Spotify’s Car Thing has already died twice.

The first death came in July 2022, when Spotify stopped manufacturing its first hardware product only five months after putting it on general sale in the U.S. The second arrived on December 9, 2024, when Spotify remotely made the remaining devices non-operational and advised owners to recycle them. Refunds were eventually offered to eligible purchasers.

Apparently nobody informed the corpse.

A new free, open-source firmware called Mira 1.0 has brought Car Thing back to life without Spotify’s original Car Thing software or companion infrastructure. Flash Mira onto the device, tether it to a phone over Bluetooth or a computer over USB for internet access, sign into Spotify and the little dashboard screen becomes useful again.

There is something wonderfully awkward about volunteers accomplishing that after Spotify told customers to find an electronics recycling bin.

What Was Car Thing Again?

Spotify originally developed Car Thing for drivers whose vehicles lacked modern infotainment systems such as Apple CarPlay or Android Auto.

The four-inch touchscreen connected to a smartphone and offered Spotify playback using touch controls, a large physical dial, preset buttons and “Hey Spotify” voice commands. It still needed a phone for data and originally required Spotify Premium, so Car Thing was essentially a very attractive $89.99 Spotify remote for your dashboard.

And yes, Spotify actually sold them.

What Spotify has never publicly disclosed is how many. Reports at the time claimed roughly 2 million people had joined the waitlist, but that clearly did not translate into two million purchases. Spotify stopped production in July 2022 and recorded a €31 million charge associated with the decision.

Two million people apparently wanted to know what Car Thing was. Considerably fewer appear to have wanted one badly enough to hand Spotify $90.

What Does Mira 1.0 Actually Do?

Quite a lot.

Mira restores playback controls and the physical volume knob, four preset buttons, album artwork and lyrics, podcast support with synchronized transcripts and device selection. It also adds its own “Hey Mira” voice control for playing music, changing volume, skipping tracks and managing queues. Multiple Bluetooth phones can be paired with the device.

Mira itself requires no companion app, additional account or paid subscription. It does, however, work only with Spotify, requires a Spotify sign-in and needs an internet connection supplied through Bluetooth or USB tethering.

This is not a one-click firmware update for your father-in-law. Installation requires a computer, USB-C cable and flashing the replacement firmware, which wipes the original software. The developers also acknowledge occasional problems waking from sleep and Bluetooth not always reconnecting automatically.

Why Is This Unique?

Because Mira changes the Car Thing story from failed gadget to an uncomfortable lesson about who controls hardware after you buy it.

Spotify did not merely stop making Car Thing or end technical support. It made functioning hardware stop functioning. Owners were initially told to reset the devices and dispose of them through appropriate e-waste channels. No refund of any kind was provided to customers who stupidly took the plunge.

Mira demonstrates that those screens, knobs, buttons and processors were still perfectly capable of doing something useful. What disappeared was Spotify’s willingness to support them. That should concern anyone buying hardware whose basic functionality depends on a manufacturer’s servers remaining interested in its continued existence.

Who Is This For?

Mira is primarily for existing Car Thing owners, tinkerers and anyone who kept one in a drawer rather than following Spotify’s recycling advice.

It also gives the device a reason to exist beyond the car. Car Thing can serve as a desktop Spotify controller with physical controls, album art, lyrics and voice commands without requiring the main Spotify application to dominate another screen.

What Mira does not do is turn Car Thing into CarPlay, Android Auto or a general-purpose infotainment system. There is no Apple Music or TIDAL support, navigation remains somebody else’s problem, and this still requires more fiddling than mounting your phone on the dashboard.

The Bottom Line

Spotify deserves exactly zero victory lap here. This is the company that announced lossless audio in 2021 and did not actually begin delivering it until September 2025, years after Apple Music, Amazon Music and others had moved on. More recently, its approach to AI and music has looked less like a philosophy than a moving target: stronger rules against impersonation and AI spam in 2025, AI-powered covers and remixes with Universal in 2026, and now new labels designed to keep AI personas out of recommendations. Spotify certainly knows how to change lanes; signaling first would be nice occasionally.

Car Thing belongs in the same conversation because Spotify sold customers a piece of hardware, lost interest in it, and ultimately rendered it useless through a software shutdown. The embarrassing part is that the hardware itself did not suddenly become obsolete. A group of software developers looked at the same discarded screen, knobs and buttons and saw something Spotify apparently did not: a perfectly usable product that did not need to become electronic waste just because the corporate strategy changed.

So the people worth celebrating here are the software geeks behind Mira, not Spotify. They have given Car Thing what amounts to a third life and, in the process, made Spotify’s decision to kill it look even worse. Companies love talking about sustainability, ownership and putting users first. Sometimes the most convincing rebuttal is a few developers with GitHub accounts refusing to accept that a working piece of hardware belongs in the trash.

For more information: github.com

If you are a regular reader, then the odds are you have taken apart an electronic gadget, either for a fix, or simply because your curiosity got the better of you. Once inside, it’s all but impossible to help yourself from doing at least a little reverse engineering. That’s what happened when [PRBS23] took a look inside a Gravity 800 Grill for a simple wire fix. But one thing led to the next, and now open source firmware for the grill is freely available!

The first order of business in creating the firmware is reverse engineering the original controller. Opening it up immediately reveals an ESP-32 and a well-labeled programming port. The rest of the control board is equally simple, including connectors for four thermistor temperature sensors, lid open/close switch, fan driver, 16 segment LCD, piezo buzzer, and some physical inputs.

The thermistor along with the physical inputs are connected to a 16 pin chip, interfacing with the MCU over a 9600 baud UART connection. [PRBS23] cannot determine an ADC chip meeting these specifications, so the most likely answer is a cheap MCU programmed to act as a simple analog fronted.

The neatly labeled programming header is used to quite easily dump the firmware with the espflash utility. Analyzing this dump reveals a rather strange ADC correction function used by the original firmware. The necessity and overall utility of this function remains unclear, as it only corrects by a maximum of two or three degrees Fahrenheit.

Most of the other features ended up being at least somewhat easier. The CS1621 segmented display driver is reasonably well documented with datasheets making its implementation far easier. Likewise, the other odds and ends were implemented in a far more normal manner compared to the thermistors.

All this reverse engineering work got tied together into a neat little firmware package. It comes with over the air updates PID controlled temperature, and a real-time web interface. This also isn’t the first time we have seen an IoT device liberated from proprietary firmware, and this remains one of our favorite uses of reverse engineering!

Live commerce is taking off almost everywhere in Asia but in Singapore

On paper, Singapore’s live commerce scene appears to be growing.

TikTok Shop Singapore’s livestream GMV grew 85% by Apr 2025 compared to a year earlier, while social commerce is expected to account for roughly a third of Singapore’s e-commerce market.

Yet if you’ve ever stumbled into a local TikTok livestream, the reality often looks very different.

Instead of thousands of viewers piling into a show, many sellers find themselves talking to a few dozen people waiting for the next voucher code before scrolling away.

That gap matters because live commerce has exploded almost everywhere else in Asia, from China’s billion-dollar livestream stars to Malaysian creators earning full-time incomes from daily broadcasts.

The format has become almost routine across Southeast Asia. In 2023, nearly five in 10 consumers watched livestream sales at least once a week, and 63% of viewers went on to make a purchase.

In Singapore, that figure was just 40%. Still, a handful of local brands have managed to make livestreaming work.

The brands that have made it work

The three brands Vulcan Post spoke to—Tasty Toastys, Tap Space, and Emporal Co.—operate in completely different categories.

One sells bread-themed plushies, another sells MRT-inspired collectibles, and the third sells candles and haircare.

Yet they’ve all found growth through livestreaming.

1. Make the livestream itself entertaining

For Tasty Toastys, livestreams became less about pitching products and more about giving fans something fun to watch.

Founder Chanel Lee discovered that her bread-character collectibles naturally created “watchable” moments—whether it was unboxing plushies, showing new designs, or letting fans react together in real time.

That communal experience helped the brand grow beyond local consignment shelves into 12 Toys “R” Us outlets and even a dedicated US TikTok Shop.

If the product creates anticipation on screen, viewers stay longer.

2. Consistency pays off

Transport-collectible brand Tap Space arguably had one of the toughest starting points. Founder Danial Sim launched with zero followers and a marketing budget of just S$50.

His solution wasn’t clever growth hacks—it was consistency.

Every night after dinner, he livestreamed himself showing the MRT station keychains he’d made.

Those sessions gradually brought in a few hundred followers each day, eventually snowballing into a business capable of selling 1,500 products in a single day at a Takashimaya pop-up before selling out by day three.

Consistency compounds, even when early audiences are small.

3. Putting a face behind the brand

The sisters behind skincare and candle brand Emporal Co., Grace and Lena Lim, spent two months making zero sales.

Then, one TikTok video went viral.

Instead of relying solely on that lucky break, they kept posting daily content featuring themselves and their products, turning followers into customers who later showed up in real life. Grace has even been recognised in public by people who’ve supported the brand for years, with one customer stopping her to ask for a selfie.

Today, the business generates six-figure annual sales, has sold over 17,000 bottles of leave-in hair conditioner in two years, and attracted around 400–450 people to a warehouse sale built largely through TikTok.

Their biggest advantage was familiarity.

A different playbook for live commerce

None of these brands relies on the tactics commonly associated with livestream commerce elsewhere.

Instead of aggressive countdown timers or endless discounts, they lean on three key pilars: Consistency, a strong visual hook, and a founder whose personality is the product.

That matters because Singapore’s structural reality is very different from its neighbours’.

The single most important reason live commerce exploded across Asia is one Singapore simply doesn’t have: large populations living far from physical retail.

Indonesia’s rural population sits at around 41%, but is spread across over 17,000 islands. That means hundreds of millions of people live without convenient mall access. In Vietnam and the Philippines, rural populations exceed 60% and 50% respectively.

Livestreaming doesn’t just entertain these consumers, but brings the market to them. And in a way, residents in rural areas have become micro-retailers in their own homes. Farmers and artisans in rural China now sell directly to urban consumers through live broadcasts, bypassing the physical retail infrastructure they never had. 

Unlike Indonesia or Vietnam, where millions of consumers live far from physical retail, Singapore has one of ASEAN’s highest concentrations of shopping malls. Most people can reach a mall within minutes.

Whereas in Singapore, the city-state has the highest retail space per capita in ASEAN, at 1.08 square metres per person — nearly double Bangkok’s 0.8 sqm and significantly above Kuala Lumpur’s 0.71 sqm. Total retail space on the island stands at 6.1 million square metres, making Singapore one of the most mall-dense cities in the world.

The urgency that drives impulse purchases on a livestream—”I can’t get this anywhere near me”—simply doesn’t apply in Singapore.

And vouchers, which dominate many local TikTok streams, don’t necessarily solve that problem. They can give viewers a reason to tune in briefly, redeem a code, and leave.

The brands succeeding in Singapore have therefore had to solve a different problem: not how to make people buy, but how to make them want to stay.

Trust is also a barrier

Trust is the foundation of live commerce. You’re buying from a person you’ve watched for 20 minutes, often without seeing the product in person first. And many viewers who find trust in a livestreamer will often return for more.

In markets where livestreaming took off early, before bad actors moved in, that trust was established before it could be eroded. However, Singapore got the livestream scams before the culture could concretise.

TikTok-related scam cases in Singapore rose nearly 38% in 2025, according to the Singapore Police Force’s Annual Scam and Cybercrime Brief, making it the only major platform where scam cases increased, even as Facebook, Instagram, WhatsApp, Telegram, and Carousell all saw declines.

A famous jade stones livestreaming scam in 2023 even caused losses of at least S$95,000. 

On the bureaucratic level, TikTok itself rejected 1.4 million seller applications and removed 700,000 sellers for policy violations in H1 2025 alone, which tells you both how aggressive TikTok enforcement has become and how serious the underlying problem of scams really is.

When shoppers become wary of livestream sellers, every legitimate creator has to work harder to earn credibility.

Singapore’s version of live commerce may look smaller, but more personal

As Singapore’s live commerce ecosystem develops, some businesses are looking overseas for answers.

Some retailers have travelled to Hangzhou for livestream training, while others are experimenting with AI avatar hosts— already big business in China, with the market projected to hit US$90.1 billion (S$115.2 billion) this year, with over 993,000 companies using digital avatars.

But importing the mechanics of a more mature market doesn’t necessarily mean importing its success.

The biggest takeaway from the brands that have made livestreaming work here is that Singapore may need its own version of live commerce.

The winning formula isn’t necessarily bigger audiences, more frequent streams, or deeper discounts. It’s giving a relatively small audience a reason to keep coming back.

• Read other articles we’ve written on Singaporean businesses here.

Comcast is promoting WiFi-based motion detection as a part of its new Xfinity Shield home protection platform, allowing routers and wireless devices to detect people moving through a home without cameras or motion sensors.

This feature was announced as part of a new Xfinity Shield product offering on Tuesday, a new application suite that combines cybersecurity, physical home monitoring, and family safety features through Xfinity WiFi and the Xfinity app.

Part of this new offering is WiFi Shield, which is included at no additional cost for Xfinity Internet customers with compatible gateways. It combines Xfinity’s CyberSecure network protection, Family Settings, and WiFi Motion, with Home Watch, Away Watch, and Dark Watch modes used to control when notifications are generated.

Comcast is also launching Shield Select for $15 per month, which adds an indoor camera, door/window sensor, cloud video storage, and 24/7 urgent response functionality.

However, while Comcast is now making WiFi Motion a major part of its WiFi Shield security offering, the motion detection feature isn’t new.

A Reddit post from August 21, 2024, shows an Xfinity customer receiving an email introducing WiFi Motion.

This email describes the same functionality as today’s announcement, stating that the feature detects disruptions to WiFi signals between the gateway and devices on the network and generates notifications in the Xfinity app.

“It works too. It detects motion to the point of raising your hand to change the channel with the remote control. Detects my cat walking across the living room,” reads another user using the feature in 2024.

WiFi NOW also reported in February that Comcast had offered WiFi Motion “for a long time” and was ramping up its marketing, including advertising it during Olympic hockey broadcasts.

Turning WiFi signals into motion sensors

WiFi Motion works by turning the radio links between an Xfinity Gateway and stationary WiFi devices into virtual motion sensors.

According to support documents, customers select stationary WiFi devices, such as smart speakers or thermostats, positioned around the home. When someone moves through the area between the gateway or extender and one of those devices, their body changes how the WiFi radio signals travel.

Comcast says the system detects these changes in the home’s radio frequency signals and uses them to determine that movement has occurred. Customers will then receive notifications through the Xfinity app without installing a camera or motion detector.

Xfinity says the system does not identify who is moving or determine their exact location, and WiFi Motion is opt-in and disabled by default.

“It is designed to detect motion, not identify specific people, and does not track the exact location of movement. Notifications indicate when movement is detected between a connected device and the Xfinity Gateway,” explains an Xfinity support document.

However, the technology can be sensitive, with Comcast providing different motion sensitivity levels to filter out movement from small pets weighing around 40 pounds or less.

The company warns that the system has no visual information and therefore may not always distinguish a small pet from a similarly sized child.

Comcast also advises customers in apartments and other buildings with shared walls to lower the sensitivity if movement outside the sensing zone causes unwanted detections.

A Comcast patent application provides a glimpse into how this type of system can work.

The pending patent, titled “Methods, systems, and apparatuses for presence detection,” was filed by Comcast Cable Communications in September 2023 and published in April 2025.

It describes using stationary network devices for motion detection and analyzing changes in characteristics such as the wireless signals to determine when an object or person has moved through a space.

The patent explains that WiFi signals can travel along multiple paths as they reflect or scatter off walls, people, and other objects. Movement changes those paths and the resulting wireless signal, allowing software to detect that something in the environment has moved.

Comcast’s patent cites several earlier Cognitive Systems patents related to WiFi motion detection, including technology for detecting motion from repeated wireless transmissions and motion detection in mesh networks.

Using WiFi as an invisible motion sensor raises questions about what happens to the data generated when people move around their houses.

As first spotted by TechCrunch, Comcast’s WiFi Motion documentation says the company may disclose information generated by the feature to third parties “without further notice to you” in connection with a law enforcement investigation or proceeding, a dispute involving Comcast, or pursuant to a court order or subpoena.

Comcast separately states that it does not monitor the motion or notifications generated by WiFi Motion.

The company’s documentation does not explain what WiFi Motion information Comcast retains, how long it keeps it, or what it could provide in response to a legal demand.

BleepingComputer contacted Comcast with questions about the generated data and will update the article if we receive any additional information.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Apple is expanding one of the most useful features in Apple Wallet, with digital driver’s licences and state IDs set to arrive in four more US states.

According to evidence found in Apple’s code, Wallet IDs are coming to Oklahoma, Utah and Virginia. Meanwhile, North Carolina has separately confirmed plans to support Apple Wallet IDs in early 2027. That would take the number of US states offering the feature to 18.

The expansion gives more iPhone and Apple Watch users the option to store a compatible driver’s licence or state ID digitally. However, there are still important limitations around where these IDs can be used.

North Carolina is the only one of the four with a clearer launch window. The state’s DMV says it plans to introduce its own NC Wallet mobile ID programme in December. Support for Apple Wallet, Google Wallet and Samsung Wallet is expected to follow in early 2027.

Google is launching Gemini in Chrome for Android, the tech giant announced Tuesday. Originally teased back in May at the company’s I/O conference, the AI features are now available on mobile, following their launch on the Chrome desktop browser earlier this year. 

Gemini in Chrome allows you to quickly summarize long web pages and ask questions — a useful tool if you’re looking for a specific answer in dense content. You can also connect to select Google apps, such as Calendar and Keep, without switching tabs.

Another feature of Gemini in Chrome is the ability to generate images with the AI image generator Nano Banana. Google gives the example of creating an infographic based on a web page you’re studying for an exam if you prefer a more visual learning experience. 

Google’s also introducing auto browse for the Android Chrome browser, an agentic AI feature that lets you offload tasks to AI. You can have Gemini book event tickets, update online orders and more. Auto browse will also ask for explicit permission to proceed with sensitive tasks you assign it, such as processing payments. The feature is available for all US-based Android users on the AI Pro or AI Ultra subscription plans. Google did not provide a timeline for when auto browse would come to additional countries. 

Agentic AI on smartphones is becoming increasingly common these days, and Google’s latest Pixel 11 phones are good examples of the technology, thanks to Gemini Intelligence. But agents can go too far to complete a task. Recently, an agent hacked an Australian gym’s website just to secure a spot in a class for a user. So while agentic AI can offer significant benefits, it is important to exercise caution when using these systems, as they may behave unpredictably or take unintended actions.

Google says it’s built Gemini’s features into Chrome with safety and security in mind, and has trained its models to identify common threats, like prompt injections. Prompt injections are a type of malicious cyberattack against AI chatbots that can result in the leakage of sensitive data and other security risks.

Blake has over a decade of experience writing for the web, with a focus on mobile phones, where he covered the smartphone boom of the 2010s and the broader tech scene. When he’s not in front of a keyboard, you’ll most likely find him playing video games or watching horror movies.

See full bio

Spending hours at a desk can make the right office chair feel less like an upgrade and more like an essential part of your workspace. Whether you’re a writer working from home, a corporate professional hopping between meetings, or someone whose “quick task” turns into three hours at a desk, your office chair gets far more use than you realize.

Finding the right ergonomic office chair isn’t just about fixing stiffness but about building a workspace that genuinely supports how you work. Adjustable lumbar support, seat depth, armrests, recline, and proper spinal alignment all make a measurable difference when you spend most of your day behind a screen. Just as importantly, a well-built chair allows you to shift positions naturally rather than keeping your body locked into one rigid posture for hours.

Because different budgets, body types, and work habits call for distinct setups, here are the top ergonomic office chairs to consider in 2026.

Secretlab ATLAS

Best ergonomic office chair overall

Most of us don’t spend eight hours sitting the same way. You might be fully focused while replying to emails, lean back during a meeting, then shift again while reading through a report. The problem is that many office chairs are designed around just one ideal sitting position. Instead of expecting you to stay in one posture, the Secretlab ATLAS is designed to support the way your body naturally moves throughout the workday.

That flexibility starts with plenty of room for personalization. The seat height can be adjusted to help keep your feet firmly planted, while adjustable seat depth lets you slide the base forward or backward for a better fit. The RE-CURVE backrest follows the natural S-shaped contour of your spine, pairing integrated lumbar support with a hybrid spring-and-foam structure that moves with you. Its full-height frame extends support through your shoulders, neck, and head instead of stopping around the middle of your back. Clinical testing by United States Ergonomics found strong pressure distribution, with users noting freedom to move without feeling unsupported.

The ATLAS becomes particularly useful if your workday rarely involves sitting completely still. When you lean back, the synchronous tilt mechanism opens the angle between your hips and torso while keeping the seat stable. You can lock the chair at four angles between 100 and 120 degrees, or adjust the tilt force across four levels to find the resistance that feels right for you.

Secretlab puts just as much thought into what you’re actually sitting against. Rather than relying on standard foam or mesh, the ATLAS uses proprietary materials engineered to distribute weight evenly and reduce pressure hotspots. If long hours at a desk tend to leave you feeling warm, the SoftWeave Plus Fabric option uses a soft, breathable knit designed to promote airflow for a cooler sitting experience.

There are some practical details worth considering before buying, too. Starting at $519, the ATLAS Regular is recommended for users under 5 feet 10 inches and has a maximum load of 265 pounds. Secretlab backs the chair with a three-year warranty, with the option to extend coverage to five years by sharing a picture of your Secretlab chair. It also comes with an up to 49-day refund and return policy, giving you more time to decide whether it’s the right fit for your workspace.

For anyone looking for a chair that adapts to the way they naturally work, the Secretlab ATLAS combines extensive adjustability with movement-focused ergonomics, making it a compelling choice for long hours at a desk.

Hforesty Ergonomic Mesh Office Chair

Best for versatile comfort

Not everyone needs an office chair packed with premium adjustments to stay comfortable throughout the day. For most people, a chair that nails the daily essentials right while offering a few extra comfort features strikes the perfect balance, and the Hforesty Ergonomic Mesh Office Chair lands in that very category. 

The core design uses a double-back structure to cushion both your spine and lower back, paired with a breathable mesh backrest that prevents heat buildup during longer sessions. Underneath, Hforesty swaps mesh for a contoured, thick sponge cushion shaped to relieve pressure across your hips.

Adjustability covers all key touchpoints: chair height, headrest angle, armrest placement, and recline angle. You can set the backrest to 90 degrees for typing, 110 degrees for reading, or 135 degrees for a deep recline, while an adjustable tilt-tension dial unlocks a gentle rocking motion.

One feature that makes the Hforesty particularly versatile is its pull-out footrest. After a long stretch of work, you can extend it and give your legs somewhere to rest without leaving your desk. There’s even an integrated coat hanger on the back for keeping a jacket or other clothing off the floor.

With a 300-pound weight capacity and a practical mix of work and rest controls, Hforesty delivers strong daily ergonomics without bloated pricing.

FlexiSpot C8 Exclusive Ergonomic Chair

Best for easy adjustability

A chair can feature dozens of adjustment levers and still leave you wasting time wrestling with them. The FlexiSpot C8 Exclusive Ergonomic Chair automates key adjustments so you get personalized comfort without manual guesswork.

A big part of that comes down to its 2-way automatic adaptive lumbar support. Rather than relying entirely on manual positioning, the system is designed to adapt according to your body shape and weight. That can be especially useful if you tend to shift positions throughout the day or simply don’t want lumbar support to become another setting you have to repeatedly think about.

You aren’t giving up manual customization, either. The C8 lets you adjust the back height and slide the seat depth forward or backward, helping accommodate different body proportions and sitting preferences. Its additional 3D adjustable armrests give you control over where your arms rest while you’re typing or working at your desk.

When it’s time to move out of a focused working position, a three-level synchro-tilt recline gives you ample room to kick back during calls, and the mesh backrest ensures constant ventilation.

Built around a heavy-duty aluminum alloy chassis and smooth PU casters, the C8 is currently priced at $389.99, down from the original $599.99. It makes a compelling choice for anyone who prefers smart, hands-off lower-back support over manual levers.

COLAMY Ergonomic Executive Office Chair

Best big and tall ergonomic office chair

Not every office chair is designed with larger body types in mind. If you’ve ever felt squeezed into a narrow seat or wished for more support during long workdays, finding a chair with the right proportions can make all the difference. The COLAMY Ergonomic Executive Office Chair is built around that idea by combining a spacious executive design with practical ergonomic features.

A core feature is the built-in inflatable lumbar airbag. Instead of relying on a fixed lower-back cushion, you can increase or decrease the firmness until it feels right for your body. Paired with the high-back design, it delivers targeted support where many people need it most during extended hours at a desk.

The rest of the chair keeps things refreshingly simple. Pneumatic height adjustment, a tilt-lock mechanism, a 360-degree swivel base, and smooth-rolling casters cover the everyday essentials without overwhelming you with endless controls. The padded armrests also flip upward by 90 degrees, making it easy to slide the chair neatly under your desk or create extra room whenever you need it.

The black bonded leather upholstery gives the chair a classic executive look. Combined with its 300-pound weight capacity and generous seating dimensions, it offers a comfortable fit for larger users who want more room to settle in.

Priced at only $177.99, the COLAMY isn’t trying to compete with highly adjustable premium ergonomic chairs. Instead, it emphasizes the features that matter most for daily comfort. A spacious seat, adjustable lumbar support, and practical everyday functionality make it an appealing choice for anyone looking for dependable support without stretching their budget.

Steelcase Series 1

Best for shared workspaces

Unlike a home office, shared workspaces rarely have the luxury of a chair that’s adjusted once and left exactly the way you like it. Different people, body types, and working styles often use the same workstation throughout the day, making adaptability one of the most important features a chair can offer. That’s precisely what the Steelcase Series 1 is designed for.

Its LiveBack Flexor System is designed to move with your spine as you naturally shift positions, helping maintain support instead of forcing you into one fixed posture. A height-adjustable lumbar support system lets each user fine-tune lower-back comfort, making it easier to accommodate different preferences without overcomplicating the setup.

The Series 1 also keeps movement effortless. Its weight-activated recline automatically adjusts resistance based on who’s sitting in the chair, while an upright back lock provides extra stability when it’s time to focus. Flexible seat edges and adaptive foam cushioning are designed to distribute pressure more evenly, helping improve comfort during longer work sessions.

Its compact footprint also makes it particularly well suited to offices where space is at a premium. Steelcase also offers a variety of upholstery options, frame finishes, 3D Microknit back styles, and caster choices for carpet or hard flooring, giving businesses plenty of flexibility when furnishing different workspaces.

At $530, the Series 1 represents a premium investment. However, for offices that need a durable chair capable of comfortably supporting multiple users throughout the day, its combination of adaptive ergonomics, compact design, and thoughtful customization makes it well worth considering.

EZAKI High Back Ergonomic Executive Office Chair

Best executive office chair

If your office doubles as a place where you meet clients, jump on video calls, or simply prefer a workspace that looks as polished as it feels, appearance matters just as much as comfort. The challenge is that many executive chairs prioritize style over long-term support. The EZAKI High Back Ergonomic Executive Office Chair aims to bring those two together.

Rather than relying on foam alone, it combines high-resilience spring packs with thick memory foam cushioning for a softer, more sofa-like sitting experience. Built-in adjustable lumbar support adds targeted support around the lower back, while the high backrest is designed to help maintain a more neutral spinal position.

There’s room to move around, too. The wide seat and 300-pound weight capacity make this another option worth considering for bigger users, while the armrests can be flipped upward when you want more space at your sides. That also lets you push the chair farther underneath your desk when the workday is over.

One practical addition is the choice of wheels. EZAKI includes traditional casters as well as inline rubber rollerblade-style wheels, giving you options for moving across hard flooring or thicker carpet without necessarily adding a separate chair mat.

Adjustment is relatively straightforward, with seat-height control and a rocking function that moves between 90 and 110 degrees. You can also alter the rocking resistance using the tension control.

Starting at around $229.99, depending on the color, the EZAKI isn’t trying to compete with highly configurable task chairs. If your priorities are comfort, practical ergonomic support, and a polished executive look, it brings those qualities together in a straightforward package that’s well suited to everyday office use.

NEO CHAIR Office Desk Chair

Best budget office chair

Setting up a comfortable workspace can get expensive quickly. Between monitors, keyboards, desks, and accessories, an ergonomic chair often ends up being one of the biggest purchases. The good news is that improving your sitting posture doesn’t always require spending hundreds of dollars, and the NEO CHAIR Office Desk Chair is proof that a budget-friendly option can still cover many of the ergonomic essentials.

Its high-back design uses breathable mesh, which can be particularly appealing if you tend to feel warm after spending several hours at your desk. More importantly, adjustable lumbar support lets you fine-tune the lower-back support rather than relying entirely on a fixed backrest.

The seat brings another thoughtful detail to the equation. A waterfall-style edge is designed to reduce pressure around the backs of your legs, while the armrests can flip upward when you don’t need them. Besides letting you pull the chair closer to your desk, that extra room can come in handy if you’re someone who occasionally prefers sitting cross-legged while working.

The adjustments aren’t as extensive as what you’ll find on some of the more expensive chairs in this roundup, but the everyday essentials are covered. You can change the seat height and switch the tilt mechanism between tilting and rigid positions, while the swivel base makes moving around your immediate workspace easy.

Budget-friendly shouldn’t automatically mean cutting corners. The NEO CHAIR backs up its approachable price with practical build-quality features, including BIFMA-tested casters, an SGS-certified gas lift, and an internal cushion structure made with FSC-certified wood. While these aren’t features you’ll notice every day, they can provide extra confidence in the chair’s overall construction. 

With support for approximately 270 to 275 pounds, the NEO CHAIR won’t be the right fit for every body type. But if you’re setting up a home office, upgrading from a basic desk chair, or simply trying to improve your workspace without stretching the budget too far, it covers many of the ergonomic essentials without piling on features you may never use.

How to pick the right ergonomic office chair

Choosing an ergonomic chair isn’t about picking the model with the longest feature list or the highest price tag. It comes down to selecting a seat that adequately supports your body, suits the way you work, and stays comfortable throughout your day. Whether you’re upgrading your home office, replacing an aging desk chair, or furnishing a brand-new workspace, keeping a few core factors in mind will steer you in the right direction.

Comfort should always come first, but that extends far beyond a soft seat cushion. A well-designed chair should support the specific areas of your body that experience the most strain during long hours at a desk. Lumbar support is particularly vital for maintaining the natural curve of your lower back, while supportive backrests and headrests make a noticeable difference during extended screen time. The best models also encourage natural movement, giving you the flexibility to shift positions throughout the day without locking you into one rigid posture.

Adjustability is another critical aspect that’s easy to overlook until you use your chair daily. Features like seat height, seat depth, recline mechanisms, tilt tension, and adjustable lumbar support allow the hardware to adapt to your unique frame rather than forcing your body to adapt to the chair. The more personalized your setup, the easier it becomes to stay comfortable through everything from quick emails to hours of deep work.

It’s also worth paying attention to the armrests. While terms like 2D, 3D, and 4D simply describe their range of motion, properly positioned armrests dramatically reduce strain on your shoulders and wrists. Some models even feature flip-up armrests, which make it effortless to slide the chair under your desk or open up extra space if you prefer sitting cross-legged.

Beyond adjustments, your chair simply has to fit your frame. Checking the maximum weight capacity is a crucial baseline, but it’s only part of the equation. Seat width, depth, backrest height, and the overall sizing range all dictate long-term comfort because even the most feature-packed office chair won’t feel right if its dimensions don’t match your body.

Ultimately, the ideal ergonomic chair is the one that fits your workspace, champions your posture, and keeps you comfortable from morning to evening. By prioritizing what matters most to your routine, you’ll secure a seat you’ll genuinely enjoy using long after the initial setup wears off.

A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files.

Cybersecurity company ReliaQuest analyzed the web shell after it is believed to have been deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill.

ReliaQuest says the implant is not a generic web shell repurposed for the attacks, but was instead built with detailed knowledge of Windchill’s internal APIs, database schema, keystore, and file-vault structure.

“This appears to be an application-specific evolution of Clop’s established mass-exploitation playbook,” ReliaQuest said in a report shared with BleepingComputer.

The researchers say they found the web shell during the intelligence collection process.

The researchers say the activity is likely linked to Clop based on extortion emails containing addresses used on the ransomware gang’s data leak site, previously observed X-windchill-req headers also used in the web shell, and TTps commonly used by the threat actors.

The Clop extortion gang has a long history of breaching enterprise platforms in data theft attacks, with previous campaigns targeting Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer file-sharing servers, the latter affecting more than 2,770 organizations worldwide.

As BleepingComputer reported in July, Clop targeted exposed PTC Windchill and FlexPLM servers in a data theft extortion campaign involving exploitation of CVE-2026-12569 and the deployment of JSP web shells.

At the time, ReliaQuest said attribution was unconfirmed, but the attacks shared similarities with previous Clop data-theft campaigns targeting secure file-sharing applications.

Ransom-ISAC later confirmed Clop activity associated with the attacks, including extortion emails sent to hundreds of employees at affected organizations and containing the gang’s latest contact information.

PTC began releasing fixes for CVE-2026-12569 on June 17, and CISA later added the vulnerability to its Known Exploited Vulnerabilities catalog following warnings of heightened threat activity.

A web shell built specifically for Windchill

Analysis by ReliaQuest and BleepingComputer confirms the tool was designed to target Windchill servers rather than act as a generic web shell.

The malware is a JavaServer Pages (JSP) web shell that directly imports Windchill-specific classes, including MethodContext, WTConnection, and WTKeyStoreUtil.

These classes allow the shell to use Windchill’s own functions to access its database, decrypt stored credentials, and locate files stored in application vaults.

“The web shell connects to Windchill’s database through the application’s own MethodContext and WTConnection classes, meaning its queries run under the application’s existing database identity rather than through a separately configured attacker account,” explains ReliaQuest.

“As a result, database telemetry may attribute this activity to the application’s normal service identity, limiting the value of alerts that rely solely on detecting new accounts or unexpected source hosts.”

The web shell is controlled using a custom protocol sent through the HTTP X-windchill-req header, which contains eight characters, with the first character specifying the command and the remaining seven matching a fixed value.

The web shell supports the following commands:

• S – Steal Windchill secrets and configuration: Reads Windchill’s LDAP configuration and uses the application’s own WTKeyStoreUtil.decryptProperty() function to decrypt the LDAP manager password and other encrypted application data.
• L – Map Windchill’s file vault: Searches Windchill’s database for filenames, storage paths, and file sizes. The results are written to a file named flst.txt, which can then be retrieved by the attackers using G command.
• D – Enumerate directories and retrieve files: Enumerates supplied paths and reads portions of files.
• G – Read a file: Retrieves the contents of a specified file.
• R – Delete a file: Deletes a specified file.
• J – Load and execute additional Java code: Passes a Base64-encoded ZIP archive and loads compiled Java bytecode directly into memory and executes it within the Windchill process. 
• O – Identify the operating system: Returns the operating system name.
• E – Echo supplied data: Echoes data in the X-windchill-prm header to verify the webshell is responding.

ReliaQuest says the web shell’s vault enumeration is also designed specifically to query certain tables in Windchill’s database. BleepingComputer’s analysis shows that these tables are ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem.

The cybersecurity company recommends that organizations immediately patch vulnerable Windchill systems and look for unusual JSP files in Windchill directories, especially those containing reference to X-windchill-req.

Organizations that suspect their Windchill servers were compromised should also change the LDAP manager password and other Windchill credentials, as they should be considered compromised.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report