Researchers at the Singapore University of Technology and Design built a small robot that leaves a drone, spins on the way down, and keeps moving once it meets the water. They named it ALBATROSS, short for Airborne Lander with Buoyant AuToROtating Sailing Sensor. Lead author Shane Kyi Hla Win, working with professor Foong Shaohui, describes the machine in Science Robotics as a way to put sensors on a lake or a sheltered stretch of sea without sending a boat out to meet them.

A drone raises the one-kilogram prototype about 150 meters and then releases it. The inflexible wingsails attached to one side of the hull grab some air and begin spinning within a few seconds, much like a maple seed does on its journey to the earth. During tests on a reservoir, the craft settled into a very constant glide of around 7.4 meters per second, or roughly 26 kilometers per hour. According to Foong’s team, an identical hull without the spin would smack into the sea with nearly 18 and a half times the force, so the wings effectively negate the need for a parachute.

Sale

LEGO Icons Transformers: Soundwave – Building Set W/Sound Effects for Adults, 18+ – Model Kit W/Ravage…

• MODEL KIT FOR ADULTS – Relive 80s science fiction glory with the LEGO Icons Transformers: Soundwave (10358) building set for adults 18 years old and…
• AUTHENTIC TRANSFORMING ACTION – Build Soundwave with his rocket pod, laser blaster, and dart accessories, then transform him from robot and cassette…
• INTERACTIVE SOUND EFFECTS – Press Soundwave’s play button to activate specially recorded voice and sound effects that capture the character’s iconic…

The weight is responsible for landing the thing. A good heavy keel and ballast will turn the boat upright in approximately a second after it enters the water, and no power is required to flip it over. Once it floats, those same wings transform into sails. The main sail just turns freely with the help of a tail rudder, whilst a smaller front sail can alter angle to maintain the spin stable and catch any wind on the sea. To complete the task, only three actuators and three navigation sensors are required, which is quite small when compared to some air-and-water machines that require six to eight actuators.

Once it reaches that threshold, the wind takes over. Trials on Singapore’s Bedok and Pandan lakes revealed that a larger test version could reach a top speed of roughly a kilometer per hour and maintain that speed for nearly three hours while recording humidity, heat, and wind direction. Not bad given it only consumed almost half of its main battery. When the air lowers, a rudder shaped like a fish tail starts rotating and can provide the ship a moderate push forward at up to 0.4 meters per second, allowing it to make some headway when operating upwind.

Currently, the limit is relatively calm water. The design is primarily intended for still reservoirs and peaceful areas of coastline, and the team believes it would not last long in severe swell. Future versions are expected to be able to stay out for weeks, monitoring things like algal blooms, oil spills, trash, and the flow of heat between the sea and the air, and having a rapid release mechanism will come in useful if they need to conduct a search or inspect a remote beach. For now, though, it’s all about the sequence: one set of wings, one drop, one smooth landing, and a miniature boat that sails away on its own.

Felix at Billet Labs set out to park a real gaming PC in a living room and leave the fans off. A Ryzen 9 9800X3D and an RTX 5080 share a Gigabyte AORUS Pro B850 board, fed by a 600 watt Flex ATX supply, and the pair can pull well past 500 watts once a demanding game settles in. Air coolers handle that load by moving a lot of air. Moving a lot of air makes noise. An earlier attempt had hung the same idea on a cast iron radiator and ended near 100 kilograms, so this version started over on a hand-worked aluminum block that brings the finished machine down to about 15.7 kilograms once the loop holds roughly two liters of water.

The enormous black block on the floor is the case’s base, and 6 mm of thermal paste rests underneath the motherboard, while a big ol’ glob of paste is put under the power supply, allowing heat to be poured directly into the metal. Three radiators sit on top of the motherboard on brackets he built himself, with the paint stripped and the metal polished nicely: a large 200 x 400 mm unit at the bottom, followed by two smaller 140 and 120 class radiators laid flat so warm air can rise naturally through the fins. He closed the loop by soldering old copper piping from the home to brass fittings. A separate length of pipe capped at one end serves as a reservoir and feeds the pump. The pressure and temperature gauges are right up front. Motherboard fans are actually disabled in the bios, therefore they do not turn on. The thermal paste on the supply base is only there to keep the fan from spinning up (which it probably shouldn’t anyhow).

Sale

msi Cyborg 17 17.3″ FHD 144Hz Gaming Laptop: Intel Core 7-240H, NVIDIA Geforce RTX 5060, 16GB DDR5, 1TB…

• Thin & Light 17.3” Gaming Powerhouse: Experience big-screen immersion in a surprisingly portable design—just 0.83 in thin and 5.5 lbs—making it…
• Powered by Intel Core 7-240H for Smooth, Responsive Play: The latest Intel Core 7-240H delivers fast hybrid-architecture performance so games load…
• RTX 5060 Graphics for Next-Gen Gameplay & AI-Boosted Performance: Unlock advanced gaming with NVIDIA GeForce RTX 5060, featuring real-time ray…

The first few runs were relatively smooth, but then things became a little wacky. Even when idle, the water in the loop was exactly 28 degrees Celsius. A simple game barely put a dent in it. Cinebench, on the other hand, raised the temperature of the water to around 39.5 degrees Celsius, with processor cores reaching the low 90s. Halo remained playable, however. Cyberpunk 2077, on the other hand, raised the water temperature to 55.5 degrees, and by the end, the processor was approaching 95 degrees as the power draw dropped from 110 to 100 watts. A combined stress test eventually drove the water up to 56 to 60 degrees, just shy of the pump’s capacity.

As the water heated up further, he began to notice some cavitation. The small radiators were having problems allowing air to rise beyond the dense fins, so heat was simply creeping past them rather than through. The flow order was also contributing to the problem, because the warmest water was not being directed to the top radiator first. The pressure gage was loud enough to be heard across the room, and he had nearly punctured a radiator with a screw while assembling the entire thing. That is a very good technique to melt copper pipe, though; simply pass a long, hot torch over it, and the copper absorbs all of the heat.

One 120mm Noctua fan, a small black one that blends well with the metal background, sits neatly between the two smaller radiators and draws air through the fins to provide airflow that would ordinarily be insufficient to clear them. The gage is removed, and with it, the ticking sounds. The idle water temperature drops to 22 degrees. When you run cinebench, the coolant temperature maintains at 25 degrees, the cores are in the upper 70s with a brief peak of 82, and the processor is still only drawing 129 watts without needing to be cooled.

A full stress test that had been approaching 60 degrees finally settles at around 40, a full 20 degrees cooler, while the graphics card max out at 61. In ordinary games, the fan runs at a low speed and is almost inaudible, since it is quieter than the old gage even when it spins up slightly. The aluminum block already effectively cools the board and card, so all that was required was a single fan between the smaller radiators to complete the loop.

You can get by with a completely silent loop that can idle and handle some light gaming, but if you try to run a 9800X3D and a 5080 through a long gaming session, the water temperature will start to rise into the 50s and the processor will begin to fail. One quiet fan, directed at the radiators that were seriously impeding airflow, transformed the entire copper and aluminum configuration into a living room PC that looks good on a shelf and can even finish a session without crashing.
[Source]

Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousands of phishing emails.

In a Sunday statement, the company said an employee’s Google Workspace account was accessed in late July, exposing the personal information of employees and business partners.

Nikkei changed the account’s password after discovering the breach in early August, following a notification from Google.

While this incident may have exposed the names and email addresses of 1,646 individuals, Nikkei says the affected data doesn’t include information about readers or interviewees.

More recently, threat actors accessed another employee’s Microsoft 365 account in September and used it to send 9,000 phishing emails targeting Nikkei staff and interviewees.

“On September 30th , emails containing links to malicious websites were sent to internal staff and to interviewees with whom several employees had been in contact,” the media giant said. “Our company has changed its passwords, and no unauthorized logins have been confirmed since then. We have contacted the recipients individually and requested that they delete the emails.”

The company also warned affected individuals to watch for suspicious emails that may impersonate Nikkei or its subsidiaries in new phishing attacks.

Nikkei has yet to attribute the attacks to a specific threat actor or hacking group and hasn’t shared whether the two incidents are connected.

These are the latest in a string of security incidents Nikkei has disclosed in recent years. Last year, the company also revealed that its Slack messaging platform had been breached, affecting more than 17,000 employees and business partners.

In May 2022, Nikkei’s Singapore subsidiary was hit by a ransomware attack that affected a server “likely” containing customer data. Three years earlier, in late September 2019, Nikkei lost approximately $29 million in a business email compromise (BEC) attack that targeted a Nikkei America employee.

Nikkei owns the Financial Times and The Nikkei, the world’s largest financial newspaper, and is one of the world’s largest media corporations.

It controls more than 40 affiliated companies involved in publishing, broadcasting, events, database services, and the index business, has 37 foreign editorial bureaus and over 1,500 journalists worldwide, and has over 3.7 million digital paid subscriptions.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Lucid Motors built 2,954 electric vehicles (EVs) in the third quarter of this year, a 54% drop from a year ago, as the company purposely limits production to better meet demand for its EVs.

This was the third straight quarter in which the number of EVs Lucid built has declined. It’s also the lowest quarterly output since the first quarter of 2025, which was just after Lucid Motors started production of its second EV, the Gravity SUV.

Lucid delivered 3,806 EVs in the third quarter, roughly flat with the second quarter and down about 200 vehicles from the third quarter of 2025. The company has struggled to find buyers for either of its first two luxury EVs. In five of the last six quarters, it built more vehicles than it delivered.

Lucid’s new CEO, Silvio Napoli, has spent the last few months leading an effort to “simplify the company.” That effort has included laying off around 1,500 employees, streamlining the company’s leadership, and eliminating a second shift at its factory in Arizona in a bid to reach cost savings of $1.4 billion. Lucid also delayed the release of its third EV, the Cosmos. That model is supposed to be much cheaper, starting at under $50,000.

The third-quarter figures, released Monday afternoon, come just a few days after rival EV upstart Rivian posted its best quarter in history on the back of the R2, its new, more affordable SUV. Although Rivian didn’t break out specific delivery figures for the R2, the company shipped nearly 20,000 vehicles in the third quarter, the first full quarter with the R2 in production, up from 12,194 in the second quarter.

Lucid’s failure to find a large market of buyers for its EVs is even more stark when compared with the promises the company made when it went public in 2021. That year, Lucid Motors merged with a special purpose acquisition company and estimated it would ship as many as 90,000 EVs in 2024 alone. The company raised $4 billion in the transaction.

On Lucid’s second-quarter earnings call in August, Napoli spoke about why he thinks the company has failed to make a dent in the EV market.

“While there is no question that Lucid brought leading innovations and outstanding products to the market, we have disappointed on several fronts, and for far too long,” he said. “We have not executed consistently. We missed commitments, launched products before they were ready, underinvested in service, responded too slowly to quality issues, and allowed complexity to slow decisions down.”

The Cosmos’ lower price could, in theory, let Lucid access a wider market, but Napoli cautioned shareholders that rushing the new EV out could create more trouble.

“We will not repeat the mistakes of the past by bringing a product to market before it is ready,” Napoli said on the call.

The gap between Mac and PC is finally closing, but be careful before you pick a Mac as your primary gaming platform.

What a MacBook can and can’t handle

Filipe Espósito for Engadget

Which MacBook to buy, and when to look elsewhere

Filipe Espósito for Engadget

Security teams at Google, JPMorgan Chase, Weaviate, France’s interministerial digital directorate (DINUM) and the city government of Tangerang in Indonesia have each fixed the same type of flaw in their Model Context Protocol (MCP) servers. Independent researcher Syed Anas Mohiuddin reported all five, he wrote in an update published this month.

MCP is the standard AI agents use to call tools and data sources. The flaw is server-side request forgery (SSRF). An MCP server takes a URL, path or endpoint from an agent and builds an outbound request from it, without checking where the address actually resolves. That lets whoever steers the agent decide what the server talks to, including internal systems.

In May, Mohiuddin argued that the problem was structural. If it was, he predicted, teams that share no code or owner would all produce it.

“Watching the same mistake come back from a hyperscaler, a bank, and a national government, one report at a time, is the moment the May argument stopped being a guess,” Mohiuddin wrote.

Five fixes

Google’s MCP Toolbox for Databases had an HTTP client with no restrictive redirect policy and no check on target IP addresses, according to the GitHub advisory. A crafted path parameter could send its requests to internal or external endpoints. The flaw, CVE-2026-14540, carries a high rating of 8.0 and affects versions 0.3.0 to 1.4.0. Google’s fix adds a guard against DNS rebinding and lists of allowed and blocked IP ranges, and credits Mohiuddin.

JPMorgan’s open-source repository includes a documentation-search MCP server with two tools that fetch content. One checked domains against an allowlist. Its sibling fetched any URL the caller supplied, Mohiuddin wrote. JPMorgan forked the component from an AWS project that never fetched the caller’s URL at all. JPMorgan’s Responsible Disclosure team confirmed the finding and deployed a fix, he wrote. The finding is medium severity, he wrote.

Weaviate restricted its Google module’s endpoint settings to Google API hosts, he wrote. DINUM’s official MCP server for France’s open-data platform fetched URLs supplied by data producers, which could point at internal or cloud metadata addresses. Its fix, titled “harden SSRF on external APIs”, opens with “Reported by Syed Anas Mohiuddin”.

In Tangerang’s Wazuh MCP server, a tool advertised SSRF protection but only rejected literal IP addresses, according to a high-severity advisory published on 3 September. It never resolved hostnames.

Rapid7 fixed a different bug he found, CVE-2026-97228, in its Bulk Export MCP server. The bug allowed GraphQL injection within the operator’s own access, and Rapid7 rates it low, at 2.7, its database entry says.

Still open

On 2 September, Mohiuddin privately reported issues in five MCP servers under the US General Services Administration’s Technology Transformation Services. They include servers for Veterans Affairs benefits claims, CMS Blue Button, regulations.gov, USASpending and CDC PLACES. All five are still in triage and not fixed, he wrote.

In the Veterans Affairs case, the server logs full error responses from the benefits API without redaction, according to Mohiuddin. Those can contain a veteran’s name, Social Security number, date of birth and address. He is withholding code-level detail until maintainers patch the servers. His report on Japan’s Digital Agency grants server, which had no authentication, also remains open.

‘Protocol pivoting’

Mohiuddin calls the wider attack class “protocol pivoting”. An attacker plants text in content an MCP tool returns, shaped like a task for Google’s A2A protocol. An orchestrating agent passes it to a subagent, which runs it because it trusts the orchestrator.

“Every piece in that chain did exactly what it was designed to do, which is what makes this so tricky to catch,” Douglas McKee, Rapid7’s director of vulnerability intelligence, told Ars Technica.

Markus Vervier of X41 D-Sec told Ars that the technique is a form of indirect prompt injection. Mohiuddin will present the findings at MCPCon North America in San Jose on 23 October.

This year, the United States hit a milestone nobody asked for: more measles cases than any year since 1991, six decades after a vaccine was first developed. Fear and misinformation convinced families to walk away from settled science. Children paid the price.

I bring this up not to talk about vaccines, but to talk about literacy.

On July 15, Lynn Vasquez of the New Mexico Public Education Department met with lawmakers alongside Mark Angel, CEO of Amira Learning, to defend the use of the company’s AI-powered literacy screener in public schools across the state. New Mexico has been under a court order since 2018 to improve outcomes for its most underserved students, and officials turned to Amira in 2025 to help improve reading proficiency.

The software lets teachers “listen” to 5- and 6-year-olds as they read aloud, catching the hesitations, substitutions and decoding errors that reveal struggle but are easy to miss. It allows educators to intervene early and more accurately, delivering on the promise of the science of reading. The state initially required districts to administer the Amira Reading Assessment to K-2 students at the beginning, middle and end of the school year.

Meanwhile, parents in cities including Santa Fe and Albuquerque have organized in opposition to the tool, urging their districts to opt out of participation – an option now available across the state. Their objection isn’t with reading assessments, but with data privacy fears and a growing discomfort with anything called AI.

In September, that argument stopped being local. New York City, the largest school system in the country, announced a one-year moratorium on student-facing generative AI for roughly 600,000 students in 2-K through eighth grade. Days later, Los Angeles pulled generative AI from every student’s district device. Both policies target generative tools like chatbots. Amira isn’t one of them: it listens to a child read aloud and flags where they stumble. But once “AI” becomes the enemy, a reading screener lands in the same bucket as ChatGPT. 

Whatever you think of these policies, the reasoning coming out of New York and Los Angeles will be quoted in state capitals for the next year, New Mexico’s included.

The same machinery turns in both stories: settled science on one side, fear and misinformation on the other, children holding the bill. I have seen this movie. I know how it ends, and who pays.

I spent 15 years as a Google executive championing classroom technology, and I’ve been called a techno-optimist more than once. Most education technology has not earned your trust: schools have been sold engagement dressed up as learning, apps that babysit rather than teach.

Classroom technology demands skepticism that sorts products without evidence from the rare ones with it. Yet when skepticism stops sorting and starts banning, it becomes panic. Fear in education carries real costs. In New Mexico, it is tallied in third graders who can’t read.

Politics have derailed settled reading science before. In 2000, the National Reading Panel reviewed the research and found that children learn to read best with explicit, systematic instruction in phonics and phonemic awareness. Washington funded that science through Reading First, then killed the program after the Education Department’s inspector general found officials had steered schools toward favored products. Emily Hanford’s 2022 podcast, “Sold a Story,” forced a reckoning. As of November 2024, more than 40 states have passed science of reading laws.

A Costly Experiment

New Mexico cannot afford to run the same experiment. The state’s fourth graders post the lowest reading scores in the nation. According to a study commissioned by the Annie E. Casey Foundation, children not reading on grade level by the end of third grade are four times more likely to drop out of high school. In New Mexico, that’s not a statistic. It’s a pipeline, and everybody knows which kids are in it.

The state’s own numbers show the technology is working. In July, the NMPED shared a report with lawmakers that revealed the impact of Amira during the previous school year. The screener flagged 16.7% of first graders, roughly one in six, as showing signs of dyslexia, in line with national estimates. Under the previous computer-based screener, the figure reached 45%. Nearly half the state’s six-year-olds carried a label they didn’t deserve, often because their first language wasn’t English, and the old test couldn’t tell the difference.

Fewer false positives means intervention dollars reach children who actually need them: a machine enabling judgment, not replacing it.

Of course, critics raise legitimate questions. Thirty-five New Mexico lawmakers sent a letter to the state’s education department wanting to know what happens to children’s voice recordings. Los Alamos and Santa Fe paused the screener over parent concerns that Amira was training its products with the recordings for commercial use. 

Any parent can fairly ask about data privacy or whether the tool struggles with kids who have accents or speech differences – and how that’s being addressed. AI speech-recognition tools sometimes fail to accurately assess speakers who have accent or speech differences because they were not specifically trained to recognize different accents. Those challenges deserve vendor testing and public answers, not a shrug.

But I was that kid. I grew up in Hell’s Kitchen, raised on welfare by a single mother from Argentina. English was something I assembled at school, piece by piece. The analog status quo sorted kids like me quietly, by teacher impression, by gut feel: no audit trail, no accuracy study and no appeals process.

Human judgment has biases, too, but you can measure a machine’s error rate and fix it. You cannot audit a hunch. If the tool mislabels children with accents, prove it and demand the fix. That’s governance; pulling the tool just hides the bias where nobody can see it.

Uneven Stakes

The stakes are not evenly distributed. Some families organizing opt-outs may have the books, tutors and confidence to work the system. The children that New Mexico is failing have a screener, and may have nothing else. A kindergartner cannot opt herself back in at 16, when the problem nobody caught becomes a life problem everybody can see.

By all means, govern. Write the rules of procurement. Tell parents in plain language what gets recorded, how long it’s kept and who can use it. Demand the data of the software’s accuracy and throw out every product that can’t produce it.

Albuquerque shows what that could look like. This school year, the district kept the screener, communicated with parents about the rationale for voice recordings and opted to store recordings for a shorter time period.

Every state is now going to be asked whether it wants what New York and Los Angeles want. New Mexico’s problem is not AI. It’s that most of its children aren’t reading proficiently. Solve that one first. 

Jaime Casap spent 15 years as Chief Education Evangelist at Google, advising school systems and education leaders on classroom innovation and technology policy. Raised by a single mother in Hell’s Kitchen, he is the co-author of “Our First Talk About Poverty.”

On Friday morning, Shivon Zilis, a top executive and lieutenant of Elon Musk at his brain chip implant company Neuralink—as well as mother of four of the 14 children he is known to have fathered—took to his social media platform, X, to announce an abrupt shift in their relationship.

“It’s hard to go from in love to let go in a week with no warning, but that’s just how it is sometimes,” Zilis wrote, sharing a screenshot of the X account @BigTechAlert that showed Musk had unfollowed her there. Zilis’ post continued: “I feel happy that I got to show Elon how it feels to be deeply understood, nurtured, and peacefully loved with stability and gentleness,” followed by warm praise and best wishes for Musk. “I do hope and pray he and I can be great friends and coparents,” Zilis concluded, leaving some ambiguity as to what exactly changed between them and whether she remains a director of operations and special projects at Neuralink, though it does not appear as if she has left the position.

While this was a strange revelation of a private matter, it seemed hardly out of the ordinary for Musk’s dizzyingly complicated family life. At this point, all four of the women confirmed to have had children with him—Zilis, ex-wife Justine Wilson, Claire Boucher (better known as Grimes), and Ashley St. Clair—have used X to share details of their time with him or push back against his own claims.

Both Wilson and St. Clair participated in filmmaker Alex Gibney’s sprawling new documentary Musk, in theaters nationwide on October 16 and screening at the WIRED World Fair in Miami next month. St. Clair, a former conservative influencer, alleges that she rejected a nondisclosure agreement worth $40 million that would have prevented her from talking about her tumultuous association with Musk. Among an ensemble of tech entrepreneurs, journalists, and former Musk employees, the pair stand out as arguably the most important critical voices in the film, shedding light on Musk’s rise in Silicon Valley as well as his turn toward MAGA extremism during the 2024 election.

At a run time of nearly four hours, Musk sounds like daunting viewing, though once it’s over, you’ll find yourself wondering if it could’ve been a 10-part miniseries. That’s how much ground there is to cover, from the unrealistic ambitions of landing on Mars and the corporate colonization of Texas to the fatal collisions involving “self-driving” Teslas and the annihilation of the US Agency for International Development by the so-called Department of Government Efficiency (DOGE) at the beginning of Trump’s second term. (WIRED’s reporting is cited in the documentary, which features interviews with global editorial director Katie Drummond and contributing editor Zoë Schiffer.)

Alongside a fast-moving, comprehensive account of Musk’s career as an all-powerful and untouchable oligarch, his former romantic partners provide crucial context about exactly who he is, piecing together a devastating portrait of the type of man to “let go” of a significant other by unfollowing her on social media.