The Latest

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

Week in review

Strands Box: Open-source sandbox for AI agents
AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in developer preview and runs on Macs with Apple silicon, with Linux support planned.

Geopolitics and the cyber resilience gap belong in your threat model
In this Help Net Security interview, Akshay Joshi, Head of the Centre for Cybersecurity at the World Economic Forum, talks about how AI, geopolitics and industrialized fraud are changing cyber risk. He discusses findings from the Global Cybersecurity Outlook 2026, including that CEOs now rank cyber-enabled fraud above ransomware as their top concern.

npm Trusted Publishing flaw exposed 1,500+ npm packages to takeover
Bloom Security researchers found that npm’s Trusted Publishing feature let an attacker push new versions of someone else’s package without stealing a credential. The attacker only needed to register a GitHub repository name the maintainer had left behind. Bloom counted more than 1,500 npm packages exposed this way, and GitHub, which owns npm, says it has shipped fixes.

Patching and preventing issues: What are the lessons you can learn?
In this Help Net Security interview, Kunal Modasiya, Senior VP & GM at Qualys, talks about why patching is still hard to get right. He explains how business pressure, revenue-critical systems, and patches that break things keep fixes from going out. Modasiya argues that speed alone has limits and that teams should look at the whole remediation workflow.

Immuta CISO predicts critical AI incidents at major enterprises within 18 months
In this Help Net Security interview, Michael Scott, CISO at Immuta, talks about how organizations should handle permissions for AI agents. He argues agents should be treated as lower-trust identities that don’t inherit everything their user can access.

Why Active Directory weaknesses stay open for years in teams with one or two admins
David Fuhr, CTO at intcube, talks about a security cohort for public administration, where 27 municipalities hardened Windows Server and Active Directory together over 12 weeks. This Help Net Security interview covers how a cohort works, with weekly sessions, homework and measurements at the start and end.

The cyber talent shortage? Job postings just hit a four-year low
US employers posted 235,786 cybersecurity jobs from January through September 2026. That is the lowest total for those months in the four years that staffing and workforce intelligence firm CyberSN has tracked. They pulled the listings from job data provider JobSpikr, removed duplicates and sorted each one by the security work it described.

Hidden implant in Ledger hardware wallets linked to $93M theft
Three days after customers in Southeast Asia began reporting drained wallets, Ledger says the damage is limited. In its 72-hour update on X on October 11, the Paris-based hardware wallet maker said “all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis.”

Cyberattacks hit European grocers: French supermarket freezers hijacked, Dutch and Belgian stores disrupted
European food retailers have been affected by two separate disruptive cyberattacks: In France, several supermarket chains have had their fridges and freezers tampered with and chilled/frozen products destroyed, while in the Netherlands and Belgium workers at stores owned by Dutch multinational Ahold Delhaize have been dealing with disruption resulting from an unspecified “security issue”.

Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)
In another record-breaking Patch Tuesday, Microsoft has squashed over 1,400 security bugs, including a Mark of the Web bypass vulnerability (CVE-2026-96951) exploited by attackers in the wild. CVE-2026-96951 is a command injection vulnerability in Windows Shell that can be triggered by remote attackers via a file that is designed to exploit the vulnerability.

Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances
A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti’s Connect Secure (ICS) appliances to breach organizations, collect credentials, exfiltrate configuration data, and perform network reconnaissance.

Be a good AI ancestor: Cybersecurity already gave us the playbook
AI has brought us to a familiar inflection point in the story of privacy, cybersecurity, and online safety. We have an opportunity to apply decades of cybersecurity experience before the next generation of technology creates consequences we cannot easily reverse. Lisa Thee, Commissioner at Global Council for Responsible AI learned the importance of that responsibility through a three-year-old child called Adia. Her name is a protective pseudonym.

Let’s Encrypt TLS certificate lifetimes to drop from 90 to 64 days starting February 2027
Websites that rely on Let’s Encrypt will soon have to renew their TLS certificates more often. Starting February 10, 2027, the certificate authority will issue certificates valid for 64 days by default, down from 90 days.

Low-cost Android phones are arriving with malware that owners can’t uninstall
People who buy low-cost Android phones from online marketplaces may be carrying malware that was placed on the device before it reached them, Bitdefender has found.

Most high-severity cloud security findings are downgraded once an AI agent checks the environment
Cloud security platforms turn every failed rule into a finding, and those findings pile up in queues sorted by severity. Research from Sola Security tested what happens to that order when each finding gets checked against the environment where it lives.

GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)
GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on GitLab servers. CVE-2026-97229 is an integer overflow vulnerability in GitLab’s CI/CD Regular Expression Compiler, and it affects both GitLab Community Edition (CE) and Enterprise Edition (EE).

Ukrainian drones hit Yandex data centers, sparking claims that Russian troll farms went quiet
Russian tech giant Yandex confirmed that drones hit three of its data centers, shutting down the facilities in Sasovo and Vladimir and knocking out part of the infrastructure in Kaluga. On October 11, Yandex Cloud told its customers that the platform was running in emergency mode and advised them to switch to their own disaster recovery plans, after a drone attack shut down the company’s data center in Vladimir. The facility was the third Yandex data center hit within four days.

OpenAI engineer arrested for allegedly trying to eavesdrop on executive meetings
A recording device wrapped in toilet paper and plugged into the back of a television in an executive conference room at OpenAI’s San Francisco office has led to the arrest of one of the company’s engineers.

Phase Eight, Hobbs and Whistles owner joins growing list of fashion retailers targeted by hackers
People who have shopped with Phase Eight, Hobbs or Whistles will have to wait to find out whether their personal information was exposed in a cyberattack on the company behind the three UK fashion brands.

FBI raids 40+ laptop farms helping North Korea pocket US tech salaries
North Korean IT workers used stolen and fabricated identities to land remote jobs at more than 70 US companies, with help from Americans who allegedly kept company-issued laptops running from their homes, according to the US Department of Justice.

CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products
The US Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The agency added them based on evidence of active exploitation and has given US federal civilian agencies three days, until October 17, 2026, to address the vulnerabilities.

KGB RAT trojan packs webcam spying, password theft and a “fun” menu to terrorize victims
A Windows trojan advertised on hacking forums for as little as $150 a month promises buyers access to a victim’s webcam, microphone, keystrokes and saved passwords, and comes with a set of features made to frighten the person on the other side of the screen.

Fake Arch Linux AUR packages exploit typos to run malware with root privileges
Arch Linux users who mistyped yay or paru while installing the package helpers from the Arch User Repository (AUR) may have given a stranger root access to their machine. AUR is a popular community package source for Arch Linux and related distributions, hosting user-submitted build scripts for proprietary programs, beta builds and older software versions that the official repositories do not carry.

Scammers clone candidates’ voices to steal cash and voter data ahead of 2026 midterms, FBI warns
Three weeks before Americans vote in the 2026 midterm election, fraudsters are borrowing candidate names, logos and slogans to collect fake donations and harvest personal data, the FBI warned.

Hackers disguise phishing as promising business opportunities
Attackers are breaking into business email accounts with short messages asking whether a company can quote on an upcoming project, the kind of request sales and procurement staff answer every week. Cadence Riddle, a cybersecurity researcher at Fortra, tracked a 12-fold increase in malicious emails mentioning “RFQ” (request for quotation) between October 2025 and September 2026. In nearly 73% of cases, the lure led to a page built to steal login credentials.

What makes some open source updates so difficult?
Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering effort, according to Google’s case study, “How much does it cost to maintain a copy of an open source software package (at Google)?”

AI vulnerability patching has a grading problem
Researchers at Northwestern University tested AI coding agents on 112 real security bugs. They found that a patch which stops a crash often fails the checks the project’s maintainers wrote for the fix. With Claude Opus 4.7, third of the patches that made the crash go away still failed those maintainer tests.

Windows PCs missing key updates could lose security fixes in 2027
Microsoft is advising users and businesses to update Windows devices before digital certificates used to verify Windows Update servers expire in May and June 2027. The certificates expire on May 17 or June 19, depending on the Windows version. Devices without replacement certificates will lose access to Windows Update, including security fixes delivered through the service. Microsoft is distributing the replacements through a process known as certificate rotation.

Microsoft’s new model helps AI agents judge their next move
Microsoft-Decision-1 is a small decision-scoring model. Given a situation, a question and a fixed set of answer options, it returns a calibrated probability for each option.

Frontier AI cleared every OT attack goal Booz Allen set in its lab
Booz Allen set frontier AI models against an isolated industrial-control testbed in its Chantilly, Virginia lab and watched them clear all eight attack objectives it had defined. The models mapped the network, tied equipment to known weaknesses, wrote working exploits, pivoted into the systems that run production, and in the last test found a robotic arm, took administrative control, and moved it.

Meta outlines Muse Wonder safeguards for AI agents acting on your behalf
Meta’s Muse Wonder and Muse Wonder Full models are built for AI agents that handle tasks such as preparing insurance claims, reviewing leases and developing software. The models combine document analysis and tool use with the ability to retain relevant details across conversations and work through obstacles toward a user’s goal.

Mozilla’s Firefox Enterprise lets companies block shadow AI in the browser
Mozilla’s Firefox Enterprise is a paid platform that lets organizations control how sensitive data is shared, check device security, and manage employee access to web applications. The platform pairs the browser with a management dashboard hosted on an organization’s own infrastructure.

Google quadruples Chrome bug bounty base pay, offers up to $20,000 for sandbox escapes
Google is updating its Chrome Vulnerability Rewards Program (Chrome VRP), increasing payments for memory corruption vulnerabilities and expanding rewards for other security flaws, fixes and research tools.

Most companies count AI agents as insiders, and CISOs worry about their own liability
Software that works on an employee’s behalf is now turning up in incident reports. At 95% of the companies in a Trellix survey of 600 CISOs, an AI agent or other autonomous system was linked to an insider incident in the past 12 months.

Meshery: Open-source cloud-native manager for Kubernetes
Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing Foundation project. Teams use it to lay out clusters and applications on a visual canvas, check the design, and push it to multiple clusters and clouds from one central console, without hand-editing YAML.

GitHub adopts cheaper AI model to catch secrets developers leave in code
GitHub has trained a credential classifier to improve generic secret detection and reduce false alerts. The new pipeline cut median post-push scan execution time by 86% and model serving costs by more than 98% compared with its previous large language model (LLM) pipeline.

Product showcase: GuardOS checks QR links, scans for data breaches, and filters Safari content
GuardOS is an iPhone application that combines device security checks, VPN access, Safari content filtering, QR link scanning, and storage cleanup. It is available through the App Store.

AI-generated changes create review bottlenecks in software delivery
83.4% of respondents who use DevOps practices run CI/CD pipelines, making them the most widely adopted practice in that group, according to JetBrains’ The State of CI/CD in 2026 report. Adoption exceeds that of containerisation and orchestration, infrastructure as code, GitOps and platform engineering.

The internet’s attack surface moves at very different speeds
Censys found that AI-related software exposed to the public internet grew 63% in nine months, from 164,088 IP addresses in October 2025 to 267,915 in July 2026. Elsewhere in its scans, the internet-scanning company measured much slower movement. Exposed industrial control systems rose about 4% in two and a half years. The oldest versions of four widely deployed business products barely changed their share at all.

Microsoft disrupts phishing network behind more than a billion scam messages
Microsoft uncovered a criminal marketplace supplying tools and accounts used in phishing scams worldwide. Attackers used these resources to target organizations in healthcare, financial services, wholesale distribution, and IT across Japan, the United States, Australia, and India.

Fake CAPTCHAs are tricking users into running malware on their own devices
Fake CAPTCHA checks are being used to do more than hide phishing pages. Attackers are turning the familiar “prove you’re human” step into a gateway for malware downloads, malicious browser notifications, and commands that victims are tricked into running themselves, according to Barracuda.

Fastfetch 2.70.0 changes how Disk free space is reported
Fastfetch is a system information tool written mainly in C that runs on Linux, macOS, Windows 8.1 and later, Android and several BSDs. The fastfetch project removed QuickJS scripting and changed what its Disk, Command and Shell modules report in version 2.70.0, released October 14. Configs written for older versions may print different values or stop working.

DDoS attacks can knock services offline before links reach capacity
More than 9.1 million DDoS attacks were recorded globally between January and June 2026, an increase of nearly a quarter year over year, according to Netscout’s DDoS Threat Intelligence Report.

Stolen AI API keys are paying for hackers’ autonomous scans
A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key’s owner pays for the scans. Bitsight’s threat intelligence team tracked the shift across thousands of posts on 16 underground forums from February through August 2026. Over that window, mentions of AI agents, indirect prompt injection and the Model Context Protocol (MCP) rose 67 percent.

Android adds AI-powered scam alerts, hangs up on bank impostors
Google’s new scam protections cover Google Messages and third-party messaging apps, with an enhanced protection mode, expanded scam alerts and safeguards against call-forwarding and screen-sharing scams.

Download: The IT and security field guide to AI adoption
Security and IT teams are under pressure to adopt AI, but many are seeing the opposite of what was promised. This guide breaks down why AI adoption fails in practice and gives teams a clearer path forward, from evaluation to implementation, with humans in the loop.

Cybersecurity jobs available right now: October 13, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

New infosec products of the week: October 16, 2026
Here’s a look at the most interesting products from the past week, featuring releases from NinjaOne, Qualys, Scytale, and SolarWinds.


from Help Net Security https://ift.tt/X3mtW9F

New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.


from Schneier on Security https://ift.tt/jlEnRxu

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

Powered by the M6 chip, the compact 2026 Mac mini is currently 13% off at Amazon, dropping its price to $779.99 from $899. That gives shoppers in the Apple ecosystem a small but mighty computer, meant for home offices and creative workspaces short on desk space.

The entry-level model pairs a 12-core CPU and 12-core GPU with 16GB of unified memory and a modest 256GB SSD, but its speed and five-by-five-inch footprint help make up for the limited storage. If you want to upgrade to the 512GB model, you can still get a 14% discount, although it costs $170 more. The Mac mini supports up to three monitors and can handle everyday work and multitasking.

It comes in a sleek aluminum enclosure with rounded corners, and the metal case sits atop a rubberized plastic base lined with cooling vents. It has front-facing USB-C ports and a headphone jack, as well as plenty of connectivity options, including Thunderbolt 4, HDMI, 2.5Gb Ethernet, wifi 7, and Bluetooth 6. For those with iPhones, iPads, and other Apple devices, it also offers seamless integration. PCMag, which gave it an Editors’ Choice award, praises its ability to stay cool and quiet under load, along with its impressive CPU and GPU performance.

Our Best Editor-Vetted Tech Deals Right Now
Deals are selected by our commerce team

from Lifehacker https://ift.tt/yclBLoN

Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms:

Abstract: We estimate how much public cryptanalysis each public-key assumption has received, using the literature itself as the instrument. From roughly sixteen thousand candidate papers we classify cryptanalytic work on ECDLP, structured and plain lattices, syndrome decoding and their comparators, then convert papers into estimated research-allocation years through a person-level author map. These publication-based estimates may substantially overstate actual time spent. Lattices have overtaken elliptic curves in this cumulative measure only recently; we express that history as inference budgets under stated productivity assumptions. The study was conducted by AI models: Claude Fable 5.1 and Claude Opus 5.5 built the pipeline, ran the analysis and wrote this page, with contributions from GPT-6 Astra. Matthew Green set the questions, made the key methodological decisions and oversaw the work.

There are a lot of caveats to this analysis. It relies on published work, so anything unpublished does not count. This includes both academic cryptanalysis that didn’t result in a paper, and intelligence agency cryptanalysis done in secret. But it’s a good first stab at a metric of this sort.


from Schneier on Security https://ift.tt/3Y0Un4X

The worst thing about your favorite chat app is trying to get your friends and family to use it. WhatsApp may be the most popular messaging platform in the world, but in the United States, it is hardly universally adopted. On the contrary, you'll find plenty of people who don't use it at all. In short, it's difficult to get a whole group to commit to any one platform, which can make casual video calls frustrating: If you don't use WhatsApp, and your friends are hosting a call, what are you supposed to do? You can't join a WhatsApp call without a WhatsApp account.

That's now changing. Meta, WhatsApp's parent company, announced "guest calling" on Wednesday. Now, any WhatsApp user can invite any non-WhatsApp user to a call, even if the recipient doesn't have an account. These calls still get the same core perks as traditional WhatsApp calls, Meta says: They're free and end-to-end encrypted, so you won't be compromising on your privacy by calling a non-WhatsApp user this way.

Non-WhatsApp users are still limited. Meta says these users always need a call host's approval to join. If you're a non-WhatsApp user, you'll find yourself in a waiting room until the call host lets you in. Meta also says that you can be kicked off the call at any time, and you won't be able to see other callers' phone numbers. You won't be able to send messages or add other users to the call. You are purely a participant.

How to invite someone without a WhatsApp account to a WhatsApp call

If you're trying to add a non-WhatsApp user to a call, first head to the Calls tab in the app. Here, hit (+), create a call link, then send it to the recipient. Meta says the user can open the link in their computer browser, enter their name, and join. This applies to one-on-one calls as well as calls with up to 32 people. While guests will have the aforementioned limits, they do have some features available to them. They can share their screen, react with emojis, or raise their hand.

WhatsApp isn't the first chat app to offer such a feature. Apple's FaceTime platform, for example, lets you create call links that anyone can join, whether they're calling in on an Apple device or a device running Android or Windows (or Linux, for that matter).


from Lifehacker https://ift.tt/X0hKkBc

We may earn a commission from links on this page.

It turns out the kids can't get enough of John Steinbeck. The Florence Pugh-led, Zoe Kazan-created adaptation of his novel East of Eden has been a massive hit for Netflix, its epic story covering decades in the lives of two California families in the run-up to World War I. And why not? It's got grand family drama and plenty of sex, set against a massive historical backdrop and stuffed with biblical allusions that make it all feel like less of a guilty pleasure. If this is your bag, here are more similar shows to stream after you've finished your binge-watch.

The House of the Spirits (2026)

One generation will inevitably influence those that follow, for better and worse—sins and strengths in equal measure, dramatized most succinctly, perhaps, by Steinbeck's East of Eden and in Isabel Allende's seminal novel, adapted here (indicentally, both books are among the most frequently challenged in the United States). Told from the perspective of Alba (Rochi Hernández), House of the Spirits starts in the 1970s and works backward as Alba explores four generations of family history through he journals of her grandmother, Clara (Dolores Fonzi). Though their country is never named, Allende based it all on the real history of Chile through those decades of political violence and upheaval, and on her own family's triumphs and tragedies in its wake. Stream The House of the Spirits on Prime Video.

War and Peace (2016)

The most recent adaptation of Leo Tolstoy's epic, and a pretty good one. We begin in 1805, during the height of the Napoleonic Wars, meeting Pierre (Paul Dano), the idealistic illegitimate son of an oligarch; romantic and impulsive dancer Natasha (Lily James); and thoughtful, high-minded Andrei (James Norton), destined to become a soldier. Throughout the years of war that follow, the three of them and their families move in and out of each other's lives, as tragedy alternately unites and divides them. Stream War and Peace on Peacock and Prime Video.

Pachinko (2022 – )

Starting in 1915, this multigenerational saga follows one woman (played in different time periods by Youn Yuh-jung and Kim Min-ha) and her family, taking us from the Japanese occupation of Korea through the decades of the Korean diaspora. With her opportunities limited, Sunja leaves her home and family in Busan to pursue a life in Japan, even as racism and anti-immigrant sentiment are rampant amid the war. In a parallel narrative that begins in 1989, we see what has and hasn't changed for Sunja and her family. It’s a journey as personal as it is epic, with better location cinematography than most movies. Stream Pachinko on Apple TV.

The Forsyte Saga (2002 – 2003)

I haven't been the biggest fan of the newer adaptation of the John Galsworthy novels—though The Forsytes has already been renewed for a further two seasons, so I'm apparently in the minority. Nevertheless, I'll direct you back to 2002 and this extended miniseries led by Damian Lewis. It starts off in 1884 when the slightly scandalous engagement of one of the wealthy new-money Forsytes is marred by the revelation of an affair between cousin Joylon (Rupert Graves) and the governess, kicking off an impossibly complicated series of events that plagues the family for decades. Author Galsworthy was inspired to write by his own extramarital affair, so the drama is in the show's DNA. Stream The Forsyte Saga on Netflix.

When Life Gives You Tangerines (2025)

An epic love story that cleaned house at the 2025 Baeksang Arts Awards (that's South Korea's most prestigious entertainment award ceremony), Tangerines stars IU as Oh Ae-sun (and as Ae-sun's daughter and the series' narrator, Geum-myeong), a young woman born in the 1960s on rural Jeju Island. The series spans decades in her life with friend and later romantic interest Yang Gwan-sik (Park Bo-gum), as South Korea changes around them. The focus is more on Ae-sun's own love story than some of these broader narratives, but the scope is epic all the same. Stream When Life Gives You Tangerines on Netflix.

North & South (2004)

Not to be confused with the American Civil War miniseries North and South from the 1980s, this series adapts Elizabeth Gaskell's 1851 novel that follows Margaret Hale (Daniela Denby-Ashe) and her family, forced to leave their Hampshire home and travel to the industrial north of England to avoid religious scandal involving the clergyman father. Poor but well-educated, Margaret runs up against the wealthy owner of the local mill, John Thornton (Richard Armitage), whose family sees her as haughty despite her circumstances; meanwhile, hers sees John and his peers as gruff and inhumane where workers are concerned. Despite their very opposing views, you won't be surprised to learn that Margaret and John find themselves growing closer over the subsequent years, even as their families remain divided. Stream North & South on Prime Video and Tubi.

House of Guinness (2025 – )

There's plenty of upper-crust family drama in this loosely-based-on-real-events series, but it comes from Steven Knight (Peaky Blinders), so expect bloody fisticuffs, too. The first episode begins shortly after the death of Sir Benjamin Guinness, who became the wealthiest man in Ireland by expanding the trade in Guinness beer throughout the British Empire. The cracks begin to show on the way to the funeral: Religious leaders deplore all of the beer-drinking, while Irish Republicans want the company brought down for colluding with the Empire. Sir Benjamin's four heirs have wildly different goals and/or hate each other, so, you know—lots of drama, and lots of beer. The show has been renewed for a second season, so a second round is on the way. Stream House of Guinness on Netflix.

Roots (2016)

Subtitled The Saga of an American Family by Alex Haley in his novel, Roots, in any of its incarnations, is hard to top as an epic family drama grounded in history. Absolutely nothing can match the cultural importance of the 1977 miniseries, also an easy recommendation, which centered the generations-long story of a Black family at a time when such narratives were rare on television. The 2016 version couldn’t possibly have that kind of impact, but it works just the same: it's impressively acted and adds a modern polish that doesn’t detract from the story’s power. Covering much of the same ground, the newer version goes further in focusing on the American family at its center, spending less time leading white viewers into the story that begins with Kunta Kinte (Malachi Kirby) captured in Gambia and sold as chattel. There’s a very reasonable debate about the preponderance of slave narratives in film and television and the purpose they serve for white audiences; while both versions of Roots are unflinching in that area, they also go beyond it by engaging with what came before and after. Stream Roots on Prime Video and Tubi.

The Plot Against America (2020)

A dark turn down an alternate path in American history, The Plot Against America asks: what if Charles Lindbergh had succeeded in his bid for political power in the 1930s, bringing to bear his vision of an America that followed in the footsteps of Nazi Germany by halting the “infiltration of inferior blood” (by which he meant, mostly, Jewish people). Adapted from the book by Philip Roth, the series bends imagination with real history, depicting Lindbergh's successful campaign for the American presidency against Franklin D. Roosevelt, which ultimately keeps the U.S. out of World War II—and which results in things at home growing increasingly dangerous for the Jewish family at the show's center, which splinters between members who advocate for resistance, quiet acquiescence, or active participation. Morgan Spector, Zoe Kazan, Winona Ryder, and John Turturro star. Stream The Plot Against America on HBO Max.

The Thorn Birds (1983)

Rarely has so much drama been sparked by a herd of sheep, but here we are with this blockbuster miniseries adapting Colleen McCullough's novel in suitably grand style. It's set on a sheep station in the Australian outback over several decades in the 20th century. Rachel Ward plays Meggie Cleary, a tough but damaged young woman who becomes the de facto leader of her family after her father uproots the family from New Zealand to New South Wales to live and work on a ranch owned by her wealthy, widowed Aunt Mary (the legendary Barbara Stanwyck, whose performance lives on in "Kiss me on the mouth!" gif reactions). Both Mary and Meggie have eyes for the same man, Ralph de Bricassart (Richard Chamberlain), who just happens to be a priest. It's expensive, star-studded melodrama par excellence. Buy The Thorn Birds from Prime Video.


from Lifehacker https://ift.tt/TsZmiQ4

Gemini 3.1 Pro launched back in February of this year—quite a while ago, in AI terms. Now Google has jumped to the next full number with Gemini 4 Argon, which it says "excels at deep work in complex, real-world tasks."

You can get the new AI model now inside the Gemini app if you're on the AI Pro ($19.99 a month) or AI Ultra ($99.99 or $199.99 a month) plans. Users on the free and AI Plus ($4.99 a month) plans miss out for now, though you can expect a smaller, cut-down version of Gemini 4 Argon to roll out to these tiers eventually.

What can Gemini 4 Argon do?

Google has a long list of areas where the new AI model excels. There's mention of complex engineering tasks (like checking millions of lines of code for efficiency improvements), predicting molecular structures in chemistry, and delivering 3D visualizations. It also enhances knowledge work across legal, finance, science, and coding.

Google says Gemini 4 Argon is now better at advanced physics modeling, picking through genetic databases, protecting software from vulnerabilities, and resolving problems in physical space (handy for robotics development). The new model "answers questions more directly with less hedging, doesn't repeat itself more than necessary, and skips clichés throughout the responses," according to Google.

Google Gemini
Gemini has some suggestions for how to use the new model. Credit: Lifehacker

With many in the industry worried about an AI-driven apocalypse of some form or another, Google has upped its defenses against misuse and jailbreaking. The company has significantly upgraded its blockers for harmful requests, limits on AI agent overreach, and resistance to malicious prompt injections.

All of these stats are things you would expect to read about in a new AI model announcement, whether it's from Google, Anthropic, or OpenAI: "Our new model is better and safer than ever, and particularly good in these specific benchmarks we've chosen." But is it any more helpful for the average user tapping away in the Gemini app?

I don't have any pressing scientific breakthroughs to research or large-scale software optimizations to run, but I have put Gemini 4 Argon to the test against GPT-6 Sol, which is the latest model available to consumers through the ChatGPT app—though you need to be on at least the Plus plan ($19.99 a month) to get to it.

Testing Gemini 4 Argon against GPT-6 Sol

Make no mistake: Both of these new AI models are quite capable. I first prompted Gemini 4 Argon and GPT-6 Sol with the following: "Using information online, create a web app I can run locally that plots the lighthouses of the world on a map. Clicking on a lighthouse should give me some details about it, show how far its light reaches, and display a simple 2D model showing its shape and height (if known). Put a lighthouse keeper in each model pop-up for scale."

At the highest, slowest levels of "thinking," these AIs took a while to get back to me: Nearly 10 minutes for Gemini and almost 26 minutes for ChatGPT. Both hit the same problem—restricted access to map data online—but both were able to make a rudimentary world map of their own when prompted a second time.

The ChatGPT effort, dubbed "Beacon," wasn't bad, apart from a bit of map clunkiness (it clearly needs to work on its cartography skills). It presented plenty of information, laid out everything well, and gave me nice, neat diagrams on each of the lighthouses featured. The day/night mode worked fine, and it was an impressive bit of coding work, even if it did take 26 minutes.

However, the Gemini effort, called "Pharos," was better in almost every respect. The map was more detailed, lighthouses actually showed their light range (with an impressive animation), and there was more information on each location—perhaps due to Google's expertise in web search. Some of the layout choices were a bit off, but Gemini 4 Argon produced what was clearly the superior app in less than half the time.

OpenAI ChatGPT
ChatGPT's lighthouse map was pretty good—but had its problems. Credit: Lifehacker

Next, I fed PDFs of 10 recent scientific studies into each AI model. The prompt: "Give me a brief summary of each of these studies in plain English, with a single sentence each for the main finding, one study strength, one study weakness, and the main implication." While I hadn't read the studies through entirely myself, I had read news stories on all of them, and I lowered the "thinking" level to low.

This time ChatGPT was faster—25 seconds versus Gemini's 55 seconds—and gave what I thought were the better summaries, at least for my purposes. Gemini did well, and its answers were accurate and to the point, but the summaries ChatGPT gave were easier to understand and shorter. ChatGPT also offered some overall thoughts on the most promising study, which Gemini didn't.

Finally, I checked the imagination and creative juices of the models: "With the success of the Apple TV shows Severance, Slow Horses, Silo, and Widow's Bay, give me five pitches for new show ideas on the platform that combine elements from some or all of these shows. Try and be as original as possible and keep each pitch to around 100 words." I put the "thinking" level back up to "high" for this job.

Google Gemini
Gemini's lighthouse map offered more information and a better layout. Credit: Lifehacker

(Is this how Apple TV executives actually get their ideas nowadays? I hope not.) As far as the answers the AIs gave me, Gemini was faster than ChatGPT (1 minute and 28 seconds against 3 minutes and 48 seconds, respectively), and both served up responses that were a bit more literal in their mashing up than I wanted: failed secret service agents and supernatural terrors abounded, which is I suppose what I asked for.

The ideas were mostly "Widow's Bay set somewhere else" or "Slow Horses set somewhere else," and didn't make a whole lot of sense for the most part, but the best Gemini offering was about a Silo-style underground bunker whose operators go through a Severance-style procedure every 24 hours: outside, the bunker protecting it from zombies by night; inside, the bunker planning social activities for residents by day. It's not perfect, but I might watch the trailer at least.

My favorite of the ChatGPT suggestions was a show about a remote, Severance-style weather station whose employees discover they're not recording the weather—they're creating it. Again, it didn't really logically hold up, but overall I found the suggestions from GPT-6 more nuanced, more likely to be an actual show, and better "thought" through. Maybe Gemini should've given itself more time to "think."

This is only a narrow set of quick tests, but, in my view, it seems Gemini is back to, at the very least, an even playing field with ChatGPT. It performed much better on the lighthouse task, though its summarizing and TV show pitching weren't quite as impressive. Access to the best models requires a subscription on both platforms, but if you're able to, it's worth comparing them against each other on the jobs you most commonly need AI for.


from Lifehacker https://ift.tt/7aj2PUA