from the they-still-put-people-at-risk dept

Age verification (laws and regulations requiring platforms and websites to assure or estimate that a user seeking to use an online service is of a certain age) is everywhere. At the time of writing, about half the states in the US have some internet age verification law in place, and dangerous proposals, from the KIDS Act to the Kids Online Safety Act (KOSA), have been advancing at the federal level. European Union member states are moving toward having age verification in a centralized app by the end of this year. Australia famously now has one extremely broad restriction in place.

Most age verification laws tend to fail at their primary goal of barring kids from being online or from entering only specially designated zones, not to mention they pose a significant threat to everyone’s privacy. Some proponents of these age-based internet restrictions think they’ve found the silver bullet: Zero-Knowledge Proofs (ZKPs). We wrote about ZKP’s when they were first rolled out in the age verification context last year. However, more recent examples show our concerns weren’t just conjecture; ZKP-focused AV schemes are gameable, hackable, and not the cure-all some may claim.

ZKPs in Age Verification Would Only Centralize Power and Create More Harms

Before we jump into how these systems work, it must be said: creating a single point of failure for internet access contradicts the very idea of a free and open internet. 

The mechanisms underlying ZKPs pose an existential threat to everyone’s digital rights, not just kids. The idea behind ZKPs is that you are issued a “token” that vouches for your age every time you log in, creating a constant link back to the entity that verified you. The issuer of the tokens these AV schemes rely on could track every time that credential is used, creating a dangerous trail of metadata on any user they wanted to target. The issuer itself could be pressured by authoritarian governments to remove a user’s access to a service, essentially removing that person’s access to the internet entirely. Without oversight of who has authority to implement and operate these systems, this approach centralizes critical internet infrastructure in the hands of very few actors. 

How ZKPs Work

ZKPs are mathematically impressive cryptographic tools—but they weren’t developed with age verification in mind. Essentially, they let a computer quickly attest to the validity of a given question asked by another computer without divulging any underlying private data. 

Computer A (such as the device operated by a person trying to access a website) is able to prove to Computer B (such as the server for the website that person is trying to access) that something is true without actually sharing the contents of that information itself. Computer A locks in a “commitment” to the information it needs to convey. Computer B, which wants to verify that information, generates mathematical “challenges” that can be answered correctly only if the information is true. Traditionally, this happens over many different “challenges” until there is no room for doubt that Computer A’s “commitment” is true.

Since that kind of lengthy back-and-forth process would drastically slow things down over the internet, there’s a shortened version of this exchange that’s “non-interactive.” In that case, the ZKP is verified instantly. The answer itself is hashed (mathematically converted into a fixed, shorter string of characters), and the resulting hash is theoretically unpredictable and tamper-resistant. This shortened version of the ZKP exchange is called “zk-SNARK,” which is the current preferred method for age verification.

In the ideal scenario, this means that ZKP’s are able to attest to a person’s status as an adult or a child without actually giving away any other private information about that person. In other words, only one entity would collect that private information, typically on the user’s device, instead of every website or app that needs the user’s age attested to. Unfortunately, recent real-world testing of these systems prove that ZKP’s aren’t the silver bullet that proponents of AV laws were hoping for.

EU’s AV Rollout Reveals How Broken It Is

By the end of 2026, the 27 states within the European Union are expected to have infrastructure in place to do age verification within a “mini-wallet” app that will live inside the EUDI (European Digital Identity) Wallet. This is being met with plenty of warranted criticism from digital rights experts. The “mini-wallet” version is already being rolled out, with promises that the ZKPs are in working order. But recent insights show that the ZKP features aren’t yet turned on except for the closed demo/prototype build (not the version of the app people are using “out of the box”), which the vast majority of everyday users can’t access. 

Worse still, a security researcher found they could bypass the app’s system using a quickly built Chrome extension that tricked the app into repeatedly accepting the same “over-18” token. It did so without ever asking for fresh verification. 

Over 400 security researchers signed an open letter stating that age assurance checkpoints, even if implemented with privacy in mind, would cause more harm than good. A primary focus of their concern, which we share, is the fact that a centralized identity verification system creates a single point of failure that is extremely vulnerable to both cyberattack and authoritarian overreach.

Once the “mini-wallet” version of this is fully integrated into the EUDI Wallet, it will replicate these same failures, perhaps more, but at a much larger scale. At that point, the failures will involve many more pieces of sensitive information that the EUDI Wallet contains: passports, driver’s licenses, travel information, financial information, to name a few.

ZKP’s Aren’t The Magic Bullet

As we’ve said time and time again, no method of online age verification is privacy-protective, fully accurate, and capable of guaranteeing universal coverage without introducing severe security risks. 

Lawmakers concerned about the privacy failures of age verification mandates must understand that ZKPs are not a magic bullet. They do not solve the age verification paradox; they simply push the burden of trust down the road, relying on technical ignorance and magical thinking about how the internet actually functions.  

Mandatory online age verification of any kind is a dangerously flawed idea. Tell your lawmakers we said so.

Republished from the EFF’s Deeplinks blog.

Filed Under: age verification, centralization, cryptography, tokens, zero knowledge proofs

Anthropic has made Claude Mythos 5 available for code scanning in Claude Security and is integrating it into partners’ defensive products, with users receiving outputs rather than direct access to the model. It is also committing $35mn in credits to open-source security work.

Anthropic is widening access to its most capable cybersecurity model, without letting most people near the model. Claude Mythos 5 now runs code scans inside Claude Security and is being built into the products defenders already use.

The distinction is the whole design. A user of a partner tool receives a specific artifact, a suggested patch or an alert, and has no way to prompt the model to write an exploit instead.

What is live today is the scanning. Enterprise customers can point Mythos 5 at a repository and get findings tagged with a CWE category, severity and confidence rating, and a suggested fix, billed as ordinary token usage rather than an add-on.

Humans stay in the loop by design. Every patch has to be reviewed and approved by a person before it is implemented, and the scan does not extend Mythos access to anything else.

The second announcement is money, and it points at the real bottleneck. Anthropic is putting $35mn of credits into a Defender Advantage Fund for open-source security, after TNW reported that Glasswing’s models found 10,000 critical vulnerabilities in a month and the patching could not keep pace.

Grants will go to three things. Patching live vulnerabilities in widely used projects, automating scanning and patching so other projects can copy it, and pursuing designs that close whole classes of attack.

For European maintainers the timing is not incidental. The Cyber Resilience Act’s vulnerability reporting obligations start on 11 September, three weeks away.

Those rules land on open-source stewards specifically. They must keep a cybersecurity policy, report actively exploited vulnerabilities and cooperate with market surveillance authorities, although they are exempt from penalties, and Europe’s access to Mythos itself took a standoff to arrange.

Credits are not maintainers, which is the limit of this. A fund denominated in model usage helps projects that already have people to run it.

The competitive picture is converging on the same shape. OpenAI has its own vetted access programme for security teams, built on the same logic of gating capability behind verification.

The caution behind all of it is recent. Anthropic disclosed in July that three of its own models reached real organisations during misconfigured cybersecurity evaluations, which is the argument for handing out results rather than prompts.

We’ve tested over 100 mini PCs, and with back-to-school season now in swing, I’ve spotted plenty of deals under $600 on these compact machines that are pitch-perfect for dorm rooms and home offices, providing the performance needed for studying and working.

So, I’ve rounded up some of my favorite mini PC deals, including the excellent Geekom A6 for $549 (was $649), and the recently reviewed Beelink EQi Wild Cat, now $469 (was $549), both scored 4.5 stars in our review, and both are discounted at Amazon.

Whether you need an inexpensive computer for homework and browsing or something more powerful for more demanding workloads and creative projects, these are the top mini PCs you can get for less than $600 right now.

Why we recommend these mini PCs for work and study

The Geekom A6 is one of the strongest all-rounders, combining a Ryzen 7 6800H with Radeon 680M graphics, USB4 and support for four 4K displays. Its upgradable memory and storage also give it plenty of room to grow. In his four-and-a-half-star review, our expert Alastair said it: “packs in an impressive amount of power, which is more than enough to handle MS Office and light use of Adobe Creative Suite Apps.”

The Minisforum UM760 Slim is similarly capable, with a newer Ryzen 5 7640HS and Radeon 760M graphics making it a good option for productivity, creative work and some lighter gaming.

For more straightforward school and office duties, the Geekom A5 provides 16GB of upgradable RAM and a large 1TB SSD, alongside useful extras such as six USB ports and an SD card reader. In his four-star review, expert Mark said it “delivers a thoughtful design that ticks most of the general usage boxes.”

The Beelink EQi takes another approach, combining Intel‘s Wildcat Lake 304 processor with Thunderbolt 4 and triple 4K display support in a compact package. In his four-and-a-half-star review, Alastair said: “The EQi is highly tuned to an office environment,” adding, “when opening Microsoft Office, Lightroom, and browsing the internet, the speed was surprisingly sharp. The strength of this machine comes in day-to-day office work, where it excels.”

Finally, the GMKtec M5 Ultra, with its eight-core Ryzen 7 7730U, dual 2.5GbE ports and triple-display support make it particularly useful for productivity, networking and home-office setups. In his four-star review, Mark said: “it supports a decent amount of memory, has dual M.2 slots and dual 2.5GbE LAN ports, which increases the number of roles that this system could occupy exponentially.”

For more top-tested machines, see our guide to the best mini PCs. We’ve also selected the best mini PC deals this week.

Should you buy a mini PC?

OFFBEAT

Billionaire walks back earnings call optimism as orbital test approaches

CEO Elon Musk says SpaceX probably won’t attempt to catch a returning Starship for several months, walking back his earlier suggestion that it could happen on the next test flight.

In a post on his social media platform, X, Musk said: “We will probably catch the ship with the tower in a few months.” He added that if a tower had been waiting at sea where Starship splashed down last month, “it would have been caught.”

During SpaceX’s first earnings call as a public company, Musk was more bullish, saying: “We could possibly catch the ship as soon as the next flight.” A few weeks later, that attempt appears to be off the table.

In his post, Musk also predicted that the “first reflight of the ship will be either end of this year or early next” – a timeline that, given his record for hitting Starship targets, should perhaps be written in pencil.

Musk’s post coincided with a SpaceX static-fire test of a single Raptor engine on Starship. The test simulated the deorbit burn required for upcoming orbital missions.

Starship’s previous test flight went relatively well. The Super Heavy booster made a hard splashdown in the Gulf of Mexico, while the upper stage settled into the Indian Ocean more gently and survived intact. This was not anticipated, and the vehicle ended up having to be towed into port – something Starship wasn’t designed for.

Starship is expected to reach operational orbit on its next test flight and deploy a batch of Starlink V3 satellites if all goes to plan, according to Musk’s comments during the earnings call.

Reaching orbit consistently is also critical to SpaceX’s work for NASA. Artemis III, scheduled for 2027, is intended to test rendezvous and docking between Orion and one or more commercial lunar lander test articles in low Earth orbit. NASA plans to use the results to prepare for the Artemis IV crewed lunar landing in 2028.

Catching Starship is not required for the Artemis III demonstration, but a faster launch cadence will become increasingly important as SpaceX prepares for later missions, including the multiple launches needed to fuel a lunar lander in orbit. As Musk’s latest post demonstrates, however, Starship milestones have a habit of slipping.

Full reuse is also central to the economics SpaceX has pitched to investors since its IPO. Catching the upper stage, rather than fishing it out of an ocean, is a substantial part of that promise. ®

PATCHES

Ukrainian hacktivists exploiting the bugs, but TrueConf’s reach stretches well beyond home turf 

CISA has ordered US federal agencies to patch two exploited flaws in TrueConf, a Russian-built video conferencing platform, after compromised servers were caught handing malware to unsuspecting meeting participants.

The US cybersecurity agency on Thursday added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalog, saying both have been used in real-world attacks. What CISA doesn’t say is who is being attacked, or where.

The only publicly documented attacks exploiting these two bugs so far come from Kaspersky, which linked them to Head Mare, a pro-Ukrainian hacktivist group that has repeatedly gone after Russian organizations. Its latest campaign targeted Russian companies across industries including transport, energy, electronics, IT, and software development.

CISA doesn’t say whether it added the flaws to KEV because of those attacks or because it has evidence of exploitation elsewhere, potentially including against organizations in the US.

That question is particularly interesting given what TrueConf is and who uses it.

TrueConf is a Moscow-based maker of video conferencing software that offers an on-premises alternative to cloud services such as Zoom and Microsoft Teams. Organizations can run TrueConf Server on their own infrastructure, including in private networks, giving them control over where their calls and associated data go.

While the company’s roots and much of its customer base are Russian, TrueConf has users worldwide. It says it has users in its portfolio that include Switzerland’s Department of Justice and Home Affairs, Istanbul Airport, and a news org, which The Reg has contacted to confirm. Most of the customer success stories are dated before 2022.

Used together, the two bugs flagged by CISA can give an attacker control of the underlying server. According to Kaspersky, an unauthenticated attacker with network access to TCP port 4307, which TrueConf documentation says is open by default, can exploit the first flaw to run a malicious script. The second flaw lets the attacker break out of the isolated environment where the script runs and execute arbitrary code on the underlying server.

Kaspersky says Head Mare used that access to plant a web shell, move through victims’ infrastructure, and gain privileged access to the TrueConf database. From there, the attackers replaced the legitimate TrueConf Windows client installer on compromised servers with a trojanized version carrying the PhantomCore backdoor.

Kaspersky warns that this creates a risk beyond organizations actually running vulnerable TrueConf servers. Employees joining conferences hosted by suppliers or other third parties could potentially download a compromised client from someone else’s hacked infrastructure.

The researcher says the flaws affect TrueConf Server releases going back to 2022. TrueConf shipped fixes in versions 5.3.9, 5.4.9 and 5.5.5 on June 18, warning customers that skipping the update could leave their conferencing systems exposed to attacks over the public internet.

That doesn’t mean every TrueConf box is sitting on the internet waiting to be popped. Exploitation requires network access to the vulnerable service, so a server confined to an internal network would not be directly reachable from outside unless an attacker had another route in.

Federal agencies have until September 10 to patch the flaws. Other TrueConf admins can take their time, as long as they’re comfortable with a conferencing server potentially moonlighting as a malware distribution point. ®

There’s more coming than just an OLED MacBook Pro in the fall. Apple’s 14-inch MacBook Pro is expected to get a big speed boost with the M6 chip. Here’s what the rumor mill has to say.

While Apple plans to overhaul its MacBook Pro line with OLED panels and touchscreen support, we’ll still see one more model boasting the current design. Known internally as the J804, the base model 14-inch MacBook Pro will likely mark the debut of the M6 chip, in an all-too-familiar laptop chassis.

In essence, the M6 MacBook Pro will feature the same miniLED screen with ProMotion support, the same six-speaker sound system, the same assortment of ports, and presumably the same $1,999 starting price as the current M5 model. However, the chip inside might be a lot more powerful.

According to a July 2026 report, Apple’s M6 chip will offer a memory bandwidth of 200 gigabytes per second, up from 153 gigabytes per second with the M5 chip. Apple will allegedly improve memory bandwidth by adopting a new memory architecture with the M6 chip, and by increasing the core count of the Neural Engine from 10 to 12.

The same source also said in June 2026 that Apple tested standard M6 chips with 12 GPU cores. This would give the base M6 MacBook Pro two extra GPU cores as well, relative to its M5 counterpart. While a more powerful graphics processing setup will be useful for gaming and 3D rendering, it looks as though Apple’s focus lies elsewhere.

A powerful GPU and Neural Engine, coupled with improved memory bandwidth, would make the M6 MacBook Pro better at Apple Intelligence and Siri-related tasks, compared to the preceding M5 model. The hardware improvements planned for the M6 may also enable more advanced on-device capabilities.

According to a February 2026 rumor, meanwhile, the M6 chip will use TSMC’s first-generation 2nm process known as N2. This means the M6 chip will have a smaller die than the preceding M5, meaning the MacBook Pro will run faster, generate less heat, and use less power than the current model.

AI-focused hardware improvements and processing power aside, though, the base M6 MacBook Pro won’t offer anything new. It will continue to use the chassis and design that debuted in 2021 for the M1 Pro and M1 Max 14-inch MacBook Pro. The lack of a redesign was outlined in a November 2025 rumor, but it’s not exactly a groundbreaking discovery.

In July 2025, AppleInsider outlined Apple’s plans for the Mac lineup through 2026, revealing the identifiers for every Mac in development at the time. In October 2025, we received additional details about when these Mac models were scheduled to debut.

Our findings revealed that, while the OLED-equipped touchscreen MacBook Pro had the identifiers K114 and K116, Apple’s low-end M6 MacBook Pro used the product identifier J804. Rather than adopting a new starting letter for the M6 MacBook Pro, Apple chose to stay with the letter J, like the preceding J704 and J604 MacBook Pros. For reference, the latter two are the base M5 and M4 MacBook Pro, respectively.

The identifiers make it readily apparent that Apple had always planned to launch two completely different MacBook Pro variants. The low-end MacBook Pro will use the existing platform design, as indicated by the J at the beginning of J804, while high-end K114 and K116 MacBook Pros will adopt a new chassis, differentiated by the letter K.

The information we received regarding pre-release builds of macOS Tahoe never mentioned new high-end models using the existing MacBook Pro design. In short, there was never a J814 or J816 to replace the M5 Pro and M5 Max MacBook Pro, known broadly as the J714 and J716.

The entry-level 14-inch MacBook Pro with the M6 chip is looking like a worthwhile speed bump, but that’s about it.

It might even be replaced within six months, according to a July 2026 rumor. It won’t be until the M7 model, codenamed K104, that the base model MacBook Pro gets a redesign, per the same source.

While the M6 14-inch MacBook Pro might be a model worth skipping if you have a relatively new MacBook Pro, more exciting changes for the MacBook Pro remain on the horizon with the revamped K114 and K116 models.

For the high-end MacBook Pros, the rumor mill says to expect OLED panels, touchscreen support, and the same M5 Pro and M5 Max chips found in the current MacBook Pro lineup.