It’s officially the Ternus era at Apple.  

Tim Cook stepped down as CEO this week, handing the company to former hardware chief John Ternus, whose first memo promised a “huge launch next week” — timing that puts Apple’s next iPhone event on his desk before he’s even settled in. Cook isn’t going far, though: he’s staying on as Executive Chairman, focused on the kind of policy relationships that recently turned something as small as a map label into a very public balancing act. All of which raises an obvious question: what does the Ternus era look like, and how much rope will shareholders give him to figure it out? 
 
On this episode of TechCrunch’s Equity podcast, hosts Kirsten Korosec and Sean O’Kane unpack what Ternus is walking into, why he may actually be better positioned to make progress on software than hardware in this new AI era, and more of the week’s news. 

Subscribe to Equity on YouTube, Apple Podcasts, Overcast, Spotify and all the casts. You also can follow Equity on X and Threads, at @EquityPod. 

Nintendo just announced two livestream events for next week. There’s one to celebrate the 40th anniversary of The Legend of Zelda on September 8 at 10AM ET and another traditional Nintendo Direct on September 9, also at 10AM ET.

The Zelda stream will last around 30 minutes. It’s being advertised as a celebration of the iconic franchise’s 40th birthday, but it’ll probably spend most of its time on that upcoming Ocarina of Time remake. The company first announced this game back in June and it looks like a full redesign of the N64 classic.

Of course, it’s always possible the company will take that time to tease another Zelda game coming at a later date. Unfortunately, I think it’s still too early to get any news on a mainline entry, like the follow-up to Tears of the Kingdom. I suppose we could get another 2D game or some kind of Mario Kart World cross-promotion or something. It’s also likely we’ll get a short teaser for the Zelda movie.

The standard Direct livestream on September 9 is a bit more mysterious. It’s highly probable the Ocarina of Time remake is the company’s big holiday release, though there’s other stuff coming out in the next few months. We’ll probably get a final trailer for Fire Emblem: Fortune’s Weave, which comes out on September 17. Nintendo Switch Sports Resort, another pseudo-sequel to Wii Sports, will be released on October 22, so expect some new footage. Despite the name, it’s a Switch 2 exclusive.

It’s likely we’ll see trailers for some cross-platform holiday releases, like Dragon Quest Monsters: The Withered World and Final Fantasy Resonance. Past as prologue, we’ll also get footage of dozens of cozy games and the like.

However, this Direct is slated to last 45 minutes. That’s a lot of time for surprises. The Switch 2 has been out well over a year now and there’s still been no news of an upcoming mainline Mario game. The same goes for the Animal Crossing, Super Smash Bros. and Pikmin franchises, among others. Hope springs eternal. 

In any event, the company expects some excitement regarding these two streams. There’s a two-hour Treehouse event scheduled for 10:45AM ET on September 9. Treehouse streams typically show people playing games that were just announced.

NASA and the ESA said the vast central void seen above measures around 210 by 140 light-years in area, and was likely created by the stars visible at its centre.

NASA and the ESA have published striking images of a nebula ‘superbubble’ in the Dorado constellation that were captured using the Hubble Space Telescope.

‘LHA 120-N44’ – or N44 – is described as “a complex nebula filled with glowing hydrogen gas, dark lanes of dust, massive stars and many populations of stars of different ages”.

N44 is part of the Large Magellanic Cloud (LMC) – the largest of the small galaxies that orbit our Milky Way galaxy, according to the space agencies, and about 160,000 light-years away from Earth.

The superbubble – the vast central void visible in the image above – measures around 210 by 140 light-years in area, and was likely created by the stars visible in its centre, according to the agencies.

N44 spans about 1,000 light-years overall, and is described as a “highly active star birth site”. The stars at the centre of the bubble are thought to have expelled – through “powerful stellar winds and explosive supernovae” – much of the gas from which they were created.

This dislodged gas then compressed and formed a dense and dusty ‘shell’ around the bubble, now visible as the colourful perimeter to the central dark void.

NASA and the ESA said that new star formation within the nebula’s compressed gas shell is ongoing, and the subject of study by astronomers, who want to figure out the duration between the collapse of cold gas clouds into dense knots and the moment when nuclear fusion ignites in the heart of a newborn star.

A possible 5m-year age difference between stars within the superbubble and at its rim was previously identified by NASA.

The deep blue area to the bottom-right of the superbubble is one of the hottest regions of the nebula, according to researchers, and the site of the most intense star formation. N44 is an emission nebula, which means its gas has been energised, or ionised, by the radiation of nearby stars.

A separate, smaller bubble formation is visible in the top-right of the image – this is known as N44F and is an “interstellar bubble blown by the intense stellar winds of a single hot and massive star”.

The image displayed derives from research using Hubble to take a census of N44’s stars, of which around 500,000 have been catalogued – with 30,000 deemed to be “pre-main-sequence stars” that have yet to begin fusing hydrogen into helium in their cores.

NASA recently launched a new space telescope, the Nancy Grace Roman.

In May, its James Webb telescope was used to detect clear evidence that some supermassive black holes were enormous from the beginning, forming without a stellar collapse phase and without a significantly more massive host galaxy to feed them.

In January, Hubble was used to capture images of ‘infant stars’ as part of the Sofia Massive Star Formation Survey.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

from the not-sure-you-did-your-homework dept

Just so we’re clear: pre-merger promises (especially in the media and telecom sectors) are absolutely worthless. There’s fifty years of indisputable evidence that all of the “synergies” and innovative improvements promised on the front end of major media mergers mean absolutely nothing. Especially in a country dead-set on defanging its labor and consumer protection regulators.

To sell their unpopular $111 billion merger with Warner Brothers, Paramount/CBS executives continue to make the promise that the newly-merged company will produce 30 major films per year. It’s again a worthless promise that ignores all the massive pressures the bigger debt-riddled company will face in a sector where broadcast TV is dying and brick and mortar theaters are struggling.

There’s very little indication that this megadeal even ends with a functional company, much less 30 films a year. The massive debt from these transactions always results in higher prices, mass layoffs, and shoddier quality product due to corner cutting. 30 films a year simply isn’t something you can promise.

But the kind of Hollywood insiders that have tethered their horses to David Ellison have unsurprisingly come on in defense of what’s abjectly a terrible deal. Director James Cameron, for example, came out last April in full-throated support of the deal, propping up the Ellison family’s claim that significantly more media consolidation will result in bold new storytelling and a healthier Hollywood.

Now it’s apparently Tom Cruise’s turn to prop up the shitty deal. The Scientologist movie star went on The Pat McAfee Show to help sell Larry and David Ellison’s empty promise:

“They’re going to deliver 30 movies,” Cruise said on The Pat McAfee Show of the Paramount CEO’s sometimes-mocked vow to increase film production and releases. “It’s a community to me. It’s not an industry. The people in these studios are not just people in the studios. They’re my family.”

I think Cameron and Cruise really do love traditional movies in traditional theaters, and probably do think they’re “helping.” I suspect they haven’t really done the math or spent much time studying the academic literature on U.S. media consolidation, and are just basing their support on their personal financial ties to Ellison (who has thrown a lot of money into Cruise’s Top Gun revival in particular).

The 30 film promise exists to largely get traditional theater owners and guys like Cruise and Cameron on board. Though nobody will confirm this and they’re not sharing the actual document, there’s some talk they put the promise in writing for major theater chains. But that’s again meaningless if the company’s high-debt load, incompetence, and sagging viewership derail the company’s finances.

For what it’s worth, another top U.S. male lead, George Clooney, has taken the opposite tack, last week proclaiming he didn’t see how the deal or its promises make any coherent financial sense.

Clooney’s right to worry. The deal will result in untold thousands of layoffs as Paramount attempts to shift the debt load of this deal to consumers and labor. We know this because this is what always happens. You might recall the AT&T DirecTV/Warner series of mergers resulted in 50,000 people losing their jobs, something curiously left unmentioned by most press coverage of Paramount’s latest merger promises.

Pretending that mass layoffs aren’t going to happen is like boldly declaring you’re going to win a boxing match with the Colorado river. Mass layoffs are simply physics when it comes to this sort of debt-heavy consolidation.

And that’s before you get to potential price hikes, corner cutting eroding product quality, the deal’s dodgy funding by a bunch of Middle-East autocrats with a history of killing journalists, or the fact that billionaire Larry Ellison is a Trump-ally keen on converting both CNN and CBS into right wing oligarch-friendly agitprop machines aimed at undermining foundational Democracy.

What kind of gift is that to give your purported “family?” A recent survey indicated that most Americans aren’t buying the consumer benefits Paramount is selling, which is why the company has resorted to using fake consumer groups wielding fake AI-generated support to try and scuttle the 12-state antitrust lawsuit aimed at slowing harmful U.S. media consolidation.

Filed Under: ai, astroturf, consolidation, david ellison, hollywood, james cameron, larry ellison, media, mergers, tom cruise

Companies: paramount, warner bros.

Iris Software Group’s research explored how more established employees are unwilling to train up less experienced peers who are on a similar salary.

Much is expected of employees in 2026, particularly in the wake of a working environment that has been transformed and reimagined multiple times since the introduction of AI and workplace automation.  

Professionals are often expected to work across a range of teams, to hold a diverse yet specialised skillset and to undertake additional responsibilities, often for a salary that is not reflective of the work being carried out. 

One such obligation often bestowed upon professionals is duties related to the training and support of younger or less experienced co-workers, often as a means of creating a consistent and in-house system of learning. It also means that if and when a professional moves on from the role, there is an equally qualified person ready to step into the position. 

This is the focus of new research conducted by Iris Software Group. On behalf of the organisation, Censuswide collected data from 511 UK-based senior HR professionals and 500 UK employees who have been in full-time work for between two and five years. 

What was discovered is that 71pc of young professionals that have been employed for between two and five years find it difficult to feel motivated to train or help a new starter earning almost as much as them.

In scenarios where a young professional discovered what a new starter earns, 24pc said that it was the same as their own salary. Almost 40pc said that it was up to £1,000 less, while only 16pc said it was between £1,000 and £3,000 less. A further 16pc said that they had discovered new starters were being paid more than they were.

Commenting on the report, Stephanie Coward, the managing director for HCM at Iris, said: “It’s not surprising to see frustration building when young professionals are taking on harder work, more responsibility and helping train the next intake, but see almost no difference in their pay.

“Businesses have faced genuine pressure to raise starting salaries, including increases to the National Minimum Wage and National Living Wage. But this isn’t only being driven by forces outside employers’ control. HR professionals also pointed to internal issues such as salary bands not being reviewed regularly enough.”

Core concerns

Almost a third (32pc) of HR leaders who participated in the research admitted that the gap between young professionals and those who are just starting out has narrowed over the course of the last two years. 

Among the factors noted by the report as having a part to play in pay compression are rising national minimum and living wages in the UK, as well as companies increasingly prioritising attractive starter salaries over pay rises for the existing staff. 

The research also indicated that there is little positivity among HR leaders that this pay compression is going to improve. Almost half (46pc) of contributors explained that they expect salary bands to narrow further over the course of the next two years.

Among the surveyed young professionals who learned what new starters were being paid in comparison to themselves, 69pc said it had left them feeling undervalued, frustrated or disappointed. Some were motivated to take action, as 16pc accepted a new job offer and a third requested a pay increase. 

Moreover, despite 84pc of participating HR leaders concerned about the risk of losing the loyalty of young professionals who feel as though their pay does not reflect their additional responsibilities and experience compared to new recruits, only 20pc have plans to make targeted salary adjustments.

Coward said: “Compounding the problem, almost a quarter (23pc) of HR leaders said their current HR systems are not capable of comparing pay against changes in employees’ skills and responsibilities, making it harder to identify where pay compression is emerging and which employees are most affected.

“Most businesses won’t be able to solve this with blanket pay rises. But they do need to understand where compression is happening and where it risks costing them good people. A targeted salary increase may look expensive, but so is losing an experienced employee, recruiting their replacement and rebuilding the knowledge that walks out of the door with them.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Apple has reportedly scrapped plans for two new MacBook models, including a large foldable MacBook and a larger OLED model that would have sat above the current MacBook Pro lineup.

According to research firm Omdia, Apple has canceled development of a foldable MacBook that would have measured between 16.1 and 18 inches when unfolded. The device had previously been linked to a 2026 production window, although earlier reports had described it as a large foldable iPad rather than a MacBook.

Apple has also apparently dropped plans for a separate OLED MacBook measuring between 14.4 and 16.1 inches. This model would have occupied a new tier between the existing MacBook Pro sizes and the cancelled foldable MacBook. With both products seemingly off the roadmap, the 14.3- to 16.3-inch range will remain reserved for the MacBook Pro lineup.

Most true wireless earbuds are fighting the same war: better ANC, clearer calls, longer battery life, smaller cases, and increasingly elaborate software designed to convince us that Bluetooth earbuds require an engineering degree to operate.

HiFiMAN has apparently decided the category needs more resistors.

The new $299 Svanar Wireless 2 takes a less conventional approach by retaining the discrete R-2R digital conversion architecture that distinguished the original $499 Svanar Wireless, while shrinking the circuitry and earbuds themselves. Bluetooth moves from version 5.2 to 6.0, the internal DAC has been redesigned, each earbud drops from 8 grams to 7.4 grams, and HiFiMAN is finally developing a dedicated mobile app.

That last one deserves some emphasis. Our review of the original Svanar Wireless praised its sound quality but found its lack of an app, middling ANC performance, limited battery life, bulky charging case and occasional wireless instability difficult to overlook at $499. HiFiMAN clearly had some homework to do.

Svanar Wireless 2 does not abandon the company’s sound-first approach. Instead, HiFiMAN appears to be trying to make that architecture more practical and $200 less expensive.

Related Reviews:

What Makes Svanar Wireless 2 Different?

Most TWS earbuds rely heavily on highly integrated Bluetooth system-on-chip architectures that handle multiple stages of the signal path inside a compact package.

HiFiMAN does things differently.

The Svanar Wireless 2 uses the company’s new HYMALAYA Mini DAC, a dedicated R-2R digital-to-analog converter that keeps conversion separate from amplification. The signal then passes through an independent Class AB balanced amplifier, rather than combining DAC and amplifier functions into one integrated stage.

An R-2R DAC uses a precision resistor ladder to convert digital information into an analog signal. Implementing that approach inside a battery-powered earbud presents an obvious challenge: space.

The original Svanar Wireless required a stacked two-PCB architecture to accommodate its DAC and amplification circuitry. According to HiFiMAN, the new HYMALAYA Mini uses twice as many resistors while occupying one-fifth the space of the previous implementation.

That smaller footprint is what allowed HiFiMAN to reduce the size and weight of the earbuds without removing the architecture that made the original Svanar Wireless unusual.

Each earbud now weighs 7.4 grams, down from 8 grams on the original. That may not sound like a dramatic diet plan, but shaving weight and internal volume matters when the entire DAC, amplifier, Bluetooth receiver, battery, microphones and driver have to live inside something jammed into your ear canal.

Topology Diaphragm Returns

The DAC architecture might attract most of the attention, but it still needs something to turn the electrical signal into sound.

Svanar Wireless 2 uses a 10mm dynamic driver featuring HiFiMAN’s Topology Diaphragm technology.

The company’s approach applies a nanoparticle coating to selected areas of the diaphragm in specific geometric patterns. HiFiMAN says varying those patterns, materials and thicknesses allows its engineers to alter the diaphragm’s behavior and better control how it produces sound.

This technology is not new to Svanar Wireless 2. HiFiMAN has been using variations of its Topology Diaphragm in wired IEMs and previous wireless models for years. The important point here is that the company has retained the combination of its proprietary dynamic-driver technology, R-2R conversion and dedicated amplification rather than simplifying the audio path to reach the lower price.

HiFiMAN rates the frequency response at 10Hz to 35kHz, with onboard amplifier output specified at 45mW.

Bluetooth 6.0, LDAC and L2HC

Wireless connectivity has also received a meaningful update.

The original Svanar Wireless used Bluetooth 5.2. Svanar Wireless 2 moves to Bluetooth 6.0 and supports LDAC and L2HC for higher-resolution wireless transmission from compatible devices.

LDAC remains the more broadly relevant codec for Android users, although actual codec support always depends on the source device.

HiFiMAN also specifies up to 35dB of active noise cancellation, along with an IPX5 rating for resistance to water and sweat.

That still leaves an important question.

HiFiMAN’s strength with the original Svanar Wireless was sound quality, not class-leading ANC. Bose, Sony, Technics and others have spent years refining adaptive noise cancellation, microphone arrays and environmental processing. A specification saying “35dB” does not tell us whether Svanar Wireless 2 has closed that experiential gap.

We will need to hear it.

There’s Finally an App

The original Svanar Wireless launched without a dedicated control app, which was difficult to excuse on a $499 flagship wireless product.

HiFiMAN says that will change with the new HIFIMAN Mobile App, which is being developed to provide firmware updates, touch-control customization, EQ adjustment and other settings.

There is one caveat: HiFiMAN says the app will debut soon, so we would not describe it as an available feature until the company actually releases it.

Still, adding proper software support is overdue. Firmware updates should not feel like an optional luxury on premium wireless earbuds in 2026.

Battery Life

This is one area where HiFiMAN still does not appear determined to win the numbers war.

Battery life is rated between four and eight hours per charge, depending on operating mode and usage. The charging case can fully recharge the earbuds three additional times before the case itself needs charging.

That represents some improvement at the upper end compared with the original model, which HiFiMAN rated for up to four hours in HiFi mode, six hours with ANC and seven hours in Transparency mode.

Those figures remain modest compared with some current $300 competitors, however. Sennheiser rates its MOMENTUM True Wireless 5 for up to 12 hours without ANC and 6 hours with ANC, while Technics rates the EAH-AZ100 for 10 hours with ANC when using AAC.

Apparently even an R-2R DAC cannot repeal the laws of battery chemistry.

How Does It Compare?

The $299 price places the Svanar Wireless 2 directly in one of the most competitive parts of the TWS market.

Technics EAH-AZ100 — $299.99

The Technics EAH-AZ100 has been one of our favorites at the same price point. Its 10mm Magnetic Fluid Driver was derived from technology used in Technics’ EAH-TZ700 wired IEM and is designed to reduce driver distortion while delivering strong bass response and high-frequency detail. The AZ100 also offers adaptive ANC, LDAC, LC3, Dolby Atmos with head tracking, three-device multipoint connectivity and substantially longer battery life.

Although, Technics offers more features, HiFiMAN is betting its less conventional R-2R DAC and separate Class AB amplification architecture will give a sonic edge.

Sennheiser MOMENTUM True Wireless 5 — $299.95

Sennheiser’s new MOMENTUM True Wireless 5 uses a 7mm TrueResponse dynamic driver and supports aptX Lossless, aptX Adaptive, Bluetooth 6.0, hybrid adaptive ANC and Dolby Atmos spatial audio. Sennheiser also offers four microphones per earbud, including a bone-conduction microphone, and rates total battery life at up to 40 hours with the charging case.

Sennheiser is leaning heavily into acoustic tuning, codecs, ANC, call quality and software integration. HiFiMAN is putting more emphasis on what happens inside the actual digital-to-analog signal path.

Noble Audio FoKus Rex5 — $449

The Noble Audio FoKus Rex5 costs considerably more at $449 but may be the strongest competitor for listeners whose first priority is sound quality rather than maximum noise cancellation.

Noble packs five drivers into each earbud: one 10mm dynamic driver, three balanced-armature drivers and one planar magnetic driver. It also offers Bluetooth 5.4, multipoint connectivity and onboard storage for personalized EQ profiles.

Where HiFiMAN is using one sophisticated dynamic driver supported by unusual DAC and amplifier architecture, Noble attacks the problem with an elaborate multi-driver acoustic system.

Neither approach is remotely normal for mainstream TWS. That is precisely why both are interesting.

Svanar Wireless 2 Specifications:

• Type: True wireless earbuds
• Driver: 10mm dynamic driver with Topology Diaphragm
• DAC: HYMALAYA Mini R-2R
• Amplifier: Independent balanced Class AB
• Amplifier Output: 45mW
• Frequency Response: 10Hz to 35kHz
• Bluetooth: Bluetooth 6.0
• High-Resolution Codecs: LDAC, L2HC
• ANC: Up to 35dB
• Water Resistance: IPX5
• Battery Life: Approximately 4 to 8 hours, depending on usage
• Case Capacity: Three additional full earbud charges
• Weight: 7.4 grams per earbud
• App: HIFIMAN Mobile App announced; availability forthcoming
• Price: $299
• Availability: September 2026 through Amazon and the HiFiMAN online store

The Bottom Line

The original Svanar Wireless proved that HiFiMAN could make an unusually good-sounding TWS earbud. It also proved that great sound alone does not excuse every usability compromise when the asking price is $499.

Svanar Wireless 2 is interesting because HiFiMAN did not respond by turning it into another conventional Bluetooth earbud.

Instead, the company shrank its R-2R DAC architecture, retained separate Class A/B amplification and its Topology Diaphragm driver, reduced the weight, upgraded connectivity to Bluetooth 6.0 and dropped the launch price to $299.

That price is especially aggressive considering the original Svanar Wireless launched for $499 and the previous Svanar Wireless LE already occupied the $299 slot. HiFiMAN is effectively asking the new flagship to compete where its reduced-cost model used to live.

There are still questions. Battery life is not class-leading, the new mobile app has yet to arrive, and a 35dB ANC specification does not tell us whether HiFiMAN has caught Technics, Sony or Bose in real-world noise cancellation.

But $299 for a TWS design with a dedicated R-2R DAC, separate amplification and a 10mm Topology Diaphragm driver?

The wireless earbud category certainly did not need another anonymous pair of plastic blobs.

This isn’t that.

Where to buy: $299 at HiFiMAN’s Store

Related Reading:

Automatic pet feeders aren’t new, but most are limited to dispensing dry food. Strolling a press preview ahead of IFA 2026 in Berlin, I spotted a wild new take on the handy pet parent helper, and it’s basically an Instant Pot for cats.

OK, maybe it doesn’t pressure cook, sauté and steam like most multicookers, but it does churn out fresh meals on demand for your feline friend. Like an Instant Pot, all you have to do is add two ingredients, set it and forget it.

The Best Tech, All Tested by CNET Editors

Advertisement

Riko, the latest release from Neakasa, is a self-contained smart wet-food maker that prepares meals on demand (or whenever you schedule them via the app) and serves them to your cat at mealtime.

The unit, which is about the size of an average drip coffee maker, houses a compartment for freeze-dried food and a water reservoir. When activated, it rehydrates and mixes the cat food for a gourmet autonomous feeding experience.

As strange as it may sound, this one makes great sense for busy or forgetful owners of cats that prefer wet food. While it’s not advertised for dogs, we can’t see why this system wouldn’t work for small canines.

The Shenzhen-based brand is known for its self-cleaning litter boxes and automatic feeders. Until now, it didn’t have an answer for owners who feed their cats wet grub. Wet food feeders from other brands rely on refrigeration to keep preloaded meals cold until chow time, and most are limited to two or three meals. This is the first one we’ve seen that whips up your cat’s lunch in real time.

Rico retails for $200 and is available on Neakasa’s website.

Editors’ note: David Watsky’s travel costs for the IFA conference were covered by IFA. The judgments and opinions of CNET are our own.

David Watsky

Managing Editor / Home and Kitchen

David lives in Brooklyn where he’s spent more than a decade covering all things edible, including meal kit services, food subscriptions, kitchen tools and cooking tips.

David earned his BA from Northeastern and has toiled in nearly every aspect of the food business, including as a line cook in Rhode Island where he once made a steak sandwich for Lamar Odom.

Right now he’s likely somewhere stress-testing a blender or tinkering with a toaster. Anything with sesame is his all-time favorite food this week.

See full bio

Advertisement

A Chinese state-linked hacking group compromised executive laptops at an agricultural industry conference on Hainan Island this spring — not through phishing or a network breach, but by breaking into hotel rooms and booting the machines from a USB stick while the executives were at dinner.

CrowdStrike, which tracks the group as OVERCAST PANDA, disclosed the campaign in its 2026 Threat Hunting Report and detailed the operation’s timeline in an interview with VentureBeat at Fal.Con 2026: an intruder entered one room at around 8 p.m. local time and a second room by 9:57 p.m., writing a backdoor called FlowCloud directly to each laptop’s storage before rebooting the machines and leaving. There was no network intrusion, no phishing email, and no credential stolen through a login page.

The report dates the intrusions to between March and May 2026, and the timestamps come from Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, who cleared them for publication in the VentureBeat interview. CrowdStrike’s OverWatch team disrupted the intrusions and assessed that OVERCAST PANDA will almost certainly continue. FlowCloud itself predates this campaign by years: Proofpoint documented it in 2020, delivered by phishing to U.S. utilities, and NTT Security’s SOC has tracked USB-delivered infections at overseas branches of Japanese organizations since early 2022.

Security researchers have called physical-access tampering with an unattended laptop an “evil maid attack,” since Joanna Rutkowska demonstrated one with a bootable USB stick in 2009. Physical-access operations are rare across the 290 named adversaries CrowdStrike tracks, according to Meyers, and MUSTANG PANDA‘s version depends on a dropped USB stick the victim plugs in. What Meyers identified as novel is the combination of hotel-room entry by a state intelligence service with malware deployment, booting the target machine from the USB rather than relying on a user to execute a file from it.

When the executives powered on the next morning, the trigger fired and FlowCloud loaded. Keylogging, screen capture, file collection, and credential harvesting began.

“We have the visibility once the machine boots up,” Meyers told VentureBeat. A registry key or similar trigger starts FlowCloud sometime after the operating system loads, and that’s when Falcon’s sensor picks it up. The gap is the window between the USB write and the next boot — the hours the laptop sits compromised and undetected before the executive logs back in.

CrowdStrike published that gap a month before it announced its AI security product slate — Falcon Guardian, SafeMind, the Agentic Identity Provider, and AI Gateway — at Fal.Con 2026 this week.

Why existing security tools missed it

EDR needs the operating system loaded and the agent running. MFA waits for a login attempt, phishing training for an email, AI agent security for an agent to secure.

OVERCAST PANDA bypassed all of them at the point of entry. The initial compromise completed below the running OS, below the EDR agent, below the authentication stack. Falcon caught FlowCloud once its process started after boot, but by then the implant and its trigger were already on disk.

“Hotel entry is a very common thing,” Meyers said. “Talk to any corporate physical security person. They’re generally aware of hotel entry, but I think what is unique is the combination of hotel entry with deployment of malware.”

Meyers said he thinks China’s Ministry of State Security sits behind OVERCAST PANDA. The people entering the rooms are either officers or agents of the MSS or the Ministry of Public Security, or hotel housekeeping staff the services have bribed or compelled, Meyers told VentureBeat. A separate mid-2026 intrusion targeted a U.S.-based media professional using the same tradecraft, according to the report. Targeting an agricultural conference aligns with collection priorities Meyers tied to China’s five-year plans.

What CrowdStrike announced at Fal.Con and where runtime security begins

Nvidia CEO Jensen Huang joined George Kurtz on the Fal.Con stage to unveil SafeMind, an agentic cybersecurity system built on Nvidia Nemotron open models and CrowdStrike’s threat data. Meyers told the Fal.Con audience that 7,400 CVEs were registered in June 2026, a 96% increase over June 2025, and that CrowdStrike submitted 2,400 of them via responsible disclosure, roughly 30% of all CVEs registered that month.

Falcon Guardian, the company’s runtime security layer for AI agents on the endpoint, went live the minute Kurtz put the slide up, CrowdStrike President Mike Sentonas told the Day 2 audience, and AI Gateway, listed as a Guardian capability, ships in September as a hosted service with a hybrid version to follow. AJ Shipley, CrowdStrike’s chief product officer, told VentureBeat that CrowdStrike will embed a SafeMind model into Guardian for malicious-prompt detection within the next couple of weeks.

The threats those products address are real, and the report quantifies them. AI agent-triggered detection leads grew at 2.5 times the rate of human-triggered leads, by OverWatch’s count. Cloud-conscious eCrime activity surged 171% over the reporting period. Vishing intrusions doubled in the first half of 2026 compared to the second half of 2025, with the eCrime group SNARKY SPIDER moving from account takeover to data exfiltration in under five minutes after compromising SSO-integrated SaaS applications.

Every one of those threats is network-based. All of them assume a running OS, an active user session, or a live cloud workload.

The controls that stop this are firmware and policy

“It’s a solvable problem,” Meyers said. “It’s just an inconvenient solution, which means that a lot of people don’t do it.”

CrowdStrike itself has shipped firmware attack detection and BIOS settings auditing through the Falcon sensor since May 2019, including a Dell SafeBIOS integration that surfaces BIOS verification telemetry in the Falcon console. The ability to audit security-related BIOS settings on the laptops executives carry has sat inside the platform for seven years. Pointing it at travel devices is a decision, not a product gap.

The controls that would have blunted the OVERCAST PANDA campaign are old and cheap, and each does a different job. Disabling external boot in UEFI removes the vector. A BIOS administrator password keeps it disabled. Pre-boot authentication lets a foreign boot environment load and still keeps the encrypted volume unreadable until a human supplies the PIN or key. Firmware monitoring detects tampering after the fact.

“Don’t bring anything with you that you’re not comfortable with handing over to a foreign intelligence service,” Meyers advised. He used temporary laptops and email accounts on overseas trips while at CrowdStrike, wiping the device when he returned. The exposure starts at customs. Officials can seize a device and compel a login, he added.

“They have master keys to that stuff,” was his verdict on hotel safes.

Why scale wins the priority fight

Intrusions tracked by CrowdStrike OverWatch grew about 4% over the reporting period, after a 27% rise the year before, a plateau CrowdStrike attributed to a shift toward more complex, resource-intensive campaigns. The OVERCAST PANDA hotel room operation is the example.

The network threat worries Meyers more. Asked to weigh OVERCAST PANDA’s hotel room campaign against the REVENANT SPIDER case he had shown on the Fal.Con stage, an eCrime group using AI to compromise 17 victims with custom web shells in 48 minutes, he picked REVENANT SPIDER.

“You can’t intrude on hotel rooms at scale,” he said. “You can’t intrude on physical devices at scale. And even then, it’s just one device.” The person in the room is the target, and the intrusion rarely pivots further, he added. “REVENANT SPIDER, they’re moving at that speed and they’re using AI across the board, and that’s a whole other threat, and I think that’s more concerning for the average enterprise.”

Network-speed, AI-powered intrusions scale. Physical-access tradecraft does not. Security budgets follow the threat that hits the most machines. The threat that is hardest to detect on one machine gets what is left.

But the executives who attended an agricultural conference in China this spring were the specific targets of a state intelligence service, one that chose the slow, unscalable method precisely because it works where network-based attacks fail.

The conference itself is the threat model

Executives at conferences are the campaign’s targets, and runtime security starts only once the machine boots. The vendors filling the Las Vegas show floor this week were selling that same runtime protection to attendees whose own laptops carry the identical gap.

Organizational fracture is the real problem. Falcon Guardian ships to one team, and BIOS configuration on travel laptops belongs to another. The Agentic IdP rolls out under identity governance while the decision about whether executives carry production-access machines to international conferences sits with a different group. And the budget line that funds cloud-threat defense has nothing to do with travel-device policies.

Meyers has lived both sides. “I’ve talked to companies where they’re like, we’re having a board meeting in Shanghai, and I’m like, why would you do that?”

What security leaders need to do before the next trip

Audit every executive laptop for USB boot status. If the device can be booted from USB right now, it has the same gap OVERCAST PANDA exploited this spring. The steps below cover Windows laptops, the platform FlowCloud targets.

Enforce full-disk encryption with pre-boot authentication. BitLocker in a TPM-only configuration is a documented weak point against physical access. SCRT researchers pulled the volume master key off the LPC bus with a $49 FPGA module in 2021, and Dolos Group did the same over SPI that year. OVERCAST PANDA wrote a backdoor and its post-boot trigger to the Windows volume, so the operators had write access to it. That points to machines that were either unencrypted or protected by a configuration the operators defeated. Pre-boot authentication with a PIN or USB key forces a human step before storage becomes readable.

Verify Secure Boot is enabled and the revocation list is current. Secure Boot validates signatures on boot components and blocks most unauthorized bootloaders, but it leaves external media bootable and signed shims can still carry a bypass. ESET published findings on 11 legacy Microsoft-signed UEFI shims in July 2026 that let untrusted code run at boot on any machine trusting Microsoft’s third-party certificate. Microsoft revoked them in its June 9, 2026 DBX update, so a laptop that skipped that update still trusts them. Lock the boot order at the UEFI level, disable one-time boot menus, and set a BIOS administrator password that covers both the setup utility and any boot-override key. Meyers’ read is that a lot of these settings go unchecked because the fix is inconvenient.

Issue travel-only devices for international conferences with no access to production systems, no saved credentials for internal tools, and no persistent VPN configuration.

“If they can get their hands on it, they can own it,” Meyers put it, citing an old DEF CON adage. Falcon catches FlowCloud only after boot — the exposure is the hours between the USB write and the next login, while the laptop sits closed and compromised.

“It’s cheap to buy a couple of laptops and a couple of phones,” Meyers said. The controls that close that window are a handful of firmware settings and a spare laptop. The question is whether anyone has deployed them.