Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor.

The flaw is tracked as CVE-2026-27540 and impacts plugin versions 2.0.3.1 and older. It is an unauthenticated arbitrary file-upload vulnerability discovered by security researcher Teemu Saarentaus.

An attacker can exploit it to upload PHP webshells and execute code, potentially leading to a complete site compromise.

From a technical standpoint, the flaw is caused by exposing  an unauthenticated AJAX action named wwlc_file_upload_handler, which checks file extensions against an allowlist supplied through the user-controlled file_settings request parameter.

This allows adding ‘php’ to the permitted file types, making the plugin accept PHP executable file uploads.

The vulnerability was addressed in version 2.0.3.2 of the WooCommerce Wholesale Lead Capture plugin, released on February 20.

However, WordPress security company Defiant is warning that its Wordfence web application firewall blocked over 100,000 attacks linked to CVE-2026-27540.

Wordfence reports that exploitation activity spiked between June 4 and June 17, and on July 1 and August 30.

During the attacks, the hackers upload a webshell that conducts reconnaissance but can also introduce additional payloads.

“The attacker submits a request to the wwlc_file_upload_handler AJAX action containing a forged file_settings parameter and a malicious file with a .php extension,” Wordfence explains.

“The uploaded shell.php is a PHP webshell that reports host details and provides a browser-based upload form for writing additional malicious files to the site.”

Wordfence provides a set of high-offender IP addresses that deployed tens of thousands of exploitation attempts. Administrators are recommended to add them to a blocklist and upgrade to plugin version 2.0.3.2 or later that addresses the security problem.

The researchers advise checking upload directories for unexpected or recently created PHP files, examining logs for requests to /wp-admin/admin-ajax.php invoking wwlc_file_upload_handler, and removing unknown administrator accounts.

If compromise is confirmed, the recommended action is to restore the website from a safe backup, as removing all persistence mechanisms, users, and backdoors may be complicated.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

If anything, 2026 has made clear that cybersecurity is no longer a background concern. Today, security is at the front and center of many conversations, woven into almost every major story of the year. 

Inequalities are still common, the climate is worsening, and we’re seemingly one dodgy sneeze away from the next global pandemic. But running beneath all of it is a digital current that touches everything: Wars are fought on digital fronts as well as physical ones, governments are weaponizing citizens’ own data against them, botnets are quietly undermining democratic institutions, nation-state hackers are targeting civilian infrastructure from power grids to water systems, and ransomware gangs are holding companies and institutions hostage for massive payouts. The attacks are getting bolder, more destructive, and harder to contain.

As we cross into the closing quarter of this already horrendous year of digital attacks and hybrid warfare, here is a look at some of the worst hacks and breaches so far, and how they might affect us going forward.

Questions of DOGE’s massive swipe of Social Security data linger

More than a year after operatives with the Elon Musk-led band of government destroyers known as the Department of Government Efficiency (or DOGE) swept through and dismantled federal agencies from the inside out, we’re still learning about the data lapses that happened under their watch.

After DOGE entered the Social Security Administration, it’s not yet known what happened with some of the nation’s most sensitive data, as lawsuits are still going on in federal courts. The most alarming claim by a federal whistleblower is that DOGE uploaded a live copy of the Social Security database to an unsecured third-party server, which led to a scramble to understand what was stored on the server. This database allegedly contained the Social Security numbers and associated personal information of most living Americans.

In court filings, the Social Security Administration isn’t sure what was on the server, but said that the DOGE signed an agreement with an outside political advocacy group under the guise of finding evidence of voter fraud, which President Trump continues to claim without any evidence. The fears are that the database could be misused to target Americans for spurious reasons. 

Two of the top House Democrats investigating some of DOGE’s activities at the Social Security Administration said the exposure “could very well be the largest data breach in our nation’s history.”

Hackers are increasingly targeting U.S. water systems and European energy grids to sow chaos

A rash of cyberattacks across Europe targeting civilian energy and water supplies, like power plants and water dams, has set a troubling trend. 

Several hacks attributed to (or partly blamed on) Russia have risked real-world harm to communities and populations. Poland’s energy grid was targeted with computer-destroying malware late last year, as was a Swedish thermal plant and a Norwegian dam that spilled entire swimming pools’ worth of water. 

Then earlier this year, Russian hackers targeted Poland’s water treatment plants, showing that Moscow’s hybrid war antagonism continues to extend beyond the digital realm.

Now, thanks to the recent war waged by the U.S. and Israel against Iran, hackers working for the Iranian regime are actively hacking critical infrastructure across the United States in opportunistic attempts to disrupt neighborhoods and communities. CISA said Iranian hackers targeted over a hundred water providers over the summer, including privately owned water utilities, which remain a soft target as they often lack basic funding and cybersecurity protections.

Klue reached a deal with its hackers, but still lost control of its customers’ data

Market research provider Klue was at the center of a huge data breach that affected close to 200 companies, several of which were cybersecurity giants such as Jamf, HackerOne and LastPass. It was one of the broadest data breaches of the year, affecting a multitude of Klue’s customers, less than a year after the company laid off half of its staff in favor of doubling down on AI.

Klue admitted that an extortion gang, dubbed Icarus, broke into its systems using a credential that it issued in 2022 for a limited pilot. So it appears the company had around four years to decommission the credential before it was stolen and used to break into its systems. In the data breach, Klue exposed the keys to its customers’ cloud services, allowing the hackers to break in and steal those stores of data to extort those companies for a ransom.

While governments and researchers often urge victims not to pay ransoms to prevent hackers from profiting from cybercrime, Klue told its customers that it had reached an agreement with the hackers not to publish the stolen data — strongly suggesting that it had paid them.

But as part of the deal, the hackers conceded that another hacking group also had a portion of Klue’s customers’ data and urged those victim companies not to pay them.

Thousands had their Instagram accounts hijacked thanks to Meta’s AI chatbot

When is a hack not quite a hack? When you’re granted access simply by asking for it. That’s what happened when thousands of Instagram accounts were hijacked in early 2026 as people abused Meta’s AI chatbot to reset others’ account passwords.

The hijackings, first reported by 404 Media, happened over the course of several months, and were only noticed after news of the exploit began to leak online. The attack was simple in execution: impersonating a target, people opened a chat with Meta’s AI chatbot and pretended that they had been locked out of the account. By requesting the chatbot to send a password reset code to an email address of the attacker’s choosing, the attacker gained access to their victim’s account.

The incident affected tens of thousands of accounts before the improper access was discovered and cut off. It was an embarrassing and high-profile lapse in security — and trust — for one of the world’s largest tech companies.

FBI and ATF surveillance systems were breached, sparking two “major cyber incidents”

The U.S. Federal Bureau of Investigation was forced to declare a “major cyber incident” in April, prompting a legally required disclosure to Congress, after it found that one of its surveillance systems was compromised. According to reports, the breach potentially exposed phone numbers of targets under surveillance by federal agents. 

Chinese spies were accused of the breach of the unclassified network, which held sensitive information about the surveillance targets of wiretaps and other communication intercepts, such as pen register returns. Because lawmakers were notified, the breach is likely to have met a high bar: Causing “demonstrable harm” to U.S. national security.

Months later in August, the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives, or ATF, confirmed its own “major incident” that prompted a separate disclosure to Congress. A ransomware gang took credit for the breach of a system that the enforcement agency said contained “targets of ATF investigations.”

The software supply chain is under attack, targeting open-source projects and Big Tech companies

A series of ongoing, concurrent and occasionally overlapping attacks on open-source developers has resulted in massive hacks targeting Big Tech companies and their customers. 

Some of the biggest names in security, including Aqua Security’s Trivy tool, Bitwarden and Checkmarx, alongside other major open-source projects, were compromised this year. The hacks allowed attackers to steal passwords, credentials and other sensitive tokens from the computers of anyone who installed a backdoored copy of the software, or their pre-installed software auto-updated to download the malware. 

These attacks used stolen credentials to spread further, and opened the door to downstream compromises of big companies that rely on the targeted software, including AI giant OpenAI and web hosting company Vercel. The EU’s top cyber agency later confirmed a major data heist following the theft of its cloud keys by the hackers. 

By August, two hackers blamed for these major heists were arrested in Australia.

Hundreds of millions of passports and driver’s licenses are now exposed online

An immense data breach at an identity document checking company called IDScan threatens to affect almost every driver in North America: Hackers touted a search engine on the dark web capable of listing the photos of 150 million drivers in the U.S. and Canada, including the reporter who broke the story.

The company confirmed a data breach soon after, but details are still emerging. The hackers appear to be holding the vast cache of data, stolen over the course of a year, hostage in return for a ransom.

This breach adds to an already extensive list of data spills involving people’s passports and driver’s licenses: From a hotel check-in system and a money transfer app to a prison payphone provider and a U.K. visa service, services exposed over 2 million people’s personal documents. Many of these were caused by simple security lapses that would have been easily prevented if basic cybersecurity practices had been followed.

The massive data breaches come as closed-community apps and websites are increasingly leaning on “know your customer” checks to force users to verify their identity before being allowed in. Meanwhile, governments are pushing age-verification laws, demanding similar identity checks from adults to access a vast swath of the internet. 

The logic goes that the greater the spills, the less effective these identity-checking systems are, as they can be easily misused with a stolen or leaked passport or driver license. The further rollout of these ID-collecting systems will inevitably lead to more data breaches and security lapses.

Healthcare hacks spill medical records belonging to tens of millions of people

A scattering of healthcare-related data breaches have hit tens of millions of people across the U.S. this year. The largest known breach of 2026 hit insurance company DentaQuest, which resulted in the theft of health data of 15 million people. Another major data breach at CareCloud, a company that hosts electronic patient records, allowed hackers to steal the sensitive medical information of at least 3.7 million people. 

And, a breach at healthcare data and billing giant Aesto Health at the end of last year was later confirmed to affect at least 9.5 million patients at dozens of providers and practices that use its software. 

Hasbro’s hack led to weeks of downtime

Toymaker giant Hasbro is the latest example of what happens when a large corporation isn’t prepared to manage a security incident. Weeks after discovering hackers in its systems in late March, the 103-year-old company remained largely offline, its website was unavailable, and unable to serve its customers.

The company, which owns big name brands such as Transformers, Peppa Pig and Dungeons & Dragons, has said little about the incident itself, what data was taken (if any), and whether it paid the hackers. But the disruption alone was likely to affect the company’s financials, and it was forced to delay filing its quarterly report with the SEC, as it scrambled to handle the incident. 

Hasbro said in May that the hackers were no longer in its systems, and that its recovery was underway. While the data breach affected a few hundred employees, the financial costs of the breach and the knock-on effects to its business are likely to be realized in the coming months.

Instructure falls victim to ShinyHunters’ disruptive hacking campaigns

The ShinyHunters gang continued its hacking campaign, targeting dozens of companies with simple but highly effective voice-phishing techniques. The English-speaking hackers are adept at tricking companies into turning over access to their internal systems by pretending to be IT support, or conversely, an employee who forgot their password.

Few companies know better the toll a ShinyHunters campaign can exact than education tech giant Instructure. The hackers breached the company’s flagship learning management system, Canvas, to steal private data and personal information of over 30 million students and staff. 

When the company didn’t pay the hackers’ ransom, the hackers broke in again, and defaced the login screens for Canvas, used by students to access their exam and coursework material. This second hack happened during school finals, disrupting exams across the United States. 

Instructure eventually paid the ransom, despite efforts by the FBI to dissuade the company from paying.

This wasn’t the only company targeted by the ShinyHunters hackers. The gang has been behind some of the largest breaches by the number of records stolen: They’ve stolen some 40 million records from internet provider Charter and at least 6 million customer records from cruise liner Carnival, as well as other victims in higher education, finance, and government.

Medical device makers Stryker and Boston Scientific struck with destructive attacks

A cyberattack on a U.S. medical tech company, Stryker, in March saw Iranian hackers break in and remotely wipe tens of thousands of employee devices in one fell swoop, widely disrupting the company’s operations for several days. 

The breach represented a marked shift in Iran’s hacking tactics at a time of ongoing war: the country moved from its typical focus on espionage and hack-and-leak operations in aid of political gains, toward active, destructive hacks in apparent retaliation for the war. 

The U.S. government connected the hacking group behind the breach to an arm of Iranian intelligence. The breach ended up having a material impact on Stryker’s first-quarter earnings.

In August, a similar fate befell medical device maker Boston Scientific, after a cyberattack cut off the company’s global network, causing a “global disruption” to its operations. The Massachusetts-based company, which makes heart implants like pacemakers, said some patients were affected by the outages, which also prevented it from shipping and creating new orders. 

Boston Scientific took two weeks to recover from its immediate outage, though its ongoing recovery has stretched into September. 

First published on June 8, and updated on July 7 and again on September 15.

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems.

The malware adopted MQTT for command-and-control communications in variants developed between 2024 and 2025, compromising servers used by mobile apps, legal and financial services, and software development.

MQTT is a lightweight messaging protocol primarily designed for IoT (Internet of Things) devices. It relies on a central broker and channels called “topics” to relay messages from publishers to subscribers, rather than using direct communication channels.

While MQTT is not novel, it is an uncommon approach, and researchers at cybersecurity company ESET documented an unrelated backdoor called MQsTTang in 2023.

In the case of BambooToken, the infected machine subscribes to topics associated with a unique identifier. The attacker then publishes to those topics the commands to be executed on infected hosts.

The malware publishes status and system information through the broker and receives operator instructions through subscribed topics.

This approach has the advantage that infected systems do not connect directly to the attacker’s infrastructure, which increases evasion and resilience. At the same time, communications can be asynchronous, ensuring operational continuity during temporary network disruptions.

A report today from Lumen’s research arm, Black Lotus Labs, notes that BambooToken infected systems by side-loading via a digitally signed Tendyron OnKey USB-token software or by impersonating the Kingsoft Office productivity suite.

The researchers recovered a BambooToken plugin that enumerates antivirus products on infected hosts and returns the results to the C2. They also found strings pointing to keylogging, clipboard theft, audio recording, webcam capturing, and screenshot capturing.

However, they retrieved these details from “dead code,” meaning the researchers cannot confidently determine if the referenced modules existed and were used in attacks or were still under development.

The researchers found a Linux variant of the malware, BambooToken version 2.1, as the most recent one (observed in December 2025) that could be linked to the campaign

It also uses MQTT, collects extensive system information, can spawn a command shell, and allows operators to upload, download, and delete files. However, Black Lotus Labs says that “the Linux sample still appeared to be under development.”

Lumen’s telemetry identified approximately a dozen compromised enterprise entities, mostly in Asia and South America, including hotels, biomedical firms, law firms, a financial organization, and a cryptocurrency website in Lithuania.

Additionally, the researchers found that the most compromised servers were associated with the backend infrastructure of mobile applications.

The threat actor also compromised a GitLab server in Hong Kong, creating a potential foothold for supply-chain attacks.

Lumen hypothesizes that some of the activity may have targeted overseas Chinese users accessing mainland services through the SpeedCN VPN service.

Although the researchers could not attribute BambooToken activity to a specific threat actor or a known activity cluster, they note that the targeting patterns are consistent with China-aligned operations.

Lumen has shared indicators of compromise (IoCs) associated with this activity to help defenders detect and block the attacks.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

A global survey highlights a growing AI trust gap among employees and leaders in the IT space.

Cloud communications and IT company GoTo has today (15 September) released the findings of a new research study, ‘The Pulse of Work in 2026: Opportunity, Risk and Responsibility in an AI-driven Workplace’. 

The report, in partnership with Workplace Intelligence, collected data from 2,500 globally dispersed employees and IT leaders to explore AI use and sentiment. Participants were from a diverse range of countries, including the US, Canada, the UK, Ireland, Germany, Austria, Switzerland, India, Mexico and Brazil.

What was identified in GoTo’s research is that, while there are many positives associated with the use of AI in the workplace, there are “pitfalls” too. 

The research found that AI can save more than two hours per day, boost productivity and reduce routine workloads. However, amid unclear guardrailing, employees are struggling to navigate growing risks. More than 80pc of participants fear they could be blamed or fired for an AI mistake and 31pc agreed they avoid using AI for that reason. 

Nearly one-quarter of IT leaders who contributed to the research said that AI has already made mistakes that have either negatively impacted consumers and clients, or financially impacted their company. Almost all of the IT leaders who took part (91pc) agreed that they are concerned AI will make a mistake that impacts their company in the future.

Commenting on the findings of the research, Rich Veldran, the CEO of GoTo, said, “In the US alone, there’s an opportunity for more than $2.9trn in potential efficiency gains to be captured from effective AI use. But without clear guardrails, that potential is being eroded by anxiety, misuse and unaddressed risk. 

“The organisations that close the gap with clear accountability structures, training and policies that give employees confidence won’t just speed adoption, they’ll be the ones who pull ahead.”

Small businesses were also found to be facing significant challenges, as only 24pc said they have an AI policy in place, compared to 36pc of mid-size organisations and 53pc of enterprises.  

The report stated, “That leaves the majority of small and mid-size business employees without clear guidance on how to use these tools safely, further increasing concerns.”

Making AI accountable

The research found that not only are some people not confident enough in the use of AI, but some employees are taking advantage of AI’s limitations. More than one-quarter of contributing employees said that using AI allows them to avoid any real accountability at work. 

25pc said it feels safer to blame AI than to own up to a mistake and 17pc of employees admitted that they have already done so. 

Many employees feel as though their company is falling behind in the promotion of responsible AI, even in cases where there is a clear policy in place. 55pc admitted they don’t always review or double-check AI outputs, even for high-stakes tasks, and 43pc said they’ve used AI outputs even though they felt they were low-quality or suspected they might contain errors or fabricated information.

GoTo’s report also highlighted fears that employees’ concerns are being ignored or that they are in an environment in which they are not confident enough to vocalise concerns. 

31pc said there is unspoken pressure at work to trust AI and keep quiet about its mistakes, while 14pc reported AI errors to a manager or leader but were told to stay quiet about them. 

Dan Schawbel, a managing partner at Workplace Intelligence, said, “We’re seeing a new kind of workplace pressure – employees feel they must use AI to avoid looking replaceable, but fear repercussions if it goes wrong. 

“That combination is exactly how you get a workforce that uses AI recklessly. Many organisations are accelerating AI adoption without providing the training, policies and support employees need to use these tools effectively.

“The companies that close this gap will be best positioned to unlock AI’s full capabilities while building a more productive and confident workforce.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

More Meal Kits I Liked

Sunbasket

Photograph: Matthew Korfhage

Sunbasket (~$16 per serving): Sunbasket focuses heavily on fresh, organic ingredients and offers a whole lot of variety in its menus. Its recipes are attentive to saucing, and to basic good cooking techniques such as deglazing. Like Hungryroot, it also offers breakfasts and snacks to supplement meal options with little extras such as coconut yogurt and sous-vide egg bites. The meal kit also lets you filter out allergen-containing items. WIRED reviewer Louryn Strampe loved the flexibility and add-ons. During my most recent test, I enjoyed an excellent Greek chicken and orzo salad dish—and, wonder of wonders, the advertised prep time was actually the actual prep time (about 30 minutes). The focus on organic ingredients does make Sunbasket one of the more expensive meal kit options, and the annual Thanksgiving meal kit was a lovely and welcome extravagance at $200.

Gardencup ($11 to $15 a serving): Gardencup is a little like having the whole menu of Sweetgreen sent to your house or office, except in cylindrical form. Basically, you pick out premade salads, soups, and snacks, and they come in little cups—fresh, lovely, crisp, and ready to eat. I found it to be a great way to keep myself eating healthy when there’s no time to cook at the office (or the home office), which is typically when DoorDash or freezer-meal temptations run wild. It remains among the healthiest prepared food delivery options I know. I even tested Gardencup as a salad option during a cyclospora parasite scare, in part because I missed salad and because Gardencup could attest that it did not use lettuce from any of the suspected sources of the outbreak. The salads remained delicious and delivered a shocking amount of protein in options with meat. But variety of options is not a strong suit. A slackened focus on local sourcing, plus limited transparency on sourcing—Gardencup will disclose only that it sources its greens in the salad belt from Salinas, California, to Yuma, Arizona—has kept Gardencup in my honorable mentions.

Factor

Photograph: Matthew Korfhage

Factor ($13 to $17 a serving): Factor is a prepared-meal delivery plan run by HelloFresh, with ready-to-eat meals that look a lot like TV dinners. But there’s a twist: The trays have never been frozen. They were made fresh in a commissary kitchen and were shipped out with cold packs, yielding a result that’s kind of like restaurant leftovers. Consistently, Factor ranks among the best-tasting prepared meal plans I’ve tested, especially when I shrug off directions and use an air fryer to reheat my meals instead of a microwave. Proteins and high-protein meals are a strong suit. Proteins maintain their texture quite well, especially a truffled filet mignon I couldn’t believe I microwaved. Still, some meals, especially carb-avoidant or keto meals, are oddly mushy, while meals centered on proteins and whole starches, like potatoes or rice, alongside veggies like green beans or brussels sprouts, tended to fare quite well. So did stir-fry-style meals. My gluten-free colleague, Scott Gilbertson, wrote that he had the best luck with Factor’s Mexican fare. I do wish Factor would shed its reliance on the microwave: When I went off-script and used a Ninja Crispi air fryer or convection oven, I had much better results than with the nuker. But non-air-fryer ovens do not seem to offer the same improvement. Like many ready-to-eat meals, it’s a bit more expensive than the kits you cook yourself. Oh, and as a bonus? Factor has a really, truly delicious selection of nutrient-amped juice bottles and elderberry “shots.” I could pretty much subsist on their probiotic cucumber-pineapple green juice.

Fuel Meals

Photograph: Matthew Korfhage

Fuel Meals ($14 to $15 a serving): Fuel Meals are a no-nonsense, no-fluff, no-added-ingredients, pure-protein-packed nutritive meal plan, with many meals paleo-friendly. Some of Fuel’s meals had as few as five ingredients, consisting of essentially the macronutrients themselves plus a modicum of oil and salt. A large percentage of meals are marked gluten-free or dairy-free. Does all this mean less flavor? It can. The meals are also often not beautiful, dominated by a large and no-fuss serving of protein. But Fuel’s meal service offers an admirable focus, especially for those bulking up or watching carbs. Meals are substantive, usually topping 600 calories and 40 grams of protein without added sugar or fatty dairy or carb-heavy filler. I feel like if I wore tank tops more often, this is what I’d eat.

Wildgrain

Photograph: Matthew Korfhage

Wildgrain ($13 to $17 per loaf or box of pastries): This is less a meal delivery service than a way to step up a home meal. Wildgrain is a monthly delivery bread box: You receive par-baked bread and pastries from small bakeries all over the country. This is pretty much the same process that likely happens at local restaurants when your warm bread basket comes out: It’s not quite as high-quality as you’d get direct from an artisan bakery, if you live in places with artisan bakeries. But it’s also as fresh as it gets, and I had a very good experience testing the box in October 2025, in particular, with sourdough breads perfect for large meals with houseguests. You finish the baking at home, so what you have at the end is ultra-fresh baked bread, biscuits, doughnuts, or scones that are still warm and crisp from the oven. A Wildgrain subscription arrives as a monthly box, filled with four, six, or 12 items that might range from a full sourdough loaf or fresh-made pasta to a pack of six doughnuts or four large croissants. Basically, you build your own box each month, choosing from among healthy sourdough or pasta and decadent pastries.

Thistle ($12 to $15 per meal): A prior top pick for solo diners with individually prepared dishes that require little to no prep, Thistle is mostly a plant-based meal kit—but there’s a $3 option to add sustainable meats to any otherwise vegan meal. It’s also so local and seasonal that the West and East Coasts have different menus, and the whole middle of the country, except Chicago, gets none. (You can check your zip code here to see if you can get delivery.) WIRED reviewer Adrienne So has used Thistle as a means to get herself to eat more vegetables, and thus avoid a life of rickets and/or scurvy. Portions are generous enough to split among meals, and in a nice turn for those who hate having to dispose of boxes, Thistle’s drivers will pick up the cooler bag that housed last week’s meal and replace it with a new one full of food. Vegan tester Molly Higgins’s favorite meals from Thistle were a whirlwind of textures, including a Mexican-inspired corn and poblano chile salad with adobo pinto beans and a chilled lemongrass-accented rice noodle bowl that mixed spice, tang, crisply fresh veggies, and deep umami from mushrooms and seaweed. She still dreams about it sometimes. Breakfasts are available at a lower cost, as low as $9.

Tovala

Photograph: Matthew Korfhage

Tovala (~$9 to $15 a serving): It’s not every day you get to try something that feels super new. Tovala offers perhaps the most ambitious solution to ready-to-heat and prepared meal delivery I’ve seen: The meal kits come with an oven! In contrast to the sogginess of many prepared meals, Tovala’s recipes come in little foil pans with recipes custom-designed for a little steam oven. The results are often delicious—as was the case during my testing with a sweet chili–glazed salmon with pickled veg and noodles—and the QR code scanning function makes each recipe seamless to cook. Stick with the meal plan for six weeks, and in the bargain you get a quite affordable and powerful little convection oven, toaster, and steamer. A previous flaw was that Tovala only offered single-serve meals. But as of early 2026, at least four or five meals a week offer two to four servings, making the meal delivery service much more useful to families and couples—and much more economical on a per-serving basis. But not that it’s also one of the most sodium-filled meal services I’ve tested.

Gobble

Advertisement

Photograph: Matthew Korfhage

Gobble ($17 a serving): Formerly the top pick for fast-cooked meals, Gobble previously wowed with speed-demon dishes that also offered interesting and worldly flavors. Indeed, the most recent test included Caribbean rondon, an Indonesian peanut curry stir-fry, and steak vierge. But while the flavors have stayed interesting, the focus on fast cooking appears to have waned since my colleague Louryn Strampe tested Gobble. Cook time estimates aren’t printed on the recipe cards, but meals took as long as 30 minutes. For now, Hungryroot has taken the fast-cooking crown. For small households, Gobble is also among the most expensive kits. At most portions, prices approach $17 a serving plus shipping.

Nurture Life ($6 to $7 per serving): Nurture Life is like a restaurant kids’ menu, in ready-to-eat meal kit form. We loved the idea behind this fresh-made, never-frozen delivery meal plan when we tested it a few years back: a bunch of toddler- and slightly bigger kid-friendly meals, from mac and cheese to spaghetti and meatballs to myriad variations on the chicken nugget. The meal prices have dipped to reasonable levels of late, meaning it’s likely due for a retest—and each plate contains vegetables alongside the greatest hits.

Veestro ($7 to $14 per serving): WIRED reviewer Louryn Strampe enjoyed Veestro as a ready-to-eat vegan option, with premade meals delivered fresh, but with freezable options so you can have extra meals on hand in a pinch. The service offers a number of filters for other dietary requirements, and satisfying taste and texture—which is not always a guarantee on ready-to-eat meals. Veestro has updated its menu and offerings since the last time WIRED tested, including a number of snacky soup offerings. The online menu interface, allowing you to sort by ingredients and filter out unwanted ones, is among the best I’ve seen.

Splendid Spoon ($9 to $13 per serving): Splendid Spoon is a nutrition delivery kit that offers a plethora of plant-based smoothies, soups, bowls, noodles, and shots. Everything here is natural, plant-based, and free of gluten or GMOs, including spaghetti and plant-based “meatballs.” WIRED reviewer Louryn Strampe has a big yen for the smoothies in particular ($10 apiece), but wasn’t quite prepared for the intensity of a lemon juice shot that comes as part of a five-pack of dense 3-ounce superfoods.

ModifyHealth’s Braised Beef (top) and Paprika Salmon (bottom)

Photograph: Matthew Korfhage

ModifyHealth ($10 to $13 per serving): The idea behind ModifyHealth is that food can be medicine. Sometimes, I’ll admit, it tasted like it was designed purely for nutrition rather than flavor. ModifyHealth is a prepared meal delivery service tailored to people who need a heart-healthy, low-carb, or low-FODMAP diet to avoid dire digestive or health consequences. GLP-1 weight-loss plans are also available for people with diabetes or others. Gluten-free meals are attested to be made in an entirely gluten-free facility. The meals were simple, benign, and low-sodium but also sometimes a little soggy—a common problem with prepared meals. The plastic top of the packaging was also difficult to disengage from the base of each meal tray—a problem when the plastic is hot after a turn in the microwave. But here’s what I do like: The meals are carefully tailored with consultation from dietitians to help people for whom food can be a source of fear or pain. An additional service, offering one-on-one dietitian consultation, can be covered by many insurance plans. ModifyHealth also offers a free consultation for those just trying to figure out which diet plan is right for them. For those with IBS in particular, this remains the most focused food plan I’ve seen.

Daily Harvest (prices vary): Daily Harvest is another ready-to-eat meal delivery service specializing in dietary restrictions: plant-based, plus gluten- and dairy-free. Smoothies feature, as do harvest bowls, pastas, and grains. Calories are low. Ingredients are often inventive. The meal’s a lifesaver for the solo vegan eater without time to prep a meal, and WIRED vegan reviewer Molly Higgins appreciated that the meals mostly relied on the natural flavors of the vegetables themselves, accented with flavors like curry and lemongrass. As with a lot of frozen meals, however, texture wasn’t a strong suit in the ready-to-heat meals. The ready-to-blend smoothies are great, though.

A Meal Kit I Don’t Recommend

Sakara Life ($30+ per serving): Sakara Life offers plant-based weekly menus in fresh, prepared portions, with greens, flavorful sauces, all-organic ingredients, and textural add-ons like seeds or berries. But it’s among the most expensive meal plans we’ve tested, and neither WIRED reviewer who tried it has really cottoned to the thing. Tester Louryn Strampe questioned the science on health claims for detoxes and cleanses, while calling Sakara “egregiously expensive” and full of “bitter veggies and tart fruits.” Vegan tester Molly Higgins, meanwhile, said Sakara Life’s tinctures and metabolism supplements didn’t agree with her system, and that the mostly raw-food plan made her long for “human food.”

Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.

After the iPhone, the Redmi Note is perhaps the best-known phone series, at least in markets like India. Millions have bought a Redmi Note, including me, because it’s a faithful companion. Today, Redmi introduced the newest Redmi Note 17 Pro series, and I’ve been using it for the past two weeks. While there is still some time before the full review, here’s everything you need to know about the Note 17 Pro.

Battery That Lasts Days, and More

As you may have guessed, the biggest highlight of the Note 17 Pro is its 9,000 mAh silicon battery. And while I can’t talk much, you definitely won’t be charging it every day. This is coupled with 67W fast wired charging, and the Note 17 Pro also reverse charges at 27W. Redmi has also gone the extra mile and gotten the 5-star Battery Performance Certification from TÜV.

That massive battery powers the Snapdragon 6s Gen 4 processor, which Redmi says shoukd should stay smooth for years to come. Alongside, you can get up to 8 GB RAM and 256GB UFS 3.1 storage. I’ll reserve my final verdict on gaming and sustained performance for the full review, but so far the phone feels exactly like what a Redmi Note should: dependable, responsive, and built for long days away from a charger.

Premium Design

Redmi has refreshed the camera island with a cleaner, more modern look that feels closer to its premium phones than previous Note devices. The phone comes in multiple finishes like Sky Blue, Black, Satin Orange, Purple, and the matte rear panel does a good job resisting fingerprints despite using a plastic back.

At 223 grams and 8.6mm thick, it isn’t a lightweight device, but that’s the trade-off for fitting such a massive battery. In hand, the weight is well distributed, and the flat design is pretty comfortable for everyday use. The front is protected by Corning Gorilla Glass Victus 2, while the phone also carries IP68 and IP69K ratings for dust and water resistance. Redmi even claims up to 3-meter drop resistance, and to test that, they invited The Great Khali, who then proceeded to drop the phone from his height.

The Redmi Note 17 Pro features a 6.83-inch AMOLED display, and it’s easily one of the better-looking panels you’ll find in the mid-range segment. You get a 1.5K resolution, a 120Hz refresh rate, and 3,840Hz PWM dimming. Redmi claims a peak brightness of 3,500 nits, and while I haven’t measured it yet, outdoor visibility has been excellent during my time with the phone.

Redmi has opted for a relatively simple dual-camera setup this year. The primary sensor is a 50MP wide camera with optical image stabilization (OIS), accompanied by an 8MP ultrawide shooter. On the front, there’s a 16MP selfie camera housed inside the centered punch-hole cutout. Out of the box, the Note 17 Pro runs Android 16 with HyperOS 3.

The REDMI Note 17 Pro 5G starts at ₹36,999 for the 8GB + 128GB version, and the 8GB + 256GB version costs ₹39,999.

• The gaming chat service Discord appears to have gone down
• Users are reporting that the app is not loading
• Discord says there are problems affecting availability right now

Popular gaming chat service Discord appears to have gone down, with many users reporting that they are currently unable to access the app on social media.

It’s unclear which regions are affected right now, but here in the UK, I can no longer open the desktop application. The mobile app seems to be functioning properly, though, and I am able to both send and receive messages for the time being.

cyber-crime

Forum post claims 7.49 million files up for grabs as Texas utility investigates breach

Texas utility CenterPoint Energy has confirmed that an attacker broke in and stole customer information through one of its internet-facing systems.

The company disclosed the breach in a Form 8-K filing with the Securities and Exchange Commission after a post on a cybercrime forum claimed to offer its customer data.

Houston-based CenterPoint, which serves around 7 million customers, said its electricity and gas services remain operational and undisrupted.

“While the investigation remains ongoing, the company has determined that an unauthorized third party obtained personal information relating to a portion of the company’s customers through one of the company’s external-facing systems,” the filing said.

“The company is continuing to work with third-party experts to determine the scope of customers and personal information affected by the incident and intends to notify affected customers and regulatory authorities as required by applicable law.

“The company reported the matter to law enforcement authorities and has notified certain regulatory authorities of the issue.”

The person claiming responsibility said they extracted 7.49 million of CenterPoint’s files from a poorly secured API.

Among the data allegedly available to download are customer names and contact details, billing data, move-in dates, driver’s license information, and the last four digits of Social Security numbers.

The Register has not independently verified the contents of the alleged data dump, and CenterPoint did not respond to our request for comment on the veracity of the claims.

CenterPoint said it does not believe the incident is reasonably likely to materially affect its financial condition or results of operations.

For operators of critical infrastructure, cyberattacks can lead to far worse outcomes.

Recently, disruptive attacks have been recorded at facilities in Poland and the UK, and more than 100 US water systems were affected by attacks in July.

The US consistently warns about the cyber threat facing utility providers from hostile states because successful attacks can disrupt essential services. ®