It's time for your guide to today's Wordle answer, featuring my commentary on the latest puzzle, plus a selection of hints designed to help you keep your streak going.

Don't think you need any clues for Wordle today? No problem, just skip to my daily column. But remember: failure in this game is only ever six guesses away.

SPOILER WARNING: Today's Wordle answer and hints are below, so don't read on if you don't want to see them.

Wordle hints (game #1893) - clue #1 - Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Wordle hints (game #1893) - clue #2 - first letter

C is a very common starting letter in Wordle – in fact, it's the second most common of all, behind only S.

Wordle hints (game #1893) - clue #3 - repeated letters

Repeated letters are quite common in the game, with 748 of the 2,309 Wordle answers containing one. However, it's still more likely that a Wordle doesn't have one.

Wordle hints (game #1893) - clue #4 - ending letter

K is much more common at the end of a Wordle answer than at the start, and in fact ranks ninth overall in this regard.

Wordle hints (game #1893) - clue #5 - last chance

Still looking for more Wordle hints today? Here's an extra one for game #1893.

• Today's Wordle answer is a button press.

If you just want to know today's Wordle answer now, simply scroll down – but I'd always recommend trying to solve it on your own first. We've got lots of Wordle tips and tricks to help you, including a guide to the best Wordle start words.

If you don't want to know today's answer then DO NOT SCROLL ANY FURTHER BECAUSE IT IS PRINTED BELOW. So don't say you weren't warned!

Today's Wordle answer (game #1893)

• NYT average score: 4.2
• My score: 4
• WordleBot's score: 4
• My skill score: 99
• My luck score: 44
• My start word performance: SANER (304 remaining answers)
• WordleBot's start word performance: SLATE (50)
• Tomorrow's start word: SANER

Today's Wordle answer (game #1893) is… CLICK.

If ever you needed a clear demonstration of how much difference luck can make in Wordle, then consider my last two games. For each, I began with SANER and garnered a perfect skill score of 99/99 from WordleBot — but yesterday I scored a 2, today a 4.

Today's game is harder, sure — it has an average of 4.2, versus 3.8 for RUNNY yesterday — but it's not two whole guesses tougher. Again, there's a repeated letter, but here that's a C, which is slightly more likely to appear twice than an N is (29 appearances versus 23).

Both also had alternative words with only slightly different spellings, and this might be a bigger factor — you could have gone with FUNNY, BUNNY, SUNNY or PUNNY yesterday, FLICK, SLICK, CRICK, CHICK, CLOCK, CLUCK, CLACK or CLINK today.

In my case, I didn't have to pick between any of those options above; instead, my opening two guesses of SANER and CLOUT reduced my options to a trio of CLICK, CLIFF and CLIMB.

This left me a classic game theory dilemma: I had three equally likely choices, and could easily guarantee myself a 4 by playing a word such as FLICK — because if the F turned yellow, it would be CLIFF, if the K turned green it would be CLICK, and if neither changed color it would be CLIMB.

The other thing I could do, obviously, was to play one of the three actual possible answers. If I was right, on a 33.33% chance, I'd score a 3. If I was wrong, I'd then have a 50% chance to score a 4, and if that was wrong too I'd get a 5.

At the time, I thought that it might help if I could recall any of the three words having appeared before — but try as I might, I couldn't. Still, I checked after the game and all three had in fact been answers before: CLICK was game #134 in October 2021, CLIMB was #1020 in April 2024 and CLIFF was earlier this year, game #1680 in January.

If I'd have known that, maybe I would have gone with CLICK on the third guess; the other two seem too recent to have appeared again already. However, I chickened out and went with FLICK, and had to settle for that 4 instead.

Yesterday's Wordle hints (game #1892)

In a different time zone where it's still Monday? Don't worry — I can give you some clues for Wordle #1892, too.

• Wordle yesterday had a vowel in one place*

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

• The first letter in yesterday's Wordle answer was R.

R is a surprisingly uncommon starting letter. Despite ranking third overall in Wordle, it's merely the 11th most likely to begin an answer.

• There were repeated letters in yesterday's Wordle.

Repeated letters are quite common in the game, with 748 of the 2,309 Wordle answers containing one. However, it's still more likely that a Wordle doesn't have one.

• The last letter in yesterday's Wordle was Y.

Y is the second most common ending letter in the game, behind only E. In total, 364 Wordle answers end with a Y.

Still looking for more Wordle hints? Here's an extra one for game #1892.

• Yesterday's Wordle answer is watery in consistency.

Yesterday's Wordle answer (game #1892)

• NYT average score: 3.8
• My score: 2
• WordleBot's score: 3
• My skill score: 99
• My luck score: 86
• My start word performance: SANER (2 remaining answers)
• WordleBot's start word performance: SLATE (315)
• Tomorrow's start word: SANER

Yesterday's Wordle answer (game #1892) was… RUNNY.

Some days, Wordle can be a real slog. And then there are days like this one. I scored a 2 here, but barely had to work at all for it. In fact, the only decision I did have to make was one that I fluffed slightly — but I still managed to score that lovely 2.

This is my third in the past 30 days, together with eight 3s, 16 4s, two 5s and one 6, for an average over that period of 3.666; not terrible and in fact a tiny bit below my overall average of 3.678 — but not great either. Still, an unexpected 2 is always appreciated.

RUNNY's global average of 3.8 implies it's another middling Wordle, but I doubt too many other people got it on the second guess. Some popular start words were fairly successful, for instance TRAIN left only 23 options, but I imagine the majority of people got 4s, with a healthy smattering of 3s in there too.

It has that repeated N, of course, plus the -U--Y format we also saw for MURKY last week. These can be tricky to solve, so coupled with the repeat it was far from an easy one.

Well, unless you began with SANER as I did. That left only two possible answers, and I have no shame in admitting that I didn't think of one of those, RUNUP. Instead, I spotted only RUNNY, so played it swiftly without even considering whether there were alternative options. So, an undeserved but welcome — and relatively rare — success for me. Not a bad start to the week.

Wordle answers: The past 50

I've been playing Wordle every day for more than four years now and have tracked all of the previous answers so I can help you improve your game. Here are the last 50 solutions starting with yesterday's answer, or check out my past Wordle answers page for the full list.

• Wordle #1892, Monday 24 August: RUNNY
• Wordle #1891, Sunday 23 August: OLDEN
• Wordle #1890, Saturday 22 August: PRAWN
• Wordle #1889, Friday 21 August: TRACE
• Wordle #1888, Thursday 20 August: MURKY
• Wordle #1887, Wednesday 19 August: GRILL
• Wordle #1886, Tuesday 18 August: STRIP
• Wordle #1885, Monday 17 August: TRIBE
• Wordle #1884, Sunday 16 August: ASPIC
• Wordle #1883, Saturday 15 August: LOOSE
• Wordle #1882, Friday 14 August: GEODE
• Wordle #1881, Thursday 13 August: CRASH
• Wordle #1880, Wednesday 12 August: WIMPY
• Wordle #1879, Tuesday 11 August: FENCE
• Wordle #1878, Monday 10 August: SNIPE
• Wordle #1877, Sunday 9 August: CLUNK
• Wordle #1876, Saturday 8 August: PRIVY
• Wordle #1875, Friday 7 August: FEIGN
• Wordle #1874, Thursday 6 August: GRIPE
• Wordle #1873, Wednesday 5 August: POSIT
• Wordle #1872, Tuesday 4 August: MOTIF
• Wordle #1871, Monday 3 August: REPLY
• Wordle #1870, Sunday 2 August: PENAL
• Wordle #1869, Saturday 1 August: SLUSH
• Wordle #1868, Friday 31 July: PURSE
• Wordle #1867, Thursday 30 July: FLUME
• Wordle #1866, Wednesday 29 July: VALVE
• Wordle #1865, Tuesday 28 July: SONAR
• Wordle #1864, Monday 27 July: POSER
• Wordle #1863, Sunday 26 July: GRAPE
• Wordle #1862, Saturday 25 July: ALOHA
• Wordle #1861, Friday 24 July: PUTTY
• Wordle #1860, Thursday 23 July: ORBIT
• Wordle #1859, Wednesday 22 July: LORRY
• Wordle #1858, Tuesday 21 July: SHILL
• Wordle #1857, Monday 20 July: DIVER
• Wordle #1856, Sunday 19 July: CHURN
• Wordle #1855, Saturday 18 July: BOOTH
• Wordle #1854, Friday 17 July: LEGAL
• Wordle #1853, Thursday 16 July: BUTTE
• Wordle #1852, Wednesday 15 July: PSHAW
• Wordle #1851, Tuesday 14 July: STEAK
• Wordle #1850, Monday 13 July: STOUT
• Wordle #1849, Sunday 12 July: CLACK
• Wordle #1848, Saturday 11 July: AVIAN
• Wordle #1847, Friday 10 July: CANAL
• Wordle #1846, Thursday 9 July: AMEND
• Wordle #1845, Wednesday 8 July: DEMON
• Wordle #1844, Tuesday 7 July: SLING
• Wordle #1843, Monday 6 July: TODDY

What is Wordle?

If you're on this page then you almost certainly know what Wordle is already, and indeed have probably been playing it for a while. And even if you've not been playing it, you must surely have heard of it by now, because it's the viral word game phenomenon that took the world by storm in 2022 and is still going strong in 2026.

We've got a full guide to the game in our What is Wordle page, but if you just want a refresher then here are the basics.

• Hackers exploited trusted software updates to deliver malware directly into car head units
• Kaspersky says this is the first campaign tailored specifically for vehicle head units
• The malware can run silently without showing drivers any visible interface

Car head units are now being drawn into a growing wave of Android malware campaigns built for connected vehicle systems, experts have warned.

A newly discovered malware campaign is infecting these head units directly, systems that combine multimedia functions with, in some models, vehicle control.

According to Kaspersky, this campaign marks the first documented case of malware built specifically for this type of infection chain.

Compromised update channels deliver malware straight into vehicles

Researchers believe the activity can likely be traced back to the MoYu Group, a threat actor closely tied to the well-known BadBox botnet, which spread through the legitimate update mechanisms built directly into the firmware of Android-based head units manufactured by DoFun.

The infection chain originates from TWCore, a legitimate system app that is normally responsible for collecting analytics and updating head unit software remotely.

Attackers hijacked this trusted update channel using a specialized dropper called JarService to deliver previously unknown malware directly onto a range of affected devices.

Once successfully installed, the malware operated quietly as a regular background application without ever displaying any visible user interface.

Kaspersky identified nine distinct remote commands built into the malware, capable of displaying unwanted ads and executing various forms of ad fraud.

The malware also actively collected sensitive device information, including display resolution, device model, Wi-Fi network identifier, and the device's MAC address.

Investigators found clear technical links between this campaign and prior attacks launched against TV set-top boxes tied to the same broader threat group.

The research team claims that the botnet's administration panel shares embedded URLs with residential proxy service websites PXYEDGE and ProxyForU.

BadBox itself operates as a large, sprawling network of hijacked Android devices, including streaming boxes, phones, and tablets that arrive pre-infected from the factory.

Kaspersky has already formally notified the vendor about this ongoing abuse of its legitimate software distribution channel and update infrastructure.

According to statements from DoFun, the underlying issue has since been resolved across most affected devices currently deployed in the field.

Head units present a growing and largely unprotected attack surface

Car head units can arrive factory-installed directly from the manufacturer or get added later to older vehicles as aftermarket upgrades.

Manufacturers frequently rely heavily on the Android operating system because it simplifies interface customization and essential system integration work considerably.

This widespread industry reliance means most standard Android applications, along with most existing Android malware, can potentially run on these devices.

Head units rarely store sensitive personal data directly on board, which on the surface might suggest only limited appeal to attackers.

However, they typically include active SIM card slots and maintain constant internet connectivity for navigation services and routine software updates.

That particular combination of persistent connectivity and comparatively weak security oversight makes these systems a genuinely attractive prospect for attackers going forward.

The overall scale of this particular campaign remains genuinely unclear, and whether other head unit manufacturers face similar exposure is not yet known.

• Expel researchers warn of SynkLoader backdoor spread via fake IT help desk Teams messages
• Malware modules include PhishLocker (fake login screen harvesting OS passwords) and Interactive Shell for remote control
• Defenses: distrust unsolicited Teams DMs, verify with IT before installing apps, and train staff against social engineering

For roughly a month now, cybercriminals have been targeting organizations with a new backdoor malware called SynkLoader.

According to security researchers Expel, the attack starts with social engineering. Victims would get a Microsoft Teams message from a person claiming to be from the company’s IT help desk. They would tell the victim their computer is having an issue, and that they need to install a “PowerShell Cleaner”. This fake program is nothing more than a malicious framework, hosted on Microsoft Azure to increase its trustworthiness.

The malware itself comes with a number of different modules, giving the attacker a range of features, from harvesting system information, to creating a reverse proxy. Two particularly worrying modules are called PhishLocker and Interactive Shell. The former creates a convincing, yet fake, Windows lock screen, which can harvest the user’s OS login password.

This is not SickKids' first attack

BleepingComputer argues that with this password the attackers could “access corporate environments from the infected device, bypassing IP allow-list restrictions”. Those with a sharper eye might spot the ruse, as a simple Alt + Tab shows that the login screen is nothing more than a “full-screen borderless GUI application”.

The other module - Interactive Shell, allows threat actors to remotely execute PowerShell commands and receive the output, which essentially grants them full control over the infected device.

The full list of Indicators of Compromise (IoC) can be found on this link. To defend against these types of attacks, target companies should instruct their employees not to trust unsolicited Teams messages at face value, and not to install any applications without double-checking (calling) with their IT department first.

Alongside phone calls, Microsoft Teams is one of the most-used channels for initial contact and compromise. Also, employees remain the weakest link in every company’s cybersecurity chain, unwillingly granting attackers access or sharing login credentials.

Via BleepingComputer

• Microsoft has concocted another scheme to pay people to use Edge
• It's a referral link that gives you reward points for every friend invited
• A strange Bing app has also been spotted that switches some browsers to have Microsoft's search engine by default, and it's proving controversial

Microsoft is once again pushing Edge — and also Bing — in promotional efforts that may elicit more than a few groans from Windows 11 users.

We're used to this kind of thing in Windows 11, mind, and I'll come back to Bing later, as this is an apparent plan that hasn't kicked into action yet. However, the latest Edge scheme is active, and as Windows Latest reports, it's offering financial incentives to get people to use Microsoft's web browser.

This is happening on the mobile version of Edge where users are being offered a referral scheme. If you can get a friend to switch to Edge via a referral link, you'll receive 500 Microsoft Rewards points (with the ability to accumulate up to 7,500 points per month if you're feeling ambitious).

The person you invite can't be an existing Edge user (they must never have installed the mobile browser), and they will also earn 500 points for signing up. However, your invited friend must sign into Edge and use the browser for at least two days (web searching on Bing, too) within the first two weeks of being referred.

Windows Latest observes that there's no way to access this referral scheme should you be interested — you'll just have to keep using Edge mobile and wait until it's presented to you.

As well as the promotion of Bing in that offer (in terms of the requirement to use the search engine for a couple of days), there's a more brazen initiative to push Bing usage that Windows Latest also spotted.

This was highlighted in a post on X by leaker Xeno who discovered a small app called 'Microsoft Recommended Search' which has one sole and simple purpose: to change your default search engine to Bing.

When run, it offers up a simple slider to set Bing as the default engine, and if you allow this, the app switches to Microsoft's search engine across some of your installed browsers. That means Chrome and Firefox, and also apparently Brave and possibly others, via extensions which are added to these browsers. Apparently the experience is rounded off by sending the user to the Microsoft Rewards page.

Where is this app exactly? Thankfully it isn't something that's being deployed to Windows 11, and Windows Latest notes that it's just a standalone application hosted on Microsoft's official download servers (download.microsoft.com) — for the time being, anyway.

Analysis: an ominous sign?

Does this mean that the Bing switching application is something Microsoft intends to pipe out to Windows 11 at some point? That's the obvious worry, because you've got to wonder why Microsoft built this mini app in the first place. I'm guessing that this is something for use in testing, though, and not active deployment — although it could come to Windows 11 in theory (or something similar could).

I really hope not, and given that Microsoft is doing its level best to get everyone to appreciate its desktop OS this year, it's obvious that anything along these lines would be highly counterproductive to that goal.

However, there's plenty of suspicion on Reddit about Microsoft's intentions here, and chatter from those who've already switched to Linux, pointing out that this kind of thing is exactly why they migrated. As one Redditor put it: "Every day is a Microslop news day, I'm so glad I quit Windows a while ago." There are quite a few others in that thread who see this as another reason to defect to Linux, despite the fact that nothing has happened with this Bing app yet.

As for the referral scheme to promote Edge, this isn't the first time Microsoft has effectively offered lowkey bribes to get people to switch to the browser. Indeed, the likes of million-dollar prizes have been thrown around recently (and the same has been true of Bing in the past). Not that there's anything wrong with this idea in principle, except it does show that Microsoft's getting rather desperate in its efforts to recruit folks to use Edge and Bing.

The most baffling part of all with Edge is that it's a good web browser which stands on its own merits, and I think it would benefit from not being promoted so much (as that activity only makes people suspicious, or determined not to use Edge as a reaction to being constantly cajoled about it).

• SickKids hospital in Canada hit by third‑party software vulnerability, exposing employee data
• Clinical systems and patient records unaffected; patient care continued without disruption
• Affected staff and applicants offered 24 months of free credit monitoring and identity protection

The Hospital for Sick Children, a major pediatric hospital in Canada, suffered a cyberattack that affected parts of its website, and resulted in the loss of some employee personal information.

In an announcement published on its website, the organization (also known as SickKids) said the unnamed attackers abused a “vulnerability in a third-party software application used by SickKids and other organizations.” The announcement did not say exactly which app was used in the attack, or what the vulnerability was, but stressed that clinical systems and patient information were not affected.

“Patient care has continued as usual”, it added.

This is not SickKids' first attack

After launching an investigation, SickKids learned that personal information of some former and current employees working at SickKids, Boomerang, and SickKids Foundation, as well as SickKids job applications, was exposed. It did not detail the nature of the exposed information, or how many people are affected.

Whatever that number is, those people have been offered 24 months of complimentary credit monitoring and identity protection services, for free.

“We remain committed to maintaining strong protections and continuously enhancing our cybersecurity measures to help protect the information entrusted to us,” the company concluded. Ironically, SickKids was also committed in late 2022 and early 2023, when it was struck by LockBit and had its systems locked down by the ransomware threat actor.

While, in that incident, LockBit apologized, gave the decryptor away for free, excommunicated the affiliate responsible, and did not mention any stolen data, by late 2022 double extortion attacks were standard practice, meaning data was likely exfiltrated then, as well.

At the time, LockBit was one of the most active and most dangerous ransomware operators. In early 2024, its operations were severely disrupted through Operation Cronos, but it seems the group is making a comeback. There are reports from late 2025 of LockBit 5.0 claims, including a purported attack on U.S Bank, but the news is yet to be confirmed.

Via The Record

• Apollo confirms July 2026 cyberattack via social engineering exposed PII in its cloud environment
• Data included names, DOB, contact info, addresses, and Social Security numbers
• Firm offers two years of identity protection; no evidence of dark web leaks yet

Apollo, one of the biggest private equity firms in the world, has confirmed it suffered a cyberattack which compromised some people’s personally identifiable information.

The company notified California’s Attorney General’s Office about the breach and shared a copy of the letter it is now sending out to affected individuals. It is impossible to discern from the letter if the victims are Apollo employees, customers, or someone else entirely, but the company did clearly explain what happened.

As per the letter, an unidentified threat actor tricked an Apollo employee into granting them access to the company’s cloud environment. The attackers used social engineering (usually phishing), which means the victim either tried logging in using a spoofed landing page, unknowingly installed an infostealer, or was convinced to grant the attackers access via remote monitoring and management software.

Was there really a hack?

The company spotted the attack a few days later, and after activating its safety protocols (notifying the police, enhancing its security protocols, and bringing in third-party forensic experts), launched an investigation which showed that the attackers accessed its cloud platform between July 6 and 10.

“During our investigation, we learned on August 12, 2026 that the information potentially impacted by this incident included your name, date of birth, contact information, home address, and your Social Security Number (SSN),” the company said. This means that financial data such as credit card or bank account information, was not compromised.

Still, cybercriminals can make use of this type of information, as is often the case in identity theft, business email compromise, and even wire fraud.

Apollo is now offering two years of free identity theft protection and monitoring for affected individuals through Cyberscout.

At press time, no threat actors claimed responsibility for the attack, and the data has not yet surfaced anywhere on the dark web.

Via TechCrunch

• Researchers uncover vast cybercrime ring running on computers and infected domains where outdated versions of WordPress were installed
• The StopAndProtect investigation revealed the WordPress content management system was key to the ring’s success; both the core software and third-party plugins were subverted
• Around 2,000 WordPress sites were hijacked by the cybercrime ring

Check Point Research has unearthed a global cybercrime ring that relied on a network of WordPress websites. The investigation into an operation dubbed “StopAndProtect” found a network of 5,000 infected computers around the globe, and 2,000 WordPress domains.

WordPress currently provides content management for around 43% of websites worldwide, making it the most significant CMS available. It is also the most popular website builder, and is suitable for single page websites, basic blogs, vast news sites, and even online stores.

The researchers found the crime ring had made some mistakes, which alerted them to their operation. These included screenshots and logs of victims, internal tools, and files referencing the hijacked domains. While reassuring, the StopAndProtect investigation raises questions about the security of WordPress sites.

How StopAndProtect did it

WordPress has long been a target for hackers looking for an easy way to host malware and operate botnets, with several key incidents over the course of its history. However, the CMS remains free and open source, and is easy to setup thanks to installation scripts and web builder plugins.

While StopAndProtect was initially the name given to the ransomware uncovered by Check Point Research earlier in 2026, they decided to use the name for the whole operation, as they found it doesn’t only distribute ransomware.

Check Point Research’s Eli Smadja said: “StopAndProtect shows how attackers can turn thousands of poorly maintained WordPress sites into a distributed criminal infrastructure for malware delivery, surveillance, data theft, and ransomware.”

Can any WordPress domain be hijacked?

Given the number of WordPress sites impacted by the crime ring uncovered by the investigation, and the platform’s prominence in the CMS and web builder market, the question has to be asked: is WordPress still safe?

“Based on our research findings, we urge organizations be cautious of unexpected CAPTCHA prompts that instruct them to copy, paste, or run commands, keep their devices and security software updated, and immediately leave any website that asks them to perform unusual steps outside the browser," Smadja added.

Many small businesses rely on WordPress for their public-facing web presence, and in some cases for internal purposes too. The StopAndProtect investigation highlighted a particular WordPress-driven site running a five-year-old version of the CMS, compromised by around 40 vulnerabilities.

If concerns surround WordPress, the quickest solution is to ensure the website is running the most recent version, and that the plugins are not only running as intended, but also fully updated.

Maintaining a regular WordPress update cycle can avoid sites becoming hijacked, a strategy best used in conjunction with a web host that monitors for intrusions and suspicious activity.

• Researchers show how an expired contactless card can still complete a real purchase because the expiry date the terminal reads is not covered by its signature
• The attack needs physical possession of the discarded card and two ordinary smartphones, and results vary per bank, with Visa cards being susceptible in testing
• Existing EMV protections can detect the relay, but they are optional and were not enabled on any card or terminal tested, and neither Visa nor the notified banks have confirmed a fix is in the works

For a layman, the date printed on a credit card looks like a hard stop, but that might not always be the case.

Researchers at the University of Massachusetts Amherst found that a 'zombie card' past its expiration date can be persuaded to complete a contactless purchase at a real checkout terminal, creating a real security threat.

The irony is that it is not that EMV cryptography is not bypassed in any way, but rather that card expiry is enforced in a different way for contactless payments, as a policy check between two parties rather than as a fixed property of the card itself, and interestingly, the parties do not always know who is the one checking.

Dead plastic can still be used to pay under certain conditions

Building on the last part, a contactless transaction involves a card, a point-of-sale terminal, the merchant's bank, a card network, and the issuer. Each holds a fragment of the decision that eventually results in a successful or declined card transaction.

The EMV contactless flow is only selectively authenticated: some fields travel between the card and terminal in unencrypted text and are linked to cryptographic verification later, opening a potential attack vector for users with physical access to an expired card.

The exposure here is not that those fields can be read, since the expiry date is printed on the card anyway, but that it can be changed with relative ease. The Application Expiration Date that the terminal reads sits in the unprotected portion.

In the Visa configuration the team tested, that field is not covered by the card's digital signature and is subsequently not cryptographically bound to the expiry value the issuer sees in the online authorization request.

While this should not be the case, it opens an attack vector for a device between the card and the terminal that processes the charge by simply modifying the expiry value to one that is still valid. The issue is compounded by a second issue: cards carry an expiry date inside the digital certificate used to establish the card-to-terminal conversation, and researchers have found that the certificate outlasts the printed date on the plastic. In essence, a check that might have caught the problem is looking at a clock set further ahead.

The scope of the attack, however, is narrow: it affects Visa contactless cards only, with Mastercard, Discover, and American Express rejecting the altered expiry outright. It also requires physical access to the card and two smartphones to pull it off, making it a slightly more complex endeavor, to say the least.

The irony is that EMV does have a protection that would essentially undo such an attempt altogether: Relay Resistance Protocol, which measures timing to detect an inserted relay and can stop the transaction altogether, but it remains optional and was not enabled on any of the terminals or cards the researchers tested.

The team notified Visa and the relevant banks in May 2025 and again in December 2025, supplying a reproduction guide, transaction traces, and a video. Visa's report passed initial triage, and the company's red team was reproducing it.

However, as of publication, neither Visa nor the notified banks had confirmed a mitigation attempt, and Visa also did not respond to a press request from The Register for comment.

The underlying failure, however, is based on how payment decisions have now spread across multiple players, including chip, terminal, network, and bank architectures, all of which assume that expiry is someone else's problem, an approach that could come back to haunt them and their customers. For now, the researcher's advice remains important until a fix is rolled out: stop treating dead plastic as harmless, destroy the underlying chip, and cut through the card numbers to prevent abuse.

• Windows 11 can remove a discrete GPU driver as part of its clean-up routines, as shown on Reddit
• This can happen if the laptop has been in Eco mode for an extended period
• Because the GPU is effectively gated off from the system, the driver is marked as unused and therefore deleted by the OS during clean-up – but you can stop this from happening

Apparently, Windows 11 can end up stripping away the discrete GPU driver from your laptop in certain scenarios if the OS is left to run in Eco mode for a long time – and that's a distinct annoyance if you own a gaming laptop, as per a report on Reddit.

Wccftech spotted a Redditor who posted about their Asus ROG Zephyrus G14 gaming laptop with a discrete Nvidia RTX 5070 Ti, and how Windows turned off that GPU.

At this point, some of you may immediately be thinking: who runs their gaming laptop in Eco mode? And that's a fair point, and one raised in the Reddit thread – I'll come back to that.

First, let's look at the mechanics of how this works, based on the Redditor's investigation of what went on (they noted that it "took me months to work this out"). When the laptop is put into Eco mode, power is completely cut to the discrete GPU, effectively leaving it offline (just as if it were an unplugged USB stick, as the Redditor describes).

That's not a problem – obviously it's a power-saving measure – but the issue is that Windows 11 runs a driver clean-up process from time to time as part of routine system maintenance. By default, this happens every 30 days, though the Redditor notes their laptop was set to 15 days, and this can be modified.

What happens is that if the laptop has been in Eco mode for a long time, with the GPU effectively walled off and not present as far as the system is concerned, and the clean-up happens, it judges the driver to now be superfluous, and it's removed.

When Eco mode is subsequently switched off, the driver doesn't return – it remains ditched, and the GPU shows as a 'Microsoft Basic Display Adapter' instead of an Nvidia GPU in Windows 11's Device Manager.

The Nvidia graphics driver must then be reinstalled to get the GeForce graphics card functional again – and the same is reportedly true of AMD discrete GPUs.

Analysis: a niche problem, but an annoying one – here's how to avoid it

Let's return to that question: who runs a gaming laptop in Eco mode? No gamer really does this, at least not when they're regularly playing some of the top PC games on their notebook. However, someone might be a student cramming for finals and using the laptop for work, having given up gaming distractions for a few months. In this case, with Eco mode enabled to keep battery life up while studying, Windows 11 could disable the GPU.

Okay, so it's something of a niche situation – and the Windows 11 clean-up routines are useful for keeping the system streamlined. But it's not an unthinkable scenario, and Microsoft's OS should be tuned to be more careful around GPU drivers – and it'd be useful if the system could give a warning of such a clean-up happening (so it could be avoided).

That said, this may not happen in all situations. Another Redditor notes that they have had their Zephyrus G16 in Eco mode for two months, and the Nvidia RTX 5070 Ti is still present and correct.

Whatever the case, if you run into this problem yourself, at least you know why it's happening. The fix is to simply reinstall the Nvidia driver, although the same thing could happen again if you're one of those people who regularly uses Eco mode on your gaming laptop.

You can apply a Registry fix to permanently stop the clean-up process, but I wouldn't recommend messing with those settings unless you're confident (see the Reddit post for instructions). Also note that you'll miss out on other clean-up duties, not just GPU-related activity.

A better solution is to simply remember to take your laptop out of Eco mode now and then (every couple of weeks), which will bring the discrete GPU back into play, and save the driver from being earmarked for removal.

The Redditor notes: "Or just keep the GPU visible now and then. Optimized mode in G-Helper turns the dGPU [discrete GPU] on whenever you plug in. Flipping to Standard [mode] every couple of weeks does the same thing. Resets the counter, no Registry editing."

• India-based developer Kuber Mehta uses Claude Code to create a macOS driver for the HP Laser 1008a
• Previously, only the official drivers for Windows and Linux were available for the relatively obscure 2023 laser printer
• The AI-generated driver was created over a series of meticulous prompts, and is now available via GitHub

The days of avoiding hardware that is incompatible with your operating system could be over. A developer based in India has created a macOS driver for a largely unknown HP printer using Claude Code, the agentic command-line coding tool developed by Anthropic.

Released in 2023, the HP Laser 1008a was issued with drivers for Windows and Linux, but not macOS. By using AI to generate a driver for macOS, developer Kuber Mehta has demonstrated that incompatible hardware could soon be a thing of the past.

Mehta has shared the code on GitHub and has also posted about the process on social media, and also compiled a transcript of the exchange, which has been published online for reference.

HP’s Samsung printer

Describing the issue in the introduction to the transcript, Mehta explains that the HP Laser 1008a is a “rebadged Samsung, host-based printer that speaks a proprietary raster language (SPL3), and it has no macOS driver and no AirPrint.”

No SPL3 drivers have been published for macOS previously, so the process relied on a conversation with Claude Code and reference to the Windows and Linux drivers.

The GitHub intro adds that the HP Laser 1008a and siblings in the series (1003 and 1006 a/w) have another problem: “They do not speak PostScript or PCL.” Anyone familiar with the world of printer drivers will recognize the challenge faced by Mehta, which makes the use of Claude Code even more impressive.

Using Claude Code with the Opus 4.8 model, the driver was compiled in 30-40 prompts. This might have been even quicker had the AI not made various assertions that required correcting.

The process moved through “install the drivers” to establishing the print language by analysing the printer’s error pages, via direct contact with the device and “running HP's real rastertospl codec inside a Linux container to produce genuine SPL3, to a reboot-safe background daemon.”

From here, Mehta and Claude Code moved to the published, MIT-licensed installer, which patches the macOS open-source printer driver package SpliX, adding support for the SPL3 printers (by default, SpliX handles SPL2 and SPLc drivers).

Building from AI

While already a developer, Kuber Mehta admitted learning about macOS drivers from the process, perhaps an unforeseen benefit of using generative AI tools for coding.

The GitHub repo outlines some revisions that have been made to the initial release, which is now “a tiny native IOKit helper” that dispenses with Python, pyusb, and libusb and can be swiftly installed from the Terminal.

• Infoblox Threat Intel counted roughly 65,000 expired domains re-registered every day in the first half of 2026, close to one in five of all new registrations
• An actor it calls Sable Squirrel controls more than 10,000 domains and is estimated, by extrapolation, to have spent over $7 million buying expired names for their inherited traffic and domain authority
• Some of the domains are also used to function as command-and-control structures for existing malware that can be traced back to the same group

A domain name is the closest thing the web has to a credit history: age, inbound links, search visibility, and reputation all feed the reputation scores that security products consult before deciding whether a request is worth worrying about.

New research from Infoblox Threat Intel claims this history has become a commodity with a market price, and that at least one criminal operation has been buying it in bulk.

The study, published as a three-part series, focuses on what the industry calls dropcatch domains: names that lapsed, were released back to the registry, and were then re-registered by someone else entirely.

A dropcatch domain situation: A gambling business with a malware-enabling catch

Dropcatch domains aren't new; software has been primed to spot expiring domains for years, and it sometimes snags the occasional massive win for users who deploy such solutions.

This lets users start with domains that already have history that benefits them or flip certain domains for a price that is often a multiple of the domain's original purchase price.

Infoblox counted an average of 50,400 such re-registrations a day across generic top-level domains in the first half of 2026, rising to roughly 65,000 once country-code domains are added. That amounts to close to a fifth of all daily registrations. The rate is highest on .net and .xyz, where nearly three in ten newly observed names had a previous life, with .com behind them at 24.5%.

The problem is that not all of these are seemingly innocent or small-scale scalping operations: Infoblox has identified an entity it has labeled Sable Squirrel, part of a naming convention the company applies to domain hoarders. It controls more than 10,000 domains, most of which support a large Vietnamese-language sports piracy operation operating under brands including Xoilac, Cakhia, 90phut, Socolive, and MiTom.

Infoblox estimates the actor's total spend on expired domains at north of $7 million, which it describes as the largest domain acquisition budget it has identified for a single actor in the industry. The bigger problem is that Infoblox also found that a subset of these streaming domains runs as malware command and control while continuing to serve live football to human visitors.

More than 31,000 samples identified called back to Sable Squirrel's infrastructure, spanning Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, and njRAT, plus samples carrying HiddenTear ransomware signatures.

Infoblox said the operator's carelessness made finding a link easier: many samples carry the actor's brand names in their Windows executable metadata, with fields reading socolive, xoilac, and 8xbet. Infoblox confirmed 405 domains as malware C2, which is roughly four percent of the total domains the organization controls, and the weaponization arrived as a single wave in late 2025 rather than as the operation's original purpose.

Sable Squirrel's core business is gambling, and while the entity tries to mask it as a streaming operation, it also doubles as an acquisition channel for the same. While law enforcement has not been silent here, it has had limited luck at best: Vietnamese authorities froze some of the flagship sites in February 2026 and charged 30 suspects in March.

They also seized assets Infoblox puts at roughly $12 million, but it seems to have survived and continues to expand, having acquired and run World Cup-centric domains since June, further expanding its footprint in a world where it has already identified and secured a large chunk of what is arguably a very important commodity: Domain authority.

• Hacker alias Xpl0itrs claims to have stolen 8.6GB of Target source code
• Researchers suspect it’s recycled data from January’s confirmed 860GB breach
• Xpl0itrs has a history of dubious leak claims, fueling skepticism about authenticity

Hackers are claiming to have breached Target in what would be the US supermarket giant's second breach of 2026 alone.

The attackers are threatening to release gigabytes of source code into the dark web unless the company pays up, but not everyone is sold on the idea that the US merchandise giant was actually hacked this time around.

Some security researchers believe this might just be a case of a lowly criminal piggybacking on someone else’s work.

Was there really a hack?

Target was first hit in January 2026, when a threat actor posted a new thread in an underground hacking community to claim they were selling the company's data, and that this was the first of many datasets to go on auction. To support their claim, they created multiple repositories on Gitea, a self-hosted Git platform, and uploaded a small sample of the data.

The repositories, totaling around 860 GB in size, appeared to contain internal Target source code, configuration files, and developer documentation, while repository names were referencing internal systems such as wallet services, identity management, store networking tools, secrets documentation, and gift card systems.

Target later confirmed the authenticity of the breach.

This time around, however, a different threat actor - with an alias Xpl0itrs - created a new data leak site in mid-June 2026, and earlier this month added Target. They claim to have stolen 8.6GB of the company's source code and have given it two days to pay up or see the data leak into the dark web.

Xpl0itrs is not exactly a household name in the cybercriminal community, and they have not shared any samples of the data they are claiming to have nabbed - further fueling the idea that this data was already grabbed eight months ago.

Even some of their previous “work” is questionable. Cybernews reports that in June, they teased leaking data from Spotify, the US Department of the Treasury, OpenAI, and Trustpilot, which never happened. Before that, they claimed to have stolen documents from BMW, containing details about motorcycles and dealerships. This, too, was somewhat debunked, as it turned out that some of the data was already publicly available.

• iAuthFlow v2 sold on Russian forums lets attackers persist in email accounts
• Tool phishes logins, then secretly creates attacker‑controlled passkeys for lasting access
• Defenses include auditing passkeys, OAuth tokens, mail rules, and removing rogue methods

Security researchers have discovered a new malware toolkit which allows threat actors to log back into compromised email accounts even after the password was changed and all sessions terminated.

iAuthFlow v2 is currently being sold on Russian dark web forums for north of $10,000, a new report from cybersecurity experts from Abnormal said, as they obtained a copy of iAuthFlow v2 for analysis.

The malware primarily works as a phishing tool, trying to trick users into logging into either Google, Microsoft, iCloud, or LinkedIn. As soon as they do that, they relay the login credentials to the attackers, who log into the accounts on their end, as well - before the tool displays a “processing” page for a few seconds while, in the background, it sets up a new passkey.

How to defend against iAuthFlow v2

A passkey is an alternative means of authentication that is often touted as the “password killer”. It uses cryptographic keys stored on a device, allowing users to sign in with a fingerprint, face scan, or device PIN.

Because the secret key never leaves the device, it is resistant to phishing. However, if the threat actor is able to generate a key of their own, on the device they own, access is basically guaranteed.

The ad for the toolkit also comes with a video demo, showing how it works. In the demo, iAuthFlow v2 created the passkey six seconds after authentication.

However, generating a passkey is not that straightforward of a process and it could encounter hiccups, Abnormal hints, saying that Google, for example, might require further identity verification before allowing the change.

Usually, when a threat actor compromises an email account, terminating all sessions and changing the password is usually enough.

In this case, however, users should do a lot more: review the account for signs of compromise, including unauthorized passkeys or security keys, malicious Gmail filters and forwarding rules, recovery and delegated access changes, and unauthorized applications, Abnormal suggests.

They should also revoke relevant OAuth tokens and grants, investigate available sign-in, mail-rule, 2-Step Verification, passkey and OAuth audit events, and finally, make sure any attacker-enrolled authentication methods are removed.

• Huntress spotted a ClickFix campaign targeting security pros via fake conference invites
• Victims tricked into pasting code that installs AMOS infostealer on macOS
• If lured, isolate systems, reset credentials, rotate secrets, and review cryptocurrency wallets

Cybercriminals are targeting security professionals with a highly tailored ClickFix campaign in an attempt to get their computers infected with infostealer malware, experts have warned.

An active campaign against people who have attended, or have a history of attending, various cybersecurity conferences such as Black Hat, or DEF CON has been detetced by security researchers Huntress, who were targets themselves.

The attack starts on X, where the threat actor uses a fake account to interact with people visiting and sharing content from these conferences. After establishing rapport, they move into DMs, claiming they’re organizing a conference of their own, and sharing a Google Docs file containing “more info” with the victim.

Follow-up attack

Here is where the attackersy go for the ClickFix attack. The document comes with a vertical sidebar, apparently as a security feature that keeps the contents of the file encrypted. The victim is given a decryption code to enter, but it returns an error and offers a solution - to bring up the Terminal and copy/paste a piece of code.

From here, it’s the usual ClickFix practice: the victim ends up downloading and running AMOS, a notorious Mac infostealer capable of grabbing browser information, cookies, keychain data, cryptocurrency wallet information, Telegram files, and more. The Windows variant did not work when Huntress tried to analyze it, but it’s safe to assume the end goal is the same.

Huntress also found that this is not where the attack ends. If the victim does not install the infostealer, the threat actor will follow up with a different document, this time pretending to be for Dropbox and working only with the desktop app. Of course, the download button leads straight back to the infostealer.

The researchers shared a full list of Indicators of Compromise (IoC) which can be found on this link. They also advised anyone who interacted with this kind of lure to isolate the system from the network, collect relevant forensic evidence, and “consider reimaging the system”.

“Assume that credentials on the system have been compromised”, they said. “Revoke active sessions, reset passwords, and rotate API keys or any other secrets that may reside on the system. Review cryptocurrency wallets as well, if present.”

• Windows 11's August update has broken some PC games
• Microsoft is investigating reports of crashes, but right now it's unclear what the root cause is
• Theories point to security measures in the update potentially causing issues with certain drivers and conflicts with anti-cheat tools

Windows 11 has run into trouble with gamers (again) after the latest monthly update for the OS, and Microsoft is investigating what's gone wrong.

The Register noticed that Microsoft has posted on the Windows release health dashboard about "reports of certain games becoming unresponsive" following its latest patch.

In some cases, games are either freezing and becoming unresponsive, as mentioned, or simply closing (crashing to the desktop), with an error ('Exception Access Violation') being displayed in some cases. There are also some reports of spontaneous reboots occurring after a game crashes.

Not all PC games are affected by any means, with Microsoft noting that reports are coming in from players of Arc Raiders, Marvel Tokon: Fighting Souls, and The Finals.

Microsoft is currently trying to work out what's going on, saying: "Ongoing investigation indicates that this issue is related to peripherals or internal device components which have RGB lighting features. Such devices may install drivers or code components with file names similar to inpoutx64. In systems where these drivers are found, the issue is then triggered by launching certain games."

Microsoft adds that it's currently trying to "understand the relationship between these RGB components and the games which trigger this issue", and says it will update gamers when more information becomes available.

Analysis: theories and workarounds

Microsoft is suggesting that this may be a driver-related issue of some kind, rather than a problem with Windows 11 itself. Of course, changes to Windows 11 could be the root cause, and the company admits that, and says it's still trying to "determine if this is an issue caused by Microsoft" on the release health dashboard.

As The Register points out, some on Reddit are theorizing that this bug is to do with "tightened kernel handle validation" which was introduced with the latest patch for Windows 11. Essentially meaning that Microsoft has tightened aspects of security with the August update, and that this is causing driver glitches, ones that were previously ignored, to be picked up (and subsequently crashing games).

The mentioned driver (inpoutx64) isn't just used in software controlling RGB lighting, but also in some system utilities needing low-level system access (for hardware monitoring, for example, and one such tool is mentioned in the above Reddit post: ZenTimings). It seems that if this driver is present on the host PC, the game's anti-cheat probing it now throws up a problem (post-patch), and that leads to the crash.

If this bug is causing you grief — and there are a lot of Arc Raiders players out there in that particular boat — there are workarounds that can make the game playable again.

The first is the most obvious and easiest fix: remove the August update for Windows 11 (or roll back the OS to before it was installed). You can remove an update in Windows Update, in the Update History panel — just find the patch (KB5121003 in this case) and uninstall it. However, bear in mind that you will be without a bunch of security fixes (and other features, including faster app launching) if you don't have this update on your PC.

The other alternative is to remove the problematic driver file, which seemingly won't harm your system (that said, if you do so, it's at your own risk — I haven't tested this). Going by the advice in the above Reddit thread — and also from the developer of Arc Raiders (Embark) — what you need to do is open the Command Prompt in Windows 11 by typing cmd in the search box, then right-click on Command Prompt and select 'Run as administrator'.

Once the prompt appears, type the following and press enter:

sc stop inpoutx64

Then type this second line and press enter:

sc delete inpoutx64

Now close the Command Prompt, open File Explorer, and find the following folder: C:\Windows\System32\drivers.

In that folder you should see the inpoutx64 file, it may be a SYS or DLL file (or both). Delete any of those files which are present.

That's the driver removed, and you should now be good to go, and you can still have the August update installed. But as I already noted, proceed at your own risk if you take this route.

The best bet for now may be to sit tight and wait for the results of Microsoft's investigation, and hopefully we'll hear something soon. However, this could be a somewhat thorny problem to untangle, and it rather sounds like a case of Microsoft dealing with a security issue — one which should be fixed — and that cure causing collateral damage due to driver wonkiness.

Whatever the case, on social media, a good many PC gamers are blaming Microsoft for this latest gaming-related issue in Windows 11.

One Redditor delivers the following barb: "They can't even keep the one thing they had over Linux. If you have to worry about whether or not your games work anyway, why still use Windows?"

Another observes: "Since 2025 December update till today — EVERY single month the update breaks something! There was no single month without issues."

There's no shortage of shots fired at Microsoft for monthly update woes, accusations of this being the fault of vibe coding (AI), and threats to leave for greener Linux desktop pastures. Business as usual, then.

• UK movie theatres considering smart glasses ban
• The ban would be over privacy and piracy concerns
• It's yet another instance of private bans restricting the tech

Privacy concerns have rocked Meta’s smart glasses business. They’re being ridiculed online as ‘perv glasses,’ and their use is banned in a growing number of spaces. In the UK, this could also soon include cinemas, though it’s for a very different p-word: piracy.

The main concern with camera glasses, like the ones Meta produces with its partners Ray-Ban and Oakley, is that people can record in a fairly secretive way. This is an issue for the general public as they don’t know when or if they’re being recorded, and for venues like cinemas and theatres as it allows movies and live shows to be subtly recorded by the audience.

With a stable enough internet connection, the viewing could even be live-streamed.

The ban hasn’t taken effect yet, but its consideration is another blow for smart glasses makers and users, who are finding it increasingly difficult to wear their specs because of their spy-camera capabilities.

Meta would argue that recording isn’t covert. There is a light that comes on and stays on while you record. Plus, Meta has taken numerous steps to disable recording capabilities if this light is tampered with — either via a simple cover or by fiddling with the hardware.

However, critics have argued the light is easy to miss if you don’t know to look for it, especially if you're outdoors during the day or in a bright place.

In a dark theatre or cinema, the recording light would arguably be a lot more noticeable, though the proposed ban would reduce the risk that bad actors sneak through — while also addressing privacy concerns the glasses raise for other patrons, and banning glasses that allow more covert filming.

Because while Meta is the most well-known smart glasses maker, and so is taking the heaviest share of the backlash, it isn’t the only player in town. Some glasses manufacturers aren't as strict about tackling modders who disable their recording indicator, while others make the indicator even less noticeable or don’t ship with one installed.

Going, going, gone?

Governments have also been considering action against smart glasses; however, we have yet to see much in the way of widespread bans. At this rate, we might not need to.

The court of public opinion has issued an overwhelmingly negative verdict on smart glasses. The privacy concerns for people wearing the glasses, and for passersby caught in their gaze who never consented to having their life captured by smart specs,

Even previous champions of the technology I’ve spoken with — journalists like myself who have used and tested, and loved these glasses — have stopped wearing them outside of our reviews. I’ve written before how I’m genuinely fearful I’ll get accosted in the street if I’m caught wearing these glasses.

Besides the threat of retaliation, the steady banning of these glasses across various venues makes them increasingly useless. That’s doubly true for folks who need prescription glasses — smart glasses bans often say that the glasses having prescription lenses is no excuse, meaning you could spend $500 / £500 / AU$750 plus on a pair of glasses you can’t wear anywhere.

Is this the end of smart glasses then? A serious perception overhaul could help, though it’s unclear how that would be achieved without such major software changes or hardware alterations, such as removing the camera altogether — though, from experience, cameraless smart specs don’t impress me. It’s too useful a feature to lose out on.

To that end, it’s a lose-lose, and that’s a shame for a category I think is quite fun and cool when people aren’t being creeps with them. They’re also proving a handy tool for people with visual impairments as the glasses can see and describe the world for them.

We’ll have to wait and see what happens, but I expect it’ll continue to be a rocky road ahead for smart glasses.

• Siemens S7 Series programmable logic controllers are being hit in a new critical infrastructure attack against energy, water and agriculture
• Attackers are using AI-generated malware to chain exploitations, and hiding their malicious software as a monitoring tool
• The identity of the attackers is not known

A joint warning issued by federal agencies has warned that US critical infrastructure is facing an “active threat” in the form of AI-generated malware specifically targeting programmable logic controllers (PLCs).

PLCs are widely used across the energy, water and agricultural industries to control pumps and monitor systems. The attacks have been labelled as an “evolution” in attacker capabilities, with the AI systems capable of chaining exploitations to gain control of PLCs.

The warning comes from the National Security Agency (NSA) and FBI, alongside other federal agencies who said in an advisory that, “This is not a theoretical risk — it is an active threat.”

Siemens S7 Series PLCs under active attack

The advisory warns that Siemens S7 Series PLCs are the chosen target of this latest campaign with the attackers leveraging “AI-assisted development” in their penetration.

“Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems,” the advisory warns.

The identity of the attackers has not been revealed, but critical infrastructure systems are a favorite target of state-sponsored groups looking to scout out potential targets to later cripple water treatment and disrupt energy supplies.

The hackers are locating vulnerable PLCs using internet scanning platforms and disguising the malware as monitoring tools in order to evade detection. To defend against this attack vector, the advisory said that PLCs should be isolated from the internet, with software updates performed as soon as they become available.

The advisory said that the attacks are “an evolution in threat actor capabilities,” with the AI generated scripts “dramatically reducing the technical expertise and time required to develop working exploitation scripts and malicious tools.”

Who has been targeting critical infrastructure?

The US war with Iran has led to a significant increase in attacks against critical infrastructure.

In July 2026, an attack against the operational technology of 30 Minnesota community water systems showed indications of Iranian involvement. Shortly before the attack CISA updated an advisory warning that Rockwell Automation, Schneider Electric, and Siemens PLCs were under active attack.

April saw Rockwell Automation/Allen-Bradley-manufactured PLCs were exploited in attacks against water and energy systems, as well as to compromise Government Services and Facilities.

Automatic Tank Gauge (ATG) systems have also been hit during attacks targeting energy, chemical, food, agriculture, and transportation industries. These systems were also found to be largely internet-facing, and when compromised could allow attackers to turn off systems designed to monitor fuel levels, temperature and potential leaks.

Russia has also been involved in targeting critical infrastructure at a global scale. The attacks hit broken and poorly configured networking devices such as routers that had passed their End-of-Life (EoL) and were no longer receiving updates.

• GuidePoint observed “Ransom Busters” posing as recovery firms in ransomware incidents
• Group claimed to hack RaaS panels, offering decryption keys for $20K–$60K
• Researchers say it’s likely the same affiliates behind infections, not genuine rescuers

Ransomware operations have evolved again, and this time around the crooks are pretending to be the good guys.

Cybersecurity researchers GuidePoint Security were recently brought in to respond to multiple ransomware attacks against their clients. In some of those incidents, the victims were also contacted by a group calling themselves “Ransom Busters”, which offered to delete the stolen files from the attackers’ servers, while providing the victims with working decryption keys.

What made the offer suspicious was the fact that Ransom Busters reached out to the victims before the attackers had gone public. The crooks claimed to have hacked into the admin panels of multiple Ransomware-as-a-Service (RaaS) operations, including DragonForce, Settra, and Anubis, giving them not just insight into who was targeted, but also access to stolen data and the decryption keys.

Just another affiliate

For their services, Ransom Busters ask between $20,000, and $60,000 - however, the researchers are saying this is all a ruse, and that Ransom Busters are, most likely, just affiliates of these ransomware services. Not only that, but they are also most likely the ones who infected these companies with ransomware in the first place.

They said that both the attackers and Ransom Busters are using the same software, same tactics, and same identifiers, leading to the conclusion that it’s the same group on both ends of the spectrum.

The good news is that no one seems to have paid Ransom Busters for their offer. The only thing GuidePoint observed was one victim paying the actual ransom demand, rather than the fake recovery firm. That firm, fortunately, did not have its name listed on the leak site, and its files remain secure for now.

Pretending to be a recovery firm is the next evolutionary step in the life of ransomware.

In its early days, ransomware was all about encrypting the computers and asking for payment in exchange for the decryption key. When companies responded by building out strong backups, the criminals moved to stealing files and threatening to release them to the public. Soon after, some added Distributed Denial of Service (DDoS) into the mix, blocking not just the back end but also the front-end, in an effort to force a payment.

Some criminals even called their victims on the phone for further intimidation.

These days, more and more groups are moving away from encryptors and focus solely on data theft, since it’s cheaper yet equally lucrative.

Via BleepingComputer

• Windows 11 is getting per-app permissions for all desktop software
• Previously this was limited to just apps from the Microsoft Store
• Microsoft has also decided to drop an incoming interface addition called the drag tray, which had drawn complaints from some testers

Windows 11 is finally giving you a full range of options to maintain your privacy from potentially snooping apps, and the OS is being further improved as Microsoft is scrapping an unpopular addition for the interface which was in testing.

First up, let's look at the privacy move, which as Windows Latest reports is the expansion of individual privacy controls for apps in Windows 11. This was first highlighted by Jakub on X, who noted: "Huge changes are coming to Windows 11 privacy & security. In the latest Experimental Insider Build (26340.9212) you can now revoke access to the camera & microphone for specific Win32 apps!"

What this means is that in Settings you can allow or deny access to the camera and mic (as well as location access) for desktop apps on an individual basis. Couldn't you do that before, I hear you ask. Only for Microsoft Store apps, with other (Win32) applications having just one 'master switch' to either toggle all these permissions on or off (on a blanket basis).

Thankfully, in a new experimental test build of Windows 11, Microsoft has changed things so you have granular privacy controls over all apps, not just Microsoft Store software.

On top of that, testers are seeing smartphone-style app permission prompts for allowing access to the camera and mic, which is a feature Microsoft has said it's bringing in before.

Windows Latest also noticed that Microsoft has officially canned the drag tray, which was a new part of the interface in testing with Windows 11.

The idea here is that when you grabbed and dragged a file on the desktop, this tray would appear at the top of the screen, and if you moused the file over it, you'd get some quick sharing options (so you could simply drop the file to share via WhatsApp, or Outlook, or a bunch of other icons).

Tthe drag tray could be handy for users with a touchscreen, for example, as an easier method than going by the right-click menu sharing options. So, what was wrong with this feature?

The problem was for those users with busier desktops, perhaps crowded with folders, because in these situations — or when using a maximized folder window filling the display — if a file was dragged towards the top of the screen, the tray might appear and get in the way of the target folder (effectively blocking it).

These frustrations led to some complaints, and Microsoft has ultimately decided to drop the tray.

In the notes for the most recent Windows 11 preview build in the Experimental channel, Microsoft told us: "Thank you to Insiders who have provided feedback about the Drag Tray experience. Based on feedback, we're removing the experience in this build. We're continuing to explore improvements in this area and look forward to sharing more about a future replacement experience in a later update."

Analysis: a real drag

The drag tray had to go, then, at least in its current implementation, but as Microsoft noted, this isn't necessarily the end of the road for this concept. It may be brought back to testing in a different incarnation, and indeed that sounds like the plan here, so I'll be keeping an eye out for the feature's reemergence at some point.

As for the privacy options, this is a very welcome move, as it's pretty important to be able to pick and choose which apps have what permissions. The only real question here is: why wasn't this the case in the first place? Granted, there are technical reasons why it's a good deal trickier to implement a per-app system like this for Win32 software compared to applications from the Microsoft Store. However, it isn't like this was something Microsoft couldn't solve – clearly, as it's being done now.

There might be quite a lot of work involved, but really, that isn't an excuse, and this is another one of those long overdue changes for Windows 11. A bit like the streamlining and new customization options for the right-click (context) menu in the OS, although admittedly that was a good deal more urgent. At any rate, at least both these changes are happening now, although this per-app privacy system is still in testing, and could end up looking somewhat different by the time it reaches release.

All of this is part of Microsoft's drive to fix Windows 11 while introducing a host of crowd-pleasing features that have long been requested, such as that context menu change. Note that the drag tray never actually arrived in the full release version of Windows 11, just to make that clear – it was only ever in testing, showing that not everything in preview makes the cut by any means.

• CareCloud confirmed March 16 2026 cyberattack exposed data of 3.7 million individuals
• Attackers accessed one AWS environment, stealing personal records including names
• Incident deemed non‑material but may incur remediation, legal, and reputational costs

The March 2026 cyberattack on CareCloud exposed sensitive data on 3.7 million people, the company has confirmed.

The American IT healthcare company had told the US Securities and Exchange Commission (SEC) it experienced a “temporary network disruption” in its Health division which “partially impacted the functionality and data access to one of six electronic health record environments for approximately eight hours."

Initial investigation determined that the criminals accessed people’s personal records, but it was not said how many people were affected, what the nature of the files were, or if they were exfiltrated or just exposed.

Notifying the Department of Health

In late July 2026, the company started notifying its customers of the incident, saying the unidentified actors accessed one of CareCloud’s AWS environments and claimed to have stolen files found there. The company did not say which type of data was taken, other than people’s full names.

In a separate report with the US Department of Health and Human Services, the company confirmed the exact number of affected individuals as 3,756,469.

At press time, no hacking groups claimed responsibility for the attack, or shared details about the volume, nature, and type of data potentially stolen.

CareCloud is a publicly traded American healthcare technology firm providing cloud‑based software and services to medical practices and health systems, including electronic health records (EHR), practice management, billing and revenue cycle solutions. It works with tens of thousands of healthcare providers across the United States in more than 70 specialties and across all 50 states, with over 40,000 providers on its platform.

In its initial report with the SEC, CareCloud said the incident did not have a material impact, but that it might incur expenses in remediation and response costs, legal, regulatory and notification-related matters, and could possibly affect patients, customers, counterparties, reputation and operations.

Via BleepingComputer