Feed aggregator

• China launched a fully autonomous vulnerability hunting attack against Taiwan
• The attack leveraged eight open-source AI models to hunt for new attack vectors
• The attack hit Taiwan government accounts, personnel records, the nuclear safety agency, and more

A first-of-its-kind cyberattack using autonomous AI has been spotted attacking Taiwan, and it compromised 85 government accounts and stole over 2,500 personnel records before moving on to hit the country’s nuclear safety agency and at least seven energy companies.

The attack used eight open-source AI models to build a hacking program that was able to independently conduct reconnaissance and intrusion, and was able to chain vulnerabilities and change tactics whenever it was blocked.

The intrusion took place over the course of four days, and was first exposed by The Financial Times on August 12, 2026. The FT article covered research performed by Dream, an Israeli AI and cyberdefense company that first identified the breach.

Autonomous AI attack

The attack was first uncovered during routine monitoring of cyber criminal activity. Dream found a 160MB online archive of 1,395 files. Further examination of the files revealed that the attack relied on Hermes and OpenClaw - two open-source AI agents.

As is typical of attacks relying on AI models, the hackers had framed the context of the intrusion as a routine cyber readiness test in order to bypass the built-in guardrails of the AI models.

The attack used multiple agents to hunt for new vulnerabilities and access points across the internet, providing the tool with multiple attack paths to take if one failed to gain entry.

AI agents have been quickly integrated into the attacks of cybercriminal organizations and state-sponsored threat actors alike, enhancing their abilities to launch highly complex attacks at scale. “This must be the basic assumption of every government around the globe,” said Amir Becker, Dream's chief strategy officer.

Dream did not tie the attack to any specific cybercriminal group, nor did it confirm the target of the attack, but said it had alerted a government in the “Asia-Pacific.” Documentation within the recovered archive contained Simplified Chinese, which is the official written language used in mainland China.

The archive also contained data collected from the targets, which was written in Traditional Chinese. This form of written Chinese is widely used in Taiwan, Hong Kong, and Macau.

Taiwan's Ministry of Digital Affairs has refused to comment on the breach, and the Chinese authorities have not responded to requests for comment.

China has long considered Taiwan to be a part of mainland China. Taiwan declared its independence following the end of the Chinese Civil War in 1949. A report from Taiwan’s National Security Bureau earlier this year revealed that the country was subject to 2.5 million Chinese cyberattacks per day in 2025.

Expert perspective on autonomous AI attack

Collin Hogue-Spears, senior director of solution management at Black Duck:

The agents ran the intrusion end to end and invented nothing new to run it with. Familiar identity and API failures opened every confirmed path into Taiwan's systems. Dream Research Labs documented up to eight subagents working concurrently across twelve waves, ranking attack paths, redirecting when a technique failed, and researching alternatives online before trying again.

What they found was exposed development endpoints, an API accepting authentication tokens with the signature check disabled, unauthenticated data APIs, and passwords built from employee ID numbers.

The framework also ran its own AI static analysis hunting unknown flaws, but Dream says it worked against two public single sign-on SDK sample projects, and none of those findings produced a confirmed exploit on the live systems. No zero-day appears anywhere in the report, but a nuclear safety regulator does.

In conventional web and identity logs, this reads as a security scan. The distinguishing signal is the sequence across systems, not any single request. The tell is not the request. It is what the same account does next, somewhere else.

Conventional scanners have tested thousands of endpoints at machine speed for twenty years, so raw coverage is not the change here. What Dream Research Labs describes is chaining: password spraying, then fresh SSO sessions, then access to routes an account had never touched, then the same suspected weakness retested until it held, then one identity surfacing across several connected applications.

The evidence therefore supports a Chinese Mainland-language operator against a Taiwanese target, with a target profile consistent with mainland collection priorities.

Simplified Chinese in the operator's notes is one signal. Traditional Chinese in the stolen files is just Taiwan. Dream rested its China assessment on a code-switching observation, and only half of it points at the attacker. Per Chinese-language coverage of the report, Simplified characters appeared in the operators' internal communications and Traditional characters appeared in the exfiltrated data. The first describes the operator's working language. The second describes the victim, because that is what Taiwanese government files look like [Traditional Characters].

The evidence therefore supports a Chinese Mainland-language operator against a Taiwanese target, with a target profile consistent with mainland collection priorities. It does not name a group or establish state direction. The report also publishes no indicators, no hashes, and no victim confirmation; it does not identify the model, and its executive summary claims installed backdoors while its own attack chain says authentication blocked the web shell.

Security leaders must reject unsigned authentication tokens and prohibit the alg:none setting outright, and separately require reauthentication or multi-factor at any single sign-on boundary into a sensitive system. Dream describes two independent identity failures in Taiwan, and closing one leaves the other open. Provider guardrails cannot compensate for a password-only SSO bridge.

They must also monitor route diversity per source, per session, per account, and per device rather than by request rate alone, because a distributed set of agents spreads requests across addresses and sessions that no single volume threshold catches. If your detection assumes one attacker at one address working one path at a time, you have modeled the wrong shape.

Your thresholds were built for one attacker on one path. This was eight, in parallel. And they must ask two questions of any AI attack disclosure before acting on it: which model ran the operation, and what can we hunt on tomorrow morning?"

Via United24

People ask Tucker Bryant’s ChatTJB for advice on everything from their fiction and personal dilemmas to how they should spend their free time.

The board voted to close the Washington, D.C., arts complex's main campus for a $250 million renovation — three months after a federal judge temporarily blocked a similar closure.

(Image credit: Alex Wroblewski)

Starting as a spinoff of a renowned VPN service called Hola more than a decade ago, Bright Data is among the best providers of proxy services on the market right now. The platform commands a massive ecosystem featuring 400+ million monthly rotating residential IPs and 1.3+ million static ISP and datacenter proxies each, spanning 195 countries.

Lately, the service has notably been pushing beyond “mere” proxy rotation into a complete web data platform equipped with AI-powered web unlockers, SERP and scraper APIs, and pre-collected structured datasets, to name a few things.

• Want to try Bright Data? Check out the website here

Plans and Pricing

Bright Data has quite a few products listed on its pricing page. Let’s start with proxies, namely residential, ISP, and datacenter variants.

Users pay for residential proxies according to the bandwidth they consume. Bright Data offers three standard plans, currently at a 50% discount for the first three months: $499 monthly for 141 GB, $999 monthly for 332 GB, and $1,999 monthly for 798 GB. Alternatively, you can choose the pay-as-you-go option starting at $4 per GB. The drawback is that the pay-as-you-go plan is slightly more expensive in the long run ($4 per GB compared to $3.5 per GB on the 141 GB plan). If you need more than 1 TB, you can reach out to the company for customized pricing.

For datacenter proxies, users can pay according to the number of IP addresses they require. The shared proxy plans (dedicated proxies are pricier) are 10 IPs at $14 per month ($1.4 per IP), 100 IPs at $100 per month ($1 per IP), 500 IPs for $475 per month ($0.95 per IP), and 1,000 IPs at $900 per month ($0.9 per IP). As with residential proxies, if these plans don’t meet your needs, you can contact the company for tailored pricing above 1,000 IPs. Users can also pay for datacenter proxies according to bandwidth. The standard plans are $499 monthly for 1 TB, $999 monthly for 2 TB, and $1,999 monthly for 5 TB. The pay-as-you-go option with no monthly commitment costs $0.6 per GB.

If you need ISP proxies, Bright Data has four plans to offer you: $18/month for 10 IPs ($1.8 per IP), $145/month for 100 IPs ($1.45 per IP), $700/month for 500 IPs ($1.4 per IP), and $1,300/month for 1,000 IPs ($1.3 per IP). You can also pay for ISP proxies according to bandwidth. Bright Data recently doubled the allowance, so now you pay $499 monthly for 71 GB, $999 monthly for 166 GB, and $1,999 monthly for 399 GB. The pay-as-you-go option also saw changes, with no monthly commitment costing $8 per GB.

Dedicated ISP IPs are a bit more expensive but follow the same structure. Similar to residential and datacenter plans, should you require over 1,000 IPs or 1 TB, you’ll need to check in with the Bright Data team directly.

It seems that Bright Data has slowly phased out mobile proxies from its proxy offer. Existing users with an active mobile proxy can continue to use the proxies, but the service is now unavailable to new signups and inactive accounts.

Bright Data offers sophisticated web access APIs with its Unlocker API pricing coming in four versions. First, the Free Tier (found in most products) grants you 5,000 requests per month. Then, there are three Scale plans: $499 monthly for 383,000 requests ($1.3 per 1,000 additional requests), $999 monthly for 908,000 requests ($1.1 per 1,000 additional requests), and $1,999 monthly for 2 million requests ($1 per 1,000 additional requests). The company also offers a custom pricing option for enterprise-level projects. If you don’t want a monthly commitment, you can choose the $1.5 per 1,000 results pay-as-you-go plan.

The Web Scraper API, SERP API, Crawl API, and Scraper Studio (AI-powered development environment for building and deploying custom scrapers) are identically priced, with tiny differences regarding the number of requests/page loads included. The Browser API pricing follows much the same sentiment, costing $499/month for 71 GB, $999/month for 166 GB, and $1,999/month for 399 GB. The no-commitment option is charged $8 per GB.

Bright Data also offers pre-built datasets, a unique feature that many proxy platforms don’t have. Starting at $250 per month for 100,000 records, these datasets allow businesses to access ready-made data instead of scraping it from scratch at higher costs. Available datasets include Amazon products, Yahoo Finance stock market data, Zillow real estate listings, LinkedIn profiles, and much, much more.

Finally, the Data Firehose product delivers a continuous, real-time stream of live web data, while Web Archive provides direct programmatic access to a 90 PB cached repository of the web. Pricing is based on the pay-as-you-go rate, starting at $0.20 per 1,000 HTMLs for Data Firehose and $1 per 1,000 HTML records for archived data. For projects with large data needs, long-term commitments, or multiple scrapers, volume discounts are available through Bright Data's team.

Features

Accessing Bright Data’s features starts with registration. To sign up as a new user, you’ll need a work email address, but the platform also supports logging in with Google and GitHub accounts. You'll receive a verification email after signing up and creating a password.

Residential Proxies

Bright Data offers proxy IP addresses sourced ethically from physical devices worldwide. This means that device owners (peers) explicitly opt in to share their idle bandwidth and IP addresses in exchange for perks like ad-free app experiences, cash payouts, or free premium software such as BrightVPN. Bright Data’s users can then choose one of the IPs to bypass geo-restrictions and scrape data.

Default proxy behavior rotates per request, though Bright Data also supports sticky sessions where the same residential IP is active for a specified duration, as well as custom AI-driven rotation rules. The platform offers more than 400 million ethically sourced residential proxies from 195 countries with precise country-, state-, city-, ZIP code-, and ASN-level targeting. The most popular locations are the United States, Brazil, India, Germany, the United Kingdom, and China.

(Image credit: Bright Data )

During our test, the residential proxies had excellent speed and reliability. Both static and rotating proxies allowed us to surf the web seamlessly and bypass strict website geo-restrictions. You can manage all proxies from your user dashboard, deploying new ones or removing existing ones at will.

Bright Data gives you significant control over your proxies. You can choose proxies from specific cities, states, and countries. The robust IP network, especially in Europe and North America, makes it easier to bypass geo-restrictions. If an IP address can’t successfully bypass the restriction, Bright Data rotates different IP addresses until it succeeds.

ISP Proxies

ISP proxies are static residential proxies sourced directly from Internet Service Providers (ISPs). Unlike residential IPs that rotate with each browsing session, a static ISP proxy is assigned only to you. You can keep this static IP for as long as your subscription lasts.

Bright Data offers a network of 1,300,000+ fully compliant static IPs spanning 35 countries. The U.S. commands the vast majority of this infrastructure with over 1.17 million static IPs, whereas international locations account for smaller, dedicated pools of fewer than 15,000 each. This smaller number is expected because of the higher costs and difficulty of obtaining IP addresses directly from ISPs.

The static ISP proxies offered excellent speed and reliability during our test. Bright Data lets users manage static IPs directly from their Control Panel or an external API. The user-friendly Control Panel makes it easy to deploy and organize a large number of proxies.

ISP proxies are more reliable than typical residential proxies because they don’t change frequently. Using one IP address for a long period makes it easier to browse anonymously and break through geographical and IP website restrictions. Once you bypass a site’s restriction with a static IP, you can continue accessing the site with that IP. In contrast, rotating proxies mean you can bypass a site’s restriction today and struggle to bypass it tomorrow with a new IP address. Expectedly, Bright Data’s static IPs cost more than rotating IPs.

Datacenter Proxies

Datacenter proxies are sourced from secondary corporations and high-speed server hubs rather than ISPs. A server (in a datacenter) with a unique IP acts as the intermediary between your device and a website you want to access. You can request a shared or dedicated datacenter IP: a dedicated IP is more reliable in circumventing site blockades.

(Image credit: Bright Data)

Bright Data offers over 1.6 million datacenter proxies across 98+ countries, unlike residential proxies available in 195 countries. You can select your datacenter proxy by specific country, state, city, or ASN. These proxies are the fastest option in Bright Data's lineup because your browser request is sent directly from the proxy server to the target website, unlike residential proxies that bounce through several peer devices before reaching the target site.

The drawback is that datacenter proxies are more vulnerable to detection and automated bans because of their predictable IP subnet ranges. They are cost-effective but less efficient at bypassing geo-restrictions than residential and ISP proxies.

Web Scraper API

Web scraping is one of the most common use cases for proxy servers. Some businesses need to scrape massive amounts of data from a website, e.g., pricing data from retail sites. However, many websites discourage scraping by implementing geographical and IP restrictions. Proxy IPs let businesses bypass these restrictions and scrape their desired data.

(Image credit: Bright Data)

As a first-rate platform, Bright Data doesn’t stop at providing proxy IP addresses for web scraping. It also provides APIs that let businesses automate data scraping without writing complex parsing code or managing proxy pools. It has north of 600 ready-made scraping APIs for websites like Facebook, Amazon, Instagram, LinkedIn, Zillow, X, ChatGPT, YouTube, and TikTok, as well as the AI-powered Scraper Studio for turning any unlisted site into a structured data pipeline. Several websites, such as Facebook, have filed lawsuits to block these scraping APIs, but Bright Data has countersued and prevailed.

Suppose you run a price comparison site that helps people find the best e-commerce deals. You can use Bright Data’s APIs to automate data scraping from Amazon, Walmart, eBay, and other popular e-commerce sites. You’ll then clean the scraped data and display it on your price comparison website.

Bright Data's APIs can handle bulk asynchronous scraping requests, convert raw HTML into structured data, deliver payloads straight to S3/Cloud Storage, and validate data automatically with built-in self-healing parsers.

Datasets

You don’t always have to scrape data from scratch. Bright Data offers an alternative: ready-made datasets sourced from 250+ domains and 700+ structured datasets. It includes the likes of LinkedIn (profiles, company data, job postings), Pinterest, Crunchbase, Amazon, Instagram, Google Maps, and Redfin. You can also get categorical datasets, such as car prices, housing prices, crime rates, NBA players' stats, etc.

(Image credit: Bright Data)

Pre-built datasets reduce headaches for businesses. Instead of scraping data from scratch and waiting a while to access it, you can access over 21 billion clean, validated records. Bright Data even provides an AI prompt tool that lets you describe (in plain English) the precise subset of data you need to filter out fluff before paying.

Ease of Use

Bright Data has an intuitive interface you’ll likely enjoy using. The left menu has all the features you need to access, and the right side is the main dashboard displaying real-time traffic analytics, success rates, bandwidth usage, and so forth. Many features are neatly arranged across the dashboard to make them easy to find. With a white background and a few contrasting colors, Bright Data’s interface looks visually pleasing.

(Image credit: Bright Data)

You can access this proxy software primarily from the cloud-based web dashboard. There’s also a Google Chrome and Firefox extension that lets you seamlessly change proxy locations, switch between IP types, and rotate IPs on demand. For complex, large-scale scraping, Bright Data also offers an open-source downloadable Proxy Manager app. The platform’s user-friendliness is unmatched by most rivals, thanks to a fine balance of accessible self-service controls and dev-oriented technical options.

Customer Support

One of Bright Data’s strengths is its top-notch support. You can contact its support team 24/7 and receive a response in less than 30 minutes. It offers support via a dashboard ticketing system, web chat, and email, along with dedicated Slack channels and technical account managers (TAMs) for enterprise accounts, but there’s no telephone support.

Bright Data also provides extensive documentation and user manuals to help users figure out solutions to their problems. The website’s Docs section contains detailed guides for all features and interactive code builders, plus an API reference that helps users write effective data scraping commands.

We found Bright Data’s documentation easy to follow and helpful for our test. For instance, we followed the web scraping tutorial to harvest data from an external website.

The Competition

There’s no shortage of rivals to Bright Data, and the ones we’d like to highlight are Decodo (formerly Smartproxy), Oxylabs, and Webshare.

Decodo is an excellent mid-market proxy provider offering residential, ISP, and datacenter proxies. It's a cost-effective alternative with a large pool of 125 million+ IPs across 195 countries. However, Bright Data has a larger IP pool across the same number of countries and offers more features and customizability.

Oxylabs offers a slightly larger IP pool, with 175 million+ addresses compared to Bright Data’s 400 million+. Both platforms have similar enterprise-grade offerings, but Bright Data provides some features not available in the other, such as a dataset marketplace and browser-based Scraper Studio. Bright Data also has a more responsive support team than Oxylabs, according to our experience when testing both.

Webshare is one of the best alternatives budget-wise that go head-to-head with Bright Data. It’s a notably more affordable tool, including a permanent 10-proxy free tier, which is crucial for small businesses. It offers effective APIs to scrape data en masse, just like Bright Data. However, Webshare has a much smaller pool of IP addresses: roughly 80 million compared to Bright Data’s 400 million.

Final Verdict

Morphing into a full-stack web data platform that goes beyond basic proxy services, Bright Data offers a sizable network of 400 million+ IPs covering 195 countries across residential, datacenter, and static ISP tiers. It pairs its foundational proxy service with an unrivaled suite of data collection and scraping automation tools that include over 600 specialized web scraping and crawling APIs, AI-powered web unlockers, and datasets containing over 21 billion ready-made records.

Thanks to all these features, it’s more than well equipped to provide you with anything you need to bypass website restrictions and scrape required data (developers and AI research teams will particularly be happy with the scope of features). There are a few drawbacks here and there, primarily its higher cost compared to the competition, but it might well be worth it, especially for high-volume needs.

We've also highlighted the best proxy and best VPN

Some users are already joking that the new logo reads “Instagzam.”

Dear oh dear... things aren't going well for Dutton Ranch season 2, are they?

After that explosive Ed Harris interview, we know that filming for new episodes isn't supposed to start until February 2027, but the writers room appears to be fully underway as of August 2026.

Thanks to a new report from the Daily Mail, a slew of new dramatic allegations are supposedly threatening the "mess of a show" behind the scenes, with an insider claiming "there is high drama on that one, so much tension.

"I believe it's the actors that are a huge part of the problem," they add. "Too many people think they are in control over there and that's causing a lot of issues."

Alongside Harris feeling "p*ssed off" with his lack of screen time, Annette Bening's "star power" has also allegedly caused friction behind-the-scenes.

But none of this is what I'm most interested in. Since before Dutton Ranch even premiered, I've been publicly campaigning for Taylor Sheridan to shift his role from executive producer to showrunner (much like what we saw with Yellowstone).

While there's been a confirmed positive step in a similar direction, the newly announced showrunner, Benjamin Cavell, opens up an entirely new can of worms.

Benjamin Cavell as Dutton Ranch season 2 showrunner could turn it from Yellowstone to Lioness

(Image credit: Paramount+)

According to this same report, Sheridan is set to have a "bigger presence" in the Dutton Ranch season 2 writers room, which is music to my ears. In order for Beth (Kelly Reilly) and Rip's (Cole Hauser) new start in Texas to be the best it can be, it needs the biggest amount of Sheridan input possible, so this can only be a good thing.

However, the announcement of Benjamin Cavell as the season 2 showrunner might be a cause for concern. Whereas previous showrunner Chad Feehan had Western experience after leading Lawmen: Bass Reeves, Cavell comes from a more military TV background.

With Homeland, SEAL Team, and Justified all under his belt, I wonder if Cavell would be better suited to the Lioness and Tulsa King branch of Sheridan's work. There's no question that he has an exceptional handle on action, and thanks to the miniseries The Stand, we also know that he understands the Paramount+ audience.

But with the Yellowstone world comes such a specific feel and almost a decade of lore attached, and introducing a total newbie at this stage in the game could be a make-or-break moment for Dutton Ranch's future.

As someone who fell head over heels for the spinoff, I'm willing things to work. But even while we have no idea how much truth there really is to these alleged reports, the fact that they exist at all doesn't fill me with confidence.

• Apple's MacBook Air is facing supply constraints, as delivery estimates last up to a month
• The delivery delays are a direct result of the ongoing RAM crisis
• Consumers may have to look at Windows alternatives, as the RAM crisis gets worse

PC hardware manufacturers can't catch a break from the ongoing RAM crisis, and unfortunately, Apple arguably knows that more than anyone.

As reported by 9to5Mac, MacBook Air shortages are worsening, as delivery estimates for configurations on Apple's online store are longer than usual. Nearly all configurations have a 2-3 week shipment estimate, while those with 32GB of RAM have up to 4-5 weeks.

It's increasingly clear that RAM shortages are causing supply issues for Apple, and the extended delivery estimates come shortly after Apple's recent slate of price hikes on Macs and iPads. Notably, the MacBook Air M5 saw a $200 price increase earlier in June, and despite that, shortages remain.

Supply is so bad that 9to5Mac notes that Apple retail employees state that the MacBook Air shipments are "more constrained than they can ever recall", and that's a fitting statement since the PC hardware market is possibly at its worst state ever.

Fresh rumors also point to Apple being set on a price increase for its iPhone 17 — so without a doubt, proceedings aren't looking great for the tech giant (and several other hardware companies) in terms of supply stability.

Apple also has a history of rarely dropping prices for its devices, so the only other options consumers have are to buy MacBooks from other retailers or consider Windows alternatives.

What now?

(Image credit: Shutterstock / D.L.Sakharova)

Outside of Apple's online store, Amazon currently has the 13-inch M5 MacBook Air available at a lower price ($1,256) and a shorter delivery window using Prime. The same applies to several other configurations, including the 15-inch model.

Apple's RAM and supply constraints won't end anytime soon, so Windows alternatives are also sensible for consumers to aim for. The Lenovo Yoga Slim 7x, Yoga Slim 7i Aura, and even Dell's XPS 13 are solid laptop options. They may not all match the MacBook Air in performance, but they are enough to get the job done.

There's no better time than now for consumers to act on purchasing a new laptop, as insiders like Mark Gurman and even Apple chief financial officer Kevan Parekh indicate that Apple's supply constraints aren't set to improve, but only worsen — and that likely extends to 2027 and beyond.

A surprise hearing this Friday in federal court has added to speculation that Luigi Mangione could enter a plea, which could derail a state murder trial.

(Image credit: Steven Hirsch)

The four southernmost islands of the chain also are claimed by Japan, which calls them the Northern Territories.

(Image credit: Gavriil Grigorov)

• Nightmare Eclipse discloses ShieldBreak, a new Windows privilege‑escalation zero‑day
• Flaw bypasses a recent patch and works on fully updated Windows 11 systems
• Researcher’s ongoing exploit spree leaves multiple Windows vulnerabilities still unpatched

Nightmare Eclipse has struck again! The notorious zero-day researcher with a Microsoft grudge disclosed its latest vulnerability, and just as in previous instances, they picked their timing and released their research hours after Microsoft published its August Patch Tuesday cumulative update in order to maximize the hurt.

The newest flaw is called ShieldBreak, and is described as a local escalation of privilege vulnerability that allows threat actors to gain SYSTEM-level privileges on vulnerable systems. Speaking of vulnerable systems, the list is rather long because it includes all versions of Windows 11, including those with the latest security patches.

“The PoC was tested in the latest version of windows 11 25h2 (+Canary channel) and windows server 2025, the PoC also have a 100% success rate,” Nightmare Eclipse said on their GitHub account. “Please note that Windows 10 (and respective server editions) are not currently supported, they are however vulnerable to ShieldBreak as well.”

A bypass for the RoguePlanet fix

The mysterious attacker also said that the bug was actually a bypass for the patch Microsoft issued to fix their earlier work, called RoguePlanet.

“Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass,” the GitHub read entry.

Microsoft, on the other hand, responded in pure enterprise fashion, sharing a boilerplate statement that it was “investigating” and that it “supports coordinated vulnerability disclosure”.

In response to an enquiry by The Register, a company spokesperson said Microsoft "is aware of the reported vulnerability and is actively investigating the validity and potential applicability of these claims."

"Microsoft is committed to investigating security issues and updating impacted products to protect customers as soon as possible,” the statement reads. “Importantly, we support coordinated vulnerability disclosure, an industry standard that protects customers and supports the research community by ensuring their findings are thoroughly investigated and addressed before being made public."

A hacker on a mission

Together with ShieldBreak, the number of disclosed Windows vulnerabilities and exploits now counts 10. Nightmare Eclipse’s campaign began in April 2026, when they demonstrated BlueHammer, a Windows Defender local privilege-escalation flaw that gives low-privileged users SYSTEM-level access. The researcher claimed BlueHammer, now tracked as CVE-2026-33825, was previously reported to Microsoft, but the company allegedly mishandled the disclosure.

Just before publishing the work, they said “someone violated our agreement and left me homeless with nothing. They knew this will happen and they still stabbed me in the back anyways, this is their decision not mine.”

At first, Microsoft took a tough stance, calling the public release “never justifiable” and even warning that it might pursue legal cases against people who put customers at risk.

The community interpreted this statement as a threat of legal action against Nightmare Eclipse, which triggered a backlash. Microsoft later backed away, saying “to be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research.”

In the meantime, Nightmare Eclipse (also known as Chaotic Eclipse) went on a full-blown rampage. They released RedSun and UnDefend (both targeting Defender), YellowKey (a BitLocker bypass), GreenPlasma (a CTFMON-based privilege-escalation flaw), MiniPlasma (a regression of a vulnerability Microsoft had originally fixed in 2020), RoguePlanet (another Defender privilege-escalation bug), GreatXML (a BitLocker/Windows Recovery Environment bypass), LegacyHive (a Windows User Profile Service privilege-escalation flaw), and now ShieldBreak.

BlueHammer was fixed in April, RedSun and UnDefend in May, and YellowKey, GreenPlasma, and MiniPlasma, in June. RoguePlanet was patched in July, while LegacyHive, GreatXML, and ShieldBreak, remain unpatched.

It is also worth mentioning that not all of Nightmare Eclipse’s releases were equally complete or reproducible by third parties. For GreenPlasma, independent researchers said it contained the vulnerability but turning it into a reliable working exploit required significant additional technical work. Some of the early Defender exploits were also apparently difficult to reproduce, mostly because they relied on delicate race conditions and very specific sequences of Windows components.

ShieldBreak, however, seems to be more dangerous in that respect. Speaking to The Register, security researcher Kevin Beaumont confirmed it as working: “I've tried it, it works on latest Windows 11,” he told the publication.

He also said that while ShieldBreak was described as a bypass for the RoguePlanet fix, the two flaws actually operated quite differently.

“RoguePlanet was a filesystem race condition vuln that uses virtual disks and NT native file manipulation to trick quarantine process into overwriting system files,” Beaumont explained. “ShieldBreak user-mode callback hook to change file contents during a Defender cloud-hydration scan via cfapi (Cloud Filter API).”

No one knows how much ammunition Nightmare Eclipse still has, but we will certainly be paying attention to them in the hours after next month’s Patch Tuesday, as well.

• Fans think they've uncovered The Elder Scrolls 6's eight-letter subtitle
• Redditor 'starfieldnovember' suggests the subtitle is "Sentinel"
• The clue comes from Starfield's character creator and employee number, which, translated via the alphabet, spells "Sentinel"

The Elder Scrolls 6 fans believe they've uncovered the game's secret subtitle, and it may have been under our noses the entire time.

Earlier this week, Xbox CEO Asha Sharma shared an X post that blew up, which read, "Live playthrough of The Elder Scrolls 6: ******** this morning. The scale and grandeur are incredible. The story is even greater."

Of course, fans instantly began speculating what those eight asterisks could be; Hammerfell? Nope, too many letters. Redguard? Already been used. But one fan has offered up their own theory, and it's the best one yet.

According to Redditor 'starfieldnovember', The Elder Scrolls 6's subtitle could be "Sentinel," and the clue has been hidden in Starfield's character creator without anyone realizing until now (via IGN).

"By the way, Sentinel was already teased in Starfield," they began. "In Starfield Direct and in the final game, we can see our employee number during character creation. Random string of numbers at first look, but if you translate it by dividing it into pairs and then using the corresponding letter of the alphabet, you get SENTINEL.

"This title was at our noses for more than 3 years, and we somehow missed it."

By the way, Sentinel was already teased in Starfield from r/TESVI

Other fans seem to agree with the theory, not only because Bethesda loves to hide easter eggs in its games, but because Sentinel is a major coastal capital city located in the northwestern hills of Hammerfell, which is rumored to be the setting of The Elder Scrolls 6.

What's more, Bethesda developer Michael Kirkbride replied "Yep" to a separate Reddit post after a fan suggested the name could be Sentinel, which seems like a done deal, but we'll have to wait and see.

The Elder Scrolls 6 was revealed in June 2018, and its announcement has now become as old as The Elder Scrolls 5: Skyrim was at the time. Over eight years later, there's still no development update on the game, besides Sharma's confirmation that she's played it, and no release date.

In November 2025, Todd Howard, director and executive producer at Bethesda Game Studios, said the game is "still a long way off," and revealed at the time that the studio "did a big play test."

It was also speculated that Bethesda could shadowdrop the game, just like The Elder Scrolls 4: Oblivion Remastered in April 2025, and when the idea was brought up to Howard, he didn't immediately reject it.

"You might say that was a test run. It worked out well," he said on Oblivion Remastered.

In the meantime, Bethesda is currently working on remasters of both Fallout 3 and Fallout: New Vegas, and continuing support for Starfield.

• Researchers are developing a tent that could produce its own electricity
• It's made out of magnetoelastic material
• It's still in early stages, but scientists intent to use them in off-grid camps and disaster zones

There are plenty of high-tech camping accessories you can get your hands on to spruce up your outdoor vacations — but have you ever thought about a tent that can produce its own electricity? Well, it could be the future of camping.

Researchers have been developing a ‘magnetoelastic’ tent that could generate and harvest its own electricity, kind of like a wind turbine, but one that you sleep in and use to power small devices. I thought I’ve seen my fair share of whacky tech, but this discovery is truly something else.

The tent is made out of a special material with ‘magnetoelasticity’, a textile property that can produce electrical energy from bending and stretching motions, which was first coined by physicist Emilio Villari in 1865. But it relies on fabric layering to harness its electrical production powers.

As mentioned in the Cell Press journal, Matter, the tent’s design consists of a magnetomechanical coupling layer and a magnetic induction layer. This is fused together with weaving patterns, layer stacking, and conductive fiber, allowing the tent to respond to movement.

The tent consists of two different components, one for the flooring and another for the roof. While the tent floor integrates woven fabric embedded with magnetoelastic ribbons, its roof features a layered material made of conductive fibers and magnetoelastic film.

(Image credit: Cell Press / Matter)

The interesting part is that the material can respond to more than just human movement happening inside the tent — it can absorb action from environmental surroundings, too. Even motions such as wind and movement during the setup can also help — but how?

Essentially, the material’s fabric state shifts when it bends and flexes, converting mechanical movement into electricity through induction. During the testing period, researchers found that hand-tapping a small sample of the material could charge a 0.22-μF capacitor to 5.80V in 1.5 seconds. While this is nowhere near enough to power a smartphone, for example, it shows that the material certainly has potential.

Despite the successful early-stage experiments, there’s still a long way to go before it becomes a fully realized product, but the researchers behind it have a vision.

For them, the tent isn’t intended for leisurely camping trips. Instead, they see it as the ideal opportunity to provide sanctuary in shelters, disaster zones, off-grid camps, and areas where electricity access is limited or relies solely on sunlight.

That’s one of the clever elements of the tent: it doesn’t need the sun to power itself as solar panels do. Motion alone is enough to give the tent the power it needs to create its own source of energy, meaning that it can function in the shade and after sunset.

On paper it’s a genius product, but there are many tests that are yet to come — so don’t expect to score one in time for Glastonbury 2027.

• WindRelay campaign used vishing plus custom malware to turn phones into POS skimmers
• Victims installed personalized RATs and NFC malware, enabling real‑time card theft
• Attacks were highly targeted across Eastern Europe, with only a few individuals hit

Hackers are turning people’s smartphones into malicious Point of Sale (POS) devices and stealing their money directly from their payment cards, experts have warned.

Security researchers Group-IB spotted multiple such attacks across Eastern Europe, and named the campaign WindRelay, after the custom-built malware used during the attacks.

The report notes this is a highly sophisticated, custom-tailored attack designed specifically for the victim. It starts with some form of reconnaissance, in which the attackers learn their victim’s identity, phone number, and likely other details. Although the researchers don’t discuss it, it is quite possible that the attackers obtained (or purchased) the data from unrelated data breaches and leaks.

Vishing and malware

After learning a little bit about their target, the attackers get to work. They first prepare a remote access trojan (RAT) named SpyNote. They personalize the label with the victim’s own name (instead of it being a generic or impersonated brand), to build trust with their victim:

“Such tactics are more effective at weakening a victim’s natural defenses and suspicions,” the researchers noted in the report. “It removes the one cue people are trained to check before installing something unfamiliar — a strange or generic app name — right at the moment they’re most likely to hesitate.”

Then, they call the victim on the phone and introduce themselves as employees of their target’s bank. They claim the victim has a problem with their bank card, and instruct them to deploy SpyNote through the device’s package installer (the standard way to sideload apps outside an official app store).

SpyNote is a classic RAT that the attackers then use to deploy stage-two malware themselves. In this next step, they personally (as opposed to having the victim do it) install WindRelay, custom near-field communication (NFC) malware designed to capture contactless payment card data in real-time, when a card is tapped against the phone.

In other words, the malware turns the smartphone into a POS, and when a victim taps their card against it, the information is relayed to an attacker’s terminal.

Vishing + malware

Vishing + malware combo is nothing new. We’ve seen it deployed numerous times before, and ShinyHunters are probably the shiniest example of the practice (pun definitely intended). Over the last couple of years, ShinyHunters have been calling their victims on the phone, impersonating the IT department, and getting their victims to log in via fake login portals which relay the credentials to the attackers.

They then use the credentials to access their victims’ SaaS products, exfiltrate as much sensitive data as possible, and then demand ransom in exchange for deleting the stolen files.

This new campaign, however, is a testament to the technique’s evolution. While ShinyHunters’ operatives only stay on the phone call until the victim logs in, these crooks remain on the line for as long as it takes. Group-IB says the average call lasts around 13 minutes, and by that moment, the victim will have installed both SpyNote and WindRelay, and has tapped their bank card against the phone, making unwanted payments.

In at least one case, the attackers successfully applied for a loan at the victim’s bank, stealing not only the money they had on their account, but also money they would have earned in the future.

The identity of the attackers is unknown at the time. We also don’t know exactly how many victims there were, but given the highly personalized nature of the attack, it’s safe to assume that there were only a handful.

Group-IB says it observed attacks in Czechia, Slovakia, and Slovenia, suggesting a threat actor focused primarily on Eastern European victims. The researchers also said they identified 23 samples uploaded to VirusTotal between November 2025 and July 2026, meaning the campaign was active for approximately seven months, targeting 23 individuals.

“The samples mimic various institutions from the targeted countries and contain text in the language of each targeted country,” the researchers said. “Some samples contain personalized UI elements and labels, such as the name of the victim, similar to the personalized RAT. This suggests the threat actor behind these campaigns most likely has the capability to dynamically build malicious applications tailored to individual victims.”

Group-IB says users should treat personalized app labels as a red flag and should apply extra friction to loan applications.

Russia maintained an iron grip on Crimea since seizing it from Ukraine in 2014. Many Russian civilians go there to enjoy the beaches. But now Ukraine is hitting Crimea hard, upending daily life.

(Image credit: Igor Ivanko)

• A Legend of Zelda Nintendo Switch 2 and Pro Controller have reportedly leaked
• New images posted online appear to show the packaging for 40th anniversary Zelda editions of the console and Pro Controller
• Nintendo has yet to formally announce new special edition hardware

Nintendo could be planning to release a special edition Nintendo Switch 2 and Switch 2 Pro Controller inspired by The Legend of Zelda, after leaked images were posted online.

That's according to the Centro LEAKS account on X (via VGC), which posted two images showing the packaging for the themed Switch 2 and Pro Controller, which are seemingly designed to celebrate Zelda's 40th anniversary.

The Switch 2 has black and green Joy-Cons with the iconic Triforce emblem on one side, while the dock itself has the more elaborate design, showing the gold Triforce on the front.

Similarly, the Pro Controller has black and green grips, with a different gold Triforce in the center. Looking more closely at the packaging, you can also see a 40th anniversary logo.

First limited edition Nintendo Switch 2 coming soon pic.twitter.com/cli7icFkbpAugust 11, 2026

Brazilian journalist and Universo Nintendo editor-in-chief ‘Necro’ Felipe Lima previously claimed to have been shown both products, and in a separate post, said the new images are "exactly as I saw it previously."

If these leaks are real, I'm glad I waited to purchase a Switch 2. However, Nintendo hasn't made an official announcement just yet, but it would be the first special edition Switch 2 since the console launched.

Additionally, while some speculated that Nintendo would release a new special edition Switch 2 alongside The Legend of Zelda: Ocarina of Time remake, which is due to arrive this year, it appears the supposed leaked console may not be inspired by the game.

The Ocarina of Time remake was announced this summer and will be a Switch 2 exclusive, though a launch date hasn't been set.

The changes to Rivian’s electric pickup and SUV are largely nominal, but a new seating configuration and wheel option stand out.

• Crunchyroll is coming to compatible BMW and Mini vehicles
• It comes as part of a new partnership with automotive app distrubition platform Appning
• More than 40 car brands are expected to follow

Popular anime streaming service Crunchyroll is coming to a range of vehicles in a new collaboration with automation app distribution platform Appning.

Soon, owners of compatible BMW and Mini vehicles in the US, UK, and Australia will be able to access Crunchyroll directly through their car's infotainment systems, giving subscribers a new way to catch up with hit shows like Frieren: Beyond Journey's End, My Hero Academia, Haikyu!!, and more.

As a Mini owner and Crunchyroll subscriber I can't wait, and I can already see myself diving into the latest season of Oshi no Ko while parked up waiting at the car wash.

BMW Group cars are just the start, however, with the app expected to steadily roll out to more than 40 automotive brands. Mercedez-Benz, Volkswagen, Leapmotor, and Lotus are just some of the brands that make Appning-enabled vehicles.

Appning owner Forvia estimates that the platform reaches more than 20% of the accessible market share, so if you recently bought a new car there's a decent chance that it will be compatible.

On the announcement, Crunchyroll SVP of global distribution and business development said that "Today’s consumers expect their entertainment to be available wherever they are, including in their vehicle.

"With Crunchyroll coming soon to global automotive partners, the anime experience will be even more accessible on every journey. Through this collaboration with Appning, we’re glad to provide another way for this passionate, global fan community to enjoy their favorite anime.”

Crunchyroll is already available on a wide variety of platforms. You can download the app on your iOS or Android phone, visit the website on your laptop or PC, or access it from a range of games consoles and smart TV devices.

It offers more than 1,000 titles globally, focusing exclusively on Japanese cartoon animation, or anime as it's known. Prices start at $9.99 / £5.99 / AU$11.99 a month for the most basic tier of membership.

VTOMAN FlashSpeed Pro 3600: 30-second review

The FlashSpeed Pro 3600 V-Beyond is VTOMAN's biggest power station yet, built around a 3,096Wh LiFePO4 battery, 3,600W of continuous AC output, and a claimed two-hour full recharge from the wall. It rolls on built-in wheels, carries an IP65 rating, and undercuts most rivals of similar capacity on price.

Launched about a year ago in the USA, this hardware now has regional versions with outlet connections for the UK and Europe.

While this unit could be used at home to provide backup power during a power cut, its true calling is for those going off-grid, perhaps on a building site or while camping, where they need to power appliances away from the power grid.

With its expansion battery option, it offers up to 6kWh of capacity and 3600W of output (peaking at 7200W for high-demand starts). That’s enough for most tools and appliances, and it won’t be exhausted after a few minutes.

It can be charged from the mains, with 12V automotive connections, or using solar DC inputs, and that power can be delivered to numerous outputs that can be run simultaneously.

The primary competitor to the VTOMAN FlashSpeed Pro 3600 is EcoFlow’s DELTA Pro 3, which costs almost twice as much in the UK for a 4kWh model. The extra battery alone for the DELTA Pro 3 costs more than the VTOMAN FlashSpeed Pro 3600 and its 3kWh expansion battery combined.

The price difference might be justified by the device's remote-control sophistication, and EcoFlow products are certainly superior in that respect.

What VTOMAN has focused on with the FlashSpeed Pro 3600 is offering high capacity at an affordable price, and the design largely ignores home installation users. For the capacity and price, this device offers exceptional value, making it impossible to ignore.

Is it one of the best portable power stations? Probably not, but for those looking to have easily transportable power to operate off-grid, it could be incredibly useful.

VTOMAN FlashSpeed Pro 3600: Price & availability

(Image credit: Mark Pickavance)

• How much does it cost? £1,289/€1,499
• When is it out? Available in the USA, UK, and Europe
• Where can you get it? Direct from VTOMAN and through online retailers

The current asking price for the VTOMAN FlashSpeed Pro 3600 V-Beyond is $1299.99 in the US direct from VTOMAN, and £1289.99 from the UK site.

In the UK, it can also be bought with the 3kWh expansion battery for £1799, making it one of the cheapest ways to get 6kWh of mobile battery capacity available.

Amusingly, the VTOMAN website suggests, with a struck-through price of £2599, that this is an even bigger bargain than it already looks. However, in the UK and Europe, this isn’t something you should do unless you actually sold any at this price, as trade rules prohibit this sadly common practice.

In addition to the expansion bundle, VTOMAN also offers four other options that include folding solar panels. Another £110 gets you 200W panels; £200 doubles that to 400W, and there are also bundles that include those panels and the extra-capacity battery.

As I’ll talk about later, the connection to the solar inputs on this unit isn’t standard, so if you decide to use existing solar panels from another brand, you will incur the extra expense of a £30 conversion cable.

Comparing the VTOMAN FlashSpeed Pro 3600 to what other brands offer for the 3kWh power station market, the best-known alternatives are the Jackery Explorer 3000 v2 or 5000 Plus, AFERIY Portable Power Station 3600W 3840Wh, Anker SOLIX F3800, Goal Zero Yeti Pro 4000, Bluetti Apex 300, and the aforementioned EcoFlow DELTA Pro 3.

Of these, the cheapest is the Bluetti Apex 300, which is only $1498.99 in the USA and £1799 in the UK, but with only a 2764.8Wh LFP battery, it's slightly short on capacity unless you buy it with the 2764.8Wh expansion battery, which costs another £1099 or $1078.98.

The Jackery Explorer 3000 v2, as the name implies, is a revamp of the Explorer 3000 model, which has 3072Wh of capacity and costs £1,699 on Amazon.co.uk in the UK and only $ 1,499 on Amazon.com in the USA. My only concern about this product is the lack of expansion options.

In terms of features and capacity, an interesting option is undoubtedly the Anker SOLIX F3800 that sells for $1999.99 on Amazon.com but horrifically £3699 for UK customers directly from the maker’s website. The F3800 and F3800 Plus are great products, but they are more focused on home users, and their prices are excessive.

The EcoFlow DELTA Pro 3 is expensive at $2,399 or £2699 depending on where you are, although it does have some advantages in terms of management and expandability. The VTOMAN can only be expanded to 6kWh, whereas the EcoFlow can be extended to 12kWh with extra battery packs. Easily the most sophisticated product, but also one of the most expensive.

The only device that I think has an even better battery value than the VTOMAN product is the AFERIY Portable Power Station 3600W 3840Wh (AF-P310G1/AF-P310-EC-H). It is priced at only £1298.99 from Amazon.co.uk and $1,169 from Amazon.com, for a 3840Wh battery.

With the possible exception of the AFERIY, the VTOMAN is one of the cheapest ways to get 3kWh of battery capacity in an easily portable package.

• Value: 4 / 5

VTOMAN FlashSpeed Pro 3600: Specs

Product name

VTOMAN FlashSpeed Pro 3600

Battery capacity

3,096Wh

Battery type

LiFePO4

Dimensions

378 x 418 x 581mm (14.9 x 16.4 x 22.9 inches)

Weight

38kg (83.8lbs)

Operating temperature

-4°F to 131°F (-20°C to 55°C)

Cycle life

3,000+ cycles, quoted 10-year lifespan

US port selection

4× AC, 2× 100 W USB‑C, 2× DC, 4× USB‑A, 2× Cigarette port

Continuous AC output

4 x 230V/50Hz outlets, 3,600W total

Peak AC output

7,200W

AC input

2,200W

AC recharge time

0 to 100% in around 2 hours, per VTOMAN. To be timed independently on the review unit.

Solar input

Anderson port, 12-80V, up to 800W.

USB-A output

2 x 5V/2.4A, 12W max

USB-A QC3.0 output

2 x 18W max

USB-C PD output

2 x 100W max, output only

DC5521 output

2 x 12V/10A

Cigarette lighter port

2 x 12V/10A

Total output ports

14

UPS switchover

Under 20ms

Ingress protection

IP65

Expansion

Compatible with a FlashSpeed Pro 3600 extra battery, taking total capacity to 5,912Wh.

Warranty

2-year

Jump start

US: X7 jump starter (included in bundle here).

UK: Not supported. VTOMAN explicitly states this unit is not compatible with jumper cables, unlike some other models in its range.

VTOMAN FlashSpeed Pro 3600: Design

(Image credit: Mark Pickavance)

• Built for indoors and outdoors
• Has wheels and a handle
• Battery and microinverter in one

A short disclaimer before we go any further: I’m not an electrician, and therefore any information I provide about plugging things in should be considered as being my understanding, and not an irrefutable fact.

Looking not entirely unlike a piece of luggage, the VTOMAN FlashSpeed Pro 3600 is effectively 3096Wh of LiFePO4 in a convenient box with two wheels at the rear and a telescoping handle to make dragging it about relatively straightforward.

It needs wheels and a handle because the weight of this box is 38kg, and even with carry handles, one person might struggle to carry it any distance. Personally, if this was in the rear of my vehicle, I’d ask someone to help me take it out before wheeling it to where it is needed.

It’s evident that ergonomics was of the utmost importance to the designer, because there are two hidden compartments for carrying cables and the manual. One on top is ideal for the USB cables, and another at the back, between the handle rails, is perfect for the power cable.

Out of the box, the unit comes with a charging cable, a USB-A-to-USB-C cable, and a USB-C-to-USB-C cable. The disappointment here is that there is no cable for attaching solar panels, but we’ll get to that omission later.

The front-mounted LCD screen provides a readout of the battery capacity as a percentage and what services are active, and a light bar built into the case can switch between white and red lighting in various modes. The light is activated via a button along the top and cycles between two standard white light modes of different brightness, then a red light mode, and finally a red light where the flashing spells out SOS.

Beneath the display is a flip-up panel that covers the outputs, which are divided into USB, DC, and AC areas, and each can be activated or disabled with one button.

There are four USB-A outputs split into pairs of 12W and 18W capable ports, and two USB-C ports, each capable of 100W charging. The DC section has two 12V/10A cigarette lighter outputs and two DC5521 ports with the same specs.

And, on the UK model provided for this review, the AC section has four three-pin sockets for standard appliances that can handle 3600W sustained output, and 7200W peak for devices that demand more briefly.

But that’s not the end of the ports. There are two locations on the side protected by rubber covers. On the left are solar inputs (Anderson port, 12 to 80V, up to 800W), and the IDC connection for the mains cable.

On the right is an RV connection with its own on/off button and a port for connecting the expansion battery. That battery is meant to sit on top of the VTOMAN FlashSpeed Pro 3600, and the case is shaped accordingly to accept it.

The positive aspects of this design are that everything is relatively compact and straightforward, and with the handle and wheels, it should be easily movable by most adults. Using it requires that the user knows how to power the unit on, plug in what they need and press the button to power that function; that’s all.

(Image credit: Mark Pickavance)

There are, however, a few things that might have been done better. My first complaint is the length of the power cable, which seems remarkably short. In my kitchen, placing the battery on the floor next to a cabinet, the power cable barely reached the wall socket.

The temptation is to then use an extension, and given how much power this device can pull while charging, that might be a bad idea.

What’s clearly a strength of this design is the number of ports, but I do wonder about the choices made about some of these given the current market for power stations and solar products.

VTOMAN has decided that all its solar panels should use Anderson connectors to connect to this power station, even though every other panel maker, including VTOMAN, has standardised on the MC4 connection.

That means you need to spend another £30 getting conversion cables if you use panels that aren’t by VTOMAN. The conversion cable does come with VTOMAN panels, but all this might have been avoided if MC4 connectors had been used on the FlashSpeed Pro 3600.

My final issue is the cover that is used to protect the front-facing ports. It hinges at the top and, in normal use, can be placed vertically for easy access. Except when it's in this position, it entirely obscures the display, which is rather unhelpful.

I can understand why they hinged it at the top, so that rain wouldn’t hit any of the ports, should it shower. A better solution might have been to also hinge the display, so that you can tilt it for easier viewing at all times. Often, it's necessary to crouch to read the display, and having it angled at 45 degrees would make it easier to see while standing.

• Design: 4 / 5

VTOMAN FlashSpeed Pro 3600: Features

• Big fast-charging battery
• 3600W power on demand
• 2-year warranty

In terms of what this product offers at its core, this is enough LPR cells for 3096 Wh of capacity tied to a small DC inverter for solar and vehicle recharging, and the electronics to convert the internal 48V service into 220-230V outlets and the 5V USB sockets.

None of these parts is especially clever or innovative, since many Power Stations offer much the same thing.

The headline feature is undoubtedly speed. VTOMAN's CHARGECORE system is claimed to take the FlashSpeed Pro 3600 from flat to full in around two hours on a standard UK wall socket, which would be a genuinely useful figure for anyone who needs to top up quickly ahead of bad weather or a job that cannot wait.

But I found that this two-hour recharge number has almost certainly migrated from the US version of this hardware, where the power inlets are 110V.

On a UK plug, it can easily pull over 2000W, and I recharged the whole 3096Wh from zero in just 90 minutes.

Another area where this unit exceeded my expectations was the solar inputs, because typically power stations are limited to 50-60V DC and 500W/15A, while the ones on this unit go from 12V-80V and 800W in total.

As most 200W panels provide 20V output, the maximum number of panels I could reasonably connect to my EcoFlow Delta 2, for example, is two, since it’s limited to 60V DC and 500W. But depending on the panel, it might be possible to plug four 200W panels into the FlashSpeed Pro 3600 and charge at twice the speed.

Under optimal conditions, it might be possible to recharge the FlashSpeed Pro 3600 in under four hours with 800W of panels connected. But I’d make sure with a multimeter that you are not trying to inject more than 80V into the battery, or unfortunate things might occur.

Another part of the specification I like is the UPS (uninterruptible power supply) mode of this hardware. With a switchover time under 20 milliseconds, that's fast enough to keep a PC running, positioning it as a serious option for protecting networking gear or other sensitive electronics through a power cut, not just a portable battery for the odd device. There are caveats to doing this I’ll mention later, but compared with a rack-mounted 3096Wh UPS, the VTOMAN option is highly affordable.

One area where power stations tend to get criticised, and often unfairly, is that they won’t power everything. The idea that you have one of these devices, and in the event of an unexpected power loss, it will power your whole home or office is entirely unrealistic.

(Image credit: Mark Pickavance)

Many power stations struggle with boiling a UK kettle, but this one is made of sterner stuff.

VTOMAN's V-BEYOND output technology is pitched as improving compatibility with resistive loads such as kettles, ovens, and washing machines, which tend to be harder on cheaper inverters. These often pull high loads initially, as the elements reach operating temperature, and then the demand falls once they do.

To cope with these scenarios, the battery can deliver an impressive 7200W for short periods, although its nominal load is 3600W. In this respect, you could run an oven or a washing machine on this battery, but I’d probably avoid running two high-demand appliances at once.

The obvious concern with discharging cells this rapidly is how those components will stand up over time. The battery uses LiFePO4 cells with VTOMAN's LifeBMS protection system, and the company quotes over 3,000 charge cycles and a 10-year lifespan. That all sounds great until you realise that the warranty on this hardware is just two years, followed by another three years of after-sales service.

To put that in perspective, almost all EcoFlow Delta series batteries come with a 5-year warranty from the outset, and the brand's new Stream units come with a 10-year warranty. That’s not wonderful, although VTOMAN might be factoring in the unpleasant things that could happen to their equipment when it's being rolled through a build site or forest.

However, the warranty could be better, and after-sales service doesn’t cut it.

• Features: 4 / 5

VTOMAN FlashSpeed Pro 3600: User Experience

• Lacks any external control
• No Bluetooth, no Wi-Fi, nada

To clarify, this section is mostly about the user experience rather than an electronics analysis, since I’m not remotely qualified to do the latter.

From my experience with the VTOMAN FlashSpeed Pro 3600, it outputs the power that the makers claim, and the sorts of demanding appliances it should. And it charges up quickly.

I should also say that because this model is 220V, it would work with European appliances with basic adapters, though I’d be careful about trying to run an oven using a cheap travel adapter.

But what I most wish to talk about is the user experience, which wasn’t quite what I’d anticipated, mostly because I’ve got lots of EcoFlow hardware in my home.

When I first got this battery, I noticed that VTOMAN has Android and iPhone applications and assumed, wrongly, that these would be able to connect to its flagship Power Station product. It can’t, because, shockingly, VTOMAN didn’t put Bluetooth or WiFi in this device.

Let that thought sink in for a moment, because it sort of blew my mind for a while while thinking about this. Other VTOMAN Power Stations do have Bluetooth and WiFi, but not this one, bizarrely.

Therefore, other than crouching next to it, there is no way to find out how much battery is left, how many watts are currently being drawn, and, critically, when the power is likely to run out.

If it did have the connectivity, the existing app would provide some of these answers, I believe, but VTOMAN decided not to include it.

A consumer unit that needed replacing (Image credit: VTOMAN)

Using other products, naming no names, it's possible to connect them to the grid using a smart socket and control when they recharge and discharge using the UPS function. It is possible to control this battery using the same method, but there is no feedback data loop.

So you can’t build a script that, for example, when the power drops to 5%, reconnects the mains power to recharge using Home Assistant or something similar. That's frustrating.

My research indicates that even the VTOMAN products that support the mobile app don’t have an API for someone to build their own smart plugin for this hardware, which makes this product much less interesting to someone interested in smart home power management or plug-in solar.

I can rationalise that this hardware was designed probably two years ago, when these things weren’t significant requirements, but they are today.

If you hate technology and just want a battery and buttons to push, the FlashSpeed Pro 3600 is perfect for you. But if you want to know that your battery powering the fridge during a power failure is about to run out while you are away, then it probably isn’t the solution to pick.

(Image credit: Mark Pickavance)

• User Experience: 3 / 5

VTOMAN FlashSpeed Pro 3600: Final verdict

(Image credit: Mark Pickavance)

For those renovating a chateau or seeking a few days in a remote location with enough power to run lighting and charge devices, the VTOMAN FlashSpeed Pro 3600 is an excellent choice. But given where the likes of EcoFlow and other brands are going, this brand hasn’t built much on this platform in the last year to address some of the most obvious shortcomings and give it a chance to grab a slice of the plug-in solar pie.

There are lots of things to like about the VTOMAN FlashSpeed Pro 3600. Especially if you are looking for a large battery to take on a camping trip or onto a construction site to run wired power tools. There is plenty of capacity, and that amount can be doubled, and the 3600W of output is sufficient for some demanding uses.

The wheel and handle mechanism makes moving this 38kg lump relatively easy, if the ground is firm, and you can plug lots into it at the same time.

Where it becomes less compelling is in respect of the home user, because while this will work well as an uninterruptible power supply, it won’t send you an email to warn you when the battery is down to 10%.

As I mentioned, I had issues with the VTOMAN app that aren’t unique to me, and this whole aspect of the product needs a serious overhaul. The app needs to work for most people, and what it enables when it does needs to be more useful.

VTOMAN also needs to release an API so that the battery can work with smart plugs and other devices, because that’s where most of its competitors are heading or have already arrived.

Then the VTOMAN FlashSpeed Pro 3600 would become part of a broader power solution rather than an isolated island.

VTOMAN FlashSpeed Pro 3600: Report card

Value

Not cheap, but plenty of capacity for the money

4 / 5

Design

Easy to wheel and carry (for two), and lots of ports

3.5 / 5

Features

Fast charging, 3600W output, only 24 month warranty

4 / 5

User Experience

Easy to use. No app or API connection

3 / 5

Overall

Highly functional but not intergrated

4 / 5

Should I buy a VTOMAN FlashSpeed Pro 3600 V-Beyond?Buy it if...

You want a lot of capacity for the money
At 3,096Wh and £1,289.99, the FlashSpeed Pro 3600 undercuts rivals with similar or smaller batteries. If the pricing proves genuine, this is a strong capacity-to-cost ratio.

You need fast recharging and UPS backup
A claimed two-hour full charge and a sub-20 millisecond switchover time make this a reasonable option for storm prep or protecting sensitive equipment through outages, pending independent confirmation.

Don't buy it if...

You need a jump starter as well as a power station
VTOMAN is explicit that this model does not support jumper cables, unlike some others in its range.

You want a plug-in solar solution
Without the ability to integrate this into a wider system and send power back into the house, this unit has significant limitations if you want it to extend power use at home. There are other products that you should consider.

• A limited-edition Gears of War: E-Day Xbox Wireless Controller has been revealed
• The controller releases on September 30 and can be pre-ordered now for $89.99 / £84.99
• A separate 8BitDo charging dock is also up for pre-order

Xbox has unveiled its limited-edition Gears of War: E-Day Xbox Wireless Controller ahead of the game's launch on October 6.

"To celebrate the launch of Gears of War: E-Day, we’re giving fans two new ways to immerse themselves in one of gaming’s most iconic universes," reads the Xbox Wire announcement post. "Together, these offerings pay tribute to Emergence Day with hardware inspired by the symbols, scars, and battles that defined humanity’s war against the Locust Horde."

Starting today, fans can pre-order the Gears of War: E-Day Limited Edition Xbox Wireless Controller at participating retailers worldwide and the Xbox online store. The controller, which was "inspired by the horror and brutality unleashed on Emergence Day," will be released on September 30 and cost $89.99 / £84.99.

Where to buy the Gears of War: E-Day Limited Edition Xbox Wireless Controller

Gears of War: E-Day launches on October 6, but you can pre-order the limited edition Xbox Wireless Controller now at the Microsoft Store and at the participating retailers below.

Price check: $89.99 at Amazon | $89.99 at Best Buy | $84 at WalmartView Deal

If you're in the UK, you can also secure a pre-order of the Gears of War: E-Day Limited Edition Xbox Wireless Controller now at these stores.

Price check: £84.99 at Amazon | £139.99 at Very (includes a copy of Gears of War: E-Day)View Deal

Fans seem to love the design, with one on Reddit saying, "My wallet is not gonna be happy." Another on X said, "They look frigging awesome."

"Drawing from the E-holes that scar the world of Gears of War: E-Day, the controller features 3D molded, laser-etched details of cracked asphalt with red, glowing cracks created by the power of an erupting E-hole, exposing the iconic Crimson Omen beneath the surface," the description reads.

"Blacked-out ABXY buttons are punctuated by a transparent red X button, while matching red triggers and a transparent D-pad reflect the destruction left in the wake of Emergence Day. A dark silver metallic COG tag on the battery door signifies Never Fight Alone. Squad up. Textured grips round out a design built for fans ready to carry a piece of Sera into every battle."

Additionally, beginning September 30, fans can design their own E-Day controller with Xbox Design Lab, featuring exclusive artwork from heavy metal illustrator Luke Preece.

8BitDo is also releasing an Ultimate Charging Dock for Xbox Controllers – Gears of War: E-Day complimentary accessory, which is compatible with Xbox Series X, Series S and Xbox One Wireless controllers, and includes an 8BitDo rechargeable battery pack. The charging dock will cost $33.99 / £29.54.

The drills come amid rising tensions with China, which frequently sends military planes and ships towards Taiwan.

(Image credit: Chiang Ying-ying)