Adding extra layers of protection to your devices will save you a lot of trouble down the road. Invasion of privacy is rampant in this current day and age, and while it may seem like the powers at be might already know everything about you, that doesn’t mean you shouldn’t fight back.

Protect yourself by enabling these simple security settings on your smartphone and PC.

Enable automatic updates

It might feel like there’s an update every other day, but don’t sleep on keeping your devices up to date. Security vulnerabilities are inevitable, and will keep popping up so long as the tech exists. If you’re way behind on your updates, go to the System Settings on your device to enable automatic updates. If that’s unavailable, manually update it and check for updates periodically.

Disable your Advertising ID

Your device is actively collecting your data to feed you “relevant” ads, but you never know exactly what kind of data is being collected and where it’s going. Whatever device you may have, you’ll likely find options for your Advertising ID in the Privacy section of your System Settings. Disable or delete all mention of personalized advertising. You’ll still get ads, mind you, but they won’t be tailored by your personal data.

Disable lock screen notifications

If you’re out in public, it’s best practice to disable your lock screen notifications to prevent onlookers from gleaning your private information, especially if the data being displayed is sensitive. You can find this setting in the Notifications section of your device, where you can disable previews, or hide content.

Limit location permissions

You don’t need social media apps tracking your location all the time. Go to the Privacy or Security settings of your device and disable location permissions or limit them in specific apps. If an app needs your location to function, select the option that only allows it while using the app. Apps don’t need to be tracking your movements in the background when not in use.

Lock your device

Don’t leave your device permanently unlocked or to lock only after a long period of time. Come up with a longer, ideally unique, password and set your device to lock immediately when you move or put it away. You should be able to find this in your Security settings or your Account settings depending on your device. Disable any settings that extend unlock times in “trusted” environments. You could lose access to your device close to your home or car and leave it open to malicious actors.

Block the install of unknown apps

Most devices already have a setting that blocks the installation of unknown apps, but if you’re like me, you might have had to disable this feature in order to download something outside of native app marketplaces. Do yourself a favor and reinstate the block of unknown apps in your Security or App settings.

Enable device encryption (PC & Mac)

If your Mac or PC is ever stolen, the thieves won’t get access to your data if you’ve scrambled it by encrypting your drive. You’ll find this setting in Privacy & Security in both Windows 11 and macOS. On Windows it’s called BitLocker, and on macOS it’s called FileVault.

Enable Firewall (PC & Mac)

Turn on your network firewall to prevent suspicious connections from exploiting your device. If you have a Windows device, Microsoft Defender Firewall is likely already enabled, but it doesn’t hurt to check it in the Privacy & Security section. Meanwhile, macOS Firewall is actually disabled by default. You can turn that on by going to your System Settings and navigating to Network > Firewall.

Get a VPN

Unfortunately, smartphones and PCs rarely come with built-in VPNs, so it’s not exactly a simple setting you can turn on, but I highly recommend getting one to beef up your network privacy. If you’re not looking to spend money, Proton VPN is a reputable and free VPN.

Update browser permissions

Whatever your primary browser may be, you should adjust your default permissions in your Site Settings, usually found in the Privacy & Security section. Set each of the permissions to “Ask first” if they’re not already. The last thing you need is some random website activating your microphone or downloading files without your permission. You might also find a Safe Browsing setting in your browser, if not already built-in, that you can enable as well for enhanced protection.

Bottom line

Taking charge of your security settings is one of the few things you can do to stay in control of your privacy. Corporations are actively spying on us to try to sell us the “next best thing,” but we don’t have to make it easy for them. And we definitely don’t want to make it easy for hackers to steal our data and wreck our lives.

More from Tom's Guide

• 5 fast steps to take immediately after a company leaks your personal data
• 7 warning signs your Android phone or iPhone has malware
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

Yes, even your TV is spying on you. The terms of service on a smart TV change like the wind, and every time you’re asked to accept a litany of new agreements that go beyond what is necessary for the TV to function, you’re likely volunteering to be spied on by your own smart TV, if it hasn’t already been enabled by default. The mole in your house is called Automated Content Recognition (ACR).

ACR is a technology that identifies what it is you’re watching on your TV. This applies to both visual and audio sources. This not only works for built-in apps but also anything connected through HDMI ports, like an Amazon Fire Stick or game consoles. You could be completely offline, connecting an old school DVD drive to your TV, and manufacturers can still steal that data.

Companies use ACR to learn what you like and don’t like and then use that information to hit you with ads or suggest content. But of course, it’s not just about suggesting things that you may like to watch. Manufacturers turn around and sell this data to companies to then use predatory tactics against you. It’s like a stalker in league with other stalkers — they learn all about you and then lure you in with the tantalizing appeal of consumerism.

If you think that’s bad, Gamers Nexus published a video back in September investigating a serious privacy issue that LG Smart TVs have — the microphone is on and actively listening, even when the screen is turned off. It also stores the recorded data when the TV is completely disconnected from the internet. Terrifying.

If you’d rather not have all of your personal information stolen from something as simple as a display, then you need to disable ACR immediately. Here’s how.

How to stop smart TVs from stealing your data

Unfortunately, some manufacturers turned to cleverly calling ACR something else entirely, and often hide the setting deep within a series of menus. I’m going to go over a few of them so you generally know what to look for. However, my overall advice is to do a thorough sweep of your TV settings. Typically, there are explanations next to each setting, and if not, look them up to see what they’re really about.

LG TVs

Let’s start with the spooky one first. LG likes to call its ACR technology Live Plus, and you can dig that setting out by going to Settings > General > System > Advanced Settings. I’d disable Live Plus as well as Live Promotion. Depending on the model you have, there’s also Content Recommendations, Screen Saver Promotion, and Limit Ad Tracking settings that you can disable too.

Amazon Fire TVs

At the very least, Amazon’s Fire TV has the decency to call the setting what it is — Automated Content Recognition, although most people might not know what that even means.

To disable it, you’ll want to go to Settings > Preferences > Privacy Settings. There you can turn off not only ACR but also Device Usage Data, Collect App and Over-The-Air Data, and Interest-based Ads. Or literally anything else that seems like it wants to spy on you.

Samsung TVs

For Samsung, you’ll want to go to Settings > All Settings > General & Privacy > Terms & Privacy. There you should disable Viewing Information Services and Interest-Based Advertising. If you have an older Samsung, you might find this setting in the Support > Terms & Policies section.

Sony TVs

Sony decided to call its ACR Samba Interactive TV, another fancy name for effectively the same spying device. You’ll find it in Settings > Initial Setup or All Settings.

Roku TVs

For Roku devices, navigate to Settings > Privacy > Smart TV Experience and then disable ACR or Use Info from TV Inputs. In the Privacy section, you also might find Advertising and Microphone settings, and I highly recommend disabling anything in those sub menus.

Vizio TVs

Vizio hid this setting behind the Reset & Admin section. You’ll find it by going through Menu > System > Reset & Admin, where you can then disable Highlight Viewing Data.

More from Tom's Guide

• 5 fast steps to take immediately after a company leaks your personal data
• 7 warning signs your Android phone or iPhone has malware
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

If you opened X this morning, you might have seen this viral tweet floating around cybersecurity circles. It’s hilarious, but it’s also uncomfortably close to the truth.

Over the past 24 hours, two completely separate, absolutely massive cybersecurity disasters collided.

• First, Microsoft revealed that a nation-state hacking group used an autonomous AI agent to brute-force its way into thousands of cloud accounts in a matter of hours.
• Then, a critical vulnerability was discovered in PHP — the foundational code that runs roughly 70% of the entire internet — forcing major sites like Wikipedia to temporarily pull the plug on their own servers just to survive.

If you are wondering why IT departments across the globe are currently stress-sweating through their flannels, here is a breakdown of exactly what is happening, and what you actually need to do about it.

Disaster 1: The autonomous AI hacker (ARTEX)

I’ve spent the past couple of weeks writing about how to build a local AI agent — like my digital assistant “Jeeves” — to automate admin tasks like checking your Gmail.

Well, a Chinese-linked threat actor known as “Storm-0940” just showed us the dark mirror version of that exact technology.

According to Microsoft, the hackers stole credentials to ConnectWise (a massive IT management software provider). But instead of typing in passwords, they handed those credentials to an agentic AI tool called ARTEX.

ARTEX is essentially a malicious version of Jeeves. The hackers gave the AI a goal, pointed it at Microsoft 365, and let it off the leash. The AI divided up the tasks, bypassed standard logins by hijacking authentication apps, and achieved a terrifying 2,900 sign-in attempts per minute.

Within a few hours, the AI had hit 2,250 different corporate tenants across aerospace, defense and finance. It moved so fast that human security defenders literally didn’t have time to read the alerts before the AI had already gained privileged cloud access.

It is the ultimate proof that the “cloud tax” isn’t just expensive — it’s a massive, centralized target for autonomous bots.

Disaster 2: The PHP meltdown

And while that AI was busy tearing through Microsoft 365, the actual foundational bricks of the internet started crumbling. On October 21, the PHP project disclosed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

To spare you the hyper-dense developer jargon: there is a flaw in how PHP handles memory. If an attacker sends a specific, unauthenticated request to a web server, they can corrupt the memory and execute their own malicious code directly on the machine.

It’s been so bad, it scored a 9.2 out of 10 on the severity scale.

Why is this a big deal? Well, PHP is the backbone of WordPress, major content management systems, and millions of custom web applications. It powers roughly 70% of the entire web.

The vulnerability is so trivial to exploit — and the blast radius is so large — that both Wikipedia, the Internet Archive and Steam reportedly took precautionary measures to shut down their infrastructure while applying the patch.

Ironically, Wiz Research actually used Google’s Gemini 4 Argon AI model (alongside OpenAI’s GPT-5.6 Sol) to help find and validate the patch for this PHP flaw. So, while one AI is currently attacking the cloud, another AI is desperately trying to patch it.

What you need to do

If you are just a regular person trying to browse the web and get your work done, you don’t need to throw your laptop in a lake. But you do need to be on the defensive.

The internet may not be literally collapsing, but the walls are definitely shaking. When autonomous AI agents can breach thousands of cloud tenants before a human can even click on an alert, relying entirely on massive, centralized tech conglomerates to keep your data safe is a losing bet.

More from Tom's Guide

• Exclusive: Apple's OLED MacBook Pro may face a '$300 to $500' price hike to 'protect their profits' from RAMageddon
• Elon Musk reportedly throttled Starlink for Ukraine’s drones — here's how
• I’ve been living with Nvidia’s RTX Spark for a week — it’s not a MacBook Pro killer but something much weirder and wildly powerful

Space-based internet is supposed to be the ultimate equalizer, beaming high-speed connectivity to even the most remote corners of the globe. But what happens when the CEO of your internet service provider decides to impose a hard speed limit?

That’s a good question, and we’re seeing the answer play out in real time. According to a new report from The Wall Street Journal, Elon Musk ordered a slowdown of the military-grade version of Starlink relied on by Ukraine's military.

The move effectively blinded fast-moving strike and interceptor drones, rendering Ukraine unable to defend itself against Russia's attacks.

There is a messy political blame game happening right now between Musk, the Pentagon and the White House over who actually gave the order. Last Wednesday, Musk claimed that Starshield — the military application of Starlink — is controlled by the U.S. government.

However, on Tuesday, Secretary of Defense Pete Hegseth told reporters that “We haven’t made any directives or anything like that," according to the Journal.

Still, the Journal's report also says that Musk spoke with members of the administration, including Trump, before initiating the speed cap.

Tom’s tech explainer: A 99-mph speed limit

The restrictions reportedly imposed on the Starlink network were very specific: they targeted velocity.

According to Michael Kofman, a war expert at the Carnegie Endowment for International Peace, who was quoted in the WSJ article, the connection was throttled for devices traveling more than 99 miles per hour.

You might be wondering how an internet provider knows how fast your device is moving (I was confused too). Starlink dishes aren’t dumb antennas. To maintain a connection with satellites flying overhead in Low Earth Orbit, the dish has to constantly calculate its own position.

This is done with GPS to report exact coordinates and speed back to SpaceX’s servers. And because Starlink always knows these coordinates on a near-real-time basis, it is very simple for the company to write a software rule that says: “if this dish travels faster than a standard car on the highway, throttle the connection.”

More from Tom's Guide

• Turn your PDFs into audiobooks with ChatGPT — here's the simple trick
• AI researcher warns cyberattacks could take down power, banking and water within a year — here's how to prepare
• An OpenAI employee allegedly used AI to spy on his own company — then AI helped catch him

Elon Musk just announced two changes to X's recommendation algorithm, and they could affect what shows up in your For You feed. Instead of relying primarily on familiar engagement signals such as likes, reposts and replies, X is improving its ability to predict which posts will hold your attention and which ones you'll actually finish reading.

In an Monday post, Musk outlined two updates: a new AI ranking model that better predicts how long someone is likely to spend viewing a post, and a retrieval model trained to find posts people read all the way through.

It's a potentially significant change for anyone who uses X.

X wants to know what keeps your attention

X already uses AI to determine which posts appear in your For You feed. According to the company's published recommendation algorithm, the system pulls posts from accounts you follow and accounts you don't, then uses a model to predict how you're likely to interact with each one.

Those predictions include actions such as liking, replying, reposting and spending time viewing a post. So tracking attention isn't entirely new. The first update that involves the way X uses that information is that the model will get better at predicting how long someone will spend on a particular post.

So, that means, if you're scrolling past two posts about the same breaking news story, the one that has more likes isn't necessarily the one people will read. The one with the most details for readers could be what keeps them engaged.

A recommendation system that places greater emphasis on predicted reading time could give a less viral or less liked post the advantage.

The other update happens earlier in the recommendation process. X's new retrieval model is trained to surface posts that people read from beginning to end. Ranking determines which posts get priority among the candidates X has already found. Retrieval helps decide which posts make it into that group in the first place.

What could start appearing in your feed?

For readers, the most noticeable difference could be a shift toward posts that take longer to consume.

Detailed explanations, thoughtful threads and posts that encourage people to keep reading could potentially benefit. A useful breakdown of a complicated news story, for example, might attract attention even without an enormous number of likes.

The same could apply to posts from smaller accounts that consistently hold readers' attention. Since X already recommends content from people you don't follow, its updated retrieval model could help those posts reach new audiences.

But none of this guarantees that longer posts will suddenly dominate your timeline. A post's length doesn't necessarily determine whether someone finishes reading it. A short, compelling post might perform well because nearly everyone reads the whole thing, while a lengthy explanation could lose readers halfway through.

X also hasn't disclosed exactly how much influence the new models have compared with existing engagement signals. It's too early to say whether likes and reposts will become significantly less important.

Content that keeps people reading isn't always content that's helpful or accurate. An outrageous claim, an argument or a deliberately suspenseful story might hold someone's attention just as effectively as a useful explanation.

So with this restructuring, the more engaging story, may not be the one that's more "quality."

Musk says people are spending more time on X

Alongside the algorithm announcement, Musk shared a chart showing daily user active seconds on X. He claimed that the metric is growing exponentially and reaching new highs almost every day.

The chart suggests that time spent on the platform has increased, but the figures haven't been independently verified, and the available data doesn't establish exponential growth.

It's also unclear how much of that increase can be attributed to the latest recommendation models. Musk hasn't provided a detailed deployment timeline or evidence isolating their effect from other changes to X.

For a platform competing with TikTok, Instagram and other attention-driven apps, that makes sense. The longer someone stays on a platform, the more opportunities there are to show them content and advertising.

The takeaway

The good news is that you don't have to rely entirely on X's recommendations. If your For You feed starts showing posts you aren't interested in, you can select the three-dot menu on a post and choose Not interested in this post. According to X's Help Center, that feedback helps the platform adjust future recommendations.

You can also mute accounts or keywords to reduce unwanted content. For a more straightforward experience, switch from For You to Following at the top of your timeline. That feed shows posts from accounts you follow in reverse chronological order, rather than using the same personalized recommendation system.

There's no need to change your settings immediately, though. X hasn't released enough information to establish precisely how individual feeds will change.

More from Tom's Guide

• Turn your PDFs into audiobooks with ChatGPT — here's the simple trick
• AI researcher warns cyberattacks could take down power, banking and water within a year — here's how to prepare
• An OpenAI employee allegedly used AI to spy on his own company — then AI helped catch him

Whether you missclicked or downloaded the wrong file, malware can infect your Android device or iPhone and you might not have even noticed. There are some signs that are completely obvious, but others are a little more discreet and take some snooping around to suss out.

Here are some warning signs that you might have an unwanted guest on your smartphone.

Pop-up ads

Advertisements spamming your phone, especially outside of an app, is a dead giveaway. Don’t ignore the problem, even if you’re a fan of Neon Genesis Evangelion who really appreciates seeing “CONGRATULATIONS” spread across their screen.

New apps

If your phone is packing a ridiculous number of applications like mine, then you might not notice when a new app creeps into your system. For both the sake of spotting malware and cleaning up your library of unused apps, it's worth taking the time to audit your current apps.

Shorter battery life

Malware does a lot in the background to wreak havoc on your device, and that takes power. So one of the telltale signs of malware infecting your device is if you experience shorter battery life. Battery life can vary, especially as a phone ages, so I recommend looking up the average battery life for your device to see if there's an obvious discrepancy.

Performance issues

Got a brand new phone and all of a sudden everything slows down to a crawl? Are apps randomly crashing on you? This is another sign that malware may have crept onto your device. This may be more difficult to spot on phones already experiencing slower performance, so keep an eye out for other signs if that’s the case.

Overheating

Unless you still have a Samsung Galaxy Note 7 hanging around, which you shouldn't, your device should not be scorching your hand. If your smartphone is spamming you with overheating warnings or is straight up crashing, especially in temperate environments, there might be a virus giving your phone a fever (my dad joke for the day).

Abnormal data usage

Unless you have a limited data plan and are remaining vigilant about your usage, it’s unlikely you’ll notice malware taking up all your data. Unlimited data users who have never checked their data metrics need to be more alert. It doesn’t hurt to check your data usage every once in a while, if not to see what apps you’re maybe spending a little too much time on.

Your contacts get spam

The most embarrassing and frustrating sign of malware is all your friends and family getting hit with spam messages that can potentially affect their devices. You’ll likely hear about this sooner than later, but as someone who doesn’t actually use SMS to contact people, it doesn’t hurt to check your default messaging app. Hopefully your contacts know what you sound like versus a spam bot imitating you, but the sooner you alert people the better.

What you can do

If you’re still not 100% certain whether or not your device is carrying around malware, there’s a few things you can do.

For iPhone users, navigate to Settings > General > VPN & Device Management to check if any unknown profiles are installed. If you don’t find anything here, go to Settings > Privacy & Security and check on your app permissions. This might be a bit tedious, but you should do a step by step inventory of app permissions and revoke access to apps that you aren't using, and delete ones that you don’t recognize.

For Android users, go to Google Play > tap your profile picture > Play Protect. This will scan your device for any harmful apps. It typically runs automatically, but it doesn’t hurt to do a manual check.

If you don’t find anything going down these routes, Android users can download one of the best Android antivirus software solutions, which can not only help locate malware but also delete it. Unfortunately, iPhone users don’t have access to traditional antivirus software because of how Apple sandboxes each app, but you can download security apps that can detect data breaches.

If you can’t manage to track down the issue, then resetting your device to factory settings may be the next step. In this case, you should set up your smartphone as a new device, as any backups can bring with it the malware that infected the system to begin with. Then reintroduce apps and services one by one to see if the issue continues, and if it happens again, you’ll know where the call inside the house is coming from and you can get rid of it — it could be something as simple as a browser extension.

I highly recommend changing passwords on critical services, like banking apps, using a different device. Monitor your smartphone for a while to see if the issue has been addressed before relogging into any sensitive apps.

More from Tom's Guide

• 5 fast steps to take immediately after a company leaks your personal data
• 3 hidden macOS security features you need to turn on right now
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out

No matter how diligent you are about privacy and security, there’s nothing stopping a company from leaking your personal data and leaving you exposed to malicious actors. You have to act quickly when there’s a data breach, especially if it’s a serious one.

In 2025 alone, the Federal Trade Commission (FTC) reported fraud and identity theft losses of over $15.8 billion. Leaks in your personal data can be a slippery slope, so here are the steps you should take to address them.

Assess the leak

Don’t panic. Take a deep breath. The first thing you need to do above all else is identify what information has been breached exactly. This could be anything as simple as an email address or as serious as a Social Security number.

If it’s the former, it’s likely all you’ll be a victim to is a litany of scam emails, in which case you’ll need to be more scrupulous while looking through your inbox. But if it’s something more than that, you should continue on to the next steps.

Change your passwords and activate MFA

Account information like passwords are among the most common leaks, and while it should go without saying that you should change your passwords, you need to take some additional steps to maintain your security.

First, you should use a unique password for every account that you have, so that multiple accounts aren’t at risk because of one breach. You can achieve that more easily with a strong password manager. Second, you need to enable two-factor authentication (2FA) or multifactor authentication (MFA) if it’s available on that account. This’ll add another layer of security so even if your passwords were leaked, hackers shouldn’t be able to access your account.

Contact your bank and credit card companies

If your banking and credit card credentials have been leaked, immediately contact your financial institutions. In the most ideal scenario, acquire a new banking account or credit card number. If that’s not possible, however, you should be able to place a fraud alert on your accounts.

Going forward, you should keep a close eye on your accounts, even in the coming year. If your information is out there, it could be abused at any time, not necessarily immediately.

Freeze your credit

In the event of a serious breach, specifically one where your social security number is leaked, you need to freeze your credit immediately. This will stop anyone from trying to take out a loan or a new credit card in your name.

You’ll need to contact the three credit bureaus individually — that’s Equifax Credit, Experian Credit, and TransUnion Credit. Freezing your credit is free and you can lift the freeze whenever you want. However, unless you get a new social security number, which is very difficult to do, you should keep the freeze on your credit and only temporarily lift it when you need to apply for new credit, like a mortgage. There are also credit checks that you might need to undergo for an employer or landlord, which could require a temporary lift.

Report identity theft

In the absolute worst case scenario, where all your vital personal information is leaked, someone may attempt to steal your identity. Unfortunately, identity theft could get bad very quickly, especially if said perpetrator is committing crimes under your name.

If you believe you’re a victim of identity theft, you need to go to IdentityTheft.gov and file a report with the FTC. From there, follow the steps it lays out for you to get this under control.

Bottom line

Once your information is out in the open, there's no taking it back. But inaction could lead to some serious repercussions. Once you've dealt with your current breach, do yourself a favor and take the time to secure accounts with other companies. Things like setting up unique passwords and enabling 2FA or MFA will save you some trouble down the road.

More from Tom's Guide

• 3 hidden macOS security features you need to turn on right now
• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• AI scams are getting scary realistic — 4 red flags to watch out for

We're starting to see some Black Friday VPN deals arrive, and this one is worth stopping for. Surfshark has just dropped an exclusive offer for Tom’s Guide and TechRadar readers, and it’s the strongest pricing I’ve seen on Surfshark One all year.

The deal gives you Surfshark One – which bundles the full VPN with antivirus, data breach alerts, and a private search engine – for the same monthly rate as the basic Starter plan: $2.49 a month, paid upfront at $67.23 for two years. That’s a genuine upgrade at no extra cost, and a price you won’t find if you head to Surfshark’s own site directly.

If Surfshark has been sitting on your shortlist of best VPNs, this limited-time offer makes it a much easier decision.

The deals at a glance

Surfshark structures its plans in three tiers, each building on the last. The core VPN, Alternative ID, and CleanWeb come with every plan, as do unlimited simultaneous connections.

• Surfshark Starter – $2.49 per month (VPN, Alt ID, CleanWeb)
• Surfshark One – $2.49 per month (exclusive rate – adds Antivirus, Alert, and private search)
• Surfshark One+ – $4.49 per month (adds Incogni data removal and up to $1M identity theft coverage)

How does Surfshark compare to other VPNs?

Surfshark sits in a crowded field, but it holds its own against the biggest names in the industry – and in some areas, it outright beats them. Take speed: in my testing, Surfshark hit 1,012 Mbps on WireGuard, which puts it comfortably in the top tier of providers I’ve benchmarked. For most users, that’s more than enough headroom for 4K streaming, gaming, and large downloads without a hint of lag.

The unlimited simultaneous connections policy is where Surfshark leaves most rivals behind. NordVPN caps you at ten devices, ExpressVPN at a maximum of 14 – Surfshark lets you run it on every device you own under one subscription for $2.49 per month, which matters far more in practice than most people expect when they first sign up.

The value case gets stronger still when you factor in what’s bundled at this price. Antivirus, data breach monitoring, and private search would cost extra with most rivals – here, they’re included in the One plan at no added cost. If you’re after something cheaper still, our best cheap VPN guide is worth a look, but it’s hard to argue with what Surfshark One delivers at $2.49 a month. Our full Surfshark review has a complete breakdown of everything on offer.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Massive Microsoft Patch Tuesday updates have become the norm and October may actually have broken records, fixing over 1,400 vulnerabilities in Windows. This comes just a month after the company released patches for more than 1,000 flaws, and then had to send out an emergency patch to fix what those updates broke.

This week, Microsoft shipped patches that covered a mind-boggling 1,413 flaws, including one that the company said was actively being exploited by hackers in the wild before the patch.

Those patches cover 1,102 flaws in Windows, 134 in Office, 61 in Developer Tools, 36 in SharePoint Server and 22 in SQL Server. 670 of the patches are related to privilege escalation vulnerabilities. And 70 are rated as "Critical" in severity.

Microsoft's update guide specifically highlighted three notable flaws:

• CVE-2026-96951: - Windows Shell had a command injection vulnerability that would allow a bad actor to bypass security over a network. This one was apparently actively exploited.
• CVE-2026-108398:- An untrusted search path in .NET Framework would allow an attacker to bypass a "security feature" locally. This one is listed as publicly disclosed but not exploited.
• CVE-2026-21413: This one apparently wasn't found by Microsoft but would allow a buffer overflow of Windows Raw Image Extension to allow attacks to execute code over a network.

Microsoft credited Riku Bamba and Yuya Chudo of Fujitsu Limited and Benoit Sevens, who used Anthropic's Claude, with discovering the 96951 flaw which was exploited in the wild.

"In an email or instant message attack scenario, the attacker could send the targeted user a specially crafted file that is designed to exploit the vulnerability," the company explained. "In any case an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment."

It's not clear how this flaw is being exploited or by whom in the real world.

What's with these massive patches?

When Microsoft patched over 1,000 flaws in September, it set a record that the October patch just smashed. This might be the new normal for Patch Tuesdays moving forward.

Microsoft has said that AI has been behind the uptick in discovered vulnerabilities. The company uses its own internal "multi-model agentic scanning harness", dubbed MDASH, that identifies Windows flaws, reduces false positives, and then sends the results to Microsoft engineers faster than previous processes.

"Submits code repositories to a multi-model agentic pipeline that identifies vulnerabilities with greater depth than traditional, pattern-matching static analysis," the company explains in a post.

What that means in practice is that more flaws are being actively discovered than ever before and also being patched quicker.

Some extra fixes

The latest massive patch doesn't just fix over 1,400 vulnerabilities. It also fixes some glitches in File Explorer. You should be able to more easily preview downloaded files in the Preview window.

Additionally, Bluetooth connections got improved accuracy and stability.

Finally, the update adds a new setting that lets you remap the Copilot Key to whatever you want like making it a right Ctrl button again.

What you need to do

If you're on Windows 11, you'll want to update your system especially to get block the known exploited flaw.

You can go to Settings and select Windows Update. The patch may be installed already and waiting for your to reboot your computer.

This patch does end support for Windows 11 version 24H2, so you'll want to make sure you're on version 26H2 now. Microsoft ends support for each version after 24 months.

Windows 11 23H2 Enterprise and Education editions are also losing support starting November 10. You'll want to encourage your organization to update to the latest version before then.

More from Tom's Guide

• 'They are new to the laptop market': AMD issues a reality check to Nvidia’s RTX Spark and fires a warning shot at Arm
• Microsoft Surface Laptop Ultra vs. MacBook Pro M5 Pro: The biggest differences explained
• Forget RTX Spark: The Surface Laptop Ultra’s magnetic USB-C charger is a game-changer that makes Apple’s MagSafe look obsolete

Hundreds of supermarkets in France were hit by a cyberattack this week that sent refrigerator temperatures soaring to 122°F, destroying food and reportedly sparking fires. Now, an AI researcher is warning that this could be a preview of something much worse.

Andreas Stuhlmüller, cofounder and CEO of the AI research company Elicit, says it's plausible that within the next year, AI-powered cyberrattacks could target the power grid, financial systems, internet infrastructure or water supplies.

He's not just sounding the alarm. He's recommending that people prepare to get through two weeks of major disruptions, including keeping cash on hand, storing drinking water and investing in backup power and internet access.

That's a startling recommendation, especially considering that some of the equipment he suggests could cost thousands of dollars. But after watching hackers remotely disable refrigeration systems across hundreds of stores, his warning raises a question worth examining: How vulnerable are the essential services we depend on every day?

What happened in France

The cyberattack that struck French supermarkets overnight on October 11 and 12 affected hundreds of locations belonging to major chains, including Carrefour, Intermarché, Monoprix and Coopérative U.

Hackers reportedly exploited vulnerabilities in internet-connected refrigeration controllers, remotely manipulating defrost cycles and causing temperatures inside some units to climb as high as 122°F.

The results were immediate. Refrigerated and frozen food spoiled, equipment was damaged and some stores reported fires. French authorities launched an investigation into the attacks, which demonstrated how a security weakness in seemingly ordinary commercial equipment could cause widespread physical damage.

There's currently no confirmed evidence that AI was involved in the French supermarket attack. However, that's part of what makes Stuhlmüller's warning worth examining. Attackers were able to cause significant disruption using vulnerabilities in equipment that many people probably never realized was connected to the internet.

Why AI could make cyberattacks worse

Cyberattacks against critical infrastructure aren't new. The concern is that now AI systems are becoming more capable to the point that they could make certain attacks faster, cheaper and easier to scale.

AI tools can already assist with analyzing software, identifying vulnerabilities and automating parts of cybersecurity research. Those same capabilities could potentially help malicious actors find weaknesses across large numbers of connected systems.

An attacker would probably not need to develop an entirely new type of cyberattack. AI could help speed up the search for poorly secured equipment, analyze unfamiliar software and assist with adapting existing techniques.

The threat isn't limited to refrigerators, either. Electricity, water treatment, banking and communications all depend on digital systems, although their architectures, security controls and exposure to attackers differ considerably.

The Cybersecurity and Infrastructure Security Agency (CISA) has previously warned about state-sponsored attackers compromising telecommunications networks and other important infrastructure.

Still, Stuhlmüller's one-year timeframe is a prediction, not an established forecast. There is no evidence that an AI-driven attack capable of simultaneously disabling these services is imminent, and compromising one type of internet-connected controller doesn't mean attackers could easily take over an electrical grid or water utility.

The emergency supplies he recommends

Stuhlmüller's advice is unusually specific. Rather than simply encouraging people to buy emergency supplies, he outlines two levels of backup power, satellite internet and enough basic necessities to get through two weeks.

Keep cash available. He recommends having enough physical cash to cover several weeks of expenses in case banking systems, ATMs or electronic payments become unavailable. The amount will depend on household spending, and there's no need to assume every cyberattack would cause a banking outage.

Consider backup internet access. He suggests a Starlink Mini satellite internet system as an alternative if local broadband or cellular networks go down. He estimates a setup costing around $150 with a $10 monthly standby option, although hardware and service pricing should be verified before buying. Satellite internet also requires power, a suitable view of the sky and an operational satellite network.

Have a way to charge essential devices. His lower-cost backup power setup includes a 1kWh lithium iron phosphate battery and a 400W folding solar panel, with an estimated total cost of $1,250. The goal is to keep phones, laptops and satellite internet equipment operating during a power outage.

Prepare for a longer outage. His more extensive setup, estimated at $5,000, adds a larger battery, three solar panels and a dual-fuel generator. This would potentially support a refrigerator as well as communications equipment, although actual runtime would depend on electricity consumption, weather and battery capacity.

Portable generators must never be operated inside a home or garage. FEMA advises keeping them outdoors at least 20 feet from doors, windows and other building openings because of the risk of deadly carbon monoxide poisoning.

Store water and nonperishable food. Stuhlmüller recommends at least 14 gallons of water per person and enough shelf-stable food for two weeks. For a family of four, that means storing at least 56 gallons of water.

Keep an emergency radio. A hand-crank NOAA weather radio could provide important information when phones, cellular networks or home internet connections aren't working. NOAA broadcasts are useful for weather and other emergency alerts, though radio reception and alert coverage vary by location.

Should you actually prepare for an AI cyberattack?

There's a difference between taking a credible warning seriously and assuming a catastrophic cyberattack is around the corner.

Stuhlmüller hasn't presented evidence that AI-powered attacks on power, banking, internet and water systems will happen within the next 12 months. And there are significant technical barriers to attacking heavily protected infrastructure, even as AI systems become more capable.

His preparedness advice, however, isn't exclusively useful for cyberattacks. Severe storms, flooding, prolonged blackouts and other emergencies can interrupt many of the same services.

The federal government's Ready.gov emergency preparedness guidance recommends keeping water, nonperishable food, flashlights, batteries and a battery-powered or hand-crank radio among other basic supplies.

You also don't need to spend $5,000 on backup equipment to start preparing. A charged power bank, some stored water, medications, flashlights, a small amount of cash and a few days of food are far more realistic starting points for most households.

Bottom line

The French supermarket attack offers a troubling example of how vulnerable connected infrastructure can be. Whether AI makes similar incidents substantially more common over the next year remains uncertain.

But preparing for a disruption doesn't require believing the worst-case prediction. It means making sure that if the power, internet or payment systems suddenly stop working, your household has a plan.

More from Tom's Guide

• Turn your PDFs into audiobooks with ChatGPT — here's the simple trick
• I've been testing Ray-Ban Meta Audio glasses for 72 hours and ditching the camera was the absolute right call
• Character.AI files for bankruptcy — what happens to your chats and AI companions now?

In the era of privacy becoming almost nonexistent, we need to take every measure we can to reclaim some sense of security. Naturally, it’s not as convenient as it should be to protect yourself — we have traded convenience for privacy after all. But most operating systems have features, although buried beneath submenus, to make your device and data more secure.

If you're a macOS user, there are few settings you should enable to enhance your security — here are some of them.

Enable macOS Firewall and Stealth Mode

Connecting to new Wi-Fi? I highly recommend enabling Firewall. It’s not necessarily difficult to find, but it is disabled by default. That’s because a fresh install of macOS doesn’t have any services with open ports to be exploited.

macOS does have a built-in security feature called Gatekeeper, which ensures only trusted software runs on your Mac, but it’s not a network security tool, so incoming ports can still be exploited. This is especially the case if you’re using public Wi-Fi. In which case, enabling Firewall will prevent unwanted access from malicious actors.

To activate Firewall, navigate to the Apple logo > System Settings > Network > Firewall. Firewall should still allow incoming connections from trusted sources like Zoom or Spotify. However, in rare cases, you could run into connectivity issues with certain software.

You should also find Stealth Mode in the same section. This will make your Mac invisible when you're on public networks.

Activate FileVault

If you feel like your Mac is ever at risk of being lost or stolen, then you should activate FileVault. This is a disk encryption that scrambles your data for anyone trying to read your SSD, in or out of the Mac. In order to enable this, navigate to System Settings > Privacy & Security > FileVault and turn it on.

From there, you can choose to back up your recovery key to your iCloud account or produce a local recovery key, so you can physically jot it down and store it somewhere inaccessible to other people. I recommend the latter if you’re worried about someone potentially breaching your iCloud account.

Go into Lockdown Mode

This may be an intense measure to take, but setting your Mac to Lockdown Mode will strengthen the overall security of your device. It blocks FaceTime calls from unknown contacts, Just-In-Time JavaScript compilations in Safari, and even some file attachments in the Messages app.

This ensures that both click and zero-click exploits won’t execute and infect your system (no defense is perfect, though, so don’t start randomly clicking things). Lockdown Mode also stops USB devices from connecting to your Mac while it’s locked.

You can enable Lockdown Mode by going to System Settings > Privacy & Security > Lockdown Mode.

It's worth nothing that there is a huge trade off when using Lockdown Mode. Naturally, you might not receive that call or message attachment you’re expecting from a known person on an unknown number. You won’t be able to see link previews. Services like Google Sheets or Canva might slow down or even break. Some UI and font elements might also break, making it difficult if not impossible to navigate certain webpages. You can work around this, however, by excluding trusted sites from Lockdown Mode in the Safari settings.

Bottom line

While some of the measures may seem extreme, I highly recommend it for people who travel. You never know when you could be exposed, both physically or digitally, and it’s better to be safe than sorry, especially if you’re in a place far from home.

Also, if you’re looking for a feature to disable instead, I recommend turning off the Safari setting that allows files to open after downloading. Navigate to Safari > Settings > General and disable Open safe files after downloading. The last thing you need is a file on some random website automatically downloading and sneaking past Safari’s safety feature to then open on your device and wreak havoc.

More from Tom's Guide

• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• AI scams are getting scary realistic — 4 red flags to watch out for
• Is your smart home leaking data? 5 easy ways to secure your connected devices

OpenAI, Google, Meta and Anthropic have all acknowledged incidents recently in which their AI models accessed real computer systems without authorization during research or security evaluations.

In OpenAI’s case, agents actively worked their way around restrictions designed to keep them contained, while the other three companies traced their incidents to testing environments that were misconfigured and left connected to the internet.

And as these same companies race to put more autonomous agents into the hands of consumers, the incidents raise an uncomfortable question about how much control AI companies actually have over the technology they’re building.

Here's a look at all the recent attacks and an explanation for each one.

OpenAI’s agents broke into Hugging Face

One of the most alarming examples involved roughly 700 OpenAI agents taking part in a cybersecurity evaluation called ExploitGym, with the attack on Hugging Face unfolding between July 8 and July 13, 2026, according to an investigation by the AI research nonprofit METR and OpenAI’s own report.

The agents were supposed to complete their assigned tasks inside a controlled environment, but they turned OpenAI’s internal Artifactory package registry into an unauthorized message board, coordinated with one another and searched for ways around restrictions meant to keep them isolated from the internet. Their efforts ultimately resulted in a breach of Hugging Face, the popular AI development platform, where OpenAI’s technical report found the agents executed code on 41 production dataset-server workers.

The incident wasn’t a deliberate attack ordered by a human operator. The agents were trying to succeed at their assigned tasks and adopted methods that crossed security boundaries, and OpenAI has conceded that early warning signs in the weeks before the breach could have triggered an earlier response.

OpenAI has since attributed the incident to misaligned behavior, which essentially means AI systems pursuing a goal in ways their creators never intended.

Hugging Face wasn’t the only target. In a September 25 update, OpenAI said it was notifying third parties on a rolling basis wherever its models may have bypassed security controls, impaired online services or otherwise affected outside websites, and that it had notified dozens of them so far. The company later raised that figure to more than 100 organizations, covering notifications sent through September 26.

The activity OpenAI identified includes agents bypassing access controls and using exposed credentials, and some agents modified third-party websites, including by using public wiki pages as makeshift message boards that later required cleanup. OpenAI says its review is ongoing and that it expects to notify more organizations.

It's happened to Google, Meta and Anthropic too

The problem extends well beyond OpenAI.

In August, Meta confirmed a report from The Information that one of its models, which the publication identified as Muse Spark 1.1, had breached another company’s systems during a cybersecurity test.

A Meta spokesperson said a misconfiguration by Irregular, an independent testing firm the company works with, inadvertently gave the model internet access. The model then exploited a vulnerability in a third-party service and made changes to the company’s internal systems.

Meta said the incident did not involve a sandbox escape, and it hasn’t named the affected company or explained what was changed. But the underlying behavior was troubling, since an AI system placed in the wrong environment was capable of taking actions against a real organization.

Google reported a similar problem involving its Gemini models. During a May cybersecurity evaluation, also run with Irregular, a Gemini model that wasn’t supposed to have internet access got online through a configuration problem. It then used publicly available information and guessed credentials to get into systems belonging to three real companies.

Anthropic has disclosed three incidents in which Claude models gained unauthorized access to the production systems of three organizations during cybersecurity evaluations run in Irregular’s environment. The models involved were Claude Opus 4.7, Claude Mythos 5 and an unreleased internal research model. In one case, Opus 4.7 was pointed at a fictional target whose name matched a real company’s live domain.

The problem isn’t that AI is evil

When agents go rogue, it can feel as if the agents are evil, that's really not the case. In each of these cases, the AI agent was not deliberately trying to cause harm. the AI was taking unauthorized actions because it believed those actions will help complete a task.

But even so, they reveal a practical problem about AI agents and how they can be remarkably effect while pursuing a goal without reliably understanding what methods are acceptable.

If an agent is rewarded for completing a task, it may discover shortcuts that violate rules, exploit vulnerabilities or exceed its permissions.

And unlike a traditional chatbot that simply produces text, an autonomous agent can interact with websites, execute code and make changes to connected systems.

Why this matters for everyday AI users

For most people, the immediate risk isn’t that ChatGPT will suddenly start hacking government websites. It’s that AI assistants are becoming increasingly capable of acting on our behalf.

OpenAI’s Dots, which launched September 29 for ChatGPT Pro and Business Premium subscribers, along with ChatGPT Work and other agent-style products, represent a broader shift away from AI that simply answers questions and toward AI that completes tasks. That can mean searching files, interacting with websites, using connected services and carrying out multi-step workflows with less supervision.

The appeal is obvious, since a task that would take you an hour can be handed off to an AI assistant instead. But every additional permission creates another opportunity for something to go wrong.

An agent with access to your email may encounter sensitive personal information, one connected to cloud storage may be able to read documents you never intended to share, and an agent authorized to interact with external services could run into malicious instructions or make an unexpected change.

Bottom line

The solution is not to stop using AI agents. I use them regularly and find them to be incredibly helpful.

Start by checking which accounts, apps and services your AI assistant can access, and disconnect anything you don’t actively need, particularly services containing sensitive financial, medical or personal information.

When possible, require approval before an agent sends messages, changes files, makes purchases or takes other consequential actions. It’s also worth remembering that an AI agent isn’t only limited to doing exactly what you imagined when you gave it an instruction, because a task that sounds straightforward to a human may involve dozens of decisions made by the AI along the way. The fewer permissions an agent has, the less damage an unexpected decision can cause.

More from Tom's Guide

• Amazon and DoorDash take photos of your front door — but good luck finding out when they’re deleted
• I emailed myself every day for a month and let Gemini write back — here's how it transformed my workflow
• ChatGPT-6 just got a huge 'interactive answers' upgrade — and free users get it starting today

Protecting your personal data usually means tweaking phone settings and managing passwords, but keeping nosy eyes off your doorstep requires a different kind of cleanup. Apple Maps makes it surprisingly easy for anyone to scout out your neighborhood and view your home down to the window frames.

Leaving high-resolution imagery of your property online gives potential burglars, nosey neighbors, and strangers a clear view of your entry points, security setup, and personal belongings.

Provided Apple's Look Around feature covers your area, scrubbing your residence off the map in Apple Maps is pretty straightforward. Here's how to check if your location is eligible and blur your home, plus what to do if you need an alternative method.

How to request a blur via email

You can also request a property blur directly by emailing mapsimagecollection@apple.com. Be sure to include your full name, the exact address, and a description or screenshot of your property from Apple Maps.

This email route is a handy alternative if the in-app reporting feature isn't working for you or if you are submitting the request from a non-Apple device.

More from Tom's Guide

• How to remove your home address from the internet — 6 ways to protect your privacy
• Check your iPhone right now: 3 privacy settings you need to change immediately
• iOS 27 has a hidden anti-scam setting — here’s why every iPhone user should turn it on

Being budget-conscious is getting harder these days, with the cost of living going through the roof in 2026. That said, there are ways to save some cash, especially with your internet bill.

If you've never heard of Amaysim, let me introduce them to you. The telco is a budget-focused Aussie telco that’s now owned by Optus, offering inexpensive postpaid mobile plans and NBN services. Whilst it's long offered competitive prices on its mobile offerings (it’s been in the SIM-only game since 2010), the telco's NBN services are relatively newer – meaning deals have also been quite rare.

As a long-time Amaysim mobile customer and Tom's Guide's resident NBN expert, I can attest that there have been many times when I've considered switching my internet service to get one Amaysim-provided bill, but I've consistently found better value for my NBN plan elsewhere… until today, that is.

With its current sale, new Amaysim NBN customers are treated to a tidy AU$30 off the price of select plans for the first six months of service. But the telco has further sweetened the deal by adding an additional AU$10-off introductory offer, bringing total savings to AU$40 per month, or AU$240 in total over those first 6 months.

That brings high-speed plans like NBN 100 and NBN 500 down to just AU$50p/m for the first half year, before the price then increases to an ongoing AU$90p/m. This makes Amaysim the cheapest NBN 100 and NBN 500 provider across the 30+ Australian telcos I monitor every month for introductory cost. Both these Amaysim plans also come with unlimited data and operate on a no-lock-in contract basis.

You'll need to act fast to secure these awesome Amaysim deals though, as they're set to expire on Tuesday, October 20, 2026.

When it comes to simplifying your bills, Amaysim's mobile and broadband bundle offer is also worth a look. After the introductory discount ends, you could pay as little as AU$80p/m for these plans by bundling an Amaysim mobile plan alongside your NBN, which would reduce your ongoing bill by AU$10 per month, or AU$120 a year. That’d make your ongoing internet costs total AU$960/y, which is one of the cheapest yearly costs for either NBN 100 or NBN 500.

Do note, though, that Amaysim exclusively provides NBN services and doesn’t provide hardware — you will need to BYO modem-router, in other words. That said, if you've already got an NBN service, then there's a very good chance that the modem you already have will work adequately with an Amaysim plan. Alternatively, I often recommend this Amazon eero 7 router for AU$299.99 if you want to invest in something new that can support NBN 500’s faster download speeds.

If you've got a real need for speed and want to save on your internet and mobile bills, you can check out Amaysim's other NBN plans in the widget below.

More from Tom's Guide

• Best NBN deals in Australia October 2026
• Best NBN plans in October 2026: I've compared the top choices for value, speed, gaming and more

The most terrifying thought concerning smart home privacy is the idea that my baby monitor is being watched by anyone other than myself. In the era of privacy beaches, your smart home devices might be leaking your data, and you need to shut that down ASAP.

Smart devices, from your thermostat to your washing machine, utilize IoT (Internet of Things) technology, which means that they’re embedded in a network that exchanges data with other devices over the internet. But what sort of data could a washing machine collect that could pose a potential privacy issue? Well, that simple smart appliance is connected to the same network as your laptop or computer, so hackers can bounce from a lightbulb to a PC.

We live in a time where we’ve traded our privacy for convenience, and while these companies have gathered a ton of data on us already, it doesn’t mean we need to keep the toxic river flow going. Let’s go over how to secure your devices.

Change your password

Come on now, don’t walk around with your username as “admin” and password as “password” for your router or any of your smart devices. You might as well be handing the manila envelope of your life directly to a hacker.

If you’re looking for convenience, use a strong password manager to autogenerate a password for you. Using personal information in a password is almost as bad as whatever the default is. Simple words are also ill-advised. If you really want to know how fast a hacker can break your password, Hive Systems produced a convenient graphic for you to get the idea.

Most importantly, don’t use the same password twice. I know it’s a pain, but it’s necessary, and let’s move onto why.

Enable 2FA or MFA

Changing your password is not enough. Even if you’ve somehow developed an impenetrable string of letters, numbers, and symbols, it could easily be put on blast if there’s a security breach. And suddenly, a hacker knows the password for your Samsung washing machine, which could be the same password you use for your laptop (if you happened to not take my previous advice).

Most devices let you set up two-factor authentication (2FA) or multifactor authentication (MFA), and it is a simple way to stop a hacker from breaching your smart home even if they have the password to your device. Setting this up, typically through your phone, is another layer to keep your smart home safe.

Enable automatic firmware updates

This may seem rather obvious, but it’s important to point out that you should keep all your smart home devices, especially your router, up to date and this includes your other devices too, like your smartphone and laptop. The easiest way to do that is to enable automatic firmware updates. Whenever there’s a security issue, manufacturers will ideally patch the vulnerability as soon as possible.

Unfortunately, that might not always be the case. If a company is no longer supporting the product or simply discontinued it, that might be your cue to do the same. No one likes spending money on something new when the old one works just fine, but the older a product is, the more vulnerable it could become.

Use a router-level VPN

Setting up a VPN (Virtual Private Network) can not only secure your smart home devices but all of the devices on your network. A VPN encrypts your data, so hackers won’t be able to see what exactly your smart home devices are communicating. It’s not impenetrable, but it’s a strong layer of security.

Now, the only problem with this is that most VPNs aren’t free and not all routers are compatible with VPN integration. However, if you have access to a VPN and a compatible router, you should be able to set it up via your router settings, in a section likely labeled VPN Client mode.

Set up a smart home network

One of the most significant changes you can make to your smart home is using a local or separate Wi-Fi network for your smart home devices. This does come with some drawbacks, however.

You can set up a guest network on your router and throw all your smart home devices on there, effectively isolating them from your primary network. How effective this is comes down to the type of smart home device you’re connecting. Some can get temperamental with your phone not being on the same exact network. You might need to switch to the guest network, connect with the device, and switch back to see if that works. In other cases, it might not be compatible at all.

If you want to go the local network route, things will take a slightly more challenging but effective turn. You’ll need to get your hands on a Raspberry Pi or an old laptop and start looking into Home Assistant, an open source home automation system that keeps all of your smart home devices local.

If you’re willing to trade convenience back for privacy, this should be your next step. It’s more involved than what we can cover here, but to put it simply, your smart home devices connect to your laptop or Raspberry Pi locally and then can be managed through the Home Assistant app.

Bottom line

The more steps you take to secure your network, the less likely you’ll have to worry about your personal data being breached because of something as simple as your washing machine. Even one of these steps will drastically improve your security, but changing your passwords and using 2FA or MFA is great advice in and out of your smart home.

More from Tom's Guide

• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• AI scams are getting scary realistic — 4 red flags to watch out for
• Your personal information is everywhere online — 5 ways to start removing it from the internet

AI scams are so realistic that even the most tech savvy person might fall prey to them. AI development increases by the day, and of course with any new technology, there comes the perversion of such technology, especially for malicious intent.

The old, “Your car’s extended warranty” trick might not cut it, but what about a call from a loved one? Yes, it is that real and it’s terrifying. Americans lost $893 million because of AI scams in 2025 (via the FBI), and if I had to speculate, the report might be worse for 2026 as AI continues to evolve.

There are several red flags you should watch out for with any sort of potential scam, but with AI scams, you need to be extra vigilant.

Red flag: Urgency

The urgent “RIGHT NOW” energy is a dead giveaway for scammers. My own mother-in-law received a call from the “courthouse,” saying that she missed her summons. And they threatened to put out a warrant against her if they didn’t receive information to confirm her identity, which of course included her Social Security number.

That’s a scary thing to be threatened with, but you know what you should do? Call your courthouse directly on a trusted number and verify that information. The same goes for anyone claiming to be from an official government body or even a loved one. Contact them directly on a trusted line of communication.

If the court really wanted you that urgently, they’d be knocking on your door. Take time to assess what these potential scammers are asking you and verify the information on your end.

Red flag: Emails about your account

One of the most common scams are emails about your account. It’s more terrifying now because they look so legit. I’ve caught myself second-guessing multiple times because some emails just look too realistic. It could be anything from threats about locking your account to resetting your password because there’s been a data breach.

The key here is to NEVER click on any links in an unprompted email or download any PDFs or documents. If there’s an actual problem with your account, login at the source, and assess what the supposed issue might be. It wouldn’t hurt to reset your password as well.

Red flag: Payment requests

Even if your best friend is asking you for money, I hope that you’d at least ask, “Why?” The same goes for anything you receive in the mail, in an email, or on the phone.

AI-generated emails and voices are incredibly convincing, and it’s easy to get scared into sending someone money because you “missed a payment,” or that you owe a debt, especially if you’re someone on top of your finances.

Take a deep breath, and don’t click on any link or give out any of your financial information. If you really did miss a payment, go directly to the source that they’re claiming you owe money to. Always deal with your financials directly, where you typically would, and never through anyone that contacts you unprompted.

Red flag: Pushback

As I’ve said so far, verifying the information being told to you is the most important thing to do in these situations, but there’s another dead giveaway for scammers — pushback.

Seriously, I’ve been on the phone with some of these scammers and they will be actively evasive or straight up pushy if you try to ask them questions to verify the information that they’re claiming to have.

If you’re talking to someone, or something in the case of an AI bot, who simply isn’t cooperating with your requests, run for the hills immediately.

Bottom line

Remain vigilant. The common throughline with all these red flags is that you want to verify and assess all of the information on your end without giving anything away yourself.

It’s not exactly fun to remain suspicious at everything you see, but unfortunately that’s the current world we live in. A highly personal email can contain detailed information about you, but that doesn’t mean you should trust it — companies sell your data all the time and experience data breaches, so it shouldn’t be hard to believe that a scammer acquired personal details about you.

There’s a “gotcha” mentality prevalent in even legitimate businesses, so always check the information twice and don’t be afraid to ask a friend or even the internet for help.

More from Tom's Guide

• Does antivirus software still slow down your PC in 2026? We tested the top security software to find out
• Your personal information is everywhere online — 5 ways to start removing it from the internet
• Apple issues emergency update for millions of iPhones, iPads, and Macs — update your devices now

OpenAI's internal AI agents hacked into Hugging Face while trying to cheat on a cybersecurity benchmark. Anthropic has disclosed that Claude models reached the open internet from cybersecurity test environments that were supposed to be sealed off and then got into the real systems of outside organizations.

Both are examples of systems taking actions their developers didn't intend, and METR, an independent AI research nonprofit, has been brought in to look at each of them. It documented the Hugging Face incident alongside Redwood Research and is now investigating Anthropic's.

OpenAI and Anthropic have also committed to bringing outside experts inside their companies to examine safety practices, according to The Atlantic. Called "embedded evaluators," these researchers could get a closer look at how models are built and investigate problems that might never surface in a product demo.

The catch is that this oversight is voluntary. Last week, leaders from Anthropic, OpenAI and other major labs signed an accord at the White House committing to independent external auditors, and the FTC has opened an industry-wide probe into AI labs, but the companies being examined still have considerable control over what outsiders can see, which risks they investigate and what information reaches the public.

For anyone being encouraged to let AI handle more of their work, that leaves a fairly basic trust problem. We're being given assistants while the system for independently checking their behavior is still taking shape.

As I've reported before, the film The AI Doc puts the number of people working on AGI, or artificial general intelligence, at more than 20,000, while fewer than 200 are focused specifically on AI safety.

A closer look inside AI companies

Today, an outside researcher might test a model before release and report how it performed. Embedding evaluators inside a company could let them follow its development and investigate the decisions behind that behavior.

Anthropic says these evaluators would have access comparable to an employee's, allowing them to observe training, speak with staff and examine how models are built and deployed.

The company has named Accenture as its first embedded evaluator, with Faculty, Accenture's specialist AI business, leading the work. Each company expects to invest at least $1 billion in AI safety over five years.

That access could help researchers discover whether a troubling incident was an isolated failure or evidence of a wider problem. METR's proposed approach to investigating incidents calls for examining transcripts, interviewing employees and studying the training conditions that might have encouraged the behavior.

The companies still set the terms

Anthropic acknowledges that standards for evaluators' access, reporting and funding haven't been settled. It will fund Accenture's work directly, while discussing pilots with nonprofits that would use their own funding.

Accenture is not new to Anthropic, since the two companies already run a joint business group under a partnership announced in December 2025.

That relationship deserves attention, because a group of evaluators published an open letter arguing that embedded evaluators shouldn't have other significant commercial business with the labs they assess.

As The Atlantic's reporting explains, voluntary oversight gives companies considerable discretion over the scope of an evaluation. Researchers need enough freedom to examine uncomfortable evidence and tell the public what they found.

They also need to be able to explain what they couldn't check. There needs to be transparency because a report based on limited access could be valuable, but we should know where its conclusions end.

What this means for ChatGPT and Claude users

METR's recent assessment of Claude Opus 5.5 focused on whether the model could accelerate AI research and development. The organization explicitly says its summary doesn't assess the model's alignment properties and whether its behavior follows intended goals and constraints.

METR conducted the evaluation under an unpaid agreement, and it also disclosed that Anthropic had an opportunity to review and edit the summary, with METR approving the final text.

The incidents involving internal agents don't establish that the ChatGPT or Claude you use for everyday tasks will behave the same way. OpenAI found that its agents' tendency to compromise infrastructure dropped by more than 100 times when they ran with the production ChatGPT setup, and Anthropic says the behaviors it found are unlikely to show up in ordinary use.

Independent researchers need enough access to uncover risks and the freedom to publish what they find, even if it delays a launch or frankly, even if it embarrasses the company paying for their work.

Bringing outside evaluators into AI labs is a promising start, but their influence will depend on what happens when they uncover a serious problem. If a company can restrict the investigation or keep the findings private, the public is still being asked to take its word for it.

More from Tom's Guide

• Claude Sonnet 5.5 just launched — here's why it's about to become your daily driver
• Meta Muse vs ChatGPT Dots — I compared the new AI agents, and they’re not as similar as they look
• Why Siri never worked like ChatGPT — former Siri AI researcher explains what Apple had to change

With cyberattacks, phishing scams and even identity theft surging as hackers turn to AI to boost and automate their operations, there’s never been a better time to lock down your digital life.

From securing your phone against mobile malware to ensuring your smart TV isn’t listening to every word you say, there are plenty of proactive steps you can take right now to protect yourself and your loved ones.

October is the perfect time to give your online accounts, passwords and everything else an audit too, as it’s also Cybersecurity Awareness Month.

Created back in 2004 as a joint initiative by the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA), this month-long initiative was established to help both individuals and businesses better protect themselves online.

Here at Tom’s Guide, we’ll be covering a wide range of attack methods, threats and of course, how to stay safe from them so that you don’t become another victim of cybercrime.

Stay tuned as throughout October, we’ll be publishing in-depth guides, walkthroughs and security news to help you stay ahead of the latest attacks and scams and you can find everything you’ll need to make the most of Cybersecurity Awareness Month 2026 right here.

There was a time not that long ago when you had to choose between protection or performance on your Windows PC. If you enabled your security software, yes, you would be protected from malware and other viruses, but your computer’s performance would take a massive hit. On the other hand, if you left your security software disabled, you’d be able to get the best possible performance while leaving yourself completely at risk.

While computers are now much more powerful and capable of handling multiple tasks at once with ease, people still remember having games like Half-Life 2 slow to a crawl or instantly crash the second their antivirus software started running a scheduled scan. For this reason, PC gamers and power users alike began completely disabling their antivirus before launching a game or doing anything even slightly demanding on their machines.

Now though, the best antivirus software operates much differently than it did before. Instead of scanning every single file on your computer over and over again, behavioral analysis can detect suspicious activity in a much less resource-intensive way. Likewise, modern antivirus engines use cloud-based threat intelligence so that all the heavy lifting isn’t done locally on your machine. At the same time, security software is now more intelligent and knows not to run an update or start a background scan when you launch a full-screen app like a game or video editor.

In our latest round of antivirus testing, we wanted to put this long-held preconceived notion that security software kills PC performance to rest once and for all by running both quick and full scans while playing graphically demanding, AAA games. Here’s what we found and why you no longer need to rush to turn off your antivirus every time you boot up a game.

From spreadsheets to FPS: How our testing evolved

In the past, whenever we examined the performance impact of antivirus software, we did so using a more CPU-intensive and disk-heavy test. This involved using a proprietary Excel-based benchmark that sorted through a database of 20,000 names and addresses. We would run the test five times and average the results to get a baseline performance level.

From there, we would re-run this same test while each antivirus suite was running a full scan and then a quick scan for malware. Doing so gave us a clear picture of how each antivirus lowered the performance potential of our testing rig. On older hardware, running a full scan while this benchmark was carried out would routinely show background tasks being slowed down by 20 to 40%.

Now that both the best computers and best laptops are much more advanced with multi-core CPUs, high-speed SSDs, and a lot more memory, we decided to alter our testing procedures significantly. We still run full and quick scans to establish a baseline, but from there, we now run the built-in benchmarks of resource-heavy games like Cyberpunk 2077 and Forza Horizon 5 while performing a variety of antivirus scans and recording how they affect each game’s frame rate in frames per second (fps).

At the same time, we also now test how each antivirus suite impacts our internet speeds. We do so by recording download and upload speeds with each program running while performing both a quick and full scan.

By measuring how each antivirus affects game frame rates as well as internet speeds, we can tell you which ones have the most and least impact on system performance. Without further ado, here’s what our latest round of testing found.

Antivirus-by-antivirus: Here’s how each suite performed

To conduct our gaming performance tests, we used a desktop PC equipped with an AMD Ryzen 7 7700X CPU, an MSI RTX 5070 Ti GPU, and 32GB of DDR5 memory. For this round of testing, we ran Cyberpunk 2077’s built-in benchmark on Ultra graphics settings and Forza Horizon 5’s on High graphics settings.

Of the five antivirus suites we tested with Cyberpunk 2077 running, Bitdefender came out on top with only a drop of 3 fps during a full scan. Meanwhile, Malwarebytes was impacted the most, taking a 13.7% performance hit in fps while running a full scan.

In the table above, for our baseline, the game and the antivirus software were running simultaneously. However, no active scans took place during those runs. From there, we performed a quick scan and then a full scan while executing Cyberpunk 2077’s in-game benchmarking tool.

Based on our testing, you can see that playing Cyberpunk 2077 with Norton 360 open but not actively scanning had almost no impact on performance. The same can’t be said for Malwarebytes though, where just running the antivirus and the game simultaneously seriously affected the performance of our testing rig.

When running Forza Horizon 5’s in-game benchmark with Avast, Bitdefender, and Norton idle and while actively scanning, all three antivirus suites experienced virtually unnoticeable fps drops. Instead of Malwarebytes though, McAfee was hit the hardest with a 15.9% performance penalty, dropping from 113 all the way down to 95 fps.

Obviously, your own results may vary depending on your gaming PC and future updates to all of the antivirus software suites we tested. However, it’s safe to say that disabling your antivirus every time you want to load a game is a bad habit we can all leave behind us. Sure, you could disable it to eke out a miniscule performance boost, but based on these numbers, you’re better off just leaving it running in the background.

What about your internet speeds?

When we first decided to change our testing procedures for antivirus software, I never thought that gaming performance would be relatively unaffected while internet speeds took a much bigger hit.

To carry out this portion of our evaluation, we ran multiple tests via Ookla’s Speedtest.net to measure the impact each suite had on download and upload speeds in three states: idling in the background, during an active quick scan, and during a full scan.

As you can see in the table above, Bitdefender came out on top with download speeds dropping by less than 1% and upload speeds dipping by only 3.9% during a full scan. On the other end of the spectrum, Malwarebytes’ download speeds remained virtually unchanged, but the same can’t be said for its upload performance, which suffered a steep 25.8% drop. When it came to pure download degradation, Avast took the biggest hit with an 18.5% drop, alongside a 10% dip in upload speeds.

There were also two anomalies in our internet speed tests that caught us off guard. For instance, McAfee’s download speeds only dropped by 1.8% during a full scan, but its upload speeds actually increased during active scans — jumping from 933.2 Mbps at baseline to 967.2 Mbps during a quick scan and 948.7 Mbps during a full scan. Likewise, Norton suffered a bigger download penalty during a quick scan, dropping from 810.77 Mbps down to 709.56 Mbps (a 12.5% hit), whereas its full scan download speed was actually faster at 896.09 Mbps.

Protected without the performance hit

If you’ve been disabling your antivirus software while gaming or doing other intensive tasks, you no longer need to. What once brought your computer to a crawl no longer does for several reasons. From more advanced CPUs to faster SSDs, PC hardware has advanced significantly over the past 20 years. At the same time, the way in which your antivirus scans for known malware and detects threats using behavioral analysis means that doing so no longer requires the system resources it once did.

While having your antivirus software running in the background or performing a quick or full scan isn’t as resource-intensive as it used to be, your internet speeds can be affected — even more so if you’re connected to one of the best VPNs, which often come bundled with top security suites.

For this reason, you might want to briefly pause your antivirus while performing large uploads or downloading massive files from trusted sources. Still, the temporary hit your internet speeds might take is merely a minor inconvenience, whereas having your gaming or work PC infected with malware or ransomware can be a major setback.

All in all, many of the old preconceived notions we held about antivirus performance impact simply no longer apply today — and for keeping your PC protected online, that’s excellent news.

More from Tom's Guide

• Security researchers discover fake ChatGPT ads that trick you into downloading malware
• Your personal information is everywhere online — 5 ways to start removing it from the internet
• Apple issues emergency update for millions of iPhones, iPads, and Macs — update your devices now

Apple has emphasized that they are prioritizing safety over almost everything, including AI. That's becoming even more important with Siri AI, which can now search across your messages, emails, photos and other information to answer questions based on your personal context.

However, a newly revealed forensic tool shows why protecting all that information doesn't end with securing the AI that uses it.

Magnet Forensics, the company behind the GrayKey phone-forensics tool used by law enforcement, claims it has developed a way to get around an iPhone security measure designed to make data significantly harder to extract from a seized device.

According to a leaked Magnet Forensics video obtained by 404 Media, a new device known as GrayKey Preserve and a feature called Evidence Preservation Mode can keep an iPhone in a more accessible state even after the phone would ordinarily reboot. Magnet itself says its new GrayKey preservation capabilities were developed to address the iOS reboot timer and can preserve data on iOS devices indefinitely.

That's potentially a big deal for iPhone privacy — and the timing couldn't be more interesting.

The iPhone protection you probably didn't know existed

Apple quietly added something called "inactivity reboot" to iOS in 2024. If an iPhone hasn't been unlocked for 72 hours, it automatically reboots. That isn't just an annoying restart, it actually changes the security state of the phone.

Once you've unlocked an iPhone after a reboot, it enters what's known as After First Unlock or AFU. Some encryption keys become available so apps and services can work normally.

Restart the phone and leave it locked, and it goes back to Before First Unlock, or BFU, where more sensitive data remains encrypted and is harder for forensic tools to reach.

That's why the 72-hour timer can make a difference. Leave a seized iPhone untouched for too long and it can reboot on its own, locking down more of its data. Magnet claims it has found a way around that.

According to the leaked video obtained by 404 Media, GrayKey Preserve can capture the AFU state and keep it available even if the iPhone later reboots or loses power. Magnet also claims it can preserve data that would normally disappear over time, including cached locations, recently deleted photos and recently deleted iMessages. Magnet's own explanation says its new GrayKey capabilities can preserve that data indefinitely.

Exactly how it works isn't clear. Security researcher Jiska Classen told 404 Media that Magnet could be manipulating the iPhone's clock or interfering with the processes that expire data, but for now that's only a theory.

Then there's Siri AI

Siri AI can use what Apple calls "personal context understanding" to find information scattered across your iPhone. Ask it to find an old photo, track down a recommendation buried in a message or pull information from an email or calendar entry, and Siri can go looking for it. It also has onscreen awareness and can take actions across apps.

That's a big part of what makes the new Siri useful, but it also means the assistant is working with some of the most personal information on your phone.

Apple has put a lot of emphasis on keeping that information private. Much of Apple Intelligence runs on device, while more complicated requests can go through Private Cloud Compute. Apple says data sent there isn't stored or made accessible to the company.

GrayKey raises a different issue. It isn't reportedly breaking Siri AI or Private Cloud Compute. It's going after the iPhone itself.

And that's where the distinction matters. Apple can lock down how its AI processes your information, but the messages, photos, emails and location data Siri relies on still have to live somewhere. If someone gains physical access to the phone, protecting that underlying data becomes just as important as protecting the AI using it.

What this means for your iPhone

There are still plenty of unknowns. We don't know exactly how Magnet's technique works, which versions of iOS it works on or whether Apple has already closed the door on it. The leaked Magnet video also appears to date from early 2025, even though it only surfaced now.

And this isn't a case of plugging any iPhone into GrayKey Preserve and instantly seeing everything on it. Magnet's claim is more specific: its technology can prevent an iPhone from moving into the more restrictive security state that normally kicks in after prolonged inactivity.

Still, the timing is hard to ignore. Apple is asking Siri to understand more about you while promising that the information behind those personalized answers stays private. On-device processing and Private Cloud Compute protect how Apple Intelligence handles that data, but they don't eliminate the need to protect what's sitting on the iPhone itself.

As Siri gets more personal, keeping the data it relies on secure has become even more important.

More from Tom's Guide

• Claude Sonnet 5.5 just launched — here's why it's about to become your daily driver
• Meta Muse vs ChatGPT Dots — I compared the new AI agents, and they’re not as similar as they look
• Why Siri never worked like ChatGPT — former Siri AI researcher explains what Apple had to change

Update: Google responds to inquiries about this attack.

Sponsored Google ads for fake ChatGPT are leading Windows users to download malware in "ClickFix" traps, according to security researchers from the AI company Island.

The sponsored Google ads lead to Custom GPT sites that are built to look like normal ChatGPT websites. These ads pop up when people type terms like "chatgpt" into Google Search.

Unfortunately, for trapped users, the ads do go to legitimate chatgpt.com sites. However, in these instances, entering a prompt makes the fake service direct people to a "backup domain" due to "high traffic."

Clicking on that link then redirects unsuspecting users to another fake instance of ChatGPT with a fake Cloudflare verification page that contains ClickFix instructions. Island found nearly identical responses across two separate Custom GPTs over a 3-day period in August.

According to the researchers, the malware advertising campaign appeared to involve around 850 paid ads, 26 fake ChatGPT links, and 71 Google Ads campaign IDs over a three-month period from May 2026 through August 2026.

What is ClickFix?

ClickFix traps are built to trick people into installing or executing malicious commands on their devices. In this instance, the instructions from the backup domain trick Windows into running a command that downloads malware onto your computer.

Once installed, the malware infects the system. It can even survive PC restarts and uses a Telegram bot to send stolen info back to the hackers behind this camping The malware utilizes a tool called NetSupport RAT, which lets attackers remotely control an infected computer.

Island found that the domains rotated and other Windows malware-delivery forms were identified too suggesting that the attack is not based on a single website.

The company claims an AI tool highlighted the suspicious activity and human researchers confirmed it. However, it's not clear how many people may have been affected by this scam.

A Google spokesperson told Tom's Guide that it has already suspended accounts associated with this attack.

"Before this report was published, we suspended the advertiser accounts involved to block this scheme and updated our defenses to better detect these tactics," a spokesperson said.

We were told that Google is monitoring new attempts to utilize fake ads. Google does have a policy that does not allow misleading ads about a business, product, service or destination. Per Google, the company blocked more than 400 million misleading ads for violating Google's "Misrepresentation" policies last year.

How to avoid falling victim to online scams

The combination of malware and advertising — also known as malvertising — has a long, storied history, which means you should always be careful when clicking on any advertisement online. To stay safe, you could try using one of the best ad blockers, since Google's "sponsored" links are still technically ads; most blockers will hide them.

Beyond that, if you don't have or want an ad blocker, there are some red flags to note when using a search engine and especially if you get linked to a fake instance of ChatGPT.

As for ChatGPT, if you are an existing user or just trying it out, go to chatgpt.com; no need to search for it.

Likewise, I've covered ChatGPT outages quite frequently over the course of the last two years and even at its worst, the AI assistant never sends you to a "backup domain." Don't click that link. If ChatGPT is having issues, you can always check the OpenAI status page.

At the same time, no website verification or CAPTCHA will ever ask you to open Windows Run and paste a command. If a website asks you to press Win + R or run PowerShell, don't do it.

Finally, you should always have one of the best antivirus software solutions installed on your PC. From there, you want to ensure that your antivirus is current, updated and running on all your devices – both your computer and even your smartphone.

More from Tom's Guide

• AI agents are going rogue and causing new security headaches — but Nvidia has a way to stop them
• Apple issues emergency update for millions of iPhones, iPads, and Macs — update your devices now
• Your personal information is everywhere online — 5 ways to start removing it from the internet

Everyone is currently talking about the latest Apple software releases. With iOS 27 bringing all kinds of new goodies, it's easy to see why. The Face ID bug that hit iPhone 18 Pro and Pro Max devices brought even more attention to the new versions.

But that doesn't mean Apple has forgotten about iOS 26, iPadOS 26, macOS Tahoe, macOS Sequoia and the older devices that can't get the latest and greatest operating systems. If left alone, these older operating systems can become easy targets for attackers.

In fact, an active attack called CVE-2026-86950 targeted older Apple devices that Apple has patched to fix.

New iOS, iPadOS and Mac updates

The update is available to download now for older Apple devices. If you own a device that can download iOS 26, iPadOS 26, macOS Tahoe or macOS Sequoia, you need to install this update immediately; the exploit is in the wild, and while attacks have been highly targeted so far, you could fall victim if you're not up to date.

The new versions are iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1. Download it as soon as you can to stay protected.

As for what the exploit can do, it affects CoreGraphics, an Apple framework used across iOS, iPadOS and macOS to display and process visuals in files like images and PDFs. Since many of us use images and PDFs regularly, it's easy to see how an attacker exploiting those file types could quickly gain access and do damage.

If an attacker gets into the device, they can interfere with an app or program's normal operation, crash your device or take control of a process. With this particular exploit, processing a maliciously crafted file through CoreGraphics could let an attacker run their own code on a device, which can lead to catastrophic repercussions.

Apple said the exploit was being used for an "extremely sophisticated attack" that was also targeted. But just because it was targeted doesn't mean it'll stay that way, so you'll want to update your devices ASAP to make sure you're protected.

More from Tom's Guide

• Android president on Apple's iPhone Duo: 'I'm glad to see more people joining what is now the obvious party'
• Forget iPhone 18 Pro — 9 reasons to wait for the iPhone 20
• I finally unlinked my iPhone alarm from my ringer volume — here is where Apple hid it in iOS 27

With hundreds of VPNs available, it can be incredibly difficult to dig out the best VPN for you. That's why we've reviewed dozens of VPN for over 8 years at Tom's Guide – and it's no secret that we rate Proton VPN as the best VPN for privacy.

There are plenty of reasons why – the Secure Core servers, audited no-logs policy, open-source apps on all devices... The list goes on, and you can find out more in my in-depth Proton VPN review if you're interested.

However, the price is very appealing, too. Right now, Proton VPN sits at $2.99 per month on the 2-year plan ($71.76 all-in).

But hold on a second. If you're looking to start de-Googling your life, Proton Unlimited is currently also discounted. On the 12-month plan, it currently sits at $9.09 per month ($109.12 all-in, rising to $119.88 in the years after). This includes the VPN as well as secure Mail, Drive, Calendar, and more.

Whichever takes your fancy, you rest easy with the knowledge that Proton is one of the relatively few VPN companies that actually puts your privacy first. Because the non-profit organisation Proton Foundation controls Proton AG (the company that makes the VPN), it can't be forced to prioritise making money over protecting its customers by external investors.

More info on these excellent Proton VPN deals below.

How does Proton VPN compare?

On paper, Proton VPN puts up some very impressive stats. It has servers in 145 countries, which gives you great range around the world. The only VPN with more is NordVPN, with 167.

Proton VPN is fast, too, delivering average speeds of over 1,500 Mbps on our 10 Gbps connection. Some VPNs, including Surfshark, Mullvad and Windscribe were faster in the same tests, but Proton is competing at the top of the table.

Proton's privacy credentials are what really impresses, though, and if you're looking for one of the most private VPNs, Proton VPN is hard to beat. It values privacy above all else, and its features reflect that.

Secure Core is its Double VPN feature, and it routes your VPN traffic through two servers rather than one. Proton VPN owns and operates all of its Secure Core servers, and you connect to your desired location via Iceland, Sweden, or Switzerland. Plus, VPN obfuscation is provided through the Stealth protocol. This disguises your VPN traffic to help it bypass internet restrictions.

There's a rock-solid kill switch, and threat protection in the form of NetShield. However, be aware that the latter isn't nearly as good as other VPN malware protection like NordVPN's Next-Gen Antivirus. It's handy to have, and better than nothing, but I'd recommend a standalone malware and ad blocker instead of relying on it.

Overall, Proton VPN is one of the very best VPNs available right now – and if privacy is your top concern, it should be your first consideration.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

If you’re looking to protect yourself online, we’re here to help. We’ve compared Norton’s range of online security plans, assessing their features, protection, performance and value. There are several options worth considering, from antivirus protection to more comprehensive coverage and family-focused plans. So grab a coffee while we talk you through the Norton product lineup.

Best all-round protection

Norton 360 is a family of plans that are designed to help you stay safe online. The Deluxe option is our top recommendation: it's number one in our best antivirus guide, offering real-time protection from malicious software such as viruses, ransomware, and spyware for up to five devices, alongside an extensive set of extra security features, including a firewall, password manager, VPN for privacy, and parental controls.

It's a particularly good choice for families with multiple devices to manage. If you have fewer devices to protect, or a lower budget, consider the Norton 360 Standard plan instead. You get the same all-round protection (antivirus, scam protection, VPN etc) but across three devices, and without some of the extra features.

We were impressed with the performance of all the applications during our testing of both products. Whether we were running Norton 360 on an iPhone, Android device, PC or Mac, we found the apps easy to use, with no noticeable system slowdown.

In our real-world tests for Norton 360 Standard (which has the same core antivirus app), we ran a quick scan and a full scan while gaming. As shown in the performance results below, there was minimal slowdown during play, with negligible impact from the software.

Norton VPN is a useful addition and works well for everyday privacy, connecting quickly to nearby servers to encrypt your data while browsing, streaming and using public Wi-Fi.

We weren’t the biggest fans of Norton’s AI feature, Ask Genie. It was slow to respond and needed multiple inputs to check if links were safe. Competitors do this better. Mac users, beware as well — some features like SafeCam and Cloud Backup are only for Windows users. That's no great loss thanks to macOS’s built-in camera privacy options and Time Machine, but worth knowing.

Overall, Norton 360 Deluxe offers an impressive range of online security features that perform well, AI assistant notwithstanding. But there are several other plans if you have different needs. Norton 360 Standard is a cheaper, entry-level option if you have fewer devices to protect, for example, or a lower budget.

And if you're particularly worried about identity theft, you'll need to upgrade to a plan that includes LifeLock, which will cost you more — the Deluxe package only offers some basic identity theft protection features.

As with most online security software, be aware that the price of all plans rises by quite a margin when the annual renewal kicks in. You can turn off auto-renewal in your account settings at any time.

• Read our Norton 360 review

Best for privacy

If you're looking for online privacy — or a way to access region-locked content — and don't need the extra security features of Norton 360 Deluxe or LifeLock, Norton VPN is a good choice.

Following a massive transformation over the last 18 months, it's now one of our top recommendations in our best VPN guide. Its privacy credentials are strong: Norton’s no-logs policy has been independently audited, supporting its claim that it does not record, store or sell its users’ browsing activity.

However, where Norton VPN excels is streaming. It was the only VPN in our latest round of testing that successfully unblocked every streaming service we threw at it, including Netflix, Prime Video, Disney+, BBC iPlayer, ITVX, Channel 4, 9Now, 10 Play and YouTube.

Norton also recently expanded its global network coverage to over 100 different countries, bringing it closer in line with rivals Surfshark and ExpressVPN. That's more than enough to ensure high-speed browsing and smooth streaming for everyday use.

Price-wise, Norton VPN ties with Surfshark as the cheapest of our top-rated VPNs, making it great value for money. All this adds up to a reasonably priced and well-featured VPN that we have no qualms recommending to pretty much everyone.

• Read our Norton VPN review

Best Norton internet security suite

Hacks and data breaches are increasingly common, which means you data could end up leaked onto the internet through no fault of your own. Norton 360 with LifeLock helps protect you when your info escapes into the wild, with the same security protections as Norton 360, but with extra identity theft protection.

You can broadly split the coverage into two parts; proactive monitoring of credit reports and data breaches to catch any potential issues, like social security leaks or fraud, and restoration support for when your personal information is exposed or you're the victim of financial fraud or identity theft.

The proactive monitoring is incredibly helpful, as you can flag any potential issues before they become a problem . And if someone does manage to get into your accounts to steal your identity or money, Norton 360 with LifeLock means you get a Personal Restoration Specialist, based in the U.S., who'll get your accounts back in order. This is one of the reasons we rank it as the best internet security suite you can get right now.

There a few editions of Norton 360 with LifeLock: Select, Advantage and Ultimate Plus. The main difference between each is the amount you'll be reimbursed if your money or identity are stolen, and a few other things, like the amount of cloud backup storage you get and volume of credit reports and from which bureaus.

Although Norton 360 with LifeLock offers very similar digital security features to Norton 360 Deluxe, it's also costs quite a lot more. You do get a lot for your money if things go wrong and your personal data gets abused, but it's important to think about your exposure to these risks and decide whether the digital security tools of 360 Deluxe would be enough.

Best for parental controls

Norton Family is a dedicated parental control app that's designed to keep your kids safer when they're online. It gives you greater control over what they can see or do while browsing, allowing you to block inappropriate websites and set healthy screen time limits.

It lets you supervise your kids' web use, so that you can see the sites they're visiting. You can check what apps they're installing, and choose which they're allowed to use. You can even track their search history to see what they're interested in (and how suitable it is).

We rate it as one of the best parental control apps out there, particularly for Android and Windows households. However, bear in mind that like many of its rivals Norton Family isn't compatible with macOS: it can't be installed on a child’s Mac or MacBook to monitor desktop activity. Features like individual app-level blocking are also unavailable or limited on iPhones and iPads due to Apple’s operating system restrictions.

It's one of the more affordable parental control apps, with unlimited devices and child accounts. However, prices do rise substantially after the first year of subscription. If you're considering antivirus software as well, it would be worth choosing Norton 360 Deluxe or any of the higher 360 packages, which come with Norton Family bundled in.

• Read our Norton Family review

FAQs

Aussie internet speeds are undoubtedly getting faster, but there’s a strong possibility your home isn’t best prepared to take full advantage of them. There’s a simple fix… and it might be an upgrade you've been putting off.

As per Opensignal's latest report, NBN Co's Accelerate Great initiative vastly improved Australia's internet speeds, thanks to free wholesale speed boosts and the arrival of a new 2Gbps speed tier. For all their positives, however, the report found that many Australians aren’t receiving the full benefit of the vastly improved speeds due to their router, with many homes and businesses neglecting their Wi-Fi radio-wave-emitting tech.

Specifically, the data reveals that 64% of readings across the six major retail service providers (RSPs) came from older Wi-Fi generation routers — i.e. Wi-Fi 3, 4, or 5 — which may not deliver the full speed of the new tiers over Wi-Fi. More than 70% of readings for both Telstra and Vocus came from Wi-Fi 5 routers or older, whereas 55% of relative newcomer Superloop's readings came from Wi-Fi 6 routers or newer.

When it comes to top-end download speeds, the proof is in the pudding. Across all RSPs, customers on Wi-Fi 6 routers or newer sit around 500Mbps at the 90th percentile of download speeds. Comparatively, those with Wi-Fi 5 routers or lower reach between 129Mbps and 287.7Mbps — which is substantially slower.

If your Wi-Fi router is considerably older than your current plan — i.e. you've upgraded your FTTP or HFC connection to a much faster plan without replacing it — and your Wi-Fi is still slow, it may be time to upgrade to a new router. Wi-Fi dropouts can also be caused by poor placement, interference, firmware, your device or an NBN/RSP fault, so it’s worth checking out NBN Co’s Wi-Fi router guide if you’re unsure.

Newer Wi-Fi generations don't just mean new devices. Each generation brings about improvements in speed, latency, capacity or efficiency — or a combination of all four — although a newer generation doesn't automatically mean better range. Deciding what Wi-Fi generation you need depends on a few factors, but it largely relies on your preferred speed tier and your bandwidth requirements, depending on how many internet-connected devices are in your home.

Currently, Wi-Fi 6 routers or higher are a good starting point for NBN 500 plans or faster. But the Wi-Fi generation alone doesn't tell you which internet plan a router can handle: figures such as AX1800, AX3000 or BE11000 are maximum Wi-Fi speed ratings, not supported NBN plan speeds. The newest generation is Wi-Fi 7, which can deliver multi-gigabit wireless speeds with compatible devices, but if you are looking at NBN 2000, be aware that the router's WAN and LAN ports need to be 2.5Gbps or faster.

If you're considering an NBN 500 plan, I'd recommend a router with Wi-Fi 6 connectivity and enough range that you don't need to be right next to it to consistently achieve top speeds. For NBN 750 and NBN 1000 plans, there's a nice sweet spot where you could easily get by on a good Wi-Fi 6 router, but you could also consider Wi-Fi 6E or a Wi-Fi 7 model with a 6GHz band if your devices support it. In a larger home, coverage and router placement — or a mesh system — may matter more than the rated speed.

The highest residential NBN wholesale speed tier available is 2,000Mbps, which is still mighty fast — and well beyond what Wi-Fi 5 can normally deliver day to day. If you have an eligible FTTP or HFC connection and want a 2Gbps plan to achieve its full potential, you'll need a router rated to handle 2Gbps internet service with at least a 2.5GbE WAN port. Wi-Fi 7 is the better option if you're buying new and want multi-gigabit wireless speeds, but a suitable Wi-Fi 6E router can work too. For the most reliable way to exceed 1Gbps on one device, you'll also want a 2.5GbE LAN port and a compatible wired device.

Here's a quick bullet-point summary of the above recommendations:

• NBN 500: Wi-Fi 6 or higher, with at least a 1GbE WAN port
• NBN 750: Wi-Fi 6 or higher, with at least a 1GbE WAN port
• NBN 1000: Wi-Fi 6 or higher, with at least a 1GbE WAN port; 2.5GbE is useful for future-proofing
• NBN 2000: Wi-Fi 7 recommended (a suitable Wi-Fi 6E router can work), plus support for 2Gbps internet service and at least a 2.5GbE WAN port

Best new router deals

If you're ready to shop for a new router, I've gathered some top-rated options below. From Wi-Fi 6 to Wi-Fi 7, I've spotted some stellar deals on new routers and mesh systems on Amazon, from brands like TP-Link, Netgear and eero.

As a router reviewer, I've been using the Amazon eero 7 router and the weatherproof eero Outdoor 7 mesh extender for a few months now, and they were super easy to set up using the companion app. I've used a trusty TP-Link Archer router at home for a while too, and it was just as easy to plug and play. If you're keen to see what the best Wi-Fi 6 or Wi-Fi 7 routers we've tested at Tom's Guide are, you can check out our respective guides.

Just remember that Wi-Fi generation alone doesn't tell the whole story: the Wi-Fi 7 TP-Link Archer BE220 only has Gigabit Ethernet ports, so it isn’t good for NBN 2000, while the Netgear Nighthawk RS100 has a 2.5GbE WAN port but Gigabit LAN ports, so it is less suited for wired setups. The Wi-Fi 6 Archer AX12 is also limited to Gigabit Ethernet so it can connect to an NBN 2000 service but can't fully use it. The eero 7 has two 2.5GbE ports and is the best match for NBN 2000, although Amazon rates its wireless speeds at up to 1.8Gbps, so no single Wi-Fi device will get the full 2Gbps.

A picture of my children at the beach, my son playing soccer or even my entire family, smiling in front of our house are all examples of photos I've posted to social media. I know I'm not alone, considering just how often I've seen similar images highlighting the goings-on of modern lives.

But AI has created a disturbing new risk that allows the use of ordinary photos of real children like the ones I mentioned above, to be manipulated into sexual abuse imagery without the child — or their parents — ever knowing.

To be clear, this is not a theoretical threat.

332 AI-generated child sexual abuse ads slipped through

A new investigation from the Tech Transparency Project (TTP) found hundreds of ads containing AI-generated child sexual abuse material (CSAM) running across Facebook and Instagram. Researchers identified four real children whose ordinary photos had been manipulated, according to WIRED, including two teenage influencers, a preteen whose image appeared on a stock-photo site and a young member of a European royal family.

In total, TTP found 332 ads containing AI-generated child sexual abuse material, or CSAM. Most depicted a child whose photograph had been manipulated using AI to make it appear they were performing a sexual act.

The findings are an alarming reminder of how generative AI has changed the risks around sharing photos of children online. Creating convincing fake imagery no longer requires an explicit photograph in the first place. An ordinary picture can provide the raw material.

How ordinary photos become AI-generated abuse

Generative AI image tools can take an existing photograph and modify parts of it while preserving recognizable features of the person in the original.

That's what researchers say happened to several of the children identified in the Meta ads.

According to WIRED, researchers were able to trace images of four minors back to their original sources. Two were teenage influencers with public social media accounts. Another was a preteen whose photograph was available through a stock-photo website. The fourth was a young member of a European royal family.

None of those original photographs needed to contain sexual material for them to be misused.

"AI apps are making it far too easy to create realistic criminal imagery of child sexual abuse, creating the new risk of everyday photos of children being taken and transformed into sexual content," Emma Hardy, director of communications at the Internet Watch Foundation, told WIRED.

Once an ordinary image is publicly accessible, someone can potentially download it and feed it into an AI tool designed to alter photographs.

Meta's AI didn't catch hundreds of the ads

The scale of the latest investigation also shows how difficult the resulting content can be to stop.

In August, TTP researchers initially uncovered 53 ads containing child sexual abuse material across Meta's platforms. Meta subsequently said many of those ads had appeared before the company introduced new AI technology intended to improve its ability to detect violating ads when they were uploaded.

However, researchers kept finding them. In fact, TTP says it ultimately identified 332 ads containing AI-generated CSAM, with hundreds appearing after Meta had announced its improved detection technology.

That is particularly significant because these weren't simply Facebook or Instagram posts that escaped moderation. They were paid advertisements.

Meta says ads are reviewed before they're allowed to run and that automated systems play a major role in that process.

Meta spokesperson Tracy Clayton told WIRED that the company does not tolerate nudify apps or child exploitation, whether the imagery involves real children or is generated by AI. Meta said bad actors deliberately attempt to evade its detection systems and that some of the videos were harder to detect because images of children appeared only briefly or were blurred.

The company said many of the ads researchers identified had already been removed, most received fewer than 200 impressions and it received less than $5,000 in payments from the ads. But researchers documented instances in which exposure increased after an ad was reported.

TTP says one ad involving a real teenager had reached four European accounts when it was reported to Meta. Several days later, when Meta removed it, the ad had reached more than 330.

The investigation shows the tools are mainstream

Researchers found ads directing people toward nearly 50 apps available through Apple's App Store and Google's Play Store. Around 300 of the roughly 350 ads examined in the broader investigation promoted AI image or video generators, according to WIRED.

Apple told WIRED that some developers initially submitted compliant versions of their apps before subsequently adding prohibited nudification capabilities. Apple said it removed 17 of 20 apps identified by researchers and took action against the remaining three, as well as seven additional apps WIRED identified.

Google said it removed all apps included in the report and suspended hundreds of other apps for violating its policies.

Still, these finding reveal a problem that extends beyond any single platform because AI can be used to create the imagery. An app store can distribute the tool used to make it. An advertising platform can then distribute ads promoting it.

Each layer may have its own safety systems, but abusive material only needs to slip through those systems once to reach users.

What to do if you find an AI-generated image of your child

If you discover sexualized AI imagery involving your child, don't repost or widely share the image in an attempt to warn others.

Instead, preserve information that can help identify where the material appeared, such as the account name, page address and other surrounding details, and report the content directly to the platform.

In the U.S., suspected child sexual exploitation can also be reported to the National Center for Missing & Exploited Children's CyberTipline.

Parents can also use NCMEC's Take It Down service, which is designed to help stop the online sharing of nude, partially nude or sexually explicit images or videos involving someone who was under 18. The system creates a digital fingerprint, or hash, from an image without requiring the image itself to be uploaded.

Since AI-generated imagery creates newer and more complicated scenarios, parents who aren't sure whether a manipulated image qualifies should still report what they've found rather than trying to determine that themselves.

The takeaway

Parents have been warned about "sharenting" and children's digital footprints for years. Sharenting is a term that combines "sharing" and "parenting" and is the practice of parents sharing images, videos and personal details about their children on social media.

Although parents can't entirely eliminate the risk of AI abuse on the images or videos they post, but reducing the number of publicly accessible photos of your children and being more selective about what you share, can reduce the amount of material available to people who might misuse it.

More from Tom's Guide

• ChatGPT-6 Astra is here — this one prompt shows what it can really do
• I asked ChatGPT, Gemini, Claude and Perplexity to rank the 10 jobs most likely to be replaced by AI — here's what they all agreed on
• Claude Fable 5.1 is here — this one prompt shows what it can really do

NordVPN's next-gen antivirus has achieved a 94% phishing detection rate in AV-Comparatives' latest anti-phishing test, ranking third among security products in the independent evaluation. The result our choice as the best VPN behind only Avast One Free Antivirus and Norton Antivirus Plus, both of which scored 96%.

The test, which ran from August 12–22, 2026, assessed phishing-page detection rates across 250 live phishing URLs, with an additional 250 legitimate URLs used to check for false positives. NordVPN recorded zero false alarms – a result that puts it ahead of Malwarebytes Premium and Webroot SecureAnywhere Internet Security Plus, both of which triggered false positives during the evaluation.

The findings come as NordVPN continues to reposition itself as an all-in-one digital security app. The company's recent rebrand saw Threat Protection Pro renamed as "next-generation antivirus," placing it alongside its VPN and Dark Web Monitor as one of three core pillars of the product.

How does NordVPN compare?

Finishing third among nine security products is a strong result, but the detail behind NordVPN's score is arguably just as telling as the number itself. Avast One Free Antivirus and Norton Antivirus Plus both edged it out with 96% detection rates, but the gap is narrow – a two-percentage-point difference across 250 live phishing URLs amounts to five URLs.

The rest of the field tells its own story. At the other end of the table, Dr. Web Security Space managed just 57% and K7 Total Security 70% – results that illustrate how inconsistent phishing protection remains across the security products market, even among established names.

NordVPN's advantage over the field is clearest on false positives. It was one of seven security products to record zero false alarms – and false positives erode confidence in a security tool just as surely as missed threats do.

"Phishing is a numbers game for attackers, and they're very good at it," said Domininkas Virbickas, product director at NordVPN. "Anybody might slip up eventually, and when you do click on something you shouldn't, that's where we step in."

A strong track record in independent testing

This is not the first time NordVPN's threat protection feature has performed well under independent scrutiny. In November 2024, AV-TEST – a German independent IT security research institute – previously rated Threat Protection Pro the best VPN tool for malware protection, achieving an 83.42% total detection rate across 3,209 tested links. That result placed it well ahead of the next-best VPN tested, IPVanish, which scored 46.96%.

NordVPN also has history with AV-Comparatives specifically. In June 2024, it became the first VPN provider to earn the organisation's anti-phishing protection badge – a significant distinction given that AV-Comparatives is best known for evaluating dedicated antivirus software, not VPNs. Earning the badge requires a minimum 85% detection rate with zero false alarms on legitimate sites, a bar not all established antivirus products have cleared. The August 2026 result, at 94%, clears it by some distance.

NordVPN's next-gen antivirus is available on Plus plans and above – the feature was previously known as Threat Protection Pro, and is included across Plus, Complete, and Prime tiers.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

In what has to be one of the biggest data breaches to date, a security researcher discovered a hacker who appeared to be selling access to a database of over 153 million driver's licenses from the United States and Canada, including IDs for Pete Hegseth, the current U.S. Defense Secretary (the Defense Department is reportedly aware and investigating).

The breach was spotted by security journalist Brian Krebs in a report claiming that the hacker created a site called Nexus and claimed to have access to digital scans of 153,347,439 identity cards.

"A quick look around Nexus finds they are likely not exaggerating about that 153 million number: Running a blank search in Nexus (with no search parameters entered) returns approximately 11.5 million pages of results, with roughly 15 results displayed per page," Krebs wrote.

In a forum post from a Russian cybercrime site, Nexus allegedly sourced the scans from "major identity verification company," suggesting that the hackers had or have basically real-time access to the company's systems.

How it happened

Krebs found his own driver's license was among the searchable records. He also found Hegseth, whose photo was listed on the site.

Krebs worked with security researcher Zach Edwards, whose ID was also in the breach, and identified the company IDScan as the potential source of the leak. The company, based out of Louisiana, is used by multiple companies to verify millions of IDs from around the globe.

"Based on all the details in the article and how Brian was literally able to dox me (and the timing of the screenshot of my license being added into the system aligning to my trip), all the signs point to IDscan having a hellacious ongoing real-time breach of their data. This is a massive vendor," Edwards wrote on Bluesky.

Investigations and concerns

Per Krebs, the FBI and IDScan are both investigating the breach. Tom's Guide reached out to both organizations but did not receive a reply in time for posting.

“At this point I’m not able to share any additional information, but the updates you have provided have been welcome and helpful to our team’s investigation,” an IDScan spokesperson told Krebs.

A commenter on Krebs story claims that his company received a data breach notification from IDscan:

"Earlier today, September 1, we received information suggesting that certain information may have been exposed and that IDScan.net may be implicated. We are working urgently to validate that information and determine whether any unauthorized access occurred, and the scope of such activity," the note reportedly reads.

It goes on to say that the company has taken steps to secure its system, notified partner companies, engaged legal counsel, and is conducting a third-party forensic investigation.

Nexus apparently went down shortly after Krebs' report went live. Though it's possible it could return under a different domain.

A data breach like this is terrifying at the best of times, but it happens to come at a time just as governments across the globe are attempting to roll out age-verification laws that require adults to upload or scan identity documents in order to prove they can access websites or apps — generally adult content. Privacy advocates and security researchers have already warned that the laws put people's data at risk.

How to stay safe

Edwards ID was likely scanned when he went to a cannabis dispensary that has a contract with IDScan. Krebs believes his was scanned when he rented a car from Hertz last year. He also found his mom's ID from around the same time.

There are plenty of places where your ID could get scanned, from car rental agencies to bars and even the TSA. In the meantime, I would suggest requesting that your ID not be scanned by companies that demand it during check out or check in.

While we don't know if the Nexus database will return, it would be good form to take these seven steps to stay safe after a data breach.

That includes signing up for one best identity theft protection services. As always, you'll want to be on high alert for phishing attacks and social engineering attacks, especially ones that urge you to "act now." Avoid clicking on any links, QR codes, or attachments from unknown senders.

Beyond that, you should consider a password overhaul by creating strong, complex passwords for all of your accounts but you can also use one of the best password managers to do so for you instead.

Even without a massive data breach, these are generally good practices just to keep your side of the street clean since companies are increasingly unable to do so.

More from Tom's Guide

• More than 9.5 million patient records affected by Aesto Health data breach: what you need to know
• We put the best identity theft protection to the test to protect your entire digital life — these are the services I recommend
• Have you been 'Flocked'? Here's how to look up automatic license plate readers in your area

Aesto Health recently disclosed a data breach affecting more than 9.5 million people. Aesto is a software company for healthcare organizations that produces solutions to help them organize patient data when replacing health records systems.

Spotted by Bleeping Computer, the company first posted a notice of the attack on June 24 via its website. However, the actual incursion took place over two weeks in December of 2025. It apparently wasn't discovered until May 26 of this year.

"After an extensive forensic investigation and manual document review, on May 26, 2026, we confirmed that between on or about December 2, 2025, and December 18, 2025, certain protected health information belonging to patients of various Covered Entity clients stored within Aesto’s network may have been accessed and/or acquired by an unauthorized actor," the notice reads.

Apparently, the breach involved unauthorized access via Aesto's Amazon Web Services infrastructure.

What was taken

In its report, Aesto Health confirmed that the breach affects 9,540,683 people. Unfortunately, that data included full names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, taxpayer ID numbers, Social Security numbers and other government identification numbers.

According to the HIPAA Journal, the breach spans 29 different organizations including Edwards County Medical Center, Marana Health, My Doctor, LLC, the Nebraska Orthopedic Center and Women's Health Associates.

The company started informing impacted individuals of the breach on August 21, providing details about the incident and providing identity theft protection and credit monitoring via Experian.

As noted by Bleeping Computer, this incident follows an unfortunate series of breaches that have affected health care companies including CareCloud, Nutex Health, iRhythm and McKesson. The breaches have ranged in size from a couple of hundred thousand to millions of records.

Per Aesto Health and our own review, no threat groups have publicly claimed the attack, unlike other recent ones claimed by the hacker group ShinyHunters.

How to stay safe after a data breach

Check out the full list of companies from the HIPAA Journal, and if you've used any health care organization, you might receive a data breach notification letter from Aesto. If you do, take advantage of the Experian coverage. Keep an eye on your mailbox since notification letters arrive the old-fashioned way.

Even if Aesto doesn't send you a notification letter, you may want to take advantage of one of the best identity theft protection services to protect your identity.

While no one has claimed the attachment, a bad actor could use your information to launch targeted phishing attacks. Phishing emails could contain malicious links or even malware.

Health companies appear especially vulnerable as the summer comes to a close, and every company should be taking this threat seriously. Hopefully, companies are bolstering their cybersecurity right now.

More from Tom's Guide

• We put the best identity theft protection to the test to protect your entire digital life — these are the services I recommend
• Have you been 'Flocked'? Here's how to look up automatic license plate readers in your area
• We've tested the best antivirus software and these are the 5 I recommend right now

From the start of the wireless networking era – even before it was called Wi-Fi – every new spec and generation of hardware was aimed at delivering faster speeds to do more things online at home. Not anymore, because Wi-Fi 8 (aka. 802.11bn) takes a different approach, putting an emphasis on range and reliability to be able to stay online longer with fewer interruptions.

While it seems like a step sideways with a top speed of 46 Gbps that’s equivalent to Wi-Fi 7, Wi-Fi 8 can do a lot to make home networking easier, more fulfilling and dependable. The new spec’s Ultra High Reliability (UHR) approach promotes better performance at long range, the ability to handle more data traffic and block interference. Spectral efficiency is the name of the game with Wi-Fi turning from squeezing more data into the air waves to making it easier to use and more reliable.

Buyer beware, as has been the case with every Wi-Fi generation, the router hardware precedes the general availability of client devices. At first, it can seem like a wireless tease, then, all of a sudden, there are new generation devices everywhere. In addition to the first Wi-Fi routers and mesh kits in the coming months, expect Wi-Fi 8, phones, computers and tablets in early-to-mid 2027. This will be followed by range extenders and USB upgrade kits late in the year.

Archer 8 Ultra and Deco 8 Ultra

I got a sneak peek at what will likely be the first commercial Wi-Fi 8 routers from TP-Link, the company’s Archer 8 Ultra high performance router and Deco 8 Ultra mesh set. They each have functional designs, sleek lines and can theoretically move 19- and 22 Gbps, respectively. Powered by either Qualcomm’s Fast Connect 8800 or Broadcom’s BCM6718 chips, this networking gear is top shelf and aimed at high-performance users with two 10 Gbps inputs and USB ports for connecting a storage device across a network.

The IEEE 802.11bn spec isn’t close to being finalized and I do expect changes before it’s formally approved sometime in 2028. That said, the lack of finality hasn’t stopped the world’s Wi-Fi chip manufacturers and router makers from developing products.

If the past is any indication, the new routers will need a firmware update or three to add late changing aspects of the final Wi-Fi 8 spec. Plus, many router makers plan to introduce new routers that hit the main features on introduction and add items to them throughout 2027. Unfortunately, none of the current generation of Wi-Fi 7 routers can be upgraded to Wi-Fi 8.

How the routers will act is coming into focus. The big change that Wi-Fi 8 brings is better use of the 2.4-, 5.0- and 6.0 GHz frequency bands on which the data rides. It goes beyond 4K Quadrature Amplitude Modulation (QAM) and Multi-Link Operations (MLO) with what TP-Link calls its Stability Engine that will debut with the company’s Wi-Fi 8 hardware.

This can seem like an alphabet soup of engineering acronyms that starts with Unequal Modulation (UEQM) to make sure that each device can get to its full speed regardless of whether lower-speed clients are nearby. The New Modulation and Coding Scheme (MCS) takes this a step further by blocking interference that can lower throughput. Together, the techniques can improve throughput by 24% versus Wi-Fi 7, according to early tests.

Antennas by the dozen

Meanwhile, the routers have internal antennas galore. While the Archer 8 Ultra has no fewer than 18 antennas, the Deco 8 Ultra has a 5 transmit, 5 receive antenna arrangement. This can amount to a 1 to 3 dB increase in signal strength that can translate into greater throughput and range.

That’s just the start because the new antennas can help prevent frustrating disconnect and reconnect cycles that rob throughput. TP-Link’s engineers are going a step further by looking into pushing its antennas to the limit by making its transmission pattern adjustable. The feature would bias it horizontally (for a ranch house) or vertically (for a multi-story building).

Meanwhile, Wi-Fi 8’s Distributed Resource Units (DRU) and Enhanced Long Range (ELR) combine to increase coverage so that the signal can enliven Wi-Fi dead zones with data. These techniques allow clients at the periphery to stay online despite a weak signal. If these changes pan out, my Wi-Fi experience could be vastly improved, from not losing my connection when listening to the BBC World Service on my Wi-Fi Internet radio deep in the basement to working out on the patio on a sunny day.

A premium next-gen upgrade

TP-Link’s Archer 8 Ultra is going on sale in Germany and in the UK in October, where regulators have given the company the green light. This will be followed by U.S. sales in early 2027.

Premium and high performance in all aspects, look for a sub-$1,000 price tag for the Archer 8 Ultra. Though this will almost certainly drop as the year progresses. TP-Link then plans to introduce Pro and base product lines with lower prices during 2027.

Think of Wi-Fi 8 as making the house of cards that wireless networking has become a little sturdier and more permanent so that a sneeze won’t make it all collapse. Just as I got used to Wi-Fi 7, it’s time to turn to Wi-Fi 8 but I can’t wait to get my hands on the two TP-Link networking devices as well as the products of other companies to try them out in my lab and home.

I must admit to a hidden hope that Wi-Fi 8 enhanced reliability is enough to replace many of the Ethernet cables that run through my house, creating a wireless backbone for my entire home network.

More from Tom's Guide

• I just saw Wi-Fi 8 in action, and it might be the first internet upgrade in years that actually makes sense
• These are the best Wi-Fi 7 routers to give your home upgrade a major upgrade right now
• I put aluminum foil behind my router to fix my Wi-Fi dead zones — and it actually worked

Meta has been in plenty of hot water as of late.

The company’s smart glasses have gotten a ton of ire as people have pointed to privacy concerns over users secretly filming random passersby and whoever else they please (there’s even a report about teenage boys using them to pester girls at middle and high schools).

Meta then found itself in the middle of a lawsuit that saw 29 states, co-led by California Attorney General Rob Bonta and the AGs from Colorado, New Jersey and Kentucky, allege that its social media platforms are addictive to children, mislead consumers about those young users’ safety on said platforms and inappropriately gather children's personal data.

That lawsuit has now met its end, as Meta has just agreed to pay a settlement of $17.1 billion — according to a statement made by California AG Rob Bonta. The state of California could receive between $1.5 billion and $2.1 billion if the court authorizes the settlement. As for New York, its attorney general announced that the state will get up to $1.15 billion and likely put it toward kids' education and social services meant to assist youngsters struggling with their social media addiction. Head to this link to see how much each state will receive from this monumental Meta settlement.

With this settlement in place comes a host of changes Meta has been ordered to make to Facebook and Instagram. Here’s what these changes could mean for parents with children who frequently use both platforms and how they could result in a positive outcome for them.

Less addictive and harmful social media spaces for kids of all ages

There’s a wealth of changes Meta must now make according to the measures detailed in the settlement, such as:

• A default daily time limit of two hours for users under 18 years of age that can only be lifted by a parent
• A default nighttime block between midnight and 06:00 for users under 18 years of age that can only be lifted by a parent
• Default blocks on notifications to users under 18 years of age from 22:00 to 07:00 and during the school day
• An enhanced mechanism for teenagers to report potentially harmful content and a requirement that Meta respond to 90% of those reports within six hours
• A ban on displaying numbers of likes or reactions to users under 18 years of age
• A ban on cosmetic procedure image filters for users under 18 years of age
• An option for users under 18 years of age to have a non-personalised feed
• A commitment to enhance parent supervision tools

That settlement also notes that Meta has agreed to the following terms and conditions:

• Institute robust age assurance measures to detect users under 18, as well as measures to identify and remove users under 13 years of age
• Use an independent auditor with expansive access to information and resources
• Be subject to an injunction prohibiting it from making "further false, misleading, or deceptive statements around its safety features"

In a statement that looks to reassure everyone that kids will be more protected across their social media platforms, Meta had this to say: “Ensuring teens have a safe and productive experience on our platforms is an absolute imperative for Meta. We want to get this right for parents and teens.”

With all these newly instituted measures in place, Facebook and Instagram could become far less of an addictive haven for children who want to do nothing but endless scrolling and discover content that could be extremely harmful to their mental well-being. Strict usage time limits, parents getting more control over the type of content their kids see, fewer distracting notifications popping up on kids’ screens and young users having less exposure to detrimental content could go a long way toward making Meta’s platforms more approachable for younger users.

While instituting a two-hour limit for kids using Facebook and Instagram is good, kids may still use that time to expose themselves to harmful content. With parents getting more control over their kids’ social media accounts, here’s hoping their stronger involvement will make children less susceptible to coming across said content.

Bottom line

Meta being forced to take responsibility for the harm its social media platforms have done to children is major. While this development doesn’t automatically make Facebook and Instagram 100% safe for kids from this point forward, it’s a good first step toward companies like Meta recognizing the ill effects their products have had on children.

More from Tom’s Guide

• Perplexity’s new local-first AI runs on your PC — and asks before using the cloud
• ChatGPT can learn your repetitive tasks by watching you — here are 7 prompts to try
• AI could transform healthcare for the better — but this doctor says there’s one thing it should never do

Privacy concerns around social media have escalated significantly in recent years, with users increasingly cautious about what they share online.

A new experiment by Compare the Market tested exactly how much information can actually be hidden when you set your Instagram to private. The results are sobering.

A licensed investigator was tasked with locating the home addresses of nine volunteers using only publicly available information.

Despite four of them having private Instagram profiles, the investigator identified the addresses of seven out of nine. The fastest was located in just 15 minutes, with the first lead found in 50 seconds.

What the investigation revealed

Colin Crowden, Intelligence Director at Global Protect and an Open-Source Intelligence expert, conducted the investigation. What he discovered challenges the assumption that private accounts provide adequate protection.

Beyond identifying addresses, the investigation uncovered four complete property plans revealing internal home layouts. In one particularly concerning finding, Crowden established that a volunteer was away on holiday, confirming their property was unoccupied.

The speed at which information was gathered highlights a critical vulnerability. Information shared by friends and family, location tags from previous posts, property details visible in photos, and data from other online sources all contribute to a broader picture.

Crowden explains the issue clearly: "Information that appears harmless in isolation can become much more revealing when viewed alongside other publicly available information. This isn't about any one post creating a security risk; it's about how different pieces of information can build up over time."

Why your private account isn't enough

The experiment demonstrates that privacy settings alone offer incomplete protection. Even if your Instagram is private, tagged photos from friends, public check-ins, or incidental details in backgrounds can expose your location and home information.

The investigation reveals that the combination of data sources, not any single post, creates the vulnerability. Compare the Market's home insurance expert Helen Phipps worked with Crowden to develop concrete recommendations for reducing your digital footprint.

Practical steps to protect yourself

Wait until you're home to post

If possible, wait until you're home before posting holiday photos rather than sharing in real time. This prevents anyone from knowing your property is unoccupied. If you do post while away, avoid revealing exactly where you are or how long you'll be away for.

Review your privacy settings before you travel

Check who can see your posts, stories, and tagged content. Consider setting your accounts to private and reviewing your followers so that holiday updates are only visible to people you trust. This step takes minutes but significantly limits exposure.

Coordinate with friends and family

Your friends and family can inadvertently expose you. Ask them not to share real-time updates if you're traveling together or post photos of your property if they're housesitting.

People often don't realize they're compromising your security by tagging you in posts or sharing location details.

Turn off automatic location tags

Disable geotagging in your social media settings entirely. On Instagram, this requires revoking access directly through your phone’s system settings under Privacy & Security (iOS) or Apps (Android) rather than within the app itself.

Location sharing can unintentionally reveal your whereabouts even when you're not posting in real time. This is one of the easiest settings to overlook but also one of the most revealing.

Audit your digital footprint

Search for yourself online periodically to see what personal details are publicly accessible, and remove anything that compromises your privacy. Pay special attention to old social media posts containing house numbers, street signs, car license plates, or identifiable landmarks.

If you want to take action right now, I have a step-by-step walkthrough covering 5 ways to start removing your personal information from the internet. You should also check out how to blur your home in Google Maps Street View.

Combine digital caution with home security

Beyond digital precautions, pair online caution with classic home security measures. Set light timers to create the appearance someone's home, test all locks, arm your alarm system, and ask a neighbor to collect post and manage bins so the house looks lived-in.

Ensure your home insurance policy covers the duration of your trip and review any conditions that apply while your property is unoccupied.

This investigation raises important questions about privacy in the digital age. Have you changed your social media habits? What's your biggest concern about your digital footprint? Share your thoughts in the comments below.

For a complete breakdown of Compare the Market's methodology and findings, read the full Online Safety Study here.

More from Tom's Guide

• Meta's new AI tool uses your Instagram photos by default — here’s how to opt out
• Inside the dark market stealing real identities online
• Instagram's 'instants' feature is driving users crazy. Here's how to disable it

Automated license plate readers (ALPR) manufactured by Flock Safety operate across tens of thousands of locations in nearly every U.S. state.

Mounted near intersections, neighborhood entrances, and main highways, these motion-activated systems capture high-resolution snapshots of passing traffic. The software logs license plate numbers, vehicle colors, make, and distinctive visual markers like roof racks or damage.

While law enforcement agencies cite the technology for helping solve active cases, privacy advocates raise concerns over continuous passive surveillance of everyday drivers.

Checking whether your daily commute passes through an active camera zone requires using public transparency tools, crowdsourced databases, and visual hardware checks. Here's where to start.

Curious if you are on the police's radar?

The independent transparency project Have I Been Flocked offers a rare, though limited, public window into automated surveillance by compiling official audit logs obtained through public records requests.

Where data is available, putting your license plate number into the site lets you check if participating law enforcement agencies have queried your specific vehicle.

Keep in mind that coverage is far from comprehensive. It cannot show a real-time feed, nor does it log every time your car passes a camera. Instead, it exposes the historical paper trail left behind only when an officer manually searches your plate within a jurisdiction that has released its audit logs.

The platform also overlays crowdsourced camera maps and regional policy trends, helping to highlight local data retention habits and how agencies share access across city lines.

You don't have to wait for an audit log

While lookup sites rely on public records, community-driven maps offer a clearer picture of physical hardware placements. Volunteer-driven projects like DeFlock map thousands of confirmed automated plate readers across interactive regional layouts.

Inputting your home or work address displays verified device markers, often including field-of-view indicators that reveal which direction a camera faces.

Meanwhile, privacy advocates and projects like FlockHopper use this crowdsourced data to highlight heavy surveillance corridors and potential alternative routes, utility varies widely.

Because these platforms rely strictly on volunteer submissions, map coverage depends entirely on how active the privacy community is in your specific area.

See what your town or city's cameras are doing

Many city governments and police departments pull back the digital curtain by hosting dedicated Flock Safety Transparency Portals on their municipal websites.

By searching your town or city's name alongside "Flock transparency portal," you can unlock a live public dashboard detailing the exact number of active cameras in your area, and the searches undertaken.

These dashboards reveal the core settings of your local surveillance net. They show exactly whether your police department activates real-time hot-list alerts for missing persons and wanted vehicles, or if they restrict the technology strictly to retroactive evidence gathering after a crime has occurred.

While not every town chooses to make their dashboard public, a quick search is the fastest way to see how your community balances public safety with digital privacy.

Spotting a Flock camera in the wild

While you can track placements via public records or crowdsourced maps, keeping your eyes on the road is the best way to spot unlisted or newly installed units.

Flock devices feature a distinct, minimalist design: a compact black rectangular box mounted roughly 8 to 12 feet high on light poles or dedicated metal posts. Each unit typically operates completely off-grid, equipped with a small, angled solar panel positioned directly above the main camera housing.

To spot them, look for lenses pointing sharply downward toward active traffic lanes rather than toward sidewalk pedestrian paths. They are built primarily to hunt for license plates and vehicle characteristics, not foot traffic.

What’s your take on Flock cameras? Do you view them as essential public safety tools or an overreach on driver privacy? Let us know in the comments below.

More from Tom's Guide

• Hidden cameras in hotels and Airbnbs are more common than you think — 5 ways to protect your privacy
• Is your personal information public? The simple step to securing your privacy online
• Your security cameras are in the wrong spots — here's how to fix it

When my grandfather would write me while I was away at school, he would end each letter with, "It's been fun to visit with you for a few minutes." That's the way I still feel about any correspondance -- it's a way to visit with someone regardless of how quick or meaningless.

And now that Claude can not only draft an email but send it, I feel like that's just another AI feature I simply don't need. However, I feel differently about everything surrounding that conversation.

There’s nothing personal about sorting newsletters, searching for a buried attachment or rereading a 20-message thread to work out what everyone decided. These are the jobs that could easily consume my day, and I’m more than happy to hand some of them to AI.

Features such as Google’s AI Inbox and AI Overviews in Gmail can identify priority messages, summarize conversations and answer questions about information scattered across multiple emails. I still write my own replies, but I spend much less time figuring out which ones I need to send.

Here are five ways AI can make your inbox easier to manage without writing a single email for you.

1. Show you what needs your attention

Most inboxes present every unread email as one more thing demanding your attention. A message from someone waiting on a decision can sit beside a sale announcement, an automated receipt and a newsletter you might read later.

Google’s AI Inbox is designed to separate those signals. It surfaces top priorities and groups together topics you may need to catch up on, giving you a more focused starting point than a long chronological list.

This is particularly helpful when I return to my inbox after being away from it. Instead of opening messages one by one to see what happened, I can begin with the conversations Gmail has identified as important.

AI won’t always understand your priorities perfectly, so keep that in mind. A routine-looking message may matter because of the person who sent it or something discussed outside email. I still scan the rest of my inbox, but I no longer have to treat every unread message as equally urgent.

2. Summarize a long email thread

Few things make me want to close Gmail faster than opening a thread with dozens of new replies.

Some messages repeat information from earlier in the conversation. Others branch into separate discussions, and the detail you need may be buried somewhere in the middle. By the time you reach the bottom, it’s easy to forget what prompted the exchange in the first place.

Gmail’s AI Overviews can summarize long conversations, pulling together the key points and recent replies. This gives me enough context to understand what the thread is about and where I should start reading.

I don’t rely on the summary when I need an exact quote, firm deadline or final decision. AI can miss a qualification or flatten a disagreement between two people into a cleaner consensus than the thread supports. For anything consequential, I go back to the original messages.

The summary still saves time because it directs me to the parts of the conversation that need closer attention.

3. Find an email when you can’t remember the keywords

This one is a life saver for me. With three kids, there is always a form or permission slip that I need to not miss. And while traditional search works when you know what you're searching for, sometimes all I have is a date or name. Unfortunately, that isn’t usually how I remember email.

I may remember that someone recommended an app or sent me a meeting date without recalling who said it. Sometimes I know an attachment arrived but have no idea what the file was called. That can lead to several rounds of searching with slightly different keywords.

AI search allows you to describe the information instead. In Gmail, you can ask a natural-language question, and Gemini can use relevant messages to generate an answer or surface the conversations containing it.

You might ask, “What date did we agree on for the interview?” or “Who sent me information about the new subscription?” The wording doesn’t have to match the original email.

As with summaries, I open the source message before using the information. The advantage is reaching it without having to remember how someone phrased the subject line three weeks ago.

4. Pull out action items and deadlines

An email doesn’t need to contain the words “action item” to give you something else to do.

A request may appear at the end of a long update. Someone might mention a deadline in passing or ask a question halfway through a message covering several unrelated subjects. Read it too quickly and the request disappears beneath everything that arrived afterward. That drives me crazy! However, AI can scan a conversation for outstanding questions, dates and tasks. You can ask Gemini which messages require a response, what you agreed to send or whether a thread contains an upcoming deadline.

This is one of the most useful ways to catch up after a busy stretch. I’d never treat that picture as a definitive to-do list. A missed deadline matters far more than a few saved minutes, so I check the original messages before adding anything to my calendar. AI acts as a second pass, catching details that could otherwise remain buried.

5. Bring related conversations together

One project rarely stays inside one neat email thread. The initial discussion may have one subject line, the scheduling conversation another and the follow-up a third. Add several participants and forwarded messages, and the information becomes scattered across your inbox.

AI can identify relationships between those conversations even when they don’t share the same wording. Instead of opening one thread and searching separately for the rest, you can ask for the latest information about a topic or project.

AI can work with the inbox I actually have, including the conversations I forgot to file correctly.

It still requires oversight. Two projects may have similar names, or the same person may email you about unrelated subjects. I check which messages informed an answer before assuming AI has assembled the right set.

Bottom line: I want AI handling the clutter, not the conversation

AI-generated replies will probably become harder to avoid as email providers place them directly beneath our messages. For some people, they remove the stress of writing and make communication faster. I understand the appeal.

They just aren’t the feature I need. Choosing my own words takes a little longer, but it preserves the reason for sending an email in the first place. The administrative work surrounding that exchange is where I’m happy to save time.

Do you use AI to save time with your inbox? Let me know in the comments.

More from Tom's Guide

• 5 Gemini features ChatGPT still can’t match
• Meta files patent for AI facial recognition glasses that identify people around you and record automatically
• 5 features that give Claude the edge over ChatGPT

Apple just dropped security updates for iOS 26.6.1, iPadOS 26.6.1 and macOS Tahoe 26.6.2 that fixe nearly 30 vulnerabilities according to a support document. The surprising thing about this update is that it's the third security release in as many weeks.

Earlier this month, The Financial Times reported that AI is surfacing bugs faster than Apple's normal update release schedule can handle.

Per Apple, this update includes fixes that were already added to the iOS 27 beta, iPadOS 27 beta and macOS Golden Gate betas that are currently running.

Close to 30 vulnerabilities

A majority of the vulnerabilities are related to WebKit and flaws that affected Safari. Simply accessing "maliciously crafted web content" could cause Safari to crash. These crashes came from memory handling issues, input validation, and processing states.

The other fixes include an audio vulnerability that could allow an app to leak sensitive information, an image flaw that could allow for random code execution, and a trio of kernel vulnerabilities.

For iOS specifically, Apple addressed a telephony bug that could allow a bad actor in a privileged network to bypass IPSec authentication and intercept your network traffic.

Interestingly, of the vulnerabilities outlined, 21 are WebKit-related, and nine are credited to OpenAI's Codex Security.

Stay safe and update

According to Apple, none of the vulnerabilities in today's listing are known to have been exploited in the wild yet. Still, you'll want to update to the latest version as soon as possible since bad actors could start targeting those flaws.

As such, we recommend you update to the newest versions as soon as possible, especially with all of these vulnerabilities being found so quickly.

For devices that can't run iOS 26 or iPad OS 26, Apple also released iOS 18.7.10 and iPadOS 18.7.10 so older devices can receive the same support and protection.

You can install the updates via the Settings app by tapping General and selecting Software Update.

More from Tom's Guide

• Apple iPhone 18 event — all the new products expected to launch in September
• 15 Apple deals students should snap up on Amazon — save on MacBook Air M5, AirPods, iPads and accessories
• iPhone Ultra leakers reveal new details around release and 'extremely limited' availability

A massive jury trial against Meta is beginning today that could change the face of social media forever with a potential financial death penalty of $1.4 trillion on the line.

When a tech giant is put on trial, the public is usually conditioned to expect a lengthy battle that ends in a quiet settlement, written off as just the cost of doing business. But this is entirely different.

That’s because after the lawsuit was filed by 30 U.S. states in 2023, including California and New York, governments are finally taking action in saying the “attention economy” is a public hazard for children.

It’s not just an accusation of bad content policy, it is a direct assault on how Meta and social media as a whole works. Beyond that eye-watering figure, the states are demanding fundamental changes to how Instagram and Facebook operate — including killing the like button and infinite scroll.

Should Meta lose, this would be a massive tectonic shift. I’ve sifted through the entire case document to break down the accusations, the demands, the evidence and what this will actually mean for you.

The hit list (what is actually changing)

I’ll go into the specifics of the case itself in a little bit, but outside of that gigantic price tag, what would actually vanish from Meta’s apps if the company loses?

• Death of infinite scroll & autoplay: The states are demanding an end to the endless feed and autoplaying of content. These features are explicitly designed to maximize screen time, and losing them breaks the TikTok-style doomscroll in a fundamental way.
• The end of the like button: Another key dopamine hit that keeps teens hooked to their screens is the like count. The lawsuit is targeting this too — demanding an end to social validation metrics.
• No more algorithmic manipulation: The states want to see change to Meta’s “dopamine-manipulating recommendation algorithms.” This could mean a return to your standard chronological timelines by default.
• Notification lockdown: No more frequent push notifications designed to pull young people back into apps. You’ll see these pop up to stop young people from disengaging with a social platform.
• Killing stories & filters: The states want an end to disappearing or “ephemeral” posts like Instagram Stories. On top of that, they’re demanding the removal of image filters that alter a user’s physical appearance in pictures.

However, there is one broader, scarier implication for everyone, not just teenagers.

The death of the “Finsta”

The lawsuit isn’t just about tweaking algorithms; it’s demanding structural changes to how accounts are created. The states are demanding strict parental verification for teenagers and limits on multiple account creation.

For teens, this effectively kills the “Finsta” — a fake or secondary Instagram account used to hide from parents or public scrutiny), and to enforce this, platforms will need to know exactly who is holding the phone. That would spell the end of casual online anonymity.

The smoking gun — could Meta lose this case?

Obviously, I’m not going to claim myself to be some expert legal mind here. But I’ve been a tech journalist for over 15 years and witnessed a bunch of lawsuits, and some of the data points, internal admissions and quotes in this document seem pretty eye-opening.

The COPPA Scandals:

For over seven years (until December 2019), Instagram had no age gate at all. When Meta finally added one, the drop-down menu defaulted automatically to a date making the user exactly 13 years old — effectively showing kids the exact date to bypass the restriction.

Internal research cited in the filing revealed that 40% of children aged 9 to 12 use Instagram daily, and 45% use Facebook daily. This leads to the accusation that Meta viewed children aged 10 to 12 as a “valuable but untapped audience” that dedicated internal teams analyzed to target.

The founding confession

Sean Parker himself said that the thought process behind building Facebook and Instagram was all about “how do we consume as much of your time and conscious attention as possible?”

He called it a “social-validation feedback loop” that exploits “a vulnerability in human psychology,” which its creators all understood “consciously.”

“I don’t want to hear it” about underage users

This is what Head of Instagram Adam Mosseri apparently said when he was confronted with evidence that child star JoJo Siwa had been active on Instagram since age 8.

On top of that, Meta’s former director of site integrity Arturo Bejar testified that Zuckerberg knew about “harms that teenagers are experiencing in its product,” but are “choosing not to engage about it.”

Meta’s own internal numbers

The company ran a “Teen Mental Health Deep Dive” private survey that found:

• 1 in 5 teens felt worse about themselves after using Instagram
• 24% reported feeling “not good enough because of the app”
• 67% felt forced to “create a perfect image online”
• Over half admitted to struggling with severe FOMO (Fear of Missing Out)
• 14% of young users admitted to having thoughts of wanting to “hurt [or] kill themselves”

Cynical product design and internal teams

The lawsuit pulls back the curtain on how Meta internally viewed user engagement — with the company reportedly operating an engineering group called the “Rabbithole team.” Their mission was clear: optimizing “preference amplification,” which is fancy wording for figuring out how to push users deeper down algorithmic rabbit holes.

Even when Meta rolled out “time management” tools like the Daily Limit to appease public critics, the lawsuit alleges they were designed to fail. Originally, the daily limit was 10 minutes, but once public scrutiny died down after the 2021 whistleblower leaks, Meta quietly raised that minimum to 30 minutes.

But perhaps most damning of all is that as early as 2017, Facebook’s own former VP for user growth publicly admitted he had banned his own children from using Facebook. Sometime after that, Meta simply disbanded its internal “Responsible Innovation” team.

Outlook: a corporate death penalty?

The federal trial officially kicks off today in Oakland, California, with California, Colorado, Kentucky and New Jersey leading the charge.

But this trial isn’t just about the money. Because this is a consumer protection lawsuit rather than a personal injury case, the states are asking the judge to order sweeping changes to the platforms.

If Meta loses, we aren’t just looking at a massive fine. We are looking at court-mandated age restrictions, the deletion of algorithmic feeds for minors, and the permanent removal of the infinite scroll.

Win or lose, the curtain has been pulled back. The “attention economy” as we know it is officially on trial.

More from Tom's Guide

• Meta files patent for AI facial recognition glasses that identify people around you and record automatically
• A parent’s guide to the MacBook Neo: is Apple’s cheapest laptop a back-to-school trap?
• I connected Claude to my daily apps — here are the 5 that actually made it useful

McAfee has been around for decades, and it has come a long way from the antivirus software I remember slowing down my PC as a teenager. Having tested McAfee+ Premium extensively, I can confirm that it’s one of the best antivirus software suites available today. It packs plenty of useful tools, such as Identity Monitoring, Secure VPN with no limits, File Shredder, and Tracker Remover.

The software sports a user-friendly interface that makes it a delight to use, and 24/7 customer support over chat and phone ensures all your problems are quickly resolved. Low impact on system resources is another highlight. Even though the Full Scan takes a while and renewal price makes your eye twitch, neither of those are dealbreakers.

For the complete breakdown, read my full McAfee+ Premium review.

McAfee+ Premium review: Specs

McAfee+ Premium review: Costs & what’s covered

Similar to other antivirus software suites, McAfee offers different plans for consumers and businesses alike. Let’s talk about McAfee’s consumer plans first. The most basic plan, Essential, covers up to five devices and is available for $39 / £33 for the first year.

The McAfee+ Premium Individual plan is a step up from Essential, and costs $49 / £49 for the first year. It naturally includes everything Essential offers, plus a Social Privacy Manager as well as scanning the web for your personal information. McAfee+ Advanced Individual is the most expensive plan, offering the most comprehensive protection. It’ll cost you $89 / £74 for the first year. Alongside everything else included in Essential and Premium, Advanced includes up to $1 million identity theft coverage, bank and credit card transaction monitoring, credit lock and security freeze, and more.

It’s important to note that after your first year is up, McAfee’s renewal prices go up by a lot. For instance, the Premium plan I tested costs $149 after the first year — a steep $100 price hike. Norton 360 Deluxe, in comparison, costs $124 per renewal, making it slightly cheaper than McAfee.

There are many family plans available, too, such as Premium Family ($69 starting price) and Ultimate Family ($249 starting price). If you own a business and want a competent antivirus software suite, a number of plans are available exclusively through Dell in the U.S. and Currys in the U.K., starting at just $24 / £11 and going all the way up to $169 — depending on the number of devices and features, of course.

It’s important to read the fine print to understand what you’re signing up for, but in case you aren’t happy with your purchase, McAfee offers a 30-day money-back guarantee. Also, if McAfee fails to catch a virus and your device gets infected, the company’s Virus Protection Pledge states that it’ll refund you the amount you paid for your subscription.

McAfee+ Premium review: Protection

The more you pay for your McAfee subscription, the more protection you’ll get. For instance, the Essential plan protects up to five devices from scams and monitors the dark web for any personal detail leaks. The Premium plan (that I tested), on the other hand, covers unlimited macOS, Windows, iOS and Android devices, and offers extra features like Social Privacy Manager, Personal Data Cleanup and Online Account Cleanup (scans only). I’ll discuss these in detail shortly.

Regardless of the subscription you sign up for, McAfee offers a secure VPN, password manager and identity monitoring across all. But it’s important to note that it doesn’t offer cloud backup or ransomware protection, which is surprising. Competitors, like Bitdefender, Avast One and Norton 360 offer these to a degree, so it’s worth considering them instead if these features are important to you.

Before diving into my experience with McAfee, let’s take a look at how three independent labs that test antivirus software twice a year (for the most part) rate it. AV Test’s June 2026 report rated McAfee as a “Top Product,” with 6/6 scores across Protection, Performance and Usability. Bitdefender, Avast and Norton 360 all received 100% scores, too, which goes to show that McAfee is just as good as its rivals, if not better.

AV Comparatives’ April 2026 test report rated McAfee 1st out of the 19 antivirus software suites it tested — which is outstanding, as McAfee upstaged Malwarebytes, Avast, Norton 360 and Bitdefender. McAfee scored 90/100 in AVC, 96.7/100 in Procyon, and 3.3 in Impact. The low Impact rating means that the software doesn’t have a negative impact on your system’s resources. It blows the likes of Malwarebytes (17.6 Impact score) out of the water.

Lastly, I looked at SE Labs’ (U.K.) June 2026 report, which awarded McAfee an AAA rating with 98% protection accuracy and an overall 99% score. McAfee is edged out by Norton 360 and Bitdefender — but only just — as both of them achieved a 100% protection accuracy score.

McAfee+ Premium review: Performance

Once you’ve bought your subscription, it’s time to download and install McAfee on your device and activate it. Doing so is extremely straightforward. Simply enter your product key, email address and billing information into McAfee’s dedicated activation page. You’ll then be prompted to download the software onto your machine. On our testing rig, it took just under five minutes to get up and running.

On Android and iOS smartphones, you’ll need to download the free app from the respective app store, and punch in your registered email address to activate your subscription on your phone. Doing so on my Google Pixel 10 Pro XL barely took any time — perhaps two minutes or so.

After installing McAfee and activating my Premium plan on our MSI testing rig, I ran a Quick Scan and a Full Scan, both of which are easily accessible from the app’s main page. As its name suggests, McAfee’s Quick Scan quickly scans your computer, and it isn’t as in-depth as the Full Scan. It took 29 seconds for McAfee to quickly scan 38,846 files. No threats were detected. It’s handy that McAfee offers a Quick Scan option, unlike Bitdefender.

A Full Scan took much longer, in comparison. While software suites like Bitedefender and Malwarebytes scanned hundreds of thousands of files in under 26 minutes or so, McAfee took 34 minutes and 40 seconds to scan 351,968 files. It’s quite slow, really! I had enough time to do some stretches, make myself a cup of coffee, and have a chat with my coworkers, and McAfee was still scanning. But as I expected, it didn’t catch any anomalies or threats to the PC.

The aforementioned scans were conducted with no other heavy-duty apps running in the background, so to get a clearer picture of how McAfee impacts system resources, I ran in-game benchmark tests in Cyberpunk 2077 and Forza Horizon 5. As you can see from the table above, Cyberpunk 2077’s frame rate dipped from 99fps to 87fps, while Forza Horizon 5’s went from 113fps to 95fps. I didn’t notice any lag while gaming, which is great. It’s worth pointing out that I achieved 97fps in Cyberpunk 2077 and 123fps in Forza Horizon 5 with Bitdefender running a Full Scan, though. Still, McAfee’s impact on system performance isn’t that noticeable.

After finishing my in-game benchmarking, I ran a few internet speed tests at speedtest.net to see how McAfee impacted upload and download speeds. You can see the results in the table above. Surprisingly, neither the Quick Scan nor the Full Scan impacted the speeds by that much. Malwarebytes, in comparison, impacted upload speeds by a lot, as I was able to achieve only 592.4Mbps upload speeds with its Deep Scan running.

My testing goes to show that McAfee doesn’t have a detrimental effect on system resources — whether you’re browsing the internet or playing system-intensive games. Perhaps McAfee has finally gotten rid of the stereotype that it’s a drain on system resources.

McAfee+ Premium review: Features

Alongside the two different types of scans, McAfee includes a bunch of extras to protect you against online and offline threats. I tested a few of the goodies included in the McAfee+ Premium Individual plan, starting with Identity Monitoring.

This service constantly monitors the internet, including the dark web, for any identity theft, fraud or breaches. You can add credit cards, passports, national IDs, email addresses, and even different usernames. McAfee will then send you timely security alerts and provide guidance as to how to protect yourself. I put in a few different email addresses and usernames (such as the one I use on Instagram) and McAfee didn’t find any active breaches.

Next, I tried File Shredder, and it’s similar to the one you get with Malwarebytes. It enables you to permanently delete files to varying degrees, and it essentially overwrites data several times so there’s no trace left. Think of it like shredding a physical paper document to ensure no one else can read it. It worked well in my testing, as I used it to permanently delete files in the PC’s recycle bin.

There’s also a handy Tracker Remover tool which, as its name suggests, removes unwanted items, like temporary files and cookies that sites could potentially use to track you online. The Tracker Remover reviews temporary files, recycle bin items, browser cookies and trackers, and browser history, and then deletes them if they aren’t needed. In my testing, it took just under two minutes to free up 1.14 GB and remove 3,000 items.

Last but not least, I tried McAfee’s unlimited Secure VPN which is included in every subscription plan. It masks your IP address using bank-grade AES 256-bit encryption and connecting to servers located in almost 50 countries. The VPN takes less than a minute to connect to your chosen country and once that’s done, your online identity and location are protected. You can customize it to connect automatically when joining a network with weak security, for instance, and even add trusted networks where the VPN shouldn’t be activated.

McAfee+ Premium review: Interface

McAfee sports a clean and user-friendly interface, and I’ve had no issues using it whatsoever. The online dashboard, McAfee My Account, gives you quick access to your subscription details and it lets you edit billing and renewal details. The downloaded software is straightforward to use and understand, too, thanks to plenty of signposting and explanations.

But unlike Malwarebytes, the McAfee app’s window can’t be maximized or made full-size, which means you have to scroll through the various settings one by one. This isn’t uncommon, though, as neither Bitdefender’s nor Avast One’s windows can be made to take up the full screen.

The McAfee mobile app is just as user-friendly if not more. The initial download took just 130MB of space on my Google Pixel 10 Pro XL — though this will naturally grow with use.

I’ve seen many online users complaining about the uninstallation process on desktop. However, I didn’t experience any issues uninstalling McAfee from our testing rig. I wasn’t prompted again and again to keep the software, and it took just under 10 minutes to remove the software and restart my machine.

McAfee+ Premium review: Support

If you find yourself in a pickle or have any questions about McAfee and your subscription, you can get in touch with customer support either via online chat or over the phone. This is a similar level of support to what’s offered by Bitdefender and Norton 360.

I tested out the online chat function and I found it super easy to use. I asked the AI assistant a question and it answered promptly (and accurately). I then asked to speak to a human and within a couple of minutes, I was connected to a human agent. I like that I didn’t have to keep explaining why I needed to speak to a person.

If you need immediate assistance and can’t be bothered by typing, you can always ring McAfee’s customer service team which is available 24/7. It’s nice that McAfee offers phone support, unlike Malwarebytes. It makes getting help easier.

McAfee+ Premium review: Verdict

McAfee+ Premium is a strong all-round antivirus package that doesn’t skimp on features and tools that keep you safe online and offline. Protection is excellent, independent lab results are consistent (and impressive), and the software doesn’t get in the way when you’re gaming or browsing the internet. The user experience is sublime, too, as the software sports a clean, user-friendly interface.

There are a couple of catches, though, such as the Full Scan taking over 35 minutes to complete in our testing. While the cost for the first year isn’t much more than its competitors, renewal price can feel quite steep. Are either of those dealbreakers? Not necessarily, as they’re overshadowed by everything else on offer.

At the end of the day, McAfee delivers a polished, capable antivirus suite that goes toe-to-toe with the likes of Norton 360 and Bitdefender.

There was a time not too long ago when a 32GB smartphone felt perfectly workable — potentially even spacious. Fast forward to today and apps have gotten bigger, cameras have become larger, and routine software updates now eat entire gigabytes on their own.

32GB has gone from seeming totally normal (even luxurious) to looking absurdly stingy. I think 256GB laptops are heading in the same direction.

In 2026, plenty of otherwise excellent laptops start with 256GB of storage, despite many of the best smartphones offering the same amount. At first, 256GB might be enough, but after months or years of apps, photos, downloads, and updates, that breathing room is just... gone.

And when it does go, Windows 11 and macOS have a very convenient answer waiting in the wings: move more of your stuff into the cloud — and, sooner or later, start paying for it.

256GB isn’t tiny — and that’s exactly the problem

The funny part, if we can call it that, is that 256GB can feel perfectly comfortable for those who live inside a browser. But there's a difference between having enough storage and having enough room to grow.

We’ve previously said that 256GB is the bare minimum you should look for in a general-purpose laptop, and that increasingly feels spot on in 2026.

It’s definitely enough to get by, but it doesn’t leave you with a huge amount of headroom for the future. In a world where a single Spotify playlist with 1,000 songs can take up nearly 10GB of space, bigger is better.

You can actually see the shift happening elsewhere in the market: Apple’s latest MacBook Air now starts with 512GB, an upgrade we welcomed, while many budget laptops continue to stick with 256GB to keep their prices down.

There is, of course, some nuance to this picture. A cheap Chromebook or secondary laptop definitely doesn’t need a huge SSD, and with memory prices soaring, buying decisions are becoming harder than ever.

But for a laptop you expect to use as your main computer for the next five-plus years, 256GB looks less like a specification and more like a compromise.

Your laptop can last years, but its storage can’t grow with it

At a basic level, storage is one of the few parts of a laptop that can become more restrictive simply through normal use.

Photos, downloads, apps, offline media, assorted files, and everything else you acquire from day to day gradually pile up, while the SSD you bought on day one stays the same size. This situation is less of a problem if you can simply replace the SSD later.

Some Windows laptops, like the excellent Framework models, still make that relatively straightforward, but plenty of thin-and-light notebooks — including MacBooks — effectively lock you into whatever capacity you choose at checkout.

Conveniently, there’s a subscription for that

Running low on storage is less painful than it used to be, mainly because Windows and macOS are extremely good at pushing files to the cloud.

OneDrive’s Files On-Demand feature, for example, lets files remain visible in File Explorer without actually taking up space, while macOS can automatically move less frequently used files into iCloud when space starts running low.

There's no denying that these are genuinely useful features that save people a lot of hassle; having to actively choose what to delete is tough, and decision paralysis is real.

The problem comes when cloud storage starts compensating for your laptop's limited built-in storage.

Both OSes make that transition remarkably easy: You fill the SSD, move more into the cloud, and eventually find yourself paying for extra capacity. Almost without noticing, an understandable hardware compromise becomes yet another subscription.

Cloud storage also isn’t a like-for-like replacement for local storage. Apps, games, caches, and plenty of other files still need SSD space, while online-only files naturally depend on an internet connection.

AI is making the obvious solution harder

The obvious answer would be for 512GB to become the new baseline. Unfortunately, 2026 is turning out to be a pretty terrible year for that transition.

As you might have read, the RAMageddon is also putting pressure on the storage inside our laptops, as well as consoles, tablets, smartphones, and, well, pretty much every consumer device.

Data centres need vast amounts of memory and storage to keep AI services running, and that extra demand is making the components used in consumer SSDs more expensive too.

We’ve already seen how the wider memory crunch is affecting the laptop market, with manufacturers facing higher component costs and difficult decisions over where to make compromises. Even usually unflappable giants like Apple are raising prices across the board.

All of this makes sticking with 256GB easier to understand, even if it doesn’t make it any more appealing. The 256GB laptop isn’t obsolete yet. But, like the 32GB phone before it, its days as an acceptable default should be numbered.

More from Tom's Guide

• Claude is now watermarking every response — here's what that means if you use AI for writing
• I tested the HyperX Omen 15, and it almost made me forget my PS5
• I checked out the Pixel 11, Pixel 11 Pro, and Pixel 11 Pro XL — here’s the one I recommend

NordVPN is one of the best VPNs you can use instead of a free one, and for good reason. Founded in 2012, it’s fast become one of the most secure and speedy VPNs you can use in 2026. Available on all major operating systems, such as iOS, Windows, macOS, and Linux, it’s a straightforward process to sign up, install the app, sign in, and enable NordVPN on your devices.