[Angus] of Maker’s Muse enjoys combat robotics, in which contenders zip about in an arena, attempting to disable one another with weapons that lift, spin, and smash. He got a funny idea a short while ago and wondered whether a stiff mane of bristles could serve as lightweight, ablative, impact resistant armor?

Just to set the stage, [Angus]’s new robot competes in the plastic antweight (or “plant”) division, in which robots are limited to 150 grams with both chassis and weapons made of plastic. In such circumstances, one can see how a mane of thick, rigid “hairs” might actually punch above its weight, so to speak.

Nothing settles a question like a good experiment, so [Angus] sat down and redesigned his latest robot to replace its outer shell with a thick wad of bristles, in the style of a 3D printed lion’s mane. Filament is bridged between the model and an outer support structure, which is cut away afterwards to expose the “hairs”.

How well did it perform? Well enough to merit further study! Where past robots got their outer shells broken up, the hairy robot seems to have come through quite intact. It seems the idea might not be as silly as it first seemed, at least in the plastic antweight division.

3D printers have been fantastic in the field of combat robotics. First they were great because they made custom parts easier and more accessible to hobbyists, but things have evolved more since then. Now folks compete by putting motors and electronics inside almost entirely 3D printed robots. There’s never been a better time to get into combat robotics, and experiment with unorthodox designs.

If you want to try a hairy robot for yourself, be sure to watch the followup in which [Angus] improves the hair-generating process considerably.

Big quote: Cloudflare CEO Matthew Prince says the PHP flaws that forced websites offline last week are only the beginning. His company already knows of other severe vulnerabilities in critical software, and he expects AI tools to keep turning up new ones for years. Because these models have sharply cut the time and skill needed to find and exploit serious bugs, defenders and everyday users face a long stretch of disruption before the internet’s core software ends up safer.

Prince told Reuters that Cloudflare is aware of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software,” though he did not name the affected programs. He compared them to the PHP bugs that recently forced government websites, the game store GOG, and many smaller websites offline while their operators rushed to patch.

By some estimates, PHP runs on about 70% of the world’s websites, a reach that made the flaws a potential entry point into some of the internet’s most visited destinations. TechSpot has always run on PHP, for example, and we had to update our servers that same morning out of caution. We imagine something similar happened to Wikipedia, Microsoft.com and the countless sites based on WordPress, that were all affected.

Prince expects this to keep happening. “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” he said.

He blames large language models. Security researchers and criminals alike are using them to comb through the internet’s core software for weaknesses no one has found before. Until recently, the pace of that work depended on how many skilled people had the time and patience to read through complex code. Attackers faced the same limit when trying to turn a flaw into a working exploit.

– Matthew Prince 🌥 (@eastdakota) October 24, 2026

That limit matters much less now. A single person can point a fleet of LLM agents at a codebase, and those agents can produce in hours what used to take specialists weeks.

Wiz Research, one of the teams that found the PHP flaws with help from LLM tools, described the change in its technical write-up. “Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” the firm wrote. “As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice.”

That runs counter to a long-held assumption in security: code that was hard to understand was partly protected because few people could take it apart. When models do that work, obscure, complicated code becomes as accessible as simple code.

The Electronic Frontier Foundation has put numbers on how fast this is moving. It says 3% of all software vulnerabilities ever recorded were found in October alone, and that nearly a quarter of all known security issues were discovered this year. The EFF credits frontier AI models from OpenAI, Anthropic and others with making zero-day discovery cheap in both open-source and proprietary code.

According to the EFF, several vulnerabilities serious enough to potentially break large parts of the internet were reported and patched in the last two weeks of October, many of them in the open-source software that most of the internet runs on.

According to the EFF, several vulnerabilities serious enough to potentially break large parts of the internet were reported and patched in the last two weeks of October, many of them in the open-source software that most of the internet runs on. Engineers have long accepted that widely used programs have bugs, and that more complex programs have more. What kept things manageable was the cost of finding them. Major flaws capable of disrupting the whole internet used to surface every few years, while smaller fixes happened steadily in the background.

Both Prince and the EFF expect conditions to get worse before they improve. The EFF says more systems will be breached more often, data breaches will become more likely, and some services may go down as attacks increase.

Some timely humor from our weekly newsletter’s gallery (reposted on FB/IG):

The group’s advice mostly comes down to basic security habits: it recommends keeping browsers and all applications fully updated, using a password manager with a different password for every site so one breach doesn’t expose other accounts, installing a tracker blocker such as its Privacy Badger extension, and watching out for phishing. Anyone running a blog or website should confirm that they or their hosting provider has applied the PHP fix.

The EFF is also encouraging a wider discussion of the underlying problems, including how companies that rely on open-source code should help maintain it and how large technology firms should be regulated.

Prince expects the problem to ease eventually. Every flaw that models find and developers fix leaves the software safer than before. “The reality is, we’re going to get a lot of this stuff cleaned up,” he said. The open question is how much damage happens before then.

Cutting corners: Plenty of people keep a big chunk of their lives stored in Gmail and Google Photos, from flight bookings and receipts to years of family pictures. For years, Google has said none of that content would be used to pick the ads they see. That promise now comes with an exception – and it applies to anyone who lets the company’s AI dig through those apps.

The change sits in Google’s updated privacy policy, which took effect on October 16 and was first spotted by Android Authority. The policy has long said, “We don’t show you personalized ads based on your content from Drive, Gmail, or Photos.” That line is still there, but it now ends with a qualifier: “unless you choose to make data from these services available to other Google services that support personalized ads.”

A separate new passage says Search may process the data people let it access to personalize content, including ads.

The exception mostly concerns Personal Intelligence, an opt-in feature that lets Gemini and AI Mode in Search pull context from apps like Gmail and Photos. It launched for paying subscribers in January before reaching all US users in March. So if someone asks AI Mode for things to do on an upcoming trip, it can check their hotel confirmation in Gmail and old vacation pictures before answering.

While the search giant says ads won’t be based directly on someone’s Gmail inbox or Photos library, its support page explains that AI Mode may draw on summaries, excerpts, and inferences from connected apps, and that this same information may be used to show ads. Advertisers still can’t access those apps, though, and sensitive categories like health, religion, and sexual orientation remain off-limits for ad targeting.

The company has also started testing ads in AI Mode for people with Personal Intelligence switched on. Back in March, it said that experience would stay ad-free for now, though it expected ads to work similarly for connected users down the line.

Gmail ads once worked quite differently. Google scanned free accounts to target them – a practice that drew lawsuits and steady criticism from privacy advocates. The company only stopped scanning inboxes for ad personalization in 2017, and Gmail kept showing ads targeted with other data like search and YouTube activity.

The new wording appears to be the first time since then that Google’s own policy has allowed inbox content to play a part in ads, even if only indirectly.

Thankfully, there’s still a way out. If you’d rather keep your inbox out of it, you can disconnect Gmail and Google Photos under Connected Content Apps, which can be found in your Google Account’s Search Services Personalization settings.

Another option is turning off ad personalization in My Ad Center, though it doesn’t necessarily stop connected apps from feeding the AI features.

Twenty five years after Halo Combat Evolved redefined console shooters on the original Xbox, a fan project has moved its multiplayer suite onto the Nintendo 64. Halo 64, created by Jack Tulli and available on GitHub, runs the original game’s objects, physics, collision detection, weapons, game types, HUD and pathfinding on the N64’s VR4300 processor. Maps come from a player’s own Xbox disc image. A new renderer, menu system, HUD drawing and sound layer sit on top of libdragon and tiny3d.

The end result is a local multiplayer extravaganza in which you can compete with pals in split screen mode, one to four players at a time. You’ll be able to play on all thirteen of the original multiplayer maps, including Prisoner, Hang ’em High, Chill Out, Derelict, Boarding Action, Blood Gulch, Wizard, Chiron TL-34, Longest, and the thrilling Damnation and frenetic Rat Race. Don’t worry about the game modes; vehicles, guns, teleporters, and water features all accompany the journey. You can play Slayer, Team Slayer, Slayer Pro, Capture the Flag, King of the Hill, Oddball, and even Race, with each accessible in free-for-all or team modes.

A bunch of bots will fill the empty spaces, and up to fifteen AI opponents can join in on the fun, as long as Halo does not reach its sixteen-player limit. You can select the difficulty level, ranging from lovely and easy to super-hard legendary. Get this: the bots employ the same pathfinding as the original game. They focus on the more powerful weapons and fight in groups. Each match, they select a random character name from a list of roughly three hundred very unusual names selected from Mario, Zelda, GoldenEye, and Rare’s N64 libraries. After eight bots, it becomes a little unwieldy, and the menu cautions you that your console may suffer slightly.

The Firefight mode now allows you and a few friends (up to four players) to take on waves of Grunts, Jackals, and Elites on multiplayer maps while sharing lives and selecting from four distinct difficulty settings. A pause menu allows you to stop the action, view the scoreboard for everyone (including the AI), and even access the original Halo HUD, which includes shields, health, ammunition, a motion sensor, messages, and scores. The traditional sounds from the original game have returned, including weapon and vehicle noises. Yeah, the main menu looks a little rough with its interlaced 640×480 image on that familiar ring-in-space backdrop, but it now proudly displays a Halo 64 logo.

When it comes to controller layouts, you’re in luck, as there are six to pick from, including regular, GoldenEye, D-pad movement, and even bumper jumper. Want to crouch? You can either turn it on or keep it held down. Other customization options include changing the look inversion, swapping the fire and grenade buttons, and even enabling independent look speeds for the analog stick and C buttons. Oh, there’s also rumble feedback. You may enable it for shots, hits, explosions, and vehicles, with a toggle to turn it off or on for each player. Picture quality and performance settings are saved directly to the cartridge’s EEPROM.

The game’s graphics use a color map method to load neighboring tiles from the cartridge, giving the ground textures far more clarity than a simple low-poly approach. Plus, Blood Gulch retains its beautiful blue sky. If you’re concerned about performance, don’t be, because the game allows you to trade off graphic detail for frame rate when more players or bots join in the fun.

From discovering new books and organizing your reading list to tracking your reading goal and sharing recommendations, book apps make it easier to maintain reading as a hobby. There are numerous apps on the market that promise to do just that, so we’ve compiled a list of some of the best ones to help you pick the right one for you. Whether you’re an occasional reader or a dedicated bookworm, these apps can help you make the most of your reading journey.

Some of the apps on this list are somewhat new, while others have been around for a few years. Amazon-owned Goodreads, which is arguably the most popular book-related app, isn’t included in this list because we’re focusing on newer, lesser-known platforms. 

Fable

Fable is a reading app that combines book tracking with a social platform. It lets you organize reading lists, set reading goals, track streaks, write reviews, and join virtual book clubs. You also get personalized book recommendations and the chance to discuss what you’re reading with other readers. 

The app differs from others on this list because it puts reading and community at the forefront of the platform, which makes it a great option for people who like staying motivated to read by being part of a community and discussing their reads. 

Fable is free to download on iOS and Android, but also offers a Fable Plus subscription tier that unlocks additional features like custom goals and advanced analytics for a monthly fee of $5.99.

Bookshelf

Bookshelf is a reading app designed to help people organize their libraries, discover new books, and remember more of what they read. The app positions itself as an alternative to Goodreads, and combines traditional reading logs with AI-powered recommendations and tools.

You can create custom shelves, set reading goals, receive reminders, save favorite quotes, and access AI-generated book summaries, key insights, and thematic analyses to recall the books you’ve read and get a deeper understanding of them. 

Bookshelf is free to download on iOS, but offers a $6.99 monthly fee to unlock premium features like unlimited collections and enhanced analytics. 

Pagebound

Pagebound is a book app that lets readers track their books, create lists, set goals, and discuss individual titles in dedicated forums. Instead of having to join an actual book club group, users can post reactions and thoughts to connect with others reading the same title.

You don’t have to worry about spoilers for the end of the book, as conversations are organized based on reading progress, allowing readers to share theories and thoughts as they read. The app is a great option for people who want to discuss their reads with others without having to commit to a scheduled book club.

Pagebound is free to download on iOS and Android and offers a $9.99 monthly subscription for added features like profile customization.

StoryGraph

StoryGraph is a reading app that lets users track their reading, discover new books, and access detailed reading statistics and personalized recommendations. Users can set reading goals, join reading challenges, and find new titles based on their preferred moods, themes, genres, and pacing.

The app is ideal for readers who want to better understand their reading habits and discover books that match their current interests. Its recommendation system doesn’t solely rely on what’s popular or trending, and instead caters to exactly what readers are looking for. 

StoryGraph is free to use on iOS and Android, but also offers a paid subscription called StoryGraph Plus that costs $4.99 per month and unlocks custom charts, additional statistics, and more. 

Margins

Margins is a great option for mood readers, as it offers mood-based discovery alongside a more focused reading experience. It helps users find their next read based on how they feel in the moment by searching for specific vibes, such as “books like 1920s Paris.” Users can also track their reading goals.

The app also lets users customize their virtual library by choosing book covers that match their aesthetic and organizing their shelves in different ways, including by color. For users who enjoy a more immersive experience, Margins offers a built-in “Reading Time” meditation timer that blocks social media apps.

Margins is free to download on iOS and Android.

Quordle was one of the original Wordle alternatives and is still going strong now more than 1,500 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today — or scroll down further for the answers.

Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc’s Wordle today column covers the original viral word game.

Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.

The hijacking began in late August, when, according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago.

Mysteries remain

Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn’t find among Switzerland2’s authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.

Ultimately, 333 exit relays were involved in the SSH and email interception campaign, although investigators haven’t established how the attackers gained control of all the underlying servers. The attackers then reconfigured the servers. One set of changes redirected SSH traffic traversing Tor to one of 12 attacker-controlled interceptor servers. Tor users who ignored warnings that the SSH host key had changed would then enter their SSH passwords.

A second set of changes caused the exit nodes to block ports 25, 465, 587, 993, and 995—used to accept various forms of encrypted email—while continuing to allow ports for receiving unencrypted email. If email services downgraded the connections, the attackers used their access to the exit nodes to obtain unencrypted messages. It’s unclear whether any such downgrade attempts succeeded. The hijacking occurred from October 2 to October 5.

Tor volunteers partially outlined the initial compromise of the management server and Switzerland2 and the attempt to intercept unencrypted email. Tuesday’s report revealed many new details, including how many exit nodes were compromised and how the attackers used them to redirect SSH traffic.

“If you happen to get a circuit that exits over one of those 333 infected exit nodes, you won’t notice anything at first,” Kaba, the name of the Tor volunteer who authored the post, wrote. “Encrypted web traffic is forwarded as usual, but if you attempt an SSH connection over Port 22, you’re unknowingly redirected to one of 12 SSH interception servers. That’s exactly what happened to me on Friday morning.” Kaba then received the following warning:

• The kit adapts Apple’s 2019 Mac Pro case for standard PC parts
• Buyers must source the motherboard, processor, graphics card, memory, and power supply
• The original fans and front controls can remain in service

An enthusiast is seeking crowdfunding support for a conversion system that would let owners reuse Apple‘s 2019 Mac Pro enclosure with conventional desktop PC components.

The proposed kit accommodates standard motherboards, power supplies and graphics cards while retaining the aluminium chassis, original cooling fans and front controls.