The revelation that Apple’s iCloud Private Relay feature hasn’t been as secure as Apple says has spawned a lawsuit against the iPhone maker.

Last week, a blog post by Talal Haj Bakry and Tommy Mysk exposed a vulnerability in how iCloud Private Relay, in some circumstances, doesn’t shield a customer’s IP address, which is the entire purpose of the feature. Even when it’s enabled, their information can be exposed when using a passkey to sign in or when a website uses two methods (DNS prefetching and WebTransport) to load data faster.

In a complaint filed by Clarkson Law Firm on Aug. 6, plaintiff Edward Rickman says he subscribed to iCloud Plus believing that iCloud Private Relay would hide his IP address and Safari browsing activity.

“Instead, Apple delivered a system that recreates through its own credential service the precise harm Apple told the world it had made impossible,” reads the complaint, which seeks class action status.

The lawsuit also seeks an injunction against Apple requiring it to change its business practices to mitigate the risk of consumer deception, as well as monetary relief and attorneys’ fees.

An Apple representative didn’t immediately respond to a request for comment.

A core component of the lawsuit is that iCloud Private Relay is a paid service of iCloud Plus, which costs between 99 cents and $60 per month. The feature is available only if you’re subscribed to iCloud Plus, not the basic iCloud service.

Also key is the fact that Apple has advertised for years that iCloud Private Relay is a safe way to browse the web and avoid the types of tracking that services such as Facebook use to connect people’s browsing habits and assemble profiles on them that can be monetized.

“Apple built its entire brand on the promise that it would protect its users’ privacy when no other company would,” Tim Giordano, a partner at Clarkson Law Firm, said in a statement. “For Apple’s iCloud users to now learn that for years they were paying Apple a premium for a protection that simply didn’t work, exposing them to the very tracking, profiling and targeting Apple warned them about, is an outrageous violation and betrayal of consumer trust and law.”

Clarkson recently won a $250 million settlement from Apple over the company’s marketing of AI features for the iPhone 16 Pro that were never delivered.

The researchers who discovered the flaw set up a website that lets anyone check whether iCloud Private Relay is protecting their IP address. They say they released the information publicly rather than first alerting Apple because of the company’s lengthy review process.

In an email to CNET, Mysk wrote, “If we had a better experience with the Apple Security Bounty program that would make us feel confident the issue would be addressed promptly for the benefit of iCloud Private Relay users as well as Psylo users, we would have reported this iCloud Private Relay issue to Apple without having to release a Psylo update addressing the issue, and as a result having to disclose it to our users.” Psylo is the developers’ privacy-focused web browsing app.

Jeff Carlson

Senior Writer

Jeff Carlson writes about mobile technology at CNET, from cellular phone plans to devices and emerging technology.

See full bio

Advertisement

All four Pixel 11 models run Google’s Tensor G6 alongside a new Titan M3 security coprocessor that adopts NIST’s post-quantum cryptography standards, a first for a Google phone. The chip claims 25% faster browsing and 20% better power efficiency, with a TPU carrying 50% more compute.

Every Pixel 11 ships with Google’s new Tensor G6, but the more interesting silicon sits next to it. A new Titan M3 security coprocessor adopts the post-quantum cryptography standards set by the US National Institute of Standards and Technology. Google says the Pixel 11 is its first phone to meet them.

The chip handles quantum-safe secure boot and runs Trusty, Google’s trusted execution environment, across all four models. Google describes the protection as being against “emerging, highly advanced digital attacks,” and says Titan M3 holds Common Criteria certification at the level used for SIM and bank cards.

No quantum computer can break current encryption. The reason to ship this now is that data stolen today can be kept until one can, a problem the industry calls harvest now, decrypt later. TNW has written before about why this is an inevitable threat rather than a distant one.

Governments are pushing the timeline from the other direction. The White House has signed orders calling for a useful quantum computer by 2028, which puts a date on work that vendors had been treating as open-ended.

The performance side is more ordinary. Google claims the Tensor G6 delivers 25% faster browsing and 15% faster app loading than the Tensor G5, with up to 20% better power efficiency, the complaint that has dogged every previous Tensor.

Its TPU carries 50% more compute and higher memory bandwidth. That runs Gemini Nano on device, which Google says now executes background work up to 3.5 times faster while using 3.5 times less energy. The same silicon drives 120x Pro Zoom on the Pro models, 4K portrait video and an Instant Night Sight that captures up to 4.5 times faster.

Google has not published the manufacturing process or the core configuration. Benchmarks against Qualcomm and Apple silicon remain the weak point, and nothing announced suggests that changes this year.

Pricing did land. The Pixel 11 starts at $899, the Pro at $1,099, the Pro XL at $1,299 and the Pro Fold at $1,899, with the 128GB tier dropped, confirming the increase Google signalled in July as memory prices climbed.

Insta360 just launched the X6, and the company is treating it like a full replacement for the gear most people carry on trips, rides, and everyday outings. One compact body now handles full 360 capture, locked-on subject tracking in flat video, and single-lens action shooting. Switch between the three with a tap. The camera then analyzes the footage on its own and delivers finished clips before you reach for your phone.

Dual custom Sony sensors are at the heart of this upgrade, with each 1.1-inch sensor organized in a square setup, providing a full one-inch equivalent when working in 360 mode. This configuration is significant since it gives you 33 percent more sensor area to work with than the preceding X5. That’s nearly four times the quantity of light you can capture in each shot. Low-light and high-contrast scenes will look much better. AdaptiveTone 2.0 now meters the two lenses separately, allowing it to draw two exposures every frame, which helps to extend the dynamic range without requiring any human adjustments. There are also two ambient light sensors that will help to clean up nite video, minimizing flicker and making things appear smoother.

Insta360 X6-8K 360 Camera with 1/1.1” Sensors

• DUAL 1/1.1″ SENSORS & TRIPLE AI CHIP SYSTEM: Custom-built dual 1/1.1″ square sensors deliver unprecedented 360 image quality. Combined with a triple…
• FLAGSHIP 8K50FPS 360 VIDEO: Hit record on our 360 action camera and capture your world in stunning native 8K50fps video. Every view, every highlight…
• IN-HOUSE AI MODEL FOR EFFORTLESS 360 EDITING: Insta360’s own AI model, built specifically for 360 editing. New AI Director edits your footage…

The processing power has been increased to match the larger sensors, with an 8-core 3.3 GHz processor built on a 4-nanometer technology driving the show, along with two dedicated imaging chips for good measure. That provides you a five-fold increase in computational capacity over the X5, and it will run more than twice as fast with 35% reduced power consumption. With this amount of headroom, you can run the camera in native 8K at 50 frames per second in full 360 and then reframe in whichever direction you choose. If you want something simpler, flat mode provides clear 4K with InstaFrame 2.0 subject tracking that locks onto people, dogs, or objects and keeps them centered. The single-lens action mode, on the other hand, offers 5K at 60 frames per second with a choice of 170 degree or 132 degree fields of view, or 4K at 120 frames per second in slow motion if desired.

The larger 2600mAh battery provides 140 minutes of continuous 8K @ 30 360 recording, which is a 51% increase over the X5. It charges to 80 percent in 24 minutes and can operate in temperatures as low as -20 degrees Celsius. The body is slightly shorter and more pocketable than the previous iteration, despite the larger sensors inside. The 2.32-inch OLED panel can reach 1200 nits while remaining legible in direct sunlight, and it also functions as a big record button when gloves are worn. The camera’s waterproofing has also been increased, allowing it to dive 20 meters without a case and 60 meters with the Invisible Dive Case Pro.

The windproof 360 microphones inside the body have been updated, and there’s also a new Hidden Engine Mic mode that separates engine sound while blocking out the wind for motorcycle riders. The Intelligent Audio Mode will also adapt automatically, eliminating the need for you to do anything. You now have the option of pairing two wireless transmitters simultaneously. Connectivity has also been sped up across the board, with Wi-Fi 6 moving files at a zippy 100MB per second wirelessly and USB 3.0 reaching 450MB per second via cable. If you’re afraid about dropping the connection, Bluetooth will reconnect in under a second.

The most significant change will likely be in how you edit your footage. The AI Director process takes place on the camera itself, as it pulls up your video, selects the best sections, and assembles whole clips for you, complete with framing, movement, cuts, music, and everything else, before neatening it up and delivering it to the app for sharing. Auto Edit 2.0 employs a sophisticated PanoMind model that has been trained on over 10,000 hours of real-world 360-degree film from travel, sports, diving, cycling, and everyday life.

Moments Pro on the cloud allows you to create more versions after you’ve established your subject, mood, style, and so on; simply choose your timings and it will do the rest for you. You also get ten-bit color and native Dolby Vision, as well as I-Log for heavy-duty color grading afterward. We’re talking a respectable 47 gigabytes of storage memory, so you can shoot to your heart’s content without having to worry about juggling SD cards.

The lenses themselves are five times more scratch resistant, and you can pop them in and out for sixty percent less. The magnetic mounts are fully compatible with all of your X5 and Ace gear, and you get over a hundred different accessories that can fit onto scooters, bikes, cars, and selfie sticks. A power selfie stick can give you an extra three hours of use out of your camera. Fast charge cases now have two batteries and card slots. You have the option of Midnight Black or Arctic White. The regular bundle now starts at $699.99 and includes the camera, cable, pouch, and lens cloth. Push the button to upgrade to the basics kit for an additional $100, which includes a backup battery, invisible stick, lens caps, charge case, and an extended warranty.

• The Trump-class battleship program could cost the Navy $275 billion total
• First battleship alone carries a staggering $23.4 billion price tag
• Each ship weighs 35,000 tons and packs hypersonic missiles, nuclear missiles, lasers, and more

A new US Congressional Budget Office report has estimated that the Navy’s proposed Trump-class battleship program could ultimately cost taxpayers $275 billion.

The first vessel alone is projected to cost $23.4 billion, roughly $6 billion more than the Navy’s initial estimate initially offered in December 2025.

Before anyone starts marching on Google headquarters waving torches and 4K Blu-ray cases, one important fact needs to be established: this happened to one reported customer, not millions. There is no evidence that Google suddenly removed The Lord of the Rings movies from huge numbers of digital libraries or that widespread deletions are occurring.

What we do have is a Reddit user who says the Extended Edition Trilogy they purchased through Google Play Store in 2022 disappeared from their library. Screenshots shared by the user appear to show Google Support confirming that the title had been removed from its catalog and that it could neither restore access nor provide a refund.

That distinction matters because this isn’t a mass deletion story. It is, however, a very good example of why the word “Buy” has become increasingly slippery in the digital era.

Related Reading:

You Bought It. Sort Of.

According to the customer, they paid for the films four years ago and reasonably expected them to remain available. Google Support reportedly explained that because the trilogy had been removed from its system and the transaction dated back to 2022, it could not restore the movies or issue a refund.

You can understand why someone might find that response less satisfying than walking barefoot to Mordor.

Google’s own current terms make the larger issue fairly clear. After purchasing content, customers receive a non-exclusive right to access and use it. Google also states that purchased content generally remains available only as long as Google retains the right to provide it. If those rights disappear, content or services are discontinued, or certain other conditions arise, Google can stop providing access to something you paid for.

That little “Buy” button suddenly feels considerably less permanent.

Digital movies are enormously convenient. I buy them and stream them, and most consumers are not going back to walls filled with thousands of discs.

I might not be the best example.

I own more than 3,700 movies on DVD, Blu-ray, 4K UHD Blu-ray and even LaserDisc, and there is a reason I have never viewed that collection as obsolete. If I purchase The Lord of the Rings on disc and put it on my shelf, Warner Bros. cannot remove it because a licensing agreement changes. Google cannot decide my copy is no longer in the catalog, and the internet can disappear for the evening without taking Gandalf with it.

Physical media has limitations. Discs can be damaged or lost, players eventually fail, and 3,700 movies require slightly more storage space than an app icon. But access to them does not depend on someone else’s server continuing to recognize my license.

For home theater enthusiasts, there is also the performance argument. 4K UHD Blu-ray can deliver higher video bitrates and lossless audio without the compression and bandwidth compromises inherent to streaming. Physical media offers excellent performance along with something becoming increasingly unusual in modern entertainment: a copy you can actually keep.

Music Has Exactly the Same Problem

The same argument applies to Spotify, Apple Music, TIDAL, Qobuz and every other subscription music service. You don’t own those 100 million songs. You are paying for access to a catalog, and that catalog can change.

Albums disappear. Different masters replace older ones. Labels change distributors. Licensing agreements expire. The album you played yesterday may not necessarily be there tomorrow.

Qobuz offers an important alternative because it operates a download store alongside its streaming service. Customers can purchase albums and download actual music files to local storage. Roon Ready? Permanence sold separately.

But even Qobuz makes the distinction worth understanding. Its support documentation says customers can normally re-download purchases, while explicitly warning that albums may later become unavailable for download and recommending that customers create backups.

That is the key difference. If you bought the download, saved the files and backed them up, a record label removing the album from Qobuz’s streaming catalog doesn’t magically reach into your NAS and delete it. If you only streamed it, you never had anything to begin with.

One Customer Is Enough to Ask the Question

Millions of consumers buy movies digitally without anything disappearing, and this single case is not evidence that everybody’s library is about to evaporate. It would also be naïve to assume this is the only person who has ever lost access to something they purchased digitally. Most of us do not conduct annual inventory checks on libraries containing hundreds of movies, so a missing title could easily go unnoticed for months or even years. What we cannot say is how many customers this has affected because Google does not publish that data.

But the story matters because it demonstrates what can happen when ownership is replaced by licensed access.

The customer clicked “Buy,” paid for the movies and expected them to remain available. Four years later, according to the support exchange they shared, they didn’t.

Perhaps the industry needs a different word than “Buy.”

Until then, I’ll keep my 4K discs, CDs, records and even those LaserDiscs. They take up more room, but none of them vanish because somebody in a licensing department changed a spreadsheet.

Related Reading:

The takeaway: AMD has published a new security bulletin about the Trusted Platform Module reference implementation used in its computer platforms. The disclosed flaws could have significant reliability and security implications, but updates for AMD’s numerous CPU families have already been available for months. Users simply need to install them.

Researchers working with the Trusted Computing Group recently identified a potential security issue in AMD’s TPM code, prompting the company to release new motherboard and firmware updates to address the vulnerability. The update process was not exactly swift, however, as the fixed TPM code had already been available for months. Meanwhile, AMD has only just released its AMD-SB-7064 bulletin detailing the issue.

The US chipmaker explained that the TCG Vulnerability Response Team was informed by Intel researchers about a potential out-of-bounds read vulnerability in its TPM 2.0 reference code. The flaw could be exploited by local attackers with elevated user privileges, allowing them to force the TPM code to read sensitive data stored in the firmware or even affect the availability of the TPM.

AMD programmers confirmed the issue, which affects the company’s TPM implementation in two different ways. The first flaw (CVE-2026-6726) could leak information and allow a malicious actor to recover credentials from a TPM-aware Certificate Authority, potentially enabling them to falsify TPM encryption keys or other TPM-based attestation mechanisms.

AMD describes the second flaw (CVE-2026-6727) as a timing side-channel vulnerability affecting decryption workloads using the RSA cryptosystem. The flaw could allow an attacker to decrypt encrypted data or falsify TPM 2.0 attestation keys. Both vulnerabilities require a local attack with “privileged” user access, meaning they should not pose a significant security risk to systems exposed solely to the internet.

Threat level aside, the two flaws have been assigned relatively high CVSS scores of 8.5 and 8.3, respectively, and are noteworthy for the large number of affected processors. AMD’s list includes Epyc 4004 and 4005 Series CPUs, several embedded processors, Ryzen desktop CPUs from the 3000 through 9000 series, Threadripper workstation processors, and more.

AMD recommends that users install the updated Platform Initialization firmware releases designed to address both CVE-2026-6726 and CVE-2026-6727. The fixed firmware versions have been available since at least May for most processors, while Ryzen Embedded CPUs received their updated firmware in July.

The Trusted Platform Module is a security-focused cryptoprocessor specification defined by the TCG in 2003, but the major TPM 2.0 implementation upgrade has been available since 2014. A TPM 2.0 hardware module or firmware implementation became part of Windows 11’s mandatory system requirements, providing a significant security improvement for the Windows ecosystem.

As these two AMD flaws clearly demonstrate, however, total security remains a distant goal even in the modern TPM-enabled PC world.