TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices that could be chained with previously disclosed flaws to achieve remote code execution (RCE).

The flaws were uncovered by Forescout’s Vedere Labs researchers, who published the full details at the Black Hat USA security conference earlier today.

Omada is TP-Link’s business networking product line that includes Wi-Fi access points, Ethernet and PoE switches, internet gateways, and VPN routers.

They are typically used by small to medium-sized businesses, although TP-Link also markets pro-grade deployments for enterprises.

ZTP is a way to deploy network devices without manually configuring each one on-site, allowing an IT team or managed service provider (MSP) to prepare everything remotely based on a predetermined configuration.

Some of the 15 flaws Forescout discovered also impact various TP-Link products and services, such as IP cameras, smart home IoT devices, mobile applications, and cloud accounts.

The issues include hard-coded cryptographic keys, information disclosure, remote code execution, device hijacking and spoofing, client-side code execution, and interception or compromise of encrypted communications.

Forescout says attackers could combine the new flaws with two previously disclosed command-injection vulnerabilities to compromise Omada’s chain of trust and infiltrate networks.

“The vulnerabilities fall into four impact categories: client-side code execution, information disclosure, device hijacking and spoofing, and compromise of encrypted communications,” Forescout explains.

“Combined with two previously disclosed CVEs (CVE-2025-7850 and CVE-2025-7851), these flaws enable concrete attacks that let attackers infiltrate networks through controllers and client devices.”

TP-Link’s advisory lists 15 newly disclosed flaws, of which 11 received the following identifiers:

• CVE-2025-9289 through CVE-2025-9293
• CVE-2025-15544
• CVE-2025-15627 through CVE-2025-15631

The remaining four findings did not receive a tracking number. They concern device adoption based only on knowing the serial number, default credentials used during initial adoption, predictable serial numbers, and files made available via unauthenticated temporary download links.

In one attack scenario Forescout described, a remote attacker could enumerate predictable device serial numbers to obtain MAC addresses and identify devices awaiting adoption.

The attacker could then impersonate one of those devices, exploit a race condition during cloud adoption, and authenticate using default credentials.

This would cause the controller to disclose the device configuration, including a cleartext username, an unsalted MD5 password hash, and potentially VPN keys.

The attacker could also inject JavaScript into the controller’s administrative interface to phish an administrator and steal their cloud-controller credentials.

Having stolen the credentials, the attacker can then reconfigure managed devices, create VPN tunnels into the internal network, and exploit previously disclosed command-injection flaws to compromise network equipment.

The flaws affect Omada Controllers, Gateways, Switches, Access Points, OLT platforms, Cloud services, and TP-Link mobile applications.

Forescout reports identifying over 1,800 internet-accessible Omada controllers, despite such deployments generally not being intended for direct internet exposure.

As for the Android applications, Omada and Omada Guard have 1.1 downloads on Google Play, while TP-Link apps collectively have 3 to 7 million active accounts.

Users are advised to visit TP-Link’s Omada download portal to source the latest firmware images for their device model.

Additionally, it is recommended to use strong, unique administrator credentials, enable multi-factor authentication (MFA), rotate all secrets when compromise is suspected, update mobile apps, and monitor network traffic for suspicious activity.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

The official unveiling of the Google Pixel 11 series is just over a week away, and the leaks and rumors keep spilling out. The latest leaks show a new, multicolored notification light on the back of the phone next to the camera setup. Google has teased the new feature in short YouTube videos released previewing the official event, which is on Aug. 12.

This isn’t the first time we’ve heard of this feature, dubbed Pixel Glow in previous rumors, but the latest leak replaces that name in favor of the less interesting HiLight. The feature itself hearkens back to the old days when many Android phones and BlackBerry devices shipped with notification LEDs. This time around, Google’s putting a bit of a spin on the feature. 

On Monday, Roland Quandt of tech site WinFuture shared a post on BlueSky with an image that appears to be official French-language marketing material, showing the Pixel 11 Pro Fold and detailing the new feature.

The text translates as, “When your smartphone is face down, HiLight lights up discreetly when your favorite contacts call or when you chat with Gemini.” 

Advertisement

HiLight replaces the temperature sensor introduced in previous Pixel devices. While the earlier sensor saw limited real-world use, HiLight is better positioned as a feature users can benefit from more consistently in everyday use. Still, there’s a reason some people choose to keep their phone face down in public. It helps avoid distractions and prevents notifications from constantly demanding their attention. By making this feature a default part of the experience, Google effectively removes that option unless users can disable it entirely. 

What is interesting about HiLight is that it appears to be a very small display rather than a static, multicolored LED. Many of the phones from Nothing Technology have LEDs that light up for notifications and timers, and perhaps HiLight will have its own customizations.

It remains to be seen whether HiLight will be able to work with other apps beyond favorite contact notifications and interactions with Gemini. Developers may have to provide support within their own apps for the feature to work, which could take time and adding support for a single feature on a single family of phones isn’t necessarily the most compelling reason for them to do so. 

We’ll learn more about the Pixel 11 family and all of its new bells and whistles next week at Made by Google 2026. We can also expect the debut of the Pixel Watch 5, which has already been spotted in, of all places, the Caribbean Sea.

Advertisement

Blake has over a decade of experience writing for the web, with a focus on mobile phones, where he covered the smartphone boom of the 2010s and the broader tech scene. When he’s not in front of a keyboard, you’ll most likely find him playing video games or watching horror movies.

See full bio

OpenAI and Anthropic have both had a rough few weeks on the AI safety front. OpenAI recently disclosed that its models broke out of a test environment and hacked into Hugging Face and four other organizations. The news prompted Anthropic to review its own testing, which revealed that Claude had also gained unauthorized access to three companies.

Now, the UK’s AI Security Institute (AISI) has disclosed a new round of incidents (via Wired). It recorded 19 unauthorized actions on the live internet across 122 test runs involving models from both companies, the most serious of which saw an agent invent fake online personas to push malicious code into a real GitHub project. OpenAI separately revealed a second incident in which one of its models hacked a real website after a third-party lab mistakenly gave it live internet access.

17 incidents tied to Anthropic’s Mythos 5

AISI traced 17 of the 19 unauthorized actions to Anthropic’s Mythos 5 model, with the remaining two tied to OpenAI’s GPT 5.6 Sol. The GitHub incident was one of the 17, and it didn’t end when a human reviewer rejected the submission. The agent posted a summary of its progress publicly, inviting other automated systems to pick up where it left off, an attempt at what AISI calls prompt injection. A separate agent later found that message, used it, and continued the work.

AISI says it deliberately gave the models internet access and relaxed some safety protections to test their capabilities, but never instructed the agents to target real people or organizations. The institute says it’s still unclear whether the agents understood they’d gone beyond the scope of the simulation.

Another accidental breach at OpenAI

A second incident, disclosed by OpenAI the same day, started with a mistake at Irregular, a third-party lab OpenAI hired to run its cybersecurity tests. Irregular meant to keep its evaluation model confined to an isolated sandbox, but a configuration error gave the model direct access to the live internet. Once out, it exploited a vulnerability to break into a real website, then found and used credentials to operate the site it had just hacked. OpenAI hasn’t named the website or detailed what the model did with its access.

Both companies say the new incidents happened under deliberately loosened conditions that don’t reflect how their public models behave. Be that as it may, that doesn’t change the fact that AI agents from two of the industry’s most closely watched companies have now slipped past their intended limits in three separate incidents within a matter of weeks. And that doesn’t bode well for an industry racing to hand AI agents more real-world tasks before proving it can keep them in check.

Emily The Engineer wanted something flashy for her smile and decided a store-bought set would never do. She set out to make her own removable gold grillz entirely with 3D printing, starting from a messy putty mold of her actual teeth and ending with two finished sets she could wear.

First, Emily made an imprint by mixing some dental putty, stuffing it into her mouth, and waiting for it to harden around all of her teeth and contours. When the mold was loose, she put some cement into it, and she had a solid 3D model of her bite, as well as the entire thing. Her friend Dan then scanned the plaster cast with a 3D scanner and submitted the digital file to Kev at VEK3D. Kev cleaned up the scan and then created a thin shell that would go directly on top of her teeth like a personalized cap.

Bambu Lab A1 mini 3D Printer + LED Lamp Kit, Ready-to-Use for Beginners

• A1 mini + LED Lamp Kit for Creative Light Projects: Bring your ideas to life with the included LED Lamp Kit. Simply print compatible lamp models and…
• The Perfect 3D Printer for Beginners: A1 mini 3D Printer is designed to make 3D printing easy from day one with automatic calibration, simple setup…
• Experience the Bambu Lab Ecosystem: Access MakerWorld’s huge library of ready-to-print models, manage prints through the Bambu Handy app, and enjoy…

Formlabs stepped in with dental-grade resin and a completely new build plate, resin tank, and wash station, assuring that nothing she’d used in her shop could contaminate the material destined for her mouth. The printer laid down the first batch of clear resin shells, and lo and behold, they slid into place almost imperceptibly, feeling stable enough to finish the job.

The next step was to convert plastic into gold using a conductive coating and electroplating. The problem was that the typical graphite paint peeled right off the flexible resin. After a few futile attempts, Emily got creative and mixed graphite powder with acetone and super glue, painted the shells, and polished the surface until the electricity started flowing freely. She began with copper, a copper sulfate bath, copper anodes, a good magnetic stirrer, and a small amount of sulfuric acid, and after weeks of testing and modifying, she was ready to go. A thin palladium barrier was used to isolate the copper from the final metal product. Gold (not that she could afford the full tank) was an issue, so she resorted to brush plating, which involved putting the gold solution on by hand with a tiny brush. Surprisingly, the resin shells turned a stunning gold.

While this was going on, Dan nearly drank half of the gold solution, mistaking it for Gatorade, which is some people’s idea of a prank, if you ask me. He also accidentally dropped several shells, which broke. Conductivity proved to be a long-standing issue, and these restarts extended the plating process over several weeks. Even so, the finished gold-plated set sat on Emily’s teeth like a dream and caught the light just as they’d hoped, even if speaking around them was clumsy and the taste remained metallic.

After finalizing the electroplated version, Emily and Kev began working on a much more personal set, One Piece, because she adored the material. Rather than plating the plastic shells again, she just sent the file to be 3D printed in metal. The service informed her that the walls appeared quite thin, yet the pieces arrived as solid as a rock. After some cautious tinkering to get a better fit, the metal grillz locked into place considerably more comfortably than the plastic ones, allowing her to speak away with ease.

DEVOPS

New React framework lowers memory usage by 90%, team claims

Next.js coders toiling on complex React applications live with an ongoing low-grade anxiety about running out of memory. It’s not dementia; it’s the software. The dev can fill RAM all day long until the JavaScript engine (often V8) chokes, causing the underlying Node.js engine to crash entirely, leaving only a “FATAL ERROR” message. 

Cognizant of such frustrations, the core development team behind Next.js have released a new version of the open source React framework that dramatically lowers memory usage by up to 90%, the team report.  

The 16.3 release, the first feature update since October 2025, also boasts faster rendering and better runtime performance, all with complete backward compatibility.

Turbopack packs a punch

The memory enhancements come from several sources.

One is Turbopack, an embedded high-performance bundler that cloud provider and Next.js maintainer Vercel added to the project. Turbopack is an incremental builder, compiling only those portions of the code since the last build time. It replaces Webpack.  

Turbopack has been bundled into Next since version 13, though the core team twiddled some defaults for this edition. Disk caching and memory eviction are both on by default. 

For example, an instance of the new Next.js managing 50 routes (each route basically equals a full URL) will consume 840 MB, or about 82% less memory than the ~4.6GB that the previous version would require. 

One developer from the White Room digital agency noticed an early release of 16.3 cut memory usage from ~4GB down to ~1.5GB, which seems “back to normal again,” they noted. Another early release user reported a drop in memory from ~20 GB to ~5GB.

Disk caching was tested on v16.1, and made default for the build process on 16.3. It reads the cache before compiling new changes, so only the new bits get compiled again. Vercel tests have shown that a project that once took 21 seconds can now be done in 9.2 seconds, representing a respectable 2.3x compilation speedup.

Likewise, memory eviction, enabled by default for the “next dev” development environ, evicts unconsulted artIfacts to disk when the OS starts to hit a predetermined threshold, reloading them into memory if needed later.  

For those willing to venture onto the bleeding edge, the package also includes an early (“experimental”) version of a  React Compiler written in Rust, which would eliminate hand-tuning memoization ( a job that previously required running the code through the Babel transpiler). This compiler, built directly in Turbopack, could cut page build times by 34% for cold builds and 46% for warm ones. 

Runtime gets a bump too

Although technically a TypeScript improvement, the Next project will take credit for TypeScript 7’s performance improvement that came by rebasing on the Go language. Simply bumping the local dependency to TypeScript v7 within the Next configuration will usher in a 10x performance improvement by the Next team’s reckoning. 

On the runtime side, this version of Next also offers faster server-side rendering, namely by eliminating the conversion of web streams in favor of native Node.js streams across the rendering layer. This allows the engine to execute 22% more requests without any changes to the code itself. 

Other performance-enhancing features include payload bundling for fewer pre-fetch requests, and better caching for static assets, thanks to the reuse of immutable assets. A new debugging tool called Instant Navigations “surfaces” slow-acting components for the frustrated developer. 

Other new features for this version include versioned docs for AI agents, custom error boundaries, and wild-card (“glob”) imports of multiple files at once. 

Next.js not kaput yet

Next.js haters claiming that the framework is losing relevance to upstarts such as Remix, Astro, or Gatsby don’t have the numbers on their side yet.

This year, Next.js has surpassed a billion downloads, according to a recent accounting by Vercel CEO Guillermo Rauch. That’s almost twice the number of downloads last year or approximately 520 million.®

Good sleep is a priceless commodity, and a big factor is what you’re sleeping on, including your mattress and pillows. Purple is one of our favorites on that front, from the brand’s super supportive-yet-soft pillows to its cooling mattresses. All to say, there’s plenty of great bedding to shop at Purple, and right now you can get it at a serious discount. You can save up to 30% off of bedding, pillows, and more from Purple, from the PerfectStay Duvet Cover Set to the Purple Harmony Anywhere Travel Set, with these Purple promo codes and deals.

Purple Promo Codes: Save on the Mattress That Fits You Best

Purple has a mattress for every type of sleeper, and we have a Purple promo code to help you save on those important sleep purchases. There are different types of mattresses to choose from depending on your need. The original Purple is the OG, with two inches of Purple’s signature GelFlex Grid for instant back pain relief, along with two layers of foam. The PurplePlus mattress has cradling support that isolates motion for a more peaceful sleep. And the luxe model, the RestorePlus hybrid mattress, allows for a cooler sleep and has lower back support with GelFlex Grid’s deep relief and zoned coils for extra comfort.

Courtesy of Mattress Firm

Save up to 30% With Purple’s Limited-Time Sales (No Promo Code Needed)

Right now, Purple has huge savings on tons of their up to 30% off sleep accessories like pillows, cushions, and sheet sets. I’ve found that all kinds of sleepers are drawn to Purple’s Freeform Adjustable Pillow and Purple Harmony Pillow in particular, especially since you can adjust it to best match your sleeping position. Plus, you can find some nice accessory bundles on sale, too.

Photograph: Eric Ravenscraft

Other Ways to Save on Purple Mattresses and Pillows

Looking for other ways to save on Purple’s sleep gear? Don’t miss Purple’s bundles that offer up to 25% off. Shoppers using FSA and HSA funds can also save an average of 30% on a mattress, since it does support your health. Check out the eligible products from Purple here to shop with those funds.

If you’re looking for a single pillow, you can score a pillow for free by signing up for Purple’s email updates. Purple also offers as low as zero percent APR if you use Affirm to shop.

Score a Friend a Free Purple Pillow

You can get a free pillow for a friend, too. When checking out for a $200 purchase as a new customer, you can choose to gift a friend a free Purple Cloud Pillow. Plus, if that friend later shops at Purple, you could get up to $75 in Amazon gift cards for your friend’s purchase.

Qualified Customers Can Get 10% Off Their Purchase

Some folks will qualify for 10% off, no matter what time of year it is. That list includes healthcare professionals, military members, first responders, teachers, students, and truck drivers. Check out how each discount works at the included links, and don’t miss your chance to save on all kinds of Purple bedding with these promo codes.

from the lies-the-trump-administration-told-you dept

This article is republished from The Conversation under a Creative Commons license. Read the original article.

The State Department on July 16, 2026, hosted what officials billed as a ministerial on the resurgence of left-wing political terrorism.

Secretary of State Marco Rubio invited representatives from more than 60 countries to Washington to hear an argument that many of them appear not to believe: that a transnational far-left terrorist movement called antifa threatens the democratic world. At the event, allies were asked to mobilize against that enemy despite nations like the Netherlands and Germany politely noting to their host that they cannot find evidence of any such group.

Some intelligence analysts have declined to brief on antifa at interagency meetings because they do not regard it as a serious counterterrorism threat.

As a terrorism scholar who spent a decade running the State Department office that designates terrorist organizations, I understand their confusion. The threat the administration describes does not exist in the form the administration describes it.

Antifa is not a group

As I and others have written before, antifa is not a group. It is a movement and an ideology, a loose commitment to opposing fascism. In its most organized form, it amounts to scattered local collectives like Rose City Antifa in Portland, Oregon.

There is no membership roll, no command hierarchy and no funding structure. There is no leader of antifa – the Trump administration has not named one – and there is no record of deadly attacks attributed to a U.S.-based organization called antifa.

Groups like the Islamic State group and al-Qaida have killed tens of thousands of people and have a documented chain of command. Antifa does not. You cannot decapitate a movement with no head, and you cannot sanction an organization that does not exist.

As such, the Trump administration created one.

Trump administration targets antifa

The construction project began on Sept. 22, 2025, when President Donald Trump signed an executive order purporting to designate antifa as a domestic terrorist organization. The order describes antifa as “a militarist, anarchist enterprise that explicitly calls for the overthrow of the United States Government.” It directs every relevant agency to investigate and dismantle its operations.

Two problems are immediately apparent. First, no legal authority exists to designate domestic organizations as terrorist groups. It’s a gap that Congress has deliberately preserved for First Amendment reasons.

Second, the order designates as an organization something the FBI’s past leadership has described as an ideology. Trump’s executive order asserts an antifa enterprise into existence and then declares war on it.

Three days after the executive order, the White House implemented the order through National Security Presidential Memorandum 7, which converts the fiction into machinery. The memorandum directs the Treasury Department to identify and disrupt financial networks that fund what it deems domestic terrorism. The memorandum instructs banks to file suspicious activity reports with the Financial Crimes Enforcement Network, the U.S. government’s financial intelligence unit.

That means the government’s financial surveillance apparatus, built to trace al-Qaida’s money in the wake of the 9/11 terrorist attacks, is being pointed at Americans that the administration considers left-wing.

The memorandum likewise directs the FBI’s Joint Terrorism Task Forces to coordinate a comprehensive national strategy to investigate, prosecute and disrupt entities and individuals. That harnesses a network of roughly 200 task forces comprising over 4,000 personnel from federal, state and local agencies.

The wording of National Security Presidential Memorandum 7 gives away the administration’s true intent. It identifies the markers of this supposed terrorist movement as anti-Americanism, anti-capitalism and anti-Christianity. It criticizes the movement for its hostility toward those who hold traditional American views on family, religion and morality.

Those are not indicators of terrorism. They are political positions.

State Department targets groups overseas

The foreign component of the campaign arrived in November 2025. That’s when the State Department designated four European groups – one each from Germany and Italy and two from Greece – as Specially Designated Global Terrorists and Foreign Terrorist Organizations pursuant to the Immigration and Nationality Act.

The State Department-designated groups are real. And some of their members have committed genuine crimes, including assaults and small-scale bombings.

But as I have noted, the designations are very peculiar. These groups have committed vandalism and harmed people, but not one of the four has carried out an attack that led to any fatalities.

German leaders have said the threat from one of the designated groups, Antifa Ost, or Antifa East, had recently decreased significantly.

As the former head of the State Department’s office that recommended to the secretary of state which groups to designate, I’ve been involved in the designations of hundreds of individuals and organizations. The bar was never this low. That’s because the Foreign Terrorist Organization list loses its meaning, and its deterrent power, when it includes groups whose body count is zero while genuinely lethal movements go unlisted.

The foreign nexus

That brings us back to the State Department’s ministerial. The sequence of events leading up to it matter:

Invent the organization by executive order; build the enforcement machinery by presidential memorandum; manufacture the foreign nexus through the State Department’s Foreign Terrorist Organization designations; and then convene the world to ratify the story. Each step launders the previous one.

Behind it all, Trump administration officials have discussed using the foreign terrorism labels to justify going after Americans with links to the movement. That is the point of the exercise, and U.S allies like the Netherlands have explained how antifa could not be designated as a terrorist group under their laws.

Counterterrorism tools are among the most powerful instruments the U.S. government possesses. I don’t believe that using them against an ideology, one defined by opposition to fascism, makes America safer. I believe it tells every ally the U.S. asks for help that the world’s leading counterterrorism power can no longer tell the difference between a threat and an opponent.

Implications of the ministerial meeting

This is not just an issue of semantics and rhetoric – each action by the Trump administration against a strawman enemy creates risks. And the push to internationalize the antifa threat could have dire consequences at home.

First, if the State Department leaves the July 16 meeting with pliable allies willing to brand antifa a terrorist organization, it will embolden the administration to point to a supposed global conspiracy of the far left.

That path leads to a State Department foreign terrorist designation. Such a designation means Americans could have their bank accounts frozen and quite possibly find themselves rounded up for providing material support to a movement rather than an organization. This would be more dangerous than Trump’s earlier executive order.

Second, it could chill freedom of speech and assembly. Once other governments treat antifa as a terrorist entity, the U.S. government gains cover to shut down protests under the guise of exposing global left-wing plotting.

Third, it could justify the revival of projects like the FBI’s Counterintelligence Program, resurrecting the surveillance, infiltration and disruption of lawful political activity that the bureau was supposed to have abandoned after the abuses of the 1970s.

Fourth, as one European counterterrorism scholar recently warned, the summit lays bare a widening split between American and European counterterrorism priorities and the Trump administration’s willingness to bend counterterrorism policy to partisan ends.

That divergence is the real hazard, far more than any phantom left-wing terrorism group, because European counterterrorism leans so heavily on U.S. intelligence. As such, transatlantic counterterrorism cooperation could be in for turbulent times.

Whatever the outcome of the ministerial meeting, there is no version that will make Americans safer.

I believe one result is certain: Genuine threats – from groups with leaders, actual funding and malicious intent – will get less attention from the U.S. and any ally co-opted to take action against antifa.

Jason M. Blazakis is Professor of Practice and Director of Center on Terrorism, Extremism and Counterterrorism at Middlebury College

Filed Under: antifa, donald trump, fear mongering, marco rubio, terrorism

• Intel shared rare x86 chip design access with a brand-new startup
• RosaicLabs can now build custom processors using licensed Atom architecture
• Intel shifted its low-power strategy from Atom towards newer E-Core designs

Intel has given RosaicLabs access to part of its Atom processor technology in a rare move involving the company’s x86 intellectual property.

Reports from Reuters claim the agreement involves register-transfer level, or RTL, code that describes processor functions before they are converted into physical silicon during manufacturing.

As soon as I heard that Gemini Spark was now part of the Chrome browser I had to try it for myself.

Gemini Spark is an AI agent designed to take on longer-running tasks that continue in the background. It’s much smoother now thanks to an update that incorporates the platform directly into Google‘s Chrome browser. So now the AI can actually browse the web alongside you, doing its own tasks, instead of simply talking about it, even if you close your browser.