HP has a new mini PC on sale in the U.S., and it is difficult to look at the machine without thinking of Apple’s Mac mini. The OmniDesk Mini has a similarly compact footprint and starts at $799.99, making it $100 cheaper than the recently announced M6 Mac mini.

The similarities mostly stop there. The base OmniDesk Mini is powered by Intel’s Core 3 304, a five-core, five-thread Wildcat Lake processor. It comes with 8GB of LPDDR5X memory and a 256GB SSD. HP also offers Core 5 320 configurations with up to 16GB of memory. So, despite the Mac mini-like dimensions, this is better viewed as a compact Windows PC than a direct rival to Apple’s latest desktop.

HP has packed plenty into a very small box

The OmniDesk Mini measures 5.12 x 5.12 x 1.89 inches and weighs just over a pound. For someone trying to free up desk space, that is probably its biggest attraction. HP has still managed to fit a useful selection of ports into the chassis. There are three USB-C ports, two USB-A ports, HDMI 2.0b, Ethernet, and several audio connections. The machine can also support up to three displays.

Storage can be expanded through two M.2 slots, but the LPDDR5X memory is onboard and cannot be upgraded later. Wi-Fi 6 and Bluetooth 5.4 come standard, with Wi-Fi 6E and Bluetooth 5.3 available as an option.

Who should actually buy the OmniDesk Mini instead of a Mac mini?

The bigger problem for HP is sitting only $100 higher up the price ladder. Apple’s M6 Mac mini starts at $899 and comes with 16GB of unified memory as standard. The Core 3 304 puts the base OmniDesk Mini in a much lower performance tier, so the $100 saving comes with a substantial compromise. Even the higher-end Core 5 320 configurations do not really change what this machine is.

I would mainly consider the OmniDesk Mini if Windows is a requirement or if Linux is part of the plan. For anyone comfortable with macOS, not strapped for cash, and willing to wait for the M6 Mac mini to ship, spending the extra $100 looks like the much stronger purchase.

No. Bangladesh’s Gambling Prevention Act, 2026 expressly makes involvement in online or remote gambling and online betting offenses. The law also reaches conduct such as using an online gambling account, making gambling-related financial transfers, certain promotional activity, and specified use of technical infrastructure to support or restore gambling access.

This article explains the published law in general terms and is not individualized legal advice. Actual criminal liability, procedure and sentencing depend on the facts of a particular case and the decisions of the relevant authorities and courts.

The Short Answer: Online Gambling and Betting Are Prohibited

Bangladesh now has a dedicated statute dealing expressly with online gambling rather than relying primarily on a nineteenth-century gambling law or a general cybercrime provision. The Gambling Prevention Act, 2026 was enacted as Act No. 98 of 2026 on July 1, 2026 and took effect immediately.

Section 5 states that a person involved in online or remote gambling commits an offense. Section 6 separately makes involvement in online betting an offense.

The distinction matters because the Act defines online betting broadly. It includes sports betting, live betting, exchange betting, casino betting, virtual betting, fantasy betting and esports betting. Online or remote gambling is also defined broadly enough to include more than simply operating a gambling website.

For example, using an online gambling account and placing an online sports bet are both activities the Act addresses, although the offenses and statutory maximum penalties are not identical.

What Changed on July 1, 2026?

July 1, 2026 was a significant legal transition. Bangladesh introduced a standalone gambling statute and, on the same date, enacted an amendment removing the gambling provision that had appeared in the Cyber Security Act, 2026.

The Gambling Prevention Act replaced the 1867 law

Section 49 of the Gambling Prevention Act expressly repeals the Public Gambling Act, 1867, while preserving specified earlier actions, orders and pending proceedings. The 1867 Act therefore should not be presented as Bangladesh’s current primary gambling statute when explaining the legal position in September 2026.

The change is substantial because the 2026 Act directly defines digital concepts that the 1867 law could not have contemplated, including online gambling accounts, digital gambling platforms, online betting, digital wallets, cryptocurrency and other digital assets.

Cyber Security Act section 20 is no longer the current gambling provision

The chronology is easy to misstate. Bangladesh enacted the Cyber Security Act, 2026 as Act No. 81 of 2026 on April 10, 2026. That law originally contained section 20 dealing with gambling in cyberspace.

However, the current Cyber Security Act records that section 20 was deleted by the Cyber Security (Amendment) Act, 2026. The official 2026 Acts register lists the Gambling Prevention Act as Act No. 98 and the Cyber Security amendment as Act No. 99, both dated July 1, 2026.

An article published before that change may have accurately cited Cyber Security Act section 20 at the time, but that provision should not be presented as the current primary basis for Bangladesh’s online-gambling prohibition.

What Counts as Online Gambling Under the 2026 Law?

The statute does not limit online gambling to running a casino website. Its definitions cover several kinds of conduct involving accounts, platforms, payments and participation.

Using an online gambling account

The Act’s definition of online or remote gambling includes opening, operating or using an online gambling account. It also includes operating online gambling websites, apps, servers or digital platforms and running gambling or betting groups, pages or channels on social media.

That wording matters because the statutory framework is not confined to bookmakers, platform owners or software operators. A person does not need to own the gambling platform for account activity to fall within conduct described by the law.

Casino and sportsbook activity

The Act separately defines online betting as betting conducted online, digitally or electronically on the outcome of a sport, competition, esports event, election, entertainment event or another event in return for money or property.

The listed categories include:

• sports betting;
• live betting;
• exchange betting;
• casino betting;
• virtual betting;
• fantasy betting; and
• esports betting.

The definition therefore reaches more than conventional sportsbook wagers. Casino betting and several newer forms of digital betting are expressly named.

Foreign gambling platforms are not outside the definitions

The definition of online or remote gambling also includes acting as a representative, agent or associate of a foreign online gambling platform. That matters because offshore operation does not place foreign platforms outside the subject matter of the Act.

A foreign gambling licence can regulate an offshore casino in the jurisdiction that issued the licence without changing whether Bangladesh permits residents to participate. Foreign licensing and domestic legality answer different questions.

The reviewed provisions do not create a general exception simply because an operator is based or licensed outside Bangladesh.

Are Deposits, Withdrawals and Crypto Gambling Covered?

Yes. The law connects gambling activity to its financial flows rather than treating account funding as an unrelated step.

The definitions of online or remote gambling include depositing, withdrawing or transferring money for online-gambling purposes. The Act also defines cryptocurrency and digital assets, including cryptocurrency, tokens, virtual coins, value stored in digital wallets and non-fungible tokens.

Section 14 addresses specified gambling-related use of financial systems, including banks, Mobile Financial Services, digital wallets, hawala, hundi and other financial arrangements. Mobile Financial Service, or MFS, refers here to mobile-linked financial services used for storing or transferring money.

The same section covers converting, storing or transferring gambling money or property through cryptocurrency, virtual assets or other digital assets. Section 25 provides that the section 14 offense is treated as a predicate offense under the Money Laundering Prevention Act, 2012.

A predicate offense is an underlying offense that can support a money-laundering case. This does not mean every bank, wallet or cryptocurrency transaction automatically becomes a money-laundering offense. The gambling connection and the elements of the applicable offenses still matter.

In practical terms, a bank, wallet or mobile-payment service being technically capable of processing a transaction does not make the underlying gambling activity lawful.

Does an Offshore Gambling Licence Make a Site Legal in Bangladesh?

No general foreign-licence exception appears in the reviewed provisions of Bangladesh’s Gambling Prevention Act. An offshore licence and Bangladesh legality operate at different jurisdictional levels.

A licence issued in Curaçao, Malta or another jurisdiction may establish that an operator is authorized or supervised there. It does not itself grant permission to customers in every other country.

This distinction is especially important when a gambling website uses its foreign licence as evidence that it is “legal.” That statement may describe its position in the licensing jurisdiction but does not answer whether the relevant activity is lawful in Bangladesh.

Understanding what a Curaçao gambling licence protects requires separating the regulator’s oversight of the operator from the law governing a customer’s location.

Likewise, comparing offshore and local gambling licences helps separate authorization issued in one jurisdiction from permission to offer or use gambling services in another.

What Does the Law Say About VPNs and Mirror Sites?

The Gambling Prevention Act does not establish a general ban on ordinary Virtual Private Network use. Section 12 instead addresses listed technical infrastructure when it is used for specified gambling-related conduct.

A Virtual Private Network, or VPN, routes network traffic through an intermediary server and can conceal or alter information about a user’s apparent network location. A proxy also acts as an intermediary, while the Act defines a mirror site as an alternative domain, copy or republished version of a previously blocked or prohibited gambling website.

Section 12 addresses using VPNs, proxies, mirror sites, hosting, domain services, cloud infrastructure, Content Delivery Networks or other technical infrastructure to operate gambling, conceal gambling information, assist gambling activity, reactivate a blocked gambling platform or use an alternative domain.

Section 23 provides the penalty for the section 12 offense. The qualification matters: saying simply that “VPNs are illegal in Bangladesh” would be broader than what this gambling provision states.

Likewise, the fact that a blocked or unavailable gambling platform can be reached through a mirror or another technical route does not establish legal permission to use it. Technical reachability and legality are separate questions.

A broader explanation of whether a VPN changes gambling legality must therefore distinguish network access from the law governing the underlying activity.

What Are the Penalties?

The Act does not assign one universal penalty to every gambling-related offense. The table below compares several statutory maximums relevant to online activity. These are maximum penalties written into the statute, not automatic sentences.

The official Act should be read for the exact elements of each offense. A statutory maximum is the highest punishment authorized by that provision; it does not mean every allegation or conviction produces that outcome.

Actual liability and sentencing can depend on the facts, evidence, charges, procedure and court findings in an individual case.

Can Gambling Sites or Accounts Be Blocked or Frozen?

The Act provides several enforcement mechanisms, but the existence of those powers should not be confused with proof that they have been used against a particular operator or account.

Section 38 authorizes the government or designated authority to block, remove or prohibit gambling-related websites, applications, servers, domains, IP addresses, URLs, social-media pages, groups, channels and other digital gambling platforms. Mirror sites, clone sites and alternative domains used for gambling activity may also be blocked.

Separate provisions address financial accounts and assets. Section 31 permits an investigating officer, with court permission, to temporarily freeze an accused person’s bank account, MFS account, digital wallet or crypto wallet when needed for an investigation. Section 29 allows a court to order confiscation of specified money, property and digital assets used in or obtained from an offense. Section 39 permits a court to order closure of specified financial accounts used for gambling.

For example, if a betting website suddenly becomes unreachable, blocking is one possible explanation. It would still be incorrect to state that Bangladesh authorities blocked that particular domain without direct evidence.

Likewise, the existence of account-freezing or closure powers does not establish that every gambling-related transaction automatically produces such an order.

What About Advertising, Influencers and Affiliate Links?

The Act also addresses specified gambling promotion rather than focusing only on players and operators.

Section 11 applies to persons and entities including media outlets, digital platforms, influencers, artists, athletes and celebrities when they conduct specified misleading gambling promotion, make false promises of profit, use inducement advertising, sponsorship, affiliate marketing or referral campaigns for gambling purposes. Section 22 sets a maximum penalty of 3 years’ imprisonment, a fine of up to Tk 50 lakh, or both for the section 11 offense.

This does not mean every journalistic mention, academic discussion or neutral reference to a gambling company automatically constitutes prohibited promotion. Whether conduct satisfies an offense depends on the facts and the statutory elements.

The distinction matters for publishers and influencers. A neutral legal explanation performs a different function from material designed to induce gambling participation, promise gambling profits or generate gambling referrals.

Which Law Should You Use for Current Bangladesh Gambling Information?

For the current position in September 2026, the starting point is the Gambling Prevention Act, 2026.

The Public Gambling Act, 1867 remains relevant to historical context and saved proceedings, but the new Act expressly repealed it. Cyber Security Act section 20 is also historical rather than current for this issue because the Cyber Security (Amendment) Act, 2026 deleted that provision on July 1, 2026.

This distinction matters when reading older articles. A page can have been accurate when written yet become outdated after a statutory amendment or replacement.

When evaluating a current claim about Bangladesh online-gambling law, check the publication date, the exact statute and section being cited, and whether a later law has amended, repealed or replaced that provision.

Bottom Line

Online gambling and online betting are expressly prohibited under Bangladesh’s Gambling Prevention Act, 2026. The law reaches more than platform operators: it addresses gambling-account use, online betting, gambling-related money transfers, specified promotional conduct and certain technical methods used to operate, assist or restore gambling access.

The current framework dates from July 1, 2026. The Public Gambling Act, 1867 has been repealed, and Cyber Security Act section 20 should not be presented as the current primary online-gambling offense because that provision was deleted on the same date.

A foreign licence, functioning payment method or technically accessible website does not independently establish that online gambling is lawful in Bangladesh. Anyone facing an actual investigation, charge, frozen account or other legal consequence should obtain advice from a qualified Bangladesh lawyer based on the specific facts.

A casino withdrawal can remain pending because the operator is still reviewing the request, completing verification, checking the payment method, or handling another compliance issue. A rejected withdrawal means that particular payout request did not proceed, but you still need the operator’s specific reason to know whether the problem is verification, payment routing, account rules, or something else.

The useful first step is not to guess how many hours a withdrawal should take. Identify the exact status, find out whether the casino has actually sent the money, and determine who currently controls the next step.

First, identify what the withdrawal status actually means

Withdrawal labels can look similar while representing different stages. There is no universal naming system across online casinos, so use the descriptions below as a diagnostic guide and confirm how your operator defines its own statuses.

For example, a bank cannot trace an external transfer that the casino has not yet sent. Conversely, if the operator confirms that the payment was sent and provides traceable transaction information, repeatedly asking the casino to approve the withdrawal again may not address the actual problem.

Pending or processing

A pending withdrawal generally means the request has not reached its final state. The unresolved step might involve routine internal review, Know Your Customer verification, a payment-method check, a source-of-funds review, or another account or compliance process.

Know Your Customer, usually shortened to KYC, is the process used to establish and verify who owns an account. In Great Britain, the Gambling Commission’s current customer identity verification condition requires covered remote licensees to obtain and verify information including the customer’s name, address, and date of birth before the customer is permitted to gamble. It also says a withdrawal request must not create an additional information requirement that the operator could reasonably have requested earlier, although information can still be requested later where another legal obligation requires it.

Approved or sent

Do not automatically treat “approved” and “sent” as the same event. An operator may use “approved” for an internal decision while “sent” indicates that a payment transaction has moved to the next part of the payment process. Because status terminology differs between operators, ask what each label means on the account you are using.

If the operator says the withdrawal has been sent, ask for the transaction or payment reference appropriate to the method, together with the sending date and destination. The exact reference format varies between banks, card systems, wallets, and payment processors.

A more focused process applies when a casino withdrawal is approved but not received: first establish whether the operator has actually handed the payment to an external provider, then trace that transaction rather than restarting the withdrawal process.

Rejected, declined, failed, cancelled, or returned

These labels should not be treated as interchangeable. A rejected request may reflect an account, verification, or payment decision. A failed payment may instead indicate that an attempted transaction could not reach its destination. A returned payment may have left one system and then been sent back.

Also check what happened to the balance. Rejection of a withdrawal request does not by itself prove that the money has been confiscated. The funds may have returned to the casino balance, remained restricted during a review, or been handled in another way that requires a specific explanation.

The main reasons a casino withdrawal stays pending

A delay becomes easier to investigate once you identify what the operator says it is checking. These causes occur at different stages, so the right response depends on which one actually applies.

Identity or account verification is incomplete

A casino may need to resolve an identity mismatch, unreadable document, outdated address, inconsistent account detail, or another verification issue. That does not mean every document request made after a withdrawal is automatically justified.

For British-licensed remote operators, the current identity-verification rule requires identity information to be obtained and verified before gambling and restricts operators from making a withdrawal conditional on information that could reasonably have been requested earlier. The rule still permits later information requests where another legal obligation requires them.

If verification is the stated blocker, ask which specific item is missing or cannot be verified. Do not repeatedly upload different documents without knowing what problem the operator is trying to resolve. A deeper explanation of casino KYC and source-of-funds checks can help distinguish ordinary identity verification from a separate financial-compliance review.

A source-of-funds or anti-money-laundering review is underway

Anti-money-laundering, or AML, controls are intended to identify and manage risks involving criminal proceeds and other prohibited financial activity. Source of funds refers to where money involved in a transaction came from. It is separate from simply confirming a customer’s identity.

The Gambling Commission’s 2026 risk assessment for remote casinos identifies issues including third-party payment methods, multiple payment methods, fraudulent identity documents, and open-loop payment arrangements among the risks relevant to the British remote-casino sector.

That does not mean a large or delayed withdrawal is automatically suspicious. AML controls are risk-based. The Gambling Commission has also said operators should not continue accepting deposits indefinitely and then rely on AML procedures to frustrate a withdrawal where relevant information should have been sought earlier.

There are circumstances in which an operator may be legally restricted from explaining an investigation in detail because disclosure could prejudice an anti-money-laundering matter. Outside such cases, the Commission says customers should generally be told why a withdrawal has been delayed and, where an operator decides not to process it, the basis for that decision should be explained in its guidance on account withdrawals.

The payment method does not match the account holder

A deposit funded through a payment method belonging to somebody else can trigger ownership and fraud concerns. Examples include a card in another person’s name or a bank or wallet account that cannot be matched to the casino account holder.

The Gambling Commission’s 2026 remote-casino risk assessment identifies use of a third-party payment method that is not in the customer’s name as a risk indicator. Its withdrawal guidance also notes that operators commonly use terms intended to prevent third-party payment methods or third-party funding.

If this is the problem, do not alter documents or create evidence to make the names appear consistent. Ask what ownership evidence the operator legitimately requires and provide it only through the operator’s official verification process.

The payout route cannot be reused

Some operators use a closed-loop payment model, which routes withdrawals and winnings back to the payment method used for the deposit. The Gambling Commission describes closed-loop payment systems as best practice for managing money-laundering risk and says open-loop systems can allow money to move between payment methods in ways that obscure the origin or destination of funds.

This should not be simplified into “every casino must always pay the exact same way you deposited.” Payment-method capabilities, operator rules, and applicable regulation can affect the available payout route. The useful question is whether your requested method is eligible and consistent with the operator’s verified payment policy.

The account or transaction is under review

An operator may review suspected duplicate or linked accounts, possible account takeover, inconsistent identity details, unusual payment activity, or an alleged breach of its terms. A review is not itself proof that the customer committed fraud or another breach.

For Great Britain, the Gambling Commission says an operator investigating a possible terms breach should normally explain that this is the reason for a withdrawal restriction. Where it decides not to process a withdrawal, it should generally provide the basis for the decision unless a legal restriction prevents disclosure.

Why a casino withdrawal can be rejected

A pending withdrawal remains unresolved. A rejected withdrawal has reached a decision or payment outcome that stopped that request in its current form. The next step is to identify which part failed.

Verification failed

The operator may have been unable to verify a document, account detail, payment-method owner, address, date of birth, or another required item. Ask for the failed requirement by name rather than assuming that “KYC failed” explains the problem.

The payment method or account owner does not match

A destination may be ineligible because the operator cannot establish that you control it, because the route conflicts with its payment controls, or because the method cannot accept the requested payout. If the casino proposes another route, verify that route through the operator’s official payment instructions before supplying financial details.

A contractual or promotional condition is disputed

The operator might claim that a promotion, account rule, wagering condition, payment restriction, or another contractual term affects the withdrawal. Read the exact term the operator says applies rather than relying on a generic support message.

For British licensees, a published term is not automatically beyond challenge merely because it appears in the terms and conditions. The Gambling Commission’s current fair and transparent terms condition requires covered operators to use contractual terms and consumer notices that satisfy applicable fairness and transparency requirements and to comply with their terms.

Historical Competition and Markets Authority enforcement also addressed withdrawal barriers including low withdrawal limits, arbitrary identity-verification deadlines, and promotional terms that restricted access to a player’s own deposited money. Those CMA enforcement findings provide British consumer-law context from the 2017–2019 enforcement programme and should not be treated as a universal rule for casinos licensed elsewhere.

A compliance or security review blocks the transaction

A rejected request can sometimes be one step in a broader account process rather than a final decision about the balance. For example, an operator may reject one payout destination while requiring legitimate additional verification. Ask whether the rejection is final, whether the balance remains available, and what process now applies.

The payment itself failed

A withdrawal can also fail after an attempted payout if the destination is closed, cannot accept the transaction type, contains incorrect details, or rejects the payment. In this situation, establish whether the casino actually attempted the transaction and whether the funds were returned.

Casino withdrawal troubleshooting by symptom

When does a delayed withdrawal become a complaint?

There is no defensible universal number of hours or days after which every casino withdrawal becomes improper. Processing rules differ by operator, payment method, jurisdiction, verification state, and whether the transaction has actually left the casino.

A stronger test is to compare the delay with observable facts:

• Has the operator exceeded the processing period it published for that withdrawal method?
• Have you supplied every legitimate item the operator specifically requested?
• Can support identify the exact unresolved stage?
• Has the operator’s explanation changed repeatedly?
• Does the operator claim the payment was sent but fail to provide available information that would allow it to be traced?
• Has a rejected withdrawal left the balance in an unexplained state?

Withdrawal friction is a documented regulatory concern in Great Britain. In a July 2024 publication, the Gambling Commission said withdrawal delays were its largest complaint category and that its Contact Centre continued to receive around 2,000 complaints a year about delayed withdrawals. That is a 2024 regulator figure, not a measurement of complaint volume in 2026.

The same guidance says operators should not create unnecessary withdrawal friction or rely on anti-money-laundering procedures merely to frustrate a withdrawal where relevant information should have been obtained earlier. It also says customers should generally be told why a withdrawal is delayed or not processed, subject to legal limits such as avoiding prejudice to an anti-money-laundering investigation.

How to escalate an unresolved casino withdrawal dispute

Escalation depends on the casino’s actual licence and the jurisdiction governing the account. A complaints process published by one regulator should not be assumed to apply to an operator licensed somewhere else.

Use the operator’s formal complaints procedure first

Submit a concise chronology containing the account identifier, withdrawal amount, request date, transaction ID, current status, relevant verification history, and the outcome you are requesting. Attach only the evidence necessary to establish the dispute.

For Great Britain, the Gambling Commission’s consumer complaint procedure says customers should first complain directly to the gambling business and follow its complaints policy. The business has 8 weeks from receiving the complaint to resolve it.

Use the applicable independent dispute process

For a British-licensed operator, an unresolved eligible dispute may then proceed to an Alternative Dispute Resolution provider. Alternative Dispute Resolution, or ADR, is an independent dispute process outside the operator. The Gambling Commission’s ADR guidance, updated on 15 May 2026, says customers must first go through the gambling business’s own complaints procedure and describes ADR as a free, independent service. It says an unresolved complaint can be taken to an ADR provider after 8 weeks.

The Gambling Commission does not resolve every individual gambling dispute itself, and the British process should not be generalized to every country. Other jurisdictions can use different regulators, dispute bodies, eligibility rules, and complaint deadlines.

Verify which licence actually covers the casino

Before escalating, verify the operator’s gambling licence using the relevant regulator’s own register or another authoritative licensing record. A logo in a website footer does not by itself establish that the domain, company, or account you used is covered by that licence.

Once the regulator and licence holder are confirmed, follow the complaint path published by that authority. If you cannot establish a legitimate licence or company identity, treat the situation as a separate operator-verification or potential fraud problem rather than assuming a conventional licensed-casino dispute process applies.

What not to do while a withdrawal is unresolved

• Do not make another deposit simply to release the withdrawal. Verify any unusual payment demand independently before sending more money.
• Do not falsify KYC or payment-ownership evidence. False documents can create additional fraud and compliance problems rather than fixing the original withdrawal.
• Do not repeatedly cancel and recreate the withdrawal without a specific reason. Doing so can complicate the transaction history and may affect processing.
• Do not send passwords or authentication secrets. Do not give support your password, one-time login code, full card security code, crypto seed phrase, or remote-access credentials.
• Do not ask a bank to trace a payment that the casino has not sent. First establish whether an external transaction actually exists.
• Do not file a false payment dispute to recover legitimate gambling losses. A withdrawal dispute concerns money that should be paid or properly explained, not a way to reverse unrelated valid gambling transactions.

Bottom line

A pending or rejected casino withdrawal is best handled as a transaction-status problem rather than a guessing contest about payout speed. Find the exact stage, identify whether the casino or an external payment provider controls the next step, obtain the specific reason for any hold or rejection, and preserve the records that support your timeline.

If the operator has sent the payment, trace that transaction through the relevant payment route. If the operator still controls the request and cannot resolve or adequately explain it, use the formal complaint process that applies to the casino’s verified licence jurisdiction.

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor.

Researchers at cybersecurity company Gen Digital warn that the security issue is a one-click remote code execution (RCE) flaw.

“We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link,” Gen Threat Labs says.

Sogou Input Method is a popular Windows application that lets users type Chinese characters using a standard keyboard and also offers a custom link handler and a built-in web browser using an outdated Chromium engine.

Developed by Chinese tech giant Tencent, Sogou Input Method reportedly has hundreds of millions of installations in China.

Gen Threat Labs reports that UNC3569 chains three weaknesses in the product:

1. an unvalidated command-line argument injection in the sgbiz: URI
2. an unrestricted URL navigation in a CEF-based webview
3. an outdated, unsandboxed Chromium browser engine

The attack chain starts with the victim clicking a crafted sgbiz: custom URI, causing Windows to invoke Sogou’s biz_helper.exe protocol handler, which passes attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without validating them.

The attacker-injected arguments open Sogou’s skincenter component and instruct its embedded Chromium webview to load an attacker-controlled URL. Sogou does not restrict the URL’s scheme or destination.

In the third stage, a malicious page exploits a known vulnerability in Sogou’s outdated Chromium 80 engine. Because the browser runs without a sandbox and with important web-security protections disabled, the exploit achieves code execution and installs the GrayRabbit backdoor.

In 2024, Google researchers described GrayRabbit as a modular malware family and linked it to UNC3569, a China-based threat actor operating across both the cybercrime and cyber contractor-for-hire ecosystems.

The malware sample that Gen Threat Labs analyzed is a more mature 64-bit variant with an expanded command set and RC4-encoded command-and-control (C2) configuration.

Its capabilities include process execution, opening interactive reverse shells, uploading and downloading files, collecting system and user information, and reflectively loading plugins in the host’s memory.

Gen Threat Labs reported their findings to Tencent on April 9, and the software vendor deployed a fix in Sogou Input Method version 16.3.0.3498, released on April 21.

The patch validates the URL arguments accepted through the protocol handler, permits only HTTPS, and restricts navigation to approved domains related to Sogou and Tencent.

However, the researchers warned that the underlying browser remains outdated and still runs without a sandbox, with many web security protections disabled.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

I’m sad that Reacher season 4 is coming to an end, but thanks to some expert scheduling from Amazon‘s content team, it’s not all bad news.

Just as the popular series’ fourth season comes to a close, its highly-anticipated spinoff Neagley takes its place. Maria Sten reprises her titular role from Reacher‘s first three seasons, and is now working as a private investigator in Chicago. As it happens, she quickly learns that a beloved friend from her past has been killed in a suspicious accident and becomes hell-bent on justice.

Watch Alexander Zverev vs Ben Shelton in the 2026 US Open men’s final as the American takes to Arthur Ashe Stadium in front of his home crowd looking to become the first American man to win a Grand Slam singles title since Andy Roddick at the 2003 US Open.

Zverev, meanwhile, comes into the final on a hot streak, reaching his third consecutive Grand Slam final after winning Roland Garros earlier this year before losing to Jannik Sinner in the Wimbledon final. The top seed made a slow start in New York, needing five sets in each of his opening two rounds, but has since won 13 consecutive sets, including straight-set victories over Botic van de Zandschulp in the quarterfinals and Karen Khachanov in the semis.

The new Apple Watch Ultra 4 is hailed as the “ultimate sports and adventure watch”, but how does it compare to the Samsung Galaxy Watch Ultra 2?

Considering we concluded the Galaxy Watch Ultra 2 to be a “refined, rugged Android smartwatch”, the Apple Watch Ultra 4 has a lot to live up to. 

Although we’re yet to review the Apple Watch Ultra 4, we’ve compared its specs to the Galaxy Watch Ultra 2 below. Read on to see how the two devices compare, and whether you think the Apple Watch Ultra 4 will take the Galaxy Watch Ultra 2’s spot on our best smartwatch list. 

For more on Apple’s latest launch, visit our Apple Watch Ultra 4 vs Ultra 3 and Apple Watch Series 12 vs Series 11 comparison guides. 

Price and Availability

The Apple Watch Ultra 4 will set you back $799/£749, and is available to pre-order now ahead of its launch on September 18.

Advertisement

SQUIRREL_PLAYLIST_10208757

In comparison, the Samsung Galaxy Watch Ultra 2 is available to buy now and has a slightly cheaper starting price of £649/$699. 

Advertisement

SQUIRREL_PLAYLIST_10208649

Apple Watch Ultra 4 only works with iPhone, while the Galaxy Watch Ultra 2 works best with Samsung

One of the biggest deciding factors between the two will depend on your smartphone, as the Apple Watch Ultra 4 is only compatible with iOS while the Galaxy Watch Ultra 2 can only be paired with Android phones. 

However, although the Galaxy Watch Ultra 2 is technically compatible with most phones running Android 10 or later, the device works best when paired with a Samsung Galaxy phone. That means pairing the Galaxy Watch Ultra 2 with a Samsung handset will unlock features like ECG, sleep apnea notifications and blood pressure monitoring.

Advertisement

With that in mind, if you’re sporting another one of the best Android phones, then you should take a look at our best smartwatch and best fitness tracker round-up instead. 

Advertisement

Apple Watch Ultra 4 promises to offer the most accurate heart rate sensing in a wearable

Apple makes big claims when it comes to the Watch Ultra 4 and Watch Series 12. Thanks to the new Health Sensing System that includes new heart sensors, the Apple Watch Ultra 4 promises to conduct the “most accurate heart rate sensing in a wearable”.  The Health Sensing System is fitted with larger LEDs that now measure heart rate every five seconds.

Apple has backed this claim by sharing a study conducted on over 1000 participants, which compared the Apple Watch’s new heart rate sensing accuracy against leading wearables. The result saw Apple Watch provide the highest accuracy across devices.

The Samsung Galaxy Watch Ultra 2 also monitors your heart rate, regardless of whether it’s paired with a Samsung or other Android phone. In addition, the Galaxy Watch Ultra 2 also offers a Heart Health Score that combines information like your activity time, sleep, weight and vascular load to provide you with an easy-to-understand result.

Advertisement

S11 vs Snapdragon Wear Elite

Behind the Apple Watch Ultra 4 is the S11 chip, which is hailed as “Apple’s most powerful wearable chip”. This processor not only ensures the watch runs smoothly, but it also powers the upcoming Audio Intelligence features that are said to arrive later this year. 

Audio Intelligence has three distinct features. Firstly, it can detect loud noises such as sirens, doorbells and even a baby crying and alert users who might not have heard them. Then there’s “Live Rewind” where you can go back 15 seconds in a conversation to catch what someone said and, finally, Siri Recap that gives you an overview of all your conversations you’ve had during the day. 

Advertisement

How useful these tools really are remains to be seen. While the loud noise detection undoubtedly will help those with hearing loss, the thought of being able to scroll through all my conversations at the end of the day feels strange. 

Otherwise, powering the Galaxy Watch Ultra 2 is Snapdragon Wear Elite. Samsung promises that the processor enables the device to launch apps faster and offer smoother interaction than ever. Plus, the processor allows access to Gemini, Google’s voice assistant that’s on board the Ultra 2 – a welcome addition, as we’ve found Gemini to be one of the most useful AI assistants. 

Apple Watch Ultra 4 introduces readiness scores and a health age

A frequently requested Apple Watch feature is a readiness score and a health age, and fortunately Apple has listened to our pleas. When the revamped Apple Health app rolls out later this year (exact date is still TBC), Apple Watch users will receive a personalised health age, that’s based on their VO2 Max levels. 

Advertisement

In addition, Apple will also introduce a readiness score which will analyse recent metrics, including activities, vitals and sleep score, and provides you with a score between 0-10 along with an actionable recommendation: Recover, Pace Yourself, Ready or Go For It. Essentially, the higher your score, the more you’re encouraged to push your body.

Otherwise, the Galaxy Watch Ultra 2’s accompanying Samsung Health app has recently seen a revamp, and now includes a new Vitals section that tracks metrics like your heart and respiratory rates, HRV, skin temperature and blood oxygen level too. However, although the app’s upgrade claims to be AI-focused, we found the insights weren’t as personalised as we’d have liked. 

Advertisement

Apple Watch Ultra 4 promises longer battery life in Low Power Mode

Although neither offer as long a battery life as the likes of Whoop or the best Garmin watches, the Apple Watch Ultra 4 does promise up to a hefty 50 hours in normal use. You can also eke out up to 84 hours when you put the watch in Low Power Mode too.

The Samsung Galaxy Watch Ultra 2 isn’t too far behind either, with a promise of up to 60 hours. 

Advertisement

Either way, both devices offer around two days of use which although is an improvement from older models, still falls way behind many of the best smartwatches.

Early Verdict

The most obvious reason to choose one smartwatch over the other boils down to what phone you have, as the Apple Watch is only compatible with iPhones and the Galaxy Watch Ultra 2 is only compatible with Androids. And remember, although the Galaxy Watch Ultra 2 does support Android phones, it works best specifically with a Samsung Galaxy phone.

Advertisement

Either way, both the Apple Watch Ultra 4 and Samsung Galaxy Watch Ultra 2 are rugged smartwatches that are designed to provide accurate health and fitness tracking. 

We’ll update this versus once we’ve reviewed the Apple Watch Ultra 4.

‘These levels are flashing red warning signals’, says IVCA chairperson Richard Watson.

The Irish Venture Capital Association (IVCA) has raised concerns over the influence of international venture capital funding in Irish domestic companies, as foreign contributions represented 82pc of the total investment in Irish SMEs in the first half of 2026.

“These levels are flashing red warning signals as they represent some of the highest on record and emphasise our over-exposure to overseas investors,” said IVCA chairperson Richard Watson of the VenturePulse survey data published today (13 September).

Global geopolitical instability, including the war in Iran, as well as the significant concentration of US capital in blockbuster AI deals could well impact future international VC investment into Ireland, he said.

Turbulent geopolitical conditions caused a 71pc fall-off in international investment in Q4 last year, leading to a 46pc decline in total funding for the quarter, while contributing to a 23pc drop-off in funding for the year.

The “rollercoaster” year for funding was attributed to an “undoubted Trump effect”, after uncertainty caused by tariffs led to the worst second quarter for 10 years.

Meanwhile, VC funding of AI giants has dominated the global charts in recent years, led by Anthropic and OpenAI – two of the biggest private companies in the world that between them took 43pc of global start-up funding in the first half of 2026.

Smaller deals take a hit

Total venture capital funding into Irish SMEs fell 10pc to €578.4m in the first half of 2026, while the second quarter marked year-on-year growth of more than 200pc to €356.7m. That significant jump, however, is in comparison to the same period last year – which was the worst in 10 years.

Of the more than half-a-billion euros in funding raised by Irish SMEs in the first half of this year, deals of more than €30m grew by 3pc, while all funding brackets under €5m dropped. Comparatively, in the second quarter, deals crossing €30m grew by a considerable 570pc, while there were no deals in the €10m to €30m range.

Two companies – Dublin fintech provider Fonoa and Belfast cybersecurity firm Cloudsmith – accounted for nearly 44pc of the total raised in the second quarter, led majorly by American venture firms.

Other major rounds in Q2 included drone delivery company Manna, which raised €43m; fleet safety tech provider CameraMatics, which raised €49m; and AI space-tech Ubotica.

Smaller deals included women’s health-tech Peri’s €100,000 round and AI accessibility start-up Nexus Inclusion’s €1.5m raise.

The data highlights the “extent to which the dearth of domestic sources of funding is limiting capital formation”, said IVCA director-general Sarah-Jane Larkin.

Life sciences and fintech companies led the way in the first half of the year, both accounting for 26pc of total funding, followed by cybersecurity and software at 14pc each. Meanwhile, AI and machine learning represented 7pc.

“This does not mean we are being left behind in AI,” commented Larkin.

“It is unrealistic to expect a small nation like Ireland to produce the giant platform and frontier AI leaders of the US. But AI is now embedded in the products and services of the vast majority of local VC-backed SMEs.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.