Attacks leveraging the ‘PolyShell’ vulnerability in version 2 of Magento Open Source and Adobe Commerce installations are underway, targeting more than half of all vulnerable stores.
According to eCommerce security company Sansec, hackers started exploiting the critical PolyShell issue en masse last week, just two days after public disclosure.
“Mass exploitation of PolyShell started on March 19th, and Sansec has now found PolyShell attacks on 56.7% of all vulnerable stores,” Sansec says.
The researchers previously reported that the problem lies in Magento’s REST API, which accepts file uploads as part of the custom options for the cart item, allowing polyglot files to achieve remote code execution or account takeover via stored cross-site scripting (XSS), if the web server configuration allows it.
Advertisement
Adobe released a fix in version 2.4.9-beta1 on March 10, 2026, but it has not yet reached the stable branch. BleepingComputer previously contacted Adobe to ask about when a security update addressing PolyShell will become available for production versions, but we have not received a response.
Sansec reports that in some of the attacks suspected to exploit PolyShell, the threat actor delivers a novel payment card skimmer that uses Web Real-Time Communication (WebRTC) to exfiltrates data.
WebRTC uses DTLS-encrypted UDP rather than HTTP, so it is more likely to evade security controls even on sites with strict Content Security Policy (CSP) controls like “connect-src.”
Advertisement
The skimmer is a lightweight JavaScript loader that connects to a hardcoded command-and-control (C2) server via WebRTC, bypassing normal signaling by embedding a forged SDP exchange.
It receives a second-stage payload over the encrypted channel, then executes it while bypassing CSP, primarily by reusing an existing script nonce, or falling back to unsafe-eval or direct script injection. Execution is delayed using ‘requestIdleCallback’ to reduce detection.
Sansec noted that this skimmer was detected on the e-commerce website of a car maker valued at over $100 billion, which did not respond to their notifications.
The researchers provide a set of indicators of compromise that can help defenders protect against these attacks.
Advertisement
Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.
Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.
Humanoid robots are a thing now, and here’s an interesting research project that explores using one as a form of haptic media. Specifically, using a humanoid robot to move a chair while one plays a VR driving simulator.
Here’s how it works: a Unitree G1 robot sits behind a player’s chair and grasps it with its hands. Spherical markers on the chair help the robot’s depth camera know the chair’s position, and real-time G-force signals fed from the simulator (Assetto Corsa, running on PC) tell the robot how much and in what direction to shift the chair to match in-simulator events.
While a humanoid robot (especially one equipped with articulated, human-like hands) makes for an awfully expensive force feedback chair, this approach is interesting because it specifically explores using an already-existing humanoid robot as a general-purpose device. It sits in a chair, looks with its camera, grasps with its hands, and moves the player’s chair in response to game events; no hardware modifications required.
So how well does it work? Pretty well, apparently! Participants found the synchronized motion feedback accurate and highly enjoyable, although it does seem like there were some rough edges. Some testers reported that the sustained motion and constant vibration were tiring, and in some cases seemed to worsen VR sickness.
Summer is when pools move from being part of the setup to becoming part of everyday life. What starts as a manageable routine quickly turns into regular use, whether it is weekends with family, hosting friends, or simply spending more time outdoors. It is also when maintenance stops being occasional and begins to demand consistency, which is where most systems start to fall short.
Surface debris returns faster than expected, shallow areas remain inconsistent, and steps that were meant to be automated begin to come back into the routine. What looks simple at the start of the season starts to take more time than it should, especially when the pool is being used more often.
Beatbot positions the Sora 70 as a way to remove that friction altogether. Built as a 4-in-1 cordless system, it brings together water-surface cleaning, waterline scrubbing, wall climbing, and floor cleaning into a single workflow that reduces the need for repeated intervention. More than that, it fits into how pools are actually used during the season, making it a practical upgrade for homeowners and a high-value gift for those investing in easier, more usable outdoor living. With the Anniversary Campaign running from May 9 to 25, it arrives at a point where that shift becomes both relevant and easy to act on
A 4-in-1 system designed to replace fragmented pool cleaning
Most robotic pool cleaners still leave gaps in how cleaning is handled. Floors are covered, walls are managed, but surface debris, shallow platforms, and waterline buildup are often left to separate tools or manual effort. That fragmentation becomes more visible with regular use, when no single cycle fully resets the pool and maintenance starts to return in smaller, repeated steps.
Advertisement
Ian Bell / Digital Trends
The Sora 70 is designed to replace that fragmented approach. Its 4-in-1 system brings together water-surface cleaning, waterline scrubbing, wall climbing, and floor cleaning into a single cycle, reducing the need for multiple devices or follow-up passes. Instead of dividing the process, it handles the pool as one continuous environment, which is where most systems tend to fall short.
In practical terms, this shifts the experience from managing individual cleaning tasks to relying on a system that delivers complete coverage in one run. That reduction in manual effort is what makes it a smarter upgrade, and also what allows it to stand out as a more considered purchase for homeowners looking to simplify how their pool is maintained.
Designed to handle the areas most systems miss
In many pools, the challenge is not cleaning the obvious surfaces but reaching the areas that are easy to skip. Shallow platforms, tanning ledges, and multi-level sections often sit outside the effective range of standard robotic cleaners, which leaves parts of the pool inconsistent even after a full cycle.
The Sora 70 addresses this through its dual SonicSense ultrasonic sensors, which allow it to navigate shallow-water zones as low as 8 inches. This enables it to move across varied pool layouts without breaking the cleaning path, maintaining continuity from surface to floor.
That consistency removes the need for manual correction after each cycle, which is where most of the effort tends to go. For users looking for reliable cleaning that holds up through regular use, this is where the system begins to justify itself not just as an upgrade, but as something that delivers ongoing value over time.
Advertisement
JetPulse turns surface cleaning into an active process
Surface debris is one of the most persistent issues in pool maintenance, especially during summer use when leaves, dust, and particles return quickly. Most robotic systems rely on passive movement, collecting debris only when it drifts into range, which often requires multiple cycles to achieve visible results.
The Sora 70 takes a more active approach through its JetPulse system. A twin-jet mechanism generates directed water flow that pulls floating debris toward the intake, allowing it to be captured earlier in the cycle rather than after repeated passes. This shortens the time between cleaning and usability, which matters more during periods of frequent use. Instead of waiting for the pool to settle, it stays ready with fewer interruptions, supporting a setup that is easier to maintain without repeated intervention.
HydroBalance maintains consistent suction across the entire cycle
In many robotic cleaners, suction performance drops as the cleaning cycle progresses, which leads to uneven results and often requires additional runs to fully clear the pool. That inconsistency becomes more noticeable during regular use, when debris accumulates quickly and cleaning needs to be reliable rather than repeated.
The Sora 70’s HydroBalance system is designed to maintain a steady flow throughout the cycle. A center-mounted pump creates a direct, low-resistance path, while a high-efficiency motor sustains 6,800 GPH suction without drop-off. The 6.7-inch intake reduces clogging, and the bottom-hugging design helps retain suction close to the surface being cleaned. This allows debris to be removed in a single pass, reducing the need for additional cleaning cycles and making the system easier to depend on as part of a regular pool routine.
Advertisement
Filtration that supports both routine cleaning and higher-precision results
Alongside debris removal, the Sora 70 is built to handle the difference between visible cleaning and actual water clarity. A 6L, 150-micron debris basket captures leaves, insects, and larger particles during everyday use, allowing longer cycles without frequent emptying and keeping routine maintenance consistent.
When finer particles become more noticeable, particularly during periods of frequent use, an optional 3-micron ultra-fine filter captures dust, pollen, and algae spores that are not always visible during standard cleaning cycles.
By maintaining the same cleaning process while improving the level of filtration, the system avoids adding extra steps while delivering a more refined result. That consistency becomes part of its long-term value, particularly for homeowners who want a setup that continues to perform without added effort, and for those considering a more considered purchase that improves how the pool is maintained over time.
Retrieval that does not interrupt the process
Image used with permission by copyright holder
Retrieval remains one of the most inconvenient parts of robotic cleaning. The process often requires manual handling at the end of each cycle, which breaks the sense of automation. The Sora 70 addresses this through Smart Water-Surface Parking and One-Touch App Retrieval. At the end of a cycle, it rises to the surface and moves toward the pool edge, where it can be accessed without additional effort.
The SmartDrain system releases excess water before lifting, reducing weight and making handling easier. This keeps the experience consistent from start to finish, without reintroducing effort at the final step, which is often where automation tends to fall apart.
Advertisement
Built for longer use, not just shorter cycles
Pool cleaning needs to keep up with usage, especially during summer when the pool is used more frequently. The Sora 70 is powered by a 10,000 mAh battery that supports up to seven hours of surface cleaning or five hours of full-pool cleaning, allowing it to cover up to 3,230 square feet in a single cycle.
Its cordless design removes the need for cable management, improving ease of use in active outdoor environments. This makes it easier to treat as part of a regular setup rather than a task that needs planning, which is where most systems start to feel limiting.
A shift that fits how pools are used through the season
Pool usage changes once the season is in full swing, with expectations moving beyond basic cleaning toward maintaining a space that stays ready without repeated attention. Bringing surface cleaning, walls, and the pool floor into a single system allows the Sora 70 to remove the need for managing separate steps, keeping the overall setup consistent even during periods of regular use without adding to the workload.
That difference becomes more relevant when the decision moves from solving an immediate problem to choosing a system that continues to deliver over time. For homeowners upgrading an outdoor space, the Sora 70 works as a high-value addition that improves how the pool is used without adding complexity. It also translates naturally into a premium, practical gift for pool owners or new homeowners, where the value comes from reducing a recurring task rather than introducing another one.
Advertisement
With Anniversary pricing from May 9 to 25, where it is available at $1,149, down from $1,499, the timing aligns with peak pool use. The shift toward less manual work and a more reliable setup becomes easier to act on, making it a relevant upgrade for the season as well as a considered purchase that continues to deliver beyond it.
Sora 30: a smart upgrade for consistent everyday cleaning
Building on the approach established by Beatbot’s Sora 70, the Sora 30 focuses on the parts of pool cleaning that define everyday use, delivering consistent results without moving into full 4-in-1 automation. It is designed for users who want dependable cordless pool cleaning that reduces manual effort while keeping the system simple to operate.
Its 3-in-1 cleaning across floor, walls, and waterline ensures routine maintenance is handled in a single cycle, with dual roller brushes supporting stable wall climbing and consistent contact across surfaces. The filtration system captures both larger debris and finer particles within the same pass, helping avoid repeat runs, while a runtime of up to five hours allows most residential pools to be cleaned without interruption.
Coverage extends to shallow zones such as steps and ledges, and smart surface parking brings the unit to an accessible point for retrieval, with the fully cordless design removing cable management altogether and making repeated use easier to manage over time.
Advertisement
As part of Beatbot’s Anniversary offer from May 9 to 25, the Sora 30 is available at $699, down from $999, positioning it as a clear step up from entry-level cordless pool cleaning. It works both as a smart upgrade for everyday use and as a practical, high-value gift for pool owners or new homeowners, delivering less work, more pool time, and a setup that holds up through regular use.
AquaSense X: a premium system for low-intervention pool care
Extending beyond the Sora series, Beatbot’s AquaSense X is designed for users who want pool cleaning to operate with minimal involvement, moving from consistent maintenance into a more automated, system-led approach.
It brings complete, all-zone coverage into a system built around advanced pool robotics, combining floor, walls, waterline, and surface cleaning with filtration and water clarification. Automated debris handling reduces the need for manual emptying, while intelligent navigation ensures consistent coverage across the entire pool without requiring supervision, shifting the experience from managing cleaning cycles to relying on a system that runs with minimal input. This makes it particularly relevant for larger pools or setups that see frequent use, where consistency and reduced intervention matter more than isolated cleaning performance.
As part of Beatbot’s Anniversary offer from May 9 to 25, the AquaSense X is available at $3,999, down from $4,250, positioning it as a flagship upgrade within advanced pool robotics. It also works as a premium, high-value gift for homeowners investing in outdoor spaces, delivering less work, more pool time, and a system that continues to perform without constant attention.
Advertisement
AquaSense 2 Ultra: AI-powered cleaning for complex pool environments
Positioned within the premium segment, the AquaSense 2 Ultra introduces HybridSense AI-powered mapping, enabling precise navigation, obstacle detection, and adaptive path planning across complex pool layouts. Its 5-in-1 cleaning system covers surface, floor, walls, waterline, and water purification, while HybridSense AI mapping helps reduce cleaning time by up to 50% through more efficient coverage. ClearWater natural clarification improves water clarity alongside debris removal, and side brushes enhance surface cleaning performance, ensuring that both visible and fine particles are addressed within the same cycle.
Adaptive path planning allows it to navigate multi-level platforms and irregular pool shapes more effectively, while remote control functionality provides flexibility when needed. Once cleaning is complete, the system returns to the pool edge automatically for easy retrieval without manual handling.
Available at $2,649, with $501 off as part of Beatbot’s Anniversary offer from May 9 to 25, the AquaSense 2 Ultra stands out as a compelling premium upgrade for users looking to step into AI-driven pool cleaning. It balances reduced cleaning time, complete coverage, and advanced automation, making it easier to maintain a high-quality pool setup with less ongoing effort.
A more complete way to approach pool care this season
This lineup works because each system is aligned to a clear level of effort reduction. The Sora 70 brings full coverage into a single system. The Sora 30 simplifies everyday cleaning into a more consistent routine. The AquaSense range extends that further into automation and intelligent control.
Advertisement
With the Anniversary Campaign running from May 9 to 25, the decision shifts from comparing features to choosing how much of the process to remove. Whether it is replacing manual cleaning, consolidating multiple tools, or moving toward a more automated setup, the current pricing makes that shift easier to act on now.
For pool owners preparing for the season, or for those looking at a more meaningful, high-value gift, this is a moment where upgrading becomes a practical decision. Whether it is about reducing ongoing effort or making the pool easier to use day to day, the Sora 70 aligns with a simple outcome that defines summer use at its best, less work and more time in the water.
There are probably a few old Fire TV Sticks still plugged into TVs across the country, collecting dust and loading just slowly enough to make you wonder whether it’s time to replace them. According to a proposed class-action suit filed in California, that sluggishness isn’t an accident. The suit alleges that Amazon deliberately ended software support for first- and second-generation Fire TV Sticks without adequately disclosing its plans to do so, effectively pushing functional hardware into early obsolescence and steering frustrated owners toward buying newer models.
The plaintiff named in the suit, Bill Merewhuader, filed in the Superior Court of Los Angeles County, said he purchased two second-generation Fire TV Stick devices from Best Buy in 2018, four years after the company debuted its first Fire TV Stick. Merewhuader said that a few years later, he experienced slower streaming speeds, difficulty navigating menus and long load times.
He eventually was unable to use the device. He purchased new Fire TV Sticks in 2024, according to the filing.
Advertisement
Merewhuader says in the complaint that Amazon intentionally made older devices perform poorly to spur hardware upgrades and “bricked” Fire TV devices “before the expiration of their useful life.”
A representative for Amazon did not immediately respond to a request for comment. Lawyers for the plaintiff said they had no further comment beyond the legal complaint.
Streaming devices are getting older
Popular streaming devices from big tech companies have been around for nearly two decades. Apple debuted AppleTV in 2007, and Roku followed the next year. Google’s Chromecast, which evolved streaming devices from set-top boxes to plug-in dongles, launched in 2013. Amazon followed up the next year with its Fire TV box and plug-in stick, released later in 2014.
As earlier generations of devices from these tech companies age, it’s common for them to lose functionality, as they can’t run newer apps or access certain features. For instance, Apple’s first Apple TV box is all but inoperable today and was eventually replaced with Apple TV 4K streaming boxes.
The filing partly hinges on allegations that Amazon did not inform buyers that Fire TV Stick devices would lose functionality or become inoperable over time, and that the performance of early devices did not match the promises Amazon made in its marketing.
The proposed class action would be open to anyone who resides in the US and who still owns a first- or second-generation Fire TV Stick as of Jan. 1, 2023, or April 1, 2023, respectively.
Password resets are often the first response to a suspected compromise. It makes sense; resetting credentials is a quick way to cut off an attacker’s most obvious path back in.
However, that doesn’t always completely solve the issue. In both Active Directory (AD) and hybrid Entra ID environments, password changes do not immediately invalidate the old credential across every authentication path.
Even a short window is an opportunity that potentially allows attackers to maintain access or re-establish a foothold.
For security architects and IT administrators, this gap has real implications during incident response.
Advertisement
The password reset gap
Windows systems cache password hashes locally to support offline logon. If a device hasn’t reconnected to the domain, it may still hold the previous credential in a usable form. In hybrid environments, there can also be a short delay before the new password syncs to Entra ID.
This means there are three possible states created after a password reset:
1. The user has logged in with the new credential while connected to AD. The cached credential store updates, invalidating the old hash.
2. The user has not logged in to a particular machine since the reset. The old cached credential may still be usable for certain authentication attempts.
Advertisement
3. In hybrid deployments, the password has been reset in AD but the new hash has not yet synchronized to Entra ID. The old password may still authenticate during the password hash synchronization interval.
Verizon’s Data Breach Investigation Report found stolen credentials are involved in 44.7% of breaches.
Effortlessly secure Active Directory with compliant password policies, blocking 4+ billion compromised passwords, boosting security, and slashing support hassles!
Attackers take advantage of cached password hashes with methods like pass-the-hash, where the hash itself is used instead of the plaintext password. If that hash was captured before the reset, changing the password doesn’t immediately invalidate it everywhere.
Limiting that exposure is crucial to defending AD environments. Solutions like Specops uReset enable secure self-service password resets by enforcing end-user ID verification to reduce the risk of reset abuse.
Advertisement
When combined with the Specops Client, uReset can update the local cached credential store immediately on the device where the reset is performed, closing the window where the old hash remains usable on that endpoint.
This doesn’t remove identity drift entirely, but it does reduce exposure at the network edge, where corporate laptops and remote systems are frequently targeted.
Specops uReset
Active sessions
AD authentication is primarily handled through Kerberos tickets, which are valid for a set period of time. If a user or attacker already has a valid ticket, they can continue accessing resources without re-entering a password.
That means an attacker with an active session remains authenticated even after the password has been changed. In some cases, that window is long enough to establish additional persistence or move laterally.
Unless sessions are explicitly invalidated, through logoff, reboot, or ticket purging, access can continue well beyond the reset itself.
Advertisement
Service accounts
Unlike user accounts, service accounts tend to have long-lived passwords, with elevated privileges tied to critical systems. Attackers can expose those credentials through techniques like Kerberoasting or discover them when moving laterally through a network.
Because these accounts are tied to running services, they’re less likely to be reset quickly, especially if there’s a risk of disruption. That makes them a reliable fallback for attackers after an initial access point is closed.
Ticket attacks
As mentioned above, in environments using the Kerberos authentication protocol, access is controlled through tickets rather than repeated password checks. If an attacker can forge those tickets, they don’t need valid credentials at all.
A Golden Ticket attack, made possible by compromising the Kerberos Ticket Granting Ticket account, allows attackers to create valid ticket-granting tickets for any user in the domain. Silver Tickets are more targeted, granting access to specific services without contacting a domain controller.
Advertisement
In both cases, these attacks effectively bypass password changes. Resetting user passwords won’t invalidate forged tickets, and access can continue until the underlying issue is addressed.
Permissions
AD is heavily driven by Access Control Lists (ACLs). If an attacker grants a compromised account (or a new one they control) rights like resetting passwords for other users, they’ve effectively created a backdoor. Even if the original password is changed, those permissions remain.
Furthermore, accounts protected by AdminSDHolder (like Domain Admins) inherit permissions from a specific template. Attackers who modify the ACL on the AdminSDHolder object can ensure their permissions are re-applied every hour by SDProp.
How to ensure attackers are removed
The time between a password reset and it synching across AD and Entra ID is small, typically just a few minutes, which severely limits the opportunity attackers have to exploit the gap. Forcing more frequent synchronizations is also possible, for instance turning on AD Change Notification or manually initiating a Sync to the Entra ID tenant.
Advertisement
However, the gap still exists, and by the time an account compromise is discovered, attackers may have been able to establish additional footholds. If password resets aren’t enough on their own, defenders need to look at fully closing off access.
That starts with invalidating anything already in play. Active sessions should be terminated, and Kerberos tickets cleared by forcing logoffs or reboots on affected systems. For more serious compromises, resetting the KRBTGT account (twice) is often necessary to invalidate forged tickets.
Next comes credential hygiene beyond standard user accounts. Service account passwords should be rotated, especially those with elevated privileges, and any cached credentials on endpoints should be cleared as systems reconnect.
Just as important is reviewing what’s changed in the directory itself. That means auditing:
Advertisement
Group memberships
Delegated rights and ACLs
Privileged accounts and roles
Look for anything that could allow access to be re-established without relying on a password.
For serious breaches, there isn’t a single step that guarantees eviction. It’s a combination of cutting off sessions, rotating the right credentials, and verifying that no hidden access paths remain.
Secure your AD today
Hardening your AD requires every account to be protected by strong passwords, combined with a secure reset process that limits opportunities for abuse.
Specops helps you do both, giving you confidence that password resets strengthen your security rather than introduce new gaps.
Book a demo to see how our solutions can support your identity security strategy.
The surveillance infrastructure tracking American drivers has grown far more sophisticated than most people realize. What began as simple plate-logging technology has evolved into AI systems capable of identifying faces, flagging unusual travel patterns and building detailed movement profiles — all without the knowledge of the people being watched. Companies such as Flock Safety now operate in communities across 49 states, and their data is accessible to thousands of law enforcement agencies, including federal immigration enforcement, according to civil liberties groups. State legislatures are among the few institutions actively writing rules around how these systems can be used, and what those rules say (or don’t say) have real consequences for your privacy on the road.
That raises a large question: What are the best privacy protection laws? I wanted to provide more details for anyone wondering what to support or what their state is currently doing. One challenge is that every state is different, and there’s no clear guide on what privacy laws work and which have flaws.
I spoke to Chad Marlow, senior policy counsel and lead for the American Civil Liberties Union’s surveillance work, to find the best examples. These laws are making the biggest difference in our privacy.
Advertisement
“Collective action, rather than individual action, is required,” Marlow told me. “I would caution that while Flock is the most problematic ALPR company in America, there are many other ALPR companies, like Axon and Motorola, that present serious privacy risks, so switching from Flock to Axon/Motorola ALPRs at best may constitute minimal harm reduction, but it is far from a solution.”
Which of today’s laws are a better solution? This is a “throw everything against the wall and see what sticks” situation. Let’s talk about what’s sticking.
The best laws on the books for limiting new surveillance technology
The details matter when it comes to laws against surveillance.
Advertisement
Lawrence Glass/Getty
Current privacy laws focus on two recent capabilities of local law enforcement: ALPRs, or automatic license plate readers, that can identify and track cars, and drone surveillance equipped with AI cameras. Security companies, such as Flock, are also starting to offer more traditional cameras that can provide live views and track people from the ground.
With AI features like Flock’s “Freeform” technology that let police enter any type of search they like to see what cameras bring up, these are powerful tools, and new legislation is required to address them. Let’s go over several categories of laws that make a difference.
Laws restricting the use of AI detection features
Some of the broadest laws tackle what AI cameras are allowed to do at all. These laws don’t specifically target ALPR cams or drones, but they do limit the searches that police and commercial entities can make.
Illinois has long been the best example of these privacy laws with its BIPA, or Biometric Information Privacy Act that protects personal ID like fingerprints and facial data, and requires written consent if a company wants to use them.
Advertisement
That law is so far-reaching that certain camera features like Google Nest’s Familiar Faces technology is completely blocked in Illinois, along with some of Flock’s recognition features. Cities can pass similar legislation, too: Travel to Portland, Oregon and you’ll find that certain facial recognition features won’t work there, either.
The one issue with laws like these is that they don’t include license plate and vehicle data, at least not yet. That information, which is closely tied to your name and address, needs to be protected by additional legislation or added onto existing biometric laws. So far, the former is more common: California is the only state I’ve noticed that now includes ALPR data as “personal information” for its privacy laws.
Laws that ban what details police cameras can see
States are also passing new types of laws that allow the use of ALPR cameras, but ban those cameras from being able to record and pass along personal information, or at least make that information confidential in some way — including Florida and New Hampshire.
These laws can ban cameras from seeing details like the people inside a car, for example, limiting them only to a license plate. Companies like Flock advertise the ability of their cameras to notice other descriptive details above a vehicle such as bumper stickers or roof racks, so laws like these can hamper the use of such AI detection.
Advertisement
In a related note, states may add stricter authorization steps for police cameras. For example, rules that require the police chief to sign off on any search using ALPRs make it less likely that the data is misused when collected.
Police have free reign over AI searches unless constrained by laws and policies.
EvgeniyShkolenko/Getty
Laws that limit the use of ALPRs to certain police activities
A number of states have created laws that allow the use of license plate and AI cameras, but only for specific purposes, such as ongoing investigations involving a murder or kidnapping. Some states have very strict limits on how these cameras can be used, while others have much broader descriptions.
Advertisement
Laws like these keep ALPR cameras out of the hands of businesses, HOAs and similar organizations, who would otherwise be able to contract with companies like Flock Safety. They may also block cameras from being used in certain areas, such as on public highways.
Laws requiring that any data collected by cameras be deleted within a certain timeframe
One of the most effective surveillance laws for protecting privacy is the requirement to delete any footage caught by these cameras unless its actively being used in a confirmed investigation. That means police can’t make unauthorized searches or share that data with outside organizations after a certain time.
Laws like these also prevent police departments from creating long-term files about people they want to keep an eye on and note their routines and behaviors. As Marlow said, “The idea of keeping a location dossier on every single person just in case one of us turns out to be a criminal is just about the most un-American approach to privacy I can imagine.”
New Hampshire has the most stringent laws here, requiring the collected data to be deleted within 3 minutes if not used, a far shorter timeline than most, but one the ACLU agrees with.
Advertisement
“For states that want a little more time to see if captured ALPR data is relevant to an ongoing investigation, keeping the data for a few days is sufficient,” Marlow told me. “Some states, like Washington and Virginia, recently adopted 21-day limits, which is the very outermost acceptable limit.” Marlow warned that the longer police keep this data, the easier it is to build patterns of life “that can eviscerate individual privacy.”
I’ve also seen states with laws that require ALPR data deleted after several years, but at that point it’s largely useless, as the data could easily be compiled and moved to other platforms by then.
Laws banning police from sharing data outside of the state
States like Virginia and Illinois have passed laws making it illegal to share any ALPR or related data outside the state, including with federal agencies. These laws are typically targeted at the Department of Homeland Security and ICE, which (along with the FBI and other agencies) have been known to request data from local police Flock cameras or be granted backdoor access to Flock search systems.
Laws that keep data from going out of state prevent that — as long as there are ways to track data transmission and enforce the law — which is difficult. “Ideally, no data should be shared outside the collecting agency without a warrant,” Marlow said, “But some states have chosen to prohibit data sharing outside of the state, which is better than nothing, and does limit some risks.”
Advertisement
States like Minnesota have also added requirements to make ALPR searches public so that citizens can check what searches the police have made, an important step for accountability that’s still rare for this technology.
State laws are on the rise to limit the use of surveillance drones, too.
picture alliance/Contributor/Getty
Laws requiring state approval and office certifications for any ALPR camera
There’s another option to manage these high-powered cameras — subject them to an approval process by the state before contracts and installation. The tricky part is that approval process can look completely different depending on the state.
Vermont, however, enacted a series of laws to create a lengthy approval process to ensure ALPR cameras could only be used in certain circumstances and that the data was tightly controlled. This approval process was so thorough that local organizations decided to pass altogether: By 2025, no law enforcement agency in the state was using ALPR cams.
Laws requiring warrants before launching surveillance drones
In the past year, I’ve seen a new concern on the rise in neighborhoods in addition to ALPR cameras. There are now surveillance drones equipped with cams that can recognize vehicles or human features (beards, hats, shirt colors and so on) and follow people automatically. Those have required a further set of laws to address.
States including Alaska, Idaho, Utah and Texas have laws specifically requiring a warrant before drones are used for surveillance. Technically, this should prevent the use of Flock’s automatic drone launches for things like gunshot detection or 911 calls, but local law enforcement appears to have found ways around these laws due to exemptions and other loopholes.
Advertisement
It’s worth noting my state nearly nuked its drone warrant requirements with new legislation in 2025, which ultimately failed to pass, a reminder that the rules are always up for change.
Keep an eye on the legislation in your state
State legislation can change, be repealed or added onto — and the details are important.
John Elk/Getty
New laws are subject to frequent challenges, including companies such as Flock or local police departments outright ignoring them. That requires extensive legal action to address and a buildup of case law that can take years, not mention methods of investigation and enforcement by the state that may not currently exist.
Advertisement
Proposed legislation can also be subject to many changes, even if it’s likely to be passed, so the details can shift. That means if you want to see specific bans or privacy requirements in your state, you should track ongoing legislation as it passes through approval stages, and continue to contact your senators and representatives.
If you’re not sure what’s in a law, it’s important to read it carefully or find analysis by a legal expert to learn more. Many lesser laws I didn’t include on this list have lots of carveouts, exceptions and latitude in how surveillance cameras can be used, rendering them fangless for privacy purposes.
But that’s not all you can do. I’ve also seen the rise of advocacy initiatives like The Plate Project from the Institute of Justice that you can join, contribute to or just read up on to do more. And don’t forget about the local level — voicing concerns at a city council forum could help limit surveillance contracts before they even begin.
BNP Paribas, Deutsche Bank and JPMorgan have the mandate. Maturities run from three years to 25 years.
The trade follows Alphabet’s record Swiss issuance in February and Amazon’s $37bn dollar deal in March, and is the latest demonstration that hyperscalers are now multi-currency borrowers.
Amazon is preparing its first-ever Swiss franc bond issuance, Bloomberg reported on Monday, in a six-tranche deal that stretches across three-, five-, seven-, ten-, fifteen- and twenty-five-year maturities.
BNP Paribas, Deutsche Bank, and JPMorgan have been mandated to run the books. Amazon has not yet disclosed the size of the trade; pricing is expected later this week.
The trade is the most visible sign yet that the largest US hyperscalers have crossed a threshold in their funding strategy. A US dollar bond programme is no longer sufficient on its own.
Advertisement
The capital required to fund AI infrastructure has become large enough that Big Tech treasurers are now actively diversifying into euros, sterling, and Swiss francs, often within the same multi-currency programme, to broaden their investor base and to capture pockets of demand that the US market alone cannot satisfy at acceptable rates.
Amazon’s path into the Swiss market follows a well-trodden one. Alphabet sold more than CHF 2.75bn (roughly $3.6bn) across five maturities in February as part of a multi-currency drive that included sterling, euro, and a rare 100-year US dollar bond.
That Swiss tranche was the biggest-ever corporate bond sale in the Swiss market. Caterpillar and Thermo Fisher Scientific have both used the same market in the past eighteen months.
What Amazon adds to that list is scale: with roughly $200bn of capex planned for 2026 according to CEO Andy Jassy’s recent comments, the company’s incremental funding requirement runs to multiple tens of billions per year.
Advertisement
Six tranches across the Swiss curve is consistent with a treasurer trying to lock in long-duration capacity rather than to fund a specific project.
On 10 March, Amazon raised about $37bn across eleven tranches in the US bond market. That trade was followed shortly afterwards by a EUR 14.5bn deal split across multiple tenors.
The combined dollar-and-euro raise was, at the time, the largest single funding event in the company’s history. Demand on the dollar trade was reported to have run roughly four times the size sold.
Pricing on the long end came inside Treasury yields by margins that would have been inconceivable for the company a decade ago.
Advertisement
The Swiss franc issuance now extends that pattern into a third currency and a market structure where issuance costs typically run materially below dollar equivalents for similarly-rated borrowers.
The arithmetic behind the issuance is straightforward. Amazon Web Services is growing AI-related revenue at the high end of the hyperscaler range, but the capex required to support that growth is sufficiently lumpy that the company has chosen to pre-fund a significant share through long-duration debt rather than to draw down cash reserves.
That choice is being made simultaneously by Alphabet, Microsoft, Meta and Oracle. Combined hyperscaler debt issuance ran past $121bn in 2025 and is on pace to top that figure by mid-2026; the $650bn of combined Big Tech AI capex now planned for 2026 is the operating-budget number that explains the funding-side urgency.
Investor reception of these trades has been consistently strong. The four largest US hyperscalers all retain credit ratings in the AA range, which gives them access to the deepest pools of institutional fixed-income demand at margins that no private-market financing structure can match.
Advertisement
The largest 2025 trades were oversubscribed by margins that would have looked unusual in any other sector; Amazon’s March dollar trade ran roughly 4x covered.
The Swiss franc market is smaller in absolute terms (the all-currency corporate market clears around CHF 60-70bn a year by Refinitiv tracking), but the rate environment, with Swiss yields running materially below US dollar and euro equivalents, makes it commercially attractive for issuers whose absolute funding needs can be split across currencies.
The currency-strategy logic is genuinely diversification rather than yield optimisation. A multi-currency programme reduces dependence on any single investor base, gives a treasurer flexibility about which tranches to access in periods of regional volatility, and lengthens the average maturity profile by tapping markets where long-duration demand is particularly deep.
Amazon’s choice of a 25-year tranche at the long end of this Swiss deal is consistent with that strategy. Three, five, seven and ten-year tranches give the company belly-of-curve flexibility.
Advertisement
The fifteen and twenty-five-year pieces match insurance and pension demand that is harder to source in equivalent size in dollars.
The wider question, which the cleaner trades of the past three months have made more rather than less acute, is how long the supportive funding environment lasts.
Hyperscaler bond issuance has been running at a pace that even bullish analysts had not modelled at the start of 2025. Morgan Stanley and JPMorgan have estimated that the sector may need to issue as much as $1.5 trillion of additional debt over the coming several years to fund the AI build-out at planned pace.
That figure assumes capex continues to grow on its current trajectory; if AI revenue growth lags those expectations, the credit metrics underpinning the AA ratings could come under more scrutiny.
Amazon’s specific position remains comfortable. The company generated approximately $100bn of free cash flow in fiscal 2025 against group capex of about $80bn, with the gap funded from existing cash reserves and incremental debt.
AWS’s operating margins have stayed above 30%, the highest in the segment. The credit spread on Amazon’s recent dollar issuance was in line with that of higher-rated peers, and the Swiss franc trade is expected to price comfortably inside the broader US dollar curve.
Amazon’s current programme is, in dollar terms, several multiples of that size and is unlikely to be the largest such trade for very long.
What the Swiss issuance does not yet answer is whether AI revenue scaling will eventually justify the issuance pace.
Amazon’s bond investors are taking the company’s AWS-plus-retail combined cash-flow profile as collateral for the AI build, not the AI revenue itself, which remains too early in its monetisation curve to support credit metrics on a standalone basis.
That is the same bet Alphabet, Microsoft, and Meta are asking their bond books to take. The premise has worked through 2025 and into 2026.
Advertisement
Whether it works through to the back half of the decade depends on what AWS, Google Cloud, and the various large-language-model product lines deliver in revenue over the same window.
For now, the Swiss tranche prices when it prices, and Amazon adds a fourth jurisdiction to a treasury programme that increasingly looks more like that of a sovereign issuer than a corporate one.
The company has yet to issue in yen. On the current trajectory, that is a question of when rather than whether.
The New York Times is betting that the Wordle craze isn’t over yet. On Monday, the Times announced that it would be turning the hit mobile word game into a televised game show on NBC.
“Today” show anchor Savannah Guthrie will host the affair, while The Times and “The Tonight Show” host Jimmy Fallon will both serve as production partners. Guthrie and Fallon announced the news on the 8:00 AM broadcast of the “Today” show on Monday, where they shared that the game show had been in development for the past two-and-a-half years.
The show, which will begin airing on NBC next year, is being described as “fast-paced” and a “great family game.” That sounds a bit different from the mobile game, which often requires long periods of thought where users work through the possible choices.
This will be the first time that The Times has collaborated with a TV broadcaster for an entertainment-based program, representing yet another shift in the media company’s pivot to build a sustainable digital subscription business as print revenue continues to decline.
Advertisement
Wordle began its life as a popular online word puzzle game after being released in October 2021 by Josh Wardle, a software engineer in Brooklyn. In January of the following year, The NYT acquired the title for its growing games business, almost immediately bringing “tens of millions” of new users to the New York Times. As of last year, NYT Games says that users played more than 11 billion puzzles across all its games over the course of the year, up from 8 billion in 2023.
NBC will start shooting episodes of the game show this summer and is currently looking for contestants.
Wordle, the New York Timesword puzzle sensation, is coming to your TV screen. NBC has greenlit a primetime game show based on Wordle, set to be produced by Jimmy Fallon’s Electric Hot Dog, Universal Television Alternative Studio and The New York Times. The group is promising a “fresh, fast-paced” format for the show, hosted by avid Wordle player and Today Show co-host Savannah Guthrie.
As with the online version, the Wordle game show will focus on solving five-letter word puzzles but will also incorporate a teamwork element. “It builds on the way the puzzle community engages with Wordle every day — solving together, sharing wins, debating strategies and cheering one another on,” the NYT wrote in a press release. “Now, that style of play comes to life as the most obsessed and competitive players will team up in squads and go head-to-head in the ‘Wordle’ arena, playing for an incredible cash prize.”
The New York Times said it “carefully considered” its partners. It noted that Jimmy Fallon’s production shingle already produces the game shows Password and That’s My Jam, while also bringing a game emphasis to The Tonight Show with bits like “Lip Sync Battle” and “Box of Lies.” Savannah Guthrie, meanwhile, “absolutely loves Wordle and she is also really good at it,” said the NYT‘s Caitlin Roper.
Advertisement
Wordle was created by Josh Wardle, debuted in 2021 and was purchased by The New York Times in 2022. It has already been turned into an official Hasbro board game, VR app and seen numerous unofficial variants. Production for the game show is set to start later this year and will debut in 2027.
We may receive a commission on purchases made from links.
Goodyear hasn’t become a huge name in the automotive and tire world by staying in a single product lane. The company has expanded its operation to include Goodyear products that aren’t tires, as well as a host of different tire options for different seasons, budgets, and performance levels. In terms of basic, all-season commuter tires, two standout names are the widely-available Goodyear Assurance and the Walmart-exclusive Goodyear Reliant product lines. Both are relatively budget-friendly options from manufacturer that promise all-season performance, but it should be said that buying Assurance tires doesn’t necessarily equate to buying Reliant tires, and vice versa.
Advertisement
First and foremost, there isn’t a lot of variety with the Reliant tire line. On the Walmart website, there appear to be different tire types, but these are just size differences intended to support different vehicles. Meanwhile, there are multiple different Assurance tires to consider. A few variants include the standard Assurance All-Season, the ComfortDrive, which promises a quieter, smoother ride in comparison as the name implies, and the road grip and poor weather handling-focused WeatherReady 2. While there are numerous Assurance tires to compare to the Reliant, the most apt and equal comparison is the regular All-Season tire. As far as price, Reliant tires range from around $80 to $200 per tire depending on their size. Meanwhile, the Assurance All-Season is a bit higher of a buy with a $111 to $246 range, which is also influenced by the tire size needed.
When comparing tires, size and options are just two elements to be aware of. More important is their performance, so what do the Assurance All-Season and Reliant tires each bring to the road?
Advertisement
What Reliant and Assurance tires bring to your commute
Looking at their functionality and features, Goodyear Reliant and Assurance All-Season tires bring different things to the driving experience. Starting with Reliant tires, they feature Goodyear’s Aquatred technology to move water while driving for improved traction. They include Goodyear’s patented Decoupling Grooves along the shoulder of the tire to aid in tire heat reduction and improve handling while driving. The tread blocks themselves are also designed to provide strong traction and keep tire wear even throughout the life of the set. They come with a 65,0000-mile limited treadlife warranty. Larger and heavier than the Assurance All-Season, these tires are more suitable for bigger vehicles like light trucks and SUVs.
That brings us to the regular Assurance All-Season. As far as what it’s said to include, it doesn’t use a lot of flashy language or promise Goodyear-specific technology like the Reliant does. It’s said to have wide tread grooves to evacuate water and improve grip while driving in wet conditions, along with edges that flex and “bite” to maintain traction while moving through wet or snowy roadways. The all-season tires’ large shoulder blocks are also advertised as improving handling in wet and dry conditions alike. It also shares an identical treadlife warranty. Overall, it’s positioned to be a “daily driver” tire, ideal for smaller vehicles like family cars.
Visually, the Goodyear Reliant and Assurance All-Season tires don’t deviate much. However, digging into what the company promises from each one, their price points, and their accessibility, it becomes clear how different they really are. Of course, if you’re not impressed by either, there are plenty of budget-friendly Goodyear tire alternatives to consider otherwise.
Robert Walters’ report explores how Ireland’s professionals are managing increasing yet unrecognised workloads.
According to research from Robert Walters, Irish professionals are reporting an increase in work as a result of a growing ‘shadow workload’, consisting of the invisible, non-core tasks employees often undertake alongside their main responsibilities and activities.
Six out of 10 Irish participants in Robert Walters’ study said that in the last year, the remit of their work has expanded, without being officially recognised, acknowledged or accompanied by additional pay or career progression.
In response, professionals are finding themselves in a position where they are now working longer hours (53pc of respondents). Nearly one in five said that they often have to delegate tasks where possible. Only 16pc of those who contributed their data have even spoken to their employer about the sudden spike in workload.
Advertisement
Commenting on the announcement, Suzanne Feeney, the country manager at Robert Walters Ireland, said, “Many Irish organisations are navigating a tougher operating environment right now, facing cost pressures, greater competition for top talent and the need to deliver more with fewer resources.”
Flaming out
In the workplace, when the level of work increases it is often accompanied by burnout, fatigue and general dissatisfaction. The report found that to manage added responsibilities, employers are now turning to AI tools as a means of creating more time. 37pc of Irish workers admitted to using AI tools to handle tasks they typically wouldn’t be able to manage.
More than two in five participants (42pc) explained that burnout at work is a frequent occurrence, while a further 35pc reported it as being an intermittent experience.
“Taking on new responsibilities can be valuable for both individuals and organisations, particularly when it supports growth and capability building,” said Andrew Powell, the chief commercial officer at Robert Walters.
Advertisement
“But if that effort isn’t recognised or managed effectively, it can lead to fatigue and diminishing returns, impacting everything from decision-making to overall productivity.”
Powell advised employers and leaders to keep an eye on how work is being distributed and whether employees are under increasing levels of pressure.
He said, “Addressing workload creep requires having greater visibility of where pressure is building and responding with the right mix of solutions, whether that’s redistributing work, investing in the right tools or bringing in temporary expertise where needed.
“Ultimately, organisations that strike the right balance between efficiency and sustainable workloads will be better positioned to maintain long term performance.”
Advertisement
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
You must be logged in to post a comment Login