Letterboxd has surged in popularity in recent years. Once a niche site for only the most fervent of film nerds, the site — which allows users to rate, review, and recommend movies to one another — has continued to add accounts by the tens of millions, thanks largely to interest from millennials and Gen Z. Now, the company’s controlling investor has apparently made it known that they are looking to cash out.

Semafor reported Sunday that Canadian holding company Tiny, which owns some 60% of Letterboxd, has been courting various potential buyers, including Versant, the parent company of CNBC and MS NOW (formerly MSNBC). Another potential buyer is The Ankler, a popular Hollywood newsletter, according to Semafor. Tiny bought the platform in 2023, valuing it at over $50 million. It’s unclear whether the company has neared any sort of deal.

Representatives for Letterboxd and Tiny did not immediately provide comment when reached by TechCrunch.

Founded in 2011, Letterboxd saw a jump in users in the past few years, climbing to about 26 million users this year, up from 1.7 million in 2020, according to The New York Times. In recent years, the site has seen interest from movie studios, which see it both as a vehicle for marketing films and a source of information about moviegoer trends, as well as from the Oscars, which teamed up with the social platform in a digital content partnership several years ago.

Saros Consulting’s research found that ‘scope creep’ is a significant cause of stress for IT and technical teams.

IT consultancy Saros Consulting has published the results of a new study that explores the issues of stress and mental health among IT employees, as well as the factors that drive them.

In partnership with Censuswide, Saros Consulting collected data from 200 IT decision-makers working out of large, Ireland-based organisations. What was discovered is that three out of every five participating organisations have noticed “stress or mental health issues among IT workers due to intensifying delivery pressures”.  

Saros’s research suggests that as more organisations continue to embrace AI, the pressure to roll out new products and systems is creating a fraught working environment for IT and technical teams. Only 58pc of IT leaders admitted that their leadership team has realistic expectations of how AI can benefit them.

Great expectations

Legacy systems were found to be slowing down progress for IT workers, with 59pc of contributors noting that they are running too many, while 57pc explained legacy systems are holding back innovation in their company. 

‘Scope creep’ – that is, the continuous or uncontrolled expansion of a person’s work – was also identified as a major issue. Six in 10 participating large organisations reported scope creep as a contributing factor to stress among IT and technical teams, while 61pc also admitted that these teams are working long hours because of talent shortages.

Saros’s research did find, however, that there may be a financial benefit to workers around talent shortages, in that almost 60pc of organisations taking part in the study said they gave an IT or technical team member a 50pc pay increase to discourage them from leaving. According to the report, this underlines the lengths large organisations are willing to go to if it means retaining skilled IT talent.

Fill the gap

A recent report published by the Employment and Recruitment Federation, and supported by Icon Accounting, found that temporary and contract roles are having an impact on the wider working landscape. 

Their research found that while Ireland’s jobs market is holding steady, “employer confidence is becoming more measured, with temporary and contract roles now overtaking permanent recruitment in a clear sign of growing caution across the market”.

This change in workplace needs and expectations was also evident in Saros’s data, which found that in order to ease the burden, the outsourcing of IT work is being utilised. Almost one-quarter of IT decision-makers in large organisations said outsourced project management helps reduce stress among technical team members.

Commenting on the findings, Ray Armstrong, the co-founder and co-CEO of Saros Consulting, said, “Our research shows that organisations in Ireland are struggling to address the issue of mental health among IT teams and the leadership team themselves could even be compounding the issue.

“The source of the issue lies in organisations not having a proper IT strategy in place. This means not only coming up with a strategy that is doable, but also one that works in tandem with the business and its goals. Putting a proper plan in place can help to alleviate pressure, provide clarity and lead to happier, more fulfilled workers.”

Justin van der Spuy, also a co-founder and co-CEO of Saros, added, “The sharp rise in cyber threats, coupled with the AI boom and severe staff shortages, have meant that IT teams are under a lot of pressure, to a point where it is becoming too much.

“IT has become the backbone of every organisation; if it ceases to function healthily, then so does the rest of the organisation. IT leaders must look holistically at how they can support their teams. Pay rises alone can’t cure sleep deprivation.”

AI – and ensuring that organisations are fully prepared to embrace future skills and security needs – is an important topic for most organisations in 2026. 

In response, the Irish Government recently launched AIReady.ie, a new national AI skilling platform designed to provide people across Ireland with the means to learn essential AI skills.

Developed by Solas, in partnership with the National Skills Council, the programme will aim to teach the fundamentals of AI, with a curriculum designed to support people as they work to develop the in‑demand skills needed for work, study and everyday life.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Govee, a leading smart light maker, on Monday launched what could be the most interesting ceiling light we’ve seen. The Govee Ceiling Light Ultra turns your entire ceiling into a glowing array of light, complete with AI-generated scenes. 

The 21-inch disk-shaped overhead light is filled with over 600 ultradense LEDs, featuring a screen-grade matrix layout, allowing you to do some very cool things with this light. The launch video shows an artist taking a photo of their painting of the Mona Lisa and then sending it directly to the light for display. It’s not digital picture frame quality, but you get the idea. 

The light also casts a wide array of light around the ceiling, showing off the power of that many LEDs and making it easy to set the right mood. And while the colorful effects may be the show stealer, you can also have the light follow sunrise and sunset times and adjust in real time. This isn’t a new feature for smart lights, but it’ll likely have a greater impact here given how large and bright this ceiling light is.

Since it’s 2026, you can also expect a healthy serving of AI with the light. Owners can create a colorful lighting scene with an AI prompt. The Ceiling Light Ultra also comes with more than 100 lighting effects and music-sync modes, so you can set the vibe just the way you like it.

Govee makes some of the best smart lighting solutions around, but it’s far from the only player. Philips Hue lights are largely considered superior, but cost significantly more. The Govee Ceiling Light Ultra will run you $250, which, in the grand scheme of things, isn’t a terrible deal for what you get. Now, factor in that Philips Hue has no comparable type of lighting solution, and Govee might have a winner on its hands. 

You can buy the Ceiling Light Ultra from Govee direct or at Amazon, with a shipping estimate of May 2. 

A new wave of the Glassworm campaign is targeting the OpenVSX ecosystem with 73 “sleeper” extensions that turn malicious after an update.

Six of the extensions have been activated and deliver malware, while researchers assess with high confidence that the rest of them are dormant or at least suspicious.

When initially uploaded, the extensions are benign but deliver the payload at a later stage, revealing the attacker’s true intention.

“This count may change as new updates continue to appear, but the pattern is consistent with earlier GlassWorm waves,” say researchers at application security company Socket.

GlassWorm is an ongoing supply chain attack campaign first observed in October, initially using invisible Unicode characters to hide malicious code that steals cryptocurrency wallets and developer credentials.

It has since expanded across multiple ecosystems, including GitHub repositories, npm packages, and both the Visual Studio Code Marketplace and OpenVSX. They have also been observed to target macOS users with trojanized crypto wallet clients.

A recent wave in mid-March 2026 showed significant scale, affecting hundreds of repositories and dozens of extensions.

However, operations of such a scale can be noisy and leave multiple traces, as multiple distinct research teams caught the activity early and helped block it.

The latest wave suggests that the attacker’s intent is to change their strategy by submitting innocuous extensions to a single ecosystem and introducing the malicious payload in a subsequent update, rather than embedding it in the extensions.

Socket has found that the 73 extensions involved in the most recent GlassWorm campaign are clones of legitimate listings, designed to trick developers who do not pay much attention beyond visuals.

In one case, the attacker used the same icon as the legitimate extension, adopted a similar naming and description. Although there are subtle differences, the main indicators are the name of the publisher and the unique identifier.

Instead of carrying the malware, the extensions now act as thin loaders that fetch it via one of the following methods:

• The extension retrieves a secondary VSIX package from GitHub at runtime and installs it using CLI commands.
• The extensions load platform-specific compiled modules (.node files) that contain the core logic, including fetching additional payloads and executing installation routines across supported editors.
• Some variants rely entirely on heavily obfuscated JavaScript that decodes at runtime to fetch and install malicious extensions, sometimes including encrypted or fallback URLs for payload retrieval.

Socket did not provide technical details about the newest payload. Previously, these attacks were aimed at stealing cryptocurrency wallet data, credentials, access tokens, SSH keys, and developer environment data.

The cybersecurity company has published the full list of the 73 extensions believed to be part of the latest GlassWorm wave. Developers who installed any of them are recommended to rotate all secrets and clean their environment.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

The developers are urging all developers who installed version 0.23.3 to take the following steps immediately:

1. Check your installed version:

pip show elementary-data | grep Version

2. If the version is 0.23.3, uninstall it and replace it with the safe version:

pip uninstall elementary-data

Advertisement

pip install elementary-data==0.23.4

In your requirements and lockfiles, pin explicitly to elementary-data==0.23.4.

3. Delete your cache files to avoid any artifacts.

4. Check for the malware’s marker file on any machine where the CLI may have run: If this file is present, the payload executed on that machine.

Advertisement

macOS / Linux: /tmp/.trinny-security-update

Windows: %TEMP%\\.trinny-security-update

5. Rotate any credentials that were accessible from the environment where 0.23.3 ran – dbt profiles, warehouse credentials, cloud provider keys, API tokens, SSH keys, and the contents of any .env files. CI/CD runners are especially exposed because they typically have broad sets of secrets mounted at runtime.

6. Contact your security team to hunt for unauthorized usage of exposed credentials. The relevant IOCs are at the bottom of this post.

Advertisement

Over the past decade, supply-chain attacks on open source repositories have become increasingly common. In some cases, they have achieved a chain of compromises as the malicious package leads to breaches of users and, from there, breaches resulting from the compromise of the users’ environments.

HD Moore, a hacker with more than four decades of experience and the founder and CEO of runZero, said that user-developed repository workflows, such as GitHub actions, are notorious for hosting vulnerabilities.

It’s a “a major problem for open source projects with open repos,” he said. “It’s really hard to not accidentally create dangerous workflows that can be exploited by an attacker’s pull request.”

He said this package can be used to check for such vulnerabilities.

High-end audio brands have spent the past five years pushing deeper into the luxury car market, usually leaning on bigger speaker counts and brand-name partnerships. Dirac is taking a different route. In partnership with NIO, it has launched Dirac Spaces, a new software platform designed to model and reproduce the acoustic characteristics of real-world environments inside a vehicle. The system debuts in the NIO ES9 alongside the Lyra sound system, marking a shift toward software-defined acoustics rather than hardware-led upgrades.

From there, the through line becomes clearer. Dirac has been working this angle for a while. Its automotive push builds on earlier technologies like Reference Room Mode and Dirac Dimensions in the ES8, and traces back to the introduction of its Virtuo platform in 2022. The focus hasn’t changed: control the acoustics of the space, don’t just decorate it with DSP.

Some car audio systems still try to fake spaciousness by layering on reverb and calling it a day. Dirac’s approach is more precise. By modeling how sound reflects and decays in both the vehicle and a target environment, it uses the full speaker system to create a more coherent three-dimensional sound field.

Timing on this one was almost too convenient. The press release landed while I was out this morning driving the 2026 Mazda CX-50 Turbo and the 2026 Mazda CX-5 Premium—ended up ordering the CX-5. Both come with “premium” Bose systems. They’re competent, and the cabins are quiet enough, but spatial audio isn’t part of the equation.

Apple CarPlay integration matters more day-to-day anyway, especially in a house full of iPhones where Qobuz is non-negotiable and nobody else is touching the car stereo. But even in a well-insulated cabin, you can hear the limits. The sense of space is mostly surface-level.

That’s the gap Dirac is trying to close; less about adding features, more about fixing how sound actually behaves inside the car.

BMW also announced its first vehicle this week with Dolby Atmos, which is firmly in the “nice to hear about, not buying anytime soon” category — but it’s another sign of where this is headed in the luxury automobile segment.

Dirac Spaces and NIO Lyra: Software-Defined Acoustics Inside the Cabin

Working alongside the NIO Lyra sound system, Dirac is taking a system-level approach to in-car audio that goes beyond hardware tuning. The goal here is straightforward: control how sound behaves inside the cabin rather than simply pushing more of it through more speakers. That means combining the vehicle’s audio system, the physical space, and the source material into something that behaves in a more predictable and consistent way.

Dirac Spaces is the next step in that process. Instead of treating the car as a fixed listening environment, it uses acoustic modeling and real-time signal processing to reshape how sound is perceived inside the cabin. The system measures both the vehicle and a target acoustic space, then applies Dirac’s MIMO sound field control to approximate how that space would actually sound. The idea is not to layer on effects, but to replicate the acoustic behavior of different environments with a higher degree of accuracy than traditional DSP approaches.

“Today, cars are one of the most important listening environments, but they’ve traditionally been limited by the physical constraints of the cabin,” said Anders Storm. “With Dirac Spaces, we are redefining the in-car listening experience by recreating the acoustic signature of real-world environments inside the vehicle.”

Dirac is also giving automakers some flexibility in how this is deployed. “Signature Spaces” allows OEM partners like NIO to create branded environments tied to specific venues or experiences. “Designed Spaces” are Dirac’s own presets, based on measured real-world environments, with options like Balanced Room, Warm Stage, and Grand Hall that adjust both spatial cues and tonal balance.

The distinction from typical sound modes is important. This isn’t just reverb layered on top of the signal. Dirac Spaces maps how reflections and spatial cues should behave based on the car’s speaker layout and acoustic characteristics, which results in a more coherent sound field. In practice, that should translate into better depth, clearer imaging, and fewer of the phase and timing issues that tend to show up in complex cabin environments.

Implementation is also relatively clean. Dirac Spaces runs on top of an already optimized Dirac system, so it doesn’t require additional measurement beyond what’s used to tune the vehicle in the first place. It supports both stereo and multichannel content, which keeps things consistent regardless of source.

In the context of modern EV platforms, this is really about software. By integrating Dirac Spaces into vehicles like the ES9, NIO is using audio as another layer of differentiation—one that can be updated, refined, and potentially monetized over time without changing the underlying hardware.

“At NIO, we’re focused on creating a more immersive in-car experience that goes beyond traditional expectations,” said Ted Li. “With Dirac Spaces, the goal is to move the vehicle beyond a standard listening environment and closer to a space where sound behaves more like it would in the real world.”

Dirac will demonstrate Dirac Spaces publicly for the first time at Auto China 2026, running April 24 through May 3, in collaboration with NIO. The demonstrations will take place inside production vehicles, showing how the system adapts across different cabin designs and audio system configurations.

The Bottom Line

Dirac is attacking the real problem in car audio: the cabin itself. Dirac Spaces isn’t another sound mode—it’s an attempt to model and control how audio behaves in that space, which is a fundamentally different approach from the DSP presets and upmixing most systems rely on today.

North American availability is still an open question. With NIO as the launch partner and no U.S. presence, this rollout is likely tied to future OEM deals rather than anything immediate.

The rivalry is more complicated than a simple “they don’t need Dirac” narrative. NIO is leaning into Dirac as a core technology partner, while Tesla and Rivian continue to prioritize in-house control.

Meanwhile, Dirac is driving innovation. At CES 2025, Dirac and Denon showcased a prototype 22-speaker sound system in Tesla Model Y with height channels, headrest and headliner exciters, and Dirac’s spatial processing to create a far more coherent sound field than the stock system.

It wasn’t just louder or wider. It delivered noticeably better clarity, more stable imaging, and more natural bass response, while generating immersive spatial audio from standard stereo sources without relying on Atmos mixes. 

It also exposed the core difference in approach. Tesla’s system, like Rivian’s evolving in-house platform relies on upmixing and DSP layered on top of the cabin. Dirac’s approach focuses on getting all the speakers to work together, correcting timing, phase, and interaction so the cabin itself stops fighting the sound. 

That puts NIO in a different lane. By integrating Dirac at a deeper level with Spaces, it’s betting that software-defined acoustics can outperform even well-executed in-house systems. Tesla and Rivian are betting they can get there on their own.

Right now, both approaches work. But based on what we heard in that Model Y, Dirac has already shown it can raise the bar—if an automaker is willing to give it the keys.

For more information: https://www.dirac.com/b2b/automotive/spaces

Related Reading:

Yash Jain discusses how cybersecurity needs to be an institutional ‘fundamental component’, not a ‘compliance checkbox’.

For Yash Jain, a cybersecurity, forensics and privacy manager at PwC, Ireland’s cybersecurity landscape is “evolving rapidly as awareness grows following targeted cyberattacks on critical national infrastructure, such as the Health Service Executive (HSE) and pharmaceutical companies”.

He told SiliconRepublic.com: “These incidents highlight the importance of cybersecurity in modern digital infrastructure, prompting both government and private sectors to prioritise security as a fundamental component, rather than a mere compliance checkbox.”

Can you elaborate upon some of the challenges?

Cybersecurity awareness is widespread, yet many struggle with the practical steps needed to protect both organisations and individuals from cyberthreats. The primary challenge lies in crafting a security strategy that aligns with business goals and compliance requirements. Cybersecurity isn’t just about adopting automated tools or running awareness campaigns. It’s about selecting a strategy that effectively implements protective measures across both people, process and technology. Additionally, skill shortage is another challenge that this sector is facing at this stage. Finding the right talent to deal with security and this has been a key challenge.

What skills do modern day professionals need in their arsenal to manage or stay ahead of threats?

In the current cybersecurity environment, mitigating skills shortages demands a strong grasp of networking concepts and familiarity with foundational development tools, including APIs and commonly used scripting and web technologies. These core skills enable professionals to understand how systems communicate, identify vulnerabilities and effectively analyse and respond to cyberthreats.

This knowledge lays the groundwork for understanding complex technical concepts. Pursuing globally recognised certifications like Certified Information Systems Professional (CISSP) and Certified Information System Auditor (CISA) can further enhance their security expertise. This approach equips professionals to navigate the evolving challenges in cybersecurity. Additionally, leveraging AI to develop these skills offers a modern alternative to traditional learning methods, such as sifting through extensive books.

How can an organisation ensure the workforce is adequately skilled in cybersecurity best practice?

To build a robust cybersecurity culture, organisations should make sure their teams understand the impact of cybersecurity on both them and the organisation. Education should be straightforward and clear, especially for those in non-IT roles like HR, finance and operations. Engage your workforce with interactive sessions, such as in-person training and large-scale phishing simulation exercises. These simulations, managed by your security team or a trusted third party, involve sending fake phishing emails to employees to test their ability to spot and handle phishing attempts – without any real threat to the organisation.

And back to basics, it’s crucial to maintain basic security practices, avoid sharing passwords, refrain from writing them down on desks or laptop covers and don’t use corporate email addresses for personal activities like gym memberships. By fostering these habits, you can enhance your organisation’s cybersecurity resilience.

How critical is cross-collaboration to ensure strong cyber hygiene and quick responsiveness to threats?

Cross-collaboration is critical to building a resilient cybersecurity posture. Cybersecurity is no longer solely the responsibility of the IT or security team, it is an organisational concern that touches every department and individual. When teams across HR, legal, finance, operations and technology work without collaboration, it creates blind spots that threat actors can easily exploit. Effective collaboration ensures that threat intelligence is shared swiftly across the right teams, enabling faster detection and response to incidents. For example, during a ransomware attack, a coordinated response between the security team, senior leadership, legal counsel and communications is essential to minimise damage and maintain compliance obligations.

It is essential that organisations take concrete measures to sustain and strengthen their current state of effective collaboration and consequently consider moving away from traditional cyber assessment exercises, such as conventional penetration testing. Instead, they should shift their focus towards purple team exercises. A purple team exercise is an advanced cyber penetration testing assessment in which penetration testers simulate sophisticated cyberattacks to evaluate an organisation’s security maturity across people, processes and technology, with the objective of detecting and blocking potential cyberthreats.

Are there any myths around your role in cybersecurity that you would like to debunk?

Absolutely. There are a few misconceptions I frequently encounter that I think are worth addressing. The first is that cybersecurity is purely a technical role. While technical knowledge is certainly valuable, a large part of what I do involves strategic thinking, risk assessment and communicating threats in a way that non-technical stakeholders can understand and act upon. You do not need to be a programmer to have a meaningful and impactful career in this space.

The second myth is that cybersecurity is only a concern for large organisations. In my experience, small and medium-sized businesses are often more vulnerable precisely because they are assumed to be low-risk and therefore invest less in their defences. Attackers are very aware of this.

The third and perhaps most dangerous myth is that having the right tools means you are protected. Technology is only one layer of defence. Some of the most damaging breaches I have seen were not the result of a technical failure, they happened because a person clicked a link they should not have, or shared credentials without realising the consequences.

What is your advice for professionals looking for a similar career in this space?

My advice is simple: start with curiosity and never stop learning. Begin by building a solid foundation in networking and IT fundamentals, and consider pursuing recognised certifications such as CompTIA Security+, CISSP, or CISA depending on your area of interest. Do not be discouraged if your background is not in traditional IT, as some of the most effective professionals in this field come from diverse backgrounds such as law, business and psychology, because soft skills like communication, critical thinking and problem-solving are just as valuable as technical expertise. 

We have witnessed such scenarios where people coming from diverse educational backgrounds like business studies, law and other non-tech courses followed the above approach and enabled them as competent cyber professionals. PwC provides tailored learning programmes bespoke for employees joining the firm from different backgrounds to achieve this goal. The learning path is aligned to develop individuals into cybersecurity professionals capable of managing routine governance, risk and compliance tasks to maintain an organisation’s cybersecurity posture. However, to gain further depth in this career, specifically to become an offensive security engineer additional skills are required.

Leverage AI-driven learning tools and online platforms to accelerate your development rather than relying solely on traditional methods. Most importantly, engage with the wider cybersecurity community through events, forums and networking opportunities, as this field thrives on collaboration and knowledge sharing and those who embrace that will always stay ahead.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.