Cyber threat intelligence becomes more valuable when indicators are enriched with context that supports investigation, correlation, and decision-making. Through the Criminal IP integration with OpenCTI, security teams can transform IP addresses, domains, and URLs from isolated indicators into structured intelligence within the OpenCTI knowledge graph.

The integration automatically enriches indicators with Criminal IP’s reputation scoring, infrastructure intelligence, vulnerability data, behavioral signals, and phishing analysis.

The resulting information is structured as OpenCTI entities and relationships, allowing analysts to investigate connected infrastructure, identify potential attack surfaces, and prioritize high-risk indicators.

Integration Highlights

Contextual Risk Scoring Beyond Simple Reputation

Criminal IP provides dual-perspective risk scoring (inbound and outbound), reflecting both how an IP is targeted and how it behaves externally. This gives analysts a more nuanced signal than traditional single-score reputation models and improves prioritization of high-risk infrastructure.

Deep Infrastructure Intelligence Embedded in the Graph

Enrichment goes beyond tagging indicators, Criminal IP creates structured OpenCTI entities and relationships, including vulnerabilities (CVEs), Autonomous Systems (ISPs), and geolocation. This enables analysts to pivot across infrastructure, uncover shared components, and identify related infrastructure within the graph.

Service Exposure & Vulnerability Correlation

By linking observed services to known CVEs, the integration provides immediate insight into potential attack surfaces. Analysts can quickly assess whether an IP is not only malicious, but also exploitable or actively leveraged in attacks.

High-Fidelity Threat Labeling & Behavioral Signals

Automatically generated labels incorporate multiple data points such as anonymization technologies (VPN, proxy, TOR), hosting characteristics, and malicious classifications. This layered labeling approach provides richer context than binary “malicious/benign” tagging.

Advanced Domain & Phishing Intelligence

For domains, Criminal IP performs full URL analysis to detect phishing activity, credential harvesting, suspicious files, and impersonation techniques. Confidence scores are directly tied to phishing probability, giving analysts a quantifiable measure of risk.

Infrastructure Mapping & Analysis support

The integration links indicators to network ownership (Autonomous Systems), physical locations, and resolved IP infrastructure. This allows teams to identify hosting patterns, regional clustering, and and infrastructure patterns across indicators.

How Integration Works

Indicators such as IP addresses, domains, and URLs are first ingested into OpenCTI.

The Criminal IP connector then automatically enriches each indicator with reputation scoring, infrastructure intelligence, vulnerability information, behavioral signals, and phishing analysis.

The enriched data is structured into entities and relationships within the OpenCTI knowledge graph. Analysts can then use the resulting intelligence for investigation, correlation, infrastructure pivoting, and threat analysis.

The process can be summarized as follows:

1. Indicators (IP addresses, domains, URLs) are ingested into OpenCTI
2. The Criminal IP connector automatically enriches each indicator with reputation scoring, infrastructure intelligence, and phishing analysis
3. Enriched data is structured into entities and relationships, enabling investigation, correlation, and analysis within the OpenCTI knowledge graph

Key Use Cases

SOC Triage and Alert Validation

Rapidly validate suspicious IPs and domains using dual risk scoring, infrastructure context, and phishing intelligence, enabling analysts to prioritize high-risk indicators and support prioritization of high-risk indicators.

Threat Hunting and Infrastructure Pivoting

Leverage enriched relationships such as CVEs, Autonomous Systems, and geolocation to pivot across connected infrastructure and uncover related assets used in attacker operations.

Phishing and Campaign Analysis

Identify and analyze malicious domains, credential harvesting pages, and supporting infrastructure to track phishing activity and understand broader campaign patterns.

OpenCTI Platform

OpenCTI is an open-source cyber threat intelligence platform designed to structure, store, and analyze threat data using a graph-based model. It enables organizations to connect indicators, vulnerabilities, threat actors, and campaigns into a unified knowledge base for investigation, collaboration, and intelligence sharing.

Criminal IP

Criminal IP delivers decision-ready cyber threat intelligence by analyzing IP addresses, domains, and URLs across the global internet. Powered by AI and OSINT, it provides reputation scoring, infrastructure visibility, and real-time detection of malicious activity, including phishing, exposed services, and anonymization technologies such as VPNs and proxies. Its API-first architecture enables seamless integration into security platforms to enhance visibility, automation, and response.

Sponsored and written by Criminal IP.

A vulnerability was discovered in Apple’s “Hide My Email” that allows an attacker to work out your real email address. It’s not been fixed for over a year.

Hide My Email has been a great help for Apple users who need to communicate with services and companies, but don’t want to provide their real email address. Spam, as ever, continues to be a problem requiring solutions like this.

However, while it is capable of thwarting your typical spammer or marketing-happy small business, it’s not foolproof. As a report from 404Media reveals, it’s a feature that can be beaten.

The exact nature of the vulnerability hasn’t been detailed, due to the lack of action by Apple to fix it. Testing on Monday by the report verified that it is still a problem.

EasyOptOuts co-founder Tyler Murphy discovered an issue with Hide My Email in June 2025, and responsibly reported it to Apple as well as the publication. Twelve months later, and the problem still exists.

Murphy explains that the issue was reported and instructions to replicate it where provided to Apple. He doesn’t know why it hasn’t been fixed, but also didn’t feel comfortable waiting to discuss the problem any longer.

“Hide My Email users deserve to know that it may be possible for attackers to discover their hidden email addresses,” he declared.

There are free websites accessible to the public that link email addresses to other personal details, he adds. Anyone relying on Hide My Email may find themselves at risk of being identified on them.

Under Investigation

While Apple hasn’t yet fixed the hole in Hide My Email, it is certainly aware of the problem. One month after Murphy contacted Apple, it confirmed it was looking into the issue.

In March 2026, Apple said it had “addressed the reported issue in a recent system change.” However, Murphy discovered the hole hadn’t been plugged.

Again, more information was provided to Apple, which replied a month later saying it was doing more checks.

Apple updated Murphy in May, insisting it was “still investigating” the problem. It also wished for Murphy to hold off disclosing the problem until after the investigation concluded.

Murphy wrote back, proposing that Apple could stop selling access to Hide My Email until a fix was available, as a means to limit the number of users at risk.

By the end of May, Apple said that it would be addressed in a security update “expected in the coming weeks.”

After being alerted by Murphy, the publication contacted Apple multiple times, but did not get a response.

Questionable changes

While it is unknown exactly when and how the vulnerability will be fixed, it may end up accompanying other changes to the service. These are changes that have questionable value to its users.

A June 15 developer notice warned that the email domains used for Sign In with Apple and Hide My Email will be updated in the future. The intention is for email providers and developers to update their systems in advance of the changeover.

The changes basically mean that newly-generated relay email addresses for Hide My Email will change from the domain iCloud.com to private.icloud.com. Sign In With Apple currently creates relay addresses ending with privaterelay.appleid.com, and will change to the private.icloud.com version.

The problem here is that there’s nothing stopping a website or newsletters from blocking email addresses using private.icloud.com, forcing them to sign up with another legitimate account.

For Hide My Email at least, the change removes the source ambiguity protecting the service and its users.

Oppo has unveiled the Enco Air5s, the brand’s first semi-in-ear earbuds with Active Noise Cancellation, placing them in direct competition with Apple’s AirPods 4 with ANC.

The open design that gives semi-in-ear earbuds their comfortable fit has traditionally been a poor fit for effective noise cancellation, since it leaves more room for ambient sound to leak through.

Oppo’s Real-time Adaptive Noise Cancellation addresses that limitation by adjusting noise reduction based on fit, ear canal shape and surrounding sound, all processed through an 800kHz sampling rate for faster response to changing conditions.

Alongside that adaptive system, the Enco Air 5s also include a Tailored Voice-Canceling System built to suppress vocal frequencies and reduce nearby conversations, a feature aimed at noisy environments such as crowded cafés.

Advertisement

Each earbud weighs just 3.9 grams, a figure Oppo credits to its Excimer Craftsmanship finishing process, which combines a shimmering surface with a smooth touch while keeping the overall build ultra-lightweight. Complementing this is the Ergonomic Semi-in-Ear Fit, intended to conform more closely to natural ear contours and reduce friction during extended wear.

Advertisement

Sound comes from a newly customised 12mm dynamic driver built around a Copper-Clad Aluminum Wire coil, paired with an Acoustic Cavity Design that Oppo says delivers crisp highs, impactful bass and clear vocals. An upgraded 10-band Custom EQ allows listeners to fine-tune low, mid and high frequencies, while Adaptive Sound Enhancement compensates for sound leakage in real time.

Connectivity is Bluetooth 6.0 alongside Oppo’s own Smart Bluetooth system, with Dual Connection Across Systems letting users switch between paired devices without manually reconnecting.

Beyond standard pairing, the earbuds introduce AI Translate, supporting face-to-face translation for situations such as ordering food or attending meetings abroad, alongside Slide Volume Control for hands-free adjustment without touching a connected phone.

Advertisement

Battery life reaches up to 48 hours with the charging case, with Oppo stating the cells retain over 80 percent capacity after 1,000 charge cycles, a claim backed by TÜV Rheinland certification.

Advertisement

The Enco Air 5s will launch in Lunar White, Midnight Black and Starlight Purple finishes, though Oppo has not confirmed pricing or release dates beyond noting that details will follow through official local market announcements.

Advertisement

The competitive edge in enterprise AI is shifting to context: which platform can give an agent the right memory, the right retrieval and the right data at the moment of decision.

Couchbase on Tuesday announced its AI Data Plane, combining persistent agent memory, real-time context retrieval and an enterprise-managed MCP server in a single operational platform. 

Couchbase’s roots are in caching and high-transaction databases — an architecture the company argues makes it better suited for agent memory than vendors that came to the problem from search or analytics. The AI Data Plane runs identically across cloud, on-premises and disconnected edge environments, extending agent memory and local vector search to devices with no network connection.

“How do you make sure that the intelligence that you get out of these models are the ones that databases specialize in?” Gopi Duddi, CTO at Couchbase, told VentureBeat. “How can you get that value out of storage systems, which are still going to be databases?”

What the AI Data Plane delivers

The AI Data Plane packages three components designed to replace the fragmented stacks most enterprises are currently running.

Agent memory: A unified persistence layer for conversational context, structured operational data and vector embeddings. Couchbase says the guardrails are what distinguish it from standalone memory services: token constraints per session, time-to-live limits on stored memories and metering controls that cap compute consumption per agent session.

Enterprise MCP server: An enterprise-supported self-managed server for standardized model-context protocol integration, shipping as part of the platform rather than requiring a separate service.

Agent catalog: A function-level catalog of discoverable agent tooling built by Couchbase. Duddi distinguished it from metadata catalogs like Databricks Unity or AWS Glue — describing it, in his words, as closer to a glorified MCP that surfaces agent functions as callable tools within the platform.

Memory-first architecture takes agent context to the disconnected edge

The lineage of Couchbase and its core architectural foundation is what Duddi says gives it an edge when it comes to context.

“We were a cache before we became a database,” Duddi said.

Writing to memory is 10x faster than writing to disk, Duddi said — a speed advantage he argues separates Couchbase from NoSQL databases that layer memory workloads on top of disk-based storage.

Couchbase isn’t the only data technology that has its roots in a caching layer. Redis similarly is rooted in cache and also recently announced an agentic AI context layer. Duddi argued that Couchbase is different in that it maintains an ACID (Atomicity, Consistency, Isolation, and Durability) compliant database which matters for transactional workloads. Couchbase also has a long history across multiple deployment modalities.

That architecture extends to the edge through Couchbase Lite, the platform’s on-device runtime. It runs SQL, full-text search and vector search locally without a network connection, using a proprietary sync mechanism to replicate bidirectionally back to cloud or between edge nodes when connectivity returns. The target environments are retail floor operations, field service, industrial deployments and regulated settings where agent data cannot leave the device.

Duddi cited hotel reservations as an early example: multiple agents serving customers concurrently, each pulling local context and running vector search on-device, with shared session memory synchronizing centrally. The practical benefit is token efficiency. Rather than every agent independently retrieving and processing the same data, the platform caches shared context so concurrent sessions draw on it without burning tokens repeatedly.

Agora’s view from production

Agora, a platform that helps developers embed real-time voice, video and conversational AI into enterprise applications, has run Couchbase in production since February 2024.

The initial use case was its Signaling product, managing channel setup and state synchronization for live calls. Expanding into conversational AI agents brought stricter requirements: memory-first architecture, full JSON support for storage and query, cross-datacenter replication for high availability and enterprise-grade vendor support.

“Couchbase was the best fit based on these criteria,” Patrick Ferriter, SVP of Product at Agora, told VentureBeat.

Agora is now extending that relationship to support context retrieval for conversational AI agents.

“This will simplify the architecture and deliver enterprise grade RAG with predictable lower latency required for conversational AI use cases,” Ferriter said.

For data professionals trying to figure out the best approach to context, there is no one answer. On platform selection, Ferriter was direct.

“It depends on the preference and goals of the organization, including timing,” Ferriter  said. “If they want something enterprise grade and optimal for immediate production and scale vs. having to optimize and maintain an open-source solution with community support. We wanted the former and that is why we looked at an expanded partnership with Couchbase.”

Competitive context: following the right trend

The context layer has become a crowded space in 2025.

Oracle put a memory core in its database back in March providing a context layer. Redis added a context layer in May as did vector-native database vendor Pinecone.  

“Couchbase is following this trend, not setting it, but it’s the right one to follow,” Devin Pratt, Research Director for AI, Automation, Data and Analytics at IDC, told VentureBeat. “Its real edge is reach, running the same platform from cloud to edge to mobile, which is how enterprises actually operate. The test now is to scale against bigger names.”

For teams navigating the vendor landscape, Pratt’s framing is direct. “Match the tool to the workload. Consolidate where it makes sense, use a specialized engine like a graph database where relationship-heavy reasoning earns it, and let governance drive the call rather than treating memory as plumbing,” Pratt said.

The US government has just handed scientists the largest map of human health ever assembled. It pairs more than half a million genomes with real medical records, and it arrives as the programme behind it faces deep budget cuts.

The database comes from All of Us, a research programme run by the National Institutes of Health. On June 30, 2026, the NIH released data from more than 747,000 participants. That makes All of Us the world’s largest integrated store of genomes and electronic health records. It links 535,000 whole genome sequences to nearly 482,000 medical records. No rival can match that depth and breadth.

The scale is the point. To tailor a treatment to one person, researchers first need patterns drawn from many. All of Us bundles genomes with doctors’ notes, diagnoses, and test results. It adds health surveys, wearable data from devices like Fitbits, and even local air quality. The trove now holds more than 1.3 billion genetic variants. The eventual goal is one million volunteers.

Built for the people usually left out

What sets All of Us apart is who is in it. More than 86 per cent of participants come from groups long overlooked in medical research. That includes racial and ethnic minorities, older adults, women, people with disabilities, and rural residents. Participants span all 50 states.

That matters because the current gold standard does not manage it. The UK Biobank, the field’s leading repository, holds records for about 500,000 people. Almost all are of white European ancestry. Findings from such data often fail to carry over to other groups. All of Us has already helped uncover gene variants that cut the risk of kidney disease in people of African ancestry. A narrower database would miss that kind of result.

“One of the most exciting components is its sheer diversity,” said Alicia Martin. She is a statistical geneticist at the Broad Institute who uses the data to build risk-prediction tools. It offers a way, she said, to understand not just who is at risk of disease, but who will respond to which treatment.

The data layer for AI medicine

This is also raw material for artificial intelligence. Modern drug discovery and diagnosis lean on large, clean datasets. A genomic-plus-clinical trove at this scale is exactly what the new wave of AI research tools and science-specific models are hungry for. Claims that AI can already outperform doctors run well ahead of the evidence, but better data is what would narrow the gap. The release even opens what the programme calls its multiomics era, adding protein and RNA data for thousands of participants.

The payoff is already visible. All of Us data has fed more than 1,400 peer-reviewed papers from some 23,000 researchers. It helped build a genetic test that predicts inherited risk across eight cardiovascular conditions. It backed a low-cost prostate cancer model now in a trial of 5,000 veterans, and early work on catching disease before it starts, including Alzheimer’s. The programme has returned more than 733,000 personalised DNA results to participants. Access is free, so a researcher at a rural university gets the same data as one at a top institute.

A national treasure, and a target

The timing is bittersweet. The milestone arrives just as All of Us loses ground on funding. Its budget has been cut by 72 per cent since 2023. One of its main funding streams, the 21st Century Cures Act, is set to expire at the end of this fiscal year. More than 50 medical organisations have written to Congress warning that much of what has been built could be lost.

NIH Director Jay Bhattacharya called the database “a national treasure” and a foundational platform for investigators at every career stage. Both things are true at once. The resource is more valuable than ever, and its future is less certain than ever. That tension is sharper still while other governments pour money into research and computing infrastructure.

The privacy question underneath

A store of half a million genomes tied to medical records is also one of the most sensitive datasets ever built. All of Us shares it only with registered researchers, through a controlled cloud workbench. It leans on the trust of the people who volunteered. That trust is the quiet foundation of the whole project, and it is worth as much as the genomes themselves. As AI makes it easier to draw conclusions from health data, guarding that trust will only get harder.

For now, the headline is simple. Scientists have never had a health map this large, or this representative of who people actually are. Whether the country keeps paying for it is the next question, and the answer will decide how much of the promise turns real.

Acer’s 1,000Hz gaming monitor has moved from announcement to Amazon listing. The XV273U F5 is priced at $699.99, giving competitive players a real number to weigh before one of the fastest displays headed to North America actually ships.

Availability is still the problem. Amazon lists the monitor as temporarily out of stock, and Acer has previously pointed to a Q4 North America launch window instead of a firm release date.

The bigger question is whether the fastest mode deserves the attention. The XV273U F5 is a 27-inch QHD monitor first, and its most extreme refresh rate requires a serious cut in resolution.

How fast can it really go

The baseline spec is already aggressive, as Acer built the XV273U F5 around a 27-inch IPS panel with a 2560 x 1440 resolution and a native 540Hz refresh rate.

The 1,000Hz mode is more specialized. To reach that speed, the monitor drops to 1280 x 720, making it a dual-mode esports display rather than a full-time 1,000Hz QHD panel.

That split gives the XV273U F5 a clearer audience. If you’re playing ranked shooters and chasing every bit of responsiveness, the softer image may be acceptable. If you’re buying a premium 27-inch screen for sharpness, the tradeoff is harder to justify.

Why does 720p change the appeal

At 720p, Acer’s fastest mode narrows the use case. It’s built for games where motion clarity and input feel matter more than detail, not for players who want one display to make everything look its best.

There’s also a reason to wait for testing. A similar dual-mode Philips monitor was underwhelming in a hands-on coverage, so Acer’s tuning, overdrive behavior, and real response times still need proof.

Acer also lists FreeSync Premium and Nvidia G-Sync support, which should help keep gameplay smoother when frame rates fluctuate, so the safer draw is the 540Hz QHD mode.

When should buyers hold off

The XV273U F5 belongs on the shortlist for esports players who specifically want 540Hz at QHD and can justify a $699.99 monitor. That’s still a narrow group.

For anyone mainly chasing the 1,000Hz number, patience is the smarter move. You’ll want independent reviews to show whether Acer’s 720p mode feels meaningfully faster, or whether the spec sheet is moving quicker than the experience.