Technology

• Microsoft reportedly set to lay off thousands in its new fiscal year
• Over 6,000 workers have already lost their jobs this calendar year
• Revenue is up, and Microsoft's worth more than $3.5 trillion

Microsoft is preparing to cut thousands of jobs as part of its ongoing cost-cutting shakeup as the company continues to spend big on AI.

A new Bloomberg report says if confirmed, the layoffs could be announced in early July after the company's fourth quarter and fiscal year end on June 30, 2025.

Sales teams could be the worst affected, but the redundancies could span other departments as Microsoft looks to reduce employment-related expenses.

Microsoft set for more layoffs

The company has already cut thousands of workers off in these post-pandemic years.

In May 2025, it cut 6,000 of its workers, equating to around 3% of its roughly 228,000 headcount, in an effort to reduce inefficiencies by removing middle management tiers. A further 305 workers lost their jobs this month, with 14,000 roles affected in 2023 and 2024.

In April 2025, Microsoft said it would outsource sales to small and mid-sized customers to third-party firms – an indication of the changes believed to be coming as soon as next month.

Despite widespread job losses, Microsoft continues to perform well financially. Last quarter, it reported a 13% increase in revenue to $70.1 billion. It currently holds the title of the world's most valuable company, with a market cap of $3.569 trillion.

At the time, CFO Amy Hood stated that overall company headcount was 2% up year-over-year, but slightly down quarter-over-quarter, suggesting constant fluctuations.

TechRadar Pro has asked Microsoft to confirm plans to lay off workers after the current quarter draws to a close, but we did not receive an immediate response.

While highly disappointing for the company's workers, Microsoft employees aren't alone in facing job uncertainty. Key rivals like Amazon and Google have also been making regular adjustments to their headcounts to optimize costs and output.

You might also like

• Check out the best job sites and best recruitment platforms
• Intel set for huge factory job cuts as it makes a major policy shift
• Make yourself more valuable by using the best online learning platforms to learn new skills

Quantum artificial intelligence is the fusion of quantum computing and artificial intelligence. It is poised to redefine what’s computationally possible and it’s closer to reality than many think.

The quantum technology market is rapidly expanding. Today, it's valued at around $35 billion, but forecasts estimate it could reach $1 trillion by 2030. That kind of explosive growth reflects not only the financial interest in quantum tech, but also its much anticipated capability.

In fact, a recent global survey by SAS of 500 business leaders across industries reinforces these projections as it found that interest in Quantum AI is very high, with more than 60% of respondents indicating they are actively investing or exploring opportunities in the technology.

Yet these business leaders also cited crucial barriers to adoption of Quantum AI. Among their top concerns were high cost (38%), lack of understanding or knowledge (35%), and uncertainty around practical, real-world uses (31%).

The survey results indicate that while interest in Quantum AI is on the rise, organizations need a clear roadmap and guide to better leverage this technology.

What is Quantum AI?

Quantum AI combines the power of quantum computing with artificial intelligence, leveraging the unique strengths of both fields to solve problems beyond the reach of classical systems.

At the heart of quantum computing are quantum bits, or qubits, which can exist in multiple states at once, known as superposition. This allows quantum computers to process vast amounts of information simultaneously, offering parallelism far beyond the capabilities of traditional, sequential computing.

When integrated with AI, which excels at data analysis, pattern recognition, and predictive modelling, the result is a powerful system capable of breakthroughs across industries. AI has already transformed fields like healthcare and finance, but its progress is limited by the constraints of classical computing.

Quantum AI also uses quantum algorithms to improve machine learning models. Quantum machine learning models, including quantum-enhanced support vector machines and neural networks, use quantum circuits to perform computations. These circuits form the foundations of quantum computing, representing a universal method for executing further operations.

In these neural networks, classical data is encoded into quantum states. Parameterized rotations, entanglements, and measurements allow the quantum circuit to explore complex relationships simultaneously. The resulting outputs are optimized classically and then cycled back into the quantum system, mimicking the iterative weight adjustment process seen in traditional neural networks.

A hybrid approach

Due to the current limitations of quantum hardware, Quantum AI is typically implemented as a hybrid process, combining quantum and classical computing. In some systems, quantum computation precedes classical post-processing, and in others, it's the reverse.

Many emerging approaches involve a cyclical interaction between the two. This hybrid architecture enables researchers to take advantage of quantum parallelism while relying on classical systems for stability, scalability, and optimization.

As quantum processors evolve, we are witnessing early stages of co-located quantum processing units (QPUs) and AI-specific units (AIUs) on shared platforms. This tighter integration signals a future where quantum and AI co-develop in increasingly intertwined ways, offering unprecedented performance and efficiency.

Real-world applications and opportunities

Researchers in healthcare are exploring the use of Quantum AI to streamline drug design and make the discovery of life-saving treatments faster and more cost-effective. In the financial services industry, quantum algorithms can process extremely complex financial data in unique ways and identify patterns that traditional computers might miss.

Quantum-enhanced AI systems can also manage supply chains with unmatched efficiency, or revolutionize the logistics industry by optimizing routes and inventory in ways that aren't computationally feasible today. Cybersecurity may experience one of the most dramatic shifts, as Quantum AI brings both risk and reward. For example, it could crack current encryption standards, but also create far more secure systems in their place.

This powerful convergence of quantum computing and artificial intelligence is not just convenient, but is a transformative leap that could fundamentally alter how we process data, solve problems, and envision the future.

At its core, Quantum AI draws from the very fabric of quantum mechanics, merging it with the adaptive learning and decision-making capabilities of AI.

Challenges ahead

The road to a Quantum AI future is far from smooth. In fact, one of the greatest challenges lies in the hardware itself, particularly as quantum computers are incredibly delicate.

Qubits are prone to decoherence, a process where their quantum state collapses due to interference from their environment. To maintain their integrity, these systems must be kept at temperatures near absolute zero, shielded from even the slightest vibrations or electromagnetic interference. This makes them not only expensive but also highly complex to maintain and operate.

On the software side, things are equally challenging as developing algorithms that can run on quantum systems while taking advantage of AI’s learning capabilities is an intricate task. It demands expertise across two highly specialized fields, quantum physics and machine learning, which are not often found together.

New programming languages, compilers, and development frameworks are being built from scratch, but we are still in the early stages of that journey.

Beyond the technical obstacles, there are also profound ethical questions to consider. As with AI, Quantum AI demands thoughtful deployment to prevent bias or misuse. Given its scale, responsible governance must be built in, not bolted on.

The sheer power that Quantum AI promises means it could become a tool of extraordinary benefit, or risk, depending on how it's governed, and important concerns should start to be addressed now and not after the technology is widely deployed.

A look ahead

What is clear, though, is that we are standing on the precipice of a technological revolution.

Quantum AI has the potential to reshape entire industries, challenge our current understanding of computation, and offer solutions to problems once thought insurmountable. But for all its promise, its success depends not just on innovation, but on collaboration between scientists, businesses, policymakers, and the public.

As quantum processors become more robust and AI algorithms more adaptable to quantum platforms, we will start to see the first wave of truly transformative applications.

We list the best laptop for programming.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

Apple typically releases the new iPhone in September, but change may be in the air.

If the ban does go into effect, you still have options like Instagram Reels and Lemon8.

The recent spate of cyberattacks targeting major UK retailers has sent shockwaves through the industry, exposing critical vulnerabilities in the sector's IT infrastructure. In just two weeks, high-profile brands including Marks & Spencer, Co-op, and Harrods have fallen victim to sophisticated attacks that have disrupted operations and potentially compromised sensitive data.

These incidents highlight a troubling pattern—threat actors are increasingly setting their sights on retail organizations, which represent lucrative targets due to their vast customer databases and the devastating operational impact of even brief outages. With millions in revenue lost and consumer trust at stake, these attacks serve as a stark warning that the retail sector must fundamentally rethink its approach to cybersecurity.

Security Nightmare Unfolds Across British High Street

The attack sequence began with Marks & Spencer falling victim to what appears to be a ransomware incident attributed to the notorious Scattered Spider group. The timing—over the busy Easter weekend—appeared deliberate, maximizing disruption when the retailer was least prepared to respond.

The consequences were immediate and severe—online ordering systems collapsed, click-and-collect services failed, and contactless payment gateways went offline. Some locations reported empty shelves as inventory management systems faltered, creating a visible manifestation of the digital chaos unfolding behind the scenes.

Within days, Co-op and Harrods reported similar security incidents, suggesting a coordinated campaign or the exploitation of common vulnerabilities across the sector. Co-op took the precautionary step of shutting down significant portions of its IT infrastructure, while Harrods restricted internet access across its operations. Though neither has confirmed the full extent of the breaches, the proximity of these incidents has raised alarms about a potentially systemic vulnerability being exploited.

The financial impact has already proven substantial, with M&S alone facing millions in lost revenue. Yet the long-term consequences—including potential exposure of customer data—may prove far more damaging to brand reputation and consumer trust.

The Industry & Community Responds

The severity of these attacks has prompted a coordinated response. The UK National Cyber Security Centre (NCSC) has emerged as the central coordinating body, working directly with security teams at M&S, Co-op, and Harrods to contain the damage and investigate attack vectors. The agency has simultaneously issued urgent, updated guidance to all retailers, emphasizing that these incidents likely represent a sector-wide threat rather than isolated cases.

Information sharing has become particularly important, with the NCSC working closely with the Information Commissioner's Office (ICO) and law enforcement to establish a unified response framework. Parliamentary committees have also stepped in, seeking assurances that adequate support is reaching affected businesses and that key lessons are being shared throughout the sector.

Industry experts have been blunt in their assessment—the retail sector can no longer afford complacency in cybersecurity matters. Legal and security professionals point to these incidents as evidence that modern attacks involve sophisticated reconnaissance, with threat actors often probing systems for months before launching their primary assault. The sector now faces pressure to fundamentally reconsider its approach to data governance, incident response, and customer transparency.

What Retailers Must Do—Strengthening Defenses Against Cyber Threats

With retail organizations clearly in the crosshairs of sophisticated threat actors, immediate action is essential. Based on security best practices and lessons from these incidents, retailers should implement the following protective measures:

Focus on external attack surfaces. The vast majority of breaches involve external actors exploiting internet-facing assets. Retailers must prioritize continuous monitoring of external systems, particularly ecommerce platforms, payment processing endpoints, and customer-facing applications that represent prime targets.

Implement comprehensive discovery. Security teams can't protect what they don't know exists. Discovery must span all business units, subsidiaries, and acquisitions, including cloud services, on-premise systems, and third-party integrations. Many retailers operate complex technological ecosystems with legacy systems and modern cloud computing infrastructure operating in parallel—each representing potential vulnerability points.

Test continuously, not periodically. The traditional approach of annual penetration testing is insufficient. Implement ongoing security testing across all exposed assets, including regular application security assessments and retail-specific security evaluations that account for the unique threats facing the sector.

Adopt risk-based prioritization. Not all vulnerabilities carry equal weight. Evaluate threats based on potential business impact rather than technical severity alone. Factors like customer data exposure, operational dependencies, and regulatory implications should guide remediation priorities.

Share intelligence broadly. Security isn't just an IT department concern. Integrate exposure management into existing business processes through automation and clear communication channels. Ensure findings reach relevant stakeholders from operations to customer service, creating a culture of security awareness.

These recent attacks are certainly a wake-up call for UK retailers, and other industries. Security can no longer be treated as an afterthought or compliance exercise, especially when sophisticated threat actors stand ready to capitalize on every vulnerability. With proper preparation and a proactive security posture, retailers can significantly reduce their risk profile and protect both operations and customer trust.

We list the best antivirus software in 2025 for PC.

This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro

Here are the answers for The New York Times Mini Crossword for June 19.

• Google’s new Gemini 2.5 Flash-Lite model is its fastest and most cost-efficient
• The model is for tasks that don't require much processing, like translation and data organization
• The new model is in preview, while Gemini 2.5 Flash and Pro are now generally available

AI chatbots can respond at a pretty rapid clip at this point, but Google has a new model aimed at speeding things up even more under the right circumstances. The tech giant has unveiled the Gemini 2.5 Flash-Lite model as a preview, joining the larger Gemini family as the smaller, yet faster and more agile sibling to the Gemini 2.5 Flash and Gemini 2.5 Pro.

Google is pitching Flash-Lite as ideal for tasks where milliseconds matter and budgets are limited. It's intended for tasks that may be large but relatively simple, such as bulk translation, data classification, and organizing any information.

Like the other Gemini models, it can still process requests and handle images and other media, but the principal value lies in its speed, which is faster than that of the other Gemini 2.5 models. It's an update of the Gemini 2.0 Flash-Lite model. The 2.5 iteration has performed better in tests than its predecessor, especially in math, science, logic, and coding tasks. Flash-Lite is about 1.5 times faster than older models.

The budgetary element also makes Flash-Lite unique. While other models may turn to more powerful, and thus more expensive, reasoning tools to answer questions, Flash-Lite doesn’t always default to that approach. You can actually flip that switch on or off depending on what you’re asking the model to do.

And just because it can be cheaper and faster doesn't mean Flash-Lite is limited in the scale of what it can do. Its context window of one million tokens means you could ask it to translate a fairly hefty book, and it would do it all in one go.

Flash-Lite lit

The preview release of Flash-Lite isn't Google's only AI model news. The Gemini 2.5 Flash and Pro models, which have been in preview, are now generally available. The growing catalogue of Gemini models isn't just a random attempt by Google to see what people like. The variations are tuned for specific needs, making it so Google can pitch Gemini as a whole to a lot more people and organizations, with a model to match most needs.

Flash-Lite 2.5 isn’t about being the smartest model, but in many cases, its speed and price make it the most appealing. You don’t need tons of nuance to classify social media posts, summarize YouTube transcripts, or translate website content into a dozen languages.

That’s exactly where this model thrives. And while OpenAI, Anthropic, and others are releasing their own fast-and-cheap AI models, Google’s advantage in integration with its other products likely helps it pull ahead in the race against its AI rivals.

You might also like

• Google Gemini 2.5 Flash promises to be your favorite AI chatbot, but how does it compare to ChatGPT 4o?
• Gemini's new Scheduled Actions feature puts catching up with ChatGPT on its dayplanner
• Google Gemini 2.5 just got a new 'Deep Think' mode – and 6 other upgrades

At the risk of sounding like someone who’s old before his time, I have a fairly substantial list of tech pet peeves.

At the lower end of the scale, I don’t understand folks who hold their phone at a distance when having a conversation, nor am I a fan of using a phone without a case. But if there’s one thing that I just can’t get my head around, it’s the enduring popularity of Apple's pro-level iPhones.

Don’t get me wrong, I have nothing against the likes of the iPhone 16 Pro. In fact, as a long-time iPhone user, I respect the device for being not just one of the best iPhones yet, but also one of the best phones, period. However, there seems to be a misunderstanding about who these top-tier iPhones are for.

It’s a conundrum that feels far less pronounced in the Android world, particularly as, from my experience, I tend to see tons of people rocking well-priced mid-range phones like the Samsung Galaxy A56. With that in mind, I think it’s time to set the record straight among Apple’s closest devotees.

I’m talking specifically to those who have yet to pick up one of the latest iPhone Pros in the hopes that I can convince you of why you don’t need one, and how you can find a better deal overall by opting for a different Apple device.

The clue is in the name

The iPhone 16 Pro Max running iOS 18 (Image credit: Future / Lance Ulanoff)

I will admit that there are some aspects of the iPhone 16 Pro that make it an alluring buy to an unsuspecting upgrader. As has already been discussed in detail on TechRadar, Apple's 120Hz ProMotion display is gorgeous, and it's a shame that Apple hasn’t yet seen fit to lift the refresh rate on the iPhone 16 beyond 60Hz.

The titanium build of the latest pro-level iPhones also sounds like a tempting concept, particularly if you fall into the category of those who prefer not having a case on their phone, or are liable to drop their handset on a somewhat regular basis.

These are great features to have, but you can’t tell me that they are worth the $200 / $200 / AU$250 upsell against the price of the standard iPhone 16. So, the question remains – what are you really paying for in a phone that costs $999 / £999 / AU$1,849? It’s the cameras.

I’ve been using the iPhone 16 Plus for some time now, and its dual camera setup hasn’t let me down yet.

The triple-sensor array on both the 16 Pro and the iPhone 16 Pro Max is nothing short of exceptional, and while the triangular design they carry has become something of a status symbol in itself, I have to be honest – by going for a Pro, you’re only buying extra features that you don’t need, because the cameras on the iPhone 16 are already great.

I’ve been using the iPhone 16 Plus for some time now, and its dual camera setup hasn’t let me down yet. It’s held up by the constant refinement of Apple’s behind-the-scenes computational processing that makes it nearly impossible to take a bad picture.

The only thing missing on the standard 16/16 Plus phones is the ability to shoot in Apple ProRaw and the LOG video format, but both of these features can only be put to use properly by professionals. If you’re a content creator or a professional photographer, these features are well worth the investment as you’ll get stunning quality in return. But for the average consumer, they're overkill.

Obsessing over cameras also overlooks the most crucial feature of all iPhones, the thing that keeps folks returning to Apple again and again: the software.

iOS is king for a reason

iOS 18 provides a great experience on all recent iPhones (Image credit: Apple)

Speaking for myself, there’s a reason why I’ve found it so hard to go back to Android, and it’s not just the digital ‘walled garden’ that Apple has created that makes such a feat trickier than it should be.

iOS is just easy to use, very intuitive, and brilliantly designed.

Even small things like the precise alignment of widgets are comforting – a feeling that’s exacerbated by Apple having some of the best versions of key apps around. The Weather app, for example, is clean and easy to understand, and Apple News is by far the most comprehensive app out there for staying on top of current events, particularly if you have a subscription to Apple News Plus.

This is why I can confidently recommend the iPhone 15 to friends and family in 2025, knowing that, in spite of the phone having a readily available successor, it can still provide a great overall experience thanks to the optimizations of iOS.

Plus, there’s a case to be made that the way to enjoy Apple’s ecosystem of services at their fullest is to invest in multiple products. So, to that end, I’d recommend picking up the iPhone 16 and putting the money you’ve saved against buying its Pro-level sibling towards a pair of AirPods Pro 2 or the highly underrated Apple Watch SE 2. You'll thank me later.

You might also like

• Best iPhone deals in 2025
• iPhone 17 tipped to get a larger screen thanks to smaller bezels – and that could be its biggest upgrade
• This iPhone 17 Air dummy unit looks incredibly slim next to an iPhone 16 Plus, it’s just a shame about the big camera

• HighPoint Rocket 7604A RAID card is half the size of the previous iteration
• Delivers nearly 60GBps using four Gen5 SSDs with no power cable
• First review shows it offers strong performance across both Intel and AMD platforms

The HighPoint Rocket 7604A is a PCIe Gen5 RAID card which targets professionals needing extreme sequential throughput in compact workstations.

While it builds on the legacy of the larger Rocket 1608A model, it manages to shrink the form factor by nearly half while maintaining similar performance.

The 7604A fits into a single-slot, half-length configuration and is powered entirely by the PCIe bus, with no external power required.

Eclipses previous record-holding models

TweakTown recently reviewed the card, describing it as “a masterpiece of engineering” that delivers 59.8GB/s sequential throughput using just four M.2 Gen5 SSDs.

This performance eclipses even the company's own previous record-holding models. It achieves this with a Broadcom PEX89048A RAID controller and four Gen5 x4 M.2 slots.

Testing spanned both Intel and AMD platforms. Intel systems had the edge in benchmarks like Anvil and Blackmagic, while AMD took the lead in certain file transfer scenarios.

Paired with four Samsung 9100 Pro drives (TweakTown notes that the drives must be bare to fit the card), the Rocket 7604A achieved nearly 60GB/s sequential throughput in CrystalDiskMark. "Better than any AIC we’ve ever encountered,” the site’s Senior Hardware Editor, Jon Coulter, observed.

On ATTO, it delivered up to 54GB/s, more than twice the throughput achieved with the 1608A using eight Crucial T705 drives.

TweakTown also reported that the 7604A broke multiple lab records, scoring 93,000 points in Anvil’s benchmark, far surpassing any previous flash-based AICs.

Users can configure software RAID via Windows, which supports RAID 0 and RAID 1, or use HighPoint’s own configuration utility to unlock additional options like RAID 10. The card also supports PCIe Gen4 SSDs, though throughput is reduced when used in that mode.

At $999, down from its original asking price of $1999, the Rocket 7604A is less expensive than its predecessor and many competitive solutions. It clearly isn’t made for casual users, but for anyone needing peak throughput in a constrained space, this card definitely delivers.

TweakTown awarded it 98% (dropping a few points for performance and value, but scoring the maximum for quality and features) and and named it Editor’s Choice.

You might also like

• These are the fastest SSDs you can buy right now
• What is RAID and JBOD?
• Build your own superfast virtual 32TB Gen5 SSD with this RAID PCIe Gen5 card

Serie A giants kick off their FIFA Club World Cup campaign on Wednesday at Audi Field against Abu Dhabi outfit.

There's nothing quite like the excitement of a new console; feverishly whipping off the packaging, setting up your user account, and loading up your games to settle in for an hours-long induction to your new system.

Thrilling though the process may be, there's a fundamental step all too often skipped: adjusting your settings. From Display and Audio settings to User, Lock, and software settings, there's plenty to tweak in your Switch 2.

I've spent a week with the console, and there are some must-change settings you should adjust before getting started; here are my recommendations.

1. HDR settings

(Image credit: Future / Nintendo)

Nintendo’s latest console supports HDR, and you can easily toggle this on and off within the settings. Simply head to Settings > Display > HDR Output and make sure this setting is on by default.

Don’t stop there, though, because there’s a second setting which allows you to choose which games it’s enabled for. Scroll down in the Display menu, and you'll see (confusingly) another HDR Output option. Select this, and you can choose between 'Always Enabled', 'Compatible Software Only', and 'Disabled'.

I’d recommend switching it on for compatible games instead of the default always-on setting to make sure non-compatible games look as good as ever.

2. Preserve the battery life

(Image credit: Future / Nintendo)

If you’ve suffered from battery degradation on your first-generation Nintendo Switch, you’ll be delighted to know that the Switch 2 offers a setting that caps your battery life at around 90 percent while it's on charge, which should help your battery long-term. Simply head to Settings > System > Stop Charging Around 90%.

You can easily toggle this on and off any time, so if you want a full charge every now and then for a long day of gaming in handheld mode, it’s just a matter of a quick trip to the settings. Alternatively, you can simply outsource the load and try a portable battery for your Nintendo Switch 2.

3. TV resolution

(Image credit: Future / Nintendo)

Gamers, rejoice - the Nintendo Switch 2 can support screen resolutions up to 4K, albeit at a 60Hz refresh rate and 60fps for most titles, but you might have different ideas for your new console. Again, head to Settings > Display > TV Resolution.

Within the settings, you can toggle automatic resolution detection or manually set the resolution for your TV, especially handy if you would prefer the higher refresh rates available in 1440p or 1080p resolutions.

4. Change your lock settings

(Image credit: Future / Nintendo)

(Image credit: Future / Nintendo)

Depending on who else will be using your Switch, you may want to change your Lock Screen settings with the system lock menu.

Head to Settings > User, where you can select to Skip Selection Screen if you're the only one using the console regularly. Alertanitlvey, head to Settings > System > Console Lock. Here, you can set a PIN to keep prying eyes and grubby hands off your new console, but you can also opt to add parental controls using the dedicated Nintendo Switch Parental Controls app.

5. Activate Dark Mode

Sure, this one is a preference-based tip, but personally, I don’t see why you’d prefer to use the standard white theme over dark. Especially if you play mostly in handheld, it’s a great way to conserve power and give your eyes some rest.

Once again, navigate to Settings > Themes and select between Basic White and Basic Black.

You Might Also Like...

• 3 chargers I’ve tested and recommend for giving your Nintendo Switch 2’s battery life a boost
• Missed out on a Nintendo Switch 2? Here's why the original Switch console might still be worth a look instead
• Upcoming Switch 2 games to play in 2025

Find the top internet providers in the Minneapolis area for your budget, speed and neighborhood.

If you purchased the Little Remedies Honey Cough Syrup for your child, discontinue use immediately and contact the company for reimbursement.

• Sysdig exposed how a trusted GitHub feature can silently hand control to attackers
• pull_request_target isn’t just risky, it’s a loaded weapon in the wrong hands
• Even top-tier security projects like MITRE’s can fall to simple GitHub workflow misconfigurations

Experts have revealed several critical vulnerabilities in GitHub Actions workflows which could pose serious risks to some major open source projects.

A recent investigation by Sysdig’s Threat Research Team (TRT) has exposed how misconfigurations, particularly involving the pull_request_target trigger, could let attackers seize control over active repositories or extract sensitive credentials.

The team demonstrated this by compromising projects from well-known organizations such as MITRE and Splunk.

GitHub Actions: A powerful tool with dangerous pitfalls

GitHub Actions is widely adopted in modern software development for its automation capabilities, but this convenience often hides security risks.

“Modern supply chain attacks frequently begin by abusing insecure workflows,” the report states, noting how secrets like tokens or passwords embedded in workflows can be exploited if improperly secured.

Despite available best practices and documentation, many repositories continue to use high-risk configurations, either from oversight or a lack of awareness.

At the core of the problem is the pull_request_target trigger, which runs workflows in the context of the main branch.

This setup grants elevated privileges, including access to GITHUB_TOKEN and repository secrets, to code submitted from forks.

While intended to facilitate pre-merge testing, this mechanism also allows execution of untrusted code, creating an attack surface that is easily overlooked.

The risks are not hypothetical, they are real.

In the Spotipy repository, which integrates with Spotify’s Web API, Sysdig discovered a setup where a crafted setup.py could execute code and harvest secrets.

In MITRE’s Cybersecurity Analytics Repository (CAR), attackers were able to execute arbitrary code by modifying dependencies.

Sysdig confirmed it was possible to take over the GitHub account associated with the project.

Even Splunk’s security_content repository had secrets like APPINSPECTUSERNAME and APPINSPECTPASSWORD exposed, despite the limited scope of the GITHUB_TOKEN.

Developers should reassess the use of pull_request_target, considering safer alternatives - Sysdig recommends separating workflows, using unprivileged checks first, and only allowing sensitive tasks after validation.

Limiting the capabilities of tokens and adopting real-time monitoring with tools like Falco Actions can also provide vital protection.

You might also like

• Take a look at the best malware removal options around
• We’ve rounded up a list of the best endpoint protection tools
• Check out the best antivirus for extra protection too

Get the gains you crave by eating right.

The carrier's prepaid offerings get the same price locks as its premium monthly plans.

• Mailchimp’s subtle updates are stacking up to challenge what we expect from SMB software
• Integrations with TikTok, Meta, and Google are finally making Mailchimp marketing feel connected
• Metrics Visualizer offers 40+ variables, but feels like overdue functionality rather than innovation

Mailchimp’s continued transformation from a straightforward email marketing service into a broader business platform seems less like a pivot and more like a quiet evolution.

Over the past year, the company has introduced more than 2,000 updates, most of them small but collectively significant.

These updates aim to simplify customer engagement and automate key marketing workflows, quietly nudging Mailchimp toward becoming a top CRM offering - at least in ambition, if not yet in capability.

Mailchimp expands beyond email marketing

At its recent FWD: London 2025 event, Mailchimp announced a wave of new features aimed at helping small and mid-sized businesses get more from their customer data.

These include direct lead integrations with platforms like Meta, TikTok, LinkedIn, Google, and Snapchat.

Marketers can now bring in social campaign leads more efficiently and feed them into Mailchimp’s upgraded automation flows for hyper-personalized messaging.

This, paired with over 100 new pop-up templates, seems like a step toward making Mailchimp feel less like a glorified newsletter tool and more like a proper pipeline manager.

“Mailchimp is evolving into the essential bridge between advertising and customer relationships for businesses, seamlessly connecting ad campaigns to powerful marketing automation that nurtures leads and drives sales,” said Ken Chestnut, Director of Global Partner Ecosystem, Intuit.

“We're closing the loop between advertising, marketing automation, and powerful customer insights, giving businesses the tools to engage at the right time and place of the customer journey, from attracting new leads and nurturing relationships to driving conversions and building lasting loyalty.”

Still, it’s hard to ignore that these features look like a patchwork of add-ons rather than a coherent CRM suite, at least for now.

Freya Doggett from Serpentine Galleries acknowledged the improvements but also hinted at the ongoing complexity many users still face.

“It feels like we're not having to do as much digging or joining the dots as much, which is really nice…Mailchimp really simplifies things that are complicated by nature.” It's a compliment, but a cautious one.

The new Metrics Visualizer introduces over 40 reporting variables across email and SMS channels.

Marketers can now assemble custom reports with much greater clarity, a welcome step for anyone still juggling data from multiple platforms.

If Mailchimp hopes to contend with true CRM systems or even compete with the best email marketing service options out there, this kind of cross-channel insight will be essential.

What’s still ahead might be more telling than what’s here now. Mailchimp is pushing toward becoming an all-in-one growth platform, but it's not quite the best website builder, nor a fully mature CRM system, just yet.

You might also like

• Check out our roundup of the best online collaboration tools
• These are the best productivity tools
• LG has a new 5K monitor with a Thunderbolt 5 port, and I love that it is curved and has a LAN connector

Here are hints and the answers for the NYT Connections: Sports Edition puzzle, No. 269, for June 19.

Here are hints -- and answers -- for the NYT Strands puzzle No. 473 for June 19.

Here are some hints -- and the answers -- for the NYT Connections puzzle for June 19, #739.