The U.S. Cybersecurity and Infrastructure Security Agency is giving federal agencies three days to mitigate vulnerabilities in IBM Langflow, N-central, and Apache Tomcat, all actively exploited.

​Tracked as CVE-2026-9198, the security issue in IBM’s Langflow visual framework for building AI agents is the most severe, with a critical rating of 9.8 out of 10.

It allows an unauthenticated attacker to execute remotely on default Langflow deployments by chaining two API endpoints to bypass login and run code.

In late July, multiple fully functional proof-of-concept (PoC) exploits for CVE-2026-9198 emerged in the public space, with complete instructions on how they can be leveraged.

Two weeks ago, CISA issued an alert for another critical Langflow vulnerability (CVE-2026-0770) being exploited in attacks to gain remote code execution with root privileges.

The vulnerability in N-able’s remote monitoring and management platform N-central is identified as CVE-2026-18576 and allows attackers to hijack administrative accounts without authentication.

The flaw received a high-severity rating and has been patched by the vendor. However, the fix was insufficient, and threat actors found a new way to exploit it.

N-able warned customers on August 1st that hackers were actively exploiting the new vulnerability, which received the identifier CVE-2026-18576.

An emergency hotfix was released on Sunday. The company urged customers to install it as the flaw impacted all versions of N-central before 2026.3.

The Apache Tomcat vulnerability, tracked as CVE-2026-34486, has a high-severity score of 7.5. It stems from an incomplete fix for CVE-2026-29146, a critical vulnerability with a severity rating of 9.8 that is described as the missing encryption of sensitive data.

On July 30, researchers at Palo Alto Networks Unit 42 reported that a Chinese-speaking threat actor tried to exploit the CVE-2026-34486 vulnerability in a manual campaign to plant reverse shells on nine Apache Tomcat servers.

CISA confirmed that threat actors are leveraging all three flaws in attacks and added them to its catalog of Known Exploited Vulnerabilities (KEV).

However, the agency did not share what types of attacks are leveraging them, noting that it is unknown if they are used in ransomware campaigns.

CISA has ordered federal agencies to apply available mitigations for the three targeted products by the end of Friday, July 7th.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

On July 6, at the dawn of a new fiscal year, Microsoft announced it was laying off 3,200 people in its Xbox division, plus an additional 3,200 employees across other departments. Of the Xbox layoffs, 1,600 jobs were cut immediately, while the remaining 1,600 will be lost over the coming year, the promise casting a morbid shadow over the immediate future of Microsoft’s gaming business. Additionally, Xbox attempted to shutter five of its development teams — Arkane Studios, Compulsion Games, Double Fine, Ninja Theory and Undead Labs — and it ended up divesting four of them, while the future of Arkane remains uncertain.

The layoffs hit Xbox at all levels: Doom creator id Software lost a reported 50 percent of its staff, Double Fine had to drop a third of its employees as it bought itself back from Microsoft, the platform team was gutted, and it appears that multiple projects were canceled at Fallout: New Vegas studio Obsidian Entertainment, including a sequel to Avowed.

Knowing it was coming didn’t ease the carnage.

Xbox CEO Asha Sharma and chief content officer Matt Booty, both of whom assumed their roles early this year in a surprise c-suite shakeup, outlined the brand’s dire financial situation in a June public memo. They highlighted broad internal issues with Xbox games, consoles, infrastructure and marketing, and ominously promised a “reset” for the business. Rumors of incoming mass layoffs and reports of potential studio closures swiftly followed, with the culling scheduled to begin just after Microsoft’s new financial year on July 1.

“We will end this fiscal year at about a 3 percent accountability margin, down year-over-year,” Sharma and Booty wrote in their memo. “Excluding Activision Blizzard King, over the past five years, we have spent over $20 billion on ongoing investments in our content, platform, and hardware subsidy, but our annual revenue has declined nearly half a billion during that time. Going forward, this cannot continue.” (Including Activision Blizzard King, which Xbox acquired in 2023, adds $69 billion to the company’s expenditures.)

Ahead of the layoffs, Xbox union members represented by CWA urged the company to consider the human and creative cost of repeated mass firings, and to negotiate in good faith over worker protections. Union members accused Microsoft of leaving proposals on the table for months at a time, paying little attention to meetings and unjustly allocating the company’s vast financial resources. UVW-CWA treasurer Sherveen Uduwana noted that Microsoft CEO Satya Nadella personally made $96 million in 2025.

“There is no shortage of wealth in the games industry, especially if we’re talking about Xbox, Sony, EA,” Uduwana said.

After Xbox announced the layoffs on July 6, the CWA in the United States and Canada filed lawsuits against Microsoft over unfair labor practices, and employees held protests outside their offices calling for “people over profits.”

Additionally in July, Xbox’s network went down for nearly a day and exposed that even physical media isn’t immune to DRM on the company’s consoles, though the disc issue was apparently a bug that will be fixed. Days later, Microsoft’s Q4 2026 financial results revealed a revenue decline of 10 percent for Xbox. Annually, Xbox’s reported revenue fell by more than $2 billion year-to-year, landing behind its closest competitor, PlayStation, by multiple billions.

All of this followed two years of rolling layoffs at Xbox, eight years of increasingly reckless studio acquisitions, and a systemic pattern of valuing potential revenue over any sort of creative process. But we’ll get to that at the end. First, an overview of Xbox’s terrible, horrible, no good, very bad July.

At first, the team envisions that those ideas will be codeveloped with humans, but their goal is deeply automating the process. If it works out, they contend, it’s possible that a few dedicated individuals may use Discovery Loop to out-invent the world’s largest research organizations. Presumably those small teams will be customers of Discovery Loop. (The startup also may make its own loops to seek and monetize breakthroughs.)

They put together a simple pitch deck and set out to talk to VCs about funding their company, which they set up as a public benefit corporation. “We just put a few slides with our backgrounds and a rough sketch of how we think our approach will be successful in a bunch of different ways,” says Dean. (They didn’t use AI to create it.) But their presence spoke louder than any PowerPoint could.

“With this team, I wouldn’t need to know what they were doing before I backed them,” says venture capitalist Vinod Khosla, who met with them in his Sand Hill Road office on a Saturday, so no one would get a hint of Google’s upcoming loss. “It’s the ultimate superstar team.” Khosla also loved their idea: “Humans have been using AI to do research, not using AI to be a researcher,” he says. “The fundamental thing [in Discovery Loop] is that AI is the researcher.”

Other meetings took place at Dean’s house. Ultimately Khosla Ventures and an AI-oriented VC firm called Radical Ventures bought in, along with a handful of other firms. (The founders aren’t sharing how much the funding was and at what valuation–but consider that some companies are paying tens or even hundreds of millions for a single AI superstar, and these guys are GOATs.) “Building something to solve all those problems is a powerful idea,” says Radical managing partner Jordan Jacobs, who will join the startup’s board. “These people have been doing this kind of work in the past so they know what they’re doing.”

Negotiating the exit from Google was more painful. Dean says that Alphabet CEO Sundar Pichai tried over multiple meetings to get them to keep their badges. Ultimately the team decided that they wanted the fun–and the freedom–of doing a startup.

“In a large organization there is always a lot of inertia you have to overcome to make any radical changes,” says Vinyals. “We want to build something different.” Google ultimately gave the departing engineers its blessing, along with an investment and an arrangement to provide compute power for the first year.

“Over 27 years, Jeff and Sanjay helped to drive some of the most significant technology transitions, from our early search infrastructure to the neural networks that helped create the modern AI era,” Pichai said in a statement. “We’ll continue to work with Discovery Loop as a founding investor and Cloud partner, and collaborate on a research framework for ML systems and related infrastructure advances.”

In part because of the impact this mini-exodus will have on Google. Dean and his cofounders have taken pains to maintain stealth. To date, they haven’t yet begun to hire a team (which may mean even more defections from Google) or even to rent office space. When I ask who the CEO is, there is a brief pause. “I think I’m the CEO,” says Dean, sheepishly. “Everyone pointed at me.”

Discovery Loop’s mission is not novel. Just about every major figure in AI—Dario, Sam, Jenson—has claimed at one point or another that AI will become an engine of scientific discovery, solving problems that humans could never crack on their own. This team is betting that their knowledge and skills will prevail in building a system that actually makes such breakthroughs. Short of that, Discovery Loop faces a narrower mark for success: Will the work they do as a startup be as significant as the talent gap they’re creating by leaving Google?

More than 200 people registered for the competition within the first eight days and applications will remain open until 9 August.

TechIreland has announced dates for the free annual National AI Challenge. Participants will engage with two intensive weeks of remote development, with teams presenting their work via coordinated regional events on 14 September. 

The strongest competitors will continue on to the TechIreland National AI Meet to be held at Galway’s Galmont Hotel on Thursday 24 September. Their work and knowhow  will be judged by leaders across technology, industry, investment, research and the public sector.

The 300 or so participants, from across the entirety of the island, will be made up of developers, founders, students, technologists and AI enthusiasts and will build practical AI products, prototypes and agentic workflows, with the aim of addressing real business and societal challenges. 

The competition is supported by expert mentors, industry partners, technology providers and more than 10 regional innovation hubs. More than 200 people registered within the first eight days and applications will remain open until 9 August.

This year marks the third iteration of the National AI Challenge. Last year, participants delivered 44 AI projects, with 15 teams reaching the national final – more than twice the number in 2024.

The theme for 2026 is ‘AI and Agents: Strategy, Processes and Roles’, which reflects the shift from AI experimentation to practical implementation, according to TechIreland.

Teams will be expected to respond to industry-led ‘challenge statements’ or submit their own wildcard ideas in areas such as enterprise technology, manufacturing, financial services, insurance, health, sustainability, public services and immersive technology. TechIreland said there will be an emphasis on responsible, people-centred AI that takes into consideration how AI is governed and used.  

Commenting on the announcement, Niall Norton, the CEO for TechIreland, said: “The AI Challenge is much more than a competition. It is becoming part of Ireland’s AI talent infrastructure. At a time when employers need evidence of practical AI capability, we are creating opportunities for people to demonstrate what they can build while helping organisations discover the talent they need.”

Brian Caulfield, board director at TechIreland, added: “I’m very proud to see the National AI Challenge and Meet go from strength-to-strength.

“Every year, the competition has generated more AI start-ups, while simultaneously educating new AI talent and connecting technical and commercial founders. I look forward to this year’s iteration being the best yet.”

The AI ecosystem has experienced a boom in Ireland, with many organisations and institutions focusing on education, scale and growth. In late July, the Tech Industry Alliance and RDI Hub teamed up to launch the Graduate AI Launchpad pilot, a new programme designed to prepare graduates, employers and industry professionals in Ireland’s south-west for AI-enabled workplaces.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Other Good MagSafe Accessories

The accessories below aren’t as great as the top picks in this guide, but they’re still good options if you’re looking for more MagSafe gadgets.

Belkin iPhone Mount With MagSafe.

Photograph: Julian Chokkattu

Belkin iPhone Mount With MagSafe: Using Apple’s Continuity Camera feature, you can wirelessly use your iPhone as a webcam for a MacBook. It supports various video calling apps too, from FaceTime to Zoom. This circular silicone puck magnetically sticks to the back of your iPhone and can be used as a phone grip or kickstand, but you need to keep your screen close to a 90-degree angle, or else the weight of the iPhone will drag the screen back or forward. There’s also a mount for external displays, in case you want one for your home desk setup.

STM Goods MagPod Smarter Phone Stand: I’ve been carrying this mini tripod from STM Goods all over my apartment. When I’m not using it to see notifications at a glance at my desk, I’ll place it on my kitchen counter to stream TV shows while cooking dinner, on my coffee table to FaceTime with friends while on the couch, or on the bathroom sink to listen to podcasts while doing my makeup. I’ve also used it to shoot video. It has a magnetic disc with a socket that moves around smoothly, allowing you to position it at multiple angles. The retractable legs are sturdy too, even while tapping through notifications or typing out texts. They fold in neatly into a compact size, making it easy to travel with.

Casetify Wireless Car Charger: I’ve been using this for over a year. It’s easy to install, has MagSafe support (with a USB-C cable) and an adjustable ball joint for various viewing angles, and it’s Qi 2-certified with a 15-watt rate. It’s a bit more affordable than Belkin’s and comes in several fun patterns. (I have the Penguin design, and it’s tough not to smile while looking at it.)

MagGo Magnetic Charging Station (8-in-1): This little orb has three AC outlets, two USB-C ports, and two USB-A ports on the back, and over on the front is a Qi2 wireless charging pad that can recharge your phone. It’s great for workstations where you need to plug in a lot of gadgets. Each of the USB-A ports dishes out 12 watts, and the USB-C ports can output 67 watts, though this lowers if other ports or the pad are in use.

Casely Grippy: I’ve successfully used this grippy phone mount to record a few different videos. The suction on it is hit or miss. Sometimes, it sticks to my painted wall for hours on end; Other times, it slides off my mirror or shower wall in just a few minutes (taking my phone with it). I’ve found it works best if you freshly clean it as well as the surface it’s going to stick to. Apply some extra pressure when pressing it against your chosen mounting location, and maybe be prepared to catch it if it falls.

Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.

Google has locked hundreds of Blogger websites after a false positive claimed they violated its “Malware and Similar Malicious Content” policy, with some sites actually deleted from the platform.

The issue began on August 4, and it appears to affect many legitimate blogs that do not host malware or have malicious scripts.

As seen by BleepingComputer, hundreds of web admins have reached out to Google on the company’s official forum for help in restoring access to their blogs.

The forum post now has more than 300 “I have the same question” votes and over 100 replies from publishers.

“Today’s huge number of reports regarding blogs flagged/locked for the same reason suggests misclassification by automated systems,” a Blogger Product Expert wrote. “False positives do occur from time to time, but not on this scale.”

If you’re affected, you will see a large red padlock in your Blogger dashboard with a clear warning: “Note: this blog has been locked.”

“This blog was removed for violating Blogger’s Community Guidelines. If you wish to request a review of the blog, click ‘Request Review’ below,” reads the Blogger warning.

Google’s automated message also warned publishers that their blogs can be permanently deleted within the next three months if no appeal is submitted.

While a blog is locked, its owner cannot access the dashboard tabs used to manage posts, settings, themes, or other parts of the site.

“The removal happens automatically after updating the homepage or making changes to the blog template,” one publisher reported.

The situation has become even more frustrating for some users, who say that their blogs were restored and then later deleted again.

Not all Blogger users are affected, and some of those who submitted an appeal are already seeing their blogs come back online.

It’s also unclear how many sites are hosted on Blogger, as Google has never disclosed the numbers. However, some third-party trackers suggest that close to 200,000 sites are hosted on the platform.

We’ve reached out to Google for a statement, and we’ll update this story when we hear back.

This is a developing story.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Once upon a time, telephones were primarily point-to-point communications systems. There were options for three-way and conference calls out there, but by and large the plain old telephone system was about connecting one handset to another for a direct conversation. For this reason, the telephone was seldom used for mass emergency communications, because it was simply not fit for broadcasting a message to a wide number of people.

However, technology has since changed. Our modern phones are all connected to a big digital over-the-air network, and large swathes of them can be addressed all at once if so needed. This has led to the development of emergency warning systems that use the cellular network, with Cell Broadcast being the most notable iteration.

Notification

Cell Broadcast technology has been a part of mobile network infrastructure for some decades now, having been included in various forms in 2G, 3G, 4G, and 5G mobile standards. The system was first demonstrated in 1997 in Paris, with the concept being straightforward enough—a way for cell networks and authorities to send rapid notifications in a one-to-many broadcast. The technology is sometimes referred to as Short Message Service-Cell Broadcast (SMS-CB), differentiating it from the more familiar Short Message Service-Point to Point (SMS-PP) that individual subscribers use. A Cell Broadcast message can be fired off to select cells of a cellular network, with the notification in turn popping up on the handsets of all subscribers connected to that cell. This allows for easy geofencing of emergency alerts and information, such that only individuals in the relevant area receive the Cell Broadcast message.

By firing a Cell Broadcast to entire mobile networks across a country, it’s possible for authorities to get a message out to millions of phones in mere seconds—a remarkably effective way of communicating critical information quickly.

A typical Cell Broadcast emergency message will be announced by a special alert tone with the textual message content appearing on the phone in turn. Messages can be sent in a primary and an additional language and displayed according to a devices individual language settings to aid in accessibility. There is also generally no need for a given device to have a SIM card installed, since the Cell Broadcast messages are not addressed to any given individual subscriber number.

Modern Cell Broadcast messages can be up to 1,395 characters long using Latin characters, or up to 615 characters in languages using UCS-2 character encoding. Messages can be set to refire from every 2 seconds to over 30 minutes, with handsets typically ignoring rebroadcasted messages that have already been displayed. In turn, new messages can also be sent quickly to reflect changing conditions or updated information.

Cell Broadcast messages can come in several different levels depending on the intended severity of the alert. These are identified by hex codes laid out in 3GPP standards, though the exact alert levels vary across different national implementations of the system. In the EU, they are ranked from Alert Level 1 (most severe) to Alert Level 4 (least severe) with additional levels for “Amber,” “Test,” and “Information” alerts beneath. Levels below 1 can be “opted out” on certain handsets with the functionality to do so. Similarly, in the US, the highest level is “National Alert” which can not be opted out of and will always fire on handsets receiving the message. Below that, the levels step down to “Extreme Alert,” “Severe Alert,” and “Public Safety Alert,” with Amber Alerts and test levels beneath that.

Many nations have built emergency communications systems around the Cell Broadcast infrastructure. Since a high percentage of populations in developed countries own cellular phones and keep them close at hand at all times, it serves as a highly effective way to distribute emergency warnings. Many countries simply name their systems after their own nation—such as FR-Alert and DE-Alert in France and Germany, to T-Alert in Thailand. Others get more creative, such as S!RENEN in Denmark, or more descriptive, such as the Disaster and Emergency Warning Network (DEWN) in Sri Lanka.

Despite Cell Broadcast having existed in various forms across previous generations of mobile networks, some nations are still yet to fully implement emergency warnings over this infrastructure. Notably, Australia is in the process of rolling out AusAlert in 2026, with the first national test of the system firing off on the 27th of July, 2026. Authorities noted that 94% of targeted cell towers broadcast the message succesfully, though there was some controversy around some phones not displaying the broadcast message, and concerns around secret phones being revealed by the test which would sound regardless of silent or “do not disturb” modes. Other countries still developing Cell Broadcast emergency systems include India, Poland, Ukraine, Sweden, and Brazil.

There are limitations to Cell Broadcast. Namely, as a one-to-many broadcast message, it’s not directly possible for authorities or telecommunications operators to determine how many or which subscribers may have received the message. The technology is effectively a “push” message system with no backchannel for confirmation of receipt. This is somewhat by design, however, as thousands or millions of devices sending a read receipt via the network would create huge network congestion. This would be particularly undesirable during an emergency situation.

Regardless, the Cell Broadcast methodology has key benefits for emergency and mass notifications compared to other methods of reaching out via the mobile network. Most of all, it’s a message that is broadcast rather than sent to individual subscribers. Sending the same notifications via SMS or MMS would require huge amounts of network capacity as each individual message for each individual phone number was sent out.

There are also logistical difficulties in such a method, wherein a list of valid phone numbers must be maintained and updated at all times. It can also be more difficult to do things like geofenced messaging, since individual subscribers and their phones tend to move around a fair bit.

Hopefully, you’ll never find yourself wrapped up in a major weather event or other serious emergency. If you do, though, you might just find that critical information you need to survive thanks to a timely Cell Broadcast message. Expect such systems to become a baseline part of emergency management efforts in future as long as cellphones remain a ubiquitous communication tool across the population.

Three weeks after Apple filed a landmark case accusing OpenAI of stealing trade secrets, OpenAI is hitting back. In a new blog post, the ChatGPT-maker said Apple’s lawsuit is “careless, aggressive and oddly personal.” 

Apple alleged in its initial complaint that two former Apple employees, software engineer Chang Liu and 24-year Apple veteran Tang Tan, improperly accessed Apple’s proprietary tech after they left for OpenAI. But OpenAI claims that Apple’s own security lapses allowed Tan and Liu to access Apple’s systems, and that this was a previously known issue.

This all comes as Apple asked the US District Court for the Northern District of California this week to speed up the case and order OpenAI to “collect and return” all Apple info it has. The case could have big ramifications for OpenAI, which is gearing up to launch its first AI hardware device. OpenAI is arguing that because the initial filing was based on false claims, the case shouldn’t continue. (Disclosure: Ziff Davis, CNET’s parent company, in 2025 filed a lawsuit against OpenAI, alleging it infringed Ziff Davis copyrights in training and operating its AI systems.)  

To aid its point, OpenAI released some selected text and email exchanges between the two companies and their lawyers. These, combined with the documents filed with a California federal court on Tuesday, paint a picture of two heavily lawyered companies: one that can’t figure out how to use its email, and another that is aggressively defensive.

The text and email exchanges OpenAI released are heavily redacted. But the messages seem to support OpenAI’s claim that Apple made mistakes in the lead-up to filing its lawsuit. Apple’s outside counsel leading the case, Gabriel Gross, seemed to have emailed the wrong person at OpenAI in February about Apple’s concerns. Che Chang, OpenAI’s general counsel, emailed Apple’s in-house lawyers, saying Gross claims to represent Apple and says Gross had spoken with Chang, despite the fact that Chang has never heard of him.

“I don’t know what the point of [Gross’s] lie is, but could you please confirm if he is actually representing you, and if so, whether you have other counsel you can use. I don’t think interacting through him is appropriate given this behavior,” Che emailed Apple’s in-house lawyers on Feb. 23, according to an email OpenAI released. 

Apple’s lawyers confirmed Gross is representing the iPhone-maker and that Gross initially contacted the wrong person at OpenAI. (Chang’s email is not included in court filings, but Gross’s emails straightening out the miscommunication are.)

OpenAI also released what it says are text messages between Liu and Apple employees after he left Apple. The messages show Liu’s correspondence with an unknown Apple employee on his last day at Apple, arranging file transfers. The texts continue after that day, addressing file transfer issues and seeking Liu’s advice on redacted Apple projects despite Liu no longer working there. OpenAI says that Apple’s “residual access” issues let Tan, Liu and other former Apple employees improperly access company files. 

“Of course, I could ask several folks, but you are the best. Even if you don’t work here anymore,” an unknown Apple employee texted Liu on Jan. 27, five days after Liu left Apple for OpenAI.

Apple said in its request for a preliminary injunction, filed Monday night, that “these interactions and exchanges cannot explain the repeated, unauthorized downloading of voluminous technical files from Apple’s cloud-based storage discussed below, which Mr. Liu performed on multiple occasions from February to April 2026 while employed by OpenAI.” 

Apple also referred to Liu’s text messages, which it included in its preliminary injunction filing, where Liu said he found a way to access the company’s third-party cloud storage system without authorization, to which he said: “LOL.” Apple claims he coached other Apple-to-OpenAI job hoppers on how to access Apple files in that way “to avoid trouble with the security team,” the filing says.

It’ll be up to the court to sort out which multibillion-dollar tech company is telling the truth. OpenAI certainly has a strong motive to prove Apple wrong – the lawsuit could do a lot of damage, financially and reputationally. OpenAI has now made its position clear: “We do not have, nor want, any of their trade secrets.” 

Katelyn Chedraoui

Reporter 2

Advertisement

Katelyn is a reporter with CNET covering artificial intelligence, including chatbots, image and video generators. Her work explores how new AI technology is infiltrating our lives, shaping the content we consume on social media and affecting the people behind the screens. She graduated from the University of North Carolina at Chapel Hill with a degree in media and journalism. You can reach her at kchedraoui@cnet.com.

See full bio

The smartphone was supposed to kill the digital audio player. Based on the continuing flood of new DAPs in 2026, somebody forgot to tell the portable audio industry.

Astell&Kern is now teasing the PD5 “All Day Player,” a more compact model designed to succeed the well-received A&norma SR35. The company plans to reveal the new DAP during the 2026 Hong Kong High-End Audio Visual Show, which runs from August 7–9 at the Hong Kong Convention and Exhibition Centre.

Detailed specifications remain under wraps, but Astell&Kern has already confirmed an aluminum chassis designed for comfortable one-handed use, a switchable Quad/Octa-DAC architecture, and up to 28 hours of continuous playback. The PD5 will also introduce EnviroTune, an intelligent feature designed to analyze ambient noise and tailor the listening experience to the user’s surroundings.

With another wave of new DAPs arriving from across the portable audio category, the PD5 appears to be Astell&Kern’s attempt to deliver premium performance without the flagship pricing, weight, or battery anxiety that often comes with it. The remaining questions are how much it will cost, which DACs are inside, and whether “All Day Player” proves to be more than a clever marketing line.

Related Reviews:

Astell&Kern PD5: What We Know Ahead of Its Hong Kong Debut

The PD5 uses eight Cirrus Logic CS43198 DACs, allowing listeners to switch between Quad-DAC and Octa-DAC operation.

Quad-DAC mode prioritizes longer battery life for extended listening sessions, while Octa-DAC mode is designed to deliver the PD5’s full sonic potential and maximize performance from a DAP of this size.

In Quad-DAC mode, the PD5 provides up to 28 hours of continuous playback. Support for PD 3.0 charging reduces charging time to approximately 2.5 hours.

EnviroTune analyzes ambient noise and automatically optimizes the sound for the listener’s current environment. This is designed to provide a more consistent listening experience while commuting, working, or listening in a quieter space.

The PD5 supports playback up to 32-bit/384kHz PCM and native DSD256. Its octa-core processor and full Android operating system are optimized for music streaming services, while dual-band Wi-Fi, Bluetooth 5.3, and broad codec support, including Qualcomm aptX HD, LDAC, and LHDC, provide several options for listening to high-resolution audio wirelessly.

The Bottom Line

The PD5 has a promising foundation, including eight Cirrus Logic DACs, switchable Quad and Octa-DAC operation, up to 28 hours of battery life, and EnviroTune. But Astell&Kern has not yet revealed several details that will determine whether it is actually competitive, including output power, storage capacity, screen specifications, dimensions, weight, Android version, battery life in Octa-DAC mode, pricing, and availability.

If the PD5 lands near the A&norma SR35’s $800 price point, it could be a compelling option for listeners who want a compact DAP with long battery life and enough flexibility for both casual and critical listening. It will also face strong competition from the $699 HiBy R6 Pro II 2025, the $650 FiiO M33 R2R, and the $949 iBasso DX260 MK2. The PD5 may have eight DACs under the hood, but its final price, amplifier power, and software experience will matter far more than the chip count.

Price & Availability

Following its Hong Kong debut, the PD5 will be on demo at Shenzhen International Audio Show (SIAS) August 14-16 in China and at CanJam SoCal 2026, August 29-30 in the United States. Retail availability date or price has not been officially announced at this point. 

Related Reading:

Creators will be granted access to a deep library of Disney assets to use in their videos.