The Hospital for Sick Children (SickKids) has disclosed that the personal information of some current and former employees, as well as job applicants, was exposed in a “cybersecurity incident.” The hospital says the breach stemmed from a flaw in third-party software.

Clinical systems and patient records were untouched, according to the Toronto pediatric hospital, but its public-facing Careers website was temporarily pulled offline.

Careers site restored, incident scope under review

SickKids disclosed the incident this week, saying it resulted in unauthorized access to employee data.

The hospital attributes the breach to a vulnerability in a third-party software application that it says is used by SickKids and other organizations, according to a media statement.

The framing appears to suggest that there’s a wider campaign against users of the same product, although the hospital has not named the vendor, the application, or the CVE involved.

The external Careers website was temporarily affected and has “since been safely restored,” per the statement.

Clinical systems and patient information were not affected, and patient care continued as usual, SickKids says.

After learning of the incident, the hospital launched an investigation with the help of outside cybersecurity experts.

The findings indicate that personal information belonging to current and former SickKids, Boomerang (a SickKids-owned pediatric clinic), and SickKids Foundation employees, as well as SickKids job applicants, may have been exposed.

The hospital has not said what categories of data were involved, how many people are affected, or when the intrusion took place.

Its review of the impacted information is ongoing, with individuals confirmed as affected to be notified directly.

In the meantime, SickKids says it has alerted everyone potentially caught up in the incident out of an abundance of caution, and is offering 24 months of complimentary credit monitoring and identity protection.

Job application portals are an unusually rich target for data thieves. Applicants routinely hand over full names, home addresses, phone numbers, employment histories, and in some jurisdictions government identifiers. That information is useful both for identity fraud and for building convincing social engineering pretexts against hospital staff.

A repeat target

This is not the first publicly known security incident to have hit the hospital in recent years.

In December 2022, SickKids was hit by a ransomware attack that disrupted internal systems, hospital phone lines, and its website, and caused delays in lab and imaging results.

The LockBit ransomware gang subsequently issued a rare public apology, saying the affiliate responsible had broken its rules against encrypting medical institutions, and handed over a free decryptor, though only after the hospital had spent nearly two weeks restoring systems on its own.

In September 2023, SickKids was among the Ontario healthcare providers caught up in a breach at a third-party organization it shares perinatal and child health data with. That incident, which stemmed from mass exploitation of the MOVEit Transfer zero-day (CVE-2023-34362), exposed information on 3.4 million people, including names, home addresses, dates of birth, and health card numbers.

Healthcare remains one of the most heavily targeted sectors for both ransomware crews and data extortion groups.

Pediatric hospitals in particular sit on decades’ worth of sensitive records, which continues to make them attractive to attackers regardless of the ethical lines criminal operations claim to observe.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

After a dominant win at Galle in the first Sri Lanka vs India Test, Shubman Gill’s men will now be looking to grab another 30 crucial World Test Championship (WTC) points in the second Test at SSC Colombo.

India now need 7 wins out of their remaining 8 matches to make it to the WTC final. Sri Lanka’s loss, however, puts them nearly out of the WTC final race, as they now need 6 out of 6 wins to keep their hopes alive, while also depending on other results.

It’s less about an autonomous vehicle’s capabilities and more about what conditions it can operate in.

Why Waymo is considered Level 4 automation

bluestork/Shutterstock

What separates Level 4 from Level 5 automation

Oselote/Shutterstock

Why getting to Level 5 is much harder than expanding Level 4

Ward Dewitt/Getty Images

Threat actors are abusing FTP banners to hide commands that deliver two previously undocumented remote access trojans named E4del and PINHOLE.

MalwareHunterTeam observed this unusual technique in July in an attack that used shortcut files (.LNK) and FTP server banners as dead-drop resolvers (DDR) to retrieve commands.

FTP banners are text strings the server uses as a greeting message for connecting hosts before they log in.

By embedding commands in the initial response sent when a compromised system connects to an FTP server, a malware stager can receive instructions from a remote server.

After discovering FTP banners being used to deliver malicious commands during an investigation, researchers at threat intelligence platform SOCRadar expanded their hunt and found that the technique remains in use.

“By utilizing FOFA searches, we determined that this technique has been weaponized since early July 2026 and remains operational, with new infrastructure observed as recently as August 2026.”

In a report shared with BleepingComputer, SOCRadar says that the observed attacks start with a ZIP archive that triggers an LNK-based infection chain. The researchers note that the initial compromise likely occurs through phishing.

The infection chain delivers two remote access trojans (RATs) named E4del and PINHOLE via two distinct infection routes, both retrieving  a PowerShell script from FTP banners.

E4del is a Node.js-based RAT packaged inside a digitally signed Electron application that masquerades as Discord.

The RAT supports running commands through persistent or temporary shells, capturing screenshots, streaming the desktop over WebSockets, and downloading and executing additional payloads.

SOCRadar also mentions a Node.js module named crypto32.node that attempts privilege escalation, but the researchers could not retrieve it for analysis.

PINHOLE retrieves its C2 configuration from Pinterest pins and SurveyMonkey survey questions, a tactic that offers versatility and resilience to take-downs.

The malware leaves a minimal footprint on the host, using shellcode fluctuation to keep only one 4KB section of the payload in memory at a time, and injecting the final assembly into a suspended ApplicationFrameHost.exe process via Early Bird APC injection.

PINHOLE supports 14 commands, including file enumeration, uploading and downloading files, command execution, process management, capturing screenshots, and deploying a module for stealing credentials stored in browsers.

At the time of analysis, the PINHOLE script counted only 11 execution events, suggesting that the campaign was in an early stage.

While abusing FTP banners to deliver commands is a novel alternative, SOCRadar says that the approach is less stealthy than traditional web-based DDRs (e.g., X, GitHub, YouTube) because FTP connections to unknown servers are more likely to stand out.

“While threat actors typically utilize legitimate web services, such as X, GitHub, or YouTube, to provide cover through high-volume, expected network traffic, FTP banners represent a novel alternative.”

The researchers note that the technique is very versatile and could “easily” be adapted for ClickFix social engineering campaigns.

SOCRadar’s report provides indicators of compromise that could help defenders identify the malicious infrastructure as well as infected machines on the network.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Advertisement

Get the report

On Hackaday last week, and on the podcast, we were talking about one of the educational toys of yesteryear that launched a thousand careers, at least if the comment section is to be believed: the Radio Shack 200-in-1 electronics kit. The “toy” itself was basically a bunch of components with spring terminals, but the secret sauce was in in the instruction book, and maybe the marketing.

Tom had one of these when he was a kid, and told a great story about wanting it desperately based on the ads he had seen with kids Morse coding to each other. When he got the kit, and found out that “it was just a bunch of wires” he was fully pissed off. But he worked through the examples, learned some basic electronics, and the rest is history.

What I really love about this story is the siren’s call of a good project. Tom was pulled in, and maybe even fooled, by the advertising, but it probably changed his life. It’s funny how many of our folks can remember the first project that got them hooked as well. With me it was some simple audio effects pedals and then maybe later some simple BEAM robots, and for younger hackers maybe it was a 3D printer or Arduino project.

Digital or analog, the common ground here is that we all thought that some project was cool enough to warrant the sweat of learning enough to do it. Good instructions are helpful of course, and having the parts on hand never hurts. But it’s the promise of making something that you really want that I think underlies all good first projects. (And heck, every subsequent project as well.)

So while Tom, and a bunch of our readers, were looking back with nostalgia at the 200-in-1, I’m thinking about how many more than 200 projects I’ve seen made by our community, and even featured here on Hackaday, that are out there to provide the motivation to get someone started. Keep on hacking!

The projector industry has a rather large problem in 2026: 98-inch televisions are getting cheaper, brighter and increasingly difficult to ignore. Simply telling consumers that a projector can make a bigger image is no longer enough when enormous Mini-LED televisions are becoming attainable without requiring a dedicated projection room.

That has forced projector manufacturers to become considerably more ambitious. We recently looked at the XGIMI MIRA, which attacks the more affordable end of the ultra-short-throw market, along with newer lifestyle projectors such as the XGIMI HORIZON 20 Series and Hisense XR10, which combine easier placement with increasingly sophisticated optics, HDR processing and gaming features.

The new XGIMI AURA 3 Max pushes that trend into the premium UST category with an RGB triple-laser light engine rated at 5,700 ISO lumens, a dual-iris optical system, claimed 8,000:1 native contrast, 110% BT.2020 color coverage, Dolby Vision, HDR10+, Google TV and support for 4K/120Hz gaming over HDMI 2.1.

This is not simply an AURA 2 with more light coming out of it.

Related Reviews: Hisense XR10 Triple Laser 4K Lifestyle Projector Review

What Makes the AURA 3 Max Different?

Ultra-short-throw projectors have always made a compelling lifestyle argument. Instead of hanging a projector from the ceiling and running cables through the room, a UST can sit on a cabinet beneath the screen and create a very large image from only a short distance away.

The AURA 3 Max has a 0.163:1 throw ratio and can produce a 120-inch image with roughly eight inches between the projector and screen. XGIMI also includes automated screen alignment, autofocus, keystone correction, wall-flatness compensation, wall-color adaptation and eye protection to make installation less intimidating for consumers who do not want to turn their living room into a weekend calibration project.

Those conveniences are increasingly common, however. What separates the AURA 3 Max from less expensive UST models is the amount of attention XGIMI has paid to contrast, optics and gaming performance, areas where lifestyle projectors have historically made compromises.

RGB Triple Laser and 5,700 ISO Lumens

The AURA 3 Max uses an RGB triple-laser light source with a claimed maximum output of 5,700 ISO lumens and coverage of 110% of the BT.2020 color space.

That level of brightness is clearly intended for multipurpose living spaces where total light control may not always be practical, although manufacturer brightness specifications should never be confused with independently measured output in an accurate picture mode. That will require an actual review.

A proper ambient-light-rejecting UST screen will also remain important for anyone planning to use the projector during the day. The screen is sold separately, so buyers need to factor that expense into any comparison with a 98-inch or larger television.

Dual Iris Contrast Control

The AURA 3 Max’s dual-iris optical system may ultimately prove more important than the lumen number.

Very bright DLP projectors can struggle with black levels and shadow depth, especially when they are designed to produce enough light for daytime viewing. XGIMI says its two-stage iris system combines optical light control with dynamic adjustment based on the content and can deliver up to 8,000:1 native contrast.

The company also uses Dynamic Black Enhancement to further increase perceived contrast while attempting to preserve detail in darker scenes.

Those figures need independent verification, but the direction is important. Premium UST manufacturers are no longer competing solely on brightness. Contrast control is becoming one of the key battlegrounds, with competitors such as Hisense and AWOL Vision also introducing increasingly sophisticated optical systems to improve black levels.

X Vision AI Processing and HDR

The AURA 3 Max introduces XGIMI’s X Vision AI image processor, which performs real-time analysis for detail reconstruction, HDR optimization and other picture adjustments.

HDR support includes Dolby Vision, HDR10, HDR10+, HLG and dynamic HDR tone mapping, along with IMAX Enhanced and Filmmaker Mode. Native 24fps playback is supported for film material.

XGIMI has also addressed two artifacts commonly associated with RGB laser DLP projection: laser speckle and rainbow effects. The company says its optical system and processing reduce both, although sensitivity varies considerably from viewer to viewer and remains something we would want to evaluate in person.

The optical assembly uses 19 elements, including ED-grade optical glass and multi-layer coatings designed to maintain focus and color consistency from the center of the image to the edges. That emphasis on better lenses reflects a broader shift in the lifestyle-projector category, where convenient placement is no longer considered an excuse for mediocre optics.

4K/120Hz Gaming

Gaming is one of the AURA 3 Max’s more unusual strengths.

XGIMI uses two DLPC 8545 display controllers operating in parallel to process 4K UHD signals at 120Hz. The projector also supports VRR, ALLM, AMD FreeSync Premium and Dolby Vision Gaming, along with claimed input latency as low as 1ms depending on resolution and operating mode.

XGIMI describes the AURA 3 Max as the world’s first UST projector to support 4K/120Hz playback. We would leave that phrased as XGIMI’s claim rather than treating it as an independently verified industry first, particularly given the number of regional and differently specified projector models now entering the market.

What matters more is the practical application. Owners of a PlayStation 5, Xbox Series X or gaming PC can potentially use a very large projected image without being limited to the 4K/60Hz ceiling still found on many UST projectors.

That makes the AURA 3 Max considerably more interesting for gamers than most previous premium UST designs.

Google TV and Harman Kardon Audio

The projector runs Google TV, providing native access to Netflix, YouTube, Prime Video and other major streaming services, along with Google Cast and Google Home integration.

Audio comes from an integrated 80-watt Harman Kardon system with support for Dolby Atmos and DTS Virtual.

Anyone spending serious money on a premium projector should still consider a proper soundbar or surround system, but integrated audio matters in this category. UST projectors are increasingly marketed as television replacements, and many buyers expect them to function as complete entertainment systems without requiring an AVR and five loudspeakers on day one.

Connectivity includes three HDMI inputs, including an eARC connection, plus USB 3.0, USB 2.0, Gigabit Ethernet, optical digital audio and analog audio connectivity. XGIMI also includes two pairs of 3D glasses, because projection remains one of the few corners of the display industry where 3D has somehow avoided being buried completely.

Key Competitors

The Hisense PX4 Pro is one of the most obvious rivals. Hisense currently lists it at $3,999.99 and equips it with an RGB triple-laser light engine, 3,500 ANSI lumens, a claimed 6,500:1 contrast ratio, Dolby Vision, IMAX Enhanced and gaming-focused features.

The Hisense L9Q moves further upmarket with up to 5,000 ANSI lumens, Google TV and a considerably more elaborate built-in Devialet audio system. It is particularly relevant because Hisense has spent years establishing itself as one of the dominant brands in the UST category.

The AWOL Vision Aetherion Max is another direct competitor, with RGB triple-laser projection, wide-gamut color, Dolby Vision, VRR and aggressive gaming specifications.

Consumers spending less should also consider models such as the NexiGo Aurora Pro MKII ($2,999), which has earned a strong reputation for delivering excellent UST performance without moving into the highest price tier.

That competitive field makes the AURA 3 Max’s eventual U.S. price extremely important. Its specification sheet is impressive, but premium UST buyers have more credible alternatives than ever before.

Who Is the XGIMI AURA 3 Max For?

The most obvious customer is someone who wants a 100 to 120-inch or larger image in a multipurpose living roombut has no interest in ceiling mounting a traditional projector or designing a dedicated theater around one.

Movie and sports fans should appreciate the high light output and extensive HDR support, while gamers have an unusually strong reason to look at this model because of its HDMI 2.1 feature set and high-refresh-rate capabilities.

The AURA 3 Max could also appeal to consumers considering one of the increasingly affordable 98-inch televisions but who still want something significantly larger. A 120-inch 16:9 image provides roughly 50% more screen area than a 98-inch display, which is a substantial difference once both are viewed at normal seating distances.

There are still tradeoffs. The ALR screen adds cost, even a very good UST projector will not automatically match the black levels of the best OLED or high-end Mini-LED televisions, and consumers sensitive to DLP rainbow artifacts or laser speckle should see one in person before purchasing.

Price & Availability

XGIMI has opened registration around the AURA 3 Series launch, but it has not yet announced final U.S. pricing or a confirmed U.S. retail shipping date for the AURA 3 Max.

The projector was originally unveiled in China in May 2026, so we would not describe it as a CEDIA Expo 2026 launch. XGIMI is exhibiting at CEDIA this year, however, which makes it entirely possible that U.S. pricing or additional availability information could emerge around the show.

Until XGIMI confirms that, we would rather leave the calendar alone than promote a coincidence into a launch strategy.

The Bottom Line

The XGIMI AURA 3 Max is interesting because it attacks several of the remaining weaknesses of premium UST projection rather than simply adding more brightness.

The dual-iris optical system is aimed at improving contrast, while the elaborate RGB laser engine, improved optics and broad HDR support address picture quality. HDMI 2.1, 4K/120Hz, VRR and ALLM give gamers features that remain unusual in this category, and Google TV plus substantial built-in audio preserve the convenience that makes UST projectors attractive in the first place.

The two numbers we still want independently verified are the claimed 8,000:1 native contrast ratio and ultra-low gaming latency, and the biggest unanswered question remains the U.S. price.

If XGIMI gets that part right, the AURA 3 Max could become one of the more compelling premium UST options of 2026. Giant televisions are no longer giving projector manufacturers much room for complacency, and this looks like XGIMI’s response.

Related Reading:

Chinese chip companies are running unusually broad equity schemes to keep engineers, with Cambricon covering 85.3% of its workforce and AMEC more than 97%. Europe’s semiconductor sector has a talent gap estimated at 65,000 workers.

Chinese chip companies are giving away equity at a scale that looks less like a bonus scheme and more like a defensive measure. Cambricon has unlocked around 600,000 shares for 124 core staff, worth an average of 5.57mn yuan each, or about $828,000.

The breadth is the more striking number. The same company has granted 5mn shares to 944 employees, which is 85.3% of its workforce, in a plan running to 2028.

It is not alone in that approach. Zhongji InnoLight, which makes optical transceivers for AI data centres, allocated 2.48mn shares to 99 key personnel with average yields above 26mn yuan, and the chip equipment maker AMEC has a restricted stock plan covering more than 97% of its staff.

Cash is moving in the same direction. ByteDance and Tencent have reportedly offered pay increases of up to 150% and bonuses of around 35% to secure AI talent.

The pressure behind it is domestic as much as geopolitical. Chinese firms are poaching from one another while export controls have made domestic chip design a national priority, which concentrates demand on a small pool of engineers.

The awards are not unconditional. Cambricon has tied an incentive plan to a revenue target of roughly $14.8bn, which turns retention into a performance instrument rather than a gift.

Europe’s problem is described in the opposite terms. The European Chips Skills Academy has put the continent’s semiconductor talent gap at 65,000 workers, in a region that has more AI talent than the United States by headcount.

What Europe lacks is the instrument rather than the people. Many of its relevant employers are listed incumbents, research institutes or university spinouts, and employee share schemes differ so much between member states that equity is a harder tool to reach for.

Its answer has largely been training. Skills academies, apprenticeships and Chips Act programmes address supply, on a timescale measured in graduate cohorts rather than quarters.

The American answer is simply money. TNW has reported that Anthropic pays the highest salaries in AI research, to the point that its chief executive has worried aloud about people joining for the pay.

So three regions are answering the same shortage differently. China is offering ownership, America is offering cash, and Europe is offering courses, which is the only one of the three that cannot be accepted immediately.

Across the world, rising costs and an uncertain economy mean that smartphone sales are falling, yet Apple’s iPhone has still seen a 5% growth in the latest quarter.

The latest figures from Europe recently showed that as the smartphone market continues to contract, the iPhone continues to grow. Now figures for Latin America are saying a similar, but not identical thing.

According to Counterpoint Research, smartphone sales in Latin America for Q2 2026 saw their largest decline in three years. Compared to the same period in 2025, the market shrunk by 10%.

In Europe, Apple still saw its market share rise during that period, but for Latin America, the result is less clear cut. Apple remains behind Samsung, Xiaomi, and Motorola for market share, but it still grew its shipments by 5%.

Only Samsung did better at with a 6% increase. All others saw sales decline, with Xiaomi the worst affected with a 27% drop year over year.

LATAM Smartphone Shipments by OEM, Q2 2025 vs Q2 2026 YoY – image credit: Counterpoint Research.

The price rises from the global chip shortage contributed to the overall drop, with the greatest declines seen by the entry-level and mid-tier brands. Those account for three quarters of all the smartphones sold in the region.

Researchers credit Apple’s growth in the premium market in part to the company absorbing price rises, at least for the time being. They also report that there is consistent demand for the iPhone 17 Pro Max.

There was also steady demand for older iPhones, while the quarter benefited from the then still quite new iPhone 17e. That had launched midway through March, the last month of the previous quarter.

Apple’s fiscal Q2 runs from April to June, and there were no new iPhone launches in that time. The third quarter runs from July to September, so there will be a launch of the iPhone 18 Pro range toward the end of that quarter.

That will probably benefit Apple, but overall the research expects that Latin America smartphone sales will not improve until at least 2028.