Alibaba says its Qwen models have passed 3 billion downloads, making them the most used open-weight family in the world. The Hugging Face report published a day earlier counts 2,045 million for Qwen this year, and 151,448 derivatives against Alibaba’s claim of more than 300,000.
Alibaba says its Qwen models have passed 3 billion downloads, putting the family ahead of anything from Meta or Google. It is the clearest claim yet that Chinese labs are winning the open-weight race.
The report it rests on says something slightly different. Hugging Face’s State of Open Models, published the day before, counts 2,045 million Qwen downloads this year, or 2,061 million including every repository. The 3 billion figure came from Alibaba’s own emailed statement.
The gap does not change who is first. It does mean the headline number is about a third larger than the platform being cited actually recorded.
The same pattern appears in the derivatives. Alibaba says its ecosystem has produced more than 300,000 derivative models, while Hugging Face counts 151,448 Qwen-based derivatives on its Hub, which is still 2.6 times Meta’s entire footprint there.
This is familiar ground. TNW noted earlier that Alibaba called Qwen3.8 the world’s second-best model and showed no proof.
Hugging Face is careful about what its numbers mean. Downloads measure activity inside its own hub and do not capture API usage, private deployments or models distributed elsewhere, and Alibaba runs its own distribution platform in ModelScope.
None of which touches the direction of travel. “Qwen has become part of the default workflow for developers deciding what models to fine-tune and deploy,” the report says.
The method is volume and reach. Alibaba has open-sourced more than 460 models under permissive licences and pushes them through its cloud into Southeast Asia and Africa, though it has also said it wants to charge the heaviest users of those open models.
American labs are answering in kind. Meta and Nvidia have both shipped new open models in recent weeks, and Nvidia has been explicit that it is chasing China on open weights.
The bigger threat to Qwen’s run may be domestic. Beijing has been weighing curbs on overseas access to the country’s best models, which would take the reach that produced these numbers away.
Welcome back to TechCrunch Mobility — your central hub for news and insights on the future of transportation. To get this in your inbox, sign up here for free — just click TechCrunch Mobility!
Something was in the air this week because we had a heck of a lot of electric aircraft news. Ba-dum-tss.
But really, it’s no joke — two of the bigger deals of the week involved companies developing electric vertical takeoff and landing aircraft (eVTOL). Together they illustrate how the burgeoning sector continues to consolidate and seek out near-term revenue streams even as they go through the lengthy regulatory process to eventually deploy electric air taxis.
In one of the crazier twists in the nascent eVTOL industry, Archer Aviation announced that it now owns its former rival Wisk Aero. Under the terms of the deal, Boeing agreed to sell Wisk Aero and two other subsidiaries to Archer in exchange for an ownership stake in the company. Boeing now holds a 16.5% stake in Archer. The other subsidiaries are SkyGrid, a digital airspace and air traffic management software company, and drone maker Insitu.
For those unfamiliar, Wisk sued Archer in 2021 over allegations of the “brazen theft” of confidential information and intellectual property. The case went on for two years before the companies reached an unusual settlement that not only ended the lawsuit and Archer’s countersuit against Wisk seeking $1 billion in damages, but also led to a new collaboration.
Wisk has taken a rather winding path. It started as Kitty Hawk, an electric aviation startup led by Sebastian Thrun, who co-founded the Alphabet moonshot factory X, and backed by Google co-founder Larry Page. Kitty Hawk shut down in September 2022, but its Cora program, which had spun off into a joint venture with Boeing, lived on. That joint venture was renamed Wisk Aero.
Then there’s Joby Aviation, which made a more predictable deal this week. The company acquired Resonant Sciences for $500 million, marking the electric air taxi developer’s push into the defense sector.
Resonant Sciences, which makes radio frequency and sensor systems, will become a dedicated defense business under Joby aptly called Joby Defense.
Joby has been slowly expanding into the defense sector over the past couple years even as it has pursued its original mission to certify and manufacture electric vertical takeoff and landing aircraft for use as urban air taxis. Joby says it is sticking with its mission, but also sees opportunity — not to mention revenue — in the defense sector.
For the past two years, Uber has been laser-focused on locking up partnerships with, and even investing in, autonomous vehicle technology companies. But this week Uber did the opposite. The ride-hail company sold off its entire stake in Serve Robotics, the autonomous delivery robot company that spun out of Uber more than five years ago.
Here’s the interesting part. According to some little birds, Serve Robotics was surprised by the sell-off and only learned about it when Uber’s regulatory filing was posted. Uber and Serve are still business partners, and that contract, which puts Serve’s delivery robots on the Uber Eats app, is set to expire in 2027.
Got a tip for us? Email Kirsten Korosec at kirsten.korosec@techcrunch.com or my Signal at kkorosec.07, or email Sean O’Kane at sean.okane@techcrunch.com.
Uber is investing in Galgo, a Chilean fintech company that specializes in extending credit to buy motorcycles, Bloomberg reported.
Electric mobility startup Yulu raised $93 million in a Series C round comprising $63 million in equity led by GEF Capital Partners and $30 million in debt financing.
Aurora Innovation and Kodiak AI have received permits from the California Department of Motor Vehicles to begin testing their self-driving trucks on public roads in the state. And Kodiak AI has already started.
Avride said it has surpassed 100,000 autonomous rides on the Uber app in Dallas. There are some caveats here, of course, namely that there is still a human safety operator behind the wheel. Avride wouldn’t supply me with a weekly ridership breakdown, but it has been about two months since the company announced it had reached the 60,000-ride milestone.
Delta Air Lines is investigating a cybersecurity incident in which an unidentified passenger allegedly created a fake Wi-Fi network on a flight, prompting pilots to alert air traffic control.
Flock announced a series of new policies and tools, claiming they will help curb abuse of its automated license plate camera reader systems and help keep its law enforcement customers accountable.
Ford said it’s on track to complete its $2 billion overhaul of its Louisville Assembly Plant in Kentucky, which will use a new assembly system to build its next-generation of EVs, starting with the midsize Fathom truck.
Ground Truth, an art project created to raise awareness about housing affordability in New York, created a gadget that will trigger the brakes on Citi rental bikes, making it harder to pedal through rent-burdened neighborhoods, Wired reported.
Hiroshi Okuda, a longtime Toyota executive who served as president and eventually chairman, died this week, according to the company. Okuda took some big swings during his time at Toyota, notably pushing for the gas-electric hybrid Prius vehicle. Bloomberg has a lengthy writeup on Okuda.
Pony.ai and Uber plan to bring 2,000 robotaxis to four cities in Europe as part of an expanded partnership.
Department of Transportation Secretary Sean Duffy took to X this week to promote the DOT’s effort to recruit video gamers as air traffic controllers. According to Duffy, 2,000 candidates have been hired through this program, although he didn’t say if they were all gamers.
Uber Freight is investigating a cyberattack and data breach that hacking and extortion gang Helix recently took credit for.
Waymo is expanding in California again after the state’s Public Utilities Commission approved terms of its commercial ride-hailing permit. The company’s robotaxis can now commercially operate (i.e., charge for rides) in a broader territory across the San Francisco Bay Area and Los Angeles. The service can also expand to Sacramento and San Diego — although the Waymo folks say this hasn’t happened yet.
Zoox released its safety case framework, a critical document for any company that wants to build trust with the public and show how and why it thinks its technology is safe enough. This framework is particularly important because today there is no federally mandated test, or AV “driver’s license” so to speak.
TechCrunch Disrupt 2026 is just a couple of months away and I wanted to flag one guest who might be interesting to you.
Rivian CEO RJ Scaringe will join me onstage at Disrupt, our annual tech conference that brings together thousands of founders, investors, CEOs, policymakers, engineers, and media. Have a question for Scaringe? Shoot me an email and I’ll take a look.
Disrupt will be held October 13 to October 15 at the Moscone Center in San Francisco.
Check out the programming that’s been announced so far here, and if you don’t already have a ticket, lock in yours before our next price increase on August 22.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
While they do represent a marvel of modern engineering, jet engines ultimately rely on one relatively simple requirement: air. In order to turn fuel to fire, and fire to thrust, a fighter’s engines must ingest, compress, and combust enormous quantities of air. At full power, this could equate to up to 500 pounds of oxygen being ingested per second.
The importance of airflow can be seen across the design principles of every modern fifth-generation fighter. The F-22 Raptor, Su-57 Felon, and J-20 Mighty Dragon all feature large, lateral, twin intakes capable of scooping and driving huge amounts of air directly into the engine. Simultaneously, these intakes are designed to ensure the airflow remains clean. “Clean” air, in the context of air combat, generally refers to smooth, undisturbed, high-velocity airflow entering the compressor. To achieve this, modern jets employ highly sophisticated inlet designs intended to provide a continuous, smooth, and highly compressed airflow.
But beyond that complex realm of air-breathing jet propulsion and the Brayton Cycle, “clean” air also demands consideration in its most literal sense. Dust, stones, fragments of concrete, pieces of metal, and other debris all represent potential foreign object debris, or FOD. This simple detritus exists on all airfields, but if sucked into an engine, can strike compressor blades at extraordinary speeds, causing critical damage or catalyzing cascading failures.
Today’s fighters solve airflow problems brilliantly. But the Mikoyan MiG-29 Fulcrum was also designed to solve the FOD problem. How do you keep a core-airflow turbojet breathing when the runway itself may be trying to feed it gravel? The answer is one of the Fulcrum’s strangest and most ingenious features: intake-covering anti-FOD doors, combined with top-mounted auxiliary air intakes.
The MiG-29 was conceived during the Cold War, being designed to fight on a very different battlefield than the ones modern fighters have evolved on throughout the counterinsurgency era of the past few decades. Soviet planners had every reason to believe that airfields would be among the first targets of a major European war. Runways would be cratered, parking aprons and taxiways would be struck, and instead of carefully swept surfaces, aircraft would be scrambled on runways littered with shattered concrete and metal scrap.
For a fighter expected to operate close to the front, that created a serious vulnerability. FOD is not merely an inconvenience, as a piece of debris entering a jet engine can strike guide vanes or compressor blades, deforming or breaking them. Even apparently minor damage can create an aerodynamic imbalance, reduce efficiency and, in severe cases, catalyze compressor stalls or cascading mechanical failure down the core of the engine.
The MiG-29’s answer was remarkably simple. During takeoff and landing, while the weight-on-wheels sensor was engaged, FOD “doors” would automatically seal off the aircraft’s main ventral engine intakes. Instead, the engines would draw air through auxiliary intakes on the upper surfaces of the wing-root extensions. This kept the primary air source for takeoff and landing away from the debris being kicked up beneath the aircraft.
Once airborne, the main intakes would open and take over. As an added bonus, under some disturbed airflow conditions, such as during a high-angle-of-attack maneuver, the auxiliary intake louvers would flutter as pressure worked against the springs holding them closed, opening a second route for air into the engine as the main intakes struggled against airflow separation or a poor inlet flow angle.
Within the world of technical intelligence, a shift in the threat environment is becoming apparent. Today’s fighter aircraft represent evolution through a strategic era in which air supremacy was often assumed, and asymmetric adversaries did not possess the capability to target rear airbases. Decades of expeditionary counterinsurgency warfare reinforced the belief that fighters would only operate from heavily defended and well-maintained facilities, far beyond the reach of an enemy. Cratered runways littered with combat debris weren’t considered a concern, so mechanical solutions dedicated specifically to FOD protection could therefore be traded away to save weight and allow for more aerodynamically efficient designs.
However, that assumption is beginning to look increasingly fragile in an impending era of symmetric conflict between peer adversaries. Airfields are once again valuable, and reachable, targets. Drones, missiles, and other long-range weapons can turn a previously secure runway into a debris field in minutes. Shrapnel, wreckage, or fragments of concrete, all FOD, are becoming an increasingly likely issue for near-future air operations, and one that no fifth-generation fighter has a genuine solution for.
Even a minor dent, crack, or defect in a compressor blade, guide vane, or other internal component can create stresses and compound issues that propagate downstream. In high-performance air combat, where aircraft components operate close to their limits, that small defect can have immense consequences. In many aspects, a wayward bolt or chunk of tarmac can be almost as dangerous as an adversary missile.
Although the MiG-29’s auxiliary FOD doors may look like an artifact of the Cold War, they were designed around a problem that may be making a comeback. So while the Raptor may be the deadliest thing in the sky, that means nothing if a gauntlet of FOD seals its fate before takeoff.
On both phones, the crease—the point in the display where it folds—looks significantly less obvious and feels better than on prior models, with less of a bump as your fingers swipe across the screen. That’s great, but my biggest design complaint with these Folds is the camera jutting out on the back. It means that whenever you set the phone on any surface, it rocks so much that it’s annoying. A case doesn’t really fix this either. Google’s figured this out with a horizontal camera bar for its Pixels (and so has Apple, apparently).
The Fold8 is immensely nicer to use in every way. I even prefer the way it handles split-screen mode more than the Ultra because things don’t feel super squished on the wide screen. There’s just more breathing room. And it’s nice to have the option to put three apps side by side.
There’s a $200 difference between these two very expensive folding phones, a difference that doesn’t sting as much when you’re dropping two grand. But if you opt for the cheaper Fold8, you will be making some sacrifices from a pure spec-to-spec comparison. Thankfully, there is no sacrifice in performance; the Qualcomm Snapdragon 8 Elite Gen 5 chip is the same on both and delivers a buttery-smooth experience in every app and game.
Battery life is stronger on the Ultra, which makes sense considering its larger 5,000-mAh cell, compared to the Fold8’s 4,800-mAh capacity (marking Samsung’s first devices with silicon-carbon battery technology). But I’ve still been satisfied with both. I’ve been able to hit more than six hours of screen-on time with the Fold8 Ultra, and five to six on the Fold8, though I’m using the larger display far less on the Ultra, so it’s a bit of an unfair comparison. If you prefer the Ultra’s shape and use that inner display more, it’ll suck up more juice than mine did in my testing.
It’s really the camera system where you’re losing out. The Fold8 has a 50-megapixel primary sensor and a 50-megapixel ultrawide, with two 10-megapixel selfie cameras on the outer and inner screens, respectively. The Fold8 Ultra’s 200-megapixel main sensor is stronger overall in a variety of lighting conditions, but it’s the fact that you have access to the 10-megapixel 3X optical zoom that gives it a leg up. I wish Samsung offered a greater zoom option like the 5X optical on the Pixel 11 Pro Fold, and as a big zoom photographer, the lack of this on the Fold8—especially given its high price—is frustrating. Hopefully Samsung can remedy that in the Fold9.
A new information-stealing malware called AmnesiaStealer, which targets macOS users via ClickFix attacks, includes a streaming module that allows the attacker to interactively control the victim’s web browser.
A notable capability is copying the victim’s Chromium profile, including its authentication state, and loading it into a hidden, headless browser on the infected system.
This allows the hacker to access victims’ authenticated sessions while preserving the identifiers associated with the browser, host, and network.
AmnesiaStealer can collect data in 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes and documents, and keychain data.
The malware is currently distributed through ClickFix campaigns that use a fake GitHub download page to drop a password-protected ZIP archive.
Researchers at Jamf, an Apple device management and security company, analyzed AmnesiaStealer’s distribution and found that it used the same template previously used to spread the Atomic and MacSync infostealers.
The ClickFix command executes a shell-script loader that downloads and launches the password-protected archive containing the AmnesiaStealer Mach-O payload.
The malware captures the victim’s macOS password and uses it to collect keychain data, as well as browser profiles, Apple Notes, Telegram sessions, documents, system information, and cryptocurrency wallet data.
The researchers highlight that the malware features a component called stream_module, retrieved using the remote_stream command, which gives the malicious operator remote control over authenticated sessions deployed from a headless browser instance.
According to Jamf, AmnesiaStealer’s stream_module can duplicate user profiles in seven Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium, because they share the same DevTools Protocol, launch flags, and cookie encryption.
The module launches the legitimate browser executable in headless mode with command-line switches that weaken browser defenses, duplicates the victim’s profile, and specifies its location for storing the profile data.
The malware then establishes a WebSocket channel that connects to the operator’s relay and sends a JSON registration message containing the browser name and build.
The operator can then send commands over this channel, such as navigation and mouse clicks, while the malware returns status and tab information as JSON and transmits screencast frames as binary WebSocket messages.
A second WebSocket channel connects to the local headless Chromium instance through the browser’s webSocketDebuggerUrl, providing access to the Chrome DevTools Protocol (CDP).
This allows the hacker to navigate websites with mouse and keyboard control, export or import cookies, and operate online portals using the victim’s existing authenticated sessions.
“The operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation and tab management,” Jamf explains.
“In effect the remote_stream command turns an infected host into a live, operator-driven browser running the victim’s authenticated sessions, which is a materially different level of access from file collection.”
According to the researchers, the AmnesiaStealer can exfiltrate cookies, saved logins, browsing history, bookmarks, extensions, local state, and other profile data from the 16 Chromium-based browsers it targets.
It also steals cryptocurrency wallet details and identifies them by enumerating extensions and IndexedDB data.
Jamf notes that the malware contains a fallback mechanism when it runs on macOS 26 and cannot recover the existing Chrome Safe Storage key, which replaced it with an attacker-supplied value.
This makes previously stored cookies and passwords permanently unreadable while allowing the attacker to decrypt data later.
The Chrome DevTools Protocol (CDP) has been abused by malware in the past, including by Chaos ransomware to hide command-and-control communications, and by Chaes malware to expose browser functions that could enable data theft.
However, AmnesiaStealer appears to be the first documented macOS malware to combine a cloned Chromium profile with CDP-based, live remote control, allowing attackers to interact with authenticated sessions through a hidden browser running on the infected computer.
Users are advised never to execute commands in the terminal that they found online and don’t fully understand.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
We may receive a commission on purchases made from links.
Anker has become synonymous with phone chargers and power banks. It’s one of the most reputable brands and is quite popular in global markets like North America and Europe. The company is headquartered in China and has over 30 offices that operate worldwide. Anker got its start selling replacement laptop batteries on Amazon but quickly expanded into smartphone chargers, cables, and other charging accessories.
A quick search on Amazon for a “power bank” or a “phone charger” is highly likely to yield at least a few of Anker’s products among the top results. The reason Anker is so popular comes down to a combination of quality, consistency, and, most importantly, value. Apple charges $60 for its 35W dual-port USB-C adapter, while Anker sells a 65W 3-port charger for half the price.
The company is currently best known for its high-capacity power banks, such as the Anker 25,000 mAh Power Bank, or its fast charging wall adapters, like the Anker 140W GaN Charging Block. Both of these products have high ratings and thousands of reviews on Amazon, but you’d be surprised to know that Anker’s catalog doesn’t stop at charging accessories for laptops and smartphones. Over the years, the brand has expanded into categories such as smart home accessories, home entertainment, wireless audio, and portable power solutions for outdoor use. Here’s a closer look at a few brands you may not have known are owned by Anker.
Anker has already solved many of the problems consumers faced with expensive, bulky phone chargers and power banks. The next logical step was addressing the battery problem at a much larger scale — home energy. In 2023, the company decided to apply its expertise in power storage and delivery to home energy by launching Anker Solix — a brand dedicated to portable power stations and solar generators.
While some of Anker’s larger power banks can keep a laptop going for a couple of hours, Solix offers solutions for bigger appliances that require a lot more power. Think refrigerators, televisions, and power tools — essentials that are often powered directly from a wall outlet. At this scale, batteries are measured in watt-hours (Wh) and aren’t touted for how many times over they can charge your phone but for how long they can keep larger appliances running.
The Anker 536 PowerHouse is a 508Wh portable power station that uses LiFePO4 (lithium iron phosphate), a composition that offers a higher power-to-weight ratio than traditional lead-acid batteries. Anker Solix also sells home battery systems that are designed to keep your entire house powered during an outage. If you ever decide to install solar panels, Solix has a few solutions for that, too. Despite operating in a more specialized category that requires larger-scale power storage solutions, Anker Solix’s products remain competitively priced. Most of its portable power stations come with a couple of AC outlets, USB ports, and surprisingly fast charging for when they run empty.
Hybrid work setups have grown in popularity ever since the pandemic hit. This helped drive the comeback of better-quality webcams and headsets with microphones that don’t sound like you’re underwater. AnkerWork is the company’s answer to this growing demand. The sub-brand’s portfolio of products is currently not as rich as some of Anker’s other ventures, but there’s not much to complain about here.
The PowerConf C200 Webcam brings a noticeable improvement to your video calls with its 2K resolution and wider field of view. It snaps on top of your monitor, comes with two microphones, and has an adaptive light sensor that adjusts how your image looks based on the ambient light around you. For the security-conscious, the webcam offers a switch that physically covers the camera lens for when you don’t need it. If you don’t like how high your monitor is or simply prefer a different angle, you can grab AnkerWork’s Mini Tripod that can hold a webcam, smartphone, or a dedicated camera.
The company also sells speakerphones that are designed to dramatically improve how you sound to others in meetings, as well as how well you can hear them. The AnkerWork SR500 uses eight microphones to handle audio recording from all directions and a 10W speaker that fills the room with sound. You can connect up to five of these speakerphones if you’re in a larger meeting room with several people.
Eufy may be a name you recognize. It specializes in smart home surveillance and cleaning, with a wide range of security cameras, video doorbells, and robot vacuums to choose from. Anker launched the sub-brand in 2016 as part of its efforts to expand beyond the charging accessories it was known for. Looks like it worked — Eufy’s products generally enjoy positive reviews despite stiff competition in the home automation space.
What Eufy is doing a bit differently in this segment is reducing the reliance on subscriptions. Popular competitors like Ring and TP-Link often require you to subscribe to a monthly plan if you wish to access longer video histories or unlock more advanced features. While this makes the upfront purchase more affordable, the ongoing costs can add up over time. By contrast, the Eufy Indoor Camera that’s priced at $70 doesn’t ask for any monthly fees and instead lets you store your footage locally via its SD card slot.
That said, Eufy’s security controversy in 2022 raised concerns about the company’s privacy claims. The company responded by clarifying how certain features and data flows worked. Eufy continues to make smart home devices, with some of its newer security cameras offering features like motion detection and the option to store your recordings in the cloud. Some of its outdoor security cameras are solar-powered, too. Eufy also ranks quite well among major robot vacuum manufacturers.
Like Eufy, Soundcore is one of Anker’s more recognizable brands. It was officially unveiled as an audio-focused sub-brand in 2018, though Anker had been selling Bluetooth speakers and other audio products for years before that. Today, Soundcore has a decently large catalog of over-ear headphones, wireless earbuds, speakers, and even an AI voice recorder for some reason. Though it’s Soundcore’s affordable range of headphones and earbuds that gets the most attention, the brand does have a couple of premium offerings as well.
The Soundcore Space One Pro headphones retail for $200 and feature support for Hi-Res audio, active noise cancellation, Bluetooth multipoint connectivity, and up to 60 hours of playback time with ANC off. Users generally say good things about Soundcore as a brand, too, with its products punching well above their price range. That said, if you’re looking for a true premium alternative to headphones like the Sony WH-1000XM6 or Apple’s AirPods Max, Soundcore doesn’t operate in quite the same league yet.
You do get an assortment of earbuds here. At $230, the Liberty 5 Pro Max are Soundcore’s flagship true wireless earbuds, featuring an AMOLED display on the case that lets you manage earbud settings in case you loathe having to pull out your phone every time. Soundcore also sells earbuds specially designed for sports and sleep. You have a wide range of open-ear earbuds to choose from, too. Its selection of Bluetooth speakers includes options that are waterproof, portable, or decked out with features like spatial audio and Hi-Res sound.
Having locked down charging accessories, smart home products, and consumer audio, Anker turned to the world of home entertainment with Nebula — a sub-brand focused primarily on delivering portable projectors. Nebula has been making projectors since 2017, but the sub-brand joined Soundcore in 2025. Like some of its other sub-brands, Soundcore Nebula has options at various price points.
The Nebula P1i is the entry point to the lineup, allowing users to project movies, TV shows, and other presentations in up to 1080p, all while being relatively portable. It comes with two 10W speakers that can be flipped around for a more immersive audio experience. You get essentials like auto Keystone correction, a tiny adjustable stand, and built-in support for Google TV so you don’t need to plug in an input source.
Moving up the lineup, you’ll find larger, more capable projectors that can serve as replacements for televisions. Products in Nebula’s Mars and Cosmos series offer resolutions up to 4K, much larger projection sizes, and technologies like Dolby Vision. Besides projectors, Nebula also sells accessories like tripods, carry cases, and projector screens.
Nate Scovill decided the Red Bull slogan needed a proper test. He bought cans of the stuff, cleared space in his workshop, and set out to see whether an energy drink could actually launch something into the air. His recent video walks through three attempts, each more serious than the last, until one of them finally left the ground under its own power.
He started simple, with a can of Red Bull, which included 160 calories and 38 grams of sugar. After drinking it, he attached some cardboard fins to the empty can and tossed it into the air like a smart paper plane. Not surprisingly, the can flew barely a few feet at most. He added up the calories from drinking it as energy consumed and declared the entire thing technically valid, even if it seemed a little like cheating. It made for a humorous start and set the tone for the rest of the project.
The next step was a proper-looking rocket. He took old soda bottles, cut and taped them into a pressure vessel, tacked on some cardboard fins, painted them red, blue, and silver, and created a primitive valve out of a wine cork, heat-shrink tubing, and a soccer ball needle. Nate filled the bottle with liquid, inflated it with a bike pump, and launched it into the woods. It went well until one of the fins snapped off. Nonetheless, the propulsion system was functioning perfectly, with compressed air driving the liquid out the nozzle. In the end, the Red Bull only added weight and color, which wasn’t too bad. So, in spirit, if not in reality, this was a pretty impressive water rocket powered by an energy drink.
The third attempt was when the magic happened. Old-school amateur rocketeers swear by rocket candy, which uses sugar as fuel and potassium nitrate (often sold as stump remover) as oxygen. When properly blended and put into a tube, the mixture produces a tremendous thrust. Scovill reasoned that since the Red Bull already had sugar dissolved in it, it would suffice if he could only get all the other things out of the way.
So he cooked it down in a pot at low heat until most of the water evaporated, leaving a thick syrup. Water is a major impediment to rocket fuel performance, hence this was a necessary step. However, there was still one issue to resolve, since the carbon dioxide remained trapped in the liquid. Bubbles in the mix are a real pain when you’re attempting to get a nice burn going. He solved the problem by putting the reduced liquid in a vacuum chamber and sucking out the gas. Then, using a coffee grinder, he finely ground the potassium nitrate and blended it with the syrup until it was like putty. The final combination was put into little tubes he’d created from rolled up newsprint. To provide some further insurance, he employed a cat litter base as both a safety buffer and an igniting assist. Finally, he created a small control panel with a key switch and a large red button, connected it to a model rocket igniter, and tested three different batches.
The first bunch of rockets refused to move, while the second one caught fire, but the paper tube it was in was so badly wrinkled that the pressure could escape sideways. As a result, flames erupted from the side, melting the outer nozzle, and the rocket sat still on the pad. On the third attempt, this time with a fully degassed syrup, they had it right. When Scovill clicked the ignition button, the motor screamed to life, the rocket jumped off the rail, and for a few seconds, a homemade motor powered by a Red Bull energy drink flew under its own power. To commemorate the occasion, he even created a mission patch.
When the water and gas are removed, the chemistry becomes much more straightforward. When the sugar molecules break down under heat and react with the oxygen released by the nitrate, they form an expanding hot gas that propels the rocket onward. It’s as simple as that, but the true issue is getting the ratio precisely right and keeping the moisture under control. That’s where Red Bull comes in; it’s not 100% sucrose, so determining the proper proportions requires some trial and error. Scovill’s successful motor demonstrated that the overall concept could function even with all of the additional additives contained in a commercial energy drink.
[Source]
When Soundgarden Wrote “Black Hole Sun,” they may have inadvertently been onto something.
In a new paper in Nature, scientists have chronicled a “black hole star” that’s the size of our solar system and glows bright red in the depth of space. The findings are based on observations from the James Webb Space Telescope, which continues to change how astronomers think about the cosmos.
Researchers focused on some of the most distant observable phenomena in the universe, which appear to be something like a star in disguise. Based on the light they emit, they appear to share some characteristics with giant stars, but astronomers suspect they are actually black holes shrouded in an extraordinarily dense and luminous gas.
These hypothetical objects have been dubbed black hole stars, and the new research, published Wednesday, lays out the case for them.
The signal that’s at the center of the study comes from a time when the universe was just 660 million years old. (It’s now almost 14 billion years old.) In the JWST images, the object appears as one of the many bright, reddish spots that the telescope has found in the early universe.
From a distance of billions of light-years, this phenomenon appears to be a gigantic star. But the object, known as MoM-BH*-1, has a few curious properties. It emits about 100 billion times more energy than any star could produce through nuclear fusion, according to the team. Even for the era in which it formed—during the early universe—it is an extremely bright object.
Furthermore, part of its light abruptly disappears. Stars can produce a similar signal when their atmospheres absorb certain wavelengths, but in MoM-BH*-1, the effect is too intense to be explained as normal star behavior. Researchers believe that an enormous amount of extremely dense gas is absorbing that light.
These clues led scientists to the black hole star hypothesis. At the center of MoM-BH*-1, there would be a black hole devouring matter and releasing enormous amounts of energy. Surrounding it, a massive gas envelope. The energy would pass through that gas before escaping into space and, in the process, would acquire some of the characteristics we would normally expect to find in starlight.
The hypothesis could help address another mystery uncovered by the JWST. The telescope finds, with surprising frequency, small red spots in the early universe whose origins remain uncertain. They don’t fit neatly into the usual categories of objects in deep space. Scientists have put forward a number of explanations, including that they’re compact galaxies teeming with stars, black holes hidden by dust, and systems completely different from those we observe in the present-day universe.
Oil giant Shell has confirmed it is investigating a potential security incident after the Clop ransomware gang claimed it stole 89GB of data.
Shell is a British multinational energy conglomerate and one of the world’s top three oil and gas companies, after Chevron and ExxonMobil. It has 85,000 employees in more than 70 countries and operates a massive network of tens of thousands of service and recharge stations that serve over 20 million customers daily.
According to a recent post on Clop’s dark web data leak site, the allegedly stolen files include engineering drawings, scans of facility testing reports, photos of the facilities, and project plans.
“We are aware of a potential incident. We are working with our security teams and relevant experts to investigate,” a Shell spokesperson told BleepingComputer when asked to confirm Clop’s data theft claims.
While the company has yet to share more information, the Clop gang listed it on its leak site as one of 43 new victims likely targeted in data theft attacks against Internet-exposed PTC Windchill and FlexPLM instances exploiting a critical improper input validation vulnerability tracked as CVE-2026-12569.
As part of the same attacks, Clop also claimed it stole sensitive data, including backups, system files, projects, drawings, diagrams, and blueprints, from the networks of tech conglomerates General Electric and Philips.
GE and Philips spokespersons were not immediately available for comment when BleepingComputer contacted them earlier today. A PTC spokesperson has also yet to reply to a request for comment.
PTC began releasing CVE-2026-12569 security patches on June 17 and, even though it didn’t confirm in-the-wild exploitation, it also released a private advisory urging customers to review environments for indicators of compromise (IOCs).
After PTC warned customers of “heightened threat activity” on June 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also confirmed that the flaw is actively exploited in attacks, adding it to its Known Exploited Vulnerabilities catalog, and ordering federal agencies to secure their PTC Windchill and FlexPLM instances within three days.
CVE-2026-12569 also prompted emergency action from German authorities, with the Federal Office for Information Security (BSI) warning PTC customers in the middle of the night to patch their systems as quickly as possible.
Clop’s Windchill and FlexPLM attacks were also confirmed by the Ransomware Information Sharing and Analysis Centre (Ransom-ISAC), a non-profit organization dedicated to the tracking and defense against ransomware threats, and by cybersecurity company ReliaQuest, which said that the threat actors have been deploying JSP webshells that allow them to steal sensitive data from victims’ compromised PLM platforms.
PTC FlexPLM and PTC Windchill are enterprise software platforms in the Product Lifecycle Management (PLM) category, used to track, design, and manage products up to final manufacturing.
The two systems are widely popular among engineering, manufacturing, quality, and supply chain teams at high-profile companies across the aerospace, defense, automotive, heavy machinery, retail, and medtech sectors. PTC says that its products are used by over 30,000 customers globally, including more than 1,500 brand and retail customers using FlexPLM.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Since the end of last month, several water utilities in the United States have been hit by cyberattacks, causing alarm in the country.
For years, water utilities and other critical infrastructure facilities in the power sector, for example, have been targeted by hackers, whether government-backed or individuals. What makes these recent attacks — allegedly carried out by Iran — particularly concerning is how widespread they were, hitting targets in around a dozen states.
The U.S. has more than 150,000 water systems, some of them run by local companies. In theory, that should make it harder for hackers to target several facilities at the same time. But on the flip side, the companies running these systems may not have the resources or cybersecurity expertise needed to protect themselves.
Cybersecurity experts have long believed that Iranian hackers target low-hanging fruit in opportunistic isolated attacks, so this hacking campaign could be a significant escalation.
A lot has happened since news of the initial attacks broke two weeks ago. So we decided it was a good time to recap what we know so far, and what we don’t.
On July 28, Minnesota authorities announced that water treatment plants in more than 30 communities were hit by coordinated cyberattacks.
Two days later, the FBI said water and wastewater utility companies in “at least seven states” reported incidents, and in some cases the attacks “degraded water operations.” Since then, apart from Minnesota, there have been reported hacks against water facilities in Arkansas, Georgia, New Jersey, and Michigan.
The short answer is: we don’t know yet, but the No. 1 suspect is the Iranian government.
As of today, officially, the U.S. government has yet to name the culprit behind the coordinated wave of hacks.
However, the first incidents in Minnesota came days after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that Iranian hackers were targeting internet-connected devices in water systems and the energy sector, without saying where those attacks were occurring. (CISA had originally published this warning in April, and updated it before the Minnesota attacks.)
After the initial wave was uncovered in Minnesota, President Donald Trump said he did not think “there was an Iranian cyberattack.” Instead, he blamed the state, perhaps because it is run by democratic governor Tim Walz, who was chosen as Kamala Harris’ vice president candidate in the 2024 elections.
Trump’s claim came a day after Wired reported that the Water Information Sharing and Analysis Center, or WaterISAC, a nonprofit group that distributes cybersecurity information among the water sector, told its members that the recent attacks “aligned” with the hacking campaign CISA warned of — effectively accusing the Iranian government.
Earlier this week, The Washington Post reported that U.S. intelligence agencies “are confident” that Iran, and in particular the Islamic Revolutionary Guard Corps (IRGC), is responsible. The attribution isn’t public yet, according to the paper’s sources, because the agencies are not sure which specific unit within the IRGC was responsible, and also because officials may be reluctant to contradict Trump’s claim.
Iranian government hackers have a history of targeting critical infrastructure in the U.S., and it’s possible that these attacks are part of its strategy to retaliate against the country because of the six-month war.
Until now, Iranian hackers had only limited success in their cyberattacks against U.S. targets. In March, a hacktivist group called Handala disrupted the operations of medical tech giant Stryker. The U.S. government later accused Handala of being operated by Iran’s Ministry of Intelligence and Security (MOIS). Then, the group claimed responsibility for hacking the personal Gmail account of FBI director Kash Patel.
The reality is that some systems inside critical infrastructure facilities are exposed to the internet and relatively easy to find. Earlier this month, cybersecurity firm Forescout reported finding more than 2,800 controllers in U.S. water systems exposed online. If a system is exposed, it doesn’t automatically mean hackers can take over control and cause real-world effects. But that has happened in some isolated cases in recent attacks.
The FBI said some of the cyberattacks around the country caused loss of pressure, which “could potentially allow untreated groundwater to seep into pipes,” and flooding.
The town of Braham in Minnesota, one of the first to report an incident, had to take its water plant offline for a few hours, urging its around 1,700 residents to conserve water. The city of Maple Plain, also in Minnesota, briefly declared a state of emergency. In a county outside Atlanta, Georgia, local officials briefly told residents to boil water before using it as a precautionary measure.
The worst effect, however, may be psychological. These attacks have been widely covered in national and local press, causing people to worry about the safety of a fundamental and basic need like water. That may very well be part of the hackers’ goals: to spread panic and fear.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
DeepSeek’s V4 Flash has topped model leaderboards and been hailed by developers as a “total monster” since its rollout. But in real-world testing, it completed just 53.8% of a batch of complex agent tasks.
Composio ran the model through eight different agent harnesses, including Claude Code, Codex, and OpenCode, on 30 deliberately difficult, multi-step tasks spanning live tools like Gmail, GitHub, Slack, and Google Sheets. Of 240 total runs, 129 passed — and only six of the 30 workflows were completed successfully by every harness tested.
The gap illustrates why orchestration, not raw model capability, may decide whether the model succeeds in enterprise settings: the same model produced substantially different results depending on the harness, tool configuration, caching behavior, retries, and provider stack it ran on.
DeepSeek said it will be hiking the prices for V4 Flash and Pro, models that have quickly become favorites among developers building coding assistants and agents.
While it seems the move might undercut its very appeal — strikingly capable models at ultra-low pricing that frontier providers simply can’t match — it also moves the story beyond the now-clichéd “cheap Chinese model” narrative, as early use cases emerge and enterprises figure out where different models fit into their tech stacks and what workflows they should be aimed at.
DeepSeek rolled out V4 Flash to public beta July 31, and made V4 Pro generally available on August 13. The 284-billion-parameter Flash is built for volume and speed, the 1.6 trillion-parameter Pro for more complex workflows.
Both models have flexible reasoning capabilities (low, high, max) and ‘thinking modes’ applying chain-of-thought (CoT) reasoning to improve answer accuracy.
Users were immediately impressed by Flash’s capabilities. It has dominated OpenRouter’s usage leaderboard since its rollout, currently the most-used model on the platform by weekly token volume.
“The adoption numbers of the initial DeepSeek V4 Flash were insane,” ML researcher Nathan Lambert posted to X, adding that the new version “scored the same as GLM 5.2,” making it a “total monster” that will be used extensively.
DeepSeek switching the cost model adds an interesting dimension.
V4 API rates are going up by as much as 1,100% depending on the model, token type and time of use. The new pricing structure:
Flash will be 22 cents per million input tokens and 66 cents per million output tokens off-peak; and 44 cents per million input tokens and $1.32 per million output tokens at peak. This represents a 57% to 371% increase.
Pro will be 66 cents per million input tokens and $1.98 per million output tokens off-peak; and $1.32 per million input tokens and $3.96 per million output tokens at peak. This shows a 51% to 355% jump.
Cache hits, meanwhile (when models reuse prompts rather than starting from scratch), are going up between 52% and 1,100%.
DeepSeek says offering 50% lower off-peak usage is intended to encourage “more flexible workload scheduling.” Seventeen of every 24 hours stay at half price, and the new structure actually prices the company’s home market the highest.
“This is not a simple price rise,” said Sanchit vir Gogia of Greyhound Research. “It is a pricing architecture that makes the timing of inference an economic variable.”
Work that can wait — such as batch evaluation, synthetic-data generation, and overnight development runs — moves into the cheap hours; interactive agents and live operations cannot. Gogia said irritation among developers and enterprises is genuine and vocal, and that DeepSeek’s past low pricing doesn’t obligate it to stay cheap forever.
At first glance, it does look like a “suicidal move from a platform still looking for credibility against more established AI model vendors,” said tech analyst Carmi Levy. The increases will certainly eat into DeepSeek’s price advantage and force customers to weigh concerns around the company’s Chinese origins more heavily.
Still, DeepSeek remains far cheaper by all pricing measures relative to competing models from OpenAI, Anthropic, Google, Cohere, xAI, and others, he said.
So, while the move will force DeepSeek to emphasize performance and security over cost, it hardly wipes out its already-notable price-performance advantage, and still gives customers ample wiggle room to justify its use for specific workloads, Levy said. The math will just have to be more tightly calculated.
“The advantage will likely erode over time as DeepSeek inevitably continues to align pricing with market realities, but for now it’s still easy to make the business case,” Levy said.
Adoption inside enterprises remains an open question due to cost, capability, reliability, data governance, security, and other factors.
One use case is batch processing, Levy said. This kind of work is typically routine and repetitive rather than demanding top-tier intelligence, so it makes sense to use a cheaper, more efficient model. “It’s a high-performance inference engine that enterprises can consider using for point solution workloads rather than as a wholesale replacement for the incumbent offerings,” Levy said.
Partial adoption will likely involve isolated, non-sensitive workloads with clearly-defined success metrics, strict oversight, permissions controls, and fallback models in case of failures, he noted. Broader deployment will require DeepSeek and its hosting partners to demonstrate strong reliability, security, privacy, auditability, and deployment options. As it adjusts price structures based on demand, DeepSeek also must retain a large enough price-performance advantage to justify any risk, he said.
Expect unsanctioned, smaller-scale use in backroom labs and contained test environments as IT teams get familiar with the new model and figure out when and how to bring it to senior leadership for budget approval.
“DeepSeek has built a well-earned reputation as a global disruptor,” he said, “and it’s clear that its march to broader enterprise adoption will continue to gather momentum.”
While many use cases are still in the experimental phases, Meta software engineer Naman Ahuja offers one that could translate directly into enterprise environments. In a project unrelated to his employer, he built a home-automation agent with DeepSeek V4 Flash to explore how a lower-cost model performs as the reasoning/orchestration layer for a real multi-tool workflow.
When he leaves home, an agent coordinates several actions across otherwise separate systems: Such as setting a thermostat to “away” to reduce unnecessary energy use, arming a Ring security system, closing and locking doors.
“What interested me was not simply whether the model could understand a command, but whether it could translate intent into a sequence of actions across multiple tools where reliability matters,” Ahuja said.
The biggest lesson was that once a model can take actions, reliability matters as much as intelligence. The system needs structured tool outputs, verification that actions actually succeeded, retry/failure handling, and clear boundaries around what the model is allowed to do.
In the case of enterprise, “the architecture is similar.” Home devices change to ticketing systems, databases, CRM platforms, or infrastructure APIs. The most useful agents will likely orchestrate repetitive workflows across multiple systems, with scoped permissions, auditability, observability, and human approval for higher-risk actions.
“Many valuable AI agents will not be chatbots; they will be background agents coordinating APIs, infrastructure, and business systems in response to events,” he said.
But Flash’s API is still in public beta, Gogia pointed out, and there is not yet an evidence trail of settled enterprise adoption, real-world deployments, and named customers.
“The benchmark story is looser than its retelling, the portfolio story is newer than it looks, and the economics have moved into the system around the model,” he said. Developer mainstreaming is proven; enterprise standardization is not. “The model is mainstream by traffic and still unproven by contract.”
DeepSeek’s own integration guidance is an important consideration, he said: Its documentation for at least one popular agent environment states that built-in V4 entries are not sufficient for reliable operation without compatibility overrides.
“Which is a vendor telling the market, accurately, that benchmark performance is not a proxy for production readiness,” Gogia said. “A model can score beautifully and still misbehave once tools, credentials, and state enter the room.”
The serving layer behaves no differently: the same open weights run by different hosts show visible differences in throughput and uptime. “Choosing Flash therefore answers one procurement question and opens three more: Who serves it, where it runs, and which controls surround it,” Gogia said.
DeepSeek offers a nuanced case for a multi-model future. V4 Flash is being deployed as the high-volume worker inside diverse estates, Gogia noted: It handles routine generation, retrieval, and background automation, while more difficult or sensitive tasks go elsewhere.
“The question is whether its performance is sufficient for the real-world workflows enterprises actually run, not whether it tops every benchmark,” he said. Enterprises must determine which combination of model, harness, and provider completes the work safely at the lowest cost.
Adam Dalloul, CEO and founder of EmpirioLabs AI, pointed out that bigger isn’t always better; workflows should be task-dependent. For example, his team at EmpirioLabs AI — which hosts 100-plus models on one API, including DeepSeek V4 Flash — were recently working on translating its site into different languages, and there was no need for a large model like GPT 5.6 Sol or Opus 5 to complete the task.
“This is where subagents come in handy,” he said.
His recommended approach: Spawn cheaper subagents and adapt per task. For instance, use Flash variants for day-to-day work, and Pro variants when you need something more powerful. “It depends on the nature of your application.”
Many companies are pivoting towards their own internal benchmarks to route models effectively, Dalloul noted. For example, his team has a workflow that puts a model through various gates and instructions. This helps them identify the model with the speed and accuracy required for the task.
In another example, one of his enterprise clients exclusively wanted access to DeepSeek V4 Flash. They had tested a variety of models and V4 Flash was the only one that met their criteria for speed, cost, and an “appropriate intelligence threshold.”
Meta’s Ahuja agreed that smaller, more efficient models can handle frequent, well-defined agentic tasks, while more expensive frontier models can be reserved for “ambiguous, difficult, or higher-risk decisions.” The relevant metric increasingly becomes cost per successfully completed workflow rather than simply cost per token.
The trade-off, however, is that cheap inference does not automatically mean cheap or safe automation, he said. Once an AI system can take actions, reliability, verification, permissions, failure handling, and security become much more important.
“A failed text response is inconvenient; a failed action in an operational workflow can have real consequences,” Ahuja said.
Weekend Open Thread: Ann Taylor
Communication cards help banking customers access services or report scams
Oil Price Today (August 11): Crude oil rises to $88 after Trump’s compensation demand dents Hormuz opening. Here’s why
Revolut wins French banking licence, creates second EU banking hub
Why Did Nvidia Stock Fall on Monday Despite a $500 Billion Wall Street AI Deal?
This U.S. Amateur is a glimpse into golf’s future in more ways than you think
Ben-Gvir’s crocodile project halted but abuses at Ketziot Prison continue
Saudi Arabia used 86% of missile stockpile defending Iran attacks
Birmingham 2026: Day 6 Timetable for Irish Athletes
Myanmar says over 300,000 Rohingya refugees verified for repatriation as exodus enters ninth year
The Church of England’s ruinous reparations racket
SEQ Code: The Three Letter Boarding Pass Code That Could Give You The Worst Seat
Can You Wear Double Cloth Gauze Clothing To Your Office?
Keke Palmer Subtly Hints At Sean Evans Drama With Cryptic Post
USDC and USDT Now Own 84% of Crypto Card Spend as the Euro Retreats
Grayscale quietly drops Cardano, Polkadot and Hedera ETF plans
Is Clarity's delay a blessing in disguise?: State of Crypto
57 Years Later, the Best Sitcom Ever Made Still Deserves a Reboot
Kraken Delisting Deadline Nears: Holders of 21 Tokens Risk Near-Zero Payouts
Claire Life: Kicking Off MVAAFF With the C Suite Luncheon Featuring Phylicia Rashad, Letoya Luckett, and More!
You must be logged in to post a comment Login