Firefighters in France are confronting a phenomenon never seen in the region before: fire clouds. It’s a sign of the intensity of the blazes burning—and how climate change is upping the odds that they appear.

A wave of fires has swept over France and Spain, sending hundreds of thousands fleeing. Firefighters on the frontlines are facing what a spokesperson for the French firefighter association told AFP called an “operational impossibility”—in other words, a “natural force beyond our control.”

As evidence of how out of control the wildfires in France are, look no further than the skies where the blazes have, in some cases, created their own weather. To form a fire cloud—what meteorologists call a pyrocumulonimbus or the even more metal-sounding cumulonimbus flammagenitus—you first need heat, which fires have in spades.

But just as important are dry conditions near the ground and cool, relatively moist conditions aloft in the atmosphere. As superheated smoke rises miles above the flames and into the cool atmosphere, water vapor condenses around the particles of ash to form water droplets. (Yes water vapor and water droplets are two different things.) As the air keeps rising, those water droplets eventually become ice crystals.

At this point, the smoke and water droplets have created a cloud, but unfortunately one that’s unlikely to provide much relief in the form of rain. Instead, these towering fire clouds can unleash lightning strikes that can start more fires and generate powerful downdrafts that reach the ground to fan flames further. At their worst, pyrocumulonimbus clouds can even spawn tornadoes.

Pyrocumulonimbus clouds have been documented in the US, Canada, and Australia, among a handful of other locations. But until now, there were no documented fire clouds in France. While the country is no stranger to wildfires, the size and ferocity of this summer’s blazes is well outside the normal.

Last week was France’s single most destructive week for wildfires over the past 20 years, according to data from the European Forest Fire Information System. It more than doubled the previous record during that period, which coincides with accurate satellite data. This isn’t an isolated bad week either. More than 220,000 acres have burned across the country so far, six times the annual average. That’s 61,000 acres higher than the previous yearly record.

If that sounds like a familiar trend, well, it unfortunately is. Burning fossil fuels has heated the planet up, making explosive wildfires more common and destructive around the world. A 2024 study found the incidence of extreme fires globally more than doubled from 2003 to 2023. Six of the seven most extreme years have happened since 2016.

After a slight weekend reprieve as temperatures dipped, they’re expected to rocket back up above 104 degrees Fahrenheit (40 degrees Celsius) in France and 108 degrees Fahrenheit in Spain later this week. That means firefighters will have to contend with more extreme fire weather—including the possibility of clouds created by the blazes themselves.

After getting his hands on a rope driver module from the Apollo project era that had a big ‘Scrapped Module’ stamped on it, [Mike Stewart] was naturally left curious as to what exactly had failed in this module. Originally destined for the Apollo Guidance Computer, these Raytheon-manufactured modules were the pinnacle of space-grade high-tech of the 1960s, with requisite acceptance testing so as to not endanger a very expensive space mission.

The cool part here is that the acceptance documents for the module in question (B16-B17) have been scanned in and can be found on the Internet Archive. With the part itself being potted and very much inaccessible, this document helpfully lays out the expected measurements on the module’s pins, as well as schematics and mechanical drawings. Unfortunately the reasons for the rejection were not recorded, so replicating the failing test results is required to understand the reason.

A slight complication here is that the testing procedure doesn’t just involve hooking up a multimeter for some voltage and capacitance measurements. There are also temperature and voltage extremes, and vibration tolerance involved, which would be somewhat complex to test, but most of all risk damaging a historical artefact. Thus a somewhat conservative testing procedure was chosen, even if this may not reveal the actual fault.

As noted in the video, sometimes modules were also rejected because someone simply dropped it on the floor along the way. However, generally if a module was found to be faulty they would open it to diagnose said fault, with a closer look at this module indeed revealing suspicious marks in the potting compound where it was apparently opened and conceivably repaired. This also might explain why they also put the ‘For engineering use only’ on it.

With multiple of such locations visible in the potting compound, these locations were mapped to the schematics for the module, to get some idea of what may have been accessed. After this, basic testing was performed on the module, as per the acceptance testing document.

Along the way an error was detected in said document, in the form of the wrong pin number. In table 4-2 the input pin 269 was mistakenly listed as having output pin number 169 when it should have been pin 168. Pin 169 is chassis ground, so this was presumably fixed in a later version of the document.

After all the testing with just stationary, room-temperature conditions, everything appeared to check out. This means that likely this was indeed a repaired module that got subsequently used for engineering purposes rather than installed in flight-ready hardware. The only issue found was that channels were out of calibration, but whether this was an original flaw or due to the module being half a century old is hard to tell in the absence of repair logs.

Overall it’s an exciting opportunity to document another part of history, since so many of the details pertaining to these original modules and related technologies got lost or muddled over the decades.

Arista has patched a maximum-severity command injection vulnerability in on-premises VeloCloud Orchestrator deployments that is being actively exploited in attacks.

The vulnerability, tracked as CVE-2026-16812, is an unauthenticated OS command injection flaw with severity scores of 10.0, the maximum score that can be given to flaws.

VeloCloud Orchestrator, also known as VCO, is a centralized management platform used to configure, monitor, and manage VeloCloud SD-WAN deployments and associated edge devices.

According to an Arista security advisory published Monday, the vulnerability allows remote attackers to access privileged functionality that was intended only for internal use and should not be remotely accessible.

“Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator,” Arista warned.

The company says VCO is supposed to be exposed by default, with no configuration option that can prevent this exposure. Attackers only require network access to the VCO web interface, and no VCO tenant or operator credentials are needed to exploit the flaw.

Arista says CVE-2026-16812 was discovered externally and is known to be actively exploited, but has not shared when the attacks began, who is behind them, or how the vulnerability is being exploited. BleepingComputer has contacted the company with these questions.

The following VeloCloud Orchestrator on-premises versions are affected:

• VCO 5.2.x releases before 5.2.3.14
• VCO 6.1.x releases before 6.1.3.4
• VCO 6.4.x releases before 6.4.2.4
• VCO 7.0.x releases before 7.0.0.1

VeloCloud Orchestrator Hosted and Dedicated deployments were patched before the advisory was published and are not affected. VeloCloud Gateway and VeloCloud Edge products are also not vulnerable to the flaw.

The company says the flaw is fixed in VCO versions 5.2.3.14, 6.1.3.4, and 6.4.2.4 and later. The affected software list also indicates that VCO 7.0.0.1 and later releases are not vulnerable.

Arista warns that end-of-support software versions have not been assessed to determine if they are vulnerable. Customers running unsupported release trains are advised to contact the Arista Technical Assistance Center to discuss available upgrade options.

The U.S. Cybersecurity and Infrastructure Security Agency has also added CVE-2026-16812 to its Known Exploited Vulnerabilities catalog, confirming that the flaw is being used in attacks.

CISA has ordered U.S. federal civilian executive branch agencies to mitigate the vulnerability by Thursday, July 30, 2026, as required by Binding Operational Directive 22-01.

Indicators of compromise

While patches are being deployed, administrators should restrict access to the VCO web interface to administrative networks, monitor for connections from known malicious IP addresses, and review recent administrator activity for unusual changes.

Arista shared three IP addresses that were seen exploiting the vulnerability:

• 8.19.75.217
• 206.72.242.124
• 206.72.242.162

Administrators are advised to block these IP addresses and review their logs for previous connections. However, it is possible that devices could have been compromised from other IPs, so this list is not definitive.

Organizations should review VCO logs for signs of exploitation, including:

• Unusual web requests containing encoded characters, URL-like path components, references to local or internal services, or abnormally high request rates
• Connections from known malicious IP addresses
• Unexpected outbound HTTP or HTTPS traffic from the VCO host
• Unauthorized configuration changes or privileged maintenance activity
• Unexpected command execution, file creation, database exports, or archive files
• Suspicious access to VCO databases, configuration data, device inventories, credentials, certificates, or cryptographic keys

If compromise is suspected, organizations should preserve all logs and filesystem timestamps before remediation.

Potentially affected organizations should rotate credentials, review administrator activity, validate managed devices, and consider restoring or replacing compromised instances.

As successful exploitation can compromise both the orchestrator host and the data it manages, installing the security update may not be enough for systems that have already been breached.

Arista warns that compromising a VeloCloud Orchestrator instance could also give attackers access to VeloCloud Edge devices as well.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Peacock Premium will be included with YouTube Premium in the US at no extra cost starting in early 2027. The deal, announced on Sunday by NBCUniversal and YouTube, is Peacock’s largest wholesale distribution partnership to date and immediately expands its reach to millions of existing YouTube Premium subscribers. Peacock Premium currently costs $10.99 per month on its own. YouTube Premium recently increased to $16 per month for individuals and $27 for families.

The bundle gives YouTube Premium subscribers access to Peacock’s full catalogue: NFL Sunday Night Football, the Olympics, NBA, MLB, Premier League, WNBA, and college sports alongside series including The Office, Saturday Night Live, Law & Order: SVU, Love Island USA, and blockbuster Universal films. Subscribers can upgrade to the ad-free Peacock Premium Plus tier. Peacock Premium will also be available as a standalone add-on through YouTube Primetime Channels starting later this summer.

The partnership extends well beyond the bundle. NBCUniversal’s multi-year distribution deal with YouTube TV, the largest and fastest-growing pay TV provider in the US, is renewed. NBC Sports will produce select live sporting events for YouTube. Some live events from NBCUniversal will stream on NBC Sports’ YouTube channel. The deal also expands Universal+ and Hayu to YouTube Premium subscribers in select international markets and deepens the companies’ advertising technology collaboration through FreeWheel. Google has been rebuilding its products around AI and engagement, and bundling a major streaming service with YouTube Premium turns the subscription from an ad-removal tool into a full entertainment package.

Peacock just turned its first quarterly profit, six years after launch. The YouTube bundle accelerates its next growth phase by trading per-subscriber revenue for scale. Alphabet raised its capex guidance to $205 billion this year as it invests across AI and content, and the Peacock deal positions YouTube Premium as a competitor to Apple One and Amazon Prime’s bundled offerings. “This partnership brings NBCUniversal’s world-class content to YouTube’s unmatched scale,” said Comcast co-CEO Mike Cavanagh. For YouTube, the value is retention: subscribers who get NFL, Premier League, and The Office alongside ad-free YouTube are much harder to cancel.

Microsoft said MDASH with MAI-Cyber-1-Flash received a 96 percent score on CyberGYM, a standard benchmark test. The rating is 12 points higher than Anthropic’s Mythos and also beats Google Gemini and OpenAI GPT. The new MDASH costs half as much to use as the previous MDASH offering.

The second tool Microsoft announced on Monday is named Project Perception. It too is a collection of specialized AI agents that perform red-, blue-, and green-team functions for finding vulnerabilities, investigating them to determine their risk, and taking corrective actions, respectively. Microsoft said the platform selects the models to use based on the assigned task. Considerations that go into the decision include the model’s effectiveness and the end cost to the customer. Microsoft said the decisions are shaped by “ongoing research, benchmarking and evaluation across frontier and specialized models.”

Microsoft said Project Perception is designed to perform 90 percent of tasks for lower costs than similar platforms from competitors. That means customers can turn to the more expensive alternatives only for the remaining 10 percent of tasks.

Microsoft said the new tools respond to a seismic shift in how organizations secure their networks against catastrophic hacks.

“As AI accelerates the speed and scale of cyberattacks, defenders are being asked to secure increasingly complex digital environments with approaches built for a different era,” the company said. “Security teams are often forced to piece together signals, context, and risk insights across vast amounts of data, making it harder to keep pace with emerging threats.”

With last week’s OpenAI incident evoking troubling scenes straight out of the most dystopian sci-fi novels, the tools, which are currently in preview mode, deserve a healthy dose of caution that Microsoft made no mention of. They should be closely scrutinized and evaluated before being used in production. On the other hand, there are clear risks for not adopting such tools. Balancing the risks of using AI agents versus the threat of avoiding them is a work in progress with no clear answers for now.

Apple’s iOS 26.6 update stops attackers from using iPhone Mirroring, Siri, and more to gain user data. Here’s what you need to know.

On Monday, just under a month following the arrival of the security-focused iOS 26.5.2, Apple made iOS 26.6 available to the general public. The latter includes over 75 security enhancements, 14 of which address kernel-related vulnerabilities.

10 of the now-patched kernel issues allowed apps to trigger unexpected system terminations, while others let apps access sensitive user data and write kernel memory. Apple resolved these issues through improved memory handling, memory management, state management, bounds checks, and more.

The iOS 26.6 fixes that keep your data safe

Additionally, iOS 26.6 prevents attackers from using iPhone Mirroring to access sensitive user data, as an Accessibility issue was resolved through state management improvements. Similar App Store and FrontBoard issues were resolved through improved checks and the use of HTTPS, respectively.

iOS 26.6 contains multiple fixes that protect user data.

Apple also stopped apps from accessing user information through Game Center by improving data protection. Enhanced state management was used to fix similar Managed Configuration and WorkoutKit vulnerabilities.

iOS 26.6 also removed vulnerable Siri code, resolving an information disclosure issue that gave apps access to sensitive information about the user. Entitlement checks were employed to fix an NSColorPanel issue, once again preventing apps from leaking user data.

The Contacts app received three security enhancements as well, as processing a maliciously crafted contact will no longer leak sensitive user data, thanks to the iOS 26.6 update. Additionally, apps can no longer add contacts without user authorization, thanks to validation improvements.

How iOS 26.6 stops apps from gaining root access

Apple also took security measures to ensure that attackers with physical access to locked devices can’t gain user data, as the company fixed a DriverKit and Wi-Fi issue.

iOS 26.6 prevents DOS attacks and stops apps from gaining root privileges.

iOS 26.6 also addresses a significant MediaRemote issue. The now-patched path handling vulnerability gave apps root privileges. Similarly. the iOS 26.6 update contains an Apple Books fix that prevents apps from accessing protected parts of the filesystem.

Multiple Model I/O issues were resolved as well, meaning that remote attackers can no longer cause unexpected app crashes on iOS 26.6. Three now-patched Scene I/O exploits enabled arbitrary code execution.

Apple also took measures to prevent apps from escaping their sandbox. The company did so by resolving Game Center and libc vulnerabilities with improved path validation and input validation, respectively.

Safari and WebKit fixes in iOS 26.6

Monday’s iOS update also stops apps from using a WebKit issue to escape their sandbox. In total, iOS 26.6 contains eight WebKit fixes, meant to keep your data safe while browsing the web.

iOS 26.6 contains multiple WebKit fixes.

Notably, iOS 26.6 includes a fix that stops websites from knowing the user visited a specific link. Apple also made UI improvements, as maliciously framed websites were found to spoof select UI elements.

As for the other WebKit patches, one of them prevents denial-of-service attacks, while two prevent Safari crashes on iOS 26.6. Apple similarly included fixes for mDNSResponder and Heimdal to prevent denial-of-service attacks.

Monday’s software update contains a multitude of security enhancements. As Apple’s website notes, fixes for Pro Res, WebRTC, AuthKit, the Apple Neural Engine, and more are present in iOS 26.6.Unlike other iOS releases, however, iOS 26.6 doesn’t include fixes for vulnerabilities that were used in targeted attacks.

Even so, AppleInsider recommends installing it to ensure your devices have the latest security enhancements. Unlike the iOS 27 developer betas, which may contain bugs, glitches, and performance issues, the iOS 26.6 update should be installed by all users.

On Sunday, Microsoft CEO Satya Nadella doubled down on the shocking warning he issued earlier this month to businesses that use AI, taking it a step further this time. Companies that rely wholly on the proprietary AI labs for their AI needs ultimately won’t survive, he predicts.

That’s what he said on CNN’s “Fareed Zakaria GPS.” When Zakaria asked Nadella to explain what constitutes a company sharing too much with an AI model provider, Nadella said businesses need to be wary of everything they hand over, from their data to their prompts.

Nadella called for a setup where “every time you use the model, all of the metadata around it is retained by you, so that you could use all of that to train perhaps your own weights or your own open model.” (Weights are a model’s trained parameters — essentially its brain. Nadella’s point: Companies should hold on to their own usage data so they can eventually build a model of their own.)

“Any firm that doesn’t have this control, I will claim will not remain a firm because you’ve essentially outsourced your thinking,” he added.

In short: Companies without their own models — or without a layer of AI infrastructure known as AI gateways to separate their prompts from the model itself — will be in trouble, Nadella says.

He specifically wants companies to stop relying on AI labs’ built-in coding tools, known as harnesses.(Anthropic’s Claude Code and OpenAI’s ChatGPT Codex are examples of these.)

“By keeping the harness separate from the model and the context and memory separate from the model, you absolutely can use multiple models for what they’re great at. At the same time, any one model can go away, and you can still continue to be in control of your own destiny,” Nadella said.

Mind you, Microsoft is an investor in the two largest AI labs, Anthropic and OpenAI. Coding agents are a particularly popular way for enterprises to use AI models and by all accounts are earning the model makers gobs of money.

And yet, Nadella is telling enterprises not to rely too heavily on them. Microsoft, naturally, would benefit from that warning, as its cloud business is now also selling the kind of alternative infrastructure he’s recommending.

Despite the obvious self-serving fear tactic, he’s not wrong. Enterprises are increasingly realizing that they need many model options, particularly cheaper options, and are turning to open-weight models — models whose underlying code is publicly available — that they can fine-tune and run on their own hardware. That, in turn, means they will also need ways to manage multiple models, as well as coding agents that aren’t tied to a specific model provider.

But Nadella’s observation isn’t just about runaway budgets. He anticipates that once a company has “outsourced its thinking” to a model, there’s little to stop the AI lab from eventually offering a competing service of its own. This risk grows as enterprises adopt AI agents and give them access to the innards of the company.

It’s the kind of warning that the startup industry has been shuddering about for years: What’s to stop model makers from wiping out startups by copying and competing with them?

In May, for example, when OpenAI CEO Sam Altman offered to invest in every Y Combinator startup in its latest cohort by offering them AI credits, seed investor Jason Calacanis issued a similar buyer-beware, posting: “If you take these tokens, there’s a non-zero chance that OpenAI will study exactly what your startup is doing, copy your idea and put your app into their free offering. This is the classic platform playbook — be careful, founders!” he posted.

Now Nadella is making that same case to enterprises.

One caveat: Nadella’s concern about oversharing with AI models applies only to businesses — not individuals. When Zakaria specifically asked Nadella how everyday people could protect themselves, Nadella shrugged it off, saying that sharing data is simply the price consumers pay for using a service, especially a free one.

“To some degree there’s got to be some value exchange in the consumer space where you’re getting something for free, maybe for your data. That’s sort of how the advertising business model has worked,” Nadella said.

Photo credit: Kelsonik
Nikita Chuicko works under the name kelsonik and spends his time turning existing cars into the versions manufacturers never quite got around to building. His latest set of renderings takes the Tesla Model S and stretches it into a shooting brake while adding a full widebody kit. Everything is finished in solid black, the stance is dropped, and the proportions feel deliberate rather than forced.

Tesla has finally closed the book on the Model S and Model X, but it has left a tiny window open to make one last shot at a limited Signature Series of the two cars, complete with Gold badges and a price tag to match, before moving on to the next thing. Chuicko, on the other hand, saw and appreciated a chance. As far as he could tell, the shape of that iconic vehicle still had life in it. So he preserved the Model S design but went a little further with the roof, elevating it well over the back axle and squaring off the back end to give it a functional hatch, ultimately changing it into a car that sits somewhere between a grand tourer and a high-speed hauler.

Amphibious Remote Control Car, 1:18 Monster Truck Toys for Boys RC Cars, 2.4 GHz Waterproof RC Trucks…

• 2.4 GHz Remote Control Car – 1:18 scale cool design, waterproof RC truck toys made of premium material and sturdy, with LED lights, waterproof remote…
• High Quality & DIY Removable Toys RC Cars – This remote control monster truck structure design quality, flexibility and strength in one. The rc truck…
• All Terrain Amphibious Monster Truck – 4-wheel drive off-road design rc trucks for kids, with high-quality tires (shock absorption, strong grip…

Out front, the design is reminiscent of the newer Model Y, with two independent headlights flanking a continuous LED light strip that spans the entire front of the vehicle. The bumper is nice and low and clean, with just enough going on to keep the face from looking plain, and then there are those enormous front wheel flares that push the front wheels out and give it a planted aspect even when it’s just sitting in the driveway. The Black concave Y-spoke wheels, which run way down into the flares, help to secure those wheels.

Along the sides, the extra width stands out. The size of the flares suggests that they are structural rather than purely aesthetic. There is still a high beltline that protects the glass area from looking stretched out, as well as a modest small roof spoiler that sits right above the back window. That spoiler works in tandem with the second one positioned on the hatch. At the back, there’s a translucent full-width LED light bar that runs down the tailgate, lit in a mellow crimson that really shows out against the matte black paint. Then, beneath that, there is this quite aggressive diffuser that caps off the edge of the lower paneling and connects the entire rear track.

The entire car is finished in a single deep black color that absorbs light rather than reflecting it back out. There are no bright particles to be found breaking up the surface. The end effect is a car that is both silent and hefty, with a finish that makes the extra width appear to be there by design. Looking at it from the back three quarters, you can see that the elevated roof, two spoilers, and flared arches give the car a low, purposeful appearance while still allowing for a load behind the rear seats.
[Source]