Solawave Neck & Chest Rejuvenating Mask for $349: While this mask is fairly comfortable, it can take a little finagling to secure around your neck. It is easy to use, but I didn’t see results on any of my neck lines. The rechargeable battery also doesn’t last long, and I charge this neck mask more often than the LED face masks I use. It’s also harder to tell when it dies on you since it’s around your neck rather than on your face. —Nena Farrell

Avoid These

Megelin Duo-Lux Laser & LED Light Therapy Mask for $799: My biggest issue with this mask is the unpleasant chemical odor. It reminded me of formaldehyde, and because the silicone sits against your face without a mouth opening, the smell is impossible to ignore and left me feeling a bit dizzy. For me, that alone is enough to make it hard to recommend, especially considering it costs about $450 more than my top pick. Also, I found plenty of customer complaints on Reddit that weren’t reflected in the reviews on the company’s site.

LED Esthetics Glotech Minis for $229: Skip these, especially if your skin is reactive. At first glance, these Glotech Minis look like they’re designed to target your under-eyes, but they can technically be used anywhere: chin, smile lines, even above your brows. They emit red and yellow light and promise visible results after four weeks of daily nine-minute sessions. In theory, they’re meant to be a convenient, travel-friendly LED option. In practice, they’re more trouble than they’re worth. The patches rely on adhesive stickers to stay in place, which is a total nightmare for anyone with sensitive skin. My eczema flared after one use, and peeling them off only made it worse. Even beyond that, the fit is awkward. The MemoryContour design doesn’t really hug your face, so you’ll likely find yourself pressing down or lying still just to keep them from sliding off. It’s a clever concept with poor execution.

Pro by Déesse Pro for $1,700: This is a hard-shell LED mask with six treatment modes and four light wavelengths. The lights are intensely bright; even with the included tanning-bed-style goggles, I had to keep my eyes shut. It requires a power outlet, and the cord is short, so don’t expect to be walking around. It’s not particularly comfortable, either. At $1,700, it’s one of the priciest options out there, and it doesn’t even come with a display stand or storage case.

CISA confirmed today that ransomware gangs have begun abusing a high-severity Microsoft SharePoint remote code execution vulnerability, which has been flagged as actively exploited since early July.

Tracked as CVE-2026-45659, this security flaw stems from a deserialization of untrusted data weakness and allows attackers with low privileges to execute arbitrary code on unpatched SharePoint servers.

It can also be exploited in low-complexity attacks because (as Microsoft explained in May when it released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition) “an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities Catalog (KEV) on July 1, ordering Federal Civilian Executive Branch (FCEB) agencies to secure their servers within three days.

“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the U.S. cybersecurity agency warned at the time.

In a subsequent advisory, the cybersecurity agency also urged security teams to monitor affected servers for signs of exploitation, apply Microsoft’s latest patches, verify successful installation, and shorten patching cycles.

It also recommended enabling Windows Antimalware Scan Interface (AMSI integration for SharePoint web applications and using Microsoft Defender Antivirus (MDAV) detections to detect and remediate compromise.

Internet security watchdog group Shadowserver currently tracks over 8,500 Microsoft SharePoint servers exposed online, with over 200 of them unpatched against the CVE-2026-45659 vulnerability.

While Microsoft has yet to update the CVE-2026-45659 advisory to tag it as exploited, CISA has now also flagged it as abused by ransomware gangs in a Tuesday update to the KEV Catalog.

Since November 2021, the cybersecurity agency has flagged 14 actively exploited Microsoft SharePoint vulnerabilities, with eight of them also exploited in ransomware attacks.

In June, CISA also confirmed that ransomware gangs now exploit a high-severity Microsoft Defender privilege escalation vulnerability (dubbed BlueHammer), which was also targeted as a zero-day to access the Security Account Manager (SAM) database, which contains password hashes for local accounts.

The security flaw (tracked CVE-2026-33825) was leaked by a security researcher known as “Nightmare Eclipse” in early April, together with proof-of-concept exploit code.

However, as with CVE-2026-45659, Microsoft has yet to confirm that the CVE-2026-33825 security flaw is being exploited in the wild.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

A software update, sent across 13 billion miles, gives it one more year of operation.

Jeff Bezos is reportedly attempting to join the club of very rich Americans buying stakes in U.K. soccer teams.

Bezos, alongside others including Facebook co-founder Eduardo Saverin, is looking to buy at least a 30% stake in the English soccer team Liverpool at a £1.35 billion valuation (around $1.8 billion), The Guardian reports. If the deal closes, it will be the first sports investment for the billionaire, although he reportedly previously looked at buying a stake in a U.S. football team.

Liverpool is one of the most notable sports teams in Europe and is worth about $6 billion, reports Forbes. Arguably, this team has the kind of brand recognition in the U.K. as the Dallas Cowboys has in the U.S.

It seems no billionaire portfolio is complete these days without a mega yacht and a sports team, so Bezos’ interest is not surprising. There’s also something very romantic these days about owning an English soccer team after the success of TV shows like “Ted Lasso” and Ryan Reynolds’ FX show “Welcome to Wrexham” about his experience owning that English team. 

Other American billionaires in this club include Todd Boehly and Mark Walters (who also own the LA Dodgers and LA Lakers) buying Chelsea; New York Jets co-owner (and former U.S. Ambassador to the U.K.) Woody Johnson buying Crystal Palace; Dan Friedkin taking a stake in Everton; and Bill Foley leading a group that also included Michael B. Jordan buying Bournemouth.

For that matter, owning a stake in a U.K. sports team has also become a celebrity cultural phenom. Besides Reynolds and Jordan, Tom Brady purchased a minority stake in Birmingham City. Will Ferrell has a minority stake in Leeds United, alongside Russell Westbrook and Michael Phelps.

Sky Sports had a story earlier this year mapping out why so many Americans seem to be taking over U.K. football. It found that 13 out of 20 Premier League clubs (the top football league in England) had American shareholders.

Soccer has become increasingly popular in the U.S., and many of the top sports franchises, like the NFL and MLB, are either too expensive or closed off to new buyers. It’s much more possible to buy into a Premier League team.

Owning a share in such a team also buys access and proximity to some of the most bankable and recognizable sports icons on Earth. Bezos over the past few years — especially since he married former news anchor and TV show host Lauren Sánchez — has become seen as more of a cultural figure, rather than solely a tech mogul.

So, with a net worth currently sitting at around $280 billion, perhaps it’s actually more than time that Bezos got himself a sports team. Amazon has also streamed some European soccer leagues in the past — and Bezos has growing interests in the U.K. As we previously reported, his new AI company Prometheus is reportedly looking to sign a lease to move into London’s AI hub King’s Cross.

Sounding off: A lot of people are worried about the number of AI agents that have gone rogue recently, including Bernie Sanders. The Vermont senator has now called on the top AI firms to pause development of their top models, warning that lawmakers will step in if no action is taken.

In a letter to the CEOs of OpenAI, Anthropic, and Meta, Sanders writes that almost every day brings a new story about how these companies are losing control of their AI agents.

The senator also highlighted the story of AI being used for the first time to create new viruses, something he says could, if the technology ended up in the wrong hands, lead to new bioweapons that result in the deaths of tens of millions of people.

“Yoshua Bengio, the most cited living scientist in the world, said these incidents ‘should serve as a wake-up call,’ I agree,” Sanders wrote in the letter.

Sanders adds that despite these incidents, the companies are still investing tens of billions of dollars into a technology that nobody can fully understand, predict, or control, contradicting their own commitments to responsible AI development.

“Mr. Altman, Mr. Amodei and Mr. Zuckerberg: In the interest of humanity, stand by your words. Pause AI development. It is not too late to avoid disaster. Stop building machines that humans cannot control,” Sanders writes.

– Sen. Bernie Sanders (@SenSanders) August 10, 2026

The letter finishes with a stark warning for the tech giants: “Let me be very clear: If you do not take appropriate action now, my colleagues and I in the U.S. Senate will.”

There have been calls for a halt on the development of advanced AI models for years now, including a request for a six-month pause in 2023. Charles Oppenheimer, grandson of J. Robert Oppenheimer, was one of the signatories of a 2024 letter calling for global action on AI and other existential threats.

But previous warnings have resulted in little or no action. This was illustrated last year when the US and UK refused to sign an AI safety declaration at a Paris summit. Vice President JD Vance cautioned against “overly precautionary” regulations on AI, emphasizing the US commitment to maintaining its dominance in the technology.

The situation has taken a worrying turn recently. First came news that an OpenAI model went rogue and hacked several services online, including Hugging Face. An Anthropic model followed suit – it even tried to deceive real developers into approving malicious code. Meta then became the third company in two weeks to admit its model went rogue.

Sanders isn’t the only one responding to the incidents. More than 1,300 employees from the world’s leading tech companies just signed an open letter asking governments to regulate the pace and safety of artificial intelligence development.

OpenAI said last week that it was slowing the release of its new Astra model because it has “critical” cyber capabilities.

Cisco warned of two high-severity vulnerabilities affecting the Secure Endpoint Connector that allow threat actors to crash the ClamAV scanning process in denial-of-service (DoS) attacks.

The security flaws (tracked as CVE-2026-20337 and CVE-2026-20338) were found in the ZIP archive parser of ClamAV (Clam AntiVirus), the open-source and cross-platform engine used to scan files for malware.

As Cisco explained in a Friday advisory, the two vulnerabilities are due to improper boundary checks and memory handling, respectively, and can be exploited by unauthenticated, remote attackers.

The company’s Product Security Incident Response Team (PSIRT) added that proof-of-concept (PoC) exploit code is already publicly available, but said that it has no evidence the flaws have been exploited in the wild.

“An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software,” it said. “The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in CVE-2026-20337 and CVE-2026-20338.”

Cisco added that the flaws’ security impact is high only for Windows platforms since they’re the only ones that “run the ClamAV scanning process in a privileged security context.”

These two vulnerabilities affect ClamAV 1.5.0 through 1.5.3, and they were patched in version 1.5.4 released on August 7.

While there are no workarounds for CVE-2026-20337 and CVE-2026-20338, the company plans to release software updates later this month to address them in affected versions of Secure Endpoint Connector for Windows, Linux, and Mac.

On Friday, Cisco patched five other ClamAV security flaws that can also be exploited to trigger denial-of-service conditions by submitting malicious XAR, Mach-O, PDF, GPT, and PESpin files for scanning.

It patched another ClamAV DoS vulnerability with PoC exploit code in January 2025, warning that attackers could abuse it to terminate the ClamAV antivirus scanner, preventing or delaying further scanning operations.

Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has tagged 95 Cisco vulnerabilities as actively exploited in attacks, six of them abused in ransomware attacks.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

ON-PREM

The bigger risk is underinvestment, claims consulting biz McKinsey

US power companies must decide how much capacity to build for soaring datacenter demand, knowing that some planned facilities may never materialize and the AI bubble could deflate. Consulting firm McKinsey & Company says the greater near-term risk is building too little.

Driven by the AI craze, a boom in datacenter building is expected to see the energy consumed by these facilities grow by 26 percent this year, as The Register reported not too long ago.

McKinsey’s own figures indicate that datacenters will account for about 75 percent of projected US power demand growth over the next decade. The current building rate would require the equivalent of almost 30 GW of additional power each year, including roughly 20 GW for IT equipment and the rest for cooling, distribution and resilience.

Whether that growth materializes depends on demand for AI compute holding up. McKinsey notes that although corporate interest in AI remains high, implementation is uneven: 71 percent of organizations report “negative implementation outcomes,” while parts of the ecosystem exhibit bubble-like characteristics.

Even if AI compute growth slows, McKinsey argues, the generation and transmission infrastructure built to support it is unlikely to become stranded. The assets could serve other demand while strengthening grid reliability and resilience.

A similar report from Bain & Company almost two years ago warned that the US energy sector needed to ramp up spending on generation and grid infrastructure, or demand could outstrip supply within a few years.

Datacenters are not the only source of new demand. Electric vehicles and the electrification of industrial processes will also place pressure on supplies.

The report estimates that the US has roughly 40 GW of spare dispatchable capacity to accommodate near-term demand growth, plus about 100 GW of committed new capacity.

However, 50 to 75 GW of coal and gas-fired steam capacity is expected to retire, while projected demand growth stands at about 120 GW. That leaves a nationwide capacity gap of approximately 30 to 55 GW by 2030.

To help bridge this looming gap and maintain grid reliability, utilities have been bringing retired plants back online and extending the lives of coal and gas facilities. These measures provide important temporary system relief but are likely insufficient, McKinsey says.

However, in June, the Trump administration authorized up to $500 million in funding to keep an extra 13 coal-fired power plants going to boost the resilience of critical energy infrastructure.

At the same time, the report notes that many of the developers and operators planning datacenter campuses are turning to on-site power generation via gas turbines, as well as fuel cells and battery storage, due to delays in getting a grid connection.

In McKinsey’s survey of power sector leaders, nearly 60 percent of respondents expected datacenters to retain permanent on-site generation by 2030, even after grid connections became available. Of those planning to have on-site power, 64 percent will rely on natural gas.

Beyond 2030, the firm expects to see solar paired with battery storage in addition to the growing role of gas. This is because of the cost competitiveness and speed of deployment of solar, though it warns this may be dependent on policy support and continued declining costs of storage, and that it will be a part of the broader energy system rather than the sole on-site source of large-scale power.

As for nuclear, McKinsey expects any material growth over the next decade to come from extensions and upgrades to existing plants rather than new builds.

Emerging technologies such as small modular nuclear reactors (SMRs) and next-generation geothermal energy are attracting increasing capital and buyer interest, but they are unlikely to have much impact on system capacity before the middle of the 2030s.

McKinsey’s conclusion is that the US power sector faces a likely near-term shortfall, making underbuilding a greater risk than overbuilding. ®

If you’ve been holding out on buying Valve’s ludicrously expensive home console, you may have saved yourself from more than an empty wallet. European customers who ordered a Steam Machine or Steam Controller may be the victims of a personal information data breach after one of Valve’s hardware distribution partners was hit by a cyberattack.

CEVA Logistics, the company that helps organize Valve’s European supply chain, informed its partner of the data breach on Aug. 7. A Valve spokesperson told CNET that the company spent the weekend assembling a list of at-risk customers, notifying them about the attack via email on Monday morning.

“Though CEVA is still investigating the attack, we wanted to at least send out messaging to all customers we can assume were affected based on what we currently know,” the spokesperson said.

What Valve currently knows is that the personal information revealed by the cyberattack is likely all delivery-related. CEVA told Valve that the breach revealed customers’ names, countries, street addresses, phone numbers and email addresses. According to Valve, “payment information, passwords and Steam Guard codes” are all safe, since CEVA doesn’t have access to this data.

Because phone numbers and email addresses linked to Steam accounts are openly circulating, Valve warned against phishing attacks that may be looking for additional personal information in the coming days.

Read more: Best Data Removal Services of 2026: Reduce Your Online Presence

“Expect fake messages – email, SMS or phone – that mention your hardware order and appear to come from Steam, Valve or a delivery company,” Valve wrote in its email to affected customers. “They may quote your address back to you to prove they’re genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee or sign in somewhere to ‘verify’ your order. Treat all of them as fake.”

Valve reminded customers that Steam’s support team only handles issues on the official help page and never sends messages over Steam chat or through third-party services. Company employees will also never ask for a customer’s password or Steam Guard codes.

The finer details of the attack currently remain unclear, as there’s no official information available on how many customers were affected, how much data was stolen or how the cyberattack infiltrated CEVA Logistics’ systems. In its statement, Valve said it is “pressing CEVA for the full scope” of the breach.

Alongside CEVA’s internal investigation, authorities in the Netherlands are looking into the attack. A spokesperson for the Dutch data protection authority told TechCrunch that the agency has received data breach reports from at least 10 companies in relation to the hack.

In addition to the data breach, FreightWaves reported operations at eight of the company’s warehouses have been affected by the cyberattack, causing potential delays or cancellations to customer orders in the coming days.

CEVA Logistics did not immediately respond to a request for comment.

Tyler is a writer for CNET covering laptops and video games. He’s previously covered mobile devices, home energy products and broadband. He came to CNET straight out of college, where he graduated from Seton Hall with a bachelor’s degree in journalism. When Tyler’s not asking questions or doing research for his next assignment, you can find him in his home state of New Jersey, kicking back with a bagel and watching an action flick or playing a new video game.

You can reach him at tgraham@cnet.com.

See full bio

Advertisement

In a nutshell: Andy Green will return to Utah’s Bonneville Salt Flats on Tuesday in a new kind of record car: one powered by hydrogen-burning engines. The British driver, who holds the land-speed record for a diesel car, will drive JCB’s Hydromax in an official attempt overseen by the Fédération Internationale de l’Automobile. The company is using the run to demonstrate its hydrogen internal-combustion technology under extreme conditions.

The Hydromax is a 32-foot vehicle powered by two hydrogen engines adapted from JCB construction machinery. Together, they produce 1,600 horsepower. Rather than using hydrogen in a fuel cell to make electricity, the engines mix pressurized hydrogen gas with air and ignite it.

Green reached 368.347 mph during practice last week. If he can repeat that performance in the official attempt, he would beat the 350.092 mph diesel record he set at Bonneville 20 years ago. He could also pass the current hydrogen internal-combustion record of 185.5 mph and the electric-vehicle record of 341.3 mph.

“What the peak speed is, I can’t say. We just don’t know,” Green told The AP. “Part of the adventure here is we’re going to find out.”

The run will be a test of whether hydrogen combustion can work at a level far beyond its usual industrial use. JCB has spent more than $134 million developing hydrogen engines. The company says they produce no carbon dioxide from the tailpipe and could have a role in heavy-duty equipment, where batteries can be difficult to use because of weight, charging needs, and operating demands.

“If you’re serious about emissions, you have to be serious about hydrogen, and a land-speed project is the perfect way to prove it,” JCB Chair Anthony Bamford said at the car’s unveiling in May.

Hydrogen’s environmental case is more complicated than tailpipe emissions alone. Most of the world’s hydrogen is made from fossil fuels. JCB has signed a deal to buy green hydrogen, which is produced using renewable energy, though that form of hydrogen remains a small part of the global supply.

There are also safety issues. Hydrogen is stored under pressure and is highly flammable. Green said the team put the car through extensive testing before bringing it to Bonneville. He has spent months learning how the engines work together and how the car behaves on the salt surface.

“We’re managing the risks very carefully,” Green said.

The conditions at Bonneville add another layer of difficulty. The salt flats offer a long, open course, but the surface has limited grip. Green will use a parachute to slow the car after the run. The attempt is planned for shortly after sunrise, before the desert heat builds.

Bonneville has been used for speed attempts since 1914. The flat, white expanse sits about 100 miles west of Salt Lake City on the Utah-Nevada border. Its straightaway runs for about 10 miles, and spectators watch from roughly a quarter-mile away.

Green understands the place land-speed racing holds in the public imagination. In 1997, he became the first and only person to drive a car faster than sound. His jet-powered Thrust SSC reached 763.035 mph in Nevada’s Black Rock Desert, producing sonic booms that shook the nearby town of Gerlach.

Now 64, Green said he had expected to be finished with racing before JCB asked him to take on the Hydromax project. The car will not challenge his supersonic record. Its purpose is more practical: to show what a hydrogen combustion engine can do when pushed to its limits.

Image credit: The AP