Looking ahead: As the RAM crisis makes high-end hardware increasingly unaffordable, it’s unsurprising to hear companies float streaming as a possible alternative for gaming. Despite the technology’s past failures, the head of Grand Theft Auto publisher Take-Two is bullish on its future.

During Take-Two’s first-quarter fiscal 2027 earnings call, CEO Strauss Zelnick put a number on it: he expects cloud gaming to reach commercial, low-latency viability within three years, potentially multiplying the effective installed base tenfold. He made the comments while addressing the rising cost of gaming hardware.

Due to tariffs, rising costs of TSMC’s semiconductors, and memory shortages stemming from AI data center construction, game consoles and PC components have gotten more expensive rather than cheaper over the past several years. The Xbox Series consoles and the PlayStation 5 launched at $500, but their successors might double that price.

Zelnick believes the popularity of Take-Two’s major franchises, likely referring to Grand Theft Auto and NBA 2K, will cushion the impact of hardware price hikes, though he acknowledged the price hikes could still limit the company’s addressable market.

Cloud gaming, meanwhile, has long been floated as a route for bringing high-end games to low-cost devices, and Zelnick believes its moment is finally near.

The CEO argued that advances in networking technology and infrastructure will make cloud gaming more viable than ever for a wider swath of users, potentially growing the installed base by an order of magnitude. While he doesn’t expect revenue to climb by a similar amount, he sees it as a way to reach players beyond Take-Two’s traditional core market.

According to Zelnick, those advances are what will separate this next wave from the technology’s most spectacular recent failure, Google Stadia. The major cloud gaming players today are Amazon’s Luna, Nvidia’s GeForce Now, Microsoft’s cloud functionality for Xbox Game Pass, and Sony’s PS5 cloud streaming through PlayStation Plus Premium.

The latter two have proven that streaming can succeed as a complementary feature for games users already own, but success via other business models remains elusive.

Strauss Zelnick noted that 90% of Take-Two’s business is already digital, though he left the door open for occasional physical releases going forward, comparing the practice to the enduring demand for vinyl records.

Zelnick also weighed in on Grand Theft Auto VI’s upcoming digital-only launch and the broader industry shift away from physical disc games on PlayStation. He noted that 90% of Take-Two’s business is already digital, though he left the door open for occasional physical releases going forward, comparing the practice to the enduring demand for vinyl records.

Unlike vinyl (and music CDs), though, no single company controls the pressing of physical games; console manufacturers alone manufacture their platforms’ discs, which makes a comparable resurgence less likely.

Grand Theft Auto VI is set to launch on November 19 for PlayStation 5 and Xbox Series consoles, with a PC version expected sometime later. An extended early look at the game will premiere exclusively on Netflix on August 27.

A critical Metabase SQL injection vulnerability was exploited in zero-day attacks to breach customer instances in data theft attacks, known to impact Framework and Tally.

Metabase disclosed the attacks on Thursday, warning that its Metabase Cloud SaaS platform was compromised through a previously unknown vulnerability affecting versions 1.58 and above. The company warns that self-hosted installations are also vulnerable.

“We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above,” Metabase CEO Sameer Al-Sakran warned in a blog post. 

Metabase confirmed it blocked the endpoints used for the attack and immediately rolled out a fix for the vulnerability.

“The vulnerability is an unauthenticated SQL injection flaw in Metabase that can ultimately give a remote attacker administrator access to a customer’s instance.”

While Metabase has not assigned the vulnerability a CVE identifier, its security advisory rates it as Critical with a CVSS score of 10.0 and confirms that it has been actively exploited.

“This is a CRITICAL vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance,” reads an associated security advisory.

“From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Metabase has confirmed active exploitation of this vulnerability.”

Metabase is available both as software that organizations can host themselves and through Metabase Cloud, the company’s managed SaaS offering.

Metabase says its Cloud customers have already been upgraded and patched, while organizations running vulnerable self-hosted installations must update manually.

The SQLi vulnerability has been fixed in patched versions for all affected branches from 0.58 through 0.63, with the minimum safe releases being 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5.

Organizations unable to upgrade immediately are advised to temporarily block access to the ‘/api/session/reset_password‘ endpoint until the update can be applied.

Metabase recommends that self-hosted customers immediately upgrade, revoke all active user sessions, review API keys and administrator accounts for unauthorized changes, rotate credentials for connected databases, and inspect logs and query history for signs of compromise.

The company says attacks can be identified by a POST request to /api/session/reset_password returning a 400 status code, followed by a successful GET request to /api/user/current.

Metabase warns that system logs showing these entries have likely been compromised.

Customers disclose Metabase data theft attacks

Laptop maker Framework is one of the companies that has confirmed customer information was stolen after attackers compromised its Metabase instance.

In a breach notification sent to customers and shared with BleepingComputer, Framework said the incident allowed the attackers to steal customer information. The stolen data includes full names, email addresses, login IP addresses, billing and shipping address information, phone number, and company name.

For Framework for Business customers, the data may also include the company name, phone number, VAT, EIN, and billing email address.

Framework said Metabase notified the company on August 6 that its instance had been vulnerable to the zero-day and accessed by the attacker on August 3.

Tally, the popular online form builder, has also notified users that its Metabase analytics environment was compromised on August 3.

“Through that they reached your email address, and your password as a cryptographic hash. A hash is one-way, so it can’t be turned back into your password. They didn’t reach your forms, or the answers people submitted to them. Those are stored separately.”

BleepingComputer asked Tally which password hashing algorithm was used and whether the exposed password hashes were salted, but had not received a response at the time of publication.

In an email shared with BleepingComputer, LexisNexis is warning customers that it was impacted by a cyberattack at one of its third-party vendors.

While the company did not specifically state it was linked to the Metabase API, it did say its Metabase API was impacted by the attack.

“We are writing to provide an update on the service disruption affecting Diligence, Metabase API and Newsdesk,” reads the LexisNexis email.

“Earlier this week, we identified unusual activity on servers that are hosted and managed by a third-party vendor. To protect our customers and contain the issue at its source, we made the immediate decision to disconnect from those third-party systems.”

LexisNexis said taking the systems offline caused the affected applications to become unavailable, but it was necessary while the company investigated.

It is unclear whether customer data was exposed during the attack, but the company says it is working with a cybersecurity forensic firm to investigate the incident.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

The company says payment details weren’t exposed.

Sandboxing a Linux process usually means spending a lot of effort deciding what it isn’t allowed to see. You might put it in a mount namespace, bind-mount a few directories into place, hide some others, add a chroot, and generally construct a carefully restricted version of the filesystem. But a new Linux kernel feature is about to change all of that. Instead of carefully hiding most of the filesystem, why not just take the filesystem away?

That’s essentially the idea behind FailFS, a tiny pseudo-filesystem expected to land in Linux 7.3. As the name suggests, it doesn’t do very much. In fact, that’s the point: every operation that reaches FailFS returns EOPNOTSUPP, meaning “operation not supported.”

The interesting bit is what happens when a process uses FailFS as its root or current working directory. At that point, normal pathname lookup essentially ceases to work. Absolute paths fail. Absolute symbolic links fail. Relative paths using the normal current-directory mechanism fail. If the application tries to open /etc/passwd, there simply isn’t a useful /etc to find.

Instead, the process has to start filesystem operations from an explicit file descriptor it already owns. For example, a sandbox manager could open a directory, hand that descriptor to the application, and the application could access files below it using calls such as openat(). Anything not reachable from one of those deliberately supplied descriptors might as well not exist.

Instead of starting with an entire filesystem and constructing rules that say, “not that, not that, not that,” you start with nothing and explicitly hand over the pieces the program needs.

There are some interesting consequences. At present, putting a process completely inside FailFS also prevents it from launching ordinary dynamically linked executables. ELF binaries generally specify their dynamic loader using an absolute pathname such as /lib64/ld-linux-x86-64.so.2. Absolute paths don’t work, so neither does the loader.

FailFS also has an interesting sibling called NULLFS, introduced earlier. NULLFS is another deliberately useless filesystem, but it behaves slightly differently: it contains a permanently empty directory and failed lookups return ENOENT, as though the requested file simply doesn’t exist. It was originally introduced to provide an immutable bottom layer beneath the real root filesystem and make operations such as pivot_root() cleaner.

Neither replaces all the other pieces needed for a secure sandbox. Processes still have system calls, networking, IPC, inherited descriptors, and plenty of other ways to cause trouble. But for controlling filesystem access, FailFS has a nice, simple philosophy.

Of course, if your file system is unwritable, that works, too.

When the Chernobyl Nuclear Power Plant’s #4 reactor experienced an extreme criticality event on that infamous day in 1986, the resulting steam explosion and lack of any kind of containment building meant that parts of the core were scattered throughout the site. In an extensive update to the original 2023 video, the [Chornobyl Family] covers the mad scramble to design robots to perform on-the-ground measurements, and ultimately remove all this debris for safe disposal.

This essentially took the form of a hackathon, involving teams from all over the USSR and allied nations, creating the most diverse range of robots that 1980s Soviet technology and later Western technology could muster.

Many of these robots didn’t perform very well, or at all, mostly due to the bypassing of any kind of testing before deployment. Especially at the beginning of the clean-up the robots were being pushed into the high-radiation zones as soon as they were finished, with not only mechanical issues being a problem, but also with e.g. inaccurate radiation measurements by the RR-1 robot, that overstated measurements by more than a factor of ten. Meanwhile the RR-2 and RR-3 were too top-heavy and after deployment by helicopter simply tipped over. Eventually manual measurements proved to be faster and safer.

Early debris removal robots like the TR-1A were rather simplistic, with successive generations of robots over the next weeks and months improving on it. The use of a combustion engine instead of batteries provided to be a boon, as combustion engines are far less affected by radiation.

The BAER Beloyarets used an airport cart as the basis, with its electronics relying on vacuum tube technology and relays, with an internal combustion engine. This proved to be one of the most reliable designs and it’s been largely preserved on display in the Chornobyl Exclusion Zone, with many others of these robots also being on display around the nuclear plant or in the city of Chornobyl.

Overall an absolutely dizzying number of robotic designs were invented on the spot, adapted from existing designs or repurposed for operation in a high-radiation zone. Eventually bulldozer designs like the STR-1 helped to push radioactive debris off the roofs into containers, massively reducing the radioactive contamination of the area.

The fact that following #4’s RUD the other three RBMK units were able to keep operating safely without risks to its operators, and with the zone now safe for tourists, is a real testament to the success of the worst hackathon imaginable. Many of the lessons learned are relevant today, including during the decommissioning of Fukushima Daiichi’s melted-down cores.

Hegel has spent nearly four decades quietly producing some of the best high-end electronics in Scandinavia, yet the Norwegian manufacturer still manages to fly under the radar compared with louder brands from Denmark, the United Kingdom, Japan, and North America.

That feels increasingly strange.

Founded in 1988 by Bent Holter, Hegel has built its reputation around high-current amplification, unusually high damping factors, minimalist industrial design, and its proprietary SoundEngine distortion-reduction technology. Its products are now sold through dealers in 63 countries, so this is hardly three engineers working beside a frozen fjord while waiting for the fishing boats to return with Lord Erling and his supply of cowboy hats.

The new Hegel H200 and A200 integrated amplifiers are unlikely to change the company’s preference for visual understatement, but they offer one of its clearest product choices yet.

Both use the same 150-watt-per-channel Class AB output stage. The $4,995 H200 adds an internal DAC, network streaming, USB playback, and digital connectivity. The $3,995 A200 removes all of that and focuses exclusively on analog sources and external components.

Same engine. Two different roads.

One Amplifier Platform With Two Personalities

The H200 and A200 deliver 150 watts per channel into 8 ohms and are rated to remain stable with loudspeaker loads down to 2 ohms. Both use Hegel’s SoundEngine2 circuitry, which is designed to identify and reduce distortion as it occurs rather than relying on large amounts of conventional global feedback afterward.

Hegel also claims a damping factor greater than 4,000, giving both amplifiers considerable electrical control over loudspeaker drivers. That figure does not guarantee great sound by itself, but it helps explain why Hegel amplifiers have developed a reputation for controlled bass, strong dynamics, and an ability to drive more demanding loudspeakers without becoming flustered.

Both models include a Moving Magnet phono stage derived from the MM section of Hegel’s standalone V10 phono preamplifier. The circuit uses hand-matched FET gain stages and selected operational amplifiers rather than the inexpensive phono board that sometimes gets tossed into an integrated amplifier so the marketing department can check another box.

A front-panel headphone output, fixed RCA output, variable RCA output, configurable input levels, home-theater bypass functionality, TV remote learning, automatic standby, and adjustable display brightness are also included on both models.

The real difference is everything that happens before the analog amplifier stage.

Hegel H200: The Connected Option

The H200 is designed to function as the center of a complete two-channel system.

Its internal DAC supports coaxial, optical, USB-B, USB-A, and network sources. Resolution reaches 24-bit/192kHz through coaxial, USB-B, and network playback, while the two optical inputs support up to 24-bit/96kHz.

The USB-A port can play music directly from storage devices containing libraries of up to 10,000 songs. Supported streaming formats include FLAC, WAV, ALAC, AIFF, AAC, MP3, PCM, and Ogg.

Streaming support includes Spotify Connect Lossless, TIDAL Connect, Qobuz Connect, Apple AirPlay, Google Cast, UPnP, Roon Ready, and airable internet radio and podcasts. The Hegel Control app handles volume, source selection, playback, and browsing of compatible network and USB libraries.

The H200 also includes a coaxial digital output and Hegel’s DAC Loop feature. This allows owners to send a digital signal to an external DAC and route its analog output back into the amplifier, providing an upgrade path without abandoning the H200’s streaming platform, source control, or power amplifier.

That is a smart addition. Buying an all-in-one amplifier should not require swearing lifelong allegiance to its internal DAC.

There is no HDMI eARC input, which feels increasingly conspicuous on a $4,995 connected amplifier. Television audio can still be handled through optical or coaxial digital inputs, and the amplifier can learn commands from many TV remotes, but buyers looking for HDMI switching or automatic eARC integration will need to look elsewhere.

Hegel A200: Digital Need Not Apply

The A200 uses the same core amplifier platform but removes the DAC, streamer, network connection, USB ports, and every other digital input.

That will sound backward to some buyers and entirely sensible to others.

Many audiophiles already own a DAC or network streamer they prefer. Others upgrade digital components more frequently than amplification or build systems around turntables, CD players, tuners, tape decks, and other analog sources. For those listeners, paying extra for a digital section they have no intention of using makes very little sense.

The removal of the H200’s digital circuitry also makes room for a second balanced XLR input. The A200 therefore offers two balanced inputs, two unbalanced RCA inputs, the MM phono stage, headphone output, and fixed and variable RCA outputs.

It is not the cheaper H200. It is the same amplifier aimed at someone who has already chosen the rest of the system.

Specifications: H200 vs. A200

The Bottom Line

Hegel’s decision to offer the same amplifier in connected and fully analog versions makes more sense than forcing every buyer into the same configuration.

The H200 is the obvious choice for listeners who want streaming, digital playback, vinyl, headphones, and loudspeaker amplification consolidated into one component. The A200 is aimed at owners who already have a preferred DAC, streamer, or collection of analog sources and would rather spend $1,000 less than pay for duplicated circuitry.

Neither model looks designed to attract attention from across the room. That has never been Hegel’s game. The company builds understated amplifiers that frequently outperform flashier competitors and then seems mildly surprised when someone notices.

Perhaps Norway needs to work on its bragging.

Pricing & Availability

• The Hegel H200 will retail for $4,995 at Audio Advice, with shipping expected to begin in late August 2026. It will be available in black or white.
• The Hegel A200 will retail for $3,995 at Audio Advice and is scheduled to follow in October 2026. It will be offered only in black.

For more information: hegel.com

Related Reading: