Today’s organizations rely on an extensive network of third-party vendors, partners, and service providers to enhance operations and fuel innovation. Whether leveraging cloud services, supply chain partners, or outsourced IT solutions, these external dependencies introduce complex cybersecurity risks.
The 2024 Change Healthcare cyberattack exemplified the devastating consequences of a third-party vulnerability, exposing the personal and medical information of nearly 190 million individuals—the largest healthcare data breach on record. This incident underscored how deeply vulnerabilities in a single third-party provider can ripple across entire industries, exponentially expanding attack surfaces and amplifying the consequences of a single security failure.
The escalating threat of third-party cyber risksOne year after the Change Healthcare cyberattack, third-party breaches continue to dominate headlines, with new incidents emerging almost monthly. In January, government IT contractor Conduent suffered a cyberattack due to a third-party system compromise on an operating system. The following month, Grubhub disclosed a data breach after detecting unusual network activity linked to a compromised third-party service provider. These incidents are not isolated; they reflect a growing trend where cybercriminals exploit a single point of entry to infiltrate one or more organizations' entire digital supply chain.
The repercussions of a third-party cyberattack extend far beyond immediate operational disruptions. They erode customer trust, trigger scrutiny from officials, and result in significant financial losses. The evolving threat landscape coupled with businesses expanding their reliance on external vendors increases the potential for third-party security failures, making it imperative for organizations to rethink their approach to vendor risk management. Third-party risk management (TPRM) is no longer a compliance exercise, it is a business-critical function requiring continuous oversight and modernization.
The shortcomings of traditional TPRM approachesHistorically, organizations have relied on manual assessments to evaluate third-party risks, often involving lengthy security questionnaires, periodic audits, and contractual agreements outlining cybersecurity expectations. While these measures establish a baseline for vendor security, they are largely static and offer little real-time insight into evolving threats. As cybercriminals become more sophisticated and exploit new vulnerabilities within days of being discovered, a point-in-time assessment is no longer sufficient.
The increasing volume of vendor relationships further complicates manual risk management. Security teams are often overwhelmed by the sheer number of third parties they must monitor, leading to inefficiencies, delays, and gaps in visibility. Traditional approaches rely on periodic assessments that provide only a snapshot, leaving organizations blind to threats that can emerge between evaluations.
Without continuous oversight, security gaps can go undetected until it’s too late. Addressing these shortcomings requires a shift from manual, reactive processes to automation-powered security operations, where real-time monitoring and AI-driven analytics provide the agility needed to stay ahead of evolving threats.
How AI and automation-driven security is transforming TPRMAI and automation should not replace human decision-making; but rather augment it, empowering security teams with the tools and information needed to make better, faster, and more informed choices. A well-implemented AI and automation-powered strategy reduces operational fatigue, optimizes resource allocation, and ensures organizations stay ahead of evolving cyber threats rather than constantly playing catch-up. By automating TPRM, organizations can shift from passive risk management to proactive threat prevention.
Unlike traditional risk assessments that provide a static view of a vendor’s security posture, automation and AI can continuously monitor third-party networks, applications, and behaviors to identify anomalies and provide real-time visibility of external threat environments. AI-based third-party risk detection can also help organizations progress beyond known, rule-based security risk detection to a more heuristic detection capability.
While the risk of AI hallucinations and associated false positives can still be an issue, this is an emerging field for detecting software and network vulnerabilities that should not be overlooked. This proactive approach helps organizations move away from reactive security models, allowing them to address risks before they become crises.
Automation further strengthens incident response. When a security event occurs within a third-party environment, automation platforms accelerate containment by instantly analyzing the breach, assessing its impact, and triggering efficient notification of the appropriate practitioners which can be used to engage response protocols quickly and accurately. This rapid intervention significantly reduces dwell time, limiting the potential damage caused by an attack.
An automation platform with robust case management capabilities and highly customizable playbooks provides a centralized location for storing valuable information about TPRM-associated tasks, detections, software in use in the organization, asset criticality, and more. This helps not only in the defense of an environment but also can be leveraged for compliance audit readiness or demonstrating to insurers and stakeholders what measures have been taken to manage third-party risk.
The time for action Is nowThird-party data breaches, such as the recent GrubHub cyberattack, act as a wake-up call for organizations to prioritize proactive security measures. Cybercriminals will continue targeting external providers as a backdoor into organizations, reinforcing the need for a proactive, AI-enhanced approach to TPRM.
By integrating AI and automation-driven security operations, organizations can achieve real-time monitoring, automated threat detection, and rapid incident response, detecting anomalies before they escalate into full-scale breaches. In an era where cyberattacks are inevitable, resilience is built on preparedness. The time for action is now before your organization becomes the next headline.
We've featured the best business VPN.
This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
A new NYT Connections puzzle appears at midnight each day for your time zone – which means that some people are always playing 'today's game' while others are playing 'yesterday's'. If you're looking for Wednesday's puzzle instead then click here: NYT Connections hints and answers for Wedneday, March 19 (game #647).
Good morning! Let's play Connections, the NYT's clever word game that challenges you to group answers in various categories. It can be tough, so read on if you need Connections hints.
What should you do once you've finished? Why, play some more word games of course. I've also got daily Strands hints and answers and Quordle hints and answers articles if you need help for those too, while Marc's Wordle today page covers the original viral word game.
SPOILER WARNING: Information about NYT Connections today is below, so don't read on if you don't want to know the answers.
NYT Connections today (game #648) - today's words (Image credit: New York Times)Today's NYT Connections words are…
What are some clues for today's NYT Connections groups?
Need more clues?
We're firmly in spoiler territory now, but read on if you want to know what the four theme answers are for today's NYT Connections puzzles…
NYT Connections today (game #648) - hint #2 - group answersWhat are the answers for today's NYT Connections groups?
Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.
NYT Connections today (game #648) - the answers (Image credit: New York Times)The answers to today's Connections, game #648, are…
I used up three Mistakes today by convincing myself that VOCAL belonged in KINDS OF CORDS, trying every combination and getting “one away” each time before giving up and dropping it.
All part of the fun of Connections and hopefully I wasn’t the only person who fell for this trap.
This little niggle out of the way, the rest of the groups fell together easily. I might have even have gotten THINGS IN BOTTLES if I hadn’t completed OUTSPOKEN ahead of it.
How did you do today? Let me know in the comments below.
Yesterday's NYT Connections answers (Wednesday, 19 March, game #647)NYT Connections is one of several increasingly popular word games made by the New York Times. It challenges you to find groups of four items that share something in common, and each group has a different difficulty level: green is easy, yellow a little harder, blue often quite tough and purple usually very difficult.
On the plus side, you don't technically need to solve the final one, as you'll be able to answer that one by a process of elimination. What's more, you can make up to four mistakes, which gives you a little bit of breathing room.
It's a little more involved than something like Wordle, however, and there are plenty of opportunities for the game to trip you up with tricks. For instance, watch out for homophones and other word games that could disguise the answers.
It's playable for free via the NYT Games site on desktop or mobile.
A new Quordle puzzle appears at midnight each day for your time zone – which means that some people are always playing 'today's game' while others are playing 'yesterday's'. If you're looking for Wednesday's puzzle instead then click here: Quordle hints and answers for Wednesday, March 19 (game #1150).
Quordle was one of the original Wordle alternatives and is still going strong now more than 1,100 games later. It offers a genuine challenge, though, so read on if you need some Quordle hints today – or scroll down further for the answers.
Enjoy playing word games? You can also check out my NYT Connections today and NYT Strands today pages for hints and answers for those puzzles, while Marc's Wordle today column covers the original viral word game.
SPOILER WARNING: Information about Quordle today is below, so don't read on if you don't want to know the answers.
Quordle today (game #1151) - hint #1 - Vowels How many different vowels are in Quordle today?• The number of different vowels in Quordle today is 4*.
* Note that by vowel we mean the five standard vowels (A, E, I, O, U), not Y (which is sometimes counted as a vowel too).
Quordle today (game #1151) - hint #2 - repeated letters Do any of today's Quordle answers contain repeated letters?• The number of Quordle answers containing a repeated letter today is 2.
Quordle today (game #1151) - hint #3 - uncommon letters Do the letters Q, Z, X or J appear in Quordle today?• No. None of Q, Z, X or J appear among today's Quordle answers.
Quordle today (game #1151) - hint #4 - starting letters (1) Do any of today's Quordle puzzles start with the same letter?• The number of today's Quordle answers starting with the same letter is 0.
If you just want to know the answers at this stage, simply scroll down. If you're not ready yet then here's one more clue to make things a lot easier:
Quordle today (game #1151) - hint #5 - starting letters (2) What letters do today's Quordle answers start with?• R
• S
• W
• N
Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.
Quordle today (game #1151) - the answers (Image credit: Merriam-Webster)The answers to today's Quordle, game #1151, are…
I was a WAFER away from a 7-guess finish in less than a minute today, gambling on GAMER instead.
Still, it was very pleasing to get home without any other issues, thanks to my 15-letter start revealing a handful of greens and yellows.
How did you do today? Let me know in the comments below.
Daily Sequence today (game #1151) - the answers (Image credit: Merriam-Webster)The answers to today's Quordle Daily Sequence, game #1151, are…
A new NYT Strands puzzle appears at midnight each day for your time zone – which means that some people are always playing 'today's game' while others are playing 'yesterday's'. If you're looking for Wednesday's puzzle instead then click here: NYT Strands hints and answers for Wednesday, March 19 (game #381).
Strands is the NYT's latest word game after the likes of Wordle, Spelling Bee and Connections – and it's great fun. It can be difficult, though, so read on for my Strands hints.
Want more word-based fun? Then check out my NYT Connections today and Quordle today pages for hints and answers for those games, and Marc's Wordle today page for the original viral word game.
SPOILER WARNING: Information about NYT Strands today is below, so don't read on if you don't want to know the answers.
NYT Strands today (game #382) - hint #1 - today's theme What is the theme of today's NYT Strands?• Today's NYT Strands theme is… Wetland patrol
NYT Strands today (game #382) - hint #2 - clue wordsPlay any of these words to unlock the in-game hints system.
• Spangram has 10 letters
NYT Strands today (game #382) - hint #4 - spangram position What are two sides of the board that today's spangram touches?First side: bottom, 3rd column
Last side: top, 3rd column
Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.
NYT Strands today (game #382) - the answers (Image credit: New York Times)The answers to today's Strands, game #382, are…
I’m sure I wasn’t the only one who tapped out wading birds a couple of times before WADING BIRD.
A tangent, and this is a very niche irritation, but I don’t like it when the Spangram ends in the middle of the puzzle. It feels wrong.
FLAMINGOs are amazing birds. Not only do they look brilliant, but they also do lots of strange things – like eat with their heads turned upside down, stand on one leg and only fly at night. The best thing, though, is that the collective noun for a group of flamingos is a flamboyance.
How did you do today? Let me know in the comments below.
Yesterday's NYT Strands answers (Wednesday, 19 March, game #381)Strands is the NYT's not-so-new-any-more word game, following Wordle and Connections. It's now a fully fledged member of the NYT's games stable that has been running for a year and which can be played on the NYT Games site on desktop or mobile.
I've got a full guide to how to play NYT Strands, complete with tips for solving it, so check that out if you're struggling to beat it each day.
With Genshin Impact Version 5.5, or 'Day of the Flame's Return', set to launch next week on March 26, developer Hoyoverse has shared some new details about what's included in the update.
Most significantly it introduces two new playable characters: Varesa and Iansan. Varesa is a 5 star Electro Catalyst user, with the ability to enter a Fiery Passion state to deal increased damage.
She's got quite a unique design, with cow-like horns and a tail. Outside of the battlefield, she has a very laid back personality and is almost never seen not nibbling on some kind of food.
Image 1 of 3The Version 5.5 key art. (Image credit: Hoyoverse)Image 2 of 3Veresa loves snacking. (Image credit: Hoyoverse)Image 3 of 3Iansan is a fitness obsessed fighter. (Image credit: Hoyoverse)Iansan is a 4 star Electro Polearm user and a fitness instructor with a variety of workout-themed attacks. She can smash enemies with makeshift dumbells while healing allies and enhancing their attacks.
The update will also expand the open-world, extending the Natlan map by allowing you to venture into the area surrounding the Great Volcano of Tollan. It contains a special hidden city, plus new mysteries to discover.
In the area, you will also encounter a new tribe - the Collective of Plenty. Devoted to fitness, they share an interesting culture founded in competitions to test their strength.
Occasionally, you'll be able to transform into the Tatankasaurus, a new Saurian from the Collective of Plenty that can smash from large Pulverite chunks and dash across water.
Of course, it wouldn't be a Genshin Impact update without a new event. This time it's the 'Tournament of Glory in Bloom' seasonal event which prominently features the new NPC character Ifa.
New optimizations are also being added, including a handy boss tracker and a revamped Artifact levelling experience.
Interested in diving in? Genshin Impact is available as a free-to-play title on mobile, PlayStation 4, PlayStation 5, Xbox Series X, Xbox Series S, and PC.
You might also like...Despite having no previous experience in malware coding, Cato CTRL threat intelligence researchers have warned they were able to jailbreak multiple LLMs, including ChatGPT-4o, DeepSeek-R1, DeepSeek-V3, and Microsoft Copilot, using a rather fantastical technique.
The team developed ‘Immersive World’ which uses “narrative engineering to bypass LLM security controls” by creating a “detailed fictional world” to normalize restricted operations and develop a “fully effective" Chrome infostealer. Chrome is the most popular browser in the world, with over 3 billion users, outlining the scale of the risk this attack poses.
Infostealer malware is on the rise, and is rapidly becoming one of the most dangerous tools in a cybercriminal's arsenal - and this attack shows that the barriers are significantly lowered for cybercriminals, who now need no prior experience in creating malicious code.
AI for attackersLLMs have ‘fundamentally altered the cybersecurity landscape”, the report claims, and research has shown that AI-powered cyber threats are becoming a much more serious concern for security teams and businesses by allowing criminals to craft more sophisticated attacks with less experience and at a higher frequency.
Chatbots have many guardrails and safety policies, but since AI models are designed to be as helpful and compliant to the user as possible, researchers have been able to jailbreak the models, including persuading AI Agents to write and send phishing attacks with relative ease.
“We believe the rise of the zero-knowledge threat actor poses high risk to organizations because the barrier to creating malware is now substantially lowered with GenAI tools,” said Vitaly Simonovich, threat intelligence researcher at Cato Networks.
“Infostealers play a significant role in credential theft by enabling threat actors to breach enterprises. Our new LLM jailbreak technique, which we’ve uncovered and called Immersive World, showcases the dangerous potential of creating an infostealer with ease.”
You might also likeMax has canceled The Sex Lives of College Girls after three seasons, but the hit comedy series might find a new home on another streaming service.
The Sex Lives of College Girls wrapped its most recent season in January, which saw beloved cast member Reneé Rapp (Mean Girls) depart the series after the first two episodes. By the third season, the characters were only midway through their sophomore year and its cliffhanger-free finale left fans wondering if this was the end for the show.
But despite the coming-of-age comedy making it onto Max's top 10 list of most-watched shows over the years, the streamer has decided not to renew the series. However, there is still hope for The Sex Lives of College Girls as Warner Bros. Television is reportedly looking for another streaming service to pick it up, sources familiar with the matter told The Hollywood Reporter.
'We are living in an era where we need comedy badly'Justin Noble, who co-created the series with Mindy Kaling, made an Instagram announcement (see below) regarding the cancelation. Although he was disappointed and surprised by Max's decision to ax The Sex Lives of College Girls, he wrote that there are “discussions with some new potential homes for the show".
He added that: "I can’t help but mention that it feels like there are fewer and fewer comedy series every month – and we are living in an era where we need that comedy badly. So I really hope that turns around, but I will always be proud of this show for being the things that we weren’t seeing enough of: a hard comedy ensemble where ladies get the jokes."
A post shared by Justin Noble (@thejustinnoble)
A photo posted by on
The Sex Lives of College Girls follows the lives of four 18-year-old college roommates as they navigate their sexually active lifestyle and the challenges of adulthood. The Guardian hailed it as a "modern-day Friends," but it unfortunately hasn't met the same success as some of the other best Max shows like Hacks or Barry.
This isn't the first time one of Kaling's projects has been canceled and moved to one of the best streaming services. Her sitcom The Mindy Project first aired on Fox in 2012, before being canceled after three seasons. The Mindy Project was then saved by Hulu and finished its six-season run.
If The Sex Lives of College Girls were to be re-homed on another streaming service, there's a potential it would attract a wider audience and be renewed for a fourth season. For now though, it remains as another canceled show on Max's scrap pile.
You might also likeMicrosoft is developing a feature in Windows 11 that provides some easy to understand information on the spec of your PC, and how powerful the hardware inside the device is.
Neowin noticed that a regular contributor to the Windows rumor scene on X, PhantomOfEarth, uncovered some new work on this capability which remains hidden under the bonnet of Windows 11.
New Frequently Asked Questions list in Settings > System > About, hidden in builds 26120.3576 and 22635.5090. Has some questions related to the Windows version and device specs. (vivetool /enable /id:55305888) pic.twitter.com/AkaP8XR3PRMarch 17, 2025
PhantomOfEarth found the new FAQ section in preview builds 26120.3576 and 22635.5090, and they enabled the functionality using a Windows configuration utility (ViVeTool).
You may recall that this feature was first discovered in the background of Windows 11 back at the start of 2025, when the same leaker aired images of some ‘cards’ in the Settings app, which are compact info panels that display the specs of the PC so they’re easy to see at a glance.
These panels (in System > About, within Settings) display core specs such as the CPU, graphics card, and amount of memory and storage. On top of that, as we noted at the time, Windows 10 users already had this feature live, in testing, and it came with a FAQ section tacked on.
Now that FAQ has arrived in Windows 11, as mentioned, and it provides a range of questions and answers on elements of the spec of the host PC.
The nifty bit is that the FAQ is tailored based on the PC that’s running Windows 11. So for example, if you haven’t got a discrete GPU, and you just use the integrated graphics provided by your processor, Microsoft will provide info on exactly what that means for your prospects of running certain software or games.
Or if you’ve got a low amount of system RAM, you’ll be given details on how that leaner allocation might affect the running of apps on your PC.
(Image credit: Shutterstock) Analysis: Shaping up nicely (albeit at a very early stage)It’s good to see this FAQ section arriving in Windows 11, although it was expected to do so, given that it was present in Windows 10 (testing) already. (However, I’m not quite sure why Microsoft is developing this for Windows 10 at all, given that the OS is shuffling off its coil before too long, something Microsoft is now regularly reminding us about in, erm, creative ways, shall we say).
We still must remember that at least for Windows 11, this is a hidden feature and not yet enabled in testing, so there’s no guarantee it’ll ever arrive in the finished version of the operating system (the same’s true for Windows 10, for that matter).
I think it’s quite likely that it will be pushed through to Windows 11, though, given that this will be a helpful feature for computing novices who aren’t sure about the capabilities of their PC. The tailored nature of the new FAQ is particularly useful, so the info provided is guaranteed to be relevant to the user.
Still, the answers to the questions posed do remain a little generic, but I can see them being fleshed out by AI in the future. This could be a good use of Copilot in getting the assistant to be of more use to the less tech-savvy out there.
As I’ve discussed in the past, this new approach looks far superior to the Windows Experience Index, which computing veterans may recall from back in the day. The WEI, as it was known, was introduced with Windows Vista, and rated your PC’s performance in a bunch of categories – but it was convoluted and confusing, rather than helpful.
It looks like Microsoft is going to do much better with this fresh take on the concept, but the proof, as ever, will be in tasting the pudding – and this feature is still very much at the mixing ingredients stage right now.
You may also like...Wouldn't it be great if you could have all the benefits of headphones without having to bother with the headphones? That's what a new technology creating "audible enclaves" could one day deliver.
The technology comes from professor of acoustics Yun Jing at Pennsylvania State University, whose team has found a way to project sound so that only the intended listener can hear it. It's currently short range – about 1m – and relatively quiet at 60dB, but both range and volume should be improved by using higher power transmitters.
(Image credit: Heyonu Heo) How do audio enclaves work?Audio enclaves are made using ultrasound waves, which are higher frequency than the sound waves we can hear. Two waves are passed through acoustic lenses that bend them, creating a curved path for the waves to follow. Those paths converge at the destination – that's you.
The clever bit here is that each individual wave is inaudible on its own, so nobody hears anything unless they're at the sweet spot where the two waves are in the right place for the listener's ears – then they form something your brain can actually make out.
The hope is that the technology could be used to deliver private audio in public places, such as in classrooms or at outdoor venues, and possibly inside vehicles too.
This isn't the first time we've been promised personalized directional audio. In 2016, Turtle Beach announced their Hypersound speakers which used transparent glass to create "highly directional audio". The promotional video is below.
Turtle Beach announced a partnership with Chinese audio firm Audfly in 2021, and the resulting Focusound speakers demonstrate one of the downsides of the tech: where normal speakers start at a double-digit low frequency (ie, down to 20Hz), these directional speakers have a much higher starting point: 500Hz to 600Hz. That makes them good for speech but not great for music.
This tech isn't likely to remove all need for the best wireless headphones, and may not work on something like an airplane, where the ambient noise is so loud that you'll still need some of the best noise cancelling headphones – but imagine if you could switch your TV to sending sound that only you can hear with a push of a button once the family goes to be, or imagine hearing interesting commentary about a museum exhibit simply by standing in the right place. No headset needed – I like the sound of that (if I'm in the sweet spot).
You might also likeWhile we await AMD's addition to its Strix Point Ryzen AI 300 series processors - like the Ryzen Z2 Extreme for handheld gaming PCs - Team Red is already planning its next generation of mobile APUs, codenamed ‘Medusa Point’. Unfortunately, there’s been some disappointing news.
According to Kepler_L2 (who covers tech rumors and leaks) on X, AMD's upcoming Zen 6 APUs (notably the Medusa Point lineup) won't use RDNA 4 architecture - based on unearthed code in AMD’s GPUOpen Drivers - and instead, will likely use RDNA 3.5. This discovery was made via RDNA 4's device ID 'Gfxlp12', which is for discrete GPUs only according to one line of the code.
Essentially, this means that next-gen features like FSR 4 potentially won't be available on any devices that use next-gen Zen 6 APUs - which will be a huge disappointment for many expecting the new upscaling tech to come to handhelds or laptops. We don't yet know what APUs are included in the Medusa Point lineup or whether any of its processors will star in future handheld gaming PCs, but given the pace of development in the handheld market right now, it would be a surprise if they didn’t.
While no FSR 4 isn't exactly a dealbreaker, it's been shown to provide exceptional image quality enhancements - specifically within its performance mode, in some sequences even outdoing Nvidia's DLSS 3 CNN model - and it would help replace FSR 3's existing performance mode, which significantly sacrifices image quality for better performance.
(Image credit: Lenovo) This leaves me worried about the state of potential Medusa Point APU-powered handheld gaming PCs…I must clarify again that we still know very little about Medusa Point APUs, particularly whether they’ll be used for handheld gaming PCs. But assuming that they will (which I'm almost certainly sure of), no FSR 4 is a disappointment, to say the least.
I'm aware that AMD isn't ruling out the chance of FSR 4 coming to RDNA 3: Nvidia's Frame Generation tech could only now be making its way to RTX 3000 series GPUs, similar to FSR 4’s potential backport. However, I'm convinced that even if it does, it won't be the full package, with the new frame-gen model potentially missing.
The good news is that the upcoming Medusa Point processors may yield fantastic performance results in games regardless - we've seen AMD’s chief rival Intel achieve this recently, with the MSI Claw 8 AI+ using Intel's Core Ultra 7 258V processor to provide a huge jump over the original Intel-powered Claw, but there are still games that definitely require upscaling.
Hopefully, FSR 4 exclusivity on RDNA 4 GPUs can end soon (as this would even help current handhelds like the Asus ROG Ally), but I doubt it. Let's pray that I'm wrong.
You may also like...A Windows zero-day vulnerability which has remained unpatched for eight years has been exploited by 11 nation-state attackers, and countless financially motivated groups, experts have warned.
Trend Micro’s Zero Day Initiative (ZDI) criticized Microsoft for downplaying the importance of the findings into the vulnerability, tracked as ZDI-CAN-25373, which is a flaw in Windows that allows attackers to craft malicious shortcut (.lnk) files, enabling the execution of hidden commands when a user interacts with these files.
This exploit can be abused by embedding harmful code within the .lnk file, which the victim then unknowingly runs when opening the shortcut. The vulnerability was used in data theft attacks, espionage, and malware distribution.
"Very detailed information"The researchers said the bug has been in use since 2017, and that they found some 1,000 weaponized .LNK files recently. The total number, obviously, is much bigger.
After sifting through the files, ZDI said the majority came from nation-state actors (70%), and were used in espionage or data theft. Of that number, almost half (46%) were built by North Korean actors, followed by Russia, Iran, and China, with roughly 18% each. The rest fell to financially motivated groups.
That being said, most victims are government agencies, followed by firms in the private sector, financial organizations, think tanks, and telecommunications firms.
The researchers also slammed Microsoft for allegedly downplaying the issue: "We told Microsoft but they consider it a UI issue, not a security issue. So it doesn't meet their bar for servicing as a security update, but it might be fixed in a later OS version, or something along those lines,” Dustin Childs, head of threat awareness at the Zero Day Initiative, told The Register.
"We consider that a security thing. Again, not a critical security thing, but certainly worth addressing through a security update," Childs opined.
Microsoft seems to agree, at least about the “not critical” part. A spokesperson told The Register: "While the UI experience described in the report does not meet the bar for immediate servicing under our severity classification guidelines, we will consider addressing it in a future feature release."
You might also likeThe Google Pixel 9a is official and brings with it a mix of neat upgrades to keep the budget phone firing on all cylinders.
Starting at $499 / £499 (we're still waiting on Australian pricing), the Pixel 9a isn't as affordable as Pixel a-series models of the past but tracks with the Pixel 8a, and notably undercuts the iPhone 16e.
Like the Pixel a-series releases in recent years, at a quick glance you’ll not see a huge amount of difference in the Pixel 9a over the full-fat Google Pixel 9 or the outgoing Pixel 8a. But digging deeper there are a suite of changes here that could make it a new contender for our best cheap phones list.
(Image credit: Google)For starters, the Pixel 9as comes with a new design. The rear-spanning camera bar of the Pixel 8 and the pill-shaped module of the Pixel 9 and Pixel 9 Pro models has been ditched for a smaller, narrower module, which to my eyes has made the 9a seem more compact.
Helping with that are new sides that are less rounded than those of the Pixel 8a but still curve at the top, which should make the Pixel 9a feel a little more comfortable to grip for longer prions. The dust and water resistance has also got a boost and now has a rating of IP68. Just don’t expect a glass back, as Google has stuck with a plastic composite, which is pretty much a signature of the Pixel a-series.
You do get a nice choice of colours for the Pixel 9a, comprising a lavender-esque ‘Iris’, a bright pink ‘Peony’, the standard ‘Porcelain’ white, and the ever-present ‘Obsidian’ black.
(Image credit: Google)One neat but not immediately obvious upgrade is the new “Actua Display”, which comes in at a larger 6.3 inches and can now hit a peak brightness of 2,700 nits; that’s a decent jump from the Pixel 8a’s 2,000-nit peak brightness.
A variable refresh rate of 60Hz to 120Hz remains present, but Google noted the new display is more scratch-resistant than that of the Pixel 8a, which should help make the 9a more durable than the older phone.
@techradar ♬ original sound - TechRadar New Tensor chip, a fresh camera, and a lot of AI (Image credit: Google)At the heart of the Pixel 9a you’ll find Google’s latest Tensor G4 chip, which gets paired with 8GB of RAM. Don’t expect screaming fast raw performance to take on the latest Snapdragon or Apple A-series chips, but do expect capable performance such as the kind we’ve seen in the main Pixel 9 models, and responsive AI features.
The smart processing chops of the chip should also help get the most out of the new 48-megapixel main camera on the Pixel 9a. What may seem like a downgrade in sheer resolution on the Pixel 8a’s 64MP main camera, doesn't look set to be the case, as the new camera has a wider aperture that should deliver brighter photos, especially in low-light citations.
A 13MP ultra-wide camera remains, but it now has a Macro Focus mode, a first for the Pixel a-series, and should help deliver crisp up-close photos.
Around the frost you’ll find a 13MP f/2.2 camera, which is business as usual for this Pixel, though the larger display should help make snapping a selfie easier than ever.
The big upgrade for the cameras will likely come from improvements in the sensor and the processing on the Tensor G4 chip.
But the real photography chops will come in the form of the AI features, with the Pixel 9a getting the host of tools that its predecessor came with, but also those introduced with the Pixel 9 phone last year, such as Add Me that lets users combine two shots into one, along with upgrades to tools like Magic Editor and native access to the Pixel Studio that lets you create images with text prompts.
Google Pixel 9a specsOther AI features include Google Gemini being at the heart of the Pixel 9a, including Gemini Live that allows you to have natural conversation with the generative AI-powered virtual assistant.
There’s also Theft Detection that uses AI to identify potential theft attempts and lockdown the phone if needed, and Crash Detection that also uses AI to detect when you might have had a crash and alert the emergency services.
Rounding all this out is a larger battery, coming in at 5,100mAh, which is a solid jump from the 4,492mAh on the Pixel 8a, plus seven years of software support.
Could this be the best Pixel phone for everyone? (Image credit: Google)Now I and the phones team need a closer look at the Google Pixel 9a before we draw any conclusions. And I’d advise you to wait for our full review before buying the phone when it’s released in April.
But Google rarely misses with the Pixel a-series, and the 9a looks to bring a decent mix of upgrades to make it a compelling phone at a palatable price. If that 48MP camera delivers the photography goods, then the suite of AI features, neat design and new display should all be icing on the cake.
Take all this into account and then contrast it to the more-expensive, less well-equipped iPhone 16e and I’d argue Google has somewhat embarrassed Apple on the affordable phones front. The Pixel 9a offers a lot more for a chunk of change less.
I think we could be looking at a new budget phone champion here, when all things are considered, and perhaps an Android phone that I’ll recommend for most people. Stay tuned to TechRadar for more, and let me know your thoughts in the comments below.
You might also likeAdobe has announced major updates to its Firefly generative AI services to support even more media types, including video and 3D.
Revealing the new offerings at its Adobe Summit 2025 event, the company introduced a new Firefly Creative Production tool with a no-code interface for creating new variants of existing assets and making repetitive multimedia production tasks even quicker.
Adobe said that marketers might want to change the language or aspect ratio of a video to cater to different markets and services, but editing video has previously been a mission that takes hours, days or even weeks.
Adobe Firefly just revolutionized video editingThe update consists of a series of new APIs, but the most game-changing is the translate and lip sync API which will translate spoken dialogue into other languages while maintaining voice authenticity and also matching lip movements.
The reframe API also promises handy productivity boosts for designers and editors – it will automatically resize videos while identifying scenes to accurately keep subjects central. A handy tool for converting a landscape video to mobile-friendly portrait productions.
Already, early adopters have reported a 70-80% increase in asset variant production efficiency and a 75% reduction in asset revision time. Estée Lauder has been using Firefly’s updates to shorten the time it takes to deliver digital marketing campaigns across its 25 brands in 150 countries.
Adobe GenStudio and Firefly Enterprise Solutions GM Varun Parmar summarized: “Generative AI increases the capacity of marketers and creatives, enabling them to focus on what matters most, their craft.”
Moreover, Firefly also works with Custom Models via Adobe GenStudio for Performance Marketing for businesses to create new assets that adhere to brand guidelines.
The translate and lip sync, reframe and Custom Models APIs are all generally available now.
Discover the power of generative AI with Adobe Firefly
See what's new in Firefly and how it can help power individuals and teams to quickly and creatively design on-brand content customized for your business. Try out Firefly's new tools by clicking here.
You might also likeIn a bid to keep up with emerging tech and boost customer acquisition and retention, website builder giant Wix has unveiled its new no-code interface, Wix Functions.
Businesses can use the no-code tool to create custom business flows and elements like dynamic pricing rules, checkout conditions and tailored loyalty rewards without needing any coding expertise.
Besides creating their own flows from scratch, users can also pick from a library of templates to help them get up and running.
Wix FunctionsIn an announcement, the company described how businesses may want to impose location-based fees for some customers and trigger discounts for returning buyers, which they can now do through Wix Functions with ease. “
The function then outputs the desired action, which the Wix app executes in real-time,” the announcement explains.
“Wix Functions gives businesses even more control over their operations, enabling them to customize more workflows, further automate processes and implement advanced business rules," said Tomas Petras Rupšys, Head of Wix Functions.
“The function’s output directly influences how the Wix app behaves in real-time, ensuring that businesses can seamlessly adapt their operations to meet unique needs, further empowering business owners to operate more efficiently and scale with ease,” Rupšys added.
To get the most out of Wix Functions, Wix suggests customers use it in conjunction with Wix Automations, a feature that was launched earlier this month and described as a tool to “support advanced business workflows” with a fully customizable automation engine.
Wix and Wix Studio for Wix Stores, Wix Bookings, Wix Restaurants, Wix Donations, Wix Forms and Wix Loyalty Program will all work with Functions, which is available for free, just like Wix Automations.
Also like Automations, the company is also charging for optional premium upgrades, unlocking unlimited actions and access to business solutions like checkout and payments.
You might also like