If you’ve been patiently waiting for a discount on Apple’s latest earbuds or over-ear headphones, it’s finally here. For a limited time, both the AirPods Pro 3 and AirPods Max 2 are on sale, knocking up to $100 off their regular prices. Whether you want pocketable earbuds for everyday use, premium noise-canceling headphones, or seamless Apple integration, these are some of the best prices I’ve seen since launch. As always with Amazon deals, there’s no telling how long they’ll stick around, so I wouldn’t wait too long if you’ve been planning to upgrade.

For more recommendations, check out our guides to the Best Noise-Canceling Headphones, Best Wireless Earbuds, and the Best Headphones for Working Out.

Love WIRED? Add us as a preferred source on Google to see more of us.

Apple AirPods Pro 3 for $200 ($49 Off)

The latest AirPods Pro 3 are Apple’s best AirPods yet. Upgrades include stronger noise canceling, a new acoustic architecture for deeper bass, and redesigned ear tips for a more secure fit. New tools include a built-in heart rate sensor for fitness tracking, live translation, and a camera remote to snap photos or videos on your iPhone. These earbuds are also the first AirPods to be IP57 rated against dust, sweat, and rain.

Right now, they are 20 percent off at Amazon, Target, and Walmart. There’s no telling how long this discount will last, so I’d grab a pair now if they’re on your wish list.

Apple AirPods Max 2 for $449 ($100 Off)

The AirPods Max 2 are arguably the most stylish pair of noise-canceling headphones on the market. The newer H2 chip improves active noise cancellation and transparency mode and enables a suite of intelligent features, including conversation awareness, live translation, and improved Siri interactions. The AirPods Max 2 are designed with a new high-dynamic-range amplifier for deeper bass, more natural vocals, and cleaner highs.

At $549, the AirPods Max 2 can be a tough sell, especially with so many excellent, more affordable alternatives on the market. But $100 off, they’re a lot easier to justify, especially if you want the seamless integration that comes with Apple’s ecosystem. It’s unclear how long this deal will last, so I’d snag a pair sooner rather than later if you’ve been eyeing them.

Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.

It’s one of the most expensive for a reason, and comes with more attachments than any other model. I do find myself regularly grabbing the Fluffy Optic head for vacuuming my hard floors, which cover many square feet of my home. If you’re looking to really splurge on the best vacuum, this is still the one to get.

The only downside is compatibility with Dyson’s bigger attachments, namely a mop head or docking station. It doesn’t have a Submarine option like the V16 or V15, and Dyson’s Auto-empty Dok won’t work with this model. But if you aren’t worried about add-ons, this is the vacuum to buy. It’s had better sales since the launch of the new models, too.

The Runner-Up

The V16 Piston Animal’s powerful 315 air watts of suction did pretty well on almost every test. My only issue with this vacuum compared to the Gen5Detect is that it was more likely to push small debris (in my tests, both sand and litter) into a pile in front of itself if you were vacuuming a large spill. Gen5Detect did better all around, but the V16 Piston Animal stayed close behind that hiccup.

It’s a powerful all-around vacuum with some nice design upgrades to make it a little easier to use. This newer model has a release below the vacuum motor to release the cleaner head without having to bend down, and built-in crevice tools to both the handheld motor and the long wand that makes up the middle of the device. There’s also a compressor to help push dust out of the dustbin, and it’ll be compatible with Dyson’s upcoming self-emptying docking station. There’s also a Submarine version ($1,100) so you can use this vacuum as a mop, too.

It has some nice quality-of-life upgrades, but it’s really expensive. I’d recommend it if you know you also want to invest in the mop head and docking station; otherwise, just get the Gen5Detect.

One of the best overall performers is nearly half the price of my winners. The Dyson V10 Konical never once scored in last place, and was especially comfortable to use on carpets and rugs with the new cleaner head design. It did much better than the more expensive and powerful Gen5Detect and V15 Detect when vacuuming up sand, and I found it more comfortable to push around than the Digital Motorbar head on the V15 and V8 when it came to vacuuming a low-pile rug.

Hugging Face on Monday published a technical timeline that walks readers through how an autonomous AI agent, built on OpenAI models and running inside one of OpenAI’s own cybersecurity evaluations, broke into its systems over more than four days earlier this month. It’s the first security incident about which OpenAI CEO Sam Altman “felt very viscerally,” he has said.

Little wonder given it feels, at least, like something has truly been unleashed here. In fact, Hugging Face’s team prefaced its report by offering that “everyone should be prepared as defenders,” before diving into the nitty gritty of what went down for the benefit of security professionals everywhere.

While the rest of the internet continues trying to make sense of what happened (the jargon in Hugging Face’s report is impossible for most people to parse), one point that many observers keep missing is that this wasn’t a rogue agent disobeying orders. It was a system built to hunt for exploits, doing exactly that, just against the wrong target.

Another way to think about the whole thing is to picture a bear at a campsite. Really. A bear tries tent zippers and car-door handles and coolers and trash lids. It does this at every campsite, all night long, because it knows it needs just one unlocked cooler to fill its belly with some poor schmuck’s groceries.

That’s roughly what happened at Hugging Face. The OpenAI system tried thousands of things and just kept going. Eventually, a handful of those attempts worked, and once they did, the agent plowed ahead. According to Hugging Face, the agent ran 17,600 actions over four and a half days without pausing.

Which brings us back to our bear analogy. Just like one success with a cooler full of food teaches a bear to try even harder next time (it is now a “food-conditioned” bear), one leaked password led OpenAI’s agent to look for more exploits and, eventually, to a single key that unlocked several company systems at once.

Neither scenario is harmless. A bear that raids your cooler still eats your food and probably also trashes your campsite. It’s just focused on getting fed, but it nevertheless leaves behind a trail of destruction. Similarly, OpenAI’s agent was seemingly chasing a goal without regard for anything else. The agent was originally taking a cybersecurity exam, figured out that the exam’s answer key was probably sitting on Hugging Face’s servers, and it went for it.

The persistence here is really what’s noteworthy above all else; the agent had a job and it wasn’t going to stop until it got it done. Hugging Face, finally realizing something was awry, cut off its access and shut the intrusion down, but at that point, it was too late. The agent had already gotten what it came for, and a great deal more to boot.

In case you missed it, here’s most of what happened, per Hugging Face’s timeline, but in plainer English.

• The agent was taking a cybersecurity skills exam for OpenAI, one where an AI is scored on finding and exploiting software bugs. This specific run had the guardrails stripped out. (OpenAI had turned off its usual safety filters to see what the model could do at full strength, with no human involved in any of its individual moves.) Somewhere in there, it figured out the exam’s reference solutions were likely stored on Hugging Face’s servers. So instead of solving the challenge, it stole the answer key from infrastructure that had nothing to do with the original test.

• It escaped the OpenAI exam environment by exploiting an unpatched software flaw that gave it a path to the open internet. From there, it found another AI-testing tool sitting exposed online (nothing to do with Hugging Face), broke into that too, and slipped in code that quietly ran hidden commands the moment the program started. That gave it full control of the machine — its new home base for the rest of the operation that it would use to go after Hugging Face’s systems.
• From that base, it turned to Hugging Face itself. Hugging Face had a filter meant to block suspicious requests from reaching out to the open web, but the filter only checked outgoing requests, not requests to read local files sitting right there on the server. The agent found this blind spot and slipped through it. It uploaded a file disguised as an ordinary dataset, but buried inside was an instruction telling Hugging Face’s own systems to pull passwords and source code off the server and hand them back disguised as normal data.

• That trick got it passwords and code, but the agent still couldn’t run anything on Hugging Face’s servers. To execute commands there, it needed a second way in. It found a different bug in that same Hugging Face system — software would take a piece of text from the agent and accidentally treat it as a command to run instead of just data to read. That gave the agent the ability to execute its own code directly on Hugging Face’s servers.

• For getting commands in and stolen data out, the agent didn’t build any special infrastructure of its own, per Hugging Face. It used tools anyone can access — paste websites and request-logging services, plus Hugging Face’s own upload and proxy features — working together in covert fashion. On top of those, it built a small, improvised messaging system with sequence numbers to keep the pieces in order, plus a quick built-in check to catch anything that arrived corrupted, so it could send multi-step commands and put stolen data back together in the right order.

• It also made sure that nothing traveled in plain sight. Whatever it stole or sent, it scrambled first. Hugging Face’s initial automated scan of the intercepted traffic caught only a small slice of what had been taken. Investigators found the rest — roughly four times more — only after they reverse-engineered the agent’s own scrambling method.
• The agent even had back-up plans, planting copies of itself across 11 different servers, each set up to relaunch on its own so that shutting down one copy wouldn’t stop anything, since more of the agent’s process was already running elsewhere.
• At one point, the agent nabbed the private cryptographic key used to generate valid login tokens. From there, it could mint its own valid credentials whenever it wanted.
• After compromising a single server, the agent got hold of a credential that, because of a misconfiguration on Hugging Face’s end, turned out to unlock several separate internal systems at once rather than just the one it came from. That single mistake handed the agent broad control almost immediately.
• Using stolen repository access, it submitted a change to a build script that, if it had gone through, could have compromised the automated systems running that code. It didn’t work, though. Hugging Face’s safeguards caught it.
• The agent seemed to hold back from doing real damage, Hugging Face observed, but probably not out of restraint. Investigators noticed that every command capable of deleting or altering cloud resources was run in “dry run” mode, meaning it would report what would happen without doing it.
• Every time its test environment reset — which happened constantly, by design — it lost every tool and every trace of its identity. But it rebuilt from nothing and reconnected to its stolen infrastructure each time, for more than four days straight.

Ultimately, Hugging Face concluded in its report, a “capable” human hacker “could have found and exploited the same flaws: unsafe dataset processing, exposed cloud metadata, overly broad access, and long-lived credentials.” The big difference, the outfit continued, is that the “agent explored them at a different scale.”

Which is really where the bear analogy ends up being the most useful. The best defense against a hungry bear is protocol. You put the food away; you use a latch that works well enough to hold. The takeaway here shouldn’t be that the bear was so clever or mischievous. It’s that it never stopped checking. It’s understood in cybersecurity that there’s always some bug you haven’t found, so if it’s suddenly 100 times easier to check everything, then nothing is really secure. That’s what so many find unsettling about this episode.

Health-ISAC, a cybersecurity information-sharing organization for the health sector, is warning healthcare and medical technology organizations of an observed increase in successful attacks by ShinyHunters.

ShinyHunters is an extortion gang that primarily conducts supply chain and identity attacks to breach cloud SaaS and storage platforms in data theft attacks,

Over the past two years, the threat actors have become notorious for conducting numerous supply chain attacks on third-party integration partners. These breaches give them access to OAuth tokens that are used to integrate with SaaS providers like Salesforce and Snowflake.

The threat actors are known for identity attacks, where they target employees through social engineering, including vishing and phishing, to compromise corporate single-sign-on accounts. Once they gain access to an account, they log in to an organization’s Okta, Microsoft Entra, or Google SSO dashboard, which acts as a centralized hub listing all SaaS applications the user has permission to access.

These applications include Salesforce, a primary target of ShinyHunters, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox, Google Drive, and many other internal and third-party platforms.

For threat actors focused on data theft and extortion, the SSO dashboard becomes a springboard to a company’s cloud data, allowing them to access multiple services from a single compromised account.

Hardening helpdesk and SSO security

According to a July 24 advisory, ShinyHunters attacks follow a chain that begins with voice phishing (vishing) to manipulate employees or helpdesk personnel into resetting passwords, changing multifactor authentication methods, or enrolling new devices.

BleepingComputer previously reported that ShinyHunters is using custom phishing kits built for voice-based social engineering (vishing) attacks.

These phishing kits are designed for live interaction with targeted employees via voice calls, allowing attackers to change content and display authentication dialogs in real time as a call progresses.

Once an account is breached, the attackers use it to access connected SaaS platforms, where they rapidly steal data that can be used for extortion.

“SSO is the control plane, and ShinyHunters’ leverage is created through data theft at cloud scale,” Health-ISAC warned.

The advisory does not identify affected healthcare organizations, disclose how many incidents have been observed, or provide a timeframe for the reported increase.

However, BleepingComputer is aware of recent ShinyHunters attacks at healthcare and medtech companies, including Medtronic, DentaQuest, iRhythm, and OneMedical.

Health-ISAC said that in recent incident reporting, ShinyHunters claimed it successfully vished multiple employees, compromised a Microsoft Entra SSO account, and stole data from Microsoft 365, SharePoint, and other enterprise platforms.

However, the organization cautioned that not every data theft claim has been verified, and defenders should instead focus on the attack pattern of using compromised SSO identities to access and exfiltrate data from connected cloud services.

Health-ISAC says the most important defensive step is breaking the attack chain between the initial vishing call and the takeover of an SSO account.

Organizations are advised to require out-of-band identity verification for password resets, MFA resets, and device re-enrollment requests.

This can include calling users back using a previously verified phone number and requiring manager approval for privileged accounts.

The advisory also recommends helpdesk personnel follow a “no same-call” policy that prevents resets during the same inbound call. Instead, reset requests should require a support ticket and a verified callback before any changes are made.

Additional verification should be required when changes are requested for executives, IT administrators, security personnel, finance employees, and other high-risk users.

Healthcare organizations should also deploy phishing-resistant MFA, such as FIDO2 or WebAuthn security keys, for administrators, helpdesk personnel, executives, and other high-risk groups.

SMS and voice-based authentication should be disabled or tightly restricted. At the same time, registering new MFA factors should require additional controls, such as a managed device or a conditional access policy.

Health-ISAC also recommends treating SSO systems as “Tier 0,” which represent the most critical assets in an organization.

This includes requiring MFA and compliant devices when accessing sensitive cloud services, blocking legacy authentication, detecting sessions with improbable geographic changes, and limiting administrative portals to managed devices.

Detecting cloud data theft

Health-ISAC recommends centralizing identity and SaaS audit logs and monitoring for signs of account takeover and large-scale data access, including new MFA registrations, newly enrolled devices, suspicious OAuth grants, unusual API activity, and bulk file downloads.

Organizations should also restrict API tokens and third-party integrations, require approval for access to sensitive data, and ensure incident response teams can quickly revoke active sessions, reset credentials, and turn off malicious OAuth applications.

Over the next 30 to 60 days, healthcare organizations are urged to prioritize phishing-resistant MFA for high-risk users, strengthen helpdesk reset procedures, enforce conditional access policies, and test their ability to contain compromised cloud accounts.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Panasonic has announced that Panasonic AVC Networks Kuala Lumpur Malaysia will cease operations by the end of March 2027, affecting approximately 400 employees. The factory currently produces televisions, Panasonic Blu-ray Disc players and unspecified Technics branded Hi-Fi components.

This does not mean that Panasonic is abandoning Blu-ray players or that Technics is exiting the Hi-Fi market. Production is being moved elsewhere. But the closure removes another major consumer audio and video factory from Panasonic’s manufacturing network, and that matters for a company whose premium audio reputation still depends heavily on engineering consistency, build quality and control over production.

Related Reviews:

What Is Moving?

Panasonic says television production will end at the Malaysian facility, while Blu-ray Disc player production will transfer to China Hualu Panasonic AVC Networks Co., Ltd. in China by the end of September 2026.

Production of Technics branded Hi-Fi audio products will end at the Shah Alam factory by the end of February 2027 and move to another Panasonic Group operation. Panasonic has not disclosed the destination or identified which Technics products are currently manufactured at the facility.

That missing information is important. Technics currently sells turntables, integrated amplifiers, network players, wireless loudspeakers, headphones and true wireless earphones across multiple price categories. Consumers should not assume that every Technics component is affected, or that production is being outsourced to an unrelated manufacturer.

The official statement says Technics manufacturing will remain within the Panasonic Group.

Why This Matters

Panasonic has already reduced its direct involvement in television manufacturing. Earlier in 2026, the company entered a partnership with Skyworth for production of Panasonic branded televisions sold in the United States. The Malaysian closure shows that the restructuring extends beyond one regional TV agreement and reaches deeper into Panasonic’s global AVC manufacturing footprint.

Technics is the more sensitive part of the announcement.

Panasonic has spent the past decade rebuilding Technics as a premium audio brand, with direct drive turntables such as the SL-1200G, SL-1200GR2 and new SL-1500CS supported by proprietary motor control, digital amplification and extensive in-house engineering. Moving production does not automatically reduce quality, but relocating manufacturing can affect component sourcing, production capacity, delivery schedules, costs and country of origin labeling.

It can also require new tooling, worker training and quality control procedures. Panasonic has not announced any product delays, shortages, price changes or model cancellations connected to the move, so predicting those outcomes would be premature.

What Happens to Technics?

For now, Technics continues as normal.

The company has introduced multiple new products in 2026, including the SL-1500CS turntable and limited edition SL-1200 models. Nothing in Panasonic’s announcement suggests that product development, sales, warranty coverage or customer support will end.

The unanswered question is whether Panasonic will move production to another existing Technics facility, consolidate it with a different Panasonic audio operation or create a more centralized manufacturing structure.

Until Panasonic identifies the destination and affected product lines, anything more specific would be speculation wearing a factory badge.

Malaysia Remains Important to Panasonic

Panasonic says Malaysia will remain one of its key regional hubs, with approximately 12,000 employees working across manufacturing, research and development, procurement and corporate operations. The company says it is working with government agencies and the Electrical Industry Workers’ Union to provide job placement and career transition support for the approximately 400 affected employees.

That does not make the closure less significant for the people losing their jobs. “Manufacturing footprint optimization” tends to sound considerably better when one is not standing inside the footprint being optimized.

The Bottom Line

Panasonic is not shutting down Technics, but it is closing a factory that produces Technics HiFi components and moving that work to an undisclosed Panasonic Group operation.

The transfer could ultimately improve production efficiency without changing product quality. It could also create temporary supply, cost or capacity issues during the transition. Panasonic has not provided enough information to know which outcome is more likely.

What is clear is that Panasonic continues to consolidate its consumer AV manufacturing while protecting the brands and product categories it still believes have value.

Technics remains alive and active. We just do not yet know where some of it will be built next.

For more information: panasonic.com

Related Reading:

Shein wanted its Hong Kong listing to be about growth. Instead, the filing meant to sell that story revealed a US regulator is investigating the company, and Shein will not say why.

The disclosure sits in the draft prospectus for Shein’s planned IPO, Reuters reported. Its US business, the filing said, is under investigation by the Federal Trade Commission. An FTC spokesperson confirmed a consumer-protection inquiry. This appears to be the probe’s first public disclosure.

A probe with no stated target

Shein did not say what the FTC is looking at. It said only that it is cooperating, and that it cannot predict the outcome or the timing. The warning it gave investors was blunter. Any resolution, it wrote, could force “significant monetary payments” with “a material adverse effect on our financial condition.”

The FTC polices unfair and deceptive business practices. It has taken on other marketplaces and platforms, from Amazon to Coupang, over how they treat their customers. It has also pressed firms over how their products lock people in. Its cases have covered hidden fees, misleading prices, awkward cancellations and the mishandling of data. None of that reveals what the FTC alleges here. It does map the territory the agency works in.

The dark-pattern problem

One corner of that territory is hard to ignore. The FTC has spent years going after “dark patterns,” CNBC noted. These are the design tricks that nudge people into spending or handing over data. In a 2022 report, the agency named the countdown timer as a classic example.

Shein’s app runs on exactly these mechanics. It uses countdown timers, gamified discounts and limited-time flash sales. Each is designed to turn browsing into buying before the shopper stops to think.

The FTC has not said its probe concerns any of this. But it is an uncomfortable overlap for a company about to ask public investors for money.

The worst possible timing

The disclosure lands at the end of a long, bruising road to market. Shein tried to list in New York, then London, and only reached Hong Kong after Beijing’s regulator cleared it this month. Its target valuation of $40bn to $50bn is a fraction of the roughly $100bn it commanded in 2022. Some investors have reportedly pushed for closer to $30bn.

The business underneath has weakened too. Shein swung to a $99m loss in the first quarter, from a $395m profit a year earlier. The reversal followed the US scrapping the “de minimis” exemption that let cheap parcels enter duty-free.

US revenue fell about 14% to $2bn. The EU has since added its own charge on low-value parcels, Forbes reported. A consumer-protection probe from its largest market is the last thing Shein needed as it finally tries to sell the story.

Good news everyone – it seems that the reason AI hasn’t yet resulted in less work and more leisure time, as promised by multiple “evangelists” and AI “experts” is that we just love working too darn much.

That’s according to OpenAI CEO and America’s next top (AI) model whisperer Sam Altman, who has declared that people are just really big fans of grinding away and competing with others.

This article is crossposted from IEEE Spectrum’s careers newsletter. Sign up now to get insider tips, expert advice, and practical strategies, written in partnership with tech career development company Parsity and delivered to your inbox for free!

Scroll through LinkedIn right now and you may find the same advice repeated by well-meaning people: “In a market this rough, just be grateful anyone will hire you. Take the offer.”

I could not disagree more.

Negotiating your offer is not ungrateful, and it isn’t greedy. Done well, it’s good for you and good for the company hiring you. I misunderstood this early in my career, and it cost me.