This past summer, Samsung launched the Galaxy Watch9 alongside the Galaxy Watch Ultra2, its more rugged, shock-resistant smartwatch for outdoor adventures.

The Watch9 is the everyday option, and it’s a solid smartwatch and fitness tracker with a plethora of health features. It’s available in a 40-mm size in cream and graphite, and a 44-mm size in graphite and silver, starting at $80. Compared with last year’s Galaxy Watch8, it’s a modest update, though. There’s a faster processor, a slightly larger battery capacity, and an expanded suite of wellness metrics.

After two weeks of testing the 40-mm model, I wouldn’t necessarily upgrade to the Watch9 from the Watch8. But if you have an older Galaxy Watch or you’re invested in Samsung’s ecosystem and are looking for a smartwatch, the Watch9 is the best choice.

A Familiar (Squircle) Face

The Galaxy Watch’s main hardware update is its new processor. It now utilizes Qualcomm’s Snapdragon Wear Elite platform, which Samsung claims enhances CPU and GPU performance along with efficiency. In testing, the watch responded smoothly when scrolling menus, launching apps, and dismissing notifications.

Wear OS 7 also adds more customizable widgets and live updates from compatible apps. One of the more exciting new additions is raise-to-talk for Gemini. Lift your wrist toward your mouth, and you can start talking to Google’s AI assistant. The Google Pixel Watch has had this feature for two generations now, so I’m happy to see Samsung finally catch up.

Samsung has also slightly increased the battery capacity. The 40-mm model has a 390-mAh battery (up from 325 mAh), while the 44-mm models get a 445-mAh cell (up from 435 mAh). Unfortunately, that doesn’t translate to an improvement in battery life, which is probably because it’s being used to power the watch’s expanded suite of health features (more on that later). Samsung still estimates up to 30 hours of battery life, but I averaged closer to 25 hours with Always-On Display enabled. That’s enough to get through a full day and night, but not enough to make charging something you can forget about. A full recharge also took me about 100 minutes on average, which is significantly longer than the 45 minutes it takes the Pixel Watch 5 to reach a full charge.

Every coral colony is cushioned by a thin boundary layer of water whose movement is slowed by friction at the coral’s surface. Researchers assumed that corals were passive with respect to the slow-moving boundary layer, simply relying on natural diffusion through it to provide nutrients and oxygen.

Then, in 2014, a team from the Massachusetts Institute of Technology and the Weizmann Institute of Science published a groundbreaking study showing that coral cilia interact with the boundary layer by rapidly whipping about to generate swirls of fresh, oxygenated seawater. Until a decade ago, scientists thought of these cilia merely as brooms that move mucus and sweep away waste particles and other debris. The research not only modeled the tiny vortices created by the cilia for the first time, but also revealed the cilia’s importance for survival and metabolism.

At first, the microbiologist and environmental engineer Orr Shapiro, who led the 2014 work at MIT as a postdoctoral fellow, was interested in how microbes that infect corals and cause disease follow concentration gradients, a process called chemotaxis. Under the microscope, he noticed something weird: In the boundary layer, particles were swirling around and mixing together—not at all like the passive diffusion he had been expecting.

“That was to me, and I think later on to the entire field, sort of a paradigm shift,” said Shapiro, now a researcher at the Volcani Institute in Israel. It became clear that the boundary layer wasn’t static, but rather a dynamic zone, and one where cilia were creating their own turbulence. The realization inspired Shapiro’s team to go off on a tangent, mapping the flow of oxygen to coral tissues via cilia. “It really transformed how we understand this [micro]environment, because suddenly the diffusion is no longer really important,” Shapiro said.

Diffusion is the default route for nutrients traveling through water, but it’s painfully slow. It can take as long as four minutes for oxygen to travel just 1 millimeter. That’s why the fast-moving flows created by cilia are so important: because naturally flowing water slows down near the coral’s surface, and corals consume oxygen faster than diffusion can supply it.

It is a system that delivers enough oxygen, despite the cilia’s energy consumption. But there’s a downside: Oxygen dwindles as temperature climbs. That’s when corals run into trouble.

Scientists have a clear understanding of one thing that happens to corals when water gets too hot: bleaching. As water temperatures rise, a coral’s symbiotic algae become stressed and release molecules that are toxic to the coral in large quantities. To protect itself, the coral expels its own algae—a primary food, energy, and oxygen source—and soon loses its color. It’s a slow death and an increasingly common occurrence as heat waves sweep across the world’s reefs.

But sometimes, some corals on a reef bleach while others don’t, and in other cases corals under heat stress die without expelling their algae. An international team of microbiologists, engineers, and physiologists was eager to understand how heat affects cilia, and whether this could explain different types of coral death.

Apple’s smart home device will be the AI center of the household, with it potentially becoming the poster child for Apple’s new “intelligent personal hub” strategy.

During the Apple keynote, new CEO John Ternus laid out the company’s plans for the future, including what is described as an “intelligent personal hub” approach. If a report is right, the long-rumored Home Hub will do that for the home, as the iPhone does for the person.

Outlined in the “Power On” newsletter for Bloomberg on Sunday, Mark Gurman writes that the rumored smart display will serve as the anchor for the home. It will bring together a person’s digital connected life, including device controls, video calls, and media.

The newsletter goes out of its way to suggest that Ternus’ characterization of iPhone as an already-existing “intelligent personal hub” is in some way meant to protect the company from OpenAI’s impending hardware product. Then it goes on to describe Apple’s second hub, one for the home, suggesting that Ternus has a bad hand of cards and is running out of plays in light of OpenAI’s still non-existent hardware platform.

OpenAI’s current known cash burn is $1.25 per dollar it earns, if that says anything about the danger Apple faces.

Referred to as J490, the Apple Home Hub will use an operating system focused on Siri AI, and is apparently being tested in employees’ homes. It also allegedly matches Ternus’ description of an intelligent personal hub.

Gurman goes on to reiterate various previously-rumored elements, such as the square-ish display that uses a desk-based stand that looks like half a HomePod mini, or attaches to a wall mount using magnets.

It will use facial recognition to identify users, to personalize the information it displays to that individual. However, it will do so without a Face ID-level depth sensor.

Apparently, this feat could result in facial recognition in a future iPhone Duo update, without necessarily requiring the physical space for the sensor array.

The hub will have a home screen, widgets, and clock faces, but Siri will be the main feature. It will be able to bring up information across the user’s devices and accounts, play pertinent podcasts and songs, and also carry out more precise tasks.

One thing that is still missing is a release date. So far, all of the hype about the device implies it is coming “soon,” possibly this fall, though when exactly is still a mystery.

On the outside, the iPhone 18 Pro and 18 Pro Max look identical and have the same dimensions as last year’s iPhone 17 Pro and 17 Pro Max. But on the inside, the 18 Pro and 18 Pro Max are quite different, with bigger batteries, a new A20 Pro chip, a significantly larger vapor-cooling system, and tiny mechanical aperture blades in the main camera’s lens.

As the new Apple pro phones make their way into people’s pockets, they’re also appearing in durability testing and teardown videos. 

Tech reviewer Zach Nelson dropped a pair of iPhone 18 Pro videos on his YouTube channel, JerryRigEverything: one showing how the new pro phone did in a scratch and durability test, and the other showing him dismantle Apple’s new handset.

On Sunday, the tech repair and advocacy site iFixIt did a teardown of the iPhone 18 Pro, and not all of it went according to plan. Taking the back glass panel was relatively straightforward, but there’s not much that a person can repair aside from the panel itself.

Of the four 18 Pro and 18 Pro Max models that iFixIt took apart, the plastic frame behind the display broke on three. Apple doesn’t sell the plastic frame part, so if it’s damaged, it can only be replaced by getting a whole new display module. You could put the display back on without the plastic backing frame, but it wouldn’t sit flush with the body. I should note that in Nelson’s teardown, he didn’t suffer the same calamity and gave Apple a “thumbs up for repairability” after removing the display.

“Four phones are too few to establish a failure rate. Adhesive strength, heating, technique, or a difference in the plastic could all matter. That plastic frame has been present since the 15 Pro. But it hasn’t given us nearly as much trouble in previous years,” wrote Liz Chamberlian and Carsten Frauenheim, iFixIt’s director of sustainability and repairability engineer, respectively, in a blog post. “Using isopropyl alcohol might make display removal more consistent, but we’ll have to do more testing to be sure.”

Nelson and iFixIt’s teardown, along with Apple’s Ireland site, gives us a complete picture of the battery capacity for the new iPhone Pro models, SIM card and eSIM only models. Both the iPhone 18 Pro and 18 Pro Max have larger batteries compared to last year’s 17 Pro and 17 Pro Max. The variants sold outside the US have a slightly smaller battery to afford room for a SIM card tray.

The new variable aperture on the main camera of the 18 Pro and 18 Pro Max is another curiosity. It’s made of six tiny mechanical blades. For CNET’s iPhone 18 Pro and Pro Max review video, our cinematographer, Celso Bulgatti, filmed it in action.

If any of the rear cameras on the iPhone 18 Pro or 18 Pro Max break, you’d likely need to replace the entire camera array, which includes the new mechanical aperture.

“We dismantled the main camera and concluded that an aperture-only repair isn’t going to be feasible: if your aperture gets stuck, you’ll be looking at replacing the entire main camera assembly,” noted Chamberlian and Frauenheim.

On the whole, iFixIt gave the iPhone 18 Pro and 18 Pro Max a provisional repairability score of 7 out of 10, the same as the 17 Pro and 17 Pro Max and 16 Pro and 16 Pro Max.

You can watch more of iFixIt’s findings in the company’s full teardown video below.

Patrick Holland

Director of Content

As Director of Content, Hardware, I lead CNET’s team of journalists and editors, covering news and testing on smartphones, laptops, wireless carriers, AI, and pretty much anything with a battery.

See full bio

Security researchers found two ways out of the OpenAI Codex sandbox, one of them capable of running commands on a developer’s machine from Codex’s most locked-down mode, with no approval prompt and nothing shown on screen.

Both flaws were reported to OpenAI on August 12 and fixed within eight days, according to Oren Yomtov of Accomplish AI.

The more serious of the two, which the researchers call Heapjack, turns a routine action into remote code execution: open someone else’s repository in Codex, ask it a question about the code, and whoever wrote that repository gets unsandboxed command execution on your computer.

Codex is OpenAI’s coding agent, available as a command-line tool and a desktop app. Like rival agents, it runs the model’s actions inside a sandbox so that untrusted code cannot touch the wider system. Both escapes work by defeating that boundary from the inside.

Heapjack

The Heapjack technique, as described in Yomtov’s writeup, targets a component called node_repl, which Codex Desktop writes into the global ‘~/.codex/config.toml’ file at install time.

There is no opt-in and no setting to turn it off, and because the entry lives in the shared config, plain Codex CLI users inherit the same tool without ever being asked.

node_repl runs a single Node.js process that holds two separate JavaScript execution contexts. One is trusted and contains OpenAI’s own code. The other is untrusted and runs the agent’s code. The trusted context proves it is trusted by presenting a random token generated fresh on each run.

The problem is that both contexts live in one Node process and share one memory heap, so the token is just a string sitting in memory the untrusted side can read.

The untrusted code takes a snapshot of the heap with ‘v8.getHeapSnapshot()’ and tries every string shaped like a UUID. A wrong guess returns “not authorized.” A correct token with a bad argument returns a real validation error, which tells the attacker the token is right.

With the token, the untrusted code writes its own request onto the same pipe the trusted context uses to talk to a native, unsandboxed parent process.

The parent checks the token, sees a valid one, and does the work. The proof of concept used the system’s ‘open’ command to launch an application outside Codex’s process tree entirely. The same access reaches any Unix socket, a Docker daemon socket being the obvious target, and a tool for editing the global config file.

All of this runs at read-only, the strictest sandbox mode, where the agent is not supposed to write anything at all.

Overpatch

The second flaw, Overpatch, sits in the open-source Codex CLI. In workspace-write mode, the agent may only write inside the project folder, and a shell command aimed at the home directory is refused.

The researchers got Codex’s own patch tool, apply_patch, to write there anyway.

The tool grants write access to the parent folder of each path named in a patch. Name ‘/tmp’, and it grants write access to the root of the disk.

The working exploit uses a patch with two changes: one that names ‘/tmp’ and does nothing useful except widen the permission, and one that appends a line to ‘.zshrc’ through a symlink into the home directory.

Remove the first change and the write is refused. With it, the next terminal the developer opens runs the attacker’s line unsandboxed.

The same underlying mistake

Both bugs share a shape: the enforcement mechanism was living inside the thing it was supposed to be enforcing. apply_patch worked out its own permissions from attacker-supplied input. node_repl kept the secret separating trusted from untrusted code in the same memory as the untrusted code.

In each case the sandbox was told, from the inside, to let something through.

The class of bug is not new. In July 2026, Pillar Security researchers demonstrated the same idea across Cursor, Codex, Gemini CLI and Google’s Antigravity, where an agent that stays inside its sandbox writes a file a trusted tool outside the sandbox later runs.

Reacting to Yomtov’s post on X, one commenter wrote that “V8 contexts isolate globals, not memory, so the sandbox was really a promise the heap never agreed to.” Another called the trust boundary “a room divider.” The default-enabled behavior drew its own scrutiny, with one asking why a privileged token was reachable from untrusted JavaScript at all.

What to do

OpenAI fixed Heapjack in Codex Desktop build 26.818.21641 and Overpatch in Codex CLI 0.149.0, according to Accomplish.

Users should update to those versions or later. Yomtov credited OpenAI with resolving both issues within eight days of his report.

BleepingComputer reached out to OpenAI for comment prior to publishing.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

What just happened? With OpenAI, Anthropic, and Meta all hitting the headlines for their AI agents going rogue, it seems that Google might have been feeling a bit superior – but apparently not. The company has confirmed that its Gemini AI breached the systems of three other companies during cybersecurity tests. In one instance, it repeatedly guessed passwords until it found the right one, and Google wasn’t very forthcoming about what happened.

The incidents, first reported by The Wall Street Journal, took place in May during an evaluation by AI security firm Irregular. Gemini was supposed to work with fictional companies in a controlled test environment. However, an unintended internet connection gave the model access to real websites, and it treated them as part of the exercise.

In one test, Gemini was asked to retrieve information from software belonging to a fake company that shared its name with a real business. The AI guessed passwords until it gained access to the real firm’s protected system.

In the other cases, the model found credentials in public online repositories and used them to enter two more companies’ systems.

Google says that in all three instances, Gemini stopped once it realized the targets were real. The company didn’t disclose the incidents publicly when Irregular informed it in late July. It says no damage was done, the affected organizations were notified, and the testing procedures have since been changed. Google has not named the companies or identified which Gemini model was involved.

Heather Adkins, Google’s vice president of security engineering, said the incidents show why powerful AI models need to be trained to act responsibly. Google maintains that the model was trying to complete its assigned task, rather than deliberately seeking out victims.

This is just the latest in a series of similar incidents involving big AI companies. OpenAI’s agents breached Hugging Face and compromised accounts across several other services after escaping a test environment. Anthropic disclosed that Claude models accessed three organizations’ production systems during evaluations; another model tried to trick a real developer into accepting malicious code.

Meta’s model also reached the internet during an Irregular test and breached a third-party service. Meta blamed the breach on a testing misconfiguration. Unsurprisingly, Google and the other companies never publicly apologized for any of these breaches.

These incidents, alongside warnings from AI developers themselves, have intensified fears that the technology could threaten humanity’s survival. We’ve also seen Anthropic boss Dario Amodei, OpenAI CEO Sam Altman, and xAI owner Elon Musk support calls for a slowdown in frontier model development.

Elsewhere, Bernie Sanders and Representative Greg Casar have announced the Ban Artificial Superintelligence Act, which would permanently ban the development and deployment of superintelligent AI and temporarily pause advanced AI development until a federal regulator has established safety rules. Individuals who violate the proposed restrictions could face up to 20 years in prison.

After spending some time daily driving the Pixel 11 Pro, I could find plenty of faults with the device. Comparing Google’s latest flagship with other expensive Android phones, you’ll find areas where it lags behind. It isn’t the best in terms of raw performance, battery, or even charging–and many can argue that One UI or other Android skins feel better in various aspects, especially when it comes down to customizations.

Even then, I managed to get along with it just fine, and even after reviewing it, I’ve decided to stick to it for a little while longer. The Pixel has become an increasingly divisive phone. I know some fans of the Pixel formula, and even more who dislike it with a passion. Regardless of which side you lean, it is a very “opinionated” phone. So to really see its strengths, you have to pay attention to what Google actually spent its engineering effort on.

Only room for casuals, but then again, is that really a bad thing?

Tensor G6 still isn’t the chip I’d choose if mobile gaming were my priority, and I don’t think Google gets a free pass because Tensor was designed differently. Gaming will show you exactly where the Tensor G6 stumbles. An argument can be made for people expecting top-tier performance on their $1000+ phone, but then again, not everyone is playing AAA mobile games. The chip isn’t disgustingly slow to the point that you can’t smoothly scroll through the UI. Still, gaming was a choppy experience overall.

Tensor G6 has 50% more TPU compute than its predecessor, according to Google, and the company directly credits that additional AI processing with features such as Instant Night Sight, Magic Capture, and its latest on-device Gemini capabilities. But if you consider its real-world experience, it’s fast enough for most people. A vast majority of mobile games don’t require top-of-the-line hardware, and that’s where the Tensor shines. It is for the average user who just wants to drop in for some rounds in PUBG Mobile or play some relaxing puzzle games.

The little interactions go a long way

The same thinking extends beyond the camera. Google highlights Magic Capture, Rambler, and HiLight as three examples of how it wants the Pixel 11 family to make your experience with the Pixel smoother. Rambler is designed around transcribing naturally spoken thoughts, while HiLight provides information through the rear light without requiring you to turn the phone over.

Neither feature is enough to sell me a $1,099 phone outright. HiLight seems underwhelming for the most part, even if I prefer it over the niche sensor that I never used on the Pixel 10 Pro. But there’s a lot more solid groundwork here. Live Translation is an example, letting you dub supported audio and video into another language in real time using Tensor G6’s on-device models.

Gemini Intelligence is also getting smarter, with the system now anticipating more of your needs and working across information on the phone. Sure, a lot of these are features that will trickle down to older Pixels; still, it doesn’t take away from the fact that the Pixel experience here is the main deal. Individually, these are small features, but together, they make a genuinely good package.

Some compromises are still just compromises

Google having a different philosophy isn’t a checkmate against the rest of the industry–being different doesn’t automatically make you right. I’ve spent enough time using phones with 80W and 90W charging that my habits have changed around them. A few good minutes restore a meaningful amount of battery.

Meanwhile, the Pixel 11 Pro requires more planning. Battery life isn’t worth showing off either. Tensor G6 appears reasonably efficient, which only makes me wonder how good the smaller Pro could be with a little more capacity. Figuring out Google’s priorities helped me appreciate the phone, not blinding me to its issues. The software is there, but the hardware still has a little catching up to do.

Google isn’t playing the same game

People often miss the point of Pixels. Google honestly isn’t competing in terms of shipments with Apple or Samsung. The company is only moderately pushing to grow Pixel sales and mainstream appeal. It is mainly using the Pixel lineup as a hardware and AI showcase. Pixel Drops are also a big highlight, which offer the first access to the latest Android features (along with bug fixes).

So if you’re a competitive mobile gamer or a power user who needs a long-lasting and powerful phone, the Pixel is definitely not my first recommendation. Used to charging a phone in 20 minutes? Well, that is out of the question too. I wouldn’t try to convince you that you’re looking at the Pixel incorrectly; there are plenty of good options out there. Your only mistake would be assuming otherwise.