Sony has expanded its flagship noise-cancelling headphone range with a new finish for the WH-1000XM6, introducing an Olive Gray colourway aimed at buyers looking for a more understated design.

The new option joins the existing Sand Pink and Sandstone finishes. Sony describes Olive Gray as part of its collection of nature-inspired colours designed to offer a more timeless look. In addition, the company says the muted earth tone is intended to complement a wide range of styles while avoiding trend-led colour choices.

Apple’s iCloud Private Relay feature is designed to obscure your web traffic so sites like advertisers, unscrupulous governments or malicious attackers can’t trace that traffic back to you. But it turns out the mechanism isn’t actually as private as Apple says.

As reported by 404 Media, security researchers at software company Mysk discovered that even with iCloud Private Relay active, the IP address of a device or home network can be transmitted, which could be used to reveal a person’s identity or location.

iCloud Private Relay is a feature for paid customers of Apple’s iCloud Plus service. It routes web traffic through proxy servers, obscuring your IP address and the website address you’re visiting, so neither the site nor Apple can see that information.

It’s also a feature that runs within Apple’s WebKit framework, which includes the Safari browser and other apps and services that use WebKit to access websites. It’s specifically not a VPN (Virtual Private Network), which encrypts all internet traffic and runs it through a proxy server.

The researchers, Talal Hak Bakry and Tommy Mysk, set up a website that lets you check whether your connection is vulnerable. When I tested it using an iPhone 17 Pro and a MacBook Pro with iCloud Private Relay enabled, it correctly identified the IP address of my home internet router.

In a post on X, the researchers noted that they chose to make the vulnerability public rather than report it to Apple first.

“Unfortunately, our past experience with Apple tells us that reporting this issue would involve months of delays, inconsistent communication, and in some cases, denying the issue’s impact entirely,” the researchers wrote. “We weren’t willing to wait months, or upwards of a year, sitting on bugs that undermine the core privacy guarantees of [Mysk’s browser] Psylo and iOS Tor browsers while saying or doing nothing.”

An Apple representative didn’t immediately respond to a request for comment.

How iCloud Private Relay is being bypassed

One problem is related to passkeys, the method of signing into sites that’s more secure and user-friendly than usernames and passwords. WebKit bypasses the Private Relay proxy and sends requested information directly from the device.

“Because the fetch is issued by the operating system’s credential service rather than by Safari, it never enters Private Relay’s proxied path,” the researchers wrote on the Mysk blog. “The destination server sees the device’s real IP address either way.”

There are two other paths that can reveal your IP address even with iCloud Private Relay enabled.

DNS prefetching is a way for websites to request data before it’s needed to speed up the connection. That happens separate from the relay mechanism, so the data is passed directly from your network to the website. However, a site must include the code in its HTML to trigger it.

The third vulnerability is with a low-latency method called WebTransport where WebKit opens a direct connection that bypasses the private relay and sends the user’s real IP address.

Apple’s security also took a hit recently when a bug in Apple’s iCloud Hide My Email feature seemed to expose people’s real email addresses. It, too, is a paid feature of iCloud Plus and is now the focus of a lawsuit accusing Apple of false advertising, fraud and breach of contract.

Jeff Carlson

Senior Writer

Jeff Carlson writes about mobile technology at CNET, from cellular phone plans to devices and emerging technology.

See full bio

Advertisement

Ripple effect: In the run-up to the launch of the foldable iPhone Ultra, iPhone 18, and iPhone 18 Pro, Apple and its assemblers are working to secure enough mobile DRAM. Apple leans heavily on Micron for these chips and also buys from SK Hynix and Samsung. People involved say they still expect to meet initial demand, but they worry online wait times could stretch and store inventory could run out quickly if the shortage continues.

Apple’s next iPhones are built around a new chip and packaging setup that pairs the A20 Pro processor with high-performance DRAM at the wafer level, and that packaging step is being slowed by a tight memory market, according to sources who spoke with Taipei-based journalist Tim Culpan.

The core of the new lineup is the A20 Pro chip, Apple’s first processor built on TSMC’s N2 node, which moved into volume production earlier this year. The chip isn’t shipped alone: it’s packaged together with DRAM using TSMC’s Wafer-Level Multi-Chip Module process, or WMCM.

This replaces the Integrated Fan-Out (InFO) approach TSMC has used for about a decade, and is roughly “CoWoS for mobile,” as Culpan has described it, drawing a parallel to the company’s advanced CoWoS packaging for data-center AI chips.

On the front-end side, N2 is produced at Fab 20 in Hsinchu’s Baoshan district and Fab 22 in Kaohsiung, with Fab 22 set to be the main hub for Apple’s chips. WMCM is being tested on pilot lines at Advanced Packaging Fab 3 in Longtan and will mainly be handled at AP7 in Chiayi once that site is fully online.

Earlier this year, Culpan reported that demand for N2 is strong enough that capacity is booked out through the end of next year, a sign of broad interest in the node from multiple customers. Despite that demand, N2 itself isn’t the bottleneck. Sources say A20 Pro production on N2 is running well, with good volumes and yields. The problem is DRAM.

Wafers with A20 Pro dies are stacking up while they wait for memory chips to arrive for WMCM packaging. Until that DRAM is in place, those processors can’t move further along the assembly line. As a result, TSMC is holding around $1 billion worth of Apple processors that are ready on silicon but stuck waiting for memory.

TSMC’s recent earnings call offered a clue to this buildup. In comments that drew little attention at the time, CFO Wendell Huang told investors that inventory days had increased seven days to 87, “primarily due to the ramp of N2 technology.”

Inventory is now 11 days higher than a year ago and seven days above the prior quarter, figures that match a situation where wafers and partially processed chips are sitting in the pipeline, consistent with the current DRAM-related packaging delay.

Downstream, the shortage is also affecting board and device assembly. Main logic board assembly and final iPhone production are being done in China, with BYD and Foxconn as the primary producers, according to Culpan’s sources.

Without enough DRAM-equipped WMCM packages, those assemblers have less time to ramp up and build stock before launch, raising the risk that some models could be scarce in the early weeks.

Apple plans to make about 200 million units of the foldable iPhone Ultra, iPhone 18, and iPhone 18 Pro over the life of this generation, assemblers have been told. Less than 10% of that total will be the Ultra, which various reports have hinted will sell for more than $2,000. The remaining units will be split evenly between the Pro and standard versions.

For now, Apple and its partners are focused on pushing more DRAM into the WMCM flow fast enough to keep that plan intact. The N2 node is ramped and the packaging infrastructure is being built out, but the pace of Apple’s most advanced mobile architecture still hinges on how quickly its key memory suppliers can deliver.

The Justice Department’s Civil Rights Division announced on Wednesday that OpenAI, and its once-subsidiary Statsig, signed a settlement that includes three years of oversight over the AI lab’s hiring practices.

The DOJ has alleged that these companies used various tactics to prevent U.S. citizens from applying for jobs held by immigrant employees when the companies were sponsoring those workers for permanent U.S. residence. The companies did not admit to wrongdoing, although they did agree to pay $3.2 million. Of that, $1.2 million is a fine and the remaining $2 million is being set aside to pay restitution to U.S. citizens who applied to those jobs, should the DOJ find any who were harmed.

The DOJ alleged that OpenAI and Statsig broke provisions of the Immigration and Nationality Act (INA) by not truly looking for qualified U.S. citizens for these jobs before pursuing permanent residence applications (PERM) as the INA requires. The DOJ said they didn’t list roles on public job boards, advertised on the radio late at night, and required paper applications rather than electronic ones.

While there were fewer than 10 roles at issue, the DOJ said that as part of the settlement, the companies must pay the fine and submit to oversight by the department over their PERM roles. Oversight includes items such as drafting and obtaining approval for their PERM-role hiring policies and submitting semiannual reports. Those reports must include how many applications for foreign employees they pursued, how many U.S. citizens they interviewed, and other statistics.

OpenAI acquired AI A/B testing company Statsig in September 2025 and later divested at least part of the business in May 2026. The DOJ, however, says it began investigating both companies separately before the acquisition, in August 2025, including five cases at OpenAI between 2023 and 2025, and one at Statsig.

The DOJ says that this settlement is part of its increased crackdown on companies over the matter. However, the INA, a law passed in 1952, has been enforced by other administrations against other Big Tech companies. During Biden’s administration, for instance, both Facebook and Apple signed similar settlements, though in both of those cases the DOJ alleged that the violations were widespread and systematic.

WhatsApp already lets channel admins mark sponsored posts with a paid partnership label, a feature that started rolling out last month on Android and iOS. Now the app is cooking up something similar, but this time for AI-generated media. The idea is to keep followers in the loop when a photo or video wasn’t captured with a camera but conjured up by an AI tool instead.

How will the new AI label work?

WaBetaInfo spotted this feature brewing inside the WhatsApp beta for Android, version 2.26.31.1, currently available on the Google Play Store. Once it goes live, admins will be able to tap and hold an update containing AI-generated media to bring up the context menu, where a new “Add AI content label” option will appear. 

Tap it, and a visible tag gets attached to the message bubble so followers instantly know they’re looking at AI-made content. Once the label is added, admins likely won’t be able to remove it, so it pays to double-check before hitting share.

Not everything needs the tag, though. Plain text messages, even ones drafted using WhatsApp’s own Writing Help tool, seem to be exempt from this rule. 

Why do admins need this AI label?

Turns out, it’s not just about being a good digital citizen. Several countries now have laws that require apps to disclose AI-generated media, and this label gives admins a simple way to stay compliant without extra hassle. Best of all, it doesn’t play favorites. Whether you made your image using Meta AI, ChatGPT, Gemini, or literally any other tool, the label applies the same way.

For now, this feature is still baking in the Android beta, and testers don’t have access to it just yet. WhatsApp is also working on bringing the same label to iOS, so it won’t stay an Android exclusive for long. There’s no word yet on a public rollout date, but we’ll keep an eye on it.

It’s rather awkward when you buy a piece of hardware like a sketchy router to make a video about its hidden admin password backdoor – known as CVE-2026-11405 – only to discover that you bought the wrong Tenda router, namely the AC10V6 model. After making this mistake, [Low Level] did the only reasonable thing one ought to do in this case, and try to find an exploit in this ‘wrong’ router as well.

The obvious start here is to do the same as with the other exploit, in that you download a firmware image from the manufacturer’s website, then pluck it apart using binwalk to do an initial check for juicy files. After that tools like Ghidra can be used to do a more in-depth analysis of any binary files, with a special focus on things like user-facing elements like login screen, as input validation will likely forever remain the number one type of exploited CVE.

One major change that Tenda made here was to encrypt the firmware image, which seemed suspicious. With that easy path blocked, the research of others on different Tenda routers was looked at, including the AC20 with the fascinating Telnet exploit in the form of CVE-2025-9090 where merely poking a file on the device turned on the Telnet service. This left the minor issue of finding a password to log into said Telnet session.

This is where CVE-2025-52054 comes in handy, as this explains how to calculate the root password of a Tenda router using a static string and the last two octets of the device’s MAC address. The unfortunate aspect here is that this static string is unknown for this particular router, and the AC8 version did not work. Luckily, for some unknown reason Tenda did decide that they had to print this secret information to the serial output, ergo it was time to probe the UART pins on the router’s guts.

One hard reset later and the console output on these UART pins happily showed that the password pre-Base64 encoding was 9cUFeUZC_125700. Mashing in the Base64-encoded string in the Telnet login gave root access and completed the first step of the whole fun, as now [Low Level] also had access to the decrypted firmware including the decryption keys for the previously safely encrypted firmware image.

There will be a blog post published with likely the keys and other details after clearing it with [Low Level]’s lawyer, but even at this point it’s truly a tragedy of CVEs on the side of Tenda that led to this outcome. If you ever needed a reason not to let friends use Tenda routers, this has got to be another good reason.

Meta, considered a bit of a straggler in the AI harnesses realm, is making strides to catch up. This week, the company released a new terminal coding agent aimed at programmers looking for assistance with complex tasks across large software code bases.

Muse Code, which is currently available in beta, can accomplish “complete software engineering tasks across large repos,” Meta CEO Mark Zuckerberg said in a social media post on Wednesday. Those tasks include “planning changes, writing code, validating the results,” he added.

Code, which can be installed with a single command, is powered by Meta’s previously released coding model, Muse Spark. It handles large projects by launching its own agents, which then work simultaneously.

“When a job is big enough, it fans out to separate sub-agents working in parallel in isolated worktrees,” Zuckerberg explained. “Your working copy is never touched. In testing we had it build six features for a game simultaneously with no collisions.”

The move attempts to position Meta more competitively, and more affordably, with AI lab peers like OpenAI and its coding agent Codex, and Anthropic with Claude Code.

“We think that for a lot of workflows and a lot of use cases, this can be an incredibly good option, especially from a cost perspective,” Alexandr Wang, Meta’s AI chief who leads Meta Superintelligence Labs, told the Wall Street Journal.

Meta has been attempting to grow its AI presence by pouring money into development. In June, it expanded beyond its core focus of using AI to support its advertising business and entered the enterprise AI market with an agent aimed at customer service and support.

Let’s cut to the chase: Starting today, you can take an additional $100 off of our current $300 discount for your founder, investor, or attendee TechCrunch Disrupt 2026 pass, which is a nice bonus on top of our current discounted pricing. 

This flash sale will run all week, up until Friday, August 7 at 11:59 p.m. PT. This discount will mark your last chance at a bonus deal before our next pricing tier kicks in on August 21. 

Register with this link to lock in your extra $100 off.

If you need to learn more before locking in your plans, Disrupt takes over Moscone West from October 13–15, bringing more than 10,000 founders, VCs, tech industry innovators, and builders for three days built around one thing: creating momentum for future success. 

This isn’t a passive conference you simply watch — it’s a curated itinerary of speakers, workshops, network opportunities and post-event excitement for those actively building, investing, and looking for what’s next. 

The Disrupt Stage: The conversations everyone will be talking about 

The Disrupt Stage is our flagship programming, and we just revealed the initial lineup. We’ll dig into the biggest shifts in tech right now, whether it’s a post-smartphone future with Amazon’s SVP of Devices and Services Panos Panay; the real implications of a world in which everyone can develop their own software, with Replit founder and CEO Amjad Masad; and much, much more. 

But that’s just one stage. Disrupt 2026 also features the: 

AI Stage, covering the security gaps and business model shifts AI is forcing on every SaaS company.

New Smart Money Stage, tackling stablecoins, instant payments, and AI’s role in financial trust. 

New Smart Systems Stage, with a perspective on fusion breakthroughs and grid strain powering AI’s next decade. 

Builders Stage, the long-standing favorite stage where founders and investors get tactical about raising, hiring, and scaling. 

Beyond the stages 

Most Disrupt passes also unlock Startup Battlefield, where 200 startups will compete live for the Battlefield Cup. You’ll also get access to networking opportunities driven by your needs as a founder, investor, or learner, plus our Expo Hall, where hundreds of startups showcase their work. 

This flash sale ends Friday 

After 11:59 p.m. PT on Friday, August 7, this extra $100 savings goes away. Regular discounted pricing ends on August 21. If Disrupt is on your radar for this year, this is the best deal you’ll get between now and the event. 

Save an extra $100 before Friday.

We’ll see you October 13–15 at Moscone West in San Francisco!