Routers made by the Chinese company Zbtlink are shipped with a built-in backdoor, according to a new report from cybersecurity firm VulnCheck.

VulnCheck examined 20 models made by Zbtlink and found an implant on each one’s firmware that automatically communicates with cloud servers in China. The backdoor could give the company access to other devices connected to the router’s network, says Jacob Baines, the chief technology officer at VulnCheck. 

“When you take your router and you plug it into your network, it tries to reach out to a server in China that can then fully control that router,” Baines said. 

The discovery is as close to a smoking gun as we’ve seen for an argument that many cybersecurity experts and lawmakers have been making for years: Routers from China can’t be trusted.

It’s a fear of implants like this that led the state of Texas to sue TP-Link, a router manufacturer founded in China but now headquartered in California, alleging in a February lawsuit that its routers are used by the Chinese government to launch cyberattacks in the US. 

It’s also why the Federal Communications Commission instituted a blanket ban on the sale of new foreign-made routers in March, although it’s since granted exemptions to several non-Chinese manufacturers. But nothing like Zbtlink’s backdoor has ever been found in TP-Link’s routers. 

“What makes this different – and I’ve never really seen it – is that this is just an implant. It just connects out. You don’t have to make the mistake of exposing it to the internet,” Baines said. 

Zbtlink routers are sold around the world ​under both the Zbtlink and Wiflyer brand names, including on platforms like Amazon. They’re primarily used in businesses rather than home networks, Baines said. He estimates that 100,000 are currently deployed around the world, but he wrote in his report that “the true affected population might be larger than the twenty models we examined.”

Baines tells me that it’s common for Chinese routers to be white-labeled, or rebranded to look like they’re from somewhere else.

“They look like they’re from South Korea or Germany, but really they were made in China by this one company,” he said. “And they could be using that firmware. We just don’t know.”

Zbtlink didn’t immediately respond to CNET’s request for comment.

Joe Supan is a senior writer for CNET covering home technology, broadband, and moving. Prior to joining CNET, Joe led MyMove’s moving coverage and reported on broadband policy, the digital divide, and privacy issues for the broadband marketplace Allconnect. He has been featured as a guest columnist on Broadband Breakfast, and his work has been referenced by the Los Angeles Times, Forbes, National Geographic, Yahoo! Finance and more.

See full bio

Advertisement

Nikita Bier was the face of some of the platform’s biggest changes.

After the release of Google’s Chromecast so-called ‘streaming sticks’ have remained a popular form factor, even though such technology is these days part of ‘smart’ TVs. Being curious as to what kind of hardware they put into these sticks or dongles these days, [electronupdate] decided to do his typical full teardown of a 2026 model Fire Stick HD from Amazon, including the typical nekkid die shots.

Although most of the bits inside are fairly typical, being just your typical Mediatek-sourced solution, the ceramic patch antennas for Bluetooth and Wi-Fi are a rather interesting detail, as are the purported limitations that make this the ‘HD’ version of the Fire Stick, unlike its 4K brethren.

The used Mediatek MT8698D SoC isn’t so different from the SoC in those 4K versions, with the 2025-era 4K Plus using the MT8696D, but the 4K Select using basically the same SoC as the HD version, featuring the same G310V2 GPU at 500 MHz per the Amazon Developer documentation and the same decoder block (VPU), both of which are capable of 4K video decoding. This implies that the HD vs 4K distinction is purely software-based.

After popping open the device and noting the various ICs, the NAND Flash, the Mediatek MT7902 wireless IC, the PMIC and the aforementioned SoC all have their caps popped in order to take a closer look at their dies. For reference, as one of the largest ICs, the SoC die is a mere 5.2 x 6.45 mm. The PMIC die is more interesting as usual, as this one integrates USB-PD functionality, adding quite a bit of logic to what is otherwise a fairly mundane bit of power management features.

Overall not a very surprising design, though it does tickle that thought in the back of one’s mind whether it could be turned into a ‘4K stick’ with a few software tweaks, or perhaps more simply by installing plain Android onto its 8 GB of eMMC.

Another former Uber executive is joining Travis Kalanick’s robotics and industrial AI startup Atoms, just a few weeks after it raised $1.7 billion.

Gautam Gupta, the former finance chief under Kalanick, said in social media posts on Wednesday that he has has joined Atoms as chief financial officer. Gupta spent more than four years at Uber until he left in July 2017, just a few weeks after Kalanick resigned as CEO. (Gupta had announced his intention to leave that May.)

Hiring Gupta continues a trend of Kalanick getting the Uber band back together at Atoms. Earlier this year, Atoms acquired mining autonomy startup Pronto, which is run by former Uber (and former Google) self-driving engineer Anthony Levandowski. According to LinkedIn, a number of former top Uber employees who worked with Kalanick also work at Atoms, which was previously called CloudKitchens.

“On many levels, this round is a bit of unfinished business. Fuel to complete the bits-to-atoms story arc we started at Uber, continued at CloudKitchens, and will now finish at Atoms,” Kalanick wrote when he announced the $1.7 billion funding round last month.

Uber even joined the round as an investor, reuniting the company with the founder it pushed out in 2017 after a series of scandals and complaints of widespread sexual harassment and discrimination. Uber hasn’t disclosed how much it contributed. The Information reported $100 million, a figure that TechCrunch has also been able to confirm.

Kalanick has said he wants Atoms to work on mining, food, and transportation, though his posts to date about the startup have been less about specifics and more about wanting to “go up against the final boss, Nature and its fierce resistance to change.”

Gupta invested in Uber in 2012 when he was a vice president at Goldman Sachs, and then joined the company in 2013.

“[T]he single biggest reason I joined was – Travis. I believed he possessed a magical mix of genius and intensity that made me want to bet on the person, not the market,” Gupta wrote Wednesday. “First one in, last one out, every day. Breaking down walls of regulations, unions, city bureaucracies, etc. Had he not pioneered ridesharing, I don’t think anyone else had the fortitude to fight through one adversity after another to create a whole new market worth hundreds of billions out of nothing.”

Gupta wrote Wednesday that A*, the VC firm he co-founded in 2020 after three years at Opendoor, invested in Atoms in what was the “largest investment in the history of our fund.” Gupta is stepping down from A* to take on the CFO role at Atoms, according to his LinkedIn profile.

“I have no idea how they got my contact information,” says the engineer. Unlike other interviews for government jobs, the engineer says, there was no recruiter present—only Coristine was on the interview call. “Normally initial screenings are done over the phone, rather than video, to reduce bias in the process,” they say.

During the engineer’s NDS interview, they say, Coristine didn’t seem to know the skill set he was looking for. “I generally don’t know if this person is capable of evaluating a full-stack engineer,” they say, “because they themselves aren’t aware of the skill sets, tools, and things needed in this profession.” Coristine did not reply to a request for comment. (In January 2025, Coristine was one of several DOGE members who interviewed workers at the General Services Administration’s Technology Transformation Services, who were required to defend their jobs and justify their projects. At the time, employees who spoke to WIRED described meetings in which the DOGE members were not familiar with their work.)

Coristine told the engineer that the role was geared toward supporting what would become Rampart, a tool released in late June to prevent personally identifiable information (PII) from leaving a user’s browser, particularly if they’re using something like a chatbot. In an interview with the Technology Business Programming Network (TBPN) podcast, Coristine described the project as a “side quest ” and told the engineer that the NDS team of about 30 people did not include a machine-learning engineer.

The tool is similar to OpenAI’s browser-based “privacy filter,” which can detect things like a personal email, address, or account number, and mask them automatically. But exactly how this tool is meant to be used in the context of government services is unclear. In the interview with TBPN, Coristine did not offer any particular examples, though he noted the tool is significantly smaller than OpenAI’s, making it potentially more accessible in lower-bandwidth environments.

“It feels very counterintuitive because in most instances, when you are asking for PII, you want PII,” says the engineer, noting that in government work, a user might need to provide PII like their social security number or address in order to access government benefits. “You don’t want that information redacted.”

In many cases, developers can choose to encrypt certain fields that an API sends to the backend of a website, and websites that use HTTPS connections to communicate with their backends also encrypt their requests.

This is not the first time the Trump administration has tried to reinvent the wheel of government technology. Last year, as DOGE promised government efficiency through technology, its members fired technologists who were already working on exactly the kinds of projects it purported to want, even killing a flagship product in the Internal Revenue Service’s free tax filing tool. An OPM memo published last week instructed agencies to prioritize hiring technical talent.

“This does feel superfluous. My most optimistic speculation is that this is indicative of an organization that has no goals,” the engineer says, noting that the National Institute of Standards and Technology (NIST) regularly supports the creation of tools to solve complex technical problems around issues like privacy. “Why are these guys who are so closely associated with the White House wasting tax money on this little hacker project?”

Nikita Bier has stepped down as head of product at X, Elon Musk’s social media platform, after a little more than a year in the role.

Bier wrote Wednesday that he thinks it’s “time to pass the torch and demote myself to my natural state: a poster,” adding that he’ll continue to advise the company.

The serial entrepreneur and Lightspeed venture partner took over the product lead role in July 2025. He wrote Wednesday that, while in the role, he oversaw the launch of 30 new products while “protecting the integrity of the town square.”

Of course, Bier was also head of product during a number of scandals at X. Just a few days after he took the product lead role, the chatbot Grok — made by xAI, which was then a separate company owned by Musk — started calling itself “MechaHitler.” Grok has also been used by X users to generate nonconsensual nude imagery, including child sexual abuse material, which has gotten the platform in legal trouble.

“X is, and will remain, the most important communication technology in history. But running this app is a 24/7 job and it’s now time for me to take a breather,” Bier wrote Wednesday.

The terminal-based coding tool is powered by a new AI model, Muse Spark 1.2.

• Ukraine develops ground robot firing nets against incoming FPV drone attacks
• VORON combines drone interception with logistics and battlefield evacuation capabilities effectively
• Net launchers attempt physical drone captures instead of explosive aerial interceptions

Ukrainian firm SMART BIRDS has introduced an Unmanned Ground Vehicle (UGV) called VORON, built specifically to intercept first-person view drones from multiple directions simultaneously.

The system relies on Pavuk net launchers, a defensive mechanism designed to trap incoming drones before they reach their intended target.

A one-line command in your macOS terminal can get you access to Meta’s Muse Code, which aims to be a transparent AI coding tool that can work across large repositories.

There are already coding agents like Claude Code and ChatGPT Codex available for macOS, but Meta wants to enter the ring with its latest AI toolset. Unlike the others, it doesn’t have an app interface and runs through the Terminal.

According to an announcement post from Meta, Muse Code can take on complex software engineering tasks across large repositories. It is capable of planning changes, writing code, and validating the results while coordinating multiple persistent subagents.

As always with these AI announcements, remember that the language being used attempts to anthropomorphize the tools to be more human-like. Nothing about an AI behaves like a human — they don’t think, reason, organize, sympathize, or understand.

AI is a tool, and if Muse Code sounds like it could help you develop software, it might be a particularly useful tool. Developers have shared just how useful having a coding agent available can be, especially for troubleshooting bugs.

To install Muse Code, you’ll just need to paste in a single command into Terminal:

curl -fsSL https://dev.meta.ai/install.sh | bash

Of course, this isn’t free. Those that install Muse Code will start on Meta’s contributor tier. Developers join with a pay-as-you-go option which charges $1.25 per million tokens in input and $4.25 per million tokens of output.

The Muse Code announcement was paired with the release of Muse Spark 1.2, which was trained with coding assistance in mind. Meta says the training included rejection-sampled harness trajectories and recipe optimizations for goals, compaction, and subagents.

Choose your AI partner

Meta’s inevitable introduction of a coding agent was a long time coming. The company has been poaching Apple employees in its expensive chase for so-called superintelligence.

Muse Code is also another revenue stream to cover the incredible costs of AI and research around it. Meta previously tied some of its premium subscriptions to AI tool use as well.

There are several AI coding tools to choose from, so it will be interesting to observe if Meta can make a dent in the market. Not having a direct UI and interfacing via Terminal could be a problem for some.

Then there’s the privacy aspect. Meta is known for its horrific history of scraping every piece of data it can from users, and while it might have safeguards in place for its AI tools, it seems unwise to trust Meta software installed with access to so much information.