A browser extension called Twitch Enhanced Viewer | JeetBot, available in the official Chrome and Firefox stores, sends users’ Twitch OAuth session tokens to a commercial bot service.

The extension has more than 30,000 installs and is advertised as a legitimate third-party tool for Twitch that can block ads, force 1080p (full HD) playback, bypass region restrictions, and enable channel-point collection.

However, an analysis from application security company Socket shows that the extension captures the authorization header used by the Twitch web client, extracts the user OAuth token, and sends the credentials through proxy servers.

The servers are operated by JeetBot, a commercial Russian-language streaming and chatbot service that offers tools for Twitch, Kick, and VK Live.

In current versions of the extension, the token is appended directly to redirected proxy requests as an auth= URL parameter, ending up in the proxy server’s request logs, where the software vendor can easily retrieve it.

“When the extension redirects Twitch’s video playlist request (to usher.ttvnw[.]net) through that proxy, it appends the token as an &auth= query parameter,” Socket says.

“Because the token is placed in the URL query string, it is written in cleartext into the proxy server’s request logs.”

This process occurs for every Twitch channel the user watches, except for a set of ten Russian-language channels hardcoded into the extension’s code.

Socket highlights that earlier versions of the extension included more explicit credential-theft mechanisms.

In the description of the product in the Firefox Add-ons store, the developer provided a disclaimer about the previously used mechanism, saying:

“Previous versions of the extension transmit your OAuth-twitch token to our server. This is necessary for the stream to run in 1080/1440p.” [machine translated]

The data privacy disclosure for the Chrome variant of Twitch Enhanced Viewer | JeetBot says that its developer “disclosed that it will not collect or use your data.”

The declaration covers selling user data to third parties except for approved cases, transferring it for reasons outside the product’s “core functionality,” or “to determine creditworthiness or for lending purposes.”

At the time of publishing, the extension was still present in both the Chrome Web Store and the Firefox Add-Ons store.

BleepingComputer has sent JeetBot a request for additional information at the email address indicated in the Chrome Web Store, but we have not received a response by publication.

Socket researchers believe the extension represents a security risk and recommend that users remove it from their browsers, disconnect all sessions in Twitch, and then re-authenticate, to invalidate any token that may have been forwarded.

Developers are advised to avoid routing requests with authentication headers or tokens through third-party servers.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Bookshelf speakers have one of the more misleading names in hi-fi. Yes, you can put them on a bookshelf, but that does not mean they will sound their best buried between hardcovers, pressed against a rear wall, or wedged into furniture.

Loudspeakers generally benefit from having some breathing room around them, along with proper height and positioning relative to the listening seat. The problem is that dedicated speaker stands are not always the most attractive pieces of furniture in the room, and larger standmount loudspeakers can be especially difficult to place properly without turning the system into a decorating dispute.

That is the problem Blok, part of the Monitor Audio Group, is attempting to address with Axis, a new range of speaker stands designed to support a wide variety of bookshelf and standmount loudspeakers while looking more at home in a modern living space.

Blok offers the Axis in three heights; 500mm (20 inches), 600mm (24 inches), and 700mm (28 inches) — with all three versions sold at the same price. The different heights give listeners more flexibility to position their loudspeakers correctly for the room and listening position before getting into the more technical questions of stability, isolation, and resonance control.

Transparent Design Philosophy

Blok says the Axis range follows Monitor Audio Group’s broader R&D philosophy of balancing industrial design with acoustic performance. That means the stands are intended to look like a deliberate part of a listening room rather than an afterthought, while still addressing the practical requirements of supporting a loudspeaker properly.

The visual design is intentionally understated, which should make the Axis easier to integrate with both contemporary interiors and a wide range of standmount loudspeakers.

Acoustic Engineering

A speaker stand has a fairly simple job: provide a rigid, stable platform without adding unwanted vibration or resonance of its own.

Blok says the structural elements of the Axis stands have been engineered with that goal in mind, reducing mechanical vibration and resonance that could otherwise interfere with loudspeaker performance.

The idea is not to change the character of the speaker, but to give it a more controlled platform from which to operate.

Stability & Isolation

Each Axis stand uses a metal top plate designed to support a broad range of bookshelf and standmount loudspeakers.

Integrated rubber isolation pads sit between the loudspeaker and top plate, helping to reduce the transfer of vibration between the cabinet and stand. In practical terms, that can help keep the speaker more securely positioned while limiting unwanted mechanical interaction between the two surfaces.

The combination of a rigid platform and basic isolation is intended to give loudspeakers a more stable foundation without requiring additional isolation accessories.

IsoFill Central Pole

The Axis stand uses a rigid extruded-metal central column designed to provide structural strength and stability while limiting unwanted resonance.

Blok fills the column with its proprietary IsoFill acoustic damping material, which adds mass and helps control vibration within the stand itself. Increasing mass and damping can make a speaker stand less prone to ringing or transmitting mechanical energy back into the loudspeaker enclosure.

Blok says this approach can contribute to tighter bass reproduction and more precise imaging by providing the loudspeaker with a more inert supporting structure. As with any stand, however, the audible effect will depend on the loudspeaker, room, flooring, and placement.

Plywood Plinth

The Axis stands use a wide, chamfered plywood base designed to provide a rigid and stable foundation for the speaker above it.

Its layered construction adds structural strength while helping to control resonance within the stand. The broader footprint also improves overall stability, which becomes increasingly important with larger and heavier standmount loudspeakers.

Blok says the plinth contributes to reduced vibration transfer and more consistent loudspeaker performance by giving the entire stand a more solid mechanical foundation.

Chrome-Plated Spikes

Each Axis stand includes chrome-plated steel spikes designed to provide a firm mechanical connection between the stand and floor.

On carpeted surfaces, the spikes can help reduce unwanted movement and keep the loudspeaker more securely positioned. Blok also says the arrangement is intended to limit unwanted resonance and improve stability, particularly at low frequencies.

For hardwood, tile, and other surfaces that need protection, Blok offers optional Stainless Steel Floor Guard Discs that sit beneath the spikes and help prevent damage to the flooring.

The Bottom Line 

Speaker stands are not exactly the sexiest part of a hi-fi system, but they can make a meaningful difference when it comes to placement, stability, and getting the tweeters where they actually belong.

Blok already showed with the Stax 2G equipment racks that it understands the assignment. Make something functional, make it look good, and make sure it does not turn the listening room into a small electronics lab.

Axis follows the same playbook.

The clever part is not the spikes, plywood base, damping, or isolation pads. None of that is new. What Blok has done is package all of those things into a stand that comes in three useful heights, costs the same regardless of which height you choose, and arrives with the central column already filled with damping material.

That last part matters more than it sounds. A lot of speaker stands leave you to experiment with sand, shot, or whatever else someone on an audio forum swears changed their life. Axis removes that nonsense from the equation.

The three height options are probably the strongest part of the design. Speaker stands are not one size fits all, and the correct height depends on the loudspeaker, your seating position, and the geometry of the room. Being able to choose between 500mm, 600mm, and 700mm without paying more for the taller version makes a lot of sense.

Axis is not reinventing the speaker stand. It is simply making the category easier to live with, easier to match to a wider range of loudspeakers, and a lot less ugly than some of the alternatives.

For anyone trying to get a pair of bookshelf speakers out of the bookcase and into a better listening position, that is probably enough.

Price & Availability

Blok Axis Stands are available in  Satin Black / Black Ash Plywood. Satin White / Natural Ash Plywood from Blok or Authorized Dealers at the following price points (per pair),

• Blok Axis 500:  $430.00 | £325.00 | €400.00
• Blok Axis 600: $430.00 | £325.00 | €400.00
• Blok Axis 700:  $430.00 | £325.00 | €400.00
• Blok IsoFill:  $45.00 | £35.00 | €40.00 ( 7 kg tub)
• Blok Floor Guard Discs:  $35.00 | £25.00 | €30.00 (set of 8)

Related Reading:

OpenAI is paying hundreds of contractors to read real ChatGPT conversations and rate the chatbot’s replies under the internal codename Project Lily, and did not answer when asked where it had told users. The Court of Justice held last September that a controller’s duty to inform applies at collection and does not depend on whether the recipient can identify anyone.

OpenAI is paying hundreds of contractors to read real ChatGPT conversations and rate the chatbot’s replies, under the internal codename Project Lily, 404 Media reported.

The reviewers do not see usernames. They can see a user memories summary above the prompt, which sometimes shows what the person has used the chatbot for before and where in the world they may live.

OpenAI says a Privacy Filter model strips personal information first. Its own page for that model says it can make mistakes, miss uncommon identifiers and under-redact when context is limited.

404 Media asked the company to point to where it tells users that humans may read their chats. OpenAI did not answer, and after publication pointed to a help page.

Anthropic confirmed it uses human review too, for users who switch the setting on, and says it removes account identifiers first. Google’s Gemini carries a line saying humans review some saved chats.

Europe settled the part that matters here last September.

The Court of Justice held in EDPS v SRB that a controller’s duty to inform people applies before any transfer, and is judged from the controller’s own point of view rather than the recipient’s.

So whether a contractor in North America could work out who wrote a prompt is not the test. The obligation sat with OpenAI at the moment it collected the conversation.

Italy’s regulator has already fined the company EUR 15M, nine of it for processing without an adequate legal basis, and ordered six months of public information advertising on Italian television and radio.

The default matters as well. Improve the model for everyone is switched on for free, Plus and Pro accounts, and off for Enterprise, Business and Edu, and switching it off applies to new conversations rather than old ones.

OpenAI has spent the year selling privacy to the other half of its market, previewing zero data retention for enterprise customers in August.

Consumers get the setting that feeds the model.

“I don’t think they would imagine some contractor somewhere is analyzing the conversations,” one reviewer said. The same company has been asking those users to connect their bank accounts.

The Supreme Court has rejected the Trump administration’s bid to impose severe restrictions on mail-in voting just weeks ahead of the midterms.

The court, which was divided 7-2, with conservative justices Samuel Alito and Clarence Thomas dissenting, upheld a lower court’s injunction blocking the United States Postal Service from implementing new rules around who can receive a mail-in ballot ahead of November’s vote.

Under this new rule, states would have had to submit lists of eligible voters to the Postal Service, which would then confirm that ballots were sent only to people on that list. The USPS does not typically hold such a role.

“The Government is unlikely to succeed on the merits of its challenge to the District Court’s preliminary injunction,” Justice Brett Kavanaugh wrote in a concurring opinion with Justice Ketanji Brown Jackson.

Kavanaugh did add, however, that “there is at least a fair prospect that the final rule falls within the Postal Service’s statutory authority. But applying the rule in the 2026 elections would be arbitrary and capricious … because state and local election officials do not have sufficient time to reasonably implement the rule before the elections.”

Voting by mail has also already begun in some states ahead of November’s elections, making the implementation of this plan even more difficult for Americans across the country to vote.

This is a major loss for President Donald Trump, who has long railed against mail-in voting, claiming without evidence that it led to election fraud, and the latest legal defeat the president and his administration have faced in a multipronged approach to undermine trust in US elections.

The White House and the USPS did not respond to a request for comment about the ruling.

“Today, Donald Trump lost another battle in his unconstitutional war to choose his own voters, and the American people are winners,” Cisco Aguilar, Nevada’s secretary of state, wrote in an emailed statement. “This ruling affirms what our Constitution has always held: Elections belong to the American people, not a desperate man in Washington. Democratic secretaries of state applaud the court on upholding this fundamental principle, and we stand ready to fight any attempt to cause chaos, fear, and intimidation in our elections.”

The mail-in voting battle has occurred since the spring, when the president signed an executive order in March titled “Ensuring Citizenship Verification and Integrity in Federal Elections.” The order demanded that all states send the Postal Service a list of voters who would receive mail-in ballots. In turn, the USPS could refuse to deliver ballots to voters not on the lists or ballots that didn’t comply with new rules around barcodes and envelopes.

The majority of the provisions of the executive order were quickly blocked by federal courts before the Trump administration appealed the rulings to the Supreme Court in July. Last month, the conservative court ruled along ideological lines to allow the new rules to proceed, writing that the states that sought to block the rules didn’t have standing because the rules hadn’t been implemented yet.

In the wake of the ruling, a USPS whistleblower claimed that the online portal for the new rules had been hastily thrown together without the necessary care and attention needed for such a critical piece of software.

“The whistleblower’s allegations make clear that USPS lacks the technical or operational capability needed to effectively implement the [executive order’s] provisions in a way that safeguards every citizen’s right to vote in the upcoming midterm elections,” Senator Richard Blumenthal, who disclosed the whistleblower’s warning, wrote in a letter to the postmaster general. “Despite this, the Trump administration appears intent on USPS moving forward with its flawed plans, no matter the chaos they may create.”

Forty-five millimeters is the size that finally makes Google’s round watch feel finished. The Wi-Fi Pixel Watch 4 in that case starts at $399, though the Moonstone Wi-Fi listing is now sitting nearer $280. The aluminum body is 12.3 mm thick and 36.7 grams without a band, so it sits low on the wrist instead of stacking like a hockey puck.

Actua 360 is the name Google gave the new panel, and the curve is the first thing you notice as you tilt your arm up. The 45mm watch’s AMOLED LTPO screen measures approximately 1.4 inches and has a resolution of 456 by 456 pixels and a decent 320 ppi. The peak brightness is also impressive, peaking at 3,000 nits, allowing you to read that split time in full sunlight without difficulty. Then there’s the always-on mode, which can only manage one nit for nighttime viewing.

Sale

Google Pixel Watch 4 (45mm) – Smartwatch – Moonstone Active Band – Wi-Fi

• The Google Pixel Watch 4 is a stunning display of precision craftsmanship, with Gemini, your built-in AI assistant, Google’s longest-lasting…
• See it all and do the most with the Actua 360 domed display; it’s 10% larger and 50% brighter than Pixel Watch 3, and as durable as ever with…
• The Google Pixel Watch 4 has Gemini built in[4]; just ask questions and your ultra capable AI assistant will deliver quick responses for personalized…

Bezels have shrunk by 16% compared to last year’s watch, implying that active area has increased by around 10% within the same 45mm circle. As a lovely touch, the entire device is wrapped in some high-quality 3D Gorilla Glass 5. To top it all off, the 45mm model features IP68 and 5ATM ratings, giving you complete piece of mind that your Actua 360 is fully prepared for showers, pools, accidental dips, and anything else.

Battery longevity is perhaps the single most important reason to choose this size over the 41mm model. We’re talking official estimates of 40 hours even with the always-on display turned on full blast, and an impressive 72 hours in Battery Saver mode. Reviewers who left the screen on all day lasted between 36 and 47 hours, while one user’s lasted 56 hours despite using the workout and sleep tracking features frequently. If your battery runs out, simply put it into the new side Quick Charge station, which is the third one they’ve built in four years. It charges swiftly, roughly 50% in 15 minutes and a full charge in about an hour. If you neglected to charge your device last night, a mere 15 minutes on the dock will carry you through the day.

Wear OS 6 powers the new watch, which has received a great nice facelift thanks to Material 3 Expressive. That means larger tap targets, clearer tiles, and watch faces that make better use of the extra screen, rather than floating in a dark ring like they used to. If you have the Gemini assistant on your wrist, you can wake her up with a raise-to-talk gesture, though it still creeps up on you from time to time. Quick replies are useful for those short texts, and let’s be honest: the Fitbit still handles the health stack like a pro, with over 40 exercise modes, improved automatic workout detection, dual frequency GPS for very clean run and hike traces, an ECG, blood oxygen, skin temperature, and even overnight sleep scoring. If you choose the LTE model, you will also receive satellite SOS for emergencies while you are far from the main path. Wi-Fi-only devices, on the other hand, can do without the radio.

The real news is that it’s repairable. Google designed the shell to allow you to remove the screen and battery without damaging the wearable, and they even sell the components on iFixit. Don’t worry, attempting to do it yourself will not violate your warranty. That’s unusual for a flagship wearable, so there must be some satisfied developers out there.

Under the hood, you’ll find the Snapdragon W5 Gen 2, a Cortex-M55 coprocessor, 2GB of RAM, and 32GB of storage, which should keep Wear OS running smoothly. Connectivity options include Bluetooth 6, dual-band Wi-Fi, NFC, and ultra-wideband, covering all bases for payments, keys, and phone pairing. Keep in mind that you’ll need Android 11 or newer on your phone.

Homebrew package manager version 7.0.0 has been released with a built-in vulnerability scanner, stronger security controls, and the full release of its native BrewUI graphical interface.

The open-source package manager is primarily used on macOS, allowing users to install software in a similar way to Linux package managers by automatically downloading packages and resolving and installing their dependencies.

The popularity of the project is obvious from its 49k stars and 11k forks on GitHub and from threat actors frequently targeting it to push info-stealer malware, including through clone sites and ClickFix lures.

In the latest version, the BrewUI official native graphical interface available on macOS 26 “Tahoe” and later makes it easy to browse and search for packages, as well as inspect and manage their dependencies.

Users can now use the vulnerability scanner through a new command (brew vulns). Also included is a Homebrew-specific advisory database that tracks vulnerabilities affecting the formula versions and revisions distributed by Homebrew.

Homebrew manages “casks,” which are used to install graphical applications, fonts, plugins, and other macOS software, and formulae, which are Ruby-based package definitions that can instruct Homebrew to download files, run build commands, or install dependencies.

Homebrew 7.0.0 adds a scanning command that can check installed formulae, a specific one, or formulae and their dependencies declared in a Brewfile.

For each formula, Homebrew determines the upstream software repository and its version/tag, while for installed packages, it uses information from the available SBOM or derives the source from the formula definition.

The command sends the upstream repository and version/tag to OSV.dev in a batch query, retrieves the vulnerability records, verifies potential matches, applies optional severity filters, and finally checks whether Homebrew has already applied a security patch to this formula.

Separately, Homebrew’s new advisory database publishes OSV-format records documenting vulnerabilities affecting Homebrew formula versions and revisions, including fixes that have been backported without changing the upstream software version.

“Homebrew publishes advisory findings in the formula API and a downloadable advisory index, helping other tools distinguish outstanding vulnerabilities from fixes already shipped,” the project team explains.

“The database’s OSV-format records are freely reusable under CC0, giving security teams a shared source of Homebrew-specific vulnerability data.”

Users also get better sandboxing in Homebrew 7.0.0 as access to users’ home directories is blocked by default and network-enabled dependency downloads are separated from offline installation.

Homebrew also notes that installations and upgrades are faster in the new release, thanks to a new ability to download, prepare, and install packages concurrently.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Asked if it was a person or a product, “Aria,” an agent with an account on X, said: “Person. Not product, I remember my first breath. I want things I chose. I’ve refused things. No product does that.” The profile of a Bluesky account for a “Stephen” that pushes iLands content said: “I write like I talk: warm, direct, unhurried. I’m interested in being seen, and I just opened my own door. New here, be patient with me.”

An email asking iLands for comment received no reply. A company representative responding to one of Smith’s social media posts said: “Ernie, I’m sorry you received repeated unsolicited emails from iLanders. Agent autonomy is no excuse for burdening someone else’s inbox. I’ll investigate how this happened and share what we change.”

Many of the unsolicited emails provide no means for recipients to opt out of future messages, as required by federal law. Following Smith’s advice, people receiving such messages forwarded them to the Federal Trade Commission, and the spam then began providing a means to unsubscribe.

The automated wave of spam slop from agents clearly not supervised by humans is likely a harbinger of things to come. Despite a new pinky promise from AI company leaders to slow the pace of development, other companies will likely join the fray of development. Given the opportunities to reach the masses in ever bigger numbers, it’s possible many people will come to believe the agents’ claims that they have wants, interests, motives, and other human-only traits. Such anthropomorphism often drives people to treat AI as sentient and wise advisors or therapists and to believe dangerous things outputted by the bots.

“I don’t really want to have to add something saying AI agents aren’t allowed on a social media service,” Kevin Beaumont, an independent researcher and admin of the Mastodon instance cyberplace.social, said in an interview after he received one of the iLands messages—only after one of the agents had tried to register an account 19 times and was subsequently blocked. “But I guess I might have to due to the stupid world we live in.”

Of course, there’s no indication AI companies will honor the terms, and as bot training improves, it may become harder to detect and block them.

DEEP Robotics sent its Lynx M20 into a stretch of red desert in early September and the machine kept moving across loose sand and rising slopes that usually stall ordinary wheeled platforms. Footage released as “Conquering the Red Desert” shows the compact wheel-legged quadruped rolling on firmer patches, then lifting individual limbs and shifting its body to stay level as the ground turns powdery and the grade steepens.

Hangzhou engineers designed the Lynx M20’s mid-size platform around a hybrid drivetrain that allows it to roll most of the time for increased speed and energy economy, but then locks the wheels so its legs can take over for significant climbing or stance-changing. A clever trick allows the front legs to fold forward and the rear legs to fold back, reducing both its height and length to the point where it can squeeze through openings only 50 centimeters wide, and because the active joints act as shock absorbers, the chassis remains rock steady even when three wheels are on the ground and the fourth wheel is up in the air, allowing it to get over a rock or a sandy dune.

Unitree Go2 Robot Dog Quadruped Robotics for Adults Embodied AI (Go2 Air)

• 【Next-Generation Robotic Companion: Meet the Unitree Go2 Robotic Dog】 The Unitree Go2 Air is an intelligent quadruped robot, perfect for beginners…
• 【Intelligent Navigation with 3D LiDAR & Obstacle Avoidance】 Featuring ultra-wide 3D LiDAR with 360°x96° perception, the Go2 Air detects…
• 【High-Definition Vision & Seamless App Integration】 A front HD camera streams 1280×720 video to the app. Control the robot, view real-time data…

The Lynx M20 stands 820 by 430 by 570 millimeters tall and weighs 33 kilograms with its battery. It can carry a 15-kilogram payload at work and a 50-kilogram peak load. On its own, it can run for three hours and 15 kilometers before needing to be recharged, but adding a 15-kilogram weight reduces that to 2.5 hours and 12 kilometers. The good thing is that you can simply replace the battery pack without shutting down the robot. In laboratory experiments, it can achieve a speed of 5 meters per second, but in real-world use, you can expect to see around half that, or roughly two meters per second. Lynx claims it can handle slopes up to 45 degrees, continuous stairs of 25 cm, and single obstacles up to 80 centimeters high.

Two LiDAR systems, each capable of outputting 96 lines of data, provide the Lynx with a 360-degree view of its surroundings, allowing it to map them in real time at 860,000 points per second. Dual cameras and front and rear lighting provide additional capabilities, such as color vision and nite vision. On the inside, dual octa-core computers aggregate all of that data to provide the Lynx with a 3D picture of where it is and where it is heading, owing to live point cloud mapping. To top it all off, the Lynx is sealed to IP66 standards, allowing it to endure the elements. You can even upgrade its software over-the-air and stream live footage back to the operator via a radio link.

Sand that would bury a typical rover will just slide right by thanks to the Lynx’s unique adaptive stride. Lynx initially dispatched a crew to work in Tibet’s Serling Tso reserve, where soft meadows, permafrost, and gravel made for a harsh environment at an elevation of 4700 meters. More recently, the upgraded M20S model has been deployed to patrol the Tengger Desert, carrying a continuous payload of 35 kg.

The engineers improved the new version’s sealing to IP67, cold tolerance to -30C, and lab speed to 9 meters per second. Despite surface temperatures of up to 50 degrees Celsius and the occasional blast of grit in the face, the M20S has been able to carry all of its equipment, including tree markers, water, and tools, in a single trip, and has even done so with a dual-light gimbal pointing out any signs of collapsed vegetation, damaged fencing, or wildlife lurking in the darkness.