The Latest

We may earn a commission from links on this page.

If horror films have taught me anything, it's that nothing good ever comes out of the fog, but the haze-filled thriller Below has definitely earned record ratings and enthusiastic audiences for Netflix—it's the top debut for a Canadian show in the streamer's history, as it happens. In its wake, consider these 10 other series that take you to isolated and evocative landscapes filled with horrors both human and monstrous.

Midnight Mass (2021)

Claustrophobic, mysterious, and perpetually misty (seriously, you can't see shit in any of these towns), Midnight Mass is very much about the monsters within being no less frightening than those without. It may or may not be the best of Mike Flanagan's Netflix work, but it's certainly the most emotionally devastating. Riley Flynn (Zach Gilford) returns to the tiny, isolated community of Crockett Island, his arrival coinciding with that of Catholic priest Father Paul Hill (Hamish Linklater). Riley is wrestling with his justifiable guilt over a drunk-driving death for which he was responsible, while the charismatic priest is reviving the town's once-flagging religious fervor while exacerbating local tensions. The brewing conflict, involving the limits of both faith and guilt, is fascinating, while the inseparably horrific elements are terrifying. Stream Midnight Mass on Netflix.


Katla (2021)

Running to the darker end of the spectrum, the often devastating Katla moves slowly until it doesn't, deliberately picking up speed as it builds to an emotional climax. Set in Iceland, the show takes place one year following the eruption of the real-life Katla volcano, which buries the nearby town of Vik in choking ash. The few people who've elected to remain are surprised, to say the least, when soot-covered figures from the past start arriving, including the dead son of the volcanologist studying the meteorite in the nearby glacier. Stream Katla on Netflix.


The Terror (2018 – )

Each season of The Terror is distinct, but all converge on the idea that real life is far, far more horrifying than the supernatural stuff going on in the background. Season one, adapted from the Dan Simmons novel, is our focus here, involving as it does the true story of two ships, the Erebus and the Terror, searching for the Northwest Passage before becoming trapped in a field of ice. Starvation, madness, and monsters ensue. While set in the 1840s (and in an ice field), the vibe isn't wildly dissimilar to Below. Stream The Terror on AMC+ and Shudder.


The Third Day (2020)

This weird, ambitious slice of folk horror finds Jude Law's Sam arriving on Osea Island while grieving his murdered son and trying to save his failing business. After he intervenes when he sees a young woman attempting to hang herself, Sam is caught up in some wildly atmospheric creepiness around the town. Later, Naomie Harris' Helen arrives on the island with her daughters only to discover that everything's gone to hell, and that the causeway that connects the island to the mainland is gone. In between the two halves of the miniseries, the creators produced an immersive 12-hour, single-camera livestream capturing a day in the life of the island, a wild bit of innovation. Admittedly, it's all a bit more vibes than plot, but the vibes are genuinely disturbing. Stream The Third Day on HBO Max.


True Detective: Night Country (2024)

One of the better creepy-stuff-in-an-isolated location narratives of recent years, moving away from the schvitzy bro energy of earlier seasons in favor of a darker (literally) and frostier mystery involving missing scientists at a research station near a tiny and necessarily remote Alaskan town, where the dark and the cold are practically characters themselves. The resulting case ties together veteran Chief Liz Danvers (Jodie Foster) and Trooper Evangeline Navarro (Kali Reis), two women with complicated pasts and screwed-up present family lives. Stream True Detective: Night Country on HBO Max.


Gyeongseong Creature (2023 – )

Set in 1945 Gyeongseong (modern-day Seoul), and during the Japanese occupation of Korea, this series finds the title's monster arising out of human experimentation conducted in secret by the Japanese army. The scars of occupation have been justifiably fertile ground for storytelling in the last few years (see also Apple’s Pachinko), and Gyeongseong adds science fiction to that mix. The second season moves the action to the present day, with a third season renewal looking likely. If Below's monster is a primary draw, South Korean import Gyeongseong is about as good a follow-up as you're likely to find. Stream Gyeongseong Creature on Netflix.


Curon (2020)

Set near the real-life Lago di Resia in northern Italy, this show was inspired by the lake's singular view: the bell tower of a 14th century chapel rising above the water, the only visible remains of a village submerged by a dam in the 1950s. That eerie setting is home to Anna Raina (Valeria Bilello); it was, anyway, until she fled while pregnant with her twin daughters following her mother's tragic and mysterious death. The twins are now teenagers, and the three of them have returned—except nobody seems to want them around. They come to learn that Anna's been having dreams about her mother's death in which she's the killer, and then she herself disappears. It all ties back to that lake and the creepy bell tower—more about family mystery and vaguely supernatural menace than monsters, but the evocative setting ties this and Below together. Stream Curon on Netflix.


Widow's Bay (2026 – )

Another recent addition to the atlas of regrettable vacation destinations is Widow's Bay, an isolated New England island trying to shrug off its literally cursed reputation in favor of becoming a tourist destination à la Martha's Vineyard—but, alas, the timing isn't great. Cozy and idyllic on the surface, Widow's Bay appears to be "waking up," according to a few of the more tuned-in locals. Mayor Tom Loftus (Matthew Rhys), a relative newcomer, is having none of it—at least until a killer clown and waterlogged lady come for him, convincing him to join forces with local eccentric Wyck (Stephen Root) who seems to be on to something with his crackpot theories. The show is frequently funny, but also legitimately scary, with an everything-and-the-kitchen sink approach to the horror genre. Stream Widow's Bay on Apple TV.


The Rig (2023 – 2025)

As we in the real world well know, monsters can be tiny at least as easily as they can be large. This import finds us on a Scottish oil rig (obvi) in the North Sea, abruptly cut off by a mysterious fog (never a good thing) just as the facility is beginning to experience catastrophic system and structural failures. The mysterious haze is more than just a weather phenomenon, though, as there seems to be a microorganism carried within it that causes dramatic behavioral changes, and that may have a relationship to every mass extinction event in Earth's history. But hey—anything to push down the price of oil, amirite? Stream The Rig on Prime Video.


Monarch: Legacy of Monsters (2023 – )

The tone is wildly different, but so many of the shows here are included on the basis of their claustrophobic, mist-shrouded settings and similarly hazy human motivations, so it's only fair to give you some actual monsters, and no show has more creatures than this Godzilla spin-off. Monarch does a surprisingly effective job of telling its own story within the universe of all those American Godzilla movies of the past decade or so, bringing the narrative back down to Earth while building out an entire monster-verse mythology in the process. Anna Sawai stars as a young teacher searching for her father, missing since Godzilla's attack on San Francisco (depicted in the 2014 film), and finds herself drawn into the past and present of a secret government agency. Wyatt and Kurt Russell play the past and present incarnations of the Army colonel who helped set the whole thing in motion. Kong and Godzilla make appearances alongside the whole Toho monster stable. Stream Monarch on Apple TV.


from Lifehacker https://ift.tt/bQ8WxGc

Security patches are turning into roadmaps for attackers, with a growing share of fixes later found incomplete or open to bypass.

OPIS

Oren Yomtov, a security researcher at Terra Security, began tracking broken fixes after the team kept running into them in its own work over the past year.

“A fix would ship, a bypass would be found, and another fix would go out. Worried this was sample bias, we looked at every published CVE record and every GitHub-reviewed advisory for one pattern: a fix ships, and a later advisory says it was incomplete or could be bypassed.”

“The data backed up our hunch,” he wrote. “Broken fixes have been reported for years at a low, steady rate until 2026, when the share of open-source fixes on GitHub later reported broken rose about eightfold.”

Exploited bugs and blocklist fixes break most often

Fixes for vulnerabilities on CISA’s Known Exploited Vulnerabilities catalog are later reported broken about four times as often as fixes for other bugs from the same vendors. The likely reason, in Yomtov’s view, is attention, since exploited bugs draw more people who study the patch and find what it missed.

Bug classes where the usual fix is a list of blocked inputs, such as server-side request forgery (SSRF) and prototype pollution, show up far more often among broken fixes than among CVEs overall. When a blocklist doesn’t anticipate every form of a bad input, an attacker only needs to find one that gets through, Yomtov explained.

Roundcube, the open-source webmail software, is one example. In March 2026, its developers fixed an SSRF flaw (CVE-2026-35540) by blocking links to private addresses, but the check missed other ways of writing the same address, along with domain names that resolve to it. Closing those gaps took three more CVEs, released in May, July and August.

Microsoft patched CVE-2026-21510, a Windows Shell vulnerability the APT28 group was exploiting in the wild, in February 2026. Akamai later found the patch could be bypassed with a crafted Control Panel item that made Windows contact an attacker’s server and leak the user’s NTLM hash. Microsoft fixed the bypass in April as CVE-2026-32202, and that flaw also ended up on CISA’s exploited list. The new advisory makes no mention of the earlier CVE.

Advice for developers and defenders

A patch that only blocks the reported input can make a bug look addressed while it stays in the underlying code, Yomtov argued, and it shows attackers both the vulnerable code and the defender’s idea of what the bug was.

“Diff-hunt your own fix before shipping it, certainly before any attackers do,” he advised, urging developers to check whether a fix addresses the root cause and covers the whole bug class.

For organizations installing patches, Yomtov recommends assuming that when a vendor fixes an exploited bug, someone is reading that patch for a way around it, and to keep testing after a scanner reports no problems.


from Help Net Security https://ift.tt/gk12A5J

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

In a market where every year there is an expectation of releasing a new model, how long tech companies take to feel the need to upgrade a product is a testament to how good the product is. The Sennheiser Momentum 4 has been around since 2022, and they were only succeeded this summer with the Sennheiser Momentum 5. However, they are still great headphones, and with their $204.60 price (originally $299.99) after a 32% discount, they're a great opportunity to get top-quality headphones at a more than reasonable price.

The Momentum 4 competes with other flagships from its time, including the Sony 1000XM5 and the Bose QuietComfort 45, in terms of comfort, design, audio quality, and other features. The Momentum 4 has a more bass-forward sound compared to its competition, but it's still balanced. The biggest con is that you don't have full EQ control, only being able to select certain presets from the Momentum app. The ANC is great, but not a match compared to the Sony and Bose competition. Where it does beat its competition is with the codecs it supports, including AAC, AptX, AptX Adaptive, and SBC codecs. This means better audio quality for Android devices than the Sony or Bose options.

The battery is powerful, reaching about 60 hours of juice at mid-level. It also has a 3.5mm audio cable, so you can use it wired. The microphone is perfect for making calls, with four-MEMS-mics helping make your voice stand out even in noisy environments. You can see more features from the Momentum 4 in PCMag's "excellent" review. If you're looking for a bargain on an established flagship headphone model without having to pay the premium in 2026, the Sennheiser Momentum 4 are a great pair to consider.

Our Best Editor-Vetted Tech Deals Right Now
Deals are selected by our commerce team

from Lifehacker https://ift.tt/KhIWZEe

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

If you’re shopping around for a reliable laptop but don’t want to spend an arm and a leg on a premium model from Apple, Lenovo has some highly underrated options that are versatile and offer great processor performance for the price—and it's now even more affordable, thanks to Walmart’s newly discounted Lenovo V14 G5 14-inch FHD Laptop, now 37% off and down to $629 (originally $999.99).

It’s powered by the 10-core Intel Core i7-13620H, with  six performance cores and four efficiency cores) and has a maximum turbo speed of 4.9GHz. It’s more powerful than many similarly priced 14-inch laptops and can excel at heavy multitasking, light video or photo editing, and data-heavy office work. It includes 16GB of DDR5 memory, comes with a 1TB PCIe 4.0 SSD for additional storage, and is powered by a modest 47Wh battery.

Despite its power, it’s relatively lightweight, clocking in at around three pounds and 0.7 inches thick. One reason the weight stays low is its plastic build. It might not feel as durable or premium as an aluminum laptop, but the tradeoff for an under-$650 price tag makes it worth it for those on a budget. The V14 G5 includes a range of ports, including two USB-A ports, one USB-C port, and an HDMI 1.4b port, as well as a headphone and microphone jack.

It supports Wi-Fi 6 and includes a physical webcam shutter for added privacy. The keyboard is designed for office use and has a conventional layout that’s helpful for those who find added touchscreens and convertible hinges unnecessary. Despite having a relatively sharp resolution and an anti-glare coating, the panel technology is somewhat outdated and has limited contrast, so it may not be the best choice for photographers, designers, or video editors.

Still, if you’re looking for an everyday office or personal laptop with a strong processor, a solid port selection, and a lightweight build—but don’t mind a couple of cost-cutting compromises—the budget-friendly Lenovo V14 G5 14-inch FHD Laptop strikes the right balance between affordability and performance, especially at nearly $370 off.

Our Best Editor-Vetted Tech Deals Right Now
Deals are selected by our commerce team

from Lifehacker https://ift.tt/rDjaown

We may earn a commission from links on this page.

If you've ever been on your feet all day and your calves felt like two sandbags, you know how tough it can be to find relief. I'm a marathon runner, so I know it well. Training blocks mean high mileage, and calves take a beating on every mile. I've tried foam rollers, massage guns, stretching, and my favorite maneuver: lying with my legs up against the wall.

This week's upgrade is the first recovery tool that seems to do all the work for me, and hey—after a long run, I'm not complaining. It's my first foray into compression boots: the Hyperice Normatec Go.

How the Normatec Go compression boots work

The Normatec Go is a pair of wearable compression sleeves that wrap around your calves and give you a dynamic air compression massage. Hyperice describes it as a fully portable version of its Normatec line, which pro athletes and recovery rooms have used for years.

The sleeves inflate and deflate in a pulsing pattern (as opposed to just squeezing constantly). Hyperice calls this compression "gapless": There are three overlapping zones of 360-degree compression working through the calf. In theory, the wave of pressure helps push fluid and blood through your lower legs, which is why Hyperice says the massage increases circulation and reduces tension and swelling.

Hyperice also points out that the calf is often called the body's "second heart" because it helps push blood back up from your lower legs. That matches my experience: After a long run, calves are where the heaviness and tightness show up first.

Why I recommend these compression boots

The biggest upgrade over traditional compression boots is that you don't need to set up a whole system. You strap on the sleeves, open the app, pick an intensity, and relax. I've worn them at my desk, on the couch, and while answering emails after a long run. I show up to my next run feeling fresher, and for a marathon runner, that's the whole point of recovery.

A few features make the experience better:

  • Seven compression levels (40 to 200 mmHg), so you can go gentle after an easy run or firm after a long one

  • The two sleeves always stay in sync for a symmetrical massage

  • Bluetooth control through the Hyperice app, so you adjust everything from your phone

  • 1.2 pounds total, and TSA friendly, so they can travel with you

Hyperice recommends sessions of about 20 to 30 minutes. You can go up to 60 after a tough workout, or use a shorter 15- to 20-minute session at medium intensity before a run to warm up your legs.

The Normatec Go costs $379. Full-size compression boots that cover your whole leg usually run well over $1,000, so that's a big difference. These only cover the calves, but if calves are where you need relief, you don't have to pay for coverage you won't use. They're also FSA/HSA eligible.

At the same time, the obvious limitation is that these are for calves only. I suppose it's a testament to the product that I've never been more tempted to spring for full-size boots, so that my quads and hamstrings can experience the same treatment.

The battery life also leaves something to be desired. Hyperice claims they last three hours per charge, but in my experience, you're better off charging between every hour or so of use.

If you're training for a race, spending long days on your feet, or just tired of tight, heavy calves, the Normatec Go is the upgrade I'd recommend. I can't imagine my recovery routine without it now.


from Lifehacker https://ift.tt/izXT1G5

AI agent traffic across DataDome’s network grew 41.5% quarter over quarter to nearly 25 billion requests in Q3 2026, according to the company’s AI Traffic Report Q3 2026. Meta’s Muse generated 29.1 million requests between September 22 and October 3, its first 12 days of full availability. In a sample of Muse traffic, 99.3% of requests came from cloud and CDN infrastructure.

Nearly half of the AI agent traffic recorded in 2026 through September occurred in Q3. The growth had left capacity plans and bot-management policies based on the previous quarter’s averages out of date.

Meta leads AI agent traffic

Meta-ExternalAgent and Meta-WebIndexer generated a combined 12.4 billion requests in Q3, accounting for 49.7% of AI agent traffic recorded. Meta-WebIndexer overtook Meta-ExternalAgent in September, which is interpreted as a sign of continued investment in AI answer generation. ClaudeBot ranked fourth for the quarter, overtaking GPTBot.

AI agent traffic

Top AI agents per month (Source: DataDome)

OpenAI, Anthropic and Amazon each use separate bots to collect training data, index pages for AI search and retrieve pages when users ask questions. Each bot has a distinct name, allowing website owners to allow or block it individually. These controls do not cover AI agents that browse websites through a regular browser without using those bot names.

This separation gives publishers a way to refuse model training while remaining accessible to AI search and answer services. It also helps AI companies develop search results with current information and source links, reducing their reliance on Bing, Google or Brave.

Each additional bot gives publishers another access setting to manage. Companies do not always explain upfront how each bot treats robots.txt, the file website owners use to communicate rules for automated access.

Agentic browser traffic nearly quintuples

Agentic browser traffic in the dataset rose from 12.5 million requests in August to 58.2 million in September. Excluding Muse, traffic more than tripled to 38.7 million requests.

ChatGPT’s cloud browser generated the most traffic in the category in September. Muse accounted for 33% of that month’s total after becoming fully available on September 22. Comet’s traffic fell 65% from July to September.

Muse is a personal AI agent that operates inside a dedicated cloud virtual machine containing a browser. DataDome includes it in the agentic browser category because its traffic is browser-driven.

Its daily traffic patterns were consistent with user activity instead of a scheduled crawl. In the sample, 8.9% of requests reached sensitive website endpoints, including login, payment, account creation, shopping cart and form pages. Forms accounted for 81% of that sensitive traffic, receiving about eight times as many requests as login pages.

“Muse is the first mass-market example of where agentic traffic is heading. It works from its own cloud virtual machine, so nearly all of its requests look like data-center traffic rather than a user’s device, and a meaningful share lands on forms and checkout flows,” said Jerome Segura, VP of Threat Research at DataDome.

“Policies that trust residential or ISP-based traffic won’t catch agents like this. Organizations need to validate agent identity, understand intent, and decide deliberately which agents to allow and what they’re authorized to do.”


from Help Net Security https://ift.tt/wI5fevU

Ransomware attackers threatened employees’ family members or friends at 37% of organizations surveyed for Semperis’ 2026 Ransomware Risk Report. The survey covered 1,200 IT and security professionals at organizations that had experienced at least one successful ransomware attack.

“Ransomware has proven to be a great cash-generating activity for criminal syndicates, which have no hesitation about inflicting both cyber and physical harm,” said Mickey Bresman, Semperis CEO.

Threats reach beyond the workplace

Respondents described threatening messages, stalking and threats of physical harm. Criminals use these tactics to increase pressure on employees and their employers to meet ransom demands.

A quarter said employees or their family members needed medical or psychological treatment because of ransomware threats. Meanwhile, 23% reported swatting, where someone makes a false emergency report to send police to a person’s location.

Doxxing, which involves exposing someone’s personal information online without consent, was another consequence described by respondents. Some employees needed security protection or changed jobs, offices or homes following an attack.

ransomware employee safety

What threats did attackers leverage? (Source: Semperis)

Documenting response roles across the organization and including procedures for threats against people outside the workplace, such as employees’ family members is recommended. Establishing relationships with law enforcement before an incident is also advised.

The personal consequences add to the pressure on staff responding to an attack.

“IT and cybersecurity staff are already dealing with high levels of stress,” says Tim Beasley, Semperis Senior Incident Response Consultant. “A ransomware attack takes that to a whole new level. I’ve seen CISOs literally say, ‘I’m out, I’m done, I can’t do this. It isn’t worth it.’ I’ve seen people walk out the door because leadership thought they mismanaged something that caused the breach to occur. It all takes a mental toll.”

Restoring operations can leave attackers with access

Some 69% of surveyed organizations experienced multiple successful ransomware attacks within the previous year.

Recovering from an incident requires teams to find how criminals entered, remove their access and check the systems being restored. Malware, backdoors and compromised accounts can give intruders a way back into the organization.

Pressure to resume operations can lead businesses to restore services before establishing whether attackers have been removed. That leaves unresolved weaknesses available for another intrusion.

Ransom payments remained common, with 59% of respondents saying their organization paid. Reasons included protecting customer information, limiting disruption and containing reputational damage. Some paid because they could not remove attackers from their environment.

Payment provides no guarantee of recovering data or system access. Receiving a decryption key also does not eliminate the need to rebuild the environment to a trusted state. Decryption tools can be buggy or contain malicious code, and some files may remain unrecoverable.

Restoring access needs its own plan

Attackers targeted or exploited identity systems in 87% of surveyed cases. Services such as Active Directory, Entra ID and Okta manage accounts, sign-ins and permissions across an organization.

Control of these systems can help criminals access connected services, change user privileges and interfere with recovery. Responders need to establish which accounts remain safe and whether permissions have been altered.

Half of the surveyed organizations had dedicated identity backups. A trusted copy of account and permission information helps teams restore access without carrying compromised settings into the rebuilt environment.

Identity recovery also affects the order in which services can return. Employees need working accounts to use restored applications, and administrators need trusted access to manage them.

Respondents identified evolving cyber threats, outdated systems, technical debt and regulatory demands as leading challenges to keeping operations running and recovering from attacks. They also cited outdated crisis plans, undefined roles and responsibilities, and communication gaps between teams as barriers during incident response.


from Help Net Security https://ift.tt/8y61JPr