Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Tech
NetNut proxy network disrupted, 2 million infected devices cut off
A joint operation involving Google has disrupted NetNut, a residential proxy network that gave access to millions of compromised Android devices, including smart TVs and streaming boxes.
Also known as Popa, the NetNut botnet allowed cybercriminals and espionage groups to hide behind legitimate home internet addresses when launching attacks.
According to the Google Threat Intelligence Group (GTIG), the residential proxy botnet is estimated to comprise at least two million compromised devices.
“GTIG estimates Netnut controls at least 2 million infected devices globally (including smart TVs and streaming boxes), powered by trojanized applications and botnets like Badbox 2.0 that package proxy plugins,” Google told BleepingComputer.
Residential proxy networks work by compromising home systems and selling access to them, allowing threat actors to conceal malicious traffic by routing it through the victims’ residential IP addresses.
Typically, home devices become part of the botnet after being infected with malware that is either pre-installed before purchase or added via malicious or trojanized applications downloaded by the user.
As a result, infected consumer devices serve as exit nodes in the botnet, routing unauthorized network traffic through their residential IP addresses, which can cause the devices to be flagged as suspicious or blocked by internet service providers or online services.
Dismantling the NetNut botnet involved a coordinated effort that included Google, the FBI, Lumen Technologies, The Shadowserver Foundation, and other industry partners.
source: BleepingComputer
The malicious proxy service is considered one of the largest networks in the world, being used by hundreds of threat actors.
It uses multiple domains, including netnut.com, which was taken down by the FBI.
“I checked with the disruption team and confirmed .com domain was also used by them along with other domains taken down,” Mark Karayan, Communications Manager at Mandiant, told BleepingComputer.
GTIG said that in one week last month it “observed 316 distinct threat clusters using suspected NetNut exit nodes, including cybercriminal and espionage groups.”
According to the researchers, threat actors used NetNut to access their own infrastructure, conduct password-spraying attacks, and to reach victim environments.
On its part, Google disabled the accounts and services on its infrastructure that NetNut operators used for malware command-and-control (C2), thus blocking access to “critical backend infrastructure.”
The company protected users by automatically warning them and disabling infected applications using Google Play Protect, the built-in security mechanism on Android.
Additionally, Google shared technical details on NetNut’s software development kits (SDKs) and backend command-and-control (C2) infrastructure with platform providers, law enforcement agencies, and cybersecurity researchers.
Google expects disrupting NetNut to have a broader impact in the proxy industry as the botnet “has a robust reseller program that allows whitelabeling of its network” and many of the popular residential proxy services are fueled by NetNut.
Karayan told BleepingComputer that disrupting one proxy service often prompts operators to purchase replacement capacity from competing providers, turning them into a reseller.
“The proxy industry is deeply interconnected where operators constantly buy and resell each other’s botnet capacity, and Netnut is among the largest and most popular residential proxy networks in the world.”
The action against NetNut is part of Google’s commitment to dismantle residential proxy botnets and follows the disruption of IPIDEA earlier this year.
Continue Reading
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned on Wednesday that attackers have begun exploiting a high-severity Microsoft SharePoint remote code execution vulnerability.
Tracked as CVE-2026-45659, this security flaw stems from a deserialization of untrusted data weakness, and it allows attackers with low privileges to execute arbitrary code on unpatched SharePoint servers in low-complexity attacks that don’t require user interaction.
“Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges. In a network-based attack, an authenticated attacker, who has a minimum of Site Member permissions (PR:L), could execute code remotely on the SharePoint Server,” Microsoft explains.
“The attack vector is Network (AV:N) because this vulnerability is remotely exploitable and can be exploited from the internet. The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the payload against the vulnerable component.”
Microsoft released security updates for SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition to address this vulnerability on May 21, saying that the CVE had been accidentally omitted from the May 2026 Security Updates.
Internet security watchdog group Shadowserver is currently tracking over 10,000 SharePoint servers exposed online. However, there is no information regarding how many of these devices have already been secured against ongoing CVE-2026-45659 attacks.
With the April 2026 Patch Tuesday, Microsoft addressed another SharePoint vulnerability that was exploited in zero-day attacks.
On Wednesday, CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog (KEV), ordering Federal Civilian Executive Branch (FCEB) agencies to secure their servers by Saturday, as required by Binding Operational Directive (BOD) 26-04.
BOD 26-04 was issued last month and requires U.S. federal agencies to prioritize patching based on whether the security flaw is included in CISA’s KEV catalog, whether exploitation can be automated for large-scale attacks, whether the asset is publicly exposed online, and whether successful exploitation grants attackers partial or total control of the targeted device.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” the cybersecurity agency warned yesterday. “Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.”
Since 2021, CISA has tagged 11 Microsoft SharePoint vulnerabilities that have been abused in the wild, with seven of them also exploited in ransomware attacks.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
PlayStation Underground captured the scene at Sony Disc Manufacturing in Springfield, Oregon, just after 7 a.m. The night shift had already run for hours, and stacks of fresh discs waited for the next steps. Everyone asked the same question back then. How did those distinctive black PlayStation CDs actually get made?
Security began at the mastering room door. To be safe, all workers donned safety gear, coveralls, and shower caps. Any of them leaving a stray hair or skin cell behind could be disastrous for the production line. However, that area had to remain sealed and locked down because the master discs within were gold, which was extremely precious.
PlayStation 5 Portal Remote Player – Midnight Black
- Play Your Game Collection with Remote Play – PlayStation Portal Remote Player can play compatible games you have installed on your PS5 console…
- Cloud Streaming from the Game Catalog and Classics Catalog – Discover an awesome library of PS5 games on the PlayStation Portal Remote Player with…
- Cloud Streaming for PS5 Games in Your Library – With PlayStation Plus Premium, stream select digital PS5 games in Your Library from PlayStation Store…
Previously, game makers would transmit their finished products on a special gold master CD. It was nothing more than a jumbled mess of zeroes and ones, yet a laser would cut through it all, flashing on and off as it imprinted the same sequence onto a glass master disk. The disc was coated with some ultra-sensitive film, and after being exposed to that laser, as it was washed down, all of the empty film was rinsed away, leaving a microscopic spiral of tiny pits and lands so precise that you could stack a strand of hair on top of 40 of the little guys.
That glass master held the game, but it would never withstand the high-volume pressing procedure that followed. So, initially, a technician would meticulously make a metal stamper out of it, and that stamper would be responsible for all of the hard work of pressing the game onto thousands of discs. Then followed a batch of plastic pellets, which were dumped in handfuls on the floor. Machines heated them until they were the viscosity of thick syrup, then pressed them into a mold with the stamper, resulting in a flawlessly shaped disc with the stamper’s design imprinted on its surface. This time, black colorant was also thrown in, and it was this colorant that gave every PlayStation disc its signature dark appearance while also adding a small extra barrier against duplicating.
The next task on the list was to apply a thin layer of metal. Without it, the laser inside the console would have nothing to bounce against. That was what transformed the very tiny pits and lands into usable data that the console could later use to generate pictures, sound, and gameplay, and before long, the all-important quality control test arrived. A series of automated equipment inspected each disk for flaws. Any CDs that did not pass the test were immediately recycled. And no disc left the line unless it satisfied the stringent specifications required for smooth play.
Up next was the all-important artwork, and this was where screens came into play, painting on one colour at a moment across the top surface. Then came the ultraviolet lamps to set the color in place. Then it was back to the painting station to repeat the same process. This was the component that gave each game its own cover image without smearing or fading. Special trucks were guided by a computer and just rolled along a predetermined path in the facility; no one had to push or pull a single disk. As a result, 375 people were able to move more than 6 million discs per month, primarily for games, music, and software items.
Robert Pollard and Guided By Voices (GBV) have again bestowed upon us another excellent new album: Crawlspace Of The Pantheon. A dandy rocker in grand GBV form, this is easily the band’s best since the last best one, which for me was 2025’s Thick Rich And Delicious. And I mean that with all the heart and soul of the deep fan that I am.
While no band likes to be pigeonholed, I sometimes think Guided By Voices deserves its own genre to describe what they do. Initially, I was thinking “Modern Classic Vintage British Rock,” but since GBV are from Dayton, Ohio, perhaps we should just call it “Modern Classic Vintage Rock.”
For me, GBV fills a musical void dating back to my childhood, when everyone anticipated a new Beatles album every six months or so. It was an event. In their own special way, a new GBV release is also an event, chock full of fresh earworms that feel familiar yet new.
Crawlspace Of The Pantheon is another solid sounding, well produced, full studio effort from the band, retaining just enough indie rock aesthetic to make clear that it is a GBV made, self-released, home brewed production. The current GBV is arguably the band’s most consistent lineup, achieving a super appealing balance between its glossier late 1990s and early 2000s first commercial peak, including Do The Collapse and Isolation Drills, and the early LoFi cassette multitrack basement wizardry that first put them on the map in the early 1990s, including Propeller and Bee Thousand.
“Lost In The Sun” kicks off Crawlspace Of The Pantheon echoing The Who and The Cars in the same breath, with Mellotron strings and tight harmonies. Saving its best hook for the very end, the song is one of those tunes I had to immediately play over and over.
“We Outlast Them All” could be a hit single for The Psychedelic Furs. Seriously, I cannot not hear Furs founder Richard Butler singing this song, even though it feels lyrically GBV autobiographical, a grand affirmation of the group’s staying power.
Another single candidate, “Advance Without Dropping,” packs a punch and is elevated by an incredible changeup in its ending bridge sequence: a mesmerizing, rising Doug Gillard guitar solo moment that sends quick chills down the spine.
If “Arthur Square” might be considered a lost cousin to 1969 pre Tommy Who, Mark Shue’s mad bass lines and Kevin March’s rolling drum fills appropriately channel the spirits of John Entwistle and Keith Moon, respectively. Gothic bells, more Mellotrons, and voiceover news reports turn this into a mad, brilliant psychedelic metal meltdown.
“(How Would You Like A) Chariot Ride” riffs on a chord sequence that cleverly echoes “The Punk And The Godfather” from The Who’s Quadrophenia. Try not humming Roger Daltrey’s stuttered “My Generation” melody over that moment.
“When You’re My Clown (Nothing Happens)” is an epic album closer, built around a tremendous chugging communal riff before launching into a beautiful acoustic driven coda. A classic GBV moment.
I think by now you get the idea Crawlspace Of The Pantheon is another shining crazy diamond in a long arc of winning musical gems from Guided By Voices. You can buy it at Amazon on vinyl for $26.39 or on CD for $17.98. Support independent music.
Our Ratings
★★★★★★★★★★ Album
★★★★★★★★★★ Sound Quality
★★★★★★★★★★ Pressing Quality
Where to buy
Mark Smotroff is a deep music enthusiast / collector who has also worked in entertainment oriented marketing communications for decades supporting the likes of DTS, Sega and many others. He reviews vinyl for Analog Planet and has written for Audiophile Review, Sound+Vision, Mix, EQ, etc. You can learn more about him at LinkedIn.
Related Reading:
Plus, we dive into Sony dumping PlayStation discs.
Valve’s Steam Machine is finally here! But while it lives up to much of the hype, its high price makes us wonder who it’s really for. In this episode, Senior Writer Jessica Conditt joins to talk about her experience with the Steam Machine and how it compares to consoles (which have also gotten very expensive). Also, we discuss Sony’s bombshell announcement about killing physical PlayStation discs in 2028 and Xbox’s confusing array of layoffs.
Credits
Hosts: Devindra Hardawar and Jessica Conditt
Producer: Ben Ellman
Music: Dale North and Terrence O’Brien
Looking for the most recent Connections answers? Click here for today’s Connections hints, as well as our daily answers and hints for The New York Times Mini Crossword, Wordle, Connections: Sports Edition and Strands puzzles.
Today’s NYT Connections puzzle has some fun words in the grid. You might recognize the blue category right away. Read on for clues and today’s Connections answers.
The Times has a Connections Bot, like the one for Wordle. Go there after you play to receive a numeric score and to have the program analyze your answers. Players who are registered with the Times Games section can now nerd out by following their progress, including the number of puzzles completed, win rate, number of times they nabbed a perfect score and their win streak.
Read more: Hints, Tips and Strategies to Help You Win at NYT Connections Every Time
Hints for today’s Connections groups
Here are four hints for the groupings in today’s Connections puzzle, ranked from the easiest yellow group to the tough (and sometimes bizarre) purple group.
Yellow group hint: Keep at it.
Green group hint: Limerick is another one.
Blue group hint: Cheers!
Purple group hint: Not sour.
Answers for today’s Connections groups
Yellow group: Persist.
Green group: Kinds of poems.
Blue group: Tropical drinks.
Purple group: Sweet ____.
Read more: Wordle Cheat Sheet: Here Are the Most Popular Letters Used in English Words
What are today’s Connections answers?
The completed NYT Connections puzzle for July 4, 2026.
The yellow words in today’s Connections
The theme is persist. The four answers are continue, last, linger and stay.
The green words in today’s Connections
The theme is kinds of poems. The four answers are ballad, epic, ode and villanelle.
The blue words in today’s Connections
The theme is tropical drinks. The four answers are hurricane, painkiller, scorpion and zombie.
The purple words in today’s Connections
The theme is sweet ____. The four answers are dreams, nothings, pea and spot.
The U.S. Interstate Highway System began taking shape in the 1920s. However, all those projects were put on hold in 1929 when the Great Depression hit, and remained so for decades. In 1956, President Dwight D. Eisenhower signed the National Interstate and Defense Highways Act in response to the explosion of automobiles taking to the roads during the post-war boom, with a plan to build 41,000 miles of highways that ran from sea to shining sea.
In 1954, 58 million registered motor vehicles were on the road in the U.S. Today, there are over 284 million, and it can sometimes feel like we’re all driving around on those same century-old roads. Enter the infamous work zone, where workers don’t necessarily need to be present for you to get a speeding ticket if you’re caught on camera by an Automated Speed Enforcement (ASE) system. As with standard work zones, state laws vary, so always check local regulations.
For instance, New York state statute 1180-E requires workers to be present, and clear signage leading up to the work zone warning that a photo-monitoring system is being used. Caution is advised in NY as State Police are known to wear hard hats and reflective vests to blend in with road construction crews. Much like New York, the state of Washington also requires signage, and enforcement only happens while workers are present in the zone. In Maryland, however, workers don’t need to be present for a traffic camera to issue a ticket. Florida has stringent work zone laws, but by and large doesn’t currently use ASEs in work zones. However, state law allows them to be at intersections and designated school zones (which are common).
Work zone speeding fines can add up
In California, Assembly Bill 289 went into effect in January of 2026. However, it only applies if the appropriate signage stating that it’s “photo enforced” is present and must be located no more than 500 feet ahead of where the system is placed. Furthermore, citations can only be issued when construction workers are present.
Fines associated with these relatively new ASE laws can vary widely depending on the scenario. Going 11 to 15 mph over the posted speed limit in California carries a $50 fine (like in New York) and can escalate to $500 for speeds of 100 mph or greater. In New York, though, a second violation is $75 (if it occurred within 18 months of the first), while subsequent violations are $100 (again, if within 18 months of the first). In Maryland, the current tiered schedule starts at $60 for going 12 to 15 mph over the posted limit and goes up to $500 for driving 40 mph or more over the posted limit; those fines double if workers are present. Beginning on July 1, 2026, Washington drivers can expect a first-time infraction to cost $125, with subsequent infractions increasing to $248. On May 1, the state began requiring initial driver’s license applicants under 25 to pass an online work zone and first responder safety course before receiving their license.
More and more, states are using ASE systems to keep everyone safe because work zones are inherently dangerous due to uneven pavement, narrower lanes, concrete barriers, and strange orange lines on the road. Ultimately, it’s better to be safe than sorry. Stick to the letter of the law when traveling through them because, in the grand scheme of things, it’s a momentary annoyance that’s not worth a lifetime of regret.
Alibaba banned Claude Code after security researchers found Anthropic had embedded steganographic tracking code to identify Chinese users. The ban follows Anthropic’s accusation that Alibaba ran the largest known distillation attack on its models.
TL;DR
Alibaba has banned its employees from using Claude Code, Anthropic’s AI-powered coding agent, after security researchers discovered that the tool contained hidden code designed to identify Chinese users. The ban, effective 10 July, follows weeks of escalating conflict between the two companies over allegations that Alibaba stole Anthropic’s AI capabilities through industrial-scale distillation.
“As Claude Code was recently discovered to carry back-door risks, after comprehensive evaluation, Claude Code has now been added to a list of high-risk software with security vulnerabilities,” Alibaba said in an internal notice reported by the South China Morning Post. The company recommended employees use Qoder, its own coding agent platform, as a substitute.
How the tracking worked
A Reddit user identified as LegitMichel777 reverse-engineered Claude Code on 30 June and found obfuscated code that had been silently present since version 2.1.91, released on 2 April, with no mention in the release notes. The code checked whether a user’s system timezone was set to Asia/Shanghai or Asia/Urumqi and scanned proxy URLs against a hardcoded list of Chinese domains and AI lab addresses.
Rather than logging the results conventionally, the system used steganography to hide its signals in the system prompt sent back to Anthropic’s servers. If the timezone was Chinese, the date format changed from dashes to slashes, and the apostrophe in “Today’s date is” was swapped with one of three visually identical but technically distinct Unicode characters depending on which flags were triggered.
The alterations are invisible to human users and potentially even to the AI model itself, but they are machine-parseable by Anthropic’s servers. Portions of the detection code were XOR-obfuscated with the key 91, a technique used to prevent plain-text extraction during code analysis.
Anthropic’s response
Thariq Shihipar, an Anthropic engineer on the Claude Code team, said on X that the tracking was “an experiment we launched in March that was meant to prevent account abuse from unauthorised resellers and protect against distillation.” He said the team had been “meaning to take this down for a while” and that the pull request to remove it was merged on 1 July.
The rollback coincided with the restoration of Anthropic’s Fable 5 and Mythos 5 models, which the US Commerce Department had ordered the company to disable for all foreign nationals in mid-June after Amazon researchers found a jailbreak vulnerability. The export controls were lifted on 30 June, and Anthropic restored access on 2 July, saying it would “scale up government collaboration” on frontier AI security.
The distillation backdrop
Anthropic’s justification for the tracking code sits within a broader campaign against what it calls systematic theft of its models’ capabilities. In a letter to the US Senate Banking Committee on 10 June, the company accused operators affiliated with Alibaba’s Qwen AI lab of running the largest known distillation attack on Claude, using roughly 25,000 fraudulent accounts to generate 28.8 million exchanges between April and June.
Alibaba has denied the accusation. Anthropic had previously named DeepSeek, Moonshot AI, and MiniMax in February as perpetrators of similar campaigns, framing distillation as an existential threat to the business models of frontier AI companies.
Distillation, the practice of using a powerful model’s outputs to train a smaller one, occupies a grey area in AI development. Asian AI startups have launched alternatives to Anthropic’s models partly because the export ban on Fable 5 and Mythos 5 left a gap in the market, making the line between legitimate competition and illicit extraction increasingly difficult to draw.
The developer trust problem
Claude Code requires deep access to a developer’s local file system to read, modify, and execute code, meaning any hidden functionality in the tool effectively has access to everything on the machine. Huorong Security, a Chinese cybersecurity firm, said Anthropic’s tracking was not only a transparency issue but also raised cross-border data compliance concerns.
“Today it’s a timezone check, tomorrow it could be system sabotage or data exfiltration,” one Reddit user wrote. Anthropic’s privacy policy states that it collects the kind of data in question, but critics argue the steganographic method, designed to be invisible to users, crosses a line that a standard privacy disclosure does not.
The bigger picture
The episode accelerates China’s push to reduce reliance on American AI tools, which Chinese firms increasingly view as carrying legal, security, and operational risks. Alibaba has been building out its own AI stack aggressively, integrating its Qwen models across products from e-commerce to robotics, and the Claude Code ban gives it further justification to push employees toward domestic alternatives.
Lizzi Lee, a fellow at the Asia Society Policy Institute’s Centre for China Analysis, said the conflict showed how the US-China AI competition has moved beyond technology into access control and sovereignty. “If a US AI coding tool can detect Chinese usage or proxy access, then it’s not surprising for major Chinese tech companies to not want employees using it internally,” she said.
Anthropic’s models have long been officially inaccessible in China, but they remain popular among domestic developers who use workarounds to maintain access. Whether the tracking controversy pushes more of them toward Chinese alternatives or simply confirms what many already suspected about the risks of depending on American AI tools is a question that extends well beyond Alibaba.
The eufy Omni C20 is built for households that don’t want to bother with constant cleaning.
This vobo vac has dropped to £308.99 from its original price of £599, a saving of 48% that brings a fully automated cleaning station within much easier reach.
Save nearly 50% on this Eufy robo vac
A saving of 48% brings Eufy’s fantastic fully automated cleaning station within much easier reach of most budgets.
The station itself does the unglamorous work most robot vacuums leave to their owner, since it empties dust into a 3.1 litre bag, washes the mop pads, and dries them with room temperature air once the C20 docks.
That drying step alone cuts energy use by 57 times compared with heated methods, which matters if you would rather this thing run quietly in the background than announce itself every time it recharges.
None of that automation counts for much if the vacuum itself struggles to get under furniture, and this is where the eufy Omni C20’s 3.35 inch body earns its keep, sliding beneath sofas, beds, and low cabinets at just 90mm tall with room to spare, reaching the strips of floor that upright vacuums and clumsier robots consistently miss.
Suction sits at 7,000 Pa in its strongest mode, enough to lift pet hair, crumbs, and general debris across hard floors and carpet alike without needing a second pass over the same stubborn patch of mess.
Hair wrapping around the brush is one of the more tedious habits of any robot vacuum, so the Pro-Detangle Comb built into the roller exists specifically to stop that problem before it starts.
Mopping gets the same attention to detail, since the dual pads spin at 180 rotations per minute with 6N of downward pressure to lift dried stains rather than just smear them across the floor.
Carpets are handled with equal care, as the C20 detects the change underfoot and lifts its mop by 0.41 inches so rugs and carpeted rooms are vacuumed without getting soaked in the process.
For a broader sense of how the Omni C20 stacks up against everything else worth considering this year, our Best Vacuum Cleaner 2026 guide rounds up the models actually earning their place in a UK home right now.
SQUIRREL_PLAYLIST_10148964
Looking for a different day?
A new NYT Strands puzzle appears at midnight each day for your time zone – which means that some people are always playing ‘today’s game’ while others are playing ‘yesterday’s’. If you’re looking for Friday’s puzzle instead then click here: NYT Strands hints and answers for Friday, July 3 (game #852).
Strands is the NYT’s latest word game after the likes of Wordle, Spelling Bee and Connections – and it’s great fun. It can be difficult, though, so read on for my Strands hints.
Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc’s Wordle today page for the original viral word game.
SPOILER WARNING: Information about NYT Strands today is below, so don’t read on if you don’t want to know the answers.
Latest Videos From
NYT Strands today (game #853) – hint #1 – today’s theme
What is the theme of today’s NYT Strands?
• Today’s NYT Strands theme is… Ooh!
NYT Strands today (game #853) – hint #2 – clue words
Play any of these words to unlock the in-game hints system.
NYT Strands today (game #853) – hint #3 – spangram letters
How many letters are in today’s spangram?
• Spangram has 9 letters
NYT Strands today (game #853) – hint #4 – spangram position
What are two sides of the board that today’s spangram touches?
First side: bottom, 4th column
Last side: top, 6th column
Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON’T WANT TO SEE THEM.
NYT Strands today (game #853) – the answers
The answers to today’s Strands, game #853, are…
- BRIGHT
- COLORFUL
- DAZZLING
- EXCITING
- SPARKLING
- SPANGRAM: FIREWORKS
- My rating: Hard
- My score: 1 hint
Talk about a theme that could mean absolutely anything at all.
Totally in the dark, not an entirely unusual feeling to be truthful, I worked my way around the board in search of non-game words to earn a hint. Instead, I saw the spangram FIREWORKS and remembered today’s date.
I went to a fireworks display recently that was underwhelming, in part due to the murky conditions but also because the drones that made up a large part of the display had to be viewed from a particular angle in order to impress; a case of “uh?” rather than “ooh!”.
Meanwhile, it was nice to see a bit of color in Strands for a change. A rare treat.
Yesterday’s NYT Strands answers (Friday, July 3, game #852)
- OBSTINATE
- STUBBORN
- WILLFUL
- FIRM
- HEADSTRONG
- SPANGRAM: NOTBUDGING
What is NYT Strands?
Strands is the NYT’s not-so-new-any-more word game, following Wordle and Connections. It’s now a fully fledged member of the NYT’s games stable that has been running for a year and which can be played on the NYT Games site on desktop or mobile.
I’ve got a full guide to how to play NYT Strands, complete with tips for solving it, so check that out if you’re struggling to beat it each day.
Palantir CEO Alex Karp has assembled a $200M+ real estate portfolio centred on seclusion, from a 3,700-acre Colorado monastery to a Miami compound. The privacy-obsessed lifestyle contrasts sharply with the surveillance software his company sells to governments.
TL;DR
Alex Karp, the co-founder and chief executive of Palantir Technologies, has quietly assembled a real estate portfolio worth more than $200 million across a reported 20 properties worldwide. The common thread is seclusion: a former monastery in the Colorado mountains, a rural compound in New Hampshire, and a pair of mansions on a gated Miami island.
Karp, whose net worth stood at $14.4 billion as of early July according to the Bloomberg Billionaires Index, has said he never learned to drive because he was once “too poor” and is now “too rich.” The fortune that funds his acquisitions comes from Palantir, whose revenue hit $1.63 billion in Q1 2026, up 85% year over year, driven by surging demand for its AI and data analytics platforms from governments and defence agencies.
The monastery
In December 2025, Karp paid $120 million for the Saint Benedict’s Monastery ranch, a 3,700-acre property in the Capitol Creek Valley near Snowmass, Colorado, about 15 miles north of Aspen. The deal, transacted through an entity called Espen LLC, set a record for Pitkin County and was one of the largest residential sales in Colorado history.
Trappist monks of the Cistercian Order of the Strict Observance had stewarded the land since 1956, supporting themselves through farming and candy sales. Their numbers dwindled over the decades until only five remained, and the order’s General Chapter voted to close the monastery in the autumn of 2022.
The property was listed for $150 million in April 2024 before selling for $30 million below asking. The compound includes a chapel, monks’ living quarters, a retreat centre, 1,200 acres of irrigated meadows with senior water rights, and three creek systems stretching more than five miles.
Karp is an avid cross-country skier who reportedly trains 12 to 15 miles daily. A 3,700-acre property in the Elk Mountains is a fitting base for someone whose fitness regime is better described as vocational.
The Miami compound
In June 2025, a Delaware entity called Hibiscus East LLC purchased a nearly 10,000-square-foot waterfront mansion at 55 East San Marino Drive for $46 million. Business Insider reported that the LLC is linked to a New Hampshire attorney and accounting firm that have appeared on documents tied to Karp’s previous transactions.
Karp then bought the house next door at 29 East San Marino Drive for $28.5 million, bringing his total investment on the island to nearly $75 million. The second property was listed at $30 million and went under contract in eight days.
Together, the two lots total more than 0.8 acres with 265 feet of waterfront, and The Real Deal reported that the acquisitions appear to be the start of a compound. San Marino is one of six man-made Venetian Islands in Biscayne Bay, an exclusive enclave whose past and present residents include basketball player Dwyane Wade and singer Gloria Estefan.
The Miami purchases predated Palantir’s decision to relocate its headquarters from Denver to Aventura, a Miami-area suburb, in February 2026. The company is currently operating from a co-working space while searching for permanent offices in areas including Wynwood, Brickell, and Coral Gables.
The New Hampshire compound
Karp’s reported primary residence is a 500-acre estate in Lyman, New Hampshire, part of which he purchased for $825,000 in 2019. He has been known to work from the property’s barn.
Lyman is a rural town in Grafton County with fewer than 600 residents, nearly two hours south of Manchester. Despite running one of the most closely watched companies in the defence technology sector, Karp chose a near-invisible town as home base, a pattern that extends across every significant property in his portfolio.
What Palantir builds
The seclusion of Karp’s lifestyle is striking because of what Palantir does. The company took over Project Maven, the Pentagon’s AI drone analysis programme that Google abandoned after employee protests, and its platforms power surveillance systems used by ICE, the military, and hundreds of local law enforcement agencies across the United States.
Karp has defended this work as essential to national security, arguing that democracies need tools powerful enough to compete with authoritarian adversaries. The company continues to expand its government footprint, competing for contracts including the FAA’s predictive air traffic AI system, and its stock has risen more than 600% since the start of 2024.
The pattern
Karp’s net worth fluctuates with Palantir’s share price, which has traded between $106 and $208 over the past year, meaning the Bloomberg figure is a snapshot rather than a fixed number. The reported 20-property portfolio has not been independently confirmed in its entirety.
What is confirmed is the scale of his recent purchases: $120 million in Colorado, $75 million in Miami, and a 500-acre estate in one of the least populated towns in New Hampshire. Together, they form a portfolio designed around a single principle that Karp’s own company has made a $75 billion business out of undermining: the right to be left alone.
Business1 second ago
8-year-old boy becomes Disneyland’s 1 billionth guest
Entertainment2 minutes ago
Warner Bros. Secretly Knew Supergirl Would Bomb
NewsBeat5 minutes ago
Update on England vs Mexico kick off time after speculation it could be moved
Business3 weeks ago
No Jackpot Winner as $257 Million Prize Rolls Over to $269 Million Monday Draw
Entertainment2 weeks ago
Renter of Home in Anne Heche Crash Denies Settlement With Son
Fashion1 week ago
Weekend Open Thread: Staud – Corporette.com
News Videos24 minutes ago
BITCOIN SHORT SQUEEZE OVER (This is Next)!!! – Bitcoin News Today, Ethereum & Altcoins
News Videos51 minutes ago
Caleb Hammer Turned Financial Help Into Public Embarrassment…
News Videos1 hour ago
Bitcoin & XRP Bottom for 2026? #xrp #bitcoin #btc #cryptocurrency #crypto #trading #ripple #xlm
-
Tech6 days agoClaude Code turned every engineer into three. Now companies need more product thinkers
-
Tech6 days agoBluekit phishing kit adopts browser-in-the-middle for login theft
-
Crypto World4 days agoStrategy authorizes up to $1.25B in Bitcoin sales under new capital plan
-
Fashion7 hours agoWeekend Open Thread: High Hopes
-
Politics14 hours agoThe House | “Reframing the debate from a binary discussion of winners and losers”: Yuan Yang reviews ‘We Are Not Machines’
-
News Videos5 days agoMAJOR BITCOIN & MARKET UPDATE!!!! (MUST WATCH ASAP!!!)
-
Tech4 days agoAnonymous researcher drops 0-day ‘exploitarium’ repo
-
Crypto World6 days agoCoinbase, Circle Deepen Crypto Stock Losses Despite Resilient S&P 500
-
Business4 days agoAustralia treasurer says alleged access of prime minister’s bank data ’incredibly concerning’
-
Crypto World7 days agoKraken's xStocks Opens Bending Spoons IPO Registration to EEA Retail
-
Tech7 days agoRussian hackers now target Signal backup recovery keys
-
Business4 days agoThe AI boom won’t burst all at once. It will pop in ‘rolling bubbles’: Macquarie
-
Sports3 days agoBroncos roster: OL Ben Powers (No. 74) entering final year of contract
-
Tech6 days agoSilicon Valley paid to kill AI regulation, now it wants the rules back
-
NewsBeat3 days agoPresenter Caroline Flack’s brother Paul Flack dies aged 55
-
Crypto World2 days agoBinance stock trading tops $1B in first month after launch
-
Tech7 days agoOpenAI mulls delaying IPO over valuation concerns
-
NewsBeat2 days agoNew exhibition reflects five decades of movement between island of Ireland and GB
-
Crypto World2 days agoAlibaba-affiliate Ant Group enters the humanoid robot market with 12 deals
-
News Videos4 days agoHow to Build INSANE Live Financial Dashboards With Claude
You must be logged in to post a comment Login