• A threat actor built malware that reads poems posted on GitHub
• The poems are a secret code for the location of C2 servers
• The servers instruct the malware to deploy cryptojackers and scanners

Somewhere in the trackless wastes of cyberspace, a digital Robert Langdon is decoding an ancient poem to find the location of his masters and receive instructions on his next steps. I might be exaggerating a bit, but this is the gist of a rather bizarre story on cyberattacks and cryptocurrency mining.

Cybersecurity researchers from Lumen’s Black Lotus Labs found a piece of malware that gets the instructions on the location of the C2 server from a poem shared on GitHub.

By looking for specific words and decoding them into numbers, the malware can get an IP address where the C2 server is located and receive instructions on what to do next - Black Lotus calls it “adversarial poetry” and says it’s never seen anything like it.

Adversarial poetry

The attacker, who seems to be of Italian origin (or at least based in Italy), first hunts for vulnerable internet-facing services, such as LiteLLM or Ollama, and installs a piece of malware called PoeLLM.

This malware then goes to GitHub to look for a poem which seems to be AI-generated. Here are the lines:

In the silent hum of driver, the machines begin to speak,

Each pulse of diode threading light through copper veins.

we taught the dark to carry meaning, byte by byte —

A language built from lightning, cold and clean.

Beyond the wall of encryption, a signal finds its way,

the tick of distant servers answering back.

Data moves like water through the cracks of ordered thought,

and somewhere in the code, the world stays on track.

It then looks for specific words in this poem: driver, diode, decryption, tick, and matches them to corresponding numbers (its dictionary is hardcoded). When they are combined, they form an IPv4 address where the server is located.

PoeLLM then reaches out to the server and gets instructions on what to do next. In most cases, it just deploys a cryptocurrency miner called XMRig, using the device’s electrical energy, compute, and access to the internet to mine Monero tokens and enrich the malicious poet.

The malware can also run as a scanner, searching for additional vulnerable systems, and allowing the attacker to worm his way into even more devices.

Changing the song

If the attacker needs to move the infrastructure, all they need to do is change certain words in the GitHub poem. Therefore, when infected machines retrieve the updated version, they can calculate the new C2 address without needing a malware update. In fact, this already happened multiple times.

According to The Register the poem, titled “On the Nature of Connection,” has been updated 11 times since its initial commit. The latest update happened in September 2026.

“The Canto Incognito campaign appears to be relatively unique in its targeting of multiple AI-related services,” the researchers told The Register.

“Other notable campaigns this year, including the LiteLLM supply chain compromise, focused on a single service and impacted roughly 2,500 victims, according to open sources. The collection of more than 3,000 PoeLLM victims appears to exhibit multiple vulnerable services at any given time.”

In other words, the adversarial poetry campaign has been rather successful, so far infecting more than 3,000 (confirmed) devices.

The PoeLLM malware developer “has been extremely successful in identifying vulnerable servers, deploying exploits, and conscripting victims to continue expanding the campaign,” Black Lotus Labs said.

“If the actor had only focused on one or two vulnerabilities, the potential victim pool might have quickly dried up, but the expanding scope allowed for a bigger, more powerful (and more profitable) botnet.”

• Former CIA official admitted falsifying credentials, securing a senior role with top-level clearance
• He allegedly stole nearly $194 million through a fake intelligence program scheme
• FBI seized gold, cash, luxury assets; he faces up to 20 years in prison

A 49-year-old man lied on his resume to get hired by the CIA - and when he got a high-ranking position, he used it to steal millions of dollars from the US government. He then used that money to fund a lavish lifestyle and was ultimately caught - and is now facing 20 years in prison.

No, this is not the plot of Martin Scorsese’s “Wolf of Langley”, the news was just confirmed by the US Department of Justice, who named David J. Rush, of Ashburn, Virginia, as the fraudster, and said he pleaded guilty to “executing a scheme to defraud the federal government”.

“Following an internal investigation that identified potential crimes, CIA immediately referred this matter to the FBI,” said CIA Director John Ratcliffe. “David Rush abused his position and betrayed the public trust and should be held fully accountable for his actions.”

The Wolf of Langley

According to court documents, Rush lied during the job interview about his education and military experience, which ultimately helped him land a senior executive-level position with a federal agency. In that position, he held a Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance - a designation some government agencies use to control access to some of the government’s most sensitive classified information.

It combines Top Secret clearance (the highest standard US security classification level), with eligibility to access Sensitive Compartmented Information (SCI) which, in itself, is subject to additional security restrictions.

This clearance allowed Rush to access highly classified US government intelligence, but more importantly, allowed him to create a fake “Special Access Program” and get it funded. He then used this funding to wire himself roughly $145 million, buying luxury real estate, watches, and “at least one car”. He also acquired 298 gold bars, worth approximately $46 million. In total, Rush pocketed $193,590,400 in US government funds.

Obviously, $200 million is no pocket change, and someone must have noticed, since on May 19, the FBI raided Rush’s residence. They recovered 298 gold bars, more than two million in cash, just over €100,000 in euros, and “numerous luxury watches” most of which were Rolexes. He later pleaded guilty and agreed to forfeit the gold bars, the fiat currency, 30 watches, two 2026 BMW Alpina cars (worth north of $150,000 - each), and all of the real estate he bought with the stolen money.

“By his own admission, David Rush defrauded the government of hundreds of millions of dollars, and then misused those funds for extravagant purchases,” said FBI Director Kash Patel. “Rush betrayed his oath, his co-workers, and the American people and he will now face justice for his actions. This plea demonstrates the FBI’s commitment to protecting the public’s trust; and that no government position, security clearance, or access to government resources places anyone above the law.”

20 years in jail

Rush will have to wait until January 28, 2027, to hear his sentence which could be up to 20 years in prison, three years of supervised release, forfeiture, restitution, and a fine, the DoJ said.

“A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.”

According to TechCrunch, Rush was employed in 2010 and has since then worked on developing hacking tools and techniques for espionage. His “Special Access Program” was described as a “surveillance or intelligence-gathering operation so sensitive that only a few people are read into [it]”.

Rush allegedly constructed the compartmentalized program as a fake “continuity of government” plan, to be used in case of war, natural disaster, or similar major and disruptive event. The gold was apparently bought by a defrauded defense contractor, which Rush later took home.

Defending email users from themselves

For years now, Microsoft has been adding different file types to the “blacklist”, in an effort to prevent users from downloading and running malicious attachments sent in phishing emails. As The Register reminds, in December 2023, the company disabled ms-appinstaller protocol handler by default, after it was abused to distribute malware.

Since then, Microsoft has also blocked .py (Python files), .ps1 (PowerShell files), and .cab (cabinet files). Some people found it surprising it took Microsoft this long to remember .msix and .msixbundle types, as well.

Via The Register

• Attackers hijacked three country-code domains to obtain fraudulent HTTPS certificates for major websites
• Fake certificates could enable convincing traffic interception and phishing against affected domains
• Google revoked the certificates, protected Chrome users, and warned impacted organizations

Cybercriminals recently managed to hijack three country-code top-level domains (ccTLDs) and used the access to generate HTTPS certificates covering several Google domains, as well as those belonging to other organizations. Google said the attack placed thousands of websites at risk, but stressed that the certificates have since been revoked.

According to Google, the domains that were hijacked are .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). During the attacks, the threat actors modified authoritative DNS records, obtaining HTTPS certificates covering not just Google, but other organizations, too.

In other words, any website operating on these domains was at risk, as well as all of the visitors. By manipulating authoritative DNS records, threat actors could redirect traffic away from legitimate websites and towards malicious ones under their control, all the while telling users they were visiting the legitimate one by showing the padlock icon. Visitors entering login credentials, payment information, or other data, would easily lose them to the attackers, and depending on the circumstances, they could also end up installing malware.

“Due to the nature of the attacks, we have no reason to believe the Certification Authorities (CAs) that issued the impacted certificates did anything wrong,” Google said.

Affecting major brands

Although Google blocked the unauthorized certificates in Chrome and worked to have them revoked, it warned that its interventions might not have identified every affected domain or protected users of other browsers.

“As part of our usual incident response process, we immediately acted to protect users by blocking the use of unauthorized certificates for Google properties in Chrome via CRLSets,” Google added. “We also worked with the issuing CAs to ensure the certificates were revoked to protect users in clients other than Chrome.”

The risk for websites wasn’t theoretical. Google said “several leading global brands and widely used online services” were impacted by these attacks, and stressed that all of the certificates used in these attacks were blocked.

“Where possible, we reached out to impacted organizations to alert them to our findings and actions,” Google concluded. The company did not say which of its own domains were affected, and did not want to name the victim companies. We also don’t know how many organizations were impacted.

Chrome users don’t need to take any action to be protected, it was said, but domain owners do have a thing or two to do. That includes performing ongoing monitoring of Certificate Transparency for all of the domains, and publishing restrictive CAA records with ACME account bindings.

Not the first rodeo

Attacks like this have happened before - in 2011, cybercriminals compromised Dutch Certificate Authority DigiNotar, generating 531 fraudulent certificates for domains belonging to Google, Microsoft, Mozilla, Skype, and more. Some of these certificates were allegedly used to intercept encrypted communications of Iranian internet users, and the incident ultimately forced major browser vendors to withdraw their trust in DigiNotar, putting the company out of business.

Earlier that year, threat actors stole an account belonging to a registration authority partnered with Comodo, obtaining nine fraudulent certificates for domains operated by Google, Yahoo, Microsoft, and others. Something similar happened in 2015, when Google discovered that Symantec's Thawte-branded Certificate Authority had improperly issued an unauthorized certificate during internal testing, covering Google's domains.

This incident, however, was more of an internal failure and less of an attack. Subsequent investigations uncovered numerous additional misissued certificates.

“In parallel with domain-owner defenses, we will continue to work alongside the broader community to limit the impact of transient routing and DNS compromises on the safety of the web,” Google concluded. “To keep our users safe, we are committed to long-term HTTPS ecosystem improvements, such as reducing certificate validity and DCV reuse, through the Chrome Root Program and the new Chrome Quantum-resistant Root Program.”

Via Ars Technica

• Windows 11 search is getting a major overhaul
• It'll be made faster, more efficient with RAM usage, and be tweaked to better understand what you're searching for
• Microsoft is also adding 'actions' to allow users to directly adjust Windows 11 options in the search box, a nifty and convenient touch

Microsoft has announced that it's forging onwards with making Windows 11's search function a faster and more streamlined experience.

In a blog post, Microsoft said it's rolling out this redesigned search experience to Windows 11 testers in the Experimental channel now (likely in a very limited fashion to begin with).

This new search is built on WinUI 3 (the contemporary interface framework for Windows 11), and as a result it'll be faster and will have less impact on your system resources. Microsoft boasts that: "Early testing shows substantial improvements in performance and memory usage, so [search] feels faster and more efficient from the moment you open it."

The search panel itself has been pared back to a single list, as opposed to the current implementation with the list on the left and the preview pane on the right. The interface therefore looks less cluttered, and it's easier to see what you're, well, searching for.

Microsoft also promises it'll work on ensuring that search more readily grasps what you're trying to find, with better handling of typos and guessing what you might mean if you're, say, attempting to find a system option and have entered the name incorrectly. This is work that the company already started in Windows 11, and the post notes that Microsoft will continue to fine-tune all this over the coming weeks.

This is what's happening initially; then, later this year, Microsoft is going to bring more features into testing. That includes inline previews and details that give you all kinds of extra info on the file you're searching (like a thumbnail for an image along with its resolution and size).

Search queries like "weather in London" will bring up an in-line card (powered by Bing) with the relevant at-a-glance details, including the likes of temperature highs and lows for the day.

The other big step is to introduce 'actions' to Windows 11 search, meaning you can simply type a command to change settings in the OS directly from the search box. Microsoft shows an example of typing 'change to dark theme' which pops up the option, then you simply click apply and you're done.

You can type 'mute' to turn off sound, or 'dim my screen' to adjust the brightness level automatically, and issue a similar range of instructions via search.

Analysis: some polarized reactions

These are clearly useful changes, although as with much of the work to fix Windows 11 this year, one of the main questions is: why wasn't this done before? It's long been known that Windows 11 search is clunky and sluggish, with too much clutter in the panel — so why has it taken Microsoft so long to address these points?

A typical barb on Reddit runs like this: "It only took decades for Microsoft to sort this abysmal search out." Someone adds that: "The only time search was decent in Windows was in Windows 98 SE."

Okay, so this kind of flak isn't fair, as other Redditors point out, but you can certainly say that it's not acceptable that Windows 11's search has been in bad shape since the launch of the OS half a decade ago.

It's good to see meaningful movement towards a slicker search is happening, and I'll definitely take this. The actions are a nifty idea, too, for quickly changing options there and then (rather than simply locating the option, and having to use extra clicks to go into Settings and adjust what you want).

As others on Reddit note, this is sort of drafting some ideas over from PowerToys (the Run tool), and something I've previously argued is that Microsoft should port over some of the functionality in that suite of utilities so it's in Windows 11 by default. Maybe that's starting to happen.

Even so, there are folks on Reddit who don't want search to be anything but an ultra-streamlined search (rather than offering the likes of actions). This Windows 11 user complains: "Why isn't the search bar just for searching? Why does it do a million other things on top of it?"

Of course, everyone's entitled to their own take, but I don't agree, and there is a lot of streamlining work going on here which Microsoft should be commended for, with the additions on top being useful in my opinion. Still, it just goes to show that the level of Microsoft hate out there is still palpable, and whatever the software giant does, it'll have its critics.

One of the most important moves with search that's just gone live in the most recent Windows 11 update is the introduction of the ability to turn off web results clutter. Again, that was a long time coming, but at least Microsoft is getting there… finally.

It's time for your guide to today's Wordle answer, featuring my commentary on the latest puzzle, plus a selection of hints designed to help you keep your streak going.

Don't think you need any clues for Wordle today? No problem, just skip to my daily column. But remember: failure in this game is only ever six guesses away.

Want more word-based fun? TechRadar's Quordle today page contains hints and answers for that game, and you can also take a look at our NYT Strands today and NYT Connections today pages for our verdict on two of the New York Times' other brainteasers.

SPOILER WARNING: Today's Wordle answer and hints are below, so don't read on if you don't want to see them.

Wordle hints (game #1937) - clue #1 - Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Wordle hints (game #1937) - clue #2 - first letter

S is the most common starting letter in the game, featuring in 365 of Wordle's 2,309 answers. In fact, it's almost twice as likely to begin an answer as the next most common starting letter, C.

Wordle hints (game #1937) - clue #3 - repeated letters

Repeated letters are quite common in the game, with 748 of the 2,309 Wordle answers containing one. However, it's still more likely that a Wordle doesn't have one.

Wordle hints (game #1937) - clue #4 - ending letter

W is an uncommon ending letter in Wordle. A mere 17 games finish with one, out of 2,309 original answers.

Wordle hints (game #1937) - clue #5 - last chance

Still looking for more Wordle hints today? Here's an extra one for game #1937.

• Today's Wordle answer is to scatter carelessly.

If you just want to know today's Wordle answer now, simply scroll down – but I'd always recommend trying to solve it on your own first. We've got lots of Wordle tips and tricks to help you, including a guide to the best Wordle start words.

If you don't want to know today's answer then DO NOT SCROLL ANY FURTHER BECAUSE IT IS PRINTED BELOW. So don't say you weren't warned!

Today's Wordle answer (game #1937)

• NYT average score: 3.9
• My score: 3
• WordleBot's score: 3
• My skill score: 86
• My luck score: 69
• My start word performance: SANER (8 remaining answers)
• WordleBot's start word performance: SLATE (17)
• Tomorrow's start word: SANER

Today's Wordle answer (game #1937) is… STREW.

Picking a good narrowing-down word is an art, and based on my efforts today I am entirely lacking in artistic talent. I got away with it, though — and that speaks to STREW's relative easiness.

Or at least it might have been easy — it will have depended on your choice of start word. SLATE, the 'Bot's choice, left 17, while STARE reduced the options to only three. CRANE, in contrast, was up in the high hundreds.

The overall average today is 3.9, but I suspect there will be a fair spread, with many scoring a 3 and plenty having to settle for a 5.

I was in the 3 camp, with SANER having reduced my shortlist to eight, which made life a lot easier right away.

I found seven of them: SHRED, SHREW, SCREW, SCREE, STREP, SPREE and STREW, but not SIRED. Is SIRED a realistic choice? I don't think so, based on what we know of Wordle and ED words, but maybe I'm missing something.

With the seven options on my list, I wanted something that contained some combo of C, H, W, T and P, but I couldn't for the life of me think of one. The best I could do was EPOCH, which had three of those letters and which might have left one of three 50/50s. The 'Bot, however, told me later that if I'd have played TWICE I would have guaranteed myself a 3 — and of course, annoyingly, it was right.

If there was any justice in the universe then I would have been punished for my lack of skill with a below-par 4. However, there is not and I instead got lucky. EPOCH did leave me a 50/50, but it was between STREW and SIRED — and I still hadn't thought of the latter. So of course I played STREW and scored a 3. Lucky me.

Yesterday's Wordle hints (game #1936)

In a different time zone where it's still Wednesday? Don't worry — I can give you some clues for Wordle #1936, too.

• Wordle yesterday had vowels in two places*

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

• The first letter in yesterday's Wordle answer was P.

P is a very common first letter among Wordle answers. It's the fifth most common in the alphabet and begins 141 solutions in total.

• There were no repeated letters in yesterday's Wordle.

Repeated letters are quite common in the game, with 748 of the 2,309 Wordle answers containing one. However, it's still more likely that a Wordle doesn't have one.

• The last letter in yesterday's Wordle was E.

E is the most common letter to end a Wordle answer by far. That's one of the reasons why many of the best start words, including SLATE, CRANE, CRATE and STARE, all end with one.

Still looking for more Wordle hints? Here's an extra one for game #1936.

• Yesterday's Wordle answer is to establish the truth or validity of something.

Yesterday's Wordle answer (game #1936)

• NYT average score: 4.2
• My score: 3
• WordleBot's score: 4
• My skill score: 96
• My luck score: 55
• My start word performance: SANER (125 remaining answers)
• WordleBot's start word performance: SLATE (121)
• Tomorrow's start word: SANER

Yesterday's Wordle answer (game #1937) was… PROVE.

PROVE has one of Wordle's most common formats, and that is both a blessing and a curse.

First, the proof. Not only does it have the consonant-consonant-vowel-consonant-vowel thing that so many answers do, but it also has some of the most likely letters in three of those positions: -RO-E.

There are 16 words that have the -RO-E format, then, but to make matters worse, -RA-E and -RI-E are the only two that are even more common, so if you didn't identify the correct middle letter early on, you may well have been choosing between lots of possible solutions.

That's the bad bit. The good bit is that R, O and E are very common, so many people will have identified them early on — for instance, in their start word.

However, there's another bad bit here: V is a far less likely letter, and won't have been played by many people until it was obvious that PROVE was a possibility. Oh, and there's another bad bit: PROBE, PROSE and PRONE are obvious alternatives, as are GROVE and DROVE.

We're in net negative territory here, then — it's clearly more difficult than it might initially look, and if you don't believe me just look at its average score of 4.2. That's actually higher than the score for yesterday's DIMLY, which had dropped to 4.1 by the end of the day.

Somehow, I scored a 3 — and beat the 'Bot while doing so. How? Well, I got lucky. SANER had left more than 100 options, and although DROIT did a decent job in reducing those to seven, I wouldn't have expected a solve on the next guess.

However, when I drew up my shortlist of PROVE, PROBE, GROVE, GROPE, BROKE and FROZE (I missed PROLE, which I'm not sure would really be an answer anyway), it was apparent that PROVE gave me the best chance.

Or rather, PROVE and PROBE gave me an equal chance; either might left one of two 50/50s, but was otherwise guaranteed to solve it in 4, and might even have give me a 3. For whatever reason I picked PROVE, and got lucky when all five letters turned green.

Wordle answers: The past 50

I've been playing Wordle every day for more than four years now and have tracked all of the previous answers so I can help you improve your game. Here are the last 50 solutions starting with yesterday's answer, or check out my past Wordle answers page for the full list.

• Wordle #1936, Wednesday 7 October: PROVE
• Wordle #1935, Tuesday 6 October: DIMLY
• Wordle #1934, Monday 5 October: MOCHA
• Wordle #1933, Sunday 4 October: SHACK
• Wordle #1932, Saturday 3 October: PEEVE
• Wordle #1931, Friday 2 October: USURY
• Wordle #1930, Thursday 1 October: RITZY
• Wordle #1929, Wednesday 30 September: RIVER
• Wordle #1928, Tuesday 29 September: SCUBA
• Wordle #1927, Monday 28 September: TRUNK
• Wordle #1926, Sunday 27 September: SLOOP
• Wordle #1925, Saturday 26 September: ELEGY
• Wordle #1924, Friday 25 September: COPSE
• Wordle #1923, Thursday 24 September: MESSY
• Wordle #1922, Wednesday 23 September: FORTH
• Wordle #1921, Tuesday 22 September: STOKE
• Wordle #1920, Monday 21 September: PAGER
• Wordle #1919, Sunday 20 September: SHONE
• Wordle #1918, Saturday 19 September: WAKEN
• Wordle #1917, Friday 18 September: SNOWY
• Wordle #1916, Thursday 17 September: THETA
• Wordle #1915, Wednesday 16 September: WISPY
• Wordle #1914, Tuesday 15 September: DEALT
• Wordle #1913, Monday 14 September: RINSE
• Wordle #1912, Sunday 13 September: FOCUS
• Wordle #1911, Saturday 12 September: NIFTY
• Wordle #1910, Friday 11 September: ASTER
• Wordle #1909, Thursday 10 September: DRYLY
• Wordle #1908, Wednesday 9 September: BURST
• Wordle #1907, Tuesday 8 September: LIVEN
• Wordle #1906, Monday 7 September: BLIND
• Wordle #1905, Sunday 6 September: BEIGE
• Wordle #1904, Saturday 5 September: SOUPY
• Wordle #1903, Friday 4 September: WAGER
• Wordle #1902, Thursday 3 September: JOIST
• Wordle #1901, Wednesday 2 September: RULER
• Wordle #1900, Tuesday 1 September: REMIX
• Wordle #1899, Monday 31 August: MOUND
• Wordle #1898, Sunday 30 August: INTEL
• Wordle #1897, Saturday 29 August: BLOOD
• Wordle #1896, Friday 28 August: TWEEN
• Wordle #1895, Thursday 27 August: UNCUT
• Wordle #1894, Wednesday 26 August: CAPON
• Wordle #1893, Tuesday 25 August: CLICK
• Wordle #1892, Monday 24 August: RUNNY
• Wordle #1891, Sunday 23 August: OLDEN
• Wordle #1890, Saturday 22 August: PRAWN
• Wordle #1889, Friday 21 August: TRACE
• Wordle #1888, Thursday 20 August: MURKY
• Wordle #1887, Wednesday 19 August: GRILL

What is Wordle?

If you're on this page then you almost certainly know what Wordle is already, and indeed have probably been playing it for a while. And even if you've not been playing it, you must surely have heard of it by now, because it's the viral word game phenomenon that took the world by storm in 2022 and is still going strong in 2026.

We've got a full guide to the game in our What is Wordle page, but if you just want a refresher then here are the basics.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1718) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1718) — hint #2 — repeated letters

Quordle today (game #1718) — hint #3 — uncommon letters

Quordle today (game #1718) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1718) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1718) — the answers

The answers to today's Quordle, game #1718, are…

• MINTY
• ROWER
• BROOD
• RESET

I came very close to losing my winning streak and in the end got lucky with ROWER.

The problem — or rather, problems — were the opening R-O and ending E-R combinations, which left me with, by my reckoning, six possibilities for the missing letter. Fortunately, I got the right one just in time.

Daily Sequence today (game #1718) — the answers

The answers to today's Quordle Daily Sequence, game #1718, are…

• KNACK
• EXULT
• TENSE
• FILLY

Quordle answers: The past 20

• Quordle #1717, Wednesday, 7 October: PALER, FROTH, DOZEN, ERASE
• Quordle #1716, Tuesday, 6 October: FRESH, SKULK, BATCH, ENSUE
• Quordle #1715, Monday, 5 October: SIXTH, SPEAK, SEDAN, HEIST
• Quordle #1714, Sunday, 4 October: INFER, RAINY, THING, ARENA
• Quordle #1713, Saturday, 3 October: CHORE, FLYER, STICK, PURSE
• Quordle #1712, Friday, 2 October: IVORY, SADLY, ANGEL, LLAMA
• Quordle #1711, Thursday, 1 October: NAVEL, SHEER, BIRTH, TACKY
• Quordle #1710, Wednesday, 30 September: CHOKE, BATCH, MOSSY, EAGER
• Quordle #1709, Tuesday, 29 September: BILGE, MEDAL, LODGE, PORCH
• Quordle #1708, Monday, 28 September: BRUNT, TORSO, STONE, HEATH
• Quordle #1707, Sunday, 27 September: VALET, CHEST, VIGIL, PUREE
• Quordle #1706, Saturday, 26 September: SNORT, BIBLE, LAPSE, CRANE
• Quordle #1705, Friday, 25 September: SWEAR, FLOOD, GUPPY, GROAN
• Quordle #1704, Thursday, 24 September: TOPIC, METRO, SCALP, FREED
• Quordle #1703, Wednesday, 23 September: SHEET, BLAND, JOIST, GUAVA
• Quordle #1702, Tuesday, 22 September: COMFY, LOBBY, DRESS, PANEL
• Quordle #1701, Monday, 21 September: WAXEN, HIPPO, PETAL, LEASH
• Quordle #1700, Sunday, 20 September: DERBY, LIMBO, GAWKY, REIGN
• Quordle #1699, Saturday, 19 September: SCOPE, HEIST, PULSE, CHAMP
• Quordle #1698, Friday, 18 September: MUCUS, MIRTH, APPLE, TILDE

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #949) - hint #1 - today's theme

NYT Strands today (game #949) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• MACE
• CREATE
• MINCE
• BRAIL
• CLUE
• WINNER
• TUNA

NYT Strands today (game #949) - hint #3 - spangram letters

NYT Strands today (game #949) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #949) - the answers

The answers to today's Strands, game #949, are…

• FAME
• CELEBRITY
• REPUTE
• ACCLAIM
• RENOWN
• EMINENCE
• SPANGRAM: LUMINARY

• My rating: Easy
• My score: Perfect

After the Lady Gaga movie, the first thing today’s theme made me think of was FAME, so I immediately went searching for it in the game and found it lurking on the right-hand edge.

CELEBRITY was the next most obvious word, but from here the synonyms were less obvious — although, thankfully, easy to spot, along with a spangram that was unfashionably short at just eight letters..

Later in my search I found the word ”winner” and was shocked that it wasn’t featured in the game, because, let's face it, the talented folk who can be described as achieving ACCLAIM, RENOWN and EMINENCE are winning at life.

Yesterday's NYT Strands answers (Wednesday, October 7, game #948)

• BUBBLEGUM
• BARBIE
• SHOCKING
• QUARTZ
• FLAMINGO
• SPANGRAM: TICKLEDPINK

• A new dark web monitoring service has been launched for Netgear customers
• Netgear Dark Web Monitoring is available on Netgear routers supporting its Armor and Armor Plus plans
• Expert analysis of the dark web shows that over 15 billion personal records are available to purchase

Netgear has announced a new service whicht conducts dark web monitoring and notifies you when your stolen data is found lurking in someone else’s database.

Announced as part of its Armor and Armor Plus plans, the Dark Web Monitoring service is available to subscribers via the Netgear app.

The dark web is the hidden arena of the internet where various “out of sight” transactions are conducted. While it has legitimate uses (such as dissidents accessing resources via Tor), it is also the home of a black market in data – typically stolen from large organizations, companies, and governments in successful hacking attempts.

Collection of tools

Owners of the data should be notified by law when their information is stolen. However, often it isn’t until personal information (and more valuable data such as company secrets or software engines) hits the dark web that companies are even aware that they have been hacked. This makes dark web monitoring services such as Netgear’s new feature particularly attractive.

Netgear’s service is added to its existing collection of tools for Armor and Armor Plus subscribers. These include protection against malware and exploits, intrusion, anomaly, and DDoS detection and protection, and a VPN with adblock and anti-tracking.

The dark web monitoring feature adds to these by offering continuous monitoring of the dark web for emails, phone numbers, and financial details lost during a data breach. National Insurance numbers are also monitored.

If anything is found, Netgear Dark Web Monitoring sends alerts and recommends actions. It also offers an Identity Protection Score to illustrate exposure, and as households improve their security the tool tracks their progress.

Finding exposed data

While free services can uncover data that has been exposed in data leaks, the dark web is home to stolen information that may not yet be disclosed. This could be because the organization that has been hacked hasn’t got around to sharing the breach with their customers – or because they don’t know it has even happened.

This makes an active monitoring service like Netgear Dark Web Monitoring particularly valuable.

“Most people think about network security as something that happens within their home,” says Jonathan Oakes, Senior Vice President and General Manager of NETGEAR’s Home Networking Division. “But your details can end up exposed somewhere else entirely, in a breach at a company you’ve never even dealt with directly. Dark Web Monitoring means finding out while there’s still time to act.”

Netgear Dark Web Monitoring is available with its routers’ Armor ($99/year) and Armor Plus ($149.99/year) plans, available to be purchased via the Netgear app.

• A successful phishing attack at the Arizona Supreme Court led to data compromise
• More than a million people are now thought to be affected
• The court's operations were not disrupted

The Arizona Supreme Court has suffered a cyberattack in which it lost sensitive data on more than a million people after an employee allegedly “clicked a malicious link in an email”, which led to the compromise of information on 1.3 million people.

Information is still scarce on the issue, as we don’t know if that malicious link resulted in the victim’s device being infected with an infostealer, or if they were asked to log into a bogus portal, allowing the threat actors to access their account directly.

It was confirmed that the threat actors copied information on 1.3 million people with unpaid court fees, fines and restitution payments for traffic and criminal violations dating back 30 years. They also nabbed almost 30,000 active and inactive orders of protection, as well as 150,000 reports dating back to 2010 from a foster care board making recommendations in cases where parents were allegedly unable or unfit to care for a child.

This kind of data is a gold mine for cybercriminals. Personal and private information can be used to tailor unique, personalized phishing lures which the victims will have a very hard time identifying. These emails can lure the recipients into downloading malware, or navigating to spoofed login portals designed to steal credentials. That malware can then spread to the victims’ employers, possibly resulting in ransomware deployments or data theft and extortion.

Responding to the attack

According to the Associated Press (AP), the court’s IT team shut down the attack on a backup server, roughly two hours after being spotted, on September 24. Since then, they have been notifying the affected individuals about the breach and theft.

So far, the data has not yet made it to the dark web, it seems: “We don’t have any evidence it has been used or shared” after the attack, Supreme Court spokesperson Alberto Rodriguez said.

This would also suggest that this was not the work of any known ransomware groups or data extortionists because by now they would have at least bragged about it on the dark web.

The investigation is still ongoing. The court’s operations have not been disrupted in any way, Rodriguez added. The records were not altered, or deleted, and the attackers apparently did not steal information about jurors, witnesses, or court employees.

Attacking courts

Courts (both in the US and elsewhere) are frequent targets, mostly due to the sensitivity of the information they work with.

In early September 2026, it was reported that Thomson Reuters, the IT company behind the Reuters news agency, suffered a similar incident in March.

The company operates a court case-management system called C-Track, used by different courts to manage things like cases, filings, hearings, and schedules. It is used by courts in several US states, the US Virgin Islands, as well as Ontario, Canada. Unnamed miscreants managed to break in, obtaining “court records and personal information” across 11 US states, the US Virgin Islands, and Ontario, Canada.

Earlier still, on November 21, 2025, the Georgia Superior Court Clerks’ Cooperative Authority (GSCCCA), which manages court and public-record services across Georgia, detected hackers trying to break into the network. The attack was claimed by threat actors called Devman, which claimed to have stolen sensitive files and demanded a ransom payment in exchange. The GSCCCA temporarily shut down its websites and online services, while the FBI warned the authority of an imminent threat.

However, GSCCCA said it stopped the attackers before they were able to extract or encrypt any data and refused to pay the ransom. Devman is not a household name in the cybercriminal underworld, and apparently, it is a financially motivated group, not a state-sponsored one.

Via AP News

• Microsoft will block .msix and .msixbundle email attachments in New Outlook and Outlook Web
• Change aims to reduce malware delivery through application package files sent via email
• Organizations relying on these formats must explicitly allow them before rollout begins

Users of New Outlook for Windows and Outlook on the Web in Exchange Online will no longer be able to download email attachments of two file types: .msix, and .msixbundle, Microsoft has confirmed, saying it’s for the users’ own safety.

“To enhance security in Outlook on the web and new Outlook for Windows, we are updating the default list of blocked file types in OwaMailboxPolicy,” a newly released advisory reads.

“As part of this update, the .msix and .msixbundle file types will be added to the BlockedFileTypes list in the default OWA Mailbox policy and any custom policies created in your tenant.”

What are .msix and .msixbundle files?

MSIX is a file format for packaging and installing applications. It is similar to .exe and .msi installer since it contains files and information Windows needs to install an application. Microsoft introduced .msix as a more modern and secure way of distributing software, saying it comes with features that make installing and updating software more reliable.

MSIXBUNDLE is, as the name might suggest, the same but in plural. It can contain several versions of an .msix package in a single file. For example, a developer can bundle versions designed for different processor architectures (x64 and ARM, for example), and Windows will automatically install the correct one. Both formats are commonly used to distribute Windows applications, including apps delivered through the Microsoft Store.

How big of a deal is this?

Apparently, not that big of a deal. Microsoft itself says that “most organizations are not expected to be affected by this update,” given the fact that these file types are “infrequently used.” However, they seem to be used frequently enough to warrant an update.

“This update is part of our ongoing efforts to strengthen security and help protect organizations from potentially unsafe file attachments,” Microsoft added.

Truth be told, sending application packages as email attachments is hardly the primary way businesses distribute software today. Employees usually do that through managed company portals, the Microsoft Store, package management tools, or direct downloads from software vendors. Therefore, we can assume that the majority of .msix and .msixbundle being sent through email could be malicious and weaponized.

General rollout will begin in early November 2026 and is expected to be complete by mid-November, the advisory reads. Exchange Online administrators who manage OWA mailbox policies are generally affected, as well as those who usually send or receive .msix or .msixbundle attachments in Outlook on the web or new Outlook for Windows Platforms and services. Obviously users of Outlook for the web, New Outlook for Windows, and Exchange Online, too.

So, in roughly a month, these two file types will be added to the BlockedFileTypes list in all OWA Mailbox policies across organizations, including the default policy and any custom policies created across tenants, preventing users from downloading them as attachments, or running them that way, at all.

Organizations that don’t rely on these two file types won’t need to do anything, but those that do should add them to the AllowedFileTypes property of their users’ OwaMailboxPolicy objects prior to rollout.

Defending email users from themselves

For years now, Microsoft has been adding different file types to the “blacklist”, in an effort to prevent users from downloading and running malicious attachments sent in phishing emails. As The Register reminds, in December 2023, the company disabled ms-appinstaller protocol handler by default, after it was abused to distribute malware.

Since then, Microsoft has also blocked .py (Python files), .ps1 (PowerShell files), and .cab (cabinet files). Some people found it surprising it took Microsoft this long to remember .msix and .msixbundle types, as well.

Via The Register

• Fake AI marketing tools impersonate ChatGPT, Gemini, Claude, and others to steal business accounts
• Attackers use realistic browser-in-the-browser phishing and live operators to capture credentials
• Stolen advertising accounts provide access to payment methods, budgets, and linked client accounts

Cybercriminals are offering fake AI-powered products for advertisers and marketing managers, in an attempt to steal their Google business accounts.

Most of today’s biggest AI names, including Chat-GPT, Google Gemini, Claude, Manus, and Muse, are being abused in this campaign, and people are still falling for it.

Security researchers Island have published a new report detailing how the campaign works. Apparently, the operators left the source code for earlier versions of their work open on a misconfigured public GitHub repository, giving the researchers unique insight into the operation and its success.

What researchers found was an advanced phishing platform that was used to target advertisers and marketing managers. It was used to create websites offering fake marketing-related products powered by Artificial Intelligence.

“Every brand gets its own pitch. ChatGPT promises a Monday Google Ads brief. Gemini promises MCC (manager account) and linked-client support. Claude gets its own advertising portal, Perplexity offers campaign planning and spend audits, and Manus offers a private Meta integration,” the researchers explained.

All about connecting

Each site asked the victim to do the same thing - connect their Google account. After pressing “connect”, the platform launches a typical browser-in-the-browser (BitB) attack - it displays an entire browser, address bar and all, within the actual browser.

Therefore, victims not paying attention to the details might see a legitimate domain in their address bar, for example accounts.google.com. However, if they were to lift their gaze just a few inches higher, they would see the actual domain, which has nothing to do with Google, or OpenAI, or any other legitimate business.

The phishing kit is advanced, too. The fake browser adapts to whatever the visitor runs, so it won’t happen that a victim running macOS suddenly sees a Windows, well, window. Newer builds also come with nifty little details, like Safari’s URL pill, Chrome’s custom tabs, and even a dark mode.

As the victim tries to log in, a “human operator” (the scammer) on the other end follows them through the process. They see each submission, and decide what the victim sees next. They can fake a mistyped password error, or they can choose which MFA screen they see. The device gets fingerprinted, from IP and location, all the way down to screen size and WebGL.

The platform supports Google, Meta, TikTok, and Okta workflows, it was said.

Targeting advertisers

At the end of the day, it’s all about money. Island says the crooks are deliberately going for business accounts because these are connected to credit cards, which they can later abuse.

“The lures are written for agency staff, media buyers, and manager-account administrators, because an advertising account is a spending account. It carries a stored payment method and an approved budget, and a manager account can reach several client accounts, each with its own billing profile and linked users.”

This is hardly new. Both Google and Facebook have their own advertising networks, displaying ads to billions of people every day. However, getting accounts, payment methods, and ads approved, is a stringent, painstaking process, which is why it’s a lot easier for crooks to simply use someone else’s account, especially if that someone already walked through Google’s fire barefoot.

Unfortunately, Island could not disrupt the operation or tear it down. At the moment of writing, the campaign was still ongoing, and the researchers saw “hundreds of victim submissions to the platform”.

The researchers are urging organizations to treat fictional AI integrations as account-access requests, inspect the outermost origin, correlate the client pattern, and hunt for the control vocabulary. Finally, they should use phishing-resistant authentication, and review advertising control changes.

“Origin-bound passkeys and hardware-backed authentication remove the reusable password and one-time-code material this platform is built to collect,” they said. “After exposure, check every client account the identity could reach for new managers or partners, changed recovery details, and campaigns or spend nobody approved.”

Via The Hacker News

• AMD's CEO said that the company plans to 'substantially increase' its chip supply in 2027
• Sadly this is chips for AI and data center usage, not consumer products
• If anything this is bad news for Radeon GPUs and Ryzen CPUs, as it's AMD underlining its commitment to the AI sphere

AMD's CEO has assured us that the company is going to increase chip production in 2027, but while that might sound great on the face of it, this isn't good news for consumers.

That's because CEO Lisa Su was talking about making chips for AI usage in data centers, not consumer processors or graphics cards.

Yahoo Finance reports that AMD has been expanding its chip production for AI and that Su said: "We've been able to increase our supply as we've gone through 2026, and we're going to substantially increase our supply in 2027."

This was a comment made to the press during a visit to Taiwan, and the chief executive made it clear that part of the reason for her trip – which included a visit to Foxconn and TSMC – was to make sure AMD's supply of CPU and GPU production could be increased to meet greater AI demand.

The next stop on the CEO's trip is South Korea, where Su will look to shore up memory chip supplies and is set to meet with Samsung and SK Hynix.

On the broader topic of how AI is impacting us all, Su said that it could be "incredibly good for the world" while at the same time cautioning on the risks and the need to cooperate on the safety of this technology.

Analysis: consumers in the cold

There's no mention of consumer products – Radeon GPUs and Ryzen CPUs – here, and the fact that AMD is clearly focused on beefing up AI supply is bad news for the typical PC owner. If anything it might mean that next year is an even leaner time for chip supply for consumer products, especially given all the negative chatter there's been of late talking about memory chip supply in particular looking like it'll considerably worsen next year.

Of course, none of this is surprising – there's a lot more profit in AI accelerators (graphics cards), of course, and as a business, Team Red can hardly afford to ignore that. But it does underline AMD's commitments, and PC owners on Reddit have voiced their displeasure in no uncertain terms.

As one Redditor put it: "Yeah I have a feeling the consumer market will end up being 'whatever the data centers consider obsolete' soon. We might have to contend with buying used data center CPUs and GPUs soon."

Okay, so that's going a bit far. And yes, others are quick to note that you can't just stick an old data center GPU in a PC and run it – there are issues around the implementation and cooling, display output (which isn't needed for a data center card), and the fact that many of these AI GPUs simply can't run games at all. But the point remains: consumers are indeed getting the short end of the stick due to the AI boom, and that's been the case since the invention of the likes of ChatGPT and other LLMs.

It doesn't sound like the situation is going to get any better next year, and that's just another worry to throw on the towering pile of memory price concerns that has been steadily growing in height as this year progresses.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.

SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.

Quordle today (game #1717) — hint #1 — Vowels

* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).

Quordle today (game #1717) — hint #2 — repeated letters

Quordle today (game #1717) — hint #3 — uncommon letters

Quordle today (game #1717) — hint #4 — starting letters (1)

If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:

Quordle today (game #1717) — hint #5 — starting letters (2)

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

Quordle today (game #1717) — the answers

The answers to today's Quordle, game #1717, are…

• PALER
• FROTH
• DOZEN
• ERASE

Two rare occurrences popped up for the second time in the past week — another word beginning and ending in E, and another appearance of a rare letter.

However, despite the rarities, this ended up being an oddly easy game for me, with most of the work done for DOZEN and no other letter working at the beginning for ERASE.

Daily Sequence today (game #1717) — the answers

The answers to today's Quordle Daily Sequence, game #1717, are…

• HANDY
• PUREE
• SHOOK
• SATIN

Quordle answers: The past 20

• Quordle #1716, Tuesday, 6 October: FRESH, SKULK, BATCH, ENSUE
• Quordle #1715, Monday, 5 October: SIXTH, SPEAK, SEDAN, HEIST
• Quordle #1714, Sunday, 4 October: INFER, RAINY, THING, ARENA
• Quordle #1713, Saturday, 3 October: CHORE, FLYER, STICK, PURSE
• Quordle #1712, Friday, 2 October: IVORY, SADLY, ANGEL, LLAMA
• Quordle #1711, Thursday, 1 October: NAVEL, SHEER, BIRTH, TACKY
• Quordle #1710, Wednesday, 30 September: CHOKE, BATCH, MOSSY, EAGER
• Quordle #1709, Tuesday, 29 September: BILGE, MEDAL, LODGE, PORCH
• Quordle #1708, Monday, 28 September: BRUNT, TORSO, STONE, HEATH
• Quordle #1707, Sunday, 27 September: VALET, CHEST, VIGIL, PUREE
• Quordle #1706, Saturday, 26 September: SNORT, BIBLE, LAPSE, CRANE
• Quordle #1705, Friday, 25 September: SWEAR, FLOOD, GUPPY, GROAN
• Quordle #1704, Thursday, 24 September: TOPIC, METRO, SCALP, FREED
• Quordle #1703, Wednesday, 23 September: SHEET, BLAND, JOIST, GUAVA
• Quordle #1702, Tuesday, 22 September: COMFY, LOBBY, DRESS, PANEL
• Quordle #1701, Monday, 21 September: WAXEN, HIPPO, PETAL, LEASH
• Quordle #1700, Sunday, 20 September: DERBY, LIMBO, GAWKY, REIGN
• Quordle #1699, Saturday, 19 September: SCOPE, HEIST, PULSE, CHAMP
• Quordle #1698, Friday, 18 September: MUCUS, MIRTH, APPLE, TILDE
• Quordle #1697, Thursday, 17 September: CRIER, CHIRP, NEIGH, FREER

Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.

SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.

NYT Strands today (game #948) - hint #1 - today's theme

NYT Strands today (game #948) - hint #2 - clue words

Play any of these words to unlock the in-game hints system.

• KING
• FLIP
• BARGE
• LINKS
• SOCK
• BULK

NYT Strands today (game #948) - hint #3 - spangram letters

NYT Strands today (game #948) - hint #4 - spangram position

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

NYT Strands today (game #948) - the answers

The answers to today's Strands, game #948, are…

• BUBBLEGUM
• BARBIE
• SHOCKING
• QUARTZ
• FLAMINGO
• SPANGRAM: TICKLEDPINK

• My rating: Easy
• My score: Perfect

In case you were unaware, today’s theme celebrates Breast Cancer Awareness Month and the “Wear it pink” campaign of global fundraising.

The pink aspect became apparent early on, and I was thinking of the phrase “in the pink” when looking for the spangram. That was wrong, but it did help me to locate today's all important color and score another Spangram First with TICKLEDPINK.

I really enjoy games like this, where they fool around with the standard Strands palette — and I’m impressed by how many shades of pink they created.

Yesterday's NYT Strands answers (Tuesday, October 6, game #947)

• FLIP
• UNDO
• REVERSED
• OVERTURN
• BACKPEDAL
• SPANGRAM: THEOLDSWITCHEROO

• A new startup has built an AI PC which has sold out of its first batch
• Ghost's Core is a 'personal AI computer that runs models entirely on device'
• It connects to your apps, services and devices, so it 'builds context on your life over time, and works continuously to help you'

Ghost is a startup in the AI field that wants to capitalize on the desire to have agents running locally rather than using AI in the cloud — and to get this done with a minimum of fuss.

TechCrunch reports that Ghost's first product is a PC for using local AI agents which runs those LLMs (Large Language Models) exclusively on-device, ensuring your data stays private (I'll come back to that point later).

The device is called Core, and Ghost explains on the product's site: "Core is a personal AI computer that runs models entirely on device. It connects to your apps, files, and devices, builds context on your life over time, and works continuously to help you, not just when you ask."

It is, if you will, a personal AI assistant on your desk at home, or as Zain Javaid, the founder and CEO of Ghost — which just raised $11 million in funding — put it, a "brain in a box".

Core is a PC which is an unassuming black box built around an Nvidia RTX Pro 4000 (Blackwell) graphics card with 24GB of video RAM, the central muscle for driving the AI, along with 64GB of DDR5 system RAM. The rated AI performance is 770 TOPS.

The PC comes with three AI models pre-installed: Qwen-3.8-Next, Qwen-3.8-27B, and Gemma-4-31B.

You can use your own model on the device, as you might expect, or any alternative for that matter, but the real selling point of Core is that it's an easy way to get yourself a fully primed AI box which requires no effort or setup.

This is for the AI enthusiast who doesn't want to buy a Mac mini (or Mac Studio) with maxed-out memory (required for larger AI models), and then have to mess around setting up everything themselves.

Javaid stresses that the PC comes with software built specifically for running those pre-installed AIs, avoiding all the fuss of model configuration. The CEO observes: "You can run [AI] models on existing hardware, but it's a terrible experience on many levels."

Core updates its models automatically as new upgrades emerge (unless you don't want that to happen), and the idea is that it's a seamless system and "similar to how Tesla works" with over-the-air updates.

You interact with the PC using an app (on your phone or laptop) with which you can issue voice commands should you wish.

Privacy and security

As well as the ease of use, privacy is the other big selling point for Core. It's tapping into a market of the increasing number of people realizing the potential of AI for helping with their life or work, who are concerned about sending their thoughts or data into the cloud, when they have no real idea where those queries or uploads will end up.

Core will run your AI agents continuously taking on whatever tasks you require while keeping all your data on the device, with Ghost promising that it's not going anywhere else. The personal data on the PC is encrypted to keep it safe — even Ghost can't access the data — and the device is specifically designed to keep running even if Ghost were to shut down (there's no subscription fee here).

The CEO assures us: "All of the source code, logic, and model weights live on the device, not the services. We build this device to not be dependent on having an outside entity maintaining the service."

Security is further bolstered by a firewall that limits how any agent can use credentials such as passwords, and you can dictate how much autonomy the Core agents are allowed, heavily restricting the AI should you prefer.

Javaid tells us that the firewall monitors all outgoing requests and "if it sees the agent performing a sanctioned action or exfiltrating data it shouldn't, it rejects the request and flags it for user review".

Core is priced at $3,499 in the US (around £2,600 / AU$5,000), and pre-orders for the first batch of PCs sold out on the first day that they were offered (yesterday). Those devices ship at the end of this month, and you can now register your interest in a second batch of PCs which are coming off the production line.

Analysis: a question of worth

Core can be hooked into all aspects of your life — or that's certainly the idea, and part of the reason why there's such an emphasis on privacy. It needs to be watertight for security given that Core connects to your existing devices and services, smart-home gadgets, fitness watches — or personal health data — and learns over time about how you live your life, imparting advice based on that knowledge.

Exactly how useful the system will be, well, that remains to be seen — and it may also depend on how 'smart' you've gone in terms of your array of gadgets and tech. There could be a lot of scope beyond life monitoring for Core's AI agents, of course, and there will presumably be the flexibility to get them doing whatever you want.

The other potential sticking point is that price. Is $3,499 a lot to pay for a dedicated AI PC? Well, it's undeniably a hefty sum of money, but there are some heavyweight components under the hood here (and the RAM crisis remains in full force). Indeed, the current price of the Nvidia GPU actually makes the PC a bargain as it stands (the company bought its stock of those graphics cards when they were much cheaper — so the next batch will be pricier).

If you configure a Mac mini as a top-of-the-line device for AI, you're looking at $3,199 in the US at the time of writing — and it doesn't come with the aforementioned strengths of software specifically designed for running local AI easily, and the privacy and security elements mentioned.

I've a feeling Ghost might be onto something here, at least in terms of pushing the concept of a user-friendly and straightforward AI box that does everything locally. I doubt this will be the last take on this kind of idea, and the price tag involved may eventually become a bit more realistic in the future. Although that depends on how the RAM crisis shakes out — and the latest signs are far from positive, sadly.

• Microsoft issues fix for CVE-2026-96940, a high-severity Exchange privilege-escalation flaw
• Attackers with compromised user credentials could access other employees’ mailboxes and emails
• No active exploitation reported, but Microsoft labeled the vulnerability “exploitation more likely"

Microsoft has pushed an urgent update for Exchange Server which fixes a high-severity flaw that could wreak some serious havoc among email users.

The company patched CVE-2026-96940, a “weak authorization in Microsoft Exchange Server [that] allows an authenticated attacker to elevate privileges over a network,” as per the National Vulnerability Database (NVD).

According to Microsoft’s advisory the bug, which was given a severity rating of 8.8/10 (high), can be abused to gain unauthorized access to people’s inboxes within the same organization.

In theory, threat actors who obtained credentials of a low-privileged Exchange user could exploit CVE-2026-96940 to escalate their privileges within Exchange, and then read confidential emails and attachments belonging to other people working for the same organization.

The bug cannot be exploited for cross-tenant access, though.

Establishing a foothold

To exploit the vulnerability, the threat actor needs to have authenticated access beforehand. This, however, is not a major obstacle for the attackers, since they can easily purchase login credentials from the dark web, or use phishing to deploy an infostealer capable of extracting these secrets.

Therefore, even an email account of an “ordinary” employee can be enough to establish a foothold, escalate privileges, and access inboxes belonging to higher echelons within an organization.

At that point, the vulnerability becomes highly valuable. Corporate email accounts can contain confidential documents, contracts, invoices, internal discussions, and other sensitive information, which the attackers can then use for follow-up attacks such as Business Email Compromise (BEC).

It is worth stressing that CVE-2026-96940 is not known to grant administrator or SYSTEM-level privileges on the underlying Windows server. Instead, Microsoft’s disclosed attack scenario focuses on escalating privileges within Exchange and gaining unauthorized access to other users’ mailboxes

Users of Exchange Online are already secured, Microsoft further explained, since it deployed a related “service-side” fix. However, those using on-prem Microsoft Exchange Server products should upgrade to the latest version to avoid being targeted.

Here is a list of the affected versions:

- Microsoft Exchange Server Subscription Edition RTM

- Microsoft Exchange Server 2016 Cumulative Update 23

- Microsoft Exchange Server 2019 Cumulative Update 15

- Microsoft Exchange Server 2019 Cumulative Update 14

Microsoft says there is no evidence of the flaw being abused in the wild, and at press time, the US Cybersecurity and Infrastructure Security Agency (CISA) does not have it listed in its Known Exploited Vulnerabilities (KEV) catalog. However, the Windows maker labeled the bug as “exploitation more likely” suggesting that cybercriminals might try to exploit it, and warning users to apply the provided fix as soon as possible.

It is also worth mentioning that both Exchange Server 2016 and Exchange Server 2019 reached their end of support last year. Microsoft said that these latest security updates are only available to organizations enrolled in its Period 2 Extended Security Update (ESU) program.

The program gives eligible Exchange Server 2016 and 2019 customers access to security updates released between May and the end of October 2026. Organizations that have not enrolled are being urged to migrate to Exchange Server Subscription Edition (SE) if they want to continue receiving the latest security fixes.

Unusual release

Microsoft issued the patch on October 2, as part of its September 2026 V2 Exchange Server Security Updates. The original September updates were pushed on September 8, and the software giant added that the main difference between these two versions is the fix for CVE-2026-96940.

As it was releasing the patch, it confirmed it was pushing it “ahead of its intended schedule”, without elaborating further. Perhaps labeling it as “exploitation more likely” is elaborating enough, especially since the company urged customers to review its deployment guidance and apply the update as soon as possible.

fter installing the update, administrators are also advised to run Microsoft’s Exchange Server Health Checker. The tool can verify whether the security update was installed successfully and determine whether any additional action is required.

Via The Hacker News

• The Norwegian government plans to issue a ban on the use of smart-glasses in public spaces
• These include parks, beaches, museums, gyms
• While the ban is temporary, Norway's government wants to introduce permanent legislation in the future

Norway has become the first country to propose a temporary ban on camera-enabled and AI-powered smart glasses in public spaces, amid growing concerns around privacy.

Ars Technica reports that the Norwegian Government is proposing a blanket ban in selected public spaces where it believes people are vulnerable to being recorded without their consent. It follows the news this week that Dutch eyewear retailer Hans Anders has pulled Meta Ray-Ban glasses from over 400 stores.

Venues where the use of smart glasses would be prohibited include parks, beaches, museums, schools, kindergartens, shopping centers, healthcare facilities, gyms, and public events. Private use of smart glasses, for example in wearers' homes, would still be permitted.

The ban would initially be temporary, but it seems that Norway’s government is set on rolling out some form of permanent restrictions in the near future, and will enlist the help of an expert group to draft legislation.

Explaining the reasons for the proposals, Norway’s Minister of Digitalization, Torgeir Micaelsen, said "I am concerned about the introduction of powerful new technology where people risk being photographed, filmed, or recorded without their knowledge."

He added that a temporary ban "will give [us] time to conduct a thorough assessment and hold an informed debate that can lay the foundation for permanent regulation".

In order for a ban to be passed the governing Labour party will need the support of opposition parties, as it doesn't have an overall majority in the Norway's parliament, but it says it’s determined to introduce the bill "as soon as possible".

Smart glasses have prompted a patchwork of bans by authorities and companies in various countries, and most agree that they're an unsatisfactory approach. Norway’s more sweeping approach would be a first, and could serve as a model for other countries who want to introduce bans or other restrictions.

The Australian government recently announced that the use of smart glasses will be prohibited in federal workspaces, service centers, and local council buildings, and is considering a ban on their use in public areas. The City of Sydney joined forces with four other local councils, vowing to ban smart glasses from public pools, gyms, childcare centers, libraries and other spaces.

Localized bans have also been introduced in other countries. In the UK, pub chain Wetherspoons and some restaurants have individual restrictions on the use of smart glasses, and UK cinema chains could soon follow (although in that case the concerns are around piracy rather than privacy).

One of the biggest concerns with smart glasses is that, while they have a light to indicate when video footage is being recorded, wearers have been able to disable or cover these. In an effort to counter this, Meta rolled out an update to stop privacy hackers, introducing a tool that stops smart glasses from recording video when the LED is blocked.

• A source at a major Chinese chip maker says the firm "expects the global memory shortage will last for at least another three years"
• On top of that, analyst firm TrendForce is suggesting "meaningful price increases" are coming for RAM in the final quarter of 2026
• The cloud giants in the US are providing the increased demand that's pushing up Q4 pricing

A source at one of the big Chinese memory chip makers has warned that the firm anticipates the RAM shortage will last through until the end of the decade — and we've heard some gloomy nearer-term news from TrendForce, too.

TweakTown highlighted a post from Jukan on X (who works at analyst firm Citrini Research), which in turn pointed to a report from The Wire China.

This cites an employee at YMTC in China who said that the company "expects the global memory shortage will last for at least another three years". YMTC has just pushed up pricing for its chips, the source says — to no one's surprise — and is shifting its production towards chips with a higher profit margin.

Jukan ties this specifically to NAND production — for SSDs — but the quoted comment refers more broadly to the memory crisis (meaning RAM sticks as well). As TweakTown points out, though, the purported impact on SSDs is particularly relevant seeing as YMTC is now the third biggest global NAND chip supplier behind only Samsung and SK Hynix.

Other predictions, such as from analyst firm TrendForce, forecast NAND supply coming back into balance later in 2027, but that notion is very much being questioned here.

Speaking of TrendForce, Jukan also flagged a new report from the company that labels DRAM supply as 'very tight', noting that: "Suppliers' early-stage discussions on 4Q26 contract pricing point to meaningful price increases, suggesting strengthening demand momentum, particularly from US CSPs."

In other words, the big cloud service providers (CSPs) are the main force behind the increased demand that's pushing fourth-quarter RAM pricing to meaningful price hikes.

Analysis: negative chatter continues to align

'Meaningful' price rises for RAM sounds ominous, mainly because memory pricing has already risen painfully over the last few months. If you recall, going by the German market, DDR5 memory is a ridiculous 544% up on the price it was before the RAM crisis began — so the thought of further increases feels, well, even more ludicrous. But here we are.

We can seemingly expect SSDs to get more costly as well, going by the leak from YMTC, although it's worth noting that it's in the company's interest to talk up its future prospects and profits (as it heads into an IPO). That said, this isn't an official statement, but a leak (though it could have been intentionally leaked, cynics would doubtless argue).

The fact of the matter is that more memory-related misery is believable enough these days, as all predictions are very much slanted towards more price hikes for the remainder of 2026 and into 2027. The view that we have at least another three years of this crisis to weather — taking us all the way to 2030 — is one also shared by other analysts and industry figures, including Nvidia's CEO (and those in the world of SSDs).

• ASOS app users received a threatening notification on Tuesday morning
• The message states that ASOS' Snowflake instance has been compromised
• There has so far been no confirmation from ASOS

Customers of online shopping giant ASOS have received a notification apparently suggesting the site has been hacked.

The message, written but the hackers, was sent out via a mobile app notification on Tuesday morning.

“Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it”, the message reads, before linking out to a Telegram chat.

Has ASOS been hacked?

ASOS has not released a breach notification as of the time of publication, but according to Down Detector, users began reporting issues with the ASOS app just before 10am Tuesday morning.

The notification is directed towards ASOS’ Data Protection Officer. A DPO is responsible for a company’s data security strategy and compliance with key data protection legislation.

Snowflake is a well-known Software-as-a-Service (SaaS) that organizations use as a dedicated cloud environment. A Snowflake ‘instance’ in this sense refers to an organization’s account. Snowflake environments are used to store, process, and analyze data.

The Telegram channel linked in the notification seems to have been set up specifically for the breach , and is named the 'Xuanye gateway'.

Under UK law, ASOS has to disclose any data breaches to the Information Commissioner’s Office within three days, and notify those affected when the breach is classified as ‘high risk’.

Pieter Arntz, Senior Malware Intelligence Researcher at Malwarebytes, told TechRadar Pro, "It’s too early to say how much ASOS customer data attackers could get their hands on, but the potential scope is significant. ASOS uses Simon AI for marketing, which runs on Snowflake, making the connection indirect."

"Any exposure could reveal a detailed customer picture, from browsing and buying habits to location and loyalty status. That’s valuable profiling data, though the connection alone doesn’t establish what attackers could actually access," Arntz said.

According to ASOS, the online shopping site had 17 million customers across 150 countries. Many of these customers are located in the UK, where the company’s headquarters are also located. ASOS also has a strong customer base in the European market.

TechRadar Pro has contacted ASOS for comment, but has not yet received a response.

What should I do if I received the notification?

If you are on of the many ASOS customers who has received the notification, there are a few steps you can take to stay safe until more details are available:

• Do not click links in any suspicious emails
• Do not click links in any suspicious texts or messages

Other opportunistic cybercriminals could capitalize on the hysteria caused by the notification to trick you in to handing over your account details.

Be especially wary of emails telling you your account has been compromised, or asking you to reset your password.

Always double check the authenticity of the email address you receive any communications from to ensure it is a genuine company email.