There’s no denying the appeal of deep-fried foods, from donuts to drumsticks, plus numerous bite-sized appetizers and every kind of potato. But when it comes to whether to bother deep-frying at home, it isn’t necessarily a matter of difficulty. With the right vessel and thermometer, frying can be a quick, easy way to make memorable dishes — the real issue is: what to do with all that leftover oil?

Shallow frying can also get the job done in many cases, but it can also create a conundrum. Putting that oil down the sink? Potentially drain-clogging, environmentally dubious, and frankly, wasteful. I grew up in a household where leftover grease and oil went into a glass mayonnaise jar kept under the sink, to be discarded once it was full. Sure, this saves the sink, but it doesn’t address the other two issues. It’s a quick kitchen hack that makes it easier to put it out with food waste, but there’s also another solution.

Don’t get rid of it. “Oil used for frying is not one and done,” says Melanie Underwood, cookbook author, culinary instructor, and founder of Nourish and Gather, “unless the oil has been overheated, or if you’re frying things that are particularly strong in flavor. With something like seafood, you want to be careful, but it’s perfectly reusable as long as it wasn’t smoking.”

With that, Underwood shares her best practices and advice for reusing oil multiple times before it’s done.

Manage the oil before and during the frying process

To ensure oil is good for multiple uses, first make sure you’re using the right oil — something neutral in flavor with a high smoke point. “Any vegetable oil, such as canola oil, peanut oil or sunflower oil, is best for frying,” says Underwood. While olive oil can be tricky to fry with because it has a lower smoke point, “I definitely have used olive oil,” she says, “and I have never had any problem with it whatsoever.”

Resist the impulse to eyeball your oil for temperature clues, or test bits and pieces to make sure you’re in the right zone, unless you fry so regularly that it’s second nature. Otherwise, that’s a recipe for pieces with burnt exteriors and undercooked interiors, and/or smoking out your upstairs neighbors. (Speaking from experience, sadly.) Using a thermometer, “the correct range for frying is usually between 350 to 400,” says Underwood, which prevents smoking.

During the frying process, it’s a great idea if you can skim out any crumbs or whatever has come off in the oil,” she says, “because when you have little burned pieces, that will degrade the oil faster.”

After frying: cool, strain, and store

Once you’re done frying, managing the oil for future use is simple. “First, you let it cool,” says Underwood. Don’t try to speed up the process by refrigerating it; just let it sit until it cools to room temperature.

Straining it is also straightforward and can be done with whatever you already have on hand. “I use a fine mesh strainer,” Underwood says. “People also use cheesecloth or a coffee filter. You just want to strain it and get out all those teeny particles.” Some micro particles may still be visible in the oil after straining, but they will settle once the oil is stored, and it is easy to prevent them from transferring into a pot the next time you want to use it.

Finally, Underwood suggests transferring the oil to a clean and dry container. “It’s very important that it doesn’t have any residual water in it,” she says, “and then just put a lid on it, tightly sealed, and keep it away from heat and light.” If you don’t plan to use it immediately, you can store it in the refrigerator, but any place with a consistent temperature and away from light works.

Considerations for reusing oil

There’s nothing special that needs doing in order to use preused oil the next time, but bear one thing in mind: “Just be aware that it would now carry allergens from anything that you previously cooked in it,” says Underwood, which is essential to know if you’re cooking for other people.

Since that can be hard to track over multiple uses, “Always label and date it,” she suggests. “I just put a piece of tape on it with the date and the number of uses. And I also actually put what was fried in it,” she says, which can help keep track of potential allergens.

It also helps keep potentially odd flavors out of whatever you cook next, as certain items like seafood or onion rings can impart flavor into the oil. “I don’t typically like to fry a savory thing and then fry a sweet thing,” says Underwood. “Like I wouldn’t make schnitzel and then use that oil for a donut.” 

If you’re unsure whether an oil is still good to use, let your nose guide you to suss out if something is funky. If you’re not confident in your sniffing ability, Underwood advises smelling unused oil of the same type first, then smelling the used oil for comparison. You can use frying oil at least two or three times, maybe more if it was only used for light-flavored things that didn’t impart many particles and was never overheated.

Read more: An Expert Explains When to Use Certain Cooking Oils

Benefits of reusing oil

The biggest benefit of reusing frying oil is the savings in every possible regard — you save money, and it’s a much more environmentally friendly practice across the board. “When you’re reusing any product, then you’re lowering the demand for things like production, packaging and transport,” Underwood says. “I don’t think that we think about that big picture very much, but if we were all reusing it, it would reduce those demands on the environment.”

Each time you reuse oil, it also diminishes in volume a bit. In my experience, at least with shallow frying, you can use the same batch of oil until, after a few uses, nothing remains to discard — the ultimate win.

Pamela Vachon

Contributor

Pamela is a freelance food and travel writer based in Astoria, Queens. While she writes about most things edible and potable (and accessories dedicated to those topics,) her real areas of expertise are cheese, chocolate, cooking and wine. She’s a culinary school grad, certified sommelier, former bartender and fine dining captain with 10 years in the industry. When not sitting at the keys, she leads in-home cheese classes, wine tastings and cocktail demonstrations.

See full bio

Advertisement

Jason Dessen cannot seem to get away from the Box, even when there isn’t one in front of him. In Dark Matter Season 2, Episode 4, Jason finishes a shift at the bar and, after stepping outside, reaches for the door to go back in. For a moment, it isn’t the entrance to the pub anymore. He sees himself opening the familiar door of the Box, with the corridor behind it, before reality settles back into place.

It is a brief moment, but an effective one, particularly after Episode 3 had Jason painstakingly dismantling the machine in the hope of finally putting some distance between his family and the multiverse. The physical Box can be taken apart; Jason’s relationship with it clearly cannot. More than that, seeing an ordinary rectangular doorway suddenly become its entrance makes us wonder about something Dark Matter has largely trained us to accept without question: why was the gateway to infinite realities a box in the first place? Why not a circle, a sphere, or the kind of glowing portal science fiction has taught us to associate with travelling somewhere impossible?

The answer begins much earlier than the Apple TV series.

The Box came before Blake Crouch knew what it did

When Blake Crouch was developing the 2016 novel on which the series is based, the shape wasn’t the conclusion to some elaborate piece of quantum theory. The image came first. “I had the image of a box in a warehouse, with a door on it. And that was it,” Crouch said of the idea that eventually became Dark Matter. He was brainstorming the novel in 2014, after spending years circling quantum mechanics and looking for the right story to connect to it.

A box creates an unmistakable boundary, which makes it a particularly useful object for a story built around lives that can branch into almost endless possibilities. Something is either inside it or outside it, and crossing that threshold becomes an event in itself. Crouch didn’t need the fictional physics to demand a cube; he needed an object that could make the act of entering another possibility feel physical.

The science behind the Box is fictional, but its basic idea grows out of a familiar quantum concept. Jason’s original research involved a much smaller cube intended to shield a tiny physical object from observation and external stimuli, keeping it in what he describes as an undetermined “cat state.” Jason2 succeeds where he did not and scales the concept until the experiment is large enough to contain a human being. The Box becomes the physical expression of an experiment built around observation, uncertainty and the possibility that more than one outcome can exist.

A hard-edged cube also gives the story something almost paradoxical to work with. Its dimensions are fixed, its walls are solid, and its boundary is obvious. Inside it, however, Dark Matter places a corridor that seems to have no meaningful end, with doors leading to realities that can differ wildly from the one left behind. The most ordinary-looking object in the story consequently becomes the entrance to something that cannot be contained by its physical dimensions.

Schrödinger’s cat makes the shape more interesting

The obvious reference is Schrödinger’s cat, the famous thought experiment in which a cat is sealed inside a box with a quantum event that can determine whether it lives or dies. Until the system is observed, the thought experiment imagines the cat occupying both possible states.

Dark Matter effectively puts the observer inside that experiment. Jason doesn’t stand outside the Box wondering which state exists on the other side. He enters it, becomes part of the experiment, and encounters a corridor through which different outcomes can be reached. The Box turns a thought experiment about mutually exclusive possibilities into the architecture of the series itself.

The visual contradiction is what makes the idea especially effective. A cube is rigid, finite and easily understood. It has fixed dimensions, hard corners and an obvious boundary between inside and outside. Dark Matter, meanwhile, places something apparently limitless within it. Once the drug takes effect, the enclosed space gives way to a corridor whose doors can lead to an extraordinary number of realities.

A circular portal would immediately communicate its purpose. Science fiction has spent decades teaching audiences that a glowing ring, tear or doorway is shorthand for travel between places that should not be connected. The Box carries a different suggestion. From the outside, it looks like an industrial object that could plausibly be sitting in an abandoned warehouse. Its strangeness only begins once the door closes.

Every door inside the Box also turns the mechanics of the multiverse into a question of choice. Jason can see other versions of his life, but seeing them does not make choosing between them easier. Each possibility carries its own consequences, and the person standing in the corridor still has to decide which one is worth entering.

Season 2 has changed what the Box represents

In Season 1, the Box was primarily a means of movement. Jason needed it because every journey through it offered another chance to find Daniela, Charlie and the world from which Jason2 had removed him. However frightening the realities behind its doors became, the machine still represented a possible route home.

In the current season, the relationship has become much less comfortable. Jason has his family again, yet the Box remains at the centre of their instability. His fixation with the machine is now affecting the life he fought to recover, and dismantling it becomes an attempt to impose some kind of final boundary between his family and the multiverse.

Episode 4 pushes that idea somewhere more personal. Jason no longer needs to be physically inside the Box for its presence to follow him. An ordinary doorway briefly becomes its entrance, turning something completely familiar into a reminder of the place he has spent so much of his life trying to escape. The image works because Jason’s problem is no longer simply the machine itself. He has begun to carry the Box with him.

The object can still function as a laboratory and a doorway, but its meaning has expanded. For Jason, it has also become a kind of prison, because destroying the physical machine cannot erase what happened inside it or the lives he has seen on the other side. A story about infinite possibilities has consequently given its central character a strangely finite problem: he cannot simply choose a different reality and leave the consequences behind.

Crouch may have started with nothing more complicated than the image of a mysterious box in a warehouse, but Dark Matter has spent two seasons turning that simple shape into the physical language of its entire story. It contains the experiment, separates Jason from the world he knows, opens onto lives that should never have been accessible, and now follows him even when he isn’t anywhere near the machine. The Box was always about crossing a boundary, but Jason’s experience suggests that some boundaries become much harder to cross back over.

The latest episode makes the idea particularly clear. Jason can dismantle the machine and try to build a life outside it, but the Box has become part of how he sees the world. For a character who spent so long trying to find the right door, the more unsettling possibility may be that he can no longer look at an ordinary one without wondering where it might lead.

An ongoing npm malware campaign involving the ‘indexed-btree’ package shows how threat actors bypass supply chain defenses by hiding malicious code in a package’s normal runtime behavior rather than in installation scripts.

The package, spotted by Checkmarx researchers, attempts to impersonate the legitimate ‘sorted-btree’ library and has already amassed 2 million weekly downloads.

The campaign may also have generated significant profits for the attackers, who, according to Checkmarx, use a wallet holding 109 ETH. However, the report does not say those funds came from cryptocurrency theft.

Bypassing latest security measures

In June 2026, GitHub announced a set of npm security measures designed to help prevent supply chain attacks that have shaken open-source ecosystems repeatedly since late 2025.

One key security measure is to block dependency lifecycle scripts such as ‘preinstall’, ‘install ‘, and ‘postinstall,’ unless explicitly approved.

Other measures prevent npm from automatically retrieving dependencies from Git repositories or remote URLs without permission.

The malicious indexed-btree package sidesteps these protections by avoiding installation scripts and instead hiding its loader in the package’s BTree.prototype.set() method, which executes at runtime when the application calls it with a specific key value.

As a result, installation appears clean and triggers none of npm v12’s approval mechanisms.

“The malware loader hides inside the library’s own BTree.prototype.set method, which is the main function that every user would call constantly,” explains Checkmarx.

“This triggers the sharedLoad.min.js, which contains the obfuscated first stage of the malware. This is a well-built way to sneak past standard taint-analysis tools and most static scanners.”

Once the malware is executed, it can collect system details, including architecture, hostname, CPU, memory, and uptime, and exfiltrate the information through hardcoded Slack and Telegram channels.

The malware also polls an Ethereum smart contract on the Sepolia test network for command-and-control (C2) information. It uses X25519 key exchange to derive an AES key and decrypt a second-stage payload stored in the contract.

When the operators choose to end the attack, the malware can delete its files and remove the malicious trigger from the package code to wipe its traces.

The researchers note that the threat actors have gone to great lengths to make the project appear legitimate, including building a legitimate-looking GitHub repository, populating its commit history, and curating the developer account.

Checkmarx also discovered nine additional npm packages linked to the same operation, which it has now removed from npm. Those also achieved significant download numbers, as seen here:

1. ordered-kv-index (448,184 downloads)
2. btree-leaderboard (493,685 downloads)
3. priority-slot-queue (402,860 downloads)
4. btree-range-store (468,092 downloads)
5. btree-core (1,951,274 downloads)
6. btree-time-index (425,312 downloads)
7. btree-lru-cache (372,185 downloads)
8. neighbor-key-map (366,019 downloads)
9. sliding-score-window (448,024 downloads)

Developers are advised not to rely on install-time scanning alone, and to also employ runtime behavioral analysis.

Those who installed indexed-btree or any of the above-listed packages should rotate all secrets and restore their development environment from a safe backup.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Pavlo Bazilinskyy still can’t believe he was on PornHub for work. He’s an assistant professor at the Eindhoven University of Technology in the Netherlands, and has spent more than a decade researching AI-driven interactions between humans and robots. But he found himself typing “public transport” into the search bar of a very specific website’s “amateur section.” 297 hits.

“People are hard to predict,” Bazilinskyy says. It’s why he researches what he does. So his prurient pursuit had a point. Robotaxis without cabbies behind the wheel have started picking up passengers in a handful of countries, including the US. Meanwhile, there’s a long history of people getting up to antisocial behavior inside the quasi-private or straight-up public spaces of trains, planes, and automobiles—think the prom night limo, the “Mile High Club,” Tom Cruise in slow motion aboard the Chicago L in Risky Business, the stuff he found on PornHub.

What might riders do when there’s no authority figure inside a vehicle to say, “Hey, stop that!”? What do they do? Can people be convinced to stop before they start?

This week, Bazilinskyy and academic colleagues with backgrounds in systems engineering, computer science, psychology, and tourism studies are hosting an industry workshop asking participants to brainstorm along those very lines: How do you stop people from doing it in self-driving cars? Thinking about sex in autonomous vehicles, they theorize, can let anyone who cares about the future of mobility “stress-test” the role the vehicles might eventually play as communal spaces, where social norms get acted out every day.

The event focuses on prevention not just because these academics are no fun (though Alexandros Rouchitsas, an engineering psychologist who is also hosting the event, admits they are “taking the side of the parents, the elderly—we are not the cool people here”). They don’t want people to have sex in self-driving cars because they’re worried it will give a potentially positive technology a really bad rep.

“We want to see automated mobility solutions accepted, trusted by the general public,” Rouchitsas says. Self-driving could have huge upsides for the elderly, children, and people with disabilities, who have a harder time getting around places where driving is quicker and sometimes necessary. The tech might eventually move beyond private taxis and into public transit, where all sorts of people should be able to travel safely and comfortably. “We want automated mobility solutions to be seen as something that is equitable, serious, societally minded,” he says.

Rouchitsas’ biggest fear is that self-driving gets co-opted by the partiers, the drug users, the sort of hedonistic folk who have descended on some islands of his native Greece. “You know ‘Bang Bus’?” he says. “We don’t want that.”

The four-hour workshop—rise and shine, it starts at 8:30 am—is part of an industry conference in Gothenburg, Sweden, focusing on how people interact with vehicles and larger mobility systems. The organizers expect participants from academia but also the wider industry. (Gothenburg is home to Volvo Cars and the tech supplier SmartEye; BMW and Google are conference sponsors.) Those who show up will be prompted to come up with physical and design interventions that encourage people to not do that. The workshop will focus on preventing consensual interactions, its organizers say.

Rouchitsas, who studies human-machine interactions, says he hopes participants will get creative with their anti-action designs. But just off the top of his head: Maybe the vehicles could be transparent? Maybe a light begins to blink if the technology senses behavior it disapproves of? The organizers intend to publish a paper based on the workshop’s results.

Sex is the fun, eye-catching part here, made all the more alluring because it’s “the elephant in the room” for those thinking about how humans might interact with machines in the future, says Bazilinskyy—very under-studied. But the results of this sort of inquiry could help designers, companies, and lawmakers figure out how to compel people to safely share communal spaces like public self-driving buses in the future.

Prevent sex and maybe you’ll also prevent robbery, bullying, and homicide. “It could be helpful for the industry and academics to use this example to design other things,” he says.

There’s a frightening new digital threat that Android users should be aware of. New AI-powered malware called RatHat can automatically gain admin-level control over your Android device, stealing whatever it wants.

RatHat was discovered by mobile security firm Zimperium, which notes that the program tricks people into downloading what appears to be a legitimate app, such as Google Chrome, via a fake web page that mimics the Google Play Store. Once opened, the app seemingly innocently asks for accessibility permissions, which it then uses to take over your entire device. 

RatHat uses the accessibility permissions users grant it to navigate your phone’s menu system and unlock Wireless Debugging, a legitimate developer tool commonly used in app testing, then grants itself ADB Shell permissions. This effectively grants the malware admin access to your device. Next, RatHat installs an AI-assisted agent that runs system commands to steal information and a proxy client that tunnels that stolen information back to the hacker. 

“That sort of infection chain isn’t necessarily more complex than, say, following a phishing email on Windows and saying yes when the program asks for administrator permissions,” Sav Wheeler, a research engineer for Malwarebytes, said in an email. “Escalation in the Android landscape often relies on granting apps additional permissions that the OS locks away by default to keep the devices secure.”

Per Zimperium, the malware can be traced to attackers in China and primarily targets apps like WeChat Pay and Alipay, which are as popular in China as Apple Pay and Venmo are in the US. Malwarebytes notes that other financial apps can also be targeted. So far, researchers have found 162 infected apps in the wild, which report back to a dozen servers run by attackers. 

What can this malware do?

The worrisome part is that the malware doesn’t do anything wonky the user would notice immediately, unlike with a ransomware attack. Instead, it bides its time, runs in the background, and captures information that appears on the screen, including usernames, passwords and two-factor authentication codes. 

It can also steal raw touch input from your touchscreen, allowing it to recreate PIN codes and pattern unlock codes. It can capture SMS messages, too, thereby intercepting security codes. There isn’t much that the app can’t steal if it wants to.

How can I find out if I have RatHat on my phone?

The only way to find it is to run an antivirus scan that detects the software. Malwarebytes is a free option on Google Play that can do this. Wheeler told CNET that it can detect the malware pretty easily, which is good news for anyone who’s worried about whether or not they have it. 

The bad news is that RatHat is sneaky and difficult to quarantine. 

“Unfortunately, because of the behavior of the program itself — remasquerading as other apps, dynamically changing its behavior using the AI endpoint — static analysis and quarantining is not enough to remove the malware,” Wheeler said. 

In short, the only way to actually get rid of this malware is a complete factory reset of your device. This effectively removes the hidden secondary files the malware installs, which antivirus apps can’t deal with. Uninstalling the app doesn’t work because the malware retains its admin access through those hidden files, which then let it reinstall the app over and over again. 

How do I avoid RatHat?

This is also good news. RatHat’s infection method is complex and can be thwarted at multiple points during the process. First, you should never click a link from an SMS or email from a source you don’t know or trust. That stops almost all social engineering threats right out of the gate, including RatHat. Verify that you’re using the official Google Play app rather than a deceptive imitation website. Look at the top of the screen. If it has an address bar where you type URLs, it’s just a website disguised as an app. Real apps do not have address bars.

Also, note that preinstalled or existing versions of Chrome do not require reinstallation, so if you’re being asked to reinstall an app you know you have, think twice.

Denying accessibility permissions is the critical final line of defense against mobile malware. While downloading a malicious application is risky, the software remains largely powerless until you grant it advanced system privileges.

Wheeler says that SMS phishing is targeted to each specific user, so you won’t see the same phishing attempt as another person, and the tactics the app uses vary from region to region. Following standard antiphishing practices and not enabling accessibility permissions largely removes the threat of RatHat. 

Joe is a freelance journalist. It all started with a long-running affection for building his own PCs, which he did for the first time as a teenager. It evolved into a lifelong enjoyment of putting words on the internet about the subject. He’s written for CNET, PCMag, Mashable and SlashGear as a freelance writer, and worked as a Senior Editor at Android Authority for 10 years. When he’s not writing about tech and science, he’s learning the ins and outs of DIY home repair, gaming, playing his bass guitars and posting help on PC building and gaming subreddits. He is a staunch believer that orange juice should have pulp.

See full bio

Advertisement

A £249.01 discount on a full SteamOS handheld is the kind of deal you usually only hear about after it’s already gone.

Catch this one while it’s still live: Lenovo has cut the Legion Go Steam Handheld Gaming Console to £399.99 as part of its EE Game Day offers this September, down from £649, a straight saving of £249.01, or roughly 38 percent off.