7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files.

The vulnerability, disclosed by Lunbun researcher Landon Peng, exists in 7-Zip’s processing of XZ-compressed data.

According to an advisory from the Zero Day Initiative, specially crafted XZ data can trigger a heap-based buffer overflow, potentially allowing attackers to execute arbitrary code as the user.

While the developer has not published technical details about the flaw, the changes in the 26.02 source code suggest it is related to how 7-Zip tracks available space while decompressing XZ data.

The patch adds checks to ensure the decoder cannot write beyond the remaining available space in an output buffer, helping prevent a heap-based buffer overflow.

The advisory states that exploitation requires user interaction, such as visiting a malicious page or opening a malicious archive file.

No automatic update feature

As 7-Zip does not include an automatic update feature, users will not receive the security fix automatically. Instead, they must install it manually by downloading the latest version from the program’s official site, 7-zip.org.

Because 7-Zip is one of the most widely used archive utilities on Windows, security flaws impacting its archive features are an attractive target to threat actors.

A phishing campaign or social engineering attack could be used to distribute a malicious archive that exploits the flaw to install malware on vulnerable systems.

This is not far-fetched, as archive vulnerabilities, including those in 7-Zip, have been exploited in past attacks.

In early 2025, a 7-Zip vulnerability that allowed malware to bypass Windows’ Mark of the Web (MotW) security feature was exploited by Russian hackers as a zero-day.

Later that same year, a Russian hacking group exploited a WinRAR vulnerability tracked as CVE-2025-8088 via phishing attacks to install the RomCom malware.

There are currently no reports that attackers are actively exploiting this newly disclosed 7-Zip vulnerability.

However, users are advised to update to version 26.02 as soon as possible to reduce the risk of future attacks.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

How Apple Watch water lock works

Christine Persaud for Engadget

Why use Water Lock on Apple Watch

Christine Persaud for Engadget

Strands is the NYT’s latest word game after the likes of Wordle, Spelling Bee and Connections – and it’s great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc’s Wordle today page for the original viral word game.

Brits bought 384 Chinese-made vehicles in 2015. Last year, they bought 285,000, according to automotive consulting firm Mobility Global. The growth is accelerating. BYD nearly doubled its UK sales in the first half of 2026 to over 37,000 units, and Chinese brands collectively hold roughly 13% of new car registrations in Britain, double their share a year ago.

The reason is a tariff gap. The EU charges countervailing duties of up to 35.3% on Chinese battery-electric vehicles and is preparing additional tariffs on plug-in hybrids. The US charges 100%. The UK charges neither. Britain applies no additional tariff on Chinese plug-in hybrid vehicles, which has made it the easiest major Western market for Chinese automakers to enter at scale. “It becomes an excellent size market that’s progressing well towards electrification and is in demand for some cheaper vehicles with that void to fill,” said Will Roberts of Benchmark, an automotive consultancy.

The price gap is stark. A Volkswagen Tiguan plug-in hybrid built in Germany sells in the UK for just over £43,000 ($58,000). The BYD Seal U built in China costs almost £10,000 less. Buyers at a Geely dealership in Maidstone told CNBC the value proposition was obvious: better equipment, lower price. Canada opened its market to Chinese EVs in January with a 49,000-unit cap, but the UK’s approach is more permissive, with no quota and no additional duties.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

China’s domestic auto market is cooling. Retail sales fell 26% in the first half of 2026 while exports rose 72%, according to the China Association of Automobile Manufacturers. That export surge has to go somewhere. Former GM board member Jon McNeill told CNBC that Chinese automakers are entering Europe “with really attractive cars at really attractive prices with technology that sort of blows away what they can buy from a European manufacturer.” Geely has already stopped building new factories and is using Volvo’s existing plants instead to sidestep tariffs and absorb overcapacity. The UK’s open door may not last: if Chinese market share keeps climbing, pressure to align with EU tariff policy will follow. For now, 285,000 cars in a single year tells its own story.

Waymo says robotaxi service has resumed after it made “temporary adjustments” in San Francisco amidst a power outage that appears to have affected around 7,000 PG&E customers in the city.

According to a screenshot posted on social media, Waymo told SF customers that service was “temporarily paused” and that “freeway routes are unavailable.”

When TechCrunch reached out to the Alphabet-owned company for comment, a spokesperson said in a statement, “We are making temporary adjustments to our service while we monitor local conditions. We know riders depend on us, and we will return to normal operations as soon as possible.”

Following the initial publication of this article, a Waymo spokesperson added that the company “decided to pause service for approx. one hour to assess the scale of the power outage affecting a large portion of San Francisco and coordinate with local officials.”

Power outages have affected Waymo service in the past, for example when a number of Waymo vehicles stalled on city streets during a blackout in December, and when a similar incident paralyzed traffic during a Golden Gate Bridge fireworks show on the Fourth of July.

As a result, San Francisco Mayor Daniel Lurie has called for tougher state regulations to “adequately address how autonomous vehicles operate during major incidents, planned or not.”

This post has been updated with additional comment from Waymo reflecting that service has resumed.

Unlike most cutting lasers, femtosecond lasers don’t vaporize materials; rather, they produce such short, intense bursts of light that the affected region is ablated without having the chance to heat its surroundings. This makes them good at cutting away material without damaging the surroundings, something [Ben Krasnow] exploited to cut cross-sections of samples while still in a scanning-electron microscope.

In this case, the samples were crickets, and before imaging they had to be prepared. First, the bodies were soaked in glutaraldehyde to cross-link the proteins and stabilize the structure. Next, a series of solvent exchanges replaced the water in the bodies with a low-surface-tension solvent; this meant that during the next step, drying, surface tension wouldn’t distort the crickets’ internal structure. Finally, the insect bodies were charred under argon, which made the bodies conductive and more absorptive to laser light.

The laser itself and the scanning galvo are mounted outside the microscope, and shine in through a transparent window. To protect the detector and electron optics from a spray of ablated carbon, a servo motor swings an aluminium shutter between these and the sample while the laser is active. This caused some mysterious problems during testing: after the first ablation run, the electron microscope’s image would contain so much noise as to be unusable, but it would improve over time. As it turned out, the shutter was painted, and the other side of the paint was getting coated with charged carbon particles. This created a small capacitor which disrupted the electron optics as it discharged. Eventually, after solving this and a few other strange problems, [Ben] was able to take several time-lapse videos of the laser gradually ablating a cricket, 30 microns at a time, revealing its inner structure.

Although scanning-electron microscopes are unfortunately shard to come by, it’s still possible to restore a secondhand microscope or, as [Ben] did, build your own. Femtosecond lasers are yet more inaccessible, though they can be used to replicate themselves.

AI chatbots are everywhere these days, and they seem to “know” about everything. But while that is a strength, it can sometimes be a weakness because it isn’t laser-focused on one topic. Not so with this Ham-radio-centric chatbot called HamGPT. The service is clearly built on another GPT engine but understands how to retrieve data from common ham radio sources, such as the FCC database, propagation reports, and the like. It didn’t, however, seem to have access to ham radio-related books, magazine articles, or other “static” data that we could tell.

You do have to sign up for an account, which includes providing your callsign and location. There is a free tier that allows a limited number of queries per day, so you can try it to see if it is useful for you without subscribing.

Here’s a typical session:

                What band will have the best propagation to Japan from my QTH right now?

The best band for Japan from your QTH right now is 30 meters, which shows good propagation reliability. 20 meters is also active and providing a viable path.

Advertisement

Real-time data confirms activity on both bands, primarily using FT8. While the path is open, the signals are relatively weak (typical for this long-haul path), making digital modes like FT8 or CW your best bet for a successful contact.

Would you like me to check if your current antenna setup is suitable for these bands, or perhaps help you calculate dimensions for a 30m or 20m antenna?

In addition, bubbles at the bottom of the screen showed me the busiest band in my area and how many repeaters were nearby.

In all fairness, we asked ChatGPT the same question, but did say “ham radio band” just to give it some idea of scope. It gave a much more detailed answer with sources, even provided headings, and made a suggestion about another location I sometimes operate from because it remembers things from previous unrelated chats.

We understand reactions will be mixed. If you’ve been a ham for a long time, you probably could have guessed that a path from the US to Japan in the morning was likely to be on 20 or 30 meters. You probably also know how to look things up yourself.

We didn’t try any more sophisticated queries that might make it more worthwhile. For example, what if you could send it an ADIF log file and ask it what awards you qualified for? Or to process contest logs for duplicates and fill out a scoring worksheet? What would you like a ham radio-aware AI to do for you?

Ham radio — at least parts of it — has become inextricably linked with computers.