcoming software development lifecycle work will focus on refactoring applications to be more AI-native. Some legacy applications may be strong candidates for a full AI rebuild, while others are better positioned for an AI add-on. Gartner research from 2025 found that only 28% of AI use cases in infrastructure and operations fully succeeded.

Among those that did, success was attributed primarily to integrating AI into existing workflows and systems. “As AI becomes part of day‑to‑day operations, it boosts adoption and creates visible impact within the organization,” Gartner states.

It’s important to keep in mind the distinction between using AI to optimize an existing process or workflow within your application, versus powering a workflow or feature with AI. The former approach is more palatable for legacy applications because it generally doesn’t change the cost profile of running that application. In the latter case, if you’re introducing an AI-powered module into the application, you’re generally going to incur inference costs at runtime, and they are an order of magnitude more expensive for today’s frontier models than base compute.

4. Do you have documented processes for maintaining legacy applications?

If so, you’ll more quickly identify where AI can optimize. The more coherent, organized and detailed processes are, the faster AI can find its footing and drive tangible efficiency gains. If documentation is lacking, start there. Keep detailed instructions and workflows for how you do things. Consistency matters. Don’t do things by heart. Don’t approach tasks casually, and don’t do things differently each time. The more uniform your process, the more easily you can insert AI into discrete steps and achieve efficiencies without disrupting the broader software development lifecycle. The organization in the most precarious position is the one managing legacy applications with no documented process for doing so.

5. Can you prioritize?

Making a change to a piece of legacy software might involve 20 or more steps. Only one or two of those steps may be clear candidates for AI-driven optimization. Identifying and prioritizing those opportunities will help you realize early wins and build the case for broader return on investment. Also, not all candidates for optimization make sense in light of broader financial and operational constraints. As always, prioritize ruthlessly in favor of ROI—bang for your buck. If your team has been struggling to operate a particular part of your system due to a lack of expertise or time, you might consider using AI to buttress the maintenance of that component. Having AI own that part of the workflow might unlock big time savings—or it might erode crucial domain knowledge that your team used to possess through repetition. There is no one-size-fits-all; think through the second-order effects.

Adding AI in testing in the SDLC

Beyond coding and application development, AI is opening new possibilities in how we test software. As leaders examine processes and look for places to insert AI, testing is often a natural entry point. There has been substantial innovation here, including new autonomous AI-driven testing solutions, those that have been enhanced with AI, and hybrid approaches that blend both. Each organization will be at a different place in its AI journey. Testing solutions exist to meet everyone where they are. Also, the state of applications will help determine which approach fits best—and when it fits as you evolve applications.

Of course, there is some substance to the AI hype around how much code AI will write and how many applications it is already creating faster than ever. But one school of thought is that AI’s biggest economic impact will be in the creation of massive new markets and industries rather than in the complete displacement of existing industries. Regardless of how far AI takes us through the universe, it’ll take some time and it’ll be bankrolled by the trillions of dollars of existing products and industries that we depend on every day.

That’s all good news for legacy players, but no one can afford to stay still. AI capabilities are advancing rapidly. Make it a habit to revisit legacy applications and workflows regularly. The right moment to introduce AI will keep shifting, and staying ahead of it is a competitive advantage.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

I investigated Palantir’s foothold in the British state – and what I found should worry us all | Peter Geoghegan

Wed, 15 Jul 2026 06:03:32 +0200

Paid-for political access and threadbare regulations have helped to embed the US tech firm in the NHS – and beyond. But there is a way to free ourselves

Andy Burnham faces a lot of big decisions. But one of the incoming prime minister’s biggest early tests is what he does about the world’s “scariest company” – Palantir. The US defence and surveillance tech behemoth has a swathe of British public contracts, including, most controversially, a £330m deal with the NHS. It’s pretty clear what many of Burnham’s new parliamentary colleagues want him to do: the science, innovation and technology committee says the government should ditch Palantir and its “clear mismatch with UK values”.

Peter Thiel and Alex Karp’s company is not without British backers. The Times and the Telegraph have been enthusiastic supporters. In the Financial Times last month former Conservative party adviser Camilla Cavendish accused Palantir’s critics of putting politics over progress: “To me, what matters is what works.”

Peter Geoghegan runs the investigative website Democracy for Sale

Switching help

Wed, 15 Jul 2026 04:08:38 +0200

I'm looking at ditching Windows 10 and moving to Linux. I'm honestly just over Windows at this point. Even something as simple as wanting more than 5 rotating wallpapers is limited, and I can't move to Windows 11 because my main rig has dual CPUs.

I'm after some opinions from people who daily drive Linux.

At the moment I'm leaning towards openSUSE Tumbleweed. I'm generally not a fan of forks of other distros (Manjaro, CachyOS, etc.). My servers all run Debian, so I'm very familiar with Debian-based systems, but those are all headless so desktop experience isn't really a factor.

I don't think Debian is the right choice for my desktop. I like it for servers because it's rock solid, but for gaming and newer hardware I feel it's a bit too conservative. That's one of the reasons I'm leaning towards Tumbleweed — it seems like a good middle ground with up-to-date packages while still having a reputation as a safer bleeding-edge rolling release.

I had a pretty bad experience with Fedora. My GTX 1070 had horrible mouse lag with the proprietary drivers, and my 3Dconnexion SpaceMouse wasn't supported properly, so that put me off Fedora.

From what I've researched, it seems like my best options are either Arch or openSUSE Tumbleweed, but I'm not 100% sure where to go.

Gaming isn't a huge concern. The games I play are supported through Proton, and I don't have TPM (hardware swap reasons), so kernel-level anti-cheat isn't really an issue. I haven't been gaming much recently anyway — I've gotten into Wolfenstein: The New Order and I'm having fun with that on my second playthrough.

Specs

- Dual Xeon E5-2689 v1

- 128GB DDR3 ECC RAM

- GTX 1070

- Radeon HD 6540

- 5×500GB HDD

- 1×250GB HDD

- 1×6TB HDD

Apps I know will be fine or have alternatives

- OrcaSlicer

- FreeCAD

- 3Dconnexion SpaceMouse drivers

- Spotify

- qBittorrent

- KDiskMark / smartctl instead of CrystalDiskInfo

- lm-sensors / alternatives instead of Core Temp

- Remmina instead of MobaXterm

- Kdenlive

- Audacity

- Steam

- Minecraft

- Hardware monitoring tools

- Discord

Apps I'm unsure about

- Logitech Options+

- SuperDisplay / Android tablet as a wireless display

- FrostWire

- UniFi Network Server

- WinDirStat equivalent

- OBS Studio

- Camo

- Rockstar Games Launcher

- Epic Games Launcher

- DS4Windows / PS5 DualSense controller support

- FancyZones alternative (KWin tiling, Hyprland, etc.)

- Audio drivers/software

I'm fairly comfortable in the terminal, so that isn't an issue. I don't mind learning, but I also don't want to spend every weekend fixing my OS.

I'm open to suggestions. If you've used openSUSE Tumbleweed, Arch, or another distro that you think would suit my use case better, I'd like to hear your thoughts. Also interested in any issues I might run into with the apps listed above or anything else I should know before making the switch.

submitted by /u/Equal_General1672
[link] [comments]

Linux Foundation's Latest Foray Is To Standardize Internet-Native Payments For AI Agents

Tue, 14 Jul 2026 21:02:48 +0200

Today, the Linux Foundation launched the x402 Foundation to standardize internet-native payments for AI agents, APIs, and applications, based on Coinbase's contributed x402 protocol. Backed by companies including AWS, American Express, Cloudflare, Google, Mastercard, Stripe, and Visa, the effort aims to make payments work directly over HTTP (assuming users are comfortable letting AI agents handle financial transactions). "The whole idea is to give agents access to money and, through that financial independence, improve their set of capabilities to pretty much anything on the internet," Lincoln Murr, Coinbase's AI product lead, told CNBC last month when the company announced the protocol. "In the 2010s, every internet company dealt with the transition from desktop and web into a mobile environment. And now in the late 2020s, we're seeing the exact same thing happen where agents are going to be the new primary economic actors on the internet."

Read more of this story at Slashdot.

The July 2026 Security Update Review

Tue, 14 Jul 2026 20:22:46 +0200

Adobe Patches for July 2026

Here’s this month’s overview table:

Bulletin ID	Product	CVE Count	Highest Severity	Highest CVSS	Exploited	Deployment Priority
APSB26-82	Adobe ColdFusion	13	Critical	9.9	No	1
APSB26-73	Adobe Commerce	13	Critical	9.6	No	2
APSB26-78	Adobe After Effects	3	Critical	7.8	No	3
APSB26-83	Adobe Animate	6	Critical	8.6	No	3
APSB26-71	Adobe Audition	6	Critical	7.8	No	3
APSB26-81	Adobe Bridge	6	Critical	7.8	No	3
APSB26-77	Adobe Creative Cloud Desktop Application	2	Critical	8.1	No	3
APSB26-74	Adobe Experience Manager	13	Critical	9.6	No	3
APSB26-79	Adobe Illustrator	5	Critical	9.3	No	3
APSB26-72	Adobe Media Encoder	5	Critical	7.8	No	3
APSB26-76	Adobe Premiere Pro	4	Critical	7.8	No	3
APSB26-80	Content Credentials SDK	12	Critical	8.2	No	3
TOTAL	12 bulletins	88

Microsoft Patches for July 2026

Here’s the full list of CVEs released by Microsoft for July 2026:

CVE	Title	Severity	CVSS	Public	Exploited	Type
CVE-2026-56155	Active Directory Federation Services Elevation of Privilege Vulnerability	Important	7.8	No	Yes	EoP
CVE-2026-56164	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Moderate	5.3	No	Yes	EoP
CVE-2026-50661	Windows BitLocker Security Feature Bypass Vulnerability	Important	6.1	Yes	No	SFB
CVE-2026-54121	Active Directory Certificate Services Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-45499 **	Azure OpenAI Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-48564	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50370	DHCP Server Service Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-56159	DHCP Server Service Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50382	DirectX Graphics Kernel Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-41106 **	Microsoft 365 Copilot Elevation of Privilege Vulnerability	Critical	9.3	No	No	EoP
CVE-2026-26145 **	Microsoft Azure Synapse Elevation of Privilege Vulnerability	Critical	4.8	No	No	EoP
CVE-2026-48561	Microsoft Copilot Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-55011	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55012	Microsoft Defender Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55944	Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-57100 **	Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55041	Microsoft Excel Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-54998 **	Microsoft Exchange Online Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-55008	Microsoft Exchange Server Spoofing Vulnerability	Critical	9.6	No	No	Spoofing
CVE-2026-54992	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50314	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50467	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55018	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55022	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55045	Microsoft Office Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-55049	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55129	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55056	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55140	Microsoft Office Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55043	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55123	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55120	Microsoft PowerPoint Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50522	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-58644	Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-55040	Microsoft SharePoint Server Security Feature Bypass Vulnerability	Critical	9.1	No	No	SFB
CVE-2026-54117	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54118	Microsoft SQL Server Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-50655	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-56189	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-57090	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57094	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57087	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-57092	Microsoft Windows VMSwitch Elevation of Privilege Vulnerability	Critical	9.9	No	No	EoP
CVE-2026-55033	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55127	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55132	Microsoft Word Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-55010	Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50474	Remote Desktop Client Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-49164	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-54128	Windows DHCP Client Remote Code Execution Vulnerability	Critical	8.4	No	No	RCE
CVE-2026-50518	Windows DHCP Server Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-49796	Windows GDI+ Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-50380	Windows GDI+ Remote Code Execution Vulnerability	Critical	9.6	No	No	RCE
CVE-2026-54127	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	7.4	No	No	EoP
CVE-2026-50680	Windows Hyper-V Elevation of Privilege Vulnerability	Critical	8.2	No	No	EoP
CVE-2026-50327	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58542	Windows Media Remote Code Execution Vulnerability	Critical	7.8	No	No	RCE
CVE-2026-58608	Windows Print Spooler Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54982	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-54995	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-42982	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7.8	No	No	EoP
CVE-2026-50392	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Critical	7	No	No	EoP
CVE-2026-50694	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Critical	8.1	No	No	RCE
CVE-2026-56188	Windows Server Network driver Remote Code Execution Vulnerability	Critical	9.8	No	No	RCE
CVE-2026-50444	Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability	Critical	8.8	No	No	EoP
CVE-2026-54999	Windows TCP/IP Remote Code Execution Vulnerability	Critical	8.8	No	No	RCE
CVE-2026-47302	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50525	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50651	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57108	.NET Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50524	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50527	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50648	.NET Framework Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50650	.NET Framework Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50646	.NET Framework Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50649	.NET Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47304	.NET Security Feature Bypass Vulnerability	Important	8.1	No	No	SFB
CVE-2026-50528	.NET Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-50659	.NET Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-50526	.NET Tampering Vulnerability	Important	7	No	No	Tampering
CVE-2026-50682	Active Directory Denial of Service Vulnerability	Important	7.1	No	No	DoS
CVE-2026-55001	Active Directory Domain Services Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50647	Active Directory Federation Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50684	Active Directory Federation Server Spoofing Vulnerability	Important	4.8	No	No	Spoofing
CVE-2026-56170	ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-47300	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-47303	ASP.NET Core Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50652	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50653	Azure Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57969	Azure CycleCloud Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58279	Azure CycleCloud Elevation of Privilege Vulnerability	Important	6.5	No	No	EoP
CVE-2026-47632	Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50338	Azure Spring Apps Elevation of Privilege Vulnerability	Important	8.2	No	No	EoP
CVE-2026-50488	Clipboard User Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50491	Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50381	Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50427	Content Delivery Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50692	Desktop Window Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58633	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58634	Desktop Window Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50296	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50375	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-50353	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50493	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56643	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56644	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58629	DirectX Graphics Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49174	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-50495	DNS Client Tampering Vulnerability	Important	6.1	No	No	Tampering
CVE-2026-57088	Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50663	Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-47282	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-41109	GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-50510	GitHub Copilot Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49787	HTTP.sys Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50420	HTTP.sys Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49788	HTTP/2 Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50696	Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58617	M365 Copilot for iOS Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-58595	Microsoft Bing App for IOS Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-49162	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50305	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50361	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50466	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50458	Microsoft Brokering File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50658	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56178	Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50657	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50329	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58541	Microsoft DWM Core Library Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58596	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability	Important	8.3	No	No	EoP
CVE-2026-57991	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	7.4	No	No	Info
CVE-2026-58291	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57981	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57984	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57985	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.6	No	No	RCE
CVE-2026-57986	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57988	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.1	No	No	RCE
CVE-2026-57992	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58276	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-56645	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57974	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-57975	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58281	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58284	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58285	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58287	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58288	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.3	No	No	RCE
CVE-2026-58289	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	9	No	No	RCE
CVE-2026-58290	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58292	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58293	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58294	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-57983	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.7	No	No	SFB
CVE-2026-58295	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.3	No	No	SFB
CVE-2026-58525	Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability	Important	8.2	No	No	SFB
CVE-2026-57987	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-58278	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-56646	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-57977	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.1	No	No	Spoofing
CVE-2026-57993	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.4	No	No	Spoofing
CVE-2026-58282	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58283	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58286	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	8.1	No	No	Spoofing
CVE-2026-58298	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	7.2	No	No	Spoofing
CVE-2026-58524	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-58296	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58297	Microsoft Edge for Android Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-58300	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-58522	Microsoft Edge for Android Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-58299	Microsoft Edge for Android Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-58523	Microsoft Edge for Android Security Feature Bypass Vulnerability	Important	6.5	No	No	SFB
CVE-2026-50678	Microsoft Excel Information Disclosure Vulnerability	Important	6.6	No	No	Info
CVE-2026-54988	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-48580	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50408	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55046	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55138	Microsoft Excel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55054	Microsoft Excel Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55122	Microsoft Excel Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55898	Microsoft Excel Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-50675	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55899	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55948	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58618	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-47642	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55024	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55025	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55031	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55048	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55029	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55039	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55136	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55141	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55036	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55044	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55037	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55058	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55137	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55053	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-54131	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55947	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55949	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56156	Microsoft Excel Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55006	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55009	Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55005	Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56642	Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-50343	Microsoft Install Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50439	Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-58537	Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56193	Microsoft Office Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-55023	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55026	Microsoft Office Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-55027	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55028	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55047	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55035	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55057	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55121	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55042	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55139	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50665	Microsoft Office Information Disclosure Vulnerability	Important	7.8	No	No	Info
CVE-2026-56192	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56195	Microsoft Office Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-47290	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50301	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55017	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55125	Microsoft Office Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55133	Microsoft OneNote Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58636	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50438	Microsoft PC Manager Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58647	Microsoft PowerBI Report Server Spoofing Vulnerability	Important	8	No	No	Spoofing
CVE-2026-55052	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58277	Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-55051	Microsoft SharePoint Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54108	Microsoft SharePoint Server Spoofing Vulnerability	Important	6.5	No	No	Spoofing
CVE-2026-55016	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55019	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55020	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55021	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55030	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-55034	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55126	Microsoft SharePoint Server Spoofing Vulnerability	Important	7.3	No	No	Spoofing
CVE-2026-55135	Microsoft SharePoint Server Spoofing Vulnerability	Important	4.6	No	No	Spoofing
CVE-2026-56157	Microsoft SharePoint Server Spoofing Vulnerability	Important	5.4	No	No	Spoofing
CVE-2026-47296	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55002	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-47295	Microsoft SQL Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50468	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54116	Microsoft SQL Server Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-42900	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-49784	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50356	Microsoft Windows App Store Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49165	Microsoft Windows App Store Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54993	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58610	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55050	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55124	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55142	Microsoft Word Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-55032	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55055	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55038	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55134	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55128	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-55130	Microsoft Word Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50359	Microsoft XML Core Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-57097	Microsoft XML Security Feature Bypass Vulnerability	Important	6.4	No	No	SFB
CVE-2026-50346	Netlogon RPC Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50402	NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50506	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-45646	OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-54989	Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50365	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-54990	Remote Desktop Client Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-58594	Remote Desktop Client Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56190	Remote Desktop Protocol Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-49783	Secure Boot Security Feature Bypass Vulnerability	Important	7.8	No	No	SFB
CVE-2026-42990	SQL Server ODBC driver Elevation of Privilege Vulnerability	Important	9.8	No	No	EoP
CVE-2026-49168	Storage Spaces Direct Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-48581	Surface Broker SDMA Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49180	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50455	Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54111	Universal Print Management Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58543	Universal Print Management Service Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58601	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Important	7.8	No	No	EoP
CVE-2026-50520	Visual Studio Code Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-45496	Visual Studio Code Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-57101	Visual Studio Code Security Feature Bypass Vulnerability	Important	7.1	No	No	SFB
CVE-2026-57102	Visual Studio Code Security Feature Bypass Vulnerability	Important	8.8	No	No	SFB
CVE-2026-47305	Visual Studio Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49805	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50297	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50325	Win32k Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50489	Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57095	Win32k Elevation of Privilege Vulnerability	Important	6.2	No	No	EoP
CVE-2026-50416	Win32k Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-56184	Win32k Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50432	Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-54119	Windows Active Directory Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-57976	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50366	Windows Active Directory Domain Services Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-49178	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-58529	Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-54983	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50695	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50304	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50368	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50324	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	5.9	No	No	DoS
CVE-2026-50355	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50411	Windows Active Directory Federation Services Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-58631	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-56196	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56197	Windows Admin Center (WAC) Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-56169	Windows Admin Center Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-57107	Windows Admin Center Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56185	Windows Admin Center Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50312	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-50462	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57093	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-34346	Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-48572	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-48571	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50400	Windows App Package Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50331	Windows Application Model Core API Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49803	Windows AppX Deployment Extensions Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50351	Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50440	Windows Audio Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34328	Windows Audio Service Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50406	Windows Backup Engine Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50364	Windows Backup Service Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-42975	Windows Bluetooth Port Driver Remote Code Execution	Important	8	No	No	RCE
CVE-2026-58538	Windows Bluetooth Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58638	Windows Boot Loader Security Feature Bypass Vulnerability	Important	6	No	No	SFB
CVE-2026-58637	Windows Client-Side Caching Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50384	Windows Clip Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49183	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50689	Windows Clipboard Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50374	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	6.3	No	No	EoP
CVE-2026-58536	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58613	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50401	Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50697	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50667	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50421	Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50428	Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability	Important	7.1	No	No	Info
CVE-2026-50352	Windows Cryptographic Services Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50302	Windows Cryptographic Services Security Feature Bypass Vulnerability	Important	4.2	No	No	SFB
CVE-2026-55144	Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-50347	Windows Data.dll Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49181	Windows DHCP Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50683	Windows DHCP Client Elevation of Privilege Vulnerability	Important	8	No	No	EoP
CVE-2026-58627	Windows DHCP Server Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50685	Windows DHCP Server Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-49807	Windows DirectX Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-49175	Windows DNS Client Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50487	Windows DNS Client Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50465	Windows DNS Client Tampering Vulnerability	Important	7.1	No	No	Tampering
CVE-2026-49169	Windows DNS Server Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-50426	Windows DNS Server Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50424	Windows Domain Controller Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-50300	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50437	Windows DWM Core Library Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-34348	Windows Event Logging Service Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50502	Windows Event Logging Service Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-33842	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40422	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-41087	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50473	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50442	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50389	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50456	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57084	Windows File Explorer Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-57091	Windows File History Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50405	Windows Filtering Platform Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49172	Windows FTP Service Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50387	Windows GDI Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54122	Windows GDI+ Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-50483	Windows Graphics Component Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58609	Windows Graphics Component Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50391	Windows Group Policy Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50310	Windows Human Interface Device Information Disclosure Vulnerability	Important	4.7	No	No	Info
CVE-2026-50485	Windows Hyper-V Denial of Service Vulnerability	Important	4.5	No	No	DoS
CVE-2026-54129	Windows Hyper-V Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50315	Windows Image Acquisition Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58534	Windows Input Method Editor (IME) Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50490	Windows Installer Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58540	Windows Installer Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50425	Windows Internal System User Profile Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50293	Windows Internal Task Bar Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49167	Windows Kernel Elevation of Privilege Vulnerability	Important	4.7	No	No	EoP
CVE-2026-49173	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54132	Windows Kernel Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-49795	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-49798	Windows Kernel Elevation of Privilege Vulnerability	Important	9.3	No	No	EoP
CVE-2026-49808	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50354	Windows Kernel Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50332	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50377	Windows Kernel Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-50390	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50423	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50397	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50436	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50399	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50459	Windows Kernel Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50477	Windows Kernel Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50478	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50484	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50673	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58532	Windows Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50294	Windows Kernel Information Disclosure Vulnerability	Important	6.2	No	No	Info
CVE-2026-50316	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50419	Windows Kernel Information Disclosure Vulnerability	Important	3.3	No	No	Info
CVE-2026-50463	Windows Kernel Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50475	Windows Kernel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50429	Windows Kernel Information Disclosure Vulnerability	Important	8.2	No	No	Info
CVE-2026-58614	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58545	Windows Kernel Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-58602	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50393	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50396	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50378	Windows Key Guard Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50303	Windows Key Guard Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-40378	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	7.5	No	No	DoS
CVE-2026-49799	Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50371	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58544	Windows Management Services Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50404	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50358	Windows Media Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50336	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50398	Windows Media Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50414	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50379	Windows Media Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50433	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50676	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50677	Windows Media Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-34349	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50394	Windows Media Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50415	Windows Media Information Disclosure Vulnerability	Important	5.3	No	No	Info
CVE-2026-57083	Windows Media Photo Codec Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-54115	Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50447	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	9.8	No	No	RCE
CVE-2026-50505	Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50342	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56183	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-56187	Windows MIDI Service Module Elevation of Privileges Vulnerability	Important	7	No	No	EoP
CVE-2026-58635	Windows Narrator Braille Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50500	Windows Netlogon Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50476	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50450	Windows Network Connections Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56650	Windows Network File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56649	Windows Network File System Remote Code Execution Vulnerability	Important	5.9	No	No	RCE
CVE-2026-50470	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-50496	Windows Network Policy Server SNMP Information Disclosure Vulnerability	Important	7.5	No	No	Info
CVE-2026-56194	Windows NFS Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56648	Windows NFS Server Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50337	Windows Notification Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49789	Windows NTFS Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50412	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50422	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50672	Windows NTFS Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-56175	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56182	Windows NTFS Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50341	Windows NTFS Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-58640	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-49184	Windows NTFS Remote Code Execution Vulnerability	Important	8.4	No	No	RCE
CVE-2026-49797	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50308	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50386	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50309	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50313	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50388	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50448	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50471	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50461	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50417	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50482	Windows NTFS Remote Code Execution Vulnerability	Important	7.3	No	No	RCE
CVE-2026-50494	Windows NTFS Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50344	Windows OLE Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50686	Windows OLE Remote Code Execution Vulnerability	Important	8.1	No	No	RCE
CVE-2026-50335	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50317	Windows Operating Systems Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54987	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50435	Windows Overlay Filter Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50409	Windows Overlay Filter Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-40400	Windows PowerShell Remote Code Execution Vulnerability	Important	8	No	No	RCE
CVE-2026-49166	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55004	Windows Print Configuration Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50499	Windows Print Spooler Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50383	Windows Print Spooler Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-57085	Windows Print Spooler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50469	Windows Projected File System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50434	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50339	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50430	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50334	Windows Push Notification Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-44800	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50363	Windows Push Notifications Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50431	Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50372	Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50666	Windows Remote Access Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56647	Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50330	Windows Remote Desktop Client Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-50376	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50504	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58533	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58535	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58546	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-58539	Windows Remote Desktop Client Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-55003	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57979	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50445	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50497	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-54126	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-57982	Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability	Important	6.5	No	No	Info
CVE-2026-50369	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-58626	Windows Remote Desktop Services Remote Code Execution Vulnerability	Important	8.8	No	No	RCE
CVE-2026-55014	Windows Remote Help Defense Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50318	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50407	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50357	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50441	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50668	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Important	6.8	No	No	EoP
CVE-2026-54109	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49792	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49793	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50362	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50492	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-50501	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-58530	Windows Resilient File System (ReFS) Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-49791	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-50451	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.1	No	No	EoP
CVE-2026-57096	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50323	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50452	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50348	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50345	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50322	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50340	Windows Runtime Elevation of Privilege Vulnerability	Important	8.5	No	No	EoP
CVE-2026-50410	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50449	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50460	Windows Runtime Elevation of Privilege Vulnerability	Important	8.1	No	No	EoP
CVE-2026-50403	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50385	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50413	Windows Runtime Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50457	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50486	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50503	Windows Runtime Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54125	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58527	Windows Runtime Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50373	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50679	Windows Search Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-44806	Windows Secure Channel Denial of Service Vulnerability	Important	5.3	No	No	DoS
CVE-2026-50681	Windows Secure Channel Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56186	Windows Secure Channel Information Disclosure Vulnerability	Important	8.1	No	No	Info
CVE-2026-50367	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58619	Windows Sensor Data Service Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50311	Windows Server Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50328	Windows Server Update Service (WSUS) Tampering Vulnerability	Important	7.5	No	No	Tampering
CVE-2026-58531	Windows SMB Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-54997	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-49801	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50690	Windows SMB Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-56168	Windows SMB Server Denial of Service Vulnerability	Important	6.5	No	No	DoS
CVE-2026-50360	Windows SMB Server Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-57089	Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability	Important	7.5	No	No	RCE
CVE-2026-50333	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50298	Windows Spaceport.sys Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49171	Windows Speech Runtime Elevation of Privilege Vulnerability	Important	7.5	No	No	EoP
CVE-2026-49170	Windows StateRepository API Server file Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58526	Windows Storage Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50299	Windows Storage Spaces Direct Remote Code Execution Vulnerability	Important	6.8	No	No	RCE
CVE-2026-57968	Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-57973	Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability	Important	6.3	No	No	Tampering
CVE-2026-50418	Windows System Secure Feature Bypass Vulnerability	Important	5.1	No	No	SFB
CVE-2026-50306	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50307	Windows TCP/IP Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49177	Windows TCP/IP Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50669	Windows Telephony Server Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-54124	Windows Terminal Remote Code Execution Vulnerability	Important	7.8	No	No	RCE
CVE-2026-50350	Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability	Important	5.5	No	No	Info
CVE-2026-50326	Windows Unified Consent System Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49790	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.3	No	No	EoP
CVE-2026-50498	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58547	Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability	Important	5.5	No	No	EoP
CVE-2026-49794	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	4.6	No	No	Info
CVE-2026-50453	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.1	No	No	Info
CVE-2026-58528	Windows USB Audio Class Driver Information Disclosure Vulnerability	Important	6.8	No	No	Info
CVE-2026-50321	Windows USB Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50479	Windows USB Hub Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55000	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	6.4	No	No	EoP
CVE-2026-54991	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54996	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49802	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49806	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-50674	Windows USB Print Driver Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-49804	Windows USB Video Driver Elevation of Privilege Vulnerability	Important	6.6	No	No	EoP
CVE-2026-50454	Windows User Interface Core Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49176	Windows WalletService Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-49800	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50480	Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-56173	Windows WebView Elevation of Privilege Vulnerability	Important	7	No	No	EoP
CVE-2026-58632	Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54107	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-54986	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54112	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-54114	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50670	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-50688	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50687	Windows Win32k Elevation of Privilege Vulnerability	Important	8.8	No	No	EoP
CVE-2026-56176	Windows Win32k Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-58628	Windows Wireless Network Manager Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-50295	Windows Zero Trust DNS Security Feature Bypass Vulnerability	Important	5.5	No	No	SFB
CVE-2026-50509	Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability	Important	7.8	No	No	EoP
CVE-2026-55945	Microsoft Edge (Chromium-based) Information Disclosure Vulnerability	Moderate	4.2	No	No	Info
CVE-2026-45488	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	5.4	No	No	Spoofing
CVE-2026-45489	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Moderate	6.5	No	No	Spoofing
CVE-2026-55145	Outlook Copilot Tampering Vulnerability	Moderate	6.3	No	No	Tampering
CVE-2026-56181	Windows Network Address Translation (NAT) Spoofing Vulnerability	Moderate	8.3	No	No	Spoofing
CVE-2026-58597	Microsoft Edge (Chromium-based) Spoofing Vulnerability	Low	4.3	No	No	Spoofing

** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user.

I’ll do my best to summarize everything else in this release, but no promises. I’m only human after all.

And because this release wouldn't be complete without it: CVE-2026-50663, an RCE in Age of Empires II: Definitive Edition. Yes, really. Patch your civilization anyway.

No new advisories are being released this month.

Looking Ahead

I’m de-influencing you from buying the RingConn 3 (even though it’s pretty)

Tue, 14 Jul 2026 16:49:35 +0200

The RingConn 3 actually looks like real jewelry, not a wearable -- but its fitness tracking and headache detection features are disappointing.

Former Rockstar producer jokes he's 'pretty happy' he's not working on GTA 6 because of how 'monstrous' it seems — 'Every single time they do a GTA, it's like ludicrously bigger than before'

Tue, 14 Jul 2026 14:19:17 +0200

Former Rockstar Games producer John Ricchio believes Grand Theft Auto 6 will be a massive game and is glad he isn't working on such an ambitious project.

Deluxe Corporation beats the odds with mainframe migration using AI

Tue, 14 Jul 2026 11:32:57 +0200

Deluxe may have prevailed against the odds when it successfully migrated from a 50-plus-year-old mainframe recently.

The company was able to move from it to a cloud environment in about 12 months without a major hitch, and while AI did some of the heavy lifting. The save will amount to about $4.9 million a year by retiring old hardware and software, cutting labor costs, and consolidating IT resources.

Deluxe, based in Minneapolis and traditionally known as a check printer, has transformed itself into a payments IT provider in recent years. But it desperately needed to end its reliance on its ancient mainframe, says Yogaraj Jayaprakasam, the company’s chief technology and digital officer, pictured.

So AI played a huge role in the IT modernization project, he says, using it to rewrite the old mainframe code, generate documentation, and regenerate code test cases. The company also used an AI-powered test automation suite, as well as AI tools to help move assets to the new cloud environment.

While AI can’t do everything during mainframe migration, it can make the move easier, Jayaprakasam says. “The biggest lessons learned is AI is one of the missing tools in your transformation tool set,” he adds.

Failing projects

Deluxe’s mainframe migration earned it a 2026 CIO 100 Award for IT innovation and leadership, but it also seems to have bucked a recent trend. Many mainframe migration projects haven’t gone as planned, and Gartner recently predicted that more than 70% of mainframe exit projects that started in 2026 will fail to produce intended benefits because of an overreliance on gen AI.

Mainframe transformation projects tend to work better when they’re part of a larger business transformation rather than a one-off project using gen AI to do most of the work, says Gartner analyst Alessandro Galimberti.

“Generative AI and agentic AI are extremely powerful, but they also have their own limits,” he says. “With all these kinds of tools trying to convert code or somehow fit into a non-mainframe workload, we don’t really see a track record of success.”

Gartner also sees a declining interest in mainframe migration projects, Galimberti says. With mainframes getting support from several IT vendors, and with a general lack of migration success, many companies are choosing to keep many workloads on their existing big iron.

But mainframes also have a proven track record of very high uptime and backward capability, Galimberti says.

“If I’m a bank, a financial institution, or a transportation company, I need to run applications that are the core of my business,” he adds. “I need reliability, transactional integrity, and security, and these applications have a low change rate over the years because they map very stable business processes.”

The Gartner prediction makes sense to John McKenny, senior VP and GM of Intelligent Z optimization and transformation for mainframe support vendor BMC Software.

“With organizations thinking about mainframe exits, the expected benefits they’re looking for are usually pretty straightforward,” he says. “They think, ‘It’s going to be lower cost, I’m going to get equal or better capabilities, I should be more agile.’ The reality is those outcomes rarely show up at scale.”

Mainframe migration is possible, but the successful projects tend to be small scale, McKenny adds. He was on a recent call about a failed migration project in Europe, with a large bank cancelling the project at the end of 2025 and recommitting to the mainframe as a strategic platform.

“I’ve never seen a large-scale mainframe migration project finish under budget, ever,” he says. “Most of the projects I hear about fail outright.”

Trying again

Like some organizations that Gartner has observed, Deluxe tried to move away from its mainframe several years ago, but the project failed, Jayaprakasam says. Yet the company took the steps it needed this time to ensure the new migration succeeded.

While a mainframe migration isn’t for every organization, the latest move made sense for Deluxe, he says.

The mainframe, after all, was the backbone for a large portion of the company’s annual revenue, and interfaces with several top banks across North America. The modernization effort rebuilt core business processes and data, moving them from the mainframe to a modern cloud-native technology stack, including Salesforce, Mulesoft, and SAP S4/HANA.

While AI played a big part, there’s danger in overestimating the power of AI during a migration project, Jayaprakasam says, and organizations need to follow best practices for IT migration.

“If you minimize the importance of communication, risk planning, and business alignment because you have AI, you tend to fail,” he says. “But as long as you play all those cards and recognize AI was the missing piece to the puzzle, then you have a much better chance of winning.”

Deluxe also used a cross-functional tiger team to look at the various options available to accelerate reverse engineering, including AI tools from OpenAI, Anthropic, as well as GitHub Copilot throughout the project.

In addition, AI was useful to dig through the mainframe code and understand what needed to be updated, Jayaprakasam says. Organizations sitting on decades-old code often no longer have people who understand it.

“I always tell people that the code remembers what the organization forgot, because with people going and changing, people don’t remember what we wrote in the code, but the code remembers,” he adds. “The amazing tool that was missing before is we didn’t have an interpreter who understood what the code remembered. Now with AI, you have the interpreter.”

Have i just identified a security vulnerability at most supermarkets?

Tue, 14 Jul 2026 04:23:16 +0200

I was just at the supermarket, and I was using one of those self-service kiosks that has an "honesty camera" watching what you scan from above. The camera view is then displayed on a screen right in front of me.

As I went to pay for my shopping with my phone, I looked at the live feed on the monitor and realized I was actually seeing myself unlock my phone with my pattern lock! On top of that, anyone standing around could theoretically spy on what you're unlocking too.

Obviously fingerprint unlocks get around this "security hole", but it was the first time I had noticed it being a real issue.

Most supermarkets have these types of self-service checkouts now — I wonder how this info is stored and processed? Security seems pretty questionable…

submitted by /u/BeardyButler
[link] [comments]

Can AI narrow cybersecurity’s class divide?

Mon, 13 Jul 2026 09:07:52 +0200

At Amazon Web Services (AWS), artificial intelligence is already compressing security work that once took months into minutes.

In the old world, human red teams would find vulnerabilities, write reports, refine those reports, and eventually hand them to defenders, who would then begin building detections or fixes, Steve Schmidt, chief security officer at AWS, tells CSO. That process could take “two, four, six, eight, 10 months,” Schmidt says.

“Now with proper application of AI, we can have the detections built for the problems the red team finds in 15 minutes-ish,” he says. “I think the outside is about four hours.”

That kind of workflow offers a glimpse of what AI could make possible for the most sophisticated security organizations: AI agents testing systems, other agents generating defenses, and human security engineers validating results and refining the feedback loop.

But it also raises a more uncomfortable question for the rest of the cybersecurity industry: What happens to organizations that cannot build anything close to that?

The concern has become significant enough that the Trump administration recently directed agencies to expand access to AI-enabled cybersecurity capabilities for resource-constrained organizations, including rural hospitals, community banks, and local utilities.

The order reflects a growing fear that AI could deepen a divide that has existed in cybersecurity for years: the divide between organizations with money, expertise, and engineering depth, and those struggling to keep pace with basic security demands.

Yet security leaders and practitioners suggest the impact of AI will be more complicated than a simple widening gap. Some experts say AI is merely adding a new layer to a long-standing security poverty problem. Others argue AI could democratize capabilities once reserved for elite organizations. Still others see today’s divide as real, but potentially temporary, as models become cheaper, more open, and easier to run.

The class divide was already here

For Matt Warner, co-founder and CTO of Blumira, the premise that AI is creating a cybersecurity class divide misses a key point: The divide already exists.

“I would go even a step further and say that there has been a class divide for the last 10 to 15 years,” Warner tells CSO.

What AI changes, he argues, is not necessarily the existence of the divide but how stark it becomes. Larger organizations have money, people, and time to experiment with AI. Smaller organizations often do not.

“The big differences that we’re seeing, especially from where we sit in the world, is the difference is getting starker in having the resources to leverage AI and the time to leverage AI more than anything else,” Warner says.

That distinction matters because many smaller organizations are already overwhelmed. Warner pointed to resource-constrained local governments and small or midmarket organizations that are still far behind large enterprises in basic IT and security maturity.

“I can find you a county in Michigan with two IT people for 2,000 employees,” Warner says. “Those people don’t have time to leverage AI and even learn how to use AI because they’re mostly just trying to put out fires.”

That problem is not unique to AI. Smaller organizations have long struggled to patch systems, prioritize vulnerabilities, monitor environments, and respond to incidents with limited staff. AI may help eventually, but only if those organizations have enough capacity to adopt it.

Wendy Nather’s framework gets an AI layer

Anton Chuvakin, security advisor in the office of the CISO for Google Cloud, sees the AI divide as part of a much older problem.

“I feel like it sends me back to when Wendy Nather invented the security poverty line,” Chuvakin tells CSO, referring to Nather’s 2011 concept describing organizations that lack the money, expertise, capability, or influence to implement effective security.

Chuvakin is skeptical that AI fundamentally changes that model. “I don’t think AI necessarily breaks that model,” he says. “I think it just adds another dimension.”

Cybersecurity has always been shaped by unequal access to top talent, tools, and services, Chuvakin argues. Large organizations could afford better SIEM deployments, advanced DLP programs, threat hunters, application security experts, and incident response retainers. Smaller organizations often could not.

AI may become another scarce resource, but Chuvakin cautions against overstating the role of model cost alone. In his view, the bigger structural issue may be talent rather than tokens.

“Prices for people won’t drop, but prices for LLMs may drop,” he believes.

That means the organizations with the greatest advantage may not simply be those that can afford the most expensive models. They may be the ones that can afford the people who know how to use them — and, as the frontier-access debate below suggests, that talent gap may prove more durable than any gap in model access itself.

AI creates new costs — and new uncertainties

Nather herself, now senior research initiatives director at 1Password, sees AI affecting every dimension of the security poverty line: money, expertise, capability, and influence.

The financial challenges are not limited to whether an organization can pay for an AI tool. In some cases, organizations that cannot afford enterprise licensing may end up making tradeoffs around privacy.

“If an organization can’t afford an enterprise license for the models they’re using, then they can’t keep their data private,” Nather tells CSO. “So, they have to give up privacy because they can’t afford privacy.”

That’s a new twist on an old dimension of the poverty line: It’s not just that under-resourced organizations lack a capability, but that the capability they can afford comes bundled with a risk wealthier organizations don’t have to accept.

Token-based pricing adds another problem: unpredictability. “At this point, nobody knows how much they’re going to burn in tokens at any given time,” she says.

That makes budgeting difficult for organizations that cannot absorb surprise costs. Nather also warns that usage-based pricing is controlled by providers and can change over time, leaving customers with limited leverage.

“The charging practice is in the hands of the providers, and they can change it at any time,” she says.

For organizations already operating below the security poverty line, that uncertainty could make AI adoption harder, even if the technology itself becomes more capable.

Access to frontier models may be a temporary divide

Dave Baggett, SVP/GM of the security suite at Kaseya, agrees there is security class divide dynamic playing out today, particularly around access to frontier models.

“There’s definitely a haves and have-nots issue around Mythos specifically because most people don’t have it,” Baggett tells CSO. But he doesn’t think the divide will have a long-term impact. Open-weight models, quantization, mixture-of-experts architectures, and increasingly powerful commodity hardware, he argues, are closing the gap faster than most people expect.

While not every organization will build a frontier model, he says, more organizations may be able to run capable models locally or use cheaper systems that approximate what today’s elite models can do.

“What it says for finding vulnerabilities is at that point, open-source people can run this stuff,” Baggett says. “Then you’re back to having a symmetrical opportunity where the defenders who are writing the open source can run the same tools the attackers would and have them fix the issues.”

His bottom line is that the divide may be real but short-lived. “Right now, there certainly is a have, have-not schism, but it may not be there for long,” Baggett says — a view Chuvakin shares, though he frames it in terms of the model market rather than open source specifically.

“I don’t think it’s the lowering prices example, but it’s more like you’re a top-tier model maker, I’m a second-tier model maker. My model in a year would do what your model did a year ago,” Chuvakin says.

The real advantage is operational depth

Schmidt’s description of AI use at AWS points to another kind of divide: not access to AI, but the ability to operationalize it.

AWS uses multiple models for different tasks, Schmidt says. One model may discover vulnerabilities, while other models validate results or help build defenses. Humans remain accountable for evaluating what the systems produce.

“Because we believe really strongly in human accountability for the use of AI from end to end, we still have humans take a look at what the systems come up with to determine whether they are reasonable and appropriate,” he says.

That workflow requires more than a model. It requires corporate data, secure infrastructure, feedback loops, security engineers, data scientists, and AI specialists who can work together.

Schmidt also pushes back on the idea that running AI locally on powerful consumer hardware is a substitute for production-grade security infrastructure. “Often the value of the model is also dependent on its proximity to data so that the model can ingest, use, and reason about data,” he says. “As a security person, I do not want that to be on your laptop.”

Experimentation on a laptop is useful, Schmidt says, but it is not the same as a secure production environment.

“I want the data to be somewhere safe that I can control, that I can see, that I can reason about, not sitting on your laptop,” he says. “Experimentation in there, awesome. That’s great. But it is not a production infrastructure component.”

That distinction may define the emerging AI security gap. Many organizations may be able to access AI tools. Far fewer may be able to safely integrate them into real security workflows.

The democratization argument

Phil Venables, a partner at Ballistic Ventures and former CISO of Google Cloud, takes the most optimistic view.

Asked whether AI is widening the gap between well-resourced and under-resourced security organizations, Venables tells CSO, “No, I actually think it’s the exact opposite.”

The reason, he argues, is that AI packages expertise and automation in ways that can be delivered broadly. “One of the fantastic things about AI, and we’re already starting to see this, is [that it’s] a great democratizer of capabilities,” he says. “AI packages up expertise and automation capabilities at a level beyond what prior waves of technology have done, and it makes it available at scale into organizations that have not previously been able to afford these things.”

He points to red teaming as an example. Nearly every organization would like a world-class red team, but few can afford one.

“Pretty much every organization on the planet would love to have a world-class red team to constantly test their security to find and fix things before attackers do,” Venables says. “But very few organizations have ever been able to afford to build a high-end red team.”

AI agents, he argues, could make that kind of capability available more economically. The same pattern could apply to insider threat; third-party risk; software security; governance, risk and compliance; and security operations.

“So even the smallest and resource-constrained organizations can now have access to a higher-end capability,” he maintains.

Venables does see a danger zone, however: under-resourced security teams inside organizations with aggressive AI ambitions. Those teams may struggle to keep up as the rest of the business adopts AI rapidly. But for many small and midsize organizations, he believes AI could improve access to security capabilities they never had before.

A divide over AI — or over readiness?

For elite organizations, AI is already becoming a force multiplier. Security teams with deep engineering talent, mature data infrastructure, and strong governance can use AI to accelerate testing, detection engineering, vulnerability discovery, and risk management.

For smaller organizations, the picture is less clear. AI may eventually package scarce expertise into affordable services. Open models may reduce dependence on expensive frontier systems. But organizations below the security poverty line still face familiar constraints: too few people, too little time, limited expertise, unpredictable costs, and weak leverage over vendors.

The emerging divide may therefore be less about who has access to AI and more about who can turn AI into durable security outcomes.

That makes the question facing cybersecurity more complicated than whether AI will create haves and have-nots. The industry already had them.

The real question is whether AI becomes another technology that rewards the organizations already best positioned to use it — or the first major security advance in years that helps those below the poverty line finally catch up.

I drew a personified void linux, because I was bored.

Mon, 13 Jul 2026 04:53:39 +0200

(apologies if that was the incorrect flair, I didn't know where else to post this because the void linux sub seems to be for questions and tips involving void lmao)

This was really fun to make tbh, 10/10 would recommend drawing personified linux distributions. The only real thing I was going for while designing them was just trying to keep the outfit fairly minimal and sleek, because void is a pretty minimal and sleek distribution. I also, for some reason, made him look... Really polite? Idk how to describe it, I'm sure ykwim.

The design obviously not perfect, but I like it. I might go back and change some things (like idk, I might turn the void logo into a halo kinda thing and give him wings or something along those lines? Might be cool), but that's a thing for future me to do.

submitted by /u/BurntCheeseSauce
[link] [comments]

OpenAI CEO Altman is now "pretty sure" AI is net job-creating, which is quite the pivot from predicting mass layoffs

Sun, 12 Jul 2026 11:33:16 +0200

OpenAI CEO Sam Altman now says he's "pretty sure" AI has created more jobs than it's eliminated. That's a sharp turn from his earlier warnings about entire professions disappearing. Anthropic CEO Dario Amodei is walking back similar claims, too. But studies so far back neither the old doomsday predictions nor optimism.

The article OpenAI CEO Altman is now "pretty sure" AI is net job-creating, which is quite the pivot from predicting mass layoffs appeared first on The Decoder.

Buildpacks vs Jib vs Dockerfile: Comparing containerization methods

Sun, 12 Jul 2026 08:06:57 +0200

As developers we work on source code, but production systems don't run source, they need a runnable thing. Starting many years ago, most enterprises were using Java EE (aka J2EE) and the runnable "thing" we would deploy to production was a ".jar", ".war", or ".ear" file. Those files consisted of the compiled Java classes and would run inside of a "container" running on the JVM. As long as your class files were compatible with the JVM and container, the app would just work.

That all worked great until people started building non-JVM stuff: Ruby, Python, NodeJS, Go, etc. Now we needed another way to package up apps so they could be run on production systems. To do this we needed some kind of virtualization layer that would allow anything to be run. Heroku was one of the first to tackle this and they used a Linux virtualization system called "lxc" - short for Linux Containers. Running a "container" on lxc was half of the puzzle because still a "container" needed to be created from source code, so Heroku invented what they called "Buildpacks" to create a standard way to convert source into a container.

A bit later a Heroku competitor named dotCloud was trying to tackle similar problems and went a different route which ultimately led to Docker, a standard way to create and run containers across platforms including Windows, Mac, Linux, Kubernetes, and Google Cloud Run. Ultimately the container specification behind Docker became a standard under the Open Container Initiative (OCI) and the virtualization layer switched from lxc to runc (also an OCI project).

The traditional way to build a Docker container is built into the docker tool and uses a sequence of special instructions usually in a file named Dockerfile to compile the source code and assemble the "layers" of a container image.

Yeah, this is confusing because we have all sorts of different "containers" and ways to run stuff in those containers. And there are also many ways to create the things that run in containers. The bit of history is important because it helps us categorize all of this into three parts:

Container Builders - Turn source code into a Container Image
Container Images - Archive files containing a "runnable" application
Containers - Run Container Images

With Java EE those three categories map to technologies like:

Container Builders == Ant or Maven
Container Images == .jar, .war, or .ear
Containers == JBoss, WebSphere, WebLogic

With Docker / OCI those three categories map to technologies like:

Container Builders == Dockerfile, Buildpacks, or Jib
Container Images == .tar files usually not dealt with directly but through a "container registry"
Containers == Docker, Kubernetes, Cloud Run

Java Sample Application

Let's explore the Container Builder options further on a little Java server application. If you want to follow along, clone my comparing-docker-methods project:

git clone https://github.com/jamesward/comparing-docker-methods.git

cd comparing-docker-methods

In that project you'll see a basic Java web server in src/main/java/com/google/WebApp.java that just responds with "hello, world" on a GET request to /. Here is the source:

code_block: {\r\n byte[] response = "hello, world".getBytes();\r\n handler.sendResponseHeaders(200, response.length);\r\n try (OutputStream os = handler.getResponseBody()) {\r\n os.write(response);\r\n }\r\n });\r\n\r\n System.out.println("Listening at http://localhost:" + port);\r\n\r\n server.start();\r\n }\r\n}'), ('language', ''), ('caption', )])]>

This project uses Maven with a minimal pom.xml build config file for compiling and running the Java server:

code_block: \r\n\r\n 4.0.0\r\n\r\n com.google\r\n sample-java-mvn\r\n jar\r\n 0.1.0-SNAPSHOT\r\n\r\n \r\n 8\r\n 8\r\n \r\n\r\n \r\n \r\n \r\n org.codehaus.mojo\r\n exec-maven-plugin\r\n 1.6.0\r\n \r\n \r\n \r\n java\r\n \r\n \r\n \r\n \r\n com.google.WebApp\r\n \r\n \r\n\r\n \r\n org.apache.maven.plugins\r\n maven-jar-plugin\r\n 3.2.0\r\n \r\n \r\n \r\n com.google.WebApp\r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n'), ('language', ''), ('caption', )])]>

If you want to run this locally make sure you have Java 8 installed and from the project root directory, run:

./mvnw compile exec:java

You can test the server by visiting: http://localhost:8080

Container Builder: Buildpacks

We have an application that we can run locally so let's get back to those Container Builders. Earlier you learned that Heroku invented Buildpacks to create standard, polyglot ways to go from source to a Container Image. When Docker / OCI Containers started gaining popularity Heroku and Pivotal worked together to make their Buildpacks work with Docker / OCI Containers. That work is now a sandbox Cloud Native Computing Foundation project: https://buildpacks.io/

To use Buildpacks you will need to install Docker and the pack tool. Now from the command line tell Buildpacks to take your source and turn it into a Container Image:

pack build --builder=gcr.io/buildpacks/builder:v1 comparing-docker-methods:buildpacks

Magic! You didn't have to do anything and the Buildpacks knew how to turn that Java application into a Container Image. It even works on Go, NodeJS, Python, and .Net apps out-of-the-box. So what just happened? Buildpacks inspect your source and try to identify it as something it knows how to build. In the case of our sample application it noticed the pom.xml file and decided it knows how to build Maven-based applications. The --builder flag told it where to get the Buildpacks from. In this case, gcr.io/buildpacks/builder:v1 are the Container Image coordinates to Google Cloud's Buildpacks. Alternatively you could use the Heroku or Paketo Buildpacks. The parameter comparing-docker-methods:buildpacks is the Container Image coordinates for where to store the output. In this case it stores on the local docker daemon. You can now run that Container Image locally with docker:

docker run -it -ePORT=8080 -p8080:8080 comparing-docker-methods:buildpacks

Of course you can also run that Container Image anywhere that runs Docker / OCI Containers like Kubernetes and Cloud Run.

Buildpacks are nice because in many cases they just work and you don't have to do anything special to turn your source into something runnable. But the resulting Container Images created from Buildpacks can be a bit bulky. Let's use a tool called dive to examine what is in the created container image:

dive comparing-docker-methods:buildpacks

Here you can see the Container Image has 11 layers and a total image size of 319MB. With dive you can explore each layer and see what was changed. In this Container Image the first 6 layers are the base operating system. Layer 7 is the JVM and layer 8 is our compiled application. Layering enables great caching so if only layer 8 changes, then layers 1 through 7 do not need to be re-downloaded. One downside of Buildpacks is how (at least for now) all of the dependencies and compiled application code are stored in a single layer. It would be better to have separate layers for the dependencies and the compiled application.

To recap, Buildpacks are the easy option that "just works" right out-of-the-box. But the Container Images are a bit large and not optimally layered.

Container Builder: Jib

The open source Jib project is a Java library for creating Container Images with Maven and Gradle plugins. To use it on a Maven project (like the one we from above), just add a build plugin to the pom.xml file:

code_block: \r\n com.google.cloud.tools\r\n jib-maven-plugin\r\n 2.6.0\r\n'), ('language', ''), ('caption', )])]>

Now a Container Image can be created and stored in the local docker daemon by running:

./mvnw compile jib:dockerBuild -Dimage=comparing-docker-methods:jib

Using dive we will see that the Container Image for this application is now only 127MB thanks to slimmer operating system and JVM layers. Also, on a Spring Boot application we can see how Jib layers the dependencies, resources, and compiled application for better caching:

In this example the 18MB layer contains the runtime dependencies and the final layer contains the compiled application. Unlike with Buildpacks the original source code is not included in the Container Image. Jib also has a great feature where you can use it without docker being installed, as long as you store the Container Image on an external Container Registry (like DockerHub or the Google Cloud Container Registry). Jib is a great option with Maven and Gradle builds for Container Images that use the JVM.

Container Builder: Dockerfile

The traditional way to create Container Images is built into the docker tool and uses a sequence of instructions defined in a file usually named Dockerfile. Here is a Dockerfile you can use with the sample Java application:

code_block: )])]>

In this example, the first four instructions start with the AdoptOpenJDK 8 Container Image and build the source to a Jar file. The final Container Image is created from the AdoptOpenJDK 8 JRE Container Image and includes the created Jar file. You can run docker to create the Container Image using the Dockerfile instructions:

docker build -t comparing-docker-methods:dockerfile

Using dive we can see a pretty slim Container Image at 209MB:

With a Dockerfile we have full control over the layering and base images. For example, we could use the Distroless Java base image to trim down the Container Image even further. This method of creating Container Images provides a lot of flexibility but we do have to write and maintain the instructions.

With this flexibility we can do some cool stuff. For example, we can use GraalVM to create a "native image" of our application. This is an ahead-of-time compiled binary which can reduce startup time, reduce memory usage, and alleviate the need for a JVM in the Container Image. And we can go even further and create a statically linked native image which includes everything needed to run so that even an operating system is not needed in the Container Image. Here is the Dockerfile to do that:

code_block: )])]>

You will see there is a bit of setup needed to support static native images. After that setup the Jar is compiled like before with Maven. Then the native-image tool creates the binary from the Jar. The FROM scratch instruction means the final container image will start with an empty one. The statically linked binary created by native-image is then copied into the empty container.

Like before you can use docker to build the Container Image:

docker build -t comparing-docker-methods:graalvm .

Using dive we can see the final Container Image is only 11MB!

And it starts up super fast because we don't need the JVM, OS, etc. Of course GraalVM is not always a great option as there are some challenges like dealing with reflection and debugging. You can read more about this in my blog, GraalVM Native Image Tips & Tricks.

This example does capture the flexibility of the Dockerfile method and the ability to do anything you need. It is a great escape hatch when you need one.

Which Method Should You Choose?

The easiest, polyglot method: Buildpacks
Great layering for JVM apps: Jib
The escape hatch for when those methods don't fit: Dockerfile

Check out my comparing-docker-methods project to explore these methods as well as the mentioned Spring Boot + Jib example.

How Flock Cameras Wrongly Tracked a Journalist for Days, Then Sent Police to Arrest Him

Sat, 11 Jul 2026 16:52:48 +0200

"Are you armed?!" the police officer screamed. "Get out of the car!" A writer for the car-news site The Drive describes how "a technological chain linking surveillance cameras, AI, and law enforcement... led to me and my wife being surrounded by police, hands on their guns, in a Kohl's parking lot in suburban Minnesota." After dropping off our Amazon returns, we'd just gotten back in the Range Rover and reversed maybe two feet out of the spot when four cop cars came flying out of nowhere and boxed us in... The Plymouth Police Department had been tracking me for days using Flock license plate cameras, waiting for the right moment to strike, because they thought I'd stolen the Range Rover. And the reason I was ID'd as a dangerous car thief was a simple data error made 2,000 miles away in California, creating an edge case within an edge case that Flock's AI camera network was unable to handle... "The plates on this car are stolen," Officer Ganshyn said... This made absolutely no sense. Car companies keep meticulous track of the fleets they loan out to the media. The vehicles all have special manufacturer or dealer plates that are logged every time one enters or exits... The New Jersey plates that were allegedly stolen from the LA dealer were 34 03 DTM, not 34 10 DTM. But when the police report was created and the plate was entered into Flock's system, it was just recorded as 34 DTM. Just the five large characters, no little number in the middle... Flock's AI tech wasn't registering that non-standard little number when it began picking up the Range Rover around town... I connected the final dot. A lot of vehicles in [Range Rover manufacturer] JLR's media fleet have a New Jersey manufacturer plate with the same alphanumeric structure — 34 ## DTM — and Officer Ganshyn observed that meant it was now a nationwide issue. Anywhere a police department has a partnership with Flock, any other JLR-owned car with the same plate structure is going to get flagged as stolen. In fact, four other 34 ## DTM cars were being tracked around Minnesota that week, according to Officer Ganshyn. I was just the first one to get nabbed. The only way to stop it would be for the LAPD to correct their initial report and update Flock's system, which Jaguar Land Rover was now racing to make happen following the phone call. Still, he warned me to drive straight home, park the Range Rover, and leave it there. If I were to cross into the neighboring town, I'd probably get flagged again and go through this entire ordeal again with a different set of officers. His parting words were ominous: "You're lucky we're in Plymouth. If you were in Minneapolis, they definitely would've come at you with guns drawn." Ironically, even the original license plate wasn't stolen either, the article points out. It was reported misplaced during a Los Angeles photo shoot, and "The corporation had to report the plate as lost to law enforcement," according to the police report — and even then, the plate "was reported as NJ 34DTM instead of NJ 3403DTM." The author's conclusion? "Once these systems have you in their crosshairs, there's pretty much only one way it can go... A simple data-entry error, magnified and broadcast nationwide by a growing surveillance network operated through an opaque partnership between a private company and public agencies, led police to identify me as a car thief and set up a sting to take me down. I mean, they even had a drone flying overhead during the 'bust'... "Thank God our kids weren't with us." Thanks to long-time Slashdot reader sinij for sharing the article.

Read more of this story at Slashdot.

Chrome Dev for Desktop Update

Fri, 10 Jul 2026 20:35:50 +0200

The Dev channel has been updated to 152.0.7939.3 for Windows, Mac and Linux.

Chrome Release Team
Google Chrome

I tested PSB's new stereo speaker system and the punchy sound and compact styling are a delight, but don't bother if you listen to a lot of vinyl

Fri, 10 Jul 2026 20:03:25 +0200

The PSB iQ2 may be the largest model in the brand's stereo speaker range, but it's still pretty small — can it justify its big price-tag?

Chrome Dev for Android Update

Fri, 10 Jul 2026 15:38:17 +0200

Hi everyone! We've just released Chrome Dev 152 (152.0.7940.2) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Schrödinger's Call Review (PC)

Fri, 10 Jul 2026 10:07:11 +0200

I’m pretty sure the cat is the key to the entire mystery. It first named itself Hamlet, then added the most important line that the character speaks to the name. It knows how the psychic telephone works and says that cats can actually use it but isn’t interested in actually making or taking any calls. And the sneaky animal talks a lot about memories but isn’t interested in telling the protagonist anything about her past. Playing the role of a telepathic soul guide for people who are stuck in limbo requires both attention and plenty of patience. The telephone at the end of the world still uses a disk. The people my character is talking to are also struggling to remember their past, caught in the psychic blast wave of the catastrophe. As I learn more about each of them, I can create the conversations that they want to have, even if that requires lying. Let’s hope that doesn’t come back to haunt me. Schrödinger's Call is developed by Acrobatic Chirimenjako and publish...

Chrome Beta for Desktop Update

Thu, 09 Jul 2026 19:53:47 +0200

The Beta channel has been updated to 151.0.7922.19 for Windows, Mac and Linux.

Chrome Release Team
Google Chrome

Chrome Beta for iOS Update

Thu, 09 Jul 2026 17:22:29 +0200

Hi everyone! We've just released Chrome Beta 151 (151.0.7922.17) for iOS; it'll become available on App Store in the next few days.

You can see a partial list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Chrome Beta for Android Update

Thu, 09 Jul 2026 17:22:28 +0200

Hi everyone! We've just released Chrome Beta 151 (151.0.7922.18) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

D.O.T. Defence Review (PC)

Thu, 09 Jul 2026 17:08:01 +0200

As someone who enjoys playing tower defense games, I was excited to see a title like D.O.T. Defence coming in. And it’s mostly thanks to the unique RTS approach that it provides. Right off the bat, the game appears to be more of a pixelated Command and Conquer, with a very simple UI. But there are some great tower defense elements, along with a great range of other things. And it all adds a great sense of excitement as well as creative ideas. D.O.T. Defence starts with a tutorial, which is pretty helpful, as it gives a lot of info when it comes to the mechanics and the way you can use them. That being said, the game has multiple island levels, and as you clear one of them, you start uncovering new levels all the time, making it way more responsive and interesting. You can’t preview levels until you unlock them, which makes sense, but I wish you were able to do so, as it makes it easier to prepare. What’s great is that the campaign maps are not very difficult, inste...

The Language of AI Could Change How Humans Speak

Thu, 09 Jul 2026 13:08:04 +0200

Last week, national security agencies from the Five Eyes—that’s the rich, English-language-speaking countries club—jointly released a statement warning of the increasing cyber risks of AI models: in particular, their ability to autonomously hack into systems and networks. The statement was more measured than some of the breathless headlines about it, and the advice they gave is pretty much the standard advice everyone gives—albeit with newfound urgency.

Internet risks are nothing new, and cyberattacks—both large and small—have been a significant issue since long before the current crop of generative AI models...

AI Enthusiasts Are in a Race Against Time, AI Skeptics Are in a Race Against Entropy

Thu, 09 Jul 2026 13:03:17 +0200

The following article originally appeared on Charity Majors’s Substack and is being republished here with the author’s permission. I recently attended a talk where one of the presenters made some pretty…astonishing claims about what they had achieved by the pure, uncut power of vibe coding. Difficult engineering problems solved, backlogs cleared. Rewrites that would have […]

Need help get out tutorial hell. Develop pwn CTF skills, build a foundation in Vuln Exploit, RE, etc

Thu, 09 Jul 2026 04:03:07 +0200

Hi guys, recently Im in a loop, hop on and off different site different courses in and out, back and forth while feeling making ZERO progress.

Here, I want to share a bit about my goal, my background, my problem. And I hope I could have some advices to get out of this feeling

MY GOAL:
- Long term: Get into cybersecurity field, especially roles that involve “low level” stuffs as I really interested in them. Thats it! For now, as Im pretty new to this + Im hyper focus on short term goal which I will talk right after
- Short term goal: Build foundation, knowledge, skills in Reverse Engineering (RE) and more excitingly Binary Exploitation, Pwn
- Shorter term goal: To prepare for upcoming CTF contests with my new team. More on this later

MY BACKGROUND:
- I already familiar with Linux, CLI, some popular commands
- I know x86 assembly
- know C, C++
- know on surface level some basic vulnerabilities and have done very simple CTF challenges (ret2win, shellcode easy, …)
- do know how to use basic gdb, pwntools, ida/ghidra

all of that is a result of following pwn.college + using Linux as daily basis + my college’s teaching on c, c++, etc

by all means, I do not master any of these above skills I told.

MY PROBLEMS:
So ofc Im very worrying the most about the upcoming CTF because Im new and feel like know nothing yet.
I also stucking into tutorial hell as I have too many resources of documentation/courses that I do not know which one is suit for my current situation

Im aware of the pinning post in this sub, that is actually where I get these resources from

But with 2 months left until the contest, I really want to make the most out of my time. So I need help with designing a road map so to speak.

Currently, Im looking into ironstone’s pwn notes + Nightmare CTF collection. Whatd you recommend?

submitted by /u/minhincs
[link] [comments]

Working as a new Patent Examiner. A lot of my fellow new examiners seem to have very outdated (20-25 years ago) views on Linux :0

Thu, 09 Jul 2026 03:54:32 +0200

Excerpts from the team chat:

Other: "is the OC still not working for everyone? i restarted and relaunched my OC"

Other: "yeah it lags for me too"

Me: "The USPTO should just switch everything to Linux at this point, way more efficient"

Other: "linux doesn't have as much software availability as windows"

Me: "What software would be missing? We only need basic software"

Other: "well we don't have office word on linux.

we also don't have teams on linux or edge"

Me: "Have you even heard of Linux before? There are Linux versions of some of these, and alternative for others"

Other: "linux is kind of annoying to configure, especially when you have to deal with dependencies yeah, I've used LInux before. I like it for writing code but when it comes to actually using software, it's not the best."

Other: "Blender doesn't always work on LInux, Ultimaker Cura doesn't always work on LInux, and whenever you update packages in Linux sometimes you have to fix dependency issues. For me at least it's ok for writing code but other than that, it's not that great

Zero production is being made because everyone would be in kernels all day instead of searching"

Me: "Some versions are easier to configure than Windows nowadays"

Other: "Also, I am pretty sure Linux can not be used for government work because of security permissions"

Me: "HA https://en.wikipedia.org/wiki/List_of_Linux_adopters#Government List of Linux adopters - Wikipedia"

Other: "Wikipedia is a biased source"

Other: "yeah linux is probably better or whatever but the PTO has already spent all this money developing tools for and training people to use windows. I think that's the big barrier why the promised linux-ization of Brazil and Europe and India never really happened"

submitted by /u/Alternative_Tank9353
[link] [comments]

Stable Channel Update for Desktop

Thu, 09 Jul 2026 02:37:59 +0200

The Stable channel has been updated to 150.0.7871.114/.115 for Windows and Mac and 150.0.7871.114 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

This update includes 27 security fixes. Please see the Chrome Security Page for more information.

[N/A][518006275] Critical CVE-2026-15112: Use after free in Ozone. Reported by Google on 2026-05-29

[N/A][524045160] Critical CVE-2026-15129: Use after free in Views. Reported by Google on 2026-06-15

[$500][527385397] High CVE-2026-15132: Uninitialized Use in V8. Reported by Pierre Langlois from Arm on 2026-06-24

[$500][527406824] High CVE-2026-15133: Use after free in InterestGroups. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-06-24

[N/A][515443146] High CVE-2026-15108: Integer overflow in Extensions API. Reported by Google on 2026-05-21

[N/A][516899138] High CVE-2026-15109: Uninitialized Use in ANGLE. Reported by Google on 2026-05-26

[N/A][516948486] High CVE-2026-15110: Use after free in Extensions. Reported by Google on 2026-05-27

[N/A][517508651] High CVE-2026-15111: Use after free in Views. Reported by Google on 2026-05-28

[N/A][520540744] High CVE-2026-15113: Use after free in Autofill. Reported by Google on 2026-06-05

[N/A][520565945] High CVE-2026-15114: Out of bounds read and write in Codecs. Reported by Google on 2026-06-06

[N/A][520576676] High CVE-2026-15115: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-06-06

[N/A][522092013] High CVE-2026-15116: Use after free in Actor. Reported by Google on 2026-06-10

[N/A][522568496] High CVE-2026-15117: Use after free in Payments. Reported by Google on 2026-06-11

[N/A][523238265] High CVE-2026-15118: Use after free in Input. Reported by Google on 2026-06-12

[N/A][523505418] High CVE-2026-15119: Inappropriate implementation in GetUserMedia. Reported by Google on 2026-06-13

[N/A][523609602] High CVE-2026-15120: Use after free in Core. Reported by Google on 2026-06-13

[N/A][523712556] High CVE-2026-15121: Use after free in WebRTC. Reported by Google on 2026-06-14

[N/A][523717219] High CVE-2026-15122: Insufficient validation of untrusted input in Codecs. Reported by Google on 2026-06-14

[N/A][523729553] High CVE-2026-15123: Insufficient data validation in DOM. Reported by Google on 2026-06-14

[N/A][523735038] High CVE-2026-15124: Insufficient policy enforcement in Passwords. Reported by Google on 2026-06-14

[N/A][523737685] High CVE-2026-15125: Inappropriate implementation in Forms. Reported by Google on 2026-06-14

[N/A][523748081] High CVE-2026-15126: Use after free in Forms. Reported by Google on 2026-06-14

[N/A][523752265] High CVE-2026-15127: Inappropriate implementation in WebGL. Reported by Google on 2026-06-14

[N/A][523756329] High CVE-2026-15128: Inappropriate implementation in Forms. Reported by Google on 2026-06-14

[N/A][526541544] High CVE-2026-15130: Insufficient policy enforcement in Navigation. Reported by Google on 2026-06-22

[$2000][503553615] Medium CVE-2026-15107: Use after free in IndexedDB. Reported by zh1x1an1221 of Ant Group Tianqiong Security Lab on 2026-04-17

[N/A][526542464] Medium CVE-2026-15131: Insufficient data validation in Navigation. Reported by Google on 2026-06-22

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Daniel Yip

Google Chrome

Chrome for Android Update

Thu, 09 Jul 2026 02:37:57 +0200

Hi, everyone! We've just released Chrome 150 (150.0.7871.114) for Android. It'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 150.0.7871.114/115, Linux: 150.0.7871.114) unless otherwise noted.

Krishna Govind

Google Chrome

Chrome Stable for iOS Update

Wed, 08 Jul 2026 20:07:43 +0200

Hi everyone! We've just released Chrome Stable 150 (150.0.7871.113) for iOS; it'll become available on App Store in the next few hours.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Cybersecurity and the Gap Between Skill and Ability

Wed, 08 Jul 2026 13:08:33 +0200

Internet risks are nothing new, and cyberattacks—both large and small—have been a significant issue since long before the current crop of generative AI models...

A brewing battle: More IT workers want unions. The industry doesn’t.

Wed, 08 Jul 2026 13:04:22 +0200

Until recently, many tech professionals viewed themselves as a special and respected worker class: highly educated, hard-working, well paid, and in demand.

“They considered themselves above unions,” says Zak Thompson, senior software engineer at Kickstarter and union steward at Kickstarter United.

Big Tech issued aspirational mission statements that motivated workers, workplaces were seen as meritocracies, and employees were encouraged to speak out if they were unhappy. If workers didn’t like where they worked, they just moved on: other employers would be falling over themselves to hire them.

How times have changed.

Now, fed up with mass layoffs, disillusioned with Big Tech’s direction, and stunned by bold management proclamations that AI will displace huge numbers of people in many tech jobs — starting with programmers — interest in unions has risen sharply among tech professionals. Workers in some organizations, including Kickstarter, have already taken the plunge.

A surge in interest

“Starting in 2022, the industry as a whole started seeing very large layoffs across the board [and] that has dramatically shifted the balance of power. I think most people in the industry have experienced that one way or another,” says Google software engineer Alan McAvinney.

But not everyone is convinced that the layoffs have changed the power dynamic. “I wouldn’t say the balance has definitively shifted… some things point to workers losing ground and others point to improvement,” says Liya Palagashvili, senior research fellow and director of the Labor Policy Project at the Mercatus Center at George Mason University.

width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Liya Palagashvili of the Mercatus Center at George Mason University

Mercatus Center at George Mason University

What matters, she says, is not the size of the layoffs but worker options: how easily laid off workers can find alternative work in their field.

For McAvinney, the decision to support a union was about a culture change at his employer.

“In 2019, Google fired four people (the ‘Thanksgiving Four’) after they organized and spoke out internally against the company’s work with the anti-union firm IRI and US Customs and Border Protection. That was a big turning point for me,” he says. “Historically, we had a pretty robust culture that actually encouraged us to speak up internally.”

Google said the employees were fired for violating data security policies, but many workers believed the move was retaliatory. It became a galvanizing event that contributed to the launch of the Alphabet Workers Union (AWU) in 2021, says McAvinney, organizing chair, Alphabet Workers Union-CWA. (Alphabet is the parent company of Google.)

So far, tech worker interest in unions hasn’t translated into higher membership numbers nationally. According to the US Census Bureau’s Current Population Survey (CPS), union membership in tech occupations was about 3.5% in 2025, says Palagashvili. “While there have been some high-profile organizing efforts, they do not yet show up as a broad national increase in tech-sector unionization.”

Overall, only 10% of American workers belonged to a union in 2025, the Bureau of Labor Statistics (BLS) reported — near an all-time low — but interest in labor unions is rising. A 2025 Gallup survey found that 68% of Americans approved of unions, up from 48% in 2009. Interest is particularly strong among younger workers, the Economic Policy Institute reports, and in a 2024 online survey of 1,900 tech professionals on the career site Blind, 67% of respondents said they’d be “very likely” or “somewhat likely” to join a union if their company had one.

Nonetheless, for most tech professionals, those positive perceptions have not so far translated into widespread union membership.

Fear, uncertainty, and doubt

In the wake of mass layoffs that began in 2022, the primary driver toward tech worker unionization may well be job security.

“I think a greater concern is that their work and skills have been devalued at the same time their jobs become less secure and their wages and benefits have declined,” says Kate Bronfenbrenner, director of labor education research and senior lecturer emeritus at Cornell University’s School of Industrial and Labor Relations.

width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Kate Bronfenbrenner from the School of Industrial and Labor Relations, Cornell University

ILR School/Cornell University

The fear that AI will displace IT workers en masse is palpable, says Google’s McAvinney. Whether the mass layoffs to date were actually driven by AI or if AI was used as a pretext, “Large numbers of people have that concern, and that is absolutely part of the interest in collective action — getting organized, joining a union, or forming a union,” he says.

The second motivator is ideological disillusionment. “Workers recruited with promises that they would be changing the world discovered that they were really building surveillance systems or military technology,” Bronfenbrenner says.

The insidious use of AI surveillance is another concern, says Bronfenbrenner. For example, Meta’s announcement that it would use AI to track US-based workers’ computer activities, including clicks, keystrokes, mouse movements, and screen snapshots to train AI agents had a dystopian feel to it. Were these workers training AI to take over their jobs, just as US workers were asked to train their lower-cost foreign replacements during the offshoring craze in the mid-2000s? (Meta later paused the tracking program after employees twice demonstrated the inadequacy of privacy protections for the collected data.)

But Bronfenbrenner argues that AI’s bigger threat may be its use as a surveillance tool to prevent organizing. “My research on surveillance in organizing campaigns found that it tripled from 11% in the early 2000s to one third in 2021,” she says.

“The deeper pattern is the same one inherent in Taylorism — management trying to know everything that’s under the worker’s cap, to monitor every step so workers have no control and no secrets,” Bronfenbrenner says. “Now they have even more technology to do it, and they can potentially replace you entirely with AI.”

Simone Robutti, an organizer with Tech Workers Coalition Global, calls the current wave of tech layoffs “a prequel to whatever AI-driven layoffs are coming.” It’s part of the trend of “lowering the cost of knowledge workers, of cognitive workers, of office workers in general — because that’s the bet on AI,” he says.

width="745" height="486" sizes="auto, (max-width: 745px) 100vw, 745px">

Simone Robutti from Tech Workers Coalition Global

TWC

Whether employers can in fact replace workers with AI (or will be able to soon) is an open question. “If Amazon lays off a hundred workers, and ninety of them find comparable jobs within a few months, that mitigates the concern,” says Palagashvili from George Mason University. “If most of them have to sell their houses and move across the country, or end up underemployed — not just unemployed, but working in warehouses instead of at a competitor — that’s a different picture.”

So far that hasn’t been a big issue for former Google employees, says McAvinney. “It used to be that if you left Google, you could get a job anywhere in tech instantly. That’s no longer the case, but most people I talk to are still finding work in the industry,” he says.

But for those newly entering the workforce, it’s much harder to find a job. According to the Stanford HAI 2026 AI Index Report, released in April, “employment for software developers ages 22 to 25 has fallen nearly 20% from 2024.”

Successes and setbacks

While organizing can be an uphill battle and workers often face aggressive pushback from their employers, there have been a few notable successes.

In the UK, workers can join a union as individual members before their employer formally recognizes that union for collective bargaining purposes. That’s how 300 workers in Google DeepMind’s London office initially joined the Communication Workers Union. In April, 98% of the 300 CWU members voted in favor of pursuing union recognition, formally requesting that management recognize the CWU and Unite the Union as representatives for approximately 1,000 staff. (Google DeepMind disputed characterizing the action as a vote to unionize).

And in May, some 2,100 tech workers at the University of California joined the University Professional and Technical Employees union, which is affiliated with Communications Workers of America (UPTE-CWA), with 96% of the workers voting yes.

“A lot of tech workers right now are extremely concerned about job security and about their work being automated,” says Max Belasco, a business systems analyst at the UCLA School of Law and co-chair of the UCLA chapter of UPTE-CWA, Local 9119.

width="1024" height="683" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Max Belasco from the UCLA chapter of UPTE-CWA

Zac Goldstein

The CWA described the organizing initiative as “the largest tech industry organizing campaign in US history.” But it wasn’t the first.

“Between 2022 and 2024, CWA organized nearly 400 different digital media companies,” Bronfenbrenner says, including the game developer Activision and the New York Times.

Kickstarter’s 85 employees voted in 2020 to form Kickstarter United — the vote was 55% in favor — and most recently the union negotiated a contract that includes a four-day workweek, AI protections, and a minimum pay floor for 59 employees, including tech workers.

“What we ended up winning was yearly benchmarking of all employee salaries to the 60th percentile, along with yearly cost of living adjustments,” says Thompson.

But the way forward has been rocky. Shortly after the union was ratified, Kickstarter announced layoffs. The union, which is affiliated with the Office and Professional Employees International Union (OPEIU), wasn’t able to reverse that decision but did negotiate better severance terms, including four months of severance pay (versus 2 to 3 weeks for every year worked) and six months of health benefits.

When contract negotiations faltered in October 2025, the union went on strike for 42 days. By December, a new contract was ratified. Shortly thereafter, the company announced another round of layoffs that included four union leaders, one of whom had helped to negotiate the new contract. The union is currently fighting those dismissals and will be arguing its case in third-party arbitration.

width="1024" height="618" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Members of Kickstarter United union on strike

Kyle Friend

The National Labor Relations Act of 1935 codified American workers’ rights to unionize and take collective action, and it established the National Labor Relations Board to protect those rights. Unfortunately for Kickstarter, NLRA enforcement under the Trump administration isn’t what it once was.

“Cases brought up for violations of the NLRA can go for months or years without ever seeing a hearing or having any sort of judgment. That gives companies more power to flagrantly ignore it,” Thompson says.

Tech firms have other weapons to dissuade employees from unionizing. Researchers from Carnegie Mellon University and Princeton University in 2025 interviewed 44 US-based tech worker-organizers, who cited additional pressure tactics including threats to withdraw venture capital funding — essentially killing venture-backed firms if employees vote to unionize — and threats of being fired that put tech workers with H-1B visas in an impossible position.

Kickstarter United is a majority union — one that has won NLRB certification. While that’s possible in smaller organizations, success in larger tech firms has been much more limited.

Alphabet is a prime example: the Alphabet Workers Union-CWA is a “pre-majority” union that lacks NLRB certification and has no formally recognized bargaining unit. Formed in 2021 with fewer than 400 members, today it represents 1,400 members, still a small fraction of Alphabet’s US-based workforce, estimated at over 100,000.

width="1024" height="839" sizes="auto, (max-width: 1024px) 100vw, 1024px">

Alan McAvinney from Alphabet Workers Union-CWA

Aran Per Ink

The challenge, says McAvinney, lies in trying to organize a distributed workforce of in-office, remote, and contract workers. “Large tech companies don’t split easily into discrete segments — there’s no strong geographic component to teams, and a single team is often spread across many locations,” which makes getting majority support unrealistic, he says.

But that doesn’t mean the union has had no impact. “In January, we launched our Googlers for Job Security campaign. Today we’re organizing around four demands: a guaranteed minimum severance package for everyone who’s laid off, voluntary buyouts before any mandatory layoffs, an end to GRAD quotas (GRAD being Google’s performance review system) so ratings reflect actual performance and aren’t given or changed to force a particular distribution, and the option to take severance as leave, giving workers, especially those on visas, more time on payroll,” McAvinney says.

“In response, Google did start offering voluntary exit packages,” he says. The union was also able to negotiate one contract, for Google Help workers. However, those workers aren’t actually Google employees: they’re contractors who report to Google management but work for Accenture.

The counterargument

Do unions get what they bargain for? Conservative business and labor economists say union contracts typically have rigid pay structures that restrict merit-based pay in favor of seniority-based wage increases, and that unions, as certified by the NLRB, create labor monopolies that limit worker choice and push up wages to levels detrimental to both workers and business.

The collective bargaining model is not well suited to the highly dynamic and innovation-driven tech sector, Palagashvili argues. “Firms often need to reorganize teams, redesign products, adjust roles, and redeploy talent quickly,” she says.

Collective bargaining agreements make those adjustments much more difficult by imposing uniform terms for an entire bargaining unit, regardless of individual preferences and circumstances. The contracts, she says, “are more about higher pay and less about flexibility.”

But Thompson says that hasn’t been his experience. “The thing with a union is you get to write the contract,” he says. “At Kickstarter we care about recognizing individual contributions, merit, and having a clear career progression.”

width="972" height="972" sizes="auto, (max-width: 972px) 100vw, 972px">

Zak Thompson from Kickstarter United

Fee Christoph

Kickstarter United pushed the company to clearly define what it takes to get a promotion, advocated for no “at will” employment, where employees can be fired any time without a stated reason; won standards for minimum pay, raises, promotions, and time off; secured AI protections; and codified a four-day work week.

Yes, some tech professionals voiced concerns about unions, such as that they stifle innovation and limit compensation for top performers, Thompson says, but “a lot of those people came around. They said ‘I was wrong. I feel way more protected, more secure, and I see the benefits.’”

Bronfenbrenner says it’s a mistake to think that tech workers are inherently different from other workers, adding that the two industries with the highest union density are entertainment and professional sports. “These are professionals with unique talents and capabilities, and they’ve organized successfully under the exclusive representation system.”

Will we see a unionized tech workforce?

If unions eventually prevail in tech, it will happen in the face of intense pressure from employers not to organize.

“The Alphabet Workers Union is a case study of the limits of the first wave of tech labor organizing,” says Robutti from the Tech Workers Coalition. “They hit a threshold beyond which they couldn’t fight the union busting anymore, and they became entrenched at that size.”

No one should expect large-scale unionization to occur overnight, Bronfenbrenner says. “The auto and steel industries weren’t organized in months. It took decades. Organizing global tech companies will take the same.”

While McAvinney acknowledges that a traditional majority union may be difficult to achieve any time soon in a company as large as Alphabet, he’s still bullish on his pre-majority union’s ability to make a difference. “Ultimately, regardless of which type of union you are, you can only win as much as you have leverage to win. Your leverage is inherently limited, but that doesn’t mean you can’t win anything,” he says.

Attitudes about unions appear to be changing rapidly. “Interest in unions is high, and I expect that will continue,” McAvinney says. “Now is an excellent time for people to start getting organized. I have seen lots of evidence of that.”

Thompson agrees. “We are seeing an uptick of people in tech reaching out, trying to get help organizing. When people have their job conditions continue to deteriorate, they are going to start organizing,” he says. “We’re definitely seeing a shift from ‘it’d be nice if we had a union’ to ‘okay, how can I actually do this now?’”

Come back next week for Part 2: How to unionize your tech workplace

Inside the Underground Economy: 5 Dark Web Trends Shaping the 2026 Threat Landscape

Wed, 08 Jul 2026 12:09:00 +0200

The dark web is no longer just a hidden marketplace for stolen credentials; it has grown far beyond that point and now affects nearly every phase of the cyberattack lifecycle. Markets that once traded only compromised accounts now also sell ransomware services, initial network access, exploit kits, phishing infrastructure, and even AI-powered attack tools. What used to be a place for selling stolen data has become the operational backbone of modern cybercrime.

Take the first half of 2026 as an example. The dark web trend for this year has evolved into a highly organized ecosystem that facilitates cybercrime, underpins ransomware supply chains, fuels geopolitical campaigns, and accelerates identity-based attacks. Instead of serving as the endpoint for stolen data, it now functions as an operational hub where access, intelligence, and malicious services are traded before attacks even begin. The pace of activity reflects this shift: March 2026 alone recorded 702 ransomware attacks and 54 major publicly reported data breaches and leaks worldwide.

Enterprise security teams must watch this underground activity; it's now not optional as an intel exercise but rather an essential capability for spotting threats before they materialize. The dark web trends observed during the first half of 2026 reveal how underground ecosystems are reshaping the cyber threat landscape.

Ransomware Operations Top the Dark Web Trends of 2026

During the first six months of 2026, ransomware remained one of the most disruptive cyber threats, but the infrastructure supporting it became noticeably more organized. Rather than hundreds of equally active groups competing for victims, five ransomware operations—Qilin, Akira, The Gentlemen, DragonForce, and INC Ransom—were responsible for more than 56% of ransomware activity recorded in March 2026.

This concentration stresses the growing consolidation of the ransomware ecosystem, where a handful of established operators dominate attacks while relying on affiliates and underground service providers to scale their campaigns.

Modern ransomware campaigns rarely center on the encryption of systems. Data theft has increasingly become a standard component in most attack scenarios, as it allows threat actors to pressure their victims with the threat of public exposure, even if the victims have proper backups and can restore their systems. The dark web leak sites play a major role in this, as they are the places where stolen information is published or auctioned when organizations do not want to make a payment.

This shift will require businesses to monitor underground forums for underground forum trends in H1 2026, including discussions around leaked data, targeted organizations, and early chatter on upcoming campaigns. Regional data reinforces the same trend. In the Americas alone, 1,305 cyber incidents were reported during Q1 2026, including 1,138 publicly claimed ransomware attacks. Nearly 58% of those attacks were attributed to just five ransomware groups.

Access Brokers Are Powering the Underground Economy

Many cyberattacks are now starting long before ransomware. Initial access brokers have become major players, specializing in one activity: network compromise and then selling that access to other threat actors.

Underground marketplaces also showed growing demand for initial access. In March 2026, researchers observed 20 separate listings advertising access to compromised corporate networks. Professional services accounted for 25% of those listings, while retail represented another 20%. Even more concerning, three sellers—vexin, holyduxy, and algoyim—accounted for more than 55% of the observed access sales.

Ransomware groups and espionage operators don’t need to spend time and effort to breach organizations themselves; they can simply buy verified entry points to corporate environments. This new division of labor has made cybercrime much faster and more effective.

Access is typically sold soon after a compromise, so the time window for defenders to catch exposed credentials or infrastructure that has been compromised is shrinking. As such, dark web intelligence is valuable not only in the identification of stolen data but also indications that access to a network of an organization is already being traded in underground markets.

To see how Cyble’s threat intelligence can help your organization detect external exposure and track threat activity, book a personalized demo.

Identity Has Become the Primary Attack Surface

With the rise of credential-based attacks over malware, the security perimeter is pretty much irrelevant. The most common enterprise infiltration paths include credential theft, session hijacking, bypass techniques for multi-factor authentication, and abuse of third-party access. All those have one thing in common: valid credentials.

From an attacker's perspective, logging in with legitimate credentials generates far less suspicion than exploiting software vulnerabilities. As organizations expand cloud adoption and remote work, identities have effectively become the new perimeter.

The shift toward identity-focused attacks is reflected in breach statistics as well. Technology and financial services accounted for approximately 44% of reported breach activity across North America during the first half of 2026.

This trend also explains why stolen usernames, passwords, authentication tokens, and corporate accounts remain among the most valuable assets traded across dark web communities. Monitoring for exposed credentials allows organizations to respond before compromised identities are weaponized.

Geopolitical Events Are Driving Cyber Activity

The connection between global conflicts and dark web activity has become increasingly apparent during the first half of 2026. State-sponsored groups, hacktivists, and financially motivated criminals frequently operate in parallel during periods of geopolitical tension, creating a more complex threat environment.

Rather than focusing exclusively on immediate disruption, many sophisticated actors are investing in long-term access to critical infrastructure, telecommunications, transportation, and energy systems. During the February 2026 escalation in the Middle East, cyber operations demonstrated how geopolitical events now extend into the digital domain.

Internet connectivity in affected regions reportedly dropped to between 1% and 4% of normal levels, more than 70 hacktivist groups became active, over 8,000 conflict-themed domains were registered for scams and malware campaigns, and disruptions to navigation systems affected more than 1,100 vessels near the Strait of Hormuz.

This convergence of political objectives and cybercrime makes attribution more difficult and raises the importance of monitoring underground discussions that may signal emerging campaigns before they reach production environments.

AI Is Accelerating Both Attackers and Defenders

Artificial intelligence has moved from experimentation to operational use across the cybersecurity landscape. Threat actors are increasingly using AI-assisted techniques to automate reconnaissance, accelerate vulnerability exploitation, and scale phishing campaigns with greater precision.

The dark web has become a marketplace for sharing AI-enabled attack tools alongside traditional malware, making advanced capabilities accessible to less experienced operators. This lowers the barrier to entry while increasing the overall speed of cyber operations.

Dark web threat intelligence in 2026 is becoming increasingly AI-driven, with defenders using automated analysis to process large volumes of dark web data, identify indicators of compromise, and prioritize threats in near real time. As attacks unfold more rapidly, automation is becoming necessary to reduce detection and response times.

The question is no longer whether your organization appears on the dark web. The real question is whether you'll discover it before your attackers do.

Subscribe to access the upcoming H1 2026 report by Cyble

Conclusion

The first half of 2026 stresses that the dark web is no longer simply where stolen information appears after an incident. The new dark web trends suggest that it has evolved into a live intelligence environment where attacks are planned, infrastructure is traded, identities are monetized, and emerging tactics become visible before they reach production networks.

Organizations that incorporate dark web intelligence into broader security operations gain more than visibility into compromised data; they gain early warning of evolving threats. As ransomware groups become more coordinated, identity attacks continue to rise, and AI reshapes offensive capabilities. Proactive monitoring will play an important role in reducing cyber risk during the remainder of 2026.

References:

https://cyble.com/blog/monthly-threat-landscape-march-2026/

https://cyble.com/blog/2026-threat-intelligence-trends/

The post Inside the Underground Economy: 5 Dark Web Trends Shaping the 2026 Threat Landscape appeared first on Cyble.

Why is it so hard to measure the ROI of AI?

Wed, 08 Jul 2026 12:08:55 +0200

Danish multinational pharmaceutical Novo Nordisk is very interested in speeding up the time it takes to get drugs to market as patents expire. “If you have a blockbuster drug, a one-week delay can be $10 to $100 million,” says Stephanie Bova, the company’s digital transformation officer. “It’s massive money because you have less time on patent.”

Gen AI offered the possibility of dramatically speeding up multiple steps in the drug development process. And since Novo Nordisk was already carefully tracking how long its key processes took, it had an advantage that many companies didn’t. So it should’ve been relatively simple to sprinkle in some gen AI, see productivity improve, and watch the money roll in. But it wasn’t that easy. A drug development process has many parts, happening at different times in different departments.

“People are experts in their own domains but don’t necessarily know the next domain and how it all fits together,” Bova says. “The system is so big and complex that you’re not able to see all the performance at once.”

Process documentation might not match what people actually do in practice, and different people might do the same task in different ways. And some crucial tasks might be nearly invisible from the outside. The manufacturing team, for example, might sit in a completely different group and not be aware the drug is getting ready for FDA submission, and don’t have all their documents ready yet.

“So you’ve run very fast only to have to wait for them to catch up,” Bova adds.

This is just one of many challenges companies face when trying to measure the results of AI projects, and why surveys are so contradictory.

Looking at individual tasks, Novo Nordisk can show productivity improvements and clear positive benefits to its use of AI. But stepping back and looking at the company’s bottom line, the picture gets murkier. First, if critical steps are missed, then time to market won’t improve. It also takes years for a new drug to get to customers, so any positive bottom-line effects won’t be felt for a while. And that’s just the start of the ROI measurement problem.

Process measurement

To address its process blind spots, Novo Nordisk turned to the new generation of process mining: AI-powered real-time digital twins of operations.

“We partnered with process intelligence company Celonis to get a digital twin of our process data,” Bova says. “We were the first in the industry to apply it to the clinical setting.” The tool collects information from enterprise systems to track what employees actually do, rather than using surveys to collect information on what a fraction of employees remembered doing at some point.

The first project was a simple, seven-step process, and in creating a digital twin of it, Novo Nordisk discovered that, depending on who was doing it, it could be a five- or nine-step process. “If you get 10 different subject matter experts in a room, you get all kinds of interpretations, and you have drift over time,” she says.

The project exposed multiple flaws in existing processes. In some cases, employees needed to be retrained. In one, the user interface had to be updated. Once a process is standardized, though, there’s an opportunity to take the before picture, so there’s something to compare to afterward, to see if the AI augmentation or automation show any results.

Another thing they had to figure out ahead of time was decide what to do with any time savings that showed up.

“You don’t want to lay people off,” Bova says. “These are highly technical, hard-to-find talent. Maybe we want to think about redistributing teams a bit.”

Today, the company has several hundred AI agents in active deployment, tagged inside the digital twin infrastructure so they can be identified.

“If something screws up, we know exactly where to fix it,” she says, adding that the next phase is multi-agent orchestration. “Today, we have them connected, but we don’t have agents of agents.”

It’s too early to say if there’s ROI yet because, for drug development, the process takes years. “But by looking at the end-to-end process, my hope is we’ll find two years of cycle time to engineer out,” she says. “Two years quicker to market, compared to where we are now.”

Drugs that are already in the final phase of development won’t see as much acceleration, but those just starting out will benefit the most. The bottom line results, however, won’t show up for several years.

The pharmaceutical industry isn’t the only one where true value comes from optimizing multiple interconnected processes at once. According to PwC, tactical AI projects often don’t deliver measurable value, with tangible returns coming from enterprise-scale deployments consistent with business strategy.

In fact, many companies have seen neither increased revenue nor decreased costs from AI in the last 12 months despite nearly universal adoption of AI. Still, enterprise spending on AI is set to nearly double by the end of the year compared to last year, according to KPMG.

Productivity measurement

Most companies start on a smaller scale, rolling out AI chatbots to employees to help improve productivity. And the pace of adoption here has been staggeringly high, matched only by a lack of ability to measure the productivity gains that are supposed to be achieved.

Having a baseline is key, says Anand Rao, professor of AI at Carnegie Mellon University, but it’s difficult to measure in some cases, and all but impossible in others. Take for example insurance decisions where results can take years to show up. With life insurance, it could be decades, he says. And for some types of decisions, companies don’t have any measurements at all.

“There’s a social stigma to saying that I’m trying to look at your decision-making and how well you’re making the decisions,” he says. “As humans, we don’t like to be measured for our decisions.”

Then, when a decision turns out well in the end, people are happy to take credit. “If the decision goes badly, it’s something outside,” he says.

But even for specific tasks where measurement is possible, companies often don’t put in the work to make the measurements prior to rolling out AI tools. “We didn’t start with a baseline,” says Julie Averill, former EVP and global CIO of fashion retailer Lululemon. Averill is now CEO at Gold Thread, a digital transformation consultancy.

“We started with the assumption that AI was going to help people make better decisions,” she says. “And that sets you up to not being able to measure well.”

There are alternative metrics that a company can look at instead, she adds, like usage rates or user satisfaction. “This is happening, and it’s bringing benefits,” she says, “some of which you can see, and some you can’t. You have to trust the process. It’s just like the cloud. You know it’s the way of the future and you can see the benefits, but it’s hard to get there, and there’s a lot of change required. But the sooner you do that, the sooner you’re in the new way of operating and can really take advantage of it.”

There are other areas where hard metrics are more readily available, like customer service. “These are repeatable tasks, and it’s usually the first place companies automate with AI,” Averill says. “There are very tangible results you can measure, and you can have a very good baseline.”

Lululemon has also been using AI for years for better personalization and recommendations, and that’s also an area that can be quantified. And automation can reduce manual data entry, reducing error rates. AI can also be used to help with compliance monitoring, fraud detection, and predictive maintenance for equipment, which are all use cases that can be quantified.

But employee productivity in general? That’s a tough one to measure, and not just for Lululemon. One obvious way might be to look at layoffs in professions exposed to AI. After all, the headlines are everywhere. But in a report released in March, Anthropic found no signs of an increase in unemployment in highly exposed professions, those in which people are most likely to be laid off due to AI.

In early 2025, research firm METR attempted to quantify developer productivity by comparing how fast experienced developers were able to achieve tasks with AI and without. The result? Developers said they were expecting AI to speed them up by 24%, and estimated that AI had actually sped them up by 20%. But the data showed an altogether different story. Their use of AI actually slowed them down by 19%.

Of course, AI tools are getting better. METR attempted to do a follow-up study, again tracking tasks done with and without AI, but they couldn’t find enough developers willing to go back to the no-AI approach, even though the researchers were paying them to participate in the study.

There are anecdotal reports of companies where one engineer does the work of a hundred by using AI. Or that time the entire half-million-line Claude Code codebase was accidentally leaked and Korean developer Sigrid Jin created a clean-room rebuild in two hours, which he then pushed to GitHub, where it became the fastest project in history to hit 100,000 stars.

But as with anything else having to do with AI, the real picture is more complicated. With software development in particular, typing the code is actually just a fraction of what’s involved in developing software.

Research firm DX recently analyzed key engineering metrics from 400 companies, and in a recent report found that AI usage increased by 65% since November 2024, but AI-related productivity was just under 10%.

Hidden costs

Just as it’s difficult to measure the productivity benefits of AI, it can also be tricky to measure the costs. When a company first starts using AI, costs might be relatively simple to estimate. What’s the total monthly subscription charges for the AI chatbots that employees are using? What’s the cost of training or fine-tuning a custom model? But when you move on to more complex use cases, the calculations get more difficult, says Averill.

“Now there are all the systems around the AI,” she says. “Those are harder to measure, but the impact is bigger.”

For example, if AI is embedded into business processes using RAG, there’s the ongoing expense of the API calls, but also the changes that need to be made to other systems, she says. And it just keeps getting more complicated every day.

“We haven’t taken a very concerted effort to putting telemetry and instrumentation in place,” says Swaminathan Chandrasekaran, global head of AI and data labs at KPMG. He says that getting a comprehensive picture of the total costs of AI in an enterprise is like predicting the weather.

“The reason we have a pretty awesome weather prediction system in this country is because we have tens of thousands of weather stations that aggregate data,” he says. “Without that, we wouldn’t know the weather.”

Companies need to set up instrumentation to measure all the aspects of AI-related consumption, he says, starting with the number of tokens used, who’s using them, and how it correlates to work output.

“That measurement is fundamentally lacking,” he says.

At least when humans are using AI chatbots, there’s a limit to how many questions they’re physically able to ask, combined with predictable subscription costs. And when business processes are AI-enabled via RAG, the API calls to LLMs are being made by predictable, traditionally-scripted business systems.

But now, agentic AI is making everything worse because the agents can act unpredictably, and the number of API calls can quickly spiral out of control. In a report by the Boston Consulting Group, two-thirds of companies are reporting uncontrollable AI scaling expenses.

Another cost some companies might not anticipate well, or not track because it’s part of a different budget, is data-related cost. Whether preparing data for training or fine-tuning, using RAG embeddings, or setting up direct MCP access via agents, these costs can quickly add up when AI comes into the picture.

“Egress fees are one of the big ones,” says Tom Coughlin, IEEE fellow and president of consulting firm Coughlin Associates. “If you have to bring data out of the cloud, those egress fees could be considerable.”

Then there are all the human costs of deploying AI, he adds.

“There’ll be a lot of value that people get out of AI in the long run, but they need to know how to use it properly,” he says. “If they don’t have those skills, you’ll be at a disadvantage.”

Solutions and mixed messages

Then there’s fixing problems. A majority of companies have had at least one AI-related incident in the last 18 months, with most resulting in financial loss, some over $500,000. Then there’s the AI that’s being embedded in everything.

“We know our direct costs,” says Andrew Johnson, CIO at Brownstein Hyatt Farber Schreck, a leading national law firm. “But where it becomes more difficult to measure is with platforms we already have in place, and SaaS applications that didn’t have AI capabilities,” he says. “They’re asking for extraordinary increases and attribute them to new capabilities due to AI. How much should be ascribed to AI? That’s a little wishy-washy.”

Even when AI saves money, there are often extra costs associated with that. For example, the firm was spending about $70,000 a year on a contract management platform. Building their own version with AI took about $40,000 in labor costs and another $3,000 a year for hosting. Ongoing maintenance will be minor for that particular application, he adds, totaling another couple of thousand a year.

But there are also other indirect costs that come with running your own applications, including security audits, vulnerability assessments, penetration tests, and code review.

“The more complex and riskier the platform, the less appetite there is for trying to create an in-house solution,” he says.

Still, the software development team is now dramatically more productive as a result of AI, with four or five developers able to do the work of 20 or 30.

But the productivity improvements don’t translate to labor savings, since there’s plenty of new work for the developers to do. “We have an enormous backlog of opportunities to develop solutions,” he says.

The tendency of work to expand to fill the time available isn’t just true for software development, says Carnegie Mellon’s Rao.

Say for example, AI is expected to lead to a 20% improvement in productivity, he says. “There were a hundred people doing it, and now we only need 80.” But at the end of the year, headcount hasn’t changed. “The tasks they were doing, there’s improvement,” he adds “But humans will add tasks to supplement or complement that 20%. It’s not that they’re going home an hour early, but they’re finding other value-generating activities.”

In fact, in some cases, increased productivity at a company can actually hurt the bottom line. Lawyers, for example, bill by the hour.

“Efficiency runs counter to our traditional ways of making money,” says Brownstein’s Johnson. “We have to think past that. It’s not detrimental to our long-term interest, but it’s a challenge in the short term. If we don’t do this, though, it’s likely we won’t be competitive in the mid- to long-term.”

So if a new AI tool helps an attorney with due diligence, there’s no straight line between the investment in that tool and increased revenues.

“It’s a given that it’s directionally right,” Johnson says. “But we can’t say it’s going to lead to a particular return.”

The IDE is dead, long live the ADE

Wed, 08 Jul 2026 11:04:02 +0200

For the last 40 years or so, software development tooling has centered around the IDE — the integrated development environment. Borland is widely credited with bringing the IDE to the masses. The joining of the editor, compiler, and debugger into a single entity revolutionized the software development industry. The popularization of the IDE through the likes of my beloved Turbo Pascal in the mid-1980s marked a huge turning point for coding.

But the IDE’s reign is over. With the unbelievably rapid rise of agentic coding, the IDE has become an afterthought, a tool that developers are finding they use less and less. Instead, developers are spending time managing agents that are actually writing the code.

Things are moving pretty fast, changing monthly if not weekly. It was only a few months ago that I was building things inside my IDE with an agent’s help. But before long, I had four or five console windows open, working on different projects all at the same time as the agents ground away at different things. This was barely manageable when working on separate repositories and projects at the same time, but when I wanted to work on different features inside the same repository, it got a bit hairy.

Clearly, we developers have a need for a next-generation tool to manage all of this.

Coding agents need worktrees

The first step was recognizing a little-known and underutilized feature of Git — worktrees. Git worktrees allow you to check out multiple branches of the same repository into different directories from a single Git database. A longtime power-user technique used only by a few, worktrees are perfectly suited for the new world of agentic coding.

Typically, a developer would work on one ticket at a time, and a simple Git checkout would do the trick. That assumes one actor — the developer — working on the codebase. But with coding agents, the notion of working on three Jira tickets at the very same time is no longer crazy, and worktrees enable that. They give each “developer” their own branch and directory. It’s easy isolation without the overhead of cloning and forking separate instances of repositories.

So this old Git feature that has been lying around basically unused has suddenly become the key to agentic coding. But of course, the overhead of worktrees is challenging in and of itself. If only there were a way to manage all of that in one place.

Agentic coders need ADEs

And that is where ADEs come in — agentic development environments. A new kind of development environment that arose with agentic AI, an ADE coordinates and manages all of the things that need to happen when multiple coding agents work on multiple issues in multiple branches in one repository. As Matt Johnston, CEO of GitKraken, maker of the Kepler ADE, put it, “The IDE was built for the age of one human typing. The ADE is built for the age of humans orchestrating fleets of agents.”

ADEs will do all the dirty work of opening, running, and closing the worktrees in Git. Having five console windows open and managing all of that is not something a human is very good at. But an AI-driven agentic development environment sure is.

The days of single-threaded development are over. With an ADE, developers can multitask with ease and track many tasks at once. Without having to worry about the logistics and overhead of managing multiple agents working in multiple worktrees, developers can focus on directing the agents and ensuring that they do the right work for the task at hand.

Admit it, you don’t really use the IDE that much anymore. And you aren’t going to miss it.

Any Other Linux Users Groups Out There?

Wed, 08 Jul 2026 04:25:34 +0200

Does anyone else out there run or attend a LUG (Linux Users Group) near them? I am very curious to know who else out there manages or participates in their local Linux community!

I run the Jacksonville Linux Users Group (JaxLUG). We have been around since 1996 and I have been working really hard over the past year giving the group a massive facelift and helped grow the group.

We have been averaging between 25-30 people each meeting (peaking this year at 35 attendees).

We had some pretty cool speakers this year including Johannes Ullrich from Sans Internet Storm Center, Champ Clark from Key9 and a veteran Def Con speaker, and Kyle Spearrin the founder of Bitwarden.

We also got the chance to throw our first ever InstallFest in decades and we are looking to head up the Software Freedom Day event in September in Jacksonville.

Please feel free to check us out at https://jaxlug.net

submitted by /u/bobafett2010
[link] [comments]

I have fewer problems with Linux than with Windows.

Wed, 08 Jul 2026 04:25:27 +0200

The title pretty much says it. I just wanted to share my experience in case it helps someone who's considering making the switch.

I started dual-booting about two years ago after Microsoft announced Windows Recall. At the time, Windows worked perfectly fine for me, and I had never really had any major issues with it, been using it since Windows XP.

Ironically, ever since I started using Linux as my main OS, Windows has become the one giving me headaches.

For example:

My mouse constantly disconnects and reconnects on Windows, making FPS games nearly unplayable. The exact same mouse works flawlessly on Linux.
I recently bought a game on Steam that launches with the wrong resolution on Windows. After trying everything I could think of, I still haven't fixed it. On Linux, it launches in the correct resolution immediately.
My Windows installation is a completely fresh install, yet it feels painfully slow. Launching CS2 can take up to two minutes, while on Linux it starts in about ten seconds.

The funny part is that Linux isn't just "good enough" anymore, it does everything else I used Windows for without any issues. Browsing, programming, gaming (for the vast majority of my library), Docker, virtualization, media, file management... everything just works.

The only reasons I still keep Windows installed are:

Playing games like Call of Duty or League of Legends with friends sometimes.
Using a collection of very large Excel workbooks with complex macros and custom forms. I tried migrating them to LibreOffice, but they simply aren't compatible.

Today I spend about 95% of my time on Linux, and I don't regret switching for a second.

I started with Linux Mint and eventually moved to Zorin OS. Both have been great, but what surprised me the most is that I now trust Linux more than Windows to just work.

submitted by /u/LetterheadNo2345
[link] [comments]

Is there a way to get around Cloudflare Verification on websites while having JavaScript disabled

Wed, 08 Jul 2026 04:23:50 +0200

Hey, I have JavaScript disabled for all websites, but this means, that Cloudflare protected websites can’t be opened.
Is there a way around this, without enabling js?
I always enable js for this website, then disable it afterwards again, but it’s pretty annoying and the website already loaded by then.
I use brave on iOS.
Thanks

submitted by /u/thatscoolbutno123
[link] [comments]

Stable Channel Update for Desktop

Tue, 07 Jul 2026 20:22:02 +0200

The Stable channel has been updated to 150.0.7871.100/.101 for Windows and Mac and 150.0.7871.100 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Daniel Yip

Google Chrome

Xbox CEO Asha Sharma Gives the Brand a Turbulent 'Reset'

Tue, 07 Jul 2026 19:18:07 +0200

That's a pretty friendly name for 3,200 job cuts.

‘You never truly quit’: how RuneScape survived to 25 – and beyond

Tue, 07 Jul 2026 11:47:55 +0200

The massively multiplayer online role-playing game has grown into a virtual social space and part of daily life for thousands of players

In a small stone chapel, on the edgelands of a medieval wilderness, two women are getting married. The attenders are draped in rainbow capes, glowing armour and top hats. A scantily clad, muscular man with angel wings officiates the ceremony. Over the heads of the two brides hover the words “I do” in bright yellow text. This is RuneScape, a massively multiplayer online role-playing game (or MMO) set in the Tolkienesque realm of Gielinor. Turning 25 this year, it has, over its lifetime, become a crucial virtual social space and part of daily life for thousands of players.

Lancashire-born Amelia, one of the pixelated newlyweds, met her wife on a dating app but first bonded through their love of the game. “Our first and second date was pretty much exclusively talking about RuneScape,” she recalls. Four years later they were married, shortly followed by their in-game ceremony. Morgan – a 26-year-old from the Midlands – is one of Amelia’s closest friends. They met through the game and run UWU Girls together, a RuneScape clan that Morgan founded in a bid to cater to players across the gender spectrum. “We do IRL meetups, and for a lot of these women, it’s been their first meetings with strangers online – and that’s the same for me.”

HPR4677: UNIX Curio #10 - Checksums and Hashes

Tue, 07 Jul 2026 02:04:13 +0200

This show has been flagged as Clean by the host.

This series is dedicated to exploring little-known—and occasionally useful—trinkets lurking in the dusty corners of UNIX-like operating systems.

In UNIX Curio #8 ( HPR episode 4657 ), I talked about using standard utilities to compare files. Left unmentioned, however, was a method commonly used today—the hash function.

As I've stated in previous entries, while I am an engineer, I don't have a background in computer science, so my understanding of the mathematics is limited. But I can give a practical description of what a hash function does. It takes an input, performs a set of calculations on it, and produces an output. As hash functions are practically used, the input is a set of bytes, such as a file or another piece of data like a password. The output is a numerical value in a fixed range—most often, expressed as hexadecimal characters. Because this "hash value" can always be represented in a certain number of bytes, its length as printed is usually a constant number of characters, padded with leading zeros if necessary. This episode will not cover the use of hashes in programming, focusing instead on using them to validate data.

A hash function, or more specifically, a cryptographic hash function, has an additional property. It should be very difficult to predict what changes to the input would be required to produce a specific change in the output.

An older, related concept is called a "checksum". While these are designed to vary when the input data is damaged or digits are transposed, they do not necessarily have that last property mentioned for cryptographic hashes. You have probably already encountered a checksum, even if you didn't recognize it. On a 16-digit number assigned to a Mastercard or Visa ¹ credit or debit card, the first six digits identify the card issuer (such as a bank), the next nine digits are assigned to you by the issuer, and the last digit is a check digit. The check digit is calculated using the values of the previous 15 digits, and it is a simple way to avoid typos in entering a card number.

In another example, every Ethernet frame that your devices send or receive includes a checksum ² to help ensure that the contents weren't scrambled in transit. This is 32 bits long and is called a cyclical redundancy check, commonly referred to as a CRC. A CRC is also used in many other places—for example, the .zip file format includes one for each archive member, and this allows a program extracting files from the archive to identify if any were damaged.

Our UNIX Curio for today is another example, the cksum utility ³ . It generates a 32-bit CRC based on the Ethernet algorithm. It operates on either a named file or standard input and outputs the CRC value, the length of the input, and the pathname if a file was given as an argument. Unlike most modern hashing programs, the checksum is printed as a decimal integer and is not padded, so it can be anywhere from one to ten digits long. The length value is the number of bytes in the input (actually specified as the number of octets , as systems could potentially use a byte that isn't eight bits long), also expressed as a decimal integer.

There are two major ways that one could use cksum to check the validity of a file. First, if you are transferring a file from one UNIX-like system to another, you could run cksum against it on both systems and check that the CRC and length are the same. The utility can also be given multiple filenames as arguments, which would generate a list that can then be compared. The second way would be for someone publishing a file or set of files to also publish the CRC values, lengths, and names so that people downloading them could verify that they match. However, I don't think the practice of publishing lists like this really started until more recent hash functions like MD5 and SHA-1 came about so it is unlikely that anyone would publish CRC values instead.

The advantage of these tools should be pretty obvious in comparison to cmp , one of the utilities discussed in UNIX Curio #8. To verify a file using cmp , you need two files to compare—if you're trying to check a large file you downloaded, you would need to spend the time and bandwidth to download a second copy. And if they didn't match, you would have no idea which of the two, if either, was correct. By contrast, cksum is quicker to run, doesn't require downloading a massive amount of excess data, and if run against the original file, makes clear what the correct value is.

This utility is a follow-on from a program called sum , which operated very much the same. I had a bit of trouble tracking down the exact development history, but what seems clear is that two different variants ⁴ were popular: a BSD version and a System V version. Both output 16-bit checksums, but used different algorithms so they didn't give the same results. Also, the BSD version printed the length of the input data as the number of 1,024-byte blocks, while the System V version instead gave a count of 512-byte blocks. (Some sources claim that System V sum generates a 32-bit checksum ⁵ , which could possibly be true internal to the algorithm, but I have tested several independent implementations of the utility and all of them output a 16-bit value for both the System V and BSD algorithms.)

From what I can tell, the BSD version ^6,7 came first; it was in 3BSD but probably appeared even earlier. An identical copy of BSD's sum was included with UNIX/32V ^8,9 , which was AT&T's 1979 port of Seventh Edition UNIX to the VAX and became one of the ancestors of System III. The divergence seems to have started with System III, released in 1980; its version of the sum utility ^10,11 changed to a new default algorithm, though it could be made to use the BSD algorithm via the -r option. System V looks to have kept the same behavior as System III. It's not clear to me why this algorithm is universally called the "System V algorithm" rather than the "System III algorithm"; perhaps it is because System V saw much more widespread use.

Instead of trying to reconcile these differences, the POSIX committee decided to create a new utility with a unique name, use a separate algorithm entirely, and avoid the block-length dispute by printing the length in octets instead of blocks. I should point out that POSIX states that the CRC algorithm for cksum does not strictly meet the mathematical definition of a "checksum". I don't know enough to say exactly why it doesn't qualify or to say whether either of the sum algorithms do. However, in less-formal usage the term "checksum" has gathered the meaning of any value used to represent or validate a set of data, so I am fine with using it no matter the technical details of the algorithm.

When two different inputs produce the same checksum or hash value, this is called a "collision". Because the output value has a limited range, there are an infinite number of possible inputs that could produce a collision. From a practical standpoint the possibilities are more limited—the majority of these inputs are larger than the number of atoms in the universe, which can't fit on any machine. Unlike a cryptographic hash algorithm, the CRC is not specifically designed to resist an attacker crafting a malicious input that would cause a collision. However, it should be sufficient to detect accidental damage.

Programs implementing more modern cryptographic hash algorithms are superior to the checksum utilities in avoiding collisions (whether malicious or accidental), but there are still three advantages that the older programs have. First, a system running a historical operating system might not have the hash programs available, but is more likely to have cksum or sum already included. Second, the checksum values are much shorter than the hashes output by the newer programs, making them easier for a user to compare by looking at them. This advantage is not as great as it might appear at first, because a common way to check a hash these days is to save a list of hashes and filenames—the hash programs can use that and do the comparison themselves, sparing the user from having to validate it character by character. The third advantage is that cksum prints the input length in bytes. This greatly limits the number of inputs that could be maliciously crafted to create a collision.

I did a moderate amount of research on implementations of modern cryptographic hash algorithms and found that some, such as MD5, SHA-1, and SHA-2, do use the length of the input (often termed "message length" in the literature) as part of the material fed in to the algorithm, but none of the hashing utilities present this length to the user as part of its output. There are two possible reasons for this that seem evident to me. First, if one is hashing a password, you would certainly not want to give a clear indication of its length—that would give any attacker a massive head start on guessing the password. However, that doesn't explain why one would avoid printing the input length for a file that is made publicly available. Second, it is convenient in many contexts, such as database entries or in software (such as git ), for the hash to be a fixed length. Including an extra value that can be of variable length would complicate those use cases. However, the length value could simply be dropped and they would be no worse off than they are currently.

Historically on UNIX, password hashing was treated differently from checksumming files— the crypt() function ¹² was used for passwords while sum and later cksum were used to confirm a file's integrity. So even rather early on, these two use cases employed algorithms with different properties, but I haven't dived into the history deeply enough to know how intentional this was. My discussion in this episode focuses on the file use case, so understand that I'm largely avoiding the topic of password hashing. Digital signatures are yet another use case, one that I'm ignoring entirely.

Every few years, some security researcher declares a particular hash algorithm to be "broken" and that everyone should move over to a new one, which generally has a longer hash. While the larger hash space certainly reduces the opportunity for collisions, this disrupts workflows, such as publishing information about software releases by e-mail, which still tends to observe a 78-character limit on each line ¹³ , making it harder to include a list of hashes with filenames next to them. This is in addition to the work of modifying software and scripts to use the new algorithm and managing how to treat past data. It seems to me that publishing the input length along with the hash would make it far more difficult to craft a malicious input that matches both, but I haven't found discussion of that during my investigation. (See the Appendix for a possible implementation.) Perhaps someone listening can record a response episode for HPR explaining that.

References:

Payment card number https://en.wikipedia.org/wiki/Payment_card_number
Ethernet frame: Frame check sequence https://en.wikipedia.org/wiki/Ethernet_frame#Frame_check_sequence
Cksum specification https://pubs.opengroup.org/onlinepubs/009695399/utilities/cksum.html
GNU coreutils manual: sum https://www.gnu.org/software/coreutils/manual/html_node/sum-invocation.html
FreeBSD 15.0 sum manual page https://man.freebsd.org/cgi/man.cgi?query=sum&sektion=1&manpath=FreeBSD+15.0-RELEASE+and+Ports
3BSD sum manual page https://www.tuhs.org/cgi-bin/utree.pl?file=3BSD/usr/man/man1/sum.1
3BSD sum source https://www.tuhs.org/cgi-bin/utree.pl?file=3BSD/usr/src/cmd/sum.c
UNIX/32V sum manual page https://www.tuhs.org/cgi-bin/utree.pl?file=32V/usr/man/man1/sum.1
UNIX/32V sum source https://www.tuhs.org/cgi-bin/utree.pl?file=32V/usr/src/cmd/sum.c
System III sum manual page https://www.tuhs.org/cgi-bin/utree.pl?file=SysIII/usr/src/man/man1/sum.1
System III sum source https://www.tuhs.org/cgi-bin/utree.pl?file=SysIII/usr/src/cmd/sum.c
Crypt specification https://pubs.opengroup.org/onlinepubs/009695399/functions/crypt.html
RFC 2822: Internet Message Format: Line Length Limits https://datatracker.ietf.org/doc/html/rfc2822#section-2.1.1
OpenSSH 10.1 released https://lwn.net/ml/all/dd12623ae86aa5eb@cvs.openbsd.org/

Appendix

The MD5 hash algorithm was (and still is) widely used, but many people characterize it as being "broken" and discourage its use. Let us imagine a variant of this, called MD5.L, where the normal MD5 hash is followed by a "." character and the input length expressed as a hexadecimal number.

Take, for example, the e-mail message announcing the release of OpenSSH 10.1 ¹⁴ . At the bottom, it includes an SHA-1 hash and an SHA-2 256-bit hash for the available gzipped tar files. That longer hash is encoded with Base64 because if it were given as a hexadecimal number, it would make the line longer than 78 bytes. The MD5.L hash of the file would be one character shorter than the SHA-1 hash, as shown below. (The extra length of the name makes them both consume the same number of characters. The hashes shown are for the "portable" version of OpenSSH.)

Some people claim SHA-1 is also broken, seeking to have people use newer and longer hash functions. For an attacker to compromise MD5.L in this example, they would not only have to create a valid tar file compressed with gzip containing a malicious payload having the right MD5 hash, that file would have to be exactly 1,972,831 bytes long (the decimal equivalent of 1e1a5f). While there are still many possible inputs that could be tried (256^1972831 , to be exact*), this is far fewer than the infinite possibilities for plain MD5, SHA-1, or SHA-2.

If for some reason it is super important to have a fixed hash length, let's imagine another variation called MD5+L. In this one, instead of L being the input length, it is the input length modulo one terabyte (2⁴⁰ bytes), which can be represented by 10 hexadecimal characters, left-padded with zeros. While this approach substantially increases the number of possible inputs an attacker could try, it is likely that an intended victim would notice that the file they downloaded is larger (or smaller) than expected by that much. The MD5+L hash is longer than a SHA-1 hash, but still shorter than a 256-bit SHA-2 hash.

SHA1 (openssh-10.1p1.tar.gz) = 7fd17b99d1beffb47cd380d64079e920bb0bd91f
SHA256 (openssh-10.1p1.tar.gz) = ufx6K4JXlGem8vQ+SoHI4d/aYU3bT5slWq/XAgu/B1g=
MD5.L (openssh-10.1p1.tar.gz) = 80dd9bb00a86519934710d05903fdf07.1e1a5f
MD5+L (openssh-10.1p1.tar.gz) = 80dd9bb00a86519934710d05903fdf07+00001e1a5f

Of course, if MD5 is considered to be too weak even with the inclusion of the length, one could produce a ".L" or "+L" version of any hash function. However, longer hashes will end up running into the 78-character limit.

*This is a number with 4.75 million digits that the bc utility on my laptop took almost 5 minutes to calculate.

Provide feedback on this episode.

Chrome Dev for Desktop Update

Mon, 06 Jul 2026 18:43:12 +0200

The Dev channel has been updated to 152.0.7928.2 for Windows, Mac and Linux.

Chrome Release Team
Google Chrome

The Nothing Ear 3(a) earbuds are almost here — and an unofficial leak just gave us an early look at them

Mon, 06 Jul 2026 17:18:57 +0200

The Nothing Ear 3(a) are launching tomorrow, and here's what to expect in terms of their design.

Is Big Tech Now Backpedaling on the AI Jobs Wipeout Scenario?

Mon, 06 Jul 2026 09:50:12 +0200

"A year ago, the message from many business leaders was that AI was going to wipe out jobs," remembers the Wall Street Journal.But "For the past month or so, tech CEOs have been striking a more optimistic tone." In late May, OpenAI Chief Executive Sam Altman — who has long predicted that AI will lead to seismic shifts in the workforce — said during a conference, "We've been roughly right on technological predictions and pretty wrong on the social and economic implications." Soon after, he told CNBC, "Our industry underestimated how much we're going to be able to keep people at the center of everything." Anthropic CEO Dario Amodei, who warned in May 2025 that artificial intelligence could eliminate half of entry-level jobs, a year later highlighted more positive scenarios for AI-adopting businesses: "They can do the same thing with less resources, and that leads to things like layoffs, or they can do more with the same amount of resources. But that requires creativity...." Is the sunnier outlook a move to win back customers and the public who are souring on AI's world-upending promise? Or is the role of AI in the workplace now just better understood...? Collectively, the narrative has shifted from worker-light doomsday scenarios caused by AI to a future in which workers keep their jobs — and get a productivity boost. The sentiment change isn't limited to tech leaders: A survey by EY-Parthenon found that the percentage of CEOs who believe AI investments will result in significant reductions in head count fell from around 46% in January 2025 to just 20% this May. "They may have noticed that the labor market is genuinely not changing (i.e., imploding) as rapidly as they expected," said David Autor, a professor of economics at the Massachusetts Institute of Technology. "They may have realized it was simply bad business to say that your great new product will destroy the economy." The article notes Amazon founder Jeff Bezos "has a history of predicting that AI will create new jobs," and in June said AI could even lead to a labor shortage. "When asked on CNBC in May about people being afraid of AI taking jobs, he said the reason they're afraid is because 'all these smart people keep saying that.'" The article then adds that "Fewer people are saying it now."

Read more of this story at Slashdot.

Artificial Extinction 2 Review (PC)

Mon, 06 Jul 2026 06:52:28 +0200

Tower defense games are very fun, but they also tend to be rather linear and with many restrictions due to the map you are playing on. And that’s where Artificial Extinction 2 steps into play, so it can provide you with a very interesting blend of FPS, strategy and tower defense. In my experience, Artificial Extinction 2 is around 70% tower defense and 30% FPS, which is great, because it adds the FPS mechanic to boost immersion, while also keeping those great tower defense roots. The game has a challenge mode, a good tutorial to teach you everything you need to know, and it also comes with a pretty impressive challenge mode. So, there’s no shortage of content there, which is great because if you like this blend of strategy and FPS, you will surely want to spend quite a bit of time with it. And there’s tons of stuff to enjoy here, that’s for sure. In Artificial Extinction 2, the premise is pretty interesting and also simple to understand. You have a base that you ne...

Ask Slashdot: Which Apps Aren't Available on Linux?

Sun, 05 Jul 2026 22:07:50 +0200

Read more of this story at Slashdot.

Vizio accidentally made the best dumb TV on the market

Sun, 05 Jul 2026 15:03:05 +0200

When I first started testing Vizio's 65-inch Mini LED Quantum TV, I thought the big story was that Vizio was back and that it had a quantum-dot TV for under $398 - the cheapest on the market. Vizio's been pretty quiet since it was acquired by Walmart in 2024, so putting out a TV with […]

VUP: Void User Packages

Sun, 05 Jul 2026 04:09:27 +0200

VUP is an unofficial Void Linux user repository. It keeps package work close to xbps-src: source templates are built in CI, release assets are exposed as XBPS repositories, and the website indexes what is available for each architecture.

The project is separate from Void Linux and does not try to replace XBPS, xbps-src, or the official repositories. It is plain repository plumbing for people who want binaries without maintaining a pile of fragile scripts.

https://voiduserpackages.org/

Basically, this is another alternative of installing softwares that are not found in official repos, but already in .xbps format. Unlike many third party xbps-src scripts found across github, VUP doesn't need to be compiled since it already comes with binary packages.

submitted by /u/Any_Mycologist5811
[link] [comments]

Matic’s robot vacuum is getting a $250 price hike in September

Sat, 04 Jul 2026 18:18:22 +0200

The Matic is our favorite robot vacuum by a pretty comfortable margin. If you’ve been thinking about buying one, you may want to plan on doing it sooner than later. The company will raise its price by $250 on September 9th, going from $1,245 to $1,495. Matic told The Verge that the new price reflects […]

'We can tune the bass to get more output, pretty much for free': I asked audio specialist Audeze about its patented SLAM system for headphones, and the slam-dunks kept a-coming

Fri, 03 Jul 2026 23:02:56 +0200

Audeze's SLAM tech was a breakthrough for the brand — but what exactly is it and how did it come to be? I asked the people who created it

Chrome Dev for Android Update

Fri, 03 Jul 2026 19:25:34 +0200

Hi everyone! We've just released Chrome Dev 152 (152.0.7924.0) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Chrome Beta for Desktop Update

Fri, 03 Jul 2026 19:25:33 +0200

The Chrome team is excited to announce the promotion of Chrome 151 to the Beta channel for Windows, Mac and Linux. Chrome 151.0.7922.10 contains our usual under-the-hood performance and stability tweaks, but there are also some cool new features to explore - please head to the Chromium blog to learn more!

Chrome Release Team
Google Chrome

How using a VPN can help you see location restricted content

Fri, 03 Jul 2026 05:09:09 +0200

One of the best VPNs for Mac will not only protect your data, but it also helps you avoid location-based restrictions. Here's how you can watch more TV shows and sports events.

Use a VPN for Mac to use the BBC iPlayer on an iPhone

The average consumer is pretty well catered to, when it comes to content consumption. With a wide selection of streaming services, broadcasters, and social media outlets at their fingertips, there's a lot to consume.

However, you can't always get what you want. Sometimes, the content you want to watch is offered through a streaming service you don't have any desire in using, or it's blocked off so it's only usable in certain countries.

Continue Reading on AppleInsider | Discuss on our Forums

Finally Switched to Wayland (This is gonna be a long one)

Fri, 03 Jul 2026 04:08:15 +0200

I finally had enough down time a couple of weeks ago to start the process of migrating to Wayland. I figured I'd share my experience for anyone who (like me) was/is concerned about how difficult the process may be or what changes may be required for someone who uses a more "niche" setup.

Context
My primary device is a Thinkpad X280. My backup is essentially a mirrored setup on a T480s. I've been using Arch/Arch derivatives for well over a decade now, and I'm currently on Artix Linux. My main X11 workflow was DWM (heavily patched) with the typical suite of supporting apps (dmenu, rofi, st, dunst, dwmblocks, etc). My daily workflow centers heavily around the tags system with simple startup scripts depending on which apps I need for work on any given day versus when I'm just using casual email/browsing apps. Most daily apps are assigned to specific tags and I HEAVILY depend on the ability to right click a tag to show it's windows on another tag temporarily (for example, pulling over a floating browser quickly to research something then sending it back to it's home tag when I'm done). The other important aspect is my use of a 3rd gen Lenovo thunderbolt dock for swapping to a dual display setup when needed for more complex work flows.

The Switch
I switched to MangoWM with waybar. The switch was relatively painless, as MangoWM is pretty much a prebuilt version of DWL with all the available patches most people would want, which is essentially the wayland version of DWM. I chose Mango of DWL mainly because the stagnant/slow development of DWL means it often falls behind current Wayland functionality, which is quite relevant since Wayland is VERY MUCH still a work-in-progress. The only real issues I ran into were configuring waybar and setting up tag/window rules. I eventually figured out the waybar stuff through reading docs and watching YouTube. Once figured out, it was quite simple to create a setup superior to my prior dwmblocks setup. The window rules were slightly more annoying because I learned that wayland identifies windows by their "appid" vs X11's method of using the "class". To make this more tedious, there's no true equivalent for xprop, so I had to learn how to use Mango's built-in IPC to find the appid I was looking for (grep will be very useful). Mango further complicates (or simplifies?) this by using a pseudo-fuzzy search algorithm for identifying the appid. For example, if I want to set a window rule for a PWA made through firefox, I don't have to quote the entire appid. I can just extract a unique string of characters from the appid and Mango will recognize it (pretty nifty once you get used to it).

Pros
I'll truncate this since the post is already unreasonably long.

Wayland is just smoother than X11/XLibre
Built in compositing removes the need for picom/fastcompmgr
Despite much of what I saw online before switching, resource usage is actually measurably less on my MangoWM setup vs my prior DWM setup
Battery life actually improved for me (anywhere between 30 mins to 1.5 hours depending on usage)
Many random X11-specific packages/config files are simply no longer necessary (xinit, xprop, XAUTHORITY, etc)
MangoWM is just more pleasant to use with the built in transparency, blur, and simpler animations. Animations aren't a must for me, but I do have fond memories of compiz when my browser opens with a subtle zoom effect versus just popping into place

Cons

Trying to run a system without xwayland comes with MANY compromises depending on your workflow
Many popular apps like virtualbox, steam, and bitwarden can't even launch without xwayland (which kinda feels like it defeats the purpose of moving away from X11). Zoom works, but completely messes with keyboard shortcuts, which led me to just switch to a PWA. I also swapped to a PWA for bitwarden, but didn't have simple alternatives to virtualbox and steam, so I ended up biting the bullet and installing xwayland
Some apps simply won't work - even with xwayland (spacefm and megasync for me). I was able to get around the megasyc issue by switching to megaCMD and I begrudgingly swapped back to PCManFM with gvfs for file management
While some "X11-specific" tools are no longer needed, their functionality simply isn't properly replicated for more advanced/niche workflows. For example, while "appid" is mostly a sufficient replacement for "Window Class" when setting up window rules, there are still some weird inconsistencies if you're used to the behavior under X11

There's a lot more that could be said, but this post already risks being reported because of the length, so here's the TLDR. Wayland is very much usable in 2026 and is actually a better general computing experience than X11 for me. However, it does require some compromises and changes in your workflow. Despite what the vocal minority online says, much of the functionality that wayland lacks in comparison to xorg is very hyper-specific and only a small subset of users cannot replicate or find a reasonable alternative on wayland. I still see significant value in X11/XLibre maintenance depending on your use case, but as for me and my house, we will be transitioning to wayland

submitted by /u/chozendude
[link] [comments]

Securing agentic identity

Fri, 03 Jul 2026 02:45:52 +0200

As is the case for many people working in the security industry, the last few months of my life have been focused on dealing with people wanting to use LLMs everywhere. From an enterprise security perspective that’s not an inherent problem - what’s more of a problem is that people want those agents to have access to resources like their calendar and email and so on, and now we have somewhat non-deterministic agents that seem very enthusiastic to achieve what you asked whether that’s a good idea or not, and we’re combining this with credentials that give them access to sensitive data, and leaving those credentials on disk where they can be committed into git repos or exfiltrated to some other service to make use of them on the agent’s behalf or well just any other number of things, at which point your CEO’s email is suddenly readable by everyone and you’re having a bad day.

As I mentioned in my last post, pretty much every strong mechanism for keeping credentials in place is just not supported in the wider world. We can imagine a universe where agents use hardware (or at least hypervisor) backed certificates to obtain credentials and any that end up leaking are worthless as a result. But, sadly, that’s not an option for most people using existing identity providers. The state of the art is that you use the device code flow and a human authenticates and the token ends up back inside the agent environment and then it proceeds to do whatever it wants with it and you just hope that you wake up the next morning without an awful infoleak occurring.

(An aside: I do not like the device code flow as used in enterprise environments, and I never will. The identity provider doesn’t have a real opportuity to inspect the security posture of the system asking for the token, and as a result some identity providers will restrict tokens that are issued in this way. The common alternative of doing stuff using a more standard flow and having a redirect URI pointing at localhost works fine for local systems and is a pain for remote ones, even if you can commit crimes with SSH forwarding. I’m going to suggest something that I think is better, and you are free to disagree)

I’m not in a position to get every identity provider and service provider to change their security posture, so I’m somewhat stuck in terms of the tokens they’re willing to issue me - largely either JWTs or opaque access tokens, with no support for any mechanism of binding that token to an instance. The token that’s going to have to be provided to the remote service is something I have little influence over. But that doesn’t mean I can’t influence the token that lands inside the agent’s environment. I can issue a placeholder token to the agent, and force it to communicate via a proxy that swaps out the placeholder for the real thing. The worst the agent can do is exfiltrate the placeholder token, and as long as malicious actors don’t have access to that proxy, it doesn’t matter - nobody else can do anything with the placeholder.

This isn’t a terribly novel insight, and it seems like almost everybody has reinvented this on their own. But a lot of these implementations involve you somehow obtaining the real token in advance and then pasting that into something that generates a placeholder that you provide to your agent environment somehow, and it’s all a bit clunky and awkward, and it also means that you need to deal with something that keeps track of the mapping between placeholders and real tokens and oh no we’ve just invented a secret store, and if you want this to work at scale and reliably you’re just invented a high availability distributed secret store, and a lot of people who’ve read that are now shaking their heads and reaching for gin. Can we simplify this, and improve security at the same time? I think we can!

Remember when I said “as long as malicious actors don’t have access to that proxy, it doesn’t matter”? What if they do? What if they compromise one machine inside your environment and are then able to email a bunch of employees and convince their agents to send more tokens back to them and then delete the email before a human reads it? Now you have someone inside the wall with access to those tokens, and presumably with access to the proxy, and now they can be anyone whose agent was gullible enough to think sending them a token was a good idea. This isn’t good!

So, I thought for a while, and I came up with a new idea. We can have a broker service that obtains credentials for us. We can run that centrally, away from the agents. A client in an agentic environment can request a token, and that can result in a URL being generated and the user being directed to open a URL in a browser and authenticate. When the user authenticates, the authentication flow redirects the confirmation back via the broker, and the broker obtains the real auth token. The obvious thing to do now would be to return the auth token to the client in the agentic environment, but we don’t do that. Instead, we mint a new JWT, and add a new claim - one that contains an encrypted copy of the token. In the process we can copy over all the original claims, because those aren’t secret - and now even if the client inspects the token to figure out what access it has, it’ll get a correct answer. We sign the new token with our own signing key, and pass that back to the client. The client now has a legitimate JWT that is utterly useless, because the signature isn’t trusted by anyone other than us.

How does it use it? It makes an API request via a proxy, including the new token in the Authorization: header. The proxy verifies the signature on the token, and then decrypts the original token and swaps out the fake token for the real one. The remote API sees what it expects, and everyone is happy. There’s never a real token in the agentic environment, but also we don’t need to store anyting anywhere. The only state is the encryption keys, and those can be injected into the environment at startup. You need to scale? Just start more of these processes. You need to support multiple availability zones? Just start more of these processes in different places. No persistent data is ever held in the broker or the proxy. You don’t need to care about distributed databases or secret stores.

This felt wonderfully elegant and I felt smug about coming up with a better idea, and then I went to a bar earlier this week and sat down to read RFC 8705 and the guy next to me saw that over my shoulder and asked what I was reading and I explained why I was interested and we talked about agentic identity and then he mentioned that fly.io had something that sounded very similar and I read that and gosh yes it is very similar, so damn you fly.io for stealing my ideas 3 years before I even had them. Anyway. Now I need to do better.

Remember that there’s still a risk around anyone who has access to the proxy having access to the encrypted keys? We can remove that risk as well. It’s not uncommon for agentic environments to have an identity issued via something like SPIFFE, at which point they have a client certificate. You can probably guess where I’m going with this. If we require that an agent present a client cert to the broker when requesting a token, we can embed a representation of that client cert into the token we mint. The proxy can then require mTLS for the client connection, and can verify that the presented certificate matches the one represented in the token. If it does then whoever’s using the token has access to the private key associated with the environment it was issued to. If we then ensure that the private keys backing these certificates are either hardware or hypervisor backed, and as such tied to a specific instance, we now have a high degree of confidence that the token can only be used in its intended environment. Even if our identity provider doesn’t support RFC 8705, we can.

This is fairly straightforward where you’re using a platform where your identity provider is also the environment that’s consuming your tokens, and more annoying for third parties. The broker potentially needs some amount of third party vendor knowledge to make that work for everyone. This is even more the case where login isn’t via your identity provider (thanks, github), but none of this is insurmountable - just annoying. And where vendors issue opaque tokens rather than JWTs, this still isn’t a problem; we can just mint a new JWT that includes the opaque token as an encrypted claim, and include the same certificate binding. The opaque token ends up being the thing that’s presented to the third party, but only after we’ve verified the mTLS binding.

In an ideal world none of this would be necessary - someone would spin up a new agentic environment, a user would prove their identity, and a certificate embodying that identity would be issued to the environment with a private key that can’t be exfiltrated. That certificate would be sufficient to obtain new certificates associated with the same private key, and we could still bind that into mTLS identity. This would be much simpler, but browsers don’t support it, so it’s not likely to happen any time soon.

Anyway. Even if we can’t have the best thing, we can do better than we are at the moment, and also it would be lovely if we could standardise on this rather than have everyone build their own thing. The end.

Maybe robots don't need legs or fingers to do laundry — Weave Robotics Isaac 1 isn't pretty or super-humanoid, but it might be ready to handle basic chores

Thu, 02 Jul 2026 21:47:43 +0200

Weave Robotics Isaac 1 is a legless robot body on a stalk that can fold laundry and do basic chores, all for $7999.

Chrome Beta for Android Update

Thu, 02 Jul 2026 19:10:03 +0200

Hi everyone! We've just released Chrome Beta 151 (151.0.7922.6) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Preventing token theft

Thu, 02 Jul 2026 08:31:40 +0200

When you log into a service you’re given an authentication token. Each further request to the site includes that token, allowing the server to figure out who you are and ensuring that you have access to your data. Depending on site policy, this token may either be stored in memory (and so vanish if you restart your browser) or disk. The token is the proof of your identity. As far as the site is concerned, anyone with your token is you. These tokens may be traditional browser cookies, but they may also be stored in either site local storage or (if you’re not using a browser) in some other storage location.

In recent years we’ve seen infostealer malware (like LummaC2) gain the ability to exfiltrate user tokens, allowing attackers to gain access to the user’s data without needing to retain access to the user’s machine. This attack is viable even if the site has strong MFA requirements, so passkeys don’t help. Encrypting the tokens on disk doesn’t prevent the malware from scraping them out of the browser’s RAM or obtaining whatever key is used to encrypt them. This feels like a pretty hard problem to solve.

But that hasn’t stopped people from trying! Dirk Balfanz wrote an IETF draft describing a mechanism for using self-signed certificates for TLS authentication. This uses the mutual authentication feature of the TLS protocol that requires both sides prove their identity to each other. In regular TLS, the remote site presents a signed certificate that tells you who it is. When performing mutual authentication, you then present a certificate to the remote site telling it who you are. These client certificates are largely unused outside enterprise environments because they’re a huge pain to deploy. It’s not so much that this has sharp edges, it’s that it’s entirely made of sharp edges. Managing certificate deployment to your devices is hard. Browsers get confused if the certificates change under them. You have one certificate and it lives forever, so sites you present it to can track your identity. Users are prompted to choose a certificate to authenticate with, and if they pick the wrong one everything breaks and is hard to recover. I’ve deployed this and I did not have a good time.

But Balfanz’s idea was simple. Rather than require certificates to be deployed, browsers would simply generate a certificate on the fly. The goal wasn’t to prove the device or user’s identity in any global way - but it would associate a TLS session with a specific certificate. You could then, for example, include a hash of the certificate in the cookie, and if someone tried to use that cookie without presenting that certificate then the cookie could be rejected. If the browser used a hardware-backed private key for the certificate then it would be impossible for an attacker to steal it. Sure, you could still steal cookies, but you wouldn’t be able to use them.

This was written almost 15 years ago, and seems simple, elegant, and functional. It didn’t happen. Part of the reason for that is that, well, it wasn’t quite so simple. One problem was privacy related. Cookies are only sent after the TLS session is established, so anyone monitoring the network doesn’t know anything about the user identity. A naive implementation of this approach would have meant the client certificate being sent before session establishment, and now user identity can be tracked (no longer an issue if this was implemented on top of TLS 1.3, but this was a log time ago). This was avoided by reordering the client handshake, but that meant having to modify the TLS specification and implementations would have to be updated to support this. Another was that figuring out the granularity of the certificates was difficult. You’d want to use different certificates for every site to avoid them effectively becoming tracking cookies, but you need to provide the certificate before cookies are set, and you don’t know what origin the site is going to set in its cookies. If you generate a certificate for a.example.com and a different one for b.example.com, and a.example.com sets a cookie for *.example.com and includes the certificate you used for a.example.com, that cookie isn’t going to work on b.example.com and things are broken. This meant supporting it wasn’t as straightforward as it seemed - you’d need to ensure that your cookie scope was compatible with the certificate scope. You could probably make this work well enough by aligning it with the Public Suffix List, but there was still some risk of expectations not being aligned.

And, perhaps most importantly, TLS session resumption (replaced by pre-shared keys in TLS 1.3) somewhat defeats the purpose of the exercise - clients store state that allows them to re-establish a TLS connection without performing certificate exchange (this reduces overhead if a connection gets interrupted or you switch to a new network or anything along those lines), and anyone in a position to steal cookies could steal that state as well.

The followup attempt was channel IDs. This simplified the implementation somewhat - rather than certificates, a raw public key would be sent, along with proof of possession of the private key in the form of a signature over a portion of the TLS handshake. This was required even in the event of session resumption, which avoided having to worry about theft of session secrets. The timing of the exchange was after the encrypted session had been established, so user identity couldn’t be leaked that way either. Cookies could then be bound to this identifier. Unfortunately it didn’t really deal with the problem of scoping keys in a way that would match cookie requirements, and the spec suggests that the right way of handling this is to scope keys to TLDs, which would enable user tracking across sites (Chrome’s implementation apparently restricted it to eTLD+1, which would match the third party cookie policy and avoid the tracking risk).

Chrome added support for this, but it was removed in early 2018. The discussion of some of the pain points in that message is interesting, explicitly calling out problems with connection coalescing across domains and the incompatibility with zero-RTT TLS1.3. The overall consensus at the time seems to be that trying to solve this entirely at the TLS layer has too many rough edges, and a different approach should be taken.

And so almost 7 years after the initial draft for origin bound certificates, we come to token binding. This ended up being a rather more complex endeavour, covering 3 different RFCs describing how it impacts TLS, how to incorporate it into HTTP, and how to manage all the various parties involved in the process. The short version is that it’s pretty similar to channel ID, except that there’s also a documented mechanism for allowing tokens to be bound to one party and consumed by another, avoiding any need for widely scoped keys. Token binding effectively solved all the issues in the original proposal, but at the cost of somewhat more complexity.

The RFC was finalised in October 2018. Chrome removed its (incomplete, draft) support for token binding in November 2018. Edge carried support until late 2024. Despite getting all the way through the RFC process, it’s functionally dead.

The process up until this point had been largely initiated by Google, with Microsoft contributing significantly to the token binding standards. The work had been focused on identifying a generic solution to the problem rather than tying it to any specific authentication flow. The next step was in a different direction - rather than trying to fix this for the entire internet, how about we try to fix it for OAuth?

RFC 8705 is titled “OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens”. This is basically the 2011 approach, but (a) with an explicit definition of how the certificate should be incorporated into issued auth cookies, and (b) with a proviso that well uh if you’re going to use tokens issued by your IdP to authenticate to someone else then well you’re going to need to use the same cert for both. This is probably fine for the company-owned-laptop case where you’re actually fine with multiple sites being able to tie identities together (that’s kind of the point here!), and also works for “I am using an app and not a browser”, but doesn’t work for more generic scenarios. It also doesn’t seem to take the session resumption case into account at all? Support for RFC8705 seems poor, as far as I can tell of the big players only Auth0 implements it. In theory it works fine with self-signed client certs but in reality that’s going to be almost as difficult to support across multiple platforms as just issuing proper client certs in the first place, so deployment is going to be kind of a pain. But the good news is it doesn’t rely on any TLS extensions or custom browser behaviour, so at the client side it works fine with any browser.

Which brings us on to RFC 9449, “Demonstrating Proof of Possession”. This goes even further than RFC8705 in terms of reducing the burden of deployment - it works fine with existing browsers, and it doesn’t even require any certs. The client generates a keypair and provides the pubkey when requesting the cookie. The cookie contains the pubkey. Every request to the service now provides the cookie with the pubkey and also provides a signature over the URI and HTTP method. If the signature matches the pubkey in the token then clearly the signature came from the machine the token was issued to, and everything is good.

This does come with some downsides, though. The first is that it uses browser interfaces to generate the keys (typically crypto.subtle.generatekey()) and as far as I can tell there are no browsers that guarantee that that key is going to be generated in hardware even if it’s marked non-exportable, so anyone able to steal the cookies can also steal the keys. The second is that the signature only covers the URI and HTTP method, and not the message content or any other headers, so anyone able to exfiltrate a valid signature can replay it against the same URI with different message content. The recommended way to handle this is to reject any signatures that weren’t generated within the last few seconds, which is a wonderful additional way to allow clock skew to give you a Bad Day. And the third is that every single request has to be separately signed, which is not intrinsically a problem because computers are fast and have multiple cores, but if you’re trying to solve the first problem by sticking the key in a TPM then you’re dealing with something that’s slow and single threaded and that’s maybe acceptable if you’re using client certificates (because there’s going to be one signature per session and you can use the same session for multiple requests) but probably not if you’re dealing with a user opening a browser that restores previous tabs and each of those is a webapp that fires off 100 requests in parallel.

In case it wasn’t clear, I don’t like DPoP. It doesn’t feel like it actually solves the underlying problem that we see in the real world (malware running in a context where if it can grab the tokens it can grab the keys), it adds a massive amount of overhead, and it has baked in replay vulnerabilities. I don’t know why it exists and I’m incredibly suspicious of vendors telling me that it fixes my problems, because if they’re telling me that then I’m going to end up assuming that they either don’t understand my problems or they don’t understand their technology, and neither of those is good.

Still. Then we get to the thing that prompted me to write this - Chrome’s announcement that they had launched device-bound session credentials. This is interesting because it’s a Chrome feature that’s explicitly intended to counter on-device malware, which was one of the things that was out of scope in 2018 when token binding was being removed. Since this is entire web level it doesn’t have to be an RFC, and so is instead defined by W3C. I’m going to handwave all the complexity and say that it’s basically a way to register a public key when a cookie is issued, and then prove possession of the private key when it’s time to renew the cookie. By making the cookies shortlived and having support for rotating them in the background, user impact is basically zero and while it’s still possible for an attacker to exfiltrate and use a cookie they’ll only be able to do so for a short window before it needs to be refreshed - something the attacker can’t do, since they don’t have the private key. This avoids the DPoP overhead because you only need to do signing once per cookie per cookie lifetime, and not on every single request. I don’t like this due to the window where exfiltrated tokens can be used, but it feels like a strict improvement over the status quo. An extension called device-bound session credentials for enterprise allows pre-enrollment of device keys, so even though the actual runtime DBCE flow doesn’t involve certificates, certificates can be used for device registration in enterprise environments and you can make sure that auth cookies only go to trusted devices. Unfortunately this is Chrome-only, and so we’re going to need to wait for it to be backported to all the random app frameworks for it to have widespread support on mobile or for almost everyone’s desktop app that’s actually three websites in an Electron wrapper. Mozilla’s current position is that they’re not in favour of it, so I guess we’ll see where Safari lands in terms of broad uptake.

The last thing on my list is another client cert/OAuth binding, this one still in draft state at the time of writing. This one is aimed primarily at the use of agent-driven tooling, where you have something running in the background using a whole bunch of tools that are each acting on your behalf. Authenticating to all of them separately isn’t a fun time, but giving broadly scoped access tokens to a non-deterministic agent and trusting that it’ll never post them somewhere public also isn’t a fun time. The key distinction between it and RFC8705 is that it’s aimed at connections rather than sessions, which avoids the worries about session resumption. This is done with TLS Exporters, which in TLS 1.3 should be unique to the connection even over session resumption (TLS 1.2 may reuse some of the same key material for exporters over session resumption, so it’s recommended to enforce 1.3 for this). By providing a new signature alongside the cookie on every new connection, the client proves that it still has access to the private key. This is a very new spec and I haven’t had much time to work through it yet, but my naive understanding is that unlike RFC8705 this would require some additional client support to be able to regenerate the client signature on every TLS reconnection.

This doesn’t avoid all the problems that RFC8705 has, including how to scope certificates. For the agentic use case that probably doesn’t matter - all these tools are acting on behalf of the same user, it’s fine if all the sites involved know they’re the same user. But it doesn’t solve the general purpose user use case, and right now DBSC seems like the best we have there.

But. Part of me still wonders whether Dirk Balfanz’s approach was the right one. Yes, there’s risk associated with TLS session resumption, but in the worst case you could just switch that off for high risk setups. The cookie scope argument is real, and also in cases where it could violate privacy the site owner could already choose to broaden their cookie scope and violate your privacy, and in cases where it breaks things you could just not make use of it. The other problems are largely fixed by TLS 1.3, and then we’re just left with “Browsers handle client certificates badly” to which my answer is “Yes, and we should fix that anyway”.

Despite having a pretty good answer to this solution over a decade ago, the closest we have to actual deployment is something that offers strictly worse security guarantees. And tokens keep getting stolen, and compromises keep occurring, and for the most part people shrug and get on with things.

Chrome Beta for iOS Update

Wed, 01 Jul 2026 18:37:09 +0200

Hi everyone! We've just released Chrome Beta 151 (151.0.7922.3) for iOS; it'll become available on App Store in the next few days.

You can see a partial list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

12 handy hidden Google Docs tricks for Android

Wed, 01 Jul 2026 11:47:57 +0200

Few apps are as essential to mobile productivity as the humble word processor. I think I’ve probably spent a solid seven years of my life staring at Google Docs on one device or another at this point, and those minutes only keep ticking up with practically every passing day.

While we can’t do much about the need to gaze at that word-filled white screen, what we can do is learn how to make every moment spent within Docs count — and in the Docs Android app, specifically, there are some pretty spectacular tucked-away time-savers just waiting to be discovered.

Make a mental note of these advanced shortcuts and options, and put ’em to good use the next time you find yourself staring at Docs on your own device.

Google Docs Android feature #1: Smarter document organization

We’ll save the best for, erm, first — ’cause the easily overlooked feature we’re kickin’ things off with can save you some serious time and make your mobile editing experience significantly easier.

After all, dealing with a complex document from your phone can be a real hassle. Who wants to waste time scrolling through endless-seeming screens to find the section of info you need to read, edit, or work on at any given moment?

I sure as heckfire don’t — and if you remember to use Docs’ out-of-the-way Outline option, you’ll never have to do it again, either. While viewing or editing any document with any sort of headers in it (be they actual header-formatted text or even just bolded section titles), tap the three-dot menu icon in Docs’ upper-right corner and then select “Document Outline.”

And by golly, wouldya look at that?

An automatic document outline is never out of reach in the Docs Android app.

JR Raphael, Foundry

Jumping to any part of the document is now just a single tap away.

[Psst: Love shortcuts? My Android Shortcut Supercourse will teach you tons of time-saving tricks for every single part of your smartphone experience. Sign up now for free!]

Google Docs Android feature #2: Instant tab access

Speaking of organization, in that same section of the in-document three-dot menu resides an easily overlooked option called “Document tabs.”

Tap it, and you can then see, manage, and move among any tabs created within the document for added organization — just like in the Docs desktop interface.

Who knew?! Your Google Docs tabs are now accessible within the Docs Android app as well.

JR Raphael, Foundry

Yes, please — and thank you.

Google Docs Android feature #3: Easier Word integration

When you’re working with clients, colleagues, or even camels who for some reason prefer the Microsoft editing ecosystem, you don’t have to do much to bridge that gap. The Docs Android app can already open and allow you to edit Word files, without any work — and with one simple flip of a switch, you can create new files in the .DOCX format just as easily.

To find the feature, you’ve gotta back out of any actual documents and get onto the main Docs screen — the screen with the search box at the top and all your documents listed out beneath it. Tap the three-line menu icon in the upper-left corner of that screen and head into the Settings section of that main menu. There, you should see the very switch we need:

Tick one toggle, and you can then create native Word files within the Docs Android app anytime.

JR Raphael, Foundry

Flip that into the on position, then back yourself out to the main Docs screen. The next time you tap the plus icon in that area’s lower-right corner, you should see “New Word file” show up as an option right above the default “New Docs file” command.

And just as a reminder, if you ever want to save an existing Docs file into the .DOCX format, you can do that, too: Tap the three-dot menu icon while editing a document, select “Share & export,” then select “Save As” and choose the “Word (.docx)” option.

Saving any document as a Word file is also easy, once you know where to look.

JR Raphael, Foundry

You can also save the file as a PDF or other common document format from that same menu.

Google Docs Android feature #4: The swift sender

While we’re thinkin’ about dealing with different document formats, download this into your long-term memory: The next time you need to save or send a document as an actual file — as opposed to an in-app, collaboration-ready Google Docs share — you can save yourself the trouble of downloading and then reuploading the thing and simply send it directly from the Docs Android app.

The trick is to once again tap that three-dot menu icon whilst editing a file and then select that same “Share & export” menu we just went over. But this time, instead of going with the “Save As” option, select “Send a copy.”

You can then pick from the same set of format choices we just finished exploring. And from there, Docs will allow you to choose from any compatible app on your device — everything from Android email and messaging apps to note-storing services like Notion and Trello.

Send any document into any other compatible app on your phone for a simplified sharing setup.

JR Raphael, Foundry

All it takes is one more tap from there, and your document will be on its way to the appropriate place in the format you requested — just like that.

Google Docs Android feature #5: The local file finder

Ever download a document onto your phone — be it from an email, a Slack channel, a website, or any other such source — and then later find yourself struggling to find it? Well, get this: Google’s got its own simple file finder ready and waiting for you right within the regular Docs app. Who woulda thunk, right?!

But oh, it be there, all righty. It’s that innocuous little folder icon within the search bar on the main Docs screen — something I must’ve seen about a thousand times before I ever thought to actually tap it.

Whoa — a built-in Docs file finder?!

JR Raphael, Foundry

When you do, the app will prompt you to find a saved file from either your local phone storage or from your online Drive storage. And once you select either option, you can browse through the associated place to see what’s there or search to find exactly what you’re after — no hopping over to a separate Android file manager required.

Google Docs Android feature #6: The Drive detour

Speaking of Google Drive, if you ever find yourself needing to mosey over to the full Drive interface to dig around more deeply or pull up a file that isn’t text-related, here’s a handy little secret:

You can actually fly from Docs directly to Drive without going through all the usual steps — y’know, heading back to your home screen, finding the Drive icon, and opening it up anew from there.

Just rely on the Docs app’s artfully hidden Drive shortcut to slash steps and zip straight between the two related interfaces. The option is quietly waiting for you within the three-line menu icon on the main Docs screen.

Docs and Drive — BFFs forever.

JR Raphael, Foundry

And now you know.

Google Docs Android feature #7: The account adjuster

Keep that overly moist eyeball of yours in that same area of the Docs app interface for a minute, ’cause we’ve got one more sneaky shortcut worth unearthing there.

It’s a shortcut baked into your face — or whatever sort of image you’ve got in place for your Google account profile photo, up in the app’s upper-right corner.

As is the case with most Google-made apps on Android these days, you can swipe up or down on that image to flip through any additional accounts you’ve got connected on your phone. If you only have a single account set up, this obviously won’t apply to you. But if you have, say, a personal Google account and a work address or even a few different situation-specific personal or work identities, it’s a splendid way to move between ’em with next to no effort and just a single swift swipe.

Google Docs Android feature #8: The direct document shortcut

Another shortcut worth burning into your brainspace: If you find yourself working on a specific document or set of documents frequently — whether they’re evolving documents you access all the time or just specific projects on your radar at one particular moment — save yourself the steps of opening the Docs app, finding ’em there, and then tapping their titles to get into ’em and instead give yourself one-tap shortcuts to open the files directly from your home screen.

The option to do that is pretty buried, but it’s well worth digging up. Start by finding the document in question on the main Docs screen. Long-press it, and then look way down on the menu that pops up for the “Add to home screen” command. (Depending on the size of your phone, you might have to scroll down that menu a bit before you’ll see it appear.)

You’ve usually gotta scroll to find it, but Docs’ “Add to home screen” option is there and ready to save you time.

JR Raphael, Foundry

Tap that bad boy and follow the prompt to place the shortcut wherever you want it — and say “hocus pocus” for good measure, if you’re feelin’ merry — and before you know it, you’ll have an app-like icon sitting right on your home screen. Tapping it will take you directly into the document you selected, without any extra steps required.

You could even get ambitious and create an entire folder on your home screen where you store a variety of high-priority or in-progress documents.

What’s up, Docs?

JR Raphael, Foundry

Three cheers for seconds saved!

Google Docs Android feature #9: Quick function shortcuts

Let’s keep our shortcut mojo goin’ for one more minute, shall we? You can actually follow that same pattern we just went over and and put shortcuts for common Docs commands like creating a new document or searching your existing documents right on your home screen, too. That way, you can perform the associated commands quickly and without any wasted effort opening up the app and hunting around for ’em — and what’s not to love about added efficiency?

These are actually part of Android’s oft-forgotten App Shortcuts system — the thing that came around way back with 2016’s Android 7.1 Nougat release and that’s still vexingly out of sight and out of mind for most of us.

Open up your app drawer, though, and find the Docs icon — or find the Docs icon on your home screen, if it’s there. Press and hold it, and you should see a series of options for direct shortcuts to actions within the app appear.

All sorts of helpful Docs options are accessible right from your home screen.

JR Raphael, Foundry

You can always get to those by long-pressing the Docs icon, but if you find yourself using the functions often, you can make it even easier by pressing and holding one of ’em within that pop-up menu and then dragging it directly onto your home screen for one-touch access.

You could even build yourself a nifty little Docs command center for super-fast access to all the stuff you use the most:

Docs, Docs, everywhere — so many options, never more than a tap away.

JR Raphael, Foundry

And while we’ve got easy access on our minds…

Google Docs Android feature #10: The offline on switch

By default, the Docs Android app will make any files you actively work within the app available for offline use for a while — but if you’re getting ready to travel or expecting any other connectivity-challenged moments, you don’t have to rely on its judgment to make sure your stuff is accessible even without internet access.

From the main Docs screen, tap the three-dot icon alongside any document name and then look for the “Make available offline” option within the menu that pops up.

Pro tip: Turn offline access on before the need actually arises.

JR Raphael, Foundry

Tap that for any document that you expect to need and then rest easy knowing it’ll be there and available for you — no matter your current connection status.

Google Docs Android feature #11: Wordless reactions

Sometimes, a picture really is worth a thousand words. Or at least a couple hundred.

That’s especially true when collaborating on a document and expressing your opinions — which, let’s be honest, often come down to simple reactions like 👍 or maybe 💩.

Docs has allowed emoji reactions as a part of its editing process for a while now, and at some point along the way, the Android app gained the same ability. It’s just weirdly tucked away in a place where few word-minded mammals would ever find it.

So do this: The next time you’re working on a shared doc, try pressing and holding your finger onto any word to highlight it. (You can then use the selector icons that pop up to expand or shift your selection, if needed.)

Now for the tricky part: In the menu that appears alongside your selection — the one that contains “Copy” and other such commands — look for the three-line icon at its far right side.

See that little three-line icon within the text actions pop-up?

JR Raphael, Foundry

Tap that — and lookie what we have here: the awkwardly hidden option to add an emoji reaction! 🥳

Emojis for everyone — hip, hip, hoorah!

JR Raphael, Foundry

Hit that sneaky little thing with all your might, then select the most appropriate reaction and move on with a satisfied 😊 in your mind.

Google Docs Android feature #12: Your in-doc AI

Generative AI these days is a bit of a mixed bag, to put it politely. Google’s Gemini and other such services are arguably causing more harm than good, on numerous levels, and also just creating paths for lazy, low-quality and accuracy-challenged work.

But in the right scenario and with the right sort of framing, Gemini-style AI can actually be useful. The onus just falls squarely on you to determine how to most effectively use it and avoid falling into the traps of unoriginality or, worse, inaccuracy.

The Docs Android app now offers a direct shortcut to Gemini within its editing interface — via the starburst-shaped icon in the toolbar at the top of the screen — and with some careful considering, it might just end up being a helpful reading or editing tool for you.

A few suggestions that notably don’t involve having AI write lazy, uninspired copy on your behalf:

You can use the Gemini in Docs system as a quick ‘n’ easy way to get a definition or list of synonyms for any word in front of you.
You can also use it to ask for context or related information — like an integrated research aide. (Just remember that AI doesn’t always get things right, so treat it as more of a starting point than a final quote-ready answer.)
And you can lean on it to perform tasks like summarizing or outlining a long document or helping you reorganize a document into a more logical state.

Gemini is now available directly within Docs. Please, use it wisely.

JR Raphael, Foundry

You may still end up spending a ton of time in Docs, but at least now you’ll make the most of every second there and avoid wasting your effort on piddly little tasks that can be made more efficient. And that, as far as I’m concerned, warrants an enthusiastic 🥂 reaction — maybe even followed by a well-earned 🍪.

Get six full days of advanced Android knowledge with my free Android Shortcut Supercourse. You’ll learn tons of time-saving tricks for your phone!

Why Ask Credentials If There Are Secret Codes?, (Wed, Jul 1st)

Wed, 01 Jul 2026 07:53:57 +0200

This morning, an interesting phishing email hit my mailbox. It targets Metamask[1], a cryptocurrency wallet, available as a browser extension and a mobile app, that lets users store, send, and receive crypto money. It's pretty popular, so a juicy target…

The post Why Ask Credentials If There Are Secret Codes?, (Wed, Jul 1st) appeared first on IT Security News.

Why Ask Credentials If There Are Secret Codes?, (Wed, Jul 1st)

Wed, 01 Jul 2026 07:22:13 +0200

Built a port of libfetch for GNU/Linux

Wed, 01 Jul 2026 03:39:07 +0200

libfetch is a GNU/Linux port of the FreeBSD userland utility similar to Wget. I created it because I really didn’t like how heavy Wget is, and I didn’t have the knowledge to write it from scratch so I decided to port it. It’s pretty lightweight compared to Wget. (Idk why reddit decided to embed my gitea pfp)

submitted by /u/IncidentSpecial5053
[link] [comments]

How to Install Kodi on a Smart TV

Wed, 01 Jul 2026 03:38:33 +0200

Your smart TV is the heart of your home entertainment center; why not boost its streaming power with Kodi? If you’re ready to access a whole world of new TV shows, live streams, movies, music and more, this guide is for you. It’s pretty easy to install Kodi on smart TV devices–just follow our step-by-step […]

The post How to Install Kodi on a Smart TV appeared first on AddictiveTips.

How to Watch Live Boxing on the Firestick

Wed, 01 Jul 2026 03:38:30 +0200

Firestick is an extremely convenient way to stream content, and it’s well-suited to viewing live boxing. Today, we show you a few proven methods to watch boxing on Firestick, including both official Fire TV channels and unofficial workarounds via Kodi. Amazon’s Fire TV and Fire Stick devices are the perfect ways to stream live video […]

The post How to Watch Live Boxing on the Firestick appeared first on AddictiveTips.

Stable Channel Update for Desktop

Wed, 01 Jul 2026 01:08:29 +0200

The Chrome team is delighted to announce the promotion of Chrome 151 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.

Chrome 150.0.7871.46 (Linux) 150.0.7871.46/.47 Windows/Mac contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 151.

Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 382 security fixes. Please see the Chrome Security Page for more information.
[N/A][506558270] Critical CVE-2026-13774: Use after free in Extensions. Reported by Google on 2026-04-26
[N/A][511766407] Critical CVE-2026-13775: Use after free in GPU. Reported by Google on 2026-05-10
[N/A][513012139] Critical CVE-2026-13776: Type Confusion in Dawn. Reported by Google on 2026-05-14
[N/A][513128566] Critical CVE-2026-13777: Insufficient validation of untrusted input in iOSWeb. Reported by Google on 2026-05-14
[N/A][513167952] Critical CVE-2026-13778: Use after free in WebUSB. Reported by Google on 2026-05-14
[N/A][513222854] Critical CVE-2026-13779: Use after free in Chromoting. Reported by Google on 2026-05-14
[N/A][514769383] Critical CVE-2026-13780: Insufficient validation of untrusted input in ANGLE. Reported by Google on 2026-05-19
[N/A][516457532] Critical CVE-2026-13781: Insufficient validation of untrusted input in Skia. Reported by Google on 2026-05-25
[N/A][516683433] Critical CVE-2026-13782: Use after free in Browser. Reported by Google on 2026-05-26
[N/A][516962178] Critical CVE-2026-13783: Use after free in Views. Reported by Google on 2026-05-27
[N/A][516962715] Critical CVE-2026-13784: Use after free in Views. Reported by Google on 2026-05-27
[N/A][517021684] Critical CVE-2026-13785: Use after free in Bluetooth. Reported by Google on 2026-05-27
[N/A][518007821] Critical CVE-2026-13786: Use after free in Ozone. Reported by Google on 2026-05-29
[N/A][522919313] Critical CVE-2026-13787: Use after free in Chromoting. Reported by Google on 2026-06-11
[N/A][523119897] Critical CVE-2026-13788: Use after free in Fullscreen. Reported by Google on 2026-06-12
[$36000][493847920] High CVE-2026-13789: Use after free in GPU. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-18
[$10000][457771782] High CVE-2026-13790: Side-channel information leakage in Scroll. Reported by Vsevolod Kokorin (Slonser) of Solidlab and Jorian Woltjer on 2025-11-04
[$10000][503850012] High CVE-2026-13791: Insufficient validation of untrusted input in Downloads. Reported by Ron Masas (Imperva) on 2026-04-17
[$4000][496012368] High CVE-2026-13792: Use after free in Touchbar. Reported by Weipeng Jiang (@Krace) of VRI on 2026-03-25
[$3000][510829679] High CVE-2026-13793: Insufficient policy enforcement in SVG. Reported by pakhunov.anton.n@gmail.com on 2026-05-07
[$2500][513893425] High CVE-2026-13794: Insufficient validation of untrusted input in WebAppInstalls. Reported by Daniel Rodríguez on 2026-05-16
[$2000][476591032] High CVE-2026-13795: Insufficient policy enforcement in Chrome for iOS. Reported by maitai on 2026-01-17
[N/A][491894115] High CVE-2026-13796: Integer overflow in Chromecast. Reported by Google on 2026-03-11
[N/A][499025645] High CVE-2026-13797: Insufficient validation of untrusted input in Chromecast. Reported by Google on 2026-04-02
[N/A][499048914] High CVE-2026-13798: Heap buffer overflow in Chromecast. Reported by Google on 2026-04-02
[N/A][499252371] High CVE-2026-13799: Use after free in QUIC. Reported by Google on 2026-04-03
[N/A][500108770] High CVE-2026-13800: Inappropriate implementation in Updater. Reported by Google on 2026-04-06

[N/A][500587568] High CVE-2026-13801: Integer overflow in Chromecast. Reported by Google on 2026-04-08

[N/A][501623322] High CVE-2026-13802: Use after free in Views. Reported by Google on 2026-04-11
[N/A][501669642] High CVE-2026-13803: Type Confusion in Chrome Tabs. Reported by Google on 2026-04-11
[N/A][501873032] High CVE-2026-13804: Use after free in Chromecast. Reported by Google on 2026-04-12
[N/A][502282040] High CVE-2026-13805: Use after free in GFX. Reported by Google on 2026-04-13
[N/A][503333798] High CVE-2026-13806: Insufficient validation of untrusted input in Accessibility. Reported by Google on 2026-04-16
[N/A][504194494] High CVE-2026-13807: Use after free in Import. Reported by Google on 2026-04-19
[N/A][504221510] High CVE-2026-13808: Insufficient data validation in Chrome for iOS. Reported by Google on 2026-04-19
[N/A][504222227] High CVE-2026-13809: Side-channel information leakage in Safe Browsing. eported by Google on 2026-04-19
[TBD][504600482] High CVE-2026-13810: Inappropriate implementation in Input. Reported by dilipsc03@gmail.com on 2026-04-20
[N/A][506149253] High CVE-2026-13811: Use after free in IME. Reported by Google on 2026-04-24
[N/A][508293203] High CVE-2026-13812: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-04-30
[N/A][508462149] High CVE-2026-13813: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-05-01
[N/A][511712766] High CVE-2026-13814: Use after free in Views. Reported by Google on 2026-05-10
[N/A][511722207] High CVE-2026-13815: Use after free in Blink. Reported by Google on 2026-05-10
[N/A][511735715] High CVE-2026-13816: Insufficient validation of untrusted input in File Input. Reported by Google on 2026-05-10
[N/A][511739631] High CVE-2026-13817: Insufficient validation of untrusted input in Glic. Reported by Google on 2026-05-10
[N/A][511823182] High CVE-2026-13818: Inappropriate implementation in Passwords. Reported by Google on 2026-05-10
[N/A][512962749] High CVE-2026-13819: Out of bounds read in ANGLE. Reported by Google on 2026-05-13
[N/A][512986879] High CVE-2026-13820: Out of bounds read in Skia. Reported by Google on 2026-05-13
[N/A][513142445] High CVE-2026-13821: Use after free in Canvas. Reported by Google on 2026-05-14
[N/A][513148038] High CVE-2026-13822: Inappropriate implementation in Extensions. Reported by Google on 2026-05-14
[N/A][513163011] High CVE-2026-13823: Use after free in Glic. Reported by Google on 2026-05-14
[N/A][513177497] High CVE-2026-13824: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-05-14
[N/A][513209610] High CVE-2026-13825: Uninitialized Use in Dawn. Reported by Google on 2026-05-14
[N/A][513237800] High CVE-2026-13826: Inappropriate implementation in Autofill. Reported by Google on 2026-05-14
[N/A][513371963] High CVE-2026-13827: Use after free in Updater. Reported by Google on 2026-05-15
[N/A][513399832] High CVE-2026-13828: Inappropriate implementation in Enterprise. Reported by Google on 2026-05-15
[N/A][513490996] High CVE-2026-13829: Insufficient validation of untrusted input in Settings. Reported by Google on 2026-05-15
[N/A][513727494] High CVE-2026-13830: Use after free in Chromoting. Reported by Google on 2026-05-16
[N/A][513781328] High CVE-2026-13831: Use after free in GPU. Reported by Google on 2026-05-16
[N/A][513822378] High CVE-2026-13832: Use after free in Headless. Reported by Google on 2026-05-16
[N/A][513920082] High CVE-2026-13833: Uninitialized Use in ANGLE. Reported by Google on 2026-05-17
[N/A][513925114] High CVE-2026-13834: Insufficient validation of untrusted input in ANGLE. Reported by Google on 2026-05-17
[N/A][514338102] High CVE-2026-13835: Inappropriate implementation in XML. Reported by Google on 2026-05-18
[N/A][514420555] High CVE-2026-13836: Inappropriate implementation in CSS. Reported by Google on 2026-05-18
[N/A][514429130] High CVE-2026-13837: Inappropriate implementation in CSS. Reported by Google on 2026-05-18
[N/A][514445398] High CVE-2026-13838: Inappropriate implementation in CSS. Reported by Google on 2026-05-18
[N/A][514449396] High CVE-2026-13839: Inappropriate implementation in CSS. Reported by Google on 2026-05-18
[TBD][514609778] High CVE-2026-13840: Insufficient policy enforcement in Canvas. Reported by Binglin Song on 2026-05-19
[N/A][515467789] High CVE-2026-13841: Integer overflow in Skia. Reported by Google on 2026-05-21
[TBD][516836297] High CVE-2026-13842: Incorrect security UI in Chrome for iOS. Reported by Azza Tegar Naufal Ataullah on 2026-05-26
[N/A][516869032] High CVE-2026-13843: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-05-26
[N/A][516926115] High CVE-2026-13844: Use after free in Updater. Reported by Google on 2026-05-27
[N/A][516936863] High CVE-2026-13845: Use after free in DOM. Reported by Google on 2026-05-27
[N/A][516999424] High CVE-2026-13846: Use after free in USB. Reported by Google on 2026-05-27
[N/A][517073397] High CVE-2026-13847: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-05-27
[N/A][517345069] High CVE-2026-13848: Use after free in Forms. Reported by Google on 2026-05-28
[N/A][517351411] High CVE-2026-13849: Insufficient validation of untrusted input in Chromoting. Reported by Google on 2026-05-28
[N/A][517610676] High CVE-2026-13850: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-05-28
[N/A][519692255] High CVE-2026-13851: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-06-03
[N/A][522560124] High CVE-2026-13852: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-06-11
[N/A][523224019] High CVE-2026-13853: Use after free in Journeys. Reported by Google on 2026-06-12
[N/A][523690961] High CVE-2026-13854: Use after free in Ozone. Reported by Google on 2026-06-13
[N/A][524395469] High CVE-2026-13855: Use after free in Ozone. Reported by Google on 2026-06-16
[$8000][508092634] Medium CVE-2026-13856: Insufficient validation of untrusted input in Speech. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-30
[$5000][479203484] Medium CVE-2026-13857: Inappropriate implementation in Geometry. Reported by Luan Herrera (@lbherrera_) on 2026-01-27
[$3000][507090179] Medium CVE-2026-13858: Out of bounds read in FFmpeg. Reported by Wongi Lee (@_qwerty_po) of Theori with Xint Code, Jungwoo Lee (@physicube) on 2026-04-27
[$2000][484756087] Medium CVE-2026-13859: Inappropriate implementation in ANGLE. Reported by Jason Villaluna on 2026-02-15
[$1000][417052041] Medium CVE-2026-13860: Incorrect security UI in Autofill. Reported by Khalil Zhani on 2025-05-12
[N/A][495456765] Medium CVE-2026-13861: Use after free in Core. Reported by Google on 2026-03-23
[N/A][495897416] Medium CVE-2026-13862: Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys). Reported by Google on 2026-03-24
[N/A][496012495] Medium CVE-2026-13863: Insufficient validation of untrusted input in CustomTabs. Reported by Google on 2026-03-25
[N/A][496399913] Medium CVE-2026-13864: Insufficient policy enforcement in WebHID. Reported by Google on 2026-03-26
[N/A][497090912] Medium CVE-2026-13865: Insufficient validation of untrusted input in Enterprise. Reported by Google on 2026-03-28
[N/A][497207698] Medium CVE-2026-13866: Insufficient validation of untrusted input in Input. Reported by Google on 2026-03-28
[N/A][497345177] Medium CVE-2026-13867: Inappropriate implementation in Geolocation. Reported by Google on 2026-03-29
[N/A][497453475] Medium CVE-2026-13868: Inappropriate implementation in Network. Reported by Google on 2026-03-29
[N/A][497610642] Medium CVE-2026-13869: Use after free in Device. Reported by Google on 2026-03-30
[N/A][497634837] Medium CVE-2026-13870: Use after free in WebView. Reported by Google on 2026-03-30
[N/A][497961376] Medium CVE-2026-13871: Insufficient data validation in GuestView. Reported by Google on 2026-03-30
[N/A][497977983] Medium CVE-2026-13872: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-03-31
[N/A][498085466] Medium CVE-2026-13873: Out of bounds memory access in Layout. Reported by Google on 2026-03-31
[N/A][498411773] Medium CVE-2026-13874: Inappropriate implementation in DataTransfer. Reported by Google on 2026-04-01
[N/A][498721671] Medium CVE-2026-13875: Insufficient validation of untrusted input in GPU. Reported by Google on 2026-04-01
[N/A][498722200] Medium CVE-2026-13876: Inappropriate implementation in Network. Reported by Google on 2026-04-01
[N/A][498820206] Medium CVE-2026-13877: Insufficient validation of untrusted input in ANGLE. Reported by Google on 2026-04-02
[N/A][499007266] Medium CVE-2026-13878: Use after free in Bluetooth. Reported by Google on 2026-04-02
[N/A][499022239] Medium CVE-2026-13879: Use after free in Bluetooth. Reported by Google on 2026-04-02
[N/A][499025880] Medium CVE-2026-13880: Use after free in USB. Reported by Google on 2026-04-02
[N/A][499100491] Medium CVE-2026-13881: Insufficient data validation in WebAppInstalls. Reported by Google on 2026-04-03
[N/A][499162550] Medium CVE-2026-13882: Inappropriate implementation in USB. Reported by Google on 2026-04-03
[N/A][500030250] Medium CVE-2026-13883: Type Confusion in ANGLE. Reported by Google on 2026-04-06
[N/A][500077014] Medium CVE-2026-13884: Heap buffer overflow in Chromecast. Reported by Google on 2026-04-06
[N/A][500474409] Medium CVE-2026-13885: Use after free in Skia. Reported by Google on 2026-04-07
[N/A][500475136] Medium CVE-2026-13886: Policy bypass in Isolated Web Apps. Reported by Google on 2026-04-07
[N/A][500508524] Medium CVE-2026-13887: Insufficient policy enforcement in NFC. Reported by Google on 2026-04-08
[N/A][500566906] Medium CVE-2026-13888: Use after free in Extensions. Reported by Google on 2026-04-08
[N/A][500588580] Medium CVE-2026-13889: Insufficient validation of untrusted input in WebAuthentication. Reported by Google on 2026-04-08
[N/A][500601345] Medium CVE-2026-13890: Out of bounds read in Chromecast. Reported by Google on 2026-04-08
[N/A][501631475] Medium CVE-2026-13891: Insufficient validation of untrusted input in Extensions. Reported by Google on 2026-04-11
[N/A][501674841] Medium CVE-2026-13892: Inappropriate implementation in Chrome for iOS. Reported by Google on 2026-04-11
[N/A][501729582] Medium CVE-2026-13893: Insufficient validation of untrusted input in WebUI. Reported by Google on 2026-04-11
[N/A][501741117] Medium CVE-2026-13894: Insufficient policy enforcement in Network. Reported by Google on 2026-04-11
[N/A][501770542] Medium CVE-2026-13895: Inappropriate implementation in Autofill. Reported by Google on 2026-04-12
[N/A][501820076] Medium CVE-2026-13896: Insufficient policy enforcement in Glic. Reported by Google on 2026-04-12
[N/A][501877896] Medium CVE-2026-13897: Insufficient policy enforcement in Chromecast. Reported by Google on 2026-04-12
[N/A][501925480] Medium CVE-2026-13898: Use after free in Cast Receiver. Reported by Google on 2026-04-12
[N/A][502109002] Medium CVE-2026-13899: Use after free in HTML. Reported by Google on 2026-04-13
[N/A][502374993] Medium CVE-2026-13900: Insufficient validation of untrusted input in Chromecast. Reported by Google on 2026-04-14
[N/A][503585173] Medium CVE-2026-13901: Insufficient validation of untrusted input in Serial. Reported by Google on 2026-04-17
[N/A][503725717] Medium CVE-2026-13902: Inappropriate implementation in Chrome for iOS. Reported by Google on 2026-04-17
[N/A][503912196] Medium CVE-2026-13903: Insufficient policy enforcement in Bluetooth. Reported by Google on 2026-04-18
[N/A][504185807] Medium CVE-2026-13904: Incorrect security UI in Safe Browsing. Reported by Google on 2026-04-19
[N/A][504192688] Medium CVE-2026-13905: Incorrect security UI in Chrome for iOS. Reported by Google on 2026-04-19
[N/A][504613867] Medium CVE-2026-13906: Out of bounds read in Codecs. Reported by Google on 2026-04-20
[N/A][505156685] Medium CVE-2026-13907: Inappropriate implementation in iOSWeb. Reported by Google on 2026-04-22
[N/A][505242189] Medium CVE-2026-13908: Insufficient validation of untrusted input in Omnibox. Reported by Google on 2026-04-22
[N/A][505933538] Medium CVE-2026-13909: Insufficient policy enforcement in DevTools. Reported by Google on 2026-04-24
[N/A][507231605] Medium CVE-2026-13910: Insufficient policy enforcement in WebXR. Reported by Google on 2026-04-28
[N/A][507239830] Medium CVE-2026-13911: Insufficient data validation in Spellcheck. Reported by Google on 2026-04-28
[N/A][508259433] Medium CVE-2026-13912: Incorrect security UI in Safe Browsing. Reported by Google on 2026-04-30
[N/A][508260619] Medium CVE-2026-13913: Insufficient policy enforcement in Autofill. Reported by Google on 2026-04-30
[N/A][508273690] Medium CVE-2026-13914: Inappropriate implementation in Passwords. Reported by Google on 2026-04-30
[N/A][508275293] Medium CVE-2026-13915: Use after free in Chrome for iOS. Reported by Google on 2026-04-30
[N/A][508283108] Medium CVE-2026-13916: Inappropriate implementation in Chrome for iOS. Reported by Google on 2026-04-30
[N/A][508286935] Medium CVE-2026-13917: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-04-30
[N/A][509712284] Medium CVE-2026-13918: Use after free in Chrome for iOS. Reported by Google on 2026-05-05
[N/A][511249430] Medium CVE-2026-13919: Insufficient data validation in Extensions. Reported by Google on 2026-05-08
[N/A][511722559] Medium CVE-2026-13920: Insufficient validation of untrusted input in Media. Reported by Google on 2026-05-10
[N/A][511738175] Medium CVE-2026-13921: Insufficient validation of untrusted input in DeviceBoundSessionCredentials. Reported by Google on 2026-05-10
[N/A][511748106] Medium CVE-2026-13922: Side-channel information leakage in Paint. Reported by Google on 2026-05-10
[N/A][511772034] Medium CVE-2026-13923: Uninitialized Use in GPU. Reported by Google on 2026-05-10
[N/A][511784747] Medium CVE-2026-13924: Insufficient validation of untrusted input in WebView. Reported by Google on 2026-05-10
[N/A][511802911] Medium CVE-2026-13925: Inappropriate implementation in Downloads. Reported by Google on 2026-05-10
[N/A][511814550] Medium CVE-2026-13926: Insufficient validation of untrusted input in Network. Reported by Google on 2026-05-10
[N/A][511826446] Medium CVE-2026-13927: Insufficient validation of untrusted input in UI. Reported by Google on 2026-05-10
[N/A][512162479] Medium CVE-2026-13928: Insufficient validation of untrusted input in Enterprise. Reported by Google on 2026-05-11
[TBD][512249559] Medium CVE-2026-13929: Insufficient validation of untrusted input in DevTools. Reported by LegioSec on 2026-05-12
[N/A][512937764] Medium CVE-2026-13930: Insufficient policy enforcement in Actor. Reported by Google on 2026-05-13
[N/A][512997441] Medium CVE-2026-13931: Inappropriate implementation in Media. Reported by Google on 2026-05-13
[N/A][513001690] Medium CVE-2026-13932: Inappropriate implementation in Sharing. Reported by Google on 2026-05-14
[N/A][513002625] Medium CVE-2026-13933: Insufficient policy enforcement in Passwords. Reported by Google on 2026-05-14
[N/A][513006636] Medium CVE-2026-13934: Insufficient validation of untrusted input in Dawn. Reported by Google on 2026-05-14
[N/A][513009005] Medium CVE-2026-13935: Side-channel information leakage in ComputePressure. Reported by Google on 2026-05-14
[N/A][513044658] Medium CVE-2026-13936: Inappropriate implementation in Passwords. Reported by Google on 2026-05-14
[N/A][513046494] Medium CVE-2026-13937: Insufficient policy enforcement in Passwords. Reported by Google on 2026-05-14
[N/A][513143921] Medium CVE-2026-13938: Integer overflow in Fonts. Reported by Google on 2026-05-14
[N/A][513149760] Medium CVE-2026-13939: Insufficient validation of untrusted input in WebShare. Reported by Google on 2026-05-14
[N/A][513158425] Medium CVE-2026-13940: Uninitialized Use in Cast. Reported by Google on 2026-05-14
[N/A][513183855] Medium CVE-2026-13941: Inappropriate implementation in SiteSettings. Reported by Google on 2026-05-14
[N/A][513186670] Medium CVE-2026-13942: Insufficient validation of untrusted input in Video Capture. Reported by Google on 2026-05-14
[N/A][513204116] Medium CVE-2026-13943: Uninitialized Use in CSS. Reported by Google on 2026-05-14
[N/A][513224212] Medium CVE-2026-13944: Inappropriate implementation in DataTransfer. Reported by Google on 2026-05-14
[N/A][513226551] Medium CVE-2026-13945: Insufficient policy enforcement in Extensions. Reported by Google on 2026-05-14
[N/A][513274039] Medium CVE-2026-13946: Inappropriate implementation in ScriptInjections. Reported by Google on 2026-05-14
[N/A][513280648] Medium CVE-2026-13947: Uninitialized Use in XR. Reported by Google on 2026-05-14
[N/A][513286820] Medium CVE-2026-13948: Insufficient policy enforcement in Extensions. Reported by Google on 2026-05-14
[N/A][513311569] Medium CVE-2026-13949: Insufficient policy enforcement in Payments. Reported by Google on 2026-05-14
[N/A][513360781] Medium CVE-2026-13950: Uninitialized Use in GPU. Reported by Google on 2026-05-15
[N/A][513394321] Medium CVE-2026-13951: Policy bypass in USB. Reported by Google on 2026-05-15
[N/A][513401808] Medium CVE-2026-13952: Inappropriate implementation in PerformanceAPIs. Reported by Google on 2026-05-15
[N/A][513459192] Medium CVE-2026-13953: Inappropriate implementation in SplitView. Reported by Google on 2026-05-15
[N/A][513504934] Medium CVE-2026-13954: Insufficient policy enforcement in XML. Reported by Google on 2026-05-15
[N/A][513508305] Medium CVE-2026-13955: Insufficient validation of untrusted input in CustomTabs. Reported by Google on 2026-05-15
[N/A][513515168] Medium CVE-2026-13956: Incorrect security UI in PageInfo. Reported by Google on 2026-05-15
[N/A][513553557] Medium CVE-2026-13957: Incorrect security UI in Extensions. Reported by Google on 2026-05-15
[N/A][513567306] Medium CVE-2026-13958: Uninitialized Use in Codecs. Reported by Google on 2026-05-15
[N/A][513609249] Medium CVE-2026-13959: Insufficient validation of untrusted input in Blink. Reported by Google on 2026-05-15
[N/A][513714023] Medium CVE-2026-13960: Inappropriate implementation in Passwords. Reported by Google on 2026-05-16
[N/A][513719481] Medium CVE-2026-13961: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-05-16
[N/A][513721370] Medium CVE-2026-13962: Insufficient data validation in PDF. Reported by Google on 2026-05-16
[N/A][513727626] Medium CVE-2026-13963: Inappropriate implementation in DevTools. Reported by Google on 2026-05-16
[N/A][513735096] Medium CVE-2026-13964: Insufficient policy enforcement in WebView. Reported by Google on 2026-05-16
[N/A][513737952] Medium CVE-2026-13965: Use after free in Oilpan. Reported by Google on 2026-05-16
[N/A][513741393] Medium CVE-2026-13966: Inappropriate implementation in History. Reported by Google on 2026-05-16

[N/A][513751951] Medium CVE-2026-13967: Type Confusion in V8. Reported by Google on 2026-05-16

[N/A][513762145] Medium CVE-2026-13968: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-05-16

[N/A][513762962] Medium CVE-2026-13969: Uninitialized Use in UI. Reported by Google on 2026-05-16

[N/A][513779283] Medium CVE-2026-13970: Uninitialized Use in Media. Reported by Google on 2026-05-16

[N/A][513780208] Medium CVE-2026-13971: Uninitialized Use in Skia. Reported by Google on 2026-05-16

[N/A][513792140] Medium CVE-2026-13972: Inappropriate implementation in Paint. Reported by Google on 2026-05-16

[N/A][513832989] Medium CVE-2026-13973: Inappropriate implementation in UI. Reported by Google on 2026-05-16

[N/A][513850475] Medium CVE-2026-13974: Integer overflow in Safe Browsing. Reported by Google on 2026-05-16

[N/A][513857658] Medium CVE-2026-13975: Out of bounds read in ANGLE. Reported by Google on 2026-05-16

[N/A][513858286] Medium CVE-2026-13976: Heap buffer overflow in Storage. Reported by Google on 2026-05-16

[N/A][513859894] Medium CVE-2026-13977: Inappropriate implementation in HTMLParser. Reported by Google on 2026-05-16

[N/A][513866949] Medium CVE-2026-13978: Insufficient policy enforcement in PageInfo. Reported by Google on 2026-05-16

[N/A][513988889] Medium CVE-2026-13979: Inappropriate implementation in Paint. Reported by Google on 2026-05-17

[N/A][513989973] Medium CVE-2026-13980: Incorrect security UI in Chrome for iOS. Reported by Google on 2026-05-17

[N/A][513990408] Medium CVE-2026-13981: Inappropriate implementation in Chrome for iOS. Reported by Google on 2026-05-17

[N/A][514006829] Medium CVE-2026-13982: Incorrect security UI in Passwords. Reported by Google on 2026-05-17

[N/A][514009910] Medium CVE-2026-13983: Incorrect security UI in Chrome for iOS. Reported by Google on 2026-05-17

[N/A][514010404] Medium CVE-2026-13984: Incorrect security UI in TabStrip. Reported by Google on 2026-05-17

[N/A][514013849] Medium CVE-2026-13985: Inappropriate implementation in MediaCapture. Reported by Google on 2026-05-17

[N/A][514020959] Medium CVE-2026-13986: Inappropriate implementation in Media UI. Reported by Google on 2026-05-17

[N/A][514039122] Medium CVE-2026-13987: Incorrect security UI in Mobile. Reported by Google on 2026-05-17

[N/A][514040614] Medium CVE-2026-13988: Inappropriate implementation in Paint. Reported by Google on 2026-05-17

[N/A][514056221] Medium CVE-2026-13989: Insufficient policy enforcement in PageInfo. Reported by Google on 2026-05-17

[N/A][514058439] Medium CVE-2026-13990: Insufficient validation of untrusted input in DataTransfer. Reported by Google on 2026-05-17

[N/A][514061117] Medium CVE-2026-13991: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-05-17

[N/A][514063409] Medium CVE-2026-13992: Inappropriate implementation in UI. Reported by Google on 2026-05-17

[N/A][514064139] Medium CVE-2026-13993: Incorrect security UI in WebAppInstalls. Reported by Google on 2026-05-17

[N/A][514067416] Medium CVE-2026-13994: Inappropriate implementation in Credential Management. Reported by Google on 2026-05-17

[N/A][514067524] Medium CVE-2026-13995: Insufficient validation of untrusted input in Autofill. Reported by Google on 2026-05-17

[N/A][514068972] Medium CVE-2026-13996: Incorrect security UI in Permissions. Reported by Google on 2026-05-17

[N/A][514069689] Medium CVE-2026-13997: Incorrect security UI in Extensions. Reported by Google on 2026-05-17

[N/A][514070501] Medium CVE-2026-13998: Incorrect security UI in File Input. Reported by Google on 2026-05-17

[N/A][514071697] Medium CVE-2026-13999: Inappropriate implementation in Extensions. Reported by Google on 2026-05-17

[N/A][514461552] Medium CVE-2026-14000: Inappropriate implementation in XML. Reported by Google on 2026-05-19

[N/A][514481943] Medium CVE-2026-14001: Inappropriate implementation in Network. Reported by Google on 2026-05-19

[N/A][514489361] Medium CVE-2026-14002: Inappropriate implementation in Geolocation. Reported by Google on 2026-05-19

[N/A][514503077] Medium CVE-2026-14003: Insufficient policy enforcement in Extensions. Reported by Google on 2026-05-19

[N/A][514538751] Medium CVE-2026-14004: Inappropriate implementation in CSS. Reported by Google on 2026-05-19

[N/A][514740273] Medium CVE-2026-14005: Use after free in Omnibox. Reported by Google on 2026-05-19

[N/A][515423596] Medium CVE-2026-14006: Use after free in Navigation. Reported by Google on 2026-05-21

[N/A][516425999] Medium CVE-2026-14007: Insufficient policy enforcement in PermissionsPolicy. Reported by Google on 2026-05-25

[N/A][516781007] Medium CVE-2026-14008: Uninitialized Use in WebXR. Reported by Google on 2026-05-26

[N/A][516819850] Medium CVE-2026-14009: Insufficient data validation in Passwords. Reported by Google on 2026-05-26

[N/A][516924151] Medium CVE-2026-14010: Uninitialized Use in Codecs. Reported by Google on 2026-05-27

[N/A][516944556] Medium CVE-2026-14011: Out of bounds read in SurfaceCapture. Reported by Google on 2026-05-27

[N/A][517110749] Medium CVE-2026-14012: Side-channel information leakage in CSS. Reported by Google on 2026-05-27

[N/A][517114175] Medium CVE-2026-14013: Inappropriate implementation in SVG. Reported by Google on 2026-05-27

[N/A][517155893] Medium CVE-2026-14014: Inappropriate implementation in Paint. Reported by Google on 2026-05-27

[N/A][517207235] Medium CVE-2026-14015: Inappropriate implementation in WebRTC. Reported by Google on 2026-05-27

[N/A][517234388] Medium CVE-2026-14016: Insufficient policy enforcement in SVG. Reported by Google on 2026-05-27

[N/A][517241992] Medium CVE-2026-14017: Inappropriate implementation in Navigation. Reported by Google on 2026-05-27

[N/A][517350251] Medium CVE-2026-14018: Use after free in Updater. Reported by Google on 2026-05-28

[N/A][517455455] Medium CVE-2026-14019: Inappropriate implementation in Passwords. Reported by Google on 2026-05-28

[N/A][517598518] Medium CVE-2026-14020: Insufficient validation of untrusted input in WebXR. Reported by Google on 2026-05-28

[N/A][517731924] Medium CVE-2026-14021: Insufficient validation of untrusted input in StorageAccessAPI. Reported by Google on 2026-05-29

[N/A][517791835] Medium CVE-2026-14022: Insufficient validation of untrusted input in Network. Reported by Google on 2026-05-29

[N/A][518063436] Medium CVE-2026-14023: Insufficient validation of untrusted input in SanitizerAPI. Reported by Google on 2026-05-30

[N/A][518245882] Medium CVE-2026-14024: Use after free in Ozone. Reported by Google on 2026-05-30

[$2000][506482786] Low CVE-2026-14025: Use after free in Views. Reported by asjidkalam on 2026-04-26
[$1000][507263861] Low CVE-2026-14026: Incorrect security UI in SplitView. Reported by adisahilna35@gmail.com on 2026-04-28
[TBD][361375787] Low CVE-2026-14027: Use after free in SignIn. Reported by Sven Dysthe (@svn-dys) on 2024-08-21
[TBD][401816601] Low CVE-2026-14028: Incorrect security UI in Chrome for iOS. Reported by Ameen Basha M K on 2025-03-09
[TBD][488762971] Low CVE-2026-14030: Incorrect security UI in SplitView. Reported by Khalil Zhani on 2026-03-01
[N/A][495459838] Low CVE-2026-14031: Incorrect security UI in File Input. Reported by Google on 2026-03-23
[N/A][495783474] Low CVE-2026-14032: Use after free in Bluetooth. Reported by Google on 2026-03-24
[N/A][495848160] Low CVE-2026-14033: Insufficient policy enforcement in Media. Reported by Google on 2026-03-24
[N/A][496368832] Low CVE-2026-14034: Inappropriate implementation in WebXR. Reported by Google on 2026-03-26
[N/A][496371586] Low CVE-2026-14035: Insufficient policy enforcement in Bluetooth. Reported by Google on 2026-03-26
[N/A][496411061] Low CVE-2026-14036: Insufficient policy enforcement in Bluetooth. Reported by Google on 2026-03-26
[N/A][496522611] Low CVE-2026-14037: Insufficient policy enforcement in GPU. Reported by Google on 2026-03-26
[N/A][497241148] Low CVE-2026-14038: Insufficient validation of untrusted input in New Tab Page. Reported by Google on 2026-03-28
[N/A][497358012] Low CVE-2026-14039: Insufficient policy enforcement in GetUserMedia. Reported by Google on 2026-03-29
[N/A][497488593] Low CVE-2026-14040: Use after free in BrowserTag. Reported by Google on 2026-03-29
[N/A][497544822] Low CVE-2026-14041: Insufficient policy enforcement in Serial. Reported by Google on 2026-03-29
[N/A][497558336] Low CVE-2026-14042: Inappropriate implementation in Isolated Web Apps. Reported by Google on 2026-03-29
[N/A][497632232] Low CVE-2026-14043: Use after free in GetUserMedia. Reported by Google on 2026-03-30
[N/A][497670996] Low CVE-2026-14044: Use after free in ANGLE. Reported by Google on 2026-03-30
[N/A][497723649] Low CVE-2026-14045: Insufficient validation of untrusted input in Network. Reported by Google on 2026-03-30
[N/A][497959724] Low CVE-2026-14046: Inappropriate implementation in CustomTabs. Reported by Google on 2026-03-30
[N/A][498864176] Low CVE-2026-14047: Insufficient policy enforcement in Extensions. Reported by Google on 2026-04-02
[N/A][499189601] Low CVE-2026-14048: Use after free in Chromecast. Reported by Google on 2026-04-03
[N/A][501659888] Low CVE-2026-14049: Inappropriate implementation in GPU. Reported by Google on 2026-04-11
[N/A][501708647] Low CVE-2026-14050: Insufficient policy enforcement in Passwords. Reported by Google on 2026-04-11
[N/A][501747804] Low CVE-2026-14051: Uninitialized Use in GamepadAPI. Reported by Google on 2026-04-11
[N/A][501810874] Low CVE-2026-14052: Insufficient policy enforcement in FileSystem. Reported by Google on 2026-04-12
[N/A][501836539] Low CVE-2026-14053: Insufficient policy enforcement in Extensions. Reported by Google on 2026-04-12
[N/A][501851312] Low CVE-2026-14054: Insufficient policy enforcement in Network. Reported by Google on 2026-04-12
[N/A][501857663] Low CVE-2026-14055: Insufficient validation of untrusted input in Device Trust. Reported by Google on 2026-04-12
[N/A][501888426] Low CVE-2026-14056: Insufficient validation of untrusted input in Media. Reported by Google on 2026-04-12
[N/A][502212647] Low CVE-2026-14057: Insufficient policy enforcement in FedCM. Reported by Google on 2026-04-13
[N/A][502354038] Low CVE-2026-14058: Policy bypass in Parser. Reported by Google on 2026-04-14
[N/A][502363986] Low CVE-2026-14059: Insufficient policy enforcement in Related-Website-Sets. Reported by Google on 2026-04-14
[N/A][502372527] Low CVE-2026-14060: Insufficient validation of untrusted input in Chromoting. Reported by Google on 2026-04-14
[N/A][502434484] Low CVE-2026-14061: Inappropriate implementation in Dawn. Reported by Google on 2026-04-14
[N/A][502448128] Low CVE-2026-14062: Inappropriate implementation in Views. Reported by Google on 2026-04-14
[N/A][502473563] Low CVE-2026-14063: Out of bounds memory access in Chromecast. Reported by Google on 2026-04-14
[N/A][502714977] Low CVE-2026-14064: Use after free in PageInfo. Reported by Google on 2026-04-15
[N/A][503617508] Low CVE-2026-14065: Insufficient validation of untrusted input in PageInfo. Reported by Google on 2026-04-17
[N/A][503779807] Low CVE-2026-14066: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-04-17
[N/A][504069465] Low CVE-2026-14067: Use after free in Chrome for iOS. Reported by Google on 2026-04-18
[N/A][504210171] Low CVE-2026-14068: Inappropriate implementation in Omnibox. Reported by Google on 2026-04-19
[N/A][505136542] Low CVE-2026-14069: Integer overflow in WebNN. Reported by Google on 2026-04-21
[N/A][505137978] Low CVE-2026-14070: Uninitialized Use in WebNN. Reported by Google on 2026-04-21
[N/A][506143724] Low CVE-2026-14071: Side-channel information leakage in WebAudio. Reported by Google on 2026-04-24
[N/A][507099867] Low CVE-2026-14072: Incorrect security UI in SplitView. Reported by FARISSAL B on 2026-04-28
[N/A][507237563] Low CVE-2026-14073: Insufficient policy enforcement in WebXR. Reported by Google on 2026-04-28
[N/A][511743480] Low CVE-2026-14074: Side-channel information leakage in WebAuthentication. Reported by Google on 2026-05-10
[N/A][511808800] Low CVE-2026-14075: Policy bypass in Chrome for iOS. Reported by Google on 2026-05-10
[N/A][511815165] Low CVE-2026-14076: Policy bypass in Network. Reported by Google on 2026-05-10
[TBD][511869411] Low CVE-2026-14077: Incorrect security UI in Select. Reported by pwn.ai on 2026-05-11
[N/A][512953564] Low CVE-2026-14078: Policy bypass in WebRTC. Reported by Google on 2026-05-13
[N/A][512971938] Low CVE-2026-14079: Policy bypass in Network. Reported by Google on 2026-05-13
[N/A][512997517] Low CVE-2026-14080: Insufficient validation of untrusted input in TabSwitcher. Reported by Google on 2026-05-13
[N/A][513030698] Low CVE-2026-14081: Insufficient policy enforcement in DevTools. Reported by Google on 2026-05-14

[N/A][513049578] Low CVE-2026-14082: Race in Storage. Reported by Google on 2026-05-14

[N/A][513128322] Low CVE-2026-14083: Insufficient validation of untrusted input in HTML. Reported by Google on 2026-05-14

[N/A][513138148] Low CVE-2026-14084: Insufficient validation of untrusted input in Chromoting. Reported by Google on 2026-05-14

[N/A][513155863] Low CVE-2026-14085: Side-channel information leakage in CSS. Reported by Google on 2026-05-14

[N/A][513169718] Low CVE-2026-14086: Insufficient policy enforcement in HID. Reported by Google on 2026-05-14

[N/A][513177237] Low CVE-2026-14087: Insufficient validation of untrusted input in WebNN. Reported by Google on 2026-05-14

[N/A][513178869] Low CVE-2026-14088: Uninitialized Use in Canvas. Reported by Google on 2026-05-14

[N/A][513188254] Low CVE-2026-14089: Insufficient validation of untrusted input in PopupBlocker. Reported by Google on 2026-05-14

[N/A][513194241] Low CVE-2026-14090: Out of bounds read in CameraCapture. Reported by Google on 2026-05-14

[N/A][513208773] Low CVE-2026-14091: Use after free in DevTools. Reported by Google on 2026-05-14

[N/A][513212892] Low CVE-2026-14092: Insufficient policy enforcement in Privacy. Reported by Google on 2026-05-14

[N/A][513240099] Low CVE-2026-14093: Use after free in Cast. Reported by Google on 2026-05-14

[N/A][513264273] Low CVE-2026-14094: Use after free in Installer. Reported by Google on 2026-05-14

[N/A][513271007] Low CVE-2026-14095: Insufficient validation of untrusted input in Browser. Reported by Google on 2026-05-14

[N/A][513310821] Low CVE-2026-14096: Object lifecycle issue in Input. Reported by Google on 2026-05-14

[N/A][513333529] Low CVE-2026-14097: Inappropriate implementation in WebAppInstalls. Reported by Google on 2026-05-14

[N/A][513375767] Low CVE-2026-14098: Inappropriate implementation in CSS. Reported by Google on 2026-05-15

[N/A][513382161] Low CVE-2026-14099: Use after free in Chrome for iOS. Reported by Google on 2026-05-15

[N/A][513383891] Low CVE-2026-14100: Insufficient data validation in NetworkCache. Reported by Google on 2026-05-15

[N/A][513454805] Low CVE-2026-14101: Insufficient policy enforcement in Sandbox. Reported by Google on 2026-05-15

[N/A][513455047] Low CVE-2026-14102: Use after free in Passwords. Reported by Google on 2026-05-15

[N/A][513465245] Low CVE-2026-14103: Use after free in SSL. Reported by Google on 2026-05-15

[N/A][513484193] Low CVE-2026-14104: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-05-15

[N/A][513528117] Low CVE-2026-14105: Insufficient policy enforcement in Speech. Reported by Google on 2026-05-15

[N/A][513532778] Low CVE-2026-14106: Insufficient validation of untrusted input in Text. Reported by Google on 2026-05-15

[N/A][513544566] Low CVE-2026-14107: Use after free in Scheduling. Reported by Google on 2026-05-15

[N/A][513689974] Low CVE-2026-14108: Use after free in PDFium. Reported by Google on 2026-05-15

[N/A][513694957] Low CVE-2026-14109: Insufficient policy enforcement in Mojo. Reported by Google on 2026-05-16

[N/A][513698452] Low CVE-2026-14110: Inappropriate implementation in DarkMode. Reported by Google on 2026-05-16

[N/A][513710926] Low CVE-2026-14111: Use after free in WebProtect. Reported by Google on 2026-05-16

[N/A][513713946] Low CVE-2026-14112: Inappropriate implementation in Enterprise. Reported by Google on 2026-05-16

[N/A][513737335] Low CVE-2026-14113: Use after free in Updater. Reported by Google on 2026-05-16

[N/A][513743129] Low CVE-2026-14114: Inappropriate implementation in WebAppInstalls. Reported by Google on 2026-05-16

[N/A][513745699] Low CVE-2026-14115: Insufficient validation of untrusted input in Cast. Reported by Google on 2026-05-16

[N/A][513747800] Low CVE-2026-14116: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-05-16

[N/A][513751020] Low CVE-2026-14117: Insufficient validation of untrusted input in DevTools. Reported by Google on 2026-05-16

[N/A][513772764] Low CVE-2026-14118: Insufficient data validation in DevTools. Reported by Google on 2026-05-16

[N/A][513775483] Low CVE-2026-14119: Type Confusion in Bluetooth. Reported by Google on 2026-05-16

[N/A][513777411] Low CVE-2026-14120: Inappropriate implementation in DevTools. Reported by Google on 2026-05-16

[N/A][513789382] Low CVE-2026-14121: Use after free in Chromoting. Reported by Google on 2026-05-16

[N/A][513824891] Low CVE-2026-14122: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-05-16

[N/A][513856644] Low CVE-2026-14123: Incorrect security UI in Chrome for iOS. Reported by Google on 2026-05-16

[N/A][513867710] Low CVE-2026-14124: Inappropriate implementation in CredentialProvider. Reported by Google on 2026-05-16

[N/A][513918431] Low CVE-2026-14125: Uninitialized Use in ANGLE. Reported by Google on 2026-05-17

[N/A][513992796] Low CVE-2026-14126: Incorrect security UI in UI. Reported by Google on 2026-05-17

[N/A][514009654] Low CVE-2026-14127: Inappropriate implementation in Printing. Reported by Google on 2026-05-17

[N/A][514015836] Low CVE-2026-14128: Insufficient data validation in Chrome for iOS. Reported by Google on 2026-05-17

[N/A][514018024] Low CVE-2026-14129: Incorrect security UI in PreviewTab. Reported by Google on 2026-05-17

[N/A][514019522] Low CVE-2026-14130: Incorrect security UI in Omnibox. Reported by Google on 2026-05-17

[N/A][514020982] Low CVE-2026-14131: Insufficient validation of untrusted input in WebAppInstalls. Reported by Google on 2026-05-17

[N/A][514039492] Low CVE-2026-14132: Inappropriate implementation in WebXR. Reported by Google on 2026-05-17

[N/A][514039947] Low CVE-2026-14133: Race in History Embeddings. Reported by Google on 2026-05-17

[N/A][514055973] Low CVE-2026-14134: Inappropriate implementation in Autofill. Reported by Google on 2026-05-17

[N/A][514058566] Low CVE-2026-14135: Insufficient validation of untrusted input in Network. Reported by Google on 2026-05-17

[N/A][514068611] Low CVE-2026-14136: Incorrect security UI in Chrome for iOS. Reported by Google on 2026-05-17

[N/A][514070067] Low CVE-2026-14137: Insufficient validation of untrusted input in Chrome for iOS. Reported by Google on 2026-05-17

[N/A][514071775] Low CVE-2026-14138: Inappropriate implementation in WebAppInstalls. Reported by Google on 2026-05-17

[N/A][514072495] Low CVE-2026-14139: Inappropriate implementation in TabStrip. Reported by Google on 2026-05-17

[N/A][514072607] Low CVE-2026-14140: Insufficient validation of untrusted input in Input. Reported by Google on 2026-05-17

[N/A][514072867] Low CVE-2026-14141: Incorrect security UI in Document Picture-in-Picture. Reported by Google on 2026-05-17

[N/A][514073460] Low CVE-2026-14142: Inappropriate implementation in Extensions. Reported by Google on 2026-05-17

[N/A][514075028] Low CVE-2026-14143: Incorrect security UI in Passwords. Reported by Google on 2026-05-17

[N/A][514079793] Low CVE-2026-14144: Incorrect security UI in Views. Reported by Google on 2026-05-17

[N/A][514485825] Low CVE-2026-14145: Inappropriate implementation in CSS. Reported by Google on 2026-05-19

[N/A][514550047] Low CVE-2026-14146: Inappropriate implementation in CSS. Reported by Google on 2026-05-19

[N/A][514632767] Low CVE-2026-14147: Inappropriate implementation in CSS. Reported by Google on 2026-05-19

[N/A][515426873] Low CVE-2026-14148: Type Confusion in CSS. Reported by Google on 2026-05-21

[N/A][515427046] Low CVE-2026-14149: Use after free in Audio. Reported by Google on 2026-05-21

[N/A][517376041] Low CVE-2026-14150: Insufficient validation of untrusted input in Speech. Reported by Google on 2026-05-28

[N/A][517381770] Low CVE-2026-14151: Inappropriate implementation in AI. Reported by Google on 2026-05-28

[N/A][517534944] Low CVE-2026-14152: Out of bounds write in ANGLE. Reported by Google on 2026-05-28

[N/A][517684077] Low CVE-2026-14153: Inappropriate implementation in Glic. Reported by Google on 2026-05-29

[N/A][517741170] Low CVE-2026-14154: Inappropriate implementation in DevTools. Reported by Google on 2026-05-29

[N/A][518246925] Low CVE-2026-14155: Insufficient policy enforcement in StorageAccessAPI. Reported by Google on 2026-05-30

[N/A][518247789] Low CVE-2026-14156: Policy bypass in StorageAccessAPI. Reported by Google on 2026-05-30

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Daniel Yip

Google Chrome

Chrome for Android Update

Wed, 01 Jul 2026 01:08:28 +0200

Hi, everyone! We've just released Chrome 150 (150.0.7871.63) for Android. It'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 150.0.7871.46/47, Linux: 150.0.7871.46) unless otherwise noted.

Krishna Govind

Google Chrome

Lego Brings Olivia Rodrigo's World to Life With Five New Sets

Tue, 30 Jun 2026 13:32:05 +0200

You seem pretty glad for a girl so in Lego.

Kali Linux 2026.2 Release (GNOME 50, KDE 6.6, Helper Scripts, APT Formats & VM Boot Tweaking)

Mon, 29 Jun 2026 18:25:00 +0200

It’s the final week of Q2, and Kali Linux 2026.2 is here - right on schedule ;) We have been heads down since our last release, and we are ready to share what we have been working on. This release is a mix of desktop refreshes, infrastructure improvements, and quality-of-life changes that we think you will appreciate.

The summary of the changelog since the 2026.1 release from March is:

Desktop Environments - Bump to GNOME 50 and KDE Plasma 6.6
Helper Scripts Consistency - Consistency to our little launches at starting services
APT Format - Goodbye sources.list, hello sources.list.d/kali.source
VM Boot Optimisation - Smaller initrd + faster boot times = happy virtual machine users
Reboot Warning - Heads-up, polkit and xrdp upgrades require a system reboot
Kali Kernel Incoming - Staying with 6.19 for now, how to get 7.0 early
Build Scripts Incoming - Heads-up with some changing on the way
New Tools - As always, various new shiny packages have been added (9!)

Desktop Environments Updates

As we do roughly every six months, every other Kali release, our desktop environments get a major update. This time it’s for: GNOME and KDE Plasma. Neither brings sweeping changes, but both have put real effort into refining performance and usability across the whole ecosystem.

GNOME 50

GNOME 50 brings usability and performance improvements across the desktop. The file manager received significant optimizations, resulting in faster thumbnail and icon loading, improved responsiveness, and reduced memory usage. The desktop also received new accessibility enhancements through a brand-new preferences window, tweaks to the screen reader, and automatic language switching.

Another addition is support for document annotations in the Document Viewer app, making it easier to add text notes and highlights directly to documents.

Here you can read more about all the changes with this new GNOME release: GNOME 50 release announcement.

KDE Plasma 6.6

KDE Plasma 6.6 focuses on improving usability and accessibility while introducing several new features, including a new on-screen keyboard, providing a better experience particularly for touch-enabled devices.

The Spectacle screenshot utility can now recognize and extract text directly from screenshots, making OCR functionality available from the desktop. Accessibility has also been enhanced with new color-vision support options, improvements to Zoom and Magnifier, support for Slow Keys on Wayland, and adoption of the standardized Reduced Motion setting.

Here you can read more about all the changes with this new Plasma release: KDE Plasma 6.6 release announcement.

Improved Consistency For Services Helper Scripts

To improve consistency across tools that depend on a service, we have updated our helper scripts. Previously, a tool that required a service might only let you start it (with no way to stop) - and the information displayed back was inconsistent (mixture of service status, how to access, default credentials or nothing at all). With this change, multiple packages have been updated to use these new scripts, which now handle the following tasks:

Manage the service - start/stop
Check if the service is already running - avoiding starting it twice
Show the service status
Show any default credentials
Show how to access it - such as if it’s a web UI, the URL (and bonus, automatically open it in the browser!)

We also make sure that any Kali packages which include a service use -start/-stop for their command names.

Hopefully this makes the little things a little easier.

APT Gets A New Sources Format

Since the beginning of time, the APT sources for Kali Linux were configured in the file /etc/apt/sources.list. This file tells APT from where to update your system, and it’s so fundamental that pretty much everyone (that is, Kali users) knows this file and its content:

┌──(kali㉿kali)-[~]
└─$ cat /etc/apt/sources.list
# See https://www.kali.org/docs/general-use/kali-linux-sources-list-repositories/
deb http://http.kali.org/kali kali-rolling main contrib non-free non-free-firmware

Well, it’s a “once in a distro lifetime” kind of thing, and here it is - /etc/apt/sources.list is retired, in favor of the new file /etc/apt/sources.list.d/kali.sources:

┌──(kali㉿kali)-[~]
└─$ cat /etc/apt/sources.list.d/kali.sources
# See https://www.kali.org/docs/general-use/kali-apt-sources/
Types: deb
URIs: http://http.kali.org/kali/
Suites: kali-rolling
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/kali-archive-keyring.gpg

All the freshly-installed systems will be configured as such. Existing systems won’t be changed. Both files are equivalent and work just the same. However, in the near future, APT will warn if the old file is in use, and will suggest modernizing it.

Note that, for those in the know, this isn’t anything new: both formats have existed for a long time now, and you could use either one or the other. What’s happening is that the default is slowly changing, from the old “one-line-style” to the new “deb822-style”. This is happening in Debian and in Debian-derivatives like Ubuntu. Kali is just following suit.

And for the curious, there’s a very complete and detailed manual page:

┌──(kali㉿kali)-[~]
└─$ man sources.list

No More Graphics Firmware Pre-installed For VM Use-cases

Kali has had a long tradition of pre-installing a lot of firmware in its images. The upside is that users didn’t need to know what firmware they needed to install for their hardware to work: it was already there. And the downside, obviously, was that all the firmware that wasn’t needed was nevertheless installed and taking space for nothing.

It worked for us so far, in the sense that we don’t get too many bug reports related to missing firmware. But lately the changing landscape of graphics firmware forced us to re-evaluate this decision.

The issue with graphics firmware is that it just keeps growing bigger, and right now having it installed for NVidia, AMD and Intel GPUs takes almost 300 MB. But what’s even worse: some bits and pieces of these firmware packages need to be loaded very early, and therefore they are also installed in the initrd (note: the initrd, or initramfs, is this “minimal” system that is loaded early on by the kernel at boot time). And lately, the Kali initrd peaked at around 200 MB, mainly due to graphics firmware. What does that mean in practice? A bigger initrd means slower boot time, and can potentially fill up your /boot partition if ever it’s too small.

So we thought we could improve the situation for VM users here: the vast majority probably don’t need graphics firmware, ever. The only use-case we can think of is a VM with a dedicated GPU + GPU passthrough enabled. If you’re in this case, you might need graphics firmware.

So, what changed in practice, you may ask?

Pre-built VM images don’t come with graphics firmware anymore
Installer images now detect if installation happens in a VM, and in that case graphics firmware is not installed

As a result, the initrd is down to 60 MB for VM users, and the boot time is cut by ~3x (tested for QEMU VM on a Linux host, your mileage may vary). That’s a massive improvement in boot time.

For baremetal users: nothing changed, so you still get a 200 MB initrd with all graphics firmware pre-installed. If you’d like to optimize, it’s on you to uninstall the firmware that you don’t need. A word of caution though: make sure to know what you’re doing, because removing graphics firmware that is needed might leave you with a system without graphics after reboot.

Disruptive Package Updates

We’ve got some slightly disruptive updates in this release.

polkit: a reboot is required

The update of the polkitd package requires a reboot, otherwise trying to start GUI applications as root will fail with cryptic error messages.

There’s an indication of this reboot requirement in the output of apt full-upgrade, when the polkitd package is updated. It’s just not very obvious, the hint is buried with the rest of the logs:

┌──(kali㉿kali)-[~]
└─$ sudo apt update && sudo apt full-upgrade
[...]
Setting up libpolkit-gobject-1-0:amd64 (127+really127-0kali1)…
Setting up libpolkit-agent-1-0:amd64 (127+really127-0kali1)…
Setting up polkitd (127+really127-0kali1)…
Upgrading to this polkitd version requires a reboot, please reboot the system when convenient.
Created symlink '/etc/systemd/system/sockets.target.wants/polkit-agent-helper.socket' → '/usr/lib/systemd/system/polkit-agent-helper.socket'.
[...]

After a reboot, and if ever you still can’t run applications as root, make sure that polkit-agent-helper is started:

┌──(kali㉿kali)-[~]
└─$ sudo systemctl enable --now polkit-agent-helper.socket

If you’re still having issues, reach out on our bug tracker.

xrdp: a reboot is required

In this Kali release, we updated xrdp and xorgxrdp to the v0.10 series. xrdp is an open-source Remote Desktop Protocol server: you might use it if you connect to your Kali instance remotely. If you’re an xrdp user, you’ll need to reboot after this upgrade.

For those who run Kali in Hyper-V, using the Enhanced Session Mode: you’re an xrdp user, even if you didn’t know it! We did our best to ensure a smooth transition, and yet we got reports that xrdp wasn’t functional after the upgrade. If ever you’re in this case, you can try to run kali-tweaks, and in the Virtualization section you can try to disable, and then enable again the Hyper-V Enhanced Session Mode. That might fix the issue. Don’t forget to reboot!

As always, if you’re still having issues after that, feel free to reach out on the Kali bug tracker.

Linux Kernel For This Release: 6.19

Regarding the version of the Linux kernel to include in this release of Kali, it’s been a tough decision.

On one hand, we’d like to release with the latest version of the Linux kernel, due to all the recent vulnerability disclosures (Copy Fail/CVE-2026-31431, Dirty Frag/CVE-2026-43284 & CVE-2026-43500 and others ). On the other hand, when the 7.0 kernel reached Debian, there were reports of incompatibilities with the NVidia DKMS drivers .

We decided to release with a 6.19 kernel to avoid breaking NVidia users. At the same time, for those who prefer to get the latest kernel and don’t care about NVidia compatibility, we have the kernel 7.0 ready for you in kali-experimental. Make sure to check our documentation that explains how to enable the kali-experimental repository. The 7.0 kernel is also available in kali-rolling, so you can just update your whole system and get the latest packages from kali-rolling.

A Sneak Peek: Build Scripts

Our build scripts are what we use to produce every Kali image - ARM SBCs, Base (Installer and live ISOs), Cloud, Containers, VMs, WSL & NetHunter/Pro. Each lives in its own repo, and over time they have each grown in slightly different directions. For the next release, Kali 2026.3, we are doing a consistency pass across all of them: same structure, same conventions, same behaviour throughout.

As a result of these changes, some CI pipelines or workflows may need tweaking.

New Tools in Kali

This release brings 9 new tools (to the network repositories). As always, we have been busy adding to the arsenal:

arsenal-ng - Go-based command library equipped with 200+ cybersecurity cheat-sheets
hydra-gtk - [Re-added] Very fast network logon cracker - GTK+ based GUI
legba - Multiprotocol credentials bruteforcer / password sprayer and enumerator
oletools - Analyze MS OLE2 files and MS Office documents
penelope - Powerful shell handler
shell-gpt - Command-line productivity tool powered by AI large language models
tailscale - Secure connectivity platform
tookie-osint - OSINT information gathering tool for finding social media accounts
uro - Declutter URLs for crawling/pentesting

There has also been numerous packages updates and new libraries as well. We also bump the Kali kernel to 6.19.

Kali NetHunter Updates

We have a tremendous amount of news for the lovers of mobile hacking! The Kali NetHunter app launches instantly now, various bugs have been fixed with the custom commands and chroot manager . A new EvilTwin (Wi-Fi Fake AP) tab has been added with password verification captive portal, which brought along a really needed iptables fix. So now after using Wifipumpkin3 or EvilTwin, Android Hotspot will work properly. Huge thanks to the incredible work by @dr.rootsu. The kernel flasher tab has also received a refresh.

However, this release’s spotlight is on the beginning of the Qcacld-3.0 injection patch wave.

The Qcacld3.0 Injection Story

We finally came to a milestone, shout-out to all the developers that worked on injection through the years!

@kimocoder easily spent more than anyone else on this goal. His original injection implementation came to life, on a specific device: the OnePlus Nord (AC2003). You can find the commit here. Then @Loukious came in the mix and his modifications made it to work on other devices with this port. Finally, @cyberknight777 did some housekeeping, removed unnecessary changes, logging, and restored the correct authorship while attributing @Loukious as co-author. The result, this patch is the almost universal one which brought many devices into the injection world, starting with the ones below for both kernel 4.x and 5.x versions:

OnePlus 7 (LineageOS 23.2)
OnePlus 9 / 9 Pro
OnePlus Nord
POCO X3 Pro
Redmi Note 10
Samsung A73
Xiaomi Mi A3 (LineageOS 23.2)
Xiaomi Poco X3 NFC (PixelOS Android 16)
Xiaomi Redmi Note 8

Wifite On TV

In the meantime, his continuous work on improving wifite caught some attention - spotted on Netflix twice. Not bad!

Magisk Standalone Kernel Installer

The kernel flasher tab (still experimental on some devices) is back in a new shape, giving a hint for the possible future look for the NetHunter app.

The Magisk standalone kernel flashing support is now here - you can simply open any newly built kernel installer zip in the Magisk app that was built using the kali-nethunter-installer.

New Kernels

In addition to the kernels that now support the qcacld3 injection, there are several new versions and phones:

Google Pixel 6a (LineageOS 23.2)
Redmi 5A (crDroid 14)
Samsung Note 20 Ultra (Android 13)
Samsung S10 (LineageOS 23.2)
Samsung S10 5G (LineageOS 23.2)
Samsung S10+ (LineageOS 23.2)
Samsung S10e (LineageOS 23.2)

NetHunter Pro

Kali bare metal now on more phones! New devices added in build thanks to the awesome work by @Max Furman:

Fairphone FP5 (QCM6490) (fp5)
Google Pixel 3 (SDM845) (blueline)
Google Pixel 3a (SDM670) (sargo)
Google Pixel 3a XL SDC panel (SDM670) (bonito-sdc)
Google Pixel 3a XL Tianma panel (SDM670) (bonito-tianma)
Google Pixel 4a (SDM730) (sunfish)
LG G7 ThinQ (SDM845) (judyln)
LG V35 ThinQ (SDM845) (judyp)
Samsung Galaxy S9 China (SDM845) (starqltechn)
SHIFTphone 8 (QCM6490) (otter)
Sony Xperia 10 III (SM6350) (pdx213)
Sony Xperia XZ2 (SDM845) (xperia-tama-apollo)
Sony Xperia XZ2 Compact (SDM845) (xperia-tama-akari)
Sony Xperia XZ2 Premium (SDM845) (xperia-tama-akatsuki)
Xiaomi Mi 10T Lite (SM7225) (toco)
Xiaomi Mi 9 Pro 5G (SM8150) (tucana)
Xiaomi Mi 9T Pro Samsung panel (SM8150) (davinci-samsung)
Xiaomi Mi 9T Pro Visionox panel (SM8150) (davinci-visionox)
Xiaomi Mi Mix 2S (SDM845) (polaris)
Xiaomi Poco X3 Huaxing panel (SM7150) (surya-huaxing)
Xiaomi Poco X3 Tianma panel (SM7150) (surya-tianma)
Xiaomi Redmi Note 10 Pro (SM7150) (sweet)

NetHunter Podcast Episode 3

@yesimxev and @Kristopher Wilson joined for a discussion about NetHunter in cars, and leveraging AI for Bug Bounty projects and more.

Kali Website Updates

Since our last release, Kali 2026.1, we have been keeping the website and documentation up-to-date. Here is a quick summary of what has changed.

Kali Documentation

Most of the documentation updates this cycle are around NetHunter device support and the new APT sources format. Pages which got something more than a tweak:

Creating A Custom Kali ISO (updated)
Handling common APT problems (updated)
Installing NetHunter on the Samsung Galaxy S10 (updated)
Installing NetHunter on the TicWatch Pro 3 (updated)
Installing NetHunter on the TicWatch Pro (updated)
Installing NetHunter on the Xiaomi Mi A2 (updated)
Installing NetHunter on the Xiaomi Mi A3 (updated)
Kali NetHunter (updated)
Kali Network Repositories (/etc/apt/sources.list) (updated)
Kali’s Default Credentials (updated)
Submitting Bugs for Kali Linux (updated)

We also want to say a little thank you to the following for their work on the sites:

Anyone can help out, anyone can get involved!

New Kali Mirrors

We welcomed 1 new mirror during this release cycle, but that’s a significant one: our first mirror in Africa! Hoping that many others will follow ;)

The mirror is located in South Africa, online at mirror.africloud.com. It is sponsored by AFRICLOUD, and was setup thanks to Oluniyi Ajao.

If you have the disk space and bandwidth, we always welcome new mirrors.

Get Kali Linux 2026.2

Fresh Images

So what’s stopping you? Go and get Kali already!

If you cannot wait for the next release, we also produce weekly builds which include the latest packages at the time of download, meaning fewer updates needed on first boot. These are automated builds rather than QA’d releases like our standard release images, but we still welcome bug reports on them. The earlier we catch issues, the sooner they get fixed.

Existing Installs

Using Kali already? Great! You can keep it up-to-date by doing:

┌──(kali㉿kali)-[~]
└─$ sudo tee /etc/apt/sources.list.d/kali.sources << 'EOF'
Types: deb
URIs: http://http.kali.org/kali/
Suites: kali-rolling
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/kali-archive-keyring.gpg
EOF
[...]
┌──(kali㉿kali)-[~]
└─$ sudo apt update && sudo apt -y full-upgrade
[...]
┌──(kali㉿kali)-[~]
└─$ cp -vrbi /etc/skel/. ~/
[...]
┌──(kali㉿kali)-[~]
└─$ sudo reboot -f

Remember, we recommend doing a reboot for this release!

You should now be on Kali Linux 2026.2. We can double check this by doing:

┌──(kali㉿kali)-[~]
└─$ grep VERSION /etc/os-release
VERSION="2026.2"
VERSION_ID="2026.2"
VERSION_CODENAME="kali-rolling"
┌──(kali㉿kali)-[~]
└─$ uname -v
#1 SMP PREEMPT_DYNAMIC Kali 6.19.14-1+kali1 (2026-05-05)
┌──(kali㉿kali)-[~]
└─$ uname -r
6.19.14+kali-amd64

NOTE: The output of uname -r may be different depending on the system architecture.

As always, if you run into anything broken, please report it. We will never be able to fix what we do not know is broken! And Social networks are not bug trackers!

Want to keep up-to-date easier? We’ve got you!

Blog? Use our RSS feed and newsletter
Download? We have a Torrent RSS feed
Socials? Bluesky, Facebook, Instagram, Mastodon & X

Once, cyber-attacks required great skill. AI is changing that | Bruce Schneier

Mon, 29 Jun 2026 14:04:39 +0200

Modern AI systems are, in effect, a universal adviser to help people do harmful things. We’ll need to harness AI for defense, too

Earlier this week, national security agencies from the Five Eyes – that’s the rich, English-language-speaking countries club – jointly released a statement warning of the increasing cyber risks of AI models: in particular, their ability to autonomously hack into systems and networks. The statement was more measured than some of the breathless headlines about it, and the advice they gave is pretty much the standard advice everyone gives – albeit with newfound urgency.

Internet risks are nothing new, and cyber-attacks – both large and small – have been a significant issue since long before the current crop of generative AI models.

Bruce Schneier is a security technologist who teaches at the Harvard Kennedy School at Harvard University and University of Toronto’s Munk School

Oh, behave! How Gemini can reshape the web for the way you work

Mon, 29 Jun 2026 13:47:43 +0200

Reading about the “revolutionary” nature of generative AI technology these days, it’s hard not to feel a little left out.

Sure, services like Google’s Gemini and its contemporaries can be useful in certain limited, specific areas for productivity purposes. But working with them can also be pretty disheartening and overwhelming — from prompt fatigue and an onslaught of AI workslop to the fear of lost jobs and even just the simple inconsistencies and inaccuracies these systems are so prone to providing. (And that’s to say nothing of the ever-increasing creepy factor that often accompanies this type of technology.)

More and more, it seems the most significant impact of these systems is in areas like coding, where AI is allowing ambitious tech-heads to create their own custom programs with limited to no programming knowledge (but a lot of time, vision, and patience) — as well as allowing accomplished coders to produce products more quickly by letting AI do the dirty work and then spending their time guiding, tweaking, and correcting its output.

That’s all well and good, but the reality is that most of us mere mortals are never gonna mess with anything that daunting. That doesn’t, however, mean we can’t enjoy a slice of the custom-coding pie and the productivity advantages it offers — on a much simpler but still supremely useful level.

The average-worker answer lies in an oft-overlooked middle-ground possibility these AI chatbots possess to help us create relatively basic but extremely high-potential custom browser extensions. As their name suggests, these simple little programs run entirely in your browser — the same exact sorts of add-ons you’d typically find and install in a marketplace like Google’s Chrome Web Store.

But with Gemini or any other similar genAI platform, you can dream up your own web-improving extension and turn it into reality in a matter of minutes — simply by describing your goal and then guiding the AI gently along the way. And given how much time most of us spend on the web these days, that opens up a tantalizing series of doors for taking total control of your work environment.

Hate all the extraneous bells and whistles gunking up the Google Docs interface? Gemini can create a Chrome extension that removes them. Annoyed by a glitchy web app? Ask Gemini for an extension that makes some under-the-hood improvements. The possibilities are endless.

Let me show you how exactly it works, how easy it is to approach and master, and how many work-enhancing possibilities are out there just waiting to be created.

The ins and outs of Gemini’s custom Chrome extensions

First things first: You don’t need any special tools or subscriptions to make this happen. For the purposes of this article, we’ll focus on Google’s Gemini for the creation and the standard desktop Chrome browser for the installation — but the same basic process would work with most any AI chatbot, if you happen to prefer ChatGPT or Claude, as well as with any extension-supporting, Chromium-compatible browser (a list that includes everything from Microsoft Edge to Brave, Vivaldi, and beyond).

Google offers a dizzying array of Gemini modes and options and an equally overwhelming series of AI subscription plans that control how much you can use those capabilities, but you don’t need to worry about any of that to create custom Chrome extensions. You might sometimes see better results if you switch your Gemini model to “Pro” or your Gemini thinking level to “Extended” — designations that even Gemini itself has trouble deciphering (believe me, I asked!) — but just using the default Gemini settings with a free Google account will generally work quite well.

Getting going with a custom Chrome extension is as simple as opening up a new Gemini chat and telling the system what you want it to cook up for you. The hardest part is deciding what you want and what’d be helpful for you — something we’ll explore more in a moment, via specific examples and suggestions. Once you’ve got that, you can just ask Gemini to create a Chrome extension that’ll accomplish what you’re envisioning, with as much specificity as possible about what it’ll do and how it’ll look.

Gemini will spit back a series of plain-text code chunks with instructions to copy each cluster and paste it into a new plain text file with a certain specific name — things like “manifest.json,” “content.js,” and “styles.css.” All you’ll do is use the on-screen button to copy each segment, then open up any simple text editor (like Windows Notepad, macOS TextEdit, or any number of simple online text editors) and paste the text in, then save it under the name Gemini gives you.

You’ll need to put all the files into a single isolated folder on your computer, and then you can go into Chrome, type chrome:extensions into its address bar, and install your shiny new creation by:

Flipping the toggle next to “Developer mode” in the upper-right corner of the screen into the on and active position, if it isn’t already
Clicking the “Load unpacked” button
And selecting the folder you just created in the pop-up that appears

Chrome’s “Developer Mode” toggle and “Load unpacked” button are the keys to importing any extension you create.

JR Raphael / Foundry

And that’s pretty much it: No complicated compiling or program publishing — the extension you envisioned will be alive and working right in your browser and ready to use.

Now, odds are, it won’t be exactly what you wanted in its first iteration, and you’ll have to go back to Gemini to request several rounds of updates and corrections. Each time, Gemini will create a new set of code chunks, and you simply overwrite the text in each file with its corresponding new code chunk.

It’s still a bit of a process. But you’ll rarely spend more than an hour on something simple and maybe a few hours on something especially multifaceted and specific, and whatever you create will then work to your advantage indefinitely from that point onward, on any computer where you install it.

Before we dive into specific slivers of inspiration, let’s just note the hopefully obvious asterisk that this’ll work only if you’re either (a) using a personal computer that isn’t associated with an organization or (b) using a work-connected computer where custom Chrome extensions are permitted. In either scenario, you’ll want to use your own best judgment to ensure that whatever you’re adding into your browser won’t expose any corporate data or cause your IT comrades any alarm if they see you using it in your workday.

With most common examples, though — including all the ones we’re about to go over — you shouldn’t have any problem or cause for concern.

Capisce? Capisce. Let’s get into it.

Custom extension category #1: The interface fixer

Our first custom Chrome extension category is the one that won me over to this practice initially and has been the most shapeshifting for my own browser-based workflow — and that’s the simple-seeming but transformational ability to have AI remake any web app you rely on to remove unneeded elements and redesign the interface to your exact specifications.

The best example I can show you is what I did with my completely homemade, Gemini-created Docs Zen extension. Google Docs, to put it mildly, has devolved into a cluttered mess. There are so many on-screen elements I never use and, ironically enough, irrelevant AI elements I’d rather not have in my hair. I just want a calm, simple, minimalist environment for writing — with Google’s second-to-none syncing, universal access, and collaboration systems beneath it.

So rather than try to reinvent the wheel, I described to Gemini all the elements I wanted to remove from Docs and all the ways I wanted to rethink how its interface appeared for me.

My original request to Gemini, followed by rounds of expansions and revisions (and eventually also a more poetic name).

JR Raphael / Foundry

I went back and forth with numerous iterations and kept coming up with interesting new additions to further flesh out and improve the experience — and I ended up with a delightful setup that gives me a distraction-free view of my writing space with a simple toggle to reveal the main Docs menus and a palette icon that allows me to switch from one eye-pleasing theme to another.

width="620" height="161" sizes="auto, (max-width: 620px) 100vw, 620px">

Google Docs with my custom Docs Zen extension — a true delight for daily writing.

JR Raphael / Foundry

My setup deliberately doesn’t include comments or other collaborative elements, as I’m mostly writing by myself these days — but when I do need those elements, the eye icon in the upper-right corner of the screen disables my custom adjustments and takes me back to the standard Docs interface. I can then click the eye icon again in that environment to switch back.

My custom extension includes a simple on-off toggle for times when I need the full Docs setup.

JR Raphael / Foundry

I used Gemini to create something similar for Trello, with which I also have a love-hate relationship — loving the foundational functions and easy access everywhere but hating the interface that’s lost focus, gained bloat, and gotten noticeably clunky and slow over time.

With the same sort of step-by-step, plain-English guidance, I was able to transform Trello from this…

Trello, in its typical current-day state.

JR Raphael / Foundry

…into this:

Trello, with my custom modifications in place.

JR Raphael / Foundry

I couldn’t even begin to recount the number of superfluous features and elements I’ve removed, along with revamping the overall interface to make it both more efficient and more visually pleasing to my eye.

Whether it’s a web app you rely on regularly or even just a website you open often, the possibilities are practically endless for the ways you can reshape it and mold it to make it work better for you.

Speaking of which…

Custom extension category #2: The feature creator

In addition to the surface-level adjustments and feature removals in my aforementioned Trello-enhancing extension, I also added in several components — such as one-click buttons for archiving or moving cards — and I managed to speed up the site by making some under-the-hood adjustments Gemini suggested when I asked about its choppy performance. The same sort of concept can apply to any web-based interface you’re using, if there are any options that are annoyingly buried within menus, shortcuts that’d make your life easier, or other improvements you’ve longed to see.

You can also consider some simple standalone extensions for giving yourself on-demand features that aren’t necessarily associated with any one specific website but could be useful in plenty of productivity scenarios. For instance:

I do a fair amount of basic image editing and frequently find myself needing to reference a hex color code that corresponds with a particular brand color, and I always end up having to open up a new tab and look in a note somewhere to find the code I need. Well, no more: I used Gemini to create a super-simple custom color code pop-up where I can store all the colors I need and then copy any of ’em onto my clipboard with a single click. Major time-saver.

All the color codes I need are now never more than a couple clicks away.

JR Raphael / Foundry

I’m also constantly converting time zones, either for meetings with clients or colleagues or for trying to wrap my head around publishing systems that insist on using random time zones with no meaning to me. It’s infinitely easier for me to manage now, thanks to the custom Chrome extension I made that shows the current time in all the zones I need most often — as well as allowing me to put any other time into any field and have all the other zones instantly adjust to match. It also offers a brilliant plain-text conversion box where I can just type things like “1pm-3pm PT in MT” and have it cough back up an instant answer for any conversion I need.

My custom time zone conversion extension comes in handy countless times a day.

JR Raphael / Foundry

Maybe what you want is the ability to interact with data on different websites more easily — to be able to save any table on a page in front of you as a CSV file, mayhap, or even to save any text you highlight on a page into a new Google Docs document. Whatever the case may be, Gemini can handle it — and that superpower that you’ve always wished for but never found the right tool to make possible can actually now be yours.

Custom extension category #3: The browser expander

Our final category of custom Chrome extensions to consider moves beyond the web itself and into your actual browser. The browser is essentially the modern-day desktop, after all — and for the first time now, you can expand and enhance it in all sorts of interesting ways.

Some specific examples, to get your brain-motor whirring:

You could walk Gemini through creating a smart auto-snooze system for your open browser tabs, both to clear clutter and help with Chrome’s performance. It could save any tab that hasn’t been touched in a certain amount of time to your local storage and then give you a simple searchable “Archive Dashboard” where you can find all those auto-closed tabs and re-open ’em as needed.
With the right guidance, Gemini could give you a custom browser research panel — where any info you highlight on a page gets beamed over into a sidebar-style panel that serves as a running scratchpad of notes from the day.
Or, if you find yourself often needing to see two tabs together side by side, you could have Gemini cook up a custom extension that instantly detaches any tab in front of you and puts it into a new tab window in a perfectly sized and spaced pattern. One keyboard shortcut could make that move happen, while another keyboard shortcut could recombine the two tabs into a single centered window.

As with all the other ideas we’ve gone over, all you’ve gotta do is ask — and now, with the right inspiration in mind, you’re ready to get your custom extension adventures going and start bending the web to your will.

The OSCP Is a Mental Game

Mon, 29 Jun 2026 12:21:09 +0200

Yes, Another OSCP Blog Post. Bear With Me.

Well, I got my OSCP a couple of weeks back and it was quite an experience. The last 3 months of preparation paid off and the main challenge wasn’t even the technical stuff. It was the mental ability to keep trying and not give up.

I’ll touch on the prep approach and resources, but the main thing I want to talk about is your mental state during the 24 hours of the exam. There are literally an infinite number of blogs and walkthroughs out there covering how to prepare and which resources to use (I looked at them and you will too), which is great, but I won’t bore you with more of the same.

Let’s get into it.

Background

Before we get into it, a bit of context on where I’m coming from.

I’m currently a graduate student in Cybersecurity with around 2 years of professional experience in AppSec and DevSecOps. Offensive security isn’t my forte and my background is on the defensive side but I’ve kept my hands dirty through HTB, THM, and occasional CTFs, which gave me a reasonable foundation going in.

Before attempting the OSCP, I also completed the PNPT certification, which I’d recommend as a stepping stone. It gave me a structured way to think about penetration testing methodology before diving into something more complicated. You can read more about that experience here.

Preparation

A. PEN-200 and Proving Grounds Practice

My prep spanned around 3 months, split between the PEN-200 course material and Proving Grounds Practice machines. And no, I didn’t complete everything.

For the machines, I followed the OSCP LainKusanagi list with ratings rather than bouncing between multiple lists and resources. This is something I’d recommend: pick one list, commit to it, and resist the urge to constantly second-guess whether the grass is greener elsewhere. Chasing the perfect resource list is its own rabbit hole, and one you want to avoid before the exam even starts.

Did I finish every machine on the list? No.

Managing a 3-month OSCP subscription alongside graduate studies doesn’t leave a lot of breathing room, and I had to align myself with that. If you’re coming in with little prior experience, seriously consider the 1-year subscription and go at your own pace.

A few things that worked for me on the machines:

Try it yourself first. Always. If you’re stuck for a meaningful amount of time, look up the writeup for only that specific step, not the whole box. Then put the writeup down and continue on your own.
Keep notes on what worked and what didn’t. Not just commands that worked, but your weak areas, gaps in understanding, and things worth revisiting. I kept a simple running list of areas to improve on, an example of mine is below.

“Areas to improve on” for some of the PG Machines

The goal isn’t to grind through every machine. It’s to understand why things work, so you’re not lost when the exam throws something slightly different at you.

B. Active Directory

Having completed the PNPT, I already had a grasp of the base knowledge needed for the Active Directory section, though PEN-200 does go a bit deeper in its coverage. Even so, I felt I needed to grind through a fair number of AD sets beforehand to get comfortable with the OffSec methodology and with time management.

First things first: get comfortable running netexec, BloodHound, and mimikatz. These are the core tools you’ll be leaning on throughout the AD portion.

Here are the main resources I used:

Hacker Blueprint’s Labs: https://hackerblueprint.com/labs

I went through the first 4 of these. They’re useful for getting familiar with the AD environment, though they don’t really cover the pivoting side of things that you’d expect in the exam. Still a solid resource. Feel free to pick up some of the later labs as well, since I’ve heard the pivoting is better covered in those.

Derron C’s AD Playlist: Playlist Link

These sets are more closely aligned with the OSCP exam and do demonstrate pivoting as you’d see it on the day. Watch them and add the techniques to your notes as you go.

My GitBook (notes and cheatsheet): https://gokulkarthik.gitbook.io/pentesting-checklist

Everything I took down throughout my prep got consolidated here. You don’t need to use it, but it was all I needed to quickly pull up commands during the exam, especially for the Windows and AD side of things.

C. Challenge Labs

Save the challenge labs for the final stretch, ideally 1 to 2 weeks before your exam date. These are the closest thing you’ll get to the real experience, so treat them as dress rehearsals.

Secura — AD focused, and in my opinion a bit easier than what you’ll see in the exam. Still good practice for building confidence.
Medtech — A larger network with more techniques than the OSCP actually expects, but it’s fun and great for sharpening your skills.
Zeus and Poseidon — More difficult and complex than the expected exam difficulty. Only take these on if you have time to spare, otherwise consider them optional.
OSCP A,B,C — The closest to the actual exam in terms of difficulty and structure. Do these as near to your exam date as possible, and time-bound yourself to mimic the real exam conditions. Treating them like the real thing is the best way to test your stamina and pacing before the day itself.

D. Pivoting

For pivoting, I relied on ligolo-ng, which I’d strongly recommend. Beyond pivoting itself, it covers two other use cases that are just as important on the exam:

Transferring files from your attacker machine to a host inside the internal network.
Catching a reverse shell back to your attacker machine from a host inside the internal network.

Both of these, along with the full ligolo-ng setup, are documented in my GitBook if you need a reference.

That said, ligolo-ng isn’t the only option. Feel free to fall back on tools like proxychains or chisel if the situation calls for it, though I’d treat those as a last resort.

The Day of Reckoning

The day had finally come, and I was about to learn what “Try Harder” really meant 😣

The Strong Start

I started on time and went straight for the AD section, which I felt more confident in compared to the standalones. Got admin on the first machine within half an hour. Riding that momentum, I moved on to the second machine and… hit a wall.

I chased an entry point that turned into a full-blown rabbit hole after a ton of enumeration.

Lesson: If something doesn’t work, maybe it was meant to not work. Don’t force it. The actual path forward is often something else entirely.

Almost 3 hours gone, no progress. So I took a break.

Lesson: Take breaks when you’re burnt out or stuck. Stepping away clears your head, and you almost always come back with fresh ideas.

Pivoting to the Standalones

With AD giving me grief, I switched over to the standalones to change up the pace.

Over the next 2 to 3 hours, I got shell access on a couple of them, but no root yet. The third standalone became its own headache: I found the entry point but couldn’t exploit it. Hours disappeared trying to break in, and by now I was almost 8 hours into the exam.

The dread started creeping in. This was my only shot, and the investment I’d invested was sitting in the back of my mind too. So I took another break. When I came back, I realized the entry point was something embarrassingly simple. No complex attack required.

Lesson: The OSCP isn’t an obscure technical exam. It won’t throw unknown exploits or weird attack chains at you. If a path seems overly complicated, it’s probably a rabbit hole. The real way in is usually simpler than you think.

From there, the privesc fell into place and I got root.

The Crossroads

By this point I still didn’t have enough points to pass, and my eyes were seriously starting to droop. I had two options:

Complete the Active Directory set, or
Get root on the two standalones I already had shell access on.

I made an estimated call: I had a better chance of finishing the AD set than rooting those standalones. So I decided to sleep for 5 to 6 hours, wake up the next day, and dedicate my final 4 hours to AD.

(You can imagine how restful that sleep was. 🫠)

The Breakthrough

I woke up still groggy and got back on. I started fresh on the second AD machine and threw every vector I could think of at it. Finally, with about 3 hours left, something clicked. I was in.

From there, it took just 30 minutes to get admin on the second machine and compromise the DC. My heart was racing. That single vector was the entire exam’s “Try Harder” moment. If I’d given up on it, I’d have been done.

That’s the 50 to 80 point swing in half an hour, after being stuck for the better part of a day.

Wrapping Up

Exhausted but relieved, I made sure all my screenshots were in order and went straight to sleep. The next day I used the official OSCP report format, finished writing it up, and submitted. My result came back a couple of days later.

A pretty wild couple of days. 🙂

One last thing: Take screenshots of everything. You never know when you’ll need them. Keep rough notes as you go too, don’t leave documentation until the end when you’re exhausted and trying to reconstruct what you did hours ago.

Tools & Resources Used

revshells — An online reverse shell generator for quickly creating reverse shell payloads in just about any language or format.
netexec — People say this can practically one-shot the AD section of the OSCP if you master it. An absolute must for AD enumeration.
bloodhound — You’ve got to walk the dog. Gives you a clear overview of all the users, groups, and attack paths in your AD environment.
mimikatz — One of the most common tools for post-compromise credential dumping and lateral movement.
penelope —Catches reverse shells and auto-upgrades them, so you don’t have to do the hard work manually.
pspy — Gives you an inside look at Linux processes running on a machine that might not be visible from the outside.
linpeas — The classic Linux enumeration script for privilege escalation.
winPEAS— A solid Windows enumeration script for privilege escalation.
powerup — A PowerShell script that hunts for common Windows privilege escalation misconfigurations.
LainKusanagi List with Ratings — A modified version of the original OSCP machine list, this one with difficulty ratings to help you prioritize.
Friend’s OSCP Medium Post — A friend’s OSCP medium post which helped me prepare for the OSCP.

Final Thoughts

Looking back, the OSCP taught me less about hacking and more about persistence. The technical skills matter, of course, but plenty of people with the right skills still walk away without a pass. What gets you through those 24 hours is the willingness to keep going when you’re stuck, exhausted, and convinced the path forward doesn’t exist.

What worked for me might not map perfectly onto your situation. I went in with a defensive background, prior CTF experience, and the PNPT under my belt, and I still got humbled for the better part of a day.

A few things I’d leave you with:

The exam rewards patience, not panic. Almost every wall I hit had a simpler answer than I was giving it credit for.
Take breaks. Genuinely. Some of my clearer ideas came after stepping away from the screen.
One breakthrough can change everything. I sat at 50 points for the better part of a day. Thirty minutes was all it took to get to 80. Don’t give up before that moment arrives.

If you want to learn more or just chat about the OSCP journey, feel free to reach out to me on LinkedIn. I’m always happy to help where I can.

Good luck, and go earn it. 🙂

The OSCP Is a Mental Game was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

UAE Cybersecurity Council Calls for Stronger Digital Footprint Protection

Mon, 29 Jun 2026 09:54:49 +0200

The UAE Cybersecurity Council has issued a cybersecurity advisory urging individuals to strengthen the protection of their digital footprints, warning that cybercriminals are increasingly exploiting personal information shared online. The Council said poor digital security practices can expose users to identity theft, phishing attacks, account compromise, and other cyber threats, highlighting the growing importance of managing online privacy. In statements to the Emirates News Agency (WAM), the UAE Cybersecurity Council explained that digital footprints are created through everyday online activities, including internet browsing, social media interactions, and the use of digital platforms. Every login, comment, photograph, post, and online interaction leaves behind a record that can be collected, tracked, and potentially exploited if users fail to manage their online presence responsibly.

Digital Footprints Create Valuable Data for Cybercriminals

According to the UAE Cybersecurity Council, digital footprints provide a detailed profile of an individual's identity, interests, preferences, and online behavior. This information, often gathered through websites, mobile applications, and connected devices, has become increasingly valuable to hackers and untrusted platforms seeking to exploit personal data. Highlighting the scale of the threat, the Council noted that more than 1.4 billion accounts are compromised globally every month, demonstrating the growing risks associated with inadequate digital security. The organization warned that the accumulation of personal information across multiple online platforms can make users more vulnerable to cyberattacks if appropriate protection are not in place.

Understanding the Two Types of Digital Footprints

The UAE Cybersecurity Council outlined two distinct categories of digital footprints that internet users generate. The first is passive digital footprints, which are created without a user's direct knowledge. These are collected automatically through the tracking of online activity by websites, applications, and other digital services. The second category is active digital footprints, which are generated when users intentionally share information online. This includes publishing social media posts, uploading photographs, leaving comments, participating in discussions, or sharing other forms of digital content. The Council noted that while active sharing is often voluntary, both passive and active digital footprints contribute to a comprehensive digital profile that can be analyzed or misused if left unprotected.

Cyber Risks Extend Beyond Privacy Concerns

The UAE Cybersecurity Council warned that the risks linked to unmanaged digital footprints extend well beyond simple privacy issues. These risks include account breaches, identity theft, phishing attacks, and the misuse of personal information by malicious actors. The Council also cautioned users about unofficial or untrusted mobile applications that may unlawfully collect sensitive information. Some of these applications, it said, could gain access to device cameras and microphones or even record phone calls without obtaining proper user consent. Such practices increase the risk of personal information being exposed or exploited. Among its recommendations, the Council advised users to avoid interacting with unknown individuals on digital platforms and to regularly review their social media follower lists to identify unfamiliar or suspicious accounts. It also urged people to limit the amount of personal information and location data they share publicly, reducing opportunities for cybercriminals to gather sensitive details.

Apple working on M7 Ultra Mac Studio for 2028 with potential major upgrade: report

Sun, 28 Jun 2026 16:39:18 +0200

Later this year, Apple will be debuting an updated version of the Mac Studio with M5 Max and M5 Ultra chips – a long awaited refresh. The current Mac Studio, released in early 2025, includes an M4 Max and M3 Ultra chip, so at least on the high end, it’s pretty behind.

According to Bloomberg’s Mark Gurman, the M5-based Mac Studio, which should just be a chip upgrade, is still on track to launch this year. Looking ahead to 2028, there may be more interesting changes in the pipeline.

Nest’s quest to fix your thermostat

Sun, 28 Jun 2026 14:17:49 +0200

The founding story of Nest is pretty much a perfect tech myth. A legendary product maker (in this case, Tony Fadell) helps create one of the most successful products ever (the iPhone) and then rides off into the sunset to enjoy the rest of his life, only to have an experience that drags him back […]

‘Swept up in its own braggadocio’: this Final gaming headset I tested sounds good for its price, and its battery should last you up to a week — but on features, it overpromises and underdelivers

Sat, 27 Jun 2026 18:17:34 +0200

Final’s affordable gaming headset offers an epic battery life and decent enough sound — but during testing, I found its claim to offer ‘immersive, spatial audio’ to be pretty overblown.

Consistency

Sat, 27 Jun 2026 15:11:29 +0200

I've worked a lot of places over the years, all for varying lengths of time. While this worked against me in the early days, with potential employers wondering why I didn't stay longer at my previous employer, and wondering how long I'd potentially stay with them, this became less of an issue later in my career.

During my career in the private sector, I've run vulnerability assessments, and spent over 26 yrs in digital forensics and incident response, some in FTE roles, and much more in consultant roles.

In 2006, I started in a DFIR consulting role at ISS, which evolved 6 months later when the company purchase by IBM was completed. I then became a "plank owner" of the IBM ISS X-Force ERS team, one of the original members of the team, even before we expanded. When I started, I was provided with a complete outfitting of equipment, including (but not limited to) write-blockers, cabling, laptops, and dongles for EnCase 4.22, EnCase 6.19, and FTK. As our team grew in size, everyone received similar (albeit updated, in some cases) equipment. When I started at ISS, I was one of 4 responders, and we each did our own thing when it came to analysis. There was little in the way of cross-pollination, sharing of experiences, etc. As the new team began to grow, it was a bit before some of us saw the need for consistency across the team.

In 2007, members of our team became certified to conduct PCI forensic investigations, which were subject to very stringent (and somewhat arbitrary) timelines. As part of this, Chris and I developed a process that we shared with all of the team members, using EnCase to conduct all of the searches required by Visa (driving the whole PCI effort at the time), not just the mandatory the credit card number searches. The idea was, in part, to remove the need for individual analysts to have to try to figure out what to do, by giving them a common, documented step-by-step process for completing all of the required activities in a consistent manner. This way, if issues arose, they were easier to troubleshoot. More importantly, having a consistent process meant that there was less room for guesswork, and we had confidence that as long as the process was followed, we'd be able to meet our obligations regarding timeliness. This also left more time for analysts to uncover things like initial access, and other pertinent information, because the guesswork of "what to do next" in order to meet Visa's requirements was no longer something analysts needed to concern themselves with.

In 2013, I started at , on a team that was already well-established. This team was responsible for developing and actively employing the EDR technology used by the company, and this was used to drastically reduce the scoping of "targeted threat actor" incidents, at which point, triage or full forensics of specific systems could take place. For example, one incident involved 15,000 endpoints in a global infrastructure, and we found that the threat actor had "touched" 8 of the systems, and "been on" only 2. Few members of the team, at the time, had actual hands-on experience with truly in-depth DF work, and there was very little in the way of sharing of tools, techniques, and processes between analysts. There was no documentation, little cross-pollination, and some issues with consistency in the use of the analysis framework. Every now and then, someone might share a tidbit here and there, but different analysts had different ways of using the framework. For example, one analyst might tag something they hadn't seen before as "unknown", where another would tag it as definitely "malicious", with the thought of going back and researching those items a bit more...and often, they didn't. They remained marked the way they were, so when those same indicators showed up on another engagement for another analyst, it was pretty much guaranteed that you'd see a mix of "unknown", "malicious", and "benign" from previous engagements.

In 2020, I started at a DF/IR consulting company, and spent my first week on-boarding at headquarters. During that time, I made an effort to start engaging with DF analysts, in part to see what tools they were using, and how they were using them. What I found was that almost all of the analysts had at least 4 dongles/licenses to commercial products, and in some cases, a total of 5 (or more). And every analyst had their own way of doing things; one analyst described what they did as an "art". I sat with one analyst as they walked me through how they used one of tools, selecting various artifacts to be parsed. They'd been doing this for some time now, and for every case, they'd go in and manually select each item, from memory. We spent a few minutes working on it together, and we found that the application had a way for analysts to have a set of items be selected every time, in a profile.

Unfortunately, I returned home at the end of that first week, just as the pandemic lockdown was kicking off, and just shy of three months into my tenure, I (and others) were laid off. It took time, but I found an amazing role as the director of the internal SOC for a large consulting company, one that had three levels of SOC analyst. The highest, L3, were responsible for deeper forensic analysis of incidents that had been escalated up by the prior two levels. During my time there, while there were some tools discussed, what became clear to me was that each of the analysts had their own way of doing things, and there was very little in way of documentation (case notes, etc.) or cross-pollination, and there was limited effort to develop a "best practices" approach to analysis, or just something that was employed consistently across the team. As a result, when a "finding" was added to a ticket or report, there was no clear understanding as to how that finding was developed, and when the "how" was dug into, often the results would be different depending upon the analyst.

I had seen time and again in the tickets that analysts were collecting active memory from reported endpoints, and running strings on the memory dump in an effort to locate indications of the use of IP addresses. I wrote up a message to the team, describing why this was an incorrect approach, and that what was expected is that they'd use Volatility and bulk_extractor to get the necessary information. I also provided a technical description as to why they needed to do this, and why they needed to use both methods.

What's common across both organizations and time is that without some modicum of consistency in processes, what you're left with is an inefficient, error-prone mess that, thankfully, cannot be replicated. Regardless of whether it's DF or SOC work, if everyone has their own way of doing things, and there's no common, consistent processes, and no way to develop and operationalize corporate/institutional knowledge across the entire analyst base, then engagement or ticket completion times will vary, accuracy will vary and be difficult to assess, some analysts will spend a great deal of time chasing down rabbit holes, and other analysts will move very quickly to incorrect answers and findings. In some cases, you'll notice that analysts will spackle over gaps in analysis with guesses and assumption.

The other thing you'll notice about these organizations, and ones like them, is that the less consistency there is, there's also little to no oversight. That is, there's no one monitoring output, no one doing "QA" or "QC". For many customer organizations, this means that what they receive is also going to be inconsistent, and the overall strategic issues, the things that could really protect them, will be missed.

Having consistency and developing processes isn't about restricting what analysts can do. Rather, it's about taking those aspects of analysis that appear regularly, finding the "best" way of conducting the parsing, and then, if possible, automating not just the parsing, but also the enrichment and decoration of that data. After all, these are things you're going to do anyway, right? If you find an IP address, you're going to look it up on some platform, such as VirusTotal, so why not automate it? Why not use CPU cycles to parse out Windows Event Logs, extract IP addresses from login (and other) events, do some form of look-up, and then tag that entry in some way with what you find. Doing all of this automatically doesn't take anything away from an analyst, other than a great deal of very manual work, and provides them with additional time to focus on actual analysis.

Next Steps
So here's what you do...write down the steps you take. Make it repeatable. Make it so that 6 months from now, you or someone else can follow the same steps on the same data and get the same results. Repeatability leads to consistency, and if it's written down, you don't forget steps. You don't forget to collect Prefetch files because the last 6 systems you looked at were servers and didn't have Prefetch files. You don't forget to parse the AmCache.hve file.

Once you've written it down, you have some place to start. Now, notice that I said, "write it down", but not that it's written in stone, not that it's immutable. You have a baseline now, and you can deviate from it, in part by adding justification for that deviation to your process. It's easy..."I collected and parsed the PCA files because this was the first Windows 11 system I'd seen in X months." Boom. Done.

With it written down, how much can you automate? If you mount the acquired image, or put the triage data in a specific folder structure, is this something you can easily do every time? Yes? Okay, so then, can you automate your parsing process? If the data is in the same location every time, can you automate the process so that a single command or button press can get everything parsed?

At one point in my career, I'd thought that having a lab intake process was the way to go...acquired images, laptops, or just hard drives could be sent to the lab, where the intake technician would take care of connecting the device/data, running through the parsing, extraction, enrichment and decoration process, and then inform the analyst when the results were ready. At that point, the analyst would have access to the parsed data, as well as the original "evidence", if needed. But they wouldn't have to do the processing themselves, and there wouldn't be a bunch of missed steps, and gaps in the reporting.

Let's assume that the automation is complete, to some extent. It doesn't have to be fancy, and it doesn't have to be everything at this point. Now that we've got stuff written down, we have something we can build on, that we can add to and extend. Now only can we add other data sources, but we can add things like enrichment and decoration, from external sources or from previous incidents. Now that we've got some modicum of automation, a lot of the manually-intensive "heavy lifting" is now being done by the computer. Now we have a more efficient, less error-prone process that frees up a LOT of time for things like actual analysis, lessons learned development, and baking those things we learn back into the process.

Apple Plans to Launch a MacBook Ultra and M6 MacBook Pro This Fall

Sat, 27 Jun 2026 12:31:49 +0200

If you are waiting for a new computer from Apple, you might have a lot to look forward to later this year. Fresh rumors suggest the brand is getting ready to launch two very different high-end laptops this fall. It looks like buyers will get to choose between a completely redesigned top-tier model and a familiar design that simply gets the newest brain on the inside. A brand new touchscreen laptop joins the lineup with older chips Recent leaks show the tech giant is working on a brand new option called the MacBook Ultra. This top-end gadget will reportedly feature a total redesign that makes it much thinner and lighter than current models. It is also expected to bring some huge firsts to the Mac lineup, including an OLED screen and a real touchscreen. However, anyone expecting the newest processor might be a bit surprised. As noted in a recent post stating the touchscreen MacBook will feature M5 chips instead of M6, the company plans to stick with the current M5 Pro and M5 Max chips for this new release. It seems the brand wants to focus its energy on getting the new touch design right before pushing the internal speeds even higher. The standard laptop design gets a bump with the newest processor For people who do not care about a touchscreen or a super-thin body, there is another great option coming. Alongside the Ultra model, the company also plans to drop an updated version of the regular MacBook Pro. This standard model will keep the same look and feel that buyers already know and like. The big difference for this standard model will be on the inside. Rumors indicate this machine will actually feature the brand new M6 chip. This means buyers will face a pretty tough choice this fall. They can either grab the familiar machine with the fastest new processor, or they can choose the fancy new Ultra design that runs on slightly older hardware.

Govee Floor Lamp 3 Review

Sat, 27 Jun 2026 04:18:26 +0200

Author: Shannon Morse - Bewertung: 13x - Views:112

This is Govee Floor Lamp 3 and it's pretty nice! Thank you @goveeofficial for sending it over for review. 🙂

No reposting without permission 🩷

Von BookTok zu Amazon Prime Video: "Off Campus", "Fourth Wing" und Co. - Diese Bestseller werden vom Streamer verfilmt!

Fri, 26 Jun 2026 21:18:22 +0200

Amazon Prime Video hat sich BookTok-Verfilmungen gewidmet. "Off Campus", "Fourth Wing" und Co. - Diese und weitere Serien und Filme hat der Streamer für euch bald parat. Dieser Artikel wurde einsortiert unter TV-Serie / Webserie, Amazon Prime Video, Entertainment, Serien, Neu bei Amazon Prime Video: Diese Film- und Serienhighlights erwarten euch im Juni 2026, Der Sommer, als ich schön wurde: Staffeln und Episodenguide, Maxton Hall - Die Welt zwischen uns: Staffeln & Episodenguide, Filme, Fourth Wing: Fans dürfen sich freuen - Rebecca Yarros schwärmt vom Drehbuch der Amazon-Serie, Amazon Prime Video, Off Campus: Staffeln und Episodenguide, Every Year After: Staffeln und Episodenguide.

DEAD OR ALIVE 6 Last Round Review (PC)

Fri, 26 Jun 2026 19:38:17 +0200

It’s clear for many fighting game fans that 3D fighting games are by far the most challenging ones to make. And Virtua Fighter or Tekken fans know that all too well. Yet DEAD OR ALIVE 6 Last Round manages to take the series forward, with some interesting upgrades. Right off the bat, the thing you will notice about the game is that it comes with a new engine, making the game look better than ever before. Visual fidelity has improved exponentially this time around, making the world feel more immersive. I still feel that the cutscenes are lower quality than the game itself, which normally is not the case. But it’s still pretty good overall, and the visuals will definitely keep you going. Additionally, there’s more focus on shading and lighting. You can see that on most maps, but it’s particularly evident on the Lost Paradise stage, particularly its oboro version. Not all maps were improved, but the developers committed to offer those down the line as free updates. Pe...

Chrome Dev for Desktop Update

Fri, 26 Jun 2026 17:54:18 +0200

The Dev channel has been updated to 151.0.7912.0 for Windows, Mac and Linux.

Chrome Release Team
Google Chrome

China-Linked Malware Found in Counterfeit USB Drives Used on Japan Defense Force Classified Networks

Fri, 26 Jun 2026 13:54:07 +0200

Japan’s defense infrastructure has faced scrutiny following an investigation that revealed members of the Japan Self-Defense Forces (JSDF) used counterfeit USB drives embedded with malware linked to China on systems handling classified information. According to findings reported by Nikkei, these compromised USB devices were acquired at significantly lower costs through unofficial channels. They were subsequently […]

The post China-Linked Malware Found in Counterfeit USB Drives Used on Japan Defense Force Classified Networks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

What CISOs need to tell the board about zero trust in OT: A 90-day communication and action plan

Fri, 26 Jun 2026 12:09:07 +0200

I work as a principal specialist at a pipeline operator where Operational Technology (OT) is the backbone of the business. I do not report to the board or act as a CISO, but the issues that get raised to those levels affect my job every single day.

Since the Colonial pipeline ransomware incident in 2021, it has become apparent that our industry has started posing different tones of “Are we zero trust yet?” I frequently witness its intense significance through auditing requests, TSA security directives and conversations around some control project’s goals.

One experience the zero trust role has changed is that it often feels misaligned with OT heavy environments. The NIST’s Zero Trust Architecture (SP 800‑207) model works for all, but is originally written as though for an IT network, not terminals, compressor stations and control rooms where equipment must run 24/7, perhaps more aged than the technology present within the organization. CISA’s guidance on adapting zero trust principles to operational technology helps close that gap, but applying it means satisfying the OT teams and company leadership at the same time.

The zero trust question I hear behind the scenes

I am pretty sure we all know it comes as a jolt of reality after something really major has happened, rather than a bullet point on a slide deck. You have pipeline. The whole distribution stops for six days. In Washington, DC, US congressional hearings are underway, and legislation is coming. TSA Directive 2021-02C requires pipeline operators to attest to several things, like network segmentation and zero-trust architectures.

NERC CIP-013 exists on a similar tack, more around supply chain security. In our case, the decision on how to select and manage a vendor partner and control their remote access is driven by regulatory compliance and governance frameworks. So, you have all those things that happen externally and force change. They say, “Are you zero trust? Yes or no?” We always get “yes.” They know it is not “yes, ” and the vendors know it is not “yes,” and nothing gets done about it until something happens.

How I reframe zero trust for OT in my work

My influence comes from how I frame problems and options in the conversations I am invited into. Zero trust is a good example.

NIST’s SP 800‑207 describes zero trust as a model where access decisions are to be based on strong identity, policy and context rather than network. CISA’s OT guidance narrows it, advising operators on the appearance of devices, identity management and what overlaps with IT instead of the overall replacement. Why zero trust breaks down in IoT and OT environments” highlights that when facing the complications of IoT and OT environments, one needs to be proactive.

During these conversations, I try to focus on three major points when talking about IoT.

Refer to zero trust as its functioning principle. In my experience, teams respond better when I say “Every user and system has to prove who they are and why they need access” than when I talk about abstract architectures. That language matches what NIST and CISA emphasize without overwhelming people with jargon.
Focus on where IT and OT converge, like jump hosts, historian connections, remote access paths and shared identity stores that span both worlds. Those are the choke points where zero trust style controls like stronger authentication, least privilege and detailed logging can give us quick wins without disrupting operations that depend on predictable behavior.
Tie everything that we need to do to the existing requirements. The conversation moves from “why are we changing this?” to “how do we do this well?” which aligns with TSA Security Directive Pipeline‑2021‑02C, a CISA alert or a NERC CIP‑013 requirement.

A 90-day plan OT leaders can execute

While someone operates a gas pipeline, they cannot play around with zero trust. Questions such as: “What can we accomplish before the TSA checks up next quarter?” Or “How can we show the internal audit team we are making progress this month?” comes often. We have established a list of actions we take over in a ninety-day plan, because we find it aligns more with our industrial settings while also being transferable to other OT settings.

Days 1–30: Map assets and identities at the IT/OT boundary

The first 30 days are for increased visibility. I focus on a relatively simple question: “Who and what can currently reach OT, intentionally or accidentally?”

CISA’s guidance on zero trust for OT, alongside other warnings, advocates for identifying and managing assets and communications where IT and OT interfaces exist, in addition to informal remote access routes. Also, TSA requires pipeline operators to regularly update and manage plans detailing which networks, systems and access points they will assess as per their established requirements across both IT and OT.

In my position, it comes down to three actions. First, I work with OT engineers, network staff and asset inventory systems to determine which OT assets threaten operations, safety or compliance if compromised, rather than inventorying every device. Second, I map the users and links that reach into OT, such as internal staff granted advanced privileges, remote vendor support, VPNs and cloud platforms that interact with production data. Third, I categorize these identities and connections based on risk, impact and exposure, not by their roles.

By the close of the first 30 days, the intention is to present leadership with an easily comprehensible overview: outlining the critical OT assets, delineating the entry points from both internal IT systems and external sources and identifying the associated identities. Having established this common understanding makes subsequent zero trust discussions less vague.

Days 31–60: Contain vendor remote access and create early wins

Look for quick wins in the next month, in a high-impact but non-disruptive area. Vendor or third-party remote access often fulfills it, and CISA has warned about it and continues to do so.

Their guidance emphasizes best practices, including using MFA, segmented user privileges and monitoring third-party activity independently. The NERC CIP-013 requires utilities to consider cybersecurity threats and risk management that protect their supply chains and suppliers that connect to critical systems. The TSA’s pipeline directives expect close monitoring and controls of remote access. In my case, early wins look like telling a vendor: OK, instead of an unsecured, remote access method, use an audited brokered remote access solution. MFA for any and all remote OT sessions. Close old vendor RDP connections that are not in service. You are simply saying that times change and since these methods were put in place a few years back, they have evolved; it is reasonable for you to evolve.

Days 61–90: Build a simple maturity scorecard and narrative

The third month is about visibility and repeatable progress. We now will have more clarity on assets and identities traversing the IT/OT boundary and have choked down the most dangerous of remote access paths. Now we will take time to track where we have been over time.

I will consult with leaders within security and OT teams to identify the right-sized set of metrics relevant to the specific context of the organization. While the specific terminology may vary, many will align with common language found in TSA, NERC, CISA and other industry documents. Consider the broad themes of “govern, protect and detect & respond”.

We can then identify solid “now” and “better next quarter” capabilities within each of these themes. “Govern” could incorporate specific OT policies on identity and access management that pull in zero trust directives alongside existing authoritative frameworks. “Protect” might track what fraction of your high-impact OT assets have been put behind better segmentation practices, coupled with the percent of your remote access pathways to OT identified as high-risk that have both MFA and a brokered connection. “Detect & respond” could see tested playbooks in place assuming a remote connection compromise that directly injects malware into an OT system, which aligns with how recent incidents have unfolded throughout North American utilities.

The output is not a scorecard to pass around but will be a meaningful, honest conversation for our leaders. You will know how to accurately frame how your organization applies zero trust in the OT world today, show what you achieved over the past three months and honestly describe where there is more work ahead.

I am not the only one trying to make zero trust ideas actually fit OT, and I pay attention to the CISOs who voice the same frustrations with IoT and OT environments. We are solving the same problem from different seats. What I have found is that a workable 90-day plan, updated monthly, beats any pledge to “Let us achieve zero trust together”

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Found my Caldera Linux diske... I may install this on a spare PC tomorrow or this weekend.

Fri, 26 Jun 2026 04:26:27 +0200

It came with 2 other CDs as well. A "Installation from Windows Commercial Packages" and a "Source Code " CD. I'm actually really wanting to install this soon. Maybe tonight. As I recall it was a pretty nice system honestly.

submitted by /u/Phydoux
[link] [comments]

Chrome for Android Update

Fri, 26 Jun 2026 03:38:48 +0200

Hi, everyone! We've just released Chrome 149 (149.0.7827.200) for Android. It'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 149.0.7827.200/201, Linux: 149.0.7872.200) unless otherwise noted.

Harry Souders

Google Chrome

Stable Channel Update for Desktop

Fri, 26 Jun 2026 00:22:47 +0200

The Stable channel has been updated to 149.0.7827.200/201 for Windows and Mac and 149.0.7827.200 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Security Fixes and Rewards

This update includes 3 security fixes. Please see the Chrome Security Pagefor more information.

[N/A][513138301] High CVE-2026-13281: Integer overflow in Mojo. Reported by Google on 2026-05-14

[N/A][517522620] High CVE-2026-13282: Use after free in Payments. Reported by Google on 2026-05-28

[N/A][522561151] High CVE-2026-13283: Use after free in AdFilter. Reported by Google on 2026-06-11

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Daniel Yip

Google Chrome

Nvidia’s direct-to-chip liquid cooling is a sustainability and a performance win

Thu, 25 Jun 2026 20:17:20 +0200

“We have eliminated massive amounts of power usage and pretty much all water usage” – Nvidia Rubin to use 45°C direct-to-chip cooling.

Here’s a bunch of Prime Day deals on keyboards, mice, and other peripherals we like

Thu, 25 Jun 2026 20:03:03 +0200

RAMageddon has come for computers. The price of memory chips, hard drives, and solid state storage has skyrocketed. That’s led to price increases on desktop and laptop RAM, SSDs, spinning hard drives, and pretty much everything that uses any of those things. Consoles are more expensive. Desktops are more expensive. Laptops are more expensive. Tablets […]

Chrome Dev for Android Update

Thu, 25 Jun 2026 18:54:21 +0200

Hi everyone! We've just released Chrome Dev 151 (151.0.7910.0) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Agentic AI security steals the spotlight at Confidential Computing Summit

Thu, 25 Jun 2026 18:50:06 +0200

For a decade, confidential computing has been chipping away at one of security’s hardest problems: data is well encrypted in transit and at rest, but when a processor works on it, that data sits in memory in the clear, exposed to anyone with privileged host access.

“Confidential computing’s aim was to solve this with a trusted execution environment, a subset of the CPU that runs the encrypted workload and handles things like memory encryption,” said Marina Moore, lead security researcher at Edera.

For years the field felt like post-quantum cryptography PhD research scientist types agreeing the work is essential, while waiting for it to reach mainstream practitioners. At the Confidential Computing Summit in San Francisco this week, the breakout use case came into focus: agentic AI.

Like the web before HTTPS

“I was in the really early days of HTTP, and then HTTPS came along pretty quickly,” said Mike Bursell, executive director of the Confidential Computing Consortium. He sees agentic AI where the web sat before certificate authorities and public key infrastructure brokered trust online.

“The original agent specifications were not written by security architects,” Bursell said, and “some of it feels in need of refinement.”

The gap confidential computing fills is attestation, which provides proof of what runs. The hardware hashes the memory and firmware of a protected execution environment and signs the result inside the chip, Bursell explained, producing a measurement a verifier checks against the expected software. Without it, an agent session shares the early web problem of open windows for hijacking, except the attackers are now agents themselves.

The old objection that confidential computing demanded exotic hardware is largely gone, Bursell said, now that it ships in AMD, Intel, and NVIDIA parts and turns on with a click in Microsoft Azure or Google Cloud. The goal is to make confidential computing so accessible that secure execution becomes the default assumption rather than a specialized deployment choice, and that trust alarms go off when secure execution criteria are not met, much like how a user visiting a non-HTTPS website is greeted with a warning.

Identity and attestation move into standards

Many of the working sessions at the Confidential Computing Summit, hosted by the Linux Foundation, were about turning these mechanisms into standards, following the same path internet security took through bodies such as the IETF and IEEE.

Raghu Yeluri, senior principal engineer at Intel, detailed a composite attestation format that Intel, Microsoft, and NVIDIA built so that attestation data can span confidential VMs, their CPUs, and GPUs, without vendor-specific formats. Yeluri said the group hopes to advance that work toward an RFC within the next year.

That effort runs through the Confidential Computing Consortium, the Linux Foundation community where competing companies collaborate on shared infrastructure problems. The consortium is not trying to become a registry of trusted agents, Bursell added, but rather a place where companies can develop frameworks, best practices, and, equally important, antipatterns.

Identity drew some of the strongest interest at this week’s event. Pawan Khandavilli, senior product manager at Microsoft, pointed to agent payment initiatives from Visa, Mastercard, and Google, the FIDO Alliance’s emerging agent work, SPIFFE workload identities, and RFC 8693 token exchange. The pieces already exist, Khandavilli argued, but “the vocabulary is fragmented.” The challenge now is connecting those identity systems to hardware-backed attestation rather than relying solely on software trust.

The attack surface below the attestation

Hardware-isolated environments are only as secure as the shared substrates beneath them. Zvonko Kaiser, principal systems engineer at NVIDIA, argued that attestation protects the trusted execution environment itself but does not eliminate risks in the shared substrates underneath. The processor cache sits below every isolation boundary, and a 2026 technique called TDXRay demonstrated how information could be observed across virtual machine boundaries. No layer above the cache, Kaiser argued, can completely hide what the cache itself sees.

The Kubernetes control plane presents another challenge. One etcd store may hold secrets for multiple tenants, while a shared scheduler decides where workloads run. Those shared services create opportunities for compromise that sit outside the guarantees provided by confidential computing hardware.

Antoine Delignat Lavaud, principal researcher at Microsoft, highlighted another limitation. Attestation can prove that a workload runs on authentic confidential computing hardware, but “it doesn’t tell you where it is running,” leaving questions of data residency and sovereignty unresolved.

“Confidential computing is hardware based. If and when vulnerabilities are discovered, it’s much harder to patch those and re-establish the security,” added Edera’s Moore.

Microsoft’s Khandavilli outlined four major gaps that still require industry coordination: binding agent identities directly to hardware, bringing attestation into the Model Context Protocol that increasingly governs tool access, establishing trusted chains when agents delegate work to other agents, and enabling trust relationships across cloud providers. Intel’s Yeluri noted that confidential computing will not solve every security problem, but it provides the foundation upon which higher-level controls can be built.

HTTPS for the agentic era

What was clear from the Confidential Computing Summit is that security for AI agents increasingly resembles the trust infrastructure that underpins today’s internet. Certificates, identity brokers, verification services, and cryptographic handshakes established trust between systems that did not know each other. Agentic AI appears headed toward the same destination.

For example, last month the Linux Foundation announced DNS-AID, extending domain name system concepts into agent discovery and introducing an Agent Name Service framework for agent identity.

Who ultimately operates those trust services for agents is “still coming out in the wash,” said Bursell. “Regulators, governments, software vendors, cloud providers, and others may all play roles. If you can’t establish trust, you can’t understand or manage risk.”

Confidential computing is focused on the layer beneath those systems, creating ways to verify the environments where agents execute and the actions they perform. If that work succeeds, the trust fabric that emerges around agents may end up looking remarkably similar to the one that quietly powers the internet today.

Slate’s electric truck: all the news about the ultra-minimal EV

Thu, 25 Jun 2026 18:03:54 +0200

Slate Auto is a new startup that emerged out of a secretive project called “Re:Car” within Re:Build Manufacturing, a domestic manufacturing project backed by Amazon founder Jeff Bezos. The company’s first electric vehicle is a barebones electric pickup that’s roughly a third of the size of your typical gas-powered truck. And the proposal is pretty […]

Chrome for Android Update

Thu, 25 Jun 2026 00:08:15 +0200

Hello Everyone! We've just released Chrome 150 (150.0.7871.46) for Android to a small percentage of users. It'll become available on Google Play over the next few days. You can find more details about early Stable releases here.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Krishna Govind
Google Chrome

Chrome Stable for iOS Update

Thu, 25 Jun 2026 00:08:13 +0200

Hi everyone! We've just released Chrome Stable 150 (150.0.7871.51) for iOS; it'll become available on App Store in the next few hours.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Klue me in on the breach.

Wed, 24 Jun 2026 22:38:34 +0200

LastPass says Klue breach affected customer information, but passwords remain secure. Attackers begin exploiting Cisco Unified CM vulnerability. CISA flags actively exploited Ubiquiti and Lantronix flaws, urges rapid patching. DifyTap flaws could expose private AI conversations across tenants. Researchers find AI plugin registry let unofficial tools masquerade as trusted software. xpl0itrs launches leak site, signaling shift toward full-service cyber extortion. Ransomware attack hits Indian auto giant Bajaj Auto. U.S. presses Meta to submit AI models for national security reviews. Alleged criminal marketplace administrator extradited to the US. U.S. expands sanctions against Cambodian scam network tied to cyber fraud operations. On today’s Industry Voices segment, we are joined by Mike Masciulli, Managing Director, Migration Products and Services at Semperis, discussing RC4 and AD Migration: The Break Scenarios Hiding in Your Source Domain. And a lesson in access control.

Chrome Beta for iOS Update

Wed, 24 Jun 2026 21:53:38 +0200

Hi everyone! We've just released Chrome Beta 150 (150.0.7871.52) for iOS; it'll become available on App Store in the next few days.

You can see a partial list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Early Stable Update for Desktop

Wed, 24 Jun 2026 21:53:36 +0200

The Stable channel has been updated to 150.0.7871.46/.47 for Windows and Mac as part of our early stable release to a small percentage of users. A full list of changes in this build is available in the log.

You can find more details about early Stable releases here.

Daniel Yip

Google Chrome

Chrome Beta for Desktop Update

Wed, 24 Jun 2026 20:39:04 +0200

The Beta channel has been updated to 150.0.7871.46 for Windows, Mac and Linux.

Chrome Release Team
Google Chrome

Boffin Claims Microsoft's 'Quantum Leap' Is Invalid Due To 'Basic Python Errors'

Wed, 24 Jun 2026 19:09:13 +0200

A peer-reviewed Nature critique argues that Microsoft's 2025 Majorana quantum-computing breakthrough -- and its claim that it could enable "a truly meaningful quantum computer not in decades, as some have predicted, but in years" -- is fundamentally flawed. According to Dr Henry Legg, a lecturer at the University of St Andrews, the claims were undermined by omitted data, selective plotting, and basic Python errors that concealed alternative results. Microsoft, for its part, says the bugs were minor and stands by its findings and roadmap. The Register reports: "Last year they claimed to be years, not decades from a 'topological quantum supercomputer,'" Legg told The Register in an email. "My feeling is that they are centuries, not decades away. If it works at all -- and, based on what I have seen, the most likely scenario is that it doesn't work." Based on his analysis of the research Microsoft published in 2025, Legg argues that the company's claims about finding and being able to control the elusive Majorana particle to build a topological superconductor do not withstand scrutiny. "I demonstrate that Microsoft's tune-up software is flawed and that coding errors resulted in incorrect statements to peer reviewers," said Legg. "Raw data, which was omitted from the original paper, also appears to indicate Microsoft's devices contain considerable disorder and are not compatible with the existence of a topological gap. In other words, the prerequisites for Microsoft's claims do not appear to be met, but this was obscured because this data did not appear in the original publication." Essentially, Microsoft has proposed a Topological Gap Protocol (TGP) that can be used to detect the phase transition deemed to be a prerequisite for conducting quantum calculations using Majorana particles. Legg argues that based on his analysis of underlying transport data (measurements of particle change) -- omitted from the original publication -- Microsoft chose to focus on results that supported its thesis and ignored data that could be interpreted as a negative result. As he notes in his critique: "The TGP plotting code was set to highlight only the largest purportedly topological region." "The primary consequence was the omission of other regions that passed their tune-up protocol (the TGP)," said Legg. "When peer reviewers asked if other regions existed, Microsoft inaccurately stated that they had investigated the only region passing the protocol within the explored range. This was not correct." Legg also argues that Microsoft mishandled its code. "The code antisymmetrized bias voltage based on array index rather than physical value," his analysis says. In other words, Microsoft's researchers made a basic programming mistake by evaluating the array index -- the number identifying a value's position in an array -- instead of the value to which the index refers. "There were two pretty basic Python programming errors that hid these alternative regions," Legg explained. "Their plotting software was hardcoded with a filter (zbp_cluster_numbers=[1]) that forced it to display only the single largest region, concealing other successful results from their phase maps. Changing this to zbp_cluster_numbers=[1,2] shows already a second region." Legg added: "The TGP software transformed the data by simply reversing a Python array (x[::-1]) based on its index position, ignoring the actual physical bias voltages."

Read more of this story at Slashdot.

Chrome Beta for Android Update

Wed, 24 Jun 2026 16:54:09 +0200

Hi everyone! We've just released Chrome Beta 150 (150.0.7871.46) for Android. It's now available on Google Play.

You can see a partial list of the changes in the Git log. For details on new features, check out the Chromium blog, and for details on web platform updates, check here.

If you find a new issue, please let us know by filing a bug.

Chrome Release Team
Google Chrome

Every Apple Watch is at the lowest price we’ve ever seen thanks to Prime Day

Wed, 24 Jun 2026 16:48:09 +0200

A guide to the Prime Day deals on Apple’s top-rated smartwatch and how to choose the right model for you

The Apple Watch has been around for a decade, so it’s safe to say you’ve already heard the evangelism from fawning owners: fitness tracking for everything from running to rowing, phone alerts on your wrist, a limitless variety of watch faces for every occasion. The latest versions have even added the ability to take an electrocardiogram, 5G connectivity and off-grid satellite messaging.

It’s no wonder the Apple Watch Series 11 earned a five-star review from our consumer tech editor and regularly pops up in our gift guides for pretty much everyone. The Apple Watch is beloved by moms, customized by dads and requested by tweens.

The Rise of the Non-Human Workforce

Wed, 24 Jun 2026 15:09:10 +0200

Your New Employees Don't Need a Desk, a Laptop, or a Payroll Number

"Life moves pretty fast. If you don't stop and look around once in a while, you could miss it." — Ferris Bueller

What do the IPOs for SpaceX, OpenAI and Anthropic mean for Microsoft?

Wed, 24 Jun 2026 13:18:46 +0200

The AI IPO tsunami on the stock market has only recently gotten under way, with SpaceX’s more-than-$2 trillion IPO likely to be followed in several months by OpenAI’s and Anthropic’s IPOs — each of which is likely to hit $1 trillion.

That will mint three new trillion-dollar AI companies in a matter of months, all of which compete with Microsoft.

Wall Street has never seen anything like it. Previously, the most money raised by all IPOs in a single year was $671 billion in 2021. It took 38,644 deals to get to that figure. Compare that to three deals this year that by themselves will likely total $4 trillion.

The numbers are eye-popping.

For Microsoft though, it’s not the numbers themselves that are important. It’s what will happen to the company once it as three newly minted trillion-dollar AI competitors. Until recently, when it came to AI, Microsoft was king of the hill. But can it keep that place?

Microsoft’s weakened position

The IPOs come at a particularly fraught time for Microsoft. At one point, it was the most valuable AI company in the world, with a big head start on the tech industry.

No longer. Microsoft’s stock price has tanked in the past 12 months, even as the S&P index has soared. In the last year, Microsoft’s stock price has dropped 24%, while the S&P has jumped 24%. The two were pretty much in sync until last fall..

Microsoft has fared even worse against its most powerful AI competitor, Google. In June 2025, Google’s total value was $2.1 trillion, well behind Microsoft’s $3.57 trillion. By mid-June this year Google was worth $4.5 trillion, Microsoft, $2.8 trillion. That’s entirely due to Google’s AI push and Microsoft’s failure to improve Copilot significantly.

Matt Vellosso, who worked for Microsoft for 14 years — including four as technical advisor to CEO Satya Nadella and then as Partner Director for fostering AI innovation in Windows before leaving in 2023 — is scathing about what he views as Microsoft’s AI failures.

He warned: “Microsoft missed the internet wave, the mobile wave and now it missed the AI wave.”

Show me the money

The most immediate likely impact on Microsoft after the three massive IPOs take place will be on the company’s stock price, which could well take another hit. Investors don’t want to miss out on the AI boom, and until now, there’s been a relatively small number of companies in which they could. When Anthropic and OpenAI join SpaceX as publicly traded companies, investors will have three more choices than they did only a few months ago. That could make it tougher for Microsoft to attract AI-focused investors. And that, in turn, could knock down its stock price.

A lower stock price means the company will have a harder time raising money when it needs it. In addition, Microsoft won’t be able to as easily buy other companies in stock-only deals, because the value of its stock will be less.

Still, the IPOs are not all bad news for Microsoft’s stock position. It does, after all, own 27% of OpenAI. So if OpenAI is valued at $1 trillion after its IPO, Microsoft has a $270 billion stake in it.

Thumbs up for increased Azure revenue

One area where these mega IPOs should be unalloyed good news for Microsoft is in Azure revenue, which should significantly. Microsoft’s final divorce settlement with OpenAI requires the latter to buy $250 billion in Azure services through 2030. And its estimated trillion-dollar valuation ensures the company will be around for the long term, meaning Microsoft can count on that revenue — and possibly more on an ongoing basis.

Microsoft will likely also get tens of billions of dollars from Anthropic for Azure cloud services. Anthropic might spend $43 billion annually on Azure cloud services by 2030, according to estimates by HSBC, one of the world’s largest banking and financial services companies.

Thumbs down for the effect on Copilot

Although Azure use will boom thanks to the IPOs, Microsoft’s own Copilot could face significant competition at a time when it’s having serious problems gaining traction. In its April 2026 earnings call, the company said Microsoft 365 Copilot had 20 million paid seats. That’s up from 15 million paid seats as of January, but still a minuscule number, considering Microsoft has 450 million Microsoft 365 commercial subscribers. That means only about 4% of the company’s business customers have been willing to pay for it since its launch in late 2023.

Beyond that, developers have been leaving GitHub Copilot and turning to Anthropic’s Claude Code and SpaceX’s recently purchased Cursor. A survey by the software development company JetBrains of more than 10,000 developers found that 29% used GitHub Copilot, 18% used Cursor and 18% used Claude Code.

Early in 2025, GitHub Copilot had a commanding 67% market share.

More downside than up from the IPOs

Although the IPOs do have some upside for Microsoft — dramatically increased Azure revenue and several hundred billion dollars in OpenAI stock holdings — mostly, they’re bad news thanks to increased competition.

Unless Microsoft significantly improves Copilot for businesses, developers and consumers, the company’s one-time AI dominance will erode even further.

The Android dark mode power-pack: 5 secrets for a smarter screen setup

Wed, 24 Jun 2026 11:48:13 +0200

Few things are as delightfully divisive as Android’s dark mode.

Some phones now ship with Android’s darker-style interface activated by default. Most reasonably recent devices offer it as a swift ‘n’ simple toggle. And most people, in my experience, have amusingly strong preferences about which approach they prefer — the standard Android “light” mode, in which screens tend to be bright and with shades of white as a foundation, and the dark mode (a.k.a. “dark theme”), where black and dark gray dominate and everything is much more muted and muddy.

It really is a night and day difference, so to speak — but no matter where you fall on the light vs. dark preference spectrum, it’s well worth your while to noddle over two pertinent points:

Android’s dark mode doesn’t have to be an all-or-nothing decision. With the right setup, you can use it as a dynamically activated sometimes switch that enables itself automatically based on different variables and gives you a darker, less glary motif when conditions call for it while leaving you with the lighter, brighter look the rest of the time.
Regardless of how often you’re using dark mode, a few easy adjustments will make it meaningfully more complete and effective as an end-to-end interface style for whatever you’re doing on your device.

It occurred to me recently that we’ve gone over several smart Android dark mode enhancements over the past weeks and months — and that, put together into a single power-pack bundle, these small-seeming items can add up to create a pretty dramatic difference in your Android-using experience, whether you’re a full-fledged dark mode convert or a more light-preferring vampire skeptic.

Here, specifically, are five easy ways to make Android’s dark mode meaningfully better for you.

[Keep the nerdy knowledge coming with my free Android Intelligence newsletter — something new and useful in your inbox every Friday!]

Android dark mode power-up #1: The app expansion

Up first is a feature that arose as part of our Android 17 discussion and sparked the entire idea for this collection — and that’s the one-tap switch in the latest Android version that forces every app on your phone to follow your dark mode preference, whether the program technically supports such a setting or not.

In Android 17, finding and flipping that switch will make every app turn dark whenever the system-wide dark mode is active. It eliminates the irksome exceptions that’ve traditionally stayed stubbornly light (due to developer laziness) even when your dark theme is on.

If you’ve got Android 17 on your phone already, it couldn’t be much easier to make it happen. Just look in the Display section of your system settings, tap the words “Dark theme,” then change the setting that shows up next from “Standard” to “Expanded.”

Android’s new “Expanded” option lets you force apps into dark mode compliance, even if they aren’t designed to do it on their own.

JR Raphael, Foundry

No Android 17? No problem: On devices with reasonably recent pre-Android-17 system software, you can actually find a switch buried deep in some developer settings that’ll let you enable the exact same option without any waiting.

Follow these instructions and enjoy your new universally consistent darkened dynamic.

Android dark mode power-up #2: A darkened web

That first trick fixes the issue of certain apps not following your dark mode preference — but what about the web? Most of us spend a fair amount of time in our browsers these days, and most websites won’t follow a dark mode setting and adjust their interfaces accordingly.

They absotively can, though. With the flip of a single switch buried within your browser’s bowels, you can force every website into a darkened motif whenever your system-level dark mode is up and running.

See?

Viewing a website in Chrome normally, at left, and with dark-mode-associated web darkening, at right.

JR Raphael, Foundry

Here’s the secret:

Open up Chrome on whatever Android device you’re using. (And note that this will also work with any Chromium-based Chrome alternative, like Brave, Edge, or Vivaldi.)
Type chrome:flags into the address bar.
Type darken into the search box at the top of the screen that comes up next.
See the line labeled “Darken websites checkbox in themes setting”? Tap the “Default” box beneath it, and change its setting to “Enabled.”
Tap the blue “Relaunch” button at the bottom of the screen.

Now, when Chrome comes back a second or so later…

Tap the three-dot menu icon in its upper-right corner.
Tap “Settings” in the next menu.
Scroll down until you see “Appearance.” Tap it, then tap “Theme.”
Make sure the newly added box for “Apply dark theme to sites, when possible” — which we just magically made appear via our last little modification — is checked and active.

Chrome’s web-darkening option appears only after you’ve enabled an out-of-the-way flag.

JR Raphael, Foundry

And that’s it: From that moment onward, whenever your Android device is switched into its dark mode, any website you’re viewing within Chrome will automatically follow suit. Nothing more to it, and no further thought or action ever required on your part.

Not bad, eh?!

Android dark mode power-up #3: A dark mode schedule

Even as someone who isn’t into dark mode as a 24/7 sort of thing, I can definitely appreciate the presence of a dimmer, less glary look on my device in certain specific scenarios.

It’s incredibly easy to overlook or forget, but Google’s actually got a way to handle that for you. In fact, it’s been built into Android itself since 2020’s Android 11 release.

Just look in the Display section of your system settings and tap the line for either “Dark theme” or “Dark mode settings.” If you see a toggle alongside that line, make sure you’re tapping the actual words next to it — not the toggle itself.

Then look for the option to create a schedule.

An Android dark mode schedule, as seen in Google’s standard Android interface (at left) and in Samsung’s Android style (right).

JR Raphael, Foundry

You can create a time-based rule for when your device’s dark mode turns on and back off again, or — more intelligent yet — you can set it to automatically activate at sunset, wherever you are at any given moment, and then turn itself back off and switch you back over to light mode at sunrise.

You can also integrate dark mode into Android’s rarely noticed Bedtime Mode so that the screen getting dimmer is part of your pre-sleep winddown routine, if you really wanna get wild.

Or — ahem…

Android dark mode power-up #4: Contextual dark mode

A dark mode schedule is pretty forkin’ sensible. But the reality is that even with a time-based setup or a sunset-driven activation approach, you’ll still be using your phone in bright rooms with dark mode active and vice-versa.

And if you want Android’s dark theme present only when you’re actually in a dark room — as makes the most sense in my mind — there’s an even more intelligent option.

It comes our way via a handy little free app called Adaptive Theme. That app does one thing and only thing only: It automatically adjusts your device’s dark mode setting based on the actual ambient light around you, using your phone’s sensors rather than an arbitrary time or a not-always-relevant sunset status as a guide. It makes so much sense, you’ll find yourself wondering why your phone didn’t just work that way from the get-go.

The app does unavoidably have a slightly complex one-time setup, which I outline step-by-step here. It’s perfectly safe to do, though, and it shouldn’t take you more than a couple minutes to pull off.

And once you’ve done that, your Android dark mode will just work for you — flipping on when the lighting around you is dim (to your exact specifications) and flipping back off when you’re in brighter surroundings.

Adaptive Theme lets you take total control of how and when Android’s dark mode activates based on your environment.

JR Raphael, Foundry

Yes, please — and thank you. Last but not least…

Android dark mode power-up #5: The wallpaper wizard

Superficial as it may seem, the one piece of the puzzle we haven’t yet addressed — that isn’t ordinarily affected by Android’s dark mode setting — is your home screen wallpaper.

By default, whatever wallpaper you set at the system level stays the same even as your interface moves between its dark and light states — and when you’re anglin’ for a dimmer, less glary look in dark environments, that can be pretty darn jarring.

An app called, rather aptly, Dark/Light Wallpaper Scheduler is the answer you never knew you needed. It’s pretty self-explanatory — you tell it which wallpaper you want when your phone is in dark mode and light mode, then it automatically switches ’em out for you based on that status — but I wrote about it in detail here, if you’re interested in reading more about how exactly it works and how you can make the most of it.

And with that, my fellow Android-appreciating animal, your dark mode power-pack is complete. Now, would someone please turn off the lights? I don’t know about you, but all this talk of darkness has me hankering for a nap.

Wake up to even more useful Android wisdom every Friday with my free Android Intelligence newsletter — one practical new trick to try each week, straight from me to ye.

Using Visual Studio Code’s ‘air-gapped’ AI model mode

Wed, 24 Jun 2026 11:03:55 +0200

Microsoft has been pushing hard to make Visual Studio Code a major way to consume its AI services, mostly in the form of GitHub Copilot. GitHub Copilot’s deep integration with VS Code brings many conveniences — inline autocomplete, for instance — but it’s frustrating for those, like me, who would rather use another model provider, or even a locally hosted LLM, for those functions.

Visual Studio Code 1.122 introduced a new feature, “Use BYOK [Bring Your Own Key] without a GitHub sign-in,” that allows you to “use chat, tools, and MCP servers in air-gapped or restricted environments where GitHub sign-in isn’t possible.” More importantly, it “enables fully offline workflows with local models like Ollama.”

In other words, you can now use locally hosted LLMs for chat, tools, and Model Context Protocol servers inside Visual Studio Code. The one thing you still can’t do is use a local LLM for inline and next-edit suggestions — at least, not without additional tooling.

Choosing a model for BYOK mode

If you want to use a local LLM with VS Code’s bring-your-own-model system, the first thing you need is a way to host the model. VS Code lacks a model-hosting mechanism of its own, although it’s conceivable that a VS Code extension may offer something like that in the future. That said, hosting models is complicated enough that a dedicated app is really needed for the job.

One easy way to host models is via a product like LM Studio, a convenient GUI for standing up, serving, and managing LLMs on one’s own hardware. The model host does not have to be the same system you run VS Code on, either. It can be on a server box you control, or on a cloud instance.

The choice of model is also important. Many models are powerful but won’t run well on commodity hardware because they’re simply too big. A good rule of thumb is to choose a model that fits into existing VRAM, along with the memory needed for a sizable token context (the more, the better). Also, the model should be suited to coding and development work. Some models in this vein that fit comfortably into 8GB VRAM include:

Setting up BYOK mode in VS Code

Once you have a model up and running, you can integrate it with Visual Studio Code. If you’ve disabled VS Code’s AI features, you will need to turn them on. Make sure the setting chat.disableAIFeatures is turned off. You can find it in Settings | Chat | Miscellaneous.

Third-party language models are managed through Visual Studio Code’s language model list. Press Ctrl-Shift-P and type Manage Language Models to open the list of existing language models.

Managing VS Code’s AI language model list. The models available by default are only models available as external APIs, not models that run locally.

Foundry

First you will see a list of the built-in models, which are all externally hosted. To add a new model, select Add Models at the top right and select Custom Endpoint.

You’ll then get a series of prompts:

Group Name: This is “Custom Endpoint” by default, but you can choose any name you want. The name is strictly for organizing the model list and doesn’t affect things like model recognition or connectivity.
API Key: If you’ve configured LM Studio to use an API key for serving models, provide it here. If you’re hosting the model locally and you haven’t explicitly set up API keys, you can leave this blank.
API Type: The options here are Chat Completions, Responses, and Messages. Most of the time you’ll want to use Responses, as it’s the most general-purpose option of the three.

Once you finish providing those answers, you’ll be dropped into a modal editor for a JSON file that holds the details about the endpoint you’re configuring.

A newly created custom endpoint for a locally hosted model. The ID, name, and URL still need to be defined for this model to be useful.

Foundry

You’ll need to provide a few more details by typing them into the labeled fields:

id: A text field that uniquely identifies this particular entry. The choice of ID is pretty much arbitrary; if you’re using only a single model, the ID could be the model name.
name: The name of the model that is used to identify it on the model server. In LM Studio, you can get this name by clicking on My Models in the main interface, then selecting the three-dot icon for the model in question and clicking Copy Default Identifier. For Qwen 2.5, for instance, name might be something like qwen2.5-coder-7b-instruct.
url: The URL to the server’s endpoint. On LM Studio, this defaults to something like http://127.0.0.1:1234/v1. The /v1 at the end is important because that endpoint is used for autodiscovery of models and their capabilities.

The other fields generally don’t need editing. Most models have tool calling functionality. If you know for a fact that the model you’re using doesn’t have vision support, then set vision to false.

Once you have these fields filled in, you can close the modal editor to save the changes. If you reload the Manage Language Models page, you’ll now see your new endpoint:

A newly created local endpoint. The choice of name and group is arbitrary. “Custom Endpoint” is the default name for a newly created group of endpoints.

Foundry

You should now be able to launch the chat window and use the defined model for conversation and utilities:

Conversing with the local model using VS Code’s chat window. Note the selected code block in the left pane that is being used as the context for the conversation.

Foundry

One current, and major, limitation of Visual Studio Code’s BYOK functionality is that it only works for chat and utility tasks. It doesn’t allow you to use a local model for inline suggestions or code completions. The only way to take advantage of local models for expanded functionality with VS Code is to use a third-party tool like Continue.

It isn’t clear if Microsoft will eventually lift this restriction. GitHub Copilot integration in VS Code is a large part of how Copilot as a service reaches its target audience. For the time being, you can certainly use third-party and local models for a significant part of your AI-assisted development work in VS Code, and you can close the functionality gap with additional tooling.

How to Download Windows 11 ISO to USB and Install It From Scratch

Wed, 24 Jun 2026 07:20:40 +0200

Key TakeawaysTo install Windows 11 on a new PC, download the Windows 11 ISO using Microsoft's Media Creation Tool and create a bootable USB drive; this avoids using unofficial downloads and ensures you have the latest version.Before starting, gather a working Windows PC with internet access, a USB drive with at least 8GB of storage, […]

The post How to Download Windows 11 ISO to USB and Install It From Scratch appeared first on iTech Hacks.

Chrome for Android Update

Wed, 24 Jun 2026 03:37:45 +0200

Hi, everyone! We've just released Chrome 149 (149.0.7827.197) for Android. It'll become available on Google Play over the next few days.

This release includes stability and performance improvements. You can see a full list of the changes in the Git log. If you find a new issue, please let us know by filing a bug.

Android releases contain the same security fixes as their corresponding Desktop releases (Windows & Mac: 149.0.7827.155/156, Linux: 149.0.7872.155) unless otherwise noted.

Harry Souders

Google Chrome

Stable Channel Update for Desktop

Wed, 24 Jun 2026 00:23:40 +0200

The Stable channel has been updated to 149.0.7827.196/197 for Windows and Mac and 149.0.7827.196 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Daniel Yip

Google Chrome

Extended Stable Update for Desktop

Wed, 24 Jun 2026 00:23:39 +0200

The Extended Stable channel has been updated to 148.0.7778.280 for Windows and Mac which will roll out over the coming days/weeks.

A full list of changes in this build is available in the log. Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Daniel Yip

Google Chrome

Netflix’s next TV gaming experiment will scare the hell out of you

Tue, 23 Jun 2026 18:19:07 +0200

As part of the latest evolution of its gaming initiative, Netflix has made a big push into cloud-based games you can play on your TV, much in the same way you'd watch a movie or show on the service. So far, these games have been pretty tame. Things like trivia, party games, and a weirdly […]

Sunsetting Tor 0.4.8

Tue, 23 Jun 2026 16:24:04 +0200

The Tor Project has announced that it is planning to actively stop supporting Tor 0.4.8 and earlier C Tor versions soon.

Usually, we try not to break existing releases, even if they are unsupported, unless we have a pretty good reason. In this case, we have several reasons. [...]

The most important reason is this: in 0.4.9, we have made some former fields in our directory data obsolete -- specifically, TAP onion keys and family lines. Removing these fields will let us save a great deal of client directory bandwidth for everyone. This, in turn, will make all Tor clients bootstrap a little faster, especially those on slow connections. But when we remove these fields, clients and relays running earlier versions of Tor will no longer work, since they expect the TAP onion keys to be present. Therefore, in order to deliver improved performance faster, we need to accelerate the date on which 0.4.8 will stop working.

The target sunset date is currently September 1, 2026, after which any version prior to Tor 0.4.9 will cease to work on the network. The first stable release in the 0.4.9.x series was announced in February 2026, and the Tor 0.4.8.x series reached end of life on June 1.

Trump vs. Anthropic: The AI wars are heating up

Tue, 23 Jun 2026 13:18:14 +0200

The US government decision to force Anthropic to close down its latest and greatest AI models, Fable 5 and Mythos 5, was only the next step in a burgeoning battle between AI providers and ignorant politicians.

Anthropic was on top of the world. Its Mythos 5 LLM had everyone excited. (If you believe the hype, it was kind of scary, too.) Even Anthropic CEO Dario Amodei admitted — or boasted? — that Mythos would bring an “enormous increase in the amount of vulnerabilities, in the amount of breaches” to us all. But with that fear came the promise of more AI power than ever.

Then, the roof caved in.

On June 12, the US Commerce Department used its export-control powers to demand that Anthropic cut off access to its Fable 5 and Mythos 5 models for all foreign nationals, citing national security concerns and fears of jailbreaks. After figuring out it had no way to do that, Anthropic pulled both of its newest frontier AI models offline worldwide.

Just what an AI company needs! All other Claude models, like the Opus and Sonnet series, remain online. But, come on, AI sales are all about the newest and most powerful models.

Adding insult to injury — and this is true at many high-tech companies — Anthropic has many employees who aren’t US citizens. This means Anthropic’s own programmers can’t work on their latest models.

Of course, this isn’t the first time US President Donald J. Trump and company have tried to put a spoke in Anthropic’s wheels. Back in February, Anthropic refused to give Defense Secretary Pete Hegseth the power to use its models to spy on American citizens and to power autonomous weapons.

This go-around, it wasn’t because Anthropic refused to kowtow to Trump’s officials. It was, they say, out of fear that these new models could be used to attack American interests.

Mind you, no one in Trump’s regime has the tech chops to know just how dangerous, or not, any AI model is. As I recently noted, Trump’s AI executive order has no teeth. Nor, more to the point, is there anyone in the administration with a clue about AI.

Specifically, at the Department of Commerce, neither Commerce Secretary Howard Lutnick nor William Kimmitt, undersecretary of commerce for international trade, knows a thing about AI. Just what we need, more political hacks deciding tech policy.

So, how did they discover that Fable and Mythos were theoretically a danger to the US? Good question. According to The Wall Street Journal, it was Amazon CEO Andy Jassy who told the Trump administration that Fable was untrustworthy. Guess what? AWS offers its own full cloud AI stack, starting with Amazon Bedrock for foundation models, Amazon SageMaker for training and deployment, and a growing set of agentic AI tools and services.

In other words, Amazon is not a neutral party; it’s a competitor. Funny, that.

Sure, Amazon also has partnerships with Anthropic. But, in case you haven’t noticed, all the big AI companies are in bed with each other. That doesn’t stop them from fighting. What’s heating this up is that the AI companies are no longer offering flat-rate subscriptions and are replacing them with far more expensive, token-based pricing schemes.

Armed with this information, Commerce gave Anthropic 90 minutes to fix its “problem.” Right. AI development is fast, but it’s not that fast. In addition, according to Anthropic, officials haven’t spelled out exactly what’s wrong. They only know that Commerce claims there was a “narrow, non‑universal jailbreak” in Fable.

That’s it. That’s all.

Anthropic has also observed, with reason, that similar jailbreaks are possible on other leading models, like OpenAI’s GPT‑5.5. Those others, however, haven’t been hammered with comparable export controls.

The AI and security experts who do have an AI clue believe Commerce is behaving stupidly. (You won’t get any argument there from me.) For example, in an open letter, “On Transparent AI Cyber Protections,” they said Commerce’s directive “has taken the best models away from defenders, created market uncertainty, and risked America’s AI leadership without any real risk to justify it,” warning that pulling capabilities “away from defenders without a good reason when our adversaries are rapidly advancing is dangerous.”

Exactly so.

Besides, as Alex Zenla, co-founder and CTO of security company Edera, observed, Fable’s capability to identify insecure code sections is the baseline for any model you’d trust to write secure code. The same capability exists in GPT-5.5, Opus, Sonnet, and Kimi 2.7 — it’s not unique to Fable. Pulling Fable from defenders doesn’t remove the capability from the threat landscape. It just removes it from the people trying to build safer systems.”

This is not about AI safety or security.

What this is really about is opening a new front in Trump’s war against the liberal-leaning Anthropic. Mind you, Anthropic isn’t really liberal. This has more to do with Anthropic not following in other tech firms’ groveling to Trump.

However, Trump doesn’t seem to realize that by essentially shutting down Anthropic’s biggest move to date, he’s also telling the world that they can’t rely on American AI companies down the road. Sure, in the short run, this hurts Anthropic. In the long run, it’s going to be another reason for Europe and other countries — taking digital sovereignty seriously — to avoid doing business with any American tech company.

In the meantime, Anthropic and Trump administration officials are in tense talks over whether, and under what safeguards, the models could return to the marketplace. Commerce indicates it might allow a narrower relaunch if jailbreak issues are resolved and additional controls are in place — whatever those might be.

Since it’s really all about massaging Trump’s ego, I’m not feeling terribly optimistic. Just ask Israeli Prime Minister Benjamin Netanyahu how well letting Trump set the terms of engagement goes. It’s not pretty.

How fuzzy APIs are remaking the web

Tue, 23 Jun 2026 11:03:56 +0200

For nearly as long as the web has existed, web development has wrestled mightily with the right way to connect components over the network. This is the question of the remote API. It influences every aspect of the software we build. We sort of arrived at a tolerable compromise with JSON APIs. While these have their limitations, you have to appreciate their underlying simplicity.

But the advent of AI-enabled endpoints that can mediate intent is changing the basic workings of the internet. This change is gradually reawakening an old dream, the service-oriented architecture (SOA). This time around, with luck, we’ll finally gain the flexible, discoverable, and maintainable automated service discovery we’ve longed for. Fingers crossed.

Why old-school SOA failed

Let’s call this burgeoning influence of AI on web architecture SOA 2.0.

To understand why SOA 2.0 is different from SOA 1.0, we have to remember the trauma of the 2000s. (This may be painful but also cathartic.) The original dream of SOA was beautiful: a world where disparate business services—inventory, billing, shipping, you name it—could automatically discover each other, understand capabilities, and orchestrate complex tasks without human intervention.

To achieve this, we built a monument to complexity. We had SOAP (Simple Object Access Protocol) for messaging, WSDL (Web Services Description Language) to define contracts, and UDDI registries for service discovery. At the center of it all sat the Enterprise Service Bus (ESB), a massive piece of middleware that was supposed to route everything gracefully, seamlessly. In case you young’uns are confused, that is all based on XML.

By the time you were done understanding the infrastructure well enough to know how to do something, you had forgotten what you set out to do.

It failed. It was egregiously heavy. Just to do some simple thing like create a “New Item” endpoint, you immediately had to begin scaling a wall of rigid definitions.

Because computers historically required absolute, deterministic perfection, if a single XML tag in a SOAP envelope was missing, or if a service updated its WSDL without every client re-generating its stubs, the entire multi-million-dollar pipeline would violently unravel. Some of us may be familiar with a similar challenge in containerized microservices (like Kubernates), where trying to determine where in the mesh a problem originated is… awkward.

Classic SOA was a house of cards, too brittle to survive the fuzzy reality of the internet.

The typical JSON API of today is a reaction against SOA. (It may be an overreaction.) We abandoned SOA for the relative simplicity of REST, giving up on the dream of autonomous service orchestration in exchange for manual integrations that just work.

The new intention-to-execution middleware

A sea change is already happening with app-level architecture.

The effect of AI endpoints in an app’s service profile goes beyond just a new capability. It changes how the rest of the services work together. The overall effect is something like the app gaining an understanding of itself, and what it can do. This is not dissimilar to what WSDL was supposed to accomplish. But instead of a hard-coded descriptor, where some person had to keep what was available and what was described in sync, you now have a layer that can accept dynamically produced descriptors and unite them with fuzzy user intention and produce meaningful action.

You tie in AI endpoints to bridge between what the user is trying to accomplish, with the various strict capabilities available. These capabilities may exist within the app at the back end, at the front end, or at another service layer. The main thing is that there is a flexible AI layer that mitigates the need to hard-code the links between services.

In classic SOA, the contract was a rigid, unforgiving WSDL document. In modern common practice, the contract is a strongly coupled RESTful endpoint. In SOA 2.0, the contract has a hitherto unknown degree of flexibility, thanks to the natural language capabilities of an LLM.

When a user or a system expresses an intent—say, “Provision a new staging environment for the billing service”—the AI middleware doesn’t look for a hard-coded, point-to-point integration. Instead, it digests the intent and performs semantic routing, consulting a registry and selecting the appropriate tools. That registry, rather than a heavy UDDI, might be a vector database of available internal API endpoints, or a collection of available functions.

Modern LLMs equipped with function-calling capabilities act as the ultimate dynamic orchestrators. They read the JSON schema of a target REST API, understand its parameters, and dynamically map the user’s fuzzy, unstructured intent into a perfectly formatted JSON payload. If a field is missing, the LLM can either infer it from context or pause execution to ask the user for clarification.

The brittleness of SOA 1.0 is replaced by a shock absorber. If the target API changes a parameter name from customerID to clientId, the AI middleware can read the updated schema and adjust its mapping on the fly. No client code needs to be recompiled. No stubs need to be regenerated. The multi-million-dollar pipeline survives.

When software becomes smart

These are not just abstract ideas. I recently did my taxes, using a popular mainstream service that I will not name. I had several unusual and grumpy areas to deal with, including the new crypto regulations. It was not pretty.

But what I was most struck by was how dumb the software was, compared to the AI chatbot I was using to help guide me. I wanted to be able to tell the (stupid) software what I was trying to do. Such as “Carry my NOL from last year!” Or “I don’t know if I need a schedule K, you tell me!”

I don’t want another chatbot. I mean, I already have a good chatbot. I want the application to be well-integrated with AI services that understand the app, understand my current situation within the app, and meet me at the level of intent, applying the lessons learned by others who have used the same tools.

This kind of targeted, intelligent leveling up of intention is, from all I can see, the next stage of software development, and it is going to be massive.

Latency, non-determinism, and other challenges

We are trading the deterministic brittleness of classic SOA for the probabilistic fuzziness of SOA 2.0. And that trade is going to be demanded with ever more insistence by users. But it comes with a new set of trade-offs.

First, there is the latency tax. The old enterprise service bus was heavy to configure, but at run time, the messaging was just routed XML. Injecting an LLM into the critical path of an application adds hundreds of milliseconds, if not seconds, of latency. For asynchronous tasks or complex orchestrations, this is a welcome trade-off. For real-time, high-throughput microservices, it is a deal-breaker.

Second, there is the problem of non-determinism. We spent decades training ourselves (and our systems) to expect that given input A, a system will always produce output B. That deterministic equation was our bottom line faith. The intent layer doesn’t work that way. An LLM might route a request beautifully 99 times, then hallucinate a parameter on the 100th. Or it might choose an entirely different execution path based on a subtle shift in the user’s phrasing.

A third fly in the ointment is the so-called non-functional requirements, or NFRs. These are your pesky sidebar issues that refuse to be ignored, like security and reliability.

Security concerns are magnified by model capabilities like function calling (or “function passing”). If you pair a user’s desires with what the AI can do, and you then let the AI decide, what happens next is clearly an act of faith unless guardrails are put in place. These guardrails must go beyond typical web security (i.e., make sure important function calls are hardened on the server, not exposed on the client) and must be internalized by the AI or (more likely) imposed from a layer outside the AI. There are a number of ways to do this, varying in degree of power and complexity.

We certainly will continue to use standard practices (like RBAC and SSO) to enforce authentication. We will continue to implement standard authorization techniques (like OAUTH and JWT). But we will bring these to bear in the context of that intent layer and its capabilities.

Reliability is another challenge. For example, I recently hit a snag with Google’s Imagen API. Everything was working beautifully, then suddenly, some of the images stopped generating. There were no errors in the client or server logs; however, there were 500 errors in the network. Upon deeper examination, the prompting had morphed (between app context and user content) to include what the Imagen API rules deemed to be dangerous content. This was not obviously flagged prompting. It was fairly pedestrian creative writing, along the lines of “A dark, surreal, and glitchy cyberpunk landscape with menacing figures….” That kind of thing.

These are some of the ways that even simple, direct use of LLM APIs can surprise you. The question I am mulling is, what will be the unexpected outcomes on software writ large?

Dawn of a probabilistic web

Since its inception, the unpredictable, probabilistic nature of the internet came primarily from the humans using it (and background radiation flipping transistors, network failures, geopolitical effects on the ground, and the like). But AI-mediated APIs introduce an intentional, semantically controlled form of probability.

As developers, we will naturally discover the techniques that make consuming AI endpoints more effective. Here I am thinking about practices like structured responses and function calling. But the larger question is, what will the nature of software become?

In a world of binary states, strict protocols, and rigid URIs, if you send a GET request to a specific endpoint, you expect an exact, predictable response. We have spent the last 40 years treating the web like a vast, unimaginably complex state machine.

But as LLM-mediated APIs permeate our architecture with stochastics, the very fabric of the internet begins to change. By injecting AI into the routing and discovery layers, we are introducing a massive dose of probability into the foundation of our networks. When a request is no longer a hard-coded URI call but a natural language intent parsed by an LLM, the connection between node A and node B ceases to be a rigid wire. It becomes a weighted probability.

In essence, we are remaking the internet to mirror the architecture of the AI models we are deploying. Just as a neural network relies on the probabilistic firing of synapses rather than deterministic if/then statements, the next iteration of the web will rely on fluid, semantic discovery. Services won’t just “link” to each other; they will gravitate toward one another based on the conceptual proximity of their capabilities within a shared latent space.

This alters the character of software engineering. We lose (the illusion) of being entirely in control. Its strange paradox is that engineering using explicitly probabilistic components may make for a more resilient system. There is a longstanding debate about the best metaphor for software development. For the longest time, the construction of a building always seemed to be an apt analogy, or perhaps the mechanics of a vehicle. But these days, the gardening or cultivation metaphor is looking ever more relevant.

Despite the challenges posed by inserting AI in the stack, we are finally circling back to the original promise of the early 2000s. This time, fingers crossed, we are equipped with the right tools for the job.

We tried to build autonomous service discovery using rigid logic and deterministic XML, and it collapsed under its own weight. Now, we are building it with neural networks that understand the “intent” behind the integration. We are still building middleware, but instead of an enterprise service bus, we are building an enterprise reasoning bus.

The era of manually hard-coding every integration between every microservice may be coming to a close.

Y2K destroyed everything in the monster taming survival game MonCraft 199X

Tue, 23 Jun 2026 10:40:15 +0200

The "Y2Katastrophe" destroyed civilization in MonCraft 199X, an alternate history monster catching survival game that looks and sounds pretty great.

Read the full article on GamingOnLinux.

Nvidia says its AI data center design runs hotter to use a lot less water

Tue, 23 Jun 2026 01:32:35 +0200

Public pushback against data centers has emphasized their water and energy consumption, and now Nvidia is highlighting its claim that the Rubin generation reference design for a fully liquid-cooled data center has "eliminated massive amounts of power usage and pretty much all water usage." Still, it doesn't address all of the concerns around AI data […]

dbrand Steam Machine Companion Cube case now up for pre-order

Mon, 22 Jun 2026 09:55:30 +0200

dbrand have now fully revealed their Steam Machine Companion Cube case, with pricing and pre-order now available and it looks pretty awesome.

Read the full article on GamingOnLinux.

Best eSIMs for Europe Travel in 2026 – Tested on iPhone

Mon, 22 Jun 2026 07:09:27 +0200

In the old days, traveling to a destination like Europe meant suffering expensive roaming fees while still not always getting the best connections. At minimum, this can create frustrations for travelers, though it can also be a recipe for catastrophe given the right (or wrong) conditions. Whether you plan on visiting multiple destinations throughout Europe or are just taking a short trip, having the right eSIM plan can provide you with reliable mobile data without having to worry about local SIM cards. Keeping this in mind, we’re looking at some of the best eSIMs for Europe travel in 2026. Here are our top picks for iPhone users based on connectability, ease of use, pricing plans, and more. 1. Jetpac eSIM Among the eSIMs tested, Jetpac eSIM is the overall best eSIM for Europe travel, especially if your trip covers more than one country. From café-hopping in Paris to checking train times in Switzerland or finding your hotel in Rome, Jetpac keeps things simple with a single regional Europe eSIM that covers 32 European countries, with 5G where available. Setting up on iPhone is quick. Pick a plan, download the Jetpac app from the Apple App Store, follow the steps, and then it’s bon voyage. During testing, Jetpac handled everyday travel needs smoothly, including maps, messaging, browsing, social media, and video calls across multiple European countries. Jetpac also adds useful travel benefits beyond standard data. Essential apps like WhatsApp, Google Maps, and Uber can still work even after your data runs out, so you are not stuck without directions, ride booking, or a quick message. It also supports unlimited hotspot sharing and dual SIM use on compatible iPhones, making it easier to keep your main number active while using Jetpac for data. The pricing is clear too. Jetpac eSIM does not auto-charge users, and its prepaid Europe plans range from 1GB to unlimited data for 30 days at USD 65.99. Add in automatic multi-network switching that connects you to the best available local 5G or 4G network while crossing borders, in-app voice calls from USD 1.99 for 5 minutes, 24/7 support via WhatsApp and email, SmartDelay airport lounge benefits on eligible plans, and a 4.8 Trustpilot rating, and Jetpac becomes one of the most well-rounded eSIM options for Europe travel. 2. Airalo As one of the most recognizable names in the eSIM market, Airalo offers affordable regional plans for travelers looking to stay connected but not wanting to spend big. Looking at the company’s eSIM coverage of Europe, it has a large number of destinations under a single package. It can be especially appealing for those who are budget-conscious, including students and backpackers. On an iPhone, users just need to scan a QR code to get started, and direct installation instructions are provided after a purchase. During testing, Airalo was dependable for everyday tasks, including accessing maps, messages, and rideshare apps. Users can choose from a variety of data allowances, which is incredibly useful when choosing a plan. Looking at some of the negative aspects, Airalo does lack the travel perks found with other services, but its low entry pricing and extensive coverage help the platform earn its place on this list. Those just looking for a basic data plan may want to consider this one. 3. Saily Developed by the team that created NordVPN, Saily offers mobile connectivity that focuses on privacy for travelers. With regional European coverage and a user-friendly mobile app, users will have little issue purchasing, activating, and managing data on their iPhone. In the testing process, Saily delivered stable speeds that were good for streaming, video calls, navigation, and messaging. The overall app experience was particularly polished, which can be really beneficial for first-time eSIM users. Switching plans or monitoring data usage was rather straightforward, and the coverage is ideal for those aiming to visit multiple European destinations in a single trip. One of the biggest advantages of Saily is its focus on digital security. With features meant to help protect users relying on public Wi-Fi, this eSIM can also be appealing to remote workers and business travelers. If you have an interest in security when making connections, Saily may be one to watch out for in 2026. 4. Holafly Holafly is going to be good for those who can never get enough data. One of the most appealing aspects of Holafly is that it offers unlimited data plans, which can be great for those not wanting to concern themselves with their data usage while traveling through Europe. Taking the eSIM to task, Holafly had little issue handling social media, video streaming, video calls, and navigation. Setting it up on an iPhone was pretty easy, and those that find themselves away from their hotel Wi-Fi for extended periods are sure to appreciate the platform. There’s definitely something relieving about not having to worry about data, making this one especially appealing for content creators and other power users. While unlimited anything can often be nice, bear in mind it comes with the tradeoff that Holafly plans can be expensive, especially compared to other platforms that have fixed data allowances. Those with an interest in unlimited connectivity throughout Europe should give this one a look, as should anyone who prioritizes convenience over cost. 5. Ubigi As a platform, Ubigi is popular among international travelers for its reliable service, flexible data plans, and broad coverage. Offering regional European packages alongside global plans, it’s going to be a practical option for users who travel globally throughout the year. With consistent performance during testing, Ubigi also did a solid job maintaining stable connections for navigation, productivity, and messaging. Activating the service on an iPhone is rather simple, and there’s also a dedicated app for simplifying plan management and tracking data while traveling. Those who frequently stay on the move are sure to appreciate the platform’s wide range of plan options and strong carrier partnerships in multiple countries. Though it may not be the cheapest provider on the market, Ubigi’s combination of reliability and flexibility makes it a dependable choice for those who frequently travel internationally. The Final Word: Which eSIM Is Right for You? A reliable eSIM can make traveling through Europe far easier for users. With the ability to gain instant access to services such as maps, rideshare apps, messaging, and other travel essentials, those traveling abroad should do their best to research all of their options before making a decision. While each provider on this list has its own set of positive aspects, Jetpac eSIM stands out through a combination of competitive pricing, reliable connectivity, and benefits that focus on travelers. It’s not always easy knowing where your next travel destinations may take you, but ensuring you have the right eSIM for the journey helps you stay prepared. There’s many out there, but not all of them can compete with the options available on this list.

I built a very unix style text-to-speech daemon (testers?)

Mon, 22 Jun 2026 01:23:36 +0200

Here's the repo:

https://github.com/SamReynoso/pfspeak

It's pretty sick. The usage is just:

1) Change the voice in the conifg

2) Restart the service (for today - restart is required)

3) echo "Hello World!" > "$SPEAK"

I spent a fair amount of time into building the runtime, and the application setup logic. I'm looking for testers interested in building a with the package, so if anyone has had a TTS project sitting on the shelf...

I have a handle on the direction I want to take this now. That's keep working on the runtime, and application framework part.

But checkout the daemon. With how relatively small the model is you'll probably keep it running all the time, and call to it from all over the place.

submitted by /u/ExtensionBreath1262
[link] [comments]

Play Quake 1, the Classic FPS Game, in Your Web Browser

Sat, 20 Jun 2026 18:00:36 +0200

Remember Quake, the popular first person shooter from 1996? It was a very innovative game at the time, and a massive hit, that initially debuted for Windows, before arriving unofficially on the Mac and Linux, and eventually got an official Mac release too (which I could swear did not perform as smoothly as the unofficial ... Read More

The post Play Quake 1, the Classic FPS Game, in Your Web Browser appeared first on OS X Daily.

Rivals season 2 star teases 'pretty full-on scenes' in November 2026 episodes — and fans need to be prepared for 'absolute madness' in these three

Sat, 20 Jun 2026 15:03:10 +0200

We've got to wait another five months until the rest of Rivals season 2 drops on Hulu and Disney+ — but expect 'absolute madness' when they do.

Some cert-spoofed stealers I'd written off as unbeatable static-analysis, turns out I was just checking the wrong field

Sat, 20 Jun 2026 12:03:10 +0200

I'm building a PE static analysis engine and for months I had a bunch of infostealers in my benchmark I'd basically given up on. A fake Zoom and a few game cheat loaders, all signed with a real NVIDIA code-signing cert (looks like one from the 2022 leak). The cert chains to a trusted root so Windows trusts it, and structurally these things look cleaner than half the legit Intel installers I have. I couldn't find any static signal that separated them from real signed software, so I wrote it off as something you'd need a sandbox to catch and moved on.

Well i was wrong, and pretty dumb in hindsight as i was checking whether the cert chained to a trusted root. I was never checking whether the file's authenticode hash actually matched the hash that got signed. These are two different questions and although my engine answered the first i assumed it covered the second.

When I finally recomputed the hashes, all four came back as digest mismatches. The cert blobs are genuinely NVIDIA's, they were just copied onto a different binary. The signature doesn't match the file it's attached to.

Wired up two checks off the back of it: digest mismatch (signed hash isn't the file's real hash), and signer EKU (a bunch of these use a TLS/serverAuth cert that can't legally sign a PE at all). Between them they catch most of the signed stealers in my set, with zero false positives on legit signed binaries, which was the part I actually cared about.

The one I haven't cracked is the burner-LLC case. Malware signed with a real, properly-issued code-signing cert that's just been abused. Digest matches, chain's valid, EKU's correct. Anyone solved this kind of issue?

submitted by /u/jonmcree
[link] [comments]

[Release] Nuvio Desktop v1.1.1 - Experimental Linux Support

Sat, 20 Jun 2026 04:55:38 +0200

[Release] Nuvio Desktop v1.1.1 - Experimental Linux Support

Hello everyone,

I am sharing an experimental v1.1.1 release of Nuvio Desktop. This is an unofficial build focused on testing the new player and library loading across different Linux distributions.

Improvements:

Integrated mediamp/mpv for direct video playback.
Added Screen Wake Lock (Linux: dbus-send).
Optimized runtime detection and library loading.
Resolved black screen issues.

Installation:

Debian/Ubuntu: nuvio_1.1.1_amd64.deb
Generic Linux: Nuvio-1.1.1-x86_64.AppImage

Technical Notes:

Corrected java.library.path for better compatibility.
Fixed LinuxDisplayWakeLock using asynchronous dbus-send.

Project Link: https://github.com/aelrased/NuvioDesktop/releases/tag/v1.1.4

I have submitted a pull request (#58) to the main repository to add native Linux support and am currently waiting for review. I would appreciate any feedback on stability and performance on your specific setups.

Thanks for your support!

submitted by /u/aelrased
[link] [comments]

Team IT Security - 📰 Alle Kategorien

Apple could ‘run the table’ on AI if it does things right

Deeply deployable

What’s wrong with good enough?

Who has the most to lose?

Cupertino rising

Your instant Android backup upgrade

The Android backup lowdown

Android’s document backup addition

AMD raises the AI stakes with Helios, Venice and robotics

AMD’s MI455X targets the AI memory wall

AMD’s Helios rack takes aim at Vera Rubin

Kind of like cowbell, AMD Venice gives agentic AI more CPU

Pensando networking and ROCm software advance

Customer commitments underscore rack-scale confidence

AMD expands its robotics and embedded foundation

Execution for AMD is now the test

The May 2026 Security Update Review

The June 2026 Security Update Review

The July 2026 Security Update Review

Announcing Pwn2Own Berlin for 2026

Smaller, smarter, safer: How to build agentic AI on the right foundation

A steep learning curve

Routing

Harness

Specialization

Ask Slashdot: Which Apps Aren't Available on Linux?

Firefox Nightly: More Kit, More Control – These Weeks in Firefox: Issue 203

Highlights

Friends of the Firefox team

Volunteers that fixed more than one bug

New contributors (🌟 = first patch)

Project Updates

Add-ons / Web Extensions

Addon Manager & about:addons

WebExtensions Framework

WebExtension APIs

DevTools

WebDriver

Lint, Docs and Workflow

New Tab Page

Search and Urlbar

Smart Window

Storybook/Reusable Components/Acorn Design System

UX Fundamentals

Settings Redesign

The Rust Programming Language Blog: The many journeys of learning Rust

Many paths to needing Rust

Rust learning resources

Beginner stumblings and unlearning habits

Learning to work with the borrow checker

The compiler as teacher

Learning by doing

Letting go of "clone guilt"

Multi-paradigm, but not the OOP some are used to

Teaching Rust in academia

Learning using LLMs

Organizational considerations for Rust learners

Silent attrition

Feedback on near-bounces from survey

Need more focused work on silent attritrion

Conclusions

What seems worth trying

What we still don't know

Chrome Dev for Desktop Update

The Anbernic RG SP looks like an awesome update to one of the most iconic Game Boys of all time

Security Workarounds: The Risk Signal Hiding in Plain Sight

Short answer

GitOps vs Traditional DevOps

Why GitOps is Not Just CI/CD

What GitOps Really Is

How do you interpret JSIG AC-10?

HPR4690: Playing Civilization V, Part 14

Playing Civilization V, Part 14

Links

Nvidia's latest trick for cooling its data center hardware is... hot water? 'Hot liquid cooling' is warmer than a hot tub, but apparently does the job pretty well

Stable Channel Update for Desktop

Chrome for Android Update

Multi-turn attacks broke AI models 88% of the time — single-turn testing missed it, Cisco AI security lead warns at VB Transform 2026

Three layers versus an operating system