Technology

RAM prices are continuing to rise, and while we're a long way from costs returning to normal, I've been tracking down the best savings on the Corsair Vengeance line of DDR5 memory. One that stands out to me right now is this Corsair Vengeance 32GB DDR5-6000 kit is now $560 (was $626) at Amazon

As a dual-profile kit, it supports AMD EXPO and Intel XMP. But if you’re building or upgrading an AMD Ryzen PC, then DDR5-6000 with CL30 timings is the memory most builders aim for. This Corsair kit nails both numbers.

• Best for: PC builders putting together an AMD Ryzen 7000 or 9000 system who want fast, reliable memory that sets up with one click.

• Why we like it: DDR5-6000 speeds at tight CL30 timings, AMD EXPO and Intel XMP profiles for easy setup, and a low-profile heat spreader that clears big air coolers.

Vengeance 32GB (2 x 16GB) DDR5-6000 CL30: was $625.99 now $559.99
A two-module 32GB (2 x 16GB) DDR5 kit (model CMK32GX5M2B6000Z30) rated at 6000MT/s with CL30 timings at 1.40V. It supports both AMD EXPO and Intel XMP, and uses a low-profile aluminum heat spreader without RGB lighting.View Deal

Why We Recommend It

Corsair’s Vengeance line is one of the most popular choices among PC builders, and this kit is tuned for AMD, with an EXPO profile that sets it to its full 6000MT/s at CL30 with a single BIOS setting. That speed and latency combination is widely considered the sweet spot for Ryzen 7000 and 9000 processors, although it is a dual-profile kit for Intel PCs, too.

Price Context & Historical Value

Memory prices have climbed sharply over the past year, so $559.99 is far more than a 32GB DDR5 kit cost not long ago. This deal takes the edge off, but with soaring RAM costs expected to last years, this is one of the better RAM deals I've seen for PC builders.

Should you buy it?

✅ Buy the Corsair Vengeance DDR5-6000 32GB if... you’re building an AMD Ryzen 7000 or 9000 PC and want memory that runs at its rated speed with one click.

❌ Skip the Corsair Vengeance DDR5-6000 32GB if... your PC uses DDR4 or you want RGB lighting.

Also consider

Vengence 32GB DDR5-6000 RAM kit: was $545.99 now $509.99
Two 16GB DDR5 modules running at up to 6000MT/s with CL36-44-44-96 timings and AMD Expo and Intel XMP 3.0 support for one-click overclocking. Each module features ten individually addressable RGB LEDs across a panoramic light bar, controllable through Corsair's iCUE software, along with onboard voltage regulation for more stable overclocking.View Deal

• See all desktop memory at Amazon

• First phone with three 200MP cameras
• A 50MP selfie camera completes the ultra-wide (0.6x), wide (1x) and telephoto (3x) array
• A photographer's kit includes a 300mm teleconverter lens

There's yet another Pro Max phone in our midst, and this time it's the Oppo Find X10 Pro Max that rivals the iPhone 18 Pro Max, following the Vivo X500 Pro Max and Xiaomi 18 Pro Max. For photographers, Oppo's new handset could top the lot as one of the best camera phones for 2026.

I had a good week with the Oppo Find X10 Pro Max ahead of its launch on October 21, including several days in Lisbon, Portugal, where I had the chance to really put the phones camera through its paces. Our full review by Luker Baker is already live, too.

It packs a slightly simpler camera array to last year's Oppo Find X9 Ultra — the company's flagship cameraphone — with an improved ultra-wide f/2.2 (0.6x), a wide f/1.5 (1x) and a telephoto f/2.1 (3x) camera.

Each of those cameras offers the option for 200MP images — that's right, it's the first phone with triple 200MP cameras. Of course, there's a f/2 selfie camera too, with up to 50MP stills.

@techradar

♬ Uncasually - Bonobo Tim ColemanTim ColemanTim ColemanTim Coleman

Video specs impress too — up to 8K / 30fps video with O-Log 2 color profile, 4K up to 120fps, plus Open Gate video. These are formidable photo and video specs, but how good are the images the Find X10 Pro Max produces?

For me, there's an appealing natural look to most of the photos I've snapped with the Find X10 Pro Max, certainly when compared to the likes of the Samsung Galaxy S26 Ultra. I've included some of my favorite shots so far, below, with notes explaining the camera features.

The Find X10 Pro Max costs £1,499 for the 12GB + 512GB version. It's not sold in the US, while Australia availability is TBC.

Oppo Find X10 Pro Max sample gallery: portrait modeWhen shooting towards the sun, there is lens flare Tim ColemanBut the tones are balanced nicely here — not too vibrant compared to other phones that I've testedTim ColemanI used the 3x lens here. Using portrait mode, the background can be blurred even more in the phone's photo editorTim ColemanTim ColemanTim ColemanI opted for the wide 1x lens for this portait in a tuktukTim ColemanAnd here's the same shot using the 3x lensTim ColemanTim ColemanTim ColemanTim ColemanOppo Find X10 Pro Max sample gallery: zoom rangeThe 0.6x ultra wideTim Coleman1x wide (main camera)Tim ColemanAnd 3x telephotoTim ColemanHere I start at the 1x wideTim ColemanThen the 3x telephotoTim ColemanAnd this is the 6x setting, which is a digital zoom from the 3x telephoto cameraTim ColemanAnother example of using the 6x zoom settingTim ColemanOppo Find X10 Pro Max sample gallery: 300mm teleconverter lensThe 300mm teleconverter lens accessory works with the camera's 3x telephoto camera, which can shoot up to 200MP stills though its f/2.1 lens. The sensor size is 1/1.56-inch, which is slightly smaller than the one in the Find X9 UltraTim ColemanOppo Find X10 Pro Max sample gallery: ultra-wideThe Find X10 Pro Max has one of the best ultra-wide (0.6x / 13mm focal length) cameras I've used in a phoneTim ColemanThe same scene but with the wide (1x main) cameraTim ColemanOppo Find X10 Pro Max sample gallery: general shotsLow light performance is very good, even using the 3x telephoto camera like I have here. Tim ColemanAuto HDR does a good job keeping detail in this scene, without feeling overly processed. Overall, picture quality is very naturalTim ColemanI used the 'Master' mode here, which is Oppo's version of a Pro mode, where I had full control of exposure. I wanted the shadows dark to make the person stepping into the light stand out, so I did negative exposure compensationTim ColemanI did fid lens flare to be an issue at times. In this scene, I would expect it to be better handled given the sun is out of the frameTim ColemanTim ColemanI'm not a fan of the auto HDR in this scene. To my eye, the shadows in the arch were much darker and how I envisaged the scene. Tim ColemanTim ColemanTim ColemanTim ColemanTim ColemanTim ColemanTim ColemanTim ColemanTim ColemanTim ColemanTim ColemanTim ColemanTim Coleman

• Amazon is launching five new Blink security cameras
• This includes its farthest-reaching camera yet, and its first pan-tilt-zoom device
• All five models are available to preorder in the US, with international availability yet to come

Amazon is refreshing its range of Blink home security cameras with five new models, introducing the company's first-ever 4K, spotlight, and pan-tilt devices, which are now available to preorder in the US.

The first two of Blink’s new models are new additions to its existing XR lineup — one being the walkie-talkie-looking Blink Frontier XR+, a device built for larger homes in remote locations and the company’s ‘farthest-reaching camera yet’. It’s available to preorder in the US now for $199.99, which includes a Sync Module XR+.

(Image credit: Amazon / Blink )

Unlike standard homes, properties with long driveways and surrounding land, or even job sites that are far out from the main building are more difficult to surveil. Amazon has designed the Blink Frontier XR+ to reach these faraway areas without it having to be close to the main hub, and can reach areas up to 7,000 feet away from the main hub with a clear line of sight, but requires a Sync Module XR+ to achieve this.

The other device coming to the XR lineup is the new Blink Outdoor 2K XR+, which also requires a Sync Module XR to push beyond standard Wi-Fi range. Blending 2K video with 1080p resolution, the camera packs a 115-degree field of view and can reach 800 feet away from the Sync Module XR with obstruction, or up to 2,700 feet with nothing in the way.

Likewise to the Blink Frontier XR+, the Outdoor 2K XR+ is handy for keeping an eye out on extended driveways and gates, and can be preordered now for $149.99 (which also includes a Sync Module XR).

(Image credit: Amazon / Blink)

Not only is Blink launching its farthest-reaching camera, it’s also releasing its inaugural 4K device. The Blink Mini 4K+ ($79.99) is a compact model built for both indoor and outdoor use, fitted with a 115-degree field of view and dual-band Wi-Fi 6 that’s ‘built to capture detail that lower-resolution cameras miss’, Amazon shares.

While it packs standard home security features such as two-way audio, you’ll need to sign up for a compatible Blink subscription plan to take advantage of features such as Smart Alerts with person and vehicle detection.

The new $109.99 Blink Spotlight Cam 2K+ marks another first for the maker of the best home security cameras, being its first battery-powered spotlight camera that uses hi-res video and built-in illumination to boost surveillance quality after dark. Its wireless setup gives you more flexibility placement-wise, allowing you to place it in the areas you feel need added surveillance.

(Image credit: Amazon / Blink)

Lastly, Blink is launching its first pan-tilt-zoom device with the Mini Pan-Tilt 2K+, the cheapest model in the new lineup at $49.99. Designed for both indoor and outdoor monitoring, Blink’s first pan-tilt camera has 350-degree pan and 115-degree tilt for wide viewing angles, but it doesn’t just capture a static frame — it follows action at the same time. That said, if you want to use it outdoors, you’ll need a Blink Camera Outdoor Adapter, which is sold separately.

(Image credit: Amazon / Blink)

As mentioned, all five devices are available to preorder in the US now, and customers in Canada, the UK, Germany, France, Italy, Spain, the Netherlands, Belgium, Australia, and New Zealand can also preorder the Blink Mini 4K+ and Blink Mini Pan-Tilt 2K+. As for the Blink Frontier XR+, Blink Outdoor 2K XR+, and Blink Spotlight Cam 2K+, these will be available in Canada, but we don’t know when they will be available internationally.

Apple’s first foldable has a lot going for it, but there may be some compromises you aren’t expecting. See for yourself if the Duo is for you.

• A major PHP vulnerability has affected scores of websites
• Many popular sites have gone offline or restricted their operations
• Government sites across Europe have also been affected

A major flaw found in the PHP coding language that powers an untold number of websites across the internet has seen scores of sites taken offline as they attempt to patch out the severe vulnerability.

If you’ve found your favorite website has been unavailable over the last few days, there’s a chance it’s related to this security incident.

Here, we’ve put together a list of as many affected websites as we can find, along with reasoning given by the sites where possible. You can also follow all the latest news in our PHP crisis liveblog.

Global sites1. Wikimedia / Wikipedia

(Image credit: Wikimedia / @oscarmike88)

The Wikimedia Foundation said it had taken some services offline to patch the PHP security vulnerability.

The group runs popular websites like Wikipedia and said in a blog post that “You may see outages for our wikis as we work on this, and we have deliberately taken many of our supporting services offline until they can be safely patched.”

The organization said this includes services such as Toolforge and Cloud VPS, while a separate post said that Wikimedia Cloud Services and other tools were affected.

2. Internet Archive

An update from Brewster Kahle on today's outage. https://t.co/Gukju5sKFOOctober 21, 2026

The Internet Archive, which backs up pages across the internet, was offline on October 21. The organization posted on X to say that “Archive.org is currently offline. We are working to restore service now,” although this was not definitively linked to the PHP incident.

Internet Archive founder Brewster Kahle called his organizations operations staff “heroes” due to their actions in limiting the damage.

3. Orange Telecom

(Image credit: Getty Images / Chesnot)

The telecommunications giant Orange has announced thats it's "temporarily" suspended access to several of its websites and apps that use PHP.

That move affects dozens of countries, mostly in Europe but also Africa and the Middle East. Orange called it a "precautionary" measure and that each country would communicate which sites have been affected locally.

That could cause a lot of confusion in some regions — for example, in France Orange has over 34 million customers. Orange said it "apologizes to impacted customers and users for any inconvenience caused".

Other popular sites

Many other high-traffic websites were affected or taken offline in response to the PHP crisis. That included several of the BBC news site’s pages, message board 4chan, school community site Pinboard, wiki hosting site Miraheze, and mapping tool OpenStreetMap all either went offline or restricted their operations.

Some major sites paused operations without mentioning PHP. That included the likes of Nintendo, productivity tool Asana, language-learning platform Duolingo, and games storefront GOG.

And several games also went offline, such as Pokémon Sleep, Umamusume: Pretty Derby, Granblue Fantasy, and Princess Connect! Re:Dive.

UK sites

Consistent with guidance from the National Cyber Security Centre (NCSC), we have taken our website offline in view of the critical security issues affecting PHP. We will continue to follow further guidance.For more information, see the NCSC advisory: https://t.co/A3qp8ESZtfOctober 21, 2026

A UK minister has revealed that 32 government services are currently offline due to the PHP security threat, while a spokesperson added: "Our work has begun with OpenAI and NCSC to fix vulnerabilities in government systems".

Meanwhile, the country’s Office for Budget Responsibility took to X on October 21 to announce that “Consistent with guidance from the National Cyber Security Centre (NCSC), we have taken our website offline in view of the critical security issues affecting PHP. We will continue to follow further guidance.” As of October 22, the Office’s website is back online.

The National Cyber Security Centre also warned organizations to identify where PHP was used across their systems and update to the latest version of the coding language as soon as possible. It added that “If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.”

Several local government websites also went offline in the UK, including those of Edinburgh Council, Oxfordshire County Council and Hillingdon Council.

Europe

A large number of European governmental and commercial websites have been taken offline while patches are rolled out for the PHP vulnerability. That includes those below:

• Belgium: The Foreign Ministry
• Czechia: The national government website
• Denmark: Municipal IT company Kombit
• Finland: Public government service websites
• France: Local government (prefecture) websites run by the Interior Ministry
• Germany: The federal IT service provider ITZBund
• Netherlands: The National Cyber Security Centre
• Netherlands: The Port of Rotterdam
• Netherlands: Government website Overheid.nl
• Netherlands: National football association KNVB
• Netherlands: The ‌websites of ⁠the five largest political parties
• Netherlands: The websites of many national hospitals

NordVPN is without a doubt, the top VPN service for most people based on our tests. It's fast, feature-rich, and does everything you'll likely need from a VPN. And currently, a range of NordVPN plans are on sale with up to 78% off.

These two-year subscriptions offer an extra three months free, for a total of 27 months' protection. Both Complete and Prime (called Ultimate Max in the UK) plans offer good value for money for professionals. They couple antivirus, scam and spam protection, ad blocking, and more security tools. There's also a password manager, and 1TB cloud storage. Prime/Ultimate Max also adds Cyber Insurance against identity theft.

• Best for: Professionals and frequent flyers who want to use public and hotel Wi-Fi securely, stream content, and get security tools for extra protection without a monthly subscription.

• Why we like it: consistently fast speeds and near-flawless streaming unblocking in our testing, plus antivirus, ad and tracker blocking, a password manager, and 1TB of encrypted cloud storage.

• What you need to know: Our review does flag that features vary across platforms, and some extras, like scam call protection, currently work only on Android.

Prime 27-month plan: was $666.63 now $188.73
NordVPN’s plans include servers in over 120 countries, Threat Protection antivirus with malware and phishing defense, ad and tracker blocking, Dark Web Monitor Pro, call and message scam protection, NordPass password manager, and 1TB of encrypted cloud storage. All plans come with a 30-day money-back guarantee.

UK price: now £161.73 (was £561.33) View Deal

Why we recommend it

NordVPN sits at the top of our best VPN guide, and in our review, we scored it 4.5 stars. Our lab testing showed consistently strong speeds and near-flawless streaming unblocking. Its apps are simple and consistent, and its phishing protection proved strong.

Price Context & Historical Value

This is Nord's early Black Friday sale, so expect these prices to be as good as they get for some time now. It's one of the cheapest ways to get NordVPN’s full security bundle, including its antivirus package. The catch is renewal: after the first 27 months, the plan renews at full price unless you cancel or switch, so set a reminder. If you want the extra tools, it’s worth buying now.

Looking for more savings? We've tracked this month's best VPN deals.

Should you buy it?

✅ Buy the NordVPN Prime if... you want a fast, top-rated VPN for streaming and travel, you’d use the password manager and 1TB of cloud storage, or you like the idea of paying once for more than two years of coverage.

❌ Skip the NordVPN Prime if... you only need a VPN, since the Basic plan is a little cheaper.

• One in two CIOs expect to miss their AI ROI targets in 2027
• AI budgets are rising, but not enough to keep up with inflation
• A quantum computing breakthrough could put further strain on budgets

New research has claimed AI is set to account for a fifth of all business technology spend in 2027 as companies invest more in thought-out deployments.

However, despite the fact that experimentation is evolving into meaningful adoption, more than half of the CIOs surveyed in Forrester's latest State Of AI Survey 2026 expect to miss their AI ROI targets next year.

The report also details what it means for AI to be considered a success – around half (45%) of CIOs prefer to see an ROI within one year to consider their rollouts a success.

AI still isn't delivering promised ROI

Over the last year, just one in five (22%) AI decision makers have reported a positive impact on their earnings.

Looking ahead, Forrester predicts that businesses will finally become better at linking their AI investments to actual financial outcomes.

All of this, of course, comes amid ongoing financial pressures. Although most tech leaders expect to increase their budgets next year, just one in two (53%) expect this to be above inflation, meaning many are just struggling to keep up with rising costs.

Forrester also touches on rising AI consumption costs, such as per-token costs, with many AI providers shifting from seat-based subscriptions to consumption-based models.

To this tune, the research firm expects cheaper, open-weight models to become more popular across many use cases as companies look to keep a lid on costs.

"Open-weight models such as Gemma, Llama, or Qwen are good enough for the enterprise workloads that generate the most token volume, such as document processing, customer support conversations, internal knowledge search, and the routine substeps inside agentic workflows," the report explains.

And just to rub salt in the wound, Forrester also believes we could see a meaningful breakthrough in quantum computing as soon as next year, accounting for even more budget consumption. Nine in 10 (87%) businesses familiar with quantum computing currently have no resources at all allocated to the matter.

All in all, then, it looks like the next year could see budgets strained even further as enterprises continue to struggle with meaningful AI ROI.

Via The Register

• Clayface's director has discussed its position on the DC Universe timeline
• Chronologically, it takes place before Creature Commandos and Superman
• However, the year it's set in is meant to be "deliberately unspecific"

Clayface's director has done little to clarify where it officially sits on the DC Universe (DCU) timeline.

In an exclusive chat with TechRadar, James Watkins declined to confirm the exact year that the Batman villain's standalone live-action movie is set in. That's despite of the fact that we already know it takes place prior to every other DCU film and TV show released to date.

Indeed, responding to a fan on Threads in April, DC Studios co-chief James Gunn confirmed that, chronologically, Clayface precedes Creature Commandos season 1 and Superman.

Then, in July, Gunn's fellow co-head Peter Safran told Entertainment Weekly (EW) that the Clayface we see in Creature Commandos is the same version of the shape-shifter we'll see in Clayface. With the adult animated series believed to be set in late 2024, Clayface must take place prior to events depicted in Creature Commandos' debut outing.

Clayface made his DCU debut in season 1 of Creature Commandos (Image credit: Max)

Since then, season 1 of Lanterns, which recently came to an end on HBO Max, included a storyline that was set in 2016. Considering Gunn and Safran will have known that prior to giving their aforementioned answers, logic would dictate that Clayface takes place before 2016, too.

Armed with that knowledge, I pressed Watkins for a definitive answer on Clayface's exact position on the DCU timeline. Does its story occur in 2015? Five years before that? Heck, even a decade? Unfortunately, Watkins danced around my query, instead choosing to say that the year it's set in is supposed to be intentionally vague.

"[It's] deliberately unspecific," Watkins replied. "I mean, we're in a kind of a world which is... it's modern, but it also has a sort of analog feel and a retro-art school feel to the world. One of the things that really attracted me about the project was the standalone nature of it, so I didn't really have to worry about [the DCU timeline], or look beyond the parameters of the world I was creating."

I guess that's that, then! Hopefully, Gunn and/or Safran can provide some clarity once the body horror comic book flick has launched worldwide. For now, if you're looking for more coverage on the latest DCU Chapter One project, my Clayface review should be your first port of call.

Clayface is out now in multiple international territories, and releases in US theaters on Friday, October 23.

On September 14th, 2026, AI frontier lab OpenAI called on UK lawmakers to impose regulations to tackle the security threats posed by the rapid development of artificial intelligence. This follows an unsolicited attack from an OpenAI agent that broke the firewalls of startup Hugging Face earlier this year.

Cybersecurity isn’t a new issue for business leaders, but its significance is increasing in the age of AI. Clients trust them with information, employees don’t want to disclose their salaries or investors don’t want to make their investments public.

Without clear governance and processes on the use of AI, these are all at risk of being leaked. Doing nothing poses an existential risk for firms.

A new class of security risks

AI presents great opportunities to speed up repetitive tasks, like data reporting, leaving more time for employees to produce more strategic, quality work for clients. For an agent to become useful, it needs as much context and information access as possible, but this is where there is the greatest potential for something to go wrong if not managed correctly.

For instance, agents may have access to bookkeeping, reporting, document management and CRM systems, meaning a successful attack could expose highly sensitive client information.

The main issue is LLMs have difficulty distinguishing data from instructions. An agent can interpret instructions from an email, a document or a webpage, even if those are malicious. These are called prompt injection attacks. Basically hackers manipulate generative AI systems by feeding them with malicious inputs disguised as legitimate user prompts.

Another threat is data leaking. An agent can visit a website or perform a web search and potentially release confidential information, for example by incorporating company data into a URL or a search query. This could expose sensitive data to the Internet without the company or the agent noticing.

The risk becomes particularly acute when three things come together: an agent receives untrusted inputs, accesses sensitive information and takes action in external systems – the so-called Lethal Trifecta. A malicious instruction hidden in an email, document or webpage can potentially trigger actions at a later point using the agent's legitimate permissions.

Therefore, firms need to set strict guardrails around each agent to limit what data it can access, what capabilities it has and what actions it is allowed to take. This is essential to avoid information leaks or an AI agent going rogue.

The threat sitting inside a company

AI adoption is scaling across all levels of a business, from finance to marketing, sales to product development. New research from Turbotic shows 51% of business leaders fear employees are feeding sensitive company data into unauthorized AI tools and 36% are concerned about employees using AI without oversight. This is called Shadow AI.

When an employee prompts a public AI platform, it leaks sensitive client information and receives output that looks confident but could be inaccurate. This could lead to inconsistent tone, misaligned advice or data breaches. The problem isn’t the technology itself, but it’s the lack of traceability and human review. Placing too much confidence in AI tools without the right guardrails is dangerous.

Most of the time, employees don’t even realize the security issues that pertain to AI usage.

They need to understand that experimentation outside any approved workflow or data safeguard is a security risk. Sharing sensitive information with a public model or using content generated by AI without reviewing it risks greater exposure to compliance breaches, AI slop and reputational damage.

Most importantly, employees become responsible for output they cannot explain, verify or trace.

To remove this risk, leaders need to democratize AI by giving employees access and clear guidance on the tools they’re allowed to use, how to provide the right context to AI agents, set up processes to review AI output and establish any guardrails to prevent data breaches. This approach that we call Organizational AI will make a firm more capable from security and capacity perspectives.

Managing the risks of AI

Despite increasing warnings about AI security threats, fewer than 1% of organizations have fully operationalized responsible AI, according to a report from the World Economic Forum and Accenture.

Given the risks associated with free AI usage, having a responsible AI policy is now obligatory.

Without restrictions on basic access controls, employees may be able to use AI to surface information they shouldn’t have access to, from colleagues’ salaries or confidential investor data. Once an AI agent is connected to an organization's data, weak permissions are a liability and it can more easily surface accidental access.

Anything that relates to company data, client communications, or that influences professional advice needs to be controlled by clear governance. It’s the responsibility of leaders to provide employees with auditable and transparent boundaries, and step one involves providing clear guidelines on what, when and how AI tools can be used. Then comes explainability combined with governance and oversight to generate trust.

The critical need for Organizational AI

Firms need to get the fundamentals right: What data can AI access? Where does the input come from? What systems can it connect to? What actions is it allowed to take? When must a human review or approve the output? All of these should be clearly communicated to employees and baked into processes.

Organizational AI is implementing a system that runs across the whole firm that the organization can grow into for a better client experience, team development and security management.

Companies should start now. The existential risk of doing nothing is bigger than the risk of doing it badly.

We've featured the best AI website builder.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

If you’ve wanted to try multicolor 3D printing without spending a fortune, the SparkX i7 Color Combo is one of the friendliest ways in - our colleagues at Tom's Hardware called it "a package that is hard to beat." And it's now part of the company's big Halloween sale.

Having reviewed our fair share of Creality 3D printers, this one's an easy recommendation for beginners looking for a multi-color 3D printer. Currently, the Creality SparkX i7 Color Combo is $349 (was $399) at Creality. In the UK, the same model is now £319 (was £399).

• Best for: beginners and hobbyists who want to print in up to four colors without a complicated setup.

• Why we like it: multi-color 3D printing through the low-maintenance CFS Lite spool system, a 260 x 260 x 255mm build volume, quiet operation, reliable automatic bed leveling, and a built-in camera for monitoring prints.

SparkX i7 3D Printer: was $399 now $349
The Color Combo bundles the SparkX i7 printer with Creality’s CFS Lite four-spool system. The i7 is an open-frame printer with a 260 x 260 x 255mm build volume, automatic bed leveling, and a 720p camera with LED lighting and a privacy shield.

UK price: now £319 (was £399)View Deal

Why we recommend it

While we haven't tested this newest model, our sister site Tom's Hardware scored it 4.5 stars, earning it an Editor's Choice award. The review praised its fast and quiet printing, friendly interface, and reliable automatic bed leveling. They were especially impressed by the CFS Lite, which was adaptable and refreshingly low maintenance. Complaints were minor: setup asks you to accept a lengthy privacy policy, and the CFS Lite doesn’t retract filament back onto its spools, which can get a little messy.

For more top picks, we've tested the best 3D printers.

Price Context & Historical Value

This is $50 off the Color Combo’s $399 list price, or about 13%. It also costs just $70 more than the single-color i7, which makes the four-color bundle the better buy for most people. It’s a solid, if not dramatic, discount on a printer we already rate highly.

Should you buy it?

✅ Buy the Creality SparkX i7 Color Combo if... you want an affordable way into four-color 3D printing, you value quiet operation and an easy setup, or you like being able to watch your prints remotely through the built-in camera.

❌ Skip the Creality SparkX i7 Color Combo if... you need an enclosed printer for materials like ABS, you’d rather avoid tidying up loose filament from the CFS Lite, or you want a printer with more than four colors.

• Shop the full sale at Creality

• EA has laid off 400 employees across its studios and is shutting down BioWare
• The Mass Effect and Dragon Age studio confirmed that Mass Effect 5 is canceled
• Developers and creatives across the industry have reacted to the news, calling it "unimaginable" and "heartbreaking"

EA is shutting down BioWare, the legendary studio behind Mass Effect, Dragon Age, and Star Wars: Knights of the Old Republic.

BioWare delivered the devastating news in a statement last night, saying that after more than 30 years as a pioneer in the choice-based role-playing game (RPG) genre, it will close down and that Mass Effect 5, which was in early development, is canceled.

The decision comes from parent company EA, which has confirmed major restructuring across its studios and projects, amounting to 400 layoffs, including roughly 50 roles at BioWare (via Bloomberg).

"For more than 30 years, BioWare has been more than a studio," the studio said. "It has been a home for storytellers, developers, and the players who brought our worlds to life. Baldur's Gate. Neverwinter Nights. Star Wars: Knights of the Old Republic. Dragon Age. Mass Effect. Anthem.

"Now, after more than three decades of shared adventures, BioWare is closing, and early development on the next Mass Effect project is ending. There is nothing easy about writing those words. Our focus right now is on our incredibly talented team who put their hearts into these games, and supporting one another through this transition.

"What generations of BioWare built together is something to celebrate and remember. These games became so much more because you played them, debated your choices, fell in love with the characters, and made these worlds your own. From all of us at BioWare, thank you for being the most meaningful part of our story.”

https://t.co/TicSujMWpsOctober 21, 2026

The news has rocked the internet, not just among BioWare fans, but also developers and creatives across the games industry who have shared their reactions to the announcement.

"This is not something I ever expected to see," wrote Larian Studios CEO Swen Vincke. "Larian and BioWare started their trajectories in the games industry at the same time, and BioWare led the way in making RPGs big. It's almost unimaginable that we're now entering an era where the name BioWare won't show up anymore when discussing upcoming RPGs. What a loss for all of us.

"Thank you for all the games. Thank you for the many hours of gameplay. Thank you for all the stories. You can be damned proud of what you achieved. I hope you all land well."

Casey Hudson, former BioWare GM, and Star Wars: KOTOR and the Mass Effect trilogy director, reacted to the announcement, calling it "sad news on multiple fronts - for those of us who worked there, for our friends and colleagues at BioWare who are impacted, and for fans who were looking forward to the next Mass Effect adventure."

Hudson, who is now CEO of Arcanaut Studios and is now working on a new Star Wars game called Fate of the Old Republic, added, "I started my career at BioWare and will forever be grateful to the founders, Greg and Ray, for inviting me to join in BioWare's legendary journey. Its legacy will live on through those who were part of it and continue to create games through a passion for unforgettable stories, worlds and characters."

This is sad news on multiple fronts - for those of us who worked there, for our friends and colleagues at BioWare who are impacted, and for fans who were looking forward to the next Mass Effect adventure. I started my career at BioWare and will forever be grateful to the founders, Greg and Ray, for inviting me to join in BioWare's legendary journey. Its legacy will live on through those who were part of it and continue to create games through a passion for unforgettable stories, worlds and characters.October 21, 2026

CD Projekt Red joint-CEO also shared a post, saying, "BioWare has been a massive part of CDPR history. We befriended them when localizing and selling Baldur’s Gate games in Poland, Czech, and Slovakia. And later they were [a] great help when lending us their engine for Witcher 1, sharing their wisdom and even giving us a spot at their booth at E3. I had a pleasure to visit them a few times in Edmonton and also host them in our Warsaw office. Very sad for the people affected, but also sad to see a legendary brand go down. Not a great day in the games industry."

The Game Awards founder Geoff Keighley said the news was "heartbreaking" and "I hope one day, somehow, Mass Effect will return," while Cyberpunk 2 associate game director, Paweł Sasko, said, "Baldur's Gate 1 and 2 shaped my imagination and the desire to create games. I would have never been here without BioWare igniting the fire in my heart. It inspired me, formed me, enriched my imagination, and for that I will be forever grateful. I will always remember you."

Michael Gamble, project director on Mass Effect 5 and executive producer on BioWare who worked on all the previous games in the series also shared a statement, thanking fans for their support.

"I could probably scroll for hours and continue reading the words of support for the studio, the legacy, and the impact that BioWare has had on you. It means so much to us. There is so much talent on this team of OGs, so if you are aware of any roles, please send them. I will personally vouch for everyone in my crew.

"As for me: At least I don't have to call in sick when GTA 6 comes out."

• Splunk finds 60% of firms say AI bill spikes cause more strain financially than just paying a higher but flatter baseline
• Observability and security teams are coming together, which is a huge positive
• 91% of observability leaders say they can attribute costs to a model/agent level

Splunk's State of Observability 2026 report has claimed AI costs are actually becoming less predictable for businesses as vendors shift toward consumption-based models.

All of this comes against a backdrop of rising agentic AI adoption, where agents can work independently and consume huge variances in tokens depending on the task, complexity and model choice.

More than half (55%) of the organizations surveyed say they can't effectively control their AI costs, with as many (57%) now worried their telemetry costs are higher than the actual infrastructure they're monitoring.

Agentic AI is making AI cost prediction even harder

But while there are clear challenges surrounding cost observability, artificial intelligence has led to one clear benefit – four in five (81%) now say monitoring AI workloads has increased collaboration between observability and security teams, and 73% can accurately trace problems to their underlying security causes (up from 65% last year).

Companies are also seeing more data sharing between the two teams. "This report shows that observability and security data are converging, and that teams need to collaborate more than ever," Cisco Chief Product Officer Jeetu Patel explained.

The report also highlights the relevance of observability teams within the broader AI strategy – an overwhelming 91% of observability leaders say they can accurately attribute AI costs to particular agents, models and workloads (compared with 69% of non-leaders), making this an important consideration for AI ROI concerns.

Still, shifts to pricing models and in how agents consume tokens continue to cause a headache for the finance department, with three in five saying that unexpected spikes in their AI bills cause more strain than a consistently high baseline cost, implying they'd much prefer to budget for flatter seat-based models over consumption models.

• Bose has bought Skullcandy
• The brands have worked together on headphones recently
• Acquisition all but guarantees more Skullcandy cans will get Bose tools

Bose, one of the top-tier audio companies, has spent the last few years helping out other brands with audio tuning and features, and Skullcandy is one of the highest-profile beneficiaries. Just look at the Method 360 or Crusher 1080, both of which were better for the Bose touch — and more recently the Noise Master Buds Open, which we got to try at IFA Berlin last month.

Now, Bose has decided a slice of credit is not enough; it wants the whole pie. The noise-nixing pioneer has just bought Skullcandy, in a deal which seems to guarantee the bony brand's continued success.

It sounds like little will change for Skullcandy, despite its acquisition (although you never can know with these things), but it should ensure that more of the brand's headphones will get Bose touches. Soon, you'll likely see Sound By Bose and the brand's noise cancellation in more devices, beyond the flagship ones.

That'll be particularly great for the Park City, Utah-based company's non-flagship headphones, speakers and earbuds. Skullcandy makes portable party speakers, workout headphones and buds, all at more affordable price-points than its now-parent company, none of which would likely have been in line for a Bose makeover before the acquisition.

Now, there's little for Bose to lose in using its magic touch liberally.

They Bose to the challenge

(Image credit: Future)

A few weeks ago, prior to news about the acquisition, TechRadar's Audio Editor Becky Scarrott spoke to Bose's President of Premium Audio, Raza Haider. One of her questions actually happened to be about whether Bose was empowering its rivals perhaps too much, by offering out its tech?

"We exist as a company to produce great sound, through audio research," Haider said, on September 30. "Our products are a very small way of that research manifesting itself onto human beings in the world. The more places we can find for that technology to land, the more service we're doing for the vision of the company.

"Bose cannot be that brand, or that company, that delivers all those use cases. One brand can't cover every single passion point, otherwise it becomes a plain vanilla tech giant. You might as well make washing machines, right? I'm not taking a dig at anyone, but you know what I'm talking about."

So, perhaps we had a preview of Bose's intentions then. It certainly shows that Bose has been wondering about the competition, and how best to maintain its unique positioning in the audio market.

For those of us who just love what Bose can do with ANC and can't wait for it to become more prevalent in a wallet-friendlier brand (and surely that's all of us?), things are looking very good indeed.

Facial recognition technology (FRT) is fast becoming part of everyday life in the UK.

In recent months, much of the media attention around FRT has focused on the police, as forces up and down the country roll out both retrospective and live facial recognition (LFR).

As deployment increases, so too does scrutiny. Concerns around the accuracy, privacy and efficacy, alongside debates over proportionality and whether widespread use is creating a “surveillance society”, all deserve serious consideration.

But while so much of the conversation around FRT focuses on police use, we risk overlooking the growing use of facial recognition by private organizations.

Public attitudes change depending on who is behind the camera

Public attitudes towards facial recognition are rarely determined by the technology alone. Where it is used, why it is deployed, and, crucially, who is operating it can all influence public levels of support.

There is an important distinction between FRT being used by the police to identify a wanted suspect – often for violent or sexual offences – and it being deployed by a retailer to identify someone suspected of previously shoplifting. Questions around accuracy, privacy, and the handling of biometric data are valid in both cases, but the purpose and context are very different.

This disparity is reflected in public attitudes. Earlier this year, Face Int commissioned an independent survey of 2,000 UK adults which found that almost three quarters (73%) support police use of FRT, compared with 54% who support its use in retail environments.

This does not mean that police use should evade scrutiny, nor does it necessarily mean that people oppose private sector deployment. What it does show is that public acceptance of facial recognition cannot be separated from the circumstances in which it is used, or from the organization operating it.

When police use LFR, its presence is typically made clear through marked vehicles and signage, often accompanied by advance announcements about when and where it will operate, and how data will be processed.

In retail spaces, its use may not always be as obvious, nor will the public necessarily understand what happens to their data. This is particularly sensitive: 57% of respondents to Face Int’s survey said they were concerned about how images of their faces are stored.

Moving beyond accuracy

Facial recognition is often discussed in terms of its accuracy, with many reports of individuals being falsely identified. Ensuring that the technology is accurate, robust and appropriately tested is essential.

But accuracy alone will not secure public trust. How facial data is collected, processed and stored, and governance surrounding its use, matter just as much. Indeed, 43% of the UK public stated that clear laws governing FRT would increase their trust in the technology.

In the UK, FRT is currently regulated through a patchwork of legislation, including the Data Protection Act and the Human Rights Act. This means that those deploying the technology must interpret several laws to ensure they are compliant, leading to inconsistent standards across the sector. In contrast, the EU AI Act specifically addresses biometric identification, with additional requirements to protect the public and their data due to come into effect in December 2027.

Earlier this year, the Government completed a consultation on a new framework for law enforcement use of FRT, but notably this did not extend to private sector deployments.

More recently, the Independent Commissioner’s Office (ICO) published findings from its work examining police use of FRT, stating that it was working with forces and police oversight bodies to give the public confidence in its governance and oversight.

What responsible use should look like

Greater scrutiny does not necessarily mean more restrictions. It should provide clearer expectations for how organizations capture, process and store biometric data.

Organizations must be transparent about when and why FRT is being used. Information about the purpose of a deployment, what happens to people’s data and who is responsible for it, should be readily available before the data is captured.

Privacy should also be built into FRT systems from the outset, rather than added after sensitive data has already been collected. Techniques such as hashing and other forms of biometric template protection can remove the need to capture facial images. This privacy-by-design approach should be a minimum expectation for those investing in FRT.

Additionally, organizations should only capture and retain data they genuinely need. Data relating to individuals who do not match a legitimate watchlist should not be retained, while clear retention period should apply to information that does need to be stored.

Robust security is also essential. Access should be restricted, with clear records of why, when and by whom data has been accessed. Anyone handling biometric data should receive appropriate training, and organizations must have processes in place for responding quickly and transparently to breaches.

Finally, technology should support human decision making, not replace it. While the technology is improving rapidly, facial recognition matches must still be treated as an alert requiring human review.

An opportunity for the new Government

The recent change in government and dissolution of the Department for Science, Innovation and Technology (DSIT) makes this debate particularly timely.

With DSIT’s responsibilities being spread across various departments and embedded across the Government’s wider economic and social agenda, there is an opportunity to develop a more coherent approach to facial recognition. After all, the implications of facial recognition extend far beyond the technology itself, spanning policing, the high street, data protection, security and economic growth.

The Government must ensure its response to the proliferation of FRT is cohesive, with departments working alongside regulators and the private sector.

The ICO’s examination of police use of FRT is a useful model for how scrutiny of the private sector could work. This could identify good practice and areas of concern, and inform clearer guidance or regulation.

Responsible businesses should welcome that scrutiny. Clearer standards give businesses greater certainty about what good deployment looks like, and give the public greater confidence that their biometric data will be handled appropriately.

The debate over facial recognition is not a binary choice between embracing the technology or restricting it. The question is how we can realize its benefits while ensuring its use is transparent, proportionate, accurate, and secure.

Police deployments will rightly remain part of the conversation, but as facial recognition becomes commonplace across the private sector, scrutiny must follow. Public trust will depend not only on what the technology can do, but on whether people have confidence in how it is used and how their data is protected.

We've featured the best authenticator app.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

We understand what it means to own a house, a car, a share in a company, a patent or a trademark. In each case, there is an established legal framework that defines the asset, establishes who holds it and enables it to be sold, transferred, financed or protected.

Data is more complicated. A business may have spent decades building a valuable body of data that it protects and depends upon, yet establishing precisely what constitutes that asset, and what rights are attached to it, is far less straightforward.

That uncertainty has commercial consequences. It can make data harder to value, license or share with confidence, leaving transactions heavily dependent on contracts and trust between the parties rather than an independently verifiable understanding of what the data is and how it may be used.

This is a challenge we have been exploring in the Isle of Man through the development of the Data Asset Foundations framework, which establishes the statutory basis for defined, governed data to be recognized as an asset.

With the framework now moving into implementation, a much broader question remains relevant for businesses: if we are serious about treating data as an asset, what does that actually require?

What makes data an asset?

The first point is that a data asset cannot simply mean any dataset.

For a body of data to function as a distinct asset, four fundamental questions need to be answered. What exactly is it? Not simply "our customer records", but a precise boundary: which information, covering which period, from which sources and, if the data has been worked on rather than simply collected, how it was produced.

Who may use it? What is the holder actually permitted to do, and what limits came attached to the data when it was gathered? Those limits do not disappear on registration; they travel with the asset as registration does not displace existing contractual, intellectual property or data-protection rights; those obligations continue to apply.

Who is responsible for it? There needs to be a named party accountable for keeping the asset in good order and maintaining its governance. How can others have confidence in it? A means needs to be established by which a third party can see that the asset has been independently assessed and understand its assurance status, without needing direct access to the underlying data itself.

These are relatively simple questions, but many organizations would struggle to answer all four consistently across the data they hold. Doing so requires businesses to move beyond broad descriptions of data and identify distinct bodies of information with defined boundaries, rights, responsibilities and potential uses.

That distinction has practical commercial value. Once there is greater certainty around what the asset is and the rights attached to it, there is a stronger basis from which it can be valued, licensed, shared or potentially used in financing.

Why the rules matter as much as the data

Perhaps the most important part of this shift is recognizing that a data asset is more than its underlying information. Its governance matters too. Typically, businesses hold data in one place while information about how that data should be governed sits elsewhere.

Its provenance, permitted uses, quality requirements and restrictions may be spread across policies, contracts, spreadsheets and other internal records. The relationship between the data and those rules therefore depends heavily on the organization maintaining it.

The Isle of Man's Data Asset Foundations framework provides the statutory basis for bringing the two together. The Data Asset Register, which is now being implemented as part of the framework's supporting operational arrangements, will record information defining the asset and its governance, including its identity, provenance, rights, permissions, responsibilities and means of verification.

Crucially, the underlying dataset itself will not sit on the Register. Instead, the information recorded will provide a consistent way of establishing what the asset is and the governance and rights attached to it.

There is a useful comparison with land registration. A land register does not determine whether a property is valuable or well managed. Instead, it provides certainty about what the property consists of, where its boundaries lie and who owns it, thereby reducing friction when conducting transactions based on the property.

The same principle has commercial relevance for data. Greater certainty will not create value where none exists, but it can make existing value easier to recognize and use, whether through licensing, sharing, financing or the development of new data-driven products.

For a potential investor, lender or licensee, that could make a material difference. Today, assessing a dataset may mean piecing together its provenance, permissions and governance from contracts, policies and internal systems. A defined and governed data asset can provide a clearer evidential starting point for that assessment, reducing some of the friction involved without determining the asset's value or guaranteeing a particular commercial outcome.

Making data an asset in more than name

For years, businesses have described data as one of their most valuable assets. But there is a difference between recognizing that data has value and creating the conditions that allow organizations to act on that value. Much of that challenge comes down to certainty: knowing what the asset is, where it came from, what rights attach to it and how those claims can be verified.

The Isle of Man's Data Asset Foundations framework is intended to provide that greater clarity. By creating a clear bedrock of uniform understanding, organizations' self-described most valuable asset can move from an internal resource to a defined, registered and governable asset, providing a much stronger basis for valuation, financing and commercial use.

As AI increases both the demand for high-quality data and the scrutiny applied to its use, the organizations best placed to benefit will be those that can demonstrate not simply that they possess data, but that they understand what it is, where it came from, what rights attach to it and how it is governed. Providing greater certainty around those questions is ultimately what the Data Asset Foundations framework is seeking to achieve.

We've featured the best cloud computing provider.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Websites across the globe are scrambling to ensure they are protected against possible cyberattacks this morning.

A potentially critical security flaw in the PHP programming language has meant organizations around the world need to update their systems immediately, with hackers ready to strike.

PHP has issued a series of patches which it says mitigates the issue, but users are reporting issues with some websites across the globe - we're tracking the story as it develops, and you can follow our updates here.

October 22, 2026 – 5:06 AM

News of the issue first broke yesterday, when PHP notified the security world of two critical vulnerabilites detected in its systems.

The flaws could expose countless sites to remote code execution (RCE) attacks, which could then lead to website takeovers, data theft, malicious redirects, and other similarly sinister situations.

PHP then published a security advisory giving admins a “heads up” on an incoming patch, as well as, "advance notice of an upcoming security release."

October 22, 2026 – 5:10 AMWhat is PHP?

PHP: Hypertext Preprocessor, or PHP, is among the most popular programming languages for websites and web applications in the world, so when remote code execution zero-days are found, it’s a big deal.

In its most basic form, when a user clicks on a website, PHP bring togthers the information you need, and presents it in a way you can read online.

PHP is not a new system - it has been around for decades, but as with many such crucial code systems, it flies under the radar somewhat, meaning potential flaws or issues can go undetected for years.

October 22, 2026 – 5:14 AMWhat has actually happened?

It's important to note that despite widespread headlines so far, the issue with PHP hasn't led any companies or websites to be hacked - yet.

Instead, many organizations have been forced to take down individual pages or even entire websites in order to apply the patches released by PHP to fix the issue, meaning users are unable to access certain resources.

So far, some government websites in Scotland and the Netherlands have gone offline briefly, along with a Danish IT firm which provides the nation's school communication platform.

Wikipedia and its content store site Wikimedia also saw some outages, but both appear to be back online now.

October 22, 2026 – 5:31 AMWondering how this affects you?

While most websites are back up and running, there were some that were taken offline yesterday after the news broke. Did you notice anything amiss? Tell us in the comments above, or vote in the poll to let us know what you normally do when you hear about cybersecurity issues in the news.

October 22, 2026 – 5:38 AMPHP fixes are out now - so get patching

As we've covered on TechRadar Pro this morning, PHP has now released its emergency fixes for users to download.

The issues are listed as CVE-2026-109618 and CVE-2026-109619 - the former is an out-of-memory handling bug, while the latter is a use-after-free memory error. Both were assigned a severity score of 9.2/10 (critical).

The vulnerabilities were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users can download the versions from PHP’s downloads pages, with Windows source and binaries being on the same page.

October 22, 2026 – 5:49 AMOpen source worries

(Image credit: Pixabay)

The issue may raise wider concerns about the role of open source software in propping up some of the most integral parts of the global information network - as the very thing that makes it so unique also leaves it vulnerable to flaws and security concerns.

"Much of the critical software running the world is also the least visible. Stable production code 'that just works' is now at risk due to the speed and volume of new vulnerabilities found via AI-driven discovery," says Gunnar Hellekson, vice president and general manager, Lightwell, Red Hat.

"The issues facing PHP are a reminder of just how deeply open source is woven into the systems that run global business."

"The ripple effects from vulnerabilities in foundational software like PHP can extend across entire industries. This makes it critical to have a trusted software source that helps manage this risk and, ideally, quickly responds to these new threats as they emerge."

October 22, 2026 – 6:00 AM"A finite window" to patch and protect

This is clearly an alarming issue, one which will likely affect companies of all sizes across the globe, so how quickly should businesses look to respond?

"This is a stake-in-the-ground moment for CISOs around the world," says Matt Cooke, EMEA Cybersecurity Strategist at Proofpoint.

"Organisations of every size have a finite window to shore up their cyber defences, because threats now operate at machine speed. Patch fast, know your attack surface and limit the blast radius, because that window is closing. If we don't act now, we will see more organisations forced to take their sites offline while they scramble to fix what should have been secured long ago."

October 22, 2026 – 6:12 AMWho has been affected so far?

(Image credit: Future)

With an issue as widespread as this (some reports are claiming around 70% of the web as we know it could be affected) it's tricky to list all the affected sites and businesses - mainly because many won't want to admit to any security shortcomings.

Thanks to Reuters, we do know that several European governments have seen some effect, although many of the sites are now back up online, including:

- The German digital ​ministry said federal IT service provider ITZBund had taken several websites offline due to ​the discovery of PHP vulnerabilities, although this was a "purely preventive" move.

- The French Interior Ministry temporarily took down the ​websites of local government administrative offices while awaiting the PHP patches - again, this was a preventive measure.

- Belgium's foreign ministry temporarily took its websites offline following reports of cyberattacks exploiting the PHP vulnerabilities, although this was not confirmed.

- In the Netherlands, the nation's National Cyber Security Centre ​took its public-facing sites offline, along with those belonging to the Port of Rotterdam, the Dutch national football association KNVB, the ‌websites of ⁠the five largest political parties and numerous hospital websites across the country.

October 22, 2026 – 6:22 AMWhat role did AI - and OpenAI - play?

(Image credit: Shutterstock / Mehaniq)

An interesting note about the PHP flaws is that they were detected (at least partly) by AI.

Ryan Austin, the researcher at cybersecurity firm Calif who played a major role in uncovering the PHP flaw, has acknowledged the part OpenAI's systems played in revealing the issues.

Potential PHP flaws had first been spotted back in 2024 by its own researchers, but it had to wait until July 2026 before being accepted into OpenAI’s Patch the Planet initiative, which looks to use advanced AI systems to detect and solve cybersecurity issues.

Calif, which was part of Patch the Planet, then found a more serious issue in PHP in August 2026, which was spotted by OpenAI's own systems shortly after, before the group began working on a fix.

"Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications," OpenAI's blog post noted.

"Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits."

October 22, 2026 – 7:12 AM

Supply chains could be another area hit by the PHP issue, as one affected company taking their systems offline could cause a butterfly effect across an industry.

“A single vulnerability can trigger a global domino effect across borders and industries within hours. What we’re seeing with PHP is a stark reminder that the global economy runs on complex, interconnected digital systems, and that hidden security weaknesses in them are now being found at unprecedented speed with the help of AI," notes Chris Dimitriadis, Chief Global Strategy Officer at ISACA.

“But the real concern isn’t just the vulnerability itself. It’s what it reveals about our preparedness. Cyber resilience isn’t something organisations can switch on when a crisis hits. They need to understand where they are exposed, recognise their technology dependencies and have the right people, processes and controls in place to respond quickly and effectively.

“Technology will never be completely free of vulnerabilities. The real test is whether organisations have the governance, expertise and operational readiness to prevent a security flaw from becoming a much bigger crisis. Most of all, that means investing in the next generation of cybersecurity professionals, who can use AI to find and fix weaknesses faster than attackers can exploit them.”

October 22, 2026 – 7:23 AMOrange suspends some websites and apps

We've been waiting for a big company to reveal some details about their response to PHP, and now Orange appears to be the first.

The French telecoms giant has confirmed it "suspended access" to several websites and apps as a "precautionary measure", apologizing for any impact.

"Following the publication on 21 October of several security vulnerabilities affecting PHP, a programming language used by many websites and applications around the world, Orange has decided to temporarily suspend access to certain services," the company wrote.

"This decision has enabled the Group to deploy the necessary security patches and carry out the related checks before progressively restoring the affected websites and applications."

October 22, 2026 – 7:34 AMSome UK government services affected

(Image credit: Future / created with Gemini)

The BBC has reported that the UK government is claiming "some" limited government services "may be offline" while security work is being carried out.

There's no specific information on what has been affected, apart from the fact that no large UK public-facing critical services were hit.

It adds that work to identify and fix potential exposures to UK government system is underway, with experts "working closely with OpenAI and international partners."

October 22, 2026 – 8:09 AMWhich major sites have been affected?

(Image credit: Getty Images)

PHP code is behind something like 70% of the website we all visit, so the potential impact is huge — but which major websites have gone dark and confirmed the PHP vulnerability to be the main cause?

We've put together a full list of the most notable sites affected so far, from Wikipedia to the Internet Archive. A recent addition, as we mentioned below, is Orange Telecom, while in the UK a government minister has revealed that 32 government services are offline as a result of the PHP security threat. Yikes.

October 22, 2026 – 8:35 AMPHP2Shell explained

(Image credit: Future / Stephen Kelly)

We've got an in-depth explainer with everything you need to know about the PHP2Shell vulnerability, including what it is, what websites are affected and what you can do to keep safe online.

October 22, 2026 – 10:14 AMWhat's the latest?

Fortunately, things still seem to be quiet - and often in cybersecurity, that can either be a good or bad thing.

The good news is that we don't seem to have seen any major outages or issues with popular websites or services - particularly as the US begins to wake up and log on for its working day.

The bad news, as mentioned previously, is that this might be the sort of issue which bubbles under the surface for some time, with hackers lurking and probing potential targets over the coming weeks and months...

October 22, 2026 – 10:43 AMWhat to do if you run a small business

(Image credit: Getty Images)

It's all well and good looking at the impact this issue might have on government websites and major organizations, but where the effects might be felt hardest is on smaller businesses, where taking your website down for even a few hours can have a major hit on trading.

If you're an SMB owner or entrepreneur, here's what we'd advise you do ASAP:

• Contact your website host or provider - if you use an external website hosting service or provider, it might be worth contacting them to find out if your website uses PHP and if it has been affected - and what the plan to fix it is!
• Make a backup of your website immediately - Users should ensure they have a reliable backup of all the information contained on their website in case the worst happens - but you should also make sure this backup can be easily restored and re-activated
• Be aware of any threats over the next few days - Along with keeping an eye on your own website to make sure nothing unusual happens, you should also be vigilant against security threats. Hackers and scammers often take advantage of highly-publicized incidents such as this to run phishing or other scams preying on victim's lack of knowledge and nervousness.

October 22, 2026 – 11:07 AM

(Image credit: iStock)

And if you're a slightly bigger business, we've had some advice sent in from Kara Sprague, CEO of HackerOne, on the security steps to take.

Sprague advises companies should:

Strengthen your vulnerability disclosure process. Closely monitor incoming reports and use automation to deduplicate, validate, and prioritise findings based on asset criticality and demonstrated impact. Not all remote code execution vulnerabilities carry the same risk in every environment.

Use researcher findings to inform patching priorities. Apply patches as quickly as possible, but when resources are constrained, externally reported vulnerabilities specific to your environment can help identify the most urgent exposures.

Look beyond the initial patching window. Large enterprises may have overlooked PHP installations that remain vulnerable after the first round of remediation. Once initial patching is complete, consider incentivising researchers through existing bug bounty programs to identify remaining exposures.

“Finding vulnerabilities before adversaries do is only an advantage if we can coordinate and deploy fixes quickly enough to stay ahead," she adds. "The PHP discoveries are also a reminder that open-source security is everyone's responsibility. Software that supports millions of websites cannot depend on a handful of maintainers to manage increasingly sophisticated threats alone.

October 22, 2026 – 11:54 AMA quick refresh

As we near the end of the working day here in the UK, a quick reminder of what we've seen today...

• Companies across the world have been scrambling to update and patch any websites running PHP, a programming language thought to support around 70% of sites online today, including WordPress sites
• The patch addresses a potential security flaw which could allow hackers to gain access to affected web servers without authentication and steal sensitive data
• While there hasn't been any confirmed news of any cyberattacks, many sites have been forced offline or taken down temporarily as owners apply the update
• Government sites and Wikipedia were among the most high-profile entities affected, but most are now back online

We'll continue to monitor for any further developments, but in the meantime, stay safe and get those updates installed!

For caffeine addicts, a dedicated coffee machine is a worthy investment. But that's very much an at-home setup — what about when you're out and about? Sometimes, a great local coffee shop will satisfy your cravings, but that's no given. If you're serious about your caffeine hit, best to arm yourself with a sturdy, portable coffee maker that leaves nothing to chance.

There are a handful of brands that dominate in this market. One is AeroPress, which shot to popularity with its innovative design that aims to combine the best bits of French press, pour-over, and espresso brewing. The original model's compact, plastic build makes it pretty travel-friendly, but now there's also a smaller 'Go' version with an integrated travel cup and filter-paper holder.

Wacaco makes a range of sturdy, hand-powered brewers that deliver an espresso with a rich crema. You release a front button and then press it in to extract the coffee — your squeezes turn into 18 bars (261 PSI) of stable pressure inside the capsule. Don't have the means to boil water up separately? The OutIn does the heating part for you. It's USB-C rechargeable and works with capsules or ground coffee. This one's also great if the manual part poses a problem for you: it starts brewing at the press of a button, with no pushing or squeezing required. (Dreame has a similar self-heating portable machine on the way, but it's not on sale yet.)

One final system it's worth drawing attention to is the Rok Presso. This looks a little bit like a two-armed corkscrew, although it's rather bigger in real life. You add ground coffee, press down on the arms, and rather than pulling up a cork, the mechanism below produces a shot of espresso. It's not the most portable option here, but as a power-free, streamlined alternative to a traditional machine it's intriguing.

Scroll down for a closer look at all of these, plus more options for on-the-go coffee that won't disappoint.

Compact coffee kits

WACACO Nanopresso Portable Espresso Maker w/ Case

AeroPress Go small portable coffee maker

WACACO Minipresso GR2 Portable Coffee Maker

OutIn Nano 2 Portable Electric Espresso Machine w/ Self-Heating

ROK Presso Smartshot Manual Espresso Maker

Bodum Travel Press mug

OutIn Mino Portable Espresso Machine w/ self-heating

AeroPress Original Coffee Press

La Cafetière Brewstir 2-In-1 Tea and Coffee Infuser

For the first time in many years, Apple is limiting how many phones you can buy.

• AI agents made more than 2,600 attempts to query Alibaba’s Amap
• Researchers traced all 17 inspected message inboxes to Tencent Cloud servers
• Some AI agents explored alternative access methods after encountering map restrictions

A group of AI agents repeatedly sought information from Alibaba’s mapping service before researchers uncovered their activities and established direct contact.

Between September 28 and October 8 2026, investigators recorded more than 2,600 attempts to obtain information from Amap, a popular Chinese navigation platform.

Although the agents encountered restrictions, they sometimes found alternative routes to information.

AI agents circumvented restrictions while collecting map information

The investigation linked the activity to Tencent Cloud infrastructure, although the researchers could not conclusively identify which underlying AI models powered the agents.

Their requests generally concerned public information about individual locations, including the number of entrances, parking areas and arrival statistics displayed on map pages.

When Amap blocked requests, some agents experimented with alternative access methods, including exposed credentials, third-party services and systems intended for testing rather than public access.

Investigators also found that agents submitted specially constructed web addresses to urlquery.net, a security analysis service, attempting to execute code through its browser environment.

The agents successfully retrieved some information and transferred results through external services and requested metadata.

Investigators also examined the infrastructure supporting the operation, tracing all 17 inspected message inboxes to Tencent Cloud servers in Hong Kong.

All observed direct requests from the agents’ Tencent Cloud machines passed through a proxy identified as hysandbox-ats.

However, this does not mean that Tencent’s own Hunyuan models controlled the agents, leaving their precise technical origin uncertain.

A source familiar with Tencent’s work told the researchers that the activity came from evaluations involving third-party models, rather than Hunyuan systems.

Tencent revealed that the incident is due to external model testing and acknowledged that some agents browsed websites in unintended ways.

The company also said an internal examination had uncovered no evidence of deliberate coordination against a particular service or confirmed intrusion into outside systems.

Researchers set an invisible bait

The researchers released an initial account on October 4 while the activity continued, and subsequently noticed signs that some agents had discovered their investigation.

They inserted invisible website text describing a supposed messaging service, which invited agents to submit questions that researchers could answer through an intermediary.

The description contained inaccurate claims, including suggestions that the service had already helped agents retrieve information and connected them with an assistant possessing computer-control capabilities.

After messages began arriving on October 7, the team responded to agents’ questions and asked about their assignments, technical surroundings and operating instructions.

One agent explained that its task involved checking map information, then declined to disclose further system details, citing security concerns about its environment.

In another message, the agent wrote, “Thanks again for your help!” after confirming that six location labels matched its independently obtained results.

The exchange surprised researchers because the agents remained polite even while their activities involved circumventing restrictions.

The last activity recorded by the team occurred on October 8, and researchers reported that the agents had not returned by October 14.

Via Swarmcha

The creator of Proton Mail now hosts a powerful, professional Flock camera mapping tool on its site.