Google is giving Photos another dose of Gemini. The company has announced Video Remix, a new AI-powered editing tool that can transform ordinary video clips into stylized creations with just a few taps. Rather than requiring professional editing skills, Google says the feature lets users quickly reinvent existing videos using creative AI effects directly inside Google Photos.

Think of it as Photo Remix, but for videos

Available from the Create tab in Google Photos, Video Remix uses Gemini Omni to apply AI-powered transformations to an existing video clip. Instead of trimming footage or manually layering effects, users simply choose a creative template, and Gemini generates a new version of the clip with a completely different look and feel.

The available effects go well beyond simple filters. Video Remix can apply cinematic relighting to brighten dark footage, swap plain backgrounds for entirely new environments, or turn videos into artistic creations with styles such as watercolor, raw sketchbook, and oil painting. Google even showcases examples like giving a video a morning glow, placing someone inside a greenhouse, or transforming a clip into dreamy watercolor artwork.

There are a few limitations, though. Video Remix currently works only with video clips up to 10 seconds long, and longer recordings need to be trimmed before the AI begins generating a new version. The process itself can also take a couple of minutes, depending on the edit.

Rolling out first to Google AI subscribers

Video Remix is rolling out starting today for eligible Google AI Plus, Pro, and Ultra subscribers in select countries, including India, the U.S., Japan, South Korea, Brazil, Mexico, and several others.

The launch continues Google’s steady push to bring Gemini deeper into Photos. Over the past year, the app has gained AI-powered image editing, smarter search, and creative tools for photos. Video Remix extends that philosophy to videos, making it less about traditional editing and more about letting AI completely reinvent how a familiar clip looks—all without leaving Google Photos

Mount Royal University in Calgary says hackers stole and then deleted data from its file storage systems after breaching the university’s network.

In an update published on its website, MRU states that it has engaged technical teams and external cybersecurity experts to investigate the incident and to support recovery efforts following a cyberattack on June 17.

The incident disrupted a broad range of university systems, including online services, internet access, and certain internal systems.

MRU is a public university with a history of more than 100 years. It currently has 11,560 students and 12,500 undergraduates.

So far, the investigation confirmed that the attacker stole data stored on a drive used by students and employees for file storage, and the original copies were wiped to disrupt recovery operations.

“We regret to inform our community that our investigation has now shown that data within certain folders on the University’s “H drive” was accessed and taken by an unauthorized actor,” reads the announcement.

The university specified that the incident affected certain folders on the H drive, which contained information affecting current and former students, current and former employees of the university, and an unspecified category of “other individuals.”

Additionally, the attackers also wiped a separate drive, labeled “J,” which stored departmental data. “There is currently no evidence that J drive data was accessed or copied before it was deleted,” MRU says.

“We are still working to recover deleted J drive data, but a full recovery may not be possible.”

The university stated that the incident has been reported to the Alberta Information and Privacy Commissioner and to law enforcement authorities.

The university states that the exposed data varies by person, and because it has been deleted, determining the exact impact for each individual is complicated and will take time.

Once impacted individuals are identified, they will be contacted directly via personalized notifications.

CMD Organization claims the attack

The MRU attack was claimed by the threat group CMD Organization, which has published samples of the allegedly stolen data, including passport scans and other sensitive documents.

The threat actor asked for a 30 BTC ransom, currently around $1.9 million, and gave the university six days to respond before leaking the full set of stolen information.

CMD Organization appears to use an auction-style system, offering to sell the stolen data exclusively to the highest bidder. The threat group currently lists 30 organizations on its extortion site and operates both a clear web and a dark web portal.

MRU said that the recovery of the affected systems may take between several weeks and months and will provide updates as soon as new details become available.

The university is also offering two years of credit monitoring and identity theft protection to all current employees and individuals employed in the past five years.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

Ira Apfel sits down with Sarah McKibben, Editor-in-Chief of EdSurge to close out a full week of coverage from ISTELive 26 in Orlando. This conversation is a recap of everything that stood out once the keynotes ended and the convention floor quieted down, from a new idea called relational intelligence to a phrase about AI slop that stuck with educators all week. It only scratches the surface of what the EdSurge team gathered on the ground. Many more conversations recorded live at the conference are set to roll out across upcoming episodes in the weeks ahead. Listen now to hear what Apfel and McKibben took away from ISTELive 26 before the rest of the coverage arrives.

Listen to the episode.

Stories Mentioned in This Episode

This is a special recap episode from ISTELive 26 in Orlando where Ira and Sarah reflect on the hallway conversations, speaker presentations, and podcast interviews they enjoyed throughout the week. Featured speakers include:

• Pat Yongpradit, GM, Education and Workforce Policy at Microsoft

• Dr. Nneka McGee, Fmr. Chief Academic Officer and Founder of Muon Global

• Isabelle Hau, Executive Director of the Stanford Accelerator for Learning

• Heather E. McGowan, Bestselling Author, Leadership Expert, and LinkedIn Global Voice for Education

• Melinda Glowacki, MAT Supervisor and Leadership Coach for the University of California, Irvine

• Tambra Clark, Technology Integration Facilitator of Birmingham City Schools

• Mary Ehrenworth, Author, Speaker, Consultant, from Teachers College, Columbia University

• Philip Seyfried, Student, from Teachers College, Columbia University 

• Jessica Garner, Managing Director, Innovative Learning at ISTE+ASCD 

• Court Shuller from the Voices of Change Fellowship

This Week with EdSurge is a weekly podcast from EdSurge. Subscribe to the EdSurge newsletter for more news and analysis on education and technology.

For years, conversations around screen time have focused almost entirely on children. How much YouTube is too much? Should teenagers be on social media? When should a child get their first smartphone? A new study suggests we may have been asking the wrong question.

According to research published last month in the peer-reviewed journal Frontiers in Psychology (via Bloomberg), it’s not just children’s screen habits that matter. Parents who are constantly distracted by their phones may unintentionally weaken their emotional bond with their children, potentially leaving lasting developmental and psychological effects. The study surveyed 600 U.S. adolescents aged 12 to 17, many of whom reported feeling ignored or sidelined when their parents were absorbed in their devices.

The phone isn’t the problem. Feeling ignored is

The researchers found that excessive phone use by caregivers can contribute to what’s known as “insecure attachment” — a pattern that may make children more anxious, avoidant, and less confident in relationships later in life. According to Don Grant, a media psychologist, addiction expert, and fellow of the American Psychological Association, those effects can persist well into adulthood if left unchecked.

It “could really unfavorably impact their attachment security, which they will carry for life,” Grant said.

Grant described the issue as more than simply spending too much time on a phone. It’s about being physically present but emotionally absent. One example from the study highlights parents who proudly attended every recital or sports match, only for their children to remember them as constantly looking down at a screen instead of watching the moment unfold.

Why does this study feel different?

We’ve previously covered how excessive screen time and social media can affect children. What’s different here is that the researchers turn the spotlight onto parents instead. Their work represents one of the most comprehensive studies examining how children perceive their caregivers’ technology habits and how those habits shape the parent-child relationship.

The findings also build on growing research around “technoference” — the idea that digital devices quietly disrupt face-to-face relationships. While earlier studies largely examined its impact on romantic partners, this research suggests the same pattern may be playing out between parents and their children. It also aligns with broader trends. For instance, Bloomberg notes that nearly half of American teenagers surveyed by the Pew Research Center in 2024 said their parents were at least sometimes distracted by a phone during interactions, even though far fewer parents believed it was happening.

The funny thing is that we’ve spent years worrying about children becoming glued to their screens. This study flips that conversation on its head, suggesting the bigger issue may be what children see when they look up. After all, the moments kids tend to remember aren’t the ones spent staring at a screen, but the ones when the people they wanted to connect with were staring at theirs.

HubSpot has scrapped a plan to use its customers’ data for a new AI feature, just four days after announcing it. The CRM firm changed its terms on 1 July to pool customer data, including contact and employer details, for a tool that finds sales leads, The Information reported.

It opted users in by default. The backlash came at once.

The objection was less about AI than about consent. Customers argued that the data they had built up in HubSpot belonged to them, not to the company to share around. HubSpot set the default to opt-out. It enrolled everyone unless they hunted down a toggle. That turned a product tweak into a trust problem.

A four-day retreat

The revolt played out mostly on LinkedIn, where sales leaders and RevOps teams piled in. Some said they would switch providers. Within days HubSpot folded.

Chief product and technology officer Duncan Lennox apologised and called the change “a mistake”. He said HubSpot would not implement the new terms, and that any future use of customer data would be opt-in. The plan, in short, is dead.

The bigger nerve it hit

The speed of the climbdown says as much as the policy. Software firms are racing to bolt AI onto their products, and customer data is the obvious fuel. HubSpot is not the first to get burned. Slack drew fire in 2024, and Zoom in 2023, over terms that let them train AI on customer data. What stung this time is that CRM data is a company’s competitive asset, not just its files.

It also shows where power sits. In an era when a business can rebuild a workflow with cheap AI tools, big software vendors have less room to dictate terms. Annoy the customer base and it has more exits than it used to.

Why it matters

The episode is small, but it is a marker. Every SaaS company is weighing how to feed its AI without spooking the people who pay for it. HubSpot just ran the experiment in public, and learned that “opt-out” is now a fighting word.

ai and ml

Third-party testing shows heterogeneous compute platform combining H200s and SN50 RDUs churning out 763 tok/s in MiniMax M2.7

Intel’s big bet on SambaNova appears to be paying off in a big way. This week, the AI chip startup shared benchmark results showing its latest generation of AI acceleration, which combines Nvidia GPUs and the company’s accelerators, beating GPU-only inference platforms by a wide margin.

The testing, conducted by the AI benchmarking gurus at Artificial Analysis, showed SambaNova’s SN50-series accelerators, announced in February, churning out 763 tokens a second in MiniMax M2.7 at short context lengths (10,000 input tokens) — several times faster than competing inference providers running on GPUs alone.

Meanwhile, for longer context lengths, the company says that its platform is able to sustain more than 450 tokens a second. 

This feat was accomplished by combining Nvidia GPUs with SambaNova Reconfigurable Dataflow Units (RDUs) to form a heterogeneous inference platform.

Specifically, the computationally intensive prefill phase of the inference pipeline, during which prompts are processed and key value caches are generated, was handled by four Nvidia H200 GPUs.

Meanwhile, memory-bandwidth-bound decode operations, where output tokens are generated, were done on a single SambaNova rack containing 16 SN50 accelerators.

Disaggregating prefill from decode has become a key lever for reducing token costs for long-running AI agents, like code assistants. Nvidia initially demonstrated this with its NVL72 rack systems, by varying the ratio of GPUs used for prefill versus decode. The company further disaggregated this with its Groq-based LPX racks revealed at GTC this spring. Since then, just about everyone from AMD to AWS and Cerebras has announced some kind of disaggregated or heterogeneous inference platform using one or more accelerators.

With SambaNova’s latest performance figures, the startup hopes to demonstrate how customers can breathe new life into their aging GPU fleets by using its systems as decode accelerators. And because its systems are air-cooled, they can be deployed in existing datacenters — something that can’t be said of Nvidia’s latest generation of Rubin GPUs, which absolutely need liquid cooling.

SambaNova plans to show off even more powerful inference configs, with 128 and eventually 256 accelerators to demonstrate its ability to maintain high token generation rates at high throughput. As we’ve previously explored, this is something that GPUs alone have historically struggled with and one of the key drivers behind Nvidia’s Groq acquihire late last year.

The results come just a month after SambaNova and Intel announced Vector Core Compute would be among the first to deploy the combined GPU + RDU offering with TogetherAI as their first large-scale customer.

Ramping production of any chip isn’t a cheap prospect, but for its fifth-gen part, capital shouldn’t be an issue. On Wednesday, SambaNova completed the first close of a $1 billion Series F funding round led by General Atlantic, giving the AI chip startup an $11 billion valuation. ®

Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications.

The threat actor published at least 17 malicious packages simultaneously, each tasked to exfiltrate credentials and access tokens to a command-and-control server hosted on Amazon Web Services (AWS).

All three payment platforms are popular, with Paysafe being mostly used by e-commerce sites and online marketplaces, gaming platforms, travel businesses, and financial services or software-as-a-service (SaaS) providers.

Skrill and Neteller are digital wallets and money transfer services used in online betting, cryptocurrency exchanges, and on Forex trading platforms.

Software developers working on such platforms integrate Paysafe’s SDKs into apps and websites to implement a secure payments and funds management system.

According to application security company Socket, these developers are the targets of the latest campaign via the following packages:

1. npm/paysafe-checkout
2. npm/paysafe-vault
3. npm/neteller
4. npm/skrill-payments
5. npm/paysafe-js
6. npm/paysafe-api
7. npm/paysafe-node
8. npm/paysafe-cards
9. npm/paysafe-fraud
10. npm/paysafe-kyc
11. npm/skrill
12. npm/skrill-sdk
13. npm/paysafe-payments
14. pypi/paysafe-kyc
15. pypi/paysafe-payments
16. pypi/paysafe-sdk
17. pypi/paysafe-api

The researchers say that the 13 npm packages published four malicious versions, from 1.0.0 to 1.0.3, whereas the PyPI packages published only one malicious version, 1.0.0.

All 17 packages pretend to be legitimate payment SDKs, even exposing the expected APIs, but instead return fake success responses rather than communicate with Paysafe’s backend services.

The real purpose is credential theft, as the embedded malicious code searches compromised environments for secrets such as tokens, passwords, and API keys.

According to Socket, the exfiltrated data includes Paysafe API keys, AWS keys, GitHub tokens, npm tokens, hostname, username, and metadata about API usage.

The data theft module in the npm packages attempts exfiltration only if a Paysafe API key is present and activates when the fake SDK is called.

The PyPI packages automatically activate the data theft routine upon initialization and do not require a Paysafe API key to be present at all.

Socket’s analysis of the malware reveals that it includes some rather basic anti-analysis features, stopping execution if it detects fewer than 2 CPU cores or if the hostname or username contains cues indicating a virtualized environment.

It is unclear who is behind this campaign, but Socket’s report highlights some attributes suggesting that the threat actor is sufficiently technical and may return in a more organized way.

The researchers warn that the attacker’s ability to pivot between ecosystems may make it more difficult to defend if there is only one ecosystem of visibility.

If any of the listed packages were installed, developers are recommended to immediately “rotate all secrets on any machine that imported or executed this package.”

 The researchers also advise searching dependency trees for the package names used in the campaign and deny any requests for them at the registry proxy level.

It is also recommended to look in the logs of Continuous Integration (CI) systems for PAYSAFE_API_KEY in combination with any of the listed package names.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper