Researchers have already found a critical vulnerability in the new NLWeb protocol Microsoft made a big deal about just just a few months ago at Build. It’s a protocol that’s supposed to be “HTML for the Agentic Web,” offering ChatGPT-like search to any website or app. Discovery of the embarrassing security flaw comes in the early stages of Microsoft deploying NLWeb with customers like Shopify, Snowlake, and TripAdvisor.The flaw allows any remote users to read sensitive files, including system configuration files and even OpenAI or Gemini API keys. What’s worse is that it’s a classic path traversal flaw, meaning it’s as easy to exploit as visiting a malformed URL. Microsoft has patched the flaw, but it raises questions about how something as basic as this wasn’t picked up in Microsoft’s big new focus on security.“This case study serves as a critical reminder that as we build new AI-powered systems, we must re-evaluate the impact of classic vulnerabilities, which now have the potential to compromise not just servers, but the ‘brains’ of AI agents themselves,” says Aonan Guan, one of the security researchers (alongside Lei Wang) that reported the flaw to Microsoft. Guan is a senior cloud security engineer at Wyze (yes, that Wyze) but this research was conducted independently.Guan and Wang reported the flaw to Microsoft on May 28th, just weeks after NLWeb was unveiled. Microsoft issued a fix on July 1st, but has not issued a CVE for the issue — an industry standard for classifying vulnerabilities. The security researchers have been pushing Microsoft to issue a CVE, but the company has been reluctant to do so. A CVE would alert more people to the fix and allow people to track it more closely, even if NLWeb isn’t widely used yet.“This issue was responsibly reported and we have updated the open-source repository,” says Microsoft spokesperson Ben Hope, in a statement to The Verge. “Microsoft does not use the impacted code in any of our products. Customers using the repository are automatically protected.”Guan says NLWeb users “must pull and vend a new build version to eliminate the flaw,” otherwise any public-facing NLWeb deployment “remains vulnerable to unauthenticated reading of .env files containing API keys.”While leaking an .env file in a web application is serious enough, Guan argues it’s “catastrophic” for an AI agent. “These files contain API keys for LLMs like GPT-4, which are the agent’s cognitive engine,” says Guan. “An attacker doesn’t just steal a credential; they steal the agent’s ability to think, reason, and act, potentially leading to massive financial loss from API abuse or the creation of a malicious clone.”Microsoft is also pushing ahead with native support for Model Context Protocol (MCP) in Windows, all while security researchers have warned of the risks of MCP in recent months. If the NLWeb flaw is anything to go by, Microsoft will need to take an extra careful approach of balancing the speed of rolling out new AI features versus sticking to security being the number one priority.

The world of Marvel Comics is vast and filled with tons of iconic superhero characters that people love. The universe itself has been the inspiration for a ton of great video games released over the years, with some of them going on to become classics of the eras they released. Whether you were a fan of Earth's mightiest heroes, or loved following the exploits of a friendly neighborhood vigilante, Marvel video games have always been action-packed experiences. Most recently, Marvel games have moved into territory that has been different from many of the classics that came before, often with varying degrees of success and a range of reactions from players. But there are those few games that stand tall as examples of the best parts of the Marvel universe and the stories it can tell about exciting superheroes and their adventures.

OpenAI released a new free and open GPT model yesterday that can run on a PC, and now Microsoft is making that easy to do for Windows users. The lightweight gpt-oss-20b model is now available on Windows AI Foundry, and will be coming soon to macOS, too.You’ll need a PC or laptop with at least 16GB of VRAM, so you’ll need one of the top GPUs from Nvidia or the variety of Radeon GPUs with sufficient VRAM. The gpt-oss-20b model is optimized for code execution and tool use, and Microsoft says it’s “perfect for building autonomous assistants or embedding AI into real-world workflows, even in bandwidth-constrained environments.”Microsoft has pre-optimized gpt-oss-20b for local inference, and it hints that support for more devices is coming soon. That could mean we see a more optimized version for Copilot Plus PCs at some point in the future, much like how Microsoft has been adding a variety of local AI models to Windows recently.Microsoft’s speedy addition of OpenAI’s latest model to the Windows AI Foundry comes as Amazon was equally quick to adopt the new open-weight GPT-OSS models for its cloud services. It’s the first time you can run an OpenAI model locally on Windows, but it’s also the first time Microsoft’s biggest cloud competitor has had access to the latest OpenAI models — adding another dynamic to the complicated OpenAI and Microsoft partnership.

Canceling an Adobe subscription is no mean feat. It can take months of consideration before taking the plunge and pulling the creative money plug. After a long time questioning whether I should avoid Adobe tools and testing out a myriad of creative software alternatives, these are the five major things I should have considered before canceling my Adobe subscription. Hindsight is a wonderful thing, and if my lack of forethought can benefit anyone else, then it’s a win for me, at least.

Nintendo is the undisputed king of handheld gaming consoles. For decades, the company has released multiple portable systems that have gone on to become legendary with gamers who love their ensemble of franchises. But after the release of the Nintendo DS system, Nintendo tried something different that blended together their recent success with something they tried in the past. The Nintendo 3DS was a system that offered players quality games with the option of enabling non-glasses wearing 3D effects, adding extra depth to the visuals displayed on the screen. For Nintendo fans, this was a unique feature that wasn't being made by any other company with games that were fun to play. The success of the console led to many different types of titles being released, building up the 3DS library of games that people have fond memories of.

Nvidia’s chief security officer has published a blog post insisting that its GPUs “do not and should not have kill switches and backdoors.” It comes amid pressure from both sides of the Pacific, with some US lawmakers pushing Nvidia to grant the government backdoors to AI chips, while Chinese officials have alleged that they already exist.David Reber Jr.’s post seems pointedly directed at US lawmakers. In May a bipartisan group introduced the Chip Security Act, a bill that would require Nvidia and other manufacturers to include tracking technology to identify when chips are illegally transported internationally, and leaves the door open for further security measures including remote kill switches. While Nvidia is expecting to be granted permits to once again sell certain AI chips in China, its most powerful hardware is still under strict US export controls there and elsewhere.“To mitigate the risk of misuse, some pundits and policymakers propose requiring hardware ‘kill switches’ or built-in controls that can remotely disable GPUs without user knowledge and consent,” wrote Reber Jr. “Some suspect they might already exist,” he continues, in a nod to a probe already launched in China over alleged “loopholes and backdoor” vulnerabilities in the H20 chips that have been sold in the country.“There is no such thing as a ‘good’ secret backdoor,” Reber Jr. argues, “only dangerous vulnerabilities that need to be eliminated.” He goes on to call kill switches “an open invitation for disaster,” before making it explicit that his intended audience is US policymakers: “That’s not sound policy. It’s an overreaction that would irreparably harm America’s economic and national security interests.”Both Nvidia and the US government would like the company to be the dominant supplier of AI chips to China, but the suggestion of direct US access to the hardware might put that at risk. Chinese chip companies are steadily improving their performance and production capacity, as China looks for a homegrown alternative. That raises the possibility that Nvidia will be usurped in the market by Huawei, a company that knows a thing or two about losing market share over alleged government access.

It seems that AI has really shaken the tech world down to its core. With Microsoft and Apple adopting AI big-time, you'd be forgiven for thinking that Linux users would have passed on this tech trend. However, a recent project has proved us wrong, as the GNOME-based AI assistant, Newelle, has just been released in its 1.0 state.

It’s no secret that Adobe Creative Cloud is the gold standard for creative software. But it can start to feel like renting your creativity, which isn’t the best option for solo creators, students, or anyone on a budget. This is why I finally parted with the Creative Cloud — the monthly fees became too overwhelming, and I also had concerns about my data privacy.

My NAS was initially a personal project, set up to help me better manage my storage setup, which consisted of numerous portable drives at the time. However, over time, I managed to convince my family to share the device and appreciate the convenience it offers. It didn’t take too long to see that it’d be a task that would need a lot of habit changes — because no one should be deleting files stored by another person or messing up the NAS’s core settings.

The keyboard and mouse are weird relics in the computing world. We've seen a ton of different concepts that aim to revolutionise each of them, make them more ergonomic and useful for our needs in a modern era. Still, we always seem to default back to the traditional designs that we've come to know over the years. And that's not even touching upon products that claim they'll make the keyboard and mouse redundant; I don't think I've ever seen one catch on in a big way.

It doesn't take much to build a PC nowadays, which is great if you're looking to dive in on a budget. While there are many ways to build a PC, we think this Intel Core i5 CPU is a good way to go if you're looking for something cheap and powerful. You can now grab it from Woot with a steep discount at just $100, which is a fantastic price.

Every time I built a new PC, I wasted several hours going through spec sheets before deciding on a RAM kit that I really liked. I used to obsess over every minute detail, trying to convince myself that the extra price would be worth it in the long run. But in reality, they didn't offer meaningful improvements. I encountered CPU bottlenecks before RAM speed and timings ever became a problem. There was really little to no benefit in chasing numbers that looked impressive on paper.