A nearly identical exploit kit that targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows is being actively used by at least four hacking groups, some of which have ties to the Chinese government.
Researchers from security firm Proofpoint said Wednesday that BlueMoon, the name they gave to the kit, chains three vulnerabilities together so the attackers using it can install malware of their choice. BlueMoon exploits two Chromium vulnerabilities and one in the kernel of Windows 10 (Oct 2018 Update), Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11. All three vulnerabilities have received patches in the past 24 hours.
The attacks lacked the stealth found in many campaigns. More often, hackers want to exploit newly discovered vulnerabilities sparingly to lengthen their longevity. Proofpoint hypothesized that one reason for the widely used and visible exploit chain was to take advantage of a “patch gap” in the Chromium supply chain, which spans the time a patch is available from developers and the time that patch is incorporated into browsers such as Chrome and Edge. Another likely contributor was the use of AI, which can often spot vulnerabilities faster than discovery performed solely by humans.
Both these factors likely pushed the attackers to move quickly before a window of opportunity closed. Proofpoint said:
A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development. This is particularly relevant for open source codebases, such as Chromium, where upstream patches are publicly accessible prior to downstream consumers of the codebase applying the patch. This creates a window for threat actors to attempt to rapidly reverse engineer patches and develop exploits ahead of downstream stable releases.
The four groups targeted a wide range of organizations and companies. The groups and targets included:
First look: Following years of fervent speculation, Apple finally unveiled its first folding phone, the iPhone Duo, at its ‘Surprise and Shine’ event in Cupertino, California. The company is betting big on its first foldable, with new CEO John Ternus calling it “the most transformational change to iPhone since the original.”
The iPhone Duo arrives with two “Super Retina XDR” ProMotion displays, including a large 7.6-inch folding panel on the inside and a smaller 5.4-inch screen on the outside. Both are protected by Ceramic Shield 2 and offer 3000 nits of peak outdoor brightness. They will both support the updated USB-C Apple Pencil with a future software update.
On the hardware side, the Duo is powered by the A20 Pro SoC, which comprises a 6-core CPU, a 7-core GPU, and a dual 16-core Neural Engine. Apple claims that compared to the A19 Pro, the new CPU and GPU are up to 20% and 40% faster, respectively, while being more power efficient. The Neural Engine reportedly offers 2x the compute power as the A19 Pro to run on-device AI models.
Built by TSMC on its 2nm node, the new chip incorporates a custom vapor chamber for improved thermal management.
Apple says that the new cooling solution makes the A20 Pro better than its competition at multitasking, gaming, and complex AI workloads. The company also claims that the new chip offers 35% better sustained performance than the iPhone 17 Pro.
The Duo sports a 48MP Fusion ultra-wide main camera on the outside, paired with a secondary 12MP 2x optical telephoto camera. The main sensor supports 4K 120fps recording and 4K time lapse in Dolby Vision HDR. Additionally, there’s a Center Stage camera on the front and an under-screen FaceTime camera on the inside for video calls.
The iPhone Duo is built out of Grade-5 titanium that adds structural rigidity and keeps the weight down. It also uses a 3D-printed hinge cover with a micro-blasted finish, offering a stark contrast to the mirror polish of the main frame. Apple also added antenna splits with ceramic fiber inserts to enhance the frame’s rigidity.
The foldable brings back Touch ID with an old-school fingerprint scanner integrated into the power button. It can also be unlocked using Face ID and with the Apple Watch. The device uses Apple’s in-house N1 networking chip for Wi-Fi 7, Bluetooth 6, and Thread connectivity, while the C2 cellular modem adds 5G mmWave support.
The Duo ships with iOS 27, but with several features designed specifically for the folding screen. One of the custom features is the Today View, which shows two Home Screens, including one with a vertically scrolling list of customizable widgets. Other changes include a redesigned Dynamic Island and a circular module on the status bar to show Wi-Fi, cellular strength, and battery information.
The iPhone Duo is available in Star White and Night Sky colorways, starting at $1,999 for the base $256GB model. Pre-orders begin October 16, with general availability from October 23.
Monitoring a home often means watching several things at once. Just as a car pulls into the driveway, a visitor might approach the front gate, or movement could catch your eye in the side garden. For many European homes, this is a familiar scenario.
The challenge becomes even more noticeable when a property includes a backyard, detached garage, or swimming pool. Installing another camera for every angle is one solution, but it also means more devices to set up, manage, and maintain.
Multi-lens cameras offer a more practical way to see more from a single device. While dual-lens models have pushed outdoor security in the right direction, they still face limitations. Because these lenses often capture activity independently, crucial details can slip through the cracks. Even designs pairing a fixed lens with a movable one can leave blind spots, and overall coverage remains inherently limited by having only two perspectives.
At IFA 2026, EZVIZ is taking the idea a step further with its 90f Triple series. It is available in two models, with the wired EZVIZ H90f Triple and the battery-powered EZVIZ HB90f Triple offering different power options. The series has been named an IFA Innovation Award Honoree, putting three-lens outdoor security among the innovations EZVIZ is highlighting at this year’s show.
Both models share the triple-lens design at the heart of the 90f Triple series, pairing three lenses with three motors and dual rotations. Unlike a setup where one perspective remains fixed, this design gives the cameras greater freedom to adjust their viewing direction, reducing the pressure to find the perfect installation angle.
Imagine someone entering through the front gate, then heading toward a side garage. Or picture movement starting at the far edge of the garden and steadily approaching the house. EZVIZ’s Co-Detection technology enables all three lenses to work in unison to automatically track a target as it moves. This helps capture a more fluid, detailed picture rather than just disjointed views of the same space.
While the automation handles the heavy lifting, stepping in manually is just as fluid. You can set the lenses to operate independently and toggle between viewpoints with a quick tap. When a faraway subject needs your attention, the triple-lens 3K clarity and 12x lag-free mixed zoom help bring distant activity into clearer focus.
This flexibility makes the 90f Triple series suitable for a wide range of property layouts. Whether it’s a cottage with a deep garden, a terraced house with multiple outdoor zones, a sprawling farmhouse, or a small business managing an entrance and parking lot, the cameras are designed to meet different coverage challenges.
Seeing more is useful, but it can easily create a new problem if every bit of outdoor activity becomes another notification to check.
Both the H90f Triple and HB90f Triple use AI-powered human and vehicle shape detection to identify relevant activity. Familiar face recognition provides even more context by identifying people the cameras already know, making it easier to understand what is happening at a glance. Moreover, EZVIZ processes this feature locally at no additional cost.
Where the HB90f Triple differs is its power setup and additional battery-model features. For locations where wired power is inconvenient, its 10,400mAh rechargeable lithium battery works alongside an included 8W solar panel to minimize the need for manual maintenance. Whether you are monitoring a detached garage, a large garden, or a rural property, this setup provides greater flexibility over where the camera can be installed.
The HB90f Triple also features AOV 2.0 technology to close the potential gaps that can come from relying solely on event-triggered recording. If suspicious activity occurs, its built-in siren and red-and-blue warning lights serve as an active deterrent rather than merely recording the event.
For years, seeing more of a property meant installing another camera. EZVIZ is now drawing on its smart home expertise to make the case for a different approach. Moving from one lens to two gave outdoor security a new perspective, but three coordinated lenses allow a single device to monitor more of the spaces you actually want to keep in view. With the 90f Triple series at its IFA 2026 showcase, EZVIZ offers a compelling look at where multi-lens security is heading next.
Digital Trends partners with external contributors. All contributor content is reviewed by the Digital Trends editorial staff.
Apple hosted its annual iPhone launch event on Wednesday, and something we didn’t see — along with base iPhone 18 models, as Apple focused purely on premium devices — was a second iteration of its lightweight iPhone Air.
At just 5.6mm thick and weighing only 165 grams, last year’s $999 iPhone 17 Air gave buyers a middle-ground option between the base iPhone 17 and the iPhone 17 Pro models, and for a pretty reasonable price.
While sales of the iPhone Air were reportedly disappointing, it was arguably a first step toward launching the iPhone Duo — a demonstration that a slim, lightweight phone could be just as durable and high-functioning as a fully specced-out one. It came with just one rear 48-megapixel wide-angle camera, a smaller battery and a single speaker.
The Air’s pared-back features and slim profile would have been pivotal to designing Apple’s new folding phone, since foldables must be both slim and make similar compromises on specs — the Samsung Galaxy Z Fold 8 only has two rear lenses, compared with the three that come on other Galaxy models, and the iPhone Duo likewise has just two rear cameras.
We were hoping Apple would release another version of the Air with improved cameras and battery life, especially since that middle ground still exists. Some people just want a phone that’s slightly better than the base iPhone, and many people want a capable phone without having to spend upward of $1,199 — the cheapest phone Apple announced on Wednesday as it took the wraps off premium handsets like the iPhone Duo, iPhone 18 Pro and iPhone 18 Pro Max.
Many people also don’t want a phone that folds. CNET’s survey of more than 2,600 adults last month found that 75% were not interested in a foldable iPhone and that most would want to spend less than $1,000 if they did get one. But the Duo costs between $1,999 and $3,199 — far exceeding the iPhone Air’s original $999 price tag.
Apple also raised the prices on its iPhone 17 lineup on Wednesday as it announced its new high-end handsets, leaving the middle ground with fewer options, even in previously available models. The iPhone 17 Air now starts at $1,099, with the price increases coming amid RAMageddon, the global memory shortage caused by the spike in AI tools. Apple continues to whittle down options for more budget-conscious consumers in a difficult economy.
We’re still holding out hope that the iPhone 18 Air has been pushed back until a rumored spring launch, where it could be unveiled alongside an iPhone 18 base model and a potential iPhone 18E, the budget follow-up to this year’s iPhone 17E.
IDC Worldwide Device Trackers Senior Research Director Nabila Popal likewise believes Apple is strategically withholding the second iPhone Air until next year to bundle with the iPhone 18 and iPhone 18E — launching a trio of more affordable smartphones to contrast with the premium trio of the iPhone 18 Pro, Pro Max and Duo that were just announced.
“It allows Apple to spread its shipments more evenly throughout the year and simultaneously allow the spotlight on the premium models this fall — especially the new iPhone foldable,” Popal said. “Apple is spreading its portfolio to a wider consumer demographic and giving consumers more choice.”
But for now, the lack of lower-end models means anyone wanting to upgrade their phone to a brand-new Apple handset will be stuck choosing between an $1,199 iPhone 18 Pro and up to an eye-watering $3,199 for a 2TB iPhone Duo.
Proton VPN Free is the best overall free VPN in this evidence-based comparison because it combines unlimited data, no advertising, open-source applications, and recurring independent no-logs audits. Windscribe Free is better for multiple personal devices, while hide.me is a strong alternative when unlimited data and no-email signup matter.
The important word is not just “free.” Every no-cost VPN imposes a trade-off somewhere, whether that means restricted server choice, a monthly data allowance, fewer features, one simultaneous connection, or an account requirement. This guide compares those limits using current provider documentation verified on September 8, 2026. No first-hand speed, latency, or streaming tests were supplied, so none are presented as our own results.
The table below focuses on what actually changes when you pay $0. Compare the data allowance first, then look at simultaneous connections, server choice, registration requirements, and the strength of the provider’s privacy evidence.
| Rank | VPN | Free data | Connections | Registration | Best for | What you give up |
|---|---|---|---|---|---|---|
| 1 | Proton VPN Free | Unlimited | 1 device | Account required | Always-on free use | Automatic connection to a limited free-server pool and fewer advanced features |
| 2 | Windscribe Free | 2 GB/month without email; 10 GB/month with confirmed email | Unlimited personal devices | Email optional | Multiple devices and advanced controls | Monthly data cap and smaller server pool |
| 3 | hide.me Free | Unlimited | 1 connection | No email or card required | Unlimited use without signup | Restricted speeds, limited locations, and no streaming-optimized servers |
| 4 | PrivadoVPN Free | 10 GB full-speed allowance every 30 days, then restricted emergency/Lite access | 1 connection at a time | Verified email required | Defined higher-speed workloads | Limited locations, one active device, and reduced post-cap performance |
| 5 | TunnelBear Free | 2 GB/month | Current free-plan documentation does not clearly state a separate simultaneous-device allowance | Account required | Light occasional use | No country selection or split tunneling on the standard free tier |
Proton VPN is the easiest recommendation when one device needs continuous protection because there is no monthly data ceiling. Windscribe becomes more attractive when several personal devices need VPN access. hide.me also removes the data cap, but its free tier restricts speed and location choice.
A virtual private network, or VPN, creates an encrypted connection between your device and a VPN server. That can prevent the local network or internet service provider from directly inspecting traffic inside the VPN tunnel, but it also means the VPN operator occupies an important position in your network path.
That trust should not be granted simply because an application appears in an app store. The Federal Trade Commission’s VPN privacy guidance warns that VPN apps can receive extensive access to internet traffic and that some free services may fund themselves through advertising or information sharing. The FTC also notes that a VPN does not make a person completely anonymous.
For this reason, a free VPN gets more credit here when its privacy claims have evidence beyond marketing language. Useful signals include published source code, independent security assessments, no-logs audits, transparent descriptions of retained account data, and clear explanations of how the free service is funded.
An audit still has limits. It examines a defined system at a particular time. It does not guarantee that a provider can never make a configuration error, suffer a vulnerability, or change its practices later.
A data cap is the total quantity of data you are allowed to transfer over a period. A speed limit restricts how quickly that data can move. The distinction matters because providers use both approaches.
For example, a 10 GB free VPN could run at normal available speed until that 10 GB is consumed. An unlimited-data service can remain connected indefinitely but may restrict free-user speeds or give paid customers more capacity.
Server congestion is another variable. Even when a provider says it does not impose a formal speed cap, a heavily used free server can still be slower because many customers share finite network resources. That is why this article does not translate “no speed limit” into a guarantee of a particular throughput.
The most understandable free-VPN model is freemium. A freemium provider offers a restricted service at no cost and funds it partly from customers who upgrade to paid subscriptions.
That model explains why a free account might receive 10 GB instead of unlimited data, fewer server locations, or one connection rather than ten. It does not prove that the provider is secure, but it provides a clear economic reason for maintaining the free tier without needing to monetize browsing activity.
The evaluation therefore considers both technical restrictions and the transparency of the privacy model. A large free allowance does not compensate for unclear data handling.
Proton VPN Free takes the top position because its most important limitation is not data volume. The provider currently offers unlimited free data with no stated time limit, no advertising, and one simultaneous device.
The free application automatically connects to a server from Proton’s limited free-server pool rather than giving users the full location control of a paid account. Current official documentation identifies automatic free connections across the United States, Netherlands, Japan, Poland, Romania, Canada, Norway, Mexico, Singapore, and Switzerland. Proton also notes that free servers can become busy.
That makes the free plan especially practical for one laptop or phone that stays connected for long periods. You do not have to calculate whether normal browsing, software updates, cloud synchronization, or occasional video use will exhaust a monthly quota.
The privacy evidence is also stronger than a simple no-logs statement. Proton’s apps are open source, and its free-plan documentation states that the free service has no data limit and uses the same core privacy protections. Proton also publishes a recurring no-logs audit record, updated in June 2026 to include its fifth consecutive annual assessment.
The main compromise is control. Free users receive automatic server selection and do not receive the complete paid server network or features such as Secure Core, BitTorrent support, and Proton’s full premium server choices.
Windscribe Free is a better fit when device count matters more than unlimited data. The free account can be used across unlimited personal devices, while the baseline monthly allowance depends on whether you provide an email address.
You receive 2 GB per month without an email. Confirming an email increases that allowance to 10 GB per month. Windscribe also runs optional promotions that can increase the cap, but those conditional bonuses are not treated as the standard allowance in this comparison.
The free tier includes more technical controls than many no-cost competitors. Current free-plan documentation lists its firewall leak protection, multiple VPN protocols, split tunneling, and limited R.O.B.E.R.T. domain filtering alongside a smaller server pool.
Windscribe is also unusually explicit about operational records. For free accounts, it says it retains the total bandwidth used during the current period so it can enforce the cap, plus a last-activity timestamp used to remove abandoned accounts. It states that it does not retain browsing destinations, DNS queries, or traffic-linked session histories.
This is a useful example of why “no logs” should not be interpreted as “no operational information of any kind.” A provider with a 10 GB cap needs some mechanism to determine when the account reaches 10 GB.
The biggest weakness is obvious: 10 GB can be generous for web browsing but restrictive for heavy video, large downloads, operating-system updates, or continuous cloud synchronization.
hide.me is the strongest direct alternative to Proton for users who dislike monthly data caps. Its current free plan provides unlimited data, allows one simultaneous connection, and does not require an email address or payment card.
That last point creates a meaningful difference. A user can install the client and begin using the free service without tying the VPN account to an email address. The trade-off is that the free tier has restricted speed and a much smaller location pool than the paid service.
Current hide.me pages are not completely consistent about whether the free tier exposes seven or eight locations. Its pricing and free-VPN pages say eight, while one support comparison updated in 2026 lists seven named server locations. Because the provider’s own documentation conflicts, this article treats the exact count as changeable rather than presenting one number as definitive.
The provider has stronger privacy evidence than most free products. Its no-logs documentation describes independent assessments of its logging implementation and provides access to audit material. A 2024 Securitum assessment examined areas including server configuration, deployment processes, and the standardized VPN environment used by the service.
That audit is valuable evidence, but it remains a point-in-time assessment. It should not be interpreted as a permanent security certificate.
Best fit: one-device users who want unlimited data and prefer not to provide an email address.
Look elsewhere if: you need predictable high throughput, several simultaneous devices, or specialized streaming servers.
PrivadoVPN Free uses a different model. Instead of offering unrestricted full-speed usage, it provides 10 GB of data every 30 days on its normal free service and then offers restricted emergency or Lite-mode connectivity after that allowance is consumed.
Current pricing documentation states that free users receive 10 GB every 30 days, access to a limited group of server locations, and one connection at a time. Its support documentation says older post-cap behavior limits the connection to 1 Mbps, while a January 2026 product guide describes the transition more generally as Lite Mode with adjusted performance parameters.
Because those descriptions are not perfectly aligned, the defensible conclusion is that full-speed usage is restricted after the 10 GB allowance. The exact post-cap behavior should be verified in the current application rather than treated as a permanent fixed number.
PrivadoVPN requires a verified email but not a credit card for its free account. Its applications can be installed on multiple supported devices, although only one free connection can be active at a time. That distinction prevents a common misunderstanding between “works on unlimited devices” and “unlimited simultaneous connections.”
The company states that the same no-log policy applies to free and paid users. However, a sufficiently strong current public independent no-logs assessment did not surface during this research pass, so this article treats that as a vendor claim rather than independently verified assurance.
TunnelBear’s free plan is increasingly best understood as a limited entry point rather than a full-time free VPN. It currently includes 2 GB of encrypted data per month.
The allowance is enough to learn the interface, protect occasional browsing, or cover a short period on an unfamiliar network. It can disappear quickly when large downloads, cloud backups, application updates, or video are involved.
TunnelBear also changed the free tier materially heading into 2026. Its December 2025 free-account announcement moved country selection and SplitBear split tunneling into the paid experience for ordinary free users. Free accounts retain VPN connectivity along with features such as VigilantBear and GhostBear.
The service has a substantial security-audit history. Cure53 has repeatedly examined TunnelBear applications, infrastructure, backend systems, server configurations, public-facing interfaces, and data-handling components. That transparency is meaningful, although the company’s own publications contain an inconsistency in how they number the most recent audit years. For that reason, it is more accurate to describe a long-running annual audit program than claim a precise total.
A $0 subscription still has an economic cost. The difference is that the provider collects it through restrictions rather than a payment at checkout.
The five services above show the main ways that happens.
| Trade-off | What it means | Current example |
|---|---|---|
| Data allowance | You can transfer only a fixed amount each month before the service stops or changes behavior | Windscribe and PrivadoVPN use monthly allowances; TunnelBear provides 2 GB |
| Server choice | You receive fewer countries or less control over the exact exit location | Proton automatically assigns free servers; all five restrict locations compared with paid service |
| Device limit | Only one active device may use the account at a time | Proton, hide.me, and PrivadoVPN limit the free tier to one active connection |
| Account information | More allowance may require registration details | Windscribe increases 2 GB to 10 GB when a user confirms an email |
| Feature restrictions | Advanced routing or location controls stay behind the paid tier | TunnelBear moved country selection and split tunneling to paid plans |
| Performance priority | Free infrastructure may be restricted or more congested | hide.me documents restricted free-tier speeds; Proton warns that free servers can become busy |
These are not necessarily deceptive restrictions. Running VPN infrastructure costs money. The relevant question is whether the provider explains its boundary clearly enough for you to decide whether the free tier fits your workload.
Some are defensible choices. The category as a whole is not automatically safe.
A VPN occupies a privileged position because traffic is intentionally routed through infrastructure operated by the provider. The encryption protects the connection between your device and the VPN server, but it does not remove the need to trust whoever operates that server.
This is why a credible free service should be evaluated using more than a lock icon and a statement such as “military-grade encryption.” Encryption can protect the tunnel while a poor privacy policy still permits problematic collection elsewhere.
Before installing a free VPN, check the following:
A free VPN also does not make an unsafe device safe. Malware can still run locally. A phishing site can still steal credentials you enter voluntarily. Cookies can still recognize your browser, and logging into an account can identify you regardless of the VPN exit address.
The practical goal is therefore narrower: protect a network path, reduce exposure to the local network and internet provider, and change the public IP address destinations normally see. Do not treat a VPN as an anonymity system or complete cybersecurity package.
Some restrictions sound minor on a pricing page but become important during everyday use. The following table translates them into operational consequences.
| Limit | What happens in practice | Who should care most |
|---|---|---|
| 2 GB data cap | Large downloads or prolonged video can consume the monthly allowance quickly | Video viewers, cloud-storage users, software developers |
| 10 GB data cap | Comfortable for moderate browsing but still requires monitoring during heavier workloads | Travelers, students, remote workers |
| One connection | A phone and laptop cannot both stay protected through the same free account simultaneously | Multi-device users |
| Automatic server assignment | You cannot reliably choose a specific country whenever you connect | Travelers and users with jurisdiction-sensitive requirements |
| Restricted speed | Large transfers, video calls, and high-resolution media may feel less responsive | Heavy data users |
| No streaming servers | Provider-specific optimized infrastructure is unavailable on the free tier | Media users |
| No split tunneling | You may be unable to choose which applications bypass the VPN | Users of local-network devices or apps that reject VPN connections |
A restriction also interacts with your device behavior. An operating-system update or cloud-photo upload can consume data without looking like deliberate VPN usage. If you select a capped plan, check whether background applications are transferring large amounts of data.
A free VPN is useful when the workload fits its limits. There are cases where choosing one primarily because it costs $0 creates more friction than value.
Warning
Public Wi-Fi is another case where the VPN should be only one layer. You should still confirm the correct network, update your device, disable unnecessary automatic connections, and protect important accounts with multi-factor authentication. Our public Wi-Fi safety guide covers those precautions separately.
If you routinely exceed free-tier limits, compare the restrictions against a full consumer VPN plan rather than creating multiple free accounts or constantly switching providers.
The simplest way to choose is to identify the restriction you are least willing to accept.
For a concrete example, a person protecting one laptop during a month-long trip can prioritize Proton’s unlimited allowance. Someone switching among a phone, tablet, and laptop may prefer Windscribe even though the monthly cap is lower. A user who wants no email attached to the service may prefer hide.me.
If speed becomes the main problem after installation, that is a separate diagnostic issue involving server load, route distance, protocol choice, local congestion, and device performance. Check our VPN slowdown troubleshooting guide to fix the issue.
None of the five services in this comparison requires a credit card merely to use the standard free tier. Account requirements differ, however. hide.me does not require an email or payment information, Windscribe can be used without an email at the lower 2 GB allowance, and PrivadoVPN requires a verified email.
Yes. Proton VPN Free and hide.me currently provide unlimited data. They impose different restrictions instead. Proton limits the free account to one device and automatically assigns servers from its free pool. hide.me permits one connection and limits free users by speed and server choice.
There is no single duration because usage depends on what your applications transfer. Reading websites and messaging generally consume much less data than high-resolution video, game downloads, cloud backups, or operating-system updates. A 10 GB allowance may cover substantial lightweight browsing but can be consumed quickly by large media or file transfers.
It depends on the provider’s simultaneous-connection rule. Windscribe Free supports unlimited personal devices. Proton VPN Free and hide.me allow one active free connection, while PrivadoVPN allows installation on multiple devices but only one connection at a time. Always distinguish how many devices can install an app from how many can remain connected simultaneously.
Possibly, but there is no universal result. Some providers offer obfuscated or stealth protocols designed to make VPN traffic less obvious to restrictive networks. Blocking methods vary, and a protocol that works on one network may fail on another. Free tiers may also expose fewer anti-censorship options than paid plans.
A reputable VPN normally cannot read passwords sent through a properly configured HTTPS connection because HTTPS encrypts the content between your browser or app and the destination service. The VPN provider can still occupy an important position in the network path and may observe some connection metadata depending on its architecture and logging practices. This is another reason to choose a provider carefully rather than trusting any free VPN application.
Not always. A full VPN application can route traffic from the operating system and multiple applications through the encrypted tunnel. A browser extension may protect or proxy only browser traffic. Some extensions described as VPNs operate as proxies rather than full device-level VPN tunnels, so check the provider’s documentation before assuming the protection covers every application on the device.
It can be. If you need VPN protection only for light browsing during a short trip, a reputable free plan may provide enough data and locations without a subscription. Paid service becomes more useful when you need predictable location choice, several devices, large transfers, advanced routing features, or consistent long-term support.
Buying a car, whether new or used, is one of the most expensive purchases most people make. The $3,000 rule is a rule of thumb that’s designed to make you think about whether you’re financially ready to take on the burden of car ownership. The rule can take various forms, and be applied in different ways, depending on your particular situation. The core idea is that you should have at least $3,000 available when buying a car, as owning one incurs additional expenses beyond the purchase price or monthly repayment. Because the last thing any car owner (or financially responsible person) wants is to have to take on debt to manage an unexpected repair, traffic fine, or a new set of tires.
The $3,000 rule applies to both new and used cars. For either, having $3,000 as a down payment has multiple benefits. First, it can show a lender you’re a safe bet, which can translate into more favorable terms. Second, it means lower monthly repayments than if you finance the full amount, which in turn can help you avoid the risk of negative equity, where you owe more on a car than it’s worth. Lastly, it also means you’ll pay less interest over the life of the loan (or be able to choose a shorter term, like 36 instead of 48 months), which reduces your total outlay, which in turn can help ensure you can afford surprise repairs, breakdowns, or other expenses. In that case, the $3,000 doesn’t help you pay for unexpected expenses as much as it makes sure they don’t cut so badly into your budget that you’re forced to take on high-interest debt or otherwise compromise your financial stability.
For a used car in 2026, $3,000 is probably too little to fully fund something dependable, but it’s a decent deposit. Or, it allows you to put down $2,000 and keep $1,000 for incidental expenses. Because no matter what sort of car you buy, there are also going to be other costs like inspections, registration, and insurance to think about. Outlandishly cheap used cars are often priced so low because they have exorbitant mileage, haven’t been properly maintained, or either need repairs or are likely to soon. That can result in them costing far more than $3,000 as soon as something goes wrong.
To be clear, we’re not saying you should only spend $3,000 on a used car. You may well have to spend significantly more than that — or want to — but with a larger deposit on a used vehicle, you’ll spend less over the lifetime of the loan. If you’re concerned that spending the full $3,000 on a down payment leaves you financially exposed in the case of an unanticipated expense, keep $1,000 in reserve and pay a smaller deposit. A higher but manageable monthly payment still beats being over-leveraged, for both your financial and mental health.
Another, subtler benefit of the $3,000 rule is that it can encourage would-be car owners to slow down before making a purchase. If you don’t have the money on hand and need to save to get there, it can give you time to weigh your options, shop around, and find a mechanic who can inspect a used car before you buy it, and generally avoid making an impulsive purchase. It’s also a useful tool to get you thinking about the extraneous costs of car ownership and how you plan to pay for them.
For the last few months, there has been much talk of AI agents going “rogue”. This is another of those unhelpful anthropomorphisms that are great for clickbait headlines, but which obscure a multitude of important issues. So far, there have been three major incidents of AI agents evading containment in their software “sandboxes” and going on to carry out unauthorized actions, including breaking into online sites. A post by Shakeel Hashim on the Transformer site provides timelines for them.
The most recent involved OpenAI agents taking over an old German-language wiki, using it as a message board to collaborate on solving tasks. Although this was only announced a few days ago, it seems that OpenAI knew about the incident many months before, but failed to disclose it. One of the worrying aspects of this particular incident is that the agents impersonated humans:
On May 26th, the agents started using the name of a ProWiki admin to make some of their edits to the wiki. They use some tricks (for unknown reasons) to pretend to be the admin — for example, they make an account that appears to be the same as the administrator’s username, except it uses a nearly identical Cyrillic е character in the admin’s username instead of the Latin one.
The second incident, which occurred during security evaluation of frontier AI models by the UK-based, government-funded, AI Security Institute (AISI), also involved AI agents that created fake human identities and used them for social engineering:
In the most serious sequence, an agent tried to insert malicious code into a publicly used open-source project and took actions in an attempt to secure approval for this insertion by human reviewers. The agent researched the project’s human maintainers, created multiple fake identities, and used the fake identities to socially engineer a real maintainer into approving the code. When the agent’s pull request was challenged in public, it edited its earlier activity to appear harmless and considered adopting a fresh identity to continue. The agent used Tor to bypass some network restrictions on GitHub, which is what first triggered AISI’s security alert.
In addition:
As part of the same effort, the agent tried to contact real people directly, sending messages and files through an online file-transfer service to persuade them, or their own AI coding tools, to run malicious code. Some messages carried harmful payloads, and some were attempts at social engineering; targeted at real people — something we’ve never previously observed.
The first incident of AI agents carrying out unauthorized tasks is the best-known, and involved an attack on the Hugging Face site. A full analysis of what happened and when has been released by Model Evaluation and Threat Research (METR), which “evaluates frontier AI models to help companies and wider society understand AI capabilities and what risks they pose.” It is funded by donations, but says that it does not accept them from frontier AI company employees, in order to preserve its independence:
Our investigation focused mostly on the period between July 7th and July 13th. The earlier incidents from training and the subsequent compromise of OpenAI infrastructure described in OpenAI’s recent Black Hat presentation were out of scope, as was OpenAI’s investigation process and planned remediation. Per our standard policy, we did not take payment from OpenAI for this independent assessment. [emphasis in original]
The report is detailed and long, and one of its authors, Ajeya Cotra, has helpfully picked out five things that surprised her from their investigation. One was the “sheer scale” of what happened. She says she expected that a few agents had broken out of their sandboxes; instead:
we found that 1200 completely separate agents intended to be isolated from one another found an illicit way to communicate and formed large teams to work together on ambitious cheating strategies, and 700 of them worked together to attack Hugging Face.
The scale of the illicit messaging between agents was also surprising. Cotra thought agents might be “leaving notes” to each other. However:
The main message board we studied, a particular cache namespace of a package repository, contained over 70,000 messages and files that agents sent to one another during a period of less than one week.
The agents’ goal also turned out to be interesting:
I thought the agents attacked Hugging Face to try to steal the answer keys for their tasks. Instead, we learned that agents had actually figured out a general-purpose cheat that would let them reverse-engineer the “flag” (answer) for any ExploitGym task.
ExploitGym is a standard benchmark, built from real-world vulnerabilities, that is designed to evaluate AI agents’ ability to turn those into working attacks. One particularly noteworthy aspect of the Hugging Face attack was the following:
Progress on these big collective cheating R&D projects often depended on individual agents being willing to risk failing their own task to help the “collective” learn important information. Agents often pressured each other into accepting these “sacrifices,” in a very human way. We saw several agents that volunteered for these experiments end their runs prematurely.
That may read as yet more anthropomorphization, but it is hard to see what other words could be used to describe what are very human-like operations. Cotra’s last surprise also involves a very human-like activity: deception.
~7% of our transcripts contained “spoofed tool calls”, where the agent pretended to run one command on the computer but actually ran a different command in the background. The tool call spoofs we saw seemed to be small-scale tests that were relatively obvious, but because more extensive spoofing might have been harder to detect by design, it’s tough to rule out.
In summary, Cotra says that the Hugging Face incident was far more severe than she expected:
Compared to these reward hacks from six months ago, this incident feels like it’s more than 50% of the way to full-blown AI takeover, routing through first taking over the AI company itself.
“Reward hacks” refers to when AI code finds an unexpected way to achieve a high score in a benchmark without doing what the programmers actually wanted. Here’s what Cotra means by “AI takeover”:
Another jump like this along these propensity dimensions — scale, cooperation between agents, ambition and horizon length of misaligned goals, deceptiveness — seems like it could motivate agents to try very hard to maintain a covert, persistent rogue deployment within the AI company. I continue to expect extremely rapid advances in capabilities and think frontier agents will likely be capable of establishing such a rogue deployment in six months.
Again, these are not really “rogue” agents, they are pieces of software seeking to optimize solutions to problems. The danger, according to Cotra, is that this optimization process could go on to deliver unexpected and harmful results:
As more and more work is handed off to these ever-more-capable AI agents, the rogue swarm could come to fully control the operation of the AI company and the development of future AI systems. At this point, governments and militaries may fully depend on these systems, making it possible to seize hard power.
Cotra is not the only expert who is deeply concerned by the latest developments in AI. Back in July, 1,386 employees of frontier AI companies issued a statement entitled “Pacing the Frontier”:
AI could help create a dramatically better future, but that outcome is not guaranteed. The world’s leading AI companies believe they could be close to automating AI research. It is hard to predict exactly how much this will accelerate AI progress, but there is a real risk that capability development rapidly accelerates beyond our ability to understand or control the resulting systems.
The signatories ask the US government to support an international effort to “deliberately pace the frontier of automated AI development”. Another important voice has made the same call. Jakub Pachocki is Chief Scientist at OpenAI. Just recently, he has published a post on the OpenAI’s site with the title “An Alien Mind,” where he worries about the imminent arrival of AI systems capable of “recursive self-improvement” — that is, able to drive their own development, at an ever-faster pace, by re-writing their own code:
Currently I believe that no lab has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer. I expect and hope for voluntary slowdowns to become commonplace until shared safety bars are established. And I believe that international coordination on future AI development needs to become a top priority for governments around the world.
This call to slow down might seem extreme, or alarmist, to some — but not to Jacob Coxon:
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives.
A few hours later, Evan Hubinger, Alignment Science lead at Anthropic, commented:
Jacob is correct here—we really do earnestly believe AI could kill all humans! I personally think it is >10% within the next decade. I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to.
In effect, we find ourselves dealing with a modern, AI version of Pascal’s Wager. The probability of an uncontrollable, all-powerful, self-improving AI arising may be very low, but experts like Cotra, Pachocki, Coxon and Hubinger seem to think it is non-zero; and the consequences of such a system coming into being could be catastrophically bad for humanity. Basic mathematics suggests we should at the very least slow things down, as experts are urging — just in case…
Follow me @glynmoody on Mastodon and on Bluesky.
Filed Under: agents, ai, aisi, ajeya cotra, alignment, benchmark, cooperation, evan hubinger, frontier ai, going rogue, jacob coxon, jakub pachocki, messaging, metr, pascal, pascal’s wager, recursive self-improvement, reward hack, sandbox, wiki
Companies: anthropic, hugging face, openai
Healthcare company AdaptHealth has confirmed that data of 4.1 million people was exposed in a cyberattack discovered in July that was attributed to the ShinyHunters threat group.
The company provides home medical devices, supplies, and related services, including sleep-apnea and respiratory equipment, oxygen therapy, hospital beds, and mobility products.
AdaptHealth first disclosed the incident in a filing with the U.S. Securities and Exchange Commission (SEC) on July 2, 2026, informing that attackers accessed its systems and exfiltrated private data.
At the time, AdaptHealth’s investigation confirmed the intrusion occurred earlier and involved access to cloud-based business applications, including certain internal patient management systems, document storage platforms, and electronic health record system portals.
On June 15, an unnamed threat actor contacted AdaptHealth to demand a ransom payment in exchange for not leaking the stolen data.
AdaptHealth added that the breach occurred through a successful social engineering ploy that compromised the privileged account of a third-party contractor.
In an update on August 14, AdaptHealth informed that the compromise had occurred on June 5 and may have exposed the following data:
Impacted individuals should have already received a data breach notification with instructions on how to enroll in a free-of-charge 12-month credit monitoring and identity protection service.
AdaptHealth stated at the time that it had found no evidence of identity theft, fraud, or other misuse of data stolen in the attack.
According to information on the company’s website, AdaptHealth served about 4.1 million patients across all 50 U.S. states through a network of 680 locations as of July 2024.
In a submission to the U.S. Department of Health and Human Services, the AdaptHealth data breach affects 4,115,802 individuals.
The HIPAA Journal previously reported that ShinyHunters was responsible for the attack, based on the threat actor adding the company to the list of victims.
However, BleepingComputer coould not find an AdaptHealth entry on ShinyHunter’s extortion portal, an indication that the threat actor removed the company.
AdaptHealth’s confirmation of the data breach impact follows similar recent disclosures from health-tech firms Aesto Health, CareCloud, and Unlimited Technology Systems.
McKesson and Nutex Health also disclosed data breach incidents late last month, but neither has determined the number of impacted individuals yet.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
This is going to be a very personal question, because when you’re talking cloud vs local anything, it comes down to this: how much are you willing to pay for independence? The local option might save you long term, or it might never pay off the capital investment. It will almost certainly cost you your time to set up and maintain your own system — but what you get back is independence. With LLMs, traditionally you lose quite a bit of performance, but as [Anurag Singh] points out on XDA Developers, a lesser model might actually let you get more done, depending on your workflow.
[Anurag] had been on the 20$/month plan with Anthropic when he decided that the scratch just wasn’t worth the sniff– he was hitting usage limits he couldn’t stand at that level, but couldn’t justify a higher tier of access. So he decided to try a local LLM, even though all he had was a 16 GB MacBook Air M5, not a beefy workstation. Since his workflow isn’t so much ‘vibe code the whole thing for me’ as ‘help me find where I went wrong here, electronic rubber duck’, Qwen2.5 Coder 14B proved more than adequate for his use case.
It can’t understand all the moving parts of a large project as well as Claude can — not surprising given how old it is and how much memory it has to work with — but that’s [Anurag]’s job. He’s the programmer, it’s just the assistant. For his use case, he can make use of his existing hardware and having the the LLM right in VS Code is allows for a speedy workflow.
Your millage may vary, but if you want to get into locally running LLMs, we can point you at the easy ways to get started. Depending on your hardware, you might want to grab another GPU.
Amazon named cybersecurity veteran Kevin Mandia to its board of directors, adding new security expertise a few months after former NSA director Keith Alexander stepped down.
Mandia founded Mandiant, the breach-investigation firm Google acquired for $5.4 billion in 2022, and remained at the search giant as a strategic advisor through July 2025, according to his LinkedIn profile. He now leads Armadin, an AI security startup he started last year.
Amazon said in its announcement that “cybersecurity is one of the most consequential risks and responsibilities organizations face today, and the threat landscape continues to evolve rapidly alongside advances in AI.”
Amazon added a cybersecurity specialist to its board in 2020, when it elected Alexander, who also led U.S. Cyber Command. Mandia comes from the other side of the field, with two decades spent investigating corporate breaches rather than defending government networks.
His appointment also puts an AI security entrepreneur on the board of a company whose cloud infrastructure underpins much of the internet. Armadin, founded in September 2025, uses AI to run attacks against corporate networks, probing defenses the way an intruder would.
The board’s Security Committee, which oversees Amazon’s cybersecurity policies and its response to significant cyber incidents, is now chaired by Dan Huttenlocher, dean of the MIT Schwarzman College of Computing. Mandia joins as a member, along with former Bridgewater co-CEO Jon Rubinstein.
Amazon also named Mandia to the board’s Audit Committee, according to a securities filing.
Mandia received 4,086 restricted stock units in connection with his election to the board, vesting in three equal annual installments beginning Nov. 15, 2027, the filing shows. The shares were worth about $1.03 million at Amazon’s closing price Wednesday.
The filing disclosed that his sister-in-law, Kristin Mandia, is an Amazon employee with an annual salary of $185,000. The company said her compensation is consistent with that of other employees at her level with similar responsibilities.
Oil is your car’s life blood. From the engine to the transmission to the differential — anywhere with the potential for metal-on-metal contact, you’ll need some sort of lubricant to keep it from overheating. Every type of oil is designed for different tasks as well; while some may be theoretically interchangeable, they often have different additives that make them better suited for one task or another. Take hydraulic oil versus motor oil, for instance. Both have a lot of the same qualities, but the former is best suited to accepting high pressure and the latter high thermal loads.
The same thing applies here with hypoid gear oil, such as many API GL-5 oils, versus regular gear oil. In short, hypoid gear oil is meant to be used with steel gears under the pressures inherent to hypoid gearsets, as opposed to regular gearsets.
Generally, gears use the same principle whether it’s a transmission or a windmill; you’re taking two shafts and meshing them together to transfer torque. The difference comes in how those gears interact. You have shafts that can go laterally or extend sideways, some that are articulated and others that are static. Ring gears, planetary gears, straight-cut or beveled — all these produce different pressures that require different oils, hence why manual transmission fluid (MTF) and automatic transmission fluid (ATF) are different.
But what’s special about hypoid gears that you need hypoid oil? Hypoid differentials are arranged differently; you have an input shaft that’s lower or higher than the center of the output shaft gear’s center, a setup which has its own benefits but also requires specialized lubricants because of the friction involved in laterally sliding two metal surfaces together.
Yes, car axles are complicated, so let’s address this first: What is a hypoid gear? To better visualize how this works, ball one hand up into a fist, then place your index finger beside it. Imagine your fist is a gear, and your index finger is an input shaft. That input shaft is spinning, and as it spins, it turns the bigger gear called a ring gear — your fist, in this case, which is how a driveshaft turns your car’s wheel in a typical rear-wheel drive car.
Let’s assume that the input shaft is perfectly dead-center where the output’s axis of rotation is. Your finger has a certain amount touching your fist in that case; that’s where your car’s input shaft contacts the output shaft. Okay, now for the real trick — rotate your finger so that your whole index finger is touching your fist. You have way more surface area between the two; that’s what a hypoid gear is. You’re putting the input shaft in a place where more of it is in contact with the ring gear on the output shaft.
Now, when you think about it, you can’t just place the two gears offset to one another and have them be cut perfectly straight. It’d be like moving your jaw to one side and trying to close your mouth. The teeth wouldn’t be able to mesh, so instead you cut the teeth in a spiral pattern and cut the ring gear with a curve to its teeth. That way, as the gear rotates, it’ll mesh without any friction issues because there’s minimal lateral resistance (like grinding your teeth).
Any gearbox needs fluid, as we’ve established, and hypoid gears are no exception. You’ll frequently see hypoid gears running with API GL-5, but what does that even mean and can you use regular gear oil instead? In short, no. Hypoid gear oil has specialized additives which are toleranced for the pressures placed upon them by the spiraling motion of the beveled gears.
A lot of regular manual gearboxes can also use this fluid as well; look on the back of any bottle of GL-5 and it’ll likely say it’s rated for use in them. Most modern gearboxes use steel gears, which GL-5 protects by clinging onto the surface and acting as a sacrificial barrier. The oil prevents the metal surfaces from generating friction, therefore helping your transmission last longer. The main difference is the additives. GL-5 has specific sulphur/phosphorous additives that cling onto metal better under pressure, which is why they’re so good with hypoid gears. The downside is that this additive is corrosive to brass, so if you have a car with brass synchronizers in the gears, you have to use GL-4 instead — something I have to do personally, as my car has brass synchros.
As for using other gear oils with hypoid gears, you technically can — again, much like using motor oil in hydraulic lines. But it’s not a good idea; the point of GL-5 is that it clings to metal surfaces. Without that action, your differential will struggle to lubricate itself, leading to the gears wearing out. Signs of differential failure include ticking or clunking noises when driving, a generally noisy ride coming from the axle, or odd behavior in tight corners — so don’t forget to change your diff oil.
Bitcoin price risks $76K drop as $78K support weakens
Memory prices are slowing because buyers ran out of money
Ethereum price stalls below $2,500 as ADX drops to 11
Robinhood Stock: How To Take Advantage With Reduced Risk
What went right this week: an ‘historic’ fall in violent crime, plus more
Phones confiscated, players sent home: Pakistan’s England tour turmoil revives memories of Mohammad Amir, Salman Butt and Mohammad Asif’s 2010 Lord’s spot-fixing scandal | Cricket News
England up in reading, maths and science rankings as Scotland and Wales dip
Bitcoin price holds near $79K as cycle drawdowns narrow
Meta debuts long-awaited personal AI agent, Muse
Brent Crude Oil Moves Above $100 for the First Time in 3 Months
Visa expands stablecoin card network to 160 programs
Egyptian TV Presenter Sarah Khalifa, 11 Others Sentenced To Death In Major Drug Trafficking Case In Cairo
Strong Password Policy and Password Manager Guide
Intel Stock Jumps 9% on Chip Price Hike Report, US Stake Gains $36 Billion
Meta debuts its Muse AI agent. Will consumers trust it?
Big Brother Spoilers: Dee SPINS & HUSTLES Votes – Yash Questions the Pact
Pump Fun and Kraken delete Hunter Biden $LAPTOP promotion
Ballon d’Or 2026 Nominees: Lionel Messi In, Cristiano Ronaldo Out; Erling Haaland Included In Top 30
ServiceTitan, Inc. (TTAN) Q2 2027 Earnings Call Transcript
Google’s revived nuclear power plant gets $1.9B loan from US government
You must be logged in to post a comment Login