Open your phone’s storage settings, and there’s a good chance Spotify is sitting near the top of the list, holding on to gigabytes you never agreed to give it. It’s one of those small annoyances that you only notice when your phone starts nagging you about running out of space.

Thankfully, it looks like Spotify has finally noticed it too. Android Authority has dug into the Spotify app and found signs of a new Cache Limit feature that puts you in charge of how much space Spotify’s temporary files can occupy on your phone.

Why is Spotify hogging so much storage?

Every time you play a podcast or a song, Spotify saves some of that data, along with the artwork, on your device. This keeps playback smooth and cuts down on data when you replay something. The catch is that you can’t control any of it. Your offline downloads are kept elsewhere, but this hidden stash keeps piling up until it’s taking gigabytes of your storage.

With memory prices climbing and bigger storage options costing a small fortune, that wasted space really stings. Yes, you can wipe it yourself from Settings → Data saving & offline → Clear cache, but repeating that chore over and over is tiring. Spotify fans have been asking for a fix on Reddit and the official forums for close to ten years now.

How will the new cache limit work?

The code, found by Android Authority in Spotify for Android v9.1.88.815, points to a new menu where you pick the maximum space the cache is allowed to use. Pick a tiny number, and you’ll see “A small cache may affect playback and increase data usage.” Pick a bigger one, and it tells you, “A larger cache means smoother playback and less data usage.” There’s also a “Spotify recommended” option if you’d rather not decide.

You’ll also be asked to choose a limit right after clearing your cache. The best part is that your saved songs and podcasts stay safe no matter what number you pick. For now, Spotify hasn’t said a word about it, and you can’t use it yet. Beta testers will probably get it first, followed by everyone else. I’m hoping it shows up soon, because my phone could use the extra space.

Imagine posting something critical of the government, watching your reach quietly evaporate, and never being able to prove it wasn’t organic.

X just killed that uncertainty. The platform is expanding its “Under the Hood” tool to show users exactly when a government legal demand choked their post’s reach. It will even show users which country made the request.

So how does this actually work?

X rolled out a transparency feature in August 2026. As part of the feature, the platform already allowed eligible users (those with at least 10 posts in the last month) to download a JSON file showing whether their account or any post had its visibility reduced at the request of a government body. 

Now, that file also names the exact posts withheld, along with which government made the request. This level of detail remains unmatched, even compared with popular social media platforms. 

Even if you’re a non-technical user, you can drop the file into an AI chatbot and ask it to explain in simple words (one of the AI use cases I don’t condemn). 

Who does this actually matter for?

In my opinion, the real weight of the change will fall on journalists, activists, and dissidents in countries where governments regularly lean on platforms to bury inconvenient posts and silence critics.

This isn’t hypothetical: X itself lost a 2023 court battle in India over stalled compliance with blocking orders and paid roughly a $60,000 fine, proving these legal demands are frequent, real, and previously invisible to the people they targeted.

Governments use everything from hate-speech statutes to election rules and terrorism laws to request (or even order) these takedowns. However, free-expression groups warn that authoritarian regimes often use the same laws to muzzle political dissent.

Arista Networks has released security patches for a zero-day flaw that is being actively exploited and affects VeloCloud Orchestrator (VCO) On-Prem deployments.

VCO is a cloud-based centralized management platform that helps admins configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices.

Tracked as CVE-2026-93952, this maximum-severity flaw stems from an improper input validation weakness and affects VCO deployments where certificate-based authentication from the VeloCloud Edge to VeloCloud Orchestrator (VCO) is configured.

Remote threat actors can exploit the vulnerability to access privileged internal VCO host functionality in low-complexity attacks that don’t require privileges on the targeted system or user interaction.

“This issue was discovered externally and is known to be actively exploited,” the company warned in a Tuesday advisory. “Access to the public portion of the VeloCloud Edge authentication certificate is required. A successful attack requires network access to the VCO web interface. VCO tenant or operator credentials are not required for this exposure.”

Arista says that it has already patched hosted deployments running VCO 5.2.3.16 or later and VCO 6.4.2.8 or later and that it will also release security patches for VCO instances running 6.1.3.7 and below and 7.0.0.2 and below.

The U.S. Cybersecurity and Infrastructure Security Agency has also added CVE-2026-93952 to its Known Exploited Vulnerabilities catalog on Tuesday and ordered U.S. federal civilian executive branch agencies to secure their networks by Friday, September 25.

Indicators of compromise

While security patches are being deployed, admins should restrict access to the VCO web interface to administrative networks, review recent administrator activity for unusual changes, and monitor for connections from known malicious IP addresses.

Admins should review VCO web access logs for suspicious activity, such as requests containing encoded characters, unusual URL-like path components, references to local or internal services, or high request rates.

Arista also advised security teams to block the 142[.]93.149.77 and 104[.]248.126.159 IP addresses and review nginx logs for the x-vc-opt HTTP header, and said that unexpected outbound HTTP or HTTPS activity originating from the VCO host may also warrant further review.

“If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible,” it added, and advised customers to contact the Arista Networks Technical Assistance Center (TAC) if they need additional assistance.

Since the start of the year, Arista patched two other zero-day flaws (CVE-2026-7473 in May and CVE-2026-16812 in July) that were being actively exploited in attacks and affected Extensible Operating System (EOS) and on-premises VeloCloud Orchestrator deployments, respectively.

Arista Networks is a Fortune 500 company and one of the largest United States corporations by revenue, with more than 10,000 customers worldwide.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Eight Sleep, a sleep tech company, launched the Pod 6 bed-cooling system on Wednesday with meaningful hardware changes, including a hub that’s half the size of its predecessor, new solo-size configurations and a $1,999 starting price for the solo sizes — the lowest the company has offered. The entry price for standard sizes will be $2,699.

“We redesigned the hub, so it is 50% shorter than Pod 5, while increasing thermal power. That requires a more efficient approach to the system’s internal architecture, thermal management, fluid movement and overall packaging,” Matteo Franceschetti, CEO and co-founder of Eight Sleep, told CNET. The smaller hub can slide under most standard bed frames.

For the first time since the Pod launched in 2019, customers can choose solo-size options like twin XL and half sizes for queen, king and California king. Until now, the Pod has been built for couples with standard mattress sizes. 

“For six generations, the Pod’s dual-zone design has been extremely valuable for couples, because each person can independently control their temperature and receive their own sleep data. But there are many people who want that same experience for just one side of the bed, or in a bedroom with a twin XL or split-mattress configuration,” Franceschetti said.

The Pod 6 has 80% more sensors per side and AI-powered tracking for more accurate sleep insights. The redesigned hub delivers 40% to 50% more thermal power for faster temperature response. 

Eight Sleep

Franceschetti said that the main advantage of having more sensors is improved precision and consistent tracking across different sleep positions. “People move throughout the night, and a higher density of sensors gives the system more opportunities to maintain a reliable signal, whether someone is on their back, side or shifting position.”

With these updates, the Pod 6 aims to make advanced sleep technology more accessible and versatile for individual sleepers and couples alike.

Nasha Addarich Martínez

Managing Editor

Nasha is the Head of Editorial Initiatives for CNET. She leads the development and execution of proprietary data-based franchises like Labs Exclusives and People’s Picks. She is an active writer and contributor to CNET’s health and wellness, personal care and beauty tech verticals. Throughout her career, she’s covered various topics including financial services, technology, travel and wellness.

See full bio

Advertisement

Matty Benedetto of Unnecessary Inventions just found a new way to turn a quiet night with a cold can into something that stares back at you. Out of his Burlington, Vermont studio he just finished invention number 469, a little digital pet he calls the Buzz Buddy that perches on top of any standard beer can and matches you drink for drink. The unit is a compact, egg-shaped screen housing with a pixel character already seated at a tiny desk, waiting. Once you crack the tab the figure stays put until the first tilt.

A small motion sensor concealed at the bottom of the can keeps track of each swig. Every time the can leaves the table, Buddy’s buzz meter starts ticking upwards. At first, the guy appears to be doing well, sitting up straight, but as the sips pass, he begins slouching, his demeanor changes, and he progresses through a series of increasingly sloppy stages. If you ignore the can for long enough, the buzz meter drains and he snaps out of it, returns to his normal posture, and simply waits for the next can lift. Benedetto devised the cycle so that the small boy never becomes entirely intoxicated on his own.

Sale

Bitzee Interactive Toy & Digital Pet, Ages 5+

• DIGITAL PET YOU CAN TOUCH: Bitzee goes beyond the 2D screen; it’s the virtual pet you can really touch and feel in our 3D world. Each Bitzee toy pet…
• NURTURE & PLAY: Bitzee pets need your love and care. Each Bitzee starts as a baby – feed and play with them, rock them to sleep and give them love…
• 15 TOY PETS IN 1 POD: The more you play, the more Bitzee pets you’ll unlock. Use treats to attract a new Bitzee pet. Collect all 15 interactive…

When you tap your phone’s screen, this little guy starts dancing. Swipe down for a stats overlay, which will show you the beers you’ve opened that session, the number of drinks he’s taken, and how many times you’ve made him bust a move. When you finally drain the last drop from the can, he transforms into his final form, and it’s rather amusing to see a person who doesn’t seem to want to leave the party ever again. The whole thing is built so that you can’t simply drink in silence.

Benedetto has spent seven years translating everyday jokes into full-fledged objects that seem like they belong in a storefront. Except for the occasional video, the majority of them never leave his studio. The Buzz Buddy follows the same pattern: 3D-printed shell, custom artwork, a functional sensor, and a presentation that takes the joke very seriously. He normally posts the finished item the same week he finishes it, usually in the form of a short video of the pet waiting, reacting, evolving, and celebrating the empty can.

Anyone who grew up with the original Tamagotchis will recognize the “care and neglect” loop. Simply drink to nurture it, then ignore it by leaving the beer alone. Swipe your device to check the ‘vitals’. Benedetto merely replaced hunger hearts for buzz meters and hanged them all on the one object you already had in your grasp.

Cutting corners: Meta wants Muse to take everyday chores off your hands, but some of that AI has involved actual people. The company has been testing a human concierge service that lets contractors handle calls for its new personal AI agent, raising privacy concerns among its own employees.

According to Reuters, the experiment was enabled for half of Meta’s employees last week, with an opt-out group available. Staff warned that sensitive information could end up with call-center contractors. A Meta executive acknowledged that introducing human operators without clear disclosure was a mistake, and the human concierge feature has been rolled back for now.

There was also an incident that highlighted another potential problem with handing the calls to humans. One employee who asked Muse to call an internet and cable provider to negotiate his bill said a transcript showed that the contractor had made a racist reference during the call. Meta apologized to the employee and said the human agent involved would not work on any of its projects again.

Muse’s separate phone-calling feature allows users to contact US businesses for tasks such as booking haircuts or checking whether an item is in stock.

– Alexandr Wang (@alexandr_wang) September 16, 2026

Meta spokesperson Daniel Roberts said employee feedback had been largely positive. He added that the company would only release the potential feature publicly once it was ready, with appropriate disclosures and safeguards.

Launched on September 8, Muse is Meta’s attempt to turn the chatbot into something closer to a personal assistant. Users can interact with it through its own app or WhatsApp, asking it to send emails, arrange travel, and work toward longer-term goals.

Meta says the agent runs inside a dedicated virtual machine, with a separate Sentinel agent checking outgoing actions. Users control connected services and approve sensitive steps, including purchases. The company also says conversations and data stored in that virtual machine are kept out of its advertising systems.

Meta’s own testing suggests why it is experimenting with humans in the first place. Some businesses simply hang up on Muse when they realize they are talking to an AI, which is no surprise. Internal tests found that handing calls to human agents could increase the success rate to between 95% and 98%, compared with a much lower rate for calls handled entirely by AI.

There have been plenty of examples of supposedly automated services relying heavily on humans behind the scenes. One of the most memorable was shopping app Nate, which claimed AI could automatically complete online purchases. According to the Department of Justice, hundreds of workers in call centers in the Philippines and Romania were actually completing many of the transactions manually. Sources previously claimed that between 60% and 100% of purchases were handled this way during parts of 2021.

Amazon’s “Just Walk Out” stores offered another example. The supposedly cashierless technology relied on more than 1,000 workers in India to review transactions and label footage. It was reported that around 700 out of every 1,000 purchases required human review as of 2022, although Amazon disputed those figures.

In 2023, Presto Automation revealed that around 70% of orders handled by its AI drive-thru system required intervention from off-site human agents, including workers in the Philippines.

Meta’s been here before with Facebook M, the digital concierge launched in closed beta during the summer of 2015 and shut down a few years later. Every message the service fielded was reviewed by contractors who worked at the company’s Menlo Park headquarters, but at launch, Facebook said the service was powered by AI trained and supervised by real people.

For its part, Meta is openly testing human assistance rather than claiming that contractors do not exist. But if a feature is marketed as an AI making calls on your behalf, users will probably want to know when the person actually doing the talking is sitting in a call center.

The abolition of the Department for Science, Innovation and Technology has created uncertainty about what happens next to Britain’s AI ambitions.

Kanishka Narayan’s promotion to Minister for AI gives the technology a dedicated voice at Cabinet, yet folding DSIT’s responsibilities into other departments raises questions about how the Government will coordinate the infrastructure, investment and public-sector adoption needed to support those ambitions.