A picture of my children at the beach, my son playing soccer or even my entire family, smiling in front of our house are all examples of photos I've posted to social media. I know I'm not alone, considering just how often I've seen similar images highlighting the goings-on of modern lives.

But AI has created a disturbing new risk that allows the use of ordinary photos of real children like the ones I mentioned above, to be manipulated into sexual abuse imagery without the child — or their parents — ever knowing.

To be clear, this is not a theoretical threat.

332 AI-generated child sexual abuse ads slipped through

A new investigation from the Tech Transparency Project (TTP) found hundreds of ads containing AI-generated child sexual abuse material (CSAM) running across Facebook and Instagram. Researchers identified four real children whose ordinary photos had been manipulated, according to WIRED, including two teenage influencers, a preteen whose image appeared on a stock-photo site and a young member of a European royal family.

In total, TTP found 332 ads containing AI-generated child sexual abuse material, or CSAM. Most depicted a child whose photograph had been manipulated using AI to make it appear they were performing a sexual act.

The findings are an alarming reminder of how generative AI has changed the risks around sharing photos of children online. Creating convincing fake imagery no longer requires an explicit photograph in the first place. An ordinary picture can provide the raw material.

How ordinary photos become AI-generated abuse

Generative AI image tools can take an existing photograph and modify parts of it while preserving recognizable features of the person in the original.

That's what researchers say happened to several of the children identified in the Meta ads.

According to WIRED, researchers were able to trace images of four minors back to their original sources. Two were teenage influencers with public social media accounts. Another was a preteen whose photograph was available through a stock-photo website. The fourth was a young member of a European royal family.

None of those original photographs needed to contain sexual material for them to be misused.

"AI apps are making it far too easy to create realistic criminal imagery of child sexual abuse, creating the new risk of everyday photos of children being taken and transformed into sexual content," Emma Hardy, director of communications at the Internet Watch Foundation, told WIRED.

Once an ordinary image is publicly accessible, someone can potentially download it and feed it into an AI tool designed to alter photographs.

Meta's AI didn't catch hundreds of the ads

The scale of the latest investigation also shows how difficult the resulting content can be to stop.

In August, TTP researchers initially uncovered 53 ads containing child sexual abuse material across Meta's platforms. Meta subsequently said many of those ads had appeared before the company introduced new AI technology intended to improve its ability to detect violating ads when they were uploaded.

However, researchers kept finding them. In fact, TTP says it ultimately identified 332 ads containing AI-generated CSAM, with hundreds appearing after Meta had announced its improved detection technology.

That is particularly significant because these weren't simply Facebook or Instagram posts that escaped moderation. They were paid advertisements.

Meta says ads are reviewed before they're allowed to run and that automated systems play a major role in that process.

Meta spokesperson Tracy Clayton told WIRED that the company does not tolerate nudify apps or child exploitation, whether the imagery involves real children or is generated by AI. Meta said bad actors deliberately attempt to evade its detection systems and that some of the videos were harder to detect because images of children appeared only briefly or were blurred.

The company said many of the ads researchers identified had already been removed, most received fewer than 200 impressions and it received less than $5,000 in payments from the ads. But researchers documented instances in which exposure increased after an ad was reported.

TTP says one ad involving a real teenager had reached four European accounts when it was reported to Meta. Several days later, when Meta removed it, the ad had reached more than 330.

The investigation shows the tools are mainstream

Researchers found ads directing people toward nearly 50 apps available through Apple's App Store and Google's Play Store. Around 300 of the roughly 350 ads examined in the broader investigation promoted AI image or video generators, according to WIRED.

Apple told WIRED that some developers initially submitted compliant versions of their apps before subsequently adding prohibited nudification capabilities. Apple said it removed 17 of 20 apps identified by researchers and took action against the remaining three, as well as seven additional apps WIRED identified.

Google said it removed all apps included in the report and suspended hundreds of other apps for violating its policies.

Still, these finding reveal a problem that extends beyond any single platform because AI can be used to create the imagery. An app store can distribute the tool used to make it. An advertising platform can then distribute ads promoting it.

Each layer may have its own safety systems, but abusive material only needs to slip through those systems once to reach users.

What to do if you find an AI-generated image of your child

If you discover sexualized AI imagery involving your child, don't repost or widely share the image in an attempt to warn others.

Instead, preserve information that can help identify where the material appeared, such as the account name, page address and other surrounding details, and report the content directly to the platform.

In the U.S., suspected child sexual exploitation can also be reported to the National Center for Missing & Exploited Children's CyberTipline.

Parents can also use NCMEC's Take It Down service, which is designed to help stop the online sharing of nude, partially nude or sexually explicit images or videos involving someone who was under 18. The system creates a digital fingerprint, or hash, from an image without requiring the image itself to be uploaded.

Since AI-generated imagery creates newer and more complicated scenarios, parents who aren't sure whether a manipulated image qualifies should still report what they've found rather than trying to determine that themselves.

The takeaway

Parents have been warned about "sharenting" and children's digital footprints for years. Sharenting is a term that combines "sharing" and "parenting" and is the practice of parents sharing images, videos and personal details about their children on social media.

Although parents can't entirely eliminate the risk of AI abuse on the images or videos they post, but reducing the number of publicly accessible photos of your children and being more selective about what you share, can reduce the amount of material available to people who might misuse it.

More from Tom's Guide

• ChatGPT-6 Astra is here — this one prompt shows what it can really do
• I asked ChatGPT, Gemini, Claude and Perplexity to rank the 10 jobs most likely to be replaced by AI — here's what they all agreed on
• Claude Fable 5.1 is here — this one prompt shows what it can really do

NordVPN's next-gen antivirus has achieved a 94% phishing detection rate in AV-Comparatives' latest anti-phishing test, ranking third among security products in the independent evaluation. The result our choice as the best VPN behind only Avast One Free Antivirus and Norton Antivirus Plus, both of which scored 96%.

The test, which ran from August 12–22, 2026, assessed phishing-page detection rates across 250 live phishing URLs, with an additional 250 legitimate URLs used to check for false positives. NordVPN recorded zero false alarms – a result that puts it ahead of Malwarebytes Premium and Webroot SecureAnywhere Internet Security Plus, both of which triggered false positives during the evaluation.

The findings come as NordVPN continues to reposition itself as an all-in-one digital security app. The company's recent rebrand saw Threat Protection Pro renamed as "next-generation antivirus," placing it alongside its VPN and Dark Web Monitor as one of three core pillars of the product.

How does NordVPN compare?

Finishing third among nine security products is a strong result, but the detail behind NordVPN's score is arguably just as telling as the number itself. Avast One Free Antivirus and Norton Antivirus Plus both edged it out with 96% detection rates, but the gap is narrow – a two-percentage-point difference across 250 live phishing URLs amounts to five URLs.

The rest of the field tells its own story. At the other end of the table, Dr. Web Security Space managed just 57% and K7 Total Security 70% – results that illustrate how inconsistent phishing protection remains across the security products market, even among established names.

NordVPN's advantage over the field is clearest on false positives. It was one of seven security products to record zero false alarms – and false positives erode confidence in a security tool just as surely as missed threats do.

"Phishing is a numbers game for attackers, and they're very good at it," said Domininkas Virbickas, product director at NordVPN. "Anybody might slip up eventually, and when you do click on something you shouldn't, that's where we step in."

A strong track record in independent testing

This is not the first time NordVPN's threat protection feature has performed well under independent scrutiny. In November 2024, AV-TEST – a German independent IT security research institute – previously rated Threat Protection Pro the best VPN tool for malware protection, achieving an 83.42% total detection rate across 3,209 tested links. That result placed it well ahead of the next-best VPN tested, IPVanish, which scored 46.96%.

NordVPN also has history with AV-Comparatives specifically. In June 2024, it became the first VPN provider to earn the organisation's anti-phishing protection badge – a significant distinction given that AV-Comparatives is best known for evaluating dedicated antivirus software, not VPNs. Earning the badge requires a minimum 85% detection rate with zero false alarms on legitimate sites, a bar not all established antivirus products have cleared. The August 2026 result, at 94%, clears it by some distance.

NordVPN's next-gen antivirus is available on Plus plans and above – the feature was previously known as Threat Protection Pro, and is included across Plus, Complete, and Prime tiers.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

In what has to be one of the biggest data breaches to date, a security researcher discovered a hacker who appeared to be selling access to a database of over 153 million driver's licenses from the United States and Canada, including IDs for Pete Hegseth, the current U.S. Defense Secretary (the Defense Department is reportedly aware and investigating).

The breach was spotted by security journalist Brian Krebs in a report claiming that the hacker created a site called Nexus and claimed to have access to digital scans of 153,347,439 identity cards.

"A quick look around Nexus finds they are likely not exaggerating about that 153 million number: Running a blank search in Nexus (with no search parameters entered) returns approximately 11.5 million pages of results, with roughly 15 results displayed per page," Krebs wrote.

In a forum post from a Russian cybercrime site, Nexus allegedly sourced the scans from "major identity verification company," suggesting that the hackers had or have basically real-time access to the company's systems.

How it happened

Krebs found his own driver's license was among the searchable records. He also found Hegseth, whose photo was listed on the site.

Krebs worked with security researcher Zach Edwards, whose ID was also in the breach, and identified the company IDScan as the potential source of the leak. The company, based out of Louisiana, is used by multiple companies to verify millions of IDs from around the globe.

"Based on all the details in the article and how Brian was literally able to dox me (and the timing of the screenshot of my license being added into the system aligning to my trip), all the signs point to IDscan having a hellacious ongoing real-time breach of their data. This is a massive vendor," Edwards wrote on Bluesky.

Investigations and concerns

Per Krebs, the FBI and IDScan are both investigating the breach. Tom's Guide reached out to both organizations but did not receive a reply in time for posting.

“At this point I’m not able to share any additional information, but the updates you have provided have been welcome and helpful to our team’s investigation,” an IDScan spokesperson told Krebs.

A commenter on Krebs story claims that his company received a data breach notification from IDscan:

"Earlier today, September 1, we received information suggesting that certain information may have been exposed and that IDScan.net may be implicated. We are working urgently to validate that information and determine whether any unauthorized access occurred, and the scope of such activity," the note reportedly reads.

It goes on to say that the company has taken steps to secure its system, notified partner companies, engaged legal counsel, and is conducting a third-party forensic investigation.

Nexus apparently went down shortly after Krebs' report went live. Though it's possible it could return under a different domain.

A data breach like this is terrifying at the best of times, but it happens to come at a time just as governments across the globe are attempting to roll out age-verification laws that require adults to upload or scan identity documents in order to prove they can access websites or apps — generally adult content. Privacy advocates and security researchers have already warned that the laws put people's data at risk.

How to stay safe

Edwards ID was likely scanned when he went to a cannabis dispensary that has a contract with IDScan. Krebs believes his was scanned when he rented a car from Hertz last year. He also found his mom's ID from around the same time.

There are plenty of places where your ID could get scanned, from car rental agencies to bars and even the TSA. In the meantime, I would suggest requesting that your ID not be scanned by companies that demand it during check out or check in.

While we don't know if the Nexus database will return, it would be good form to take these seven steps to stay safe after a data breach.

That includes signing up for one best identity theft protection services. As always, you'll want to be on high alert for phishing attacks and social engineering attacks, especially ones that urge you to "act now." Avoid clicking on any links, QR codes, or attachments from unknown senders.

Beyond that, you should consider a password overhaul by creating strong, complex passwords for all of your accounts but you can also use one of the best password managers to do so for you instead.

Even without a massive data breach, these are generally good practices just to keep your side of the street clean since companies are increasingly unable to do so.

More from Tom's Guide

• More than 9.5 million patient records affected by Aesto Health data breach: what you need to know
• We put the best identity theft protection to the test to protect your entire digital life — these are the services I recommend
• Have you been 'Flocked'? Here's how to look up automatic license plate readers in your area

Aesto Health recently disclosed a data breach affecting more than 9.5 million people. Aesto is a software company for healthcare organizations that produces solutions to help them organize patient data when replacing health records systems.

Spotted by Bleeping Computer, the company first posted a notice of the attack on June 24 via its website. However, the actual incursion took place over two weeks in December of 2025. It apparently wasn't discovered until May 26 of this year.

"After an extensive forensic investigation and manual document review, on May 26, 2026, we confirmed that between on or about December 2, 2025, and December 18, 2025, certain protected health information belonging to patients of various Covered Entity clients stored within Aesto’s network may have been accessed and/or acquired by an unauthorized actor," the notice reads.

Apparently, the breach involved unauthorized access via Aesto's Amazon Web Services infrastructure.

What was taken

In its report, Aesto Health confirmed that the breach affects 9,540,683 people. Unfortunately, that data included full names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, taxpayer ID numbers, Social Security numbers and other government identification numbers.

According to the HIPAA Journal, the breach spans 29 different organizations including Edwards County Medical Center, Marana Health, My Doctor, LLC, the Nebraska Orthopedic Center and Women's Health Associates.

The company started informing impacted individuals of the breach on August 21, providing details about the incident and providing identity theft protection and credit monitoring via Experian.

As noted by Bleeping Computer, this incident follows an unfortunate series of breaches that have affected health care companies including CareCloud, Nutex Health, iRhythm and McKesson. The breaches have ranged in size from a couple of hundred thousand to millions of records.

Per Aesto Health and our own review, no threat groups have publicly claimed the attack, unlike other recent ones claimed by the hacker group ShinyHunters.

How to stay safe after a data breach

Check out the full list of companies from the HIPAA Journal, and if you've used any health care organization, you might receive a data breach notification letter from Aesto. If you do, take advantage of the Experian coverage. Keep an eye on your mailbox since notification letters arrive the old-fashioned way.

Even if Aesto doesn't send you a notification letter, you may want to take advantage of one of the best identity theft protection services to protect your identity.

While no one has claimed the attachment, a bad actor could use your information to launch targeted phishing attacks. Phishing emails could contain malicious links or even malware.

Health companies appear especially vulnerable as the summer comes to a close, and every company should be taking this threat seriously. Hopefully, companies are bolstering their cybersecurity right now.

More from Tom's Guide

• We put the best identity theft protection to the test to protect your entire digital life — these are the services I recommend
• Have you been 'Flocked'? Here's how to look up automatic license plate readers in your area
• We've tested the best antivirus software and these are the 5 I recommend right now

From the start of the wireless networking era – even before it was called Wi-Fi – every new spec and generation of hardware was aimed at delivering faster speeds to do more things online at home. Not anymore, because Wi-Fi 8 (aka. 802.11bn) takes a different approach, putting an emphasis on range and reliability to be able to stay online longer with fewer interruptions.

While it seems like a step sideways with a top speed of 46 Gbps that’s equivalent to Wi-Fi 7, Wi-Fi 8 can do a lot to make home networking easier, more fulfilling and dependable. The new spec’s Ultra High Reliability (UHR) approach promotes better performance at long range, the ability to handle more data traffic and block interference. Spectral efficiency is the name of the game with Wi-Fi turning from squeezing more data into the air waves to making it easier to use and more reliable.

Buyer beware, as has been the case with every Wi-Fi generation, the router hardware precedes the general availability of client devices. At first, it can seem like a wireless tease, then, all of a sudden, there are new generation devices everywhere. In addition to the first Wi-Fi routers and mesh kits in the coming months, expect Wi-Fi 8, phones, computers and tablets in early-to-mid 2027. This will be followed by range extenders and USB upgrade kits late in the year.

Archer 8 Ultra and Deco 8 Ultra

I got a sneak peek at what will likely be the first commercial Wi-Fi 8 routers from TP-Link, the company’s Archer 8 Ultra high performance router and Deco 8 Ultra mesh set. They each have functional designs, sleek lines and can theoretically move 19- and 22 Gbps, respectively. Powered by either Qualcomm’s Fast Connect 8800 or Broadcom’s BCM6718 chips, this networking gear is top shelf and aimed at high-performance users with two 10 Gbps inputs and USB ports for connecting a storage device across a network.

The IEEE 802.11bn spec isn’t close to being finalized and I do expect changes before it’s formally approved sometime in 2028. That said, the lack of finality hasn’t stopped the world’s Wi-Fi chip manufacturers and router makers from developing products.

If the past is any indication, the new routers will need a firmware update or three to add late changing aspects of the final Wi-Fi 8 spec. Plus, many router makers plan to introduce new routers that hit the main features on introduction and add items to them throughout 2027. Unfortunately, none of the current generation of Wi-Fi 7 routers can be upgraded to Wi-Fi 8.

How the routers will act is coming into focus. The big change that Wi-Fi 8 brings is better use of the 2.4-, 5.0- and 6.0 GHz frequency bands on which the data rides. It goes beyond 4K Quadrature Amplitude Modulation (QAM) and Multi-Link Operations (MLO) with what TP-Link calls its Stability Engine that will debut with the company’s Wi-Fi 8 hardware.

This can seem like an alphabet soup of engineering acronyms that starts with Unequal Modulation (UEQM) to make sure that each device can get to its full speed regardless of whether lower-speed clients are nearby. The New Modulation and Coding Scheme (MCS) takes this a step further by blocking interference that can lower throughput. Together, the techniques can improve throughput by 24% versus Wi-Fi 7, according to early tests.

Antennas by the dozen

Meanwhile, the routers have internal antennas galore. While the Archer 8 Ultra has no fewer than 18 antennas, the Deco 8 Ultra has a 5 transmit, 5 receive antenna arrangement. This can amount to a 1 to 3 dB increase in signal strength that can translate into greater throughput and range.

That’s just the start because the new antennas can help prevent frustrating disconnect and reconnect cycles that rob throughput. TP-Link’s engineers are going a step further by looking into pushing its antennas to the limit by making its transmission pattern adjustable. The feature would bias it horizontally (for a ranch house) or vertically (for a multi-story building).

Meanwhile, Wi-Fi 8’s Distributed Resource Units (DRU) and Enhanced Long Range (ELR) combine to increase coverage so that the signal can enliven Wi-Fi dead zones with data. These techniques allow clients at the periphery to stay online despite a weak signal. If these changes pan out, my Wi-Fi experience could be vastly improved, from not losing my connection when listening to the BBC World Service on my Wi-Fi Internet radio deep in the basement to working out on the patio on a sunny day.

A premium next-gen upgrade

TP-Link’s Archer 8 Ultra is going on sale in Germany and in the UK in October, where regulators have given the company the green light. This will be followed by U.S. sales in early 2027.

Premium and high performance in all aspects, look for a sub-$1,000 price tag for the Archer 8 Ultra. Though this will almost certainly drop as the year progresses. TP-Link then plans to introduce Pro and base product lines with lower prices during 2027.

Think of Wi-Fi 8 as making the house of cards that wireless networking has become a little sturdier and more permanent so that a sneeze won’t make it all collapse. Just as I got used to Wi-Fi 7, it’s time to turn to Wi-Fi 8 but I can’t wait to get my hands on the two TP-Link networking devices as well as the products of other companies to try them out in my lab and home.

I must admit to a hidden hope that Wi-Fi 8 enhanced reliability is enough to replace many of the Ethernet cables that run through my house, creating a wireless backbone for my entire home network.

More from Tom's Guide

• I just saw Wi-Fi 8 in action, and it might be the first internet upgrade in years that actually makes sense
• These are the best Wi-Fi 7 routers to give your home upgrade a major upgrade right now
• I put aluminum foil behind my router to fix my Wi-Fi dead zones — and it actually worked

Meta has been in plenty of hot water as of late.

The company’s smart glasses have gotten a ton of ire as people have pointed to privacy concerns over users secretly filming random passersby and whoever else they please (there’s even a report about teenage boys using them to pester girls at middle and high schools).

Meta then found itself in the middle of a lawsuit that saw 29 states, co-led by California Attorney General Rob Bonta and the AGs from Colorado, New Jersey and Kentucky, allege that its social media platforms are addictive to children, mislead consumers about those young users’ safety on said platforms and inappropriately gather children's personal data.

That lawsuit has now met its end, as Meta has just agreed to pay a settlement of $17.1 billion — according to a statement made by California AG Rob Bonta. The state of California could receive between $1.5 billion and $2.1 billion if the court authorizes the settlement. As for New York, its attorney general announced that the state will get up to $1.15 billion and likely put it toward kids' education and social services meant to assist youngsters struggling with their social media addiction. Head to this link to see how much each state will receive from this monumental Meta settlement.

With this settlement in place comes a host of changes Meta has been ordered to make to Facebook and Instagram. Here’s what these changes could mean for parents with children who frequently use both platforms and how they could result in a positive outcome for them.

Less addictive and harmful social media spaces for kids of all ages

There’s a wealth of changes Meta must now make according to the measures detailed in the settlement, such as:

• A default daily time limit of two hours for users under 18 years of age that can only be lifted by a parent
• A default nighttime block between midnight and 06:00 for users under 18 years of age that can only be lifted by a parent
• Default blocks on notifications to users under 18 years of age from 22:00 to 07:00 and during the school day
• An enhanced mechanism for teenagers to report potentially harmful content and a requirement that Meta respond to 90% of those reports within six hours
• A ban on displaying numbers of likes or reactions to users under 18 years of age
• A ban on cosmetic procedure image filters for users under 18 years of age
• An option for users under 18 years of age to have a non-personalised feed
• A commitment to enhance parent supervision tools

That settlement also notes that Meta has agreed to the following terms and conditions:

• Institute robust age assurance measures to detect users under 18, as well as measures to identify and remove users under 13 years of age
• Use an independent auditor with expansive access to information and resources
• Be subject to an injunction prohibiting it from making "further false, misleading, or deceptive statements around its safety features"

In a statement that looks to reassure everyone that kids will be more protected across their social media platforms, Meta had this to say: “Ensuring teens have a safe and productive experience on our platforms is an absolute imperative for Meta. We want to get this right for parents and teens.”

With all these newly instituted measures in place, Facebook and Instagram could become far less of an addictive haven for children who want to do nothing but endless scrolling and discover content that could be extremely harmful to their mental well-being. Strict usage time limits, parents getting more control over the type of content their kids see, fewer distracting notifications popping up on kids’ screens and young users having less exposure to detrimental content could go a long way toward making Meta’s platforms more approachable for younger users.

While instituting a two-hour limit for kids using Facebook and Instagram is good, kids may still use that time to expose themselves to harmful content. With parents getting more control over their kids’ social media accounts, here’s hoping their stronger involvement will make children less susceptible to coming across said content.

Bottom line

Meta being forced to take responsibility for the harm its social media platforms have done to children is major. While this development doesn’t automatically make Facebook and Instagram 100% safe for kids from this point forward, it’s a good first step toward companies like Meta recognizing the ill effects their products have had on children.

More from Tom’s Guide

• Perplexity’s new local-first AI runs on your PC — and asks before using the cloud
• ChatGPT can learn your repetitive tasks by watching you — here are 7 prompts to try
• AI could transform healthcare for the better — but this doctor says there’s one thing it should never do

Privacy concerns around social media have escalated significantly in recent years, with users increasingly cautious about what they share online.

A new experiment by Compare the Market tested exactly how much information can actually be hidden when you set your Instagram to private. The results are sobering.

A licensed investigator was tasked with locating the home addresses of nine volunteers using only publicly available information.

Despite four of them having private Instagram profiles, the investigator identified the addresses of seven out of nine. The fastest was located in just 15 minutes, with the first lead found in 50 seconds.

What the investigation revealed

Colin Crowden, Intelligence Director at Global Protect and an Open-Source Intelligence expert, conducted the investigation. What he discovered challenges the assumption that private accounts provide adequate protection.

Beyond identifying addresses, the investigation uncovered four complete property plans revealing internal home layouts. In one particularly concerning finding, Crowden established that a volunteer was away on holiday, confirming their property was unoccupied.

The speed at which information was gathered highlights a critical vulnerability. Information shared by friends and family, location tags from previous posts, property details visible in photos, and data from other online sources all contribute to a broader picture.

Crowden explains the issue clearly: "Information that appears harmless in isolation can become much more revealing when viewed alongside other publicly available information. This isn't about any one post creating a security risk; it's about how different pieces of information can build up over time."

Why your private account isn't enough

The experiment demonstrates that privacy settings alone offer incomplete protection. Even if your Instagram is private, tagged photos from friends, public check-ins, or incidental details in backgrounds can expose your location and home information.

The investigation reveals that the combination of data sources, not any single post, creates the vulnerability. Compare the Market's home insurance expert Helen Phipps worked with Crowden to develop concrete recommendations for reducing your digital footprint.

Practical steps to protect yourself

Wait until you're home to post

If possible, wait until you're home before posting holiday photos rather than sharing in real time. This prevents anyone from knowing your property is unoccupied. If you do post while away, avoid revealing exactly where you are or how long you'll be away for.

Review your privacy settings before you travel

Check who can see your posts, stories, and tagged content. Consider setting your accounts to private and reviewing your followers so that holiday updates are only visible to people you trust. This step takes minutes but significantly limits exposure.

Coordinate with friends and family

Your friends and family can inadvertently expose you. Ask them not to share real-time updates if you're traveling together or post photos of your property if they're housesitting.

People often don't realize they're compromising your security by tagging you in posts or sharing location details.

Turn off automatic location tags

Disable geotagging in your social media settings entirely. On Instagram, this requires revoking access directly through your phone’s system settings under Privacy & Security (iOS) or Apps (Android) rather than within the app itself.

Location sharing can unintentionally reveal your whereabouts even when you're not posting in real time. This is one of the easiest settings to overlook but also one of the most revealing.

Audit your digital footprint

Search for yourself online periodically to see what personal details are publicly accessible, and remove anything that compromises your privacy. Pay special attention to old social media posts containing house numbers, street signs, car license plates, or identifiable landmarks.

If you want to take action right now, I have a step-by-step walkthrough covering 5 ways to start removing your personal information from the internet. You should also check out how to blur your home in Google Maps Street View.

Combine digital caution with home security

Beyond digital precautions, pair online caution with classic home security measures. Set light timers to create the appearance someone's home, test all locks, arm your alarm system, and ask a neighbor to collect post and manage bins so the house looks lived-in.

Ensure your home insurance policy covers the duration of your trip and review any conditions that apply while your property is unoccupied.

This investigation raises important questions about privacy in the digital age. Have you changed your social media habits? What's your biggest concern about your digital footprint? Share your thoughts in the comments below.

For a complete breakdown of Compare the Market's methodology and findings, read the full Online Safety Study here.

More from Tom's Guide

• Meta's new AI tool uses your Instagram photos by default — here’s how to opt out
• Inside the dark market stealing real identities online
• Instagram's 'instants' feature is driving users crazy. Here's how to disable it

Automated license plate readers (ALPR) manufactured by Flock Safety operate across tens of thousands of locations in nearly every U.S. state.

Mounted near intersections, neighborhood entrances, and main highways, these motion-activated systems capture high-resolution snapshots of passing traffic. The software logs license plate numbers, vehicle colors, make, and distinctive visual markers like roof racks or damage.

While law enforcement agencies cite the technology for helping solve active cases, privacy advocates raise concerns over continuous passive surveillance of everyday drivers.

Checking whether your daily commute passes through an active camera zone requires using public transparency tools, crowdsourced databases, and visual hardware checks. Here's where to start.

Curious if you are on the police's radar?

The independent transparency project Have I Been Flocked offers a rare, though limited, public window into automated surveillance by compiling official audit logs obtained through public records requests.

Where data is available, putting your license plate number into the site lets you check if participating law enforcement agencies have queried your specific vehicle.

Keep in mind that coverage is far from comprehensive. It cannot show a real-time feed, nor does it log every time your car passes a camera. Instead, it exposes the historical paper trail left behind only when an officer manually searches your plate within a jurisdiction that has released its audit logs.

The platform also overlays crowdsourced camera maps and regional policy trends, helping to highlight local data retention habits and how agencies share access across city lines.

You don't have to wait for an audit log

While lookup sites rely on public records, community-driven maps offer a clearer picture of physical hardware placements. Volunteer-driven projects like DeFlock map thousands of confirmed automated plate readers across interactive regional layouts.

Inputting your home or work address displays verified device markers, often including field-of-view indicators that reveal which direction a camera faces.

Meanwhile, privacy advocates and projects like FlockHopper use this crowdsourced data to highlight heavy surveillance corridors and potential alternative routes, utility varies widely.

Because these platforms rely strictly on volunteer submissions, map coverage depends entirely on how active the privacy community is in your specific area.

See what your town or city's cameras are doing

Many city governments and police departments pull back the digital curtain by hosting dedicated Flock Safety Transparency Portals on their municipal websites.

By searching your town or city's name alongside "Flock transparency portal," you can unlock a live public dashboard detailing the exact number of active cameras in your area, and the searches undertaken.

These dashboards reveal the core settings of your local surveillance net. They show exactly whether your police department activates real-time hot-list alerts for missing persons and wanted vehicles, or if they restrict the technology strictly to retroactive evidence gathering after a crime has occurred.

While not every town chooses to make their dashboard public, a quick search is the fastest way to see how your community balances public safety with digital privacy.

Spotting a Flock camera in the wild

While you can track placements via public records or crowdsourced maps, keeping your eyes on the road is the best way to spot unlisted or newly installed units.

Flock devices feature a distinct, minimalist design: a compact black rectangular box mounted roughly 8 to 12 feet high on light poles or dedicated metal posts. Each unit typically operates completely off-grid, equipped with a small, angled solar panel positioned directly above the main camera housing.

To spot them, look for lenses pointing sharply downward toward active traffic lanes rather than toward sidewalk pedestrian paths. They are built primarily to hunt for license plates and vehicle characteristics, not foot traffic.

What’s your take on Flock cameras? Do you view them as essential public safety tools or an overreach on driver privacy? Let us know in the comments below.

More from Tom's Guide

• Hidden cameras in hotels and Airbnbs are more common than you think — 5 ways to protect your privacy
• Is your personal information public? The simple step to securing your privacy online
• Your security cameras are in the wrong spots — here's how to fix it

When my grandfather would write me while I was away at school, he would end each letter with, "It's been fun to visit with you for a few minutes." That's the way I still feel about any correspondance -- it's a way to visit with someone regardless of how quick or meaningless.

And now that Claude can not only draft an email but send it, I feel like that's just another AI feature I simply don't need. However, I feel differently about everything surrounding that conversation.

There’s nothing personal about sorting newsletters, searching for a buried attachment or rereading a 20-message thread to work out what everyone decided. These are the jobs that could easily consume my day, and I’m more than happy to hand some of them to AI.

Features such as Google’s AI Inbox and AI Overviews in Gmail can identify priority messages, summarize conversations and answer questions about information scattered across multiple emails. I still write my own replies, but I spend much less time figuring out which ones I need to send.

Here are five ways AI can make your inbox easier to manage without writing a single email for you.

1. Show you what needs your attention

Most inboxes present every unread email as one more thing demanding your attention. A message from someone waiting on a decision can sit beside a sale announcement, an automated receipt and a newsletter you might read later.

Google’s AI Inbox is designed to separate those signals. It surfaces top priorities and groups together topics you may need to catch up on, giving you a more focused starting point than a long chronological list.

This is particularly helpful when I return to my inbox after being away from it. Instead of opening messages one by one to see what happened, I can begin with the conversations Gmail has identified as important.

AI won’t always understand your priorities perfectly, so keep that in mind. A routine-looking message may matter because of the person who sent it or something discussed outside email. I still scan the rest of my inbox, but I no longer have to treat every unread message as equally urgent.

2. Summarize a long email thread

Few things make me want to close Gmail faster than opening a thread with dozens of new replies.

Some messages repeat information from earlier in the conversation. Others branch into separate discussions, and the detail you need may be buried somewhere in the middle. By the time you reach the bottom, it’s easy to forget what prompted the exchange in the first place.

Gmail’s AI Overviews can summarize long conversations, pulling together the key points and recent replies. This gives me enough context to understand what the thread is about and where I should start reading.

I don’t rely on the summary when I need an exact quote, firm deadline or final decision. AI can miss a qualification or flatten a disagreement between two people into a cleaner consensus than the thread supports. For anything consequential, I go back to the original messages.

The summary still saves time because it directs me to the parts of the conversation that need closer attention.

3. Find an email when you can’t remember the keywords

This one is a life saver for me. With three kids, there is always a form or permission slip that I need to not miss. And while traditional search works when you know what you're searching for, sometimes all I have is a date or name. Unfortunately, that isn’t usually how I remember email.

I may remember that someone recommended an app or sent me a meeting date without recalling who said it. Sometimes I know an attachment arrived but have no idea what the file was called. That can lead to several rounds of searching with slightly different keywords.

AI search allows you to describe the information instead. In Gmail, you can ask a natural-language question, and Gemini can use relevant messages to generate an answer or surface the conversations containing it.

You might ask, “What date did we agree on for the interview?” or “Who sent me information about the new subscription?” The wording doesn’t have to match the original email.

As with summaries, I open the source message before using the information. The advantage is reaching it without having to remember how someone phrased the subject line three weeks ago.

4. Pull out action items and deadlines

An email doesn’t need to contain the words “action item” to give you something else to do.

A request may appear at the end of a long update. Someone might mention a deadline in passing or ask a question halfway through a message covering several unrelated subjects. Read it too quickly and the request disappears beneath everything that arrived afterward. That drives me crazy! However, AI can scan a conversation for outstanding questions, dates and tasks. You can ask Gemini which messages require a response, what you agreed to send or whether a thread contains an upcoming deadline.

This is one of the most useful ways to catch up after a busy stretch. I’d never treat that picture as a definitive to-do list. A missed deadline matters far more than a few saved minutes, so I check the original messages before adding anything to my calendar. AI acts as a second pass, catching details that could otherwise remain buried.

5. Bring related conversations together

One project rarely stays inside one neat email thread. The initial discussion may have one subject line, the scheduling conversation another and the follow-up a third. Add several participants and forwarded messages, and the information becomes scattered across your inbox.

AI can identify relationships between those conversations even when they don’t share the same wording. Instead of opening one thread and searching separately for the rest, you can ask for the latest information about a topic or project.

AI can work with the inbox I actually have, including the conversations I forgot to file correctly.

It still requires oversight. Two projects may have similar names, or the same person may email you about unrelated subjects. I check which messages informed an answer before assuming AI has assembled the right set.

Bottom line: I want AI handling the clutter, not the conversation

AI-generated replies will probably become harder to avoid as email providers place them directly beneath our messages. For some people, they remove the stress of writing and make communication faster. I understand the appeal.

They just aren’t the feature I need. Choosing my own words takes a little longer, but it preserves the reason for sending an email in the first place. The administrative work surrounding that exchange is where I’m happy to save time.

Do you use AI to save time with your inbox? Let me know in the comments.

More from Tom's Guide

• 5 Gemini features ChatGPT still can’t match
• Meta files patent for AI facial recognition glasses that identify people around you and record automatically
• 5 features that give Claude the edge over ChatGPT

Apple just dropped security updates for iOS 26.6.1, iPadOS 26.6.1 and macOS Tahoe 26.6.2 that fixe nearly 30 vulnerabilities according to a support document. The surprising thing about this update is that it's the third security release in as many weeks.

Earlier this month, The Financial Times reported that AI is surfacing bugs faster than Apple's normal update release schedule can handle.

Per Apple, this update includes fixes that were already added to the iOS 27 beta, iPadOS 27 beta and macOS Golden Gate betas that are currently running.

Close to 30 vulnerabilities

A majority of the vulnerabilities are related to WebKit and flaws that affected Safari. Simply accessing "maliciously crafted web content" could cause Safari to crash. These crashes came from memory handling issues, input validation, and processing states.

The other fixes include an audio vulnerability that could allow an app to leak sensitive information, an image flaw that could allow for random code execution, and a trio of kernel vulnerabilities.

For iOS specifically, Apple addressed a telephony bug that could allow a bad actor in a privileged network to bypass IPSec authentication and intercept your network traffic.

Interestingly, of the vulnerabilities outlined, 21 are WebKit-related, and nine are credited to OpenAI's Codex Security.

Stay safe and update

According to Apple, none of the vulnerabilities in today's listing are known to have been exploited in the wild yet. Still, you'll want to update to the latest version as soon as possible since bad actors could start targeting those flaws.

As such, we recommend you update to the newest versions as soon as possible, especially with all of these vulnerabilities being found so quickly.

For devices that can't run iOS 26 or iPad OS 26, Apple also released iOS 18.7.10 and iPadOS 18.7.10 so older devices can receive the same support and protection.

You can install the updates via the Settings app by tapping General and selecting Software Update.

More from Tom's Guide

• Apple iPhone 18 event — all the new products expected to launch in September
• 15 Apple deals students should snap up on Amazon — save on MacBook Air M5, AirPods, iPads and accessories
• iPhone Ultra leakers reveal new details around release and 'extremely limited' availability

A massive jury trial against Meta is beginning today that could change the face of social media forever with a potential financial death penalty of $1.4 trillion on the line.

When a tech giant is put on trial, the public is usually conditioned to expect a lengthy battle that ends in a quiet settlement, written off as just the cost of doing business. But this is entirely different.

That’s because after the lawsuit was filed by 30 U.S. states in 2023, including California and New York, governments are finally taking action in saying the “attention economy” is a public hazard for children.

It’s not just an accusation of bad content policy, it is a direct assault on how Meta and social media as a whole works. Beyond that eye-watering figure, the states are demanding fundamental changes to how Instagram and Facebook operate — including killing the like button and infinite scroll.

Should Meta lose, this would be a massive tectonic shift. I’ve sifted through the entire case document to break down the accusations, the demands, the evidence and what this will actually mean for you.

The hit list (what is actually changing)

I’ll go into the specifics of the case itself in a little bit, but outside of that gigantic price tag, what would actually vanish from Meta’s apps if the company loses?

• Death of infinite scroll & autoplay: The states are demanding an end to the endless feed and autoplaying of content. These features are explicitly designed to maximize screen time, and losing them breaks the TikTok-style doomscroll in a fundamental way.
• The end of the like button: Another key dopamine hit that keeps teens hooked to their screens is the like count. The lawsuit is targeting this too — demanding an end to social validation metrics.
• No more algorithmic manipulation: The states want to see change to Meta’s “dopamine-manipulating recommendation algorithms.” This could mean a return to your standard chronological timelines by default.
• Notification lockdown: No more frequent push notifications designed to pull young people back into apps. You’ll see these pop up to stop young people from disengaging with a social platform.
• Killing stories & filters: The states want an end to disappearing or “ephemeral” posts like Instagram Stories. On top of that, they’re demanding the removal of image filters that alter a user’s physical appearance in pictures.

However, there is one broader, scarier implication for everyone, not just teenagers.

The death of the “Finsta”

The lawsuit isn’t just about tweaking algorithms; it’s demanding structural changes to how accounts are created. The states are demanding strict parental verification for teenagers and limits on multiple account creation.

For teens, this effectively kills the “Finsta” — a fake or secondary Instagram account used to hide from parents or public scrutiny), and to enforce this, platforms will need to know exactly who is holding the phone. That would spell the end of casual online anonymity.

The smoking gun — could Meta lose this case?

Obviously, I’m not going to claim myself to be some expert legal mind here. But I’ve been a tech journalist for over 15 years and witnessed a bunch of lawsuits, and some of the data points, internal admissions and quotes in this document seem pretty eye-opening.

The COPPA Scandals:

For over seven years (until December 2019), Instagram had no age gate at all. When Meta finally added one, the drop-down menu defaulted automatically to a date making the user exactly 13 years old — effectively showing kids the exact date to bypass the restriction.

Internal research cited in the filing revealed that 40% of children aged 9 to 12 use Instagram daily, and 45% use Facebook daily. This leads to the accusation that Meta viewed children aged 10 to 12 as a “valuable but untapped audience” that dedicated internal teams analyzed to target.

The founding confession

Sean Parker himself said that the thought process behind building Facebook and Instagram was all about “how do we consume as much of your time and conscious attention as possible?”

He called it a “social-validation feedback loop” that exploits “a vulnerability in human psychology,” which its creators all understood “consciously.”

“I don’t want to hear it” about underage users

This is what Head of Instagram Adam Mosseri apparently said when he was confronted with evidence that child star JoJo Siwa had been active on Instagram since age 8.

On top of that, Meta’s former director of site integrity Arturo Bejar testified that Zuckerberg knew about “harms that teenagers are experiencing in its product,” but are “choosing not to engage about it.”

Meta’s own internal numbers

The company ran a “Teen Mental Health Deep Dive” private survey that found:

• 1 in 5 teens felt worse about themselves after using Instagram
• 24% reported feeling “not good enough because of the app”
• 67% felt forced to “create a perfect image online”
• Over half admitted to struggling with severe FOMO (Fear of Missing Out)
• 14% of young users admitted to having thoughts of wanting to “hurt [or] kill themselves”

Cynical product design and internal teams

The lawsuit pulls back the curtain on how Meta internally viewed user engagement — with the company reportedly operating an engineering group called the “Rabbithole team.” Their mission was clear: optimizing “preference amplification,” which is fancy wording for figuring out how to push users deeper down algorithmic rabbit holes.

Even when Meta rolled out “time management” tools like the Daily Limit to appease public critics, the lawsuit alleges they were designed to fail. Originally, the daily limit was 10 minutes, but once public scrutiny died down after the 2021 whistleblower leaks, Meta quietly raised that minimum to 30 minutes.

But perhaps most damning of all is that as early as 2017, Facebook’s own former VP for user growth publicly admitted he had banned his own children from using Facebook. Sometime after that, Meta simply disbanded its internal “Responsible Innovation” team.

Outlook: a corporate death penalty?

The federal trial officially kicks off today in Oakland, California, with California, Colorado, Kentucky and New Jersey leading the charge.

But this trial isn’t just about the money. Because this is a consumer protection lawsuit rather than a personal injury case, the states are asking the judge to order sweeping changes to the platforms.

If Meta loses, we aren’t just looking at a massive fine. We are looking at court-mandated age restrictions, the deletion of algorithmic feeds for minors, and the permanent removal of the infinite scroll.

Win or lose, the curtain has been pulled back. The “attention economy” as we know it is officially on trial.

More from Tom's Guide

• Meta files patent for AI facial recognition glasses that identify people around you and record automatically
• A parent’s guide to the MacBook Neo: is Apple’s cheapest laptop a back-to-school trap?
• I connected Claude to my daily apps — here are the 5 that actually made it useful

McAfee has been around for decades, and it has come a long way from the antivirus software I remember slowing down my PC as a teenager. Having tested McAfee+ Premium extensively, I can confirm that it’s one of the best antivirus software suites available today. It packs plenty of useful tools, such as Identity Monitoring, Secure VPN with no limits, File Shredder, and Tracker Remover.

The software sports a user-friendly interface that makes it a delight to use, and 24/7 customer support over chat and phone ensures all your problems are quickly resolved. Low impact on system resources is another highlight. Even though the Full Scan takes a while and renewal price makes your eye twitch, neither of those are dealbreakers.

For the complete breakdown, read my full McAfee+ Premium review.

McAfee+ Premium review: Specs

McAfee+ Premium review: Costs & what’s covered

Similar to other antivirus software suites, McAfee offers different plans for consumers and businesses alike. Let’s talk about McAfee’s consumer plans first. The most basic plan, Essential, covers up to five devices and is available for $39 / £33 for the first year.

The McAfee+ Premium Individual plan is a step up from Essential, and costs $49 / £49 for the first year. It naturally includes everything Essential offers, plus a Social Privacy Manager as well as scanning the web for your personal information. McAfee+ Advanced Individual is the most expensive plan, offering the most comprehensive protection. It’ll cost you $89 / £74 for the first year. Alongside everything else included in Essential and Premium, Advanced includes up to $1 million identity theft coverage, bank and credit card transaction monitoring, credit lock and security freeze, and more.

It’s important to note that after your first year is up, McAfee’s renewal prices go up by a lot. For instance, the Premium plan I tested costs $149 after the first year — a steep $100 price hike. Norton 360 Deluxe, in comparison, costs $124 per renewal, making it slightly cheaper than McAfee.

There are many family plans available, too, such as Premium Family ($69 starting price) and Ultimate Family ($249 starting price). If you own a business and want a competent antivirus software suite, a number of plans are available exclusively through Dell in the U.S. and Currys in the U.K., starting at just $24 / £11 and going all the way up to $169 — depending on the number of devices and features, of course.

It’s important to read the fine print to understand what you’re signing up for, but in case you aren’t happy with your purchase, McAfee offers a 30-day money-back guarantee. Also, if McAfee fails to catch a virus and your device gets infected, the company’s Virus Protection Pledge states that it’ll refund you the amount you paid for your subscription.

McAfee+ Premium review: Protection

The more you pay for your McAfee subscription, the more protection you’ll get. For instance, the Essential plan protects up to five devices from scams and monitors the dark web for any personal detail leaks. The Premium plan (that I tested), on the other hand, covers unlimited macOS, Windows, iOS and Android devices, and offers extra features like Social Privacy Manager, Personal Data Cleanup and Online Account Cleanup (scans only). I’ll discuss these in detail shortly.

Regardless of the subscription you sign up for, McAfee offers a secure VPN, password manager and identity monitoring across all. But it’s important to note that it doesn’t offer cloud backup or ransomware protection, which is surprising. Competitors, like Bitdefender, Avast One and Norton 360 offer these to a degree, so it’s worth considering them instead if these features are important to you.

Before diving into my experience with McAfee, let’s take a look at how three independent labs that test antivirus software twice a year (for the most part) rate it. AV Test’s June 2026 report rated McAfee as a “Top Product,” with 6/6 scores across Protection, Performance and Usability. Bitdefender, Avast and Norton 360 all received 100% scores, too, which goes to show that McAfee is just as good as its rivals, if not better.

AV Comparatives’ April 2026 test report rated McAfee 1st out of the 19 antivirus software suites it tested — which is outstanding, as McAfee upstaged Malwarebytes, Avast, Norton 360 and Bitdefender. McAfee scored 90/100 in AVC, 96.7/100 in Procyon, and 3.3 in Impact. The low Impact rating means that the software doesn’t have a negative impact on your system’s resources. It blows the likes of Malwarebytes (17.6 Impact score) out of the water.

Lastly, I looked at SE Labs’ (U.K.) June 2026 report, which awarded McAfee an AAA rating with 98% protection accuracy and an overall 99% score. McAfee is edged out by Norton 360 and Bitdefender — but only just — as both of them achieved a 100% protection accuracy score.

McAfee+ Premium review: Performance

Once you’ve bought your subscription, it’s time to download and install McAfee on your device and activate it. Doing so is extremely straightforward. Simply enter your product key, email address and billing information into McAfee’s dedicated activation page. You’ll then be prompted to download the software onto your machine. On our testing rig, it took just under five minutes to get up and running.

On Android and iOS smartphones, you’ll need to download the free app from the respective app store, and punch in your registered email address to activate your subscription on your phone. Doing so on my Google Pixel 10 Pro XL barely took any time — perhaps two minutes or so.

After installing McAfee and activating my Premium plan on our MSI testing rig, I ran a Quick Scan and a Full Scan, both of which are easily accessible from the app’s main page. As its name suggests, McAfee’s Quick Scan quickly scans your computer, and it isn’t as in-depth as the Full Scan. It took 29 seconds for McAfee to quickly scan 38,846 files. No threats were detected. It’s handy that McAfee offers a Quick Scan option, unlike Bitdefender.

A Full Scan took much longer, in comparison. While software suites like Bitedefender and Malwarebytes scanned hundreds of thousands of files in under 26 minutes or so, McAfee took 34 minutes and 40 seconds to scan 351,968 files. It’s quite slow, really! I had enough time to do some stretches, make myself a cup of coffee, and have a chat with my coworkers, and McAfee was still scanning. But as I expected, it didn’t catch any anomalies or threats to the PC.

The aforementioned scans were conducted with no other heavy-duty apps running in the background, so to get a clearer picture of how McAfee impacts system resources, I ran in-game benchmark tests in Cyberpunk 2077 and Forza Horizon 5. As you can see from the table above, Cyberpunk 2077’s frame rate dipped from 99fps to 87fps, while Forza Horizon 5’s went from 113fps to 95fps. I didn’t notice any lag while gaming, which is great. It’s worth pointing out that I achieved 97fps in Cyberpunk 2077 and 123fps in Forza Horizon 5 with Bitdefender running a Full Scan, though. Still, McAfee’s impact on system performance isn’t that noticeable.

After finishing my in-game benchmarking, I ran a few internet speed tests at speedtest.net to see how McAfee impacted upload and download speeds. You can see the results in the table above. Surprisingly, neither the Quick Scan nor the Full Scan impacted the speeds by that much. Malwarebytes, in comparison, impacted upload speeds by a lot, as I was able to achieve only 592.4Mbps upload speeds with its Deep Scan running.

My testing goes to show that McAfee doesn’t have a detrimental effect on system resources — whether you’re browsing the internet or playing system-intensive games. Perhaps McAfee has finally gotten rid of the stereotype that it’s a drain on system resources.

McAfee+ Premium review: Features

Alongside the two different types of scans, McAfee includes a bunch of extras to protect you against online and offline threats. I tested a few of the goodies included in the McAfee+ Premium Individual plan, starting with Identity Monitoring.

This service constantly monitors the internet, including the dark web, for any identity theft, fraud or breaches. You can add credit cards, passports, national IDs, email addresses, and even different usernames. McAfee will then send you timely security alerts and provide guidance as to how to protect yourself. I put in a few different email addresses and usernames (such as the one I use on Instagram) and McAfee didn’t find any active breaches.

Next, I tried File Shredder, and it’s similar to the one you get with Malwarebytes. It enables you to permanently delete files to varying degrees, and it essentially overwrites data several times so there’s no trace left. Think of it like shredding a physical paper document to ensure no one else can read it. It worked well in my testing, as I used it to permanently delete files in the PC’s recycle bin.

There’s also a handy Tracker Remover tool which, as its name suggests, removes unwanted items, like temporary files and cookies that sites could potentially use to track you online. The Tracker Remover reviews temporary files, recycle bin items, browser cookies and trackers, and browser history, and then deletes them if they aren’t needed. In my testing, it took just under two minutes to free up 1.14 GB and remove 3,000 items.

Last but not least, I tried McAfee’s unlimited Secure VPN which is included in every subscription plan. It masks your IP address using bank-grade AES 256-bit encryption and connecting to servers located in almost 50 countries. The VPN takes less than a minute to connect to your chosen country and once that’s done, your online identity and location are protected. You can customize it to connect automatically when joining a network with weak security, for instance, and even add trusted networks where the VPN shouldn’t be activated.

McAfee+ Premium review: Interface

McAfee sports a clean and user-friendly interface, and I’ve had no issues using it whatsoever. The online dashboard, McAfee My Account, gives you quick access to your subscription details and it lets you edit billing and renewal details. The downloaded software is straightforward to use and understand, too, thanks to plenty of signposting and explanations.

But unlike Malwarebytes, the McAfee app’s window can’t be maximized or made full-size, which means you have to scroll through the various settings one by one. This isn’t uncommon, though, as neither Bitdefender’s nor Avast One’s windows can be made to take up the full screen.

The McAfee mobile app is just as user-friendly if not more. The initial download took just 130MB of space on my Google Pixel 10 Pro XL — though this will naturally grow with use.

I’ve seen many online users complaining about the uninstallation process on desktop. However, I didn’t experience any issues uninstalling McAfee from our testing rig. I wasn’t prompted again and again to keep the software, and it took just under 10 minutes to remove the software and restart my machine.

McAfee+ Premium review: Support

If you find yourself in a pickle or have any questions about McAfee and your subscription, you can get in touch with customer support either via online chat or over the phone. This is a similar level of support to what’s offered by Bitdefender and Norton 360.

I tested out the online chat function and I found it super easy to use. I asked the AI assistant a question and it answered promptly (and accurately). I then asked to speak to a human and within a couple of minutes, I was connected to a human agent. I like that I didn’t have to keep explaining why I needed to speak to a person.

If you need immediate assistance and can’t be bothered by typing, you can always ring McAfee’s customer service team which is available 24/7. It’s nice that McAfee offers phone support, unlike Malwarebytes. It makes getting help easier.

McAfee+ Premium review: Verdict

McAfee+ Premium is a strong all-round antivirus package that doesn’t skimp on features and tools that keep you safe online and offline. Protection is excellent, independent lab results are consistent (and impressive), and the software doesn’t get in the way when you’re gaming or browsing the internet. The user experience is sublime, too, as the software sports a clean, user-friendly interface.

There are a couple of catches, though, such as the Full Scan taking over 35 minutes to complete in our testing. While the cost for the first year isn’t much more than its competitors, renewal price can feel quite steep. Are either of those dealbreakers? Not necessarily, as they’re overshadowed by everything else on offer.

At the end of the day, McAfee delivers a polished, capable antivirus suite that goes toe-to-toe with the likes of Norton 360 and Bitdefender.

There was a time not too long ago when a 32GB smartphone felt perfectly workable — potentially even spacious. Fast forward to today and apps have gotten bigger, cameras have become larger, and routine software updates now eat entire gigabytes on their own.

32GB has gone from seeming totally normal (even luxurious) to looking absurdly stingy. I think 256GB laptops are heading in the same direction.

In 2026, plenty of otherwise excellent laptops start with 256GB of storage, despite many of the best smartphones offering the same amount. At first, 256GB might be enough, but after months or years of apps, photos, downloads, and updates, that breathing room is just... gone.

And when it does go, Windows 11 and macOS have a very convenient answer waiting in the wings: move more of your stuff into the cloud — and, sooner or later, start paying for it.

256GB isn’t tiny — and that’s exactly the problem

The funny part, if we can call it that, is that 256GB can feel perfectly comfortable for those who live inside a browser. But there's a difference between having enough storage and having enough room to grow.

We’ve previously said that 256GB is the bare minimum you should look for in a general-purpose laptop, and that increasingly feels spot on in 2026.

It’s definitely enough to get by, but it doesn’t leave you with a huge amount of headroom for the future. In a world where a single Spotify playlist with 1,000 songs can take up nearly 10GB of space, bigger is better.

You can actually see the shift happening elsewhere in the market: Apple’s latest MacBook Air now starts with 512GB, an upgrade we welcomed, while many budget laptops continue to stick with 256GB to keep their prices down.

There is, of course, some nuance to this picture. A cheap Chromebook or secondary laptop definitely doesn’t need a huge SSD, and with memory prices soaring, buying decisions are becoming harder than ever.

But for a laptop you expect to use as your main computer for the next five-plus years, 256GB looks less like a specification and more like a compromise.

Your laptop can last years, but its storage can’t grow with it

At a basic level, storage is one of the few parts of a laptop that can become more restrictive simply through normal use.

Photos, downloads, apps, offline media, assorted files, and everything else you acquire from day to day gradually pile up, while the SSD you bought on day one stays the same size. This situation is less of a problem if you can simply replace the SSD later.

Some Windows laptops, like the excellent Framework models, still make that relatively straightforward, but plenty of thin-and-light notebooks — including MacBooks — effectively lock you into whatever capacity you choose at checkout.

Conveniently, there’s a subscription for that

Running low on storage is less painful than it used to be, mainly because Windows and macOS are extremely good at pushing files to the cloud.

OneDrive’s Files On-Demand feature, for example, lets files remain visible in File Explorer without actually taking up space, while macOS can automatically move less frequently used files into iCloud when space starts running low.

There's no denying that these are genuinely useful features that save people a lot of hassle; having to actively choose what to delete is tough, and decision paralysis is real.

The problem comes when cloud storage starts compensating for your laptop's limited built-in storage.

Both OSes make that transition remarkably easy: You fill the SSD, move more into the cloud, and eventually find yourself paying for extra capacity. Almost without noticing, an understandable hardware compromise becomes yet another subscription.

Cloud storage also isn’t a like-for-like replacement for local storage. Apps, games, caches, and plenty of other files still need SSD space, while online-only files naturally depend on an internet connection.

AI is making the obvious solution harder

The obvious answer would be for 512GB to become the new baseline. Unfortunately, 2026 is turning out to be a pretty terrible year for that transition.

As you might have read, the RAMageddon is also putting pressure on the storage inside our laptops, as well as consoles, tablets, smartphones, and, well, pretty much every consumer device.

Data centres need vast amounts of memory and storage to keep AI services running, and that extra demand is making the components used in consumer SSDs more expensive too.

We’ve already seen how the wider memory crunch is affecting the laptop market, with manufacturers facing higher component costs and difficult decisions over where to make compromises. Even usually unflappable giants like Apple are raising prices across the board.

All of this makes sticking with 256GB easier to understand, even if it doesn’t make it any more appealing. The 256GB laptop isn’t obsolete yet. But, like the 32GB phone before it, its days as an acceptable default should be numbered.

More from Tom's Guide

• Claude is now watermarking every response — here's what that means if you use AI for writing
• I tested the HyperX Omen 15, and it almost made me forget my PS5
• I checked out the Pixel 11, Pixel 11 Pro, and Pixel 11 Pro XL — here’s the one I recommend

NordVPN is one of the best VPNs you can use instead of a free one, and for good reason. Founded in 2012, it’s fast become one of the most secure and speedy VPNs you can use in 2026. Available on all major operating systems, such as iOS, Windows, macOS, and Linux, it’s a straightforward process to sign up, install the app, sign in, and enable NordVPN on your devices.

However, you may have previously been tempted to try out a free VPN. Whilst these can give your device a way of browsing streaming sites in another country, there’s a good chance your browsing data is at risk of being used by third-party companies. This is a big factor in funding these VPNs, and you may experience far slower speeds compared to using a paid VPN.

With this in mind, we’ve listed five reasons below why NordVPN is the far better choice than a free VPN, and we've also delved into details about how the company keeps its users’ data secure.

• NordVPN is one of the best value for money VPN packages you can buy, and is known to be one of the fastest available.
• NordVPN runs on servers with no hard drives, meaning data is never stored, and there’s low-power consumption and fast speeds, benefiting everyone.
• There have been six audits under the ISAE 3000 standard so far, showcasing NordVPN’s focus on privacy.
• There are three subscription tiers that have varying features to suit a single device or 10, depending on your needs; this flexible pricing gives you premium speed and security without the hidden data limits or privacy risks of free VPNs.

5 reasons to use NordVPN instead of a free alternative

NordVPN’s no-log policy has been independently audited six times

When you’re considering a paid VPN, privacy has to be at the top of what one offers. NordVPN’s no-log policy, which means that it doesn’t store your information, has been verified by auditors six times so far under the ISAE 3000 standard. This assures that no data, such as user traffic or metadata, is kept by NordVPN when enabled.

What does an ISAE 3000 audit actually prove?

An ISAE 3000 audit examines a company's systems and reports on its findings. It’s a big distinction from free VPNs, as they can be funded by sharing data collected by users. Many assume that these are private, but it’s usually far from the case.

NordVPN’s servers run without hard drives

Because every server in NordVPN’s network runs on RAM instead of hard drives, this means that any data stored is only temporary, as there’s no storage for hackers to steal. There are other benefits to using Nord’s services, such as high-speed and lower power consumption. This means that when you enable NordVPN, you’re less likely to experience lag compared to a free VPN that works on a server with hard drives installed.

Why is NordVPN faster than a free VPN?

This is because of NordVPN’s exclusive protocol, NordLynx. Built on the light WireGuard framework, NordLynx runs on only 4,000 lines of code, compared to legacy protocols like OpenVPN, which can bloat up to 400,000 lines.

Because it's made with far less code than others, it means that you get quick server connections, reduced battery drain on mobile devices, and fast, unthrottled speeds with almost no lag when streaming on top platforms, whereas that can be a common occurrence when using free VPNs.

In speed testing by Tom’s Guide, NordLynx reached local speeds averaging 1,249 Mbps (peaking at 1,284 Mbps), nearly doubling the speed of NordVPN's own OpenVPN implementation (688 Mbps) and being "fast enough for almost any conceivable use-case".

NordLynx is also available on all major devices, such as the best iPhones and Android handsets, so you’ll be able to experience fast speeds on the devices you use daily.

Connecting to a server and using the kill switch work without being asked

One of the biggest benefits of using a paid VPN is being protected without even realizing it. NordVPN auto-connect creates an encrypted connection once your device joins an insecure network without you doing anything.

In addition, the kill switch kicks in if your device fails to connect to a VPN, protecting it from your data being shared on an unsecure network. Free VPNs usually work on unprotected connections, which can expose your data at any moment.

One subscription covers the whole VPN experience

NordVPN offers three subscription tiers that can easily suit anyone who’s looking for a VPN to use, consisting of Basic, Complete, and Ultimate Max, which can cover up to 10 devices:

• Basic ($3.49 / £2.59 per month): NordVPN

• Complete ($4.49 / £3.39 per month): Email, phone, credit card, and national ID/SSN monitoring, scam call protection, ad & tracker blocker, and more

• Ultimate Max ($7.49 / £6.29 per month): Unique IP address to help improve security and avoid CAPTCHAs. For UK users, coverage for Scam and ID loss of up to £5,000.

These can all be a monthly, yearly, or two-year plan.

There’s also a helpful 24/7 support line included as standard - this can be used if you need some help or if you need to change your account info. Free VPNs don’t offer this, and if you’re managing ten devices, it’s good to have support when you need it.

NordVPN proves why it’s the best alternative to a free VPN

NordVPN is the best alternative to a free VPN. When you consider that the company has been publicly audited six times so far, as well as having its own protocol to ensure fast and secure connection speeds, the benefits outweigh the ability to use a free VPN. To find out more, visit the NordVPN website.

FAQs

Why is NordVPN considered one of the fastest VPNs?

This is due to several reasons, like NordLynx, an exclusive protocol that NordVPN runs on to ensure a fast and secure VPN connection. There’s also SmartPlay, which helps you securely watch movies and TV shows, as well as Meshnet, which can let you share files and more with other devices worldwide.

Is NordVPN a good long-term VPN subscription?

Absolutely. NordVPN is designed to offer more than just basic VPN protection, making it a strong choice if you’re looking for a service you can rely on long term. Its 2-year Ultimate Max plan includes a broad range of features, including NordLynx, designed to deliver fast, secure connections without making everyday browsing feel complicated. You also get tools such as a kill switch and threat protection features, giving you additional peace of mind when you’re online. For anyone who wants a VPN that’s easy to use, feature-rich and built for regular use across multiple devices, NordVPN is a compelling long-term option.

Why do people choose NordVPN over cheaper VPNs?

The appeal of NordVPN is often its balance of simplicity, security and features. Setting it up across your devices is straightforward, so you don’t need to be particularly tech-savvy to start using it. Once you’re connected, features such as the kill switch can help protect your connection if your VPN drops unexpectedly. NordVPN also offers its NordLynx protocol, which is designed to provide fast connections while maintaining strong security. While cheaper VPNs can offer basic privacy tools, NordVPN’s combination of ease of use, additional features and a polished experience can make it worth considering if you plan to use a VPN regularly.

This week two different Windows vulnerabilities were revealed that attack your PC from different angles. However, there is one unfortunate thread that connects them; both are capable of allowing a malicious actor to gain system privileges on your Windows device, and neither has been patched yet.

The flaws are a zero-day vulnerability that can circumnavigate a previous RoguePlanet and a new "Plug and Pwn" attack that emulates USB devices.

Read on to find out what each attack can do and how to potentially stay safe until they get patched.

Shieldbreak Zero-Day

The zero-day vulnerability was found by Nightmare Eclipse, a bug hunter who reportedly has major beef with Microsoft and no qualms sharing the latest vulnerabilities they've discovered before a patch has released.

The latest, dubbed ShieldBreak, can apparently get around the RoguePlanet patch and allows attackers to gain system privileges on patched Windows 10, Windows 11 and Windows Server system.

Per The Register, the exploit has been tested by other security researchers and confirmed.

ShieldBreak apparently uses a "user-mode callback hook" to change file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API)," according to security researcher Kevin Beaumont.

Basically, it uses Microsoft Defender, if enabled, when it runs a scan. Then the flaw can be exploited to gain System privileges. Another researcher, Will Dormann, says that Defender has to be active for the exploit to work.

How to stay safe from Shieldbreak

Until Microsoft patches this vulnerability, one way to stay safe is to disable Microsoft Defender.

If you think your system might be vulnerable, Kevin Beaumont did publish three detections that are supposed to be able to catch Shieldbreak in action. If you have the knowledge, you could try running them.

Plug and Pwn

The other flaw is a new "plug and pwn" disclosed by security researchers Alejandro Hernando and Borja Martinez (via Bleeping Computer) during the recent DEF CON 34 hacking conference. This vulnerability exploits how Windows identifies and automatically connects USB hardware, finds matching driver packages and then installs software as the Authority/System account.

Simply, the flaw emulates USB devices and can be used to force Windows to install vendor packages with exploitable components that can be used to gain system privileges on a Windows device.

Apparently, in some attacks, they didn't even require user interaction or physical USB hardware to gain access. This is enabled because Windows uses something called a co-installer, which automatically downloads and installs software and drivers when a new USB device is inserted in the computer.

This specific version is different from previous ones because it follows the Windows installation path and not something from a specific vendor. Notably, the remote attacks only seem to work on systems where USB redirection is enabled, which Alejandro Hernando said is common with virtual desktop environments.

Bleeping Computer gets far more granular if you're interested in how Hernando and Martinez discovered the flaw and the tools they used to instigate it.

How to stay safe from this USB attack

If you are concerned about this kind of attack and willing, you could enable a 'DisableCoInstallers' registry value. This prevents driver packages from utilizing co-installers during device installtion.

You can do this by searching for it in the Start menu or using the keyboard short cut of the Windows key +R. Then navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer Registry key. Then add DWORD-32 value named DisableCoInstallers and set it to 1.

It doesn't totally eliminate plug and pwn attacks, but it could break some of them.

"In anything sensitive I'd pair it with device installation restrictions or hardware-ID allow-lists, and turn off PnP device redirection on RDP and VDI hosts that don't need it (`fDisablePNPRedir`)," Hernando told BleepingComputer.

It's a good reminder either way to make sure you're only plugging in trusted devices to your system or downloading software from official sources when you can to ensure the safety of what you're putting into your computer.

More from Tom's Guide

• Windows 11 is broken — and Microsoft is fixing the wrong things
• Microsoft is still using ‘deceptive tactics and design’ to force you to use Edge
• Microsoft extends Windows 10 support for another year: what you need to know

If you tried to Google something recently and felt as if things looked a little different, it's not just your imagination.

Some users are seeing a redesigned Google homepage that removes the familiar Google Search button and replaces it with shortcuts for AI Mode, Create images, Ask about files and Brainstorm.

It’s only a test for now, but it’s hard to ignore what Google is putting in the Search button’s place. I've been writing about AI replacing the internet as we know it for the past several months.

For more than 25 years, Google’s homepage has barely changed. You type something into the search box, hit Google Search, and get a page of results. Now, Google appears to be experimenting with turning that same box into a chatbot window.

Google Search is starting to look a lot more like ChatGPT or Gemini

In the experimental layout, Google’s traditional search field is surrounded by tools that encourage you to do something other than type a keyword and look through links.

There’s AI Mode, which lets you ask longer questions and continue the conversation with follow-ups, you can ask about files or even create an image with Nano Banana. Interestingly, I’m Feeling Lucky is still there, but the old Google Search button is not.

Sure, you can still type a query, but the experience will be much different as Google is replacing classic search with AI Overviews and Summaries.

Google Search VP Robby Stein responded to people spotting the change and said the company isn't getting rid of traditional search.

"This is a small test on desktop to help people find new things they can do with Search. No impact to how the core search box works – just add your question and hit enter as usual," Stein said.

So, no, the Google Search button has not officially been killed off, but all signs seem to point that direction. If anything, the test still tells us quite a bit about where Google wants Search to go.

The end of Google Search as we know it

AI Mode has already pushed Google beyond the traditional search-results page by letting users ask complicated questions, follow up on answers and get information synthesized across multiple sources. Google has also been building more image, file and multimodal capabilities directly into Search.

Putting shortcuts to those tools on Google.com takes that strategy one step further. Google isn't just adding AI to Search anymore. It's experimenting with making AI the starting point.

We're being taught a new way to Google, which is ironic considering Google trained us how to search in the first place. But generative AI has changed everything, which is why Google's experimental homepage appears to be designed around the same behavior.

Keywords don't matter anymore, especially when you can search with an image or an uploaded file. The direction we are headed is a fundamentally different relationship with a search engine than we've ever seen.

Big consequences for the web

There is an obvious downside to all of this, particularly for websites that depend on Google traffic. The more Google answers a question inside its own interface, the less reason there is for someone to click through to another website.

That tension already exists with AI Overviews and AI Mode. A homepage that actively steers people toward AI responses rather than traditional search results could accelerate it.

It also puts Google into even more direct competition with ChatGPT and other AI assistants.

The Google homepage remains some of the most valuable real estate on the internet. If Google starts using it to promote image generation, document analysis, brainstorming and conversational AI, it is effectively turning google.com into a general-purpose AI interface.

And Google has one enormous advantage: billions of people already know exactly where to find it.

The takeaway

Google is very clear that removing the Search button is currently just a test, so I wouldn't declare the death of the Search button yet. But even if the Search button disappears tomorrow, the damage to the internet has already been done. The button was just a symbol at best.

The takeaway is what Google has decided is important enough to replace the Search button with: AI Mode. Image generation. File analysis. Brainstorming.

More from Tom's Guide

• I put ChatGPT on my Ray-Ban Meta glasses — and it completely changed how I used them
• ChatGPT can do more for you than ever — and I use these 5 prompts to take everyday tasks off my plate
• OpenAI’s head of ethics just quit — here’s why ChatGPT users should pay attention

If you thought Flock Safety’s massive network of pole-mounted cameras couldn’t reach any further, think again. The company reportedly planned to use dash cams installed in Uber and Lyft vehicles to significantly expand its footprint.

As reported by 404 Media, an internal Flock presentation sheds new light on a potential partnership with dash cam maker Nexar. While the deal never materialized, it paints a concerning picture of how Flock envisions expanding beyond stationary poles.

The proposed partnership would have allowed Flock to leverage hundreds of thousands of Nexar dash cams installed in rideshare and delivery vehicles, scanning and capturing license plate data from surrounding traffic. While 404 Media first revealed the potential deal last summer, new details have emerged from a presentation Flock used to pitch the concept to potential customers.

Obtained through a public records request by a Georgia resident and shared with 404 Media, the pitch deck reveals an ambitious push toward mobile tracking. Crucially, the documents leave it unclear whether Uber or Lyft drivers would have even been informed that their dash cams were feeding data into a surveillance network.

Had the deal gone through, Flock’s coverage would have exploded — adding an estimated "350k Uber/Lyft and other delivery service devices" to its grid.

From fixed poles to mobile surveillance

Flock Safety’s pole-mounted automated license plate readers (ALPRs) have drawn widespread privacy concerns, and for good reason. Engineered to log the license plate, color, make, and model of every passing car, these devices now operate in nearly every U.S. state.

When Flock founder Garrett Langley launched the company in 2017 to combat property crime in his Atlanta neighborhood, the scope was localized. However, the system evolved into FlockOS, an interconnected nationwide network that allows law enforcement to trace a vehicle's movements across state lines.

What began as a neighborhood safety initiative has morphed into a mass surveillance apparatus ripe for abuse. Numerous law enforcement officers throughout the country have been suspended or fired for using the Flock network to track vehicles without a legitimate reason — in some cases, to spy on former spouses and partners.

Public backlash against Flock’s rapid expansion is mounting. Organizers have built tools like DeFlock to map camera locations, while others have taken a more direct approach by cutting down the poles and physically dismantling the hardware.

If that physical pushback continues, Flock may well double down on the strategy outlined in its Nexar pitch. By shifting from static poles to roving, unmapped mobile sensors, the company could expand its reach while insulating its hardware from public interference.

Have you seen Flock cameras pop up in your neighborhood? Or have you been wrongly served a ticket as a result of its license plate-reading tech? Let me know in the comments below.

More from Tom's Guide

• How to remove your home address from the internet — 6 ways to protect your privacy
• Privacy apathy is real – and you probably have it
• "Blatantly unlawful and horrifically intrusive" data collection is everywhere – how to fight back

Did you buy a cheap GPS tracker for your kid? There’s a good chance that you’re not the only one who’s watching your kid.

Last week, a story in Wired revealed that security researchers were able to hack into a platform used by dozens, if not hundreds, of GPS kids watches, which allowed them to not only track a child’s location, but also remotely control a camera on the watch, and leaving them vulnerable to changing things like the emergency contact, or being able to silently eavesdrop on the child.

The researchers’ findings, which they presented at the Black Hat cybersecurity conference, looked at more than 70 GPS watches and car accessories, and found a sizable number used the same backend software and servers.

“The two researchers found that tens of millions of GPS tracker gadgets came from just three supply chains,” the Wired article reads. “All three, the researchers found in their analysis, had significant security flaws.”

If you go on Amazon and search for “GPS tracker for kids,” you’ll be presented with page after page of watches, dongles and chips, all for less than $50, purporting to make it easy to keep tabs on your kid.

Some even have screens and video calling — that seems like a real bargain compared to the best smartwatches, like the $249 Apple Watch SE 3, which cost a lot more. And, there’s a good chance that they have a lot of positive reviews, too.

Click through to the product listing for that cheap watch, and you’ll most likely see that the company’s name — one you’ve probably never heard of — is a seemingly random group of letters.

Don’t buy it.

It’s not just limited to GPS trackers. There are thousands of cheap security cameras, video doorbells, and baby monitors produced by no-name companies that are equally vulnerable to being hacked. A Consumer Reports study two years ago revealed that they could easily hack into several video doorbells, all of which were sold by different companies, but had the same underlying technology.

Earlier this year, The Verge wrote about a company that made the tech behind millions of baby monitors whose security was so lax that a hacker was able to see into people’s homes and even view images saved on the company’s servers.

Even some of the best security cameras aren’t immune to this — Wyze, for example, has suffered several security breaches over the years — but at least they, and other larger companies, have better systems in place for you (or security experts) to report any issues and to fix the problem in a timely manner.

With all that in mind, I’ve put together a list of a few dos and don’ts when shopping for any kind of device that can track your kid or take photos or videos of them or your house.

DO:

• Make sure your home Wi-Fi network is secured with a strong password and is always updated with the latest firmware
• Look for reviews of products on reputable sites

Don't:

• Rely solely on reviews posted on Amazon, Walmart, or other retail sites
• Buy a product that’s not from a brand you’ve never heard of

While these rules can’t completely insulate you from any sort of hacking, they can go a long way into making it harder for someone to break into your devices and see what they shouldn’t.

If you need to keep tabs on your kid, devices like the $29 Apple AirTag, the $149 Fitbit Ace, and the $149 Garmin Bounce are a little more expensive, but they’re made by companies with established reputations. What’s worth more: saving a few bucks, or the security of knowing some weirdo can’t spy on your kid?

More from The Gadget Dad

• I gave my 7-year-old the viral Tin Can phone because all her friends had it — here's the verdict after a month
• Don’t get burned: I talked to an expert on how to safely buy, charge, and store batteries for e-bikes and electric scooters
• It's friggin' hot! The 5 devices I'm using to keep my home (and my pets) cool this summer

You're going to want to update your Mac to address a serious Screen Sharing vulnerability that could letter a malicious actor initiate screen sharing without authentic credentials.

This week Apple released macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1 with release notes. Notably, all three releases claim that Apple made "important security fixes" and recommended the updates for everyone.

"Impact: An attacker on the network may be able to authenticate to Screen Sharing without valid credentials

Description: An authentication issue was addressed with improved state management."

That message is the same across all three versions of macOS.

It doesn't appear that the bug has been exploited in the wild, but if you haven't updated your Mac recently, now is the time to do so. Based on Apple's description, it appears that a bad actor could bypass Screen Sharing authentication checks, which would give them remote access to your computer.

Potentially, this would allow them to view the screen, open apps or files or perform other actions on the computer.

You may not use screen sharing, but it's still a good idea to install this update. Apple clearly deemed the flaw serious enough to patch three different versions of macOS before the next round of major OS updates.

Keep your Mac safe

To keep your Mac safe you may want to ensure that updates are automatically applied. Understandably if you're cautious about updates before they're settled you may wait. So you'll want to track updates and make sure you get the security-focused ones to protect your computer.

For screen sharing specifically, this vulnerability may have been able to sneak around you. But if you do any screen sharing, make sure it's with a trusted partner that you know to protect your computer. Additionally, keep any sensitive information closed before passing permissions just as a way to introduce a little bit of a block.

At the end of your session, double-check that screen sharing is turned off.

Beyond that, Apple does have Gatekeeper built-in which can block or warn you before you install unverified apps from the web. Still, you might want to consider using one of the best Mac antivirus software along side Apple's built-in ones.

Again, these macOS updates are available right now, so make sure you've installed them.

More from Tom's Guide

• How to disable iOS 27’s annoying auto-subtitles for good
• iPhone Ultra rumors: Everything you need to know about the foldable iPhone
• I asked Siri AI and Gemini a series of increasingly bizarre questions to see how they responded —here's what happened

Are you looking for your next NBN plan? Let me help you!

By way of introduction, I'm Tom's Guide's resident broadband expert, and every month I collate and analyse NBN plans from over 30 providers to find the best NBN deals. IHMO, there's a lot to consider when shopping for a suitable NBN plan, but one common factor that gets overlooked is speed.

The conversation around what NBN speed tier you have at home can be a difficult one to navigate. Finding a suitable plan means being realistic about what speeds you'll actually use, over what you’d ideally like to pay. You may find you have too many internet-connected devices (or humans) living in your household and your current plan isn't cutting it, or conversely, you may be overpaying for a fast plan that you actually don’t need.

Regardless of where your household fits in the NBN speed pie chart, there's no denying that Aussies have been embracing faster and faster internet speeds over the last few years. As per the ACCC's data, there are now over 3 million active connections for plans offering 100Mbps download speeds and faster. That number has actually quadrupled in the past 14 months, largely due to NBN Co's wholesale speed boost in September 2025.

Those speed upgrades came in the form of three new speed tiers — NBN 500, NBN 750 and NBN 2000 — which have helped turbocharge Australia's average internet download speeds to 162.34Mbps. A big contributor to that increase was the fact that two of the new tiers, NBN 500 and NBN 750, were wholesale increases to the existing NBN 100 and NBN 250 tiers. What that means is that customers on full-fibre connections at home — either FTTP or HFC — should have been automatically migrated to these faster speeds for free by their NBN provider. And in most cases, these new tiers cost the same (or only fractionally more) than the slower counterparts they’ve replaced.

If you’re currently shopping around for a new NBN provider or plan and your home has a fibre connection, in my opinion the sweet spot when comparing plan value is NBN 500, which, as the name suggests, offers maximum speeds of 500Mbps — a massive speed boost over the next tier down (NBN 50), and more than enough bandwidth for most Aussie homes.

Not only does it provide 10x faster speeds than NBN 50, on average it costs just AU$6.74 more per month and equates to just AU$0.20 per megabit. (Comparatively, while the cost per megabit does continue to decrease as you move up to faster tiers; the drop between NBN 50 and NBN 500 is the biggest one — and for most Aussie homes, the extra cost of NBN 750, 1000 or 2000 is hard to justify when it comes to practical benefits).

500Mbps is more than enough bandwidth to accommodate multiple users and devices at the same time with few interruptions, even for homes with moderately demanding internet use. It’s enough speed to allow for 4K streaming on multiple screens, online gaming and large game downloads, and conducting video calls when working from home — all simultaneously. Having that extra wiggle room means that even with numerous people doing data-intensive activities shouldn't noticeably impact regular everyday use, like social media, web browsing, or streaming YouTube.

If your household includes devoted gamers, opting for an NBN 500 plan can be especially transformative, ensuring that downloading new games or large patches completes significantly faster than on slower speeds. I've put together the table below based on three popular online games with varying download sizes so you can see how radically NBN 500 changes things.

As you can see, while NBN 500 might fall in the middle of this range, it can be the difference between minutes and hours when downloading larger titles. I think that all those practical improvements and minimal cost increase over slower plans add up to make NBN 500 the undeniable sweet spot when it comes to Australian internet in 2026.

If you’re considering switching, I've found three of the best NBN 500 plans available right now below.

Best NBN 500 deals right now

Storing everything in the cloud and streaming movies online is certainly convenient, but subscription costs just keep climbing. That’s why a lot of us — myself included — are ditching the monthly fees in favor of local storage and physical media backed up on a home NAS. However, when you take your data into your own hands there’s a real catch: one sudden power loss can wipe out everything before you even know what happened.

I’ve always been interested in Network Attached Storage (NAS), but it wasn’t until last year that I finally added one to my home network. Being able to access my files from anywhere — just like I did through the cloud, but without a monthly subscription — has been a real game changer for my workflow. Likewise, instead of bouncing between streaming services, I can watch all my favorite movies right from my home network.

Overall, this whole setup has worked out so well that even the rest of my family now knows how to access the NAS and stream content right from the TV. There’s just one problem: local grid work means constant power outages, forcing me to manually boot the NAS back up. At home, this is a minor inconvenience, but over time, it’s become a real hassle — especially when the power goes out at least once a week.

Power outages don’t just interrupt movie night, either. With every sudden drop, I worry about corrupted data — or worse, a full mechanical failure on the drives inside. For this reason, I decided to pair an Uninterruptible Power Supply (UPS) with my NAS. While these backup batteries can be expensive, if you have a Ugreen NAS like I do, you’re in luck as the company now makes an affordable one that’s a cinch to set up.

Power bank-sized peace of mind

After looking into getting a UPS a few years back and seeing them on sale at Costco more recently, I was completely surprised by just how small Ugreen’s US3000 one is. At 5.7 x 5.3 x 1.7 inches, it’s more of a mini UPS that’s not much larger than one of the best power banks. This makes sense though — the US3000 is designed to power a single device as opposed to your whole desk setup in case of an outage.

In the box, you get the device itself, a vertical stand, and a USB-C to USB-A cable — but more on that later. Despite its small size, the US3000 packs a 12,000 mAh battery and can power a four-bay Ugreen NAS like the DH4300 Plus I’m using in my living room or the more powerful DXP4800 for about 8–10 minutes.

You won't be streaming movies or running large backup jobs off its battery during a prolonged blackout. Instead, the US3000 acts as a bridge — giving you enough time to gracefully power down your system, or to safely ride out split-second power dips where the lights flicker and instantly come back on.

The US3000 is a surprisingly simple device too, with only a single USB-C port, a barrel-shaped power port, and a hardwired power-out port. If you prefer completely silent operation, there’s also a small pinhole that — instead of resetting the device — mutes the internal alarm that beeps whenever you switch to battery power.

One thing I have to give Ugreen credit for is the fact that the US3000 doesn’t come with a separate power adapter. Instead, you take the power adapter from your NAS, plug it into this UPS, and then plug that hardwired cable into your NAS. Personally, this made setup a whole lot easier since I didn’t have to redo my NAS’ cable management to add a backup battery to it.

Plug and play protection

Just like I mentioned above, getting the US3000 set up and connected to my NAS was an absolute breeze. I safely powered down my NAS, plugged its power adapter into the back of the US3000, and then inserted that hardwired cable into the back of my NAS. In fact, I was so eager to get this mini UPS set up that I initially forgot the most important part.

Sure, the US3000 will serve as a basic battery backup this way, but you’re missing out on its best features. Remember that USB-C to USB-A cable in the box? When you connect the US3000 directly to your NAS with it, the two can actually talk to each other. Without that data link, your NAS has no idea the power is out — it will simply drain the battery to zero and crash anyway during a long outage. Plugging in the cable is what unlocks intelligent features like automatic status detection and safe system standbys.

After realizing the error of my ways, I connected the two devices via USB and powered my NAS back on. From there, I pulled up the Ugreen desktop app on my computer — though I could have also done so from my phone or tablet — and opened the Control Panel within UGOS. I navigated to Hardware & Power, clicked the UPS tab, and the US3000 was instantly recognized.

Hitting the Connect button gives you access to a quick suite of tailored options. For instance, you can choose between Standby mode and Auto Shutdown. Standby mode unmounts your storage volumes and halts read-write activity to protect your drive pool from corruption while keeping the CPU powered at minimal draw — allowing the NAS to resume instantly once your power returns. Auto Shutdown, on the other hand, fully powers off the hardware, which is ideal for prolonged blackouts but requires a full boot later on.

Just like with the rest of UGOS, there’s plenty to tinker with. However, everything is presented clearly enough that even NAS newbies can get the US3000 configured to their exact liking in under a minute.

Physical insurance for your NAS

Although Ugreen’s NAS devices have made Network Attached Storage more accessible for the average user, they became widely available during one of the worst possible times: RAMaggedon.

Just a few years ago, buying several 3.5-inch or even 2.5-inch hard drives with a lot of capacity wouldn’t have set you back all that much. Now though, thanks to the current AI-fueled memory and storage crisis, outfitting your NAS with terabytes of storage space isn’t nearly as cost-effective as it used to be.

Whether you’re ditching cloud storage or streaming services, adding a NAS to your home network and outfitting it with the necessary storage is certainly an investment. Adding a US3000 mini UPS between your Ugreen NAS and the nearest power outlet does add to that initial investment too, but at $129, I’d say it’s well worth it.

You never know when a power outage, blackout, or in my case, power dips can strike. Best-case scenario, you just have to reboot your NAS, but worst-case scenario, you suddenly find yourself dealing with data loss and hardware failure. Storing your files securely at home is one of the main reasons to get a NAS in the first place, but with a strong enough surge, you might end up losing them and having to replace multiple hard drives. That’s why investing in the US3000 or even a larger, more powerful UPS is an absolute must.

For me, I can rest easy knowing that my files are safe when the lights flicker and that I won’t have to manually reboot my NAS just so my family can watch a movie when they come back on.

More from Tom's Guide

• I thought my first NAS was enough, but then I touched the future
• Ugreen DXP2800 GT vs DXP4800 GT: How much NAS do you really need when replacing your costly cloud storage?
• I built a hidden network hub to declutter my home office but it can do so much more

You can watch this article as a video on The Privacy Lab's YouTube channel.

Five billion dollars. That's how much Google agreed to pay after being caught tracking millions of users who thought they were browsing privately with Incognito mode. During the lawsuit, quotes from Google’s own employees emerged, calling Incognito "effectively a lie" and a "confusing mess."

Even Google's Chief Marketing Officer warned the CEO that they had to use "fuzzy, hedging language" because, in her own words, "it's not truly private."

I think Incognito mode is one of the most successful illusions in tech history. So, I'm going to strip it back to look at what Google Chrome actually does to protect your data, what Incognito mode completely fails to do, and the steps you can take to stay genuinely safe online.

Credit where it's due

It's important to be fair to Google here, even though it might feel a bit wrong: Chrome is actually a fairly secure web browser when it comes to keeping you safe from hackers and malware.

Importantly, it makes sure you use HTTPS, which encrypts the data that passes between your device and the websites you visit. This means that even if you connect to a dodgy Wi-Fi hotspot and someone is monitoring the connection, they can't steal your passwords or read your traffic. Plus, it warns you if you click on unencrypted HTTP links. Because Chrome and most other modern browsers do this, the classic "man in the middle" attack is very rare nowadays.

Chrome also features Secure DNS, as well as tab sandboxing. The latter isolates every browser tab so a malicious site can't jump to another and steal data. But the problem isn't Chrome's security. The problem is what happens when you click on Incognito.

What Incognito mode is good for

Incognito mode is not built for network stealth – it just keeps your browser tidy. When you open an Incognito tab, your browser stops recording some data. It doesn't save your activity in history, doesn't save auto-fills, and blocks third-party cookies

For example, if you're shopping for a birthday present or visiting… certain sites you'd rather not have saved in your history, Incognito mode works perfectly. It stops someone else who uses the same device from seeing what sites you've visited. However, this is exactly where its power ends.

Where Incognito fails

Everything falls apart the moment your data leaves your device – Incognito mode does nothing to hide your identity from the outside world. Your internet provider can still log the domain names you connect to, and if you're browsing on a work or school network, they can see every single site you visit.

Most worryingly, the websites you visit can still track you. They can record your real IP address, and if they use something like Google Analytics, they can instantly tie your "private" session to your existing digital profile.

In fact, following that massive lawsuit I mentioned earlier, Google had to change the official warning page in Chrome to explicitly admit this. It now reads: "This won't change how data is collected by websites you visit and the services they use, including Google."

Essentially, they had to confess on-screen that the data collection doesn't stop.

Is Incognito mode still worth using?

Whether you should use Incognito boils down to what you expect from it. If you care about what other people using your device can see, it's perfect. It's also great for logging into different email accounts, getting around article limits on news sites, or stopping your YouTube algorithm from being ruined because you wanted to watch one weird video.

However, Incognito does not give you any kind of meaningful digital privacy. For any entity that has control over your connection – notably your ISP, school, or workplace – there's no difference at all between using Incognito and rawdogging it with a logged-in Chrome tab.

It's the same story for the sites you visit. Your IP and any device identifiers are still available to see, so it's very easy to link this activity with anything else you've done online. At the end of the day, Incognito only hides your tracks from the person sitting next to you – not the rest of the world.

For genuine privacy, I recommend using tools that actually secure your connection. Use one of the best VPNs to hide your activity from your ISP and change your IP address, and consider switching to a browser like Brave or Firefox that blocks tracking by default. Ad and tracker blockers are also good – there are plenty available for free – and finally, keep everything updated, including Chrome. New releases address the most recent issues, so it's good to stay on top of this.

In short, it's certainly not in Google's best interest to provide you with a tool that strips away the possibility of data collection. There are still eyes behind the famous fedora and sunglasses – and they're always watching.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Satellite-based internet is nothing new, but the idea of getting satellite internet on your phone is something that has eluded us for a while. A number of smartphones now offer satellite connectivity of some kind, but that's mostly reserved for emergency situations, but the real question is, when will we be able to ditch cellular service and beam our mobile data from space?

Big tech has already been mulling over this idea for a while now. Elon Musk has talked about making Starlink a direct-to-cell service. And just this week Semafor reported that SpaceX (the parent company of Starlink) may be looking to acquire spectrum at government auction to compete directly with AT&T, Verizon and T-Mobile. Or it may decide to acquire another wireless carrier altogether.

Meanwhile, Amazon has filed an application to launch its own satellite-based internet service. Fortunately, we don't have to wait for the to get their act together, because carriers around the world have started offering satellite services to their customers.

Being the curious type, I decided to give one a go and see whether it was actually worth signing up for full time.

How satellite 4G works

Those reading this from the U.S. may be aware that T-Mobile offers a satellite service powered by Starlink. I live in the U.K., and naturally don't have access to T-Mobile, but the carrier O2 offers a similar service as an optional extra. This extra is also powered by Starlink, costs £3/$4 a month, and gives you access to satellite-based 4G should you find yourself without a cell signal or Wi-Fi connection.

That lack of additional connectivity is crucial to the whole process, because of the way modern smartphones connect to satellites. If there is another form of data connection, be it cellular or Wi-Fi, then the phone will refuse to look for a satellite. The satellite is essentially a last port of call to get your device connected.

This has led to some amusing instances of my phone looking for a satellite when there's zero chance of making a connection — such as when I was traveling several feet underground on the London Underground's Central Line. That's because I disconnected from cell service for more than a few seconds.

Finding the right spot

Surprisingly, the connectivity aspect actually caused a problem for me, because O2's outdoor 4G coverage is surprisingly good in my part of the country. There are plenty of areas in the U.K. that don't get any 4G cell signal, let alone 5G, but the official coverage map shows they're mainly in very rural areas — notably mountainous regions of Wales, Scotland and Northern England.

I live in the South East, roughly around 40 miles from central London. Anyone from different parts of England will be well aware that this is the region where most of the money goes. So, even though I live in a village in a fairly rural area, the cell signal is remarkably robust when you're using an O2 SIM card.

That's not to say 4G connectivity is universally available. There are various dead spots scattered around the place, according to both O2's own coverage checked and the independent map from mobile regulator Ofcom.

I just had to find one that intersected with a road, ideally one that had ample space to pull over and let me play on my phone. If you've had any experience with British country roads, you'll know that they're often too narrow to do this safely.

Thankfully, I found a spot roughly 30 minutes away by car. Not only is it a good-size deadspot, it also contains a pub with a sizable parking lot. There are certainly worse places to stop and test some new phone features.

The actual connection is easy and automatic

It took a couple of minutes to drive through the deadspot and park my car, by which point my Galaxy S26 Ultra had already connected to Starlink's satellites. That was rather surprising, considering that satellite connectivity typically needs a direct view of the sky to actually make the connection.

And no, before anyone asks, my car does not have a sun roof. It's totally solid, though I'm unsure of what materials were actually involved in its construction.

Admittedly, the signal wasn't particularly strong inside the car, illustrated as one bar out of three in the S26 Ultra's status bar. This doesn't change the fact that my phone was connected to the satellite through the car roof, and was receiving data from some Starlink satellite in space.

My next move was to stick the phone out of my window and raise it up towards the sky. It took about a minute for the S26 Ultra to register that circumstances had changed, and there were no obstacles in the way — at which point the signal jumped up to two bars.

It never hit three bars, though, despite the fact I was in an open area with relatively clear skies. I should also note that moving inside the pub, a 350-year old building with a thatched roof, cut off all access to the satellite. So while the signal may be able to penetrate my car, it isn't magic.

Accessing Google Maps from inside my car was a slightly drawn out affair. The app warned me that it was connected to the satellite, with lower loading times, and it took between 30 and 60 seconds for the actual map interface to load up fully. Shifting things outside and the load times were significantly reduced, though nowhere near as quick as they are with a 4G connection, let alone 5G.

So you're not going to be tapping your feet staring at your phone waiting for an all-important app to load over the course of several minutes. But your speeds aren't going to be as instantaneous as they might be with full bars of cell signal.

This isn't unrestricted 4G like you're used to

It was a surprisingly effective system, though the main drawback is that there are limitations on the apps you're able to use. These limitations seem to have been coded in at a system level by your phone rather than by the carrier. My personal guess is that this is due to modern phones treating satellite connectivity as an emergency feature, rather than a stable source of data.

This means that you will only be able to use the bare minimum of apps you need to communicate, navigate and potentially allow yourself to be found in an emergency. We're talking about things like Google Maps, Google Find Hub, Messages and the weather.

The latter may seem like an odd choice, but if you're out in the sticks by yourself with no vehicle or shelter, being able to keep tabs on the weather is essential. It could be the difference between you being stuck in a freak storm and finding somewhere to hunker down and ride it out in relative safety.

Your more frivolous apps, like social media and web browsers, are all disconnected and behave as though you don't have any active data connection. So don't expect to be sitting on a mountain somewhere catching up on your favorite Netflix series. That's not what this system is for, and the app straight up won't work if you try it.

Likewise, any third-party apps that could prove useful in precarious situations, such as mapping apps, still behave as though they are offline. The good news for wilderness-enthusiasts is that you can still get GPS with no data, but if assets haven't loaded, or are hilariously out of date, then the lack of data to update could end up being a problem.

A fantastic backup tool, but it's not replacing cell service yet

If you live out in a deadspot, or regularly find yourself in one, then gaining satellite access through your carrier is not going to make up for the fact there's no cell signal. The limitations in what the satellite connection can or can't do means that it's not a true replacement for cell service in the way a full Starlink setup would be for home internet.

But this sure as heck beats being stuck with zero access to the internet. Carrier-supplied 4G may not be able to give you access to web browsers and streaming, but it keeps you hooked into the apps that you might actually need in a pinch. In short, it means that you will always be able to reach the outside world in the event that you desperately need to.

Some may not like the fact that it's getting harder and harder to disconnect, but this means that you won't be stuck in the middle of nowhere without support. The fact that satellite access still worked in my car, and loaded up Google Maps, will easily be a major boon for navigating areas with little to no cell service. Which isn't a bad deal for $4 a month (or $10 a month with T-Mobile).

More from Tom's Guide

• I turned my iPhone screen completely gray for two weeks — here's how making it boring helped me get my brain back
• I shot the same 25 photos with a $329 budget phone and $1,199 flagship — here's the results
• I got sick of buying cases for my phones, so I decided to 3D print them at home — here's what happened

You can watch this article as a video on The Privacy Lab's YouTube channel.

In October 2020, Google launched a virtual private network. Of course, this seemed out of character – one of the most data-hungry companies in the world whipping up a product to help people protect that exact commodity. But, on paper, Google VPN looked pretty good. It had a huge server network and because it came bundled with premium Google Drive plans, for many it was effectively "free." There were murmurings that it could even dethrone the big names that populate our guide to the best VPNs overall.

However, in April 2024, it was announced that the VPN was destined for the Google graveyard. By June, it was dead and buried.

As ZDNet reported, Google stated: "We're refocusing our efforts to support more in-demand features with Google One. To keep our subscription service fresh, we're discontinuing the VPN feature." In short, Google's reasoning was that people simply weren't using it.

But that was just a cover story.

A clash of philosophies

To understand Google VPN's issues, you have to look at the business model first. Effectively, Google is a data and advertising company. It makes money by tracking your searches, mapping your locations, and ultimately building a very specific profile around you to sell targeted ads.

However, VPNs are designed to stop exactly that. By encrypting your data, VPNs allow you to hide what you're doing from your internet provider, government, and any hackers on dodgy networks. By changing your IP address, they make it harder to build a profile from your activity. Naturally, people were skeptical of Google developing such a product.

To build trust, Google published white papers, open-sourced the apps, and even commissioned independent audits. For example, in its official technical white paper, Google laid out how hard it worked to protect your data, writing:

"By employing a cryptographic blind signing step between user authentication and connecting to the VPN, we give users a stronger guarantee that their network activity can't be tied back to their identity."

Cybersecurity firm NCC Group agreed, writing in its public report that it found the system to have "a robust implementation and a strong technical security posture."

The truth is that Google's VPN was very secure. But even with these stamps of approval, most of us struggled to look past the irony of asking an advertising giant to secure your web traffic. The audience looking for privacy didn't trust Google, and the audience that trusted Google didn't care about privacy.

A VPN limited by design

Perhaps more people trusted Google than I'm giving them credit for. But those that did use Google VPN found it was no match for established names like NordVPN, Proton VPN, or Mullvad. It couldn't compete because it only did half the job.

Most people want their VPN to change their virtual location. That might be to access regional sites like BBC iPlayer and watch more shows on Netflix, or maybe to avoid content restrictions in countries like Russia and China. Either way, it's a core feature of any good VPN.

However, even on its paid plan, Google VPN did not let you choose a country to connect to. Instead, when it was first launched, it only allocated you an IP address in your "broad" location. In reality, that often meant connecting to a server several states away. This ended up messing with things like weather reports and proved very annoying – especially for people who didn't really understand how VPNs work.

In 2023, Google addressed this by allowing you to use a "local" IP address nearer your real location, but there was still no true location choice. This decision was an absolute dealbreaker for millions of potential customers.

What's more, the app was seriously underpowered. It lacked things like protocol switching, dedicated IPs, port forwarding, obfuscation, or split tunneling. Plus, if you didn't have a Pixel phone, Google VPN didn’t even have a kill switch to block internet traffic if it crashed.

In short, it was half-baked. Anyone actively looking to buy a VPN realised pretty quickly that there were so many better options out there.

The fragmented ecosystem

You might have noticed that there are more than a few similarities between Google's VPN and another well-known privacy tool from a Big Tech company: Apple Private Relay. Really, they are – or were – exactly the same thing: a limited VPN bundled with cloud storage.

But there are a few key reasons why Google VPN failed spectacularly, and why Private Relay is still going strong. Buckle up – Google made all of this quite confusing.

There were in fact three different versions of Google VPN: Google One VPN (RIP), Google Fi Wireless VPN, and VPN by Google. The latter two still exist, both now called VPN by Google, but in reality they're two different bits of software. Notably, though, the now-dead Google One VPN was the only one available for anyone to buy. The others require Google hardware to use them.

Coverage at the time shows the disconnect. Initially, Google stated that it was shuttering the VPN because "people weren't using it." However, it was also announced that the VPN would live on in the form of the Pixel VPN. And that's not to mention Google Fi.

Confusing, right? Well, it doesn't stop there. If we consider each product separately, they all appear to have different purposes and different goals – and none seem properly integrated. Let's quickly have a look at these:

• Google One VPN: This is the one that died, the one I covered the most here at Tom's Guide, and probably the most-used version at the time. It was used as an incentive to convince users to buy more cloud storage, and the only version available without the purchase of a Google hardware product.
• Google Fi Wireless VPN: This VPN's purpose was to convince customers to switch their phone lines over to Google's cellular network, and was available with a Google Fi subscription.
• Pixel VPN: The Pixel VPN's goal was to increase physical phone sales. Essentially, Google wanted to offer perks to compete with the iPhone. This version was only available with the purchase of a Pixel 7 or newer phone.

Although there's no definitive proof, it appears that each team responsible for these three products was totally separate from the other. The three VPNs may even have run on completely different infrastructures.

Here's a clue that points that way: Google claims it shut down Google One VPN due to low usage – but this was arguably the most-used version of the three. If all three VPNs shared the same servers, why kill the most popular one for being underused, while Fi and Pixel carried on unaffected? It suggests, at the very least, that Google One VPN was built and run with little coordination with Google's other VPN ventures.

Even if we avoid conjecture entirely, the fact remains that in early 2024 you could own a Pixel phone, run it on Google Fi, and pay for a Google One cloud storage – meaning you'd have three different Google-branded VPNs competing for control over the exact same traffic.

Suffice to say, it seems Google wasn't quite as organised as you might expect one of the richest companies in the world to be.

The pivot to AI

Running a VPN is expensive. Thousands of servers in dozens of countries, tip-top security, and routing huge amounts of data takes a lot of cash.

For a company like NordVPN or ExpressVPN, these costs are justified because it's their entire business. For Google, it was a expense that wasn’t generating any revenue. No one was subscribing to Google One just for the VPN – it was just a "perk" that came with their cloud storage, which they probably didn't use.

Then, in early 2024, Google changed tack. AI was here. Google's CEO, Sundar Pichai, celebrated a massive milestone on X, but his words betrayed the future of Google:

The writing was on the wall. The future of Google's subscription business didn't include tools like a VPN. It was going to be driven by artificial intelligence – and there was no reason to maintain an unpopular product that didn't line the coffers.

Bottom line

Ultimately, the collapse of Google VPN proves that privacy can't be treated as an afterthought. A successful VPN needs more than solid engineering – it demands an overall philosophy that isn’t compromised by a business model based around advertising and data collection. Google didn't fail because it lacked the technology. It failed because it lacked the trust.

Then, when the AI boom hit, the VPN was first on the chopping block. Google could no longer justify maintaining an expensive and underused infrastructure that actively protected your data – the commodity most valued by the tech giant. By killing the VPN, it cleared the path for Gemini and showed us exactly where Big Tech’s priorities lie.

But, for us, this was a win. Consumers sent a message that they refused to compromise on trust just for the convenience of a cheap bundle. You voted with your wallets, and Google had to listen.

We have contacted Google for comment. We await their reply.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

The World Cup final. One match, one night, and then a four-year wait until the next one. Whatever can go wrong with your stream, tonight is not the night for it.

The threats are real and they're varied. If you're watching from abroad, geo-restrictions could lock you out of the coverage you'd get at home. If you're on public Wi-Fi – at a bar, a hotel, a fan zone – your connection is shared, unsecured, and unpredictable. And if you're at home on your own broadband, your ISP can see exactly what you're doing – and has every incentive to throttle a 4K stream on one of the busiest nights of the streaming year.

Using one of the best VPNs solves all three at once, routing your traffic through an encrypted tunnel that sidesteps geo-blocks, secures public connections, and hides your activity from your ISP.

Norton VPN currently tops our best streaming VPN rankings, and with a deal running right now that brings it to $3.33 per month, there's no better time to get it sorted before kickoff.

How does Norton VPN compare to other top VPNs?

Surfshark is our pick for the best cheap VPN, and at $2.49 per month it's a very affordable option – with the added bonus of unlimited device connections that Norton doesn't offer. The gap is streaming consistency. Norton has been the more reliable performer across every major platform in our testing, and for a final that comes around once every four years, that's the gap that matters.

NordVPN is our top-ranked VPN overall, and earns it – 9,000+ servers across 148 countries, speeds of over 1,000 Mbps, and a near-flawless unblocking record. At $3.49 per month it costs more than Norton's current deal, though, and its 30-day guarantee is half the safety net Norton gives you for a night this important.

It's also worth remembering that the World Cup final isn't a game you can quietly catch up on tomorrow. The result will be everywhere before you've even found a replay link – on your phone, in your group chats, across every headline. Whatever VPN you go with tonight, just make sure it's one you've actually tested before kickoff.

For a night with no replay, no second viewing, and a four-year wait for the next one, Norton makes the strongest case.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

You already know about Microsoft’s desperate ploys to get you to use Edge on Windows 11 — chances are you’re one of the folks who have gone through the test of patience to install Firefox or Google Chrome.

Well, new research by Mozilla reveals that the Redmond crew are not only still up to their old tricks, but getting worse. All kinds of “harmful design” shenanigans are at play here, in order to “not allow people to download and install an alternative browser, to set it as their default, or to continue using it as their default, without harmful interference.”

If only we could only get the same treatment as Windows users get in the EU...

Staying desperate

So what did the research find? Well, Mozilla discovered that a lot of the shady tricks Microsoft was called out for in the past are still happening:

• Visual interference: Searching for different browsers to download in Edge still brings up the “All you need is right here” banner, as well as a banner promoting the browser when you go to Chrome’s download page.
• Default browser selection trickery: There is a button at the top of the default apps screen to change to a different browser, but not every file type is switched over.
• Trick wording: Things like “Use Microsoft’s recommended browser settings,” “You’re almost done setting up your PC” and more still persist.
• Dark patterns: In the setup screens you normally see a few days later, Edge-preferential options are shown as big blue buttons, whereas keeping the same settings is usually smaller, greyed-out text.

And that’s just a few of the many different harmful patterns Mozilla found — including Copilot opening links in Edge instead of your default browser, pre-selecting checkboxes to sync data to Edge, and resetting it as the default browser when you migrate from Windows 10 to 11.

Just make a better browser

It screams “inferiority complex” if I’m being real, which is a shame because Edge is indeed a good browser. It runs on the same Chromium engine as Chrome (to support all the same extensions), but also has some efficiencies built into it to not drain the battery as badly.

But this aggressive lock-in, some high RAM resource usage in the background and the clutter of Copilot and MSN news does make it falter. It’s not like Microsoft doesn't have a history of doing this — they were taken to court over an antitrust lawsuit in 1998 for bundling Internet Explorer with Windows and making it difficult to install a competing browser.

The only difference now is that users are committed enough to jump through those hoops to get to their favorite browsers. I mean “Google Chrome” is one of the most searched terms on Bing after all!

If you want to compete, build something better. Don’t go about it this way.

More from Tom's Guide

• SK Hynix warns 2027 will be 'worst year' for RAM prices — right as a damning report reveals something that will add fuel to the price-fixing lawsuit
• Router overheating? The simple mistakes killing your Wi-Fi this summer — according to a networking expert
• Dangerous new CrashStealer Mac impersonates Apple's own tools — and bypasses Gatekeeper — to steal your passwords and more

Even with one of the best MacBooks, you can never be too careful when downloading new apps. Case in point: a new malicious Mac app is posing as a legitimate Apple tool to steal passwords, keychain data and more from vulnerable systems.

As reported by BleepingComputer, the app in question serves as a means to infect vulnerable Apple computers with a new Mac info-stealer. While security researchers at Jamf first observed it back in May when it was still in development, this malware is now being actively used by cybercriminals in their attacks.

Dubbed CrashStealer, what makes this Mac malware strain so dangerous is the way in which it perfectly mimics Apple’s own macOS crash reports. Although something might seem off to more discerning users, others could easily fall for this attack given how much care and attention has gone into impersonating this legitimate tool.

Here’s everything you need to know about this new Mac malware and how you can keep your own MacBook and all the sensitive data it contains safe from hackers.

Impersonating a legitimate Apple utility

In their report, Jamf’s security researchers explain how the malware hides in plain sight by posing as a meeting platform called Werkbit. While they don’t go into details about the malware’s initial distribution method, a malicious app like this could be distributed via fake ads or on a developer-focused site like GitHub.

After downloading the app, it’s mounted on your desktop just like with any new software you download for your Mac. Surprisingly, though, the hackers behind this campaign are using a signed and Apple-notarized installer to distribute their fake app. Not only does this add a sense of legitimacy to the app but it also allows it to bypass Apple’s built-in Gatekeeper security feature without any warnings whatsoever.

When launched for the first time, the app displays a fake macOS password prompt that looks strikingly similar to what you’d see when downloading new software manually as opposed to through the Mac App Store. Once a victim puts in the password for their Mac, the hackers then have everything they need to unlock their Apple Keychain which acts as macOS’ encrypted password vault and contains all sorts of sensitive info like saved credentials in Safari, app passwords, Wi-Fi passwords and more.

The CrashStealer malware isn’t just limited to stealing from your Keychain though. It can also steal browser credentials and cookies from Chrome and other Chromium-based browsers as well as Firefox. Likewise, it can steal data from 80 different crypto wallet extensions and 14 of the best password managers including 1Password, LastPass, Dashlane and more.

To get all of this stolen data off your Mac, the malware encrypts it before packaging it into hidden ZIP archives and uploading it to a hacker-controlled C&C server.

By using a signed and notarized dropper and a re-signed payload, CrashStealer is a sophisticated Mac malware that’s especially good at avoiding detection.

How to stay safe from Mac malware

If you’re worried about CrashStealer and other Mac malware, the first thing you should do is to avoid sideloading apps, or in this case, installing new apps from anywhere besides the Mac App Store.

Just like on one of the best Android smartphones, when you download new apps from websites instead of an official app store, you’re putting your devices and the data they contain at risk. Apps submitted to the Mac App Store go through rigorous security checks while those you download from a random website don’t.

Normally when you download an unverified app from the web, macOS’s built-in Gatekeeper security feature will block it or warn you before you install it. In this case, though, that doesn’t happen since the installer used in this campaign is signed and appears to be legitimate. Well, at least in Gatekeeper’s eyes.

While Gatekeeper can keep you safe from most threats, there are ones like this that manage to bypass its defenses. For this reason, you might want to consider using one of the best Mac antivirus software solutions alongside Apple’s built-in ones. That way, if something slips past Apple, your third-party antivirus software will be able to stop the threat before it can do serious damage.

Since CrashStealer is still a relatively new Mac malware, this likely won’t be the last time we see it. This is why you always need to be extra careful when downloading and installing new software onto your Apple computer.

More from Tom’s Guide

• New PamStealer Mac malware poses as a clipboard manager to steal login info
• Apple’s ‘Hide My Email’ reportedly exposing real email addresses
• GTA 6 warning: Pre-order scams are stealing users' info and spreading malware

The official Grand Theft Auto 6 launch isn't for several months, but pre-orders have been in full swing since the end of June. You may want to be careful if you try to order the game, though.

Security researchers from Kaspersky recently released a warning via email to Tom's Guide that cybercriminals are using the hype around GTA 6 to deploy a "wide range of fraud schemes." The most common scheme appears to be fake pre-order websites or false video tutorials on how to get the game.

"Highly anticipated game releases have long presented significant opportunities for cybercriminals, and we are already detecting related fraudulent activity," Olga Altukhova, a Senior Web Content Analyst at Kaspersky, said in the report. "These schemes are carefully timed to capitalize on heightened consumer excitement: attackers understand that periods of intense anticipation can lower users’ guard and create a false sense of urgency."

The fake sites utilize graphics and copy that mimic Rockstar's branding, including real trailers and promotional artwork. They offer gamers the ability to pre-order the game for the PS5 or Xbox.

Unfortunately, when users enter their personal details and payment information, it sets them up to potentially have their bank accounts drained and sensitive data compromised.

According to Kaspersky, the false pages have been found in multiple languages, which indicates that scammers are targeting unsuspecting people across the globe.

Other frauds to avoid

Fake websites aren't the only scam. At least one website was offering what it claimed to be a beta version of the game as a download framing it as a leak.

The false beta was promoted on social media and streaming platforms where scammers showed gamers how to "safely" download the game. Downloading and opening the file enabled malware to be installed on your system which could lead to compromised data and unauthorized access.

Finally, cryptocurrency owners are also being targeted via suspicious websites promoting tokens using GTA 6 branding.

How to safely pre-order and avoid scammers

As always, when it comes to software, whether games or programs, we always recommend you purchase or download from official sources.

GTA 6 is only launching on PS5 and Xbox Series S and X this November. If you're interested, purchase the game through the storefronts on your console of choice. Or you can go to the official Rockstar GTA 6 site and pre-order there.

Kaspersky recommends using a prepaid card when purchasing games to avoid exposing your credit card or bank account information. It's an extra step but good practice for keeping your financial information safe.

Even beyond of GTA 6, you should always double-check the URL formats of websites you're visiting, especially ones you're not familiar with. Also check the spelling of names and organizations where typos can reveal falsehoods.

Online scams often end up with nasty malware infections, so you want to keep your devices protected as well. Make sure that you're using the best antivirus software on your Windows PC, the best Mac antivirus software on your Apple computer, and one of the best Android antivirus apps on your Android smartphone

For even greater protection and help recovering any funds lost to scams, you may also want to consider signing up for one of the best identity theft protection services.

Finally, consider enabling multi-factor authentication and monitoring accounts regularly, which can help warn you about unauthorized access.

More from Tom's Guide

• 3 cloud gaming services I recommend if gaming platforms are too expensive
• Assassin’s Creed Black Flag Resynced is a remake done right — and the best pirate game I’ve ever played
• I grinded enough Microsoft reward points to get GTA 6 for free — here's how you can do it too

ExpressVPN has expanded its global server network to 214 "app-selectable locations" across 113 countries – its broadest coverage to date. The expansion adds new connection points across Europe, Africa, the Middle East, and North America, with cities including Nuuk, Lagos, Doha, Valencia, and Manchester among the new additions.

For users of one of the most popular best VPNs on the market, more locations means more precise control over where their encrypted connection appears to originate – which affects everything from latency to which local services and content are accessible. The expansion also builds on ExpressVPN's earlier rollout across all 50 US states, extending that same local-first approach to its global network.

The headline figure of 214 deserves some scrutiny, however. ExpressVPN counts multiple connection points within the same city – Toronto 1 and Toronto 2, for example – as distinct locations. By our count, the network sits closer to 196. Both figures tell a real story, but they're measuring different things.

How much has changed?

The expansion represents a meaningful step up for ExpressVPN's network. By country count, the service has grown from 108 to 113 – an increase of 5. By location count, our latest testing puts the figure at 196 unique locations, up from 188 – an increase of 8. The gap between that 196 and ExpressVPN's stated 214 comes down to methodology – the company counts multiple connection points within the same city as distinct "app-selectable locations."

However, the most significant new addition is one ExpressVPN hasn't drawn attention to: China. The service now offers a Chinese IP address, though the physical server is hosted in Singapore – a setup ExpressVPN lists transparently on its virtual server locations page.

For those who need a Chinese IP for work, travel, or accessing local services, this is a genuinely useful addition, even with that caveat. It's also a selling point over big rivals NordVPN and Surfshark, which don't offer any locations in China.

How does ExpressVPN compare?

In terms of country count – the metric that matters most for most users – ExpressVPN's 113 puts it behind NordVPN (149 countries) and Proton VPN (148 countries). However, these are the only two reputable providers we can confidently say offer broader reach, and finishing third in this particular race is far from embarrassing.

The gap narrows when location depth is taken into account: ExpressVPN's 196 unique locations trails NordVPN's 224 and Proton VPN's 193, but comfortably outpaces Surfshark, our pick for the best cheap VPN, which covers 100 countries across 142 locations.

It's also worth noting that country count and location count measure different things. Country coverage determines where a VPN can get you. Location count determines how precisely you can get there – useful for reducing latency or accessing city-specific content in large countries. ExpressVPN has historically punched above its weight on the latter, and this expansion keeps it competitive.

Taken as a whole, this is a meaningful upgrade rather than a transformative one – with one exception. The addition of China changes the calculus for a specific group of users in a way that no location count figure can capture.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

USA vs. Belgium is one of the most anticipated matchups of the 2026 FIFA World Cup, and millions of fans will be settling in front of their screens on Monday to watch it unfold.

But there is a good chance your stream won't go quite as planned. Just as the referee blows the whistle for kickoff, your crisp picture could easily drop into a pixelated, low-res mess — or freeze entirely.

The culprit? Your Internet Service Provider (ISP).

During major live sporting events, internet service providers frequently throttle bandwidth to manage the surge in users.

The good news is there's a straightforward technical fix, and you don't need to be particularly tech-savvy to use it.

The best VPNs encrypt your internet traffic before it leaves your device, masking it from your ISP. Because your provider can no longer see what kind of data you're consuming, it won't trigger its throttling algorithms — leaving you with a stable, high-def stream from kickoff to the final whistle.

Is it worth keeping after the match?

If you decide to keep the service beyond Monday's match, an annual plan breaks down to less than a single match-day takeaway — and it will cover your connection for every remaining game for the rest of the year.

Because it comes with an industry-double 60-day money-back guarantee, you can essentially test it out completely risk-free. If it doesn't instantly stabilize your stream, you can claim a full refund without any hassle.

Either way, don't leave it until the last minute. Get the app downloaded and run a quick speed test before kickoff today — so when the first whistle blows, you're confident in your stream.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Security researchers who focus on Apple devices have discovered a new macOS malware that appears to be surprisingly clever while it harvests data and login credentials.

According to the IT firm Jamf (via ArsTechnica), the new malware, dubbed PamStealer, can get on your Mac in two stages. First, it disguises itself as Maccy, a clipboard manager.

Apparently, PamStealer is compiled as AppleScript written in Rust that uses the Pluggable Authentication Modules interface that is built into macOS to target the device's login password, which is then sent to an attacker-controlled server.

What makes PamStealer unique is that it combines AppleScript and disk images to stealthily enter your computer. When you click the AppleScript, it opens the macOS Script Editor where the malware is buried in the file.

"Rather than relying on shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and stages the payload using native Objective-C APIs," the Jamf team wrote. "Combined with a Rust-based second stage and a password capture workflow that validates credentials locally through PAM, the result is a quieter execution chain than we typically observe in commodity macOS stealers."

How PamStealer works

When someone installs the false Maccy and opens the disk image, they're prompted to enter Command-R immediately. Doing so executes the malicious code inside AppleScript. This allows it to bypass com.apple.quarantine, a normal macOS feature that offers warnings and restrictions when you're opening executable files from the internet.

The second stage is a Mach-O file specifically written for Macs running Apple M-series CPUs. Rust is apparently an uncommon code for macOS infostealers. This bundles SQLite and calls it read interface, meaning it opens and reads databases files directly.

PamStealer will pop up a native password prompt that is meant to resemble a system authorization request. It reads, "“Maccy wants to make changes. Enter your password to allow this.”

Once a password is entered, it's validated through the PAM API, meaning its harder for malware defenders to detect. Additionally, it can either give a malicious actor full disk access or inject code designed to access Ethereum accounts.

“Together, these behaviors illustrate how commodity macOS stealers continue to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities while remaining compatible with standard macOS features,” Jamf said.

How to stay safe from PamStealer

First and foremost, Maccy is a real, legitimate app that is quite popular. If you are interested in checking the app, the only real website is maccy.app.

Jamf found the fake Maccy was being hosted at maccyapp.com, a site you should not visit.

Secondly, it's a good reminder to double and triple-check website URLs. Specifically for macOS apps, you can also see if the app in question is available in the Apple App Store. Maccy, for instance, is in the App Store.

Apple is still a pretty closed garden so if you're looking for something and want to be sure it's real, I would recommend starting there before venturing into the hinterlands of the internet.

Beyond that, your Mac does come with built-in security software in the form of XProtect. But if you need some extra protection, it might be worth investing in one of the best Mac antivirus software solutions to run alongside it.

More from Tom's Guide

• Apple’s ‘Hide My Email’ reportedly exposing real email addresses
• What is Q-Day?
• 'Amazon put identity theft victims through a Kafkaesque ordeal': FTC issues $2.5 million fine over denying requests

Back when it was first revealed alongside iCloud Plus, Apple’s Hide My Email always seemed like magic as anyone could use it to avoid handing out their ‘real’ email address. However, a newly disclosed vulnerability just revealed that this privacy feature isn’t so private after all, leaving a way for attackers to completely uncover your actual email address.

For those unfamiliar, Hide My Email is one of the built-in perks that comes with a paid iCloud account. Once enabled, it masks your primary email address and replaces it with a randomly generated one that ends in @icloud.com. From there, Apple makes it easy to view any emails sent to that random address as they’re automatically forwarded to your main email address.

Think of Hide My Email as a fast-tracked way to get a burner email address from one of the biggest names in tech. And the best part, you don’t need one of the best iPhones to use this feature since even Android and Windows users can sign up for iCloud Plus.

From signing up for newsletters to free trials, Hide My Email can be an incredibly useful feature, especially for those times when you don’t want to use your work or personal email to avoid ending up with loads of spam in your inbox.

Personally, I always thought it seemed too good to be true and according to a new report from 404 Media, that just might be the case. Here’s everything you need to know about this new Hide My Email vulnerability along with some alternatives you might want to try out in the meantime until Apple finally rolls out a real patch for this major flaw.

Not your standard disclosure

Normally with high-profile vulnerabilities, security researchers discover them and then inform the company in question about their findings. Once this is done, they usually give companies a 90-day window to verify the bug, patch it, and test that their fix actually works. Sometimes though, companies might ask for an extension if they’re dealing with a difficult-to-patch, high-severity vulnerability.

According to 404 Media’s reporting, security researcher Tyler Murphy went above and beyond when reporting the Hide My Email vulnerability to Apple back in June of last year. Instead of 90 days, he reported the issue and showed how to replicate it to Apple over a year ago. After waiting all that time, Murphy has finally come out and disclosed the vulnerability to 404 Media.

It’s worth noting though that neither Murphy nor 404 Media have revealed the exact details of this major vulnerability. Apparently though, it’s still exploitable as the news outlet independently verified the flaw this week, uncovering their own reporter's real address using a hidden email alias.

After reporting the issue to Apple, the company told Murphy that it was looking into the vulnerability. From there, Cupertino said that it was fixed back in March of this year. However, during his follow-up investigation, Murphy discovered that it was still exploitable. He then contacted Apple about the vulnerability again, and Apple effectively begged him not to go public, stating they would "appreciate" him keeping quiet until an actual fix rolls out.

As it stands now, Hide My Email can reveal your real email address since a patch that actually fixes this bug hasn’t been released yet.

Hide My Email alternatives you can try right now

Given this is a major vulnerability that completely undermines Apple’s privacy-first focus, I guarantee that if the company wasn’t actively working on a fix, it absolutely is now. However, since your real email address could have been exposed as a result of this bug, you might be considering other alternatives.

Another reason you might want to ditch Hide My Email is due to an upcoming change Apple recently announced in a blog post. Instead of just providing you with a random email address ending in @icloud.com, going forward, all of your new burner email addresses will end with the dedicated @private.icloud.com subdomain. This might seem like a small change, but it’s actually quite a significant one. By switching to a unified, obvious subdomain, the very websites on which you previously used Hide My Email could soon start blocking your burner addresses automatically because they are so easy to identify. If you want to get ahead of that change, here are some alternatives worth considering.

Proton is well-known for its privacy-first tools, and just like Apple, it also has an email forwarding service called SimpleLogin. It’s considered one of the best alternatives to Hide My Email overall, and along with dedicated iOS and Android apps, it also works seamlessly in any web browser. Another cool feature is that you can instantly toggle your email aliases off with a single tap.

Another alternative worth considering is DuckDuckGo’s Email Protection. The privacy-focused search engine’s email alias service is both completely free and very lightweight. It’s built into both its browser extensions and mobile apps and generates a @duck.com email alias. Besides hiding your real email address, this alternative also strips out hidden ad trackers before forwarding replies from your email alias right to your real inbox.

Finally, there’s Mozilla’s Firefox Relay. It provides you with email aliases via a simple browser extension and has a user-friendly dashboard that lets you manage, mask, and delete your email aliases very easily.

Apple’s Hide My Email made email aliases mainstream and has been a godsend for many iCloud users. However, given this recent vulnerability and its potential fallout, no one would blame you for giving a similar service a try.

More from Tom's Guide

• 'Google is force-feeding AI with no way to opt ': DuckDuckGo CEO says installs are surging after Google I/O
• What are anti-censorship features and how is Proton VPN leading the way?
• We asked cybersecurity experts to build a privacy toolbox for $10 per month – here's what they came up with, and more

The Federal Trade Commission is fining Amazon $2.25 million over allegations that the retail giant regularly denied records requests from identity theft victims. The U.S. agency accused Amazon of violating the Fair Credit Reporting Act.

Per an FTC press release, a complaint was filed by the Department of Justice as a referral from the FTC. It alleged that Amazon failed to comply with Section 609(e) of the FCRA, which requires companies to provide victims of identity theft with records about transactions made in their name within 30 days of a consumer's request.

FTC accusations against Amazon

Amazon apparently did not have a written policy for responding to 609(e) requests until last year.

“Amazon often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to—records that could help victims protect themselves and recover from the fraudulent conduct,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection said in the release.

The complaint claims that customers who reached out to Amazon were often told that the requested records could not be provided for "security" or "privacy" reasons. In one provided example, a consumer tried to get business records related to unauthorized charges from a fraudulent account. However, Amazon reportedly refused for security reasons unless the consumer "guessed the name on the [fraudulent] account," which they were unable to do.

Penalties and resolution

Alongside the $2.25 million civial penalty, the DOJ's proposed order requires Amazon to provide records lawfully requested by identity theft victims and law enforcement agencies. It also requires the company to provide notice to customers about how they can request FCRA records.

Additionally, Amazon is required to contact any customers who requested records since April 2024.

An Amazon spokesperson told Tom's Guide that it has implemented process improvements and resolved the matter with the FTC.

“We are committed to providing customers with their detailed account information when they need it most. We've resolved this matter with the FTC and have implemented process improvements for customers who believe they may be victims of identity theft. Customers who need assistance requesting their records can visit our Help Page to learn more."

How to contact Amazon for Identity Theft records

Amazon has a portal for Identity theft called "Report Suspicious Activity." There you can report unrecognized orders, chargers to your payment methods that aren't from your Amazon account and other unauthorized activity.

You can request records relating to fraudulent transactions via the Request Your Data portal. If that's not enough you can also send an email or physical mail:

By Email: fcra-requests@amazon.com

By Mail: Amazon Legal Department
Attn: FCRA Records Requests
P.O. Box 80161Seattle, WA 98108-9990

You will need to provide a copy of a government ID, a copy of a police report concerning identity theft, or a government-issued Identity Theft Report, found at IdentityTheft.gov. You'll also need relevant details about the fraudulent transaction and contact information so Amazon can reach out.

Amazon says that it will fulfill your requests within 30 days unless more information is needed.

More from Tom's Guide

• Amazon kills Fire Stick sideloading — apparently, malware and piracy are to blame
• Amazon has a hidden button that connects you with a real customer service agent — here's where to find it
• Still shopping blind on Amazon? This ChatGPT trick helps me avoid bad buys — and it works every time

As AI tools become part of everyday life, many people are rethinking their online privacy. A new survey from All About Cookies found that 40% of VPN users say they now use a virtual private network (VPN) specifically to protect their data from AI companies.

It's an understandable concern. Every time you interact with an AI chatbot, upload a document or generate an image, you're sharing information with an online service. But there's one important catch: while a VPN is a great privacy tool, it probably doesn't protect your AI data in the way many people think it does.

Here's what you need to know.

Why people are turning to VPNs

According to All About Cookies' annual VPN survey of 1,000 U.S. adults, concerns about AI are beginning to influence how people think about online privacy.

The survey found that:

40% of VPN users say they use a VPN to protect their data from AI companies.

19% use a VPN when accessing AI tools.

For that reason alone, it's no surprise that VPN awareness has risen sharply over the past year. At the same time, very few respondents correctly identified everything a VPN actually does. Perhaps that last finding may explain the first.

What a VPN actually does

A VPN creates an encrypted connection between your device and a VPN server. There are valuable privacy benefits, and they're one reason VPNs remain popular.

That means it can:

• Hide your IP address from the websites you visit.
• Encrypt your internet traffic, especially when you're using public Wi-Fi.
• Prevent your internet service provider from seeing the contents of your browsing activity.
• Make it appear as though you're browsing from another location.

What a VPN doesn't do

This is where AI enters the picture. If you open ChatGPT, Gemini, Claude or another AI service and type in a prompt, you're voluntarily sending that information directly to the company operating the service.

A VPN doesn't stop that.

Similarly, if you're logged into an AI account, the service can still associate your conversations with your account regardless of whether you're using a VPN.

In other words, a VPN protects the connection, but not the information you choose to share once you reach the website.

How to better protect your AI privacy

A VPN is still a smart addition to your privacy toolkit, especially if you frequently use public Wi-Fi or want to hide your IP address. Just don't expect it to prevent AI services from collecting information that you intentionally submit.

If your goal is to reduce how much information AI companies collect, these steps are usually more effective than relying on a VPN alone:

• Review each AI service's privacy settings.
• Turn off chat history or model training where the option exists.
• Avoid sharing sensitive personal or financial information.
• Use temporary chats or anonymous sessions when appropriate.
• Read each company's data retention policy before uploading documents.

The takeaway

The survey highlights the fact that people are increasingly concerned about what happens to their data when they use AI.

A VPN is an excellent tool for improving online privacy, but it's not an invisibility cloak for AI. If you're using ChatGPT, Gemini, Claude or another AI assistant, the most important privacy controls are usually found inside the service itself — not in your VPN app.

More from Tom's Guide

• ChatGPT isn't just a chatbot anymore — here are 11 things it can do in 2026
• I built five ChatGPT agents — then replaced them with one 'master' AI
• I used ChatGPT to audit my subscriptions — these prompts helped me find nearly $2,000 a year in recurring charges

The biggest WhatsApp privacy update in years is officially underway. WhatsApp is finally shifting away from phone numbers and introducing usernames, giving its three billion users an entirely new way to connect securely.

But with username reservations going live this week, the clock is ticking to claim your digital identity before the scramble begins. While the platform is offering first dibs to users wishing to port over their existing Facebook or Instagram handles, unreserved names are up for grabs.

Here is how to beat the global rush, navigate the new settings, and secure your WhatsApp username right now.

More from Tom's Guide

• You can use WhatsApp on Apple Watch — here's how to set it up
• Message like a boss — these are the 7 WhatsApp features you should be using
• WhatsApp finally lets you pin messages — here's how

Stadiums, airports, and fan parks are some of the worst environments imaginable for public Wi-Fi. Tens of thousands of people competing for the same signal means packet loss, crawling speeds, and connections that drop without warning. So, for example, if you're heading to a few games at the FIFA World Cup 2026, things might not be as smooth as you'd like.

One of the best VPNs is a handy tool to have at your disposal on networks like these. While it's fairly unlikely nowadays you'll be caught out by a man-in-the-middle attack, boosting your privacy can only be a good thing – and when a VPN is set up right, a VPN may also be able to increase your connection speeds significantly.

Here, I'll run down a few quick settings to tweak to make your public Wi-Fi experience more bearable.

Pick your protocol

A VPN protocol is the set of rules that determines how your device encrypts and moves your data. On a congested or restrictive network, the wrong protocol can mean failed connections, throttled speeds, or both – and switching is often the quickest fix.

WireGuard should be your first port of call. It's a modern protocol built with a low data overhead and near-instant reconnection times, making it well suited to the kind of unstable connections you'll find in a packed stadium or airport terminal. Most VPN apps already default to it – but if you're on an iPhone, check your settings, as IKEv2 is often the default instead.

IKEv2 is a solid runner-up for mobile users who switch frequently between Wi-Fi and cellular data. It handles network changes smoothly, though speeds won't quite match WireGuard.

If you're struggling to connect at all, try OpenVPN. It's generally slower than WireGuard, but its ability to run on port 443 – the same port used by standard web traffic – means it's more likely to work on networks that try to block VPNs. For a deeper look at how the fastest VPNs handle different conditions, our dedicated guide is worth a read.

Stay stealthy

Many stadiums and airports actively manage their networks by throttling heavy data users – a necessary measure when tens of thousands of people are sharing the same connection, but one that can reduce your speeds to near-unusable levels during a big event.

VPNs can sidestep this by hiding your traffic from the network – if it can't see what you're doing, it can't single you out for throttling. The catch is that many venues have wised up to this, and will throttle any traffic that looks like VPN traffic too.

The fix is Stealth Mode – sometimes called Obfuscation or Scramble depending on which app you're using. It disguises your VPN traffic as ordinary web traffic, so the network treats it accordingly. You keep the speed benefits of bypassing throttling while your actual activity stays hidden.

Unfortunately, if the network you're connected to flat-out throttle's everyone's connection, regardless of how much data theyre using, a VPN won't make much of a difference. As always, there's an element of trial and error to this.

Set switches to kill

Switching between Wi-Fi and mobile data – or simply dropping out of range in a crowded venue – can cause your VPN connection to drop momentarily. That split second is enough for your real IP address to be exposed before the VPN reconnects, which defeats the purpose of using one in the first place.

A kill switch solves this by blocking all internet traffic the moment your VPN drops, preventing any leaks until the connection is restored. Pair this with Auto-Connect, which ensures your VPN engages automatically whenever you join an untrusted public network, and you've closed off the two most common sources of accidental exposure.

As a side-note, your VPN "blocking all internet traffic" sounds drastic, but in reality, it's nothing to worry about. This only equates to a second or two of downtime, which is very unlikely to be noticed.

Split the tunnel

Running all your apps through a VPN simultaneously puts extra demand on both your device and the network – bandwidth you can't afford to waste when thousands of people are competing for the same signal.

Split tunneling lets you choose which apps use the VPN and which don't. Route your sensitive apps – banking, email, social media logins – through the encrypted tunnel, and let everything else connect directly. Checking live scores or streaming music in the background doesn't need VPN protection, and bypassing it for those apps can free up enough speed to make a real difference. Plus, by reducing the amount of data you need to encrypt will also save you precious battery life.

Bottom line

A few seconds spent in your VPN's settings can be the difference between a working connection and a frustrating one.

Switch your protocol – WireGuard for speed, OpenVPN if you're struggling to connect – enable Stealth mode, turn on your kill switch, and set up split tunneling. Do all of this, and you'll be in a far better position than the thousands of other people on the same network.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

USA vs Turkey is a chance for the USMNT to really flex their muscles, seeing as they're through to the Round of 32 regardless of the result. However, even if you've got a solid broadband connection at home, there's no guarantee of a smooth stream. ISPs routinely throttle bandwidth when they detect heavy streaming activity, and with millions of fans tuning in simultaneously, the risk of a buffering-plagued match is very real.

The best VPNs tackle this by making your traffic unreadable to your ISP. Without knowing what you're doing, it can't make the decision to slow you down – so instead of throttling your stream mid-match, it simply lets your connection run at full tilt.

Right now, Norton VPN sits at the top of our best streaming VPN rankings, and a compelling World Cup deal makes it particularly well-timed for anyone wanting a buffer-free tournament.

How does Norton VPN compare to other top VPNs?

When it comes to sheer breadth, NordVPN is hard to beat. Its network spans more than 9,000 servers across 149 countries, and in our speed tests it hit over 1,249 Mbps locally – figures that put it ahead of most of the competition. That firepower does come at a cost, though. NordVPN starts at $3.49 per month, and that requires you to commit for two years. What's more, it comes with only a 30-day money-back guarantee, compared to Norton's 60-day window.

Surfshark undercuts both on price, with two-year plans coming in at just $1.99 per month – and unlike Norton, it places no cap on device connections, making it an appealing option for households with a lot of hardware. Speed-wise it's no slouch either, ranking among the fastest VPNs we've tested. Where it falls short is consistency: in our streaming tests, it has occasionally failed to unblock certain Netflix regions that Norton handles without issue.

For throttling specifically, what matters most is that your VPN can reliably access streaming sites and mask your traffic from your ISP – and that's precisely where Norton's streaming credentials count most. Add in the 60-day money-back guarantee, which is double the industry standard and comfortably covers the entire tournament, and the choice is easy.

NordVPN and Surfshark are both worth considering once the final whistle blows on the group stage, but if a buffer-free World Cup is the goal, Norton is the one to back.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Scotland vs Brazil is one of the most anticipated matches of the FIFA World Cup 2026's group stage – and whether you're watching from a bar, a hotel, or any other network that isn't your own, your connection may be more exposed than you think. Plus, if you accidentally end up on websites that aren't trustworthy, exposing your IP address to them can spell danger.

Using one of the best VPNs closes that window by encrypting your traffic and masking your IP address, so nobody on the same network can see what you're doing. It also means your ISP can't monitor your streaming habits, and websites can't see your real IP – useful if you'd rather keep your viewing activity to yourself.

We currently rate Norton VPN as the best VPN for streaming, and there's a sensational deal running right now that makes it an easy choice for World Cup coverage.

How does Norton VPN compare to other top VPNs?

NordVPN continues to outperform Norton VPN in our overall VPN rankings, and its testing record backs that up: speeds of over 1,249 Mbps locally, a server network spanning more than 8,000 servers across 135 countries, and a near-flawless streaming unblocking record. In comparison, Norton VPN only offers servers in 65+ countries – meaning potentially less choice when it comes to streaming services.

The catch is price – even on the discounted two-year plan, NordVPN works out at around $3.49 per month, which is a little more than Norton. What's more, it only comes with a 30-day money-back guarantee. Norton also has the edge when it comes to raw streaming performance, unblocking every major streaming platform in our latest round of testing, despite its smaller network.

Surfshark is a budget alternative, with plans starting at a very reasonable $1.99 per month and the bonus of unlimited device connections. This is a contrast to Norton VPN, which has strict limits on how many devices you can install the VPN on. Surfshark's a capable all-rounder, too, and one of the fastest VPNs we've tested. However, its streaming unblocking has been less consistent than Norton's in our reviews, occasionally struggling with certain Netflix regions.

If your main priority is keeping your streaming activity private without interruption, Norton VPN is the clear choice. What's more, that performance currently comes with competitive pricing against NordVPN and a 60-day guarantee which is double what most competitors offer, giving you the entire tournament to decide if it's right for you.

NordVPN and Surfshark remain solid options for general use once the World Cup wraps up, but for streaming this tournament privately and securely, Norton's combination of unblocking power and excellent pricing is hard to beat.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Even though you should always download new apps from official sources like the Google Play Store, some Android users still end up getting tricked into downloading them from websites which can be extremely dangerous. Case in point, a new Android banking trojan is currently making the rounds online that’s distributed via fake apps from malicious websites.

As reported by BleepingComputer, once installed on vulnerable Android phones, the banking trojan in question is capable of targeting over 200 banking and financial apps to drain accounts and steal crypto. Unsurprisingly, it does so by impersonating Google Chrome and TikTok as both apps are extremely popular.

The trojan installs the new Rokarolla malware which also steals lock screen credentials, your contacts, SMS data and even uses keyloggers to record everything you type into your phone.

Here’s everything you need to know about this new Android banking trojan and how you can keep your bank account safe from the cybercriminals using it in their attacks.

Masquerading as Google Play Protect

Although you should never sideload Android apps unless you absolutely have to, many people still do despite the risk. The hackers behind this campaign use fake websites to trick unsuspecting users into installing Chrome or TikTok unofficially instead of downloading these apps directly from the Google Play Store like they should.

According to a new report from the cybersecurity firm Zimperium, after downloading either app though, the hackers use an interesting trick to give potential victims the illusion of safety. For those unfamiliar, Google’s built-in security app Google Play Protect checks any new software you download for viruses. However, in this case, a fake Play Protect pop-up appears before the Rockarolla malware is actually downloaded. Given the fact that the pop-up perfectly impersonates a Play Protect warning, most users wouldn’t think twice before proceeding with this secondary download.

At this point, the damage is done and the Rockarolla malware gets to work. In total, it’s able to spoof 217 different banking and financial apps to steal your credentials. It does so by using overlays that mimic each individual app. While to the end user it appears as if they’re just logging into their online bank account, they’re actually handing over their username and password to hackers.

Another interesting trick up Rockarolla’s sleeve is that it can steal SMS notifications from your online bank as well as intercept any calls trying to warn you that something is amiss. This way, you won’t get a fraud alert and the hackers can proceed to empty your accounts one by one.

While Google continues to improve Android’s security, if you don’t download apps the right way, you too could easily end up falling victim to this and other malware.

How to stay safe from Android banking trojans

I can’t stress this enough, unless you really know what you’re doing, you should avoid sideloading apps. Sure, malicious apps do manage to sneak past Google’s defenses from time to time but for the most part, if you download new apps from the Play Store, you should be safe. The same goes for other official Android app stores like the Samsung Galaxy Store too.

From there, you want to make sure that Google Play Protect is installed and enabled on your smartphone. It’s enabled by default on all of the best Android phones but it’s always a good idea to check to make sure. For extra protection though, you can also use one of the best Android antivirus apps alongside it. You have to pay for many of them but they typically add other useful features like a VPN or password manager to help keep you safe online.

Despite constant warnings, people keep installing apps from websites instead of official stores. As long as this keeps happening, hackers are going to use it to their advantage. However, if you install new apps the way you’re supposed to, you can avoid falling victim to Rockrolla and other banking trojans like it.

More from Tom's Guide

• Popular Steam wallpaper app hijacked to spread dangerous malware — how to stay safe
• Update your Nvidia GPU drivers now to protect your PC from 9 "high-severity" vulnerabilities — here's what's at risk
• I just got hit by the Ultrahuman data breach — here's what hackers stole from my account

If accidentally downloading malicious apps and getting your computer infected with viruses wasn’t enough, these days, you can’t even trust your own eyes and ears thanks to deepfakes.

Just a few years ago, you only had to look out for phishing emails, fake websites and dodgy attachments from unknown senders. Now though, thanks to AI, you can just as easily be fooled by a very convincing fake image or video.

Fortunately, in the same way that cybercriminals are now using AI in their attacks, so too are cybersecurity firms. While Norton and the rest of the companies behind the best antivirus software use cloud-based AI to better analyze and detect new threats, this isn’t your only option when it comes to staying safe online.