In brief: GeForce Now is a cloud gaming service that lets users stream games over the internet in limited sessions. As a pair of modders recently discovered, however, a bit of tinkering can turn it into a formidable system for offloading demanding computing tasks.

GeForce Now can apparently do much more than simply stream a selection of supported games using the AV1 codec. Two modders known as “Zortos” and “dpadGuy” have uncovered a trick to gain full desktop access to the streaming service, allowing them to run custom games and software directly on Nvidia’s hardware. Granted, Nvidia will probably patch this loophole eventually, but in the meantime the workaround remains fully functional for anyone willing to follow the modders’ steps.

The modders explained how they achieved this unprecedented result in a video tutorial. The clip essentially provides a step-by-step guide on how to access the remote desktop, although they warn that the method only works with a paid GeForce Now subscription. Free-tier users and GeForce Now Alliance Partner services remain limited to AV1 game streaming.

The tutorial is based on the free-to-play game Trove and GeForce Now’s ability to expose the Steam client’s full interface. From within the current Steam session, users need to access the client’s browser and locate a specific executable file in Trove’s installation folder. They then need to replace the file with a special version provided by the modders and launch it to finally access the remote desktop.

GeForce Now machines can provide some hefty hardware specifications. Zortos said he was able to access an “Ultimate”-tier machine equipped with an AMD Epyc 9375F 32-core CPU and a GeForce RTX 5080 GPU. The system has 48GB of VRAM and 56GB of total system RAM.

– Zortos (@Zortosdev) August 7, 2026

The tutorial demonstrates how the newly discovered desktop access could be used to install Wallpaper Engine from Steam or customize the Windows taskbar. More generally, it could provide broader access to Nvidia’s hardware resources, raising significant security and trust concerns. Later, Zortos used the powerful remote machines to install custom AI models, promising that more “juicy” demonstrations are on the way.

It’s worth noting that this kind of access sits well outside GeForce Now’s terms of service, so anyone attempting this risks having their account suspended or banned.

In any case, the Trove-based method for breaking into Nvidia’s cloud gaming service does not appear to be foolproof. Some users who tried the same trick experienced a few unexpected issues, including Windows sessions closing automatically or being unable to download the custom executable file to Trove’s folder. Some said the Trove method no longer works, although Zortos reiterated that this is not the case.

Hackers used a dedicated mobile gateway to compromise a second facility during the destructive cyberattacks that hit Poland’s energy sector last year.

The second target was a small combined heat-and-power (CHP) plant that supplies heat to around 50,000 residents, resulting in the steam turbine and the water treatment system being shut down.

The Polish Computer Emergency Response Team (CERT) disclosed this second incident in a follow-up report over the weekend, saying that the attacker used a private Access Point Name (APN) to access the operational technology network.

“The attack was made possible, among other factors, by a misconfiguration that allowed arbitrary devices within the private APN network to communicate with one another.”

On December 29, 2025, an attacker believed to be linked to the Russian Electrum threat group targeted 30 wind and solar power installations and a large CHP plant in Poland, destroying key equipment beyond repair.

The threat actor hit distributed energy resource (DER) sites across the country, disabled communications equipment, corrupted operational technology (OT) devices, and wiped Windows systems. Despite this effort to destabilize the grid, energy generation and distribution were not disrupted.

In the newly disclosed attack at a second, smaller CHP plant, the threat actor switched off the programmable logic controllers (PLC) and protected access with a password, thus deactivating a steam turbine and the plant’s process-water treatment system and interrupting cogeneration operations.

The staff at the plant managed to restore impacted systems quickly, so the outage was short-lived and had no impact on the population.

Novel attack path

Upon investigating the incident, the Polish CERT determined that the attacker initially compromised a FortiGate VPN/firewall at a wind farm and used a Teltonika cellular router on its network to tunnel into a private APN managed by the distribution system operator.

The APN lacked client isolation, allowing the attacker to scan for and communicate with devices at other facilities.

Beginning on December 18, the attacker found a WAGO PFC200 PLC at the CHP plant whose web interface was exposed on the APN and protected with default administrator credentials.

After compromising the controller, the attacker enabled SSH and used it as a bridge into the plant’s OT network.

Over the following week, they scanned the network for SCADA systems and industrial devices, and on December 25 they connected to three Siemens PLCs, likely in preparation for the attack.

At approximately 5:30 a.m. on December 29, the attacker accessed the SCADA interface and Siemens PLCs, switching them into STOP mode, activating password protection, and shutting down the steam turbine and process-water treatment system.

The attacker also reset and reconfigured several Moxa devices to impede recovery, destroyed logs, and hindered forensic analysis by corrupting or resetting the WAGO controller, Teltonika router, and FortiGate firewall used throughout the intrusion.

The Polish CERT believes this to be the first known real-world cyberattack in which an attacker entered an OT network by moving laterally through a private APN.

“To the best of our knowledge, the incident described in this report, which involved gaining access to an OT network through a private APN, was the first observed instance of this attack vector being used in a real-world cyberattack,” commented CERT Polska.

The surveys that followed the investigation determined that this configuration was common in Poland at the time, and the country’s CERT estimates that it’s likely similar arrangements are widely used internationally.

It is recommended to treat private APNs as untrusted external networks, enable isolation between connected clients, use allowlists for essential traffic between APN gateways and OT systems, and disable exposed SSH and Telnet administration services.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Sounding off: Microsoft’s push to bake AI into every product and service it sells is understandably facing some backlash. Even Office is turning into a vessel for Redmond’s chatbots, which may be why one developer decided to go back in time instead, releasing a wild modern port of an early Word release.

Developer Justin Marshall recently ported Word for Windows 1.1a to modern Windows systems. The open-source conversion draws on the source code of the original program, which Microsoft shared with the community in 2014.

Marshall’s port brings the original WfW experience to Windows x64, replacing non-working 16-bit code with modern programming conventions. The coder explains there’s no emulation, virtualization, or reimplementation trick involved: the original Word application runs with its original resources and UI elements intact.

Porting WfW to Windows x64 wasn’t exactly a “plug-and-play” affair. Marshall said that while the original C code and resource files are still part of the port, he had to make the 16-bit code behave properly in a modern 64-bit Windows environment. Specific behaviors tied to the Win16 API had to be adapted to modern Win32 APIs, while dialogs, cursors, and bitmap elements had to be rebuilt with native host tools through the CMake build process.

“CMake inventories the legacy assembly tree but does not compile those modules into native targets. This keeps the historical implementation available as a reference while ensuring all shipped code is valid for AMD64,” Marshall explained on the project’s GitHub page.

Word, and Word for Windows 1.1a specifically, hold a special place in Microsoft’s software history. The original Word for Windows debuted in 1989, bringing the DOS-based productivity tool to a new GUI paradigm; version 1.1a followed a year later as the release that added dedicated support for Windows 3.0. Over time, Word became the de facto standard for word processing in lieu of WordPerfect.

Compared to the barebones GUI of Word for Windows 1.1a, today’s Word is a completely different beast. Microsoft now treats its productivity software largely as a means of promoting its AI services. Thanks to chatbots and LLMs, the latest Microsoft 365 version of Word can even write documents and expand drafts on its own. No pesky human intelligence required.

While Microsoft keeps cramming more AI into Office, some developers are trying to fight back by returning to the roots of its software tools. Before the WfW port, Marshall built other projects blending old software with modern tech, including a ray-tracing port of Quake 1 and a merge of the Quake 4 SDK with the Doom 3 graphics engine, among others.

The Mcon controller balances portability and performance in a compact, MagSafe-compatible design for iPhone gamers.

Gaming controllers usually come in two flavors. You’ll find ones that are extremely comfortable and capable, as well as those that are small and portable.

Finding a controller that is both portable and capable is a rarity, to say the least. The OhSnap Mcon is the first one I’ve tested that makes good choices on compromises and uses MagSafe for easy connection to iPhone.

Mcon mobile gaming controller review: Design

Mcon has a very cool design. It’s roughly the size of my iPhone 17 Pro, but a bit thicker.

Mcon mobile gaming controller review: It’s fun to open the Mcon controller

It connects to your iPhone with MagSafe and has a solid hold. When you’re ready to game, you just press the silver button that sits right where your fingers rest.

When the button is pressed, the controller springs open. The Bluetooth is turned on, and the iPhone gets positioned just above the controller buttons.

Mcon mobile gaming controller review: The grips fold flat to the controller

Advertisement

It’s just fun to do and has a satisfying whoosh and click. I also appreciate that the phone doesn’t just slide forward; it angles upward slightly to make it more comfortable.

With the controller open, you can then rotate out two extra palm grips from around the back. This puts you in a natural gaming position with access to the joysticks, triggers, and all the other buttons.

Mcon mobile gaming controller review: The buttons use XYAB labels

Speaking of the buttons, they’re in a bit of an interesting layout. It’s like a combination of a PlayStation controller and an Xbox controller.

It uses the XYAB buttons that Xbox uses, but it uses dual, center-justified joysticks as PlayStation does. The button labels are mostly irrelevant, and I vastly prefer this joystick setup to the Xbox’s.

Mcon mobile gaming controller review: The top comes off to use as a stand

Those joysticks use what OhSnap calls MagRes technology that promises to be ultra-accurate, lag-free, and drift-free. OhSnap even claims it is superior to the well-respected Hall-effect mechanics.

You can use the controller via Bluetooth, or you can use it wired via USB-C. If you go wireless, you can enter “kickback mode” by pressing the eject button and removing the MagSafe module.

Mcon mobile gaming controller review: It’s easy to reassemble and snaps into place

This gives you a magnetic stand for your phone that you can place anywhere you want and then relax with the wireless controller. It’s very clever how the metal arm that works as the stand also doubles as the central guide and stabilizer as it opens and closes.

Mcon mobile gaming controller review: Gaming performance

I wouldn’t consider myself a professional gamer by any means, but I’m certainly an avid one. I’ve long been a proponent of more console-level games making their way to iPhone, iPad, and Mac.

Quickly after launch, I eagerly downloaded Assassin’s Creed Mirage, Hitman World of Assassination, and Red Dead Redemption. Not to mention many more mobile-specific games like PowerWash Simulator, Thronefall, Call of Duty Mobile, or Alto’s Odyssey.

Mcon mobile gaming controller review: Playing Hit Man on iPhone with the Mcon controller

I tested the Mcon controller with most of these games over the course of the last several weeks. While it wasn’t perfect, it’s very reliable to use.

All of the buttons were incredibly tactile, providing a solid click each time they are pressed. The bumpers and triggers also felt reliable, though they were skinny, leaving my finger feeling a bit unsupported.

Mcon mobile gaming controller review: The joysticks are very accurate and responsive

Advertisement

To me, the joysticks are the most important control, and OhSnap did a great job with these ones. They’re absolutely on the small side, but there was basically no dead zone in the middle, and they were very reactive when using them.

Mcon mobile gaming controller review: The bumper and trigger buttons feel good, but are somewhat thin

I think all of these buttons are premium in design and performance, but are slightly smaller to accommodate the portable footprint.

Mcon mobile gaming controller review: Should you buy it?

With mobile gaming being as popular as it is, there is no shortage of controllers on the market. We’ve reviewed several here at AppleInsider.

Mcon mobile gaming controller review: There are lots of controllers out there, but none as compact and premium

For standalone controllers, I’m still the biggest fan of the DualSense controller that is MFi certified and even has a streamlined pairing process with iOS 26. The Razer Kishi Ultra is also an excellent option.

Both of them are inarguably more comfortable than the Mcon is. They fit your hand better, and the buttons are bigger.

Neither of those, nor the equally popular Backbone, will fit in your pocket, though. That portability is ultimately what matters most with the Mcon.

Mcon mobile gaming controller review: You can play the Mcon controller anywhere

You can find more comfortable controllers, but you’d be hard-pressed to find a portable one that is as solid as this one is.

Mcon mobile gaming controller review: Pros

• Premium construction with metal parts
• Hall-effect triggers and mag-res joysticks
• Simple MagSafe connection
• Works wired or wireless

Mcon mobile gaming controller review: Cons

• Not the most comfortable controller out there
• Relatively expensive

Rating: 4.5 out of 5

Where to buy the OhSnap Mcon controller

Buy the Mcon controller for $129 from OhSnap in either black or white.

Security

Franklin project adds new security providers, employs digital twins and AI

DEF CON hackers expanded their efforts to provide free cyber-defenses to rural water systems in the US to include managed detection and response providers, digital twins, and AI agents.

On Friday, at the annual hacker’s conference, DEF CON Franklin and the National Rural Water Association (NRWA) announced a new program called the Water Watch Center. It will initially fund five providers – Defendify, Legato Security, L1 Secure, Rapid7, and Sentinel Technologies – to help small water utilities serving fewer than 10,000 people detect and mitigate breaches. 

The security providers will exchange threat info and share that with the NRWA, which provides technical assistance and operational support to small water and wastewater utilities across all 50 states.

“We’ve had our volunteer experts out for two years in these water utilities, in the trenches with these folks, and the thing that we’ve realized is that there’s just not a scalable delivery mechanism for cyber for these utilities when there’s 150,000 of them, and 98 percent of them are small businesses,”  Jake Braun told The Register during an interview at DEF CON.

Braun co-founded the Franklin project at DEF CON in 2024, and 350 people signed up that year to donate their time and talent to securing water facilities.

“We groped around in the dark for what to do, and eventually realized we already know how to do security for small businesses – it’s MSSPs,” Braun said. “So why don’t we just do that?”

He described the new Water Watch Center as a pyramid, with the NRWA at the top, the managed detection and response providers’ sensors hunting for security vulnerabilities across the utilities’ networks, and then Franklin volunteers fixing issues or responding to instructions as needed.

“We have five initial MSSPs, which will expand to 10 eventually, based on the 10 CISA regions,” Braun said. “And then below that, we have volunteers who can help, and connect water utilities to MSSPs, so we’re not just sending alerts. We can take the alerts that CISA and the ISAC put out, and deliver cybersecurity. That’s been the missing piece: there has been no delivery mechanism for cybersecurity that’s scalable nationally – that’s what this is.”

Suspected Iranian hackers have hit numerous water systems in recent weeks, and most were small, community systems that left programmable logic controllers directly exposed to the internet using default or weak passwords. There’s no indication that the attackers used AI to help plan or carry out these digital disruptions. However, as both cyber and national security experts told The Register during conversations on the sidelines of Black Hat and DEF CON, it’s only a matter of time until that happens.

DEF CON Franklin has a plan for that scenario, too.

The Water Watch Center also partnered with Vanderbilt University to apply research from the DARPA Cyber Agents for Security Testing and Learning Environment (CASTLE) program. This partnership will create digital twins for a few WWC water and wastewater system environments, and then researchers will deploy both red- and blue-team agents across these digital dupes.

The red-team attack agents try to hack the water systems, testing the blue-team defenders’ automated detection and response capabilities, with the eventual goal of deploying AI-based defense to water and wastewater facilities across the US.

“They let it fight each other a gazillion times, and then they figure out when does the blue team win, so we can train agents to then later drop into these 150,000 water utilities,” Braun said.

“There’s already a 500,000-person shortage of cyber professionals. The idea that we’re magically going to find 150,000 new people is a fantasy. There is no other way to really be able to combat the AI attacks that are going to be coming at these things.” ®

Facepalm: Microsoft’s default Weather app in Windows 11 can use nearly 1.2 GB of RAM while sitting open on a forecast screen, according to testing by Windows Latest. The app doesn’t need to be actively used to reach that level of memory consumption. The report found that MSN Weather launches as many as nine Chromium-based subprocesses, suggesting the app is built around a web wrapper rather than as a fully native application. That design helps explain why a basic system utility can use so much memory.

MSN Weather is the standard weather app included with Windows 11. It provides a detailed set of tools, including live radar, hourly forecasts, wind and precipitation data, air-quality readings and moon phases. The data comes from several weather providers, with Foreca serving as a primary source.

The app’s interface is modern and works smoothly, but still, the level of resource use stands out when compared with Apple’s Weather app on macOS, which uses about 250 MB of RAM while providing similar forecast details. That is about five times the RAM usage for the built-in Windows alternative.

The Windows app also carries advertising. Windows Latest’s testing cited ads for Adobe Acrobat while others saw ads for LendingTree and Spotify. Microsoft may need to offset the cost of delivering weather data, but ads in a Microsoft-owned app remain a point of frustration for users who have already paid for a Windows license.

The report arrives as Microsoft has been talking more openly about Windows 11 performance. The company recently removed material recommending 32 GB of RAM for gaming PCs, and has said Windows 11 is optimized to run smoothly on systems with 8 GB of memory.

On an 8 GB machine, an app using close to 1.2 GB of RAM would take up roughly 15% of the system’s available memory. That is a significant share for an application users may open only to check the temperature or see whether rain is expected.

But it seems Microsoft has been building simple apps like this one using WebView2, the company’s framework for embedding web content inside Windows apps. It runs on the same Chromium engine that powers Microsoft Edge, splitting rendering, networking and GPU work into separate processes. That’s why Task Manager shows Weather behaving less like a single lightweight app and more like a small browser session running in the background.

Apple’s Weather app uses far fewer resources than MSN Weather.

Microsoft has said it plans to improve performance, reliability and memory use across Windows 11. It has also discussed updating the apps included with the operating system as it shifts from older Win32 and UWP approaches toward WinUI-based development.

It’s not clear whether that work will include MSN-branded services such as Weather and News. Those services are built into the Windows experience, but Microsoft hasn’t specifically said they’ll be part of the planned overhaul.

For now, the Weather app shows the gap between Microsoft’s broader optimization goals and the experience of using some Windows utilities today. The app is visually polished and offers plenty of forecast data, but its browser-based structure, high memory use and ads make it an awkward fit for a default desktop app.

Good morning! Let’s play Connections, the NYT’s clever word game that challenges you to group answers in various categories. It can be tough, so read on if you need Connections hints.

What should you do once you’ve finished? Why, play some more word games of course. I’ve also got daily Strands hints and answers and Quordle hints and answers articles if you need help for those too, while Marc’s Wordle today page covers the original viral word game.

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators’ browsers to create rogue admin accounts.

Starting Saturday, the affected BdThemes products were no longer available for download after the WordPress Plugins team closed all of them pending a full review.

BdThemes provides premium WordPress plugins, including Element Pack, Prime Slider, Ultimate Post Kit, Pixel Gallery, and Ultimate Store Kit.

Its flagship free Element Pack plugin alone currently shows more than 100,000 active installations on WordPress.org, while the developer advertises a portfolio with over 350,000 active installs.

WordPress security firm Defiant started seeing attacks through its Wordfence web application firewall (WAF) on August 7.

The researchers say that the attacker “poisoned a static remote JSON data stream fetched by an administrative promotional banner component” after obtaining write access to the vendor’s storage bucket.

According to the researchers, the plugin developer had introduced a cross-site scripting (XSS) vulnerability in the JSON response parsing code, allowing the attacker to replace the legitimate promotional JSON with malicious code that exploited the security issue.

The researchers report that the attack was enabled by a coding flaw introduced in March 2026 in the JSON response-parsing code, which created a cross-site scripting (XSS) vulnerability in the BdThemes infrastructure.

The flaw is in the Biggop Library used by the Biggopti component responsible for getting promotional banners from the vendor’s API server and showing them in the customers’ WordPress admin dashboard.

A report from Defiant explains that the malicious JavaScript injection uses the legitimate administrator’s authenticated session to create rogue admin accounts on impacted sites, while an additional payload (w2.js) establishes persistence via a webshell (emer-run.php) by installing a fake plugin.

“The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping,” Wordfence researchers say.

“This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.”

The issue was assigned a “medium” severity score, and Defiant’s report lists it as unpatched as of publishing.

Because the attack is entirely API-driven, requires no interaction, file modification, or plugin update, it is entirely stealthy, and the payload executes every time a logged-in administrator opens a wp-admin page.

The injected code manipulates WordPress database queries to hide rogue administrator accounts from the user list, making the compromise more difficult to spot.

Defiant’s Wordfence researchers say that reports that the command-and-control (C2) infrastructure used in the observed attacks points to the same attacker behind the recent Advanced Responsive Video Embedder and OptinMonster supply-chain compromises.

After discovering the attacks, the researchers analyzed available records and determined that the earliest possible start of the campaign was June 23.

The affected plugins were pulled from the WordPress.org directory on August 8, pending investigation, while two poisoned API endpoints now return clean JSON data.

At the time of writing, the vendor has not published an official statement about the incident on its website.

BleepingComputer has contacted BdThemes for a statement, but we have not received a response.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper