A nine-year-old race condition vulnerability in the Linux kernel’s XFS filesystem, tracked as CVE-2026-64600, allows local attackers to overwrite protected files and gain root privileges.

Dubbed RefluXFS by the Qualys Threat Research Unit (TRU), which found and reported it, the security flaw affects systems with an XFS filesystem with reflink enabled (a default configuration on major enterprise Linux distributions), running Linux kernel v4.11 or later, with a directory writable by an unprivileged local user, and a high-value target (a root-owned configuration file or SUID-root binary).

Also, standard defenses (including the Security-Enhanced Linux SELinux kernel security module, kernel lockdown, container isolation mechanisms, and memory-protection features like KASLR, SMEP, and SMAP) don’t block RefluXFS attacks because the flaw operates at the filesystem allocation layer, below where those protections apply.

According to Qualys, exploitation is highly reliable, leaves no kernel log output, and the on-disk modification survives a system reboot.

“The attacker reflink-clones a target file (for example /etc/passwd, or a SUID-root binary such as /usr/bin/su) into a scratch file they own, then races concurrent O_DIRECT writes on that scratch file,” the Qualys TRU team explains in a detailed technical write-up published on Wednesday.

“A lock-drop window in the kernel’s copy-on-write allocation path lets one of those writes land, not in the attacker’s own storage, but in the physical block that still backs the original file. The change is made directly on disk, persists across reboot, produces no kernel log output, and does not touch the target file’s inode — so a modified SUID-root binary keeps its SUID bit.”

RefluXFS has existed since kernel version 4.11, after being introduced in February 2017 by commit 3c68d44a2b49. It has been present in every mainline and stable kernel since and was patched on July 16 after commit 2f4acd0was merged into the Linux kernel source tree.

The list of impacted Linux distros includes Red Hat Enterprise Linux (RHEL), Oracle Linux, Amazon Linux and Fedora, as well as CentOS Stream, Rocky Linux, AlmaLinux and CloudLinux.

Qualys estimates that it potentially affects more than 16.4 million systems based on analysis using its Cybersecurity Asset Management software.

Saeed Abbasi, the head of Qualys’ Threat Research Unit, says the discovery emerged from a research initiative between Qualys and Anthropic, in which researchers integrated the AI model Claude Mythos Preview into their manual audit workflow.

The Claude Mythos Preview was tasked with hunting for a race condition resembling the “Dirty COW” vulnerability class, and after iterative refinement identified the flaw in XFS and generated a functional proof-of-concept. Abbasi added that the Qualys security researchers then reviewed the model’s reasoning, reproduced the exploit, and independently verified all technical claims before coordinating disclosure with kernel maintainers.

“Immediate kernel patching is recommended to neutralize this vulnerability. Exploitation succeeds consistently under standard hardening settings, and the on-disk modification survives a system reboot,” said Abbasi.

“Vendor-fixed kernels are now available and being backported to enterprise distributions. Organizations should prioritize patching exposed and multi-tenant systems and ensure a reboot to verify the update. As of now, there are no reliable or practical mitigations or temporary configuration changes available.”

RefluXFS is the latest in a long series of Linux privilege escalation vulnerabilities disclosed since the start of the year, including CIFSwitch, PinTheft, Copy Fail, Dirty Frag, Fragnesia, Pack2TheRoot, and DirtyDecrypt/DirtyCBC.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

SOFTWARE

Mozilla walls off your online identities as MZLA unleashes a bumper repair job

Mozilla released Firefox 153 on Tuesday, closely followed by MZLA with Thunderbird 153 – codenamed “Meadow” for reasons that remain obscure for now.

Firefox 153 is Mozilla’s new Extended Support Release (ESR), so it will receive security updates until some time after the next ESR in mid-2027. We covered the highlights of what’s new in this version last week.

Firefox 153 will be good news if you used the Multi-Account Containers extension: a preview version of the functionality is now built in. Firefox already has user profiles, which let you keep sets of settings and credentials separate. With some extra effort, you can even launch multiple separate instances of Firefox with different profiles. Containers make similar functionality much easier: each container has its own set of stored credentials. So, for instance, a “home” container could hold a set of tabs logged into various sites with your personal accounts, while a “work” container could log into the same sites with your day-job credentials.

There are also new features for users on mobile. Firefox 153 for Android gets tab groups, while Firefox for iOS users in the US get the new Quick Answers feature. Speech recognition happens on the device, although the transcribed question is sent online to generate an answer.

Thunderbird ‘Meadow’

MZLA’s Thunderbird messaging client also has a new version, itself an ESR: Thunderbird 153.

This version is codenamed “Meadow,” replacing the previous “Eclipse” release, but at the time of writing, info about what “Meadow” signifies is scant. The New in Thunderbird Desktop page hasn’t been updated since Thunderbird 150, which came out back in April. At least there’s some info there, even if it’s outdated. At the time of writing, following the What’s New in Thunderbird 153 link in the release notes gives this helpful info:

Since that final link is the only helpful thing there, we’ve done so. It might even be fixed by the time you read this.

Perhaps the team has been too busy fixing things instead, which seems like respectable prioritization to us. Under What’s New are 32 refinements, 15 entries under What’s Changed, and a whopping 181 bug fixes under What’s Fixed.

This many changes is good news for an ESR release, and it looks like the team has been busy fixing things. It does make us wonder if MZLA is struggling to keep up with Firefox’s monthly release schedule, as it’s been doing since Thunderbird 138 in April 2025. Since Mozilla decided to accelerate Firefox to fortnightly releases from September, perhaps MZLA should drop Thunderbird back down to annual releases.

Still, this ESR brings improvements to folder handling, notifications, OpenPGP encryption, OAuth login, address book export, PDF handling, and much more. There won’t be any more 32-bit Linux binaries – joining Firefox, which did that in September after Firefox 144. “Junk” mail is now called “Spam,” and the dedicated setup option for the Russian Odnoklassniki service has been dropped, with users directed to configure it through XMPP instead.

Thunderbird offers so many different views that we’ve seen some user confusion about this, but they are handy, and a few of the non-default ones are improved in this release. We sometimes use the “Unread Folders” view, and it’s now better at hiding folders with no unread messages. The other non-obvious view is “Unified Folders.” This categorizes and combines multiple inboxes into one tree: all your inboxes, followed by separate per-account trees of all subfolders. It sounds confusing, but we find it very helpful. This view now lets you color-code different accounts.

Several of Thunderbird’s new options around account handling concern Thundermail accounts. These are part of MZLA’s paid email service, Thunderbird Pro. This hasn’t been launched yet, but the new account type suggests it’s getting close. One of the most visible signs is in the Account Hub wizard for adding messaging accounts: it now has a “Sign in with Thundermail” button at the top.

This vulture is on the waiting list, and we will report back when we get to the front of the line. ®

Apple reportedly plans to launch a Klarna-backed financing program next week that will let you pay off an iPhone, iPad, Mac, or Apple Watch in monthly installments over two to three years. While Apple hasn’t shared any details about the rumored “Apple Upgrade” program yet, code spotted in an iOS 27 beta release suggests the company has already built a system to deal with customers who fall behind on payments.

A built-in switch lenders can flip to lock most apps

According to 9to5Mac, iOS 27 includes a new framework called App Managed Features, which hands an approved lending app the ability to monitor whether a customer has been keeping up with payments. If they miss enough installments, the lender can put their iPhone in Restricted Mode, which blocks access to all but nine apps.

Phone, Settings, Wallet, Clock, Health, Passwords, Magnifier, Accessibility Reader, and the App Store will reportedly continue to work. Subscriptions tied to any blocked apps will also keep running, since Restricted Mode doesn’t appear to touch App Store billing. That means someone locked out of an app will be charged even if they can’t use the subscriptions.

A second layer called Partner Finance Lock will close off the obvious workarounds, preventing users from disabling Restricted Mode with a factory reset, selling a restricted device, or stripping it for parts.

The lender sets the rules, not Apple

Messages, Home, and other apps that send critical alerts may stay available during a lockout. That call reportedly sits with the lender, so the exceptions a user gets could depend on who financed the phone.

The code also sets no threshold for how many missed payments trigger a lockout, suggesting that financing partners will decide those terms as well. If that’s the case, the agreement a customer signs will be the only place to learn how much wiggle room they get.

None of this is confirmed, and Apple could make further changes before the system rolls out with iOS 27 later this year. It’s also unclear whether the same system will reach financed iPads, Macs, or Apple Watches.

What just happened? Nvidia has released more information about its upcoming Vera data center CPU this week, including key details about the custom Olympus cores that are purpose-built for agentic AI workloads. The company also claimed that the new core architecture offers faster single-core performance than competing products.

Part of Nvidia’s Vera Rubin platform, the Arm-based Vera CPU is designed to perform complex reasoning, facilitate tool execution, generate code, and plan tasks for AI agents. Developed as a multi-purpose chip, it can also handle scientific data processing and reinforcement learning, which demand more CPU power than typical AI workloads.

Each Vera CPU incorporates 88 Olympus cores, 176 physical threads, a 64KB four-way L1 instruction cache, and 164MB of unified L3 cache on a monolithic compute die. It also features a 48-instruction decode queue. The mid-core incorporates a 96KB six-way L1 data cache and a 2MB eight-way L2 cache, alongside a hardware graph prefetcher for data-intensive graph and analytics workloads.

Each custom core comprise a wide front-end with optimized branch predictors, a mid-core with critical path acceleration, and an execution engine with complex vector optimization. They offer high-bandwidth instruction fetch supporting up to 16 instructions per cycle and include a 10-wide decode engine processing up to ten fused instructions per cycle.

Olympus’ branch prediction subsystem includes a neural branch predictor capable of reducing wrong-path execution on specific branch patterns. Combined with the wide decode path, it also helps improve front-end throughput for latency-sensitive workloads, such as agentic AI and reinforcement learning.

The Olympus core architecture integrates Nvidia’s Spatial Multithreading technology, enabling flexible resource partitioning. It also supports the Scalable Coherency Fabric for 3.4 TB/s of on-die core-to-core bandwidth, 1.2 TB/s of aggregate SOCAMM2 LPDDR5X memory bandwidth, and up to 1.5 TB of memory capacity.

Vera supports 1.8 TB/s connectivity on NVLink-C2C, PCIe 6.4, and CXL 3.1. It supports dual-socket scaling, too, with each socket providing 176 PCIe Gen 6 lanes. To improve latency in dual-socket systems, Vera uses a software-based solution where each socket presents itself as a single NUMA domain, avoiding fragmentation and creating a clean two-NUMA-node topology.

To back up its claims about Vera’s performance, Nvidia published its internal SPEC CPU 2026 test results from earlier this month. The data seems to show that Vera delivers up to 1.8 times the performance of AMD’s Epyc Turin 9755 systems in select agentic AI workloads, such as 714.cpython_r. However, the results have yet to be independently verified.

Sixteen million light-years away, in the constellation Canes Venatici, sits a spiral galaxy that refuses to look ordinary. NASA’s Chandra X-ray Observatory recently delivered a composite view of Messier 94, also catalogued as NGC 4736, that layers high-energy X-rays over a ground-based optical photograph. The result shows a bright central region wrapped in a tight ring of intense star formation, with the whole structure set against a softer outer disk that stretches farther than early observers realized.

X-rays detected by Chandra illuminate the galaxy in all of its brilliance, with brilliant reds, oranges, and blues where heated gas cools to millions of degrees. Those electrifying colors appear on top of a more recognizable scene, constructed by amateur astronomers Brian Brennan and Remi Lacasse with a typical red, green, and blue color scheme. When combined, the galaxy’s inner ring is very striking. That ring is more than just an adornment; a chunk of gas swirling inward is directed along an oval-shaped path, where it accumulates and piles high before shattering into intense explosions of stars. These newborn stars are only a few million years old, and they are what cause the flash of activity we see today, known as a starburst ring, which is where the majority of the galaxy’s star formation occurs.

LEGO Technic NASA Artemis Space Launch System Rocket Building Toy for Boys & Girls – STEM Learning…

• BUILD AN OFFICIAL NASA ROCKET – Kids prepare to explore outer space with the LEGO Technic NASA Artemis Space Launch System Rocket (42221) building…
• 3-STAGE ROCKET SEPARATION – Young builders can turn the hand crank to watch the rocket separate in 3 distinct stages: solid rocket boosters, core…
• STEM BUILDING TOY FOR KIDS – This educational rocket kit was created in collaboration with NASA and ESA to showcase the authentic system that will…

Messier 94 is a monster of a galaxy, measuring almost 50,000 light-years wide in its main body, with fainter outlying portions stretching it out slightly. Its core shines brilliantly, a bit of an anomaly, as they’ve classified it as a LINER, which is basically a region where incredibly old stars produce a lot of light, and at the center of it all is a supermassive black hole with a mind-boggling 16 million times the mass of our Sun. That black hole in the center has an oval-shaped partner, similar to a cosmic pump, which drives material into the starburst ring and accelerates star formation. Beyond that, as you move outwards towards the edges, the light dims dramatically before picking up again in a flatter zone that was formerly assumed to be a second ring altogether. Later, when scientists looked at it in other wavelengths, they discovered that it was simply the outer spiral arms that appear to form a ring from our perspective.

Pierre Méchain first discovered this galaxy in March 1781, and two days later Charles Messier added it to his famous list. For centuries, this was just this dazzling tiny compact spiral, and it appeared to be any other spiral at the time, but as you go deeper, you can see the outer arms and the very surprising way that star formation is just happening on the outskirts. It gets even more interesting when you consider that a portion of the outer disk comprises a solid 23% of the galaxy’s total mass but still produces 10% of all new stars, and it does so at a significantly higher rate than the interior parts.

The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers.

The malware is written in Rust and uses the Chrome DevTools Protocol (CDP) to control a headless browser session and establish a connection to the attacker’s server.

Since the malware routes all communication through the browser, it does not make any direct connection to the C2 infrastructure, significantly lowering the risk of detection.

The Chaos ransomware group emerged in early 2025, unrelated to the same-named ransomware family that existed since 2021.

Earlier this year, researchers at Rapid7 found that Chaos was leveraged by Iranian state-backed hackers ‘MuddyWater’ to disguise their cyber-espionage operations as financially motivated attacks.

More recent Chaos ransomware attacks observed by the Cisco Talos research team started through email or voice phishing and continued with the installation of remote management software to establish persistence.

Once inside the environment, the attacker downloaded an MSI installer posing as a Windows update, which loads msaRAT (lib.dll) directly in system memory.

Hijacking Chrome

Once launched, msaRAT searches for Chrome or Microsoft Edge and launches the browser in headless mode, where the process starts without any visible window.

Next, it enables the browser’s remote debugging interface and connects to it via CDP. After this step, it opens a new browser tab and injects JavaScript into it using CDP commands.

The injected JavaScript is responsible for building the communication channel, bypassing Chrome’s Content Security Policy (CSP), and registering several CDP bindings that enable communications.

Once the initial setup is complete, the browser contacts a Cloudflare Workers endpoint (is-01-ast[.]ols-img-12[.]workers[.]dev) to obtain WebRTC connection information and establish an encrypted channel.

Talos explains that there are two layers of encryption: the WebRTC DTLS, automatically provided by the browser, and ChaCha20-Poly1305 + ECDH key, implemented by msaRAT.

Communication is relayed through Twilio TURN (Traversal Using Relays around NAT) servers with a specific configuration to avoid direct peer-to-peer connections.

“By intentionally omitting the ICE candidates that are normally present in standard WebRTC communications, P2P connections are prevented from being established, resulting in a design where all communications are always routed through TURN,” explains Cisco.

“By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in the network traffic, and the dual-layer infrastructure combining Twilio with Cloudflare Cisco Confidential Workers makes it significantly difficult to trace the attacker’s infrastructure.”

The researchers documented how the data exchange system works by breaking down messages into chunks called “frames,” which include key exchanges, channel opening/closing, session resets, and Windows command execution.

By using Cloudflare Workers as the signaling relay, the attacker ensures that their server remains protected as the destination IP address is assigned to Cloudflare’s infrastructure and will pass firewall and allowlist automatic verification.

Also, the “*workers.dev” free subdomain is assigned for developers and blocking it would disrupt legitimate Cloudflare Workers deployments, and affect benign services.

The researchers underline that the communication mechanism in msaRAT allows it to control the C2 exchanges without touching the network directly and bury it within normal web traffic.

The report from Cisco Talos shares a complete list of indicators of compromise (IoCs) associated with attacks using the msaRAT backdoor attacks.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Sony has just unveiled its latest cinema camera that may foreshadow some long-awaited features in its consumer mirrorless lineup. The FX5 slots between the FX3 and FX6 in the company’s “Cinema Line” and comes with features previously missing on Sony cameras like RAW video and open gate recording. With other features like the 16.6-megapixel stacked sensor, five-axis stabilization and three base ISO settings, it should be an impressive cinema camera — for a price. 

The key to the FX5’s new feature set is the all-new 16.6MP fully stacked full-frame sensor that brings what Sony calls a balance between speed and resolution. 

For the 5K RAW recording, Sony is using its own proprietary X-OCN codec (short for “Extended tonal range original camera negative”). That delivers something new to creators: 16-bit linear RAW recording with 280 trillion colors, 1,000 times more color data than 12-bit ProRes RAW or Canon’s 12-bit C-RAW codecs. These are captured via the dual CFexpress type A card slots to Sony-validated cards. The FX5 can also capture 4K at 240 fps, 4.5K 120 fps and 5K 60 fps video, all firsts for FX cameras.

Sony

Open gate recording at a 3:2 aspect ratio uses the full sensor width and allows for easy cropping or vertical video creation in post. With a new de-squeeze function, it also allows easier use of anamorphic lenses. Sony is even thinking ahead, promising 4K 240p functionality in RAW and Open Gate 3:2 XAVC-I modes, along with an updated UI optimized for vertical shooting, expected by August 2027. 

Another new thing for Sony (and the first I’ve seen on any camera) is the three base ISO settings at 800, 4000 and 12800. This allows for improved dynamic range, along with cleaner shadows and improved sharpness compared to typical dual base ISO cameras. For night shoots, clean video at ISO 12800 will be a game-changer for indie filmmakers. For even better dynamic range (up to an incredible 16 stops), you can use the Dual Gain mode at the cost of increased rolling shutter.

Stabilization is often missing on cinema cameras but Sony has gone all-in on it with the FX5. The amount of compensation depends on the lens, but an updated electronic Dynamic Active mode is supposed to provide smooth video even when walking. Interestingly, Sony has a service for filmmakers who don’t want IBIS, allowing them to do an irreversible locked sensor conversion. 

Sony

The FX5 has a relatively lightweight (1.62 pounds) and compact body much like the FX3. Though covered with quarter-inch mount screws for cinema accessories, it has a big grip like its A7 models. It comes with a nice complement of manual controls, including numbered buttons à la Canon’s C50. 

The removable OLED EVF has 3.68 million dots and 2,500-nit brightness, along with a wide color gamut. The 3.5-inch 16:9 rear display is bigger, brighter and sharper (2.76 million dots) than most camera screens and uses Sony’s four-axis articulating design that’s great for vloggers. As with Sony’s higher-end mirrorless cameras, it includes two CFexpress and two SDXC UHS-II card slots, along with mic and headphone ports, a full-sized HDMI port, ethernet and tri-band Wi-Fi. The battery is Sony’s new NPSA100 from the A7R VI, which delivers up to 130 minutes of recording time. 

Sony’s FX5 is now on pre-order starting at $4,898 (body only) with availability planned for mid-August. You can also get it with a handle that allows XLR audio connectivity for $5,498, or buy the handle separately for $798. Hopefully, some of the features like RAW and Open Gate video will trickle down to its vlogging and mirrorless cameras. 

PUBLIC SECTOR

Health service told to ensure ministers don’t mistake before-and-after comparisons for cause and effect

The UK’s statistical regulator has told NHS England to ensure ministers are briefed accurately following a row over data used to promote the purported benefits of a Palantir-run platform.

The Office for Statistics Regulation (OSR) said the health quango had accepted that it needed to communicate more clearly about data purporting to measure the benefits of the NHS Federated Data Platform (FDP), which is based on the US spy-tech firm’s technology under a £330 million contract.

“We expect NHS England to ensure that any figures cited by ministers or in official briefings about the FDP and its effectiveness are communicated in a clear, accurate manner,” the OSR said. 

Campaign group Foxglove called on health officials and ministers to correct the record with Parliament and the media on data used to illustrate the FDP’s success.

Earlier this month, the OSR, part of the UK Statistics Authority, said it was assessing how NHS England used data to make claims about the FDP’s performance, which sometimes made its way into ministerial statements.

The move followed a Freedom of Information request from Foxglove, which found that nearly a third of NHS trusts using Palantir’s health data platform were performing fewer patient procedures than before it went live.

Foxglove also said Chelsea and Westminster Hospital NHS Foundation Trust accounted for 84 percent of the reported fall in outpatient waiting lists, while only 16 trusts were using the tool provided by Palantir.

The results sit uneasily alongside NHS England’s claim that, as of June, 139 trusts used the FDP, with 137 reporting benefits. Another commonly quoted data item found that an Inpatient Care Coordination Solution (CCS) tool based on the FDP had resulted in 111,589 additional patients undergoing procedures in operating theaters.

Writing to James Murray, Secretary of State for Health and Social Care, Foxglove noted that NHS England had said in documentation that it was inappropriate to “draw conclusions about cause and effect as other variables have not been controlled for” in its published FDP data.

Foxglove said: “The claim that Palantir’s FDP has delivered a large number of additional operations has been widely repeated.”

At the time, the OSR said it was assessing the information around NHS England’s claims about the FDP’s performance.

Publishing its response yesterday, the regulator said it had engaged NHS England statisticians and conducted its own desk research based on information provided by the NHS and others who raised concerns about data used to promote the FDP’s benefits.

It noted that on June 6, NHS England added a sentence to published data, which read: “We cannot therefore draw conclusions about cause and effect as other variables have not been controlled for.” It also updated the methods page.

“NHS England has told OSR that this was motivated, in part, by NHS England having received numerous Freedom of Information requests to provide more detail on how data provided by FDP was analysed,” the OSR said.

“While the addition of this sentence is welcome, we understand why many users took this to represent a significant change in how NHS England was communicating the benefits of FDP data in relation to NHS performance.”

The statement welcomed NHS England’s decision to acknowledge that there is “more that can be done to strengthen messaging around the FDP benefits data and its onward interpretation by users.”

NHS England agreed to add further caveats to the published data and ensure public communications clearly identify before-and-after comparisons and explain that they do not establish causality.

It has also commissioned Imperial College London to evaluate the FDP, looking at products including OPTICA “where the issue around causality is most evident.” OPTICA is designed to streamline the patient discharge process. It was based on Palantir’s technology built under a £60 million series of contracts awarded without competition and then transferred to the FDP. NHS England said it would publish the results.

The OSR said it wanted to be kept informed of progress against a series of other commitments by NHS England’s Head of Profession for Statistics.

An NHS England spokesperson said: “We welcome this review from the Office for Statistics Regulation into the presentation and communication of information about the Federated Data Platform, which found the updates we made to our website have helped to make information more explicitly clear. We are implementing the recommendations in full to provide further clarity about the patient benefits being achieved through the use of the technology.”

Donald Campbell, advocacy director at Foxglove, said: “This damning report makes it clearer than ever that the Government and Palantir must withdraw these dodgy marketing claims and correct the record.

“Even the head of NHS England has admitted personally raising doubts about the claims made on Palantir’s benefits to the NHS. This intervention by the stats watchdog should be the nail in the coffin for the fairy stories we’ve heard about the extra operations supposedly delivered by Palantir’s platform.

“With a new government, there’s a chance to draw a line under the previous administration’s shameful practice of running marketing for this Trump-aligned tech giant. The new health secretary must withdraw these figures, correct the record with Parliament and the media, and ensure that the debate about whether Palantir should have a place in our NHS is conducted based on reliable, verifiable evidence – not spin.” ®

Lenovo has expanded its LOQ gaming laptop lineup with a new graphics option. The company has introduced a refreshed version of the LOQ 17IRX10, pairing Intel’s Core i7-14700HX processor with Nvidia’s newly announced GeForce RTX 5070 12GB laptop GPU. The update gives buyers another configuration to choose from without changing the overall design or feature set of the laptop.

The new variant joins Lenovo’s existing LOQ 17IRX10 lineup, which was previously available with GeForce RTX 5050, RTX 5060, and RTX 5070 8GB graphics options. While the chassis remains unchanged, the addition of a 12GB RTX 5070 brings more VRAM to the series, a specification that has become increasingly important as modern AAA games demand larger texture caches and higher memory capacity.

RTX 5070 12GB joins the existing LOQ lineup

According to Lenovo’s PSREF listing, the new configuration retains the same 115W Total Graphics Power (TGP) and 2,347MHz boost clock as the 8GB RTX 5070 model. The primary difference is the increase in graphics memory from 8GB to 12GB.

The laptop is available with an Intel Core i7-14700HX, 16GB of RAM, and a 1TB PCIe SSD. Lenovo has also retained the 17.3-inch Full HD IPS display with a 165Hz refresh rate, making the system suitable for competitive gaming where high frame rates are more important than higher display resolutions. The notebook is powered by a 60Wh battery and supports 245W fast charging.

Connectivity remains unchanged as well. The laptop includes a USB-C port with DisplayPort 1.4 and Power Delivery support, three USB-A ports, HDMI, Gigabit Ethernet, a 3.5mm audio jack, and Lenovo’s proprietary charging connector, as shown in the product diagrams.

More VRAM could make this configuration the better long-term choice

Unlike previous GPU upgrades that focused primarily on increasing raw processing power, this refresh addresses another limitation that has become more noticeable in recent games: graphics memory.

Several recent AAA titles have pushed beyond the practical limits of 8GB VRAM, particularly when high-resolution textures, ray tracing and AI-assisted upscaling are enabled simultaneously. While the RTX 5070 12GB carries the same power budget and clock speeds as its 8GB counterpart, the additional memory should provide more headroom in newer titles and help reduce texture streaming issues at higher graphics settings.

Lenovo has not announced pricing or availability for the new configuration, and Notebookcheck notes that the model is not yet listed for sale.

For buyers considering a gaming laptop in this segment, the refreshed LOQ 17IRX10 doesn’t introduce a new design or a faster processor. Instead, it offers a more balanced GPU configuration that could prove more relevant as games continue to demand additional graphics memory.

Nokia reported comparable operating profit of €434mn for the second quarter of 2026, up 18% on the same period last year and comfortably ahead of the €382mn that analysts polled by LSEG had forecast.

Net sales rose 8% to €4.82bn, or 9% at constant currency, lifted by the companies racing to build AI data centres.

The beat extended a run that began earlier in the year, when comparable operating profit jumped 54% in the first quarter.

For the first half, net sales reached €9.25bn, up 6% as reported and 7% at constant currency, while the group operating margin widened to 9.0% in the second quarter, an improvement of 70 basis points.

The Finnish network-equipment maker’s Network Infrastructure division carried the quarter, with sales up 12% to €2.04bn.

Optical Networks grew 20% and IP Networks 16%, both supplying the optical networking and routing that hyperscalers are buying to wire their AI clusters together and to link data centres across long distances.

Sales to AI and cloud customers more than doubled year on year, reaching €446mn, and the unit booked €2.8bn of fresh orders during the quarter.

Much of that came from selling fibre-optic gear to the large technology firms building AI data centres, a market Nokia has pushed into hard over the past year.

“Demand remains strong, while supply continues to be the main industry constraint, prompting our customers to place longer-term orders,” chief executive Justin Hotard said.

New orders ran well ahead of what Nokia actually shipped, a sign of a lengthening backlog. The €2.8bn of AI and cloud orders booked in the quarter comfortably exceeded the €446mn those customers bought over the same three months, as buyers moved to lock in scarce supply ahead of delivery.

Mobile Infrastructure, still the larger unit by revenue, grew 6% to €2.68bn, a steadier showing than the surging data-centre business.

The mobile networks market has stabilised after several lean years of slowing 5G spend, though it is nowhere near the double-digit growth Nokia is now booking from cloud customers, and it remains the part of the business most exposed to the memory chips whose prices are climbing.

The comparable figures flattered a messier bottom line. On a reported basis, Nokia swung to an operating loss of €50mn and posted net profit of just €5mn, down from €96mn a year earlier, after restructuring and other one-off charges weighed on the accounts.

Nokia expects about €800mn of restructuring charges across 2026, including €350mn tied to integrating its operations in China, €200mn for European restructuring, and €250mn under an earlier cost-cutting programme.

It held the quarterly dividend at €0.04 a share, payable on August 6.

The company raised its full-year outlook for comparable operating profit to between €2.1bn and €2.6bn, up from €2.0bn to €2.5bn, though €0.1bn of the increase is a technical adjustment linked to reclassifying discontinued operations.

Hotard said the group was on track to finish “somewhat above the midpoint” of that range.

The raised guidance still leaves most of the year to play for. Nokia earned roughly €715mn of comparable operating profit across the first half, which means the top of its €2.6bn target depends on the second half delivering close to €1.9bn, a back-loaded shape that leaves little room for slippage.

The results arrive against a backdrop of rising memory chip prices, which AI demand has pushed to record levels and which are squeezing makers of telecoms and networking equipment.

Rival Ericsson has flagged similar cost pressure, though Nokia’s second-quarter numbers suggest it is absorbing the hit for now.

Hotard, who joined from Intel and took over as chief executive in 2025, has steered Nokia towards the data-centre buildout rather than the slower telecoms-equipment cycle that defined the company for much of the past decade.

The next test comes with third-quarter results, when investors will watch whether that €2.8bn order book converts into the second-half momentum he is promising.