A massive heat wave has broken heat records in 14 states, including Arizona and California, reaching up to 112 degrees Fahrenheit in some areas. Now it’s creeping eastward, according to the National Weather Service.

The heat wave is continuing its journey through the Midwestern United States and is projected to affect anywhere from one-quarter to one-third of the 48 mainland states, National Weather Service meteorologist Gregg Gallina told The Associated Press. The highest temperatures recorded today are in Arizona, New Mexico and Texas — what the National Weather Service refers to as the Southern Rockies region. But the hot air is on the move.

The reason these high temperatures persist is the “heat dome” phenomenon, in which high pressure prevents hot air from rising, trapping it in a bubble above a region. As the dome of pressure moves, so too does the hot air — and right now, it’s barreling east.

The states that will be smothered by the heat dome in the coming days include those in the Southern and Central Plains regions. This means residents of Texas, Colorado, Oklahoma, Kansas and Nebraska can expect to sweat as the heat blankets them on its eastbound journey.

What the heat dome means for climate change and our health

According to Climate Central, the US has experienced rising blackout rates over the past 20 years, largely due to weather-related issues and an aging electrical grid.

As of August 2025, the US Environmental Protection Agency states that heat is the leading weather-related cause of death in the US. The World Health Organization reports that between 2000 and 2019, about 489,000 heat-related deaths occurred each year. 

Fortunately, humidity levels are not as high during a summer heat wave. As humidity can contribute to dehydration, body strain and breathing difficulties, lower humidity makes this heat dome somewhat less dangerous for workers in affected areas.

The World Weather Attribution, an initiative formed by international climate change researchers and climate scientists, determined that the heat dome would be “virtually impossible without human-induced climate change.”

In a world where weather events like these cease to be impossibilities, you’ll want to prepare for future heat waves properly. Here’s how to stay safe during the heat dome.

How to prepare for the heat dome before it hits your state

There’s nothing you can do to beat the heat outside, aside from following heat safety best practices. You’ll just need to stay hydrated, wear breathable, light-colored clothing and wait out the potentially dangerous heat dome, which is expected to dissipate by the end of next week when April begins. But you can do things to batten down the hatches before the sweltering heat reaches your home.

Even if you don’t have much prep time, a couple of small items can make your home safer (and far more comfortable). Cooling towels, portable fans and countertop ice makers are must-haves during a heat wave, especially if you aren’t looking to crank the thermostat down and spend a pretty penny.

Heat waves are also extremely costly due to the sheer amount of energy used — it’s expensive to stay cool. Depending on your living situation, though, you might want to invest in heat pump installation. These HVAC system additions are extremely energy efficient, which means you can keep more money in your pocket while beating the heat.

During the middle of the heat wave, when everyone has their AC running, there’s also the potential for an early brownout (a temporary drop in electrical voltage, causing lighting to dim) or even a blackout (a complete loss of power). It’s common to feel helpless during power outages, but you can get ahead of the curve by preparing a summer blackout kit with portable chargers and alternative light sources before the heat wave hits.

Even if the historic heat wave doesn’t hit your home, these tips will help you prepare as the summer season bears down on the US in a couple of months.

Most carpenters and woodworkers find themselves with the problem of disposing of all the sawdust they create when performing their craft. There are lots of creative solutions to this problem, such as adding it compost, using it as groundcover in a garden, adding it as filler in a composting toilet, or pressing it into bricks to burn in a stove. All of these have their uses, but involve either transporting the sawdust somewhere or performing some intermediate step to process it. [Greenhill Forge] wanted to make more direct use of it so he built this stove which can burn the sawdust directly and which provides enough heat for his woodshop.

The design is based on one which is somewhat common in Japan and involves building a vessel with a central tube for airflow, with the sawdust packed around it. The tube is made from a hardware cloth or screen to allow air to reach the sawdust. The fire is lit from the top, closed, and then allowed to burn through the stack. [Greenhill Forge] welded the entire stove from various pieces of sheet metal and bar stock, with a glass plate at the top of the stove to close off the fire and a baffle to control the airflow and rate of burn.

Initially, [Greenhill Forge] thought that the fire would burn from the top down, but this turned out to create a smoldery, messy fire instead of a hot, clean burn. Eventually, though, an ember fell down to the bottom and let the stack burn from the top up, and then it started generating serious heat. He estimates that with around 5 kg of sawdust burning for three hours that it’s about equivalent to a 6 kW stove. While a woodworker might not have enough sawdust to run this stove every day, it could be good to have on hand to use once every few weeks when the sawdust builds up enough. [Greenhill Forge] has been hard at work building unique wood burning stoves lately, like this one we recently featured which generates and then uses charcoal as fuel.

Apple may be planning one of the biggest changes to Siri since the voice assistant launched more than a decade ago. According to a report on Tuesday from Bloomberg, Apple is testing a standalone Siri app, a redesigned interface and a new “Ask Siri” button that would make the assistant more visible and useful across the Apple ecosystem, as part of a broader AI reboot.  

According to the Bloomberg report, the new Siri experience is expected to be introduced at Apple’s Worldwide Developers Conference on June 8 and would arrive as part of iOS 27, iPadOS 27 and MacOS 27 later this year. The report says Apple is testing out a new Siri that would make the assistant feel more like a standalone AI chatbot — think ChatGPT or Claude — rather than the current built-in tool.

The latest report builds on earlier Bloomberg reporting from January, which said Apple planned to revamp Siri into its first real AI chatbot to better compete with OpenAI and Google. 

For Apple, the move would mark another attempt to reset expectations around its AI strategy after repeated delays to its more advanced Siri ambitions. Apple had previewed a more personalized Siri at WWDC 2024, but the broader rollout has slipped, and Bloomberg’s new report suggests the company is now aiming for a more sweeping relaunch in iOS 27 instead.  

Apple has not publicly announced these iOS 27 features, so plans could still change before WWDC.

An Apple representative didn’t immediately respond to a request for comment.

PTC Inc. is warning of a critical vulnerability in Windchill and FlexPLM, widely used product lifecycle management (PLM) solutions, that could allow remote code execution.

The security issue, identified as CVE-2026-4681, could be leveraged through the deserialization of trusted data.

Its severity has prompted emergency action from German authorities, with the federal police (BKA) reportedly sending agents to affected companies to alert them to the cybersecurity risk.

Fix under development

There are no official patches available, but PTC states that it is “actively developing and releasing security patches for all supported Windchill versions” to address the issue.

According to the vendor, the flaw impacts most supported versions of Windchill and FlexPLM, including all critical patch sets (CPS) versions.

Until patches become available, system administrators are recommended to apply the vendor-provided Apache/IIS rule to deny access to the affected servlet path. PTC noted that the mitigation does not break functionality.

The same mitigation should be applied to all deployments, including Windchill, FlexPLM, and any file/replica servers, not just internet-facing systems. However, PTC advises prioritizing mitigations on internet-facing instances.

If mitigation is not possible, the vendor recommends temporarily disconnecting the affected instances from the internet or shutting down the service.

IoCs available

The company says that it has not found any evidence that the vulnerability is being exploited against PTC customers. However, PTC published a set of specific indicators of compromise (IoCs) that include a user agent string and files.

Additionally, the bulletin lists detection advice, including checks for webshells (GW.class, payload.bin, or dpr_.jsp files), suspicious requests with patterns such as run?p= / .jsp?c= combined with unusual User-Agent activity, errors referencing GW, GW_READY_OK, or unexpected gateway exceptions.

Additionally, in an email to customers seen by BleepingComputer, the company said that “there is credible evidence of an imminent threat by a third-party group to exploit the vulnerability.”

According to Heise, BKA officers were dispatched over the weekend to alert companies nationwide of the risk of CVE-2026-4681, even some that did not use any of the affected products.

The German outlet reports that the BKA woke up system administrators in the middle of the night to hand them a copy of PTC’s notification, and also alerted the state criminal investigation offices (LKA) in various federal states.

This unusual and urgent response by the authorities has sparked concerns that CVE-2026-4681 may be exploited or is likely to be exploited soon.

Given that PLM systems are also used by engineering firms in weapons system design, industrial manufacturing, and critical supply chains, the authorities’ response could be justified on grounds of protection from industrial espionage and other national security risks.

Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.

Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.

Download The Report

Amazon has just completed the acquisition of Fauna Robotics, the New York based startup that has been quietly developing a compact household humanoid called Sprout. The team of around 50 is folding into Amazon’s Personal Robotics Group, though Fauna will continue to operate under its own name as an Amazon company, though financial terms were not disclosed.

Fauna Robotics was founded in 2024 by a small group of engineers from Meta and Google alongside Rob Cochran, with Josh Merel joining as a co-founder. The company raised at least $30 million from backers including Kleiner Perkins, Quiet Capital, and Lux Capital, and its ambition was clear from the beginning: to build robots that people actually want to have around them.

Unitree G1 Humanoid Robot（No Secondary Development）

• Sleek & Durable Design: Standing at 132cm tall and weighing only approx. 35kg, the G1 is constructed with aerospace-grade aluminum alloy and carbon…
• High Flexibility & Safe Movement: Boasting 23 joint degrees of freedom (6 per leg, 5 per arm), it offers an extensive range of motion. For safety, it…
• Smart Interaction & Connectivity: Powered by an 8-core high-performance CPU and equipped with a depth camera and 3D LiDAR. It supports Wi-Fi 6 and…

Sprout is a compact and surprisingly personable little machine, standing just 3.5 feet tall and weighing 50 pounds. It walks on two legs, can pick up small objects, and is capable of getting itself up from a seated position to move around the room. Early footage shows it pulling off the Twist and the Floss with surprising fluency, which tells you something about the kind of robot Fauna had in mind. At $50,000 it is not built for heavy industrial work, but rather for the everyday household tasks that nobody particularly enjoys, picking up toys, grabbing groceries from the pantry, that sort of thing.

Part of what makes Sprout so interesting is how accessible it is on the software side, making it a practical platform for testing ideas in real world environments rather than controlled factory settings. That openness has attracted researchers and labs interested in how robots might fit into everyday life, whether that is a family home or a student dorm. And unlike the large warehouse dwelling humanoids that dominate the industry right now, Sprout is small enough to feel genuinely approachable in ordinary situations.”

Amazon already has a significant robot presence in their warehouses, with over a million of them in operation. They purchased Kiva Systems in 2012 and transformed it into the foundation of their modern fulfillment centers. On the consumer side, a few years ago, they debuted Astro, a rolling house robot that may not have taken off. They just acquired Rivr, a Swiss company working on four-legged delivery assistants. Amazon is increasingly focusing on robotics outside of the warehouse.
[Source]

In an email, Aikido researcher Charlie Eriksen said the canister was taken down Sunday night and is no longer available.

“It wasn’t as reliable/untouchable as they expected,” Eriksen wrote. “But for a while, it would have wiped systems if infected.”

Like previous TeamPCP malware, CanisterWorm, as Aikido has named the malware, targets organizations’ CI/CD pipelines used for rapid development and deployment of software.

“Every developer or CI pipeline that installs this package and has an npm token accessible becomes an unwitting propagation vector,  Eriksen wrote. “Their packages get infected, their downstream users install those, and if any of them have tokens, the cycle repeats.”

As the weekend progressed, CanisterWorm was updated to add an additional payload: a wiper that targets machines exclusively in Iran. When the updated worm infects machines, it checks if the machine is in the Iranian timezone or is configured for use in that country. When either condition was met, the malware no longer activated the credential stealer and instead triggered a novel wiper that TeamPCP developers named Kamikaze. Eriksen said in an email that there’s no indication yet that the worm caused actual damage to Iranian machines, but that there was “clear potential for large-scale impact if it achieves active spread.”

Eriksen said Kamikaze’s “decision tree is simple and brutal.”

• Kubernetes + Iran: Deploy a DaemonSet that wipes every node in the cluster
• Kubernetes + elsewhere: Deploy a DaemonSet that installs the CanisterWorm backdoor on every node
• No Kubernetes + Iran: rm -rf / --no-preserve-root
• No Kubernetes + elsewhere: Exit. Nothing happens.

TeamPCP’s targeting of a country that the US is currently at war with is a curious choice. Up to now the group’s motivation has been financial gain. With no clear connection to monetary profit, the wiper seems out of character for TeamPCP. Eriksen said Aikido still doesn’t know the motive. He wrote:

While there may be an ideological component, it could just as easily be a deliberate attempt to draw attention to the group. Historically, TeamPCP has appeared to be financially motivated, but there are signs that visibility is becoming a goal in itself. By going after security tools and open-source projects, including Checkmarx as of today, they are sending a clear and deliberate signal.

The hack that keeps on giving

Last week’s supply-chain compromise of Trivy was made possible by a previous compromise of Aqua Security in late February. Although the company’s incident response was intended to replace all compromised credentials, the rotation was incomplete, allowing TeamPCP to take control of the GitHub account for distributing the vulnerability scanner. Aqua Security said it was performing a more thorough credential purge in response.

• OpenAI is shutting down Sora
• It’s not clear why, but people will be able to somehow save the videos that they created in the app and elsewhere
• Disney may have also exited its big OpenAI deal

In a stunning turn of events, OpenAI has unexpectedly shuttered the Sora app, and Disney may have walked away from its $1 billion deal in support of the generative video technology.

Less than 18 months after launching Sora to wide shock and acclaim and less than a year after launching the Sora App, OpenAI announced in a X post on Tuesday, “We’re saying goodbye to Sora.”