The revelation that Apple’s iCloud Private Relay feature hasn’t been as secure as Apple says has spawned a lawsuit against the iPhone maker.
Last week, a blog post by Talal Haj Bakry and Tommy Mysk exposed a vulnerability in how iCloud Private Relay, in some circumstances, doesn’t shield a customer’s IP address, which is the entire purpose of the feature. Even when it’s enabled, their information can be exposed when using a passkey to sign in or when a website uses two methods (DNS prefetching and WebTransport) to load data faster.
In a complaint filed by Clarkson Law Firm on Aug. 6, plaintiff Edward Rickman says he subscribed to iCloud Plus believing that iCloud Private Relay would hide his IP address and Safari browsing activity.
“Instead, Apple delivered a system that recreates through its own credential service the precise harm Apple told the world it had made impossible,” reads the complaint, which seeks class action status.
Advertisement
The lawsuit also seeks an injunction against Apple requiring it to change its business practices to mitigate the risk of consumer deception, as well as monetary relief and attorneys’ fees.
An Apple representative didn’t immediately respond to a request for comment.
Craig Federighi, Apple’s senior vice president of software engineering, describes new privacy features at an Apple event.James Martin/CNET
A core component of the lawsuit is that iCloud Private Relay is a paid service of iCloud Plus, which costs between 99 cents and $60 per month. The feature is available only if you’re subscribed to iCloud Plus, not the basic iCloud service.
Also key is the fact that Apple has advertised for years that iCloud Private Relay is a safe way to browse the web and avoid the types of tracking that services such as Facebook use to connect people’s browsing habits and assemble profiles on them that can be monetized.
“Apple built its entire brand on the promise that it would protect its users’ privacy when no other company would,” Tim Giordano, a partner at Clarkson Law Firm, said in a statement. “For Apple’s iCloud users to now learn that for years they were paying Apple a premium for a protection that simply didn’t work, exposing them to the very tracking, profiling and targeting Apple warned them about, is an outrageous violation and betrayal of consumer trust and law.”
Advertisement
Clarkson recently won a $250 million settlement from Apple over the company’s marketing of AI features for the iPhone 16 Pro that were never delivered.
The researchers who discovered the flaw set up a website that lets anyone check whether iCloud Private Relay is protecting their IP address. They say they released the information publicly rather than first alerting Apple because of the company’s lengthy review process.
The information in the red box was the IP number of my home router.Screenshot by Jeff Carlson/CNET
In an email to CNET, Mysk wrote, “If we had a better experience with the Apple Security Bounty program that would make us feel confident the issue would be addressed promptly for the benefit of iCloud Private Relay users as well as Psylo users, we would have reported this iCloud Private Relay issue to Apple without having to release a Psylo update addressing the issue, and as a result having to disclose it to our users.” Psylo is the developers’ privacy-focused web browsing app.
Jeff Carlson
Senior Writer
Jeff Carlson writes about mobile technology at CNET, from cellular phone plans to devices and emerging technology.
See full bio
Regions such as Galicia, Asturias, Castile and León, Madrid, Aragon, Catalonia, the Valencian Community, and the Balearic Islands experienced the path of totality, while the rest of the country saw a partial eclipse.
The solar corona glows as the moon completely blocks the sun during the totality phase, as seen from San Asensio in the La Rioja region.
Photograph: Ander Gillenea/Getty Images
The event lasted about four and a half hours, while the total darkening of the sky lasted just under two minutes, allowing various space agencies to conduct scientific experiments along the path of totality.
Fans of Real Madrid watch the solar eclipse through special glasses before the Teresa Herrera Trophy match between RC Deportivo A Coruña and Real Madrid at Riazor Stadium.
Advertisement
Photograph: José Manuel Álvarez Rey/Getty Images
One of the most notable projects involved a NASA mission tracking the moon’s shadow using a WB-57 high-altitude research aircraft that flew at 50,000 feet. A team of scientists sought to gather new data on the dynamics of the solar corona—the sun’s outermost atmosphere—which can only be studied in detail during total eclipses.
A new NYT Strands puzzle appears at midnight each day for your time zone – which means that some people are always playing ‘today’s game’ while others are playing ‘yesterday’s’. If you’re looking for Wednesday’s puzzle instead then click here: NYT Strands hints and answers for Wednesday, August 12 (game #892).
Strands is the NYT’s latest word game after the likes of Wordle, Spelling Bee and Connections – and it’s great fun. It can be difficult, though, so read on for my Strands hints.
Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc’s Wordle today page for the original viral word game.
Advertisement
SPOILER WARNING: Information about NYT Strands today is below, so don’t read on if you don’t want to know the answers.
Latest Videos FromTechRadar
Advertisement
NYT Strands today (game #893) – hint #1 – today’s theme
What is the theme of today’s NYT Strands?
• Today’s NYT Strands theme is… Coming in hot
NYT Strands today (game #893) – hint #2 – clue words
Play any of these words to unlock the in-game hints system.
CRIED
SALE
FORT
BRAND
ROVER
EVENT
NYT Strands today (game #893) – hint #3 – spangram letters
How many letters are in today’s spangram?
• Spangram has 9 letters
Advertisement
NYT Strands today (game #893) – hint #4 – spangram position
What are two sides of the board that today’s spangram touches?
• First side: left, 1st row
• Last side: right, 4th row
Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON’T WANT TO SEE THEM.
Advertisement
Advertisement
NYT Strands today (game #893) – the answers
(Image credit: New York Times)
The answers to today’s Strands, game #893, are…
FIERCE
HEATED
TORRID
INTENSE
ZEALOUS
SPANGRAM: FIREBRAND
My rating: Hard
My score: 2 hints
I don’t think I have seen a game that featured so many non-game words, which is possibly why I found it so hard to find the words we were actually looking for.
Sign up for breaking news, reviews, opinion, top tech deals, and more.
This, though, is what hints are for, although it took me two before I understood that today’s game had nothing to do with heating and everything to do with attitude.
Advertisement
Yesterday’s NYT Strands answers (Wednesday, August 12, game #892)
GIVE
DONATE
ENDOW
BESTOW
CONTRIBUTE
SPANGRAM: PHILANTHROPY
What is NYT Strands?
Strands is the NYT’s not-so-new-any-more word game, following Wordle and Connections. It’s now a fully fledged member of the NYT’s games stable that has been running for a year and which can be played on the NYT Games site on desktop or mobile.
I’ve got a full guide to how to play NYT Strands, complete with tips for solving it, so check that out if you’re struggling to beat it each day.
That kind of markdown is still rare for a first-generation product still this new, and with Nothing’s transparent, retro-futurist design turning heads wherever it goes, $219 makes it a much easier headphone to justify than the near-£300 asking price at launch.
Advertisement
Our tech expert Cam Bunton reviewed the Headphone (1) and found aluminium cans with rounded corners and Nothing’s signature see-through panels, a look he described as distinct enough that nobody would mistake it for anyone else’s headphones.
Cam singled out the roller and paddle controls on the right cup as something close to a masterstroke, since the different textures let him adjust volume, skip tracks and pause music without ever needing to check which switch was which.
Advertisement
Sound comes from 40mm drivers tuned in partnership with KEF, and Cam found the bass on tracks like Imagine Dragons’ Gods Don’t Pray came through strong and controlled without ever swallowing the mids or treble around it.
He also got real mileage out of the Nothing X app’s 8-band equaliser, using it to shape a more detailed sound signature than the default balanced setting offered straight out of the box
Battery life held up well in Cam’s testing too, with the headphones still showing close to full charge after two hours of playback and landing near Nothing’s promised 35 hours with noise cancellation switched on.
Nothing has spent every product answering one question, whether tech can look wildly different from everything else on the market and still work exactly the way you need it to, and at $219 the Headphone (1) settles that argument in its favour.
All four Pixel 11 models run Google’s Tensor G6 alongside a new Titan M3 security coprocessor that adopts NIST’s post-quantum cryptography standards, a first for a Google phone. The chip claims 25% faster browsing and 20% better power efficiency, with a TPU carrying 50% more compute.
Every Pixel 11 ships with Google’s new Tensor G6, but the more interesting silicon sits next to it. A new Titan M3 security coprocessor adopts the post-quantum cryptography standards set by the US National Institute of Standards and Technology. Google says the Pixel 11 is its first phone to meet them.
The chip handles quantum-safe secure boot and runs Trusty, Google’s trusted execution environment, across all four models. Google describes the protection as being against “emerging, highly advanced digital attacks,” and says Titan M3 holds Common Criteria certification at the level used for SIM and bank cards.
No quantum computer can break current encryption. The reason to ship this now is that data stolen today can be kept until one can, a problem the industry calls harvest now, decrypt later. TNW has written before about why this is an inevitable threat rather than a distant one.
Advertisement
Governments are pushing the timeline from the other direction. The White House has signed orders calling for a useful quantum computer by 2028, which puts a date on work that vendors had been treating as open-ended.
The performance side is more ordinary. Google claims the Tensor G6 delivers 25% faster browsing and 15% faster app loading than the Tensor G5, with up to 20% better power efficiency, the complaint that has dogged every previous Tensor.
Its TPU carries 50% more compute and higher memory bandwidth. That runs Gemini Nano on device, which Google says now executes background work up to 3.5 times faster while using 3.5 times less energy. The same silicon drives 120x Pro Zoom on the Pro models, 4K portrait video and an Instant Night Sight that captures up to 4.5 times faster.
Google has not published the manufacturing process or the core configuration. Benchmarks against Qualcomm and Apple silicon remain the weak point, and nothing announced suggests that changes this year.
Advertisement
Pricing did land. The Pixel 11 starts at $899, the Pro at $1,099, the Pro XL at $1,299 and the Pro Fold at $1,899, with the 128GB tier dropped, confirming the increase Google signalled in July as memory prices climbed.
Fei-Fei Li, aka The Godmother of AI, says the biggest AI risk in education may be students losing the motivation and agency to learn, rather than simply using the technology to cheat. She argues against banning AI outright, saying it can be valuable when used to support engaged students instead of replacing the thinking and struggle that learning requires. Techspot reports: Speaking on an episode of the science podcast Huberman Lab this week, Li talked about the fears around how students are using AI. “The absolute bad outcome is that our young generation, their agency and human-level motivation of learning and living is taken away by tools,” the ImageNet inventor warned. “It should not be taken away by humans nor should it be taken away by machines.” If we see a generation of graduates who have completely relied on AI without actively trying to learn anything for themselves, they risk leaving education without having “properly developed the brain,” Li said.
[…] Li certainly isn’t advocating for a complete ban on students using AI. She believes it can genuinely help struggling students who are already engaged in their learning. Li herself noted how she struggled with organic chemistry as a premed student, when teaching assistants and professors didn’t have enough time to answer every question. While there’s no obvious solution, Li says we need to find a way to keep children and students’ motivation and agency. “Let’s find a way to give them the access and the right way of using these tools,” she said. Li added that if AI is used properly in education, it could make the students of the future “way smarter than us because they are superpowered.”
The CFTC has ordered Kalshi to keep operating in New York, claiming the state’s lawsuit against the prediction market created a “market emergency.” They said it acted “to ensure market stability” and “ordered the exchange to continue to operate in accordance with the Commodity Exchange Act’s Core Principles.” Ars Technica reports: The market emergency alleged by the CFTC is that New York Attorney General Letitia James sued Kalshi on July 31. James’ lawsuit seeks a court order to permanently enjoin Kalshi “from operating an unlawful gambling business” in the state. The lawsuit also demands that Kalshi “make full restitution to customers who have engaged in betting” and pay financial penalties.
“New York intends to make event contract derivatives waste away under its iron curtain of state gaming laws before the courts get the chance to issue final rulings,” CFTC Chairman Michael Selig said yesterday. “Congress did not intend for derivatives exchanges to be regulated under a patchwork of state gaming laws… New York has no business regulating these interstate financial markets. The commission is required by law to ensure order in these markets, and that is what we have done today.” […]
The CFTC says it alone has the power to regulate platforms such as Kalshi and Polymarket under the Commodity Exchange Act, a US law that gives the CFTC exclusive jurisdiction over designated contract markets (DCMs). “These are financial exchanges that offer financial instruments and operate across state lines,” Selig said yesterday. “They match the bid from a resident of one state with the offer of a resident from another state and submit the trade to a clearinghouse that backstops the transactions of customers throughout the country.”
Insta360 just launched the X6, and the company is treating it like a full replacement for the gear most people carry on trips, rides, and everyday outings. One compact body now handles full 360 capture, locked-on subject tracking in flat video, and single-lens action shooting. Switch between the three with a tap. The camera then analyzes the footage on its own and delivers finished clips before you reach for your phone.
Dual custom Sony sensors are at the heart of this upgrade, with each 1.1-inch sensor organized in a square setup, providing a full one-inch equivalent when working in 360 mode. This configuration is significant since it gives you 33 percent more sensor area to work with than the preceding X5. That’s nearly four times the quantity of light you can capture in each shot. Low-light and high-contrast scenes will look much better. AdaptiveTone 2.0 now meters the two lenses separately, allowing it to draw two exposures every frame, which helps to extend the dynamic range without requiring any human adjustments. There are also two ambient light sensors that will help to clean up nite video, minimizing flicker and making things appear smoother.
DUAL 1/1.1″ SENSORS & TRIPLE AI CHIP SYSTEM: Custom-built dual 1/1.1″ square sensors deliver unprecedented 360 image quality. Combined with a triple…
FLAGSHIP 8K50FPS 360 VIDEO: Hit record on our 360 action camera and capture your world in stunning native 8K50fps video. Every view, every highlight…
IN-HOUSE AI MODEL FOR EFFORTLESS 360 EDITING: Insta360’s own AI model, built specifically for 360 editing. New AI Director edits your footage…
The processing power has been increased to match the larger sensors, with an 8-core 3.3 GHz processor built on a 4-nanometer technology driving the show, along with two dedicated imaging chips for good measure. That provides you a five-fold increase in computational capacity over the X5, and it will run more than twice as fast with 35% reduced power consumption. With this amount of headroom, you can run the camera in native 8K at 50 frames per second in full 360 and then reframe in whichever direction you choose. If you want something simpler, flat mode provides clear 4K with InstaFrame 2.0 subject tracking that locks onto people, dogs, or objects and keeps them centered. The single-lens action mode, on the other hand, offers 5K at 60 frames per second with a choice of 170 degree or 132 degree fields of view, or 4K at 120 frames per second in slow motion if desired.
The larger 2600mAh battery provides 140 minutes of continuous 8K @ 30 360 recording, which is a 51% increase over the X5. It charges to 80 percent in 24 minutes and can operate in temperatures as low as -20 degrees Celsius. The body is slightly shorter and more pocketable than the previous iteration, despite the larger sensors inside. The 2.32-inch OLED panel can reach 1200 nits while remaining legible in direct sunlight, and it also functions as a big record button when gloves are worn. The camera’s waterproofing has also been increased, allowing it to dive 20 meters without a case and 60 meters with the Invisible Dive Case Pro.
Advertisement
The windproof 360 microphones inside the body have been updated, and there’s also a new Hidden Engine Mic mode that separates engine sound while blocking out the wind for motorcycle riders. The Intelligent Audio Mode will also adapt automatically, eliminating the need for you to do anything. You now have the option of pairing two wireless transmitters simultaneously. Connectivity has also been sped up across the board, with Wi-Fi 6 moving files at a zippy 100MB per second wirelessly and USB 3.0 reaching 450MB per second via cable. If you’re afraid about dropping the connection, Bluetooth will reconnect in under a second.
The most significant change will likely be in how you edit your footage. The AI Director process takes place on the camera itself, as it pulls up your video, selects the best sections, and assembles whole clips for you, complete with framing, movement, cuts, music, and everything else, before neatening it up and delivering it to the app for sharing. Auto Edit 2.0 employs a sophisticated PanoMind model that has been trained on over 10,000 hours of real-world 360-degree film from travel, sports, diving, cycling, and everyday life.
Moments Pro on the cloud allows you to create more versions after you’ve established your subject, mood, style, and so on; simply choose your timings and it will do the rest for you. You also get ten-bit color and native Dolby Vision, as well as I-Log for heavy-duty color grading afterward. We’re talking a respectable 47 gigabytes of storage memory, so you can shoot to your heart’s content without having to worry about juggling SD cards.
The lenses themselves are five times more scratch resistant, and you can pop them in and out for sixty percent less. The magnetic mounts are fully compatible with all of your X5 and Ace gear, and you get over a hundred different accessories that can fit onto scooters, bikes, cars, and selfie sticks. A power selfie stick can give you an extra three hours of use out of your camera. Fast charge cases now have two batteries and card slots. You have the option of Midnight Black or Arctic White. The regular bundle now starts at $699.99 and includes the camera, cable, pouch, and lens cloth. Push the button to upgrade to the basics kit for an additional $100, which includes a backup battery, invisible stick, lens caps, charge case, and an extended warranty.
The Trump-class battleship program could cost the Navy $275 billion total
First battleship alone carries a staggering $23.4 billion price tag
Each ship weighs 35,000 tons and packs hypersonic missiles, nuclear missiles, lasers, and more
A new US Congressional Budget Office report has estimated that the Navy’s proposed Trump-class battleship program could ultimately cost taxpayers $275 billion.
The first vessel alone is projected to cost $23.4 billion, roughly $6 billion more than the Navy’s initial estimate initially offered in December 2025.
Officials describe the 35,000-ton nuclear-powered warship as the most heavily armed surface combatant the Navy has ever attempted to build.
Latest Videos FromTechRadar
Advertisement
Ambitious design, timeline, and escalating costs
The Trump administration announced its intention to build this new class of large surface combatants in December 2025, describing it as a guided missile battleship.
It plans to equip this battleship with rail guns, large lasers, hypersonic missiles, nuclear cruise missiles and anti-air, land-attack and anti-ship missiles.
“If built to those specifications, the ship would be the largest surface combatant in the world and larger than any surface combatant built for the Navy since World War II,” according to the report.
“It would be more than three and a half times the size of the Navy’s Arleigh Burke-class guided missile destroyer and more than twice the size of the Zumwalt-class guided missile destroyer.”
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The Navy will construct 15 Trump-class battleships between 2028 and 2056, with each of the following fourteen ships priced at $18 billion.
Advertisement
By comparison, the USS Gerald R. Ford, the Navy’s newest nuclear-powered aircraft carrier, cost approximately $13.3 billion to build.
According to the CBO report, shipyards would need to produce 12% greater tonnage by 2035 under the 2027 plan than under the 2025 version.
To meet this schedule, the Navy would need to construct roughly one new battleship every other year between 2028 and 2056.
Advertisement
During that same period, the service would also need to continue producing two DDG-51 destroyers every single year without interruption or delay.
By 2058, total tonnage for large surface combatants would need to grow by 60%, a pace the report calls a potential challenge for industry.
Shipbuilding struggles raise doubts
Concerns about the Navy’s shipbuilding capacity are not new, and a Government Accountability Office (GAO) report from last March outlined years of setbacks.
Advertisement
The GAO found that too few ships have been completed, that new vessels often fail to perform as expected, and that deliveries frequently run late.
Some ships have arrived up to three years behind schedule, according to the agency’s assessment of nearly two decades of shipbuilding programs.
“We are effectively made to operate in a perpetual state of triage,” said Shelby S. Oakley, director at the Government Accountability Office.
Oakley told the Senate Armed Services Committee that unrealistic assumptions about cost and schedule have repeatedly diverted resources and delayed shipbuilding programs.
Advertisement
The report further notes that switching to nuclear propulsion could lower the battleship’s long-term operating costs by removing the need for fuel purchases.
However, the CBO did not provide a specific estimate of how much money nuclear power might save over the life of the program.
Before anyone starts marching on Google headquarters waving torches and 4K Blu-ray cases, one important fact needs to be established: this happened to one reported customer, not millions. There is no evidence that Google suddenly removed The Lord of the Rings movies from huge numbers of digital libraries or that widespread deletions are occurring.
What we do have is a Reddit user who says the Extended Edition Trilogy they purchased through Google Play Store in 2022 disappeared from their library. Screenshots shared by the user appear to show Google Support confirming that the title had been removed from its catalog and that it could neither restore access nor provide a refund.
That distinction matters because this isn’t a mass deletion story. It is, however, a very good example of why the word “Buy” has become increasingly slippery in the digital era.
Related Reading:
You Bought It. Sort Of.
According to the customer, they paid for the films four years ago and reasonably expected them to remain available. Google Support reportedly explained that because the trilogy had been removed from its system and the transaction dated back to 2022, it could not restore the movies or issue a refund.
You can understand why someone might find that response less satisfying than walking barefoot to Mordor.
Advertisement
Google’s own current terms make the larger issue fairly clear. After purchasing content, customers receive a non-exclusive right to access and use it. Google also states that purchased content generally remains available only as long as Google retains the right to provide it. If those rights disappear, content or services are discontinued, or certain other conditions arise, Google can stop providing access to something you paid for.
That little “Buy” button suddenly feels considerably less permanent.
Digital movies are enormously convenient. I buy them and stream them, and most consumers are not going back to walls filled with thousands of discs.
I might not be the best example.
Advertisement
I own more than 3,700 movies on DVD, Blu-ray, 4K UHD Blu-ray and even LaserDisc, and there is a reason I have never viewed that collection as obsolete. If I purchase The Lord of the Rings on disc and put it on my shelf, Warner Bros. cannot remove it because a licensing agreement changes. Google cannot decide my copy is no longer in the catalog, and the internet can disappear for the evening without taking Gandalf with it.
Physical media has limitations. Discs can be damaged or lost, players eventually fail, and 3,700 movies require slightly more storage space than an app icon. But access to them does not depend on someone else’s server continuing to recognize my license.
Advertisement. Scroll to continue reading.
For home theater enthusiasts, there is also the performance argument. 4K UHD Blu-ray can deliver higher video bitrates and lossless audio without the compression and bandwidth compromises inherent to streaming. Physical media offers excellent performance along with something becoming increasingly unusual in modern entertainment: a copy you can actually keep.
Advertisement
Music Has Exactly the Same Problem
The same argument applies to Spotify, Apple Music, TIDAL, Qobuz and every other subscription music service. You don’t own those 100 million songs. You are paying for access to a catalog, and that catalog can change.
Albums disappear. Different masters replace older ones. Labels change distributors. Licensing agreements expire. The album you played yesterday may not necessarily be there tomorrow.
Qobuz Music Download Store – Best Selling Albums
Qobuz offers an important alternative because it operates a download store alongside its streaming service. Customers can purchase albums and download actual music files to local storage. Roon Ready? Permanence sold separately.
But even Qobuz makes the distinction worth understanding. Its support documentation says customers can normally re-download purchases, while explicitly warning that albums may later become unavailable for download and recommending that customers create backups.
Advertisement
That is the key difference. If you bought the download, saved the files and backed them up, a record label removing the album from Qobuz’s streaming catalog doesn’t magically reach into your NAS and delete it. If you only streamed it, you never had anything to begin with.
One Customer Is Enough to Ask the Question
Millions of consumers buy movies digitally without anything disappearing, and this single case is not evidence that everybody’s library is about to evaporate. It would also be naïve to assume this is the only person who has ever lost access to something they purchased digitally. Most of us do not conduct annual inventory checks on libraries containing hundreds of movies, so a missing title could easily go unnoticed for months or even years. What we cannot say is how many customers this has affected because Google does not publish that data.
But the story matters because it demonstrates what can happen when ownership is replaced by licensed access.
The customer clicked “Buy,” paid for the movies and expected them to remain available. Four years later, according to the support exchange they shared, they didn’t.
Advertisement
Perhaps the industry needs a different word than “Buy.”
Until then, I’ll keep my 4K discs, CDs, records and even those LaserDiscs. They take up more room, but none of them vanish because somebody in a licensing department changed a spreadsheet.
The takeaway: AMD has published a new security bulletin about the Trusted Platform Module reference implementation used in its computer platforms. The disclosed flaws could have significant reliability and security implications, but updates for AMD’s numerous CPU families have already been available for months. Users simply need to install them.
Researchers working with the Trusted Computing Group recently identified a potential security issue in AMD’s TPM code, prompting the company to release new motherboard and firmware updates to address the vulnerability. The update process was not exactly swift, however, as the fixed TPM code had already been available for months. Meanwhile, AMD has only just released its AMD-SB-7064 bulletin detailing the issue.
The US chipmaker explained that the TCG Vulnerability Response Team was informed by Intel researchers about a potential out-of-bounds read vulnerability in its TPM 2.0 reference code. The flaw could be exploited by local attackers with elevated user privileges, allowing them to force the TPM code to read sensitive data stored in the firmware or even affect the availability of the TPM.
AMD programmers confirmed the issue, which affects the company’s TPM implementation in two different ways. The first flaw (CVE-2026-6726) could leak information and allow a malicious actor to recover credentials from a TPM-aware Certificate Authority, potentially enabling them to falsify TPM encryption keys or other TPM-based attestation mechanisms.
Advertisement
AMD describes the second flaw (CVE-2026-6727) as a timing side-channel vulnerability affecting decryption workloads using the RSA cryptosystem. The flaw could allow an attacker to decrypt encrypted data or falsify TPM 2.0 attestation keys. Both vulnerabilities require a local attack with “privileged” user access, meaning they should not pose a significant security risk to systems exposed solely to the internet.
Threat level aside, the two flaws have been assigned relatively high CVSS scores of 8.5 and 8.3, respectively, and are noteworthy for the large number of affected processors. AMD’s list includes Epyc 4004 and 4005 Series CPUs, several embedded processors, Ryzen desktop CPUs from the 3000 through 9000 series, Threadripper workstation processors, and more.
AMD recommends that users install the updated Platform Initialization firmware releases designed to address both CVE-2026-6726 and CVE-2026-6727. The fixed firmware versions have been available since at least May for most processors, while Ryzen Embedded CPUs received their updated firmware in July.
The Trusted Platform Module is a security-focused cryptoprocessor specification defined by the TCG in 2003, but the major TPM 2.0 implementation upgrade has been available since 2014. A TPM 2.0 hardware module or firmware implementation became part of Windows 11’s mandatory system requirements, providing a significant security improvement for the Windows ecosystem.
Advertisement
As these two AMD flaws clearly demonstrate, however, total security remains a distant goal even in the modern TPM-enabled PC world.
You must be logged in to post a comment Login