Pocket cameras are becoming more popular in purses and everyday carry bags because they solve a real frustration. Phone footage seems OK until you play it back on a bigger screen or try to film while moving. Dedicated rigs give better outcomes, but they necessitate time, preparation, and, in many cases, a second set of hands. The Xtra Muse, priced at $329 (was $449), fills that gap without asking buyers to sacrifice features essential for vlogging and trip filming. It has a one-inch sensor, shoots 4K video at 120 fps, and uses a physical three-axis gimbal to steady shots.

The camera stands about 5 and a half inches tall and weighs between a hundred and 280 grams, depending on the setup. It’s big enough to be more than just a tiny smartphone, but not so huge that it can’t fit in your pocket with your wallet and keys. The box has a rough grip and a tiny threaded handle to prevent it from slipping out of your grasp when you need to hold it firmly. A small 2 inch touchscreen on the side allows you to switch from portrait to landscape mode with a single tap, which is useful if you’ve recorded a clip for YouTube or Instagram Reels and don’t want to worry about any of your clips needing additional cropping. The screen brightness increases to 750 nits, making it much simpler to take photos outside in bright sunshine. To be honest, the build quality is sturdy enough to withstand being flung into a purse or pocket, and it comes with a carrying case and wrist strap to keep it secure while on the go.

Sale

Xtra Muse, Vlogging Camera with 1” CMOS & 4K/120fps Videos, Pocket Camera with 3-Axis Gimbal Stabilizer…

• Cinematic-Style Footage – Experience the power of Xtra Muse’s 1-inch CMOS sensor, capable of recording breathtaking 4K resolution videos at 120fps…
• Ultra-Steady Shooting – No more shaky videos! Xtra Muse’s advanced 3-axis gimbal camera stabilizer ensures exceptional smoothness. Enjoy smooth…
• Effortless Framing – Enjoy Xtra Muse’s expansive 2-inch touch screen, and switch between horizontal and vertical shooting effortlessly.

Behind a fixed f/2.0 lens with a 20mm equivalent focal length is a 1 inch CMOS sensor that gathers far more light than most phones or action cameras, making a significant difference when shooting indoors or at nightfall. You will notice less noise and greater definition in the shadows, as well as more natural-looking colors. The lens also performs a good job of blurring the background, so you can get a clean subject against a chaotic background without changing any settings. If you want to get serious about your stills, the maximum resolution is 9.4 megapixels, which is more than enough for the types of fast social posts or reference images you’d be creating while on the go. The sensor, on the other hand, significantly improves video quality, particularly when combined with the 10-bit X-Log color profile.

The three-axis mechanical gimbal only moves the camera head, not the body. So whether you’re walking, jogging, or scooting around on a bike or skateboard, handheld shots will be rock solid smooth, and because it’s a mechanical system, you shouldn’t see any of the nasty warping or stretching that digital stabilization can cause, so your footage will simply look really solid and stable. Slow-motion options include 4K at 120fps and 1080p at 240fps. When you slow down footage that much, it really hits home exactly how rapid (or otherwise) the action was, and the gimbal still keeps the subject right in frame, even at those super-slow rewind periods.

A Master Follow mode makes face and object tracking much easier, essentially keeping a subject in your sights while the camera is mounted on a tripod or in your hands (as long as they are steady). Simply double-tap to lock onto that subject, and the system will take care of framing changes; there is no need to repeatedly pan back and forth. It’s useful if you’re recording yourself giving a lecture to the camera, or if you want to catch a pet or a child on the move without wrestling with the camera.

A firmware update added support for Bluetooth mics, so you can simply pair your wireless mic straight via Bluetooth, no need for any extra gear or cables dangling from the handle, and real-time audio meters are available on the touchscreen to keep track of your levels. In terms of battery life, you can expect two to three hours of recording time depending on the resolution and functions you use, which should be sufficient for most people for a day of stop-start shooting, especially if you’re a traveler or vlogger.

Age checks are becoming law worldwide. The question is no longer whether platforms verify age, but what happens to the faces they collect — and whether they need to collect them at all.

By Ricardo Amper, Founder & CEO, Incode Technologies

More than 30 age assurance laws are now in force worldwide. The UK is enforcing the Online Safety Act’s “highly effective” age check requirement, with restrictions on under-16 access to social media planned for spring 2027.

Australia’s under-16 rules took effect in December, and the government has signaled its intent to double maximum fines to $99 million after early waves of non-compliance. Brazil’s Digital ECA became enforceable in March 2026, now half of U.S. states now mandate some form of age verification.

Facial age estimation has emerged as one of the most accessible ways to comply. It needs no government ID and no database lookup, which makes it workable for users of all age groups, including those with no documents to show.

In regulated markets, Incode’s data shows users choose it eight out of ten times over other age assurance methods. But it asks people for one of the things they feel least comfortable sharing: their face. And until now, nearly every implementation has worked the same way — capture the face, send it to a server, run the estimate there.

The problem with server-based age estimation

The record shows why that is a growing liability, especially for vendors relying on third party tech stack. According to the Identity Theft Resource Center’s 2025 Annual Data Breach Report, the U.S. recorded 3,322 data compromises last year — a record high and a 79% increase over five years — while supply-chain breaches doubled over the same period.

The same organization found that 63% of consumers have expressed serious concern over biometric data collection.

Meanwhile, the attacks are scaling faster than the defenses. Across more than 7 billion identity verifications processed on its platform, Incode has tracked the rise of agentic fraud — fraud attempts carried out with the help of AI agents.

In 2024, agentic fraud made up 3% of fraud attempts. By the first quarter of 2026 it had reached 40%, and Incode estimates it will exceed 90% within the next 18 months.

Privacy by policy vs. privacy by architecture

The industry’s standard answer has been a privacy policy: a written promise that biometric data will be handled with care and deleted after the check happens.

A policy is a legal document. It is not a security control. It cannot stop a breach, an insider, or a compromised vendor; it can only assign responsibility afterward.

Privacy by architecture is a different proposition: build the system so the sensitive data never becomes accessible in the first place. If a face is never transmitted, it cannot be intercepted.

If it is never stored, it cannot be breached. Users do not have to trust anyone’s word. Privacy stops being a promise and becomes a fact of the architecture.

A $100 million commitment, in two parts

Last month, Incode Technologies, a leader in AI-powered identity verification and fraud prevention, announced a $100 million commitment to advancing privacy-preserving identity infrastructure, alongside its acquisition of Identiq, a company specializing in privacy-enhancing cryptographic solutions for peer-to-peer anti-fraud collaboration.

The funds are directed at on-device processing capabilities, continued R&D in privacy-enhancing technologies, and expanded engineering resources and global footprint.

Two weeks later, the first product was made public. On-Device Age Estimation, launched in July, the first time Incode’s proprietary models run fully on the user’s own device.

Both trace back to architectural decisions made at the company’s founding: verification driven by AI rather than by human access to biometric data, processing pushed to the user’s own device, and fraud collaboration designed to work without exposing data.

Part one: age checks where the face never leaves the device

On-Device Age Estimation runs two of Incode’s models directly inside the user’s phone, tablet, or laptop: facial age estimation and passive liveness detection, which confirms that a real, live person — not a photo, a deepfake, or a replayed clip — is in front of the camera. The face is analyzed locally and is not transmitted or stored.

What travels onward is the outcome: whether the user meets the platform’s required age threshold. If the check cannot be completed for any reason, the user is automatically offered another verification method selected by the platform.

Making that possible meant shrinking the models. Incode compressed both to roughly a tenth of their original size using knowledge distillation — a technique in which a compact model is trained to reproduce the judgments of a much larger, more accurate one.

The resulting models are small enough to run inside an ordinary browser or app, across a wide range of devices, with no special hardware required.

Because the face is analyzed on the user’s own device, there is no technical way for Incode or any client platform to access a biometric or face image. In plain terms: the user proves their age. The face stays on the device.

Why does anything reach a server at all?

An age check that is easy to cheat protects no one. What the device alone cannot fully rule out is tampering with the session itself — an injected camera feed, for example, or a manipulated device. Incode’s server-side layer analyzes session metadata — when and how the session happened, and the characteristics of the device and connection — to detect injection attacks and tampering.

That data contains no facial or biometric information; it exists for fraud detection and session integrity.

Without it, minors could appear as adults and adults as minors, and the result would be worthless for safety and compliance.

Those defenses carry the record of the environments they came from. For more than a decade, Incode’s models have operated in some of the most attacked environments online — banks, fintechs, healthcare, and other high-stakes services where fraudsters bring deepfakes, injection attacks, and replayed video every day.

Incode’s security layer achieves 99% spoof detection across deepfakes, injection attacks, replay attacks, and physical spoofing — the same anti-impersonation standard trusted by eight of the top ten U.S. banks — and has flagged more than 1 million face attacks across Incode’s platform in 2026.

On-Device Age Estimation is the first enterprise-ready offering to combine on-device age estimation with those defenses — a combination the company believes can reset the standard for how platforms verify age worldwide.

Part two: fighting fraud together without pooling the data

The second part of the commitment addresses a different exposure: the way institutions share fraud intelligence. Fraudsters collaborate across institutional boundaries; the institutions defending against them typically work alone, each seeing a fraction of the threat data.

The traditional fix — pooling customer data across institutions — solves one problem by making the other worse. Central data lakes are precisely the kind of target the breach statistics describe.

Identiq spent nearly a decade and invested more than $50 million developing patented privacy-enhancing technology that lets organizations share fraud signals without exposing customer data to any third party.

No central data lakes. No data brokerage.

Integrated into Incode’s platform, that work is projected to reach billions of verifications annually, adding network fraud intelligence to the platform’s capabilities.

“Every institution shared the same concern with us: how do we fight fraud together without giving up control of our customers’ data,” said Itay Levy, Co-Founder and CEO of Identiq.

“Identiq built the answer to that very question. As part of Incode, that answer is now available to every organization that deals with massive amounts of user data.”

The standard is being set now

The pressure comes from both directions: regulation keeps expanding, and users are increasingly demanding more privacy-preserving ways to meet it. Regulators, meanwhile, are actively deciding which age assurance methods count as effective — which makes this the period in which the standard gets set.

Incode’s position going into that period is a matter of record rather than roadmap: a compliance program spanning SOC 2 Type 2, ISO/IEC 27001, HIPAA Attestation of Compliance, FedRAMP Ready, the Age Check Certification Scheme (ACCS), and the Kantara IAL2 Component Services Trust Mark; more than 7 billion trust checks processed; and now a shipping product where the face never leaves the device, alongside fraud collaboration that never pools the data.

“We have always believed that privacy and fraud prevention are not a tradeoff, but part of the same problem — solved together or not at all,” said Ricardo Amper, Founder and CEO of Incode.

“Age checks are becoming law around the world. Our job is to do what we can so that proving your age asks as little of the user as possible.”

Try Incode’s On-Device Age Estimation

See how On-Device Age Estimation lets platforms meet age assurance requirements without the user’s face leaving the user’s device, and book a walkthrough for your team: incode.com/privacy

Sponsored and written by Incode.

7-Zip version 26.02 was released to fix a remote code execution vulnerability that could allow attackers to execute malicious code by convincing users to open specially crafted compressed files.

The vulnerability, disclosed by Lunbun researcher Landon Peng, exists in 7-Zip’s processing of XZ-compressed data.

According to an advisory from the Zero Day Initiative, specially crafted XZ data can trigger a heap-based buffer overflow, potentially allowing attackers to execute arbitrary code as the user.

While the developer has not published technical details about the flaw, the changes in the 26.02 source code suggest it is related to how 7-Zip tracks available space while decompressing XZ data.

The patch adds checks to ensure the decoder cannot write beyond the remaining available space in an output buffer, helping prevent a heap-based buffer overflow.

The advisory states that exploitation requires user interaction, such as visiting a malicious page or opening a malicious archive file.

No automatic update feature

As 7-Zip does not include an automatic update feature, users will not receive the security fix automatically. Instead, they must install it manually by downloading the latest version from the program’s official site, 7-zip.org.

Because 7-Zip is one of the most widely used archive utilities on Windows, security flaws impacting its archive features are an attractive target to threat actors.

A phishing campaign or social engineering attack could be used to distribute a malicious archive that exploits the flaw to install malware on vulnerable systems.

This is not far-fetched, as archive vulnerabilities, including those in 7-Zip, have been exploited in past attacks.

In early 2025, a 7-Zip vulnerability that allowed malware to bypass Windows’ Mark of the Web (MotW) security feature was exploited by Russian hackers as a zero-day.

Later that same year, a Russian hacking group exploited a WinRAR vulnerability tracked as CVE-2025-8088 via phishing attacks to install the RomCom malware.

There are currently no reports that attackers are actively exploiting this newly disclosed 7-Zip vulnerability.

However, users are advised to update to version 26.02 as soon as possible to reduce the risk of future attacks.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

How Apple Watch water lock works

Christine Persaud for Engadget

Why use Water Lock on Apple Watch

Christine Persaud for Engadget

Strands is the NYT’s latest word game after the likes of Wordle, Spelling Bee and Connections – and it’s great fun. It can be difficult, though, so read on for my Strands hints.

Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc’s Wordle today page for the original viral word game.

Brits bought 384 Chinese-made vehicles in 2015. Last year, they bought 285,000, according to automotive consulting firm Mobility Global. The growth is accelerating. BYD nearly doubled its UK sales in the first half of 2026 to over 37,000 units, and Chinese brands collectively hold roughly 13% of new car registrations in Britain, double their share a year ago.

The reason is a tariff gap. The EU charges countervailing duties of up to 35.3% on Chinese battery-electric vehicles and is preparing additional tariffs on plug-in hybrids. The US charges 100%. The UK charges neither. Britain applies no additional tariff on Chinese plug-in hybrid vehicles, which has made it the easiest major Western market for Chinese automakers to enter at scale. “It becomes an excellent size market that’s progressing well towards electrification and is in demand for some cheaper vehicles with that void to fill,” said Will Roberts of Benchmark, an automotive consultancy.

The price gap is stark. A Volkswagen Tiguan plug-in hybrid built in Germany sells in the UK for just over £43,000 ($58,000). The BYD Seal U built in China costs almost £10,000 less. Buyers at a Geely dealership in Maidstone told CNBC the value proposition was obvious: better equipment, lower price. Canada opened its market to Chinese EVs in January with a 49,000-unit cap, but the UK’s approach is more permissive, with no quota and no additional duties.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

China’s domestic auto market is cooling. Retail sales fell 26% in the first half of 2026 while exports rose 72%, according to the China Association of Automobile Manufacturers. That export surge has to go somewhere. Former GM board member Jon McNeill told CNBC that Chinese automakers are entering Europe “with really attractive cars at really attractive prices with technology that sort of blows away what they can buy from a European manufacturer.” Geely has already stopped building new factories and is using Volvo’s existing plants instead to sidestep tariffs and absorb overcapacity. The UK’s open door may not last: if Chinese market share keeps climbing, pressure to align with EU tariff policy will follow. For now, 285,000 cars in a single year tells its own story.

Waymo says robotaxi service has resumed after it made “temporary adjustments” in San Francisco amidst a power outage that appears to have affected around 7,000 PG&E customers in the city.

According to a screenshot posted on social media, Waymo told SF customers that service was “temporarily paused” and that “freeway routes are unavailable.”

When TechCrunch reached out to the Alphabet-owned company for comment, a spokesperson said in a statement, “We are making temporary adjustments to our service while we monitor local conditions. We know riders depend on us, and we will return to normal operations as soon as possible.”

Following the initial publication of this article, a Waymo spokesperson added that the company “decided to pause service for approx. one hour to assess the scale of the power outage affecting a large portion of San Francisco and coordinate with local officials.”

Power outages have affected Waymo service in the past, for example when a number of Waymo vehicles stalled on city streets during a blackout in December, and when a similar incident paralyzed traffic during a Golden Gate Bridge fireworks show on the Fourth of July.

As a result, San Francisco Mayor Daniel Lurie has called for tougher state regulations to “adequately address how autonomous vehicles operate during major incidents, planned or not.”

This post has been updated with additional comment from Waymo reflecting that service has resumed.

Unlike most cutting lasers, femtosecond lasers don’t vaporize materials; rather, they produce such short, intense bursts of light that the affected region is ablated without having the chance to heat its surroundings. This makes them good at cutting away material without damaging the surroundings, something [Ben Krasnow] exploited to cut cross-sections of samples while still in a scanning-electron microscope.

In this case, the samples were crickets, and before imaging they had to be prepared. First, the bodies were soaked in glutaraldehyde to cross-link the proteins and stabilize the structure. Next, a series of solvent exchanges replaced the water in the bodies with a low-surface-tension solvent; this meant that during the next step, drying, surface tension wouldn’t distort the crickets’ internal structure. Finally, the insect bodies were charred under argon, which made the bodies conductive and more absorptive to laser light.

The laser itself and the scanning galvo are mounted outside the microscope, and shine in through a transparent window. To protect the detector and electron optics from a spray of ablated carbon, a servo motor swings an aluminium shutter between these and the sample while the laser is active. This caused some mysterious problems during testing: after the first ablation run, the electron microscope’s image would contain so much noise as to be unusable, but it would improve over time. As it turned out, the shutter was painted, and the other side of the paint was getting coated with charged carbon particles. This created a small capacitor which disrupted the electron optics as it discharged. Eventually, after solving this and a few other strange problems, [Ben] was able to take several time-lapse videos of the laser gradually ablating a cricket, 30 microns at a time, revealing its inner structure.

Although scanning-electron microscopes are unfortunately shard to come by, it’s still possible to restore a secondhand microscope or, as [Ben] did, build your own. Femtosecond lasers are yet more inaccessible, though they can be used to replicate themselves.