AI AND ML

Copilot’s gurning blob is leaving Voice for a new career in education

Microsoft has yanked Mico from the Copilot spotlight less than a year after unveiling the anthropomorphic assistant intended to make its AI a little less soulless.

As part of Microsoft’s announcement that its consumer and work Copilot applications will merge, the company confirmed that the weird blob thing would shuffle out of Copilot Voice and into Learn Live, a voice-based study mode that guides users through subjects and assignments.

“Mico helped us learn about warmth, expressiveness, and how people want to talk with AI,” Microsoft wrote. “Those learnings are shaping Copilot going forward.”

“Learn is where the character has the most room to grow, with tutoring sessions that give Mico more to react to and teach through.”

As the update rolls out, Mico will no longer be the face of Copilot Voice. Users can still speak to Copilot and receive responses, but will be spared the blob’s gurning.

Mico is only the latest in Microsoft’s long line of anthropomorphic assistants. There was Clippy (or Clippit), which arrived with Office 97 but had been pushed into Microsoft’s desk drawer of doom by the time Office 2007 appeared. Then came Cortana, named after the character from the Halo video game franchise and pitched as a far more intelligent assistant. Microsoft introduced Cortana on Windows Phone in 2014 and brought it to PCs with Windows 10 the following year, before losing interest.

Mico didn’t even last a year as the face of Copilot Voice before Microsoft pulled it from the spotlight, although both the character and its Copilot “brain” live on in Learn Live. In terms of lifespans, it’s easy to compare it to the catastrophic Microsoft Bob, which was launched in 1995, with the last release happening that same year. However, the product lingered a little longer and later resurfaced, hidden as digital ballast on the Windows XP installation CD for licensing and encryption.

Modern digital distribution means that such a second life is unlikely to await Mico. Dave Plummer, the engineer responsible for Bob’s inclusion as an encrypted blob, said: “What’s ultimately important is that while Bob never got to play on the big stage, he always followed the band around and got to ride on the bus.”

Mico hasn’t been thrown off the bus just yet. Microsoft has merely made the blob sit with the schoolchildren. ®

A new Mirai-based modular Linux botnet malware called Evooo1Bot has been targeting internet-facing gateway devices, turning them into SOCKS5 traffic relay nodes.

The malware’s capabilities extend beyond turning devices into proxy nodes and include credential theft, SSH brute-forcing, and launching distributed denial-of-service (DDoS) attacks.

Since at least July, Evooo1Bot has been targeting devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link across various regions by exploiting known vulnerabilities.

“While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities,” Fortinet researchers found.

Newer builds include a separate vulnerability-exploitation module targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx, and vulnerable PHP-CGI installations.

However, Fortinet notes that some of the embedded exploits are not correctly implemented, leading to failed exploitation.

When leveraging an exploit successfully, a script downloads one of the 12 available malware builds that match the host’s CPU architecture, then clears Bash history to wipe traces of the attack.

Evooo1Bot uses encrypted command-and-control (C2) communications over port 443 and performs extensive checks for debuggers, security tools, sandboxes, virtual machines, containers, and honeypots before it launches on the infected device.

Persistence is established through systemd, SysV init, shell profiles, and rc.local, while a cron job attempts to re-download the payload every five minutes.

An interactive shell gives operators direct control over compromised systems, while file-transfer commands support uploads and downloads.

The malware also features a credential sniffer module that monitors ‘/proc/net/tcp’ and attempts to capture HTTP Basic Authentication and Cookie headers.

The SOCKS5 module supports direct listening and reverse-relay modes, allowing attackers to conceal malicious traffic, circumvent geographic restrictions, or potentially access networks through compromised systems.

Fortinet says proxying sessions run independently, and multiple can be opened simultaneously, allowing monetization through residential proxy services if the botnet grows large enough.

The SSH scanner module uses 150 username and password combinations for enterprise-oriented accounts, and performs post-login checks to avoid honeypots.

Finally, the DDoS module that was inherited by Mirai supports 16 flood methods, including UDP, DNS, SYN, ACK, GRE, fragmented TCP, and an HTTP flood with customizable requests.

To defend against botnet malware, keep your IoT devices’ firmware updated, replace default admin credentials, turn off remote access panels, and replace devices when the vendor no longer provides support for them.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

The big picture: The RAM crisis has made the latest hardware so unaffordable that components from four years ago are storming sales charts. AMD and Nvidia have already responded to the demand by re-releasing chips from 2022, and now Intel is poised to follow suit.

Robert Hallock, Intel’s vice president and general manager of enthusiast channel business, recently told Tom’s Hardware that the company plans to continue offering Raptor Lake CPUs, first launched in 2022, for a while longer. Intel, like AMD, is responding to sustained demand for hardware that supports DDR4 RAM.

During a lengthy interview, Hallock noted a spike in demand for Alder Lake and Raptor Lake processors, which have recently become harder to find. While the exec did not mention specific products, he confirmed that the company aims to stabilize and maintain the supply of 10-nanometer chips that support Intel’s LGA 1700 socket “for years to come.”

The comments align with prior rumors that Intel might introduce another refresh for Raptor Lake – the lineup’s third – during the first half of 2027. Tom’s Hardware heard reports on the topic during Computex earlier this year, where at least two motherboard vendors also confirmed plans to increase production of aging LGA 1700-compatible boards to meet rising demand. Intel’s rumored refresh, tentatively dubbed Raptor Lake Next, would exist alongside the DDR5-exclusive Nova Lake.

Also Read: DDR5 vs. DDR4 Gaming Performance Revisited

Surging demand for processors and mainboards that support the supposedly obsolete DDR4 memory is likely due to RAM shortages driven by AI data centers. The price of DDR5 RAM has skyrocketed over the past year, driving PC users to either purchase DDR4 memory at much lower (but still inflated) prices or hold onto the RAM they already have. Raptor Lake CPUs support DDR4 and DDR5 memory, giving buyers the opportunity to upgrade without replacing an entire PC.

AMD has already responded to the situation by re-releasing the Ryzen 7 5800X3D, the CPU that introduced 3D V-Cache in 2022. The ongoing crisis has also turned the modest Ryzen 5 5500 into the reigning budget CPU king. While the company offers better processors at similar prices, such as the 7500F and 9800X3D, they all require DDR5 RAM.

The trend has even affected Nvidia GPUs. While tightening stocks of GDDR7 VRAM have increased the prices of the company’s latest RTX 5000-series graphics cards and delayed the launch of the RTX 5000 Super cards, Nvidia has revived the 12GB RTX 3060, also from 2022, as a temporary substitute.

Sam Altman told a summit of tech interns that two years of college was “the exact right amount of time” for him and that four years may be more than the world now requires. He made the case to an audience whose entry-level pipeline is already being closed by AI.

Sam Altman thinks a degree takes longer than it needs to. Two years at Stanford was “the exact right amount of time” for him, the OpenAI chief said, and staying would have brought “vastly diminishing returns.”

He was talking to tech interns. The remarks came during a surprise appearance at Internapalooza, a networking summit run by investor Cory Levy for students spending the summer in the industry.

“I’ve sort of thought that maybe the way the world has evolved, college just shouldn’t be as long as it is,” Altman said, while allowing that it was “still great to meet people and kind of like live on your own and get to work on projects.”

The audience is what complicates it. TNW has reported that AI is killing the summer internship, the mechanism that has long converted students into employees.

Nor is that only an American problem. A Swiss study found fewer job ads aimed at career starters as automation absorbed the tasks juniors used to be hired for.

Altman’s other advice pointed the same way without meaning to. “You can make a whole startup kind of by yourself in a room with a lot of AI tokens, but not much else,” he said.

Heard from a founder’s chair that is liberating. Heard from an internship, it is a description of a job that might not need filling.

Not everyone reads the trend that way. Adecco’s chief executive has argued that AI is changing jobs rather than destroying them, which is the more optimistic case and not an unreasonable one.

The rest of the session was conventional founder advice. People waste effort trying to be taken seriously, Altman said, though he conceded that enterprise sales was the exception and that he eventually solved it by hiring a 50-year-old.

His own route is worth remembering before anyone acts on this. Altman left Stanford in 2005 to co-found Loopt, which landed in Y Combinator’s first batch and led to him running the incubator, while his mentor Peter Thiel pays $250,000 over two years to under-22s on condition they drop out. As Altman put it himself, “you don’t get to run the experiment twice.“

What we know so far: Cybersecurity researchers have uncovered at least three new vulnerabilities that could potentially allow attackers to gain system privileges even on patched Windows computers. These include a memory configuration chip exploit named “Download more RAM,” a zero-day flaw dubbed “ShieldBreak,” and a “plug and pwn” exploit that could install malware remotely over RDP.

The “Download More RAM” vulnerability, which was presented at the 2026 USENIX Security Symposium in Baltimore, was discovered by researchers from the University of Birmingham and Durham University. It reportedly allows malicious actors to bypass Windows 11 security and gain system privileges without physical access by exploiting the lack of write protection on consumer memory modules.

The vulnerability allows anybody to remotely rewrite the Serial Presence Detect configuration chip that notifies the computer about the amount of installed RAM in the system. Attackers can take advantage of this vulnerability to transmit fake information to the computer, tricking it into believing that it has twice as much RAM installed as it actually does.

The false data tricks the memory controller into mapping additional pseudo-addresses, which overlap with genuine addresses. The aliases allow attackers to create a backdoor into memory by circumventing security and access control mechanisms used by the operating system and the processor.

The vulnerability could potentially allow hackers to re-enable old drivers with known exploits, disable anti-malware software, break into virtualization-based security enclaves, change corporate device management settings, and even bypass kernel-level anti-cheat systems used by video games.

Professor Tom Chothia from the University of Birmingham noted that the attack only requires a script that can be deployed remotely, while previous attacks of this kind required physical access to the machine. He added that major memory brands, including Corsair, G.Skill, and ADATA, ship at least one model line with an unprotected configuration chip in violation of JEDEC guidelines.

Tracked as CVE-2026-23670, the vulnerability has been acknowledged by both Microsoft and Corsair. While Microsoft issued mitigations in its April 2026 update, Corsair has added a feature to its iCue hardware management tool, allowing users to enable write protection on their DIMMs. PC diagnostic app HWiNFO has also added the same feature for non-Corsair users.

There’s also a zero-day vulnerability called ShieldBreak, found by bug hunter Nightmare Eclipse. Tracked as CVE-2026-50656, it’s an elevation-of-privilege vulnerability in Microsoft Defender that can circumvent the RoguePlanet patch and allow attackers to gain system privileges on Windows 10, Windows 11, and Windows Server. However, Microsoft Defender has to be active for the exploit to work.

Finally, security researchers Alejandro Hernando and Borja Martinez have described a new “plug and pwn” attack that exploits Windows’ automatic hardware identification and driver installation process to install signed vendor driver packages with system-level privileges.

Presented at DEF CON 34 in Las Vegas, the vulnerability can be exploited without admin privileges and without a logged-in user. In their proof-of-concept demo, the researchers also showed that the attack can be performed remotely over RDP without connecting any physical USB hardware to the target device.

CYBER-CRIME

Another one bites the dust

Some 1.6 million unique email addresses tied to RingCentral have been leaked online, alongside names, physical addresses, and phone numbers, according to Have I Been Pwned. RingCentral disclosed the breach on July 28 and said “it was the target of a sophisticated social engineering campaign” affecting a “limited portion of RingCentral customers.”

The comms platform said that it promptly responded to the intrusion upon detecting it, “took steps to stop the unauthorized activity,” and immediately launched an investigation into the security incident with help from a “leading third-party forensic firm.”

“We have not seen any new unauthorized activity since taking these remediation efforts,” the company added.

RingCentral did not immediately respond to The Register’s request for comment on this story. We will update it as needed. 

While the company hasn’t named its attacker, notorious data theft and extortion gang ShinyHunters previously claimed it compromised the collaboration platform, according to a post on its data leak site, viewed by The Register. Screenshots of the post also circulated on social media. The crooks claimed they stole more than 623 GB of data, and set a July 30 deadline for RingCentral to pay up – or else the crew would dump the stolen information online.

RingCentral apparently didn’t pay the extortion demand, and ShinyHunters followed through on its threat, posting customers’ details on the internet.

“The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don’t care,” the crims wrote on August 3.

A ShinyHunters spokesperson told us that the group broke into RingCentral by voice-phishing an employee and tricking them into giving the crooks their password.

This same group, which security sleuth Dominic Alvieri says is his “top threat group and probably is for most analysts,” has hacked hundreds of organizations since the start of the year, including education tech firms that provide services for schools and universities along with healthcare-sector organizations. 

Recently, ShinyHunters dumped data stolen from Abbott’s cancer diagnostics business with the leak containing 10.9 million unique email addresses alongside personal and health information.

The crooks claim that they made off with more than 30 million rows of customer information, including more than one million Social Security numbers and 7.5 million dates of birth. More concerning, however, they said the haul includes 22 million-plus rows of client notes containing confidential doctor-patient conversations and health information, and more than 20 million medical-order records containing patient IDs, prescription types, order dates, and refill information.®

Editor’s note: This story was amended post-publication with comment from ShinyHunters.

After long evenings spent designing mechanisms and calibrating movement, a New Zealand engineer named Bruce finished a system that mounts directly onto an ordinary acoustic guitar and turns digital tablature into live string vibration. He calls it MegCell Pulse. Two coordinated robots handle the work of human hands. One presses the strings against the frets. The other plucks them with six individual plectrums. The sound that reaches the room is the actual instrument speaking, complete with the body resonance and the space around it.

Bruce began this project as an engineer rather than a musician, drawing on his skills in naval engineering, composite work, CAD drawings, and automation. In spare hours after his day job he kept asking what would happen if digital music instructions could drive a real guitar instead of a speaker. He spent roughly 6 or 7 years tinkering with the concept and its variants. The majority of the build is completed on a normal 3D printer, with the remaining parts sourced from a basic list that anybody can order. The software translates ordinary digital tablature into a precise timing signal for the actuators, and it does so without requiring special programming for each song.

Sale

Enya NOVA GO SP1 Carbon Fiber 35-Inch Smart Acoustic-Electric Travel Guitar

• WHY CARBON FIBER – Nova Go SP1 is made of carbon fiber composite material, which means it’s impervious to temperature and humidity change. Taking it…
• WHERE THINGS GET INTERESTING – The absolute differentiator of this guitar is that it’s equipped with the SP1 pickup system. It gets you reverb…
• A PRODUCTIVITY WORKHORSE – SP1 pickup system not only allows you to have tons of fun unplugged. But if you plug it into an amp or PA, this Nova Go SP…

After you put the frames onto the guitar, some gears and magnetic actuators begin moving the arms, which is quite cool. The fretting side simply presses each string in the proper location between the frets, while the plucking side strikes individual strings in sequence or all at once, depending on the file you imported. Timing remains fixed to the digital instructions, ensuring consistent performance from one run to the next. All the user has to do is load a tab file and hit play: the robots will do the rest, while the wooden body and strings generate the tone.

One of the most practical applications allows a human to handle only the plucking, leaving the fretting to the machine. A single-handed musician may complete a full arrangement this way, as Bruce has demonstrated in a video where the robot supplies the left-hand section while a person handles the right, which feels rather natural.

There are a few things it can’t do currently, such as not covering the entire fretboard or doing that nice sliding between frets for legato lines, but the limitations are real, and it still covers a large range of pieces if they are first available as digital tablature. The method focuses on accuracy and consistency rather than trying to record every single human flourish, which keeps the performances sounding rather clean.

No finished units are shipped from the factory, but Kickstarter backers receive the complete digital product, which includes STL files for the printed pieces, a detailed assembly guide, control software, and a parts list. The top tier was one hundred dollars. Once printed and assembled, the owner can simply fix or change it at home. That way, the project remains accessible while still allowing the design to grow and evolve in response to user feedback.
[Source]

If you want the best quality out of your Bluetooth audio, it’s worth reviewing some settings.

Understanding Bluetooth codecs

Which Bluetooth codec is best?

sdx15/Shutterstock

How to switch Bluetooth codecs

A woman identified as Jane Doe 4 has joined a lawsuit filed by three Tennessee teenagers against Elon Musk’s xAI over the role the company’s chatbot Grok allegedly played in creating child sexual abuse material.

According to a report in The Washington Post, the woman alleged that her stepfather used Grok to manipulate a photo taken when she was 11 years old to create more than 7,000 explicit images of her. The woman also said that her stepfather was found dead of suicide two days after the images were uncovered in a law enforcement raid.

“Limitless access to these tools is spreading so quickly,” said the woman. “It is taking everyday life and turning it into child sexual abuse.”

The teenagers who’d filed lawsuit accused xAI (now part of SpaceX) of failing to take basic precautions to prevent Grok from being used to create explicit images of real people, including minors. (X was flooded with millions of Grok-generated sexualized images earlier this year.) They are seeking class action status for their suit.

TechCrunch has reached out to xAI for comment.

If you are in a crisis or having thoughts of suicide, call or text 988 to reach the 988 Suicide and Crisis Lifeline.