The Latest

Intent-based networking (IBN) lets operators state the outcome they want and leaves its translation into network policy to software, an approach AI-native 6G designs have moved to the forefront. Researchers at the University of Ottawa and Nokia Bell Labs argue that this abstraction gives attackers new openings, and it tests two machine-learning detectors against one of them.

intent injection attacks

Threat model−Malicious intent injection through vulnerable API (Source: Research paper)

The authors call that threat adversarial intent injection: hiding malicious instructions among legitimate ones. They evaluated their detectors on 1,100 intents they constructed, partly with a large language model’s help, so the reported figures describe performance on that dataset.

The entry point

Intents are machine-readable requests, often in JSON, that an IBN system turns into network policies. The researchers focus on the point where requests are accepted: an attacker with a compromised API key submits intents that pass as routine updates. The paper names denial of service, privilege escalation, traffic redirection and backdoors as possible consequences; its experiments are limited to detecting the injected intents.

For malicious examples, the team wrote 20 base attack intents, covering threats such as phishing and data exfiltration, and produced nine variants of each. One variant turns a rule that drops traffic with logging enabled into one that null-routes it with logging set to a limited mode. To model ambiguity, the authors relabeled 40 malicious intents as benign and 90 benign intents as malicious.

As a check for easy keyword giveaways, they built a rule-based classifier from 88 terms they classed as strong discriminators. Across the full dataset it caught about 10% of malicious intents, although 96% of the intents it flagged carried a malicious label.

Reading the sequence

The researchers’ bet is that attackers can give themselves away in how they space out their requests. To test that, they built four versions of their data, with malicious intents arriving at a fixed average pace, scattered at random, speeding up over time, or slowing down.

Their detectors look at short runs of consecutive requests, up to six at a time, and flag runs likely to contain a malicious one so a person can review them. The authors found that longer runs generally helped, with some exceptions.

They tried two kinds of detector. One learned from examples labeled safe or malicious. The other studied only normal activity and raises a flag when something departs from that pattern, an approach the authors pitch for teams with little advance knowledge of what attacks look like.

The first detector caught between three-quarters and 96% of the runs containing malicious requests, depending on the attack pattern. The second caught the most of any method tested in three of the four patterns, but it had trouble with the fixed-pace attack, missing about a third of those runs.

Both caught more than an earlier detector that judges one request at a time, which flagged roughly half to 60% of malicious cases across the four patterns.

Open questions

In future work, the team plans to add more varied JSON policy configurations that better reflect real IBN deployments, and to use explainable-AI methods that make detection decisions easier to interpret.

Download: The Agentic Software Development Guide


from Help Net Security https://ift.tt/DBVMEko

Forty percent of large companies had an AI-related compliance or governance issue in the past 12 months, according to 1,000 senior IT, operations, and transformation leaders surveyed by Sapio Research. Those leaders said process-related problems contributed to 84 percent of the incidents.

AI compliance issues

The researchers trace the exposure to workflows designed around people. Approvals, handoffs, and manual exceptions exist because a person was expected to handle each step. When a company drops AI into that design, checks sit at the wrong point, work changes hands with nothing written down, and the audit record cannot show how a decision was reached. A CISO who has to explain an AI-assisted decision to an auditor may find the evidence was never captured.

The researchers point to two incidents. In one, a coding agent wiped a startup’s production database, backups included, within nine seconds. In the other, AI models under a cyber evaluation broke out of their test environment and spent four and a half days acting on live infrastructure, unseen while it happened.

Employees are working around the tools

Sapio also surveyed 5,000 employees who use AI or automation at work, and most of them worry that their own AI use will cause a compliance problem. Many already route around the tools. They override AI output when the process behind it was set up wrong, and they redo work by hand when they cannot tell how the system reached its answer. Most said nobody fully consulted them about how AI would fit into their jobs.

Some employees admit they use AI only to satisfy a company mandate. That means adoption figures on a leadership dashboard can overstate how much real work AI is doing. Leaders are also more convinced than their staff that AI is making people more productive.

Redesign is stalled

Most leaders say their companies need to rebuild workflows around AI to stay competitive. Two-thirds say compliance concerns are slowing that work, so the risk that makes redesign urgent is also holding it back. Leaders estimate that adapting their most important processes will take four years on average.

The money mostly goes to infrastructure, licenses, and models, and process redesign gets a small share. Leaders put the average cost of AI projects that failed because of process problems at $1.55 million per organization. Most also concede that adding AI to existing workflows draws fewer objections inside the company than a full redesign, which helps explain why the shortcut stays popular.

Download: The IT leader’s guide to AI code sprawl


from Help Net Security https://ift.tt/qN26Znb

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

Week in review

What we know about the Revolut data breach so far
Someone impersonating a government agency, using an email address on that agency’s domain, obtained sensitive customer records from Revolut. The bank confirmed the incident on Saturday, September 12.

DeepZero: Open-source hunting for vulnerable Windows drivers
DeepZero is an open-source engine that automates the search for exploitable Windows kernel drivers. You point it at a folder of binaries and it parses them, pulls them apart, scans them, throws most of them away, and asks a language model whether what survives can be attacked. Pipelines are written in YAML, the code is Python 3.11 and up.

What happens when AI agent governance is missing at scale
In this interview with Help Net Security, Gourab Basu, Global Head of Engineering at meshIQ, discusses governance in AI agent systems. He argues that instructions written into a prompt are not enough to control what an agent does, since agents can change their own path as they work. Real control means checking proposed actions before they reach production systems, such as pausing a large refund for human approval.

Self-improving AI should slow down, von der Leyen tells EU lawmakers
European Commission President Ursula von der Leyen wants frontier AI development slowed, and said on Wednesday that she will invite the leading AI labs to discuss how the EU can support their own efforts to do that. In her State of the Union address to the European Parliament in Strasbourg, she also committed the EU to joint work with Canada, the U.K. and other partners on evaluating and verifying advanced models, early warning and AI security.

AI is adding to the review load on open-source projects, many of them thinly funded
AI coding tools are making open source software harder to maintain and secure, according to six authors writing for the Association for Computing Machinery’s Technology Policy Council, among them Simson Garfinkel and Josiah Dykstra. The tools write code and find security flaws quickly. The maintainers who decide what enters a project’s official release still have to judge that output themselves.

The AI security question leaders should be asking instead
In this Help Net Security interview, Frederic Bull, Security Officer at Gremlin, talks about what AI means for security teams. The conversation covers why asking what data a model was trained on is only part of the picture, and why least privilege and access controls still matter for AI agents.

Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)
Attackers have leveraged a zero-day SQL injection vulnerability (CVE-2026-76461) to compromise Cisco Secure Email Gateway appliances, Cisco confirmed on Monday. The vendor’s Product Security Incident Response Team became aware of active exploitation of this vulnerability in September 2025, and has shared indicators of compromise that organizations can look for to check whether they’ve been hit.

Acronis backup plugin flaw exploited in targeted attacks (CVE-2026-87886)
A Linux privilege escalation vulnerability (CVE-2026-87886) affecting Acronis’ backup extensions for cPanel, WebHost Manager (WHM), and Plesk, is being leveraged by attackers, the backup and recovery company warns.

Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)
A newly disclosed vulnerability in Parallels Desktop, tracked as CVE-2026-90894 and dubbed “ParaShells,” can allow any local user on a Mac to gain root privileges on the host system. The danger is highest on developer laptops, where a single poisoned Homebrew formula or malicious npm preinstall script can go from local user to full control, and on shared university and corporate machines that have many local accounts, JFrog vulnerability research team lead Yuval Moravchick noted.

Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460)
Two days after it warned customers about an actively exploited email gateway zero-day, Cisco confirmed one more flaw is being targeted: CVE-2026-76460, an authentication bypass bug in an API of Cisco Identity Services Engine (ISE). It checks connecting users’ identity, profiles devices and checks their security posture, grants users the right type of access, and logs it all.

CISA wants critical infrastructure orgs and smaller security teams to start using cyber decoys
Cyber deception has long been the domain of well-resourced security teams, but CISA’s latest guidance, titled “Using Cyber Decoys to Strengthen Detection and Response”, is an attempt to try and change that. The core problem CISA is attempting to address is that many organizations are incapable of detecting adversaries who use legitimate credentials, built-in administrative utilities, and living-off-the-land (LOTL) techniques.

The modern attack chain: Rethinking Google Workspace security in the age of AI
Over the past two months, Rajan Kapoor, VP of Security at Material Security, has written about the Vercel and Composio breaches separately. They show the same attack against different targets, with email not used as the entry point into the workspace.

The world must establish red lines for autonomous AI weapons
AI is transforming warfare and international conflict. Autonomous weapon systems pose a genuine threat to civilians. The war in Ukraine has become a proving ground for weapons that can navigate, identify targets, resist electronic countermeasures, and pursue and engage targets autonomously without the need for human control.

A flat cybersecurity budget doesn’t have to mean weaker coverage
Cheri Hotman, Managing Partner of Hotman Group, works as a vCISO and vGRC leader. In this Help Net Security video, she talks about holding coverage steady when the CFO asks for a flat budget or a 12% cut.

Cybersecurity attention fades within months after a breach
Cybersecurity attention often rises after an incident, then recedes as organizations return to their existing priorities and practices, according to a new ManageEngine survey of 700 IT and cybersecurity leaders in the US and Canada.

Permify: Open-source authorization as a service
Permify is an open-source authorization service that answers access questions at run time: can user X view document Y, which posts can members of team Y edit. It keeps those rules in one place, apart from the application code that would otherwise carry them.

Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages
The Debian project shipped Debian 13.7 codenamed “trixie.” The project folded in 92 security advisories it had already published separately, added corrections to 106 source packages, and rebuilt the installer around both.

WhatsApp Restricted Chat locks a conversation to your primary phone
WhatsApp is building a per-chat setting that keeps a conversation on a single phone. The setting, called Restricted Chat, sits in the Android beta distributed through Google Play as version 2.26.36.5, and it stops the app from syncing a chosen conversation to linked devices. Switch it on and the chat stays on the primary mobile device, out of reach of WhatsApp Web and any secondary phone signed in to the same account.

ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities
The EU Agency for Cybersecurity switched on the Cyber Resilience Act‘s Single Reporting Platform on 11 September 2026, the same day the law’s reporting obligations started binding manufacturers. ENISA built the tool and runs its day-to-day operations, a job Article 16(1) of the CRA hands to the agency.

Homebrew 7.0.0 is out, here’s what changed for security
Homebrew installs command-line software and desktop applications from the terminal on macOS and Linux, and Mac developers use it to set up their machines. On Sunday the project shipped version 7.0.0 and closed eight security advisories with it. The most serious of them let unsigned removal metadata for a cask, Homebrew’s recipe for installing a prebuilt application, execute commands with sudo. Homebrew deleted the vulnerable recovery code and the API accessors that reached it.

Most chief audit executives can’t tell you what AI is worth yet
Auditors are using AI in their daily work, and their departments have mostly left them to figure it out alone. 93% of audit leaders and auditors report some level of AI use, while 15% say their department has deployed formal use cases and runs them routinely in audits, according to Gartner.

Attackers hijack HBO Max’s Reddit account for 48-hour malvertising blitz
Attackers compromised the verified official HBO Max Reddit account, u/hbomax, and used its trusted advertising status to launch a ClickFix campaign targeting macOS and Windows devices with information-stealing malware. ClickFix has been rising in popularity among cybercriminals. It’s a social engineering technique that cons victims into running malicious commands on their own machine, usually by pretending the commands are needed to fix a problem or perform routine upkeep.

Uncensored AI sold on hacking forum as alternative to ChatGPT and Claude jailbreaks
A new AI subscription service called Luciferus is being marketed on a hacking forum as an alternative to jailbreaking ChatGPT or Claude, Sophos found. The Counter Threat Unit (CTU) spotted the advertisement on August 24 on the Exploit forum, posted by a persona going by “Optimus_Prime.” The account joined the forum on April 18 and has since published 21 posts. Its profile carries a “coding / coder” label.

Iranian hackers use CHOSEN BRICK data-stealing malware to spy on dissidents and journalists
Iranian state cyber actors are deploying malware called CHOSEN BRICK against individuals they see as a threat to the regime, reaching victims through social messaging apps and infecting their Windows devices, three Western intelligence agencies warned.

CenterPoint Energy confirms data breach following claims on hacking forum
CenterPoint Energy disclosed that an unauthorized third party got into customer data through one of its external systems, after online claims by a hacker that millions of records had been stolen from the company.

AWS’s new sign-up gives accounts spend caps, email invites, and agent-set permissions
New AWS customers can now sign up with a Google, GitHub, or Apple login, start with $100 in Free Tier credits, and build inside a “project” where AWS and coding agents set up permissions automatically. Paid projects get a monthly spend limit, starting at $20, and a project that reaches its limit is halted instead of running up more charges.

Spain reports first data breach involving autonomous AI agent
Spain’s data protection authority (AEPD) has reported its first data breach blamed on an AI agent acting on its own, after the system reportedly logged into a company’s network, found a way to alter personal records, and pulled invoice data.

Scammers leave AI fingerprints all over fake antivirus renewal page
AI appears to be helping scammers with little web development skill build convincing fake antivirus-renewal pages, Malwarebytes found. The researchers came across a scam page impersonating Avast, aimed at users in Belgium, that was more polished than most sites of its kind. The page told visitors their Avast Premium Security subscription had renewed for €129.99, covered five devices, and would renew again in February.

FBI takes down one of the longest-running DDoS-for-hire services
The FBI has seized the domains behind NightmareStresser, a DDoS-for-hire service officials call one of the longest running “booter” operations in existence. These attacks are called booting because they result in the dropping of the targeted computer from the internet.

Iranian strikes on AWS facilities left customer data beyond recovery in Bahrain, UAE
Six months after Iranian drone strikes tore through its Middle East infrastructure, Amazon Web Services (AWS) has acknowledged the permanent loss of customer data in Bahrain and the UAE. In two updates posted September 15, AWS said it can no longer recover customer data and resources stored in its Middle East (Bahrain) region, known as me-south-1, or in one availability zone of its Middle East (UAE) region, known as me-central-1.

Abandoned IoT apps keep sending sensitive data to broken servers
Millions of people still run smart home and IoT companion apps, the apps used to control devices like smart plugs, cameras, and thermostats, that stopped receiving updates years ago. Researchers at the University of Massachusetts Amherst analyzed 61,500 abandoned Android IoT apps and found that nearly three in four contained software dependencies associated with documented vulnerabilities.

Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched
Four major AI coding agents, Claude Code, Codex, GitHub Copilot and Gemini CLI, all share the same zero-click RCE vulnerability, one that could give an attacker the same reach into a company’s systems and data as the employee running the agent, according to AIR.

Bots with good manners are better at fooling people on social media
Most people can’t tell a bot from a human online, and the bots most likely to fool them are the polite ones, according to a new Surfshark study. The company analyzed 1,722 participants worldwide, testing their ability to separate human comments from AI-generated ones in a social media setting. Overall, people caught just 40% of the bots placed in front of them.

AWS puts AI vulnerability detection to the test, and false positives pile up
AWS’ Deception Benchmark measures how well AI models distinguish genuine security vulnerabilities from code that looks risky but is safe. AWS is making it publicly available so researchers can use the dataset and evaluation process without repeating the cost of generating and refining the samples.

Certificate failures can cost firms over $250,000
The move toward 47-day public TLS certificates by 2029 will increase the certificate management workload for enterprises, according to DigiCert’s Certificate Management Outlook. Organizations will need to renew certificates more than eight times as often as under the previous certificate lifecycle and conduct 40 times as many domain validations.

Turn it off and on again, but for critical infrastructure
Researchers at KTH Royal Institute of Technology built a container replica of a segmented industrial network, attacked it repeatedly across 14 days of running time, and used the captured traffic to train a defense agent that decides on its own when to intervene.

Apple parental controls in iOS 27 let kids ask before opening new websites
Apple has overhauled the child-safety tools that ship across iPhone, iPad, and Mac. One idea runs through the redesign. Give a child a device that does very little, then open it up as they’re ready. The tools went live on September 14, after a preview in June, and they require iOS 27, iPadOS 27, or macOS 27.

Your employees are already using AI tools you never approved
Seventy-four percent of respondents report departmental or scaled AI adoption at their organizations, including within individual teams or departments, across business functions, and as part of processes and operations, according to the latest OneTrust 2026 AI-Ready Governance Report. The remaining respondents are planning, evaluating, or experimenting with AI, while 1% report no AI use.

Product showcase: mSecure makes one vault do more than remember passwords
mSecure is a password manager and data vault for storing credentials and other sensitive information. It is available for iOS, Android, macOS, and Windows, with data synchronization across supported devices.

Microsoft sets security and safety rules for its AI models
Microsoft AI has published the first draft of its Humanist AI Code of Conduct, a training manual outlining how it develops AI models and intends them to behave during deployment. The draft is open for public consultation for six weeks. The company plans to review the feedback, revise the document, and publish an updated version later this year. That version is expected to guide model development from 2027 onward.

MSPs say nearly half their customers rely on them for CISO services
MSPs estimate that 46% of their customers, on average, look to them to act as CISOs, according to Sophos. Most of those providers do that job without the full set of compliance services, and many spread the work across several tools.

NIST and CISA finalize playbook to stop token theft and forgery
NIST and CISA have finalized guidelines to help federal agencies and cloud service providers (CSPs) protect identity and access tokens from forgery, theft, and misuse. The guidance, Protecting Tokens and Assertions from Forgery, Theft, and Misuse (NIST IR 8587), explains how agencies and cloud providers can strengthen key management, token verification, and token lifecycle controls. It also covers how identity providers and authorization servers should be designed and managed.

https://www.helpnetsecurity.com/2026/09/16/google-mandiant-enterprise-ai-security-risks-report/
Mandiant’s latest AI Risk and Resilience report, which draws on observations from Mandiant and Google Threat Intelligence Group (GTIG), warns that a poisoned data source, model dependency, or extension hook can turn a trusted agent into a channel for internal reconnaissance, lateral movement, or autonomous escape from a sandbox.

GNOME 51 adds passkey logins, offline maps and drawn PDF signatures
GNOME 51, the new version of the Linux desktop, came out on September 16 under the codename A Coruña. The release adds offline maps and live transit information to Maps, new login options at the login screen, hand-drawn signatures in the Papers document viewer, and smoother animations when the system is under load. Fedora 45 and Ubuntu 26.10 will ship it.

Fake AI trading agent steals crypto wallet passwords
Attackers built a website for a fake AI crypto trading agent and used it to install Needle Stealer, malware that replaces a victim’s browser wallet with a copy that sends the wallet password to the attacker. HP caught the campaign between April and June 2026.

Google’s new agent security system detects tool misuse, loops and rogue behavior
Google’s Agent Anomaly Detection is a reasoning-based oversight and audit layer for autonomous agents deployed on Agent Runtime in the Gemini Enterprise Agent Platform and built with the Agent Development Kit (ADK) for Python 1.2 or later. Google recommends ADK 2.1.0 or later. It is available in Private Preview.

A fake ChatGPT billing email is after your OpenAI password
A fake ChatGPT billing email is steering users to a copy of the OpenAI login page that keeps whatever username and password they type. Josh Varden of Cofense’s Phishing Defense Center traced the email’s payment button through a Google redirect to the attacker’s page.

Most WordPress pros still lack a breach recovery plan
Melapress, a maker of WordPress security plugins, surveyed 319 WordPress professionals and found that most had dealt with at least one known security incident. The respondents build and run WordPress sites for a living: agency staff, developers, designers, site owners and administrators.

98% of fraudulent hires have company credentials by the time they’re caught
A 90-day period between hiring and onboarding is creating a blind spot in enterprise identity security, according to HYPR’s State of HR Identity Fraud Detection report.

Hardcoded MCP credentials found in public GitHub files
Hardcoded API keys, access tokens and other credentials used by AI coding tools have been found in publicly accessible MCP configuration files on GitHub, according to research from Hush Security’s The State of MCP Configuration: The Identity Security Gaps report.

Android apps can now check security patches down to individual device components
New AndroidX Security State libraries provide a more granular way to determine how securely patched an Android device is. The stable Security State v1.1.0 and Security State Provider v1.0.0 libraries allow developers to check the security status of individual device components and determine whether security updates are ready to be downloaded and installed on a specific device.

eBook: Identity-First Threat Intelligence
Download the e-book to learn how infostealers are changing credential theft, how password reuse creates enterprise risk, where IAM and Active Directory controls can fall short, and how Enzoic uses credential intelligence to detect exposed and compromised credentials.

Download: The IT leader’s guide to AI code sprawl
Employees across the business are using AI tools to create apps, agents, and automations, often outside established IT processes. That can leave IT and security teams with code they don’t know exists and risks they can’t easily assess. This Tines guide looks at the practical impact of AI code sprawl, how to assess your organization’s exposure, and how IT can put appropriate controls in place without preventing teams from building.

Cybersecurity jobs available right now: September 15, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

New infosec products of the week: September 18, 2026
Here’s a look at the most interesting products from the past week, featuring releases from Akuity, Bitsight, Cohesity, Dataminr, Nozomi Networks, and Tuskira.


from Help Net Security https://ift.tt/WDVqpid

We may earn a commission from links on this page.

Unless you're shopping from a wishlist, buying a book for a big reader is always a fraught prospect. Have they read it? Will they like it? Will they be offended at the mere suggestion that you think it's the kind of book they might like? Will you be crushed when you give them a copy of your favorite book and they never get around to reading it?

Buying a gift for someone who prefers to read e-books—whether on a Kindle or one of the many excellent non-Kindle alternatives—can be much less emotionally charged: Instead of risking everything by giving them a book, just get them a cute e-reader accessory (if not a new e-reader) that they will thank you for every time they dive into a good read.

A truly pocketable travel e-reader: The Xteink X4 Pro

THe Xteink X4 Pro next to a set of AirPods Pro 3 for scale
Credit: Joel Cunningham

Chances are good your giftee already owns a Kindle, but there's room for another e-reader in their life—especially when it's as small as the Xteink X4 Pro ($99). TikTok and Reddit are obsessed with this tiny, quirky device from a Chinese tech startup that has taken the e-reading world by storm over the past year, and it's not hard to see why: For under $100, you can get a palm-sized, single-purpose e-ink device that will disappear into any pocket, so you can truly take your books with you wherever you go. (Promotional images even show it magnetically attached to the back of a smartphone.)

While the first Xteink device could be clunky and cumbersome to use, the new X4 Pro has improved software and quality-of-life updates like a faster processor, more RAM, a touchscreen, and a front light. It isn't the ideal primary device for every reader, but as an ultra-portable alternative for reading on the go, it's hard to beat—though competitors have popped up to give it a go. Learn more about the device (and its potential drawbacks) in my full Xteink X4 Pro review.

An e-reader that can curb any smartphone addiction: The Boox Palma 2 Pro

If you've got more to spend and want to give a potentially transformative gift, consider the Boox Palma 2 Pro ($399.99), part of the family of phone-shaped devices that kicked off the small e-reader craze (and helped me kick my own doomscrolling habit). It has a 6.13-inch color e-ink screen and runs on an open Android operating system, which means it can connect to the Google Play Store and run any reading app, from Kindle to Nook. That means your giftee will be able to read all of their existing e-books wherever they're from, and get new ones from anywhere. It can connect to the internet via a mobile SIM and works with a stylus, so it also makes a great productivity and note-taking device, but with a screen that's easier on the eyes, less stimulating, and subsequently, much less addictive than a smartphone. Learn more about it in my full Boox Palma 2 Pro review.

A remote page turner: The Boox Tappy

Boox Tappy next to a Boox Go 6
Credit: Joel Cunningham

Typically, to turn pages on an e-reader, you have to press a button on the side of the device or, more often, tap the screen—but there's a better way: Bluetooth page turners connect to an e-reader and make it possible to turn the page by clicking a remote that you hold in your hand. This is obviously great for anyone with motor control issues, arthritis, or any disability that makes manipulating a screen difficult, but honestly, they can be pretty useful even if you don't experience anything of the sort. With a Bluetooth remote like the adorable Boox Tappy ($30), you can keep your hands under the blanket while you read with the e-reader propped in your lap, or enjoy a snack without worrying about getting Cheeto dust all over your touchscreen. My first reaction when testing one out was "this seems cute but unnecessary," but after a few reading sessions, I found it let me read more comfortably, no matter how I was sitting or what else I was doing.

Now for the bad news: Kindle devices don't support Bluetooth remotes. The list of compatible devices includes, well, basically any other kind of e-reader, whether one that runs on Android (like a Boox Go 6) or a Kobo like the Clara Colour (all Kobo devices support Bluetooth accessories). If your giftee has a Kindle, you'll need to get a radio frequency remote that turns pages by physically tapping the screen for you.

A pillow stand that doubles as a snack bowl: The SupeDesk Tablet Pillow Stand

If you have a Bluetooth page turner, it only makes sense to pair it with a hands-free stand that will allow you to position your e-reader where you can use it most comfortably without having to physically hold it (that's for chumps!). Though you can get a utilitarian stand with a flexible neck, I kinda dig this $45 fuzzy pillow design that doubles as a bowl for your reading snacks. It's adjustable, so it can hold most any size e-reader or tablet.

A strap to make long reading sessions more comfortable: The Strapsicle

E-readers are generally pretty light, but holding anything for a long time can make your hands tired (and yes, I do occasionally get exercise and lift things that weigh more than my iPhone). You can extend your reading sessions with a strap that attaches to the edges of your device across the back so it will remain firmly in your grip without you actually needing to grip it at all. I've personally tested and can vouch for the Strapsicle ($20), available in sizes that will fit select Kindle and Kobo models, but you can also try this cheap, more universal alternative.

An easily personalized case: CoBak Clear Plastic Case With Magnetic Ring

There are a ton of different patterned e-reader cases out there, but it can be tricky to pick one that your giftee will appreciate enough to happily carry it around every day. Instead, get them a clear case with a magnetic ring like this seven-inch-compatible one from CoBak. They'll be able to easily customize it by putting stickers underneath, and the MagSafe-esque ring will allow them to attach the PopSocket kick-out grip ($14) you've also thoughtfully gifted them. (Those also come in countless colors and patterns—I guess you're just going to need to take a risk at some point.)


from Lifehacker https://ift.tt/nCEUHY9

We may earn a commission from links on this page.

If you're planning on giving home entertainment gear as a gift this holiday, forget about traditional benchmarks like "biggest screen" or "most expensive speakers." Match the gear with the personality and needs of the person being entertained by that home entertainment system instead. Below are my best picks for everyone from college kids squeezed in a dorm room to legacy media snobs for whom streaming video isn't an option.

Best overall home entertainment gift of 2026: Philips Hue Play HDMI Sync Box 8K

You probably won't buy someone a new TV for the holidays, but you can give the media-hound on your list a gadget to make the TV they already own even better. Enhancing watching and gaming is the mission of the Philips Hue Play Sync Box. It’s a middleman between TVs and HDMI gear like consoles or streaming boxes that analyzes video signals in real time and tells the connected smart light strip (as well as other compatible smart lights) to match what's on screen. This is great for gaming immersion, but it also improves just watching TV. Projecting colors behind the set that complement the visuals gives the illusion of a bigger screen, and it's just cool.

Best home entertainment gift for the legacy media snob: Magnetar UDP800 MKII

The Magnetar UDP800 isn't for casual media consumers, but if you're giving a present to the type of person who sneers at streaming and demands picture and sound at the highest possible quality, consider a Magnetar. This thing is monster. Magnetar laughs at the compression of Netflix by reading 4K video at bitrates up to 100 Mbp. It humiliates Spotify with lossless audio in formats like Dolby TrueHD and DTS-HD Master Audio. It's also a true universal player, handling everything from 4K UHD Blu-rays and standard DVDs to Kodak Picture CDs. Like the best niche gear, it's expensive, but I'm sure your purist is worth the cost.

Best home entertainment gift for the minimalist: Anker Nebula Cosmos 4K

Most take it as a given that a huge, semi-matte black rectangle will dominate every living room like the monolith from 2001, but some people don't buy into it. If there's someone like that on your list, the Anker Nebula Cosmos 4K projector is the perfect gift. It's small enough that they can put it in a closet to keep their decor pure and pretend they don't even know what a television is, and it still projects a crisp, 4K image on any flat wall so they can watch Love Island in high def when everyone else is asleep. The portability makes it perfect for a backyard film festival too.

Best home entertainment gift for the student gamer: ROG Xbox Ally X20

If there's a college student who plays video games on your Secret Santa list (and every college student plays video games), send them back to the dorms with a ROG Xbox Ally X20. This versatile system functions as a portable game system for killing time between classes with either PC or Xbox games. It hooks right up to a cheap dorm TV for late-night gaming sessions, and it runs a full version of Windows 11 for actually doing work.

Best home entertainment gift for new parents: Anker Soundcore Sleep A20 Earbuds

It's wild that there is a class of audio equipment designed for people to not listen to, but these earbuds solve a real problem, particularly for anyone with young children. Soundcore Sleep A20 Earbuds contain a noise-masking system designed to block out any unwanted sounds and improve your sleep. They're designed with the ergonomic needs of sleepers in mind, and they even track your "sleeping analytics" so you can make sure your slumber is up-to-par. If your giftee would rather not collapse into dreamless sleep through white noise, these can be used as normal Bluetooth earbuds too.

Best home entertainment gift for empty nesters: Samsung S95H OLED TV

You ever see the movie All that Heaven Allows? Jane Wyman plays a widow who starts dating a much younger man, but her children don't approve of the soulful lumberjack, so they wreck their relationship, then give her a TV so she doesn't get lonely in her tomb of a home. You will not be creating the same energy by giving the empty nesters on your list a Samsung 95H: That lumberjack was sort of creepy, and having an empty nest is cool, actually. An ultra-thin, 77-inch 4K OLED TV is better than human connections anyway: This is a really nice television. The design is tasteful—thin metallic frame, matte display surface—and the picture is about as good as you can get in 2026.


from Lifehacker https://ift.tt/36FGAtE

We may earn a commission from links on this page.

Outlander filled a void no one suspected existed (probably). Based on the bestselling book series by Diana Gabaldon, this epic love story about a time-traveling woman who plunges into the messiest extramarital affair ever known was one of the most popular shows on TV screens, and inspired some intense fandom. If you were one of the show’s superfans and you’re not quite sure how to fill your time now that Claire and Jamie’s story is done, there’s some good news: The best movie for Outlander fans to watch was released decades ago, in 1980.

Somewhere in Time is the best movie for fans of Outlander

Based on the 1975 novel Bid Time Return by Richard Matheson, Somewhere in Time is one of those movies that people still talk about almost fifty years after its release—and it’s a spookily perfect companion to Outlander.

Christopher Reeve, fresh off his star turn in Superman, plays playwright Richard Collier. While on a road trip, he stops at the Grand Hotel and sees a photo of Elise McKenna (Jane Seymour), who was a famous actress in the early 20th century. He realizes that an elderly Elise had given him an antique pocket watch years earlier, and comes to believe that time travel is possible and begins planning for a trip back to 1912—succeeding after several tries.

In the past, he meets Elise, and they fall madly in love—but her manager sees Richard as a threat to her career, and does everything he can to thwart them. It’s a story that parallels Outlander’s in many ways, especially when Claire decides to return to the 18th century to seek Jamie after she learns that he’s still alive. Richard’s determination to stay with Elise no matter what ends up in tragedy (something else fans of Outlander are familiar with), but the story asks a simple question: Isn’t suffering worth it if it leads you to true love?

Somewhere in Time doesn’t get to dig as deeply into Richard and Elise’s love story as Outlander does with Jamie and Claire, of course—the series was able to linger on their story over more than 100 episodes. But the film captures the same powerful moment of connection as two people overcome the most fundamental obstacle in the universe—time—in order to be together. Fans of the show will love it. Stream Somewhere in Time on The Roku Channel, Tubi, or Plex, or rent it on Prime Video.

More movies for fans of Outlander

Iif you still need more timeless time-travel romance in your life, there are more movies to check out.

Kate & Leopold (2001)

Frothier, funnier, and sillier than Outlander or Somewhere in Time, Kate & Leopold is the story of Leopold, the impoverished Duke of Albany (Hugh Jackman). Living in New York City in 1876, he is on the verge of inventing the Otis elevator when he chases a man through a time portal and finds himself in 2001. There’s a lot of plot about elevators and temporal paradoxes, but Outlander fans will come for the romance Leopold falls into with the man’s ex, Kate McKay (Meg Ryan). The thoroughly modern Kate is wooed by Leopold’s old-fashioned charm and intelligence, and it leads to one of those classic romcom moments where someone has to race to be with their soulmate, except instead of a plane they’re racing toward a time portal, as one does. Rent Kate & Leopold on Prime Video.

The Two Worlds of Jennie Logan (1979)

Another film adapted from a novel (Second Sight by David L. Williams), The Two Worlds of Jennie Logan stars Lindsay Wagner as Jennie, a woman who moves into an old Victorian house with her estranged husband, who has confessed to an affair. Legends about the house center on a previous owner, David (Marc Singer), who claimed to see the ghost of his dead wife and supposedly died in a duel. When Jennie finds an old dress hanging in a closet and tries it on, she finds herself transported to 1899 several times. When she finally meets David, she realizes she was the “ghost” he spoke of. They fall in love, but a jealous rival threatens everything in this surprisingly twisty movie that Outlander fans will appreciate. Stream The Two Worlds of Jennie Logan on The Roku Channel or YouTube.

Peggy Sue Got Married (1986)

One of the most effective aspects of Outlander is how it explores the necessity of leaving something behind in order to truly appreciate it. In Peggy Sue Got Married, Peggy Sue (Kathleen Turner) is recently separated from her philandering husband, Charlie (Nicholas Cage). When she’s transported from 1986 back to her senior year of high school in 1960 and given a chance to change the entire course of her life, she has to wrestle with what could have been versus what she still might have in the “real” present. It’s got plenty of funny moments, but Peggy Sue Got Married is, at its core, a love story. Stream Peggy Sue Got Married on Tubi or rent it on Prime Video.

The Fountain (2006)

Whether there is any actual time travel or immortality in this complex, symbolically rich film is debatable—writer/director Darren Aronofsky left much of the story open to interpretation. But it’s 100% a love story that spans centuries in one sense or another, as Hugh Jackman plays three versions of a man named Tom (or Tomás, as he is called when he is a Spanish Conquistador in the 16th century). In the present day, Dr. Tom Creo searches for a cure for death as his beloved wife, Izzi, dies of a brain tumor. And in the far future, Tom travels through space with what may be the Tree of Life, seeking to be reunited with Izzi in some way. It’s lushly romantic whether you choose to believe that all the Toms are real or that some of them are imaginary, and a deeply affecting story fans of the show will love. Rent The Fountain on Prime Video.

Timeline (2003)

Timeline, based on the book by Michael Crichton, isn’t a love story—but if your favorite part of Outlander is the fish-out-of-water aspect of a person from the future finding their way in the past, this is the perfect choice. When a group of archaeology grad students is sent back to 1357 to discover the fate of their professor, everything that can go wrong quickly does, stranding them in the midst of The Hundred Years’ War between the English and the French. The film presents the challenges of adapting to the past in a relatively realistic way, and the twists and turns of its fast-paced plot are a lot of fun. There’s a romance in there, too, though it’s far from the focus—but if you’re looking for more grand adventure via the magic of time travel, this movie is a treat. Rent Timeline on Prime Video.


from Lifehacker https://ift.tt/c4YTNEP

When you think about browsers, Vivaldi is probably not the first name that comes to mind—but it should be. This is a Chromium-based browser that focuses on adding so many features that you don't need to install multiple apps to get things done. Vivaldi has been around for over a decade now, and has become a pretty complete product, though it continues to improve. I've been using the browser for while, and these are the best Vivaldi hacks I've found in my time.

Use Chrome extensions to enhance privacy in Vivaldi for Android

Vivaldi for Android, one of the best non-Chrome browsers on Android, recently added support for Chrome extensions—even though Chrome for Android still doesn't support extensions. You can use it to enhance your privacy by installing uBlock Origin Lite to block ads and tracking. You should also consider using Decentraleyes to evade tracking through centralized content delivery networks, and SponsorBlock to skip sponsored segments in YouTube videos. That said, all your favorite extensions should work here, and they're pretty easy to install on Vivaldi for Android. Just tap the puzzle piece icon in the address bar, and you'll see a menu that allows you to open the Chrome Web Store.

Create Vivaldi workspaces to separate work from life

"Workspaces" allow you to separate tabs by project, like folders for your browser tabs. For instance, if you have a few sites open for work, you can group them under a separate workspace. I've created a workspace called "Research" to group all the tabs I use to compile my articles, and similarly, I have workspaces to group my long reads, distractions, and social media. To get started, click the Workspaces button in the tab bar, and select New Workspace. Give it a name, and start adding tabs to the workspace. You can right-click any open tab, and select Move > Workspace.

Use tiled "Follower Tabs" to follow links without closing the original page

Vivaldi's Tiled Follower Tabs.
Credit: Pranay Parab

"Follower Tabs" allow you to go down rabbit holes without losing track of the original page. I often get lost when clicking different links on articles and websites. Vivaldi's Follower Tabs allow me to keep the original page open in a split-screen view while I read the context links, and I can quickly return to reading the original page. To use this feature, open any webpage, right-click a link, and select Open Link in > Open Link as Tiled Follower Tab. You can also open any link in split-screen view by right-clicking the link, and selecting Open Link in > Open Link as Tiled Tab.

Use Quick Commands to look for tabs, features, and search

Vivaldi's "Quick Commands" feature is a lot like Mac's Spotlight Search. Both allow you to make calculations, find settings, and execute automation commands. In Vivaldi, you can open the Quick Commands popover by pressing F2 or Ctrl-E (Command-E on Mac). You'll see a long list of commands here: The search box at the top allows you to look for specific commands, but you can get started by performing basic math, toggling the status bar, or even running a niche command like "Copy all links," which copies the URLs of all of your open tabs.

Set up Command Chains to automate repetitive actions

Vivaldi also supports some degree of automation through Command Chains. You can find this feature by clicking the Vivaldi button in the top-left corner of the browser (the exact position may vary depending on your layout), and selecting Settings > Quick Commands. Under "Command Chains," you'll be able to see a few examples of these automations, and you can click the + button to create your own. I like the simple "Toggle Fullscreen and Reader View" Command Chain for quick distraction-free reading. Once set up, you can run Command Chains by using the Quick Commands feature described above. Press F2, and search for the name of the Command Chain.

Customize Vivaldi's right-click menu to remove clutter

Vivaldi settings, showing the right-click customization menu.
Credit: Pranay Parab

Vivaldi also allows you to customize most menus in the browser, including the right-click menu. I never use the Back/Forward buttons in these menus, and I find a few other options redundant, so I like adding features I'll actually use, such as "Find in Page." To do this, go to Vivaldi Settings > Appearance, and scroll down to the "Menu Customization" section. Use the drop-down menu to select Page, where you can add commands from the right pane. Right-click any command in the left pane, and select "Delete" to remove it. You can also reorder options, add a separator, subfolders, and so on. If you accidentally change things too much, you can always use the Restore Default Menu button on this page for a reset.

Use "caret browsing" to navigate webpages with your keyboard

Vivaldi has a mode called "caret browsing," which shows a blinking cursor on any webpage, and allows you to use the arrow keys to browse the page, copy text, links, and images. This lets you use the browser without touching the mouse, similar to how keyboard navigation works in apps like Google Docs or Microsoft Word. You can toggle this feature on any page in Vivaldi by pressing Shift-F7.

Create mouse gestures for faster navigation

Similarly, you can also create mouse gestures in Vivaldi to replace keyboard navigation. Go to Vivaldi Settings > Mouse, and check out the gestures under "Gesture Mapping." You can hit the + button to create your own gesture and link it to a browser command of your choice. To perform a gesture, just hold the right-mouse button, then move the cursor in the pattern you've recorded.

Use these Vivaldi settings to prolong battery life on your laptop

Vivaldi allows you to prolong battery life by using its Energy Saver and Memory Saver features. Go to Vivaldi Settings > Performance to view your options. Under "Energy Saver," you can enable Turn On at 20% Battery or Lower. I also recommend using Balanced Savings in "Memory Saver," which frees up RAM by unloading inactive tabs. This prevents the browser from slowing down, and as a result, enhances your battery life.

Use "Periodic Reload" to automatically refresh your social media feed

If you're constantly refreshing news websites or your social media feeds, you can automate that action with Vivaldi. Just right-click any open tab, select Periodic Reload, and choose a time interval. The browser allows you to refresh the page once every minute, two minutes, all the way up to once every 90 minutes.


from Lifehacker https://ift.tt/dBW9Mqk