Peacock is raising prices across all three of its subscription plans.

New customers will pay more immediately, while existing subscribers will see the higher rates on bills from September 17.

The ad-supported Peacock Premium plan is increasing from $11 to $13 per month. Premium Plus is going from $17 to $20. The Select plan, which offers a more limited selection of programming, is also going up from $8 to $9 per month.

Annual subscriptions are getting more expensive too. Peacock Premium will now cost $130 a year, up from $110, while Premium Plus rises from $170 to $200. Select is increasing from $80 to $90 annually.

Sonos has finally added Live Activities support to its iPhone app.

The new feature, rolling out to iPhone users now, gives users quicker access to playback controls without having to reopen the app. The feature appears on the Lock Screen after you start playing audio on a Sonos device and leave the app.

Once active, the Live Activity shows the room or group that was last playing audio, along with controls for playing, pausing and skipping tracks. This means you can make basic playback changes directly from the Lock Screen.

The feature also works when playback is started outside the Sonos app. Sonos says the controls will still appear when audio is initiated through Direct Control from supported services. They also work with Bluetooth or AirPlay. This gives the Live Activity a little more flexibility than simply acting as an extension of the app.

Your desk or bench is a work area, so why not make it look the part? That’s the idea behind the miniature blinking traffic barrels that [Glen Akins] recently put together. Of course, just a single blinking light doesn’t really sell the idea of a busy construction zone, so he spent a somewhat surprising amount of time and effort optimizing the design for small-scale production.

The end result is a fascinating write-up that dives into the design decisions [Glen] made. Every aspect of this project, from the overhang of the “handle” on the 3D printed barrel to the number of passive components on the PCB was carefully considered. Critics may say [Glen] put too much thought into something that didn’t need to be so complex, but projects like these are an excellent way to keep your skills sharp — there’s no such thing as practicing too much.

Starting with the design of the barrel itself, we appreciate that [Glen] kept the capabilities of his desktop 3D printer in mind. By breaking the design up into multiple pieces and avoiding overly steep angles, he produced a design that prints cleanly without the need for support material. His step-by-step documentation and screenshots also serve as a great introduction to designing parts in Fusion if that’s something you’re interested in.

From there, things switch over to the electronics. Some in the audience will bemoan that he’s using a PIC12F1612 microcontroller to blink a single LED instead of a 555, but [Glen] brought the receipts on this one. Not only does the PIC offer more flexibility in terms of getting the blinking to look the way he wants, but it requires fewer passive components on the board and is considerably more energy efficient than the iconic timer IC. Even if you ignore all the other advantages, he calculates that going with a 555 would have cut the battery life of the finished product by approximately 15%.

This is one of those projects that’s difficult to summarize in such a terse format, as every time you think the write-up must be about over it takes a new turn on you. We were mildly bemused when the second iteration of the PCB popped up, but by the time he introduced the custom programming adapter board, we knew [Glen] wasn’t messing around.

Unsurprisingly, this isn’t the first time we’ve seen [Glen]’s handiwork. You may recall seeing his RP2040-powered sound board earlier this year, but his name has been popping up on these pages for more than a decade now.

• Nine PBS in St. Louis sues to recover roughly 50 terabytes of archive spanning seven decades after cloud vendor Open Source Storage went defunct and cut off access on the day its contract expired
• Iron Mountain says it never had access to the data, arguing it rents physical space to OSS and that handing over a third party’s hardware would have breached its contracts and exposed other clients’ data
• A Denver judge has since ruled that Nine PBS owns the material and ordered cooperation on retrieval within 30 days

Nine PBS, the public television station in St. Louis, has sued Iron Mountain Data Centers in Denver District Court, seeking the return of roughly 50 terabytes of archival material sitting in a Denver facility.

This move was necessitated by its contracted cloud storage provider, Open Source Storage (OSS), which quietly went defunct earlier in 2026.

Security

CEO apologizes for police misuse as activists call for vandal action against license plate cameras

Surveillance tech company Flock has struggled with its public image for years, but the problem has become particularly acute in recent weeks.

Its network of ALPRs has long attracted criticism over mass surveillance and the retention of location data belonging to motorists who are not suspected of any offense.

Days after its CEO apologized for documented abuses of the company’s system, The Register contacted the company’s usually responsive media team about an online campaign calling for its automated license plate readers (ALPRs) to be vandalized on Halloween, and received an automated response.

“Thanks for reaching out to Flock. Our media team is currently touching grass and taking a break,” the email said.

“Unlike our cameras, we can’t work 24/7, so we’ll get back to you when we’ve had a snack and regained the ability to form coherent sentences.”

The media handlers have a lot on their plate. More recently, reports of ICE agents accessing local police forces’ Flock systems, and police officers using the technology to stalk former partners, have coincided with an increase in vandalism targeting the cameras.

This week, US social media users began promoting Halloween 2026 as a night of action against Flock’s ALPRs, which continue to attract negative coverage.

X grouped posts about the so-called “De-Flock America” campaign into a dedicated trending story, which recorded more than 36,500 posts over two days. Similar calls have appeared on other major social platforms.

Posts encourage participants to wear costumes, leave their smartphones at home, and disable nearby ALPRs while concealing their identities.

The Reg asked Flock whether it was aware of the campaign and planned any countermeasures, but received only the automated response.

Apologies and changes

Last week, Flock CEO Garrett Langley apologized after a woman was stalked using his company’s ALPR system.

“It kills me that she went through that,” he told CBS News in an interview, less than two weeks after The Washington Post published a story highlighting 46 cases involving US police officers abusing their access to Flock’s system. Some allegedly involved officers abusing that power to stalk women.

Langley gave the interview after Flock announced an array of changes, including reducing its standard data retention period from 30 days to seven.

Customers may retain information for longer, however. A new “Evidence Mode” allows law enforcement to retain data beyond that seven-day period if it’s required for ongoing casework.

Flock also introduced controls allowing police agencies to restrict the types of searches that outside forces can run against their data.

For example, City A might request permission to search data belonging to City B as part of an investigation. With the new feature, City B can restrict City A from making searches related to “immigration enforcement,” a nod to ICE agents accessing police Flock systems without a dedicated contract.

Flock will also require customers to enable its existing Audit Assistance feature by year-end. The tool detects unusual search activity and flags it for review. It is currently optional but will become mandatory by year-end, having been “associated with arrests of several law enforcement officers who allegedly abused the system.”

Flock said more than a third of customers have voluntarily opted in to Audit Assistance so far.

Langley’s interview appeared one day after People reported that Haines City police officer Christopher Goodson, 31, allegedly used Flock to search for his estranged wife’s license plate 717 times. The searches took place between September 1, 2024, and June 30, 2026, according to a probable cause affidavit.

Goodson was suspended with pay pending further investigation. ®

PERSONAL TECH

Consumer group sees improvements on paper but warns the devil remains in the detail

Apple’s latest attempt to settle its App Store dispute with the European Commission has drawn criticism from Epic Games and a cautious response from a consumer group, which warned that “the devil is in the detail.”

Announced on August 18, the changes introduce new business terms for applications distributed in the European Union. Apple says the changes “reduce complexity by moving every developer that distributes apps in the EU to a single set of business terms” and resolve its long-running spat with the Commission over fees and alternative distribution.

An App Store app using Apple In-App Purchase will attract a 26 percent commission, reduced to 15 percent for developers in qualifying programs and auto-renewing subscriptions after their first year. The rate for apps using alternative payment processing will be 20 percent, or 10 percent for qualifying developers. Apps linking to the web to complete purchases will incur a 15 percent commission, again reduced to 10 percent for qualifying developers. Apps distributed through an alternative marketplace or the web will pay Apple a 5 percent “Core Technology Commission” on digital transactions.

The structure is simpler than Apple’s previous terms, which were revised after the company was slapped with a €500 million fine. Complaints about Apple’s antics continued through the end of 2025 amid accusations that the company was persisting in non-compliance with the Digital Markets Act (DMA).

Apple claims the changes follow “close collaboration with the European Commission” and “resolve Apple’s disagreements with the Commission over business terms and alternative distribution.”

Naturally, there was plenty of hand-wringing and “think of the children” rhetoric from the iPhone slinger. The company would obviously prefer users to stick with Apple In-App Purchase, calling it “the safest, most trusted way for users to purchase and download apps and make seamless and secure payments in those apps.” It also noted that it had worked with the Commission on child safety measures for alternative payments, including parental gates and restrictions on links from apps aimed at children.

Epic Games, a longstanding critic of Apple’s App Store practices, called the scheme “junk fees,” adding that the plan did “nothing to open up the mobile app ecosystem to competition, as required by Digital Markets Act.”

“The law makes it clear that Apple must allow developers to offer link outs to the web for purchases ‘free of charge’ and has to allow ‘effective use’ of competing stores,” the company wrote.

The European Consumer Organisation (BEUC), an umbrella group representing 42 independent consumer organizations across 31 countries, was also cautious.

Sébastien Pant, the group’s senior officer for competition and digital enforcement, wrote: “On paper, there seem to be some improvements with a simpler and lower fee structure. But it remains to be seen if these commitments will satisfy app developers who will, in any case, pass on the fees to consumers.

“We also need to see the full user flow to see if consumers will truly benefit. For example, will consumers be able to easily conclude contracts with app developers on iPhones outside the App Store without having scare screens displayed? Will it be possible to easily download and use alternative app stores on iPhones and iPads without the artificial friction Apple deliberately created?

“Also, we must remember this is not a gift Apple is giving consumers, but something they are required to do so by EU law. It might be a cliché, but the devil is in the detail!”

Developers can sign the new terms immediately, with the changes taking effect on October 1. ®

U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure.

PLCs are industrial computers used to automate and control machinery and physical processes in factories and other critical infrastructure.

The NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency issued the joint advisory Wednesday, saying the attacks are ongoing.

“This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs),” reads the advisory.

“However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems.”

The critical infrastructure sectors most targeted include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The agencies also note that Siemens S7 PLCs are used in the Defense Industrial Base, which could also be targeted.

Threat actors are using internet scanning services, including Censys and ZoomEye, to find exposed Siemens PLCs and exploit critical and high-severity vulnerabilities, outdated software, and weak authentication.

The advisory says the attackers are using artificial intelligence to develop Python exploitation scripts that use the ‘snap7.dll’ and ‘python-snap7’ libraries to communicate with Siemens S7 PLC devices.

These custom tools are disguised as legitimate OT monitoring software and can provide read and write access to PLC memory, configuration data, and ladder logic programs over the S7comm protocol.

The agencies say the activity appears focused on persistent reconnaissance, potentially preparing attackers for disruption to critical infrastructure, including stealing sensitive data, damaging equipment, causing extended downtime, or leading to safety incidents.

The actively targeted devices include Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 PLCs.

Organizations are urged to inventory Siemens S7 PLCs, install the latest security updates, block internet access, strengthen access controls, and monitor for unusual activity targeting these devices.

Today’s advisory follows a recent increase in attacks targeting exposed PLCs at U.S. critical infrastructure organizations.

In July, hackers targeted more than 30 Minnesota water utilities, causing equipment malfunctions and forcing some facilities to switch to manual operations temporarily.

CISA later warned of an increase in attacks against internet-exposed PLCs used by water and wastewater utilities.

Earlier in April, U.S. agencies also warned that Iranian-linked hackers were targeting internet-exposed Rockwell Automation/Allen-Bradley PLCs, causing disruptions and financial loss across multiple critical infrastructure sectors.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Advertisement

Get the report

A short video posted last week shows someone strolling through a dense night-time cyberpunk city. Skyscrapers rise on either side of the streets. Cars roll past. Trees stand along the sidewalks. Pedestrians move about. Everything on screen is made from ordinary keyboard characters: letters, numbers, punctuation marks, and symbols stacked and spaced to form walls, windows, roadways, and moving figures. Grow Now Games, working alone, put the whole thing together inside a single HTML file.

The code is JavaScript-based and uses the browser’s canvas element, so no game engines, 3D models, textures, or shaders are required. This city exists as a simple grid that contains the locations of its roadways, building heights, trees, automobiles, and residents. Every frame, the engine shoots a series of rays from the camera position, calculating the perspective and distance, checking for collisions, and determining which surfaces should be seen. Those results are displayed as clumps of characters on the screen. Closer items appear larger and brighter, whereas distant structures shrink and fade into darkness.

Sale

LEGO City Car Transporter 60408

• Transporter truck toy playset – Fans of toy vehicles will love this multi-vehicle LEGO City Car Transporter Truck with Sports Cars building set for…
• What’s in the box? – This car toy construction set includes a toy truck with trailer, ’50s-style tail dragger car, ’70s-style muscle car and…
• Fun addition to any toy car collection – Tilt the driver’s cab to access the engine, hitch the trailer and drop its upper deck and lower deck…

The effect feels quite solid, since you can look all around, up, down, left, and right, and everything appears convincing. Depth is easy to interpret, and moving autos and pedestrians appear to move smoothly as you shift perspectives. Even semi-transparent trees allow light from further away to shine through their letter-based leaves. The entire thing has that greenish data-stream aspect that was common in earlier sci-fi films and games, yet it never devolves into a boring flat backdrop of text.

Grow Now Games stated that the idea was to create a location where you feel like you’re wandering around a data-driven universe rather than staring at a static image. All of this is made feasible by the proprietary ray-casting method. The map remains a plain grid of cells in memory with no frills. Every frame, the renderer does the heavy lifting, converting all those numbers into something you can see, and despite the fact that every visible surface is practically constructed from scratch as text, the performance remains smooth enough to allow you to move around in real time.

The project is still a work in progress, with more atmosphere to add, finer elements to work on, and more ways to engage with the city. Even as it is, the demo provides a comprehensive first-person experience across streets lined with tall buildings and real-life traffic. People tend to watch the video till the end since the motion keeps unveiling new corners and the character work keeps changing itself.
[Source]

In a large-scale campaign that researchers dubbed CameraSwarm, hackers compromised more than 14,500 Dahua IP cameras mostly in Ukraine and Russia.

The operation ran for at least 35 days between June 17 and July 22, compromising devices by exploiting vulnerabilities, brute-forcing logins, and  using offline recovery codes from serial numbers for cloud-registered cameras.

Researchers at threat intelligence company Hunt.io discovered the campaign after finding a working directory on an HTTP server that the operator left unprotected.

Hunt.io recovered 407 MB of data comprising 2,616 files across 234 directories, including source code, logs, credentials, captured camera images, shell history, and exploitation results, which helped them map an impressive operation.

According to their findings, the 35-day CameraSwarm campaign compromised 14,530 Dahua IP cameras using three attack methods in parallel:

1. A brute-forcing system scanned TCP port 37777 and compromised devices at 12,324 unique IP addresses. It captured usable camera snapshots, sent results to Telegram, and exported them for Dahua’s SMART PSS platform.
2. Exploiting CVE-2021-33044 and CVE-2021-33045 vulnerabilities using a tool called p2pwn that installed a persistent backdoor account (p2pwn / p2password) on 1,923 cameras. The account survives password changes and, on most firmware versions, factory resets.
3. A cloud-relay attack reached 283 cameras behind NAT using only serial numbers and SDK credentials embedded in Dahua applications. Data indicates that 89.4% of live serials exposed an access channel without authentication.

The recovery code generation mechanism in the attack toolkit leverages the camera serial number, which allows the CameraSwarm operator to redeem new codes via Dahua’s standard password-recovery process without knowing the current admin password.

The researchers found two misleading vulnerability references in the toolkit, CVE-2024-39943 and CVE-2025-31702, which are not exploited in the observed attacks.

Hunt.io’s analysis uncovered that scanning was global, first checking the Russian address space, then scanning the entire IPv4 range. According to the researchers, “the operator’s focus settled on Russian and CIS telecom netblocks.”

However, the researchers also found Russian comments in modified code inserted in repurposed public tools.

On August 10, Hunt.io notified national CERTs and Dahua’s PSIRT about the CameraSwarm campaign.

Dahua cameras reachable through port 37777 between June and July should be treated as potentially compromised. Owners should examine them for the presence of a ‘p2pwn’ account and remove it.

Hunt.io warns that removing the backdoor account does not invalidate recovery codes generated by the toolkit, and they remain usable until Dahua alters the derivation server-side.

Additionally, users are recommended to disable P2P when not needed, and apply the Dahua SA-2021-0130 firmware updates for CVE-2021-33044 and CVE-2021-33045, or a later firmware version.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report