Shortly after increasing the lifetime version of the Plex Plan to $749.99, Plex has now introduced a new five-year option. One charging $249.99 for streaming media from your Mac to your iPhone.

On July 1, Plex significantly increased the cost of its Lifetime Plex Plan from $249.99 to a staggering $749.99. While consumers will have missed the boat to get the old pricing, they can still spend $249.99 on something that’s not quite as everlasting.

Subscribers can sign up for a new five-year Plex Pass. The new option, offered alongside the monthly $6.99 and annual $69.99 subscriptions, gives users a lengthy period of usage without paying a regular subscription.

The price, $249.99, will be familiar to users, since it’s the same as the Lifetime Plex Plan pre-price rise.

Good, but not quite great

It does still work out to be a decent deal for Plex users as they’d pay the equivalent of three and a half years of the annual plan for five years of usage. Or just under three years worth of the monthly plan price.

This is a bit of a cost saving for consumers. But it’s not as good as the old Lifetime offer, which did the same thing but without an end date.

The new plan certainly does help soften the blow of the Lifetime price rise to $749.99. But there are still some elements to remember.

The key one is what happens after the five-year period ends. Users will then have to either sign up for a new five-year or equivalent plan, or consider switching to a monthly one instead.

However, they won’t get any grandfathered pricing. Due to the inevitability of price increases over time, you can count on the subscriptions going up in price within those five years.

Consider your streaming choices

In justifying the price rise, Plex admitted that it had previously considered removing the Lifetime Plex Pass altogether. While recurring subscriptions sustain long-term development, the lifetime pass does not, and becomes less useful to Plex as time goes on.

The new pricing of that plan “reflects the real, ongoing value of the software we’re committed to building and maintaining for years to come.”

The severely high price of the Lifetime pass certainly does make buying one of the lower-tier options more attractive to users. Especially the new five-year option.

However, this also serves as an opportunity for users to consider whether to stick with Plex at all.

Other options exist, such as Jellyfin, which is free to use. It offers the same core streaming functionality as Plex, but it requires a little more work to get it up and running.

Vendors are trying to position “confidential computing” as the technical backbone of Europe’s sovereign cloud ambitions. But new research shows that a security protocol used to prove cryptographic trust in the system may have a fundamental architectural flaw.

Confidential computing rests on a mechanism called remote attestation, in which a server cryptographically proves to a client that it is running inside a genuine, unmodified Trusted Execution Environment (TEE) before any sensitive data changes hands. Intel’s product pages promise TDX will “add safeguards to data sovereignty and governance.” Google Cloud describes its confidential computing infrastructure as offering “full, auditable control over access to customer data.”

In May, The Register reported that the chip beneath the chip, the management engines running below the operating system on Intel and AMD silicon, falls outside what European sovereignty frameworks like SecNumCloud actually assess. That left an open question about the layer above the silicon: the protocol meant to prove the chip itself can be trusted.

New, independently verified research answers it, and the answer is not reassuring.

A protocol that promises more than it proves 

Muhammad Usama Sardar, a researcher at TU Dresden, has spent the past two years formally verifying whether that protocol, known as attested TLS, actually does what it claims. Using ProVerif, a tool for the symbolic security analysis of protocols, he and his co-authors discovered that it largely does not. 

Their recent paper, Identity Crisis in Confidential Computing, published with co-authors Mariam Moustafa and Tuomas Aura and presented at the AsiaCCS 2026 conference, found diversion attacks against two state-of-the-art attested TLS protocols. A connection intended for one server can be silently redirected to a different, compromised machine running identical software, anywhere in the world, without the client ever knowing. The intended server has done nothing wrong. The attacker simply exploits the fact that the protocol checks the software’s integrity, not its location.

The most recent paper, Intra-handshake.fail, published with co-authors Viacheslav Dubeyko and Jean-Marie Jacquet and accepted for ESORICS 2026, goes further. It examines what the industry calls intra-handshake attestation, where evidence is generated during the TLS handshake itself, and tests seven different ways of cryptographically binding that evidence to the underlying connection. None of them prevent relay attacks, in which a client verifies the evidence of a genuine, trustworthy AI agent or server but ends up encrypting its traffic to an entirely different, malicious one. The starting assumption in all of this is that the hardware itself can be trusted. 

“In confidential computing, you have to trust the hardware manufacturer anyway,” Sardar told The Register. “There is absolutely no way around this.” With that root of trust accepted, he argues, the protocol layer was supposed to provide everything else. His research shows it provides far less than assumed.

Three levels of trust

The researchers formalise the problem as three increasingly strict levels of cryptographic binding between the attestation evidence and the actual TLS connection it is meant to vouch for.

The weakest, level one, ties evidence only to the very first key exchange in the handshake, the Diffie-Hellman step, where client and server agree on a shared secret before either side has proven who they are. Level two ties it to the client’s handshake traffic key, covering everything up to the server’s identity confirmation. Level three, the strongest and the one that matters most in practice, ties evidence to the application traffic key itself, the key actually used to encrypt the sensitive data a client sends once the connection is live.

Sardar’s extensive analysis in ProVerif focused on intra-handshake attestation; post-handshake attestation fell outside its scope. Three of the seven binding mechanisms examined achieve level one. The rest fail even that baseline.

His team’s own proposed mitigation, a cryptographic binder built from the TLS handshake secret combined with the server’s public key, formally achieves level two. Level three, the paper concludes, “may not be possible” within intra-handshake attestation as currently architected, without breaking properties of TLS 1.3 that the protocol was never designed to give up.

In plain terms: the best fix available today proves a client is talking to the right machine at the start of a handshake. It cannot prove that the data sent minutes later is still going to that same machine.

Production systems, not laboratory proofs of concept

The vulnerability is not confined to academic models. Sardar’s team formally analysed four real-world implementations of intra-handshake attestation: Meta’s Private Processing system for WhatsApp, Edgeless Systems’ Contrast, the open-source Cocos AI platform, and a proof-of-concept maintained by the Confidential Computing Consortium’s (CCC) Attestation Special Interest Group. The first three of the four are running in production today. The attacks apply to every version of Cocos AI between 0.4.0 and 0.8.2. The class of flaw itself is not new. Sardar’s team notes the attacks are subtle enough to have gone undiscovered for years before formal analysis caught them. 

The responsible disclosure resulted in CVE-2026-33697, rated 7.5 on the Common Vulnerability Scoring System, high severity. For comparison, the researchers note in their paper that BadRAM, the 2024 memory aliasing attack against AMD’s SEV-SNP that made headlines in its own right, scored 5.3. The CCC Attestation SIG’s repository lists CVE-2026-33697 as the highest-scoring vulnerability among a cluster of recent confidential computing flaws, ahead of Fabricked (5.9), BreakFAST (5.9) and Staleus (4.0).

The working group and the IETF’s TLS working group have both formally acknowledged the relay attacks. “As implemented today, attested TLS is not mature yet,” Sardar told The Register. “We are investigating further, and we are confident there are more issues yet to be discovered.” 

What makes the finding more pointed is who missed it first. Meta commissioned an extensive security review of its WhatsApp implementation from Trail of Bits, a well-regarded security firm, before Sardar’s team examined it. That review did not detect the relay attack.

It is methodology, not incompetence, that explains the gap. The ESORICS paper records that Sardar’s team contacted Trail of Bits directly, who confirmed no formal methods were used in their review process. Formal verification tools like ProVerif check a protocol exhaustively against every scenario a defined threat model allows. A manual audit, however thorough, samples. A subtle flaw in how evidence is bound to a connection can slip past a sampled review and still be provably broken under exhaustive formal analysis.

The Attestation Special Interest Group of the CCC, which governs the adopted proof-of-concept project Sardar tested, found its own system vulnerable to the same relay attacks. 

A repository nobody would create

The vulnerability itself had already been through a lengthy, orderly disclosure process. Sardar’s team flagged it to Cocos AI in October 2025, the vendor acknowledged it two months later, and the CVE was published in March 2026.

What happened next was different. 

On 14 June, Sardar wrote to the chairs of the CCC’s Attestation Special Interest Group requesting a new public GitHub repository, named relay-attacks-in-intra-handshake, so his formal analysis artefacts for the relay attacks could be released under an Apache 2.0 licence, for use by researchers and the standardization community. He referenced an existing, adopted project under the same group’s governance, the kind of administrative step that, on paper, should take minutes.

Three days later, on 17 June, he sent a reminder. The following day, a second, noting the artefact link was needed for the paper’s final version. On 24 June, ten days after the original request, he wrote again, this time without the diplomatic padding: “I do not see a good reason for such a delay, since the requested repo is part of an adopted project and creation of a new repo is not such a time-consuming task.” The new repository still did not exist.

The CCC’s Attestation Special Interest Group is made up of representatives from the hardware and cloud vendors whose products the research concerns. That fact requires no embellishment. A working group populated by the companies whose attestation implementations were just shown to be vulnerable to relay attacks did not act, for over a week and across three written reminders, on a request to publish proof of that vulnerability.

Since no repository had been created before the paper’s final version went to the publisher, Sardar published the artefacts anyway, but inside an existing CCC-affiliated repository rather than the dedicated one he had asked for. He told The Register the repository had originally been built for an unrelated project: “Since the monopoly [of vendor-dominated working groups over this infrastructure] continues, we have released the artifacts to inform the community and for researchers to analyse it independently.”

The CVE stands regardless, credited and public. The delay changes nothing about the underlying mathematics. 

BSI reaches the same verdict 

None of this requires taking Sardar’s interpretation on faith. A world away from the IETF mailing lists, Germany’s Federal Office for Information Security (BSI) arrived at a closely related conclusion through its own, entirely separate channel.

Carina Hilt, deputy press spokesperson at BSI, was asked directly about confidential computing’s role in digital sovereignty. She told The Register the technology functions as “a defense-in-depth component,” strengthening tenant isolation and protecting confidentiality and integrity, but not availability. Crucially, she added that “dependencies on other services, such as identity and key management etc., are also not mitigated by CC.”

That is, in other words, an institutional echo of exactly the gap Sardar’s protocol analysis exposes: confidential computing’s guarantees stop well short of guaranteeing who actually controls the keys and the identity infrastructure a deployment depends on.

Pressed further on vendor marketing claims, BSI did not soften its position. “The vendors’ positioning on CC might give too much weight to its technical capabilities,” the spokesperson told The Register. “CC alone cannot satisfy the requirements for digital sovereignty.” 

What the chipmakers say

Mikael Moreau, Intel’s France Communication Manager, was asked specifically about the attestation infrastructure underpinning its TDX confidential computing technology, and whether Intel’s own role in that infrastructure constitutes a dependency. He said the company does “not consider its attestation infrastructure to be a limitation to sovereignty guarantees,” arguing that any reliance on Intel’s silicon and certificate root of trust is “bounded.” Intel is not in the customer’s workload data path, does not receive customer plaintext through attestation, and the operational trust decision can be delegated to an independent verifier or retained by the customer. 

That is a carefully constructed, technically defensible answer. It explains the architecture, not the law. Intel was asked whether its attestation infrastructure poses a sovereignty risk under RISAA, the 2024 US law that can compel hardware manufacturers to cooperate with secret intelligence orders. That question went unanswered. 

Google did not respond to a request for comment for this article.

Acknowledged everywhere except the sales pitch

Sardar’s findings prompted four different institutional responses.

The IETF’s Secure Evidence and Attestation Transport (SEAT) working group, formed after a group including Sardar successfully argued for it at a Birds of a Feather session at IETF 123 in Madrid in July 2025, wrote his correlation properties directly into its charter as an explicit, mandatory requirement for any new specification work. That is a standards body doing exactly what it should, building formal verification into the process rather than bolting it on afterwards.

The IETF’s TLS working group formally acknowledged the same attacks, without adopting a binding requirement of its own. The CCC’s inaction over ten days meant Sardar published the evidence himself, without the working group’s help. 

None of that reached the sales conversation. Intel and Google continue to market confidential computing as proof of sovereign, verified protection. Asked directly about the infrastructure underpinning that claim, Intel’s answer stopped short of the legal question at its centre. Google did not answer at all.

For European CIOs and procurement officers, this raises a question beyond the one usually asked. It is no longer only which company owns the cloud or which government can compel which hardware manufacturer. It is whether the cryptographic handshake meant to prove a workload is running where it claims to be running can be trusted at all. 

The level that timing rules out 

Sardar’s own mitigation reaches level two. Level three, the one that actually matters to a customer trying to verify their workload is still protected once data starts flowing, may not be achievable at all within the current architecture of intra-handshake attestation, where evidence is generated during the handshake itself. The timing is the problem. Level three requires binding the evidence to the key that encrypts the actual application data, but by the time that key exists, the evidence has already been sent, unless the TLS protocol itself is significantly changed. Post-handshake attestation waits until after that point, when the key is already there to bind against. 

“We believe post-handshake attestation alone can achieve level three binding,” Sardar told The Register, warning that newer proposals combining both approaches add unnecessary complexity without adding security. His recommendation to the IETF’s TLS working group is blunt: developers should abandon intra-handshake attestation altogether. ®

Android 17 desktop mode has a very simple pitch. Plug your phone into a monitor, add a keyboard and mouse, and watch the slab in your pocket pretend to be a computer. I wanted to give that pitch a fair shot, so I tried using it for an actual workday instead of a cute demo.

The goal was boring on purpose: write an article, edit it, build the page in WordPress, upload whatever needed uploading, and publish the thing without running back to my laptop like a coward.

For a little while, the illusion held together. That’s where the trouble starts.

When almost starts to look convincing

The first hour wasn’t a disaster, which somehow made the whole thing more suspicious. With a monitor, keyboard, mouse, and USB-C hub attached, Android desktop mode looked close enough to the real thing. I had browser tabs open. I could type in a document. I could jump into messaging apps.

For a few minutes, I could even accept the clean little fantasy people have been promising since phones became more powerful than the laptops many of us used in college.

The catch is that desktop mode only feels convenient after you’ve rebuilt half a desk around it. My phone needed a hub so the monitor, charger, keyboard, mouse, and HDMI connection could all behave like members of the same household. Bluetooth can cut down the cable mess, but then you’re juggling pairing, batteries, and the quiet uncertainty of whether everything will reconnect before your patience files a complaint.

When portable stops meaning portable

The portability argument is where things started falling apart. In theory, I could use a hotel TV as a monitor and turn my phone into a tiny newsroom. In practice, that means carrying a small nest of accessories and pretending that still counts as traveling light. Desktop mode solves the problem of not having a laptop by asking me to recreate everything around a laptop except the laptop.

At that point, the obvious question becomes hard to dodge. Why didn’t I just bring the machine with the screen, keyboard, trackpad, ports, battery management, and operating system already built around this exact job?

The annoying answer is that Android desktop mode can still get the job done. I was able to write. I was able to build the page in WordPress. I was able to move through the web tools that make up too much of modern work now. That’s partly because everything is browser-based anyway, so the phone mostly needs to render a pile of web services without giving up.

That sounds like a win until you actually sit with it. WordPress loaded, but page building came with a patience tax. Moving between tabs, managing images, waiting for menus, and treating the browser as my main workspace made every small task feel slightly more deliberate than it should.

The setup didn’t collapse. It just kept reminding me that I was using a workaround with a monitor attached.

When the dream beats the desk

That’s probably the most confusing part of Android desktop mode. It’s capable enough to make the dream feel reasonable, then rough enough to make the current version feel faintly absurd. Phones are already powerful. They’re already everywhere.

The sci-fi version of this is easy to imagine: drop the phone onto a little dock like a wireless charger, watch a full desktop environment wake up, then pretend the holograms aren’t deeply unnecessary but emotionally important.

That future still sounds great to me. I’d love a world where the phone becomes the computer, not a compromised laptop impersonator surrounded by dongles. Android desktop mode feels like a step toward that, but a step isn’t the destination, no matter how many cables are involved.

So yes, I wrote and built an article from my phone. I could even do it again, which may be the most annoying admission here. The harder question is why I would, unless something had already gone wrong.

If the most honest use case is still some version of “I guess, in an emergency,” who is Android desktop mode actually for?

Today’s Argentina vs Scotland live stream in the 2026 Nations Championship sees two perennial dark horses go head-to-head at the Estadio Mario Alberto Kempes in Cordoba for both sides’ opening game of the tournament.

It’s a replay of one of the most exciting matches of the last 12 months. The Scots led 21-0 at halftime when these sides met at Murrayfield in November, before the Pumas roared back to win 33-24. In doing so, the South Americans nudged their way to a one-win advantage in the overall head-to-head between these sides and into the top five of the world rankings. Santiago Carreras starts at full-back, with the evergreen Julian Montoya captaining the side at hooker.

Northwestern University chemists have built a material that begins as an ordinary yellow liquid and rearranges itself into a black gel whenever it absorbs energy. The change locks electrons inside a new structure that can hold them for months when sealed away from air. Open the container later and oxygen triggers the release, powering chemical reactions even in complete darkness.

There’s no need for permanent electrodes or sophisticated battery packs because the material can handle capture, storage, and release on its own simply modifying its structure. Samuel Stupp and his team’s recent research, published in the journal Chem, demonstrates how this works. Tyler Jaynes and Luka Dordevic were the study’s co-first authors, and they carried out some very amazing lab experiments. The design is essentially a duplicate of the cytoskeleton, a dynamic protein network that exists within every cell and is constantly formed and deconstructed to allow the cell to move and expand. All they’ve done is exchange biological fuel for electrons.

National Geographic Amazing Chemistry Set – Chemistry Kit with 100+ Science Experiments Including Crystal…

• OVER 100 EXCITING EXPERIMENTS – The science experiments in this kit let kids explore the wonders of hands-on science experiments. They’ll make…
• EVERYTHING KIDS NEED – This kit includes all materials needed to conduct 15 stunning chemistry experiments, including growing a crystal tree, changing…
• 85 BONUS EXPERIMENTS – Because we know your kids will want to conduct even more science experiments once they get going, we include a bonus experiment…

In their resting state, the custom molecules form independent tiny clusters. Now, push one section of each molecule with light, electricity, X-rays, or chemical fuels, and it will transfer electrons to its partner segment. That causes the charged molecules to stack up because they tend to adhere together in neat little rows, and these rows turn into long, ribbon-like strands that begin to tangle and catch some water, transforming the entire thing into a soft, black gel.

Inside that assembled mess, the electrons are as safe as houses. Northwestern researchers believe that a single gram can store enough electrons to power a smartwatch for several months. To get those electrons out, all you have to do is give the gel some oxygen, which causes the formation of some nasty reactive oxygen species. These reactive compounds can degrade contaminants or initiate other chemical reactions that do not require light to occur. Once the gel has completed its function, it simply begins to degrade and returns to the original yellow liquid from which it originated.

This is a working example of dark photocatalysis, in which energy is stored during the day using sunlight or another input and then used to drive chemical reactions afterward. The substance itself serves as a sort of intermediary, bridging the gap between energy arriving and energy used. The researchers also demonstrated that light can form transitory conductive patterns within the gel, employing masks to ensure that the patterns appear in the first place. These conductive patterns only remain for as long as the gel is created, making them ideal for soft, programmable electronics that appear and disappear as needed.

Traditional batteries simply keep on trucking, storing ions or electrons in their unchangeable circuitry. Solar panels either convert light immediately or fail to do so at all. This technology, on the other hand, allows the material to alter shape and manage energy over time. Then step back once it’s finished, and everything runs in water, because the only thing required to reset the material is ordinary air. It also avoids the metals and plastics that are so prevalent in modern electronics.

This technique could be used to clean up the environment by on-demand oxidation, or to create sterilization systems that employ chemical energy. It could also be used as a power source for soft robotic components that only require a little amount of juice at times. They’re still in the early stages here, and thus far, researchers have only looked at small lab samples under fairly controlled conditions. They still need to figure out how to scale this up so that it works in the real world, enhance the energy density per gram of material, and then convert all of that stored chemical energy into a direct electrical output rather than releasing it as chemical reactions.
[Source]

The incident is also being investigated by the National Highway Traffic Safety Administration.

A leaker with a fair but short track record, claims that Apple has suspended work on the expected AirPods with cameras.

Back in February 2026, leaker Kosutami claimed that AirPods with cameras were coming, and that they would stay the same price as current models. Now the same leaker is back saying that Apple has suspended the whole idea.

That’s literally all this routinely brief leaker says. Reposting a previous claim about the device from June 2026 that said just “case concluded,” Kosutami has now responded with the single word “Suspended.”

It follows a late June 2026 report from Bloomberg that said the device was in the advanced stages of testing. It was said that Apple might not release AirPods with cameras in 2026, but that they were close.

The idea as first described in 2004 by analyst Ming-Chi Kuo, is that AirPods, or more likely AirPods Pro, would feature miniature cameras in the stems. So when worn in the ear, the camera would face forward.

Then if a user asked Siri for information about something in front of them, the cameras could take a still image, or record video footage. That could then be analyzed by Visual Intelligence.

With no further information at all, there can only be speculation over why Apple would suspend the device. If it has, perhaps it’s a consequence of the global chip shortage and Apple prioritizing other devices.

Or perhaps it’s to do with the still unanswered question over privacy. Apple would be expected to put some kind of indicator light on the AirPods to show that images were being recorded, but there’s no confirmation of that.

Kosutami is better known as a collector of prototype Apple devices, though they have also shared inaccurate leaks about the Apple Watch.

Judge Linda Kullberg stated that the ruling is ‘without a doubt the largest claim that has been ordered in a Swedish competition case’.

In a legal dispute regarding an abuse of power in the market for comparison shopping services, search-engine giant Google has been ordered by a Swedish court to pay almost $2bn in damages to PriceRunner, the price comparison business owned by payment platform Klarna.

On Wednesday (1 July), the Patent and Market Court in Stockholm, through judge Linda Kullberg, awarded compensation for lost revenue caused by Google’s perceived preferential treatment of its own comparison shopping service over competing services. 

Kullberg did, however, dismiss further claims wherein PriceRunner asked for an additional $8.2bn. Despite this, Kullberg said the decision still represents “without a doubt the largest claim that has been ordered in a Swedish competition case”. 

Google is in a position to appeal the ruling and stated that it is not in agreement with the court’s findings. 

A spokesperson for the organisation said, “We are reviewing and will consider our legal options. The changes we made to shopping ads back in 2017 are working successfully, generating growth and jobs for hundreds of comparison shopping services who operate more than 1,500 websites across Europe.” 

This is in reference to a decision that was reached in 2017 by the European Commission, in which Google was ordered to pay a €2.4bn penalty for abusing its dominance online as a means of giving its own service an advantage, a result which at the time Google also expressed dismay at and appealed. 

Commenting on the outcome of the latest case, Dan Greaves, Klarna’s head of communications and policy, said, “When markets work well, everyone benefits. Consumers get higher quality at lower cost, companies stay focused on serving customers rather than defending position, and society is better off for it.”

Separately, Google has also lost a long-running dispute over a €4.1bn anti-trust fine imposed by the European Union for a case in which it was determined that Google unfairly leveraged a dominant position in the context of its Android operating system. The decision is legally binding and is a major win for the Brussels-based regulator, as the argument has been in full flow since the case was first ruled upon in 2018. 

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.