from the you-own-nothing dept

Sony just gave the world another lesson in how they don’t actually own the content they’ve bought digitally generally, and particularly not through Sony’s digital storefronts. Instead, as readers here will largely know, what is actually being bought is a temporary license to download and play these games, movies, music, whatever. Sony has done this sort of thing before, disappearing bought items from people’s accounts when licensing agreements expire. Many are surprised to find their shit gone.

This doesn’t happen when you buy physical media, typically, unless it relies on backend servers to operate. But for movies on disc, books on pulp, music on physical media, and physical games this generally isn’t a concern.

But what if a major gaming console maker announced it simply isn’t going to support physical media any longer? Well, that’s precisely what Sony’s PlayStation just did.

Some gamers are concerned about the future of game ownership after Sony’s announcement today that it won’t produce physical discs for PlayStation games as of January 2028. On that date, “new games will be available on PlayStation Store and at retailers in digital formats only,” Sony said in a blog post.

Ditching discs is “a natural direction” for Sony “to adapt to consumer trends as the general preference for digital media significantly outpaces physical discs,” the post said.

Advertisement

Now, for some numbers to chew on. The reality is that nearly 80% of PlayStation games are bought digitally these days. This is pretty much a perfect example of companies following the 80/20 rule, where you plan and account for 80% of the reality you face and de-prioritize the 20% of the outliers. If you left it there, this plan might make some sense.

But in this case, that 20% of the market is both a sizable chunk of revenue and almost certainly made up in no small amount of people who will not move to digital purchases instead. There is a very passionate, vocal community who believes in ownership rights that you can’t get currently with digital purchases, or who believes in video game preservation efforts that can’t exist at the pleasure of gaming companies that haven’t shown a ton of interest in the topic.

If you needed proof of that, the backlash online to Sony’s announcement has been ferocious.

For example, the official Sony account on Twitter posted a simple tweet teasing the upcoming release of the next Spider-Man movie with a single spider emoji. Normally, this account gets a few hundred replies at most, but the Spider-Man tweet now has over 3,000 replies, and most of them are from people yelling at Sony for killing PlayStation game discs.

Similarly, over on the official PlayStation Instagram account where most posts get around 200 to 300 replies, the most recent video shared by the company has amassed over 2,000 comments. And once again, most of them are very angry about PlayStation abandoning physical media, begging the company to reconsider, or threatening to boycott future Sony products and games if it doesn’t.

Advertisement

The most recent video on the PlayStation YouTube account, a trailer for a World of Tanks update, has over 300 comments, most of them yelling at Sony over the news. Usually these videos, outside of the biggest trailers, get less than 50 comments.

This has been going on for a week. Somewhat amazingly, Sony has been running with a typical playbook of ignoring the backlash entirely and waiting for it to just go away. The PlayStation ExTwitter account went fully silent for nearly a week after the news broke, which is one more giant middle finger to its own customer base. At the time of this writing, July 7th, the account finally posted again… to pitch a new wireless flight stick. The reaction to that was, well…

In less than an hour, Sony’s fight stick video received over 12,000 negative comments and nearly 4,000 angry quote-tweets. If there is anyone in there defending the company’s move to all-digital, I couldn’t find it. “As was evident, PlayStation has followed the strategy of acting as if nothing had happened,” one fan wrote. “They think we’re going to forget it easily, but we can’t allow that. They’re trying to kill physical games with lies and using us players as an excuse. It’s shameful.”

The level of tone-deaf going on at Sony over all this is fairly astounding. There is no support for ending all physical media on PlayStation consoles. None whatsoever that I can find. There is either silence or hatred.

For ownership rights, for preservation efforts, for collectors, and for many others, this may be a “Give me physical media or fuck all the way off” type scenario. We’ll now have to wait and see if Sony bothers to listen.

Filed Under: downloads, ownership, playstation, video games

Companies: sony

IBM’s 2025 Cost of a Data Breach Report found that 16% of breaches studied involved attackers using AI tools, most often for phishing or deepfake impersonation attacks. For security teams, that has direct implications for the service desk.

The service desk is a natural target for social engineering, as an attacker that convinces an agent they are a legitimate user may not need to bypass technical controls. They can simply ask for help getting around them. AI makes that easier, helping attackers sound more credible by personalizing their approach.

Onboarding is particularly exposed in a threat landscape where AI enables more convincing social engineering attacks.

New employees need fast access, but the organization may not yet have strong familiarity with who they are. Attackers can exploit that gap, so service desk agents need better ways to prove identity before they hand over credentials, reset MFA or approve sensitive changes.

Three ways AI aids service desk attacks

1. AI makes impersonation more convincing

High-profile attacks against M&S, MGM Resorts, Clorox and others all started with a simple question to the service desk: “Can you help me get access?”. From there, the threat actors gained access to accounts, escalated their attacks and cost the victim organizations millions.

Impersonation has long been a risk at the service desk, and AI makes it even harder for agents to judge whether a request is genuine.

Attackers can now use generative AI to create polished emails, convincing chat messages and realistic call scripts in seconds. In more targeted attacks, they can also use AI-generated voice or video to impersonate an employee.

Onboarding is especially exposed. New employees are not always known to IT teams, and first-day access issues are expected. An attacker posing as a new hire can use AI to sound credible, reference the right department and create just enough urgency to push a request through.

2. AI accelerates reconnaissance and personalization

More personal information is available on the internet than ever before, and AI helps threat actors find it.

When defending against onboarding attacks, this is a real concern. Organizations often share more than they realize. A welcome post might name a new employee, or a job advert might mention the systems the company uses. A LinkedIn profile might show the hiring manager, team structure and office location.

Threat actors can pull this information, then use AI to scrape more from LinkedIn, company websites, job posts, press releases and social media. They can then turn those details into a believable story. Names, roles, locations, departments, internal tools and reporting lines can all be worked into a script that sounds credible.

That level of detail can make a malicious request look routine. And when a request feels routine, it is more likely to move quickly.

3. AI helps attackers scale service desk attacks

An attacker no longer needs to create a social engineering campaign from scratch. They can use AI to create dozens of phishing email variations, test different pretexts and adapt their wording to tailor their efforts.

That creates a problem for service desks because they are built to respond quickly. Attackers know this, so use urgency and persistence to make a malicious request feel like another routine task in a busy queue.

AI makes it easier for attackers to adjust their approach, and they can try the same basic request across multiple channels or agents until someone approves the reset, releases the credential or changes the recovery method.

How to prevent AI-enabled service desk attacks

AI-enabled attacks are designed to look normal, so prevention cannot rely on service desk agents making perfect judgment calls under pressure.

It’s here that specialized solutions can help secure an especially high risk process the service desk deals with: onboarding.

Specops Secure Onboarding helps secure onboarding end-to-end and beyond, ensuring agents have the tools they need to confidently verify identity and protect new credentials from interception.

1. Secure password delivery during onboarding

A new starter needs credentials quickly, but sending a password via SMS or email creates risk if it’s intercepted.

A safer approach is to not send credentials at all. Specops Secure Onboarding instead allows the IT team to send secure enrollment links to new hires, with instructions explaining how to create their own strong passwords. As there’s no credential created or shared from the service desk, this eliminates the risk of interception.

2. Use biometric liveness detection to defeat impersonation

Traditional identity checks are becoming less reliable; for instance, the answers to security questions can often be guessed from information an attacker can source from social media profiles.

Especially in instances where the service desk may not be familiar with the employee,  such as a new starter on their first day, agents need confidence that the person requesting access isn’t an attacker impersonating a genuine employee.

Biometric liveness detection, delivered through solutions like Specops Secure Onboarding, can help by confirming that a real person is present during verification, rather than a static image, recording, mask or deepfake. This is especially useful for remote onboarding, where the service desk may never meet the employee face to face.

3. Verify identity before sensitive service desk actions

Sensitive actions need stronger identity verification before they are approved. For instance, a request to reset the password of a privileged account should trigger checks as biometric liveness detection to provide high assurance that the request is genuine and the person making it linked to the correct account.

Specops Secure Onboarding ensures that verification takes place before agents complete actions like password resets. Agents can enforce verification through strong identity checks and make trust decisions with greater confidence.

Protect your service desk from AI-enabled attacks with Specops 

Specops Secure Onboarding helps organizations secure the service desk during high-risk actions by placing identity verification at the center of processes like onboarding, delivering: 

• Stronger protection against identity-based attacks: Replace assumed trust with verified identity throughout onboarding, helping service desk teams defend against AI-powered impersonation.
• A consistent onboarding experience: Give every new starter the same secure process, wherever they are based, without adding unnecessary friction for HR teams or employees.
• Less risk at the service desk: Verify identity before sensitive actions are taken, so agents are not left to judge whether a request is genuine based on trust alone.

If you’re interested in seeing how Specops Secure Onboarding can help your service desk defend against sophisticated social engineering attacks, contact us today or book a demo.

Sponsored and written by Specops Software.

Microsoft has released a security patch to address a Defender zero-day vulnerability known as “RoguePlanet,” disclosed after the June 2026 Patch Tuesday.

The flaw (tracked as CVE-2026-50656) was disclosed by a security researcher using the “Nightmare Eclipse” handle as part of an ongoing dispute with Microsoft over the company’s bug bounty and vulnerability disclosure practices.

They also shared a proof-of-concept exploit in a self-hosted Git repository, claiming that Microsoft had previously removed their repos hosting exploits on GitHub and GitLab.

According to Nightmare Eclipse, RoguePlanet affects fully patched Windows 10 and Windows 11 devices, allowing attackers to spawn a command prompt with SYSTEM privileges via a Microsoft Defender race condition.

“The exploit is a race condition, so it’s a hit or miss. I have managed to get a 100% success rate on some machines while it struggled to work on others,” they explained. “The PoC for RoguePlanet works regardless if real time protection is on or not,” the researcher added in a follow-up update.

Microsoft confirmed it was working on a patch for CVE-2026-50656 on June 16, but has yet to acknowledge that Nightmare Eclipse discovered the vulnerability.

Patched via Malware Protection Engine update

On Wednesday, the company addressed the RoguePlanet vulnerability by releasing Microsoft Malware Protection Engine 1.1.26060.3008, an update to the core scanning engine that powers its security solutions and services.

“Microsoft has released an update to the Microsoft Malware Protection Engine that addresses the vulnerability identified by CVE-2026-50656. Please see the FAQ for more information on how to check if the new version has been installed,” Microsoft noted.

Over the past several months, Nightmare Eclipse has disclosed multiple other Windows zero-day exploits, including for the BlueHammer, RedSun, GreenPlasma, MiniPlasma, YellowKey, and UnDefend flaws.

While some of these security vulnerabilities affect Microsoft Defender, others target BitLocker and Windows components. Microsoft fixed the GreenPlasma, MiniPlasma, and YellowKey flaws one month ago as part of the June 2026 Patch Tuesday updates.

Microsoft has also reacted to Nightmare Eclipse’s disclosures by issuing warnings of legal action against people engaging in what it described as “malicious activity causing real harm to our customers,” leading cybersecurity experts to believe that Microsoft was directly threatening the security researcher.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Through the looking glass: Meta launched a new AI image-generation model called Muse Image this week, letting users create, edit, and blend photos using natural language prompts inside Meta AI, with the tool already live on Instagram and WhatsApp and expected on Facebook and Messenger soon. However, the new feature is already raising privacy concerns, as it allows anyone to generate AI images using other people’s Instagram photos.

All public Instagram profiles are automatically opted into Meta’s new AI image platform by default, letting users generate AI images using someone else’s likeness simply by tagging their account in a prompt. Meta notes that users won’t be notified when someone uses their photos to generate an image, so they have no way of knowing how many images are being generated in their likeness, or by whom.

Thankfully, Meta says users can opt out of the image-generation feature without making their account private. To do so, open Instagram settings by tapping your profile picture, hit the hamburger menu in the top-right corner, then select Sharing and Reuse.

Under “Allow people to reuse your content on Instagram and with AI features on Meta,” toggle off both Posts and Reels.

Switching off those two options will prevent others from creating new AI images using your photos, but images that have already been created won’t be deleted. The only other way to stop random people from generating AI images with your photos is to make your account private, which limits your content to approved followers only.

Muse Image is currently rolling out on Instagram and WhatsApp and is expected to reach Facebook and Messenger soon. Meta will also bring it to advertisers through its Advantage+ Creative suite of AI-powered tools, which automates aspects of ad creation such as background generation, image animation, and music integration.

Meta has often drawn scrutiny from privacy advocates and industry observers over user privacy and data security. Earlier this year, the company’s smart glasses raised privacy alarms after contractors working with Meta in Kenya revealed they were being paid to review graphic and often intimate footage captured through the Meta AI Glasses, including clips of people using bathrooms, getting dressed, and engaging in sexual activity.

From Folarin Balogun’s suspended ban and Cristiano Ronaldo’s shortened suspension to the treatment of Iran and referee Omar Artan, so many aspects of World Cup 2026 have defied belief. But the brazen introduction of full-screen hydration break ads arguably tops the lot.

From the moment the USA was confirmed as a co-host, there were light-hearted rumours that this beautiful game of two halves could be disfigured by the introduction of additional breaks for commercials, a la the NFL and NBA.

Elin Hilderbrand’s novel was published in 2023, and TV studios wasted no time in battling to bring the story to the small screen. Peacock won, and The Five-Star Weekend is set to be one of the hottest new drama series to hit streaming this summer.

Jennifer Garner leads a sterling cast including the likes of Timothy Olyphant, Gemma Chan, Regina Hall, and Chloe Sevigny in this story of grief and friendship set against the backdrop of a luxurious coastal landscape of Nantucket.

Truecaller has opened a public fight with India’s telecom regulator over rules governing caller ID apps, saying the country’s anti-spam framework is making it harder to protect consumers from unwanted calls in its biggest market.

On Wednesday, CEO Rishit Jhunjhunwala (pictured above) took to X to publicly challenge the Telecom Regulatory Authority of India (TRAI), accusing the watchdog of preventing Truecaller from displaying community-reported spam information for calls from the country’s dedicated 1400 and 1600 number series, a restriction he said had enabled abuse of those numbers and eroded trust in legitimate business calls.

The dispute stems from a framework introduced in 2024 under which India’s telecom authorities designated the 1400 and 1600 number series for commercial communications, with businesses using the former for telemarketing calls and the latter for service- and transaction-related calls. TRAI later mandated the migration to the dedicated numbering series, saying the move would help consumers identify legitimate business communications and curb spam and scam calls.

The framework was rolled out amid growing concerns over spam and scam calls in India, one of the world’s largest telecom markets, where regulators and telecom operators have rolled out multiple measures to curb fraudulent communications. Last year, the Indian communications ministry said authorities disconnected more than 2.1 million fraudulent mobile numbers and took action against more than 100,000 entities over the preceding year, underscoring the scale of the challenge.

Jhunjhunwala argued the policy has produced unintended consequences. Citing internal company data, he said consumers have increasingly lost trust in the designated number series, with Truecaller users ignoring 81% of calls from the 1400 series and 79% from the 1600 series over the past eight months. During the same period, users manually blocked 74 million calls from the two number series, while daily blocking actions against 1600-series numbers have more than tripled since October 2025, he said.

Unable to mark those numbers as spam, Truecaller instead introduced a “Frequently Blocked” badge to alert users when a number from the designated series has been blocked by many people.

The unusually public criticism came after Indian business daily The Economic Times reported that TRAI had sought powers under India’s Information Technology Act to take action against caller ID apps such as Truecaller, Hiya, and Whoscall for labeling numbers from the designated 1400 and 1600 series as spam.

TRAI and India’s Ministry of Electronics and Information Technology, which would consider any such proposal, did not immediately respond to requests for comment.

The dispute comes at a pivotal time for Truecaller, whose core caller ID business has been facing growing regulatory and competitive pressures as the company expands into new products and services. India remains its largest market by a wide margin, with more than 350 million of its 500 million monthly active users based in the country, according to the company.

Jhunjhunwala said Truecaller would share its data with the Indian IT ministry as part of the regulatory process, arguing that any decision on caller ID apps should be evidence-based.

“Penalize the bad actors, not the ones like Truecaller that make a significant positive impact,” he wrote.