When I started at Spectrum 25 years ago, a senior editor suggested that I find a “rabbi,” by which he meant someone who could mentor me in how EEs approach problems and evaluate potential solutions.

I didn’t find one right away. Then in 2005 we decided to do a special report, focusing on the challenges of enterprise software development. I suggested we invite IEEE Life Senior Member Robert N. Charette, a self-described risk ecologist, prolific book author, and leading authority on risk management and software engineering, to explore in our pages the myriad reasons software projects fail. His seminal article “Why Software Fails” is still read in university engineering classes today.

IEEE Life Senior Member Robert N. Charette is one of IEEE Spectrum’s most prolific authors.Robert N. Charette

It was, as they say, the beginning of a beautiful friendship. I had found my rabbi, one who shared my love of writing. We settled into a rhythm that would last more than 20 years, talking on Friday mornings about a range of topics including the growing ubiquity of software in our lives.

So when I became Spectrum’s website editor in 2007, he was the first contributor I tapped to start a regular blog (remember those?). The Risk Factor was born and over the course of more than 10 years and 1,750 posts, Bob chronicled hundreds of software debacles, culminating in “Lessons From a Decade of IT Failures,” which won a Jesse H. Neal Award for Best Infographics in 2016. Ironically, yet predictably, those infographics were created in a software package that is no longer supported and thus are lost to the bits of time.

“I like the expression on the fish just before it’s going to be swallowed by the heron.”Robert N. Charette

Bob, however, was not a one-trick pony. In between his full-time job running his two management consultancies and raising a future biochemist and a future civil engineer, his daughters Maura and Megan, he also wrote many deeply reported and insightful articles. These include last year’s “The Doctor Will See Your Electronic Health Record Now,” the eye-opening 12-part series and e-book The EV Transition Explained, and my personal favorite “Automated to Death,” about the deadly consequences of the automation paradox as manifested by the cyberphysical systems that pilot planes, trains, and automobiles.

“The young bald eagle I photographed in September 2024 had bands that I could read which identified it as a female born in May 2024, near Lexington Park, St. Mary’s County, Maryland, about 65 miles away from where I live.”Robert N. Charette

His main goal all along has been to make software visible, as he told me one Friday in July. “Software is all around us, but we don’t recognize it at all,” he said. “I really wanted my stories to help people better understand complex software systems. You can’t see software, you can’t touch it, you can’t taste it. You may feel the consequences of software failure, but you never see the reason itself.”

When he told me that he was hanging up his hat as a contributing editor to focus on nature photography and to write a handful of fictional trilogies, including one entitled “The STEM Murders” featuring an engineer-turned-detective and his rabbi, I asked him which of his Spectrum articles had the biggest impact.

“The hummingbird I caught with the yellow of a road curb behind it.”Robert N. Charette

He singled out the 2013 feature “The STEM Crisis Is a Myth.” “Spectrum gave me a platform to question the assumption that we needed more STEM graduates. Until then, people didn’t really realize how much of the STEM crisis was a mythology that was perpetuated by employers and the academic community and was foisted on the IEEE community,” he said.

Charette made a career of questioning assumptions. The best way to mitigate risk, he told me as our Friday chat drew to a close, is to be careful making assumptions in the first place. “My main risk maxim is assumptions made are risks accepted.”

A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE).

Rails is a popular open-source web application framework written in Ruby for building websites and web apps. It uses the built-in Rails component Active Storage for handling file uploads and attachments.

Rails maintainers published an advisory about the CVE-2026-66066 flaw, which received a critical severity rating.

Active Storage may also generate image thumbnails from uploaded media using image processing libraries such as libvips or ImageMagick.

According to the security bulletin, CVE-2026-66066 is exploitable when libvips is used, allowing an attacker to upload a specially crafted image to a vulnerable application and read arbitrary files on the server.

Another prerequisite for the attack is that the server needs to allow image uploads from untrusted users.

If these requirements are met, an attacker may access app files, including the process environment, which typically contains ‘secret_key_base’ and credentials for databases, cloud storage, and other services.

CVE-2026-66066 impacts Active Storage before 7.2.3.2, 8.0.x before 8.0.5.1, and 8.1.x before 8.1.3.1.

Rails 6.x is only affected if Active Storage has been configured outside its defaults.

The Rails team recommends upgrading to libvips 8.13 or later and rotating the ‘secret_key_base’ (the Rails master key), database credentials, Active Storage service credentials, and any other secrets accessible to the application process.

For systems running libvips 8.13 or later, administrators can temporarily disable the vulnerable functionality by setting the VIPS_BLOCK_UNTRUSTED environment variable or calling Vips.block_untrusted(true) when using ruby-vips 2.2.1 or newer.

There is no workaround available for apps that use libvips before 8.13.

ImageMagick users are not affected by this vector. However, libvips is the default processor in the official Rails Docker images, and also Debian and Ubuntu setups.

The Rails team said it has intentionally withheld technical details for the vulnerability to reduce the risk of exploitation before users have time to apply the updates.

Full technical details were initially scheduled to be disclosed on August 28 on the Rails forums.

However, because public proof-of-concept (PoC) exploits became available very quickly, the maintainers decided to publish the full details as well as forensic investigation tooling.

The vulnerability was discovered and responsibly reported to the Rails team by researchers from Ethiack and GMO Flatt Security Inc.

Security firm Akamai has also published a warning about CVE-2026-66066, naming the attack chain “KindaRails2Shell,” and warning about its RCE potential.

“With the secret_key_base compromised, the attacker holds the master cryptographic key to the application,” explains Akamai.

“They can forge session cookies, sign global IDs, and manipulate serialized data, which directly translates into full RCE on the underlying server.”

Akamai says it coordinated with Ethiack before public disclosure to prepare protections for customers, and has now released web application firewall (WAF) protections.

Ethiack noted that a WAF might buy admins some time, but attackers using AI tooling should be able to reconstruct the attack chain based on the patch diffs.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

In a nutshell: Amazon’s growing use of AI across its operations is starting to expose a practical problem: the technology can become expensive quickly, and in some cases, no one notices until the bill is already high. Internal discussions reviewed by the Financial Times show that several AI-driven projects at the company have run over budget, sometimes by a wide margin.

In one case, Amazon spent $1.8 million on a project that used Anthropic’s Claude Sonnet model to match author information with product listings. The system ultimately failed, and spending exceeded the original budget by 860%. The issue went undetected for five months.

Engineers say the problem isn’t limited to one project. As more teams shift from traditional software to AI models, routine mistakes are becoming far more costly. Tasks that once required minimal computing resources now depend on systems that charge based on usage, often measured in tokens. When those systems are misconfigured or left unchecked, costs can climb quickly.

During a recent internal meeting, senior engineers described these errors as “catastrophically expensive,” noting that similar mistakes in conventional systems were “trivially cheap.” The difference comes down to how AI workloads are priced and executed. Instead of predictable infrastructure costs, teams are now dealing with variable expenses that depend on how often models are called and how they are used.

Other projects have run into similar issues. One effort to build a financial auditing tool generated about $541,000 in unexpected costs. Another project aimed at improving delivery speeds in Amazon’s logistics network incurred $134,000 in additional spending, and it took more than two weeks to catch the problem.

According to people familiar with the situation, engineers are now working on safeguards to prevent similar incidents from happening again. These include automated controls to limit how AI systems are used and improved real-time spending tracking.

Part of the challenge is visibility. “It’s difficult to figure out how much anything [AI related] costs,” one senior Amazon employee told the Financial Times. Unlike traditional software systems, where costs are easier to estimate, AI introduces more moving parts. Model calls, prompt chains, and autonomous agents can all drive usage in ways that are difficult to track until after the fact.

Amazon, for its part, says the company is still in a learning phase. “As with any new technology, we’re experimenting, learning and improving how we use it, including how we drive cost efficiencies,” the company said in an internal presentation.

It also pushed back on the idea that these incidents reflect broader problems, adding that “Cherry-picking small, isolated examples where teams are learning from one another and portraying them as business as usual doesn’t reflect how teams across Amazon are using AI.”

Still, the examples point to a broader shift happening across the tech industry. As companies move away from fixed pricing models and toward usage-based billing, AI costs are becoming harder to predict. Systems that rely on autonomous agents can generate large volumes of activity, sometimes far beyond what teams initially expect.

Amazon has already encountered related issues elsewhere. Earlier this year, AWS experienced outages tied to errors from AI coding tools. In response, the company limited what those tools were allowed to do rather than giving them full access. It has also stepped back from internal efforts to encourage heavy AI usage after costs began to rise.

For a company of Amazon’s size, the financial impact of these overruns is relatively small. The business generates more than $180 billion in revenue each quarter and is expected to spend heavily on AI infrastructure this year. But the incidents highlight a more fundamental issue: managing AI costs requires a different approach than managing traditional software.

Time to deal with that overflowing drawer of tangled old cables.

Go to a local chain store or other depot

Savanevich Viktar/Shutterstock

What cables should you keep?

kurgenc/Shutterstock

What just happened? X has ended a high-profile dispute with the World Federation of Advertisers, closing a legal fight that had become a proxy for broader tensions between the platform and the advertising industry. The company, owned by Elon Musk, confirmed that both sides had agreed to resolve the case and move forward.

In a joint statement, X Corp. and the WFA said they were “putting the litigation . . . behind them” and that the agreement “resets the relationship between the two organizations.” Neither side disclosed the terms.

The settlement brings an end to one part of a lawsuit X filed in 2024, accusing the WFA and several major advertisers of coordinating an “illegal boycott” that diverted “billions of dollars” away from the platform. A federal judge dismissed the case earlier this year, but X appealed in April. That appeal is still ongoing against the other companies named in the suit.

At the center of the dispute was the Global Alliance for Responsible Media, a WFA-backed initiative launched in 2019. Garm was designed to help brands avoid placing ads next to harmful or illegal content, an issue that has become more complex as ad buying has shifted toward automated systems and AI-driven placement.

X argued that the standards promoted through Garm effectively pressured advertisers to pull their spending. The WFA and participating brands rejected that claim, maintaining that companies have the right to decide where their ads run.

As part of the agreement, the WFA said it will not “form or restart Garm or a similar initiative.” That decision removes a widely used framework that had shaped how platforms, agencies, and brands approached brand safety at scale.

The group also emphasized that its position on broader principles has not changed. It said it “reiterates its commitment to freedom of speech, a principle first included in WFA’s founding constitution back in 1953, and a principle it shares with X.” It added that “WFA and X are fully aligned in the view that brands, platforms and consumers will all benefit from brand safety innovation.”

The case stemmed from a sharp drop in advertising revenue at X following Musk’s $44 billion acquisition of Twitter in 2022. Many advertisers cut spending amid concerns about content moderation and the risk of their ads appearing next to controversial material.

Those concerns have been amplified by the way modern ad systems work. Much of digital advertising now runs through automated platforms that use machine learning to place ads in real time. While this increases efficiency, it also makes it harder for brands to control exactly where their ads appear, raising the stakes for brand safety tools and standards.

Musk has repeatedly pushed back against advertisers and industry groups over those issues. When X filed the lawsuit, he wrote, “we tried peace for 2 years, now it is war.” In a separate incident, he told advertisers to “go *uck themselves” as revenue declined.

– Elon Musk (@elonmusk) August 6, 2024

At the same time, X has been shifting toward a more technology-focused strategy. The company merged with Musk’s artificial intelligence venture, xAI, last year, linking its social platform with a growing AI operation that also connects to SpaceX. That move points to a heavier reliance on in-house systems for everything from content ranking to ad targeting.

The agreement with the WFA removes one of the biggest external challenges X had mounted against the advertising industry. But it does not resolve the underlying tension between how platforms manage content and how advertisers decide where to spend.

It’s summer. You are sweaty. There’s some unprecedented heat wave that’s even worse than the last unprecedented heat wave. You are uncomfortable. You’re getting sweatier by the second. What do you do?

This predicament — one that’s becoming more and more common — just flat out sucks. But if you have a handheld mini fan on you, the situation can change from “actively horrific” to “less than ideal.” In sweaty circumstances, that’s a miracle.

Over the last few summers, I’ve bought a handful of random mini fans on Amazon or TikTok Shop. While those $10 to $15 devices have become staples in my summer purse, I noticed that premium brands like Shark and Dyson were rolling out their own handheld fans at much higher price points ($100 to $150). As someone who suffers from the SSRI sweats — if you know, you know — I was curious whether these higher-end products are really that much better than the drop-shipped fans I’d bought in summers past.

The verdict is: they’re all pretty good in their own way! But the best one for you depends on your budget, the size of your go-to summer bag (or pockets), and your tolerance for drawing attention to yourself with a large device blowing air in your face.

Most powerful: Dyson HushJet ($99)

I wasn’t surprised to find that the Dyson HushJet is an exceptionally powerful mini fan — this company is best known for vacuums, air purifiers, and hair dryers. Dyson knows how to make stuff that blows air! But at about 7 inches tall, the HushJet is the tallest and heaviest device I tried. It will still fit in most purses, but it’s not pocketable.

The HushJet comes with a travel bag, a charging/desktop stand, a neck lanyard, and a USB-C charger (all of these fans charge via USB-C — woohoo!).

If my desk weren’t directly below an air vent, I could see myself using this while I work, since it functions so well on a desktop. The neck lanyard looks a little dorky, and I imagined myself wearing it while pushing a stroller at Disney World. This is an odd image, since I don’t have children, but maybe the reason I envisioned a hot day out with kids is because the lanyard frees up your hands? Or, maybe it’s because if I had to give one of these devices to a kid and bet they wouldn’t break it, I’d say the Dyson is the most kid-proof? Unfortunately, the lanyard doesn’t really help the fan blow air at you while you wear it — you still have to pick it up to direct it at your face.

The HushJet is more powerful than any other mini fan I tried, but that power comes with some noise. Luckily, it has five different power settings, and the lower ones are quieter.

Most versatile: Shark ChillPill ($149)

The Shark ChillPill is the most expensive fan of the bunch, but to be fair, it also does the most. The ChillPill comes with three attachments: a fan, a water mister, and a cooling plate that you touch to your wrist or temple to help you cool down. Like the Dyson HushJet, the ChillPill can sit up on its own for desktop use. It’s about 4 inches long and about double the width of the other options because of its dual-cylinder design.

I chose to bring the ChillPill with me to a softball tournament, since I knew I’d already be sweaty enough that a mister would benefit me without making me look unnecessarily damp (there is no universe in which I would not appear damp at an all-day outdoor event in the summer).

You just have to pour a tiny bit of water into the attachment and it works great. The cooling plate is interesting, but I personally found the fan more immediately effective — plus, it has ten speeds!

I might be more inspired to bring the ChillPill with me in my bag if it came with a case for all of its accessories — I wasn’t really sure what to do with the extra little components. I mostly used the ChillPill with its fan attachment, but I was impressed by the product design when it comes to changing out attachments. There’s a locking mechanism, which you toggle when you want to remove or add a new attachment. It feels secure enough that it would be pretty difficult for an attachment to accidentally fall off or something.

I understand why the ChillPill is as wide as it is — there’s probably a lot of technical components in there that make the 3-in-1 design possible. The design works for outdoor events like music festivals, sports games, or beach days, but I prefer smaller fans for other circumstances, like when you’re the only one at the bar who thinks it’s a little hot inside, and you feel weird about that.

Good enough: JISULIFE 3-in-1 Portable Fan ($13)

The JISULIFE 3-in-1 Portable Fan was the first mini fan I ever bought, and it’s served me well for the last three years — it still works just as good as new. I’ve taken it on vacations without AC and found it endlessly valuable. It has a flashlight, though not one that’s any better than your phone flashlight, and a USB plug-in to charge your phone. Of all the fans I tested, the JISULIFE is the weakest (though still decent), and it can be kind of annoying to flip open. Then again, it has little bear ears on it. Does Dyson randomly put little bear ears on its fans? I didn’t think so.

This product isn’t going to knock your socks off. The charging is slow, yet effective. The fan is fine. The light is kind of dim. But it gets the job done well enough that it’s accompanied me on a few “glamping” trips and a trip to Paris during a heat wave. Sure, those trips all took place before I had tried any of these other fans, but I wasn’t sitting around thinking, “Gee, I sure wish I had a better fan.” (Rather, I was reflecting on how the most American thing about me is that I love AC.)

The fan is about 4.5 inches when folded, and about 8 inches when using the fan.

Best overall: This random fan from Amazon ($15)

While over $250 worth of review unit mini fans sat at home, I couldn’t stop reaching for this random MACMORE fan from Amazon when I went out. It’s definitely some sort of sketchy drop-shipping situation — the images on the listing all look very obviously edited. The company, MACMORE, only lists two products (both mini fans) on Amazon. But what can I say? I love this little thing. I even bedazzled it. (Bedazzling kit sold separately, but highly recommended to maximize whimsy.)

At 4 inches tall, this fan is both the smallest and lightest one I tried. It’s not as strong as the Shark or Dyson fans, but it works well enough that I’m not wishing the fan were stronger. It comes with a removable clip, so you can attach it to your shirt or the strap of a crossbody bag to keep cool, hands-free. Like every other fan, it makes some sound, but it’s small and quiet enough that I don’t feel like I’m drawing attention to myself when I use it in public.

When it comes down to it, the size (and low price) is probably what makes me love this fan so much. It takes up less space in my purse than my keys, and it fits in a pocket too, so it’s become a staple. But really, this all comes down to personal preference. I’m optimizing for discretion, but maybe you’ll choose to optimize for a fan with the most features or that has little bear ears on it.