Samsung now sells two book-style foldables side by side. The regular Galaxy Z Fold8 starts at $1,899.99. The Z Fold8 Ultra opens at $2,099.99 for the 256GB model and climbs to $2,699.99 for 1TB. That $200 jump lands the Ultra in rare air for a phone that still has to fold in half. The question is simple: does the extra money buy enough to matter?

Unfolded, the Ultra is only 4.1 millimetres thick and weighs roughly 215 grams, making it one of the thinnest and lightest foldables Samsung has ever created for a pocket. Underneath the large display is a dual-layer titanium structure, and the hinge is also made of titanium alloy, as it’s surprisingly difficult to spot the crease nowadays. The whole thing has an IP48 rating, which should be good for being submerged in 1.5 meters of fresh water for half an hour. When folded, it’s somewhat taller and thinner than the standard Fold8, so it’s not as pocket-friendly, but it’s still a good fit.

Samsung Galaxy Z Fold8 Ultra Phone + $350 Gift Card, 512GB, Violet Shadow

• PRE-ORDER NOW: Get an Amazon gift card when you pre-order Samsung Galaxy Z Fold8 Ultra. You will receive an email once your gift card is available…
• SPLIT THE VIEW. MULTITASK¹ TO THE MAX: Productivity never felt this powerful. Use up to three apps¹ at once on the expansive inner screen of Galaxy…
• MULTITASKING MADE SMARTER WITH AI: Stay one step ahead with AI² that suggests which apps you might need next. Then view those multiple windows side…

The outside and inner screens have both expanded in size, with the cover display now measuring 6.5 inches of FHD+ Dynamic AMOLED 2X goodness, and the main panel expanding to a full 8 inches of QXGA+ when the phone is opened. Peak brightness is increased to 3,000 nits, and there’s an anti-reflection coating to keep things from becoming too shiny on the larger surface. There’s also an Adaptive 120Hz refresh rate, which helps keep things smooth whether you’re using the phone one-handed or treating it like a tiny tablet. The difference between viewing a video and running things side by side is rather noticeable.

The Ultra has also received a significant camera upgrade. The main sensor is a 200-megapixel beast with an f/1.7 lens, and there’s Quad Pixel autofocus for extra sharpness. You can also achieve a nice 2x optical-quality cut that retains sharpness. But that’s not all; in addition to the primary sensor, there’s a 50-megapixel ultrawide with an enhanced f/1.9 aperture for capturing more light, as well as a separate 10-megapixel telephoto picture that finally provides genuine 3x optical zoom. To make things even more intriguing, the main and ultrawide cameras can also shoot 8K video. When you add Nightography and the ProVisual Engine to help with low-light shots, as well as Super Steady to keep your handheld videos from being too shaky, it’s evident that the Ultra is in a class by itself when it comes to camera performance. You can’t help but make comparisons to the S26 Ultra, and to be honest, the difference is now less than it has ever been on a foldable. The normal Fold8, on the other hand, only has two 50-megapixel cameras and no optical telephoto. Zoom and detail are obviously going to be more of an issue with that one.

Inside the Ultra, you’ll find the same dependable Snapdragon 8 Elite Gen 5 chip, which has been optimized to maximize Galaxy phone performance. You can get it with 256GB or 512GB of storage and 12GB of RAM, or if you want to go all out, 1TB of storage and 16GB of RAM. The battery has finally expanded to 5,000 mAh, making it the largest Samsung has ever put in a Fold, and it claims up to 27 hours of video playback. There’s also charging, 45W wired charging should charge your battery to two-thirds capacity in under an hour.

Software includes the whole new One UI 9, which puts a comprehensive set of Galaxy AI tools at your fingertips. The Nudge tool just observes what you’re doing and makes excellent ideas for using split screen in a way that suits you. My FanCam can lock onto a subject and reframe the video on the fly, all without you having to move a finger. With Photo Assist, you can simply type a text prompt and move, remove, or expand items; it’s that simple. Many of these capabilities are also available on the standard Fold8, but having more screen real estate on the larger version helps them feel more natural, especially when you have numerous windows open.
[Source]

• Guardio Labs found CVE‑2026‑48294 in Adobe Acrobat Chrome extension, enabling cross‑site data disclosure
• Attackers could steal WhatsApp Web chats if victims opened malicious landing pages with extension active
• Adobe patched the flaw in version 26.7.2.0; update recommended for 314M extension users

If you have Adobe Acrobat’s extension for Chrome, and you like chatting through WhatsApp Web, there is a potential security vulnerability you might want to address.

Security researchers from Guardio Labs discovered a “universal cross-site scripting (UXSS)-class cross-origin data disclosure vulnerability”, which is another way of saying that a website could use the flaw to read the contents of a different website, loaded in a separate tab.

Despite being a GoPro product, the Wireless Mic System isn’t limited to action cameras. The main selling point here, though, is its direct connectivity to GoPros. Since the Hero 12, you could connect a Bluetooth microphone directly. Ironically, that meant, up until now, DJI’s Mic Mini and Mic 3 were likely the best options for connecting directly to a GoPro as those both offer Bluetooth alongside a physical receiver.

Pairing the Wireless Mic System with the camera is simple: Turn on one of the microphones and tap the power button three times to switch to Bluetooth mode. Turn the mic off, then back on while keeping the power button held down to pair. The GoPro recognizes the mic and you’re all set. You can pair either microphone to the camera, but only one at a time. A single press of the mic button turns on noise reduction and a white LED confirms it’s activated.

Using either of the receivers is as simple as connecting to the camera or PC via USB or 3.5mm (depending which one you’re using) and then turning on the mic. Unless you last used it with a Bluetooth connection, in which case, three taps of the power button will put you back in receiver mode.

While it’s a major benefit to connect a mic to a GoPro without a receiver, the hardware receiver offers superior audio quality. What’s more, it means you can use both mics at the same time. The USB receiver is designed to fit neatly into a GoPro’s recessed USB port. You don’t need to fully remove the protective door from the camera, but you can if you want things to look a little neater. If you plan on using the kit with a phone, the dongle slightly extends from the base of your handset, but it’s snug and practical, and feels secure.

James Trew for Engadget

I noticed while using both microphones and the USB receiver, the GoPro only shows one VU meter on its display. At first, it looks like only one mic is connected, but watching back through the video, both are in fact recorded.

In this setup, the mics record in “split” mode, one mic on the left channel and the other on the right. This is jarring when listening back on headphones or a TV with connected speakers. The TRS receiver lets you change between mono or stereo, but right now there’s no apparent way to do this with the USB dongle. This means you need to convert the track to mono in editing software, which adds friction if you just want to share a clip directly from your phone or PC.

With your phone, you can side-step this issue with apps like Blackmagic camera that have the option to merge both channels, but most native camera apps don’t offer this. Combined with the UI issue mentioned above, it feels a little clumsy. The good news is, it should be easy to fix in a firmware update. GoPro itself has two apps — Quick and the Fluid camera — that could offer a way to update settings on the USB dongle, but right now you’re stuck with workarounds.

While we’re talking feature requests, there’s no way to start and stop recording on a GoPro with GoPro’s own mics, something DJI offers and a feature I use all the time with its Osmo cameras. It’s a small detail, but I feel it’s a missed opportunity.

• South Korean government discloses ten‑month cyberattack on the National Diplomatic Academy’s online education system
• Data stolen included user IDs, names, emails, and encrypted passwords of at least 6,000 individuals
• MFA shut down IT systems, deployed enhanced security, and delayed disclosure due to diplomatic sensitivity

Current and former employees of the South Korean Ministry of Foreign Affairs (MFA), as well as other government personnel, may have had their data siphoned out by cybercriminals in an attack that lasted for ten months.

The South Korean government has disclosed an attack against the online education system of its National Diplomatic Academy. The system, set up in 2022 by the country’s premier institution for educating and training diplomats, apparently contained a security vulnerability that unnamed threat actors managed to exploit.

Samsung’s latest Galaxy Unpacked event wasn’t just about new hardware. Alongside the Galaxy Z Fold8, Galaxy Z Flip8 and new Galaxy Watch lineup, Google used the occasion to announce a series of updates aimed at Android developers, encouraging them to optimize apps for a growing range of foldable devices and wearable form factors.

The guidance focuses on one challenge that has become increasingly relevant as foldables evolve: building apps that work seamlessly across different screen sizes, aspect ratios and device postures. With the Galaxy Z Fold 8 adopting a wider, landscape-first display, Google says developers can no longer assume every Android phone follows the traditional portrait-first design philosophy.

The company has also introduced new tools for camera apps, adaptive layouts, AI-powered features and Wear OS 7 widgets, making this one of its broader developer updates around Android’s expanding device ecosystem.

Google expands adaptive app toolkit for foldables

The biggest change is Google’s renewed focus on adaptive app design. Instead of designing apps around fixed screen dimensions, Google is encouraging developers to build interfaces that automatically adjust based on the available window size. The company recommends using Window Size Classes through the Jetpack WindowManager library to detect how much screen space an app actually has, particularly when devices enter split-screen or multi-window modes.

Google is also highlighting the latest Jetpack Compose April 2026 release (Compose BOM version 2026.04.01), which introduces a new Grid API, FlexBox layout API, and MediaQuery API. Together, these tools allow developers to build layouts that can adapt to changing screen sizes, fold states, keyboard configurations, and device posture without relying on hardcoded interface rules.

The company is also asking developers to make apps “fold aware” by detecting hinges and fold lines through Jetpack WindowManager. That allows applications to avoid placing important controls across the fold while maintaining app state when users switch between folded and unfolded modes.

Camera apps are receiving attention as well. Google recommends migrating to CameraX, whose PreviewView automatically manages camera orientation, scaling, and display changes during folding transitions. Developers maintaining Camera2-based apps can instead use the CameraViewfinder library to simplify preview handling without rewriting their camera stack.

Wear OS 7 and Gemini Nano 4 open new opportunities

The updates extend beyond foldable phones. With Wear OS 7, Google is introducing Wear Widgets, allowing developers to build glanceable widgets using Jetpack Glance and RemoteCompose. These widgets can now appear inside multi-widget tiles, giving third-party developers access to functionality that was previously limited to Google’s own apps.

Google is also encouraging developers to build on-device AI experiences for Samsung’s latest devices. The new Galaxy foldables ship with Gemini Nano 4, which supports more than 140 languages and improved multimodal capabilities. Through ML Kit’s Prompt API, developers can integrate structured outputs and reasoning features into apps without relying entirely on cloud-based AI processing.

While these announcements don’t introduce new Android features for end users, they provide an early look at where Google’s software priorities are heading. As foldables become more diverse and wearables continue to evolve, Android developers are being encouraged to build apps that adapt to changing hardware rather than assuming every device looks and behaves like a conventional smartphone.

A nine-year-old race condition vulnerability in the Linux kernel’s XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges.

Dubbed RefluXFS by the Qualys Threat Research Unit (TRU), which found and reported it, the security flaw affects systems with an XFS filesystem with reflink enabled (a default configuration on major enterprise Linux distributions), running Linux kernel v4.11 or later, with a directory writable by an unprivileged local user, and a high-value target (a root-owned configuration file or SUID-root binary).

Also, standard defenses (including the Security-Enhanced Linux SELinux kernel security module, kernel lockdown, container isolation mechanisms, and memory-protection features like KASLR, SMEP, and SMAP) don’t block RefluXFS attacks because the flaw operates at the filesystem allocation layer, below where those protections apply.

According to Qualys, exploitation is highly reliable, leaves no kernel log output, and the on-disk modification survives a system reboot.

“The attacker reflink-clones a target file (for example /etc/passwd, or a SUID-root binary such as /usr/bin/su) into a scratch file they own, then races concurrent O_DIRECT writes on that scratch file,” the Qualys TRU team explains in a detailed technical write-up published on Wednesday.

“A lock-drop window in the kernel’s copy-on-write allocation path lets one of those writes land, not in the attacker’s own storage, but in the physical block that still backs the original file. The change is made directly on disk, persists across reboot, produces no kernel log output, and does not touch the target file’s inode — so a modified SUID-root binary keeps its SUID bit.”

RefluXFS has existed since kernel version 4.11, after being introduced in February 2017 by commit 3c68d44a2b49. It has been present in every mainline and stable kernel since and was patched on July 16 after commit 2f4acd0was merged into the Linux kernel source tree.

The list of impacted Linux distros includes Red Hat Enterprise Linux (RHEL), Oracle Linux, Amazon Linux and Fedora, as well as CentOS Stream, Rocky Linux, AlmaLinux and CloudLinux.

Qualys estimates that it potentially affects more than 16.4 million systems based on analysis using its Cybersecurity Asset Management software.

Saeed Abbasi, the head of Qualys’ Threat Research Unit, says the discovery emerged from a research initiative between Qualys and Anthropic, in which researchers integrated the AI model Claude Mythos Preview into their manual audit workflow.

The Claude Mythos Preview was tasked with hunting for a race condition resembling the “Dirty COW” vulnerability class, and after iterative refinement identified the flaw in XFS and generated a functional proof-of-concept. Abbasi added that the Qualys security researchers then reviewed the model’s reasoning, reproduced the exploit, and independently verified all technical claims before coordinating disclosure with kernel maintainers.

“Immediate kernel patching is recommended to neutralize this vulnerability. Exploitation succeeds consistently under standard hardening settings, and the on-disk modification survives a system reboot,” said Abbasi.

“Vendor-fixed kernels are now available and being backported to enterprise distributions. Organizations should prioritize patching exposed and multi-tenant systems and ensure a reboot to verify the update. As of now, there are no reliable or practical mitigations or temporary configuration changes available.”

RefluXFS is the latest in a long series of Linux privilege escalation vulnerabilities disclosed since the start of the year, including CIFSwitch, PinTheft, Copy Fail, Dirty Frag, Fragnesia, Pack2TheRoot, and DirtyDecrypt/DirtyCBC.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

SOFTWARE

Mozilla walls off your online identities as MZLA unleashes a bumper repair job

Mozilla released Firefox 153 on Tuesday, closely followed by MZLA with Thunderbird 153 – codenamed “Meadow” for reasons that remain obscure for now.

Firefox 153 is Mozilla’s new Extended Support Release (ESR), so it will receive security updates until some time after the next ESR in mid-2027. We covered the highlights of what’s new in this version last week.

Firefox 153 will be good news if you used the Multi-Account Containers extension: a preview version of the functionality is now built in. Firefox already has user profiles, which let you keep sets of settings and credentials separate. With some extra effort, you can even launch multiple separate instances of Firefox with different profiles. Containers make similar functionality much easier: each container has its own set of stored credentials. So, for instance, a “home” container could hold a set of tabs logged into various sites with your personal accounts, while a “work” container could log into the same sites with your day-job credentials.

There are also new features for users on mobile. Firefox 153 for Android gets tab groups, while Firefox for iOS users in the US get the new Quick Answers feature. Speech recognition happens on the device, although the transcribed question is sent online to generate an answer.

Thunderbird ‘Meadow’

MZLA’s Thunderbird messaging client also has a new version, itself an ESR: Thunderbird 153.

This version is codenamed “Meadow,” replacing the previous “Eclipse” release, but at the time of writing, info about what “Meadow” signifies is scant. The New in Thunderbird Desktop page hasn’t been updated since Thunderbird 150, which came out back in April. At least there’s some info there, even if it’s outdated. At the time of writing, following the What’s New in Thunderbird 153 link in the release notes gives this helpful info:

Since that final link is the only helpful thing there, we’ve done so. It might even be fixed by the time you read this.

Perhaps the team has been too busy fixing things instead, which seems like respectable prioritization to us. Under What’s New are 32 refinements, 15 entries under What’s Changed, and a whopping 181 bug fixes under What’s Fixed.

This many changes is good news for an ESR release, and it looks like the team has been busy fixing things. It does make us wonder if MZLA is struggling to keep up with Firefox’s monthly release schedule, as it’s been doing since Thunderbird 138 in April 2025. Since Mozilla decided to accelerate Firefox to fortnightly releases from September, perhaps MZLA should drop Thunderbird back down to annual releases.

Still, this ESR brings improvements to folder handling, notifications, OpenPGP encryption, OAuth login, address book export, PDF handling, and much more. There won’t be any more 32-bit Linux binaries – joining Firefox, which did that in September after Firefox 144. “Junk” mail is now called “Spam,” and the dedicated setup option for the Russian Odnoklassniki service has been dropped, with users directed to configure it through XMPP instead.

Thunderbird offers so many different views that we’ve seen some user confusion about this, but they are handy, and a few of the non-default ones are improved in this release. We sometimes use the “Unread Folders” view, and it’s now better at hiding folders with no unread messages. The other non-obvious view is “Unified Folders.” This categorizes and combines multiple inboxes into one tree: all your inboxes, followed by separate per-account trees of all subfolders. It sounds confusing, but we find it very helpful. This view now lets you color-code different accounts.

Several of Thunderbird’s new options around account handling concern Thundermail accounts. These are part of MZLA’s paid email service, Thunderbird Pro. This hasn’t been launched yet, but the new account type suggests it’s getting close. One of the most visible signs is in the Account Hub wizard for adding messaging accounts: it now has a “Sign in with Thundermail” button at the top.

This vulture is on the waiting list, and we will report back when we get to the front of the line. ®

Apple reportedly plans to launch a Klarna-backed financing program next week that will let you pay off an iPhone, iPad, Mac, or Apple Watch in monthly installments over two to three years. While Apple hasn’t shared any details about the rumored “Apple Upgrade” program yet, code spotted in an iOS 27 beta release suggests the company has already built a system to deal with customers who fall behind on payments.

A built-in switch lenders can flip to lock most apps

According to 9to5Mac, iOS 27 includes a new framework called App Managed Features, which hands an approved lending app the ability to monitor whether a customer has been keeping up with payments. If they miss enough installments, the lender can put their iPhone in Restricted Mode, which blocks access to all but nine apps.

Phone, Settings, Wallet, Clock, Health, Passwords, Magnifier, Accessibility Reader, and the App Store will reportedly continue to work. Subscriptions tied to any blocked apps will also keep running, since Restricted Mode doesn’t appear to touch App Store billing. That means someone locked out of an app will be charged even if they can’t use the subscriptions.

A second layer called Partner Finance Lock will close off the obvious workarounds, preventing users from disabling Restricted Mode with a factory reset, selling a restricted device, or stripping it for parts.

The lender sets the rules, not Apple

Messages, Home, and other apps that send critical alerts may stay available during a lockout. That call reportedly sits with the lender, so the exceptions a user gets could depend on who financed the phone.

The code also sets no threshold for how many missed payments trigger a lockout, suggesting that financing partners will decide those terms as well. If that’s the case, the agreement a customer signs will be the only place to learn how much wiggle room they get.

None of this is confirmed, and Apple could make further changes before the system rolls out with iOS 27 later this year. It’s also unclear whether the same system will reach financed iPads, Macs, or Apple Watches.

What just happened? Nvidia has released more information about its upcoming Vera data center CPU this week, including key details about the custom Olympus cores that are purpose-built for agentic AI workloads. The company also claimed that the new core architecture offers faster single-core performance than competing products.

Part of Nvidia’s Vera Rubin platform, the Arm-based Vera CPU is designed to perform complex reasoning, facilitate tool execution, generate code, and plan tasks for AI agents. Developed as a multi-purpose chip, it can also handle scientific data processing and reinforcement learning, which demand more CPU power than typical AI workloads.

Each Vera CPU incorporates 88 Olympus cores, 176 physical threads, a 64KB four-way L1 instruction cache, and 164MB of unified L3 cache on a monolithic compute die. It also features a 48-instruction decode queue. The mid-core incorporates a 96KB six-way L1 data cache and a 2MB eight-way L2 cache, alongside a hardware graph prefetcher for data-intensive graph and analytics workloads.

Each custom core comprise a wide front-end with optimized branch predictors, a mid-core with critical path acceleration, and an execution engine with complex vector optimization. They offer high-bandwidth instruction fetch supporting up to 16 instructions per cycle and include a 10-wide decode engine processing up to ten fused instructions per cycle.

Olympus’ branch prediction subsystem includes a neural branch predictor capable of reducing wrong-path execution on specific branch patterns. Combined with the wide decode path, it also helps improve front-end throughput for latency-sensitive workloads, such as agentic AI and reinforcement learning.

The Olympus core architecture integrates Nvidia’s Spatial Multithreading technology, enabling flexible resource partitioning. It also supports the Scalable Coherency Fabric for 3.4 TB/s of on-die core-to-core bandwidth, 1.2 TB/s of aggregate SOCAMM2 LPDDR5X memory bandwidth, and up to 1.5 TB of memory capacity.

Vera supports 1.8 TB/s connectivity on NVLink-C2C, PCIe 6.4, and CXL 3.1. It supports dual-socket scaling, too, with each socket providing 176 PCIe Gen 6 lanes. To improve latency in dual-socket systems, Vera uses a software-based solution where each socket presents itself as a single NUMA domain, avoiding fragmentation and creating a clean two-NUMA-node topology.

To back up its claims about Vera’s performance, Nvidia published its internal SPEC CPU 2026 test results from earlier this month. The data seems to show that Vera delivers up to 1.8 times the performance of AMD’s Epyc Turin 9755 systems in select agentic AI workloads, such as 714.cpython_r. However, the results have yet to be independently verified.

Sixteen million light-years away, in the constellation Canes Venatici, sits a spiral galaxy that refuses to look ordinary. NASA’s Chandra X-ray Observatory recently delivered a composite view of Messier 94, also catalogued as NGC 4736, that layers high-energy X-rays over a ground-based optical photograph. The result shows a bright central region wrapped in a tight ring of intense star formation, with the whole structure set against a softer outer disk that stretches farther than early observers realized.

X-rays detected by Chandra illuminate the galaxy in all of its brilliance, with brilliant reds, oranges, and blues where heated gas cools to millions of degrees. Those electrifying colors appear on top of a more recognizable scene, constructed by amateur astronomers Brian Brennan and Remi Lacasse with a typical red, green, and blue color scheme. When combined, the galaxy’s inner ring is very striking. That ring is more than just an adornment; a chunk of gas swirling inward is directed along an oval-shaped path, where it accumulates and piles high before shattering into intense explosions of stars. These newborn stars are only a few million years old, and they are what cause the flash of activity we see today, known as a starburst ring, which is where the majority of the galaxy’s star formation occurs.

LEGO Technic NASA Artemis Space Launch System Rocket Building Toy for Boys & Girls – STEM Learning…

• BUILD AN OFFICIAL NASA ROCKET – Kids prepare to explore outer space with the LEGO Technic NASA Artemis Space Launch System Rocket (42221) building…
• 3-STAGE ROCKET SEPARATION – Young builders can turn the hand crank to watch the rocket separate in 3 distinct stages: solid rocket boosters, core…
• STEM BUILDING TOY FOR KIDS – This educational rocket kit was created in collaboration with NASA and ESA to showcase the authentic system that will…

Messier 94 is a monster of a galaxy, measuring almost 50,000 light-years wide in its main body, with fainter outlying portions stretching it out slightly. Its core shines brilliantly, a bit of an anomaly, as they’ve classified it as a LINER, which is basically a region where incredibly old stars produce a lot of light, and at the center of it all is a supermassive black hole with a mind-boggling 16 million times the mass of our Sun. That black hole in the center has an oval-shaped partner, similar to a cosmic pump, which drives material into the starburst ring and accelerates star formation. Beyond that, as you move outwards towards the edges, the light dims dramatically before picking up again in a flatter zone that was formerly assumed to be a second ring altogether. Later, when scientists looked at it in other wavelengths, they discovered that it was simply the outer spiral arms that appear to form a ring from our perspective.

Pierre Méchain first discovered this galaxy in March 1781, and two days later Charles Messier added it to his famous list. For centuries, this was just this dazzling tiny compact spiral, and it appeared to be any other spiral at the time, but as you go deeper, you can see the outer arms and the very surprising way that star formation is just happening on the outskirts. It gets even more interesting when you consider that a portion of the outer disk comprises a solid 23% of the galaxy’s total mass but still produces 10% of all new stars, and it does so at a significantly higher rate than the interior parts.