off-prem

An expired card, overzealous spam filter, and broken authenticator create havoc with a very clear moral 

Nothing can ruin the end of a week like finding out that all of the websites and hosted email you’re responsible for are offline, which is exactly what happened to Christopher Bradbury and his web design and development firm, Digital Takumi last week. AWS has since resolved the situation, but Bradbury’s mistakes can serve as a useful lesson to others of what not to do.

As Bradbury explained to The Register in an email, he noticed last Thursday, July 16, that all the websites and Google Workspace email accounts connected to domains he manages were offline. All of those sites are hosted through Route 53, AWS’ combined DNS/hosting service, and none of them were resolving. 

Bradbury went digging through his emails to figure out if there was anything to point to the failures, and sure enough: In his spam folder were numerous messages from AWS telling him a payment card on file had expired, and warning him that the account used to host all those customer websites through Route 53 was going to be suspended unless he took action. He didn’t obviously, because he didn’t realize there was an issue.

“AWS had been sending billing notifications, but unfortunately they had been filtered into a spam folder and, in some cases, were being delivered to an employee who had since left the business,” Bradbury told us. 

“I accept responsibility for missing those notifications,” he added, but that didn’t help his customers’ websites get back online. 

The situation could have been resolved sooner, but Bradbury had made some other mistakes as well:

“The root account had MFA enabled using a software authenticator that had been stored on an older laptop which has since suffered a motherboard failure,” Bradbury explained. Without access to that authentication code generator, he was unable to get into the account. Rather than getting the dead-laptop-with-a-critical-authenticator-on-it problem resolved, he was just relying on MFA emails instead – not the best idea.

“I’ve been bypassing the device key for quite a while by just using the recovery MFA via my email,” Bradbury told us. “It works, I get access. However if I just had my Passkey up to date it would have let me right in and I could have solved this.”

And then there was the email address where those MFA codes were going:

“The AWS recovery process required email verification using the registered root email address,” Bradbury told us. “That email address belonged to one of the domains whose DNS was hosted in the suspended AWS account, meaning I couldn’t receive the verification email.”

The account recovery tango

Bradbury’s next option was contacting AWS from a different email address, which didn’t go anywhere. He created another AWS account and purchased business support access on someone’s recommendation, but the support engineers he spoke to using that method wouldn’t discuss the other account until he verified he owned the one in question. 

“Over the following days I spoke with several AWS teams, including Billing and Account Recovery. I was transferred between teams multiple times, but nobody was able to complete the ownership verification or restore access to the account,” Bradbury told us.

He wanted to pay AWS, Bradbury told us, but it took a while for them to be able to take his money. “The practical consequence is that I cannot log into the AWS account, cannot receive email at the registered root address, cannot access the MFA device, cannot update the expired payment method, and therefore cannot pay the outstanding invoices from inside the account.” 

While we were working on this story, after speaking to both Amazon and Bradbury, he contacted us to say that access to the sites had been restored, and that he had logged in, paid the back invoices, updated his payment method, reset his MFA keys, and generally taken care of all the stuff he had been putting off until all this happened. 

It’s unfortunate that someone has to go through AWS billing hell to serve as an example to others, so let this be a warning to anyone else managing client websites through AWS.

“Firstly pay your AWS bills,” Bradbury said in an email, adding that anyone running an AWS hosting account also makes sure their emergency recovery email isn’t on the same domain as one of the sites they manage through that profile. That, and “stop using shortcuts” when it comes to MFA. 

“This isn’t a big infrastructure account, we run a single company marketing website and some domains through Route 53,” Bradbury explained. “It just shows that even the most modest instances of AWS can be absolutely business critical and you need to use proper practices and processes.” ®

Anthropic can finally start cutting checks to a group of authors and book publishers that sued the AI lab over copyright infringement. A federal judge gave final approval Monday of Anthropic’s landmark $1.5 billion settlement of a class action copyright lawsuit, Reuters reported.

Judge William Alsup of the U.S. District Court for the Northern District of California issued a preliminary approval of the settlement last year, after ruling that Anthropic had illegally downloaded and stored millions of copyrighted books.

Alsup has since retired and Judge Araceli Martinez-Olguin signed off on the settlement on Monday.

The payout will deliver $3,000 per work across an estimated 500,000 works, shared among the authors and publishers who hold rights to them. While the settlement is believed to be the largest in the history of U.S. copyright law, many authors and creators still don’t view it as a win.

That’s because of how the legal question was resolved. Alsup sided with Anthropic on the core issue. He ruled that training an AI model on copyrighted text counts as fair use — a decision widely seen as a turning point for the AI industry. But the ruling didn’t excuse how Anthropic obtained the books in the first place. Anthropic had built its training library from two sources: books it purchased and scanned (fine), and books it downloaded from pirate sites like Library Genesis and Pirate Library Mirror. Alsup found the second method illegal on its own terms and said that piracy question could go to trial; Anthropic agreed to a settlement soon after to avoid a trial and whatever damages a jury might have awarded.

While the final approval closes out this case, it doesn’t settle the legal question industry-wide because Alsup’s ruling was a single district court decision, and Anthropic’s decision to settle means the case will never reach an appeals court to become binding precedent.

Other judges are still free to reach their own conclusions on their own facts, which is exactly what’s playing out elsewhere. There is still a string of copyright lawsuits against companies such as Google, Meta, Midjourney, and OpenAI over whether it’s legal to train AI models on copyrighted works. Just last week, a group of publishers and authors, including Hachette, Cengage, Elsevier, author Scott Turow, and S.C.R.I.B.E. filed a class action lawsuit against Google over accusations that the company used their copyrighted works to train its AI platform, Gemini.

Global consumer spending on recorded music increased 8.6% to $47.1 billion in 2025, with streaming accounting for 86% of the total, according to Futuresource Consulting’s latest industry outlook.

The number of paid music subscriptions worldwide reached 865 million, an increase of 71.5 million from the previous year. Those figures make the direction of the business difficult to misunderstand: streaming is no longer merely the largest part of the recorded music market. It has become the market’s central economic engine, with physical sales and downloads operating around it.

Futuresource expects global music spending to surpass $50 billion in 2026 and reach $60.2 billion by 2030, when subscription streaming could account for almost nine out of every ten dollars spent on recorded music.

That does not mean physical music is disappearing. Consumer spending on physical formats increased 7% during 2025, while global vinyl retail value rose 10% to $3.77 billion. Streaming may have taken over the largest bedroom and changed the Wi-Fi password, but records and CDs have not moved into the garage quite yet.

Subscriber Growth Is Moving Beyond Mature Markets

The addition of 71.5 million paid subscriptions during 2025 reflects continued growth in regions where streaming adoption still has considerable room to expand.

Latin American recorded music revenue increased 15%, while the Asia-Pacific region surpassed 400 million paid music subscriptions. China, India, Brazil and Mexico are expected to play increasingly important roles as subscription growth slows across North America and Western Europe.

That slowdown is one reason streaming services are focusing more heavily on higher-priced plans, bundled content, premium features and regular price increases. Most consumers in mature markets who are willing to pay for music streaming already subscribe to at least one service, which means future growth depends increasingly on charging existing users more rather than simply finding new ones.

Spotify, Apple Music, TIDAL, Qobuz, Amazon Music and other platforms have responded with higher monthly prices, additional subscription tiers, audiobooks, music videos, artificial-intelligence features and other additions designed to make the increases appear less like increases.

Some of those changes have created real value. Others have mostly improved the number printed on the credit-card statement.

Vinyl Remains the Physical Market’s Economic Engine

Vinyl continues to generate the largest share of physical music revenue, with global retail spending reaching $3.77 billion in 2025.

That figure is consistent with the broader trend eCoustics has followed throughout 2026. The RIAA reported that U.S. vinyl generated $1.043 billion in wholesale revenue during 2025, with 46.8 million records sold. Revenue increased 9.3%, while unit sales grew 7.9%.

It was the format’s 19th consecutive year of growth in the United States, which makes it increasingly difficult to dismiss vinyl as a short-lived revival driven entirely by aging collectors and Record Store Day releases. Fads generally do not survive four presidential administrations, multiple economic downturns, a pandemic and the arrival of $50 single-LP reissues bought by people who already own five other copies.

Vinyl now supports a substantial network of independent retailers, pressing plants, equipment manufacturers, distributors, labels and reissue companies. It has also evolved into something broader than an audio format, combining music ownership with collectibility, artwork, limited editions and physical merchandise.

That explains why buyers continue to spend money on colored vinyl, numbered editions, alternate covers and deluxe box sets, even when the same music is available instantly through a streaming subscription.

CDs Are Showing More Life Than Expected

Compact discs remain considerably smaller than vinyl in both revenue and cultural visibility, but the format has shown unexpected momentum during 2026.

Luminate reported that U.S. CD sales increased 16% to 16.3 million units during the first half of the year, while vinyl unit sales grew by only 2.4%. That gave CDs a growth rate almost seven times higher during the period.

K-pop releases contributed significantly through elaborate packaging, photo cards, alternate editions and fans purchasing multiple versions of the same album. However, Luminate found that CD sales would still have increased 6.7% after K-pop titles were removed from the data, suggesting that the improvement was not dependent on one unusually committed group of collectors.

Target, Walmart and other mass-market retailers now account for almost 30% of U.S. physical music sales, another indication that records and CDs are no longer confined to independent stores and specialist websites.

The figures do require some context. Futuresource measures global consumer spending, while the RIAA reports U.S. wholesale revenue net of returns and Luminate tracks retail consumption and unit activity. The numbers describe related trends, but they are not directly interchangeable.

The RIAA still reported that U.S. CD sales declined to 29.5 million units in 2025, with wholesale revenue falling to $312.4 million. Luminate’s stronger first-half results therefore suggest a possible change in direction rather than proof that compact discs have suddenly returned to their late-1990s commercial peak.

Nobody should start rebuilding Tower Records just yet.

Physical formats will remain much smaller than streaming, but the evidence does not support the idea that they are disappearing. Vinyl is a multibillion-dollar global business with nearly two decades of sustained U.S. growth, CD sales are showing renewed momentum in 2026, and manufacturers at both ends of the market continue introducing new players and transports.

Esoteric and Luxman still serve buyers who want disc playback treated as a precision instrument, while Denon, Yamaha, NAD, Audiolab, Mission, Quad, Topping and FiiO continue to develop products at more accessible prices. This is not an industry maintaining a format on life support; it is one still investing in it.

The turntable market is even more remarkable. There have not been this many new models available in at least 30 years, with hundreds of options from Rega, Pro-Ject, Thorens, Kuzma, VPI, Vertere, Linn, Luxman and far too many others to list without turning this article into a dealer catalog. Entry-level decks, premium belt-drive designs, direct-drive models, automatic turntables and statement products all continue to arrive because demand remains real.

Interest in physical music has not been this strong in a very long time. Listeners understand that well-mastered records and CDs can sound better than compressed or compromised streams, but sound quality is only part of the appeal. Physical media provides ownership, permanence and a sense of community among listeners, collectors, retailers and artists that no monthly subscription can reproduce.

There will never be a Streaming Store Day. Nobody is lining up outside at 6 a.m. to celebrate a licensing agreement that can disappear before lunch.

The music business often treats streaming and physical media as opposing formats, but consumers increasingly use them for different reasons.

Streaming provides access, convenience and discovery. It allows listeners to explore enormous catalogs, move between devices and hear new releases immediately without committing to a purchase.

Physical media provides ownership and permanence. A record or CD cannot disappear because a licensing agreement expired, an artist changed distributors or a streaming platform removed a specific version from a regional catalog.

CDs also provide an inexpensive route to creating lossless local files, while vinyl offers artwork, presentation and a physical connection to an album that streaming cannot reproduce. For many listeners, the most practical approach is to stream broadly and purchase selectively.

That is not a contradiction. It may be the most rational way to consume music in 2026: use streaming to discover, buy the albums that matter, rip the CDs and retain a library that does not depend on a monthly subscription or somebody else’s licensing agreement.

The cloud is convenient. It is not ownership.

AI Will Influence Where the Next Billions Go

Futuresource also identifies artificial intelligence as one of the major forces shaping the music business.

Streaming platforms are using AI for recommendations, playlists, search and engagement, while labels and rights holders explore licensing and content-management agreements. Services are also being forced to address the rapid growth of fully synthetic music and determine whether AI-generated recordings should compete directly with human artists for recommendations and royalty payments.

Deezer has taken one of the clearest positions by identifying fully AI-generated tracks and removing them from algorithmic recommendations. Other services are still developing their policies, even as synthetic content continues to increase.

The issue will become more significant as streaming controls a larger share of global music spending. Platforms do not merely deliver music; they influence what listeners discover, which artists receive exposure and how revenue is distributed.

There is a great deal of money attached to those decisions, which usually means the ethical discussion will continue immediately after the commercial agreements have been signed.

The Bottom Line

Global paid music subscriptions reached 865 million in 2025, while streaming captured 86% of recorded music spending and pushed the market to $47.1 billion. By 2030, that share could approach 90%, driven by higher prices, premium tiers, expansion in developing markets and the increasingly unavoidable arrival of AI inside every service.

Those numbers confirm that streaming has won the battle for access. It is fast, convenient and almost impossible to avoid. What it does not provide is ownership, permanence or any guarantee that the version of an album you love will still be available next year, in the same country, under the same licensing agreement.

Physical media remains much smaller, but it offers something streaming cannot: control. A record or CD belongs to the buyer, can be played without permission from a platform and often sounds better when the mastering is superior.

That combination of sound quality, ownership and community is why records and CDs continue to matter, even as streaming absorbs most of the money. The industry may prefer recurring monthly payments, but listeners still understand the difference between having access to music and actually owning it.

The industry appears perfectly willing to charge people for both, and a growing number of listeners appear willing to pay.

[Reference: futuresource-consulting.com (login required)]

Related Reading:

security

IC3 says any account claiming to represent it is fake

Real FBI agents won’t slide into your DMs and offer to help you recover stolen funds. The bureau’s Internet Crime Complaint Center (IC3) updated an earlier warning on Monday about scammers impersonating the agency online, saying fraudsters continue to use the scheme “to deceive and revictimize individuals.”

According to IC3, there are two different schemes being used to target cybercrime victims, both directly and by soliciting them to report incidents. 

In the first scheme, IC3 said scammers create fraudulent social media profiles and pages impersonating FBI personnel or IC3. They may also infiltrate online groups for fraud victims or contact victims directly while claiming to represent the FBI or the complaint center.

In other cases, victims are being contacted by someone claiming to be an FBI agent after realizing they were approached by someone trying to scam them and saying they intended to report the incident to the FBI or file an IC3 complaint. The FBI said the impersonator then directs victims to a fake IC3 update page or continues communicating through messaging apps.

In the other instance, scammers are creating AI-generated videos on social media depicting senior FBI officials and directing users to a spoofed IC3 website to report cybercrimes they may have fallen victim to, with the scammers then collecting the information and using it to contact victims for further fraud. AI-generated depictions of public figures are similarly being used to make such scams appear legitimate.

“Some individuals received an email or a phone call, while others were approached, or observed an advertisement via social media or forums,” the IC3 said. “Almost all complainants indicated the scammers claimed to have recovered the victim’s lost funds or offered to assist in recovering funds.”

Regardless of how legitimate social media profiles look, or how realistic those AI-generated videos may be, the IC3 is warning that none of them should be believed for a simple reason: The IC3 doesn’t have a social media presence of any kind, and it doesn’t investigate crimes or offer to recover lost funds through social media.

“Any social media profiles or pages claiming to represent IC3 or offering to recover lost money are fraudulent and are actively attempting to steal your personal or financial information,” the IC3 warned. “IC3 will never directly communicate with individuals via phone, email, social media, phone apps, online chat, or public forums.” 

The IC3 said that any contact made with a cybercrime victim who reports an incident via its actual website will be made by an FBI employee from a local field office or other law enforcement official. 

Here’s another hot tip: If you fall victim to a cybercrime or online scam, don’t post about it on social media – that’s only going to invite someone with bad intentions to seek you out. ®

Strands is the NYT’s latest word game after the likes of Wordle, Spelling Bee and Connections – and it’s great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc’s Wordle today page for the original viral word game.

security

Plus dozens of PoCs in the public domain

If you use WordPress, patch now. Just hours after fixes came out, attackers have begun exploiting two bugs that, when chained together, allow pre-authentication remote code execution (RCE). And security researchers tell us there’s a very good chance the miscreants had an AI assist.

“Once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was only a matter of time and tokens,” Jake Knott, watchTowr principal security researcher, told The Register. “WatchTowr was able to trivially reproduce CVE-2026-63030 within minutes of disclosure, and the second CVE-2026-60137 with some additional effort.”

WordPress released patches for both CVEs late Friday, but by Saturday it was game over.

“By the early hours of Saturday morning, successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public,” Knott said. “From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical.”

Here are the details about both security holes, and what went down since WordPress revealed and fixed them on Friday.

CVE-2026-60137 is a moderate-severity SQL injection issue, and CVE-2026-63030 is a critical REST API batch-route confusion bug.

“A route confusion flaw causes the arrays containing the sub-requests, validation results, and matched handlers to become misaligned,” Hacktron researchers explained. This causes WordPress to become confused about which requests have been properly validated and thus treat all requests as trusted, including those that it should block.

Individually, the bugs are difficult to exploit. But when chained together, they can wreak havoc on any organization using a vulnerable WordPress version because they allow unauthenticated RCE.

WordPress 6.9 is affected by both vulnerabilities, and version 6.9.5 contains fixes for both, while WordPress 6.8 is only affected by the SQL injection flaw, and version 6.8.6 fixes it.

Additionally, WordPress 7.1 Beta 1 is also vulnerable. Version 7.1 Beta 2 fixes both CVEs.

Versions of WordPress prior to 6.8 are not affected.

John Blackbourn, one of the WordPress core developers, recommended affected users “update your sites immediately.” Because of the flaws’ severity, the WordPress security team “enabled forced updates via the auto-update system for sites running affected versions,” he added. 

The content management system credited Searchlight Cyber researcher Adam Kues with finding and reporting CVE-2026-63030, and in a subsequent Friday advisory, Kues dubbed the bug wp2shell. 

“The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins,” Kues said, adding that his security shop released a free wp2shell checker to determine if your instance is vulnerable. 

Security firm PatchStack reported exploitation of both CVEs as of Friday night, but didn’t provide details about the attacks.

VulnCheck’s research team, which also began researching the patches on Friday, verified more than two dozen unique proof-of-concept exploits targeting WP2Shell as of Sunday.

“After public exploit code was released, attackers began spraying the internet indiscriminately, hitting anything reachable and trying to get lucky,” Knott told us. “Our honeypots recorded tens of thousands of exploitation attempts, and more than 100 backdoor accounts created by different threat actors using variations of public tooling.”

After creating these backdoor admin accounts, watchTowr observed attackers deploying fake WordPress plugins to achieve RCE, exfiltrate credentials or secrets, or download additional tooling to further compromise the system, he added. “In one case, we watched a threat actor repeatedly attempt to pull down Overlord RAT, a Golang-based remote access trojan.”

Any orgs that waited until Monday to patch are likely already compromised, Knott warned. “Defenders need to inspect their WordPress instances for new administrator accounts, malicious plugins, or other suspicious files, regardless of whether they’ve patched,” he said.®

Apple users are becoming even less likely to switch away from the iPhone. According to new research, the company’s customer loyalty has reached its highest level in years.

A new report from Consumer Intelligence Research Partners (CIRP) (via MacRumors) found that 87% of people who bought an iPhone during the first quarter of 2026 were already using one beforehand.

This is up from 84% during the same period last year. At the same time, the number of Android users moving to Apple’s platform has continued to shrink.

According to CIRP’s survey, just 12% of new iPhone buyers switched from Android during the March quarter. This is down from 14% a year earlier. The remaining 1% came from feature phones, other smartphone platforms or were buying their first smartphone.

“Cards are basically a commodity at the end of the day; how you differentiate them is really what makes the difference,” Riley says. “That’s really the big deal here—how you use your card.” Riley has a card for grocery shopping and one for Amazon transactions; all of these steps help him earn the most points.

“One of the big challenges here on rewards is that quite often, you go in well-intentioned and you don’t get the full benefit of the rewards because you start revolving on the product,” Riley says, meaning cardmembers start accumulating interest on the unpaid balance, with interest charges wiping out the value earned by the rewards.

Riley points to one of the failings of the Apple Card: Apple oversold it. It’s slick, yes, but it never became a mainstream challenger to the credit card industry because the average consumer typically has three or four cards per household: one for all of their purchases, one for emergencies, and one that might focus on travel.

Sara Rathner, a credit card expert at NerdWallet, echoed that sentiment. “The Apple Card is far from the iPhone in terms of changing the world,” Rathner says. “It’s fine; it’s a cash-back card.” All of these cards exist to create brand loyalty, she says. If you have a lot of points with Hyatt, you’re more likely to book a stay at a Hyatt property on your next trip. If you make many purchases with Samsung Wallet, that might incentivize you to get the Galaxy Card.

Rathner says the 3 percent cash reward for purchases using the Samsung Wallet app is a really good rate. If you tap-to-pay at New York City’s subway turnstile with Samsung Wallet on your phone, for example, that’s 3 percent on every commute, and “that would be compelling.”

While Rathner finds the Apple Card underwhelming, she does credit Apple with innovating on certain features. For example, Apple allows you to see the interest rate and credit rate you would qualify for before a credit pull, something other credit cards are increasingly offering. The app (and card) have a beautiful design, the physical card is easy to activate with just a tap on the iPhone, and cash rewards are posted daily rather than waiting for a billing cycle.

“I think if other cards want to compete in that way and also follow suit with those features, I think that just makes credit cards in general better products for consumers,” Rathner says. “We’ll see how this resonates with people who have Samsung phones.”