Revolut has received its licence to operate from Colombia’s financial regulator, the Superintendencia Financiera de Colombia (SFC). The company said the licence is the last regulatory step it needs before it launches in the country.

Revolut announced the approval on 15 September. The licence allows it to operate as a regulated bank in Colombia.

Around 200,000 people in Colombia have already joined the waiting list, according to the company. It has not given a launch date.

Six banking licences

Colombia is Revolut’s sixth full banking licence. The company already holds banking licences in the UK, France, Australia, Lithuania, and Mexico.

This year Revolut has obtained bank licences in France, Australia, and the UK. It has also received conditional approval from the US Office of the Comptroller of the Currency for a national bank charter.

In the same period, Revolut won a payments licence in the UAE. It also received an organisation licence from Peru’s banking, insurance and pension regulator, the SBS.

Chief executive and founder Nik Storonsky said in the announcement:

“Securing this licence allows us to bring our cutting-edge technology and financial stability to a dynamic market, offering Colombians a transparent platform that puts power back in their hands. With over 80 million people already trusting Revolut and a balance sheet that reflects our strong and sustained profitability, we are proving that financial control can, and should be, borderless.”

What Revolut plans in Colombia

Revolut says it will launch a full range of financial products in Colombia. It plans to focus on everyday banking and on managing money across borders, including remittances.

The company said it has met the SFC’s capital requirements. Fogafín, Colombia’s deposit insurance scheme, will protect customers’ deposits.

Diego Caicedo, chief executive of Revolut Colombia, said:

“Today we are one step closer to operating in Colombia. We are not going to just launch as a bank; we are connecting Colombia to the global economy, simplifying remittances and access to world-class products in one single place, supported by the infrastructure of one of the world’s most innovative financial platforms. This licence is an important regulatory milestone, and we are excited to demonstrate the value of our proposition in the Colombian market.”

The numbers behind the expansion

Revolut says it has more than 80 million customers worldwide. It aims to reach 100 million by mid-2027.

According to its 2025 annual report, Revolut made $6bn in revenue last year, up 46% on the year before. Pre-tax profit was $2.3bn, its fifth year in a row of net profit. Customer balances reached $67.5bn.

A share sale earlier this year valued the company at $115bn. A new share deal for Storonsky targets a $500bn valuation.

Revolut’s expansion has also drawn regulatory attention. In June, the European Central Bank moved to restrict some of its products. On 13 September, TNW reported that Revolut handed customer passports to scammers who used a real government email domain.

Apple has addressed more than 260 CVEs across all of its operating systems, browsers, and other software products, marking the largest single patch cycle in Cupertino’s history. 

While this CVE count is hardly notable compared to some vendors – hello, Microsoft’s record-breaking 974 bugs disclosed earlier this month – it does set a company record for Apple. It also reflects the new reality of AI-driven bug hunting, as models become exponentially better and faster at finding security vulnerabilities.

However, the flip side of the AI coin we were promised – that models would also excel at writing patches and automatically fixing software and systems – yeah, that hasn’t happened yet.

The silver lining for everyone updating their Apple products right now (including this humble vulture): none of the vulnerabilities are listed as being under active exploitation. Of course, that may change very quickly as attackers are, at this very moment, looking to exploit the newly disclosed bugs, too. And we promise you that they are using AI.

Apple’s latest mobile and operating system versions, iOS 27 and macOS 27 Golden Gate, released on Monday, also address a record 122 and 204 security vulnerabilities, respectively, across phone, iPad, and computer operating systems.

Of these hundreds of CVEs, however, there are only ten (by our count) that AI is directly credited with finding.

iOS 27 fixes 122 flaws

Just two of the iPhone and iPad CVEs fixed with iOS 27 credit a coding agent or AI assistant with finding them. These include CVE-2026-65410, a vuln that exists in iPhone and iPad AVE video encoders, that can cause unexpected system termination. Apple credited AI-bug-finding firm Calif, along with Claude and Anthropic Research, with finding and reporting this security flaw.

Then there’s CVE-2026-65409, a type-confusion issue in iOS’ Foundation framework that can be abused to cause a denial of service, also found by Calif – specifically human researcher Bruce Dang – in collaboration with Claude and Anthropic Research.

Some of the more interesting and serious iOS bugs fixed with the newest update aren’t listed as found by AI.

These include CVE-2026-43689, a privilege-escalation flaw that could allow an app to gain root access. Apple credited Nosebeard Labs’ Andreas Jaegersberger and Ro Achterberg with reporting this bug.

Additionally, CVE-2026-65406, a logic-issue flaw due to improper validation in Background Assets, could be abused to access sensitive user data. Background Assets is an Apple framework that lets you download large files and content in the background before a user opens the app for the first time. Baidu Security researcher Ye Zhang spotted this one.

macOS 27 patches 204 vulns

Meanwhile, the new macOS 27 update that addresses 204 vulns also fixes both the AI hunted bugs: CVE-2026-65410 and CVE-2026-65409. Plus, it credits AI helpers with discovering eight others, including one especially nasty flaw that could lead to remote code execution through the CUPS printer interface. Let’s start with that one.

CVE-2026-43692 is a validation issue in CUPS that can be exploited by a remote user to either terminate the app or execute malicious code. Aaron Grattafiori and the Nvidia AI Red Team receive credit for disclosing this flaw.

CVE-2026-64790 in CUPS can be exploited to gain elevated privileges. Grattafiori and the Nvidia AI Red Team again get credit for the win.

CVE-2026-43791, a validation issue in StorageKit, can be abused to read files. Grattafiori, the Nvidia AI Red Team, Meridian Miftari, and Amy from amys.website disclosed this flaw to Apple.

CVE-2026-43690 is a race-condition bug in the Server Message Block (SMB) network communication protocol. A local user can exploit the flaw to read kernel memory. Calif’s Bruce Dang, with Claude and Anthropic Research, found this one.

CVE-2026-43719 is another SMB use-after-free bug, discovered by Calif’s Dang and Jakob Pammer, Claude, and Anthropic. “Mounting a maliciously crafted SMB network share may lead to system termination,” Apple warned. 

CVE-2026-65376 is yet another SMB issue – this one an out-of-bounds-read flaw reported by Dang, Claude, Anthropic, and 재영 정.

CVE-2026-65374 is a memory-corruption issue in the WebDAV protocol that can lead to code execution. Dang, Claude, Anthropic, and He Wei (ギカク) receive credit for finding this bug.

CVE-2026-65375, also in WebDAV, can cause unexpected system termination. Apple credited Dang, Claude, Anthropic, and Devcore Research Team’s YingMuo.

CVE-2026-43677 is an out-of-bounds write issue in WebDAV with a slew of researchers receiving credit for finding it. In addition to the usual trio (Dang, Claude, and Anthropic), bubu, Omar Cerrito, HE WEI（ギカク), Roman Zabicki, Richard Zana, Chris Bailey – Short Circuit, Aswin Kumar Gokulakannan, and Surya Narayan Kushwaha are on the list.®

By Sila Ozeren Hacioglu, Security Research Engineer at Picus Security.

If you run PaperCut NG or MF, the last week of August showed what vulnerability response looks like when AI speeds up vulnerability discovery.

On August 27, PaperCut’s urgent advisory said attackers were already exploiting servers. No CVE, no exploit, no patch. The first emergency patch came a day later and was bypassed the same day. The third one landed on September 1. Six days without a patch that held or an exploit to test with, while attackers were already exploiting in the wild.

And the window is closing. Disclosure-to-exploitation averaged 21.5 days last year. It is measured in hours now. PaperCut isn’t the outlier. It’s the template.

Below is one day in the life of a security team, told through a hypothetical CVE.

The CVE is made up. The day is not: it is what PaperCut’s customers lived through in August. Let’s walk through it hour by hour. 

08:00 – A CVE drops. No patch.

You wake up and CVE-2026-1001 is in your feed: unauthenticated RCE, no patch. You run a version check. Twenty assets match. Before you can finish reading the list, your phone rings. It’s management. They’ve already seen it, they’ve already been asked about it, and they want an answer in the next fifteen minutes: are we exposed, and what are we doing about it?

Strip the panic away and there are exactly two questions to answer:

1. Are these 20 assets actually exploitable, in my environment?

2. Would my security controls stop it, right now?

Version data says “affected.” Version data is not an answer. Both questions start the day at Unknown.

Patching is off the table, because there is no patch. 

Shutting the services down would settle the question, but the business runs on them. Nobody is going to negotiate that. You need a verdict, not a shutdown.

08:05 – Your first instinct cannot act

The natural move is to reach for your automated pentesting tool. Take the exploit, fire it at the 20 assets, see what falls. So you go looking for the exploit.

There isn’t one. No public PoC, nothing to run. The tool that would give you the answer is waiting for ammunition, and so are you.

The attacker is not. Weaponization used to take weeks; now it takes hours, and the clock started at 08:00. If you wait for a public exploit, the first working one you see may be the one that hits you.

08:15 – The exploit is a chain, not a payload

Here is the shift. An exploit is not just a payload. It is a chain: the payload has to be delivered, it has to execute, and then the attacker has to escalate privileges, inject into a process and pull credentials to make the foothold worth anything. Each step is a known technique, and techniques can be simulated safely against your controls before anyone has written the payload itself.

You cannot test the exploit, because there is none. But you can test the chain the exploit would need. Map the CVE to the techniques it has to run, delivery, execution, privilege escalation, injection, credential access, and run those against your live stack: NGFW, WAF, endpoint hardening, EDR, SIEM. Per asset. The output is a verdict: would this chain succeed in your environment?

The question “is it exploitable here?” becomes testable ten minutes after disclosure.

We explained how this works in detail in our post on validating CVEs without a working exploit.

08:30 – Simulated, tested, ticketed

By 08:30 the chain has run. The results are not comfortable, and that is the point. The NGFW missed the delivery step. The WAF detected it but did not block. Endpoint hardening flagged execution. The EDR raised no alert. The SIEM raised no alert.

Now the two Unknowns have answers. The 20 assets are exposed to this chain, and nothing in the stack would stop it. But the gaps have names and owners. An action plan is created: a detection rule for the NGFW, a prevention rule for the WAF, GPO hardening for the endpoints, an IOA rule for the EDR, a detection rule for the SIEM. The EDR and SIEM rules deploy automatically. The rest go out as tickets and get worked through the morning, alongside a patch ticket for every affected asset, parked until a patch exists.

By 08:45 the chain is re-run. This time: detected, blocked, blocked, alerted, alerted.

You have not patched anything. You have broken the chain on every affected asset before a working exploit exists.

12:00 – The threat gets a name

Threat intel arrives. An Iranian threat group is running a campaign weaponizing CVE-2026-1001. There is still no public exploit, but the attacks have started. At 08:00 you had a vulnerability. At 12:00 you have an adversary.

That changes the question. The CVE is now one link in a full kill chain: initial access, lateral movement, persistence, exfiltration. You validated the vulnerability this morning. Would you survive the campaign?

12:30 – The whole campaign, rehearsed

You take the new report, pull the group’s past behavior from earlier reporting, and assemble the full campaign as an attack simulation. Run it end to end against your controls.

• Initial access: blocked. The 08:30 fixes hold, and the morning pays off twice. 

• Lateral movement: detected, alert fired. 

• Persistence: missed. This is a technique the CVE-focused work could never have surfaced, because it has nothing to do with the CVE. 

Advertisement

• Exfiltration: blocked, egress controls holding.

The persistence gap runs the same loop as the morning: rule delivered, deployed, re-proven. Closed before lunch is over. Remember this rehearsal.

16:00 – The exploit goes public

A working exploit is published. Now, and only now, live testing has ammunition. Automated pentesting can fire the real thing.

But two constraints show up immediately. 

First, you may not be allowed to. Policy often forbids firing live exploits at production or critical assets, and print servers, domain controllers, and OT systems are exactly where that policy bites. 

Second, reach: with a real exploit, a pentest can safely touch maybe 5 of the 20 assets. The other 15 were only ever answerable the way you answered them at 08:15.

16:30 – Ground truth, two ways

The five reachable assets get tested with the real exploit. Three are not exploitable: the controls hardened this morning meet the real attack and hold. That is live confirmation the simulated verdicts were correct. 

Two are exploitable. They need the patch, and there still isn’t one, so the patch tickets opened at 08:30 get upgraded to critical, with the working PoC and the exploitation evidence attached. No severity debate. The proof is in the ticket. Until the patch lands, the two go behind the WAF prevention rule with web access restricted to trusted IPs.

18:00 – The attacker arrives. Nothing happens.

The campaign hits your organization. Blocked. Alerted. Gaps already closed. The attack fails against controls validated at 08:15, fixed by 08:30, and proven at 08:45.

Ten hours before the attacker had a working exploit, your environment already did not have this exposure. That is what machine-speed validation buys: you finish before they start.

What this day required

Look at what actually got used. Not one capability, three, and none of them is a silver bullet on its own:

And they had to work together, on signal, in hours. The 12:30 campaign reused the 08:30 fixes. The 16:30 pentest confirmed the 08:15 verdicts. Findings from one fed the next. Run them as three siloed tools on three schedules and this day takes six weeks, not ten hours.

That is what the Picus Platform is built to do: exploitability validation, security control validation, and autonomous pentesting on one platform, sharing one data fabric, triggered by change rather than by calendar.

See the whole day, live

We are going to run this exact scenario, live in the product, at The Validation Summit ’26 on October 14 at 1 PM ET and October 15 at 11 AM BST.

Mikko Hyppönen opens with what changed after Mythos. Our CTO Volkan Erturk shows how machine-speed validation closes the patch gap and the speed gap. Security leaders from Chanel, Atlassian, and Kraft Heinz talk about how they are actually preparing. Ron Eddings of Hacker Valley hosts.

One question answered: what does Mythos-ready actually look like?

Two hours. Free. See the workflow run live.

Sponsored and written by Picus Security.

Meta One went live today as a paid layer across Instagram, Facebook, WhatsApp, and Meta AI, grouping more than 50 extras that sit on top of the free apps. Plans already collected 15 million subscriptions and trials during earlier tests, and Meta says later waves will reach Edits and AI glasses. Everyday feeds, chats, and basic Meta AI stay free.

WhatsApp Plus costs $2.99 per month, while Instagram and Facebook Plus cost $3.99 each. Core packages those three Plus subscriptions with additional AI capabilities for $7.99. Premium grants you access to the most AI allowance for $19.99. On top of that, you have your Creator and business tiers, which begin at $14.99 for Essential, $49.99 for Advanced, $149 for Expert, and a staggering $499 for Max. Keep in mind that these charges vary by location and account, and if you run a business on Instagram or Facebook, you may receive separate bills for each unique profile.

Meta Glasses, Fury AI Glasses

• Answers, tips and inspiration are a question away. Forgot an ingredient for dinner? Ask Meta AI for a substitute to save a trip back to the store…
• Meta Glasses are meticulously designed to deliver a fit that feels custom to you. Choose from a variety of bold colors and experience a comfortable…
• Travel like a local whether you’re navigating a bustling market in Spain or having a conversation in Japanese. Just say “Hey Meta” to start a live…

Instagram Plus offers a really great deal: you can stretch your Stories to 48 hours (before they disappear), use custom fonts in your DMs and Stories, receive notifications everytime someone views your Story, and even look at someone else’s Story without being added to their viewer list. Facebook Plus, on the other hand, provides personalized app icons, super hearts, additional Reels stats, and larger reactions in both the Feed and Reels. WhatsApp Plus offers exclusive themes and icons, some fancy effect stickers, and the ability to pin up to 20 chats. Backup storage and scheduled Focus Schedules are also on the way.

Core and Premium upgrade the Meta AI with additional functionality and greater limits. You can generate more photographs and videos with the Muse models, experiment with Restyle on more Instagram Stories, and utilize in-app creative tools like voice effects more frequently. People that joined up for testing used both the AI tools and the style extras rather regularly, and it turns out that Restyle and voice effects were the two most common causes.

Advanced is where all of the scheduling and operations magic occurs. You can queue up Stories up to 30 days in advance, schedule posts and Reels even further ahead of time, include clickable links in your organic posts and Reels, access exportable analytics, deeper audience insights, team seats without revealing your password, additional linked WhatsApp devices, and a slew of broadcast credits. Expert and Max push those boundaries even farther for larger teams and more corporate traffic. One thing to look out for is edits. Plus, it will include cloud project storage and an assistant that will read your Instagram analytics and make suggestions.

It’s worth noting that subscription does not remove ads completely, as Meta continues to run the same ad-supported core for its 3.6 billion daily visitors. Instead, they’re positioning these subscription tiers as a method to assist big hitters that use a lot of AI, while also providing power users and organizations with a single location to manage everything rather than having to fragment among a variety of third-party schedulers, link pages, and analytics tabs. To keep track of the rollout, the feature list will vary depending on your location, app, and account, so you’ll need to look inside the applications to see what’s available to you.

Helen Ma, Meta’s VP of subscriptions, told reporters that people who want specialized work out of apps built for billions now have a paid lane, and that free creator tools will not be cut to force a sale. Essential adds an enhanced profile with website and location slots, a bolder follow button on Reels, automatic follow invites to people who already engage, more Meta Business Agent replies on WhatsApp around the clock, a verified badge and WhatsApp Business channel after checks pass, plus impersonation monitoring.

Looking for the most recent NYT Strands puzzle answers? CNET publishes daily answers and hints for The New York Times Mini Crossword, Connections, Connections: Sports Edition and Strands puzzles.

Strands is like a word find game, but without the list of words to find. Sometimes I see the theme and begin recognizing the answers right away. But for those times when I can’t seem to manage this, there’s a loophole: Strands lets you make as many words of four or more letters as you want. For every three of those words you find, the puzzle will highlight one of the answers. You’re still going to have to unscramble that answer, though, which can be very tough.

I go into depth about the rules for Strands in this story. 

Today’s puzzle has a fun category, with some lively words. They’re pretty easy to unscramble once you pick up on the theme. Read on for hints and all the answers.

Hint for today’s Strands puzzle

Today’s Strands theme is: Hard not to notice.

If that doesn’t help you, here’s a clue: Showy or glitzy.

Clue words to unlock in-game hints

Your goal is to find hidden words that fit the puzzle’s theme. If you’re stuck, find any words you can. Every time you find three words of four letters or more, Strands will reveal one of the theme words. These are the words I used to get those hints, but any words of four or more letters that you find will work:

• CASE, CHIN, STIR, SHACK, HACK, LACK, LACE, LACY, TRICK, RICE

Answers for today’s Strands puzzle

These are the answers that tie into the theme. The goal of the puzzle is to find them all, including the “spangram,” a theme word that reaches from one side of the puzzle to the other. When you have all of them (I originally thought there were always eight, but learned that the number can vary), every letter on the board will be used. Here are the nonspangram answers:

• JAZZY, VIVID, BRIGHT, FLASHY, VIBRANT, STRIKING

Today’s Strands spangram

Today’s Strands spangram is EYECATCHING. To find it, start with the E that’s the first letter on the top row, and wind down, over, and then down again.

CNET editor Gael Fashingbauer Cooper, a journalist and pop-culture junkie, is co-author of “Whatever Happened to Pudding Pops? The Lost Toys, Tastes and Trends of the ’70s and ’80s,” as well as “The Totally Sweet ’90s.” She’s been a journalist since 1989, working at Mpls.St.Paul Magazine, Twin Cities Sidewalk, the Minneapolis Star Tribune, and NBC News Digital. She’s Gen X in birthdate, word and deed. If Marathon candy bars ever come back, she’ll be first in line.

See full bio

Advertisement

There is a particular kind of question that families postpone for years. It is difficult not because the answer is secret, but because the question is too large: Tell me about your life.

Faced with it, even a willing storyteller may retreat into generalities. A childhood becomes “happy”. A marriage was “good”. A migration, a war, a career, a grief, all reduced to a few durable adjectives. The trouble is not necessarily memory. Often, it is form.

From weekly prompts to voice

Storyworth began as a family project. Nick Baum recorded his 82-year-old father’s answers; in 2013, he and Krista Baum founded the family-owned company. Its established format is deliberately incremental: a storyteller receives regular questions, responds over time, and eventually turns those responses and photographs into a hardcover book. Rather than demanding an autobiography all at once, the service divides a life into scenes small enough to enter.

The original Storyworth model centered on written responses. A storyteller could answer a weekly prompt by replying to an email or using a Storyworth account. That route remains available.

With its newer voice features, however, Storyworth is adding a technological layer between memory and the finished memoir: software can now record, transcribe, prompt and help structure the recollection before it reaches the page.

Story Calls, Magic Interviews and Family Calls

The first step in that shift came in 2024 with Story Calls. Storyworth first enabled phone recording in 2013, initially relying on human transcription. In 2024, the company added automated transcription. Today, Story Calls lets a storyteller answer by phone, including on a landline, with the call transcribed word for word.

The distinction matters. A verbatim transcript preserves the loops, digressions and idiosyncratic phrasing of speech, even when the result is less orderly than conventional prose. The storyteller can later revise the text or add photographs, but the initial record begins with the spoken answer rather than a rewritten version of it.

In early 2026, Storyworth added two more conversational formats. Magic Interviews guides a storyteller through a phone conversation and asks follow-up questions. When the call ends, the exchange is shaped into a written narrative and added to the memoir.

Family Calls brings another person (a relative or friend) into the conversation, allowing that person to ask questions, contribute memories and help direct the story. The recording preserves both voices, while Storyworth adds a cleaned-up transcript of the conversation to the memoir.

These are small product distinctions, but they produce different kinds of documents. Story Calls privileges fidelity to speech. Magic Interviews privileges structure. Family Calls introduces relationship itself as a source.

A daughter may remember the name of a neighbour her father has omitted. A grandchild may ask why a detail mattered, rather than merely what happened. One person’s recollection can become more specific when another person is present to recognise the gaps.

Every question is a frame

That does not mean guided conversation produces a deeper or truer memory. Interviews are never neutral containers. Every question places a frame around the past, and every follow-up makes one path more visible while leaving others unexplored.

A polished narrative is also not the same object as a verbatim transcript. The first may be clearer and more readable; the second may preserve more of the speaker’s manner.

Storyworth’s expanded system is interesting partly because it makes those choices visible. Families are not simply deciding what to preserve. They are deciding how much shaping should occur between speech and page.

The more consequential shift is that Storyworth is no longer only giving families a place to store finished recollections. In Story Calls, software transcribes; in Magic Interviews, it asks follow-up questions and helps shape the conversation into a polished narrative; in Family Calls, it preserves a two-person conversation as a cleaned-up transcript. The product is beginning to mediate the act of remembering, not merely preserve its result.

Remembering is uneven. People contradict themselves, circle back, pause, misplace dates and discover the meaning of an event halfway through describing it. A useful family archive cannot eliminate that instability; it can only decide what to do with it.

A book with a second record behind it

Storyworth’s answer is layered preservation. Stories can be edited and supplemented with photographs after a call. Friends and family with access to the project can listen through a private podcast feed.

In the finished hardcover, a QR code takes authorised readers to the Memoir project page, with stories and available recordings; a downloadable audiobook is included. The result is neither simply a book nor simply an audio archive. It is a printed narrative with a second record behind it: the actual sound of the person speaking.

That hybrid model also creates a distinctly digital dependency: the book is physical, but access to the linked recordings is mediated through Storyworth’s platform.

Voice carries information that transcription cannot fully absorb. It contains pace, accent, hesitation and emphasis. It reveals where someone laughs before reaching the end of a sentence, where certainty weakens, where a familiar story still catches in the throat.

None of this guarantees intimacy. A recording can be formal, guarded or repetitive. Yet it preserves the physical event of telling: breath passing through a particular body at a particular moment.

Why the telephone works

That quality makes the telephone an unexpectedly apt instrument for family history. It is ordinary enough not to feel ceremonial. It does not require a studio, specialised equipment or, in Storyworth’s system, even a smartphone.

The same device used for routine check-ins can become the site where a memory is prompted, questioned, recorded and transferred into a more durable form.

The limits of a designed archive

There is a tension here that Storyworth cannot entirely resolve. The service turns private recollection into a designed process, and design always influences outcome.

Weekly prompts encourage continuity, but they also divide a life according to the questions selected. Guided interviews can draw out detail, but they may also smooth the disorder from which a person’s way of remembering becomes visible.

A family memoir is not the whole life. It is a sequence of chosen entrances.

Still, that limitation belongs to every archive. Photographs exclude what stood outside the frame. Letters preserve what someone was willing to write. Home videos favour occasions when a camera was present. Storyworth’s voice tools add another kind of partial evidence: not merely what a person remembered, but how the memory emerged in conversation.

The phrase “family legacy” is often used as though inheritance were a finished object passed intact from one generation to the next. In practice, it is usually assembled from fragments: a name written on the back of a photograph, an anecdote repeated at dinner, a voicemail no one meant to save.

When software joins the act of remembering

Storyworth’s newer features show how consumer software can move from storing memory to participating in how it is elicited and organised. A question is asked, a voice is recorded, a transcript is generated, and a conversation can be reshaped into narrative. Each step adds convenience, but each also adds another layer of design between the remembered event and the archive that survives it.

That makes Storyworth interesting beyond the family-memoir market. It points to a larger question for consumer technology: what happens when software becomes an active intermediary in human acts that once seemed too personal to automate? In this case, the act is remembering.

The inheritance is still human. The system helping to produce it increasingly is not.