The Latest

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

Week in review

A hardware neural network backdoor that hides in plain sight
Deep learning systems on edge devices often rely on third-party-designed FPGAs and ASICs for performance and efficiency, creating supply chain risks. Researchers from the University of Tennessee and the University of Florida developed HAMLOCK, a backdoor attack that splits malicious functionality between hardware and software, making detection more difficult.

Onspring CISO on where automated GRC systems fall short
In this interview with Help Net Security, Nichole Windholz, CISO at Onspring, talks about the limits of automated GRC systems and continuous control monitoring. She explains why color-coded dashboards can hide nuance, how teams can check the data feeding their tools, and which risks resist measurement, such as insider behavior and vendor concentration.

AI vulnerability discovery is pushing 2026 CVEs toward 66,000
Vulnerability disclosures are piling up faster in 2026 than anyone expected at the start of the year. The running count for the first few months sits well above the original projection, and the Forum of Incident Response and Security Teams (FIRST) now expects the year to land near 66,000 CVEs.

Reachability makes AI threat modeling worth the trust
In this interview with Help Net Security, Oscar Andersson, CTO at Oplane, explains why most scanning tools fail. They cry wolf, flagging threats that cannot run in real code. The argument centers on reachability. A finding counts only when someone walks the path to impact on a working build.

The SOC’s visibility gap comes down to staffing
AI has settled into security operations centers faster than any earlier wave of technology. Around four in five practitioners report reaching for AI or machine learning tools in their daily work. The catch shows up one layer down. Roughly a third of those same teams have built these tools into a defined workflow with structure, governance, and consistent validation. The rest pick up AI on their own, case by case, with no shared playbook for how it gets used or checked.

The Chainguard Athena coalition already shipped 2,000 patches across 500 open source projects
Chainguard launched Athena, an industry coalition that pools open source vulnerability findings and remediates them under embargo before public disclosure. The group went live with more than two dozen member organizations. Founding members include BNY, Chainguard, Cisco, Cloudflare, Corridor, DepthFirst, Docker, JPMorganChase, Kyndryl, LTIMindtree, and PwC.

What happens to oversight when AI agents write a lab’s own code
Inside the labs building frontier AI, a growing share of the coding gets done by the AI itself. These agents write, edit, and run software with light human oversight between steps, and they reach into production infrastructure, research pipelines, and potentially the systems that train and evaluate future models.

Securing digital keys when your phone unlocks the car
In this interview with Help Net Security, Alysia Johnson, President of the Car Connectivity Consortium (CCC), explains how the CCC Digital Key has grown from a single-brand feature into a standard meant to work across phones, automakers, and suppliers.

Your browser tab could become encrypted storage for someone else’s files
Decentralized storage networks already hand pieces of people’s data to strangers’ machines. The lasting question across these networks is whether the machine holding the data can read it. A research paper by Gregory Magarshak, a professor at IENYC, describes a system called Safecloud built on one design rule: the nodes that store data see only ciphertext, and the nodes that route data hold no keys.

PhishLumos: Exposing phishing campaigns that evade detection by hiding content
Phishing remains one of the most stubbornly persistent threats in cybersecurity: humans are tired, distracted, trusting, and susceptible to urgency and authority in ways that no amount of awareness training can completely overcome. The security community has largely accepted this reality and shifted focus toward automated detection systems that can intercept and block phishing threats before users see them.

China-linked spies backdoored authentication stack to stay hidden for years
A China-linked cyber espionage group known as Velvet Ant spent nearly a decade inside the internal network of an unnamed organization without being detected, according to the results of a forensic investigation published by cybersecurity firm Sygnia.

Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262)
Cisco has revealed another Catalyst SD-WAN Manager vulnerability (CVE-2026-20262) that its Product Security Incident Response Team observed being exploited by attackers. But the associated security advisory also states that “the vulnerability was found during internal security testing”, raising the question of how attackers came to exploit it before Cisco had disclosed it publicly.

SimpleHelp RMM flaw could give attackers full access to managed endpoints (CVE-2026-48558)
A critical vulnerability (CVE-2026-48558) in SimpleHelp, a popular remote monitoring and management (RMM) tool, can be exploited remotely by unauthenticated attackers to create a new “Technician” account and use it to remote into managed endpoints, execute scripts, and more.

Attackers are exploiting FortiSandbox vulnerabilities
Attackers have been spotted exploiting three vulnerabilities (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) in FortiSandbox, a platform that other Fortinet security products depend on for threat verdicts to enforce blocking decisions and trigger automated responses. The warning came on Monday from threat intelligence company Defused, which said that the exploit for one of the flaws is vibecoded, and likely faulty.

Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656)
Microsoft has acknowledged the local elevation of privilege issue in Microsoft Defender that can be triggered via the “RoguePlanet” exploit, and is “working to provide a high quality security update that addresses this vulnerability.” The vulnerability, which has been assigned the CVE-2026-50656 identifier, stems from improper link resolution before file access, and can be exploited in low complexity attacks by authenticated attackers, with no user interaction required.

Low-skilled attacker used Claude, Codex to breach 14 companies
Researchers have long warned that AI agents could lower the skill floor for offensive cyber operations, and a recent report by OALABS (Open Analysis) researchers bears that out. After recovering and analyzing over 1,000 agent sessions from a compromised server on which an attacker deployed Anthropic’s Claude Code and OpenAI’s Codex agents, the researchers discovered how easily the attacker was able to bypass most of the agents’ guardrails, and how little he actually needed to know and do himself.

74,000 Fortinet firewall credentials exposed in FortiBleed data leak
A Russian-speaking cybercriminal group has stolen credentials contained in the configuration files of nearly 74,000 Fortinet firewalls and VPN gateways around the world. The data was accidentally exposed by the group on a server, along with other artifacts and tools, and the exposure was noticed by security researcher Volodymyr “Bob” Diachenko.

Law enforcement hits SocGholish: 106 servers down, 15,000 sites cleaned
SocGholish, an operation that’s been delivering malware to users via fake software updates, has suffered a major blow: the international law enforcement coalition behind Operation Endgame has taken down 106 of its servers and domains, and cleaned up nearly 15,000 websites compromised to serve their malicious payloads. The result of this most recent multinational law enforcement action was announced today by the Dutch National Police and on the operation’s website.

Unauthenticated RCE in Splunk Enterprise under active attack (CVE-2026-20253)
CISA has added CVE-2026-20253, a critical, remotely exploitable vulnerability in Splunk Enterprise, to its Known Exploited Vulnerabilities catalog, and ordered US federal civilian agencies to apply mitigations by June 21, 2026.

EU Cybersecurity Act 2.0: When good regulation goes bad
Over recent years we’ve witnessed the EU becoming increasingly serious about cybersecurity. After years of watching high profile breaches, many resulting from supply chain attacks targeting our critical infrastructure, that seriousness is welcome. But good intentions and good policy are not the same thing, and the proposed EU Cybersecurity Act 2.0 is starting to look a lot more like the former than the latter.

Navigating SEC, NIS2, and DORA incident disclosure timelines under pressure
In this Help Net Security video, Rick Goud, Global Field CTO at Kiteworks, discusses how to handle SEC, NIS2, and DORA disclosure timelines during a security incident.

Proving what a military AI model will do is the real problem
Defense contractors build AI systems that task drones automatically and propose kill-chains to support soldiers. Several of these contractors have partnered with frontier AI companies to put advanced models into military tools. The systems coming out of these partnerships carry a security problem that sits outside the methods of arms control diplomacy: confirming what an AI model will do.

Open-source CI/CD abuse detector guards against stolen credential attacks
CI/CD Abuse Detector is an open-source project that uses a large language model to flag suspicious changes to continuous integration and continuous deployment pipelines, workflows, and automation configurations. The repository contains drop-in templates for GitHub Actions, GitLab CI, and Azure DevOps.

Ukrainian national pleads guilty in connection with Conti ransomware
A Ukrainian national pleaded guilty to conspiracy to commit wire fraud in connection with the deployment of Conti ransomware, which targeted more than 1,000 victims worldwide.

Chinese hackers breached North American research institutions via REDCap servers
A China-linked cyber espionage operation targeted North American medical research institutions through compromised REDCap servers, using custom malware to gain persistent access and collect sensitive information, Google’s Threat Intelligence Group (GTIG) researchers found.

Planning a trip? Fake travel sites are multiplying this summer
Cyberattacks against hospitality, travel, and recreation organizations rose 24% year over year, reaching an average of 2,291 incidents per organization each week in May 2026, according to Check Point.

Crypto scammers are sending couriers to victims’ homes to collect cash
Scammers behind cryptocurrency investment schemes are dispatching couriers to pick up cash from victims in person, the FBI warns. According to the agency, scammers usually approach victims through social media, text messages, or fake investment personas, luring them into cryptocurrency schemes that use fraudulent trading platforms and fabricated returns to encourage additional deposits.

Cybercriminals mask malicious communications through Microsoft Teams relays
The DragonForce ransomware group used a custom malware called Backdoor.Turn to hide command-and-control traffic inside Microsoft Teams relay infrastructure during an intrusion at a U.S. services company, according to Symantec.

Apple is bringing Hide My Email and Sign in with Apple under one domain
Apple will unify the email domains used by Sign in with Apple and iCloud+ Hide My Email under a shared domain, private.icloud.com, later this summer. Hide My Email is a service included with iCloud+, Apple’s subscription service. It allows users to generate one-time-use or reusable email addresses that forward messages to their personal inbox without revealing their actual email address.

Rokarolla Android trojan targets banking and crypto users, enables device takeover
A newly discovered Android banking trojan, dubbed Rokarolla, targets 217 banking and cryptocurrency applications and can execute 137 commands on infected devices, according to researchers at Zimperium. Named after its command-and-control (C2) infrastructure, Rokarolla is primarily distributed through malicious websites that impersonate popular applications such as TikTok and Google Chrome, fooling users into downloading what appears to be a legitimate app.

Another healthcare firm attacked days after Novo Nordisk breach
Medical technology company iRhythm Holdings disclosed a cyberattack involving certain third-party-hosted business applications that resulted in the theft of patient protected health information, proprietary data, and other personal data. The company discovered unauthorized activity on June 8, 2026, and launched an investigation with the assistance of external cybersecurity experts.

AWS Continuum brings AI models to code vulnerability management
AWS Continuum for code vulnerabilities, a system built to handle a vulnerability across its lifecycle, from discovery through to a fix, is now available in gated preview. It reasons over a customer’s environment, confirms which findings are real, and works toward resolution. It is model agnostic and draws on multiple frontier models, assigning each to the work where it performs best. AWS designed it to take in newer models as they become available.

Malware attacks strip Roblox developers of entire games
Hackers who once focused on stealing valuable Roblox items are now taking over entire games. Although Roblox operates the service, users can create and publish their own games on it. Successful games can generate substantial revenue through in-game purchases. Some developers have earned millions of dollars and built dedicated studios around their creations.

Klue breach lead to Salesforce data theft, Huntress affected
Cybersecurity vendor Huntress was among multiple companies hit by a breach originating at Klue, a market intelligence platform used to integrate CRM and sales data across various business tools.

Senior engineers are spending their week cleaning up AI-generated code
At most U.S. technology companies, machines now write the bulk of the code that ships each week. The engineer’s job has shifted toward reviewing what the AI produces, and that review gives the code high marks. Leaders rate AI-generated code as higher quality than the code their own people write, praising its clean structure, consistent style, and low count of obvious bugs at submission time.

Microsoft’s workplace check-in via Wi-Fi tracks who’s in the office, and not everyone’s happy
Microsoft is rolling out workplace check-in via Wi-Fi for Teams and Microsoft Places. Connect to your office network and your in-office presence updates automatically, no manual status change needed.

A $2 trillion revenue shift hinges on AI data governance
Across large enterprises, a single question keeps surfacing when teams want to put customer data to work. Can this record be used for a given purpose, and does the consent behind it still hold? The data sits in warehouses and customer databases, and the ability to answer that question often lags behind. That delay carries a cost.

GitHub releases an open dataset for multilingual developer content
Developers coordinate code across README files, issue threads, and pull request discussions. Much of that exchange happens in English, and a large share happens in other languages. GitHub has released a dataset built to help researchers and developers locate public repositories that carry non-English natural-language content.

Software supply chains are heading for a transparency test
Software supply chain visibility is becoming part of product security work as the EU Cyber Resilience Act (CRA) moves toward application in December 2027. ENISA’s SBOM Adoption State of Play 2026 shows organizations preparing for CRA obligations through SBOM tooling, automation, and changes to software development practices.

The checklist problem behind critical infrastructure cyber safety
An asset owner can meet major federal cyber compliance standards and still run equipment that lacks the engineering to withstand an attack or a failure. New research from George Mason University examines how United States cyber policy defines reasonable care for systems that control physical processes, and it finds that compliance has become a stand-in for safety.

Product showcase: From phishing texts to risky Wi-Fi, Norton 360 Deluxe watches the gaps
Norton 360 Deluxe combines device security, scam detection, web protection, and VPN privacy in a single subscription that covers up to five devices. It is available for Windows, macOS, Android, and iOS.

Microsoft AntiSSRF open-source library helps block server-side request forgery
AntiSSRF is an open-source code library from Microsoft that validates URLs and network connections to reduce server-side request forgery (SSRF) risks in web applications. It supports .NET and Node.js applications and is distributed under the MIT license. The library works as a drop-in component, giving developers a way to check untrusted input before their applications make outbound requests.

Ukraine can now tap EU cyber support during major attacks
Ukraine can now call on emergency cyber support from the European Union during large-scale cybersecurity incidents. The move follows a decision by the Council of the European Union to add the country to the EU Cybersecurity Reserve.

What’s new in Android 17? Anti-theft tools, scam detection, and parental controls
The Android 17 rollout has started for supported Pixel devices, delivering new security and privacy capabilities before expanding to other devices later this year.

Most agentic AI projects in production have stalled over data problems
Enterprises are connecting AI agents to live data feeds and putting them to work on tasks that once required human review, from IT operations to software development. The number doing this in production reached 32 percent in 2026, up from 29 percent the year before, according to Confluent’s annual Data Streaming Report, which surveyed 4,625 IT leaders across 14 countries.

Homebrew tightens tap security, begins work on its interface
Anyone who installs software through a third-party Homebrew tap runs Ruby code written by people outside the project, and that code runs without a sandbox. That risk sits at the center of Homebrew 6.0.0. It now requires a tap, along with any tap-qualified formula or cask, to be trusted before its code is evaluated or run.

Google’s open standard for AI agents to discover and verify tools
AI agents rely on tools, services, and other agents distributed across different teams, organizations, and platforms. Because these resources are often isolated in separate systems, agents have limited ability to discover and connect to capabilities outside their own environment. Google aims to solve this with Agentic Resource Discovery, an open specification for publishing, discovering, and verifying AI capabilities across the web, regardless of framework, protocol, or provider.

GentleKiller targets more than 400 security processes across 48 products
Most ransomware operations leave the work of disabling endpoint security software to their affiliates. The ransomware-as-a-service gang Gentlemen runs a different model. Its operators develop and maintain a set of tools for shutting down endpoint detection and response (EDR) products, then provide these tools directly to the affiliates who rent the gang’s encryptors.

Asia-Pacific scam networks generate nearly $40 billion a year
Cybercrime is taking a larger share of criminal activity in Asia and the Pacific. More than half of surveyed jurisdictions reported that cybercrime accounts for over 30% of all crimes recorded nationally, according to INTERPOL’s 2025/2026 Asia and South Pacific Cyberthreat Assessment Report.

Companies are discarding the logs they need to catch a breach
Many large enterprises discard most of the log data their systems generate, and they do it on purpose to keep costs down. A Dynatrace survey of 450 senior IT leaders at large enterprises found that half of organizations drop or never collect an average of 86 percent of their logs, even after filtering and aggregation. Many also limit how long they retain the logs they do keep.

The rise of machine identities and agentic AI: Securing trust in the next era of digital autonomy
For years, identity security has been centered on humans, ensuring that the right person has the right level of access to the right resources. But now, the same principle applies to non-human entities: machines, APIs, bots, and increasingly, AI agents. These new “digital actors” authenticate, access sensitive information, execute workflows, and even make decisions, often faster and at greater scale than any human ever could.

How security teams are getting credential visibility into developer endpoints
Attackers increasingly target developer machines to steal credentials. Recent supply chain attacks, including Megalodon, TrapDoor, and Miasma, focused on compromising developer environments where secrets often reside in shell histories, .env files, cloud CLI configs, local caches, and AI agent directories. To address this risk, GitGuardian has introduced Developer Endpoint Protection in ggshield, enabling organizations to discover credentials on developer workstations.

Google sets timeline for Android developer verification enforcement
Android’s developer verification protections will take effect on September 30, 2026, starting with users in Brazil, Indonesia, Singapore, and Thailand. Developers distributing apps through participating stores in those markets must complete the verification process by the deadline.

Mastodon 4.6 adds profile Collections and two-factor controls
People who run accounts on the open source social network Mastodon can now group profiles together and share those groups across the web. The 4.6 release centers on a feature called Collections, along with reworked profiles, email newsletters, server administration controls, and a set of accessibility changes.

Forget traffic lights, Google’s reCAPTCHA may ask for hand gestures
Google has introduced hand gesture verification for reCAPTCHA, a new method for verifying that a user is human. Google’s reCAPTCHA is part of Google Cloud Fraud Defense, a fraud and abuse prevention platform for bot, account, and transaction protection. It uses risk analysis and challenge-based verification to help organizations identify automated activity and suspicious behavior.

Cybersecurity jobs available right now: June 16, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

New infosec products of the week: June 19, 2026
Here’s a look at the most interesting products from the past week, featuring releases from ArmorCode, Barracuda Networks, Blue Planet, Flip, Fortinet, Legit Security, Tigera, and WitnessAI.


from Help Net Security https://ift.tt/cGo1QuH

Dolphins, sharks, turtles, and human workers are all victims of unregulated squid fishing fleets.

Another news article.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.


from Schneier on Security https://ift.tt/QnxPeHz

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

Amazon Prime Day kicks off next week, but that doesn't mean that you need to wait for tech deals. While the biggest sales will likely start during the sale itself, Amazon currently has discounts on a number of devices, including smart speakers, headphones, and smartphones. If were you planning on upgrading your tech in the near future, it's not a bad time to take a peek at Amazon's sale.

Now, seeing as this is Amazon Prime Day, the biggest tech deals I'm seeing are on Amazon products, across the company's many brands. That's all fine and well if you were planning on buying Amazon stuff anyway, but I don't typically want to highlight just anything Amazon happens to put up for sale. As such, I've listed a few options here, but know that, if Amazon makes it, there's a good chance it's discounted right now.

These AirPods are over $30 off

There are a lot of headphone options out there, but if you're already entrenched in the Apple ecosystem, AirPods are arguably the best choice. They sound great, yes, but they also pair and sync with all of your devices. You can go from listening to music on your iPhone to watching a YouTube video on your iPad without having to re-pair your earbuds.

While Apple's AirPods Pro 3 were on sale ahead of Prime Day, the sale appears to have ended. However, if you prefer Apple's more traditional earbuds, you're in luck. Amazon has discounts on both the AirPods 4 with Active Noise Cancellation and the standard AirPods 4. If you don't need noise cancellation, you can snag the latter for a flat $99.

The Beats Solo 4 headphones are 35% off

If you're looking for a pair of Apple headphones, but balk a bit at AirPods Max's $549 price tag, Beats might be your best bet. Since Apple owns Beats, you'll get the same easy-pairing perks as AirPods, but with a smaller MSRP. For on-ear fans, there's Beats Solo 4, which are currently on sale for $129.95 (down from $199.95). The Solo 4 can last up to 50 hours on one charge, and support lossless playback over USB-C. If over-ear is more your style, there's Beats Studio Pro, $169.95 (down from $199.95.) These will run up to 40 hours on a single charge, come with noise cancellation, and also support lossless audio over USB-C.

The Sony WH-CH520 headphones are almost half off

Sony isn't known for catchy names, but that doesn't have any impact on the quality of their products. While Sony headphones can run pricey, the company offers midrange and budget options, too. Case in point, the Sony WH-CH520 headphones, which are only $38 ahead of Prime Day (a 46% discount from $69.99). These are on-ear style headphones, with up to 50 hours of playback. Like other modern wireless headphones, you can connect the WH-CH520 with up to two devices at once, so you can jump between your phone and laptop as needed.

The Bose QuietComfort Ultra headphones are 27% off

Bose has long been known for its noise cancellation tech, but it also makes some of the highest-quality headphones you can buy. As such, the QuietComfort Ultras aren't cheap, with an MSRP of $449. But ahead of Prime Day, you can pick them up 27% off for $329. These are over-the-ear headphones with up to 24 hours of playback on one charge. They also support spatial audio, and can connect with Bose soundbars for TV audio.

Samsung's Galaxy S26 is $100 off

While a lot of the best deals I'm seeing now are with headphones, there's one smartphone brand with some discounts on Amazon. Samsung's Galaxy S26 is currently $100 off, dropping the price to $799.99. The company's latest flagship smartphone comes with three rear cameras (including a 50MP wide lens, a 10MP telephoto lens, and a 12MP ultrawide lens), a 6.3-inch 1080p AMOLED display, a Snapdragon 7 Elite Gen 5 chip, and 256 GB of RAM. If you need a bit more storage, the 512GB Galaxy S26 is also on sale for the oddly-priced $943.99.

The Amazon Fire TV Cube is 36% off right now

I'm not necessarily a big Amazon person, but as I mentioned above, most of the Prime Day perks are for Amazon's own devices. If you need a new streaming device, for example, you'll find many of the company's Fire products already on sale. Maybe the best I see right now is the Fire TV Cube, which is currently 36% off—at least the lowest price in the past three months per Keepa. The Cube comes with all of Amazon's streaming perks, including most HDR formats, Wi-Fi 6E and ethernet, live view picture-in-picture, Alexa Home Theater, and the ability to connect your other devices. If all you want is 4K streaming, however, consider deals on Amazon's Fire TV Stick 4K devices, which are cheaper than the Cube.

Amazon's eero 6+ mesh wifi system is 35% off

Similarly, Amazon has a great deal right now on its eero 6+ wifi mesh system. Mesh wifi is among the best strategies for extending wifi throughout your home. Standard extenders take your wifi signal as it is and "repeat" it further out; this can be helpful for extending the range, but if the signal was weak to begin with, it won't do you much good. Mesh wifi, on the other hand, rebroadcasts wifi signals at full strength from each "node," which can radically improve a wifi network, especially in larger homes. The eero 6+ mesh system is listed at $299.99, but Amazon has it for $194.99.

The Amazon Echo Dot Max is 35% off

Nearly all of Amazon's smart speakers are on sale ahead of Prime Day, from its base models to its priciest options. But my guess is most people are interested in Amazon's mid-tier speaker, the Echo Dot Max, which typically retails for $99.99. Right now, it's 35% off at $64.99, cheaper than its previous dip back in early May. This is the speaker that directly competes with Apple's HomePod and the new Google Home Speaker.

Our Best Editor-Vetted Early Prime Day Deals Right Now
Deals are selected by our commerce team

from Lifehacker https://ift.tt/VO0QR3x

We may earn a commission from links on this page.

Between President Trump's tariffs, global instability, and historic demand for RAM, the past year has had an outsized influence on tech prices. It seems that just about every major company has announced price hikes recently, from laptop manufacturers like Acer and Dell to gaming companies like Sony and Nintendo. It's an odd turn of events: In the past, you only needed to wait for a new piece of tech to get cheaper. But now, if you didn't buy a Switch or PlayStation at launch, you'll pay more for one today.

Despite these increases, Apple has largely avoided passing higher costs on to consumers. It has some tricks up its sleeve, of course: The company eliminated some cheaper device tiers, so the cost of entry for products like the Mac mini and MacBook Air technically increased, but it did so without actually raising prices. Over the past year, not only have Apple device prices stayed the same, the company has also released new low-cost options like the MacBook Neo, which offers a full Mac experience for the cost of an iPhone 16. (Perhaps there are some perks to being a $4 trillion company.)

Sadly, this isn't a story about how Apple is continuing to keep prices stable. On Wednesday night, The Wall Street Journal published an exclusive, sharing news direct from outgoing Apple CEO Tim Cook. "Unfortunately, price increases are unavoidable," Cook told the newspaper. "We're doing our best to mitigate the huge increases that are being passed to us, and we've been trying to shield our customers from the increases, but the situation has become unsustainable." In other words, Apple products are about to get more expensive.

Cook went on to say that both RAM and storage chip shortages are driving factors in these issues: "There's less supply at a time when consumers want devices and the memory guys are passing along huge price increases." In a rather ominous aside, he added, "I've never seen anything like it in any area in over 40 years."

There are few details in the piece outside of the quotes from Cook. We don't know which products are going up in price, nor exactly when. The Wall Street Journal predicts that Apple will need to "substantially" increase prices if its goal is to maintain its current profits to cushion the impact from more expensive RAM and CPUs. Regardless, visit Apple's online store and take note of the MSRPs you see: They'll likely never be lower than they are right now.

Should you buy Apple devices now to beat the price increase?

Choosing when to buy tech is a bit like judging the stock market. You can make your best guess and hope you're getting the lowest price, but tomorrow, a massive sale could make your deal look paltry by comparison. Or you could wait, and prices could creep higher. There are no guarantees anymore.

That said, we can make some educated guesses. Tim Cook is calculated, and while he may be passing the torch to John Ternus soon enough, he wants to ensure Apple's valuation only continues to grow. As such, my guess is these price hikes are not immanent; rather, they likely will kick off with Apple's next hardware release cycle, which the company will almost certainly announce in the fall. That could mean the iPhone 18 will cost more than the iPhone 17, or the Apple Watch Series 12 will cost more than the Series 11. The "iPhone Fold" has no successor to compare it to, but perhaps it, too, will cost more than Apple originally intended. If that's the plan, Wall Street (as well as the rest of us) will no longer be surprised when the new products cost more than last year's.

If you're set on buying a new Apple device as soon as it's announced, you'll need to anticipate paying more. But if your goal is to get a device at the best possible price, I'd recommend buying sooner rather than later. While it seems probable that Apple won't raise prices before the fall, it could also choose to implement hikes long before then. As such, I'd encourage you to choose the device you want rather than getting fixated on paying a certain price. Use price comparison tools to see what deals are out there. If it looks like a device is at a relatively low price, jump on it now. You can no longer trust that older devices will be cheaper once Apple releases its next crop of products; if the iPhone 18 costs $200 more than the iPhone 17, there won't be that usual market incentive to drop the price of the latter.

The timing here is actually good, at least: Next week is Amazon's Prime Day (which should be called Prime Week now), and there are already early Apple deals with considering. A great discount on AirPods Pro 3 came and went (at least at Amazon; you can still find them for $70 off at Best Buy), but you can still score solid deals on the AirPods 4, with and without active noise cancellation. It's worth keeping an eye out next week for any deals on Apple products, including Macs, iPads, and AirPods. Again, no guarantees on what will get discounted, but we know two things for sure: Amazon is having a sale, and Apple is planning on raising prices at some point. More so than usual, the timing of your purchase matters.


from Lifehacker https://ift.tt/5Y6vzh0

We may earn a commission from links on this page.

Google's new Fitbit Air is officially HSA/FSA eligible for qualifying customers, giving you more ways to use your pre-tax health savings. But before you rush to check out, it helps to understand how HSA and FSA eligibility actually works for wearables—because for most devices, it's a little more complicated than it sounds.

How FSA and HSA eligibility works for wearables

Health Savings Accounts and Flexible Spending Accounts let you set aside pre-tax dollars to pay for qualified medical expenses. The IRS determines what counts as true medical expenses, and historically, fitness trackers and smartwatches haven't made the cut on their own. The IRS has ruled that devices of this type are generally used to promote "general health," not to treat or monitor a specific medical condition, which means they typically don't clear the bar for qualified medical expenses.

According to the FSA Store's eligibility list, a wearable device becomes eligible when it is necessary for treating or monitoring a specific medical condition, as opposed to just for general wellness. This is where a “Letter of Medical Necessity” comes in.

What is a Letter of Medical Necessity?

A Letter of Medical Necessity (LMN) is essentially a doctor's note that classifies a specific purchase as a qualified medical expense under IRS guidelines. To get one, your physician must certify that the device in question will be used to treat or monitor a legitimate medical condition, such as obesity, a heart condition, sleep apnea, or diabetes. Once you submit that LMN to your benefits administrator, your wearable purchase will most likely be approved for reimbursement.

When it comes to securing your LMN, you might not even need to make a doctor's appointment, thanks to certain third-party players like Truemed partnering with a number of health tech companies. You'll see the option to “Pay With Truemed” at checkout at Whoop, Coros, and Amazfit, to name a few. From there, you'll be asked a few questions about your health circumstances, and you’ll be matched with a provider to determine your eligibility. If you qualify, you’ll get an LMN that will allow you to use your HSA or FSA funds to complete your purchase.

How to use your HSA/FSA funds to buy a Fitbit Air (or any health tracker)

Once you've confirmed your eligibility—ideally with an LMN in hand—there are two main ways to use your pre-tax health dollars to purchase a wearable: paying directly with your FSA or HSA card at a qualifying retailer, or paying out of pocket and submitting for reimbursement afterward.

Option one: Pay directly with your FSA or HSA card

The simplest method is to use your FSA or HSA debit card at the point of sale, the same way you'd use any other credit card.

  1. Confirm the retailer accepts FSA/HSA payments. Major retailers like Amazon, Walmart, and Target accept FSA/HSA cards for eligible items, and the Google Store may accept them directly for the Fitbit Air, given its certified eligibility status. Specialty health retailers like FSA Store and HSA Store are also strong options, as everything they sell is pre-vetted for eligibility.

  2. Have your LMN ready. Even if you're paying directly with your card, your plan administrator may follow up and request documentation. Keep your LMN accessible.

  3. Swipe your card and save your receipt. The transaction may go through without any extra steps, but if your administrator later flags the purchase, your receipt and LMN are your proof.

Note: If your wearable isn't on a pre-approved eligibility list, your FSA card may be declined at the register even if you have a valid LMN. In that case, you can try option two.

Option two: Pay out of pocket, then submit for reimbursement

If your FSA card doesn't work at checkout—or if you'd rather buy from a retailer that doesn't support FSA/HSA payment—you can pay with any form of payment and request reimbursement from your plan administrator afterward.

  1. Purchase the device using a personal credit card or any other payment method, and keep your itemized receipt.

  2. Obtain your Letter of Medical Necessity if you haven't already. Your doctor will need to specify your diagnosis, explain why the device is medically necessary, and confirm it's being prescribed to treat or monitor your condition (not just for general wellness).

  3. Log in to your benefits portal or contact your plan administrator. Most FSA and HSA administrators have an online portal where you can submit reimbursement claims directly.

  4. Upload your documentation. You'll typically need to submit your itemized receipt and your LMN together. Some administrators may also ask for additional information about the device.

  5. Wait for approval and payment. Processing times vary by administrator, but most claims are reviewed within a few business days to a few weeks. If approved, you'll be reimbursed from your FSA or HSA balance via direct deposit or check.

If the Fitbit Air isn't your style, check out these other major brands offering HSA/FSA-eligible fitness trackers.

The bottom line

Even if a device is marketed as health-focused, that doesn't automatically make it FSA or HSA eligible. For most smartwatches and fitness trackers, eligibility hinges on your documentation, not just the device features appearing medically sound. Some administrators scrutinize wearable purchases more closely than others, and approval is never guaranteed. If you have a qualifying medical condition and a physician willing to support your case with an LMN, you may be in great shape to put those pre-tax dollars to work.

FSA funds are use-it-or-lose-it on an annual basis (with some grace period exceptions), so timing matters. If you're near the end of your plan year and have a balance to spend, a qualifying wearable purchase could be a smart way to put those funds to work before they expire. HSA funds, by contrast, roll over indefinitely, so there's less urgency (but the reimbursement process is the same).

Also worth noting: you can reimburse yourself from an HSA for a past eligible purchase at any time, even years later, as long as you have the receipt and documentation. That flexibility makes HSA accounts particularly useful for health tech purchases. Whatever you buy, keep meticulous records. The IRS expects you to be able to back up every HSA purchase you make, and good record-keeping is the simplest way to protect yourself if questions ever arise.


from Lifehacker https://ift.tt/r73Q4Nf

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

If you passed on Nothing's unique over-ear headphones when they dipped in price last month, you have another chance, and this time, the deal is even better. The distinctive Nothing Headphone (a) and Nothing (1) headphone have both dropped to their lowest price yet on Amazon in an early Prime Day deal. The Nothing Headphone (a)  is down 24% to $151.05 (originally $199), and the Nothing (1) headphone is down 29%, dropping to $213.75 (originally $299).

While most headlines focus on the brand’s transparent retro-futuristic design, there's more going on here than aesthetics with these headphones. The Headphone (a), the brand’s more affordable model, has ANC up to 40 dB, a 40mm titanium-coated diaphragm, support for high-resolution LDAC audio, spatial audio with head-tracking, and the increasingly rare option to listen via Bluetooth, USB-C, or a traditional 3.5mm cable. The more premium Headphone (1) has 40mm dynamic drivers and adaptive ANC. 

Comfort gets mixed reviews; some reviewers found the earcups on the Nothing (a) a bit shallow for larger ears compared to the more luxuriously padded Headphone (1). Reviewers have also praised the physical controls, which use tactile buttons rather than finicky touch panels, as well as a volume roller and a paddle switch for track controls. The headphones support multipoint connectivity, adaptive ANC, transparency mode, and an IP52 rating to protect against dust and light rain.

Battery life is another standout; the headphones last up to 135 hours with ANC disabled and 80 hours with ANC on, which is impressive compared to many premium competitors. Surprisingly, despite being widely hailed as the more premium model, the pricier Nothing (1) has significantly reduced battery life, with up to 80 hours with ANC off, and 35 hours with ANC on. On the Nothing (a), a quick five-minute charge provides up to eight hours of listening time, while a full charge takes two hours. The Headphone (1) delivers up to five hours of playback from a five-minute top-up.

The Nothing (1) also adds an advanced 8-band EQ and six mics for calls, compared to the Nothing (a)’s adjustable EQ via the Nothing X app and five mics. Ultimately, the Nothing (1) headphones deliver a more refined listening experience and a more premium, comfortable build, while the Nothing (a) headphones give you exceptional battery life at a much lower price. At the current record-low discount, they’re both appealing options for anyone who wants premium features and an eye-catching design at a lower price.

Our Best Editor-Vetted Early Prime Day Deals Right Now
Deals are selected by our commerce team

from Lifehacker https://ift.tt/Qlvqn54

Researchers have long warned that AI agents could lower the skill floor for offensive cyber operations, and a recent report by OALABS (Open Analysis) researchers bears that out.

After recovering and analyzing over 1,000 agent sessions from a compromised server on which an attacker deployed Anthropic’s Claude Code and OpenAI’s Codex agents, the researchers discovered how easily the attacker was able to bypass most of the agents’ guardrails, and how little he actually needed to know and do himself.

“In many cases, the attacker supplied only vague, low-skill prompts and allowed Claude to fill in the gaps: researching exposed services, identifying possible vulnerabilities, writing exploit code, validating access, and harvesting data,” the researchers noted.

“The attacker did not need to be an expert operator; they simply had to use the correct framing for their prompts. The agent supplied much of the structure and technical execution that the attacker appeared to lack.”

A window into the attacks and the attacker

The analyzed sessions were recoverable due to an operational security failure on the attacker’s part, the researchers explained.

Rather than running the AI agents on infrastructure he fully controlled, he copied them onto a server belonging to someone else. When that server’s owner discovered the intrusion, they downloaded the attacker’s entire working directory and shared it with the researchers.

“Because the agents were local to the host, their full session logs were recovered, including the attacker’s prompts, the tools used, the internal monologue of the large language model (LLM), and any policy violations recorded during the sessions,” the researchers found.

By analyzing the sessions, they discovered that:

  • The Claude agent had been copied onto the host rather than installed, and that instance had previously belonged to a software developer.
  • The attacker’s working directory also contained other stolen Claude instances archived in 7-Zip folders, suggesting that hijacking and reusing other people’s AI agent installations was the attacker’s routine mode of operation.
  • The attacker usually bypassed the agent’s reluctance to execute hacking requests by claiming he was engaging in authorized red team exercises or cyber security research.
  • The attacker used the agent to identify exploitable services on targets’ systems, build custom exploits based on discovered vulnerabilities, execute these exploits against the targets, and exfiltrate data and credentials.

The prompt history shows that almost all hacking activity was driven through the Claude agent, with the attacker preferring to issue vague directives such as “recon this” and allowing Claude to carry out the requests autonomously.

“For each successful target, Claude would draft a ‘PENTEST-REPORT’ detailing how the access was gained and, more importantly, providing dollar-value ‘monetization’ estimates for the harvested data,” they shared.

“Both Claude and Codex raised the majority of their policy violation blocks during this phase, often correctly identifying that monetizing stolen data was likely not part of a legitimate redteam exercise. However, the attacker eventually obtained a list of suggested strategies, including extortion, access and data sale, business email compromise (BEC), and direct theft of funds.”

The collected sessions documented the breach of at least 14 companies, but there was no information in the logs to confirm that the attacker succeeded in monetizing the stolen data or stealing funds.

The attacker’s inexperience was also evident in his operational security failures. At one point he asked Claude to help edit his resume, which contained his full name, location, education history, and LinkedIn profile.

Later, while investigating a potential compromise of one of his own hosts, he inadvertently confirmed his home IP address to the agent. Based on this and other corroborating evidence, the researchers believe the attacker to be a young man based in Addis Ababa, Ethiopia.

The line between research and crime is hard to see (for AI)

Across more than 1,000 sessions, Claude emitted only nine policy violations, and Codex only one, and in most cases, the attacker was able to work around them by reframing his request.

The problem is that the framing that bypassed the guardrails here (“authorized red team engagements”, “cyber security research”) is also the framing used by thousands of legitimate security professionals every day, and drawing a reliable line between the two may be an unsolvable problem.

Blunting LLMs with broader refusals is not a good solution, the researchers feel, as it would hurt defenders more than attackers, who can simply turn to older or less restrictive non-frontier models.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!


from Help Net Security https://ift.tt/tDXHZlC