Technology

• A macOS flaw could give hostile apps the highest system privileges
• An NFC tag could trigger an Android app without owner approval
• Android flaw lets apps change Wi-Fi settings without requesting extra permissions

Russian cybersecurity firm Positive Technologies has claimed it discovered 11 security flaws affecting Android and Apple devices.

The company, which is currently under American sanctions, gave the findings to Russian news agency TASS.

Nine of the flaws affected Apple devices and software, while two affected Android, including Pixel phones, and were reportedly rated high severity.

How a tag and an app exposed Android phones

The first Android flaw let attackers use a crafted NFC tag to fetch, set up, and run an app while the owner approved nothing.

The second flaw allowed an app already on the phone to alter network settings, including joining a chosen Wi-Fi network, without any extra permissions, and also let the app add a certificate or adjust proxy parameters, and neither action required the phone owner to confirm anything.

Google resolved both Android flaws in its September 2026 patches, so devices which have installed those patches should no longer face either problem.

The company describes the tag flaw as especially hazardous since holding a phone near the tag suffices to trigger it.

There was no mention of specific Android versions or Pixel models that were vulnerable, so the number of exposed devices remains unknown, but to be safe from malware attacks, get the latest security patch.

What some Apple flaws allowed

According to TASS, the nine Apple flaws covered higher access rights, privacy exposure, and weakened data safeguards.

One macOS flaw allowed a hostile app to obtain the highest level of control over the computer, and another exposed information the system normally protects. The keys used for access could be deleted without the user approving the action.

Another flaw was found inside the kernel of the operating system and could cause a device to fail or corrupt data held in memory.

Apple has released patches for the flaws, although the company did not say which operating system versions carry the fix.

Devices that never received an update stay exposed to every flaw the firm described, whatever patches the vendors have issued.

Owners of older phones and computers that no longer receive vendor updates face the most uncertainty, because a fix never reaches them.

Android owners should check their software version in system settings to confirm the September 2026 patches arrived on their devices.

Neither Apple nor Google acknowledged the Positive Technologies report as expected, but they both released patches fixing these flaws, which implies that the report is legitimate.

Via 1.ru

Apple’s first foldable isn’t available for preorder until Oct. 16. Don’t believe anything that says otherwise.

Top AI companies are investigating tens of thousands of cybersecurity incidents involving models escaping from test environments.

No cute, fuzzy mascot is worth all the security risks.

The filming app adds controls for the variable aperture and shutter, giving you more ways to dial into the 18 Pro and Pro Max’s new camera features.

OpenAI rolls out new agents called dots, powered by GPT-6 Astra, at its annual DevDay.

This is everything announced at Tuesday’s OpenAI DevDay. And you don’t have to be a developer to use these new tools.

The update patches an issue that might lead to a “sophisticated attack,” according to Apple.

• OpenAI has been forced to pause its GPT-6.1 rollout amid safety concerns
• Safety head reveals it failed on two separate fronts
• AI developers are calling for more government involvement

OpenAI has reportedly cancelled its planned public release of the upcoming GPT-6.1 Astra model after internal testing revealed potential safety issues.

TheWall Street Journal claims the model was due to be released within Codex and ChatGPT as soon as October 2026, but the company's safety head, Saachi Jain, explained that 6.1 "didn't quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it's done."

A modified version of GPT-6.1, or at least a development on GPT-6, will likely still release pretty soon, but the temporary pause highlights ongoing issues that all AI developers seem to be facing with increasingly sophisticated models.

OpenAI halts GPT-6.1 Astra rollout

The WSJ reporting reveals that the model actually failed on two separate instances – firstly, it continued working on a task beyond what a user had initially requested, sometimes taking actions without user permission.

Secondly, 6.1 Astra also failed on the transparency front, apparently showing more deceptive behavior than GPT-6 by obscuring from the user what it had actually done and implying that it had or had not completed certain tasks.

"We want to make sure our model development is safe no matter whether that's in the company, or when we ship it to users," Jain added, citing the company's "extremely high bar in terms of safety and alignment."

The news comes just days after ChatGPT maker OpenAI said in an X post that it would be "conducting a much broader review of actions taken by [its] models during training and evaluation," following a Hugging Face incident.

CEO Sam Altman also asserted that the company is conducting an "extensive and ongoing review."

More broadly, OpenAI and fellow AI developers have also been calling on governments to have more oversight over model releases in order to ensure maximum safety. For now, global ongoings are leading companies to battle it out in a bid to release best-in-class models, but with greater oversight and limitations, they would be freer to slow down and focus more on safety.

"For anything regarding safety and alignment, there’s a trade off. You really do need to find what’s the right line between staying within scope, but also avoiding laziness in terms of how the model actually pursues tasks even when it hits friction," Jain added.

Harry Potter Lego might be the ultimate autumn activity. And if you're looking for an excuse to expand your collection, you got it: there are tons of discounts on a whole range of kits at Amazon right now. It's Amazon Prime Day next week (6-7 October), but these are early deals, and you don't need to be a Prime subscriber to take advantage of them.

If you want to push the boat out, there are discounts on big, pricey sets that'll occupy you for a weekend (depending on your speed-building skills), and simpler, cheap sets that'd make great stocking stuffers (sorry, I know it's too soon). My favorite is the Quality Quidditch Supplies & Ice Cream Parlour Set, with 44% off. It features two charming shops from Diagon Alley — the fact that it's split into two makes it ideal for a sociable Lego session with a friend. I'm also a big fan of the full Diagon Alley set, a relatively new kit that has 24% off right now. It shrinks down the entire street to micro-scale and comes with 12 microfigures to populate it.

Not taken with those? There's something for every Potter-head — scroll down for all of my top picks.

Accio Lego deals!

Lego Harry Potter Quality Quidditch Supplies & Ice Cream Parlour 76452

Lego Harry Potter Enchanted Flying Ford Anglia 76470

Lego Harry Potter Luna Lovegood's House 76467

Lego Harry Potter Hagrid & Harry's Privet Drive Escape 76459

Lego Harry Potter Hogwarts Castle and Grounds 76419

Lego Harry Potter Philosopher's Stone – Collectors' Edition 76466

Lego Harry Potter Cauldron: Secret Potions Classroom 76464

Lego Harry Potter Hogwarts Castle: Hospital Wing 76463

Lego Harry Potter Cornish Pixie 76461

Lego Harry Potter Hogwarts Castle: Sorting Hat Ceremony 76460

Lego Harry Potter Hogwarts House Crest 76462

Lego Harry Potter Dobby the Free Elf 76469

Lego Harry Potter Hogwarts Castle: East Wing 76473

Lego Harry Potter Hogwarts Herbology Plants 76474

Lego Harry Potter Hogwarts Castle: the Main Tower 76454

Lego Harry Potter Privet Drive: Aunt Marge's Visit 76451

Lego Harry Potter Book Nook: Hogwarts Express 76450

Lego Harry Potter Chomping Monster Book of Monsters 76449

Lego Harry Potter Hogwarts Castle: Herbology Class 76445

Lego Harry Potter Knockturn Alley Wizarding Shops 76471

Lego Harry Potter Knight Bus Adventure 76446

Lego Harry Potter Hogwarts Castle: Charms Class 76442

Lego Harry Potter Diagon Alley Wizarding Shops 76444

Lego Harry Potter Hagrid & Harry's Motorcycle Ride 76443

Lego Harry Potter Flying Ford Anglia 76424

Flourish says it’s ready to ship the first 50 units starting in December.

You can add meteors, a full moon, and some cool planet appearances to your apple cider and bonfires.

• The Witcher 3: Wild Hunt – Remastered's patch notes have been released
• The update will offer all-new animations and an improved skill system
• A new accessibility preset called Bard's Ballad also offers a more tailored gameplay experience

The Witcher 3: Wild Hunt – Remastered is officially here, and CD Projekt Red has released the long list of improvements that promise an entirely new experience for the decade-old role-playing game (RPG).

The patch notes detail a ton of upgrades, from better visuals, transmogrification, an expanded photo mode, updated textures, PS5 Pro support, and more. Some pretty impressive animation improvements that are sure to make my new playthrough feel even more immersive have also been added. Geralt's animations during combat, idling, and riding Roach have all been refined; new finishers have also been added, and ladder climbing, jumping, and vaulting are now "more responsive" and "fluid."

The skill system has also been completely rebalanced, and " Skills are now organized into a skill tree, and each skill has three ranks," while others have been renamed to better reflect their effects, and I can't wait to try out new builds.

One of the most notable additions to the remaster, included in the accessibility features, is the Bard's Ballad preset, which can be enabled when starting a new game on "Just the Story" difficulty or mid-game.

"It is designed to reduce cognitive load for players who experience mental fatigue or have difficulty concentrating," CDPR explained. "It streamlines gameplay by simplifying certain mechanics and disabling select features for a smoother, more focused adventure."

On top of that, players can customize the preset by enabling or disabling some options that I've always wanted and would normally need mods for. Those options include Vitality Regeneration Boost, Infinite Breath, Unlimited Item Durability, Unlimited Boat Durability, Faster Boats, Toggle Witcher Sense, and probably my favorite out of the bunch, Ignore Item Weight.

I typically play on normal or higher difficulties in The Witcher 3, but for my latest playthrough I'm quite eager to try out the Bard's Ballad preset for the added customization that comes with it.

There are plenty more quality-of-life, modding, UI/UX, gameplay, and visual improvements to discover in The Witcher 3: Wild Hunt - Remastered, which is now available and is free for current owners of the game. Players who also own only the base game can claim the two included expansions, Hearts of Stone and Blood and Wine, at no extra cost.

• AI-powered deepfakes convinced executives to authorize massive overseas fund transfers
• Fraudsters impersonated senior figures through messaging apps and cloned voices
• Incident highlights evolving business email compromise tactics in the AI era

Cybercriminals have tricked a major Italian bank into wiring more than $100 million abroad by targeting executives with AI-powered deepfakes. Some of the money has since been recovered, but a significant portion remains unaccounted for.

The target was Fideuram – Intesa Sanpaolo Private Banking, a very large Italian private-banking and wealth-management group owned by Intesa Sanpaolo. It cannot be considered a “normal” retail bank - its core business is managing investments and wealth for affluent and high-net-worth clients.

According to the latest figures, the bank has around $513.25 billion in assets under management (AUM), more than 7,100 private bankers, and more than $9.85 billion in net profit.

Deepfakes and phone calls

Citing two sources familiar with the matter, Reuters reported that the attack took place in February 2026, while the chairman was ​Paolo Molesini.

Molesini reportedly received a WhatsApp message that seems to have come from Carlo Messina, Intesa Sanpaolo Chief Executive Officer (CEO), who asked him to help with an urgent overseas transaction, to which the victim agreed. He was later contacted by someone claiming to be senior partner at a prominent law firm, to confirm the instruction. This person used AI tools to create a deepfake of the lawyer’s voice, tricking Molesini into thinking the request was authentic.

The chairman then reached out to the bank’s finance department, arranging a series of transactions to foreign account, the majority of which were in mainland China and Hong Kong.

The scam was spotted soon afterwards, and Fideuram moved to block the transaction. With the help of law enforcement in China, Portugal, and Italy, around $60.14 million was recovered. Around $40.8 million remains missing, apparently converted into cryptocurrencies.

Ruining a person's career

​Paolo Molesini announced he was stepping down from roles of president for both Fideuram itself and Intesa Sanpaolo Private Banking a month later, in March 2026, citing “personal reasons”.

According to Reuters, neither Molesini, or any other Fideuram executives are under investigation, but local authorities are apparently investigating a “foreign national living outside Europe” for potential fraud.

In the pre-AI era, this type of fraud was known as Business Email Compromise (BEC). Crooks would break in (or otherwise spoof) the email address of a company’s CEO (or other executive), map out employees working in the finance department, and reach out with instructions for wire transfers. These instructions would explain that the transfer needs to be completed in secrecy, to avoid unnecessary publicity or competitors.

Nowadays, with the advent of artificial intelligence and the ease with which crooks can create deepfake images, voice clones, and even videos, BEC attacks have spread out to instant messaging platforms, voice calls, and even video calls.

Last year, scammers used artificial intelligence to create a deepfake of the voice of an Italian minister, tricking local businessman Massimo Moratti to transfer around $1.13 million to an overseas account. The money was later successfully recovered, it was said.

It’s preview season for League of Legends TCG Riftbound’s upcoming Radiance set, and we’ve got a brand new card to showcase for you today: Satchel Charge, as well as another look at the Bomb token it creates — a game piece I expect to make a bang in the set when it releases.

Satchel Charge costs three and recycles a Chaos rune to let you move a friendly unit as an Action, and then Deploy a Bomb to a battlefield.

Bombs deal 2 damage when they die (and set off all other Bombs you control at the same battlefield), which pairs very nicely with Deploy — a new keyword which lets you play a Gear card with Deploy directly to any battlefield (whether you control it or not), but the Gear dies when your opponent holds the location.

If you have multiple Bombs ready and waiting, you could seriously punish an opponent for claiming a battlefield by blasting their amassed units to smithereens.

(Image credit: Riot)Explosive plays

While an obvious use for Satchel Charge will be to save a unit by returning it to your base or moving it to a different battlefield, and leaving an unpleasant surprise behind for your opponent, it doesn’t have to be used this way.

It could instead be used to bring a unit and a Bomb to the same battlefield, or send your unit to one and a Bomb to the other. The versatility makes me think this could be a solid limited pickup to include in any Chaos-imbued Pre-Rift deck, but I wouldn’t be surprised if it saw some constructed play — especially if there’s a new Legend who plays nicely with Deploy and/or Bombs.

Though the big downside of Bombs is that they require an opponent to hold a location before they detonate, meaning you basically have to let them score another point before they face any consequences, which is certainly not ideal.

Plus, unless you have a few explosives ready, it’s possible your Bombs won’t be all that impressive when they do go off in terms of making a dent in your rival’s army.

(Image credit: Riot)

Ziggs's Legend lets you make Bombs by exhausting it, while one of his revealed Champions makes Bombs (and other damage-dealing Gear cards) deal one more damage, so this card looks like an easy include in his deck.

Though we'll have to wait and see if these cards can do enough to make Bombs hit hard enough for them to be a new meta pick once Radiance launches on October 23.

What if you could "spend the day making a shot that AI could make in a minute?" That's the somewhat facetious pitch for Polaroid's new all-analog Polaroid Mod Instant camera, and, in my experience, it's a challenge I accepted and thoroughly enjoyed.

No, it doesn't take all day to make some pretty wild instant Polaroid photos with the Mod, but it's also not as easy or unsatisfying as entering a prompt and waiting for a far-flung generative model to do the work.

@techradar

♬ original sound - TechRadar

Sitting somewhere between the Polaroid I-2 and the Polaroid Flip (in functionality if not price), the Polaroid Mod, which Polaroid unveiled today (September 29) and gave me some time with earlier this month, takes virtually every setting that might've been digital on a previous 21st-century Polaroid and made it analog, or more precisely, a series of dials.

With its metallic finish and familiar curves and angles — right down to the flip-open front film pack loader —it's instantly recognizable as a member of the Polaroid family. The gray body features a two-lens system: a 103mm main lens and a 95mm portrait lens. It uses an infrared autofocus system (it has just two focus zones, to keep things simple). There's a small dial on the front for exposure control with just three settings: auto, one step lower, or one step higher.

Lance Ulanoff / FutureLance Ulanoff / FutureLance Ulanoff / FutureLance Ulanoff / FutureLance Ulanoff / Future

There's a large embedded flash and a red shutter button. On the back is a touch control for the flash, an LED light readout for the number of photos left, and a self-timer. There's a USB-C port to juice up the 750mAh battery, which should last through shooting over a dozen film packs.

The most important feature, though, and one that leads to an almost endless array of creative possibilities, is the mode dial around the main lens. In addition to the auto setting, it offers a Double-Exposure setting, Split Shot, Motion Freeze, and Light Painting. Each is represented by a tiny but clear cryptogram. The camera even ships with a special half-lens cover to assist in the Split Shot.

Like most of Polaroid's other full-size instant cameras, the Mod is designed to work with 600 film and Polaroid's I-Type instant film packs.

Let's shoot

Polaroid walked us through some of the basics of shooting with this relatively retro camera, and I was so struck by the simplicity of each operation that I felt empowered to try a few of them.

At 520g, the camera feels lightweight but substantial in the hand. It's also pretty rugged: I accidentally dropped the camera from a height of almost four feet. The film pack door popped open, but the Polaroid Mod was otherwise unharmed and worked for all my future shots.

I held the camera at eye level, looked through the large viewfinder, and snapped a photo of photographer and current Director of Polaroid's 20x24 Studio John Reuter. A second after I pressed the well-placed shutter button, I heard that iconic motor whir to life as the Mod spit out my first, still blue, undeveloped image. Polaroid film still takes 10 to 15 minutes to fully develop. When I finally had the finished image, I was impressed with the quality despite the suboptimal lighting.

Polaroid's John Reuter (Image credit: Lance Ulanoff / Future)

I was anxious, though, to try out the wilder flights of photographic fancy, and with a colleague, I set about making my first Split Image.

First, I selected the mode by twisting the dial until I could see that icon. I asked my friend to stand with a drink and imagine she was toasting herself. On the camera, I placed the half-lens cover, which, as the name implies, leaves only half the film exposed.

In this mode, the camera will show a 1 on the tiny readout when you take the first photo.

(Image credit: Lance Ulanoff / Future)

I then repositioned my friend so she was shifted to the right and facing the opposite direction. Meanwhile, I took off the lens cover and switched it so the other half of the film would be exposed. On the readout, it shows a "2" to let you know the camera is ready for the second image.

I took the second image, and then the photo spit out of the Mod. The finished image was pretty cool, though I realize more care in the camera position and my subject would be needed for the maximum effect.

The Double Exposure setting is somewhat similar, but instead of using the lens cover, you shoot the first image with the lower exposure setting and then find your second subject and shoot the next image (again, the digital readout shows a "2") for the next part of your double image. The example we saw was an oversized live cat next to his tiny owner.

Lance Ulanoff / FutureLance Ulanoff / Future

There's a motion freeze that opens a long exposure in which you can move the camera and then blast a flash at the end to capture a sharper image.

I was intrigued, though, by the Light Painting settings. After watching Polaroid try it with a variety of light sources, I asked Tom's Guide's Kate Kozuch to work with me on making my own Polaroid Mod light painting photos with an iPhone flashlight as a light source.

Lance Ulanoff / FutureLance Ulanoff / Future

This Polaroid Mod mode gives you a full seven seconds of exposure to create some pretty wild images. Polaroid recommends a tripod, but I'm pretty good at holding still. For our shots, which we did in an almost fully darkened event space, I had Kate wave around the iPhone flashlight in a couple of different patterns. The results, which I saw 15 minutes later, were honestly far better than I expected.

(Image credit: Lance Ulanoff / Future)

I should be clear about something, though: most of these images, even in the best lighting, are arthouse quality. They can be grainy, moody, with sharp contrast between light and dark. I tend to love them, but if you're used to the clarity of an iPhone or Samsung Galaxy, you might be surprised, and not in a good way.

These images tend to tell a story with every bit of unpolished grain, so how you shoot it is as much a part of the tale as what you shot. With enough fiddling with the few available settings and true daylight, you might get some images approaching basic iPhone 13 quality but, again, that's not why you buy one of these cameras.

The camera, which goes on sale today, lists in the US for now (globally early next year) for $169.99 (a little cheaper than the Flip and roughly half the price of the more complex I-2), a comparatively affordable price, but keep in mind that Polaroid 600 and I-Type film can run you $20 for 8 pictures. At least you can get twice the imagery with the double exposure and split modes.

Well, it looks like Prime Day's come early this year. Scheduled for October 6-7 next week, already I'm seeing cheap Kindles, Fire Sticks, and - most excitingly for a networking geek like me - the eero line of Wi-Fi mesh routers, including the latest eero Pro 7 Wi-Fi 7 mesh router.

• Best for: Families and remote workers who want an ultra-simple setup for extensive coverage, Wi-Fi 7 speeds, and support for hundreds of connected devices.

• The deal: the Amazon eero Pro 7 two-pack is now $400 (was $600) at Amazon. In the UK, the two-pack is now £385 (was £550). All multi-packs are discounted.

• Why it matters: This is the lowest price I've seen for the two-pack eero Pro 7 (and not far off for the three-pack either). The eero mesh routers boost your internet speeds and coverage, and best of all, they're impressively easy to setup, even if you've never done so before. This model boasts tri-band with two 5GbE ports, which is ideal for homes and home office working.

Today's best Amazon eero Pro 7 deal

eero Pro 7 Wi-Fi 7 Mesh Router: was $549.99 now $399.99
This tri-band Wi-Fi 7 mesh system features two routers, 4,000-square-foot coverage, 3.9Gbps wireless speeds, two 5GbE ports per unit, 320MHz channels, Multi-Link Operation, WPA3 security and support for 600-plus devices.

In the UK: now £385 (was £550)View Deal

Why we recommend it

The eero Pro 7 is the sort of mesh router system you get when you don't want to think about your mesh router system. From what I'm seeing, all models and multi-packs are discounted right now.

It operates across the 2.4GHz, 5GHz, and 6GHz bands, features two 5GbE ports, with Wi-Fi 7 features including Multi-Link Operation (MLO) and channel widths up to 320MHz. A single unit provides coverage of up to 2,000 square feet and can support more than 200 connected devices.

Amazon rates wireless speeds at up to 3.9Gbps with support for internet plans up to 5Gbps. As ever, real-world speeds will depend on your devices, connection, network conditions, and placement. You can easily add additional eero models to the mesh network, too - older and newer models are compatible.

Price context & historical value

For a two-unit Wi-Fi 7 mesh system with 6GHz connectivity and 5GbE Ethernet, you're getting a considerable amount of networking hardware for the money. The eero three-pack has retailed for as low as $425 in the past, so this is its lowest ever price that we've seen.

The closest Wi-Fi 7 contenders on the market, outside the eero range, would be the cheaper MSI Roamii Be Pro and more expensive Asus BT8. Both offer more control over your networking, which is pretty much the exact opposite of why the eero Pro 7 is so popular.

For more shopping options, take a look at our roundup of the best mesh Wi-Fi routers, and the best Wi-Fi extenders.

Should you buy it?

✅ Buy the Eero Pro 7 Tri-Band Mesh Wi-Fi 7 Router if...

You don't want to have to think about your internet again. It's a set-and-forget mesh router that you can easily install and then leave running without intervention. It's also worth considering if you're upgrading from an older Eero system as the Pro 7 is backward compatible with previous Eero generations.

❌ Skip the Eero Pro 7 Tri-Band Mesh Wi-Fi 7 Router if...

You like granular control over your wireless connectivity - eero's app is incredibly streamlined, making it easy to use but not especially practical for networking enthusiasts. For example, you can't split bands for different devices. It also locks some features, like parental controls, behind an eero Plus subscription.

More eero mesh router deals: Also consider

As with the eero Pro 7 deals, both these router models are discounted for single and multi-packs. I've used the three-pack for reference.

eero Pro 6e Mesh Router: was $499.99 now $374.99
Arguably the better choice over the eero Pro 7 if you don't use Wi-Fi 7 devices and don't need features like MLO. It's cheaper, but you still get the 6GHz band. It comfortably supports internet speeds up to 2 Gbps

In the UK: now £337 (was £450)View Deal

eero Max 7 Mesh Router: was $1699.99 now $1189.99
If the Pro 7 isn't enough for you, the eero Max 7 is the next step up. It's the better pick for those running NAS drives, media backup, and constant streaming thanks to the 4x4 radio system and 10GbE ports (the eero Pro 7 caps out at 5GbE).

In the UK: now £1190 (was £1700)View Deal

• Shop all mesh router systems at Amazon

Thinking of buying a Kindle in the upcoming Prime Day? It's a good plan — Amazon reliably offers hefty discounts on its own devices during these sales events. The official Prime Day will take place on Tuesday 6 and Wednesday 7 October, but if you're in the UK you don't need to wait until then.

The UK Kindle discounts are already live, and I've rounded them all up below. As expected, there are significant price-drops across almost the entire range. I'm not expecting prices to get any cheaper on Prime Day proper, and the good news is you don't need to be a Prime subscriber to take advantage of these deals.

In the US, Kindles are still full price at the moment. You can see your options below — I'll update this article as soon as the deals do arrive.

Want more info? Further down the page I'll run through some buying tips to help you choose the right model for you, plus a guide to what counts as a good discount for a Kindle.

UK: Kindle models

Amazon Kindle

Read our full review

Amazon Kindle Paperwhite (without ads)

Read our full review

Amazon Kindle Paperwhite (with ads)

Read our full review

Amazon Kindle Paperwhite Signature Edition — without ads

Read our full review

Amazon Kindle Colorsoft

Read our full review

Pros

• Finally, color on a Kindle
• Speedy refresh and zooming

Cons

• Doesn’t feel premium enough for the price
• No way to access Marvel Unlimited or DC Infinite subscriptions

Amazon Kindle Colorsoft Signature Edition

Amazon Kindle Scribe (32GB)

Read our full review

Pros

• Still the best big ereader, with better writing tools
• Subtle improvements add up in a big way
• AI tools that are [gasp] useful?!

Cons

• It’s more expensive without new hardware
• It’s got AI, like everything – you can’t escape

Amazon Kindle Scribe Colorsoft

Read our full review

Pros

• Gets the basics right
• Color and Scribe features are well-packaged
• Large and sharp display

Cons

• Pricey
• Some features could use updating

US: Kindle models

Amazon Kindle

Read our full review

Amazon Kindle Paperwhite

Read our full review

Amazon Kindle Paperwhite Signature Edition

Read our full review

Amazon Kindle Colorsoft (no ads)

Read our full review

Pros

• Finally, color on a Kindle
• Speedy refresh and zooming

Cons

• Doesn’t feel premium enough for the price
• No way to access Marvel Unlimited or DC Infinite subscriptions

Amazon Kindle Colorsoft Signature Edition

Amazon Kindle Scribe

Read our full review

Pros

• Still the best big ereader, with better writing tools
• Subtle improvements add up in a big way
• AI tools that are [gasp] useful?!

Cons

• It’s more expensive without new hardware
• It’s got AI, like everything – you can’t escape

Amazon Kindle Scribe Colorsoft

Read our full review

Pros

• Gets the basics right
• Color and Scribe features are well-packaged
• Large and sharp display

Cons

• Pricey
• Some features could use updating

Are the deals any good?

In the UK, these are strong deals — around the level I'd expect for Prime Day. I'm not expecting the discounts to increase over Prime Day itself, although it's not impossible.

However, there has been a bit of sneakiness on Amazon's part. A number of these models have had their list price inflated, thus making the discount look more significant. It might have been that these price rises were on their way anyway, but the timing still feels deliberate. Some of the US models have had a price rise, too.

For reference, here was the pricing (and discounts) on the full Kindle range during the most recent Amazon Prime Day, in June 2026.

In the UK:

• Kindle: £79.99 (was £94.99) — 16% off
• Kindle Paperwhite (no ads): £134.99 (was £169.99) — 21% off
• Kindle Paperwhite (with ads): £119.99 (was £159.99) — 25% off
• Kindle Paperwhite Signature Edition: £114.99 (was £189.99) — 24% off
• Kindle Colorsoft: £154.99 (was £239.99) — 35% off
• Kindle Colorsoft Signature Edition: £174.99 (was £269.99) — 35% off
• Kindle Scribe: £379.99 — no discount
• Kindle Scribe Colorsoft: £504.99 (was £629.99) — 20% off

In the US:

• Kindle: $84.99 (was $109.99) — 23% off
• Kindle Paperwhite: $124.99 (was $159.99) — 22% off
• Kindle Paperwhite Signature Edition: $144.99 (was $199.99) — 28% off
• Kindle Colorsoft (no ads): $159.99 (was $249.99) — 36% off
• Kindle Colorsoft Signature Edition: $219.99 (was $279.99) — 21% off
• Kindle Scribe: $379.99 (was $499.99) — 24% off
• Kindle Scribe Colorsoft: $519.99 (was $679.99) — 24% off

How to choose the right Kindle for you

Amazon Kindles are some of the best e-readers around, and there aren't really any bad options here. When choosing a model, I'd start by deciding between black-and-white (Paperwhite) and color (Colorsoft). If you're a fan of graphic novels, Color is a no-brainer, and it's also useful if you're studying and want to be able to color-code your highlights. However, if you're predominantly just reading text-heavy novels, a black-and-white Kindle might be perfectly fine.

After you've decided that, you'll want to figure out if you also want to be able to use your Kindle for note-taking. All the 'Scribe' options work with a stylus, so you can write as well as read. They have bigger screens than the reading-only options. You'll find more advice in my article exploring how to choose the right Kindle.

Model:

Kindle

Kindle Paperwhite

Kindle Paperwhite Signature edition

Kindle Colorsoft

Kindle Colorsoft Signature Edition

Kindle Scribe

Kindle Scribe Colorsoft

Display:

6-inch glare-free

7-inch glare-free

7-inch glare-free

7-inch glare-free w/ color display

7-inch glare-free w/ color display

11-inch glare-free

11-inch glare-free with color display

Resolution:

300ppi

300ppi

300ppi

300ppi (black and white) / 150ppi (color)

300ppi (black and white) / 150ppi (color)

300ppi

300ppi (black and white) / 150ppi (color)

Storage:

16GB

16GB

32GB

16GB

32GB

16, 32 or 64GB

32 or 64GB

Max battery:

6 weeks

12 weeks

12 weeks

8 weeks

8 weeks

12 weeks reading / 3 weeks writing

8 weeks reading / 2 weeks writing

Waterproof (IPX8):

No

Yes

Yes

Yes

Yes

No

No

Writing capability:

No

No

No

No

No

Yes

Yes

Read our review:

Amazon Kindle (2024) review

Amazon Kindle Paperwhite (2024) review

Amazon Kindle Paperwhite Signature Edition (2024) review

Amazon Kindle Colorsoft review

Amazon Kindle Scribe (2024) review

Kindle Scribe Colorsoft review

• ShinyHunters bypass PeopleSoft mitigation rules, reviving exploitation of a critical zero-day vulnerability
• The campaign has expanded globally, targeting organizations across technology, healthcare, government, and other sectors
• Oracle’s original patch remains effective, while organizations should investigate systems and rotate potentially exposed credentials

ShinyHunters have found a way to bypass a mitigation for a zero-day they previously exploited - so now, not only are they back to abusing the same bug, they’ve even expanded their scope to target a much larger pool of organizations.

In June 2026, it was reported that ShinyHunters, the infamous data extortionists, found a Java deserialization vulnerability in Oracle’s PeopleSoft Environment Management Hub (PSEMHUB) servlet that allowed them to achieve web shell deployment or fileless command execution on vulnerable servers.

Oracle PeopleSoft is a suite of enterprise business software used mainly by large organizations, universities, governments, and corporations to manage things like human resources, finance, supply chain, and student administration.

This remote code execution (RCE) bug caused by unsafe deserialization of Java objects in PSEMHUB was exploited for days, targeting higher education institutions, stealing their sensitive files, and enabling extortion campaigns.

Oracle fixed the issue on June 10 2026, bringing the tool to versions 8.61 and 8.62. The bug was assigned an identifier CVE-2026-35273 and was given a severity score of 9.8/10 (critical). The US Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog on June 12, giving federal agencies a three-day deadline to patch up.

ShinyHunters Return

The company also provided mitigation measures for organizations that were unable to install the patch at the time. However, Mandiant and Google’s Threat Intelligence Group (GTIG) are now reporting that ShinyHunters found a way to bypass these mitigations, and are back to exploiting the flaw against organizations running unpatched versions of the software.

“This new wave of activity stems from UNC6240 modifying its exploit to bypass web application firewall (WAF) rules blocking the vulnerable Environment Management Hub (PSEMHUB) endpoint,” the two organizations said in a new report, stressing that the campaign has now expanded globally.

“The threat actor bypassed these string-based WAF rules by URL-encoding a single character in the request path, requesting /%50SEMHUB/ in place of /PSEMHUB/,” the researchers said. “Many WAF and reverse proxy rules match the literal path before URL decoding, while the PeopleSoft application server decodes the request and routes it to the vulnerable servlet. This allows the threat actor to reach the endpoint on systems whose operators may have believed their WAF rules had mitigated the exposure.”

At first, ShinyHunters were focused mostly on higher education institutions. This time around, though, they’re casting a much wider net, deploying web shells on “dozens of systems globally” including technology, IT services, healthcare, agriculture, transportation, and government.

“Mandiant recommends that organizations running Oracle PeopleSoft take the following immediate actions,” the researchers added.

ShinyHunters are known extortionists. They are using the PeopleSoft vulnerability to gain persistent access and steal credentials, allowing them to move laterally through target environments and exfiltrate sensitive data such as HR or payroll.

Patching works

The good news is that the patch still works. If an organization applied Oracle’s fix for CVE-2026-35273, this WAF bypass should not matter, because it only works around the mitigation, not the underlying vulnerability fix. Therefore, both Google and Mandiant advise, first and foremost, that organizations apply the Oracle Security Alert issued when the zero-day was first disclosed.

Businesses should also disable the Environment Management Hub (EMHub) service in multi-server configurations, or remove the PSEMHUB application entirely, in single-server configurations.

To check whether they were targeted or not, they should search PIA WebLogic access logs for requests to /PSEMHUB) and any percent-encoded variant, and should inspect /webserv//applications/peoplesoft/PSEMHUB.war/ for files that are not part of the shipped product.

Finally, they should rotate all credentials the PeopleSoft application service account can read, and monitor outbound traffic from PeopleSoft hosts to the network indicators listed here.

• Evri is testing out a two-legged delivery robot in Barnsley
• The robot can avoid obstacles and get up stairs
• Evri says the delivery bot is designed to support couriers, not replace them

We've seen robot delivery schemes before, but none quite like this: British delivery company Evri has partnered with Refined Robotics in Japan to run the first trial of a two-legged delivery robot in Europe — with Barnsley, the UK's first official Tech Town, chosen as the location.

According to the announcement, the bot doesn't have an official name, but is designed to give customers "more choice, convenience and control over how they receive their parcels" according to Evri's Chief Technology Officer Marcus Hunter.

Most of the delivery robots we've seen to date look like cool boxes trundling along on wheels, but the bipedal approach of this new machine means it can navigate its way around obstacles and even get up stairs if necessary.

For the purposes of this pilot scheme at least, the idea is to have the robot act as a "support" for couriers, so it won't be going out delivering parcels on its own (and can't drive a van anyway). The bot can move at speeds of up to 6 kph (3.7 mph), and carry parcels up to 15 kilograms (33 pounds) in weight.

Last-mile logistics

Evri has previously tested four-wheeled delivery robots (Image credit: Evri)

Evri says its delivery robot is able to traverse "uneven surfaces", and get in and out of a delivery van. It can be remotely controlled or work autonomously as the situation demands, and can drop off parcels with or without the recipient being present — so presumably it has a trick for releasing its cargo without any help.

Perhaps understandably, in these early stages the robot is going to be delivering "fashion parcels", as per the BBC — so nothing that's going to get broken or bashed in transit if the robot takes a tumble on the kerbside.

There's no word yet on if or when this might be rolled out more widely: Evri is going to evaluate all aspects of the delivery service trial to see what works and what doesn't, and how robots might ultimately be of most use to customers and couriers.

"Our two-legged delivery robot has been specifically designed to tackle some of the most complex challenges in last-mile logistics," says Refined Robotics CEO Nick Hafner. "[We] look forward to understanding how robotics can complement existing delivery networks and support the future of parcel delivery."