Cars in European cities are smaller than ever. But as Europe’s appetite for microcars has grown, the cute Italian ‘yoghurt pots’ have largely given way to small Chinese EVs. Even Smart, the the iconic ultracompact car brand, has moved manufacturing to China.

Spanish startup Liux thinks it can compete in a crowded market with a tiny electric car built around sustainability.

Following the tracks of the Microlino out of Switzerland, Liux is trying to carve out a place in the market with its upcoming microcar, the Liux Big. The “Big” name is a joke. It is small enough to park at a right angle to the curb; but the name also reflects the oversized ambitions of a team that rarely takes the expected route.

“The idea of ​​a European car does not exist,” Liux co-founder Antonio Espinosa de los Monteros told TechCrunch. Coming from the CEO of a startup whose cars are already making headlines for being “made in Spain,” it was a surprising take — and one that reveals a lot about the company’s priorities.

Liux’s batteries are not made in Europe, but they are rechargeable at home, including with power generated from solar panels. The car is also meant to be easy to maintain and avoid the faster obsolescence cycles of modern cars. Perhaps most notably, its fiber body is made from a novel linen-based biocomposite designed so the material can later be extracted and recycled. 

“One thing that’s very clear for David and me is that recycling isn’t just a lab concept. You can recycle almost anything in a lab. What makes something recyclable has to do with how it’s built,” Espinosa said. “When you build something, you have to try to preserve the integrity of the material and the components so that a second life is possible.”

“Real circularity” is where Espinosa comes from; he previously cofounded Auara, a Spanish B Corp selling natural mineral water in bottles that are both recycled and recyclable. But after a larger player acquired this successful brand, he embarked on a new chapter with Sancho as his co-driver.

When it comes to cars, Sancho is in the driver’s seat, with low emissions on the radar. His specialty is engineering electric vehicles that can rival gas-powered ones. Before Liux, his most impressive feat was the Bóreas, a hybrid supercar unveiled at the 24 Hours of Le Mans in 2017. But after a fallout with his former partners, he and Espinosa teamed up to found Liux.

Liux’s first prototype, the Animal, combined their expertise: The fully electric five-seater was made almost entirely from recycled or plant-based materials. And yet, the two co-founders decided to pivot soon after unveiling the SUV to the world in 2022. It was then that they determined that their odds of completing homologation would be much higher with a smaller car.

Fast forward to 2026, and Liux has secured Europe-wide homologation for the Liux Big, which it expects to start selling in the first half of next year. In the meantime, the company has grown to 65 employees and is getting ready to ramp up production across three facilities in Spain.

These include the plant that TechCrunch visited in Azuqueca de Henares, about a one-hour drive from central Madrid.

Liux’s Azuqueca factory is small because it follows Toyota’s “lean management” principles and performs only the last steps of the process, said its head of production Beatriz Belda González, a Spanish-born engineer who previously worked for BMW in Munich. But don’t let its size fool you: Liux says its production capacity could reach 20,000 cars a year by 2030.

It is still too early to gauge demand, but more than 7,500 people have joined the waiting list for a Liux Big. Joining doesn’t require a fee, but the list has helped the startup learn more about its prospective buyers. The most represented profile is a 55- to 60-year-old city dweller, and Liux is now assuming that the Liux Big will often be a household’s second car.

This may dampen hopes that microcars could challenge traditional car ownership, but Liux has to pick its battles, Espinosa said. Rather than trying to guess where the market is going, or how fast, the startup is keeping the door open to partnerships with companies that manage B2B fleets and others that could help make its cars autonomous.

For Espinosa, the Liux Big could already make a difference by offering a more sustainable option that is also affordable. The startup hasn’t confirmed its final price tag, but said it will be below €18,000 — about $21,000 — before potential EV subsidies. This puts it at the higher end of the price range for microcars, but Liux hopes it will punch above its weight — literally. 

According to Liux’s head of R&D, Celso Fernández Llorens, weight and size limitations are a huge constraint in this category. In his view, most microcars are fairly similar, despite the fact that European authorities differentiate ultralight L6e four-wheelers from slightly heavier L7e ones. Liux, however worked around these constraints to make the most of its L7e homologation.

Thanks to a litany of decisions large and small, the startup managed to fit a 260-liter trunk into the car. But most of its efforts were geared toward making sure users feel like they are driving a car, rather than a two-wheeler. That’s also closely tied to safety, Sancho said: you don’t want a car that’s only lightweight because its frame can’t withstand a crash, or that will topple on the first turn.

With this in mind, and despite the fact that its category doesn’t even require crash tests, Liux has been testing and showcasing the Liux Big’s ability to slalom, brake, and perform other maneuvers. The startup demonstrated some of those capabilities to TechCrunch during a short ride and test drive in its upcoming off-road version.

For now, its main model will have two versions: 15 kWh and 20 kWh. A cargo version is also planned, and with Sancho on the team, the temptation to build a supercar is never far away. In a LinkedIn post, the company noted that it doesn’t intend to be “a one-car brand.”

First, though, Liux will use the €16 million it has secured so far (about $18.5 million, including European funding) to bring the Liux Big’s urban version to market through partnerships with car dealerships across Europe.

The showroom where we met is also a preview of Liux’s future sales experience, head of brand Ana Terrado Leyva said. She pointed to textile screens, 3D models showcasing the Liux Big’s three color options — two more than the Ford T — and a linoleum floor as a nod to linen. These aesthetic choices, she said, are another way Liux hopes to stand out from its Chinese competitors.

Maybe the idea of ​​a European car does exist.

There are several things you should check.

Don’t blame Android Auto first — Check the music app

Spotify

Use wired and wireless connections to narrow it down

Alex Photo Stock/Shutterstock

AI AND ML

Disclosure optional, quality mandatory

The Debian community has voted to allow members to use generative AI when creating their contributions, with the caveat that developers remain responsible for code quality.

The Linux distro’s community recently decided to develop a policy on use of AI-assisted coding tools, and asked participants to vote on one of eight proposals that included an outright ban, cautious use, or just avoiding LLMs because of their impact on Earth’s environment.

The rules of the vote saw community members asked to rank each of the eight proposals. Just under 600 people voted, but Debian’s election team rejected many for unspecified reasons, leaving almost 450 valid votes to count.

When the tallying was done, proposal E – “Responsible Use of Generative AI” – won the day.

The proposal means “Debian neither endorses nor prohibits the use of generative AI tools in the development, maintenance, or documentation of software, packaging, documentation, and other media published within the Debian Project.”

The proposal advocates that approach because “such tools can substantially improve the productivity of contributors when used responsibly, allowing volunteers to spend more of their limited time on work that requires technical expertise, judgment, review, and collaboration.”

The proposal also spells out that the Debian community doesn’t believe “AI made a mistake” is an excuse for sloppy contributions.

“The Debian Project nevertheless expects that all contributions submitted to Debian, regardless of how and with which tools they were produced, satisfy the same standards of quality, correctness, maintainability, and legal compliance,” the proposal states. “The use of a generative AI tool does not diminish the contributor’s responsibility for the work they submit. Contributors are expected to understand, review, test, and, where appropriate, modify AI-assisted output before incorporating it into Debian.”

Woe betide the dev who doesn’t check their AI-generated code, as the proposal also states, “Blindly accepting or uploading AI-generated material without appropriate human review is inconsistent with Debian’s established development practices.”

Another element of the proposal tries to make acknowledging the use of AI a norm.

“We encourage our contributors to disclose whether a contribution was made with AI assistance, but do not require them to do so,” the text states.

As our FOSS aficionado Liam Proven wrote in his report on the vote, the Gentoo Linux team has banned use of AI, while NetBSD and OpenBSD don’t want any clanker-written code contributions.

Linus Torvalds, arguably the most influential figure in the FOSS community, welcomes AI-generated contributions.

In July he declared “Linux is not one of those anti-AI projects” – and recently proved it by using AI to squash a tricky bug. Torvalds has also sometimes complained about AI, such as his May observation that AI-generated bug reports sometimes made the Linux security mailing list “unmanageable.” ®

Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage.

The company is signing affected users out of Claude, removing saved payment methods, and refunding charges it identifies as unauthorized.

“We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage,” Anthropic said in an email sent to an affected user, who shared it on Reddit.

“If your usage limits looked like they refilled and then drained while you weren’t using Claude, this was likely the cause,” Anthropic warned.

It is also worth noting that infostealers can copy an already authenticated browser session, which means the attacker may not need to go through the normal password and 2FA login process again.

Anthropic links attacks to Vidar, LummaC2, StealC, RedLine and other infostealers

In the email, which is also being sent out to other compromised account holders, Anthropic says its investigation is ongoing, but computers were likely already infected with general-purpose infostealer malware.

“We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude,” the company stressed.

According to Anthropic, the malware typically arrives through downloads or malicious apps and steals information stored locally, including browser passwords, login cookies, and credentials belonging to other apps.

“Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them,” Anthropic said.

In this case, the Redditor who shared the email confirmed that they downloaded a pirated game, which explains why their system got compromised.

Anthropic has identified multiple malware, including Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, along with Atomic Stealer (AMOS) on a small number of Macs.

If you get affected, Claude will revoke compromised sessions and remove saved payment methods to prevent unauthorized purchases.

“Signing you out of Claude stops the stolen sessions, but it doesn’t remove the malware,” Anthropic warned. “If it’s still on your computer, your next login session could be stolen the same way.”

Anthropic has urged affected users to take basic security steps, including changing credentials, revoking other sessions, and removing the malware from the PCs.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Google Maps now labels Lake Ontario as Lake America for users in the United States, following an update to the US Geographic Names Information System, while Canadian users see the old name and everyone else sees both. Google Maps has been a designated very large online platform in the EU since April 2023, with duties to assess systemic risks including effects on civic discourse.

Google Maps now shows Lake Ontario as Lake America to anyone using it in the United States. Alphabet announced the change, Bloomberg reported.

What you see depends on where you are standing. Canadian users still get Lake Ontario, and everyone else, Europe included, gets both names printed on the same water.

The trigger was a database entry. The US Geographic Names Information System was updated on 27 August, after President Trump said he would rename the lake.

“These updates follow our long-standing policy for bodies of water with names that vary from country to country,” Alphabet said in a statement.

Not everyone went along with it. MapQuest refused outright and built a generator letting users invent their own names for the lake, and Apple Maps was still showing Lake Ontario to American users.

There is a precedent for the mechanism. The Gulf of Mexico became the Gulf of America in the same product last year, under the same stated policy.

The rule underneath is worth stating plainly. A government can change what the world’s most used map says by changing its own naming database.

Europe has that machinery too. Geographical names are a harmonised data theme under the INSPIRE directive, maintained by national mapping agencies.

No European government has used it this way. That is an observation about restraint rather than about capability, and the two are easily confused.

The other half of this is regulatory. Google Maps has been a designated very large online platform in the EU since April 2023.

That designation brings duties with it. A platform of that size has to assess the systemic risks arising from the design and functioning of its service, including negative effects on civic discourse and public security.

The Commission does act on those duties. Poland has asked it to fine Meta €250M over scam advertising under the same regime.

Nobody has tested the mapping question. A product that shows two countries different geography, on the strength of one database entry, has never had to explain itself in Brussels.

In this week’s Sunday Reboot, Apple’s inconvenient Mac launch timing and the transition from Cook to Ternus nears its conclusion.

Sunday Reboot is a weekly column covering some of the lighter stories within the Apple reality distortion field from the past seven days. All to get the next week underway with a good first step.

An oddly earlier upgrade than normal

It is the pre-iPhone event season, and the media is hard at work preparing for what Apple will be showing off in its early September event. It’s usually a busy period, with lots of pre-writing of pieces that will be adjusted and added to as Apple makes its announcements.

Except this week, Apple decided to change things up a lot. It announced some products way earlier than we expected.

Cue a week of writing about the Mac Studio, the Mac mini, and the new M6 generation of Apple Silicon.

To people covering Apple, this meant a sudden influx of launches to analyze and write about at length. This wouldn’t entirely be a bad thing, except that we were expecting Mac stuff to arrive either during the September event or in October.

The Mac preparations usually happen after the iPhone launch posts. This meant the Mac posts this week were created with no pre-made elements, no prep work. Doing it live.

However, one thing did pop into my head about this week’s Mac launch. Why did Apple do this now?

Mac Studio, one of Apple’s August updates.

Someone speculating on Apple’s current situation may see it as an attempt by Apple to shake up how it launches products even more. After all, it’s already separated the Pro and non-Pro iPhone launches, so other changes are fair game.

The impending Ternus change could be a license for Apple to switch things up even more.

There’s also the idea that Apple would rather use its events for bigger product launches, like its new smart home items. They would certainly rank higher than a spec-bump update.

However, looking back over Apple’s launches in recent years, we also see that it’s not entirely a new phenomenon for the company.

The last time Apple launched a product in August was an iMac in 2020. Since then, it has launched Mac products in June and July, such as the M2 MacBook Pro and MacBook Air in 2022, as well as the MacBook Pro, Mac Pro, and Mac Studio updates in 2023.

There was a HomePod mini update in July 2024, but nothing Mac-based during the summers of 2024 and 2025. That doesn’t mean Apple gave up on them, as this week’s Mac launches have confirmed.

The real question is whether Apple has more products that it could put out in October to warrant a second event. With some of its Mac lineup already announced, that reduces the potential pool of Mac updates.

With this year introducing a folding iPhone that will eat into the September event’s time, we may see Apple keeping its OLED iPad mini update for the October one, alongside a much smaller collection of MacBook launches.

This early batch of Mac launches could well be in service of creating two events that have far fewer products on show.

For us at least, it helps spread the stress out a little.

Cook out for Ternus

The week ahead will be a major one for Apple’s history. Apple CEO Tim Cook is vacating his role for a similar board-based one, and giving it up for hardware chief John Ternus to take over.

It’s a transition that we have known about for months, thanks to Apple’s decision to announce the change in advance. But as the changeover date draws near, you can expect an awful lot of coverage about it.

Looking to the past, there’s going to be discussions about Cook’s legacy, reminiscing about key moments at the company, and picking apart what he got right and wrong.

Then there’s the other side of the coin. Articles explaining who Ternus is, speculation on how the company could change, and a lot about potential executive team changes.

From Apple itself, you’re not going to get much of a song or dance about the situation.

Pikachu at Apple Park.

Sure, there will be press releases about Cook’s role shift, as well as one about Ternus becoming CEO. Cook will also take to social media to thank Apple employees for their work, and Apple’s fans too.

But really, this week ahead is going to be a gradual introduction of Ternus to the public. A very gradual one, that has so far involved Pikachu.

Apple will want to gently break in Ternus being in charge, because not everyone knows about this. At September’s special event, despite the long wind-up period, people are still going to see Ternus and ask who he is in complete surprise.

Maybe Apple could do its own version of the “Doctor Who” regenerations as a pre-announcement skit.

Last week’s Sunday Reboot talked about the leaked video for the AirPods Pro with Cameras, and how they could be the best smart glasses for people who wear glasses.

on-prem

Tree huggers aim to end blanket critical infrastructure status for bit barns and ensure environmental standards are met

The Green Party of England and Wales wants the government to end the blanket designation of new bit barns as “critical infrastructure” and change planning rules to stop such facilities taking precedence over households for water and energy.  

The current UK government designated datacenters as critical national infrastructure (CNI) back in 2024, putting them on the same footing as essential services such as water and power. This made them eligible for special protection, but may also make it easier for developers to overcome any local objections to their construction, as The Register pointed out.

The Green Party claims that CNI status means that server farms are prioritized for access to water and energy, even when ordinary households are hit with drought restrictions, as over 27 million people currently are in England.

It wants to see planning permission for new facilities granted only when the developer can show it will meet the highest environmental standards, and there has been full community consultation.

“We need to slam the brakes on the rampant building of new datacenters which could put our communities at risk of water shortages and drive up energy bills – and yet are currently being waved through by our government,” said Green Party leader Zack Polanski.

“Data should serve people, not the other way around – but right now, because datacenters are designated as critical infrastructure, people come a poor second, with datacenters even being given priority for water and electricity.”

“We need clear criteria to distinguish between datacenters vital to national security or public services, and those that simply serve private tech companies and private profit,” Polanski added.  

There was certainly talk earlier this year of prioritizing “strategically important” grid connections, which would include data campuses, and a report published by the London Assembly late last year highlighted the pressure on the power supply in the capital, with some areas of West London having to put a hold on new housing developments.

On the water side, MPs were warned earlier this year that official forecasts of England’s future water needs excluded datacenters, despite the growing number of them, and that they could end up competing with homes and businesses for supply.

The Green Party claims that a single large-scale datacenter can use around 1.5 million liters (396,258 US gallons) of water per day, comparable to the daily water needs of a town of around 10,000 people. Yet bit barn construction is projected to expand rapidly, with growth often concentrated in areas already classified as water-stressed, like London and the South East. 

But water consumption can vary, depending on the cooling systems in use at specific facilities. In theory, newer campuses should require less water, especially if they are deploying AI infrastructure that uses so-called direct-to-chip cooling, where fluid is circulated through a closed-loop system.

A government spokesperson told us: “A pause on building new datacenters would simply send investment and good jobs abroad, while leaving Britain dependent on overseas computing for the processing of sensitive health and defense data. Put simply, it would be a disaster for jobs and national security.”

However, the spokesperson added: “This does not mean a blank cheque for Big Tech or that every datacenter should be approved. Developers should prioritize clean power, use water responsibly, create British jobs and supply chains, and provide investment to the communities in which they are built.”

The Green Party is also calling on the government to urgently develop a comprehensive national strategy for AI infrastructure, as the country is currently dependent on foreign-owned infrastructure for critical services, from healthcare to public safety – something the Institute for Public Policy Research was warning about just this week. ®

The Manchester Airports Group data breach has been claimed by extortion group FulcrumSec, which told BleepingComputer that it stole approximately 86 GB of data.

Samples reviewed by BleepingComputer contained information consistent with MAG’s disclosure while indicating that the breach exposed considerably more detailed customer, booking, and travel information than initially revealed.

Hackers claim theft of 86 GB of data

Manchester Airports Group (MAG), the United Kingdom’s largest airport operator, disclosed on August 27 that an unauthorized third party had stolen customer data related to Manchester, London Stansted, and East Midlands airports.

The company said the affected information came from car park, lounge, and Fast Track bookings and in-airport Wi-Fi registrations.

In emails to BleepingComputer, FulcrumSec claimed responsibility for the attack and shared samples of the allegedly stolen data as evidence.

BleepingComputer validated one record by comparing it with the traveller’s known Manchester Airport purchase history.

The record accurately listed previous Fast Track purchases, booking and scheduled-arrival times, the terminal used, amounts paid, purchase references, total spending and the apparent purpose of the trips.

The material included a roughly 21.5 GB Manchester customer export containing consolidated profiles that combined customer identifiers with historical booking activity and marketing classifications.

The group claims it obtained access using airport-specific Iterable API credentials exposed in client-side JavaScript and that the stolen material includes nearly 200,000 records related to upcoming travel during the remainder of 2026.

These records allegedly contain dates, times and booking information linked to personally identifiable information.

FulcrumSec says it intends to publish the stolen data and a technical account of the intrusion. However, it told BleepingComputer that it is considering withholding or redacting those records because of the potential for “real-world harm.”

While the samples appeared authentic, BleepingComputer could not independently verify the alleged source or extent of the threat actor’s access, the overall size of the stolen dataset, or the claim concerning nearly 200,000 upcoming-travel records.

After completing its verification, BleepingComputer securely deleted all supplied material without retaining copies and will not publish or share any part of it.

FulcrumSec is a financially motivated data-extortion group active since 2025 that focuses on stealing sensitive corporate data and threatening to publish it rather than encrypting victims’ systems.

The group has previously claimed attacks on organizations including LexisNexis, Novo Nordisk, Global Schools Group, and Avnet.

MAG declines to address hackers’ claims

BleepingComputer contacted MAG again before publication and asked the company to address FulcrumSec’s claims concerning the 86 GB dataset, exposed credentials and future-travel data.

A spokesperson declined to address the specific claims, referring instead to an updated statement confirming that affected customers with upcoming bookings had been contacted.

“MAG is confident that we have taken effective measures to protect our customers and we have contacted all those affected, including reaching out to all those with upcoming bookings to advise them of additional support,” a MAG spokesperson told BleepingComputer.

The attackers reportedly demanded a monetary ransom, which MAG was understood to have refused to pay.

Scope appears broader than initially suggested

Beyond the email addresses, phone numbers, vehicle registrations and postcodes disclosed by MAG, sampled records contained purchase and booking references, airport and product selections, prices, discounts, booking status, parking dates and times, historical spending, IP addresses, approximate locations, device information and customer-engagement data.

BleepingComputer did not observe payment-card or bank-account information in the reviewed samples.

Unlike US ZIP codes, which generally cover broader delivery areas, a full UK postcode can identify a small group of neighboring properties. According to the UK Office for National Statistics, a typical small-user postcode covers approximately 15 addresses, while some postcodes are assigned to a single address.

Combined with contact, vehicle and travel information, these details could allow attackers to reference a victim’s airport, vehicle, parking dates, booking status or purchased services in convincing phishing emails, text messages or telephone scams impersonating MAG or a booking provider.

MAG said it has contacted affected customers and advised them to remain vigilant for suspicious emails, text messages, and telephone calls.

The airport operator stressed that it would never contact customers unexpectedly to request payment-card details, banking information, or passwords.

The incident has not caused operational disruption, and MAG says passenger safety and aviation security were not compromised.

A MAG spokesperson previously told the Manchester Evening News that around 8.7 million customers were affected, although only email addresses were exposed for the “vast majority.”

That makes it the largest known customer data breach affecting a British airport operator.

With files from Bill Toulas

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report