Connect with us
DAPA Banner
DAPA Coin
DAPA
COIN PAYMENT ASSET
PRIVACY · BLOCKDAG · HOMOMORPHIC ENCRYPTION · RUST
ElGamal Encrypted MINE DAPA
🚫 GENESIS SOLD OUT
DAPAPAY COMING

Tech

Inside the DDoS-as-a- Service Market

Published

on

DDoS

You have probably experienced the following scenario yourself. A website suddenly stops loading, a login page times out, or an online service becomes unreachable at the worst possible moment. Sometimes the cause is not an internal outage, but a Distributed Denial-of-Service (DDoS) attack designed to overwhelm the service from the outside.

DDoS attacks have long been one of the simplest ways to disrupt an online service:flooding it with enough traffic, exhausting its infrastructure, and making it unreachable without breaking into the target’s systems. Now more than ever DDoS is being packaged, branded, and sold with the language of a mature online service, and the impact is well recorded in the real world.

Cloudflare reported blocking a 7.3 Tbps attack in 2025 and later said it mitigated a 31.4 Tbps attack in its Q4 2025 DDoS report. Microsoft also said Azure mitigated a 15.72 Tbps attack in October 2025, attributing the activity to the Aisuru botnet.

Behind those incidents, underground sellers are competing over the same buyers with an increasingly polished pitch. Recent underground activity analyzed by Flare researchers describe attack panels, API access, monthly plans, reseller options, customer support, botnet-backed capacity, game-server methods, and Cloudflare bypass claims. 

Advertisement

A comparison of two datasets of DDoS-related underground activity from the first five months of 2023 and the first five months of 2026, shows how quickly that offer has changed. What once appeared more frequently as scripts, tutorials, leaked tools, and scattered forum posts is now more often presented as a repeatable product that is easier to buy and operate.

A DDoS attack attempts to overwhelm a website, application, network, or server with traffic from many sources at once. Some attacks target network capacity, while others focus on application layer resources such as login pages and APIs. The objective is usually simple: make the service unavailable, unstable, or expensive to operate.

DDoS-as-a-service lowers the barrier further. Instead of building infrastructure, an attacker can pay for access to a web panel, choose a target, select a duration, and rely on someone else’s botnet, proxy network, or third-party attack infrastructure.

A flow chart that illustrates how DDoS attacks work
A flow chart that illustrates how DDoS attacks work

Flare Researchers Analysis

Flare researchers searched for DDoS-related underground activity from two periods in time. The first was the fivefirst months of 2023 and the second was the first five months of 2026. The team cleaned the data, curated it and found some important insights.

Advertisement


Advertisement


Advertisement



Advertisement


Advertisement


Topic 2023 2026 Change
Volume of records 4,403 4,964 Slight increase
High-signal DDoS service ads 38 364 ~10x increase
Unique ad clusters 31 123 ~4x increase
Unique actors 15 41 ~3x increase
Sources observed 22 43 ~2x increase

An important disclaimer, in this research we focused on distributed DoS. There’s another category, which is denial of service.

Technically it is a bit different in the way a server is targeted, but the goal is the same. In this research we only focused on DDoS offerings and did our best to exclude the DoS offerings.

DDoS-as-a-service platforms are openly advertised across dark web forums and cybercrime communities — the same sources Flare monitors continuously.

Advertisement

Flare tracks underground marketplaces, botnet infrastructure chatter, and threat actor activity across thousands of dark web sources, so your security team sees emerging threats before they impact your operations.

Detect your exposure for free

From scattered tools to packaged services

The topics in the posts from 2023 are more diverse. Many offerings revolved around scripts, leaked tools, tutorials, or generic “botnet service” advertisements.

One repeated type of post from 2023 (as seen in the screenshot below) promoted a “Botnet Service L7 – L4” and claimed Layer 3, Layer 4, and Layer 7 capability, optional API access, automatic payments, high attack slots, game-server targeting, and bypasses for Cloudflare-related protections. The same advertising text appeared across multiple sources and actors, suggesting copying, reselling, or recycling marketing.

A post from 2023 offering Botnet services
A post from 2023 offering Botnet services

While the post from 2023 was focused about the services, more recent posts from 2026 are focused around the price and the offering they give. 

An advertisement of “SatelliteStress” described the service as an IP stresser with a user-friendly panel, API access, game-server support, and monthly plans starting at €20. The same post claimed the service was “100% botnet-powered” and did not rely on downstream APIs, a positioning meant to distinguish it from resellers that depend on another provider’s infrastructure.

Advertisement

As illustrated in the screenshot below, Areshun, which is another post that offers a “Premium DDoS Service” with Layer 4 and Layer 7 attacks, monitoring, API integration, custom plans, 24/7 support, and promotional discount codes is also pinpointed on specific service and its price. 

Screenshot taken from Flare's platform.
Screenshot taken from Flare’s platform.
Sign up for the free trial to access if you aren’t already a customer.

Another similar example is of “RebirthStress”, which is similarly marketed as a botnet-powered IP and web stressing device, a free Layer 7 hub, more than 400 slots, reselling suitability, and plans starting at $15 per month.

If you go over these posts, one-by-one and make the comparison, you see a distinct trend. The post in 2026 is more focused on a product, the sellers are competing one against another on customers. They package everything nicely, offer shiny features: ease of use, fully automated, full support, privacy promised, reselling capacity, and reliability.

The technical details have not disappeared, they became part of the sale pitch. In 2026 ads more commonly bundle Layer 4 and Layer 7 claims (means the service support both network-level attacks and application-layer attacks) words such as “panel,” “API,” “slots,” “bypass,” “monitoring,” “uptime,” and “support.”

One THORCC-related advertisement claimed more than 7,000 active Layer 4 bots and promoted bandwidth analytics and attack-vector statistics. Another Russian and English post presented “professional stress testing” while claiming Cloudflare and DDoS-Guard bypasses, high concurrency, and long attack durations.

Advertisement

Sellers are possibly exaggerating about their capabilities. However, the consistency of their marketing language remains important intelligence.

It shows what buyers are being encouraged to value beyond raw traffic volume, including web panels, automation, bypass claims, and the ability to launch or resell attacks with minimal effort.

The pricing of a DDoS attack in 2026 is very cheap. We’ve seen the following offers:

There are some more expensive offerings. An actor named “SamuraiDD” advertised attacks starting at $100 per day (see in the screenshot below).

Advertisement
Screenshot taken from Flare's Platform.
Screenshot taken from Flare’s Platform.
Sign up for the free trial to access if you aren’t already a customer.

Another actor named “POWERDDOS” used a tiered model of $5 tests, $100 per day for “weak” target, $200 per day for “medium” target, and $500 per day for “strong” or protected targets. 

Lastly, we’ve also seen some “premium” offerings which included infrastructure-style targeting, including a DDoS botnet attack network advertised for $2,000.

The pattern shows a market segmented by buyer type. Cheap tests and short attacks for low-skill users, daily pricing for one-off disruption, private negotiation for longer campaigns, and higher-value infrastructure or reseller-style offers for more serious customers.

Public reporting on the booter economy (a paid DDoS-for-hire service that lets users launch attacks through someone else’s infrastructure) also aligns with this low-cost access model, with Akamai noting that some DDoS booter services can cost less than $25 per month and may offer limited trials.

Conclusions

DDoS-as-a-service is no longer only about traffic volume. The market is dropping down the entry bar, enabling easier purchase, easier operation, and easier to resell. What matters is not only how powerful an attack is, but how easy it is to launch an attack through a panel, various plans, full support, API access, and rented infrastructure.

Advertisement

This lowers the barrier for several types of actors. Low-skill users can buy short, cheap attacks. More serious customers can negotiate longer or higher-volume campaigns. Resellers can help expand the reach of the original service. As a result, defenders should not assume that disruptive DDoS activity requires a sophisticated attacker behind the keyboard.

In the near future, this market will likely continue moving toward more polished service models. As clearer pricing tiers, more automation, stronger reseller programs, and heavier branding around “bypass” capabilities and attack reliability.

Learn more by signing up for our free trial.

Sponsored and written by Flare.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Tech

BMPS 2026 Grand Finals Day 3 Schedule & Format

Published

on

Day 2 of the BMPS Grand Finals was truly the day of comebacks, with teams like GDR and Victoris Summus making the largest leap, and occupying the second and third place in the rankings, respectively. While there was plenty of action from the bottom dwellers, Divine held their 30-point lead, thanks to clever strategies that put them in the top five of almost every match consistently. Here’s what the schedule will look like for day 3 of the BMPS Grand Finals.

BMPS 2026 Grand Finals Day 3 Schedule & Timing

The live broadcast will begin at 2:45 PM IST. Fans can catch the games like on Krafton’s YouTube channel in Hindi, English, and a few other regional languages. Or, if you want to support your team live, head over to the Jaipur Convention Center. Tickets are available on the District app. Maps for today will include:

  • Match 1 — Rondo
  • Match 2 — Erangel
  • Match 3 — Erangel
  • Match 4 — Erangel
  • Match 5 — Miramar
  • Match 6 — Miramar

A total of 18 matches will be played over the course of this weekend. And the format is pretty simple. Points are awarded for each finish, and also for how long a team survives. In the end, the team with the most total points (position + finish) will be the winners.

BMPS Grand Finals Standings After Day 2

Rank Team WWCD Finish Points Position Points Total Points
1 DIVINE 2 83 47 130
2 GDR 1 65 28 93
3 VS 2 55 36 91
4 GODL 1 58 32 90
5 GENS 0 63 27 90
6 iQOOORGE 2 40 38 78
7 NBE 1 52 25 77
8 VASISTA 1 52 24 76
9 iQOOSOUL 1 46 23 69
10 iQOO8BIT 0 45 24 69
11 iQOOxTT 0 49 19 68
12 iQOORNTX 0 47 15 62
13 7GODS 1 35 20 55
14 iQOOxOG 0 37 17 54
15 TAG 0 45 2 47
16 MYTH 0 33 7 40

Source link

Advertisement
Continue Reading

Tech

Forza Horizon 6 on a Wheel Finally Makes Sense Thanks to One Pro WRC Driver

Published

on

Forza Horizon 6 Pro WRC Driver Racing Sim
British World Rally Championship (WRC) driver Louise Cook recently climbed into Forza Horizon 6 with an enthusiast-grade Direct Drive (DD) wheel setup, triple screen monitor rig, and a digital 1986 Audi Quattro rally car. She is most likely using dialed in custom force feedback values, before threading the car through narrow mountain roads, tunnels, and tight corners with pro racer precision.



Playground Games launched the latest installment in Japan, and the setting is better suited to the franchise than any previous location. The map covers a variety of biomes, including actual elevation fluctuations. You have snow-capped alpine passes rising over the verdant highlands and coastal highways, and then there’s Tokyo City, which is five times larger than anything they’ve done before, with distinct districts that change character as you walk around them. So you’ll be passing through cherry blossom tunnels one minute and neon-lit streets the next, before returning to peaceful (yet narrow) alleyways. The seasonal weather does a fantastic job of adjusting grip and visibility without making each drive difficult. They’ve also included a few vertical slopes and hairpin sequences to test your ability to use momentum rather than pure power.


Lenovo Legion Go S – 2025 – Mobile Gaming Console – AMD Radeon graphics – 8″ PureSight IPS Display…
  • ALL GAMES, ALL PLACES, ALL YOURS – Get ready to game on the 8″ 120Hz Lenovo PureSight display and launch any title using Legion Space. The AMD Ryzen…
  • SEE EVERY DETAIL – Make every scene pop with 500 nits of stunning brightness and 100% sRGB color accuracy. And with 10-point touch support, your…
  • PLAY YOUR WAY – Play hundreds of high-quality PC games with your complimentary 3 months of PC Game Pass and EA Play. With new games added all the…


The game has approximately 550 cars, with the majority of them being Japanese vehicles, ranging from everyday icons like the Nissan Cedric to legends like the R32 Skyline, S15 Silvia, and Honda NSX. You also have some recent standouts, such as the Toyota Land Cruiser and the GR GT Prototype (on the cover). Of course, you’ll come across some barn treasures that will surprise you, like a vintage Toyota 2000GT hidden away on a dirt track. The tuning depth has also been increased, with engine swaps, aero options, and visual layers now available, and community-shared tunes and liveries provide an excellent way to skip some of the grind while still customizing cars for certain routes or events.

Forza Horizon 6 Pro WRC Driver Racing Sim
The handling has also been dramatically enhanced, with cars transmitting weight more convincingly around corners and steering inputs feeling noticeably sharper than in the last game. Drifting down the winding roads of the Highlands is no longer a source of frustration, but rather a delight. They’ve also introduced a new simulation steering mode to help prevent understeer in controller configurations. Wheel support has also been significantly improved, with more detailed force feedback and cockpit animations displaying a complete 540 degrees of rotation.

Advertisement

Source link

Continue Reading

Tech

Hackers hijacked Brazil’s emergency alert system and sent ‘misanthropy’ to millions of phones

Published

on

TL;DR

Brazil’s civil defense alert system was hacked, sending fake extreme alerts with the word “misantropi4” to millions of phones before the platform was shut down.

Hackers breached Brazil’s national civil defense alert system overnight, sending fake “Extreme Alert” notifications containing the word “misantropi4” to millions of mobile phones across at least seven states. The Civil Defense Alert platform was taken offline at 1:30 am on Saturday after the Ministry of Integration and Regional Development confirmed the intrusion.

The Federal Police has been activated to investigate. No timeframe has been given for when the platform will be restored.

The first unauthorized alert was registered around 11:40 pm on Friday, 19 June, in Paraná. Within hours, the same emergency sound, the type that bypasses silent mode and overrides whatever is on screen, reached phones in São Paulo, Rio de Janeiro, Brasília, Bahia, Pará, Mato Grosso do Sul, and Acre.

Advertisement

National Secretary of Protection and Civil Defense Wolnei Wolff told a press conference that 10 alerts were tracked across various Brazilian states, with most sent via Cell Broadcast and at least one via SMS. The total number of phones affected was not officially disclosed, though German outlet Ad-hoc-News reported an estimate of approximately 30 million people reached.

It’s difficult to say whether one or more people participated in this criminal act,” Wolff said. He added that the incident was “very bad for the system, considering that we are dealing with people’s safety when we issue the alert.

Phones displayed “Defesa Civil: misantropi4,” with the final letter “a” in the Portuguese word “misantropia” replaced by the number 4, a substitution common in leetspeak. Misantropia translates to misanthropy, meaning hatred or aversion to humanity.

No dangerous instructions accompanied the message, but the use of the most severe alert category, which is reserved for imminent natural disasters, caused widespread alarm. Recipients across seven states were jolted awake by the emergency sound.

Advertisement

Wolff confirmed that the attackers managed to regain access after an initial blocking attempt. The platform was ultimately shut down entirely at 1:30 am The system will remain suspended until all digital security conditions are re-established, according to the ministry.

Brazil’s Cell Broadcast system is relatively new. It was mandated by telecommunications regulator Anatel in 2022, piloted in 11 cities beginning in August 2024, and expanded to cover the entire national territory by October 2025.

The technology broadcasts alerts to all devices within a cell tower’s range without requiring phone numbers or prior registration. The four operators that deliver the service, Algar, Claro, TIM, and Vivo, were involved in the overnight response alongside Anatel.

The vulnerability exploited in the attack has not been publicly disclosed, and the investigation is ongoing. Security researchers have noted that Cell Broadcast systems globally lack cryptographic authentication, meaning devices cannot independently verify whether an alert was genuinely sent by civil defense authorities.

Advertisement

Academic research since 2019 has demonstrated that fake alerts can be transmitted using relatively inexpensive equipment, including software-defined radios. Whether the Brazilian attack exploited the central platform, as the government’s statement implies, or used a clandestine transmitter remains unclear.

A person claiming responsibility for the attack posted on X (formerly Twitter) before the posts were removed by the platform, according to Brazilian tech outlet TecMundo. The Federal Police has not confirmed whether this individual is a genuine suspect.

The incident echoes a pattern of critical infrastructure alert systems being compromised through surprisingly basic attack vectors. In Taiwan last month, a 23-year-old student triggered emergency braking on four high-speed trains using a laptop and a cheap software-defined radio, exploiting cryptographic keys that had not been changed in 19 years. The European Commission was breached in March through a poisoned open-source security tool, resulting in 92 gigabytes of stolen data.

The immediate concern for Brazil is the erosion of public trust. The Cell Broadcast system was built to save lives during floods, landslides, and severe weather events.

Advertisement

If citizens learn to associate the emergency sound with pranks rather than genuine warnings, they may ignore future alerts when a real disaster is unfolding. That risk, more than any technical vulnerability, is the lasting damage of a hack that woke up a country with a single strange word.

Source link

Advertisement
Continue Reading

Tech

Today’s NYT Strands Hints, Answer and Help for June 21 #840- CNET

Published

on

Looking for the most recent Strands answer? Click here for our daily Strands hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle, Connections and Connections: Sports Edition puzzles.


Today’s NYT Strands puzzle was a bit challenging, but the words make sense once you figure out the theme. Some of the answers are difficult to unscramble, so if you need hints and answers, read on.

I go into depth about the rules for Strands in this story

Advertisement

If you’re looking for today’s Wordle, Connections and Mini Crossword answers, you can visit CNET’s NYT puzzle hints page.

Read more: NYT Connections Turns 1: These Are the 5 Toughest Puzzles So Far

Hint for today’s Strands puzzle

Today’s Strands theme is: That’s included!

Advertisement

If that doesn’t help you, here’s a clue: More than just a bed.

Clue words to unlock in-game hints

Your goal is to find hidden words that fit the puzzle’s theme. If you’re stuck, find any words you can. Every time you find three words of four letters or more, Strands will reveal one of the theme words. These are the words I used to get those hints but any words of four or more letters that you find will work:

  • FAST, FATS, FATE, HATE, SATE, RENT, TERN, TALE, THAT, LAST, LATS

Answers for today’s Strands puzzle

These are the answers that tie into the theme. The goal of the puzzle is to find them all, including the spangram, a theme word that reaches from one side of the puzzle to the other. When you have all of them (I originally thought there were always eight but learned that the number can vary), every letter on the board will be used. Here are the nonspangram answers:

  • INTERNET, LAUNDRY, SAFE, FRIDGE, BREAKFAST

Today’s Strands spangram

completed NYT Strands puzzle for June 21, 2026

The completed NYT Strands puzzle for June 21, 2026.

NYT/Screenshot by CNET

Today’s Strands spangram is HOTELAMENITIES. To find it, start with the H that’s three letters down on the far-left vertical row, and wind down and over.

Advertisement

Toughest Strands puzzles

Here are some of the Strands topics I’ve found to be the toughest.

#1: Dated slang. Maybe you didn’t even use this lingo when it was cool. Toughest word: PHAT.

#2: Thar she blows! I guess marine biologists might ace this one. Toughest word: BALEEN or RIGHT. 

#3: Off the hook. Again, it helps to know a lot about sea creatures. Sorry, Charlie. Toughest word: BIGEYE or SKIPJACK.

Advertisement

Source link

Continue Reading

Tech

Rights groups brand Home Office’s AI age guesser for asylum-seekers as biased and inaccurate

Published

on

security

Campaigners say tech is unable to reliably distinguish between kids and adults at the boundary where use is planned

More than 60 rights groups have told the UK government to scrap plans to use AI-powered facial age estimation on asylum-seeking children, warning the technology is biased, inaccurate, and potentially unlawful.

In an open letter sent to border security and asylum minister Alex Norris, 62 organizations, including Amnesty International, Human Rights Watch, Liberty, the Electronic Frontier Foundation, Foxglove, and the Open Rights Group, called on the Home Office to halt deployment of facial age estimation (FAE) technology, currently slated for rollout from 2027.

Advertisement

The intervention comes after the Home Office unveiled plans to use AI-powered facial age estimation to help immigration officers decide whether someone claiming to be a child is likely to be over or under 18. Ministers insist the technology will support, rather than replace, human decision-making.

But the coalition behind the letter is unconvinced.

“There are substantial and well-founded concerns about the bias of FAE,” the groups wrote, arguing that the technology has “baked-in failures and discrimination,” particularly affecting women and people of color.

The groups also highlighted an uncomfortable detail in the Home Office’s own guidance: the technology’s performance varies by ethnicity and skin tone. That makes it difficult to see why officials believe it will be reliable for assessing asylum-seeking children, who are predominantly people of color, they argued.

Advertisement

The organizations also took aim at what may be the technology’s biggest practical problem: age estimation systems are least precise around the exact boundary the Home Office wants them to assess.

“The Home Office admits FAE systems are imprecise at the crucial 16-to-18-year-old boundary,” the letter notes, citing government figures showing even the best-performing systems have an error margin of roughly 2.5 years in that range.

The groups argue that the technology may fare even worse on asylum-seeking children. Their letter says trauma, violence, malnutrition, dehydration, sleep deprivation, and long journeys can leave children looking older than they are, potentially skewing the results.

“As such… we can see no basis upon which the Home Office has concluded this technology will increase the accuracy of its decision making,” the groups wrote.

Advertisement

The coalition also raised questions about the data used to develop and test the systems and demanded details about the images and datasets used for training, arguing it is unclear how consent could lawfully have been obtained if asylum-seeking children were included.

The Register asked the Home Office to comment.

The Home Office has so far released only limited details about its testing program. The groups noted that officials have yet to publish detailed results, methodologies, or impact assessments that would allow independent scrutiny of the technology’s performance. The letter also noted that no Equality Impact Assessment or Data Protection Impact Assessment has been made public.

The groups have given the department 21 days to respond to a series of questions covering testing methods, training data, safeguards, appeal mechanisms, and how facial age estimates would ultimately influence asylum decisions.

Advertisement

The row also exposes a broader disagreement over age assessments. While the Home Office has emphasized cases involving adults claiming to be children, campaigners argue the greater risk is that vulnerable children end up being treated as adults.

Until then, the government’s AI age guesser remains a technology it says works, but has yet to fully show its workings. ®

Source link

Advertisement
Continue Reading

Tech

A Critical Deadline Is Approaching for Windows and Linux Security

Published

on

The clock is ticking for Windows and Linux users to update cryptographic keys that protect their systems against firmware-based UEFI infections, a pernicious form of malware that loads before operating system and antimalware protections start.

Beginning June 24, three certificates that cryptographically verify that each piece of firmware and software that loads during system boot will expire. The Microsoft-signed certificates are the linchpins of Secure Boot, a Microsoft-designed chain of trust. Secure Boot checks the digital signatures of all firmware that loads during system startup to ensure it originates from a trusted provider, such as the manufacturer of the motherboard the system runs on.

Secure Boot is designed to thwart UEFI bootkits, a form of malware that alters the Unified Extensible Firmware Interface, the successor to the BIOS, both of which begin the initial boot sequence. Because these bootkits load before the OS and most other code, they can be difficult to detect. Once installed, they typically load malware onto the OS that steals credentials, backdoors the system, or performs other malicious actions. Even when the OS is disinfected, the bootkit can reinfect the system. Bootkits survive OS reinstallations as well.

A Brief History of Bootkits

The genesis of bootkits dates back to the early 1980s with the creation of several pieces of malware that targeted Apple II machines during the boot process. They spread in the wild through floppy disks that ostensibly contained pirated games.

Advertisement

Windows bootkits gained notice in the early 2000s as proofs of concept developed by researchers of offensive security. BootRoot, a bootkit demonstrated at the 2005 Black Hat security conference, is likely the first such instance. The malware infected the Network Driver Interface, which streamlined communications between network protocol drivers enabling service such as TCP/IP network adapter drivers. In the years following, similar PoCs included Vbootkit, the Stoned Bootkit, and Mebroot. There were many more.

In 2012, a new form of bootkit was demonstrated. Instead of targeting machines through the BIOS or master boot record, one such bootkit attacked Mac OS X systems by infecting the EFI, a package of firmware that started the boot process. A second very primitive bootkit targeted Windows 8 machines by infecting the​​ UEFI bootkit, the predecessor to the UEFI. Around 2013, a researcher demonstrated a more advanced UEFI bootkit for Windows named Dreamboat.

The first known case of a real-world attack targeting the UEFI came in 2018 with the discovery of malware dubbed LoJax. A repurposed version of legitimate anti-theft software known as LoJack, it was created by the Kremlin-backed hacking group tracked under names including Sednit, Fancy Bear, and APT 28. The malware was installed remotely using malware tools that can read and overwrite parts of the UEFI firmware’s flash memory.

In 2020, researchers unearthed the second known instance of real-world malware attacking the UEFI. Each time an infected device rebooted, its UEFI checked whether a malicious file was present in the Windows startup folder and, if not, installed it. Researchers from Kaspersky, the security provider that discovered the malware, named it “MosaicRegressor.” Researchers have yet to determine how the compromised UEFIs became infected. Since then, a handful of new UEFI bootkits have come to light. They are tracked under names including ESpecter, FinSpy, and MoonBounce.

Advertisement

Necessity Is the Mother of Invention

In response to the more menacing threat of UEFI bootkits, Microsoft worked with device makers to develop Secure Boot, an industry-wide standard that uses cryptographic signatures to ensure that each piece of firmware loaded during startup is trusted by a computer’s manufacturer. Secure Boot is designed to create a chain of trust that prevents attackers from replacing the intended bootup firmware with malicious firmware. If a single link in the startup chain isn’t recognized, Secure Boot will prevent the device from starting.

Then in 2023, researchers discovered LogoFail, a series of critical vulnerabilities found UEFIs booting up just about every Windows and Linux system in the world. An image-parsing bug in the software that presented hardware manufacturers’ logos during bootup allowed attackers to bypass Secure Boot and infect the UEFI with malicious firmware.

Source link

Advertisement
Continue Reading

Tech

AirPods Pro 3 heart rate sensor nearly matches Apple Watch in accuracy test

Published

on

TL;DR

CNET Labs found AirPods Pro 3 averaged 1.67% heart rate error vs a Polar H10 chest strap, second only to Apple Watch at 0.98%.

Apple’s AirPods Pro 3 heart rate sensor averaged 1.67% error compared to a medical-grade Polar H10 chest strap in testing by CNET Labs, making the earbuds the second most accurate consumer heart rate device the publication has measured. Only the Apple Watch Series 11 performed better, averaging 0.98% error in the same test protocol.

The results, published by CNET this week, place AirPods Pro 3 ahead of every smartwatch and fitness tracker the lab has tested except Apple’s own watch. CNET’s methodology used a four-lap track protocol with the Polar H10 as the gold standard reference, a setup consistent with how exercise physiology labs validate optical heart rate sensors.

The AirPods Pro 3 use a photoplethysmography (PPG) sensor that fires infrared light at 256 times per second to detect blood volume changes in the ear canal. Apple says the sensor was trained on more than 50 million hours of data from the Apple Health Study, and the company describes it as the smallest heart rate sensor it has ever built.

Advertisement

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

A peer-reviewed study published in PLOS Digital Health in April 2026 independently corroborates the accuracy claims. Researchers tested 40 adults across 16,735 paired heart rate measurements and found the AirPods Pro 3 averaged 2.02% deviation from a reference device. The study noted that the ear canal offers a more stable optical reading environment than the wrist because there is less ambient light interference and less motion artifact during exercise.

The PLOS study did flag wider epoch-to-epoch variability at higher exercise intensities, meaning individual readings became less consistent even as the overall average remained close to the reference. This is a known limitation of all optical heart rate sensors, including wrist-worn devices, and it means the AirPods are more reliable for steady-state activities than for interval training with rapid heart rate swings.

Advertisement

CNET’s testing has important caveats. The publication completed only two full AirPods runs in its protocol, a smaller sample than it typically uses for smartwatch reviews. CNET is also the primary source for the comparative ranking that places AirPods Pro 3 above other smartwatches, as no other lab has published equivalent side-by-side testing across this many devices using the same methodology.

The ear as a location for biometric sensing is not new in research, but Apple is the first company to ship it at mass-market scale in a consumer audio product. The ear canal’s vasculature sits closer to the skin surface than the wrist, which is why PPG sensors placed there can achieve comparable or better accuracy with a smaller sensor footprint. The trade-off is that health tracking is expanding beyond the wrist into ears, fingers, and other body locations, each with distinct physiological advantages.

At $250, the AirPods Pro 3 are $150 cheaper than the $400 Apple Watch Series 11, and they serve a primary function as earbuds. For users who want heart rate data during workouts but do not want a smartwatch, the accuracy gap between the two devices is small enough that the AirPods represent a credible alternative.

Apple does not position the AirPods as a medical device and the heart rate feature is not FDA-cleared for clinical use. The Apple Watch, by contrast, has FDA clearance for its ECG and irregular rhythm notification features, capabilities the AirPods lack entirely. The AirPods measure heart rate only, they do not detect arrhythmias, blood oxygen levels, or other clinical markers.

Advertisement

The broader trend is that health wearables are shrinking and diversifying in form factor. Oura’s Ring 5 measures heart rate, temperature, and respiratory rate from a finger. Whoop tracks recovery from a screenless wrist band, and Google’s Fitbit Air launched at $99 with AI health coaching.

Apple now has accurate heart rate sensing in both a watch and a pair of earbuds, giving it two data collection points on the same user.

The dual-device approach matters because heart rate data from two locations can improve accuracy through cross-referencing. Apple has not announced plans to fuse data from AirPods and Apple Watch in real time, but the infrastructure exists. The Apple Health app already aggregates heart rate data from multiple sources, and the company’s machine learning teams have published research on multi-sensor fusion.

For competitors, the AirPods result raises the bar. Samsung, Google, and Xiaomi all sell earbuds, and none currently offer heart rate monitoring that approaches the accuracy Apple has demonstrated. The PPG technology underlying all optical heart rate sensors is well understood, but Apple’s advantage appears to come from the training data volume and the sensor’s sampling rate rather than a fundamentally different approach.

Advertisement

Whether earbuds can eventually replace a smartwatch for health tracking depends on what users actually need. Heart rate is one metric. The Apple Watch also measures blood oxygen, skin temperature, and takes electrocardiograms.

AirPods cannot do any of those things today. But for the single most requested health metric, heart rate during exercise, the AirPods Pro 3 deliver results that are close enough to the Apple Watch to matter.

Source link

Advertisement
Continue Reading

Tech

Microsoft’s latest Windows bug belongs in the Recycle Bin

Published

on

PERSONAL TECH

File deletion dialog swaps recognizable names for internal gibberish

Microsoft’s latest Windows update has introduced a cosmetic bug that exposes the Recycle Bin’s internal file-naming scheme when users permanently delete a file.

When permanently deleting a single item from the Recycle Bin, Windows now displays its internal name – such as $Rxxxxx.ext – in the confirmation dialog rather than the file’s original name.

Advertisement

The name is correct in the Recycle Bin itself and also correct if restored. It’s only in the deletion confirmation dialog that Windows exposes its innards.

There is a workaround, but Microsoft isn’t sharing it unless an organization contacts Microsoft Support for business. Otherwise, the company stated: “A resolution is in progress and will be included in a future Windows update.”

Unlike other problems reported by users, including OneDrive woes and Blue Screens, this is relatively minor. However, it is an example of ongoing quality issues, coming after Windows boss Pavan Davuluri said Microsoft is working to improve the reliability of its software.

It has been ten days since the June 9 update was released, and a few weeks remain until the next Patch Tuesday release. So far, there are two known issues with the update, compared to one for May’s update (although that could make the update fail – quite a bit more severe than an annoying text error).

Advertisement

The glitch affects desktop versions of Windows from Windows 10 Enterprise LTSB 2016 through Windows 11 26H1, as well as Windows Server 2012 through 2025.

The bug is little more than a cosmetic irritation but at a time Microsoft when has acknowledged it needs to make Windows more reliable, even small failures like this do little to inspire confidence. ®

Source link

Advertisement
Continue Reading

Tech

Today’s NYT Mini Crossword Answers for June 21

Published

on

Looking for the most recent Mini Crossword answer? Click here for today’s Mini Crossword hints, as well as our daily answers and hints for The New York Times Wordle, Strands, Connections and Connections: Sports Edition puzzles.


Need some help with today’s Mini Crossword? There’s a fitting Father’s Day mention. Read on for all the answers. And if you could use some hints and guidance for daily solving, check out our Mini Crossword tips.

If you’re looking for today’s Wordle, Connections, Connections: Sports Edition and Strands answers, you can visit CNET’s NYT puzzle hints page.

Advertisement

Read more: Tips and Tricks for Solving The New York Times Mini Crossword

Let’s get to those Mini Crossword clues and answers.

completed-nyt-mini-crossword-puzzle-for-june-21-2026.png

The completed NYT Mini Crossword puzzle for June 21, 2026.

Advertisement

NYT/Screenshot by CNET

Mini across clues and answers

1A clue: “Black” or “Yellow” dog, familiarly
Answer: LAB

4A clue: No-no for the lactose intolerant
Answer: DAIRY

6A clue: On the ocean
Answer: ATSEA

Advertisement

7A clue: Subway commuter’s annoyance
Answer: DELAY

8A clue: Like the logos of Marvel and Netflix
Answer: RED

Mini down clues and answers

1D clue: “See ya!”
Answer: LATER

2D clue: Pathway for an airplane beverage cart
Answer: AISLE

Advertisement

3D clue: No-no for the gluten-free
Answer: BREAD

4D clue: Apt palindrome for Father’s Day
Answer: DAD

5D clue: Apt palindrome for Father’s Day
Answer: YAY

Advertisement

Source link

Continue Reading

Tech

MSI Claw 8 EX AI+ with Intel Arc G3 launches at $1,800

Published

on

Facepalm: MSI is expected to launch its latest gaming handheld very soon, but people will have to pay a high price if they want one. The Taiwanese corporation tried its best to improve the cost situation, but the supply chain issue in the memory market is not going to disappear anytime soon – and things could become even worse in the not-so-distant future.

MSI should start shipping the Claw 8 EX AI+ on June 23, 2026, slapping a massive $1,800 price tag on the device. The OEM recently explained that the cost is a result of the current state of the memory market, and that more price hikes could arrive over the next few months if the supply chain doesn’t improve soon.

The MSI Claw 8 EX AI+ is based on the Intel Arc G3 processor, a powerful APU design that should provide plenty of computing and graphics power in a 65W envelope. Unlike Valve’s Steam Deck, the new handheld focuses on powerful hardware components to offer a “no-compromise” approach to PC-based portable gaming.

According to MSI product marketing manager Andy Chu, the corporation still has “privileged” access to hardware parts compared to a company like Valve. However, this benefit didn’t result in a much different situation in terms of silicon costs or the final price for customers.

Advertisement

All in all, Chu confirmed in a recent interview that 2026 will be a difficult year for both chipmakers such as Intel and OEM manufacturers such as MSI. Device makers are now unable to fully absorb the cost hikes impacting crucial components such as memory chips or storage, which is why consumers are going to pay more for everything no matter the brand.

“All I can say is we have tried every approach to get the memory and also storage at a lower cost,” Chu said in the interview, “like, deepen the relationship between us and also those suppliers, like to have some deals.” In the end, MSI executives “have done everything we can do to make our system as affordable as possible.”

Despite the high-profile effort, the Claw 8 EX AI+ will still carry its $1,800 price tag. MSI is now trying to change the narrative, highlighting how the new handheld is a high-end gaming device targeting enthusiasts who can spend that kind of money to get a luxury x86 machine. Even the “affordable” Steam Deck is now carrying a significant price premium, which is why MSI hopes customers will take a closer look at a device’s potential in terms of performance and capabilities before placing their order.

Chu is also warning that market conditions could even worsen compared to where they are today. According to his assessment, there is room for yet another price increase related to the supply chain crisis caused by the AI industry. Still, MSI expects sales of its handheld products to remain relatively stable even when factoring in a pricey offering such as the Claw 8 EX AI+.

Advertisement

Source link

Continue Reading

Trending

Copyright © 2025