Security

(Security) hole-ier than thou

Click To Pray, a prayer app endorsed by the Pope with hundreds of thousands of users worldwide, has leaked people’s names and email addresses for months – or longer – according to an ethical hacker who said she found and reported the security vulnerability six months ago to no avail. This app needs to take a vow of silence when it comes to your personal information.

The app, available in seven languages and on iOS, Android, and clicktopray.org, is the official app of the Pope’s Worldwide Prayer Network. It connects users across the globe to pray for the Holy Father’s intentions, and as of July 2026, it has 719,517 registered accounts.

It’s also very leaky, according to security sleuth BobDaHacker, who says she spotted and disclosed the vulnerability to the Pope’s Worldwide Prayer Network on January 3.

“The vulnerability is still live,” the hacker said in a Friday blog. “Nobody has ever responded. I guess my email wasn’t in their prayers.”

The Reg readers likely remember BobDaHacker for her previous research exposing a free-food flaw in McDonald’s ordering system and open controls on Chinese robot manufacturer Pudu Robotics.

This latest security hole stems from an Insecure Direct Object Reference (IDOR) bug in the prayer app. This is a very common and easy-to-exploit type of flaw that occurs when a website or an app blindly accepts user-provided input to view or modify resources without checking to see if the user is actually authorized to retrieve the data.

“You ask for your own data, the server gives it to you,” BobDaHacker explains. “You ask for someone else’s data, the server gives you that too. Thou shalt not authorize, apparently.”

When you sign up for a Click To Pray account, the app assigns you a sequential numeric user ID. As BobDaHacker uncovered, the API endpoint GET https://api[.]clicktopray.org/user/users/{id} will return user data for any account – not just your own account – so long as you supply a valid, five-digit user ID. 

It doesn’t perform any authorization check or ownership validation. “Just increment the number and get someone else’s data,” she wrote.

This data includes users’ email addresses, first and last names, country, dates of birth, and whether the account has been deleted, and the API exposes all 719,517 accounts on the prayer site. “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform,” the hacker explained. “One GET request per user. for i in range(1, 719518): scrape(). That’s it. That’s the exploit.”

As BobDaHacker points out, many of these users are likely older individuals, not all that tech savvy, and very trusting of anything Vatican related, making these exposed accounts a “phishing goldmine.”

“Imagine getting an email that says ‘The Holy Father requests your urgent attention’ with a Vatican-looking link,” she wrote. “Grandma is clicking that. Every time.”

And then it gets even worse.

The signup endpoint, POST https://api.clicktopray.org/user/users/sign-up, returns the account’s validation_hash directly in the response body, and that value is the same UUID used in the email verification link. This means someone could sign up using any email address and verify the account before the confirmation message reached the inbox.

Plus, BobDaHacker’s email client flagged the real verification email with a warning that it had failed the domain’s authentication requirements and might have been spoofed or improperly forwarded.

“So not only is the API leaking 700,000 email addresses that could be used for phishing, but the real emails from Click To Pray already look like phishing,” the hacker noted. “An attacker wouldn’t even need to try hard. They could send a pixel-perfect phishing email and it would have the same level of email authentication as the real thing: none. God works in mysterious ways.”

The Register reached out to the Pope’s Worldwide Prayer Network and did not receive any response. BobDaHacker says she’s still praying for one, too.®

Your battery is continually losing charge.

Why the battery depletes

Rawpixel/Getty Images

Keep it half charged

Nature/Getty Images

Tips for keeping the battery healthy

Korosi Francois-Zoltan/Shutterstock

SCIENCE

So, how are those commercial replacements working out for you, NASA?

This week marks 15 years since a Space Shuttle last returned from orbit and the end of NASA’s Space Shuttle program.

Space Shuttle Atlantis landed at the Shuttle Landing Facility (SLF) at Kennedy Space Center 15 years ago this week, marking the final mission for the program.

STS-135 was originally designated STS-335, the Launch On Need (LON) mission for the previous STS-134 flight of Space Shuttle Endeavour. LON missions had been a feature of the Space Shuttle program following the Columbia disaster.

If a Space Shuttle was damaged, another could be launched at short notice to rescue the crew. NASA assigned Launch On Need flights separate STS-3xx designations, so the rescue mission for STS-116 was STS-317, STS-117 was STS-318, and so on. There were exceptions (a notable one was the STS-125 Hubble servicing mission, which had STS-400 ready to go if anything went wrong), but the Space Shuttle program should have ended with STS-134.

However, lawmakers and NASA managers opted to make STS-135 the final Space Shuttle mission. There could be no Launch On Need mission waiting in the wings this time around – the Space Shuttle program was being wound down – so the crew would have had to come down from the International Space Station (ISS) aboard Soyuz capsules if Atlantis could not return to Earth safely. There were also only four crew members, a figure not seen since the STS-6 mission of Challenger in 1983.

The crew was commanded by Christopher Ferguson, who would later join Boeing’s Commercial Crew Program and was assigned to (although did not fly) Boeing’s calamity capsule, the Starliner. The pilot for STS-135 was Douglas Hurley, who went on to fly the first crewed test flight of SpaceX’s Crew Dragon in 2020. Rounding out the crew were mission specialists Sandra Magnus and Rex Walheim.

The launch occurred on July 8, 2011, and Atlantis returned from orbit on July 21, bringing the Space Shuttle program to a conclusion.

It wasn’t, however, the end of crewed spaceflight for the US, although the gap that followed was considerably greater than expected or hoped. After the Space Shuttle retired, the US was dependent on Russia for getting its astronauts to and from the ISS. NASA later awarded Commercial Crew contracts to SpaceX and Boeing to restore launches from US soil, but it took SpaceX until 2020 to get the first humans to the outpost, and Boeing until 2024.

The latter’s mission was marked by ignominy due to failures and faults during the mission that meant managers opted to send the capsule back to Earth empty from the ISS and have the Starliner flight test crew return in 2025 aboard a SpaceX vehicle. NASA and Boeing have yet to set a definitive date for when a crew might venture to the ISS once again aboard Starliner.

All of which, 15 years after a Space Shuttle returned from orbit for the last time, has left the US space agency in a bit of a pickle. Instead of depending on the Space Shuttle, the plan was to reduce risk and add redundancy to US capabilities with two providers, but things haven’t worked out that way. To make matters worse, there is uncertainty about how much longer SpaceX will continue to fly the Crew Dragon beyond its contracted missions. The vehicle is reusable, but no more are planned to be manufactured, and SpaceX reckons that each should be good for 15 flights, with some refurbishment.

This should be enough to get through to the end of the ISS program and beyond, but in the longer term an alternative will be required. For SpaceX, this will likely be Starship.

The fate of the Space Shuttles themselves is also not completely set. Atlantis has been staged in a facility at Kennedy Space Center as if in orbit, and the California Science Center has mounted Space Shuttle Endeavour on an external tank and solid rocket boosters, as though ready for launch. The fate of Space Shuttle Discovery is, however, uncertain. Certain lawmakers would very much like to transport the retired orbiter from the Smithsonian’s Steven F. Udvar-Hazy Center in Virginia to Houston, Texas.

For others, well, there’s always a used Orion capsule. ®

Apple is currently aiming to unveil its first smart glasses at next June’s Worldwide Developers Conference, with a consumer release by the end of 2027, according to Bloomberg’s Mark Gurman. But the company’s engineering and marketing teams are still wrestling with a question that will define the product: whether its glasses should include a camera at all. The teams developing the device, code-named N50, within Apple’s Vision hardware group see privacy as the top priority, Gurman reported on Saturday.

That caution is a direct response to the backlash Meta created. Meta has sold more than seven million pairs of its Ray-Ban smart glasses, but the product’s camera has become a lightning rod for privacy complaints, with women being secretly filmed in public and Kenyan data workers reporting they were asked to review intimate footage captured by the devices. Apple executives are acutely aware that simply entering the same category risks undermining a privacy reputation the company has spent more than a decade building.

Apple is planning safeguards that go beyond what Meta and Samsung have offered. The company will favour on-device processing, eschew facial recognition, and avoid anything resembling Meta’s proposed “super-sensing” mode, which would continuously analyse a wearer’s surroundings without activating the recording indicator light. Apple also does not plan to follow Meta’s practice of having contractors review footage captured by its glasses, having already dealt with a similar controversy around its Siri voice assistant.

One option Apple executives have debated would include the full camera system but disable photo and video recording entirely, limiting the cameras to feeding visual data into AI tools that identify objects and places. Another prototype eliminates the camera hardware altogether, retaining hands-free Siri access, music playback, and phone calls without any recording capability. Both approaches would sacrifice what has made Meta’s glasses popular: effortless first-person video of holidays, children, and sporting events.

The privacy problem is not theoretical. Apple is entering one of the most important product cycles in its history, with the 20th anniversary iPhone, a second-generation foldable, camera-equipped AirPods, and new Macs all expected in 2027. Courtrooms across New York State have already banned smart glasses, Royal Caribbean has barred them from casinos, restrooms, and children’s areas, and Samsung has called the privacy situation an “industry-shared problem” requiring a collective fix.

The glasses were originally targeted for introduction later this year under the N50 code name, but Apple delayed the timeline partly to refine its privacy message. The company knows from experience that good intentions do not prevent misuse: its AirTags, designed to locate belongings, quickly became associated with stalking. Camera-equipped glasses will inevitably face similar problems, and Apple will likely spend years updating software and working with regulators to address them.

The first half of 2026 has been marked by waves of economic uncertainty. From fuel prices to inflation to market dives, here’s why leaders should stay flexible as they prepare for the uncertain months ahead.

Furthermore, it has been marked by significant economic volatility. Business leaders have had to navigate a uniquely unpredictable market defined by wild swings in gas prices, better-than-expected inflation readings, jumpy consumer behavior and jittery markets.

Close up crypto trading,Photo by Rafael Minguet Delgado

As leaders look to the months ahead, they are bracing for more volatility. Here’s a quick snapshot of the past six months and a look at how flexibility will define success in the latter half of 2026.

Unpredictable Fuel Prices

In 2025, EY noted that fuel would be a difficult area of the economy to prepare for in the short term. While some market conditions appeared favorable, EY also noted that the global nature of the oil, gas and chemicals sector continued to create uncertainty.

In 2026, that prediction has been proven true more than once. By March, gas prices jumped sharply in reaction to global supply concerns. Crude oil prices rose quickly, pushing prices at the pump from $2.98 per gallon of regular gasoline in late February to $4.08 per gallon on April 2, more than a dollar in just over a month.

Easing tensions in late spring led to a quick drop as supply fears faded. All seemed to be heading back to normal. But by mid-summer, prices were on the rise again as potential oil supply chain disruptions once again became a topic of concern.

While there is no clear indicator of what is to come next, a year ago EY was already saying that companies will face a degree of uncertainty that will be higher than has been seen in several years. This won’t necessarily lead to higher fuel prices and less activity in the latter half of 2026. But it is a distinct possibility, and businesses are clearly bracing for the unknown.

EY added that even in the oil, gas and chemicals sector itself, businesses are looking for ways to manage the uncertainty. Mergers and acquisitions will likely continue, fueled by companies looking for cost advantages that reinforce their ability to survive economic downturns.

Inflation and Markets Aren’t Helping Ease Volatility

While gasoline prices have a trickle-down effect on the global economy, there are other factors that are exacerbating the current state of the economy, as well. Once again, these are a melting pot of good and bad news that is making it increasingly difficult for leaders to predict what comes next.

For example, in June, the Consumer Price Index (CPI) reading dropped by 0.4%. This brought the annual inflation rate down to a less-than-expected 3.5% reading. This was pleasant news for consumers and business owners alike.

Despite the good news, a simultaneous tech sell-off in June hit stocks hard. The tech sector was particularly vulnerable, and in a single day early in the month, the Nasdaq dropped by 4.1%, resulting in the loss of an entire month of gains. The sell-off has continued in fits and starts, and as of this writing, even the much-lauded ticker for an industry-leading space company has dropped below its IPO price within weeks of meteoric initial gains.

Planning in an Unplannable Economy

The one predictable thing in the current economy is that nothing is consistent. Good news and bad news are balanced, pulling markets in different directions and leaving many businesses bracing for more economic volatility in the months to come.

The hardest part of the equation is the fact that few, if any, of these developments are actually resolved. Gas prices, for instance, could continue to rise, limiting consumer spending. But they could also find relief if geopolitical tensions ease again. If that were to happen, it could open opportunities for businesses to take advantage of improved consumer sentiment.

The real factor all business leaders should be investing in isn’t predicting an accurate roadmap for the next few months. Instead, they should be investing in adaptability, resiliency and contingency plans. The more leaders can maintain a degree of flexibility through things like cash savings and flexible decision-making, the more likely they will be to make the most of the months ahead.

The eventual launch of Apple Glass is still expected in 2027, but based on how people distrust Meta’s smart glasses, Apple may have a challenge ahead of it.

Smart glasses have been rumored to be in development at Apple for quite a while, and aren’t expected to emerge from Cupertino anytime soon. But, when Apple actually does ship them, it will have to deal with the problem of privacy.

In Sunday’s “Power On” newsletter for Bloomberg, Mark Gurman discusses the privacy implications of smart glasses. Specifically how Apple must work hard to counter the distrust of consumers who are jaded by versions sold by Meta.

Apple will be introducing its first smart glasses at WWDC in 2027, Gurman writes, followed by a consumer release by the end of the year. The summer launch is intended to give developers an opportunity to start building apps before the public gets a chance to buy the hardware.

It’s apparently taken so long to get the glasses ready because Apple is concerned with how it maintains its image of maintaining privacy. Something both the engineering and marketing teams at Apple are working on.

While Apple’s Vision hardware group insists privacy is the top priority, it has to contend with what’s already on the market. When it comes to smart glasses, that means the releases from Meta.

Though Meta does get some credit for being a commercial success when it comes to smart glasses, it’s only part of the story. Meta’s reputation for failing when it comes to privacy protection has become an anchor around its neck.

This has had the result of poisoning the well when it comes to consumers. People are not content with being around people wearing cameras on their head, due to the possibility of being recorded while conducting everyday activities in public.

While the world is used to smartphone cameras being a problem, the stealthy nature makes smart glasses seem worse to consumers. Meta has worked to ally those privacy fears, including using an indicator light that disables recording if it’s been tampered with by the user.

The Apple Way

Apple wants to include similar protections, but it does so with a reputation for privacy to uphold. While it could use the same privacy-forward messaging, Apple is also going to try to distinguish itself from rivals in various ways.

The favoring of on-device processing and avoiding features like facial recognition or Meta’s “super-sensing” mode should help Apple. Add in a pledge not to use the cameras or recordings for AI model training and steering clear of using third-party contractors to review footage could help too.

Apple’s also working on a number of hardware and software-based privacy features, with the glasses in mind.

There’s also the prospect of Apple eliminating the camera element, and instead providing access to AI features, calls, and audio without visual assistance. Apple has apparently already prototyped something similar.

Executives have considered the possibility of including cameras, but just for the AI tools to see the world.

This would be similar to the idea of external cameras on the rumored AirPods Pro, so AI can identify real-world items and mention environmental elements to the user. Not for users to take photographs or videos at all.

Apple has a tough challenge ahead of it in convincing the world that its smart glasses aren’t privacy-destroying devices. At least the company has a year to refine its plan before it needs to brace the users for the release.

Paramount Skydance wanted to own Warner Bros. Discovery by September, but the $110 billion transaction is now frozen while 12 states and the Writers Guild of America pursue Clayton Act cases that could decide who controls a substantial piece of Hollywood. Instead of closing the deal, Paramount may spend much of the next ten months paying for the privilege of waiting.

Paramount, Warner Bros. Discovery, a coalition of 12 state attorneys general and the Writers Guild of America have agreed that the proposed acquisition cannot close until five days after the court rules on the merits of the antitrust cases or June 1, 2027, whichever comes first.

The agreement also prohibits Paramount and Warner Bros. Discovery from taking steps to integrate or consolidate their operations. The companies therefore remain separate, and the planned combination of Paramount Pictures, Warner Bros., CBS, CNN, HBO, Showtime, Paramount+, HBO Max and dozens of cable networks has been placed in legal cold storage. 

The deal values Warner Bros. Discovery at approximately $81 billion in equity and $110 billion including debt, with Paramount agreeing to pay $31 per share in cash. It would be one of the largest media transactions ever completed, assuming it ever gets completed.

This stopped being a conventional merger review some time ago. It has become an expensive courtroom battle involving federal regulators, Democratic state attorneys general, Hollywood labor groups, international competition authorities and enough political baggage to fill several private jets.

The August Hearing Is Gone

The new agreement replaces the shorter temporary restraining order issued on July 20 by U.S. District Judge Araceli Martínez-Olguín of the Northern District of California.

The cases are The State of California et al. v. Paramount Skydance Corp. et al., Case No. 4:26-cv-07116-AMO, and Writers Guild of America, West, Inc. et al. v. Paramount Skydance Corp. et al., Case No. 4:26-cv-07212-AMO.

The judge had originally scheduled an August 3 hearing to determine whether the merger should remain blocked under a preliminary injunction. That hearing and its associated briefing deadlines have now been canceled. The WGA has withdrawn its preliminary injunction motion, although both the states and the guild may renew those requests later if necessary. 

The parties must submit proposed trial schedules by July 31. No trial date has been established.

Paramount is calling this a victory because it removes the immediate preliminary injunction fight and creates a more direct path to a full trial. California Attorney General Rob Bonta and New York Attorney General Letitia James are also calling it a victory because Paramount cannot complete the transaction while their cases proceed.

Both sides are declaring victory, because nothing says “we won” quite like Paramount preparing to burn through roughly $7 million per day while everyone waits for a judge to decide whether the deal survives.

What the Judge Found

The July 20 ruling was not a final determination that the merger violates antitrust law. Judge Martínez-Olguín did, however, find that the states had presented enough evidence to justify stopping the companies from closing while the court considered the larger case.

The states identified three markets that they claim would be harmed:

1. Distribution of wide release theatrical films
2. Distribution of anticipated top grossing theatrical films
3. Licensing of basic cable channels to distributors

For the temporary order, the judge focused primarily on wide release theatrical distribution.

According to the states’ evidence, Paramount and Warner Bros. would hold an estimated 27 percent share of that market. The proposed combination would also increase the Herfindahl Hirschman Index, a standard measure of market concentration, by approximately 359 points to 2,074.

The court found that those figures created a substantial enough presumption of reduced competition to justify maintaining the status quo. It also found that allowing the companies to close could result in operational consolidation, the exchange of competitively sensitive information and employee terminations or reassignments that would be extremely difficult to reverse. 

Once the corporate omelet has been cooked, courts are generally not enthusiastic about being asked to put the eggs back in their shells.

The judge also declined to accept Paramount’s argument that greater efficiency in streaming would offset potential damage in the theatrical market. That does not mean the streaming argument is irrelevant to the final case, but it was not enough to defeat the states’ request for temporary relief. 

Paramount Says the States Are Fighting the Wrong Industry

Paramount argues that the states have defined the entertainment market too narrowly.

Its position is that Paramount and Warner Bros. Discovery do not merely compete with Disney, Universal and Sony. They compete with Netflix, Amazon, Apple, YouTube and technology companies with vastly greater resources than most legacy Hollywood studios.

That argument deserves more than a dismissive shrug.

Paramount and Warner Bros. Discovery are both trying to survive an industry in which cable revenue continues to deteriorate, theatrical attendance remains inconsistent and streaming requires enormous spending before anyone discovers whether there is a sustainable business underneath it.

Paramount insists that combining the companies would create a stronger competitor, increase investment in films and television, and provide consumers with a more credible alternative to the largest technology backed entertainment platforms.

The Trump administration’s Department of Justice reached a similar conclusion when it closed its investigation in June. The Antitrust Division said its extensive review indicated that the transaction would increase competition and benefit American consumers and workers. 

The European Commission has also approved the merger, although it imposed conditions involving Paramount’s European film distribution relationship with Universal. The United Kingdom’s Competition and Markets Authority is still examining the transaction. 

The States and Writers See Fewer Doors

The states argue that creating scale by removing another major competitor is not a solution. It is merely concentration wearing a more fashionable suit.

The combined company would control two of Hollywood’s five major film studios, more than 50 basic cable channels, CBS, CNN, HBO, Showtime, Paramount+, HBO Max, Discovery+ and three major television production operations. 

For movie theaters, fewer major distributors could mean less negotiating leverage, less favorable revenue sharing and fewer films receiving wide theatrical releases.

For writers, actors, directors and production workers, fewer independent buyers can mean fewer places to pitch a project, fewer competing employment offers and greater power concentrated within one corporate structure.

That is the heart of the WGA’s separate Clayton Act case. The guild argues that the merger would reduce writing opportunities, weaken compensation and leave creators with fewer employers. The July 24 standstill agreement applies to both the states’ lawsuit and the WGA action. 

Paramount says a stronger company would produce more. The WGA fears a larger company would have more power to produce less and pay less for it.

Welcome to the actual fight.

Has Politics Replaced What Is Best for the Industry?

The political divide is impossible to ignore.

Every attorney general involved in the state lawsuit is a Democrat. The Trump administration’s Justice Department, meanwhile, cleared the merger and issued an unusually detailed statement arguing that the transaction would strengthen competition.

Critics have also raised questions about the Ellison family’s relationship with President Trump and about what Paramount ownership could mean for CNN, particularly after the editorial upheaval surrounding CBS News. 

There is no court finding that the Justice Department’s decision was politically motivated. The party affiliation of the attorneys general does not invalidate their market analysis either.

But the optics are dreadful.

One political camp sees the merger as a necessary counterweight to Netflix and Big Tech. The other sees it as an illegal concentration of entertainment, news and employment power. Each side insists it is protecting consumers, workers and democracy, which is generally the moment one should check that the silverware is still on the table.

The more important question is whether either side is still focused on the structural problem facing the industry.

Legacy studios need greater scale to compete with technology companies capable of subsidizing entertainment from cloud computing, advertising, hardware sales and other businesses. Yet repeatedly combining studios also leaves fewer buyers for creative work, fewer independent decision makers and an ever smaller number of companies deciding what gets produced and distributed.

Hollywood is being asked to choose between concentration and irrelevance. Neither option looks especially healthy.

The $7 Million Daily Meter

The delay comes with a substantial financial cost.

Paramount agreed to pay Warner Bros. Discovery shareholders an additional 25 cents per share for every quarter the merger remains incomplete after September 30, 2026. That works out to approximately $650 million per quarter, or roughly $7 million per day.

Should the legal battle run until June 2027, Paramount’s additional payments could approach $1.7 billion. 

Paramount accepted that provision while competing against Netflix for Warner Bros. Discovery. It helped make Paramount’s offer more attractive by transferring much of the regulatory delay risk away from WBD shareholders.

The company cannot now act surprised that someone eventually turned on the meter.

What This Means for Subscribers

Nothing changes immediately for Paramount+ or HBO Max subscribers.

The services will remain under separate ownership while the cases proceed, and the companies cannot begin integrating their operations under the proposed transaction. Any combined streaming platform, unified technology system or larger corporate restructuring must wait.

That does not prevent Paramount+ or HBO Max from independently changing prices, programming or subscription tiers. Streaming companies have never required a federal judge’s assistance to make a monthly bill more irritating.

The longer delay also leaves open major questions involving theatrical distribution, physical media, licensing arrangements, CNN and CBS News, and the future of overlapping cable networks.

Employees face the least appealing version of corporate uncertainty: potentially ten months of waiting to learn whether their departments will eventually be combined, sold, reduced or eliminated.

The Bottom Line

The Paramount Warner Bros. Discovery merger has moved beyond regulatory review and into a full contest over what competition in modern entertainment actually means.

Paramount has a legitimate argument that traditional media companies need greater scale to compete with Netflix, Amazon, Apple and YouTube. The states and the WGA have an equally legitimate concern that combining two of Hollywood’s five major studios could reduce competition for audiences, theaters and creative workers.

The court must now decide which market definition reflects reality: the narrower world of studios, theatrical distribution and cable licensing, or the much larger ecosystem dominated by global streaming and technology platforms.

Politics has not merely entered the discussion. It is sitting at the head of the table and asking everyone else to explain themselves.

The merger might still happen. It might be blocked. It could also collapse beneath the weight of legal fees, ticking payments and corporate fatigue.

For now, Paramount and Warner Bros. Discovery remain competitors, the trial clock has started and the financial clock begins on September 30.

Hollywood wanted a new empire. It received two antitrust cases, a political war and a $7 million daily invoice.

Related Reading: