• A report commissioned by Mozilla accuses Microsoft of using 'harmful design' to undermine browser choice in Windows 11
• That allegedly includes trick wording, nagging, preselection, and generally dubious tactics to push Edge over other browsers
• The report does observe the situation is better in the European Economic Area, due to regulations there, and notes that "regulatory action works", urging authorities elsewhere to take a similar stand

Mozilla, the maker of Firefox, has published another report that claims Microsoft isn't maintaining a suitably level playing field for web browsers on Windows, and is unfairly pushing users towards Edge.

As Mozilla makes clear, it published the first 'Over the Edge' report – about 'How Microsoft's design tactics compromise free browser choice' – two years back, and the follow-up has just arrived (as spotted by Eteknix).

It's not actually written by Mozilla, I should note, but two independent researchers commissioned by the Firefox maker (Harry Brignull and Cennydd Bowles, the same pair who wrote the first article). It takes in user opinions from the US, UK, India and Germany regarding "key browser-choice journeys" on Windows 11 and 10.

In a nutshell, they conclude that: "Microsoft continues to deploy harmful design to undermine people's browser choice."

That specifically involves, according to the report: "Trick wording, obstruction, visual interference, preselection, nagging, and forced action — at almost every step of the user journey."

Some of the worst excesses highlighted are the pop-up banner that Edge users see when they go to the Chrome download page (trying to get them to stick with the Microsoft browser, which, it says, has the same tech as Chrome but with the "added trust of Microsoft"), and nagging within Windows around using Edge as the default browser in one way or another.

The report also notes how Edge is pre-pinned to the Windows taskbar, and how a migration from Windows 10 to Windows 11 resets Edge as the default browser, overriding any previous choice. There are a lot of accusations around trick wording, too, as well as an observation that Microsoft is using Copilot (AI) to open links in Edge rather than your default browser.

On the topic of AI, the report notes: "The researchers suggest that a sequence of seemingly minor consent requests across Windows and Edge may combine into a 'pipeline' funneling browsing data — potentially including data originating in rival browsers — into Microsoft's advertising and personalization systems."

It's notable that Germany — included as a representative country within the European Economic Area (EEA), which has different regulatory requirements Microsoft must adhere to — escapes quite a few of these excesses (the Chrome download nonsense included).

Despite that, the researchers argue that their broad conclusion that "Microsoft does not allow people to download and install an alternative browser, to set it as their default, or to continue using it as their default, without harmful interference" is, they claim, true "across every region tested".

Analysis: a call to regulate

Yes, this is a report commissioned by a browser rival, but these findings aren't at all surprising in the main, and it's long been known that Microsoft overzealously promotes Edge in Windows 11, trying various dubious shenanigans to get the browser in play as the report observes. Of course, on the flipside Google pulls similar stunts with Chrome.

Still, that's not an excuse, and no browser should be actively attempting to dissuade people from downloading another rival browser. What Mozilla is also pointing out, of course, is that Microsoft is in a particular position of power here, given that it owns the world's primary desktop OS, and it's leveraging that platform in various ways to push adoption of Edge.

Whether that's worked for Microsoft, or not — spoiler alert, it hasn't — is irrelevant, as this behavior obviously isn't ethical or fair, and while it may not have dented Chrome's reign as the top browser, it may have damaged smaller rivals like Firefox.

While the EEA may have a considerably better balance of browser equality within Windows, the report notes that this is, of course, because regulations have forced Microsoft's hand. Arguably, this is another negative in that it shows Microsoft only respects user choice in terms of browsers when it's forced to do so.

Mozilla finishes with the following paragraph that sums everything up nicely: "We again urge Microsoft to abandon these harmful patterns worldwide. And we urge regulators in the European Union, the United Kingdom, the United States, India, and beyond to consider this report as evidence that regulatory action works — there is much still to do."

So, if Microsoft really wants to talk about "added trust", how about some action on some of these sticking points? Or is this just a case of having to be more trustworthy than Google?

• Researcher “Chaotic Eclipse” releases new Windows 11 zero‑day dubbed LegacyHive, a local privilege escalation bug targeting user registry hives
• Exploit could let attackers elevate low‑privileged accounts, but requires prior device access; no CVE or full PoC was published
• Experts caution that skilled actors could weaponize it quickly, urging intelligence teams to prepare mitigations despite lower perceived impact than earlier releases

Chaotic Eclipse, the infamous security researcher with a Microsoft grudge, did as they previously promised and released yet another zero-day vulnerability for fully patched Windows 11 devices.

However, other researchers don’t see it as dangerous as some of their previous releases.

Chaotic Eclipse disclosed a zero-day called LegacyHive, which is a local privilege escalation (LPE) bug targeting Windows’ user hives.

Escalating privileges

A few months ago, a hacker/researcher with the alias Chaotic Eclipse started publishing functioning exploits for fully patched Windows 11 systems, all with PoCs, claiming that Microsoft acted against them in ill faith and argued that the company does not treat researchers with the respect they deserve.

They released a total of seven exploits, some more damning than others, and promised to release a “bone-shattering” one on July 14 2026. In the meantime, Microsoft first criticized the researcher for not “responsibly” disclosing the flaws, and at one point even threatening possible legal action. However, it did not sue the researcher and later backed away from the threat entirely, partly as a result of strong public backlash.

In Windows, user hives are registry files that store configuration settings specific to an individual user account. These include desktop preferences, user-specific application settings, network drive mappings, user-specific security and privacy settings, and more.

With LegacyHive, threat actors could, in theory, gain privileged read-write access targeting other users’ hives. Or, in other words, they could turn low-privileged accounts into high-privileged ones. However, they would first need to have any access to the device, which is one of the reasons why some security researchers don’t see it as disastrous as Chaotic Eclipse’s previous work.

What also makes LegacyHive different from some other releases is that this one was not released with a CVE identifier or a fully functioning Proof of Concept (PoC).

Still, security experts are urging intelligence teams to work fast, because skilled threat actors can fill the gaps with relative ease, and turn LegacyHive into a potent weapon.

Via The Register

• Russian hacker “bandcampro” used Google’s Gemini CLI to control an eight‑device botnet at a dental clinic
• The attacker tricked the AI by posing as a pen tester, directing it to migrate C2 infrastructure, troubleshoot connectivity, and prepare payload bundles
• The AI assisted with daily operations like password guessing and WordPress access, highlighting risks of misuse when threat actors co‑opt AI tools

A Russian hacker and his AI companion were able to successfully control a miniature, eight-system botnet, with the hacker giving instructions in conversational language, and the AI doing his bidding, experts have found.

Analyzing 200 session logs obtained from the Russian-speaking threat actor known as “bandcampro”, cybersecurity researchers Trend Micro saw the hacker use Google’s Gemini CLI, an open source AI command-line tool that lets developers interact with Google's Gemini AI models directly from a terminal.

Scouring through a month’s worth of session logs (between April 21 and May 19 2026), the researchers discovered that the attacker tricked the AI by telling it they were an “authorized pen tester”. While the AI mostly complied with their nefarious overlord, they refused the orders on at least one occasion.

Gone in six minutes

Trend Micro found the hacker controlled eight devices belonging to a dental clinic and sought to access their access their OpenDental database.

Using the AI, bandcampro did a number of things, starting with migrating the botnet to a new C2 infrastructure. He gave the AI a skill file with the full architecture description, standard operating procedures, infection one-liner, persistence commands, and troubleshooting steps.

He then told it to “study the C2 migration”, which had the AI process the guide and prepare all the code and necessary steps. It took the tool around six minutes to get the job done.

"The AI read the migration guide, then prepared a migration bundle, a small archive of server code, payloads, and the skill file. It then unpacked the bundle, launched the C&C server on a VPS, and brought up the Cloudflare tunnel," Trend Micro says.

Bandcampro then used the AI to troubleshoot connectivity issues, as well as for various daily operations, such as guessing passwords, generating plausible variants of existing passwords for WordPress portals, and more.

Via BleepingComputer

• TriWest Healthcare confirmed an April 16 breach in which an attacker accessed and downloaded sensitive data tied to 12,000 TRICARE beneficiaries
• Stolen information includes names, DoD Benefits numbers, ZIP codes, authorization request types, and in some cases SSNs, addresses, and dates of birth
• TriWest says it acted immediately to contain the intrusion and notify affected individuals; no group has claimed responsibility and stolen data has not surfaced online

US healthcare services company TriWest Healthcare networks recently suffered a cyberattack in which it lost sensitive customer data belonging to thousands of its clients’ users.

TriWest is a private company that manages government healthcare programs, primarily on behalf of the US Department of Defense (DoD) and the Department of Veterans Affairs (VA). One of its clients is TRICARE, a DoD healthcare program for active-duty service members, National Guard and Reserve members, military retirees, and their families.

According to Cybernews, TriWest recently started notifying TRICARE customers that an “unauthorized person” accessed its network on April 16 and “downloaded some TriWest information.” Citing data provided to the California State Attorney General’s Office, the publication says 12,000 TRICARE beneficiaries were recently notified of the breach.

Sounding the alarm

In a statement shared with Military Times, TriWest explained what it did the moment it spotted the intrusion: “With regard to timing, as soon as the incident was discovered, TriWest took immediate action to prevent any further unauthorized activity and worked diligently with the government to notify affected individuals, consistent with applicable law and notification timelines,” TriWest officials said.

The details about the incident, the nature of the attack, or the identity of the attackers, were not disclosed. We do know that the miscreants walked away with people’s names, DoD Benefits numbers, ZIP codes, types of authorization requests and, in some cases, Social Security numbers (SSN), postal addresses, and dates of birth.

At press time, the TriWest website, as well as the company’s newsroom, were offline. It is unclear if there is any connection to the data breach. So far, no threat actors claimed responsibility for the attack, and the data is yet to surface on the dark web.

In the meantime, TRICARE beneficiaries are warned to be wary of incoming emails, especially those claiming to come from the program or the company.

Via Cybernews

• Zoom patches critical improper input validation flaw in multiple Windows clients and SDKs that allowed remote account takeover
• Additional high‑severity bugs fixed include CVE‑2026‑53410 (TOCTOU race condition), CVE‑2026‑53409 (privilege management flaw), and CVE‑2026‑53411 (input validation issue)
• All vulnerabilities were found internally, with no evidence of exploitation; users are urged to update Zoom Workplace and related products to the latest versions

Zoom has patched a critical-level vulnerability in multiple products that allowed threat actors to take over people’s accounts remotely.

In a security advisory, Zoom said it fixed an Improper Input Validation bug plaguing Zoom Desktop Client for Windows (before version 7.0.0), Zoom VDI Client for Windows (before versions 7.0.10, 6.6.15, and 6.5.18), and Zoom Meeting SDK for Windows (before version 7.0.0). It did not go into more details on how the flaw works.

The bug is now tracked as CVE-2026-53412, and was given a severity score of 9.8/10 (critical). To fix it, users are advised to update their software to the newest version.

More vulnerabilities

While certainly the most dangerous one, this is not the only bug Zoom recently addressed. The company also fixed a handful of less severe vulnerabilities, including a time-of-check to time-of-use (TOCTOU) race condition bug affecting Zoom Workplace for Windows before 7.0.5, Zoom Workplace VDI Client and VDI Plugin before 6.5.17/6.6.14, Zoom Rooms for Windows before 7.0.5, and Remote Control for Zoom Contact Center before 7.0.0. This bug is tracked as CVE-2026-53410 and was given a “high” severity score of 7/10.

Other notable mentions include CVE-2026-53409 (a high-severity improper privilege management flaw in Zoom Rooms for Windows before version 7.1.0), and

CVE-2026-53411 (a high-severity improper input validation flaw affecting the Zoom Workplace VDI Plugin for Windows before version 6.6.14).

Zoom found all of these vulnerabilities in-house and says there is no evidence that any of these were abused in real-life attacks in the past.

Zoom Workplace (the company’s all-in-one collaboration platform) offers video meetings, team chat, phone, email, calendar, scheduling, whiteboards, and other productivity tools. It is an evolution of the original Zoom Meetings app which now competes with platforms such as Microsoft 365 and Google Workspace.

Via BleepingComputer

• Palit has launched a new RTX 3060 model with 12GB of VRAM
• This continues a recent theme of old GPUs being resurrected
• These GPUs may pack 12GB of video RAM at a relatively affordable price, but they don't make sense compared to current-gen pricing

We might not have seen any new graphics cards so far from Nvidia this year — and no RTX 5000 Super refreshes are in sight (although there are rumors again) — but we're continuing to witness the resurrection of some old GeForce GPUs, with Palit officially revealing a new RTX 3060.

That popular workhorse of a gaming GPU has already made something of a comeback, returning to the shelves of retailers like Newegg as an alternative budget graphics card in a RAM-starved climate where prices of many of these current-gen boards are being hiked up (alongside other PC components, of course).

As flagged by VideoCardz, Palit has trumpeted the launch of its new GeForce RTX 3060 Infinity 2 OC graphics card as "the return of a classic", which is certainly one way of putting it.

Although to be fair, even today, the RTX 3060 remains a very popular GPU, ranking second on the Steam hardware survey for June 2026 (behind only the RTX 4060 laptop GPU in a rather bizarre twist I won't get into here).

Palit observes: "Combining a massive 12GB GDDR6 memory capacity with a clean, all-black dual-fan shroud, the Infinity 2 delivers honest, dependable performance without the premium price tag."

Analysis: let's hope for a Palit-able price tag, but so far, RTX 3060 pricing has been out of whack

The key selling point for these RTX 3060 models is that they're loaded with 12GB of video RAM (VRAM), as Palit emphasizes with this new Infinity 2 OC model. Where this is side-stepping the RAM crisis (to some extent) is that these past-gen Nvidia cards use GDDR6 VRAM, a different memory supply to tap than the GDDR7 used in RTX 5000 graphics cards (except the RTX 5050, which goes with GDDR6, but that's the outlier here).

This means Nvidia can get its partners to produce graphics cards that have 12GB of GDDR6 VRAM (a loadout a good few gamers put a priority on securing), but sit at the cheaper end of the market. Due to cost issues, these days it's a lot less tenable to sell lower-end GPUs which stack up the GDDR7 VRAM (like the RTX 5060 Ti with 16GB).

It's sad that the RAM crisis has forced us to this point, but that's the reality of the GPU world at the moment. What's also problematic for me here is that the RTX 3060 might have 12GB of VRAM at a relatively affordable price point, but looking at current pricing in the US as an example, it's not meaningfully cheaper than the RTX 5060 with 8GB.

Yes, you're getting a lean RAM configuration with the latter current-gen graphics card, but it's still a much faster GPU — one that benefits from DLSS 4, too — and only just over 5% more expensive (at the time of writing). At this kind of price differential, the RTX 3060 12GB doesn't make a lot of sense.

If these RTX 3060 models were a lot cheaper, then there might be more of an argument. To be fair to Palit, we don't have a price tag on this new offering yet, but pricing needs to be a lot more compelling than what I'm seeing right now (especially in the UK, where the RTX 5060 8GB is actually cheaper than the 3060 at some retailers, although there isn't much stock of the latter).

• Nichirei Co confirms cyberattack disrupting refrigerated warehouse and frozen food logistics, impacting customers including KFC Japan
• KFC warned of delivery delays leading to possible menu restrictions, shortened hours, or temporary suspension of online orders
• No data leaks or attacker claims have surfaced; disruptions suggest ransomware, but both companies expect operations to normalize by week’s end

Nichirei Co, a large Japanese company which produces frozen and processed foods, and operates cold-chain logistics to distribute them across the country, has confirmed it suffered a cyberattack which affected some of its customers, including KFC.

The company confirmed the news in a notice stating, “Today, Nichirei Co experienced a system failure caused by unauthorized access."

Nichirei said that it is currently investigating the incident, but that there is no evidence of personal or customer data leaking outside the company. However, due to the nature of the incident (which hasn’t been explained in detail), multiple operations have been affected, including refrigerated warehouse inbound/outbound operations, and frozen food shipping services.

No claims yet

These disruptions affected, among others, KFC - one of the largest fast food chains in the world. In a separate announcement, KFC said that a system failure at Nichirei Logistics Group, which happened on July 13, affected the company’s logistics and delivery sites. “From Tuesday, July 14, 2026, food delivery to KFC stores is expected to be affected,” it said.

“As a result, each store may suspend operations depending on some products going out of stock, menu restrictions, shortened business hours, or ingredient stock availability. Additionally, online orders from the official app and website have also been temporarily suspended.”

The nature of the attack, or the identity of the attackers, were not disclosed. Since Nichirei had to shut down some of its services, it could mean this was a ransomware attack and that some company data was stolen after all. The Register reports that KFC Japan hasn’t posted information about store closures and continues to promote summer menu items.

At press time, no threat actors claimed responsibility for the attacks, and no Nichirei/KFC data surfaced on the dark web. The companies expect to resume normal operations by the end of the week.

Via The Register

It's time for your guide to today's Wordle answer, featuring my commentary on the latest puzzle, plus a selection of hints designed to help you keep your streak going.

Don't think you need any clues for Wordle today? No problem, just skip to my daily column. But remember: failure in this game is only ever six guesses away.

Want more word-based fun? TechRadar's Quordle today page contains hints and answers for that game, and you can also take a look at our NYT Strands today and NYT Connections today pages for our verdict on two of the New York Times' other brainteasers.

SPOILER WARNING: Today's Wordle answer and hints are below, so don't read on if you don't want to see them.

Wordle hints (game #1853) - clue #1 - Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Wordle hints (game #1853) - clue #2 - first letter

B is a very, very common starting letter in Wordle. In fact, it's the third most common overall, behind only S and C.

Wordle hints (game #1853) - clue #3 - repeated letters

Repeated letters are quite common in the game, with 748 of the 2,309 Wordle answers containing one. However, it's still more likely that a Wordle doesn't have one.

Wordle hints (game #1853) - clue #4 - ending letter

E is the most common letter to end a Wordle answer by far. That's one of the reasons why many of the best start words, including SLATE, CRANE, CRATE and STARE, all end with one.

Wordle hints (game #1853) - clue #5 - last chance

Still looking for more Wordle hints today? Here's an extra one for game #1853.

• Today's Wordle answer is an isolated hill or mountain.

If you just want to know today's Wordle answer now, simply scroll down – but I'd always recommend trying to solve it on your own first. We've got lots of Wordle tips and tricks to help you, including a guide to the best Wordle start words.

If you don't want to know today's answer then DO NOT SCROLL ANY FURTHER BECAUSE IT IS PRINTED BELOW. So don't say you weren't warned!

Today's Wordle answer (game #1853)

• NYT average score: 4.1
• My score: 5
• WordleBot's score: 3
• My skill score: 93
• My luck score: 31
• My start word performance: SANER (183 remaining answers)
• WordleBot's start word performance: SLATE (14)
• Tomorrow's start word: SANER

Today's Wordle answer (game #1853) is… BUTTE.

And so here we are in the calm after the storm. Only we're not really, because although BUTTE is considerably easier than yesterday's nonsense word PSHAW, it's still not exactly obvious.

I'll be honest, I didn't know what BUTTE meant until I looked it up so I could write this column. I knew it existed, because it's been an answer in Quordle at least once, but I thought it was the thing you kept water in, in the garden — but that is apparently without the E. Instead, it is apparently an isolated hill or mountain with steep sides.

It has an average score of 4.1, probably reflecting the fact that it has that repeated T, and to an extent that relative obscurity. It's unlikely to be a streak killer like PSHAW, but it's not easy either.

My game was rather disappointing once again; I'm not having a good time of it this week. The frustrating thing here was that I had only four options after the second guess: CHUTE, QUOTE, EMOTE and BUTTE. Unfortunately, I'd only thought of three of those — with the odd one out being BUTTE.

So, I guessed EMOTE and that was wrong, and thought that left only one option, CHUTE, which I played next. I was stunned (relatively speaking) when that wasn't the solution, and it took me a while to finally identify BUTTE as the answer.

Yesterday's Wordle hints (game #1852)

In a different time zone where it's still Wednesday? Don't worry — I can give you some clues for Wordle #1852, too.

• Wordle yesterday had a vowel in one place*

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

• The first letter in yesterday's Wordle answer was P.

P is a very common first letter among Wordle answers. It's the fifth most common in the alphabet and begins 141 solutions in total.

• There were no repeated letters in yesterday's Wordle.

Repeated letters are quite common in the game, with 748 of the 2,309 Wordle answers containing one. However, it's still more likely that a Wordle doesn't have one.

• The last letter in yesterday's Wordle was W.

W is an uncommon ending letter in Wordle. A mere 17 games finish with one, out of 2,309 original answers.

Still looking for more Wordle hints? Here's an extra one for game #1852.

• Yesterday's Wordle answer is an exclamation of impatience or irritation.

Yesterday's Wordle answer (game #1852)

• NYT average score: 4.7
• My score: 5
• WordleBot's score: 4
• My skill score: 48
• My luck score: 79
• My start word performance: SANER (31 remaining answers)
• WordleBot's start word performance: SLATE (20)
• Tomorrow's start word: SANER

Yesterday's Wordle answer (game #1852) was… PSHAW.

Okay, cards on the table: this is worst, stupidest, most annoying, most ridiculous Wordle ever. It is terrible.

What on earth is the NYT thinking? Yes, it is a word, and yes, it is in the dictionary, so it's technically allowed… but it is so archaic! When was the last time you used it? When was the last time you even saw it or heard it anywhere? Or is it just me? I don't think it's just me. I asked my partner, who is an avid reader and an editor herself, and like me she'd heard of it — but she'd never use it.

It's an easy addition to the rogue's gallery of worst Wordle words, joining the likes of BORAX, CAROM and BEAUT; it might well be at the top of that list.

It's certainly near the top of the list of toughest Wordles this year, with its average score of 4.7 being beaten only by DIZZY (4.8), WAXEN, PUPPY, FIZZY and DOWDY (4.9), GUNKY (5.2) and WAVER (5.3). Do I need to explain why? Probably not, but I will anyway.

In short: just look at those first three letters: PSH. There is only one other Wordle answer that begins with a PS — PSALM, which was the answer to game #973. In fact, that was the only PS-word among the original 2,309 solutions, with this (inevitably) being a nasty NYT addition.

The fact that the H follows the S makes it harder still, because the brain doesn't think to look for three consonants together at the start of a word other than with an S or T at the start, where STR, SCR, SPL, THR etc are relatively common. But otherwise you usually get a vowel as the third of the three.

That said, the obscurity of the word is probably a bigger issue; it certainly was for me.

I had a bizarre time of it, with my second guess leaving only one option, and therefore a guaranteed three… that was not guaranteed at all, because I had no idea what it was. So, I played a narrowing-down word — HOSTA, which is not a word I know but which Wordle accepted. I only played it to see if I could place my three yellow letters, but failed entirely and had to try again.

At this stage, I was not just bewildered and befuddled, but also worried about losing my 1,653-game-long streak. Determined to place those yellow letters, I went with ASHES; I knew it was wrong, obviously, but was at my wit's end.

The result: finally, a green SH combo. Plus, the A could now only go in one position, so I knew it was -SHA-.

The only problem was that I couldn't think of anything that fit. Nothing. Zip. Zilch. So, I did something that I really try to avoid doing… and made a spreadsheet of possibilities. Yes, really. Look!

There were 160 of them in total, and though I scanned through the list nothing initially jumped out at me. I tried ordering it by vowels at the start, but still came up blank. Then, knowing that PS is a valid starting combo — rare, sure, but valid in the way that DS and MS are not — I looked at all of those options and eventually spotted PSHAW.

I was less than convinced that it would be the solution, but didn't have any other options at this point, so played it and was mightily relieved when it proved to be correct.

So, I escaped with a five in the end — but with a very low skill score, due to having overlooked the only solution on two successive guesses. PSHAW indeed!

Wordle answers: The past 50

I've been playing Wordle every day for more than four years now and have tracked all of the previous answers so I can help you improve your game. Here are the last 50 solutions starting with yesterday's answer, or check out my past Wordle answers page for the full list.

• Wordle #1852, Wednesday 15 July: PSHAW
• Wordle #1851, Tuesday 14 July: STEAK
• Wordle #1850, Monday 13 July: STOUT
• Wordle #1849, Sunday 12 July: CLACK
• Wordle #1848, Saturday 11 July: AVIAN
• Wordle #1847, Friday 10 July: CANAL
• Wordle #1846, Thursday 9 July: AMEND
• Wordle #1845, Wednesday 8 July: DEMON
• Wordle #1844, Tuesday 7 July: SLING
• Wordle #1843, Monday 6 July: TODDY
• Wordle #1842, Sunday 5 July: SWAMI
• Wordle #1841, Saturday 4 July: PIZZA
• Wordle #1840, Friday 3 July: BATON
• Wordle #1839, Thursday 2 July: MAVEN
• Wordle #1838, Wednesday 1 July: DEMUR
• Wordle #1837, Tuesday 30 June: PUPPY
• Wordle #1836, Monday 29 June: CRUDE
• Wordle #1835, Sunday 28 June: EMCEE
• Wordle #1834, Saturday 27 June: SCOOP
• Wordle #1833, Friday 26 June: ACUTE
• Wordle #1832, Thursday 25 June: UNITY
• Wordle #1831, Wednesday 24 June: QUEER
• Wordle #1830, Tuesday 23 June: CURRY
• Wordle #1829, Monday 22 June: OVATE
• Wordle #1828, Sunday 21 June: ALIBI
• Wordle #1827, Saturday 20 June: DRAKE
• Wordle #1826, Friday 19 June: EMOJI
• Wordle #1825, Thursday 18 June: ENTRY
• Wordle #1824, Wednesday 17 June: TOKEN
• Wordle #1823, Tuesday 16 June: AMAZE
• Wordle #1822, Monday 15 June: BROIL
• Wordle #1821, Sunday 14 June: SEPIA
• Wordle #1820, Saturday 13 June: QUELL
• Wordle #1819, Friday 12 June: BREAK
• Wordle #1818, Thursday 11 June: TESTY
• Wordle #1817, Wednesday 10 June: ALIGN
• Wordle #1816, Tuesday 9 June: WHARF
• Wordle #1815, Monday 8 June: MAFIA
• Wordle #1814, Sunday 7 June: THUMB
• Wordle #1813, Saturday 6 June: MORPH
• Wordle #1812, Friday 5 June: NOBLY
• Wordle #1811, Thursday 4 June: ALLOY
• Wordle #1810, Wednesday 3 June: NOTCH
• Wordle #1809, Tuesday 2 June: BASIS
• Wordle #1808, Monday 1 June: CHILI
• Wordle #1807, Sunday 31 May: ETUDE
• Wordle #1806, Saturday 30 May: SMILE
• Wordle #1805, Friday 29 May: CLANG
• Wordle #1804, Thursday 28 May: DIVOT
• Wordle #1803, Wednesday 27 May: STUFF

What is Wordle?

If you're on this page then you almost certainly know what Wordle is already, and indeed have probably been playing it for a while. And even if you've not been playing it, you must surely have heard of it by now, because it's the viral word game phenomenon that took the world by storm in 2022 and is still going strong in 2026.

We've got a full guide to the game in our What is Wordle page, but if you just want a refresher then here are the basics.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1634) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1634) — hint #2 — repeated letters

Quordle today (game #1634) — hint #3 — uncommon letters

Quordle today (game #1634) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1634) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1634) — the answers

The answers to today's Quordle, game #1634, are…

• IGLOO
• PLAIT
• YEAST
• AROMA

This was a tricky game — mainly due to two words ending in vowels.

I thought I had exhausted all words ending in the letter O, before I finally got to one ending in two of them.

Daily Sequence today (game #1634) — the answers

The answers to today's Quordle Daily Sequence, game #1634, are…

• NEEDY
• GOOFY
• ABIDE
• VISIT

Quordle answers: The past 20

• Quordle #1633, Wednesday, 15 July: PROXY, BRICK, BROTH, SURGE
• Quordle #1632, Tuesday, 14 July: EBONY, AVOID, RODEO, CUTIE
• Quordle #1631, Monday, 13 July: VOICE, BISON, BURNT, BUILT
• Quordle #1630, Sunday, 12 July: STAIN, BINGO, LARVA, DICEY
• Quordle #1629, Saturday, 11 July: WORTH, PRONG, DINGO, DRUID
• Quordle #1628, Friday, 10 July: GREET, STEAK, DUSKY, HAUTE
• Quordle #1627, Thursday, 9 July: CRUMP, PHONE, SHINY, STONY
• Quordle #1626, Wednesday, 8 July: GHOST, TREND, EXALT, ALONG
• Quordle #1625, Tuesday, 7 July: ARRAY, SUITE, KIOSK, BOULE
• Quordle #1624, Monday, 6 July: TRAWL, SPICE, PIANO, SHARK
• Quordle #1623, Sunday, 5 July: PINEY, SWOON, TITLE, PINTO
• Quordle #1622, Saturday, 4 July: ARGUE, MOTEL, OPERA, TRUCE
• Quordle #1621, Friday, 3 July: AVERT, MOTOR, MANIC, WORDY
• Quordle #1620, Thursday, 2 July: BULKY, PARSE, BELOW, MOVIE
• Quordle #1619, Wednesday, 1 July: EASEL, OTTER, LYRIC, SHACK
• Quordle #1618, Tuesday, 30 June: HALVE, DRYER, THERE, MINTY
• Quordle #1617, Monday, 29 June: SLURP, CRACK, CRANK, PHONY
• Quordle #1616, Sunday, 28 June: RUPEE, TOPAZ, FULLY, BEING
• Quordle #1615, Saturday, 27 June: PRINT, MARRY, SADLY, BICEP
• Quordle #1614, Friday, 26 June: JUICE, ARRAY, BONEY, SKIFF

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #865) - hint #1 - today's theme

NYT Strands today (game #865) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• NOISE
• CHANCE
• VERSE
• TRUANT
• GIVE
• SKATE

NYT Strands today (game #865) - hint #3 - spangram letters

NYT Strands today (game #865) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #865) - the answers

The answers to today's Strands, game #865, are…

• TACK
• ZIGZAG
• TURN
• VEER
• DEVIATE
• PIVOT
• SWERVE
• SPANGRAM: CHANGECOURSE

• My rating: Hard
• My score: 1 hint

Rerouting… is a word I used to see a lot when I used a sat nav in my car, so this is exactly the theme I was expecting — but I still struggled over it.

It’s not until you play Strands that you realize how many different ways there are to say the same thing, in this case a change of direction.

I took a hint to get going, but TACK didn’t help much. Then, I connected the two Zs for ZIGZAG and finally got motoring.

Yesterday's NYT Strands answers (Wednesday, July 15, game #864)

• QUIXOTIC
• IDEALISTIC
• ROMANTIC
• IMPRACTICAL
• SPANGRAM: PIEINTHESKY

• Group‑IB warns of scams exploiting Celine Dion’s concert comeback, with fraudsters selling duplicate Ticketmaster tickets and spoofing sites like AXS and Paris La Défense Arena
• Scammers embed themselves in Facebook fan groups and marketplaces, even using voice messages to build trust and make fake offers seem legitimate
• Fans are advised to only buy from official distributors, verify tickets in person if using resellers, and contact banks to dispute charges if scammed

Celine Dion is back, and hackers are already trying to exploit the fact for their own financial gain, experts have warned.

A report from security researchers Group-IB has claimed there are numerous scam campaigns all across the internet and social media, looking to exploit gullible fans and steal their money.

Its aptly named “The Scam Will Go On” report said it saw scammers lurking in Facebook Groups, Facebook Marketplace, and other fan-centric spaces, offering concert tickets for sale. The tickets themselves, hosted on Ticketmaster, are valid. However, the scammers only have a few tickets which can be redeemed by the first person who reaches the venue. Everyone else will be denied entry, since their tickets will already have been used.

How to avoid getting scammed

But that’s not the only scam. Some people don’t want to pay an unknown third person via wire, and would prefer to purchase the tickets directly from a service.

For those people, the scammers created entire websites, spoofing ticketing distributors such as AXS and Ticketmaster. Group-IB also saw fake websites spoofing Celine Dion and Paris La Défense Arena, the stadium where the concert will take place.

“We see that such an event generates excitement and provides scammers with another opportunity to make a fortune at the expense of unsuspecting fans,” Group-IB warned.

“Scammers are using increasingly sophisticated techniques, such as embedding themselves into social networking fan groups and speaking directly to their victims via voice messages to make the interaction more personal and gain their victims’ trust more easily. Furthermore, official ticketing platforms are being misused to make scams seem legitimate.”

The researchers recommend fans only visit official websites and those of official distributors, and if they absolutely must buy from a reseller, to make sure they’re purchasing a physical ticket, in person. Those that fell for the scam should call their bank and lodge an objection on their credit card.

• A Steam user has found a way to store games on SSDs with an auto-navigation and auto-start script
• These are effectively physical 'game cartridges' complete with key art
• However, costly SSDs means this is a pricey endeavor (the Steam gamer was lucky enough to pick up used drives on the cheap)

Physical copies of PlayStation games are coming to an end from January 2028, and as the backlash around that continues, a restoration of physical media on PC has been discovered — and it's novel to say the least.

A Steam user on Reddit has managed to store games on 'cheap 2.5-inch' SATA SSDs, effectively acting as old-school 'game cartridges' with key art, and a script that auto-navigates Steam to each game's page. The user also notes that automatically starting games from each drive is possible.

This comes amid a significant uproar from gamers following the revelation of Sony's plan to eradicate physical game discs, supposedly by the time its next PlayStation console arrives. It's a very controversial move that has united gamers across all platforms to fight to retain discs and to ensure game ownership remains intact.

With that said, physical media for PC has been dead for a long while, since a modern desktop PC doesn't come with a disc drive, and there are hardly any publishers selling physical copies for the platform.

With most games only accessible digitally on PC, in theory those titles can be taken away from buyers at any time. The trouble is that consumer-friendly figures like Gabe Newell, who leads Valve, the owner of Steam, won't be in charge forever.

So in the future, under new leadership, it's possible more anti-consumer measures might be introduced, or other aspects of PC gaming that consumers dislike, such as DRM (like Denuvo).

Steam Game Cartridges from r/pcmasterrace

Imagine if this 'game cartridge' system was adopted by PC game publishers? It's a smart idea, and a nice thought, but clearly not a realistic one. For starters, it'd be a prohibitively expensive method of reintroducing physical PC game copies.

Of course, platforms like Epic Games and Steam require users to be logged in and have their app installed to play games, so it's still a long way off true game copy ownership, anyway.

However, this concept would be paired perfectly with GOG, a platform that is DRM-free and doesn't require the launcher to play purchased games — in other words, you fully own purchased games on GOG.

Admittedly, publishers releasing PC game cartridges in the form of SSDs is a pipe dream, especially with the current state of the hardware market, and the RAM crisis, complete with skyrocketing SSD prices.

The idea comes at the wrong time, then, but if the RAM crisis ever settles down, then maybe this is something we'll see more PC hobbyists doing — and perhaps even the odd publisher.

• Attackers are spoofing LastPass and Bitwarden with phishing emails from fake newsletter domains, tricking users into signing bogus DocuSign documents
• Victims are redirected to malicious “compliance” domains flagged by Microsoft Defender and Cloudflare, already taken offline
• Neither password manager was breached; this is domain spoofing, and users are urged to verify sender addresses and domains before clicking links

Criminals have been found impersonating popular password managers LastPass and Bitwarden online in an attempt to trick users into sharing their login credentials, and thus access to a treasure trove of passwords and other secrets.

LastPass recently issued a warning to its customers, raising awareness of the ongoing phishing campaign.

However the scam also now seems to have spread to other password managers, with Bitwarden customers also apparently being targeted.

Passwords are safe

In the campaign, LastPass users received emails from the address “hello@lastpassnewsletter.com”.

This address does not belong to LastPass, and is in no way affiliated with the password manager. In the message, the victims are told that the company’s security policies have been updated, and that they should navigate to a specific landing page and sign a DocuSign document.

The email comes with a ‘Review & Access Terms’ button which, if clicked, redirects the victims to lastpasscompliance[dot]com, yet another domain unaffiliated with the password management platform.

BleepingComputer claims this domain has already been flagged as malicious by both Microsoft Defender for Office 365, and Cloudflare and is currently offline.

Digging deeper, the journalists uncovered another campaign, almost identical, but now targeting Bitwarden users. In this case, the victims were being mailed from the “hello@bitwardennewsletter.com” addresses and were being redirected to bitwardencompliance[dot]com. Identical methodology, just slightly personalized.

It is important to note that neither LastPass nor Bitwarden were compromised as part of this attack.

The companies’ infrastructure is intact, and the passwords are safe. This is a typical domain spoofing attack in which the crooks purchase a domain similar to the legitimate one, in hopes that the victims won’t spot the difference.

As usual, the best course of action is to always be skeptical of incoming emails, and to double-check the domains and email addresses from which they are sent. It is also good to cross-reference these emails with any older messages that are proven to be authentic, to see if the domains and addresses match.

• ArcticWolf uncovered 292 malicious GitHub repositories spoofing legitimate tools and products, delivering a new BoryptGrab infostealer variant
• Malware steals from 19 browsers, 32 crypto wallets, messaging apps, Steam, and Windows Credential Manager, and uniquely bypasses Chrome’s App‑Bound Encryption via code injection
• Most repos have been removed, but some remain active; GitHub’s popularity makes it a prime target, underscoring the need to vet code before use

Russian actors have reportedly created hundreds of malicious GitHub repositories masquerading as legitimate software but acting as a dangerous infostealer.

Cybersecurity researchers ArcticWolf discovered the campaign after finding their own products spoofed as part of the attack.

In total, the researchers found 292 fake repositories, spoofing things like security products, developer tools, macOS utilities, games, and more. Each repository contained a README file with the download URL.

Obviously malicious

Victims who download the program get a variant of the BoryptGrab infostealer family that grabs data from 19 browsers (passwords, cookies, payment information), 32 cryptocurrency wallets, Telegram, Discord, and Steam sessions, credentials for Meta’s Max, data from Windows Credential Manager, and more. It can also exfiltrate files from Desktop and Documents, and grab screenshots.

While most of the features can be found in other BoryptGrab variants, this one is unique in a sense that it can bypass Chrome’s App-Bound Encryption through direct code injection into the browser process.

While it hasn’t been specifically said that the threat actors are Russian, the compressed data is later sent to a Russia-based command-and-control (C2) infrastructure.

What’s also worth mentioning is that the malware is not designed to last. It has no anti-analysis layer, and doesn’t even try to hide itself in any specific manner. It does not establish persistence and simply tries to grab as much sensitive data as it can on the first attempt.

The attack, which seems to have started in the final days of June, is almost thwarted now, since most of the malicious repositories have been removed from GitHub. Citing “researchers”, BleepingComputer reported that several dozen still remain active, though.

Because of its importance and popularity in the open-source community, GitHub is currently one of the most targeted platforms on the internet, which is why it’s important to double-check and vet every piece of code before it’s applied to a project.

• TCL CSOT is reportedly now mass producing the first inkjet-printed OLEDs for consumers
• MSI just revealed a new 27-inch monitor which seemingly uses this 4K panel
• Inkjet printing is a more affordable way of making OLEDs and it will usher in cheaper monitors and laptops, and eventually TVs further down the line

TCL CSOT has seemingly taken a big step towards putting inkjet-printed OLED panels in the homes of consumers, and mass production of these screens is now reportedly underway.

OLED-Info reports that the Chinese manufacturer has kicked off production with an initial 27-inch 4K panel with a refresh rate of 120Hz. It offers a brightness of up to 300 nits and 99% coverage of the DCI-P3 color gamut (meaning lifelike and accurate color representation).

This inkjet-printed screen is destined for monitors, but bigger panels for the likes of TVs are expected to be in the cards for the future. For starters, though, we're looking at production for monitors and also laptop OLEDs.

This is still the very early stages for TCL, and OLED-Info clarifies that we are only talking about 'low volume' production on the firm's Gen 5.5 inkjet line for now. Still, it's an important step to take, but producing the panels is one thing, and it'll take some time for these to be incorporated into monitors which are then shipped to retailers where consumers can buy them.

Note that the Gen 5.5 inkjet line has produced OLED panels before, just not displays destined for consumer products (they were screens for commercial use in the medical field).

It seems that the freshly announced MSI Pro Max OLED 271UPJW12 uses this TCL 4K panel, although that isn't explicitly stated in the press release for the new model published by TechPowerup. All the specs match up, though, and it couldn't really be any other screen anyway – and this revelation is another sign to back up OLED-Info's contention that mass production is now up and running.

MSI boasts of the monitor: "With a 164 PPI density and an optimized RGB Stripe sub-pixel layout that closely resembles the uniform RGB structure of traditional LCDs, this advanced design effectively eliminates color fringing, optimizing text and image clarity."

We don't get a price from MSI, but that's not surprising at this stage, because as noted, the release is likely still some way off yet.

Analysis: what's the big deal with inkjet-printed OLEDs anyway?

As we've covered in the past, there are some distinct advantages with using an OLED printed by an inkjet compared to traditional (Fine Metal Mask) OLED panels. They are more power-efficient, and the inkjet-printed (IJP) OLEDs will also have a longer lifespan, but most crucially, they're cheaper.

TCL has previously told us that these IJP panels are 20% cheaper than existing OLEDs (and they can be made 30% faster, too). Analyst firms believe that these printed panels could be up to 35% cheaper in the future, when production is higher volume and more refined (with less waste).

The upshot should be OLED monitors which are a good deal more affordable, not to mention laptops with OLED screens that hit cheaper price points – and as noted, TVs eventually, too. The lower power usage will also be a major benefit for notebooks in terms of extending battery life, given that the display is one of the biggest drains on the battery.

The overall affordability of OLED will also be helped by TCL's inkjet-based creations, because the dominant panel makers – LG Display and Samsung – will be forced to be more competitive with their pricing. Add to that the emergence of BOE's Generation 8.6 panels, which went into mass production last month – again offering a more economical way to produce OLEDs thanks to much larger substrates – and this poses yet more competition, meaning there'll be some distinct downward pressures on OLED pricing.

The catch is that it will take some time for this to happen, especially in the world of bigger screens for the likes of OLED TVs – but make no mistake, it is happening.

• ESET discovers 11 vulnerable UEFI shim bootloaders signed by Microsoft, allowing attackers to bypass Secure Boot and deploy malicious bootkits
• Any UEFI system trusting Microsoft’s 2011 third‑party certificate could be exposed, potentially billions of devices; attackers can bring old trusted shims to new systems
• Microsoft has revoked the vulnerable shims, and users should apply the latest UEFI revocations (Windows auto‑updates, Linux via LVFS) to block exploitation

Cybersecurity experts from ESET have discovered 11 vulnerable UEFI shim bootloaders, all signed by Microsoft, which could allow threat actors to exploit ancient vulnerabilities and bypass UEFI Secure Boot, deploying all sorts of malicious bootkits.

A shim is a small, intermediary bootloader that works as a bridge between a computer's firmware (UEFI) and the operating system's bootloader. Its primary purpose is to allow operating systems to work with UEFI Secure Boot without having Microsoft sign every Linux bootloader individually.

Any UEFI-based machine that trusts the Microsoft Corporation UEFI CA 2011 third-party UEFI certificate authority (CE) certificate, regardless of the operating system, was said to be vulnerable to the shims (versions 0.9 and older). That would put the number of potentially vulnerable devices in the billions, since almost all modern x86 PCs use UEFI firmware, and most of them trust the Microsoft Corporation UEFI CA 2011 certificate out of the box.

Revoking the shims

However, ESET reported its findings to CERT/CC and the vulnerable UEFI applications were all revoked.

The shims come from different tools such as PC diagnostic software, Linux distribution, and other UEFI-based utilities, the researchers explained. They also added that, since the attackers can bring their own vulnerable shims to any UEFI system with the Microsoft third-party UEFI certificate enrolled, they can exploit systems that are, at first, not affected.

To block the vulnerable shims, users should apply the latest UEFI revocations from Microsoft, it was said. While Windows systems will most likely do it automatically, Linux systems users should do it through the Linux Vendor Firmware Service.

“What makes these old shims dangerous is not a novel vulnerability; it’s that no new vulnerability is needed to bypass UEFI Secure Boot,” says ESET researcher Martin Smolár, who discovered the vulnerable shims.

“An attacker needs no complicated exploitation primitives — only a copy of an old, still-trusted but unrevoked shim binary and a basic understanding of how UEFI shims work. That is enough to bypass such an essential security feature as UEFI Secure Boot."

• Microsoft’s July 2026 Patch Tuesday fixed a record 622 vulnerabilities, including 58 critical, two exploited in the wild, and one publicly disclosed, plus 428 Chromium bugs
• Actively abused flaws include CVE‑2026‑56155 (AD FS privilege escalation) and CVE‑2026‑56164 (SharePoint privilege escalation), alongside notable issues in BitLocker and Copilot
• Surge in fixes is linked to Microsoft’s use of Anthropic’s Mythos AI, with patch volumes rising sharply since its adoption

Microsoft has released its July 2026 Patch Tuesday download, marking another record-breaking update, addressing hundreds of flaws across the ecosystem.

The release, which is currently rolling out to Microsoft users, fixes a staggering 622 vulnerabilities, including 58 critical-severity ones, two that were observed as being abused in the wild, and one which has already been publicly disclosed.

On top of that, Microsoft shipped fixes for another 428 Chromium bugs, as well.

A jump in numbers

There are simply too many vulnerabilities to mention all of them, however two that are being exploited in the wild are CVE-2026-56155 and CVE-2026-56164. The former is described as an “Insufficient granularity of access control in Active Directory Federation Services (AD FS)” bug, which allows an authorized attacker to elevate privileges locally. It carries a severity score of 7.8/10 (high).

The latter is a “Missing authentication for critical function in Microsoft Office SharePoint” bug that allows an unauthorized attacker to elevate privileges over a network. Microsoft assigned it a medium severity score (5.3/10), but the National Vulnerability Database gave it a 9.8/10 (critical).

Other notable mentions include CVE-2026-50661, a protection mechanism failure in Windows BitLocker that allows unauthorized attackers to bypass a security feature with a physical attack, and CVE-2026-48561, an improper neutralization of special elements used in a command in Microsoft Copilot, that allows an unauthorized attacker to execute code over a network.

If you think fixing 622 vulnerabilities in a month is a lot, you’re absolutely right. It’s well above what Microsoft is used to do, and this is most likely due to the company now using the fabled Mythos - Anthropic’s cybersecurity-oriented AI.

In June 2026, roughly a month and a half after the release of Mythos, Microsoft fixed 206 flaws, which raised eyebrows because it was significantly above the company’s usual amount of bugs fixed.

In May it fixed 120 flaws, in April 167, and in March - 79.

• Microsoft deleted a user’s OneDrive account after it was compromised
• This resulted in the loss of 25 years’ worth of photos and games
• The incident is a reminder to use multiple backup solutions

How much do you have stored in your Microsoft account? Consider all the photos and documents backed up to OneDrive, the games and apps linked to your username, and all the rest. Many of us have a lot stored there, but as one Microsoft user recently found out, it can all be taken away in an instant — with Microsoft itself doing the deleting.

Posting on X, Joshua Khane related how a recent hack of their account led to Microsoft taking the nuclear option and removing 25 years’ worth of data, including photos of their infant son and “thousands of Euros spent on games.”

Khane shared an email from Microsoft explaining that, since “unauthorized access occurred” on their account — meaning a likely compromise by hackers — “we have permanently suspended the account.” Microsoft confirmed that “this action is irreversible … Additionally, if you had files stored in OneDrive, those files are no longer accessible. Due to encryption and privacy safeguards, even our engineers cannot retrieve them.”

The move left Khane incensed, with the disbelieving user condemning Microsoft’s decision not to restore their account: “One of the biggest companies ever couldn’t do that so they just deleted that sh*t like it was nothing??”

“Even though the security could be tighter from my side (lessons are learned),” they added, “it bothers me the most that Microsoft says that they cannot recover my account and suspended it … Thousands of Euros are gone down the drain as I’ve lost all my games also! Couldn’t back those up and I relied on Microsoft to keep that safe, even if I got compromised!”

How to keep your data safe

After the saga was posted on Reddit, other users chimed in with similar stories of their own. “Happened to me also,” said one user. “I had payment proof and everything going back 20 years. They said sorry, best we can do is lock your account for good.”

Another had a piece of advice for Khane: “When this happened to me, I created the new account and sent an email to them (on the same thread) with the new account info. They basically cloned the old account into the new one and I got everything back.” Elsewhere, many users recommended Khane take legal action against Microsoft.

If you want to avoid a similar fate, it’s important that you don’t just back up your important documents to one source — be that cloud storage like OneDrive or an external storage drive. If something goes wrong, your only copy has vanished into the ether.

Instead, build redundancy into your backups. Use a cloud backup service like Backblaze and a local NAS or offline archive drive. If possible, ensure your backups are in different physical locations, including one off the premises.

As Redditor Linesey rightly suggested, “Get a NAS, get an off-site location like a safe deposit box for cold storage, and then use the cloud if you really want to, as another layer.” That way, you’ve got at least one fallback option if a firm like Microsoft decides to delete your data without warning.

It’s also worth setting up passkeys and multi-factor authentication on your accounts and using one of the best password managers to strengthen and store all your logins. That way, you make it harder for bad actors to gain access to your account — and less tempting for Microsoft to hit the big red button, with irreversible consequences.

• Windows 11's July update has arrived
• It packs some smart features, including pausing updates at length and a new recovery option
• This patch also cures a nasty bug that slowly eats more and more drive space, but there's an issue to be aware of for Dell laptop owners

Microsoft has released its monthly patch for Windows 11 and the July update is a biggie, packing a feature that I've been awaiting for quite some time.

That would be the ability to pause updates on Windows 11 Home – beyond just a short period of time, which has been the only choice to date – and there are some other impressive additions from Microsoft here.

I'm going to pick out my top four features introduced by the July update, as well as rounding up some of the other more notable changes here. I'll also highlight an important bug fix that has been deployed for a nasty flaw that eats your drive space – along with a warning for some of those with a Dell laptop (who may not get this update for a good reason, as you'll see).

As ever, these changes were seen in the last optional update (June preview), and most of these features are being rolled out gradually, so you may not see them right away after installing this update (indeed, you may have to wait a while based on how the update winds blow regarding your exact PC configuration).

1. Pausing updates

Sometimes you want to hold off installing an update because of a bug that you're nervous about potentially affecting your system, and up until now, Windows 11 users have only been able to avoid any given update for five weeks.

Okay, so that's a fairly long time, but what if the bug is one of those persistent and niggly affairs that Microsoft takes an age to fix? You may want to delay the update beyond five weeks, and now you can. The catch is that you'll need to continually renew the delay for every 35-day period, but nonetheless, you can now keep an update at bay for as long as you want. (Well – until you're forced to update to a new version of Windows 11, that is, when support runs out for your current version).

2. Point-in-time restore

Another neat addition is point-in-time restore, a new recovery option that you can employ when something bad happens to your PC and you can no longer reach the desktop. Point-in-time restore lets you roll back a non-functioning system to a previous working state. It reverts to the "full system state" meaning that all your apps, files, and settings are recovered as captured at that previous time.

Hopefully this is a feature that you'll never need, but if you do, you'll be very glad of it. Note that the system backups obviously take up drive space, with older backups automatically deleted after 72 hours by default. Also, if you have a system drive that's smaller than 200GB, you'll have to enable this feature yourself (as it won't be turned on automatically due to potential space issues – note that you can specify a maximum amount of storage space used).

3. Fewer annoyances with widgets

The July update is making the widgets panel 'quieter' by which Microsoft means that it has cut out a lot of clutter. The main change is that by default the panel just displays your widgets and Microsoft has got rid of the promotional nonsense in terms of ads and the MSN feed. Notifications and taskbar badges are also minimized by default, and widgets no longer open when you hover over them.

There are some other streamlining moves here, and even if you don't use widgets, I think this is a noteworthy change as it shows the direction Microsoft is now heading in with Windows 11 – chilling out on the upselling as was previously promised (if not entirely banishing it).

4. Screen tint

Windows 11 has been graced with a number of accessibility improvements in the July update, first of which is a new screen tint ability. This does what it says on the tin, allowing you to tint the screen with a choice of colors to help reduce eye strain, or to make text more easily readable. You can adjust the tint intensity, and this is a very useful addition that'll save people from downloading a third-party app to get these kinds of color overlays.

Other features in the July update

There's quite a lot going on here aside from the above major moves, and that includes Microsoft boosting the speed at which File Explorer launches (helping Windows 11 to feel more performant overall).

There's a whole lot of work on the Bluetooth front, too, as Microsoft notes: "This update improves reliability and performance when connecting to and using Bluetooth devices." That includes better driver stability, improved audio routing for calls via Phone Link, and more.

File Explorer has also been honed to be more reliable, and Microsoft has implemented a performance tweak to the Background Intelligent Transfer Service (BITS) that means PCs will shut down more promptly. If you've ever sat staring at your computer while it takes 20 seconds to shut down, wondering what on earth it's doing, that kind of behavior will hopefully be a rarer occurrence going forward.

A major bug fix – and Dell laptop problems

There's some good news for those of you who have been suffering at the hands of a mysterious bug that eats storage space (due to an out-of-control database file). This is fixed with the July update (the cure was in the June preview before it), so you can grab this to resolve the issue (hopefully).

There's some bad news on the bug front, though, namely that you won't get this update on some Dell devices with Intel CPUs, as Microsoft has blocked it due to the July patch causing all sorts of weird issues. I say it's bad news, but at least Microsoft caught the problem and has prevented the update from being piped to those machines.

Microsoft informs us: "This update might not be available for a limited number of Dell devices with Intel processors due to an incompatibility reported by Dell that can potentially cause unexpected shutdowns, poor performance, increased heat, and battery drain. We are working together with Dell to prevent the affected models from experiencing the issue and plan to release a resolution for affected devices in the coming days."

So, if you were wondering why you couldn't get this patch on your Dell laptop, now you know. You'll just have to sit tight for now until Microsoft and Dell get this ironed out.

• The US Treasury has sanctioned First VPN's administrator for aiding ransomware attacks on American infrastructure
• Another suspect was targeted for selling "cryptors" that cloak malware from security systems
• The move follows a May 2026 takedown by European law enforcement and the FBI that seized the VPN's infrastructure

The United States government has officially issued sanctions against the operators of a notorious virtual private network (VPN), escalating a global crackdown on digital infrastructure used to facilitate ransomware attacks.

On Monday (July 13), the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated First VPN Service (also known as 1VPNS) and its Ukrainian administrator, Dmytro Rashevskyi, for abetting cybercriminals. The service, which has operated since 2014, was heavily favored by ransomware gangs targeting American hospitals, municipalities, and businesses.

While the best VPN services are designed to protect everyday consumer privacy, rogue networks like First VPN provided malicious actors with the tools to "hide the origins of their attacks, deploy malware, and manage exfiltrated data," according to a Treasury Department press release.

As part of the same action, the Treasury also sanctioned Yegeniy Vladimirovich Silayev, a Belarusian national accused of selling "cryptors" to ransomware operators.

While Silayev is not directly affiliated with First VPN, his inclusion in the sanctions package highlights a broader strategy of targeting the entire cybercriminal supply chain. Cryptors are tools specifically built to disguise ransomware as harmless files, preventing security systems from detecting or deactivating the malware.

A haven for cybercriminals

The US Treasury's latest move is an update to an ongoing international operation against First VPN.

In a massive May 2026 takedown, a coordinated effort led by European law enforcement agencies and the FBI successfully seized the service's website and server infrastructure.

Prior to the takedown, Rashevskyi aggressively marketed First VPN on dark web forums. To lure cybercriminals, he promised total anonymity and boasted that the network "does not keep logs of users' identities or activities, and that it refuses to cooperate with law enforcement investigations into illegal activity originating from the servers it rents to customers".

According to the US Treasury, Rashevskyi went to great lengths to keep the operation running. He utilized false identities, such as "Maksim Sorin" and "Roman Chabanenko," to "buy infrastructure from companies that might otherwise refuse to do business with him because of complaints of abuse from internet service providers about illegal activity originating from 1VPNS servers".

Disrupting the cybercriminal ecosystem

This latest wave of sanctions was coordinated alongside the United Kingdom's Foreign, Commonwealth & Development Office (FCDO) and carries severe consequences for the designated individuals.

Under the new sanctions, all property and interests belonging to Rashevskyi and Silayev within the US are blocked, and US citizens are strictly prohibited from engaging in any transactions with them. Beyond the immediate financial freeze, OFAC sanctions serve as a massive reputational blow designed to choke off future revenue streams.

By focusing on the service providers and tool suppliers who facilitate these attacks, rather than just the ransomware operators themselves, authorities are aiming to maximize their impact and disrupt multiple gangs at once.

"Under President Trump's leadership, Treasury is using every available tool to disrupt the cybercriminal ecosystem and protect the American people," said Gene Lange, who is performing the duties of the Under Secretary for Terrorism and Financial Intelligence. "We will continue targeting the actors who enable ransomware attacks against Americans and our critical infrastructure".