The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned on Thursday that a high-severity Apache ActiveMQ vulnerability patched earlier this month is now actively exploited in attacks.

Apache ActiveMQ is the most popular open-source Java-based message broker for asynchronous communication between applications.

Tracked as CVE-2026-34197, the security flaw has gone undetected for 13 years and was discovered by Horizon3 researcher Naveen Sunkavally using the Claude AI assistant.

Sunkavally explained that the vulnerability stems from improper input validation, which allows authenticated threat actors to execute arbitrary code via injection attacks. The Apache maintainers patched the vulnerability on March 30in ActiveMQ Classic versions 6.2.3 and 5.19.4.

“We recommend organizations running ActiveMQ treat this as a high priority, as ActiveMQ has been a repeated target for real-world attackers, and methods for exploitation and post-exploitation of ActiveMQ are well-known,” Horizon3 warned.

Threat monitoring service ShadowServer is currently tracking more than 7,500 Apache ActiveMQ servers exposed online.

​​​On Thursday, CISA added CVE-2026-34197 to its Known Exploited Vulnerabilities (KEV) Catalog and ordered Federal Civilian Executive Branch (FCEB) agencies to patch ActiveMQ servers within two weeks, by April 30, as mandated by Binding Operational Directive (BOD) 22-01.

Horizon3 researchers said that signs of exploitation can be found by analyzing the ActiveMQ broker logs and recommended looking for suspicious broker connections that use the brokerConfig=xbean:http:// query parameter and the internal transport protocol VM.

“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency warned.

“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”

It also urged private-sector defenders to prioritize patching for CVE-2026-35616 and to secure their organizations’ networks as soon as possible, even though BOD 22-01 applies only to U.S. federal agencies.

Previously, CISA tagged two other Apache ActiveMQ vulnerabilities as exploited in the wild, tracked as CVE-2023-46604 and CVE-2016-3088, with the former targeted by the TellYouThePass ransomware gang as a zero-day flaw.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot

AI video generation startup Luma has launched Innovative Dreams, a production company built in partnership with Wonder Project, a streaming service that produces religious films and TV on Amazon Prime. 

The tie-up’s first show will be called “The Old Stories: Moses,” starring British actor Ben Kingsley and set to launch this spring on Prime Video. 

“Innovative Dreams is a production services company where seasoned filmmakers from director Jon Erwin’s team and Luma’s creative technologists work with great studios and filmmakers to help them realize ambitious ideas,” Luma said Thursday in a social media post. 

The company envisages creative teams collaborating in real time with Luma Agents to make changes to sets, props, and lighting, as well as bring in footage of human actors. Luma Agents are the company’s recently launched tools designed to handle end-to-end creative work across text, image, video, and audio.

“This is a significant improvement over the current virtual production and performance capture processes where things come together only in post,” Luma’s post said. “This is the leverage of AI — not just faster or cheaper, but better than what came before.”

Luma isn’t the only startup to move from tooling to production. AI startup Higgsfield last week launched an original series, starting with a 10-minute sci-fi episode, and London-based creative studio Wonder Studios is working on a documentary with Campfire Studios. 

The launch comes the same week that competitor Runway’s co-founder and co-CEO Cristóbal Valenzuela said film studios should take the $100 million they spend on a single film and instead use AI to produce 50 films in order to increase their chances of making a blockbuster. 

Luma founder and CEO Amit Jain has made a similar case, telling TechCrunch that Hollywood’s soaring production costs have made filmmaking increasingly constrained. Generative AI, he argues, could make filmmaking faster, cheaper, and more efficient without sacrificing quality.

That thinking underpins Luma’s new partnership with Wonder Project.

Wonder Project, launched in 2023, is run by director Jon Erwin and former Netflix executive Kelly Hoogstraten with the goal of serving the faith and values audience globally. Their first project, “House of David,” a Biblical drama series about the life of King David, was released on Amazon Prime in 2025. 

It’s unclear whether Innovative Dreams will focus solely on religious and faith-based content or expand beyond Wonder’s remit. TechCrunch has reached out for clarification.

In a video promoting the partnership, Erwin said Innovative Dreams will use a new “real-time hybrid filmmaking” process that combines performance capture (as in “Avatar”) and virtual production (as in “The Mandalorian”), done live and more cheaply using Luma’s tools.

Performance capture is a technique where actors perform in a green-screen environment wearing suits and facial markers so their movements and expressions can be digitally captured and turned into animated characters. Virtual production involves actors performing on set, often in front of massive LED screens instead of a green screen while real-time game-engine graphics create the environment around them, blending the physical and digital worlds during the shoot. 

Luma’s tools, Erwin said, allow them to film a human actor anywhere and then transport that to a photorealistic scene, or go even further by generating a new face so it looks like a completely different person but still maps onto the actor’s movements and facial expressions. 

More than three years after the emergence of generative AI, AI-assisted coding remains by far the most popular and lucrative use case for the technology.

Although multiple companies — including Anthropic, maker of Claude Code, as well as Cursor and Cognition — are already vying for dominance, investors believe there is room for at least one more player.

On Wednesday, Factory, a startup developing AI agents for enterprise engineering teams, announced it had raised $150 million at a $1.5 billion valuation. The round was led by Khosla Ventures, with participation from Sequoia Capital, Insight Partners, and Blackstone. Keith Rabois, a managing director at Khosla Ventures, joined the startup’s board.

Factory founder Matan Grinberg told the Wall Street Journal that the company’s key differentiator is its ability to switch between different foundation models, such as Anthropic’s Claude or Chinese AI startup DeepSeek. However, startups like Cursor also don’t rely on a single model to generate code.

Factory’s customers include engineering teams at Morgan Stanley, Ernst & Young, and Palo Alto Networks.

The startup was founded in 2023 after Grinberg, then a PhD student at UC Berkeley, cold-emailed Sequoia partner Shaun Maguire. The two bonded over mutual academic interest. (Maguire’s PhD from Caltech is in the same area of physics Grinberg was studying.)

Maguire convinced Grinberg to drop out and launch Factory, with Sequoia backing the startup at the seed stage.

Gemini is getting a native MacOS app so that you have a faster way to talk to Google’s AI chatbot, bringing access to some of its best features with just a couple of clicks. 

Artificial intelligence is becoming more ingrained in everyday life, and companies are trying to make it easier than ever to access. On smartphones, AI is already just a button press away, but for desktops, LLMs like Google’s Gemini have been restricted to web applications. 

With the new app, Gemini is available via a simple keyboard shortcut. 

If you’ve got a MacBook, you can access Gemini at any time by pressing Option and Space on the keyboard, without having to switch tabs or open another window. 

Gemini’s best features, like Nano Banana image generation, video and music generation, are also just a few clicks away.

Much like you can do with the Gemini mobile app, the new MacOS app will let you share context from a window instantly so you can get insight on the content you’re viewing. Google says this will also work with local files on your computer and isn’t limited to web pages. 

The free, native app is available now for all users on MacOS 15 and up. Google says this is just the beginning and that it’s building the foundation for a “personal, proactive and powerful desktop assistant.” 

The app can be downloaded at gemini.google/mac.

AT&T switched out its unlimited data phone plans with new 2.0 versions that end up including more features and costing less than the old plans when you add in a recent price hike on retired plans. But that wasn’t enough, apparently, because the 150-year-old company also just added a brand-new tier for customers who don’t mind paying extra.

If you’re an AT&T customer suddenly bombarded by notifications about upgrading, or you’re looking to switch from another carrier, here’s a breakdown of the new offerings.

These plans replace the AT&T Value Plus VL, Unlimited Extra EL and Unlimited Premium PL plans. The carrier also removed its Unlimited Starter SL plan, which served as the entry-level plan (you had to know where to look to find the limited, but cheaper, Value Plus VL plan).

Keep in mind that AT&T plans let each person on an account have their own plan. So you might set up a package where one person has the Premium 2.0 plan for unthrottled 5G speeds and another, such as a child, is set up with the Value 2.0 plan to save money.

Also, if you’re on a current AT&T plan, you won’t be automatically moved to one of the new plans. If you do want to make the jump, you’ll incur a line activation fee of up to $50. And keep in mind that the pricing below is the AutoPay amount; carriers provide a discount (usually $10) if you sign up for automatic payments.

One nice change is that the new plans are priced with round numbers. For example, the Value Plus VL plan was priced at $50.99 for one line, and the Value 2.0 plan is $50 (in comparisons below, I’ve rounded up the old prices to full-dollar amounts). Taxes and fees get added on top of that, so you’ll never see a round-number bill, but I’d like to think it’s a quiet acknowledgment that pricing things one penny below a larger number is insulting to customers.

Let’s dig into the details.

Value 2.0, the budget plan

The Value 2.0 plan replaces both the Value Plus VL plan and the retired Unlimited Starter SL plan and costs $50 a month for a single line or $120 a month when you have four lines on the account. That’s $1 per line cheaper than Value Plus VL.

For that, you get 5GB of high-speed 5G data, and then unlimited data dropped to a paltry 128Kbps speed for the rest of the month. Calling and texting are unlimited.

You can also use up to 3GB of high-speed hotspot data to share the cellular connection with other devices, also slowed to 128Kbps after hitting the limit. The Value Plus VL plan did not offer hotspot data.

It also includes unlimited talk, text and data between the US, Mexico and Canada.

Extra 2.0, more fast data for not much more money

The Extra 2.0 plan costs $70 a month for a single line or $160 a month for four lines, which is $6 cheaper for one line and $4 cheaper for four lines compared with the old Unlimited Extra EL plan.

The Extra 2.0 plan includes 100GB of high-speed data (with the caveat that speeds can be slowed if the network is busy), which drops to 128Kbps speed until the next month’s billing cycle. That’s a boost over the 75GB offered on the Unlimited Extra XL plan.

For hotspot data, the new plan includes 50GB of high-speed data, which is 20GB more than its predecessor.

As with the Value 2.0 plan, international options include unlimited talk, text and data between the US, Mexico and Canada.

Premium 2.0, for faster everything

Replacing the Unlimited Premium PL plan is the Premium 2.0, which costs $90 a month for a single line and $220 a month for four lines. Those prices are actually higher than the Unlimited Premium PL plan, which came in at $86 for a single line and $204 for four lines. With the legacy rate increase, those amounts become $96 for a single line and $224 for four lines.

For that bump in cost, you’re getting unlimited 5G talk, text and high-speed data with no throttling, plus 4K streaming resolution (though media streams at standard definition until you enable the higher option).

Hotspot data has a 100GB cap before dropping to 128Kbps speed, which is 40GB more than the Unlimited Premium PL plan.

As for international calling and data, unlimited talk, text and high-speed data are available in 20 Latin American countries.

AT&T also has plans for cellular-enabled tablets ($21 a month) and wearables like smartwatches ($11 a month). If you subscribe to the Premium 2.0 plan, that pricing is reduced by 50%.

Elite 2.0, for even more performance

AT&T must have figured some customers — likely frequent travelers — want even more than what Premium 2.0 offered. The Elite 2.0 plan costs $110 a month for a single line and $300 a month for four lines.

That includes unlimited 5G talk, text and high-speed data with no throttling and streaming resolution in 4K, just like Premium 2.0.

Hotspot data jumps to 250GB before slowing to 128Kbps speed, giving you a comfortable cushion to share your connection with a laptop or other nearby devices.

Unlimited international calling and texting extend to 210 countries, with 20GB of data to work with before speeds drop to 512Kbps.

The Elite 2.0 also includes data access for one cellular-enabled smartwatch and one tablet.

On top of that, Elite 2.0 includes AT&T Turbo, the company’s optional add-on that prioritizes high-speed data when streaming, playing games and making video calls. Normally, AT&T Turbo costs $7 a month (and is different from AT&T Turbo Live, a separate feature.)

A few thoughts on the new AT&T plans

What AT&T’s plans lack, at least compared to the other carriers, is any streaming perks or bundled services. The 4K streaming option of the Premium 2.0 and Elite 2.0 plans opens a wider data pipeline for services such as Netflix that support 4K playback, but you’re still paying separately for those entertainment subscriptions.

In contrast, T-Mobile bundles Netflix and Hulu (both with ads) and offers Apple TV for an extra fee on its Experience Beyond and Better Value plans. Verizon takes a different approach with streaming packages, which you can choose at discounted prices instead of subscribing to them separately.

I also want to mention that I’m glad the plan names are no longer burdened with the VL, EL and PL extensions. Mobile plans are full of details as it is — always read the fine print before you sign up for one — so I appreciate conveying them to customers in ways that don’t sound like internal spreadsheet codes.

Even though the new plans carry 2.0 version numbers, I’d honestly rate them more like 1.5 based on their features and pricing, except for the Premium 2.0 plan, which is more expensive than the Unlimited Premium PL plan. As usual, if you’re happy with the plan you’re on, you’re fine sticking with it — but make sure you factor in April’s $5, $10 or $20 rate increase for legacy plans. But if you’re running up against high-speed data limits or considering AT&T as a replacement for another carrier, it’s worth looking at the details to see if one of the new plans works for you.

Read more: Speaking of AT&T, March 10 marked the 150th anniversary of the first phone call, and the company committed to spending $250 billion on infrastructure improvements. I also spoke with AT&T FirstNet folks during the 2025 Las Vegas Grand Prix about how they support customers and first responders during massive events like the Formula 1 race.

Casely has reannounced a recall of its Power Pods 5,000mAh MagSafe E33A charger after dozens of people were injured and one even killed by the defective devices, the US Consumer Product Safety Commission (USCPSC) announced. It’s recommended that you stop using the devices immediately, dispose of them safely and seek a replacement from the manufacturer.

A year ago, Casely and the USPSC published a recall of 429,000 units of the power bank with the model number E33A. That followed 51 incidents of the devices “overheating, expanding or catching fire” and burning users in multiple cases.

However, many of the devices have remained in use and are even more dangerous than initially thought. “In August 2024, a 75-year-old woman from New Jersey, was charging her cell phone with the power bank on her lap when it caught on fire and exploded,” the USCPSC reported. “The victim suffered second and third degree burns and later passed away from complications from her injuries.” In another incident this year, a 47-year-old woman was charging her phone on a plane when it caught on fire and exploded, giving her first degree burns.

As a result, the recall has been reissued due to “a risk of serious injury or death from fire and burn hazards to consumers,” according to the Commission.

The defective Casely Power Pods 5,000mAh charger is identifiable by the Casely embossed logo on the front and model number E33A on the back. It was sold at various online retailers including getcasely.com and Amazon between 2022 and 2024.

Casely is offering free replacement units as a remedy (it’s not clear if you can get a full refund). Those seeking one should write “recalled” on the battery pack in permanent marker and submit a photo, along with a second photo showing the E33A model number as pictured above. Owners are instructed to dispose of them by contacting a facility that handles lithium-ion batteries. Do NOT throw them away with regular household waste, recycling, or standard battery disposal bins due to the risk of fire and explosion.